From ad51e09fd1301484820a466a49447a34d7504882 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Sat, 8 Oct 2016 13:53:14 +0200
Subject: [PATCH] mac80211: update to wireless-testing 2016-10-08

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 package/kernel/mac80211/Makefile              |   4 +-
 .../004-fix_duplicate_skcipher_backport.patch |   2 +-
 ...c-register-field-manipulation-macros.patch | 145 ----
 .../patches/060-no_local_ssb_bcma.patch       |   2 +-
 .../100-remove-cryptoapi-dependencies.patch   |  90 ++-
 .../110-mac80211_keep_keys_on_stop_ap.patch   |   2 +-
 .../130-mac80211-hwsim-hrtimer-clock.patch    |   2 +-
 .../patches/150-disable_addr_notifier.patch   |   6 +-
 .../kernel/mac80211/patches/210-ap_scan.patch |   2 +-
 ...sing-mac80211-intermediate-software.patch} |  96 +--
 ...9k-force-rx_clear-when-disabling-rx.patch} |   0
 ...tries-for-powersave-response-frames.patch} |  47 +-
 ...rpret-requested-txpower-in-EIRP-dom.patch} |   4 +-
 ...rx-compl-task-is-stopped-when-cleani.patch |  21 -
 ...e-peer_map-references-are-cleaned-up.patch |  60 --
 ...211-add-hdrlen-to-ieee80211_tx_data.patch} |  28 +-
 ...10k-Clean-up-peer-when-sta-goes-away.patch |  32 -
 ...0211-add-NEED_ALIGNED4_SKBS-hw-flag.patch} |  53 +-
 ...-Enable-STBC-and-LDPC-for-VHT-Rates.patch} |   2 +-
 ...ta-bit-in-PS-buffered-frame-release.patch} |   7 +-
 ...ng-NULL-Qos-NULL-data-frames-for-QCA.patch |  72 --
 ...tially-stale-EOSP-status-bit-in-int.patch} |   0
 ... 309-ath9k-report-tx-status-on-EOSP.patch} |   0
 ...to-in-ieee80211_data_to_8023-for-fra.patch |  37 -
 ...ix-block-ack-window-tracking-issues.patch} |   6 +-
 .../311-ath10k-Add-support-for-160Mhz.patch   | 285 ++++++++
 ...able-wake_tx_queue-for-older-devices.patch |  73 --
 ...F-adjustment-to-align-the-beacon-tim.patch |  45 --
 ...1-Use-rhltable-instead-of-rhashtable.patch | 275 ++++++++
 ...annel-context-in-get_-set_-reset_tsf.patch |  70 --
 ...equence-number-allocation-regression.patch |  37 +
 ...-tsf-offset-helper-in-ath9k_hw_reset.patch |  65 --
 ...-reset-AHB-WMAC-interface-on-AR91xx.patch} |   2 +-
 ..._adjustment-in-mac80211-tsf-getters-.patch |  32 -
 ...hw-issue-external-reset-for-QCA955x.patch} |   6 +-
 ...e-defined-constants-to-decrease-verb.patch | 137 ----
 ...ctral-scan-enable-bit-on-trigger-for.patch |  21 +
 ...implement-temperature-compensation-s.patch | 101 +++
 ...-configuration-for-addition-removal-.patch | 544 ---------------
 ...y-simplify-building-interface-combin.patch | 108 ---
 ...-up-mismerge-of-ieee80211_tx_dequeue.patch |  35 +
 ...kup-when-removing-P2P-interface-afte.patch | 154 -----
 ...st-char-for-interface-name-in-brcmf_.patch |  40 --
 ...ude-also-core.h-header-in-cfg80211.h.patch |  33 -
 ...ssing-break-when-deleting-P2P_DEVICE.patch |  27 -
 ...interface-directly-in-code-that-sent.patch |  75 --
 ...-removing-AP-interfaces-with-interfa.patch |  84 ---
 ...espect-hidden_ssid-for-AP-interfaces.patch |  46 --
 ...-stopping-netdev-queue-when-bus-clog.patch |  56 --
 ...ac-defer-DPC-processing-during-probe.patch |  42 --
 ...b_skb-leak-in-brcmf_sdiod_recv_chain.patch |  32 -
 ...adcom-brcm80211-brcmfmac-usb-don-t-p.patch |  34 -
 ...tnl_lock-is-locked-when-removing-int.patch | 111 ---
 ...ac-Change-vif_event_lock-to-spinlock.patch | 175 -----
 ...fmac-add-missing-header-dependencies.patch |  29 -
 ...-Add-USB-ID-for-Cisco-Linksys-AE1200.patch |  51 --
 ...-0016-brcmfmac-fix-pmksa-bssid-usage.patch |  51 --
 ...otential-stack-overflow-in-brcmf_cfg.patch |  34 -
 ...port-for-bcm4339-chip-with-modalias-.patch |  55 --
 ...orten-retry-loop-in-brcmf_sdio_kso_c.patch |  56 --
 ...fmac-ignore-11d-configuration-errors.patch |  84 ---
 ...pointer-trickery-in-brcmf_proto_bcdc.patch |  32 -
 ...ory-leak-in-brcmf_flowring_add_tdls_.patch |  39 --
 ...ialize-variable-in-brcmf_sdiod_regrl.patch |  28 -
 ...worker-from-.ndo_set_mac_address-cal.patch | 107 ---
 ...emove-unnecessary-null-pointer-check.patch |  31 -
 ...fmac-fix-clearing-entry-IPv6-address.patch |  37 -
 ...-of-bound-access-on-clearing-wowl-wa.patch |  44 --
 ...cmfmac-simplify-mapping-of-auth-type.patch |  39 --
 ...-memory-leak-in-brcmf_fill_bss_param.patch |  41 --
 ...-unused-fields-from-struct-brcmf_pub.patch |  60 --
 ...-WARNING-on-timeout-with-a-simple-er.patch |  38 --
 ...rect-skb-freeing-helper-when-deletin.patch |  58 --
 ...-sta-drv_priv-before-initializing-it.patch |  33 -
 ...rogramming-of-minCCA-power-threshold.patch |  26 -
 ...ix-spectral-scan-on-AR9285-and-newer.patch |  86 ---
 ...licate-and-partially-wrong-definitio.patch |  57 --
 ...w-simplify-ar9003_hw_per_calibration.patch |  88 ---
 ...-of-some-duplicate-code-in-calibrati.patch |  94 ---
 ...ck-for-buffered-powersave-frames-wit.patch |  21 -
 ...tatus-reporting-for-A-MSDU-subframes.patch |  36 -
 ...-MPSP-even-if-EOSP-frame-was-not-rec.patch |  42 --
 .../332-ath10k-implement-NAPI-support.patch   | 642 ------------------
 ...fix-client-mode-beacon-configuration.patch |  69 --
 ...ix-purging-multicast-PS-buffer-queue.patch |  54 --
 ...80211_tx_status_noskb-where-possible.patch | 305 ---------
 ...9k-improve-powersave-filter-handling.patch |  70 --
 ...-tim-recalculation-after-PS-response.patch |  31 -
 ...lBA-on-unexpected-BlockAck-data-fram.patch |  64 --
 ...delBA-on-unexpected-BlockAck-Request.patch |  26 -
 ...order-sensitive-TX-handlers-to-after.patch | 478 -------------
 .../patches/406-ath_relax_default_regd.patch  |  12 +-
 .../410-ath9k_allow_adhoc_and_ap.patch        |   2 +-
 .../mac80211/patches/501-ath9k_ahb_init.patch |   2 +-
 .../patches/513-ath9k_add_pci_ids.patch       |   4 +-
 .../522-mac80211_configure_antenna_gain.patch |  32 +-
 .../patches/530-ath9k_extra_leds.patch        |  13 +-
 .../531-ath9k_extra_platform_leds.patch       |   2 +-
 ..._get_led_polarity_from_platform_data.patch |  20 -
 .../patches/542-ath9k_debugfs_diag.patch      |   4 +-
 .../patches/543-ath9k_entropy_from_adc.patch  |  14 +-
 ...544-ath9k-ar933x-usb-hang-workaround.patch |   8 +-
 .../patches/545-ath9k_ani_ws_detect.patch     |   2 +-
 ...-definitions-for-REG_USB_SPECIAL_OPT.patch |  27 -
 ...ry-leak-in-handling-rxdesc16-packet.patch} |   0
 ...itional-documentation-for-RX-DMA-reg.patch |  39 --
 ...ig-endian-problem-reporting-mactime.patch} |   0
 ...003-rtl8xxxu-tuse-ph-to-dump-buffers.patch |  71 --
 ...u-Fix-rtl8723bu-driver-reload-issue.patch} |   0
 ...rtl8xxxu-remove-unneeded-assignments.patch |  30 -
 ...u-Fix-rtl8192eu-driver-reload-issue.patch} |   0
 ...console-noise-when-removing-the-kern.patch |  26 -
 ...xxxu-Obtain-RTS-rates-from-mac80211.patch} |   0
 ...-ieee80211_rx_status-values-in-parse.patch |  84 ---
 ...b-delivery-into-parse_tx_desc-handle.patch | 165 -----
 ...info-to-fill_txdesc-in-order-to-hav.patch} |   0
 ...ieee80211_rx_status-within-parse_rx_.patch |  84 ---
 ...rtl8xxxu-Correct-rxdesc16-definition.patch |  37 -
 ...port-for-aggregated-RX-packets-on-ge.patch | 141 ----
 ...e-larger-RX-skbs-when-aggregation-is.patch |  66 --
 ...RX-skb-size-to-include-space-for-phy.patch |  33 -
 ...xxu-Enable-aggregation-for-rtl8723au.patch |  90 ---
 ...aggregation-for-rtl8192cu-rtl8188cu-.patch |  33 -
 ...A-aggregation-optional-by-setting-a-.patch |  55 --
 ...t-aggregation-timeout-REG_RXDMA_AGG_.patch |  43 --
 ...d-module-parameters-to-adjust-DMA-ag.patch |  74 --
 ...xu-Accept-firmware-signature-0x88e0.patch} |   0
 ...tl8xxxu-Mark-0x20f4-0x648b-as-tested.patch |  46 --
 ...itial-code-to-detect-8188eu-devices.patch} |   0
 ...tl8xxxu-Mark-0x2001-0x3308-as-tested.patch |  46 --
 ...-initial-code-to-parse-8188eu-efuse.patch} |   0
 ...or-handling-if-rtl8xxxu_init_device-.patch |  67 --
 ...Link-TL-WN823N-v2-to-list-of-support.patch |  39 --
 ...8xxxu-Detect-8188eu-parts-correctly.patch} |   0
 ...l8xxxu-Add-TX-page-defines-for-8723b.patch |  48 --
 ...xxu-First-stab-at-rtl8188e_power_on.patch} |   0
 ...l8xxxu-Add-rtl8188e_disabled_to_emu.patch} |   0
 ...8723a-to-use-new-rtl8xxxu_init_queue.patch |  27 -
 ...007-rtl8xxxu-8188e-Enable-scheduler.patch} |   0
 ...8192cu-8188cu-devices-to-use-rtl8xxx.patch |  27 -
 ...188e_usb_quirk-for-enabling-MAC-TX-.patch} |   0
 ...now-obsolete-rtl8xxxu_old_init_queue.patch |  61 --
 ...188e-add-REG_TXDMA_OFFSET_CHK-quirk.patch} |   0
 ...lify-code-setting-TX-buffer-boundary.patch |  31 -
 ...it-definitions-for-REG_FPGA0_TX_INFO.patch |  26 -
 ...rved-page-init-parameters-for-8188e.patch} |   0
 ...errupt-bit-definitions-for-gen2-part.patch |  83 ---
 ...orrect-TX_TOTAL_PAGE_NUM-for-8188eu.patch} |   0
 ...l8xxxu-Add-trxff_boundary-for-8188e.patch} |   0
 ...g-to-indicate-whether-device-has-TX-.patch |  53 --
 ...pecify-firmware-block-size-and-set-.patch} |   0
 ...-flags-in-rtl8xxxu_fileops-to-bitfla.patch |  26 -
 ...4-rtl8xxxu-Add-8188e-mac-init-table.patch} |   0
 ...ce-fops-bitflag-indicating-type-of-t.patch |  59 --
 ...xxu-Implement-rtl8188eu_init_phy_bb.patch} |   0
 ...y-calculating-of-hw-value-used-for-s.patch |  46 --
 ...ne-the-need-for-SGI-before-handling-.patch |  53 --
 ...xxu-Implement-rtl8188eu_init_phy_rf.patch} |   0
 ...ne-need-for-shore-preamble-before-up.patch |  57 --
 ...tl8xxxu-Use-auto-LLT-init-for-8188e.patch} |   0
 ...not-set-REG_FPGA0_TX_INFO-on-8188eu.patch} |   0
 ...illing-of-TX-descriptors-into-separa.patch | 315 ---------
 ...ess-with-REG_FPGA0_XA_RF_INT_OE-eit.patch} |   0
 ...u-gen1-Fix-non-static-symbol-warning.patch |  28 -
 ...ke-rtl8xxxu_ampdu_action-less-chatty.patch |  54 --
 ...u-Set-transfer-page-size-for-8188eu.patch} |   0
 ...xu-Enable-TX-report-timer-on-8188eu.patch} |   0
 ...tl8xxxu-Setup-interrupts-for-8188eu.patch} |   0
 ...sc16-and-32-byte-tx-descriptors-for.patch} |   0
 ...se-same-ADDA-on-parameters-as-8723a.patch} |   0
 ...-PHY-IQ-calibration-code-for-8188eu.patch} |   0
 ...-8188eu-uses-the-gen2-thermal-meter.patch} |   0
 ...u-Set-REG_USB_HRPWM-to-0-for-8188eu.patch} |   0
 ...-Implement-rtl8188eu_config_channel.patch} |   0
 ...xu-Use-gen2-H2C-commands-for-8188eu.patch} |   0
 ...Initialize-GPIO-settings-for-8188eu.patch} |   0
 ...-Add-simple-rtl8188eu_rf_on-routine.patch} |   0
 ...8xxxu-Implement-rtl8188e_disable_rf.patch} |   0
 ...188e-efuse-definition-for-power-val.patch} |   0
 ...xxu-Implement-rtl8188e_set_tx_power.patch} |   0
 ...t-rtl8xxxu_fill_txdesc_v3-for-8188e.patch} |   0
 ...-8188eu-registers-and-update-CCK0_A.patch} |   0
 ...register-description-for-REG_FPGA1_.patch} |   0
 ...u-properly-detect-RTL8188EU-devices.patch} |   0
 ...t-8188eu-specific-8051-reset-functi.patch} |   0
 ...le-packet-DMA-aggregation-on-8188eu.patch} |   0
 ...et-REG_OFDM0_XA_AGC_CORE1-to-match-.patch} |   0
 ...8xxxu-Fix-rtl8188eu-connection-fail.patch} |   0
 ...ot-set-auto-rate-fallback-on-8188eu.patch} |   0
 ...-0044-rtl8xxxu-Enable-8188eu-driver.patch} |   0
 ...u-Add-rtl8188etv-to-USB-device-list.patch} |   0
 ...d-sitecom-dongle-to-USB-device-list.patch} |   0
 ...u-Implement-rtl8188eu_active_to_emu.patch} |   0
 ...8xxxu-Implement-rtl8188eu_power_off.patch} |   0
 ...188eu-USB-ID-for-D-Link-USB-GO-N150.patch} |   0
 ...S_FUNC_UPLL-during-power-up-on-8188.patch} |   0
 ...able-of-WEP-TKIP-security-on-8188eu.patch} |   0
 ...rect-power-down-sequence-for-8188eu.patch} |   0
 ...8188eu-REG_GPIO_MUXCFG-on-power-off.patch} |   0
 ...e-devices-with-a-smaller-LLT-buffer.patch} |   0
 ...oading-of-driver-for-8188eu-devices.patch} |   0
 ...e-to-enable-OFDM-paths-for-8188eu-i.patch} |   0
 ...sel-entry-to-struct-rtl8xxxu_rxdesc.patch} |   0
 ...evice-on-module-unload-if-still-atta.patch |  28 -
 ...ix-spelling-mistake-firmare-firmware.patch |  30 -
 ...nt-8192e-specific-power-down-sequenc.patch | 192 ------
 ...ix-off-by-one-error-calculating-pubq.patch |  25 -
 ...-0002-rtl8xxxu-Clean-up-llt_init-API.patch |  80 ---
 ...truct-rtl8xxxu_fileops-in-rtl8xxxu_i.patch | 150 ----
 ...g-spam-from-each-successful-interrup.patch |  43 --
 .../801-libertas-configure-sysfs-links.patch  |   2 +-
 .../802-libertas-set-wireless-macaddr.patch   |   2 +-
 ...62-brcmfmac-Disable-power-management.patch |   2 +-
 ...21-ath10k_init_devices_synchronously.patch |   2 +-
 .../930-ath10k_add_tpt_led_trigger.patch      |   4 +-
 .../patches/936-ath10k_skip_otp_check.patch   |   8 +-
 216 files changed, 977 insertions(+), 8597 deletions(-)
 delete mode 100644 package/kernel/mac80211/patches/006-add-basic-register-field-manipulation-macros.patch
 rename package/kernel/mac80211/patches/{337-ath9k-Switch-to-using-mac80211-intermediate-software.patch => 300-ath9k-Switch-to-using-mac80211-intermediate-software.patch} (90%)
 rename package/kernel/mac80211/patches/{300-ath9k-force-rx_clear-when-disabling-rx.patch => 301-ath9k-force-rx_clear-when-disabling-rx.patch} (100%)
 rename package/kernel/mac80211/patches/{301-ath9k-limit-retries-for-powersave-response-frames.patch => 302-ath9k-limit-retries-for-powersave-response-frames.patch} (66%)
 rename package/kernel/mac80211/patches/{302-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch => 303-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch} (89%)
 delete mode 100644 package/kernel/mac80211/patches/303-ath10k-Ensure-txrx-compl-task-is-stopped-when-cleani.patch
 delete mode 100644 package/kernel/mac80211/patches/304-ath10k-Ensure-peer_map-references-are-cleaned-up.patch
 rename package/kernel/mac80211/patches/{306-mac80211-add-hdrlen-to-ieee80211_tx_data.patch => 304-mac80211-add-hdrlen-to-ieee80211_tx_data.patch} (87%)
 delete mode 100644 package/kernel/mac80211/patches/305-ath10k-Clean-up-peer-when-sta-goes-away.patch
 rename package/kernel/mac80211/patches/{307-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch => 305-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch} (80%)
 rename package/kernel/mac80211/patches/{310-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch => 306-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch} (97%)
 rename package/kernel/mac80211/patches/{339-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch => 307-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch} (86%)
 delete mode 100644 package/kernel/mac80211/patches/308-ath10k-Fix-sending-NULL-Qos-NULL-data-frames-for-QCA.patch
 rename package/kernel/mac80211/patches/{340-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch => 308-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch} (100%)
 rename package/kernel/mac80211/patches/{341-ath9k-report-tx-status-on-EOSP.patch => 309-ath9k-report-tx-status-on-EOSP.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/309-cfg80211-fix-proto-in-ieee80211_data_to_8023-for-fra.patch
 rename package/kernel/mac80211/patches/{342-ath9k-fix-block-ack-window-tracking-issues.patch => 310-ath9k-fix-block-ack-window-tracking-issues.patch} (94%)
 create mode 100644 package/kernel/mac80211/patches/311-ath10k-Add-support-for-160Mhz.patch
 delete mode 100644 package/kernel/mac80211/patches/311-ath10k-disable-wake_tx_queue-for-older-devices.patch
 delete mode 100644 package/kernel/mac80211/patches/312-ath9k-Correct-TSF-adjustment-to-align-the-beacon-tim.patch
 create mode 100644 package/kernel/mac80211/patches/312-mac80211-Use-rhltable-instead-of-rhashtable.patch
 delete mode 100644 package/kernel/mac80211/patches/313-ath9k-Handle-channel-context-in-get_-set_-reset_tsf.patch
 create mode 100644 package/kernel/mac80211/patches/313-mac80211-fix-sequence-number-allocation-regression.patch
 delete mode 100644 package/kernel/mac80211/patches/314-ath9k-Use-tsf-offset-helper-in-ath9k_hw_reset.patch
 rename package/kernel/mac80211/patches/{321-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch => 314-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch} (89%)
 delete mode 100644 package/kernel/mac80211/patches/315-ath9k-Expose-tsf_adjustment-in-mac80211-tsf-getters-.patch
 rename package/kernel/mac80211/patches/{322-ath9k_hw-issue-external-reset-for-QCA9550.patch => 315-ath9k_hw-issue-external-reset-for-QCA955x.patch} (93%)
 delete mode 100644 package/kernel/mac80211/patches/316-ath9k-Remove-some-defined-constants-to-decrease-verb.patch
 create mode 100644 package/kernel/mac80211/patches/316-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch
 create mode 100644 package/kernel/mac80211/patches/317-Revert-ath9k_hw-implement-temperature-compensation-s.patch
 delete mode 100644 package/kernel/mac80211/patches/317-ath9k-Fix-beacon-configuration-for-addition-removal-.patch
 delete mode 100644 package/kernel/mac80211/patches/318-brcmfmac-slightly-simplify-building-interface-combin.patch
 create mode 100644 package/kernel/mac80211/patches/318-mac80211-fix-up-mismerge-of-ieee80211_tx_dequeue.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0001-brcmfmac-fix-lockup-when-removing-P2P-interface-afte.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0002-brcmfmac-use-const-char-for-interface-name-in-brcmf_.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0003-brcmfmac-include-also-core.h-header-in-cfg80211.h.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0004-brcmfmac-add-missing-break-when-deleting-P2P_DEVICE.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0005-brcmfmac-delete-interface-directly-in-code-that-sent.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0006-brcmfmac-support-removing-AP-interfaces-with-interfa.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0007-brcmfmac-respect-hidden_ssid-for-AP-interfaces.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0008-brcmfmac-restore-stopping-netdev-queue-when-bus-clog.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0009-brcmfmac-defer-DPC-processing-during-probe.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0010-brcmfmac-Fix-glob_skb-leak-in-brcmf_sdiod_recv_chain.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0011-net-wireless-broadcom-brcm80211-brcmfmac-usb-don-t-p.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0012-brcmfmac-Check-rtnl_lock-is-locked-when-removing-int.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0013-brcmfmac-Change-vif_event_lock-to-spinlock.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0014-brcmfmac-add-missing-header-dependencies.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0015-brcmfmac-Add-USB-ID-for-Cisco-Linksys-AE1200.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0016-brcmfmac-fix-pmksa-bssid-usage.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0017-brcmfmac-avoid-potential-stack-overflow-in-brcmf_cfg.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0018-brcmfmac-add-support-for-bcm4339-chip-with-modalias-.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0019-brcmfmac-sdio-shorten-retry-loop-in-brcmf_sdio_kso_c.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0020-brcmfmac-ignore-11d-configuration-errors.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0021-brcmfmac-rework-pointer-trickery-in-brcmf_proto_bcdc.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0022-brcmfmac-fix-memory-leak-in-brcmf_flowring_add_tdls_.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0023-brcmfmac-initialize-variable-in-brcmf_sdiod_regrl.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0024-brcmfmac-remove-worker-from-.ndo_set_mac_address-cal.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0025-brcmfmac-remove-unnecessary-null-pointer-check.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0026-brcmfmac-fix-clearing-entry-IPv6-address.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0027-brcmfmac-fix-out-of-bound-access-on-clearing-wowl-wa.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0028-brcmfmac-simplify-mapping-of-auth-type.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0029-brcmfmac-fix-memory-leak-in-brcmf_fill_bss_param.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0030-brcmfmac-drop-unused-fields-from-struct-brcmf_pub.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0031-brcmfmac-replace-WARNING-on-timeout-with-a-simple-er.patch
 delete mode 100644 package/kernel/mac80211/patches/319-0032-brcmfmac-use-correct-skb-freeing-helper-when-deletin.patch
 delete mode 100644 package/kernel/mac80211/patches/320-ath9k-fix-using-sta-drv_priv-before-initializing-it.patch
 delete mode 100644 package/kernel/mac80211/patches/323-ath9k-Fix-programming-of-minCCA-power-threshold.patch
 delete mode 100644 package/kernel/mac80211/patches/324-ath9k_hw-fix-spectral-scan-on-AR9285-and-newer.patch
 delete mode 100644 package/kernel/mac80211/patches/325-ath9k_hw-fix-duplicate-and-partially-wrong-definitio.patch
 delete mode 100644 package/kernel/mac80211/patches/326-ath9k_hw-simplify-ar9003_hw_per_calibration.patch
 delete mode 100644 package/kernel/mac80211/patches/327-ath9k_hw-get-rid-of-some-duplicate-code-in-calibrati.patch
 delete mode 100644 package/kernel/mac80211/patches/329-mac80211-fix-check-for-buffered-powersave-frames-wit.patch
 delete mode 100644 package/kernel/mac80211/patches/330-ath10k-fix-rx-status-reporting-for-A-MSDU-subframes.patch
 delete mode 100644 package/kernel/mac80211/patches/331-mac80211-End-the-MPSP-even-if-EOSP-frame-was-not-rec.patch
 delete mode 100644 package/kernel/mac80211/patches/332-ath10k-implement-NAPI-support.patch
 delete mode 100644 package/kernel/mac80211/patches/333-ath9k-fix-client-mode-beacon-configuration.patch
 delete mode 100644 package/kernel/mac80211/patches/334-mac80211-fix-purging-multicast-PS-buffer-queue.patch
 delete mode 100644 package/kernel/mac80211/patches/335-ath9k-use-ieee80211_tx_status_noskb-where-possible.patch
 delete mode 100644 package/kernel/mac80211/patches/336-ath9k-improve-powersave-filter-handling.patch
 delete mode 100644 package/kernel/mac80211/patches/338-mac80211-fix-tim-recalculation-after-PS-response.patch
 delete mode 100644 package/kernel/mac80211/patches/343-mac80211-send-delBA-on-unexpected-BlockAck-data-fram.patch
 delete mode 100644 package/kernel/mac80211/patches/344-mac80211-send-delBA-on-unexpected-BlockAck-Request.patch
 delete mode 100644 package/kernel/mac80211/patches/345-mac80211-Move-reorder-sensitive-TX-handlers-to-after.patch
 delete mode 100644 package/kernel/mac80211/patches/532-ath9k_get_led_polarity_from_platform_data.patch
 delete mode 100644 package/kernel/mac80211/patches/650-0001-rtl8xxxu-Add-bit-definitions-for-REG_USB_SPECIAL_OPT.patch
 rename package/kernel/mac80211/patches/{657-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch => 650-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/650-0002-rtl8xxxu-Add-additional-documentation-for-RX-DMA-reg.patch
 rename package/kernel/mac80211/patches/{657-0002-rtl8xxxu-Fix-big-endian-problem-reporting-mactime.patch => 650-0002-rtl8xxxu-Fix-big-endian-problem-reporting-mactime.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/650-0003-rtl8xxxu-tuse-ph-to-dump-buffers.patch
 rename package/kernel/mac80211/patches/{658-0001-rtl8xxxu-Fix-rtl8723bu-driver-reload-issue.patch => 651-0001-rtl8xxxu-Fix-rtl8723bu-driver-reload-issue.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/651-0001-rtl8xxxu-remove-unneeded-assignments.patch
 rename package/kernel/mac80211/patches/{658-0002-rtl8xxxu-Fix-rtl8192eu-driver-reload-issue.patch => 651-0002-rtl8xxxu-Fix-rtl8192eu-driver-reload-issue.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/651-0002-rtl8xxxu-Reduce-console-noise-when-removing-the-kern.patch
 rename package/kernel/mac80211/patches/{659-0001-rtl8xxxu-Obtain-RTS-rates-from-mac80211.patch => 652-0001-rtl8xxxu-Obtain-RTS-rates-from-mac80211.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/652-0001-rtl8xxxu-Set-all-ieee80211_rx_status-values-in-parse.patch
 delete mode 100644 package/kernel/mac80211/patches/652-0002-rtl8xxxu-Move-skb-delivery-into-parse_tx_desc-handle.patch
 rename package/kernel/mac80211/patches/{659-0002-rtl8xxxu-Pass-tx_info-to-fill_txdesc-in-order-to-hav.patch => 652-0002-rtl8xxxu-Pass-tx_info-to-fill_txdesc-in-order-to-hav.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/652-0003-rtl8xxxu-Obtain-ieee80211_rx_status-within-parse_rx_.patch
 delete mode 100644 package/kernel/mac80211/patches/652-0004-rtl8xxxu-Correct-rxdesc16-definition.patch
 delete mode 100644 package/kernel/mac80211/patches/652-0005-rtl8xxxu-Add-support-for-aggregated-RX-packets-on-ge.patch
 delete mode 100644 package/kernel/mac80211/patches/652-0006-rtl8xxxu-Allocate-larger-RX-skbs-when-aggregation-is.patch
 delete mode 100644 package/kernel/mac80211/patches/652-0007-rtl8xxxu-Adjust-RX-skb-size-to-include-space-for-phy.patch
 delete mode 100644 package/kernel/mac80211/patches/652-0008-rtl8xxxu-Enable-aggregation-for-rtl8723au.patch
 delete mode 100644 package/kernel/mac80211/patches/652-0009-rtl8xxxu-Enable-aggregation-for-rtl8192cu-rtl8188cu-.patch
 delete mode 100644 package/kernel/mac80211/patches/652-0010-rtl8xxxu-Make-DMA-aggregation-optional-by-setting-a-.patch
 delete mode 100644 package/kernel/mac80211/patches/652-0011-rtl8xxxu-gen1-Set-aggregation-timeout-REG_RXDMA_AGG_.patch
 delete mode 100644 package/kernel/mac80211/patches/652-0012-rtl8xxxu-gen1-Add-module-parameters-to-adjust-DMA-ag.patch
 rename package/kernel/mac80211/patches/{660-0001-rtl8xxxu-Accept-firmware-signature-0x88e0.patch => 653-0001-rtl8xxxu-Accept-firmware-signature-0x88e0.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/653-0001-rtl8xxxu-Mark-0x20f4-0x648b-as-tested.patch
 rename package/kernel/mac80211/patches/{660-0002-rtl8xxxu-Add-initial-code-to-detect-8188eu-devices.patch => 653-0002-rtl8xxxu-Add-initial-code-to-detect-8188eu-devices.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/653-0002-rtl8xxxu-Mark-0x2001-0x3308-as-tested.patch
 rename package/kernel/mac80211/patches/{660-0003-rtl8xxxu-Add-initial-code-to-parse-8188eu-efuse.patch => 653-0003-rtl8xxxu-Add-initial-code-to-parse-8188eu-efuse.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/653-0003-rtl8xxxu-Fix-error-handling-if-rtl8xxxu_init_device-.patch
 delete mode 100644 package/kernel/mac80211/patches/653-0004-rtl8xxxu-Add-TP-Link-TL-WN823N-v2-to-list-of-support.patch
 rename package/kernel/mac80211/patches/{660-0004-rtl8xxxu-Detect-8188eu-parts-correctly.patch => 653-0004-rtl8xxxu-Detect-8188eu-parts-correctly.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/653-0005-rtl8xxxu-Add-TX-page-defines-for-8723b.patch
 rename package/kernel/mac80211/patches/{660-0005-rtl8xxxu-First-stab-at-rtl8188e_power_on.patch => 653-0005-rtl8xxxu-First-stab-at-rtl8188e_power_on.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0006-rtl8xxxu-Add-rtl8188e_disabled_to_emu.patch => 653-0006-rtl8xxxu-Add-rtl8188e_disabled_to_emu.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/653-0006-rtl8xxxu-Switch-8723a-to-use-new-rtl8xxxu_init_queue.patch
 rename package/kernel/mac80211/patches/{660-0007-rtl8xxxu-8188e-Enable-scheduler.patch => 653-0007-rtl8xxxu-8188e-Enable-scheduler.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/653-0007-rtl8xxxu-Switch-8192cu-8188cu-devices-to-use-rtl8xxx.patch
 rename package/kernel/mac80211/patches/{660-0008-rtl8xxxu-Add-rtl8188e_usb_quirk-for-enabling-MAC-TX-.patch => 653-0008-rtl8xxxu-Add-rtl8188e_usb_quirk-for-enabling-MAC-TX-.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/653-0008-rtl8xxxu-Remove-now-obsolete-rtl8xxxu_old_init_queue.patch
 rename package/kernel/mac80211/patches/{660-0009-rtl8xxxu-8188e-add-REG_TXDMA_OFFSET_CHK-quirk.patch => 653-0009-rtl8xxxu-8188e-add-REG_TXDMA_OFFSET_CHK-quirk.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/653-0009-rtl8xxxu-Simplify-code-setting-TX-buffer-boundary.patch
 delete mode 100644 package/kernel/mac80211/patches/653-0010-rtl8xxxu-Add-bit-definitions-for-REG_FPGA0_TX_INFO.patch
 rename package/kernel/mac80211/patches/{660-0010-rtl8xxxu-Add-reserved-page-init-parameters-for-8188e.patch => 653-0010-rtl8xxxu-Add-reserved-page-init-parameters-for-8188e.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/653-0011-rtl8xxxu-Add-interrupt-bit-definitions-for-gen2-part.patch
 rename package/kernel/mac80211/patches/{660-0011-rtl8xxxu-Correct-TX_TOTAL_PAGE_NUM-for-8188eu.patch => 653-0011-rtl8xxxu-Correct-TX_TOTAL_PAGE_NUM-for-8188eu.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0012-rtl8xxxu-Add-trxff_boundary-for-8188e.patch => 653-0012-rtl8xxxu-Add-trxff_boundary-for-8188e.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/653-0012-rtl8xxxu-Use-flag-to-indicate-whether-device-has-TX-.patch
 rename package/kernel/mac80211/patches/{660-0013-rtl8xxxu-8188eu-specify-firmware-block-size-and-set-.patch => 653-0013-rtl8xxxu-8188eu-specify-firmware-block-size-and-set-.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/653-0013-rtl8xxxu-Convert-flags-in-rtl8xxxu_fileops-to-bitfla.patch
 rename package/kernel/mac80211/patches/{660-0014-rtl8xxxu-Add-8188e-mac-init-table.patch => 653-0014-rtl8xxxu-Add-8188e-mac-init-table.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/653-0014-rtl8xxxu-Introduce-fops-bitflag-indicating-type-of-t.patch
 rename package/kernel/mac80211/patches/{660-0015-rtl8xxxu-Implement-rtl8188eu_init_phy_bb.patch => 653-0015-rtl8xxxu-Implement-rtl8188eu_init_phy_bb.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/653-0015-rtl8xxxu-Simplify-calculating-of-hw-value-used-for-s.patch
 delete mode 100644 package/kernel/mac80211/patches/653-0016-rtl8xxxu-Determine-the-need-for-SGI-before-handling-.patch
 rename package/kernel/mac80211/patches/{660-0016-rtl8xxxu-Implement-rtl8188eu_init_phy_rf.patch => 653-0016-rtl8xxxu-Implement-rtl8188eu_init_phy_rf.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/653-0017-rtl8xxxu-Determine-need-for-shore-preamble-before-up.patch
 rename package/kernel/mac80211/patches/{660-0017-rtl8xxxu-Use-auto-LLT-init-for-8188e.patch => 653-0017-rtl8xxxu-Use-auto-LLT-init-for-8188e.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0018-rtl8xxxu-Do-not-set-REG_FPGA0_TX_INFO-on-8188eu.patch => 653-0018-rtl8xxxu-Do-not-set-REG_FPGA0_TX_INFO-on-8188eu.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/653-0018-rtl8xxxu-Split-filling-of-TX-descriptors-into-separa.patch
 rename package/kernel/mac80211/patches/{660-0019-rtl8xxxu-Do-not-mess-with-REG_FPGA0_XA_RF_INT_OE-eit.patch => 653-0019-rtl8xxxu-Do-not-mess-with-REG_FPGA0_XA_RF_INT_OE-eit.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/653-0019-rtl8xxxu-gen1-Fix-non-static-symbol-warning.patch
 delete mode 100644 package/kernel/mac80211/patches/653-0020-rtl8xxxu-Make-rtl8xxxu_ampdu_action-less-chatty.patch
 rename package/kernel/mac80211/patches/{660-0020-rtl8xxxu-Set-transfer-page-size-for-8188eu.patch => 653-0020-rtl8xxxu-Set-transfer-page-size-for-8188eu.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0021-rtl8xxxu-Enable-TX-report-timer-on-8188eu.patch => 653-0021-rtl8xxxu-Enable-TX-report-timer-on-8188eu.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0022-rtl8xxxu-Setup-interrupts-for-8188eu.patch => 653-0022-rtl8xxxu-Setup-interrupts-for-8188eu.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0023-rtl8xxxu-Use-rxdesc16-and-32-byte-tx-descriptors-for.patch => 653-0023-rtl8xxxu-Use-rxdesc16-and-32-byte-tx-descriptors-for.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0024-rtl8xxxu-8188eu-use-same-ADDA-on-parameters-as-8723a.patch => 653-0024-rtl8xxxu-8188eu-use-same-ADDA-on-parameters-as-8723a.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0025-rtl8xxxu-Add-PHY-IQ-calibration-code-for-8188eu.patch => 653-0025-rtl8xxxu-Add-PHY-IQ-calibration-code-for-8188eu.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0026-rtl8xxxu-8188eu-uses-the-gen2-thermal-meter.patch => 653-0026-rtl8xxxu-8188eu-uses-the-gen2-thermal-meter.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0027-rtl8xxxu-Set-REG_USB_HRPWM-to-0-for-8188eu.patch => 653-0027-rtl8xxxu-Set-REG_USB_HRPWM-to-0-for-8188eu.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0028-rtl8xxxu-Implement-rtl8188eu_config_channel.patch => 653-0028-rtl8xxxu-Implement-rtl8188eu_config_channel.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0029-rtl8xxxu-Use-gen2-H2C-commands-for-8188eu.patch => 653-0029-rtl8xxxu-Use-gen2-H2C-commands-for-8188eu.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0030-rtl8xxxu-Initialize-GPIO-settings-for-8188eu.patch => 653-0030-rtl8xxxu-Initialize-GPIO-settings-for-8188eu.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0031-rtl8xxxu-Add-simple-rtl8188eu_rf_on-routine.patch => 653-0031-rtl8xxxu-Add-simple-rtl8188eu_rf_on-routine.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0032-rtl8xxxu-Implement-rtl8188e_disable_rf.patch => 653-0032-rtl8xxxu-Implement-rtl8188e_disable_rf.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0033-rtl8xxxu-Update-8188e-efuse-definition-for-power-val.patch => 653-0033-rtl8xxxu-Update-8188e-efuse-definition-for-power-val.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0034-rtl8xxxu-Implement-rtl8188e_set_tx_power.patch => 653-0034-rtl8xxxu-Implement-rtl8188e_set_tx_power.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0035-rtl8xxxu-Implement-rtl8xxxu_fill_txdesc_v3-for-8188e.patch => 653-0035-rtl8xxxu-Implement-rtl8xxxu_fill_txdesc_v3-for-8188e.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0036-rtl8xxxu-Add-some-8188eu-registers-and-update-CCK0_A.patch => 653-0036-rtl8xxxu-Add-some-8188eu-registers-and-update-CCK0_A.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0037-rtl8xxxu-Improve-register-description-for-REG_FPGA1_.patch => 653-0037-rtl8xxxu-Improve-register-description-for-REG_FPGA1_.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0038-rtl8xxxu-properly-detect-RTL8188EU-devices.patch => 653-0038-rtl8xxxu-properly-detect-RTL8188EU-devices.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0039-rtl8xxxu-Implement-8188eu-specific-8051-reset-functi.patch => 653-0039-rtl8xxxu-Implement-8188eu-specific-8051-reset-functi.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0040-rtl8xxxu-Disable-packet-DMA-aggregation-on-8188eu.patch => 653-0040-rtl8xxxu-Disable-packet-DMA-aggregation-on-8188eu.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0041-rtl8xxxu-8188eu-set-REG_OFDM0_XA_AGC_CORE1-to-match-.patch => 653-0041-rtl8xxxu-8188eu-set-REG_OFDM0_XA_AGC_CORE1-to-match-.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0042-rtl8xxxu-Fix-rtl8188eu-connection-fail.patch => 653-0042-rtl8xxxu-Fix-rtl8188eu-connection-fail.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0043-rtl8xxxu-Do-not-set-auto-rate-fallback-on-8188eu.patch => 653-0043-rtl8xxxu-Do-not-set-auto-rate-fallback-on-8188eu.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0044-rtl8xxxu-Enable-8188eu-driver.patch => 653-0044-rtl8xxxu-Enable-8188eu-driver.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0045-rtl8xxxu-Add-rtl8188etv-to-USB-device-list.patch => 653-0045-rtl8xxxu-Add-rtl8188etv-to-USB-device-list.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0046-rtl8xxxu-Add-sitecom-dongle-to-USB-device-list.patch => 653-0046-rtl8xxxu-Add-sitecom-dongle-to-USB-device-list.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0047-rtl8xxxu-Implement-rtl8188eu_active_to_emu.patch => 653-0047-rtl8xxxu-Implement-rtl8188eu_active_to_emu.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0048-rtl8xxxu-Implement-rtl8188eu_power_off.patch => 653-0048-rtl8xxxu-Implement-rtl8188eu_power_off.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0049-rtl8xxxu-Add-rtl8188eu-USB-ID-for-D-Link-USB-GO-N150.patch => 653-0049-rtl8xxxu-Add-rtl8188eu-USB-ID-for-D-Link-USB-GO-N150.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0050-rtl8xxxu-Clear-SYS_FUNC_UPLL-during-power-up-on-8188.patch => 653-0050-rtl8xxxu-Clear-SYS_FUNC_UPLL-during-power-up-on-8188.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0051-rtl8xxxu-Early-enable-of-WEP-TKIP-security-on-8188eu.patch => 653-0051-rtl8xxxu-Early-enable-of-WEP-TKIP-security-on-8188eu.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0052-rtl8xxxu-Correct-power-down-sequence-for-8188eu.patch => 653-0052-rtl8xxxu-Correct-power-down-sequence-for-8188eu.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0053-rtl8xxxu-Reset-8188eu-REG_GPIO_MUXCFG-on-power-off.patch => 653-0053-rtl8xxxu-Reset-8188eu-REG_GPIO_MUXCFG-on-power-off.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0054-rtl8xxxu-Handle-devices-with-a-smaller-LLT-buffer.patch => 653-0054-rtl8xxxu-Handle-devices-with-a-smaller-LLT-buffer.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0055-rtl8xxxu-Fix-reloading-of-driver-for-8188eu-devices.patch => 653-0055-rtl8xxxu-Fix-reloading-of-driver-for-8188eu-devices.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0056-rtl8xxxu-Make-sure-to-enable-OFDM-paths-for-8188eu-i.patch => 653-0056-rtl8xxxu-Make-sure-to-enable-OFDM-paths-for-8188eu-i.patch} (100%)
 rename package/kernel/mac80211/patches/{660-0057-rtl8xxxu-Add-rpt_sel-entry-to-struct-rtl8xxxu_rxdesc.patch => 653-0057-rtl8xxxu-Add-rpt_sel-entry-to-struct-rtl8xxxu_rxdesc.patch} (100%)
 delete mode 100644 package/kernel/mac80211/patches/654-0001-rtl8xxxu-Reset-device-on-module-unload-if-still-atta.patch
 delete mode 100644 package/kernel/mac80211/patches/654-0002-rtl8xxxu-fix-spelling-mistake-firmare-firmware.patch
 delete mode 100644 package/kernel/mac80211/patches/655-rtl8xxxu-Implement-8192e-specific-power-down-sequenc.patch
 delete mode 100644 package/kernel/mac80211/patches/656-0001-rtl8xxxu-Fix-off-by-one-error-calculating-pubq.patch
 delete mode 100644 package/kernel/mac80211/patches/656-0002-rtl8xxxu-Clean-up-llt_init-API.patch
 delete mode 100644 package/kernel/mac80211/patches/656-0003-rtl8xxxu-Use-a-struct-rtl8xxxu_fileops-in-rtl8xxxu_i.patch
 delete mode 100644 package/kernel/mac80211/patches/656-0004-rtl8xxxu-Stop-log-spam-from-each-successful-interrup.patch

diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index 91c9362e93..f9f50932e3 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -10,11 +10,11 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=mac80211
 
-PKG_VERSION:=2016-06-20
+PKG_VERSION:=2016-10-08
 PKG_RELEASE:=1
 PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
 PKG_BACKPORT_VERSION:=
-PKG_MD5SUM:=29c79bdc3928ef5113b17042ebda9237
+PKG_MD5SUM:=4f6350e3b75815060bfdf47ef266ad613c7bfea5b7b1dc4552dee69e1bebe4fb
 
 PKG_SOURCE:=compat-wireless-$(PKG_VERSION)$(PKG_BACKPORT_VERSION).tar.bz2
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/compat-wireless-$(PKG_VERSION)
diff --git a/package/kernel/mac80211/patches/004-fix_duplicate_skcipher_backport.patch b/package/kernel/mac80211/patches/004-fix_duplicate_skcipher_backport.patch
index 38b31795a4..22819f7ed2 100644
--- a/package/kernel/mac80211/patches/004-fix_duplicate_skcipher_backport.patch
+++ b/package/kernel/mac80211/patches/004-fix_duplicate_skcipher_backport.patch
@@ -1,6 +1,6 @@
 --- a/compat/Makefile
 +++ b/compat/Makefile
-@@ -35,8 +35,6 @@ compat-$(CPTCFG_KERNEL_4_6) += backport-
+@@ -36,8 +36,6 @@ compat-$(CPTCFG_KERNEL_4_7) += backport-
  
  compat-$(CPTCFG_BPAUTO_BUILD_CRYPTO_CCM) += crypto-ccm.o
  compat-$(CPTCFG_BPAUTO_CRYPTO_SKCIPHER) += crypto-skcipher.o
diff --git a/package/kernel/mac80211/patches/006-add-basic-register-field-manipulation-macros.patch b/package/kernel/mac80211/patches/006-add-basic-register-field-manipulation-macros.patch
deleted file mode 100644
index a51edf8182..0000000000
--- a/package/kernel/mac80211/patches/006-add-basic-register-field-manipulation-macros.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From: Jakub Kicinski <jakub.kicinski@netronome.com>
-Date: Wed, 31 Aug 2016 12:46:44 +0100
-Subject: [PATCH] add basic register-field manipulation macros
-
-Common approach to accessing register fields is to define
-structures or sets of macros containing mask and shift pair.
-Operations on the register are then performed as follows:
-
- field = (reg >> shift) & mask;
-
- reg &= ~(mask << shift);
- reg |= (field & mask) << shift;
-
-Defining shift and mask separately is tedious.  Ivo van Doorn
-came up with an idea of computing them at compilation time
-based on a single shifted mask (later refined by Felix) which
-can be used like this:
-
- #define REG_FIELD 0x000ff000
-
- field = FIELD_GET(REG_FIELD, reg);
-
- reg &= ~REG_FIELD;
- reg |= FIELD_PREP(REG_FIELD, field);
-
-FIELD_{GET,PREP} macros take care of finding out what the
-appropriate shift is based on compilation time ffs operation.
-
-GENMASK can be used to define registers (which is usually
-less error-prone and easier to match with datasheets).
-
-This approach is the most convenient I've seen so to limit code
-multiplication let's move the macros to a global header file.
-Attempts to use static inlines instead of macros failed due
-to false positive triggering of BUILD_BUG_ON()s, especially with
-GCC < 6.0.
-
-Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
-Reviewed-by: Dinan Gunawardena <dinan.gunawardena@netronome.com>
----
- create mode 100644 include/linux/bitfield.h
-
---- /dev/null
-+++ b/include/linux/bitfield.h
-@@ -0,0 +1,100 @@
-+/*
-+ * Copyright (C) 2014 Felix Fietkau <nbd@nbd.name>
-+ * Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2
-+ * as published by the Free Software Foundation
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * GNU General Public License for more details.
-+ */
-+
-+#ifndef _LINUX_BITFIELD_H
-+#define _LINUX_BITFIELD_H
-+
-+#include <linux/bug.h>
-+
-+#ifdef __CHECKER__
-+#define __BUILD_BUG_ON_NOT_POWER_OF_2(n) (0)
-+#else
-+#define __BUILD_BUG_ON_NOT_POWER_OF_2(n)	\
-+	BUILD_BUG_ON(((n) & ((n) - 1)) != 0)
-+#endif
-+
-+/*
-+ * Bitfield access macros
-+ *
-+ * FIELD_{GET,PREP} macros take as first parameter shifted mask
-+ * from which they extract the base mask and shift amount.
-+ * Mask must be a compilation time constant.
-+ *
-+ * Example:
-+ *
-+ *  #define REG_FIELD_A  GENMASK(6, 0)
-+ *  #define REG_FIELD_B  BIT(7)
-+ *  #define REG_FIELD_C  GENMASK(15, 8)
-+ *  #define REG_FIELD_D  GENMASK(31, 16)
-+ *
-+ * Get:
-+ *  a = FIELD_GET(REG_FIELD_A, reg);
-+ *  b = FIELD_GET(REG_FIELD_B, reg);
-+ *
-+ * Set:
-+ *  reg = FIELD_PREP(REG_FIELD_A, 1) |
-+ *	  FIELD_PREP(REG_FIELD_B, 0) |
-+ *	  FIELD_PREP(REG_FIELD_C, c) |
-+ *	  FIELD_PREP(REG_FIELD_D, 0x40);
-+ *
-+ * Modify:
-+ *  reg &= ~REG_FIELD_C;
-+ *  reg |= FIELD_PREP(REG_FIELD_C, c);
-+ */
-+
-+#define __bf_shf(x) (__builtin_ffsll(x) - 1)
-+
-+#define __BF_FIELD_CHECK(_mask, _reg, _val, _pfx)			\
-+	({								\
-+		BUILD_BUG_ON_MSG(!__builtin_constant_p(_mask),		\
-+				 _pfx "mask is not constant");		\
-+		BUILD_BUG_ON_MSG(!(_mask), _pfx "mask is zero");	\
-+		BUILD_BUG_ON_MSG(__builtin_constant_p(_val) ?		\
-+				 ~((_mask) >> __bf_shf(_mask)) & (_val) : 0, \
-+				 _pfx "value too large for the field"); \
-+		BUILD_BUG_ON_MSG((_mask) > (typeof(_reg))~0ull,		\
-+				 _pfx "type of reg too small for mask"); \
-+		__BUILD_BUG_ON_NOT_POWER_OF_2((_mask) +			\
-+					      (1ULL << __bf_shf(_mask))); \
-+	})
-+
-+/**
-+ * FIELD_PREP() - prepare a bitfield element
-+ * @_mask: shifted mask defining the field's length and position
-+ * @_val:  value to put in the field
-+ *
-+ * FIELD_PREP() masks and shifts up the value.  The result should
-+ * be combined with other fields of the bitfield using logical OR.
-+ */
-+#define FIELD_PREP(_mask, _val)						\
-+	({								\
-+		__BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_PREP: ");	\
-+		((typeof(_mask))(_val) << __bf_shf(_mask)) & (_mask);	\
-+	})
-+
-+/**
-+ * FIELD_GET() - extract a bitfield element
-+ * @_mask: shifted mask defining the field's length and position
-+ * @_reg:  32bit value of entire bitfield
-+ *
-+ * FIELD_GET() extracts the field specified by @_mask from the
-+ * bitfield passed in as @_reg by masking and shifting it down.
-+ */
-+#define FIELD_GET(_mask, _reg)						\
-+	({								\
-+		__BF_FIELD_CHECK(_mask, _reg, 0U, "FIELD_GET: ");	\
-+		(typeof(_mask))(((_reg) & (_mask)) >> __bf_shf(_mask));	\
-+	})
-+
-+#endif
diff --git a/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch b/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
index 8be5fa15e9..4df5ac57f0 100644
--- a/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
+++ b/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
@@ -1,6 +1,6 @@
 --- a/.local-symbols
 +++ b/.local-symbols
-@@ -481,45 +481,6 @@ USB_IPHETH=
+@@ -477,45 +477,6 @@ USB_IPHETH=
  USB_SIERRA_NET=
  USB_VL600=
  USB_NET_CH9200=
diff --git a/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch b/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
index fbe22e51b7..b65b0bd00e 100644
--- a/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
+++ b/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
@@ -34,12 +34,9 @@
  #include "aes_ccm.h"
  
 -void ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
--			       u8 *data, size_t data_len, u8 *mic,
--			       size_t mic_len)
 +static void aes_ccm_prepare(struct crypto_cipher *tfm, u8 *b_0, u8 *aad, u8 *s_0,
 +			    u8 *a, u8 *b)
- {
--	struct scatterlist sg[3];
++{
 +	int i;
 +
 +	crypto_cipher_encrypt_one(tfm, b, b_0);
@@ -54,55 +51,56 @@
 +	for (i = 0; i < AES_BLOCK_SIZE; i++)
 +		aad[i] ^= b[i];
 +	crypto_cipher_encrypt_one(tfm, a, aad);
- 
--	char aead_req_data[sizeof(struct aead_request) +
--			   crypto_aead_reqsize(tfm)]
--		__aligned(__alignof__(struct aead_request));
--	struct aead_request *aead_req = (void *) aead_req_data;
++
 +	/* Mask out bits from auth-only-b_0 */
 +	b_0[0] &= 0x07;
- 
--	memset(aead_req, 0, sizeof(aead_req_data));
++
 +	/* S_0 is used to encrypt T (= MIC) */
 +	b_0[14] = 0;
 +	b_0[15] = 0;
 +	crypto_cipher_encrypt_one(tfm, s_0, b_0);
 +}
- 
--	sg_init_table(sg, 3);
--	sg_set_buf(&sg[0], &aad[2], be16_to_cpup((__be16 *)aad));
--	sg_set_buf(&sg[1], data, data_len);
--	sg_set_buf(&sg[2], mic, mic_len);
- 
--	aead_request_set_tfm(aead_req, tfm);
--	aead_request_set_crypt(aead_req, sg, sg, data_len, b_0);
--	aead_request_set_ad(aead_req, sg[0].length);
++
++
 +void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
-+			       u8 *data, size_t data_len, u8 *mic,
-+			       size_t mic_len)
-+{
+ 			       u8 *data, size_t data_len, u8 *mic,
+ 			       size_t mic_len)
+ {
+-	struct scatterlist sg[3];
 +	int i, j, last_len, num_blocks;
 +	u8 b[AES_BLOCK_SIZE];
 +	u8 s_0[AES_BLOCK_SIZE];
 +	u8 e[AES_BLOCK_SIZE];
 +	u8 *pos, *cpos;
-+
+ 
+-	char aead_req_data[sizeof(struct aead_request) +
+-			   crypto_aead_reqsize(tfm)]
+-		__aligned(__alignof__(struct aead_request));
+-	struct aead_request *aead_req = (void *) aead_req_data;
 +	num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
 +	last_len = data_len % AES_BLOCK_SIZE;
 +	aes_ccm_prepare(tfm, b_0, aad, s_0, b, b);
-+
+ 
+-	memset(aead_req, 0, sizeof(aead_req_data));
 +	/* Process payload blocks */
 +	pos = data;
 +	cpos = data;
 +	for (j = 1; j <= num_blocks; j++) {
 +		int blen = (j == num_blocks && last_len) ?
 +			last_len : AES_BLOCK_SIZE;
-+
+ 
+-	sg_init_table(sg, 3);
+-	sg_set_buf(&sg[0], &aad[2], be16_to_cpup((__be16 *)aad));
+-	sg_set_buf(&sg[1], data, data_len);
+-	sg_set_buf(&sg[2], mic, mic_len);
 +		/* Authentication followed by encryption */
 +		for (i = 0; i < blen; i++)
 +			b[i] ^= pos[i];
 +		crypto_cipher_encrypt_one(tfm, b, b);
-+
+ 
+-	aead_request_set_tfm(aead_req, tfm);
+-	aead_request_set_crypt(aead_req, sg, sg, data_len, b_0);
+-	aead_request_set_ad(aead_req, sg[0].length);
 +		b_0[14] = (j >> 8) & 0xff;
 +		b_0[15] = j & 0xff;
 +		crypto_cipher_encrypt_one(tfm, e, b_0);
@@ -125,37 +123,30 @@
 -			   crypto_aead_reqsize(tfm)]
 -		__aligned(__alignof__(struct aead_request));
 -	struct aead_request *aead_req = (void *) aead_req_data;
--
--	if (data_len == 0)
--		return -EINVAL;
--
--	memset(aead_req, 0, sizeof(aead_req_data));
--
--	sg_init_table(sg, 3);
--	sg_set_buf(&sg[0], &aad[2], be16_to_cpup((__be16 *)aad));
--	sg_set_buf(&sg[1], data, data_len);
--	sg_set_buf(&sg[2], mic, mic_len);
--
--	aead_request_set_tfm(aead_req, tfm);
--	aead_request_set_crypt(aead_req, sg, sg, data_len + mic_len, b_0);
--	aead_request_set_ad(aead_req, sg[0].length);
 +	int i, j, last_len, num_blocks;
 +	u8 *pos, *cpos;
 +	u8 a[AES_BLOCK_SIZE];
 +	u8 b[AES_BLOCK_SIZE];
 +	u8 s_0[AES_BLOCK_SIZE];
-+
+ 
+-	if (data_len == 0)
+-		return -EINVAL;
 +	num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
 +	last_len = data_len % AES_BLOCK_SIZE;
 +	aes_ccm_prepare(tfm, b_0, aad, s_0, a, b);
-+
+ 
+-	memset(aead_req, 0, sizeof(aead_req_data));
 +	/* Process payload blocks */
 +	cpos = data;
 +	pos = data;
 +	for (j = 1; j <= num_blocks; j++) {
 +		int blen = (j == num_blocks && last_len) ?
 +			last_len : AES_BLOCK_SIZE;
-+
+ 
+-	sg_init_table(sg, 3);
+-	sg_set_buf(&sg[0], &aad[2], be16_to_cpup((__be16 *)aad));
+-	sg_set_buf(&sg[1], data, data_len);
+-	sg_set_buf(&sg[2], mic, mic_len);
 +		/* Decryption followed by authentication */
 +		b_0[14] = (j >> 8) & 0xff;
 +		b_0[15] = j & 0xff;
@@ -166,7 +157,10 @@
 +		}
 +		crypto_cipher_encrypt_one(tfm, a, a);
 +	}
-+
+ 
+-	aead_request_set_tfm(aead_req, tfm);
+-	aead_request_set_crypt(aead_req, sg, sg, data_len + mic_len, b_0);
+-	aead_request_set_ad(aead_req, sg[0].length);
 +	for (i = 0; i < mic_len; i++) {
 +		if ((mic[i] ^ s_0[i]) != a[i])
 +			return -1;
@@ -185,12 +179,12 @@
  {
 -	struct crypto_aead *tfm;
 -	int err;
-+	struct crypto_cipher *tfm;
- 
+-
 -	tfm = crypto_alloc_aead("ccm(aes)", 0, CRYPTO_ALG_ASYNC);
 -	if (IS_ERR(tfm))
 -		return tfm;
--
++	struct crypto_cipher *tfm;
+ 
 -	err = crypto_aead_setkey(tfm, key, key_len);
 -	if (err)
 -		goto free_aead;
diff --git a/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch b/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
index 3ca166ff45..c42b17de38 100644
--- a/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
+++ b/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
@@ -2,7 +2,7 @@ Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnects
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -850,7 +850,6 @@ static int ieee80211_stop_ap(struct wiph
+@@ -1016,7 +1016,6 @@ static int ieee80211_stop_ap(struct wiph
  	sdata->u.ap.driver_smps_mode = IEEE80211_SMPS_OFF;
  
  	__sta_info_flush(sdata, true);
diff --git a/package/kernel/mac80211/patches/130-mac80211-hwsim-hrtimer-clock.patch b/package/kernel/mac80211/patches/130-mac80211-hwsim-hrtimer-clock.patch
index cdcd5c8d28..29d70343bb 100644
--- a/package/kernel/mac80211/patches/130-mac80211-hwsim-hrtimer-clock.patch
+++ b/package/kernel/mac80211/patches/130-mac80211-hwsim-hrtimer-clock.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/mac80211_hwsim.c
 +++ b/drivers/net/wireless/mac80211_hwsim.c
-@@ -2631,7 +2631,7 @@ static int mac80211_hwsim_new_radio(stru
+@@ -2662,7 +2662,7 @@ static int mac80211_hwsim_new_radio(stru
  
  	tasklet_hrtimer_init(&data->beacon_timer,
  			     mac80211_hwsim_beacon,
diff --git a/package/kernel/mac80211/patches/150-disable_addr_notifier.patch b/package/kernel/mac80211/patches/150-disable_addr_notifier.patch
index 16fab84535..f4cb41cd30 100644
--- a/package/kernel/mac80211/patches/150-disable_addr_notifier.patch
+++ b/package/kernel/mac80211/patches/150-disable_addr_notifier.patch
@@ -18,7 +18,7 @@
  static int ieee80211_ifa6_changed(struct notifier_block *nb,
  				  unsigned long data, void *arg)
  {
-@@ -1090,14 +1090,14 @@ int ieee80211_register_hw(struct ieee802
+@@ -1101,14 +1101,14 @@ int ieee80211_register_hw(struct ieee802
  	if (result)
  		goto fail_flows;
  
@@ -35,7 +35,7 @@
  	local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
  	result = register_inet6addr_notifier(&local->ifa6_notifier);
  	if (result)
-@@ -1106,13 +1106,13 @@ int ieee80211_register_hw(struct ieee802
+@@ -1117,13 +1117,13 @@ int ieee80211_register_hw(struct ieee802
  
  	return 0;
  
@@ -52,7 +52,7 @@
   fail_ifa:
  #endif
  	ieee80211_txq_teardown_flows(local);
-@@ -1142,10 +1142,10 @@ void ieee80211_unregister_hw(struct ieee
+@@ -1153,10 +1153,10 @@ void ieee80211_unregister_hw(struct ieee
  	tasklet_kill(&local->tx_pending_tasklet);
  	tasklet_kill(&local->tasklet);
  
diff --git a/package/kernel/mac80211/patches/210-ap_scan.patch b/package/kernel/mac80211/patches/210-ap_scan.patch
index 29f05c44d6..94f5f397c9 100644
--- a/package/kernel/mac80211/patches/210-ap_scan.patch
+++ b/package/kernel/mac80211/patches/210-ap_scan.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2008,7 +2008,7 @@ static int ieee80211_scan(struct wiphy *
+@@ -2175,7 +2175,7 @@ static int ieee80211_scan(struct wiphy *
  		 * the  frames sent while scanning on other channel will be
  		 * lost)
  		 */
diff --git a/package/kernel/mac80211/patches/337-ath9k-Switch-to-using-mac80211-intermediate-software.patch b/package/kernel/mac80211/patches/300-ath9k-Switch-to-using-mac80211-intermediate-software.patch
similarity index 90%
rename from package/kernel/mac80211/patches/337-ath9k-Switch-to-using-mac80211-intermediate-software.patch
rename to package/kernel/mac80211/patches/300-ath9k-Switch-to-using-mac80211-intermediate-software.patch
index adfd6dfe01..57917c5b45 100644
--- a/package/kernel/mac80211/patches/337-ath9k-Switch-to-using-mac80211-intermediate-software.patch
+++ b/package/kernel/mac80211/patches/300-ath9k-Switch-to-using-mac80211-intermediate-software.patch
@@ -1,6 +1,7 @@
 From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>
-Date: Wed, 6 Jul 2016 21:34:17 +0200
-Subject: [PATCH] ath9k: Switch to using mac80211 intermediate software queues.
+Date: Fri, 2 Sep 2016 16:00:30 +0200
+Subject: [PATCH] ath9k: Switch to using mac80211 intermediate software
+ queues.
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -19,7 +20,7 @@ Based on Tim's original patch set, but reworked quite thoroughly.
 
 Cc: Tim Shepard <shep@alum.mit.edu>
 Cc: Felix Fietkau <nbd@nbd.name>
-Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
 ---
 
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -129,7 +130,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  /* VIFs */
 --- a/drivers/net/wireless/ath/ath9k/channel.c
 +++ b/drivers/net/wireless/ath/ath9k/channel.c
-@@ -1007,7 +1007,6 @@ static void ath_scan_send_probe(struct a
+@@ -1010,7 +1010,6 @@ static void ath_scan_send_probe(struct a
  		goto error;
  
  	txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO];
@@ -137,7 +138,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  	if (ath_tx_start(sc->hw, skb, &txctl))
  		goto error;
  
-@@ -1130,7 +1129,6 @@ ath_chanctx_send_vif_ps_frame(struct ath
+@@ -1133,7 +1132,6 @@ ath_chanctx_send_vif_ps_frame(struct ath
  	memset(&txctl, 0, sizeof(txctl));
  	txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO];
  	txctl.sta = sta;
@@ -237,7 +238,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  	}
  	return 0;
  }
-@@ -873,6 +872,7 @@ static void ath9k_set_hw_capab(struct at
+@@ -877,6 +876,7 @@ static void ath9k_set_hw_capab(struct at
  	hw->max_rate_tries = 10;
  	hw->sta_data_size = sizeof(struct ath_node);
  	hw->vif_data_size = sizeof(struct ath_vif);
@@ -247,7 +248,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  	hw->wiphy->available_antennas_rx = BIT(ah->caps.max_rxchains) - 1;
 --- a/drivers/net/wireless/ath/ath9k/main.c
 +++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -1897,9 +1897,11 @@ static int ath9k_ampdu_action(struct iee
+@@ -1902,9 +1902,11 @@ static int ath9k_ampdu_action(struct iee
  	bool flush = false;
  	int ret = 0;
  	struct ieee80211_sta *sta = params->sta;
@@ -259,7 +260,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  
  	mutex_lock(&sc->mutex);
  
-@@ -1932,9 +1934,9 @@ static int ath9k_ampdu_action(struct iee
+@@ -1937,9 +1939,9 @@ static int ath9k_ampdu_action(struct iee
  		ath9k_ps_restore(sc);
  		break;
  	case IEEE80211_AMPDU_TX_OPERATIONAL:
@@ -272,7 +273,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  		break;
  	default:
  		ath_err(ath9k_hw_common(sc->sc_ah), "Unknown AMPDU action\n");
-@@ -2696,4 +2698,5 @@ struct ieee80211_ops ath9k_ops = {
+@@ -2701,4 +2703,5 @@ struct ieee80211_ops ath9k_ops = {
  	.sw_scan_start	    = ath9k_sw_scan_start,
  	.sw_scan_complete   = ath9k_sw_scan_complete,
  	.get_txpower        = ath9k_get_txpower,
@@ -316,7 +317,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  static struct ath_frame_info *get_frame_info(struct sk_buff *skb)
  {
  	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
-@@ -179,7 +201,6 @@ static void ath_set_rates(struct ieee802
+@@ -164,7 +186,6 @@ static void ath_set_rates(struct ieee802
  static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
  			     struct sk_buff *skb)
  {
@@ -324,7 +325,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  	struct ath_frame_info *fi = get_frame_info(skb);
  	int q = fi->txq;
  
-@@ -190,14 +211,6 @@ static void ath_txq_skb_done(struct ath_
+@@ -175,14 +196,6 @@ static void ath_txq_skb_done(struct ath_
  	if (WARN_ON(--txq->pending_frames < 0))
  		txq->pending_frames = 0;
  
@@ -339,7 +340,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  }
  
  static struct ath_atx_tid *
-@@ -207,9 +220,48 @@ ath_get_skb_tid(struct ath_softc *sc, st
+@@ -192,9 +205,48 @@ ath_get_skb_tid(struct ath_softc *sc, st
  	return ATH_AN_2_TID(an, tidno);
  }
  
@@ -389,7 +390,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  }
  
  static struct sk_buff *ath_tid_dequeue(struct ath_atx_tid *tid)
-@@ -218,46 +270,11 @@ static struct sk_buff *ath_tid_dequeue(s
+@@ -203,46 +255,11 @@ static struct sk_buff *ath_tid_dequeue(s
  
  	skb = __skb_dequeue(&tid->retry_q);
  	if (!skb)
@@ -437,7 +438,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
  {
  	struct ath_txq *txq = tid->txq;
-@@ -898,20 +915,16 @@ static int ath_compute_num_delims(struct
+@@ -883,20 +900,16 @@ static int ath_compute_num_delims(struct
  
  static struct ath_buf *
  ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
@@ -461,7 +462,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  		if (!skb)
  			break;
  
-@@ -923,7 +936,6 @@ ath_tx_get_tid_subframe(struct ath_softc
+@@ -908,7 +921,6 @@ ath_tx_get_tid_subframe(struct ath_softc
  			bf->bf_state.stale = false;
  
  		if (!bf) {
@@ -469,7 +470,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  			ath_txq_skb_done(sc, txq, skb);
  			ieee80211_free_txskb(sc->hw, skb);
  			continue;
-@@ -952,8 +964,19 @@ ath_tx_get_tid_subframe(struct ath_softc
+@@ -937,8 +949,20 @@ ath_tx_get_tid_subframe(struct ath_softc
  		seqno = bf->bf_state.seqno;
  
  		/* do not step over block-ack window */
@@ -480,7 +481,8 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
 +			/* If there are other skbs in the retry q, they are
 +			 * probably within the BAW, so loop immediately to get
 +			 * one of them. Otherwise the queue can get stuck. */
-+			if (!skb_queue_is_first(&tid->retry_q, skb) && skb != first_skb) {
++			if (!skb_queue_is_first(&tid->retry_q, skb) &&
++			    !WARN_ON(skb == first_skb)) {
 +				if(!first_skb) /* infinite loop prevention */
 +					first_skb = skb;
 +				continue;
@@ -490,7 +492,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  
  		if (tid->bar_index > ATH_BA_INDEX(tid->seq_start, seqno)) {
  			struct ath_tx_status ts = {};
-@@ -961,7 +984,6 @@ ath_tx_get_tid_subframe(struct ath_softc
+@@ -946,7 +970,6 @@ ath_tx_get_tid_subframe(struct ath_softc
  
  			INIT_LIST_HEAD(&bf_head);
  			list_add(&bf->list, &bf_head);
@@ -498,7 +500,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  			ath_tx_update_baw(sc, tid, seqno);
  			ath_tx_complete_buf(sc, bf, txq, &bf_head, NULL, &ts, 0);
  			continue;
-@@ -973,11 +995,10 @@ ath_tx_get_tid_subframe(struct ath_softc
+@@ -958,11 +981,10 @@ ath_tx_get_tid_subframe(struct ath_softc
  	return NULL;
  }
  
@@ -512,7 +514,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  {
  #define PADBYTES(_len) ((4 - ((_len) % 4)) % 4)
  	struct ath_buf *bf = bf_first, *bf_prev = NULL;
-@@ -987,12 +1008,13 @@ ath_tx_form_aggr(struct ath_softc *sc, s
+@@ -972,12 +994,13 @@ ath_tx_form_aggr(struct ath_softc *sc, s
  	struct ieee80211_tx_info *tx_info;
  	struct ath_frame_info *fi;
  	struct sk_buff *skb;
@@ -528,7 +530,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  		skb = bf->bf_mpdu;
  		fi = get_frame_info(skb);
  
-@@ -1001,12 +1023,12 @@ ath_tx_form_aggr(struct ath_softc *sc, s
+@@ -986,12 +1009,12 @@ ath_tx_form_aggr(struct ath_softc *sc, s
  		if (nframes) {
  			if (aggr_limit < al + bpad + al_delta ||
  			    ath_lookup_legacy(bf) || nframes >= h_baw)
@@ -543,7 +545,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  		}
  
  		/* add padding for previous frame to aggregation length */
-@@ -1028,20 +1050,18 @@ ath_tx_form_aggr(struct ath_softc *sc, s
+@@ -1013,20 +1036,18 @@ ath_tx_form_aggr(struct ath_softc *sc, s
  			ath_tx_addto_baw(sc, tid, bf);
  		bf->bf_state.ndelim = ndelim;
  
@@ -570,7 +572,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  	bf = bf_first;
  	bf->bf_lastbf = bf_prev;
  
-@@ -1052,9 +1072,7 @@ ath_tx_form_aggr(struct ath_softc *sc, s
+@@ -1037,9 +1058,7 @@ ath_tx_form_aggr(struct ath_softc *sc, s
  		TX_STAT_INC(txq->axq_qnum, a_aggr);
  	}
  
@@ -581,7 +583,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  #undef PADBYTES
  }
  
-@@ -1431,18 +1449,15 @@ static void ath_tx_fill_desc(struct ath_
+@@ -1416,18 +1435,15 @@ static void ath_tx_fill_desc(struct ath_
  static void
  ath_tx_form_burst(struct ath_softc *sc, struct ath_txq *txq,
  		  struct ath_atx_tid *tid, struct list_head *bf_q,
@@ -601,7 +603,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  		list_add_tail(&bf->list, bf_q);
  		if (bf_prev)
  			bf_prev->bf_next = bf;
-@@ -1451,13 +1466,15 @@ ath_tx_form_burst(struct ath_softc *sc,
+@@ -1436,13 +1452,15 @@ ath_tx_form_burst(struct ath_softc *sc,
  		if (nframes >= 2)
  			break;
  
@@ -617,9 +619,9 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  			break;
 +		}
  
- 		ath_set_rates(tid->an->vif, tid->an->sta, bf, false);
+ 		ath_set_rates(tid->an->vif, tid->an->sta, bf);
  	} while (1);
-@@ -1468,34 +1485,33 @@ static bool ath_tx_sched_aggr(struct ath
+@@ -1453,34 +1471,33 @@ static bool ath_tx_sched_aggr(struct ath
  {
  	struct ath_buf *bf;
  	struct ieee80211_tx_info *tx_info;
@@ -649,7 +651,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  		return false;
  	}
  
- 	ath_set_rates(tid->an->vif, tid->an->sta, bf, false);
+ 	ath_set_rates(tid->an->vif, tid->an->sta, bf);
  	if (aggr)
 -		last = ath_tx_form_aggr(sc, txq, tid, &bf_q, bf,
 -					tid_q, &aggr_len);
@@ -660,7 +662,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  
  	if (list_empty(&bf_q))
  		return false;
-@@ -1538,9 +1554,6 @@ int ath_tx_aggr_start(struct ath_softc *
+@@ -1523,9 +1540,6 @@ int ath_tx_aggr_start(struct ath_softc *
  		an->mpdudensity = density;
  	}
  
@@ -670,7 +672,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  	txtid->active = true;
  	*ssn = txtid->seq_start = txtid->seq_next;
  	txtid->bar_index = -1;
-@@ -1565,7 +1578,6 @@ void ath_tx_aggr_stop(struct ath_softc *
+@@ -1550,7 +1564,6 @@ void ath_tx_aggr_stop(struct ath_softc *
  	ath_txq_lock(sc, txq);
  	txtid->active = false;
  	ath_tx_flush_tid(sc, txtid);
@@ -678,7 +680,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  	ath_txq_unlock_complete(sc, txq);
  }
  
-@@ -1575,14 +1587,12 @@ void ath_tx_aggr_sleep(struct ieee80211_
+@@ -1560,14 +1573,12 @@ void ath_tx_aggr_sleep(struct ieee80211_
  	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
  	struct ath_atx_tid *tid;
  	struct ath_txq *txq;
@@ -695,7 +697,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  		txq = tid->txq;
  
  		ath_txq_lock(sc, txq);
-@@ -1592,13 +1602,12 @@ void ath_tx_aggr_sleep(struct ieee80211_
+@@ -1577,13 +1588,12 @@ void ath_tx_aggr_sleep(struct ieee80211_
  			continue;
  		}
  
@@ -711,7 +713,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  	}
  }
  
-@@ -1611,49 +1620,20 @@ void ath_tx_aggr_wakeup(struct ath_softc
+@@ -1596,49 +1606,20 @@ void ath_tx_aggr_wakeup(struct ath_softc
  
  	ath_dbg(common, XMIT, "%s called\n", __func__);
  
@@ -763,7 +765,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
  				   struct ieee80211_sta *sta,
  				   u16 tids, int nframes,
-@@ -1666,7 +1646,6 @@ void ath9k_release_buffered_frames(struc
+@@ -1651,7 +1632,6 @@ void ath9k_release_buffered_frames(struc
  	struct ieee80211_tx_info *info;
  	struct list_head bf_q;
  	struct ath_buf *bf_tail = NULL, *bf;
@@ -771,7 +773,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  	int sent = 0;
  	int i;
  
-@@ -1681,11 +1660,10 @@ void ath9k_release_buffered_frames(struc
+@@ -1666,11 +1646,10 @@ void ath9k_release_buffered_frames(struc
  
  		ath_txq_lock(sc, tid->txq);
  		while (nframes > 0) {
@@ -782,9 +784,9 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  
 -			__skb_unlink(bf->bf_mpdu, tid_q);
  			list_add_tail(&bf->list, &bf_q);
- 			ath_set_rates(tid->an->vif, tid->an->sta, bf, true);
+ 			ath_set_rates(tid->an->vif, tid->an->sta, bf);
  			if (bf_isampdu(bf)) {
-@@ -1700,7 +1678,7 @@ void ath9k_release_buffered_frames(struc
+@@ -1685,7 +1664,7 @@ void ath9k_release_buffered_frames(struc
  			sent++;
  			TX_STAT_INC(txq->axq_qnum, a_queued_hw);
  
@@ -793,7 +795,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  				ieee80211_sta_set_buffered(an->sta, i, false);
  		}
  		ath_txq_unlock_complete(sc, tid->txq);
-@@ -1929,13 +1907,7 @@ bool ath_drain_all_txq(struct ath_softc
+@@ -1914,13 +1893,7 @@ bool ath_drain_all_txq(struct ath_softc
  		if (!ATH_TXQ_SETUP(sc, i))
  			continue;
  
@@ -807,13 +809,13 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  		ath_draintxq(sc, txq);
  	}
  
-@@ -2334,16 +2306,14 @@ int ath_tx_start(struct ieee80211_hw *hw
+@@ -2319,16 +2292,14 @@ int ath_tx_start(struct ieee80211_hw *hw
  	struct ath_softc *sc = hw->priv;
  	struct ath_txq *txq = txctl->txq;
  	struct ath_atx_tid *tid = NULL;
 +	struct ath_node *an = NULL;
  	struct ath_buf *bf;
--	bool queue, ps_resp;
+-	bool queue, skip_uapsd = false, ps_resp;
 +	bool ps_resp;
  	int q, ret;
  
@@ -826,7 +828,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  	ps_resp = !!(info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE);
  
  	ret = ath_tx_prepare(hw, skb, txctl);
-@@ -2358,63 +2328,18 @@ int ath_tx_start(struct ieee80211_hw *hw
+@@ -2343,63 +2314,18 @@ int ath_tx_start(struct ieee80211_hw *hw
  
  	q = skb_get_queue_mapping(skb);
  
@@ -860,13 +862,13 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
 -		if (!txctl->an)
 -			txctl->an = &avp->mcast_node;
 -		queue = true;
--		ps_resp = false;
+-		skip_uapsd = true;
 -	}
 -
 -	if (txctl->an && queue)
 -		tid = ath_get_skb_tid(sc, txctl->an, skb);
 -
--	if (ps_resp) {
+-	if (!skip_uapsd && ps_resp) {
 -		ath_txq_unlock(sc, txq);
 +	if (ps_resp)
  		txq = sc->tx.uapsdq;
@@ -899,7 +901,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  	}
  
  	bf = ath_tx_setup_buffer(sc, txq, tid, skb);
-@@ -2907,9 +2832,8 @@ void ath_tx_node_init(struct ath_softc *
+@@ -2892,9 +2818,8 @@ void ath_tx_node_init(struct ath_softc *
  	struct ath_atx_tid *tid;
  	int tidno, acno;
  
@@ -911,7 +913,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  		tid->an        = an;
  		tid->tidno     = tidno;
  		tid->seq_start = tid->seq_next = 0;
-@@ -2917,11 +2841,14 @@ void ath_tx_node_init(struct ath_softc *
+@@ -2902,11 +2827,14 @@ void ath_tx_node_init(struct ath_softc *
  		tid->baw_head  = tid->baw_tail = 0;
  		tid->active	   = false;
  		tid->clear_ps_filter = true;
@@ -927,7 +929,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  	}
  }
  
-@@ -2931,9 +2858,8 @@ void ath_tx_node_cleanup(struct ath_soft
+@@ -2916,9 +2844,8 @@ void ath_tx_node_cleanup(struct ath_soft
  	struct ath_txq *txq;
  	int tidno;
  
@@ -939,7 +941,7 @@ Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  		txq = tid->txq;
  
  		ath_txq_lock(sc, txq);
-@@ -2945,6 +2871,9 @@ void ath_tx_node_cleanup(struct ath_soft
+@@ -2930,6 +2857,9 @@ void ath_tx_node_cleanup(struct ath_soft
  		tid->active = false;
  
  		ath_txq_unlock(sc, txq);
diff --git a/package/kernel/mac80211/patches/300-ath9k-force-rx_clear-when-disabling-rx.patch b/package/kernel/mac80211/patches/301-ath9k-force-rx_clear-when-disabling-rx.patch
similarity index 100%
rename from package/kernel/mac80211/patches/300-ath9k-force-rx_clear-when-disabling-rx.patch
rename to package/kernel/mac80211/patches/301-ath9k-force-rx_clear-when-disabling-rx.patch
diff --git a/package/kernel/mac80211/patches/301-ath9k-limit-retries-for-powersave-response-frames.patch b/package/kernel/mac80211/patches/302-ath9k-limit-retries-for-powersave-response-frames.patch
similarity index 66%
rename from package/kernel/mac80211/patches/301-ath9k-limit-retries-for-powersave-response-frames.patch
rename to package/kernel/mac80211/patches/302-ath9k-limit-retries-for-powersave-response-frames.patch
index a160dc4f02..8c19ea22f4 100644
--- a/package/kernel/mac80211/patches/301-ath9k-limit-retries-for-powersave-response-frames.patch
+++ b/package/kernel/mac80211/patches/302-ath9k-limit-retries-for-powersave-response-frames.patch
@@ -13,7 +13,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 
 --- a/drivers/net/wireless/ath/ath9k/xmit.c
 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -136,10 +136,25 @@ static void ath_send_bar(struct ath_atx_
+@@ -177,10 +177,25 @@ static void ath_send_bar(struct ath_atx_
  }
  
  static void ath_set_rates(struct ieee80211_vif *vif, struct ieee80211_sta *sta,
@@ -40,59 +40,34 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  }
  
  static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
-@@ -1419,7 +1434,7 @@ ath_tx_form_burst(struct ath_softc *sc,
- 		if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
+@@ -1462,7 +1477,7 @@ ath_tx_form_burst(struct ath_softc *sc,
  			break;
+ 		}
  
 -		ath_set_rates(tid->an->vif, tid->an->sta, bf);
 +		ath_set_rates(tid->an->vif, tid->an->sta, bf, false);
  	} while (1);
  }
  
-@@ -1450,7 +1465,7 @@ static bool ath_tx_sched_aggr(struct ath
+@@ -1493,7 +1508,7 @@ static bool ath_tx_sched_aggr(struct ath
  		return false;
  	}
  
 -	ath_set_rates(tid->an->vif, tid->an->sta, bf);
 +	ath_set_rates(tid->an->vif, tid->an->sta, bf, false);
  	if (aggr)
- 		last = ath_tx_form_aggr(sc, txq, tid, &bf_q, bf,
- 					tid_q, &aggr_len);
-@@ -1647,7 +1662,7 @@ void ath9k_release_buffered_frames(struc
+ 		aggr_len = ath_tx_form_aggr(sc, txq, tid, &bf_q, bf);
+ 	else
+@@ -1651,7 +1666,7 @@ void ath9k_release_buffered_frames(struc
+ 				break;
  
- 			__skb_unlink(bf->bf_mpdu, tid_q);
  			list_add_tail(&bf->list, &bf_q);
 -			ath_set_rates(tid->an->vif, tid->an->sta, bf);
 +			ath_set_rates(tid->an->vif, tid->an->sta, bf, true);
  			if (bf_isampdu(bf)) {
  				ath_tx_addto_baw(sc, tid, bf);
  				bf->bf_state.bf_type &= ~BUF_AGGR;
-@@ -2293,7 +2308,7 @@ int ath_tx_start(struct ieee80211_hw *hw
- 	struct ath_txq *txq = txctl->txq;
- 	struct ath_atx_tid *tid = NULL;
- 	struct ath_buf *bf;
--	bool queue, skip_uapsd = false, ps_resp;
-+	bool queue, ps_resp;
- 	int q, ret;
- 
- 	if (vif)
-@@ -2346,13 +2361,13 @@ int ath_tx_start(struct ieee80211_hw *hw
- 		if (!txctl->an)
- 			txctl->an = &avp->mcast_node;
- 		queue = true;
--		skip_uapsd = true;
-+		ps_resp = false;
- 	}
- 
- 	if (txctl->an && queue)
- 		tid = ath_get_skb_tid(sc, txctl->an, skb);
- 
--	if (!skip_uapsd && ps_resp) {
-+	if (ps_resp) {
- 		ath_txq_unlock(sc, txq);
- 		txq = sc->tx.uapsdq;
- 		ath_txq_lock(sc, txq);
-@@ -2390,7 +2405,7 @@ int ath_tx_start(struct ieee80211_hw *hw
+@@ -2343,7 +2358,7 @@ int ath_tx_start(struct ieee80211_hw *hw
  	if (txctl->paprd)
  		bf->bf_state.bfs_paprd_timestamp = jiffies;
  
@@ -101,7 +76,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	ath_tx_send_normal(sc, txq, tid, skb);
  
  out:
-@@ -2429,7 +2444,7 @@ void ath_tx_cabq(struct ieee80211_hw *hw
+@@ -2382,7 +2397,7 @@ void ath_tx_cabq(struct ieee80211_hw *hw
  			break;
  
  		bf->bf_lastbf = bf;
@@ -110,7 +85,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		ath_buf_set_rate(sc, bf, &info, fi->framelen, false);
  		duration += info.rates[0].PktDuration;
  		if (bf_tail)
-@@ -2932,7 +2947,7 @@ int ath9k_tx99_send(struct ath_softc *sc
+@@ -2898,7 +2913,7 @@ int ath9k_tx99_send(struct ath_softc *sc
  		return -EINVAL;
  	}
  
diff --git a/package/kernel/mac80211/patches/302-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch b/package/kernel/mac80211/patches/303-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
similarity index 89%
rename from package/kernel/mac80211/patches/302-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
rename to package/kernel/mac80211/patches/303-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
index 7caa9be5a8..57f45c1c93 100644
--- a/package/kernel/mac80211/patches/302-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
+++ b/package/kernel/mac80211/patches/303-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
@@ -8,7 +8,7 @@ This reverts commit 71f5137bf010c6faffab50c0ec15374c59c4a411.
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2914,7 +2914,8 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2910,7 +2910,8 @@ void ath9k_hw_apply_txpower(struct ath_h
  {
  	struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
  	struct ieee80211_channel *channel;
@@ -18,7 +18,7 @@ This reverts commit 71f5137bf010c6faffab50c0ec15374c59c4a411.
  
  	if (!chan)
  		return;
-@@ -2922,10 +2923,15 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2918,10 +2919,15 @@ void ath9k_hw_apply_txpower(struct ath_h
  	channel = chan->chan;
  	chan_pwr = min_t(int, channel->max_power * 2, MAX_RATE_POWER);
  	new_pwr = min_t(int, chan_pwr, reg->power_limit);
diff --git a/package/kernel/mac80211/patches/303-ath10k-Ensure-txrx-compl-task-is-stopped-when-cleani.patch b/package/kernel/mac80211/patches/303-ath10k-Ensure-txrx-compl-task-is-stopped-when-cleani.patch
deleted file mode 100644
index 73accd866b..0000000000
--- a/package/kernel/mac80211/patches/303-ath10k-Ensure-txrx-compl-task-is-stopped-when-cleani.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From: Ben Greear <greearb@candelatech.com>
-Date: Fri, 1 Apr 2016 14:12:08 -0700
-Subject: [PATCH] ath10k: Ensure txrx-compl-task is stopped when cleaning
- htt-tx.
-
-Otherwise, the txrx-compl-task may access some bad memory?
-
-Signed-off-by: Ben Greear <greearb@candelatech.com>
----
-
---- a/drivers/net/wireless/ath/ath10k/htt_tx.c
-+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
-@@ -388,6 +388,8 @@ void ath10k_htt_tx_free(struct ath10k_ht
- {
- 	int size;
- 
-+	tasklet_kill(&htt->txrx_compl_task);
-+
- 	idr_for_each(&htt->pending_tx, ath10k_htt_tx_clean_up_pending, htt->ar);
- 	idr_destroy(&htt->pending_tx);
- 
diff --git a/package/kernel/mac80211/patches/304-ath10k-Ensure-peer_map-references-are-cleaned-up.patch b/package/kernel/mac80211/patches/304-ath10k-Ensure-peer_map-references-are-cleaned-up.patch
deleted file mode 100644
index 7dec1fb55a..0000000000
--- a/package/kernel/mac80211/patches/304-ath10k-Ensure-peer_map-references-are-cleaned-up.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From: Ben Greear <greearb@candelatech.com>
-Date: Fri, 1 Apr 2016 14:12:09 -0700
-Subject: [PATCH] ath10k: Ensure peer_map references are cleaned up.
-
-While debugging OS crashes due to firmware crashes, I enabled
-kasan, and it noticed that peer objects were being used-after-freed.
-
-Looks like there are two places we could be leaving stale references
-in the peer-map, so clean that up.
-
-Signed-off-by: Ben Greear <greearb@candelatech.com>
----
-
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -802,6 +802,7 @@ static void ath10k_peer_cleanup(struct a
- {
- 	struct ath10k_peer *peer, *tmp;
- 	int peer_id;
-+	int i;
- 
- 	lockdep_assert_held(&ar->conf_mutex);
- 
-@@ -818,6 +819,17 @@ static void ath10k_peer_cleanup(struct a
- 			ar->peer_map[peer_id] = NULL;
- 		}
- 
-+		/* Double check that peer is properly un-referenced from
-+		 * the peer_map
-+		 */
-+		for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) {
-+			if (ar->peer_map[i] == peer) {
-+				ath10k_warn(ar, "removing stale peer_map entry for %pM (ptr %p idx %d)\n",
-+					    peer->addr, peer, i);
-+				ar->peer_map[i] = NULL;
-+			}
-+		}
-+
- 		list_del(&peer->list);
- 		kfree(peer);
- 		ar->num_peers--;
-@@ -828,6 +840,7 @@ static void ath10k_peer_cleanup(struct a
- static void ath10k_peer_cleanup_all(struct ath10k *ar)
- {
- 	struct ath10k_peer *peer, *tmp;
-+	int i;
- 
- 	lockdep_assert_held(&ar->conf_mutex);
- 
-@@ -836,6 +849,10 @@ static void ath10k_peer_cleanup_all(stru
- 		list_del(&peer->list);
- 		kfree(peer);
- 	}
-+
-+	for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++)
-+		ar->peer_map[i] = NULL;
-+
- 	spin_unlock_bh(&ar->data_lock);
- 
- 	ar->num_peers = 0;
diff --git a/package/kernel/mac80211/patches/306-mac80211-add-hdrlen-to-ieee80211_tx_data.patch b/package/kernel/mac80211/patches/304-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
similarity index 87%
rename from package/kernel/mac80211/patches/306-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
rename to package/kernel/mac80211/patches/304-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
index 4a8f143946..72e81ee1b0 100644
--- a/package/kernel/mac80211/patches/306-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
+++ b/package/kernel/mac80211/patches/304-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
@@ -11,7 +11,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -173,6 +173,7 @@ struct ieee80211_tx_data {
+@@ -175,6 +175,7 @@ struct ieee80211_tx_data {
  	struct ieee80211_tx_rate rate;
  
  	unsigned int flags;
@@ -21,7 +21,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -922,7 +922,7 @@ ieee80211_tx_h_fragment(struct ieee80211
+@@ -955,7 +955,7 @@ ieee80211_tx_h_fragment(struct ieee80211
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  	struct ieee80211_hdr *hdr = (void *)skb->data;
  	int frag_threshold = tx->local->hw.wiphy->frag_threshold;
@@ -30,7 +30,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	int fragnum;
  
  	/* no matter what happens, tx->skb moves to tx->skbs */
-@@ -943,8 +943,6 @@ ieee80211_tx_h_fragment(struct ieee80211
+@@ -976,8 +976,6 @@ ieee80211_tx_h_fragment(struct ieee80211
  	if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
  		return TX_DROP;
  
@@ -39,7 +39,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	/* internal error, why isn't DONTFRAG set? */
  	if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
  		return TX_DROP;
-@@ -1176,6 +1174,8 @@ ieee80211_tx_prepare(struct ieee80211_su
+@@ -1209,6 +1207,8 @@ ieee80211_tx_prepare(struct ieee80211_su
  
  	hdr = (struct ieee80211_hdr *) skb->data;
  
@@ -48,9 +48,25 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	if (likely(sta)) {
  		if (!IS_ERR(sta))
  			tx->sta = sta;
+@@ -3414,6 +3414,7 @@ begin:
+ 	tx.local = local;
+ 	tx.skb = skb;
+ 	tx.sdata = vif_to_sdata(info->control.vif);
++	tx.hdrlen = ieee80211_padded_hdrlen(hw, hdr->frame_control);
+ 
+ 	if (txq->sta)
+ 		tx.sta = container_of(txq->sta, struct sta_info, sta);
+@@ -3584,6 +3585,7 @@ ieee80211_build_data_template(struct iee
+ 	hdr = (void *)skb->data;
+ 	tx.sta = sta_info_get(sdata, hdr->addr1);
+ 	tx.skb = skb;
++	tx.hdrlen = ieee80211_padded_hdrlen(&tx.local->hw, hdr->frame_control);
+ 
+ 	if (ieee80211_tx_h_select_key(&tx) != TX_CONTINUE) {
+ 		rcu_read_unlock();
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -1226,6 +1226,7 @@ void ieee80211_send_auth(struct ieee8021
+@@ -1227,6 +1227,7 @@ void ieee80211_send_auth(struct ieee8021
  	struct ieee80211_local *local = sdata->local;
  	struct sk_buff *skb;
  	struct ieee80211_mgmt *mgmt;
@@ -58,7 +74,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	int err;
  
  	/* 24 + 6 = header + auth_algo + auth_transaction + status_code */
-@@ -1250,8 +1251,10 @@ void ieee80211_send_auth(struct ieee8021
+@@ -1251,8 +1252,10 @@ void ieee80211_send_auth(struct ieee8021
  		memcpy(skb_put(skb, extra_len), extra, extra_len);
  
  	if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) {
diff --git a/package/kernel/mac80211/patches/305-ath10k-Clean-up-peer-when-sta-goes-away.patch b/package/kernel/mac80211/patches/305-ath10k-Clean-up-peer-when-sta-goes-away.patch
deleted file mode 100644
index 7248a8cecf..0000000000
--- a/package/kernel/mac80211/patches/305-ath10k-Clean-up-peer-when-sta-goes-away.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From: Ben Greear <greearb@candelatech.com>
-Date: Fri, 1 Apr 2016 14:12:11 -0700
-Subject: [PATCH] ath10k: Clean up peer when sta goes away.
-
-If WMI and/or firmware has issues removing the peer object,
-then we still need to clean up the peer object in the driver.
-
-Signed-off-by: Ben Greear <greearb@candelatech.com>
----
-
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -5992,9 +5992,17 @@ static int ath10k_sta_state(struct ieee8
- 				continue;
- 
- 			if (peer->sta == sta) {
--				ath10k_warn(ar, "found sta peer %pM entry on vdev %i after it was supposedly removed\n",
--					    sta->addr, arvif->vdev_id);
-+				ath10k_warn(ar, "found sta peer %pM (ptr %p id %d) entry on vdev %i after it was supposedly removed\n",
-+					    sta->addr, peer, i, arvif->vdev_id);
- 				peer->sta = NULL;
-+
-+				/* Clean up the peer object as well since we
-+				 * must have failed to do this above.
-+				 */
-+				list_del(&peer->list);
-+				ar->peer_map[i] = NULL;
-+				kfree(peer);
-+				ar->num_peers--;
- 			}
- 		}
- 		spin_unlock_bh(&ar->data_lock);
diff --git a/package/kernel/mac80211/patches/307-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch b/package/kernel/mac80211/patches/305-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
similarity index 80%
rename from package/kernel/mac80211/patches/307-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
rename to package/kernel/mac80211/patches/305-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
index eeb881e030..508cc92411 100644
--- a/package/kernel/mac80211/patches/307-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
+++ b/package/kernel/mac80211/patches/305-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
@@ -23,9 +23,9 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2014,6 +2014,9 @@ struct ieee80211_txq {
-  * @IEEE80211_HW_TX_FRAG_LIST: Hardware (or driver) supports sending frag_list
-  *	skbs, needed for zero-copy software A-MSDU.
+@@ -2025,6 +2025,9 @@ struct ieee80211_txq {
+  *	drivers, mac80211 packet loss mechanism will not be triggered and driver
+  *	is completely depending on firmware event for station kickout.
   *
 + * @IEEE80211_HW_NEEDS_ALIGNED4_SKBS: Driver need aligned skbs to four-byte.
 + *	Padding will be added after ieee80211_hdr, before IV/LLC.
@@ -33,27 +33,27 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2054,6 +2057,7 @@ enum ieee80211_hw_flags {
- 	IEEE80211_HW_USES_RSS,
+@@ -2066,6 +2069,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_TX_AMSDU,
  	IEEE80211_HW_TX_FRAG_LIST,
+ 	IEEE80211_HW_REPORTS_LOW_ACK,
 +	IEEE80211_HW_NEEDS_ALIGNED4_SKBS,
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
 --- a/net/mac80211/debugfs.c
 +++ b/net/mac80211/debugfs.c
-@@ -302,6 +302,7 @@ static const char *hw_flag_names[] = {
- 	FLAG(USES_RSS),
+@@ -210,6 +210,7 @@ static const char *hw_flag_names[] = {
  	FLAG(TX_AMSDU),
  	FLAG(TX_FRAG_LIST),
+ 	FLAG(REPORTS_LOW_ACK),
 +	FLAG(NEEDS_ALIGNED4_SKBS),
  #undef FLAG
  };
  
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1497,6 +1497,29 @@ ieee80211_have_rx_timestamp(struct ieee8
+@@ -1529,6 +1529,29 @@ ieee80211_have_rx_timestamp(struct ieee8
  	return false;
  }
  
@@ -85,7 +85,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  				     unsigned int mpdu_len,
 --- a/net/mac80211/sta_info.h
 +++ b/net/mac80211/sta_info.h
-@@ -279,7 +279,7 @@ struct ieee80211_fast_tx {
+@@ -282,7 +282,7 @@ struct ieee80211_fast_tx {
  	u8 hdr_len;
  	u8 sa_offs, da_offs, pn_offs;
  	u8 band;
@@ -96,7 +96,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	struct rcu_head rcu_head;
 --- a/net/mac80211/status.c
 +++ b/net/mac80211/status.c
-@@ -683,9 +683,22 @@ void ieee80211_tx_monitor(struct ieee802
+@@ -689,9 +689,22 @@ void ieee80211_tx_monitor(struct ieee802
  	struct sk_buff *skb2;
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  	struct ieee80211_sub_if_data *sdata;
@@ -137,7 +137,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -1173,8 +1173,7 @@ ieee80211_tx_prepare(struct ieee80211_su
+@@ -1206,8 +1206,7 @@ ieee80211_tx_prepare(struct ieee80211_su
  	info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING;
  
  	hdr = (struct ieee80211_hdr *) skb->data;
@@ -147,7 +147,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  
  	if (likely(sta)) {
  		if (!IS_ERR(sta))
-@@ -2108,7 +2107,7 @@ netdev_tx_t ieee80211_monitor_start_xmit
+@@ -2158,7 +2157,7 @@ netdev_tx_t ieee80211_monitor_start_xmit
  		goto fail;
  
  	hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
@@ -156,7 +156,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  
  	if (skb->len < len_rthdr + hdrlen)
  		goto fail;
-@@ -2334,7 +2333,7 @@ static struct sk_buff *ieee80211_build_h
+@@ -2376,7 +2375,7 @@ static struct sk_buff *ieee80211_build_h
  	struct ieee80211_chanctx_conf *chanctx_conf;
  	struct ieee80211_sub_if_data *ap_sdata;
  	enum nl80211_band band;
@@ -165,7 +165,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  
  	if (IS_ERR(sta))
  		sta = NULL;
-@@ -2554,6 +2553,9 @@ static struct sk_buff *ieee80211_build_h
+@@ -2596,6 +2595,9 @@ static struct sk_buff *ieee80211_build_h
  		hdrlen += 2;
  	}
  
@@ -175,16 +175,16 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	/*
  	 * Drop unicast frames to unauthorised stations unless they are
  	 * EAPOL frames from the local station.
-@@ -2640,6 +2642,7 @@ static struct sk_buff *ieee80211_build_h
- 	h_pos -= skip_header_bytes;
+@@ -2676,6 +2678,7 @@ static struct sk_buff *ieee80211_build_h
  
+ 	skb_pull(skb, skip_header_bytes);
  	head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
 +	head_need += padsize;
  
  	/*
  	 * So we need to modify the skb header and hence need a copy of
-@@ -2678,6 +2681,9 @@ static struct sk_buff *ieee80211_build_h
- 	}
+@@ -2708,6 +2711,9 @@ static struct sk_buff *ieee80211_build_h
+ 		memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
  #endif
  
 +	if (padsize)
@@ -193,18 +193,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	if (ieee80211_is_data_qos(fc)) {
  		__le16 *qos_control;
  
-@@ -2691,8 +2697,8 @@ static struct sk_buff *ieee80211_build_h
- 	} else
- 		memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);
- 
--	nh_pos += hdrlen;
--	h_pos += hdrlen;
-+	nh_pos += hdrlen + padsize;
-+	h_pos += hdrlen + padsize;
- 
- 	/* Update skb pointers to various headers since this modified frame
- 	 * is going to go through Linux networking code that may potentially
-@@ -2861,6 +2867,9 @@ void ieee80211_check_fast_xmit(struct st
+@@ -2883,6 +2889,9 @@ void ieee80211_check_fast_xmit(struct st
  		fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
  	}
  
@@ -216,7 +205,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	 * this function after doing so. For a single CPU that would be enough,
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -1224,6 +1224,7 @@ void ieee80211_send_auth(struct ieee8021
+@@ -1225,6 +1225,7 @@ void ieee80211_send_auth(struct ieee8021
  			 u32 tx_flags)
  {
  	struct ieee80211_local *local = sdata->local;
@@ -224,7 +213,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	struct sk_buff *skb;
  	struct ieee80211_mgmt *mgmt;
  	unsigned int hdrlen;
-@@ -1251,7 +1252,7 @@ void ieee80211_send_auth(struct ieee8021
+@@ -1252,7 +1253,7 @@ void ieee80211_send_auth(struct ieee8021
  		memcpy(skb_put(skb, extra_len), extra, extra_len);
  
  	if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) {
diff --git a/package/kernel/mac80211/patches/310-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch b/package/kernel/mac80211/patches/306-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
similarity index 97%
rename from package/kernel/mac80211/patches/310-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
rename to package/kernel/mac80211/patches/306-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
index 25929c9813..6e7ecb9c4d 100644
--- a/package/kernel/mac80211/patches/310-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
+++ b/package/kernel/mac80211/patches/306-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
@@ -10,7 +10,7 @@ Signed-off-by: Chaitanya TK <chaitanya.mgit@gmail.com>
 
 --- a/include/linux/ieee80211.h
 +++ b/include/linux/ieee80211.h
-@@ -1550,6 +1550,7 @@ struct ieee80211_vht_operation {
+@@ -1551,6 +1551,7 @@ struct ieee80211_vht_operation {
  #define IEEE80211_VHT_CAP_RXSTBC_3				0x00000300
  #define IEEE80211_VHT_CAP_RXSTBC_4				0x00000400
  #define IEEE80211_VHT_CAP_RXSTBC_MASK				0x00000700
diff --git a/package/kernel/mac80211/patches/339-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch b/package/kernel/mac80211/patches/307-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
similarity index 86%
rename from package/kernel/mac80211/patches/339-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
rename to package/kernel/mac80211/patches/307-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
index 49b37e407b..4fc6dc1ec3 100644
--- a/package/kernel/mac80211/patches/339-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
+++ b/package/kernel/mac80211/patches/307-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
@@ -7,10 +7,11 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/xmit.c
 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -1634,6 +1634,21 @@ void ath_tx_aggr_wakeup(struct ath_softc
+@@ -1635,6 +1635,22 @@ void ath_tx_aggr_wakeup(struct ath_softc
  	}
  }
  
++
 +static void
 +ath9k_set_moredata(struct ath_softc *sc, struct ath_buf *bf, bool val)
 +{
@@ -29,7 +30,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
  				   struct ieee80211_sta *sta,
  				   u16 tids, int nframes,
-@@ -1664,6 +1679,7 @@ void ath9k_release_buffered_frames(struc
+@@ -1665,6 +1681,7 @@ void ath9k_release_buffered_frames(struc
  			if (!bf)
  				break;
  
@@ -37,7 +38,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			list_add_tail(&bf->list, &bf_q);
  			ath_set_rates(tid->an->vif, tid->an->sta, bf, true);
  			if (bf_isampdu(bf)) {
-@@ -1687,6 +1703,9 @@ void ath9k_release_buffered_frames(struc
+@@ -1688,6 +1705,9 @@ void ath9k_release_buffered_frames(struc
  	if (list_empty(&bf_q))
  		return;
  
diff --git a/package/kernel/mac80211/patches/308-ath10k-Fix-sending-NULL-Qos-NULL-data-frames-for-QCA.patch b/package/kernel/mac80211/patches/308-ath10k-Fix-sending-NULL-Qos-NULL-data-frames-for-QCA.patch
deleted file mode 100644
index 8590aadabe..0000000000
--- a/package/kernel/mac80211/patches/308-ath10k-Fix-sending-NULL-Qos-NULL-data-frames-for-QCA.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
-Date: Thu, 23 Jun 2016 22:10:01 +0530
-Subject: [PATCH] ath10k: Fix sending NULL/ Qos NULL data frames for
- QCA99X0 and later
-
-For chipsets like QCA99X0, IPQ4019 and later we are not getting proper
-NULL func status (always acked/successs !!) when hostapd does a
-PROBE_CLIENT via nullfunc frames when the station is powered off
-abruptly (inactive timer probes client via null func after the inactive
-time reaches beyond the threshold). Fix this by disabling the workaround
-(getting the ACK status of NULL func frames by sending via HTT mgmt-tx
- path) introduced by the change ("ath10k: fix beacon loss handling ")
-for QCA99X0 and later chipsets. The normal tx path provides the proper
-ACK status for NULL data frames. As of now disable this workaround for
-chipsets QCA99X0 and later, once the 10.1 firmware is obselete we can
-completely get rid of this workaround for all the chipsets
-
-Signed-off-by: Tamizh chelvam <c_traja@qti.qualcomm.com>
-Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
----
-
---- a/drivers/net/wireless/ath/ath10k/core.c
-+++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -181,6 +181,7 @@ static const struct ath10k_hw_params ath
- 			.board = QCA99X0_HW_2_0_BOARD_DATA_FILE,
- 			.board_size = QCA99X0_BOARD_DATA_SZ,
- 			.board_ext_size = QCA99X0_BOARD_EXT_DATA_SZ,
-+			.disable_null_func_workaround = true,
- 		},
- 	},
- 	{
-@@ -204,6 +205,7 @@ static const struct ath10k_hw_params ath
- 			.board = QCA9984_HW_1_0_BOARD_DATA_FILE,
- 			.board_size = QCA99X0_BOARD_DATA_SZ,
- 			.board_ext_size = QCA99X0_BOARD_EXT_DATA_SZ,
-+			.disable_null_func_workaround = true,
- 		},
- 	},
- 	{
-@@ -262,6 +264,7 @@ static const struct ath10k_hw_params ath
- 			.board = QCA4019_HW_1_0_BOARD_DATA_FILE,
- 			.board_size = QCA4019_BOARD_DATA_SZ,
- 			.board_ext_size = QCA4019_BOARD_EXT_DATA_SZ,
-+			.disable_null_func_workaround = true,
- 		},
- 	},
- };
---- a/drivers/net/wireless/ath/ath10k/core.h
-+++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -750,6 +750,12 @@ struct ath10k {
- 			const char *board;
- 			size_t board_size;
- 			size_t board_ext_size;
-+			/* Workaround of sending NULL data frames via
-+			 * HTT mgmt TX and getting the proper ACK status does
-+			 * not works for chipsets QCA99X0 and later, while
-+			 * Tx data path reports the ACK status properly.
-+			 */
-+			bool disable_null_func_workaround;
- 		} fw;
- 	} hw_params;
- 
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -3253,6 +3253,7 @@ ath10k_mac_tx_h_get_txmode(struct ath10k
- 	 * mode though because AP don't sleep.
- 	 */
- 	if (ar->htt.target_version_major < 3 &&
-+	    !ar->hw_params.fw.disable_null_func_workaround &&
- 	    (ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) &&
- 	    !test_bit(ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX,
- 		      ar->running_fw->fw_file.fw_features))
diff --git a/package/kernel/mac80211/patches/340-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch b/package/kernel/mac80211/patches/308-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch
similarity index 100%
rename from package/kernel/mac80211/patches/340-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch
rename to package/kernel/mac80211/patches/308-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch
diff --git a/package/kernel/mac80211/patches/341-ath9k-report-tx-status-on-EOSP.patch b/package/kernel/mac80211/patches/309-ath9k-report-tx-status-on-EOSP.patch
similarity index 100%
rename from package/kernel/mac80211/patches/341-ath9k-report-tx-status-on-EOSP.patch
rename to package/kernel/mac80211/patches/309-ath9k-report-tx-status-on-EOSP.patch
diff --git a/package/kernel/mac80211/patches/309-cfg80211-fix-proto-in-ieee80211_data_to_8023-for-fra.patch b/package/kernel/mac80211/patches/309-cfg80211-fix-proto-in-ieee80211_data_to_8023-for-fra.patch
deleted file mode 100644
index 41c27cac41..0000000000
--- a/package/kernel/mac80211/patches/309-cfg80211-fix-proto-in-ieee80211_data_to_8023-for-fra.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 29 Jun 2016 10:02:32 +0200
-Subject: [PATCH] cfg80211: fix proto in ieee80211_data_to_8023 for frames
- without LLC header
-
-The PDU length of incoming LLC frames is set to the total skb payload size
-in __ieee80211_data_to_8023() of net/wireless/util.c which incorrectly
-includes the length of the IEEE 802.11 header.
-
-The resulting LLC frame header has a too large PDU length, causing the
-llc_fixup_skb() function of net/llc/llc_input.c to reject the incoming
-skb, effectively breaking STP.
-
-Solve the problem by properly substracting the IEEE 802.11 frame header size
-from the PDU length, allowing the LLC processor to pick up the incoming
-control messages.
-
-Special thanks to Gerry Rozema for tracking down the regression and proposing
-a suitable patch.
-
-Fixes: 2d1c304cb2d5 ("cfg80211: add function for 802.3 conversion with separate output buffer")
-Cc: stable@vger.kernel.org
-Reported-by: Gerry Rozema <gerryr@rozeware.com>
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -509,7 +509,7 @@ static int __ieee80211_data_to_8023(stru
- 		 * replace EtherType */
- 		hdrlen += ETH_ALEN + 2;
- 	else
--		tmp.h_proto = htons(skb->len);
-+		tmp.h_proto = htons(skb->len - hdrlen);
- 
- 	pskb_pull(skb, hdrlen);
- 
diff --git a/package/kernel/mac80211/patches/342-ath9k-fix-block-ack-window-tracking-issues.patch b/package/kernel/mac80211/patches/310-ath9k-fix-block-ack-window-tracking-issues.patch
similarity index 94%
rename from package/kernel/mac80211/patches/342-ath9k-fix-block-ack-window-tracking-issues.patch
rename to package/kernel/mac80211/patches/310-ath9k-fix-block-ack-window-tracking-issues.patch
index fea147b182..2993cbab74 100644
--- a/package/kernel/mac80211/patches/342-ath9k-fix-block-ack-window-tracking-issues.patch
+++ b/package/kernel/mac80211/patches/310-ath9k-fix-block-ack-window-tracking-issues.patch
@@ -75,7 +75,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  					ath_tx_complete_buf(sc, bf, txq,
  							    &bf_head, NULL, ts,
-@@ -986,11 +994,14 @@ ath_tx_get_tid_subframe(struct ath_softc
+@@ -987,11 +995,14 @@ ath_tx_get_tid_subframe(struct ath_softc
  
  			INIT_LIST_HEAD(&bf_head);
  			list_add(&bf->list, &bf_head);
@@ -91,7 +91,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		return bf;
  	}
  
-@@ -1048,8 +1059,6 @@ ath_tx_form_aggr(struct ath_softc *sc, s
+@@ -1049,8 +1060,6 @@ ath_tx_form_aggr(struct ath_softc *sc, s
  		bf->bf_next = NULL;
  
  		/* link buffers of this frame to the aggregate */
@@ -100,7 +100,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		bf->bf_state.ndelim = ndelim;
  
  		list_add_tail(&bf->list, bf_q);
-@@ -1684,10 +1693,8 @@ void ath9k_release_buffered_frames(struc
+@@ -1686,10 +1695,8 @@ void ath9k_release_buffered_frames(struc
  			ath9k_set_moredata(sc, bf, true);
  			list_add_tail(&bf->list, &bf_q);
  			ath_set_rates(tid->an->vif, tid->an->sta, bf, true);
diff --git a/package/kernel/mac80211/patches/311-ath10k-Add-support-for-160Mhz.patch b/package/kernel/mac80211/patches/311-ath10k-Add-support-for-160Mhz.patch
new file mode 100644
index 0000000000..372ce58772
--- /dev/null
+++ b/package/kernel/mac80211/patches/311-ath10k-Add-support-for-160Mhz.patch
@@ -0,0 +1,285 @@
+From: Ben Greear <greearb@candelatech.com>
+Date: Thu, 6 Oct 2016 17:34:14 -0700
+Subject: [PATCH] ath10k: Add support for 160Mhz.
+
+This patch was written by Sebastian Gottschall.
+
+Signed-off-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Sebastian Gottschall <s.gottschall@dd-wrt.com>
+---
+
+--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
+@@ -702,6 +702,10 @@ static void ath10k_htt_rx_h_rates(struct
+ 		/* 80MHZ */
+ 		case 2:
+ 			status->vht_flag |= RX_VHT_FLAG_80MHZ;
++			break;
++		case 3:
++			status->vht_flag |= RX_VHT_FLAG_160MHZ;
++			break;
+ 		}
+ 
+ 		status->flag |= RX_FLAG_VHT;
+@@ -926,7 +930,7 @@ static void ath10k_process_rx(struct ath
+ 	*status = *rx_status;
+ 
+ 	ath10k_dbg(ar, ATH10K_DBG_DATA,
+-		   "rx skb %pK len %u peer %pM %s %s sn %u %s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%llx fcs-err %i mic-err %i amsdu-more %i\n",
++		   "rx skb %pK len %u peer %pM %s %s sn %u %s%s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%llx fcs-err %i mic-err %i amsdu-more %i\n",
+ 		   skb,
+ 		   skb->len,
+ 		   ieee80211_get_SA(hdr),
+@@ -940,6 +944,7 @@ static void ath10k_process_rx(struct ath
+ 		   status->flag & RX_FLAG_VHT ? "vht" : "",
+ 		   status->flag & RX_FLAG_40MHZ ? "40" : "",
+ 		   status->vht_flag & RX_VHT_FLAG_80MHZ ? "80" : "",
++		   status->vht_flag & RX_VHT_FLAG_160MHZ ? "160" : "",
+ 		   status->flag & RX_FLAG_SHORT_GI ? "sgi " : "",
+ 		   status->rate_idx,
+ 		   status->vht_nss,
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -568,10 +568,14 @@ chan_to_phymode(const struct cfg80211_ch
+ 		case NL80211_CHAN_WIDTH_80:
+ 			phymode = MODE_11AC_VHT80;
+ 			break;
++		case NL80211_CHAN_WIDTH_160:
++			phymode = MODE_11AC_VHT160;
++			break;
++		case NL80211_CHAN_WIDTH_80P80:
++			phymode = MODE_11AC_VHT80_80;
++			break;
+ 		case NL80211_CHAN_WIDTH_5:
+ 		case NL80211_CHAN_WIDTH_10:
+-		case NL80211_CHAN_WIDTH_80P80:
+-		case NL80211_CHAN_WIDTH_160:
+ 			phymode = MODE_UNKNOWN;
+ 			break;
+ 		}
+@@ -970,6 +974,7 @@ static int ath10k_monitor_vdev_start(str
+ 	arg.vdev_id = vdev_id;
+ 	arg.channel.freq = channel->center_freq;
+ 	arg.channel.band_center_freq1 = chandef->center_freq1;
++	arg.channel.band_center_freq2 = chandef->center_freq2;
+ 
+ 	/* TODO setup this dynamically, what in case we
+ 	   don't have any vifs? */
+@@ -1381,6 +1386,7 @@ static int ath10k_vdev_start_restart(str
+ 
+ 	arg.channel.freq = chandef->chan->center_freq;
+ 	arg.channel.band_center_freq1 = chandef->center_freq1;
++	arg.channel.band_center_freq2 = chandef->center_freq2;
+ 	arg.channel.mode = chan_to_phymode(chandef);
+ 
+ 	arg.channel.min_power = 0;
+@@ -2444,6 +2450,9 @@ static void ath10k_peer_assoc_h_vht(stru
+ 	if (sta->bandwidth == IEEE80211_STA_RX_BW_80)
+ 		arg->peer_flags |= ar->wmi.peer_flags->bw80;
+ 
++	if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
++		arg->peer_flags |= ar->wmi.peer_flags->bw160;
++
+ 	arg->peer_vht_rates.rx_max_rate =
+ 		__le16_to_cpu(vht_cap->vht_mcs.rx_highest);
+ 	arg->peer_vht_rates.rx_mcs_set =
+@@ -2545,7 +2554,17 @@ static void ath10k_peer_assoc_h_phymode(
+ 		    !ath10k_peer_assoc_h_vht_masked(vht_mcs_mask)) {
+ 			if (sta->bandwidth == IEEE80211_STA_RX_BW_80)
+ 				phymode = MODE_11AC_VHT80;
+-			else if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
++			else if (sta->bandwidth == IEEE80211_STA_RX_BW_160) {
++				phymode = MODE_11AC_VHT160;
++				switch (sta->vht_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) {
++				case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ:
++					phymode = MODE_11AC_VHT160;
++				break;
++				case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ:
++					phymode = MODE_11AC_VHT80_80;
++				break;
++				}
++			} else if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
+ 				phymode = MODE_11AC_VHT40;
+ 			else if (sta->bandwidth == IEEE80211_STA_RX_BW_20)
+ 				phymode = MODE_11AC_VHT20;
+@@ -4277,6 +4296,10 @@ static struct ieee80211_sta_vht_cap ath1
+ 		vht_cap.cap |= val;
+ 	}
+ 
++	if ((ar->vht_cap_info & IEEE80211_VHT_CAP_SHORT_GI_160) && !(ar->vht_cap_info & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)) {
++		vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
++	}
++
+ 	mcs_map = 0;
+ 	for (i = 0; i < 8; i++) {
+ 		if ((i < ar->num_rf_chains) && (ar->cfg_tx_chainmask & BIT(i)))
+@@ -6913,6 +6936,9 @@ static void ath10k_sta_rc_update(struct
+ 			bw = WMI_PEER_CHWIDTH_80MHZ;
+ 			break;
+ 		case IEEE80211_STA_RX_BW_160:
++			bw = WMI_PEER_CHWIDTH_160MHZ;
++			break;
++		default:
+ 			ath10k_warn(ar, "Invalid bandwidth %d in rc update for %pM\n",
+ 				    sta->bandwidth, sta->addr);
+ 			bw = WMI_PEER_CHWIDTH_20MHZ;
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -3560,6 +3560,7 @@ static const struct wmi_peer_flags_map w
+ 	.vht = WMI_TLV_PEER_VHT,
+ 	.bw80 = WMI_TLV_PEER_80MHZ,
+ 	.pmf = WMI_TLV_PEER_PMF,
++	.bw160 = WMI_TLV_PEER_160MHZ,
+ };
+ 
+ /************/
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.h
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.h
+@@ -543,6 +543,7 @@ enum wmi_tlv_peer_flags {
+ 	WMI_TLV_PEER_VHT = 0x02000000,
+ 	WMI_TLV_PEER_80MHZ = 0x04000000,
+ 	WMI_TLV_PEER_PMF = 0x08000000,
++	WMI_TLV_PEER_160MHZ = 0x20000000,
+ };
+ 
+ enum wmi_tlv_tag {
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -1576,6 +1576,7 @@ static const struct wmi_peer_flags_map w
+ 	.bw80 = WMI_PEER_80MHZ,
+ 	.vht_2g = WMI_PEER_VHT_2G,
+ 	.pmf = WMI_PEER_PMF,
++	.bw160 = WMI_PEER_160MHZ,
+ };
+ 
+ static const struct wmi_peer_flags_map wmi_10x_peer_flags_map = {
+@@ -1593,6 +1594,7 @@ static const struct wmi_peer_flags_map w
+ 	.spatial_mux = WMI_10X_PEER_SPATIAL_MUX,
+ 	.vht = WMI_10X_PEER_VHT,
+ 	.bw80 = WMI_10X_PEER_80MHZ,
++	.bw160 = WMI_10X_PEER_160MHZ,
+ };
+ 
+ static const struct wmi_peer_flags_map wmi_10_2_peer_flags_map = {
+@@ -1612,6 +1614,7 @@ static const struct wmi_peer_flags_map w
+ 	.bw80 = WMI_10_2_PEER_80MHZ,
+ 	.vht_2g = WMI_10_2_PEER_VHT_2G,
+ 	.pmf = WMI_10_2_PEER_PMF,
++	.bw160 = WMI_10_2_PEER_160MHZ,
+ };
+ 
+ void ath10k_wmi_put_wmi_channel(struct wmi_channel *ch,
+@@ -1636,7 +1639,10 @@ void ath10k_wmi_put_wmi_channel(struct w
+ 
+ 	ch->mhz = __cpu_to_le32(arg->freq);
+ 	ch->band_center_freq1 = __cpu_to_le32(arg->band_center_freq1);
+-	ch->band_center_freq2 = 0;
++	if (arg->mode == MODE_11AC_VHT80_80)
++		ch->band_center_freq2 = __cpu_to_le32(arg->band_center_freq2);
++	else
++		ch->band_center_freq2 = 0;
+ 	ch->min_power = arg->min_power;
+ 	ch->max_power = arg->max_power;
+ 	ch->reg_power = arg->max_reg_power;
+--- a/drivers/net/wireless/ath/ath10k/wmi.h
++++ b/drivers/net/wireless/ath/ath10k/wmi.h
+@@ -1728,8 +1728,10 @@ enum wmi_phy_mode {
+ 	MODE_11AC_VHT20_2G = 11,
+ 	MODE_11AC_VHT40_2G = 12,
+ 	MODE_11AC_VHT80_2G = 13,
+-	MODE_UNKNOWN    = 14,
+-	MODE_MAX        = 14
++	MODE_11AC_VHT80_80 = 14,
++	MODE_11AC_VHT160 = 15,
++	MODE_UNKNOWN    = 16,
++	MODE_MAX        = 16
+ };
+ 
+ static inline const char *ath10k_wmi_phymode_str(enum wmi_phy_mode mode)
+@@ -1757,6 +1759,10 @@ static inline const char *ath10k_wmi_phy
+ 		return "11ac-vht40";
+ 	case MODE_11AC_VHT80:
+ 		return "11ac-vht80";
++	case MODE_11AC_VHT160:
++		return "11ac-vht160";
++	case MODE_11AC_VHT80_80:
++		return "11ac-vht80+80";
+ 	case MODE_11AC_VHT20_2G:
+ 		return "11ac-vht20-2g";
+ 	case MODE_11AC_VHT40_2G:
+@@ -1811,6 +1817,7 @@ struct wmi_channel {
+ struct wmi_channel_arg {
+ 	u32 freq;
+ 	u32 band_center_freq1;
++	u32 band_center_freq2;
+ 	bool passive;
+ 	bool allow_ibss;
+ 	bool allow_ht;
+@@ -1875,9 +1882,18 @@ enum wmi_channel_change_cause {
+ #define WMI_VHT_CAP_MAX_MPDU_LEN_MASK            0x00000003
+ #define WMI_VHT_CAP_RX_LDPC                      0x00000010
+ #define WMI_VHT_CAP_SGI_80MHZ                    0x00000020
++#define WMI_VHT_CAP_SGI_160MHZ                   0x00000040
+ #define WMI_VHT_CAP_TX_STBC                      0x00000080
+ #define WMI_VHT_CAP_RX_STBC_MASK                 0x00000300
+ #define WMI_VHT_CAP_RX_STBC_MASK_SHIFT           8
++#define WMI_VHT_CAP_SU_BFER                      0x00000800
++#define WMI_VHT_CAP_SU_BFEE                      0x00001000
++#define WMI_VHT_CAP_MAX_CS_ANT_MASK              0x0000E000
++#define WMI_VHT_CAP_MAX_CS_ANT_MASK_SHIFT        13
++#define WMI_VHT_CAP_MAX_SND_DIM_MASK             0x00070000
++#define WMI_VHT_CAP_MAX_SND_DIM_MASK_SHIFT       16
++#define WMI_VHT_CAP_MU_BFER                      0x00080000
++#define WMI_VHT_CAP_MU_BFEE                      0x00100000
+ #define WMI_VHT_CAP_MAX_AMPDU_LEN_EXP            0x03800000
+ #define WMI_VHT_CAP_MAX_AMPDU_LEN_EXP_SHIFT      23
+ #define WMI_VHT_CAP_RX_FIXED_ANT                 0x10000000
+@@ -1926,6 +1942,8 @@ enum {
+ 	REGDMN_MODE_11AC_VHT40PLUS   = 0x40000, /* 5Ghz, VHT40 + channels */
+ 	REGDMN_MODE_11AC_VHT40MINUS  = 0x80000, /* 5Ghz  VHT40 - channels */
+ 	REGDMN_MODE_11AC_VHT80       = 0x100000, /* 5Ghz, VHT80 channels */
++	REGDMN_MODE_11AC_VHT160      = 0x200000,     /* 5Ghz, VHT160 channels */
++	REGDMN_MODE_11AC_VHT80_80    = 0x400000,     /* 5Ghz, VHT80+80 channels */
+ 	REGDMN_MODE_ALL              = 0xffffffff
+ };
+ 
+@@ -5769,6 +5787,7 @@ enum wmi_peer_chwidth {
+ 	WMI_PEER_CHWIDTH_20MHZ = 0,
+ 	WMI_PEER_CHWIDTH_40MHZ = 1,
+ 	WMI_PEER_CHWIDTH_80MHZ = 2,
++	WMI_PEER_CHWIDTH_160MHZ = 3,
+ };
+ 
+ enum wmi_peer_param {
+@@ -5859,6 +5878,7 @@ struct wmi_peer_flags_map {
+ 	u32 bw80;
+ 	u32 vht_2g;
+ 	u32 pmf;
++	u32 bw160;
+ };
+ 
+ enum wmi_peer_flags {
+@@ -5878,6 +5898,7 @@ enum wmi_peer_flags {
+ 	WMI_PEER_80MHZ = 0x04000000,
+ 	WMI_PEER_VHT_2G = 0x08000000,
+ 	WMI_PEER_PMF = 0x10000000,
++	WMI_PEER_160MHZ = 0x20000000
+ };
+ 
+ enum wmi_10x_peer_flags {
+@@ -5895,6 +5916,7 @@ enum wmi_10x_peer_flags {
+ 	WMI_10X_PEER_SPATIAL_MUX = 0x00200000,
+ 	WMI_10X_PEER_VHT = 0x02000000,
+ 	WMI_10X_PEER_80MHZ = 0x04000000,
++	WMI_10X_PEER_160MHZ = 0x20000000
+ };
+ 
+ enum wmi_10_2_peer_flags {
+@@ -5914,6 +5936,7 @@ enum wmi_10_2_peer_flags {
+ 	WMI_10_2_PEER_80MHZ = 0x04000000,
+ 	WMI_10_2_PEER_VHT_2G = 0x08000000,
+ 	WMI_10_2_PEER_PMF = 0x10000000,
++	WMI_10_2_PEER_160MHZ = 0x20000000
+ };
+ 
+ /*
diff --git a/package/kernel/mac80211/patches/311-ath10k-disable-wake_tx_queue-for-older-devices.patch b/package/kernel/mac80211/patches/311-ath10k-disable-wake_tx_queue-for-older-devices.patch
deleted file mode 100644
index 4cf26a631f..0000000000
--- a/package/kernel/mac80211/patches/311-ath10k-disable-wake_tx_queue-for-older-devices.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From: Michal Kazior <michal.kazior@tieto.com>
-Date: Tue, 17 May 2016 14:47:01 +0200
-Subject: [PATCH] ath10k: disable wake_tx_queue for older devices
-
-Some setups suffer performance regressions with
-current wake_tx_queue implementation.
-
-Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
----
-
---- a/drivers/net/wireless/ath/ath10k/core.h
-+++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -667,6 +667,7 @@ struct ath10k_fw_components {
- struct ath10k {
- 	struct ath_common ath_common;
- 	struct ieee80211_hw *hw;
-+	struct ieee80211_ops *ops;
- 	struct device *dev;
- 	u8 mac_addr[ETH_ALEN];
- 
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -7497,21 +7497,32 @@ static const struct ieee80211_channel at
- struct ath10k *ath10k_mac_create(size_t priv_size)
- {
- 	struct ieee80211_hw *hw;
-+	struct ieee80211_ops *ops;
- 	struct ath10k *ar;
- 
--	hw = ieee80211_alloc_hw(sizeof(struct ath10k) + priv_size, &ath10k_ops);
--	if (!hw)
-+	ops = kmemdup(&ath10k_ops, sizeof(ath10k_ops), GFP_KERNEL);
-+	if (!ops)
-+		return NULL;
-+
-+	hw = ieee80211_alloc_hw(sizeof(struct ath10k) + priv_size, ops);
-+	if (!hw) {
-+		kfree(ops);
- 		return NULL;
-+	}
- 
- 	ar = hw->priv;
- 	ar->hw = hw;
-+	ar->ops = ops;
- 
- 	return ar;
- }
- 
- void ath10k_mac_destroy(struct ath10k *ar)
- {
-+	struct ieee80211_ops *ops = ar->ops;
-+
- 	ieee80211_free_hw(ar->hw);
-+	kfree(ops);
- }
- 
- static const struct ieee80211_iface_limit ath10k_if_limits[] = {
-@@ -7945,6 +7956,15 @@ int ath10k_mac_register(struct ath10k *a
- 			ath10k_warn(ar, "failed to initialise DFS pattern detector\n");
- 	}
- 
-+	/* Current wake_tx_queue implementation imposes a significant
-+	 * performance penalty in some setups. The tx scheduling code needs
-+	 * more work anyway so disable the wake_tx_queue unless firmware
-+	 * supports the pull-push mechanism.
-+	 */
-+	if (!test_bit(ATH10K_FW_FEATURE_PEER_FLOW_CONTROL,
-+		      ar->running_fw->fw_file.fw_features))
-+		ar->ops->wake_tx_queue = NULL;
-+
- 	ret = ath_regd_init(&ar->ath_common.regulatory, ar->hw->wiphy,
- 			    ath10k_reg_notifier);
- 	if (ret) {
diff --git a/package/kernel/mac80211/patches/312-ath9k-Correct-TSF-adjustment-to-align-the-beacon-tim.patch b/package/kernel/mac80211/patches/312-ath9k-Correct-TSF-adjustment-to-align-the-beacon-tim.patch
deleted file mode 100644
index df43105cb8..0000000000
--- a/package/kernel/mac80211/patches/312-ath9k-Correct-TSF-adjustment-to-align-the-beacon-tim.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From: Benjamin Berg <benjamin.berg@open-mesh.com>
-Date: Mon, 4 Jul 2016 14:37:20 +0200
-Subject: [PATCH] ath9k: Correct TSF adjustment to align the beacon time
- correctly
-
-Beacons were not send out at (timestamp % beacon_time == 0) for interfaces
-other than the primary one. To send out beacons with the correct timestamp
-according to 10.1.3.2 of the 802.11 standard the tsf_adjustment has to be
-set to the negative time difference instead of positive. This way the
-later beacons get corrected to have a lower (and similar) timestamp with
-regard to the beacon from slot 0.
-
-I am not aware about any issues that have been caused by this.
-
-Signed-off-by: Benjamin Berg <benjamin.berg@open-mesh.com>
----
-
---- a/drivers/net/wireless/ath/ath9k/beacon.c
-+++ b/drivers/net/wireless/ath/ath9k/beacon.c
-@@ -279,17 +279,21 @@ static void ath9k_set_tsfadjust(struct a
- 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
- 	struct ath_vif *avp = (void *)vif->drv_priv;
- 	struct ath_beacon_config *cur_conf = &avp->chanctx->beacon;
--	u32 tsfadjust;
-+	s64 tsfadjust;
- 
- 	if (avp->av_bslot == 0)
- 		return;
- 
-+	/* tsf_adjust is added to the TSF value. We send out the beacon late,
-+	 * so need to adjust the TSF starting point to be later in time (i.e.
-+	 * the theoretical first beacon has a TSF of 0 after correction).
-+	 */
- 	tsfadjust = cur_conf->beacon_interval * avp->av_bslot;
--	tsfadjust = TU_TO_USEC(tsfadjust) / ATH_BCBUF;
-+	tsfadjust = -TU_TO_USEC(tsfadjust) / ATH_BCBUF;
- 	avp->tsf_adjust = cpu_to_le64(tsfadjust);
- 
--	ath_dbg(common, CONFIG, "tsfadjust is: %llu for bslot: %d\n",
--		(unsigned long long)tsfadjust, avp->av_bslot);
-+	ath_dbg(common, CONFIG, "tsfadjust is: %lld for bslot: %d\n",
-+		(signed long long)tsfadjust, avp->av_bslot);
- }
- 
- bool ath9k_csa_is_finished(struct ath_softc *sc, struct ieee80211_vif *vif)
diff --git a/package/kernel/mac80211/patches/312-mac80211-Use-rhltable-instead-of-rhashtable.patch b/package/kernel/mac80211/patches/312-mac80211-Use-rhltable-instead-of-rhashtable.patch
new file mode 100644
index 0000000000..4c5fff1274
--- /dev/null
+++ b/package/kernel/mac80211/patches/312-mac80211-Use-rhltable-instead-of-rhashtable.patch
@@ -0,0 +1,275 @@
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Mon, 19 Sep 2016 19:00:10 +0800
+Subject: [PATCH] mac80211: Use rhltable instead of rhashtable
+
+mac80211 currently uses rhashtable with insecure_elasticity set
+to true.  The latter is because of duplicate objects.  What's
+more, mac80211 walks the rhashtable chains by hand which is broken
+as rhashtable may contain multiple tables due to resizing or
+rehashing.
+
+This patch fixes it by converting it to the newly added rhltable
+interface which is designed for use with duplicate objects.
+
+With rhltable a lookup returns a list of objects instead of a
+single one.  This is then fed into the existing for_each_sta_info
+macro.
+
+This patch also deletes the sta_addr_hash function since rhashtable
+defaults to jhash.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1233,7 +1233,7 @@ struct ieee80211_local {
+ 	spinlock_t tim_lock;
+ 	unsigned long num_sta;
+ 	struct list_head sta_list;
+-	struct rhashtable sta_hash;
++	struct rhltable sta_hash;
+ 	struct timer_list sta_cleanup;
+ 	int sta_generation;
+ 
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4004,7 +4004,7 @@ static void __ieee80211_rx_handle_packet
+ 	__le16 fc;
+ 	struct ieee80211_rx_data rx;
+ 	struct ieee80211_sub_if_data *prev;
+-	struct rhash_head *tmp;
++	struct rhlist_head *tmp;
+ 	int err = 0;
+ 
+ 	fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
+@@ -4047,13 +4047,10 @@ static void __ieee80211_rx_handle_packet
+ 		goto out;
+ 	} else if (ieee80211_is_data(fc)) {
+ 		struct sta_info *sta, *prev_sta;
+-		const struct bucket_table *tbl;
+ 
+ 		prev_sta = NULL;
+ 
+-		tbl = rht_dereference_rcu(local->sta_hash.tbl, &local->sta_hash);
+-
+-		for_each_sta_info(local, tbl, hdr->addr2, sta, tmp) {
++		for_each_sta_info(local, hdr->addr2, sta, tmp) {
+ 			if (!prev_sta) {
+ 				prev_sta = sta;
+ 				continue;
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -67,12 +67,10 @@
+ 
+ static const struct rhashtable_params sta_rht_params = {
+ 	.nelem_hint = 3, /* start small */
+-	.insecure_elasticity = true, /* Disable chain-length checks. */
+ 	.automatic_shrinking = true,
+ 	.head_offset = offsetof(struct sta_info, hash_node),
+ 	.key_offset = offsetof(struct sta_info, addr),
+ 	.key_len = ETH_ALEN,
+-	.hashfn = sta_addr_hash,
+ 	.max_size = CPTCFG_MAC80211_STA_HASH_MAX_SIZE,
+ };
+ 
+@@ -80,8 +78,8 @@ static const struct rhashtable_params st
+ static int sta_info_hash_del(struct ieee80211_local *local,
+ 			     struct sta_info *sta)
+ {
+-	return rhashtable_remove_fast(&local->sta_hash, &sta->hash_node,
+-				      sta_rht_params);
++	return rhltable_remove(&local->sta_hash, &sta->hash_node,
++			       sta_rht_params);
+ }
+ 
+ static void __cleanup_single_sta(struct sta_info *sta)
+@@ -157,19 +155,22 @@ static void cleanup_single_sta(struct st
+ 	sta_info_free(local, sta);
+ }
+ 
++struct rhlist_head *sta_info_hash_lookup(struct ieee80211_local *local,
++					 const u8 *addr)
++{
++	return rhltable_lookup(&local->sta_hash, addr, sta_rht_params);
++}
++
+ /* protected by RCU */
+ struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
+ 			      const u8 *addr)
+ {
+ 	struct ieee80211_local *local = sdata->local;
++	struct rhlist_head *tmp;
+ 	struct sta_info *sta;
+-	struct rhash_head *tmp;
+-	const struct bucket_table *tbl;
+ 
+ 	rcu_read_lock();
+-	tbl = rht_dereference_rcu(local->sta_hash.tbl, &local->sta_hash);
+-
+-	for_each_sta_info(local, tbl, addr, sta, tmp) {
++	for_each_sta_info(local, addr, sta, tmp) {
+ 		if (sta->sdata == sdata) {
+ 			rcu_read_unlock();
+ 			/* this is safe as the caller must already hold
+@@ -190,14 +191,11 @@ struct sta_info *sta_info_get_bss(struct
+ 				  const u8 *addr)
+ {
+ 	struct ieee80211_local *local = sdata->local;
++	struct rhlist_head *tmp;
+ 	struct sta_info *sta;
+-	struct rhash_head *tmp;
+-	const struct bucket_table *tbl;
+ 
+ 	rcu_read_lock();
+-	tbl = rht_dereference_rcu(local->sta_hash.tbl, &local->sta_hash);
+-
+-	for_each_sta_info(local, tbl, addr, sta, tmp) {
++	for_each_sta_info(local, addr, sta, tmp) {
+ 		if (sta->sdata == sdata ||
+ 		    (sta->sdata->bss && sta->sdata->bss == sdata->bss)) {
+ 			rcu_read_unlock();
+@@ -263,8 +261,8 @@ void sta_info_free(struct ieee80211_loca
+ static int sta_info_hash_add(struct ieee80211_local *local,
+ 			     struct sta_info *sta)
+ {
+-	return rhashtable_insert_fast(&local->sta_hash, &sta->hash_node,
+-				      sta_rht_params);
++	return rhltable_insert(&local->sta_hash, &sta->hash_node,
++			       sta_rht_params);
+ }
+ 
+ static void sta_deliver_ps_frames(struct work_struct *wk)
+@@ -453,9 +451,9 @@ static int sta_info_insert_check(struct
+ 		    is_multicast_ether_addr(sta->sta.addr)))
+ 		return -EINVAL;
+ 
+-	/* Strictly speaking this isn't necessary as we hold the mutex, but
+-	 * the rhashtable code can't really deal with that distinction. We
+-	 * do require the mutex for correctness though.
++	/* The RCU read lock is required by rhashtable due to
++	 * asynchronous resize/rehash.  We also require the mutex
++	 * for correctness.
+ 	 */
+ 	rcu_read_lock();
+ 	lockdep_assert_held(&sdata->local->sta_mtx);
+@@ -1043,16 +1041,11 @@ static void sta_info_cleanup(unsigned lo
+ 		  round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL));
+ }
+ 
+-u32 sta_addr_hash(const void *key, u32 length, u32 seed)
+-{
+-	return jhash(key, ETH_ALEN, seed);
+-}
+-
+ int sta_info_init(struct ieee80211_local *local)
+ {
+ 	int err;
+ 
+-	err = rhashtable_init(&local->sta_hash, &sta_rht_params);
++	err = rhltable_init(&local->sta_hash, &sta_rht_params);
+ 	if (err)
+ 		return err;
+ 
+@@ -1068,7 +1061,7 @@ int sta_info_init(struct ieee80211_local
+ void sta_info_stop(struct ieee80211_local *local)
+ {
+ 	del_timer_sync(&local->sta_cleanup);
+-	rhashtable_destroy(&local->sta_hash);
++	rhltable_destroy(&local->sta_hash);
+ }
+ 
+ 
+@@ -1138,17 +1131,14 @@ struct ieee80211_sta *ieee80211_find_sta
+ 						   const u8 *localaddr)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
++	struct rhlist_head *tmp;
+ 	struct sta_info *sta;
+-	struct rhash_head *tmp;
+-	const struct bucket_table *tbl;
+-
+-	tbl = rht_dereference_rcu(local->sta_hash.tbl, &local->sta_hash);
+ 
+ 	/*
+ 	 * Just return a random station if localaddr is NULL
+ 	 * ... first in list.
+ 	 */
+-	for_each_sta_info(local, tbl, addr, sta, tmp) {
++	for_each_sta_info(local, addr, sta, tmp) {
+ 		if (localaddr &&
+ 		    !ether_addr_equal(sta->sdata->vif.addr, localaddr))
+ 			continue;
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -455,7 +455,7 @@ struct sta_info {
+ 	/* General information, mostly static */
+ 	struct list_head list, free_list;
+ 	struct rcu_head rcu_head;
+-	struct rhash_head hash_node;
++	struct rhlist_head hash_node;
+ 	u8 addr[ETH_ALEN];
+ 	struct ieee80211_local *local;
+ 	struct ieee80211_sub_if_data *sdata;
+@@ -638,6 +638,9 @@ rcu_dereference_protected_tid_tx(struct
+  */
+ #define STA_INFO_CLEANUP_INTERVAL (10 * HZ)
+ 
++struct rhlist_head *sta_info_hash_lookup(struct ieee80211_local *local,
++					 const u8 *addr);
++
+ /*
+  * Get a STA info, must be under RCU read lock.
+  */
+@@ -647,17 +650,9 @@ struct sta_info *sta_info_get(struct iee
+ struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
+ 				  const u8 *addr);
+ 
+-u32 sta_addr_hash(const void *key, u32 length, u32 seed);
+-
+-#define _sta_bucket_idx(_tbl, _a)					\
+-	rht_bucket_index(_tbl, sta_addr_hash(_a, ETH_ALEN, (_tbl)->hash_rnd))
+-
+-#define for_each_sta_info(local, tbl, _addr, _sta, _tmp)		\
+-	rht_for_each_entry_rcu(_sta, _tmp, tbl, 			\
+-			       _sta_bucket_idx(tbl, _addr),		\
+-			       hash_node)				\
+-	/* compare address and run code only if it matches */		\
+-	if (ether_addr_equal(_sta->addr, (_addr)))
++#define for_each_sta_info(local, _addr, _sta, _tmp)			\
++	rhl_for_each_entry_rcu(_sta, _tmp,				\
++			       sta_info_hash_lookup(local, _addr), hash_node)
+ 
+ /*
+  * Get STA info by index, BROKEN!
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -759,8 +759,8 @@ void ieee80211_tx_status(struct ieee8021
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	__le16 fc;
+ 	struct ieee80211_supported_band *sband;
++	struct rhlist_head *tmp;
+ 	struct sta_info *sta;
+-	struct rhash_head *tmp;
+ 	int retry_count;
+ 	int rates_idx;
+ 	bool send_to_cooked;
+@@ -768,7 +768,6 @@ void ieee80211_tx_status(struct ieee8021
+ 	struct ieee80211_bar *bar;
+ 	int shift = 0;
+ 	int tid = IEEE80211_NUM_TIDS;
+-	const struct bucket_table *tbl;
+ 
+ 	rates_idx = ieee80211_tx_get_rates(hw, info, &retry_count);
+ 
+@@ -777,9 +776,7 @@ void ieee80211_tx_status(struct ieee8021
+ 	sband = local->hw.wiphy->bands[info->band];
+ 	fc = hdr->frame_control;
+ 
+-	tbl = rht_dereference_rcu(local->sta_hash.tbl, &local->sta_hash);
+-
+-	for_each_sta_info(local, tbl, hdr->addr1, sta, tmp) {
++	for_each_sta_info(local, hdr->addr1, sta, tmp) {
+ 		/* skip wrong virtual interface */
+ 		if (!ether_addr_equal(hdr->addr2, sta->sdata->vif.addr))
+ 			continue;
diff --git a/package/kernel/mac80211/patches/313-ath9k-Handle-channel-context-in-get_-set_-reset_tsf.patch b/package/kernel/mac80211/patches/313-ath9k-Handle-channel-context-in-get_-set_-reset_tsf.patch
deleted file mode 100644
index ef0afbea9c..0000000000
--- a/package/kernel/mac80211/patches/313-ath9k-Handle-channel-context-in-get_-set_-reset_tsf.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From: Benjamin Berg <benjamin.berg@open-mesh.com>
-Date: Mon, 4 Jul 2016 14:37:21 +0200
-Subject: [PATCH] ath9k: Handle channel context in get_/set_/reset_tsf
-
-The ath9k TSF handling routines need to be aware of the channel context that
-is being modified. With this change the TSF related values that are stored
-in each channel context will be correctly tracked and the harware will only
-be updated if the modified context is currently the active one.
-
-Without this change the TSF modifications done using these routines would
-for example be lost during a hardware reset as done by ath_complete_reset.
-
-Signed-off-by: Benjamin Berg <benjamin.berg@open-mesh.com>
----
-
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -1823,11 +1823,18 @@ static void ath9k_bss_info_changed(struc
- static u64 ath9k_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
- {
- 	struct ath_softc *sc = hw->priv;
-+	struct ath_vif *avp = (void *)vif->drv_priv;
- 	u64 tsf;
- 
- 	mutex_lock(&sc->mutex);
- 	ath9k_ps_wakeup(sc);
--	tsf = ath9k_hw_gettsf64(sc->sc_ah);
-+	/* Get current TSF either from HW or kernel time. */
-+	if (sc->cur_chan == avp->chanctx) {
-+		tsf = ath9k_hw_gettsf64(sc->sc_ah);
-+	} else {
-+		tsf = sc->cur_chan->tsf_val +
-+		      ath9k_hw_get_tsf_offset(&sc->cur_chan->tsf_ts, NULL);
-+	}
- 	ath9k_ps_restore(sc);
- 	mutex_unlock(&sc->mutex);
- 
-@@ -1839,10 +1846,14 @@ static void ath9k_set_tsf(struct ieee802
- 			  u64 tsf)
- {
- 	struct ath_softc *sc = hw->priv;
-+	struct ath_vif *avp = (void *)vif->drv_priv;
- 
- 	mutex_lock(&sc->mutex);
- 	ath9k_ps_wakeup(sc);
--	ath9k_hw_settsf64(sc->sc_ah, tsf);
-+	getrawmonotonic(&avp->chanctx->tsf_ts);
-+	if (sc->cur_chan == avp->chanctx)
-+		ath9k_hw_settsf64(sc->sc_ah, tsf);
-+	avp->chanctx->tsf_val = tsf;
- 	ath9k_ps_restore(sc);
- 	mutex_unlock(&sc->mutex);
- }
-@@ -1850,11 +1861,15 @@ static void ath9k_set_tsf(struct ieee802
- static void ath9k_reset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
- {
- 	struct ath_softc *sc = hw->priv;
-+	struct ath_vif *avp = (void *)vif->drv_priv;
- 
- 	mutex_lock(&sc->mutex);
- 
- 	ath9k_ps_wakeup(sc);
--	ath9k_hw_reset_tsf(sc->sc_ah);
-+	getrawmonotonic(&avp->chanctx->tsf_ts);
-+	if (sc->cur_chan == avp->chanctx)
-+		ath9k_hw_reset_tsf(sc->sc_ah);
-+	avp->chanctx->tsf_val = 0;
- 	ath9k_ps_restore(sc);
- 
- 	mutex_unlock(&sc->mutex);
diff --git a/package/kernel/mac80211/patches/313-mac80211-fix-sequence-number-allocation-regression.patch b/package/kernel/mac80211/patches/313-mac80211-fix-sequence-number-allocation-regression.patch
new file mode 100644
index 0000000000..c1548be0d2
--- /dev/null
+++ b/package/kernel/mac80211/patches/313-mac80211-fix-sequence-number-allocation-regression.patch
@@ -0,0 +1,37 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 11 Oct 2016 11:24:07 +0200
+Subject: [PATCH] mac80211: fix sequence number allocation regression
+
+The recent commit that moved around TX handlers dropped the sequence
+number allocation at the end of ieee80211_tx_dequeue and calls
+ieee80211_tx_h_sequence instead (for the non-fast-xmit case).
+However, it did not change the fast-xmit sequence allocation condition
+in ieee80211_xmit_fast_finish, which skipped seqno alloc if intermediate
+tx queues are being used.
+
+Drop the now obsolete condition.
+
+Fixes: bb42f2d13ffc ("mac80211: Move reorder-sensitive TX handlers to after TXQ dequeue")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3212,7 +3212,6 @@ static void ieee80211_xmit_fast_finish(s
+ 				       struct sk_buff *skb)
+ {
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+-	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 	u8 tid = IEEE80211_NUM_TIDS;
+ 
+@@ -3224,8 +3223,7 @@ static void ieee80211_xmit_fast_finish(s
+ 	if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
+ 		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
+ 		*ieee80211_get_qos_ctl(hdr) = tid;
+-		if (!ieee80211_get_txq(local, &sdata->vif, &sta->sta, skb))
+-			hdr->seq_ctrl = ieee80211_tx_next_seq(sta, tid);
++		hdr->seq_ctrl = ieee80211_tx_next_seq(sta, tid);
+ 	} else {
+ 		info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
+ 		hdr->seq_ctrl = cpu_to_le16(sdata->sequence_number);
diff --git a/package/kernel/mac80211/patches/314-ath9k-Use-tsf-offset-helper-in-ath9k_hw_reset.patch b/package/kernel/mac80211/patches/314-ath9k-Use-tsf-offset-helper-in-ath9k_hw_reset.patch
deleted file mode 100644
index e725a8bd60..0000000000
--- a/package/kernel/mac80211/patches/314-ath9k-Use-tsf-offset-helper-in-ath9k_hw_reset.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From: Benjamin Berg <benjamin.berg@open-mesh.com>
-Date: Mon, 4 Jul 2016 14:37:22 +0200
-Subject: [PATCH] ath9k: Use tsf offset helper in ath9k_hw_reset
-
-These changes make ath9k_hw_reset more consistent with other places that
-handle the TSF value by using the same helper routine.
-
-A slight improvement is to not assume that a fixed time of 1.5ms has
-passed for the initval writes when compared to the first write attempt.
-Instead the TSF value is re-calculated which will yield a higher accuracy
-of the restored TSF timer.
-
-Signed-off-by: Benjamin Berg <benjamin.berg@open-mesh.com>
----
-
---- a/drivers/net/wireless/ath/ath9k/hw.c
-+++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1832,8 +1832,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
- 	u32 saveLedState;
- 	u32 saveDefAntenna;
- 	u32 macStaId1;
-+	struct timespec tsf_ts;
-+	u32 tsf_offset;
- 	u64 tsf = 0;
--	s64 usec = 0;
- 	int r;
- 	bool start_mci_reset = false;
- 	bool save_fullsleep = ah->chip_fullsleep;
-@@ -1877,8 +1878,8 @@ int ath9k_hw_reset(struct ath_hw *ah, st
- 	macStaId1 = REG_READ(ah, AR_STA_ID1) & AR_STA_ID1_BASE_RATE_11B;
- 
- 	/* Save TSF before chip reset, a cold reset clears it */
-+	getrawmonotonic(&tsf_ts);
- 	tsf = ath9k_hw_gettsf64(ah);
--	usec = ktime_to_us(ktime_get_raw());
- 
- 	saveLedState = REG_READ(ah, AR_CFG_LED) &
- 		(AR_CFG_LED_ASSOC_CTL | AR_CFG_LED_MODE_SEL |
-@@ -1911,8 +1912,8 @@ int ath9k_hw_reset(struct ath_hw *ah, st
- 	}
- 
- 	/* Restore TSF */
--	usec = ktime_to_us(ktime_get_raw()) - usec;
--	ath9k_hw_settsf64(ah, tsf + usec);
-+	tsf_offset = ath9k_hw_get_tsf_offset(&tsf_ts, NULL);
-+	ath9k_hw_settsf64(ah, tsf + tsf_offset);
- 
- 	if (AR_SREV_9280_20_OR_LATER(ah))
- 		REG_SET_BIT(ah, AR_GPIO_INPUT_EN_VAL, AR_GPIO_JTAG_DISABLE);
-@@ -1932,12 +1933,11 @@ int ath9k_hw_reset(struct ath_hw *ah, st
- 	/*
- 	 * Some AR91xx SoC devices frequently fail to accept TSF writes
- 	 * right after the chip reset. When that happens, write a new
--	 * value after the initvals have been applied, with an offset
--	 * based on measured time difference
-+	 * value after the initvals have been applied.
- 	 */
- 	if (AR_SREV_9100(ah) && (ath9k_hw_gettsf64(ah) < tsf)) {
--		tsf += 1500;
--		ath9k_hw_settsf64(ah, tsf);
-+		tsf_offset = ath9k_hw_get_tsf_offset(&tsf_ts, NULL);
-+		ath9k_hw_settsf64(ah, tsf + tsf_offset);
- 	}
- 
- 	ath9k_hw_init_mfp(ah);
diff --git a/package/kernel/mac80211/patches/321-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch b/package/kernel/mac80211/patches/314-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
similarity index 89%
rename from package/kernel/mac80211/patches/321-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
rename to package/kernel/mac80211/patches/314-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
index 9caa76dc5d..a7bcfa549b 100644
--- a/package/kernel/mac80211/patches/321-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
+++ b/package/kernel/mac80211/patches/314-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
@@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1398,8 +1398,12 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1394,8 +1394,12 @@ static bool ath9k_hw_set_reset(struct at
  	if (!AR_SREV_9100(ah))
  		REG_WRITE(ah, AR_RC, 0);
  
diff --git a/package/kernel/mac80211/patches/315-ath9k-Expose-tsf_adjustment-in-mac80211-tsf-getters-.patch b/package/kernel/mac80211/patches/315-ath9k-Expose-tsf_adjustment-in-mac80211-tsf-getters-.patch
deleted file mode 100644
index c95ab7e644..0000000000
--- a/package/kernel/mac80211/patches/315-ath9k-Expose-tsf_adjustment-in-mac80211-tsf-getters-.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From: Benjamin Berg <benjamin.berg@open-mesh.com>
-Date: Mon, 4 Jul 2016 14:37:23 +0200
-Subject: [PATCH] ath9k: Expose tsf_adjustment in mac80211 tsf getters and
- setters.
-
-The ath9k driver modifies the TSF for VIFs for the purpose of sending
-beacons in a staggered fashion. This patch exposes this VIF specific
-adjustment of the TSF value to mac80211. Without the change the TSF
-routines handle the hardware TSF value instead of the actual TSF value as
-seen on the air.
-
-Signed-off-by: Benjamin Berg <benjamin.berg@open-mesh.com>
----
-
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -1835,6 +1835,7 @@ static u64 ath9k_get_tsf(struct ieee8021
- 		tsf = sc->cur_chan->tsf_val +
- 		      ath9k_hw_get_tsf_offset(&sc->cur_chan->tsf_ts, NULL);
- 	}
-+	tsf += le64_to_cpu(avp->tsf_adjust);
- 	ath9k_ps_restore(sc);
- 	mutex_unlock(&sc->mutex);
- 
-@@ -1850,6 +1851,7 @@ static void ath9k_set_tsf(struct ieee802
- 
- 	mutex_lock(&sc->mutex);
- 	ath9k_ps_wakeup(sc);
-+	tsf -= le64_to_cpu(avp->tsf_adjust);
- 	getrawmonotonic(&avp->chanctx->tsf_ts);
- 	if (sc->cur_chan == avp->chanctx)
- 		ath9k_hw_settsf64(sc->sc_ah, tsf);
diff --git a/package/kernel/mac80211/patches/322-ath9k_hw-issue-external-reset-for-QCA9550.patch b/package/kernel/mac80211/patches/315-ath9k_hw-issue-external-reset-for-QCA955x.patch
similarity index 93%
rename from package/kernel/mac80211/patches/322-ath9k_hw-issue-external-reset-for-QCA9550.patch
rename to package/kernel/mac80211/patches/315-ath9k_hw-issue-external-reset-for-QCA955x.patch
index 5d4e849b7f..6a958a4132 100644
--- a/package/kernel/mac80211/patches/322-ath9k_hw-issue-external-reset-for-QCA9550.patch
+++ b/package/kernel/mac80211/patches/315-ath9k_hw-issue-external-reset-for-QCA955x.patch
@@ -1,6 +1,6 @@
 From: Felix Fietkau <nbd@nbd.name>
 Date: Sat, 9 Jul 2016 15:26:44 +0200
-Subject: [PATCH] ath9k_hw: issue external reset for QCA9550
+Subject: [PATCH] ath9k_hw: issue external reset for QCA955x
 
 The RTC interface on the SoC needs to be reset along with the rest of
 the WMAC.
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1275,39 +1275,56 @@ void ath9k_hw_get_delta_slope_vals(struc
+@@ -1271,39 +1271,56 @@ void ath9k_hw_get_delta_slope_vals(struc
  	*coef_exponent = coef_exp - 16;
  }
  
@@ -91,7 +91,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	return true;
  }
  
-@@ -1360,24 +1377,23 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1356,24 +1373,23 @@ static bool ath9k_hw_set_reset(struct at
  			rst_flags |= AR_RTC_RC_MAC_COLD;
  	}
  
diff --git a/package/kernel/mac80211/patches/316-ath9k-Remove-some-defined-constants-to-decrease-verb.patch b/package/kernel/mac80211/patches/316-ath9k-Remove-some-defined-constants-to-decrease-verb.patch
deleted file mode 100644
index 36aaa1030e..0000000000
--- a/package/kernel/mac80211/patches/316-ath9k-Remove-some-defined-constants-to-decrease-verb.patch
+++ /dev/null
@@ -1,137 +0,0 @@
-From: Benjamin Berg <benjamin.berg@open-mesh.com>
-Date: Mon, 4 Jul 2016 14:37:24 +0200
-Subject: [PATCH] ath9k: Remove some #defined constants to decrease
- verbosity
-
-The removed ATH9K_SLOT_TIME_X constants simply map the value in microseconds
-to the same integer. These constants were not used consistently, so fix the
-inconsistency issue by replacing all occurances with the integer equivalent.
-
-Signed-off-by: Benjamin Berg <benjamin.berg@open-mesh.com>
----
-
---- a/drivers/net/wireless/ath/ath9k/beacon.c
-+++ b/drivers/net/wireless/ath/ath9k/beacon.c
-@@ -50,7 +50,7 @@ static void ath9k_beaconq_config(struct
- 		txq = sc->tx.txq_map[IEEE80211_AC_BE];
- 		ath9k_hw_get_txq_props(ah, txq->axq_qnum, &qi_be);
- 		qi.tqi_aifs = qi_be.tqi_aifs;
--		if (ah->slottime == ATH9K_SLOT_TIME_20)
-+		if (ah->slottime == 20)
- 			qi.tqi_cwmin = 2*qi_be.tqi_cwmin;
- 		else
- 			qi.tqi_cwmin = 4*qi_be.tqi_cwmin;
---- a/drivers/net/wireless/ath/ath9k/dynack.c
-+++ b/drivers/net/wireless/ath/ath9k/dynack.c
-@@ -280,7 +280,7 @@ EXPORT_SYMBOL(ath_dynack_sample_ack_ts);
- void ath_dynack_node_init(struct ath_hw *ah, struct ath_node *an)
- {
- 	/* ackto = slottime + sifs + air delay */
--	u32 ackto = ATH9K_SLOT_TIME_9 + 16 + 64;
-+	u32 ackto = 9 + 16 + 64;
- 	struct ath_dynack *da = &ah->dynack;
- 
- 	an->ackto = ackto;
-@@ -315,7 +315,7 @@ EXPORT_SYMBOL(ath_dynack_node_deinit);
- void ath_dynack_reset(struct ath_hw *ah)
- {
- 	/* ackto = slottime + sifs + air delay */
--	u32 ackto = ATH9K_SLOT_TIME_9 + 16 + 64;
-+	u32 ackto = 9 + 16 + 64;
- 	struct ath_dynack *da = &ah->dynack;
- 
- 	da->lto = jiffies;
---- a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
-+++ b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
-@@ -45,7 +45,7 @@ void ath9k_htc_beaconq_config(struct ath
- 		 * Long slot time  : 2x cwmin
- 		 * Short slot time : 4x cwmin
- 		 */
--		if (ah->slottime == ATH9K_SLOT_TIME_20)
-+		if (ah->slottime == 20)
- 			qi.tqi_cwmin = 2*qi_be.tqi_cwmin;
- 		else
- 			qi.tqi_cwmin = 4*qi_be.tqi_cwmin;
---- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
-+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
-@@ -678,7 +678,7 @@ static int ath9k_init_priv(struct ath9k_
- 
- 	for (i = 0; i < ATH9K_HTC_MAX_BCN_VIF; i++)
- 		priv->beacon.bslot[i] = NULL;
--	priv->beacon.slottime = ATH9K_SLOT_TIME_9;
-+	priv->beacon.slottime = 9;
- 
- 	ath9k_cmn_init_channels_rates(common);
- 	ath9k_cmn_init_crypto(ah);
---- a/drivers/net/wireless/ath/ath9k/hw.c
-+++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -454,7 +454,7 @@ static void ath9k_hw_init_defaults(struc
- 	if (AR_SREV_9100(ah))
- 		ah->sta_id1_defaults |= AR_STA_ID1_AR9100_BA_FIX;
- 
--	ah->slottime = ATH9K_SLOT_TIME_9;
-+	ah->slottime = 9;
- 	ah->globaltxtimeout = (u32) -1;
- 	ah->power_mode = ATH9K_PM_UNDEFINED;
- 	ah->htc_reset_init = true;
---- a/drivers/net/wireless/ath/ath9k/init.c
-+++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -372,7 +372,7 @@ static void ath9k_init_misc(struct ath_s
- 
- 	common->last_rssi = ATH_RSSI_DUMMY_MARKER;
- 	memcpy(common->bssidmask, ath_bcast_mac, ETH_ALEN);
--	sc->beacon.slottime = ATH9K_SLOT_TIME_9;
-+	sc->beacon.slottime = 9;
- 
- 	for (i = 0; i < ARRAY_SIZE(sc->beacon.bslot); i++)
- 		sc->beacon.bslot[i] = NULL;
---- a/drivers/net/wireless/ath/ath9k/mac.h
-+++ b/drivers/net/wireless/ath/ath9k/mac.h
-@@ -65,10 +65,6 @@
- #define INIT_SSH_RETRY  32
- #define INIT_SLG_RETRY  32
- 
--#define ATH9K_SLOT_TIME_6 6
--#define ATH9K_SLOT_TIME_9 9
--#define ATH9K_SLOT_TIME_20 20
--
- #define ATH9K_TXERR_XRETRY         0x01
- #define ATH9K_TXERR_FILT           0x02
- #define ATH9K_TXERR_FIFO           0x04
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -926,7 +926,7 @@ static void ath9k_vif_iter(struct ath9k_
- 	}
- 
- 	if (!vif->bss_conf.use_short_slot)
--		iter_data->slottime = ATH9K_SLOT_TIME_20;
-+		iter_data->slottime = 20;
- 
- 	switch (vif->type) {
- 	case NL80211_IFTYPE_AP:
-@@ -999,7 +999,7 @@ void ath9k_calculate_iter_data(struct at
- 	 */
- 	memset(iter_data, 0, sizeof(*iter_data));
- 	eth_broadcast_addr(iter_data->mask);
--	iter_data->slottime = ATH9K_SLOT_TIME_9;
-+	iter_data->slottime = 9;
- 
- 	list_for_each_entry(avp, &ctx->vifs, list)
- 		ath9k_vif_iter(iter_data, avp->vif->addr, avp->vif);
-@@ -1061,7 +1061,7 @@ static void ath9k_set_offchannel_state(s
- 	ah->opmode = vif->type;
- 	ah->imask &= ~ATH9K_INT_SWBA;
- 	ah->imask &= ~ATH9K_INT_TSFOOR;
--	ah->slottime = ATH9K_SLOT_TIME_9;
-+	ah->slottime = 9;
- 
- 	ath_hw_setbssidmask(common);
- 	ath9k_hw_setopmode(ah);
-@@ -1788,6 +1788,7 @@ static void ath9k_bss_info_changed(struc
- 			slottime = 9;
- 		else
- 			slottime = 20;
-+
- 		if (vif->type == NL80211_IFTYPE_AP) {
- 			/*
- 			 * Defer update, so that connected stations can adjust
diff --git a/package/kernel/mac80211/patches/316-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch b/package/kernel/mac80211/patches/316-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch
new file mode 100644
index 0000000000..dfe9aae268
--- /dev/null
+++ b/package/kernel/mac80211/patches/316-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch
@@ -0,0 +1,21 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 11 Jul 2016 12:07:40 +0200
+Subject: [PATCH] ath9k_hw: set spectral scan enable bit on trigger for
+ AR9003+
+
+AR9002 code and QCA AR9003+ code do the same.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -1800,6 +1800,8 @@ static void ar9003_hw_spectral_scan_conf
+ 
+ static void ar9003_hw_spectral_scan_trigger(struct ath_hw *ah)
+ {
++	REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN,
++		    AR_PHY_SPECTRAL_SCAN_ENABLE);
+ 	/* Activate spectral scan */
+ 	REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN,
+ 		    AR_PHY_SPECTRAL_SCAN_ACTIVE);
diff --git a/package/kernel/mac80211/patches/317-Revert-ath9k_hw-implement-temperature-compensation-s.patch b/package/kernel/mac80211/patches/317-Revert-ath9k_hw-implement-temperature-compensation-s.patch
new file mode 100644
index 0000000000..687df35a9e
--- /dev/null
+++ b/package/kernel/mac80211/patches/317-Revert-ath9k_hw-implement-temperature-compensation-s.patch
@@ -0,0 +1,101 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 11 Oct 2016 19:45:41 +0200
+Subject: [PATCH] Revert "ath9k_hw: implement temperature compensation support
+ for AR9003+"
+
+This reverts commit 171f6402e4aa5cd3b8407f82501f7ea21fa54ccc.
+Some users report that this commit causes a regression in performance
+under some conditions.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+@@ -33,7 +33,6 @@ struct coeff {
+ 
+ enum ar9003_cal_types {
+ 	IQ_MISMATCH_CAL = BIT(0),
+-	TEMP_COMP_CAL = BIT(1),
+ };
+ 
+ static void ar9003_hw_setup_calibration(struct ath_hw *ah,
+@@ -59,12 +58,6 @@ static void ar9003_hw_setup_calibration(
+ 		/* Kick-off cal */
+ 		REG_SET_BIT(ah, AR_PHY_TIMING4, AR_PHY_TIMING4_DO_CAL);
+ 		break;
+-	case TEMP_COMP_CAL:
+-		ath_dbg(common, CALIBRATE,
+-			"starting Temperature Compensation Calibration\n");
+-		REG_SET_BIT(ah, AR_CH0_THERM, AR_CH0_THERM_LOCAL);
+-		REG_SET_BIT(ah, AR_CH0_THERM, AR_CH0_THERM_START);
+-		break;
+ 	default:
+ 		ath_err(common, "Invalid calibration type\n");
+ 		break;
+@@ -93,8 +86,7 @@ static bool ar9003_hw_per_calibration(st
+ 		/*
+ 		* Accumulate cal measures for active chains
+ 		*/
+-		if (cur_caldata->calCollect)
+-			cur_caldata->calCollect(ah);
++		cur_caldata->calCollect(ah);
+ 		ah->cal_samples++;
+ 
+ 		if (ah->cal_samples >= cur_caldata->calNumSamples) {
+@@ -107,8 +99,7 @@ static bool ar9003_hw_per_calibration(st
+ 			/*
+ 			* Process accumulated data
+ 			*/
+-			if (cur_caldata->calPostProc)
+-				cur_caldata->calPostProc(ah, numChains);
++			cur_caldata->calPostProc(ah, numChains);
+ 
+ 			/* Calibration has finished. */
+ 			caldata->CalValid |= cur_caldata->calType;
+@@ -323,16 +314,9 @@ static const struct ath9k_percal_data iq
+ 	ar9003_hw_iqcalibrate
+ };
+ 
+-static const struct ath9k_percal_data temp_cal_single_sample = {
+-	TEMP_COMP_CAL,
+-	MIN_CAL_SAMPLES,
+-	PER_MAX_LOG_COUNT,
+-};
+-
+ static void ar9003_hw_init_cal_settings(struct ath_hw *ah)
+ {
+ 	ah->iq_caldata.calData = &iq_cal_single_sample;
+-	ah->temp_caldata.calData = &temp_cal_single_sample;
+ 
+ 	if (AR_SREV_9300_20_OR_LATER(ah)) {
+ 		ah->enabled_cals |= TX_IQ_CAL;
+@@ -340,7 +324,7 @@ static void ar9003_hw_init_cal_settings(
+ 			ah->enabled_cals |= TX_IQ_ON_AGC_CAL;
+ 	}
+ 
+-	ah->supp_cals = IQ_MISMATCH_CAL | TEMP_COMP_CAL;
++	ah->supp_cals = IQ_MISMATCH_CAL;
+ }
+ 
+ #define OFF_UPPER_LT 24
+@@ -1399,9 +1383,6 @@ static void ar9003_hw_init_cal_common(st
+ 	INIT_CAL(&ah->iq_caldata);
+ 	INSERT_CAL(ah, &ah->iq_caldata);
+ 
+-	INIT_CAL(&ah->temp_caldata);
+-	INSERT_CAL(ah, &ah->temp_caldata);
+-
+ 	/* Initialize current pointer to first element in list */
+ 	ah->cal_list_curr = ah->cal_list;
+ 
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -830,7 +830,6 @@ struct ath_hw {
+ 	/* Calibration */
+ 	u32 supp_cals;
+ 	struct ath9k_cal_list iq_caldata;
+-	struct ath9k_cal_list temp_caldata;
+ 	struct ath9k_cal_list adcgain_caldata;
+ 	struct ath9k_cal_list adcdc_caldata;
+ 	struct ath9k_cal_list *cal_list;
diff --git a/package/kernel/mac80211/patches/317-ath9k-Fix-beacon-configuration-for-addition-removal-.patch b/package/kernel/mac80211/patches/317-ath9k-Fix-beacon-configuration-for-addition-removal-.patch
deleted file mode 100644
index 360dfbfafb..0000000000
--- a/package/kernel/mac80211/patches/317-ath9k-Fix-beacon-configuration-for-addition-removal-.patch
+++ /dev/null
@@ -1,544 +0,0 @@
-From: Benjamin Berg <benjamin.berg@open-mesh.com>
-Date: Mon, 4 Jul 2016 14:37:25 +0200
-Subject: [PATCH] ath9k: Fix beacon configuration for addition/removal of
- interfaces
-
-This patch fixes some issues with interface reconfiguration. It could
-for example happen that an AP interface in beacon slot 0 was removed
-leaving an IBSS station in one of the other slots. When this happens
-the driver never sends out the beacon as it only tries to send a beacon
-from slot 0.
-
-Appart from that the tracking of required changes to the beacon config is
-relatively complicated and prone to errors.
-
-The approach taken here is to solve reconfiguration issues is to
-reconfigure the beacons when any interface changes. This means that
-the complexity of deciding whether an interface change may modify the
-beacon configuration is gone. It also means that the beacon config will
-be reliably updated when an interface is removed.
-
-The issue that a single non-AP interface might not be in beacon
-slot 0 and wouldn't be send out is solved by moving it into the
-first slot. The TSF value in hardware is adjusted accordingly so
-that the timestamp of the beacons stay consistent.
-
-Signed-off-by: Benjamin Berg <benjamin.berg@open-mesh.com>
----
-
---- a/drivers/net/wireless/ath/ath9k/ath9k.h
-+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -637,6 +637,8 @@ struct ath9k_vif_iter_data {
- 	int nwds;      /* number of WDS vifs */
- 	int nadhocs;   /* number of adhoc vifs */
- 	int nocbs;     /* number of OCB vifs */
-+	int nbcnvifs;  /* number of beaconing vifs */
-+	struct ieee80211_vif *primary_beacon_vif;
- 	struct ieee80211_vif *primary_sta;
- };
- 
-@@ -685,10 +687,11 @@ struct ath_beacon {
- };
- 
- void ath9k_beacon_tasklet(unsigned long data);
--void ath9k_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif,
--			 u32 changed);
-+void ath9k_beacon_config(struct ath_softc *sc, struct ieee80211_vif *main_vif,
-+			 bool beacons);
- void ath9k_beacon_assign_slot(struct ath_softc *sc, struct ieee80211_vif *vif);
- void ath9k_beacon_remove_slot(struct ath_softc *sc, struct ieee80211_vif *vif);
-+void ath9k_beacon_ensure_primary_slot(struct ath_softc *sc);
- void ath9k_set_beacon(struct ath_softc *sc);
- bool ath9k_csa_is_finished(struct ath_softc *sc, struct ieee80211_vif *vif);
- void ath9k_csa_update(struct ath_softc *sc);
---- a/drivers/net/wireless/ath/ath9k/beacon.c
-+++ b/drivers/net/wireless/ath/ath9k/beacon.c
-@@ -209,7 +209,6 @@ void ath9k_beacon_assign_slot(struct ath
- 	}
- 
- 	sc->beacon.bslot[avp->av_bslot] = vif;
--	sc->nbcnvifs++;
- 
- 	ath_dbg(common, CONFIG, "Added interface at beacon slot: %d\n",
- 		avp->av_bslot);
-@@ -220,15 +219,12 @@ void ath9k_beacon_remove_slot(struct ath
- 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
- 	struct ath_vif *avp = (void *)vif->drv_priv;
- 	struct ath_buf *bf = avp->av_bcbuf;
--	struct ath_beacon_config *cur_conf = &sc->cur_chan->beacon;
- 
- 	ath_dbg(common, CONFIG, "Removing interface at beacon slot: %d\n",
- 		avp->av_bslot);
- 
- 	tasklet_disable(&sc->bcon_tasklet);
- 
--	cur_conf->enable_beacon &= ~BIT(avp->av_bslot);
--
- 	if (bf && bf->bf_mpdu) {
- 		struct sk_buff *skb = bf->bf_mpdu;
- 		dma_unmap_single(sc->dev, bf->bf_buf_addr,
-@@ -240,12 +236,73 @@ void ath9k_beacon_remove_slot(struct ath
- 
- 	avp->av_bcbuf = NULL;
- 	sc->beacon.bslot[avp->av_bslot] = NULL;
--	sc->nbcnvifs--;
- 	list_add_tail(&bf->list, &sc->beacon.bbuf);
- 
- 	tasklet_enable(&sc->bcon_tasklet);
- }
- 
-+void ath9k_beacon_ensure_primary_slot(struct ath_softc *sc)
-+{
-+	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-+	struct ieee80211_vif *vif;
-+	struct ath_vif *avp;
-+	s64 tsfadjust;
-+	u32 offset;
-+	int first_slot = ATH_BCBUF;
-+	int slot;
-+
-+	tasklet_disable(&sc->bcon_tasklet);
-+
-+	/* Find first taken slot. */
-+	for (slot = 0; slot < ATH_BCBUF; slot++) {
-+		if (sc->beacon.bslot[slot]) {
-+			first_slot = slot;
-+			break;
-+		}
-+	}
-+	if (first_slot == 0)
-+		goto out;
-+
-+	/* Re-enumarate all slots, moving them forward. */
-+	for (slot = 0; slot < ATH_BCBUF; slot++) {
-+		if (slot + first_slot < ATH_BCBUF) {
-+			vif = sc->beacon.bslot[slot + first_slot];
-+			sc->beacon.bslot[slot] = vif;
-+
-+			if (vif) {
-+				avp = (void *)vif->drv_priv;
-+				avp->av_bslot = slot;
-+			}
-+		} else {
-+			sc->beacon.bslot[slot] = NULL;
-+		}
-+	}
-+
-+	vif = sc->beacon.bslot[0];
-+	if (WARN_ON(!vif))
-+		goto out;
-+
-+	/* Get the tsf_adjust value for the new first slot. */
-+	avp = (void *)vif->drv_priv;
-+	tsfadjust = le64_to_cpu(avp->tsf_adjust);
-+
-+	ath_dbg(common, CONFIG,
-+		"Adjusting global TSF after beacon slot reassignment: %lld\n",
-+		(signed long long)tsfadjust);
-+
-+	/* Modify TSF as required and update the HW. */
-+	avp->chanctx->tsf_val += tsfadjust;
-+	if (sc->cur_chan == avp->chanctx) {
-+		offset = ath9k_hw_get_tsf_offset(&avp->chanctx->tsf_ts, NULL);
-+		ath9k_hw_settsf64(sc->sc_ah, avp->chanctx->tsf_val + offset);
-+	}
-+
-+	/* The slots tsf_adjust will be updated by ath9k_beacon_config later. */
-+
-+out:
-+	tasklet_enable(&sc->bcon_tasklet);
-+}
-+
- static int ath9k_beacon_choose_slot(struct ath_softc *sc)
- {
- 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-@@ -274,26 +331,33 @@ static int ath9k_beacon_choose_slot(stru
- 	return slot;
- }
- 
--static void ath9k_set_tsfadjust(struct ath_softc *sc, struct ieee80211_vif *vif)
-+static void ath9k_set_tsfadjust(struct ath_softc *sc,
-+				struct ath_beacon_config *cur_conf)
- {
- 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
--	struct ath_vif *avp = (void *)vif->drv_priv;
--	struct ath_beacon_config *cur_conf = &avp->chanctx->beacon;
- 	s64 tsfadjust;
-+	int slot;
- 
--	if (avp->av_bslot == 0)
--		return;
-+	for (slot = 0; slot < ATH_BCBUF; slot++) {
-+		struct ath_vif *avp;
- 
--	/* tsf_adjust is added to the TSF value. We send out the beacon late,
--	 * so need to adjust the TSF starting point to be later in time (i.e.
--	 * the theoretical first beacon has a TSF of 0 after correction).
--	 */
--	tsfadjust = cur_conf->beacon_interval * avp->av_bslot;
--	tsfadjust = -TU_TO_USEC(tsfadjust) / ATH_BCBUF;
--	avp->tsf_adjust = cpu_to_le64(tsfadjust);
-+		if (!sc->beacon.bslot[slot])
-+			continue;
- 
--	ath_dbg(common, CONFIG, "tsfadjust is: %lld for bslot: %d\n",
--		(signed long long)tsfadjust, avp->av_bslot);
-+		avp = (void *)sc->beacon.bslot[slot]->drv_priv;
-+
-+		/* tsf_adjust is added to the TSF value. We send out the
-+		 * beacon late, so need to adjust the TSF starting point to be
-+		 * later in time (i.e. the theoretical first beacon has a TSF
-+		 * of 0 after correction).
-+		 */
-+		tsfadjust = cur_conf->beacon_interval * avp->av_bslot;
-+		tsfadjust = -TU_TO_USEC(tsfadjust) / ATH_BCBUF;
-+		avp->tsf_adjust = cpu_to_le64(tsfadjust);
-+
-+		ath_dbg(common, CONFIG, "tsfadjust is: %lld for bslot: %d\n",
-+			(signed long long)tsfadjust, avp->av_bslot);
-+	}
- }
- 
- bool ath9k_csa_is_finished(struct ath_softc *sc, struct ieee80211_vif *vif)
-@@ -447,20 +511,28 @@ void ath9k_beacon_tasklet(unsigned long
-  * Both nexttbtt and intval have to be in usecs.
-  */
- static void ath9k_beacon_init(struct ath_softc *sc, u32 nexttbtt,
--			      u32 intval, bool reset_tsf)
-+			      u32 intval)
- {
- 	struct ath_hw *ah = sc->sc_ah;
- 
- 	ath9k_hw_disable_interrupts(ah);
--	if (reset_tsf)
--		ath9k_hw_reset_tsf(ah);
- 	ath9k_beaconq_config(sc);
- 	ath9k_hw_beaconinit(ah, nexttbtt, intval);
-+	ah->imask |= ATH9K_INT_SWBA;
- 	sc->beacon.bmisscnt = 0;
- 	ath9k_hw_set_interrupts(ah);
- 	ath9k_hw_enable_interrupts(ah);
- }
- 
-+static void ath9k_beacon_stop(struct ath_softc *sc)
-+{
-+	ath9k_hw_disable_interrupts(sc->sc_ah);
-+	sc->sc_ah->imask &= ~(ATH9K_INT_SWBA | ATH9K_INT_BMISS);
-+	sc->beacon.bmisscnt = 0;
-+	ath9k_hw_set_interrupts(sc->sc_ah);
-+	ath9k_hw_enable_interrupts(sc->sc_ah);
-+}
-+
- /*
-  * For multi-bss ap support beacons are either staggered evenly over N slots or
-  * burst together.  For the former arrange for the SWBA to be delivered for each
-@@ -472,7 +544,7 @@ static void ath9k_beacon_config_ap(struc
- 	struct ath_hw *ah = sc->sc_ah;
- 
- 	ath9k_cmn_beacon_config_ap(ah, conf, ATH_BCBUF);
--	ath9k_beacon_init(sc, conf->nexttbtt, conf->intval, false);
-+	ath9k_beacon_init(sc, conf->nexttbtt, conf->intval);
- }
- 
- static void ath9k_beacon_config_sta(struct ath_hw *ah,
-@@ -501,7 +573,7 @@ static void ath9k_beacon_config_adhoc(st
- 
- 	ath9k_cmn_beacon_config_adhoc(ah, conf);
- 
--	ath9k_beacon_init(sc, conf->nexttbtt, conf->intval, conf->ibss_creator);
-+	ath9k_beacon_init(sc, conf->nexttbtt, conf->intval);
- 
- 	/*
- 	 * Set the global 'beacon has been configured' flag for the
-@@ -511,44 +583,6 @@ static void ath9k_beacon_config_adhoc(st
- 		set_bit(ATH_OP_BEACONS, &common->op_flags);
- }
- 
--static bool ath9k_allow_beacon_config(struct ath_softc *sc,
--				      struct ieee80211_vif *vif)
--{
--	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
--	struct ath_vif *avp = (void *)vif->drv_priv;
--
--	if (ath9k_is_chanctx_enabled()) {
--		/*
--		 * If the VIF is not present in the current channel context,
--		 * then we can't do the usual opmode checks. Allow the
--		 * beacon config for the VIF to be updated in this case and
--		 * return immediately.
--		 */
--		if (sc->cur_chan != avp->chanctx)
--			return true;
--	}
--
--	if (sc->sc_ah->opmode == NL80211_IFTYPE_AP) {
--		if (vif->type != NL80211_IFTYPE_AP) {
--			ath_dbg(common, CONFIG,
--				"An AP interface is already present !\n");
--			return false;
--		}
--	}
--
--	if (sc->sc_ah->opmode == NL80211_IFTYPE_STATION) {
--		if ((vif->type == NL80211_IFTYPE_STATION) &&
--		    test_bit(ATH_OP_BEACONS, &common->op_flags) &&
--		    vif != sc->cur_chan->primary_sta) {
--			ath_dbg(common, CONFIG,
--				"Beacon already configured for a station interface\n");
--			return false;
--		}
--	}
--
--	return true;
--}
--
- static void ath9k_cache_beacon_config(struct ath_softc *sc,
- 				      struct ath_chanctx *ctx,
- 				      struct ieee80211_bss_conf *bss_conf)
-@@ -584,87 +618,79 @@ static void ath9k_cache_beacon_config(st
- 	if (cur_conf->dtim_period == 0)
- 		cur_conf->dtim_period = 1;
- 
-+	ath9k_set_tsfadjust(sc, cur_conf);
- }
- 
--void ath9k_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif,
--			 u32 changed)
-+void ath9k_beacon_config(struct ath_softc *sc, struct ieee80211_vif *main_vif,
-+			 bool beacons)
- {
--	struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
--        struct ath_hw *ah = sc->sc_ah;
--        struct ath_common *common = ath9k_hw_common(ah);
--	struct ath_vif *avp = (void *)vif->drv_priv;
--	struct ath_chanctx *ctx = avp->chanctx;
-+	struct ath_hw *ah = sc->sc_ah;
-+	struct ath_common *common = ath9k_hw_common(ah);
-+	struct ath_vif *avp;
-+	struct ath_chanctx *ctx;
- 	struct ath_beacon_config *cur_conf;
- 	unsigned long flags;
-+	bool enabled;
- 	bool skip_beacon = false;
- 
--	if (!ctx)
-+	if (!beacons) {
-+		clear_bit(ATH_OP_BEACONS, &common->op_flags);
-+		ath9k_beacon_stop(sc);
- 		return;
-+	}
- 
--	cur_conf = &avp->chanctx->beacon;
--	if (vif->type == NL80211_IFTYPE_AP)
--		ath9k_set_tsfadjust(sc, vif);
--
--	if (!ath9k_allow_beacon_config(sc, vif))
-+	if (WARN_ON(!main_vif))
- 		return;
- 
--	if (vif->type == NL80211_IFTYPE_STATION) {
--		ath9k_cache_beacon_config(sc, ctx, bss_conf);
--		if (ctx != sc->cur_chan)
--			return;
-+	avp = (void *)main_vif->drv_priv;
-+	ctx = avp->chanctx;
-+	cur_conf = &ctx->beacon;
-+	enabled = cur_conf->enable_beacon;
-+	cur_conf->enable_beacon = beacons;
-+
-+	if (sc->sc_ah->opmode == NL80211_IFTYPE_STATION) {
-+		ath9k_cache_beacon_config(sc, ctx, &main_vif->bss_conf);
- 
- 		ath9k_set_beacon(sc);
- 		set_bit(ATH_OP_BEACONS, &common->op_flags);
- 		return;
- 	}
- 
--	/*
--	 * Take care of multiple interfaces when
--	 * enabling/disabling SWBA.
--	 */
--	if (changed & BSS_CHANGED_BEACON_ENABLED) {
--		bool enabled = cur_conf->enable_beacon;
--
--		if (!bss_conf->enable_beacon) {
--			cur_conf->enable_beacon &= ~BIT(avp->av_bslot);
--		} else {
--			cur_conf->enable_beacon |= BIT(avp->av_bslot);
--			if (!enabled)
--				ath9k_cache_beacon_config(sc, ctx, bss_conf);
--		}
--	}
--
--	if (ctx != sc->cur_chan)
--		return;
-+	/* Update the beacon configuration. */
-+	ath9k_cache_beacon_config(sc, ctx, &main_vif->bss_conf);
- 
- 	/*
- 	 * Configure the HW beacon registers only when we have a valid
- 	 * beacon interval.
- 	 */
- 	if (cur_conf->beacon_interval) {
--		/*
--		 * If we are joining an existing IBSS network, start beaconing
--		 * only after a TSF-sync has taken place. Ensure that this
--		 * happens by setting the appropriate flags.
-+		/* Special case to sync the TSF when joining an existing IBSS.
-+		 * This is only done if no AP interface is active.
-+		 * Note that mac80211 always resets the TSF when creating a new
-+		 * IBSS interface.
- 		 */
--		if ((changed & BSS_CHANGED_IBSS) && !bss_conf->ibss_creator &&
--		    bss_conf->enable_beacon) {
-+		if (sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC &&
-+		    !enabled && beacons && !main_vif->bss_conf.ibss_creator) {
- 			spin_lock_irqsave(&sc->sc_pm_lock, flags);
- 			sc->ps_flags |= PS_BEACON_SYNC | PS_WAIT_FOR_BEACON;
- 			spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
- 			skip_beacon = true;
--		} else {
--			ath9k_set_beacon(sc);
- 		}
- 
- 		/*
- 		 * Do not set the ATH_OP_BEACONS flag for IBSS joiner mode
- 		 * here, it is done in ath9k_beacon_config_adhoc().
- 		 */
--		if (cur_conf->enable_beacon && !skip_beacon)
-+		if (beacons && !skip_beacon) {
- 			set_bit(ATH_OP_BEACONS, &common->op_flags);
--		else
-+			ath9k_set_beacon(sc);
-+		} else {
- 			clear_bit(ATH_OP_BEACONS, &common->op_flags);
-+			ath9k_beacon_stop(sc);
-+		}
-+	} else {
-+		clear_bit(ATH_OP_BEACONS, &common->op_flags);
-+		ath9k_beacon_stop(sc);
- 	}
- }
- 
---- a/drivers/net/wireless/ath/ath9k/common.h
-+++ b/drivers/net/wireless/ath/ath9k/common.h
-@@ -50,6 +50,7 @@
- #define IEEE80211_MS_TO_TU(x)   (((x) * 1000) / 1024)
- 
- struct ath_beacon_config {
-+	struct ieee80211_vif *main_vif;
- 	int beacon_interval;
- 	u16 dtim_period;
- 	u16 bmiss_timeout;
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -910,6 +910,22 @@ static bool ath9k_uses_beacons(int type)
- 	}
- }
- 
-+static void ath9k_vif_iter_set_beacon(struct ath9k_vif_iter_data *iter_data,
-+				      struct ieee80211_vif *vif)
-+{
-+	/* Use the first (configured) interface, but prefering AP interfaces. */
-+	if (!iter_data->primary_beacon_vif) {
-+		iter_data->primary_beacon_vif = vif;
-+	} else {
-+		if (iter_data->primary_beacon_vif->type != NL80211_IFTYPE_AP &&
-+		    vif->type == NL80211_IFTYPE_AP)
-+		iter_data->primary_beacon_vif = vif;
-+	}
-+
-+	iter_data->beacons = true;
-+	iter_data->nbcnvifs += 1;
-+}
-+
- static void ath9k_vif_iter(struct ath9k_vif_iter_data *iter_data,
- 			   u8 *mac, struct ieee80211_vif *vif)
- {
-@@ -931,6 +947,8 @@ static void ath9k_vif_iter(struct ath9k_
- 	switch (vif->type) {
- 	case NL80211_IFTYPE_AP:
- 		iter_data->naps++;
-+		if (vif->bss_conf.enable_beacon)
-+			ath9k_vif_iter_set_beacon(iter_data, vif);
- 		break;
- 	case NL80211_IFTYPE_STATION:
- 		iter_data->nstations++;
-@@ -943,12 +961,12 @@ static void ath9k_vif_iter(struct ath9k_
- 	case NL80211_IFTYPE_ADHOC:
- 		iter_data->nadhocs++;
- 		if (vif->bss_conf.enable_beacon)
--			iter_data->beacons = true;
-+			ath9k_vif_iter_set_beacon(iter_data, vif);
- 		break;
- 	case NL80211_IFTYPE_MESH_POINT:
- 		iter_data->nmeshes++;
- 		if (vif->bss_conf.enable_beacon)
--			iter_data->beacons = true;
-+			ath9k_vif_iter_set_beacon(iter_data, vif);
- 		break;
- 	case NL80211_IFTYPE_WDS:
- 		iter_data->nwds++;
-@@ -1081,7 +1099,6 @@ void ath9k_calculate_summary_state(struc
- 	struct ath_hw *ah = sc->sc_ah;
- 	struct ath_common *common = ath9k_hw_common(ah);
- 	struct ath9k_vif_iter_data iter_data;
--	struct ath_beacon_config *cur_conf;
- 
- 	ath_chanctx_check_active(sc, ctx);
- 
-@@ -1103,13 +1120,12 @@ void ath9k_calculate_summary_state(struc
- 	ath_hw_setbssidmask(common);
- 
- 	if (iter_data.naps > 0) {
--		cur_conf = &ctx->beacon;
- 		ath9k_hw_set_tsfadjust(ah, true);
- 		ah->opmode = NL80211_IFTYPE_AP;
--		if (cur_conf->enable_beacon)
--			iter_data.beacons = true;
- 	} else {
- 		ath9k_hw_set_tsfadjust(ah, false);
-+		if (iter_data.beacons)
-+			ath9k_beacon_ensure_primary_slot(sc);
- 
- 		if (iter_data.nmeshes)
- 			ah->opmode = NL80211_IFTYPE_MESH_POINT;
-@@ -1134,7 +1150,6 @@ void ath9k_calculate_summary_state(struc
- 			ctx->switch_after_beacon = true;
- 	}
- 
--	ah->imask &= ~ATH9K_INT_SWBA;
- 	if (ah->opmode == NL80211_IFTYPE_STATION) {
- 		bool changed = (iter_data.primary_sta != ctx->primary_sta);
- 
-@@ -1151,16 +1166,12 @@ void ath9k_calculate_summary_state(struc
- 			if (ath9k_hw_mci_is_enabled(sc->sc_ah))
- 				ath9k_mci_update_wlan_channels(sc, true);
- 		}
--	} else if (iter_data.beacons) {
--		ah->imask |= ATH9K_INT_SWBA;
- 	}
-+	sc->nbcnvifs = iter_data.nbcnvifs;
-+	ath9k_beacon_config(sc, iter_data.primary_beacon_vif,
-+			    iter_data.beacons);
- 	ath9k_hw_set_interrupts(ah);
- 
--	if (iter_data.beacons)
--		set_bit(ATH_OP_BEACONS, &common->op_flags);
--	else
--		clear_bit(ATH_OP_BEACONS, &common->op_flags);
--
- 	if (ah->slottime != iter_data.slottime) {
- 		ah->slottime = iter_data.slottime;
- 		ath9k_hw_init_global_settings(ah);
-@@ -1777,9 +1788,7 @@ static void ath9k_bss_info_changed(struc
- 	if ((changed & BSS_CHANGED_BEACON_ENABLED) ||
- 	    (changed & BSS_CHANGED_BEACON_INT) ||
- 	    (changed & BSS_CHANGED_BEACON_INFO)) {
--		ath9k_beacon_config(sc, vif, changed);
--		if (changed & BSS_CHANGED_BEACON_ENABLED)
--			ath9k_calculate_summary_state(sc, avp->chanctx);
-+		ath9k_calculate_summary_state(sc, avp->chanctx);
- 	}
- 
- 	if ((avp->chanctx == sc->cur_chan) &&
diff --git a/package/kernel/mac80211/patches/318-brcmfmac-slightly-simplify-building-interface-combin.patch b/package/kernel/mac80211/patches/318-brcmfmac-slightly-simplify-building-interface-combin.patch
deleted file mode 100644
index d946ecce19..0000000000
--- a/package/kernel/mac80211/patches/318-brcmfmac-slightly-simplify-building-interface-combin.patch
+++ /dev/null
@@ -1,108 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Tue, 7 Jun 2016 21:10:18 +0200
-Subject: [PATCH] brcmfmac: slightly simplify building interface combinations
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This change reorders some operations in brcmf_setup_ifmodes in hope to
-make it simpler:
-1) It allocates arrays right before filling them. This way it's easier
-   to follow requested array length as it's immediately followed by
-   code filling it. It's easier to check e.g. why we need 4 entries for
-   P2P. Other than that it deduplicates some checks (e.g. for P2P).
-2) It reorders code to first prepare limits and then define a new combo.
-   Previously this was mixed (e.g. we were setting num of channels
-   before preparing limits).
-3) It modifies mbss code to use i variable just like other combos do.
-
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6284,29 +6284,15 @@ static int brcmf_setup_ifmodes(struct wi
- 	if (!combo)
- 		goto err;
- 
--	c0_limits = kcalloc(p2p ? 3 : 2, sizeof(*c0_limits), GFP_KERNEL);
--	if (!c0_limits)
--		goto err;
--
--	if (p2p) {
--		p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
--		if (!p2p_limits)
--			goto err;
--	}
--
--	if (mbss) {
--		mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL);
--		if (!mbss_limits)
--			goto err;
--	}
--
- 	wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
- 				 BIT(NL80211_IFTYPE_ADHOC) |
- 				 BIT(NL80211_IFTYPE_AP);
- 
- 	c = 0;
- 	i = 0;
--	combo[c].num_different_channels = 1;
-+	c0_limits = kcalloc(p2p ? 3 : 2, sizeof(*c0_limits), GFP_KERNEL);
-+	if (!c0_limits)
-+		goto err;
- 	c0_limits[i].max = 1;
- 	c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
- 	if (p2p) {
-@@ -6324,6 +6310,7 @@ static int brcmf_setup_ifmodes(struct wi
- 		c0_limits[i].max = 1;
- 		c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
- 	}
-+	combo[c].num_different_channels = 1;
- 	combo[c].max_interfaces = i;
- 	combo[c].n_limits = i;
- 	combo[c].limits = c0_limits;
-@@ -6331,7 +6318,9 @@ static int brcmf_setup_ifmodes(struct wi
- 	if (p2p) {
- 		c++;
- 		i = 0;
--		combo[c].num_different_channels = 1;
-+		p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
-+		if (!p2p_limits)
-+			goto err;
- 		p2p_limits[i].max = 1;
- 		p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
- 		p2p_limits[i].max = 1;
-@@ -6340,6 +6329,7 @@ static int brcmf_setup_ifmodes(struct wi
- 		p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
- 		p2p_limits[i].max = 1;
- 		p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
-+		combo[c].num_different_channels = 1;
- 		combo[c].max_interfaces = i;
- 		combo[c].n_limits = i;
- 		combo[c].limits = p2p_limits;
-@@ -6347,14 +6337,19 @@ static int brcmf_setup_ifmodes(struct wi
- 
- 	if (mbss) {
- 		c++;
-+		i = 0;
-+		mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL);
-+		if (!mbss_limits)
-+			goto err;
-+		mbss_limits[i].max = 4;
-+		mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
- 		combo[c].beacon_int_infra_match = true;
- 		combo[c].num_different_channels = 1;
--		mbss_limits[0].max = 4;
--		mbss_limits[0].types = BIT(NL80211_IFTYPE_AP);
- 		combo[c].max_interfaces = 4;
--		combo[c].n_limits = 1;
-+		combo[c].n_limits = i;
- 		combo[c].limits = mbss_limits;
- 	}
-+
- 	wiphy->n_iface_combinations = n_combos;
- 	wiphy->iface_combinations = combo;
- 	return 0;
diff --git a/package/kernel/mac80211/patches/318-mac80211-fix-up-mismerge-of-ieee80211_tx_dequeue.patch b/package/kernel/mac80211/patches/318-mac80211-fix-up-mismerge-of-ieee80211_tx_dequeue.patch
new file mode 100644
index 0000000000..2e742e4484
--- /dev/null
+++ b/package/kernel/mac80211/patches/318-mac80211-fix-up-mismerge-of-ieee80211_tx_dequeue.patch
@@ -0,0 +1,35 @@
+From: Bob Copeland <me@bobcopeland.com>
+Date: Wed, 12 Oct 2016 08:24:54 -0400
+Subject: [PATCH] mac80211: fix up mismerge of ieee80211_tx_dequeue
+
+Looks like this spinlock wound up on the wrong side of the
+linearize, and I also lost the part that re-enters the loop.
+Fix up to match mac80211-next.
+
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3457,17 +3457,17 @@ begin:
+ 			skb_queue_splice_tail(&tx.skbs, &txqi->frags);
+ 	}
+ 
+-out:
+-	spin_unlock_bh(&fq->lock);
+-
+ 	if (skb && skb_has_frag_list(skb) &&
+ 	    !ieee80211_hw_check(&local->hw, TX_FRAG_LIST)) {
+ 		if (skb_linearize(skb)) {
+ 			ieee80211_free_txskb(&local->hw, skb);
+-			return NULL;
++			goto begin;
+ 		}
+ 	}
+ 
++out:
++	spin_unlock_bh(&fq->lock);
++
+ 	return skb;
+ }
+ EXPORT_SYMBOL(ieee80211_tx_dequeue);
diff --git a/package/kernel/mac80211/patches/319-0001-brcmfmac-fix-lockup-when-removing-P2P-interface-afte.patch b/package/kernel/mac80211/patches/319-0001-brcmfmac-fix-lockup-when-removing-P2P-interface-afte.patch
deleted file mode 100644
index 073d012dea..0000000000
--- a/package/kernel/mac80211/patches/319-0001-brcmfmac-fix-lockup-when-removing-P2P-interface-afte.patch
+++ /dev/null
@@ -1,154 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Fri, 17 Jun 2016 12:29:21 +0200
-Subject: [PATCH] brcmfmac: fix lockup when removing P2P interface after
- event timeout
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Removing P2P interface is handled by sending a proper request to the
-firmware. On success firmware triggers an event and driver's handler
-removes a matching interface.
-
-However on event timeout we remove interface directly from the cfg80211
-callback. Current code doesn't handle this case correctly as it always
-assumes rtnl to be unlocked.
-
-Fix it by adding an extra rtnl_locked parameter to functions and calling
-unregister_netdevice when needed.
-
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -548,12 +548,16 @@ fail:
- 	return -EBADE;
- }
- 
--static void brcmf_net_detach(struct net_device *ndev)
-+static void brcmf_net_detach(struct net_device *ndev, bool rtnl_locked)
- {
--	if (ndev->reg_state == NETREG_REGISTERED)
--		unregister_netdev(ndev);
--	else
-+	if (ndev->reg_state == NETREG_REGISTERED) {
-+		if (rtnl_locked)
-+			unregister_netdevice(ndev);
-+		else
-+			unregister_netdev(ndev);
-+	} else {
- 		brcmf_cfg80211_free_netdev(ndev);
-+	}
- }
- 
- void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on)
-@@ -651,7 +655,7 @@ struct brcmf_if *brcmf_add_if(struct brc
- 			brcmf_err("ERROR: netdev:%s already exists\n",
- 				  ifp->ndev->name);
- 			netif_stop_queue(ifp->ndev);
--			brcmf_net_detach(ifp->ndev);
-+			brcmf_net_detach(ifp->ndev, false);
- 			drvr->iflist[bsscfgidx] = NULL;
- 		} else {
- 			brcmf_dbg(INFO, "netdev:%s ignore IF event\n",
-@@ -699,7 +703,8 @@ struct brcmf_if *brcmf_add_if(struct brc
- 	return ifp;
- }
- 
--static void brcmf_del_if(struct brcmf_pub *drvr, s32 bsscfgidx)
-+static void brcmf_del_if(struct brcmf_pub *drvr, s32 bsscfgidx,
-+			 bool rtnl_locked)
- {
- 	struct brcmf_if *ifp;
- 
-@@ -729,7 +734,7 @@ static void brcmf_del_if(struct brcmf_pu
- 			cancel_work_sync(&ifp->multicast_work);
- 			cancel_work_sync(&ifp->ndoffload_work);
- 		}
--		brcmf_net_detach(ifp->ndev);
-+		brcmf_net_detach(ifp->ndev, rtnl_locked);
- 	} else {
- 		/* Only p2p device interfaces which get dynamically created
- 		 * end up here. In this case the p2p module should be informed
-@@ -743,14 +748,14 @@ static void brcmf_del_if(struct brcmf_pu
- 	}
- }
- 
--void brcmf_remove_interface(struct brcmf_if *ifp)
-+void brcmf_remove_interface(struct brcmf_if *ifp, bool rtnl_locked)
- {
- 	if (!ifp || WARN_ON(ifp->drvr->iflist[ifp->bsscfgidx] != ifp))
- 		return;
- 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", ifp->bsscfgidx,
- 		  ifp->ifidx);
- 	brcmf_fws_del_interface(ifp);
--	brcmf_del_if(ifp->drvr, ifp->bsscfgidx);
-+	brcmf_del_if(ifp->drvr, ifp->bsscfgidx, rtnl_locked);
- }
- 
- #ifdef CONFIG_INET
-@@ -1057,9 +1062,9 @@ fail:
- 		brcmf_fws_deinit(drvr);
- 	}
- 	if (ifp)
--		brcmf_net_detach(ifp->ndev);
-+		brcmf_net_detach(ifp->ndev, false);
- 	if (p2p_ifp)
--		brcmf_net_detach(p2p_ifp->ndev);
-+		brcmf_net_detach(p2p_ifp->ndev, false);
- 	drvr->iflist[0] = NULL;
- 	drvr->iflist[1] = NULL;
- 	if (drvr->settings->ignore_probe_fail)
-@@ -1128,7 +1133,7 @@ void brcmf_detach(struct device *dev)
- 
- 	/* make sure primary interface removed last */
- 	for (i = BRCMF_MAX_IFS-1; i > -1; i--)
--		brcmf_remove_interface(drvr->iflist[i]);
-+		brcmf_remove_interface(drvr->iflist[i], false);
- 
- 	brcmf_cfg80211_detach(drvr->config);
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -216,7 +216,7 @@ struct brcmf_if *brcmf_get_ifp(struct br
- int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
- struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bsscfgidx, s32 ifidx,
- 			      bool is_p2pdev, char *name, u8 *mac_addr);
--void brcmf_remove_interface(struct brcmf_if *ifp);
-+void brcmf_remove_interface(struct brcmf_if *ifp, bool rtnl_locked);
- void brcmf_txflowblock_if(struct brcmf_if *ifp,
- 			  enum brcmf_netif_stop_reason reason, bool state);
- void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
-@@ -183,7 +183,7 @@ static void brcmf_fweh_handle_if_event(s
- 	err = brcmf_fweh_call_event_handler(ifp, emsg->event_code, emsg, data);
- 
- 	if (ifp && ifevent->action == BRCMF_E_IF_DEL)
--		brcmf_remove_interface(ifp);
-+		brcmf_remove_interface(ifp, false);
- }
- 
- /**
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -2289,7 +2289,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
- 			err = 0;
- 	}
- 	if (err)
--		brcmf_remove_interface(vif->ifp);
-+		brcmf_remove_interface(vif->ifp, true);
- 
- 	brcmf_cfg80211_arm_vif_event(cfg, NULL);
- 	if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE)
-@@ -2395,7 +2395,7 @@ void brcmf_p2p_detach(struct brcmf_p2p_i
- 	if (vif != NULL) {
- 		brcmf_p2p_cancel_remain_on_channel(vif->ifp);
- 		brcmf_p2p_deinit_discovery(p2p);
--		brcmf_remove_interface(vif->ifp);
-+		brcmf_remove_interface(vif->ifp, false);
- 	}
- 	/* just set it all to zero */
- 	memset(p2p, 0, sizeof(*p2p));
diff --git a/package/kernel/mac80211/patches/319-0002-brcmfmac-use-const-char-for-interface-name-in-brcmf_.patch b/package/kernel/mac80211/patches/319-0002-brcmfmac-use-const-char-for-interface-name-in-brcmf_.patch
deleted file mode 100644
index 6d3f3c640c..0000000000
--- a/package/kernel/mac80211/patches/319-0002-brcmfmac-use-const-char-for-interface-name-in-brcmf_.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Fri, 17 Jun 2016 12:48:44 +0200
-Subject: [PATCH] brcmfmac: use const char * for interface name in
- brcmf_add_if
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This function can work just fine with const pointer, it only calls
-alloc_netdev which take const as well. Moreover it makes this function
-more flexible as some cfg80211 callback may provide const char * as
-well, e.g. add_virtual_intf. This will be needed for more advanced
-interface management.
-
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -638,7 +638,7 @@ fail:
- }
- 
- struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bsscfgidx, s32 ifidx,
--			      bool is_p2pdev, char *name, u8 *mac_addr)
-+			      bool is_p2pdev, const char *name, u8 *mac_addr)
- {
- 	struct brcmf_if *ifp;
- 	struct net_device *ndev;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -215,7 +215,7 @@ char *brcmf_ifname(struct brcmf_if *ifp)
- struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx);
- int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
- struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bsscfgidx, s32 ifidx,
--			      bool is_p2pdev, char *name, u8 *mac_addr);
-+			      bool is_p2pdev, const char *name, u8 *mac_addr);
- void brcmf_remove_interface(struct brcmf_if *ifp, bool rtnl_locked);
- void brcmf_txflowblock_if(struct brcmf_if *ifp,
- 			  enum brcmf_netif_stop_reason reason, bool state);
diff --git a/package/kernel/mac80211/patches/319-0003-brcmfmac-include-also-core.h-header-in-cfg80211.h.patch b/package/kernel/mac80211/patches/319-0003-brcmfmac-include-also-core.h-header-in-cfg80211.h.patch
deleted file mode 100644
index eeda76661c..0000000000
--- a/package/kernel/mac80211/patches/319-0003-brcmfmac-include-also-core.h-header-in-cfg80211.h.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Sat, 18 Jun 2016 18:49:38 +0200
-Subject: [PATCH] brcmfmac: include also core.h header in cfg80211.h
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This header provides two inline functions using struct brcmf_if so we
-need core.h to avoid:
-
-drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h: In function ‘ndev_to_prof’:
-drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:368:13: error: dereferencing pointer to incomplete type
-  return &ifp->vif->profile;
-             ^
-drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h: In function ‘ndev_to_vif’:
-drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:374:12: error: dereferencing pointer to incomplete type
-  return ifp->vif;
-            ^
-
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-@@ -20,6 +20,7 @@
- /* for brcmu_d11inf */
- #include <brcmu_d11.h>
- 
-+#include "core.h"
- #include "fwil_types.h"
- #include "p2p.h"
- 
diff --git a/package/kernel/mac80211/patches/319-0004-brcmfmac-add-missing-break-when-deleting-P2P_DEVICE.patch b/package/kernel/mac80211/patches/319-0004-brcmfmac-add-missing-break-when-deleting-P2P_DEVICE.patch
deleted file mode 100644
index 3819248b0f..0000000000
--- a/package/kernel/mac80211/patches/319-0004-brcmfmac-add-missing-break-when-deleting-P2P_DEVICE.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Sun, 19 Jun 2016 01:55:57 +0200
-Subject: [PATCH] brcmfmac: add missing break when deleting P2P_DEVICE
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-We obviously don't want to fall through in that switch. With this change
-1) We wait for event (triggered by p2p_disc) as expected
-2) We remove interface manually on timeout
-3) We return 0 on success instead of -ENOTSUPP
-
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -2263,6 +2263,8 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
- 			return 0;
- 		brcmf_p2p_cancel_remain_on_channel(vif->ifp);
- 		brcmf_p2p_deinit_discovery(p2p);
-+		break;
-+
- 	default:
- 		return -ENOTSUPP;
- 	}
diff --git a/package/kernel/mac80211/patches/319-0005-brcmfmac-delete-interface-directly-in-code-that-sent.patch b/package/kernel/mac80211/patches/319-0005-brcmfmac-delete-interface-directly-in-code-that-sent.patch
deleted file mode 100644
index 12d7eb4887..0000000000
--- a/package/kernel/mac80211/patches/319-0005-brcmfmac-delete-interface-directly-in-code-that-sent.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Wed, 29 Jun 2016 21:54:26 +0200
-Subject: [PATCH] brcmfmac: delete interface directly in code that sent fw
- request
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-So far when receiving event about in-firmware-interface removal our
-event worker was notifying listener and afterwards it was removing Linux
-interface.
-
-First of all it was resulting in slightly unexpected order. The listener
-(del_virtual_intf callback) was (usually) returning with success before
-we even called unregister_netdev(ice).
-
-Please note this couldn't be simply fixed by changing order of calls in
-brcmf_fweh_handle_if_event as unregistering interface earlier could free
-struct brcmf_if.
-
-Another problem of current implementation are possible lockups. Focus on
-the time slot between calling event handler and removing Linux
-interface. During that time original caller may leave (unlocking rtnl
-semaphore) *and* another call to the same code may be done (locking it
-again). If that happens our event handler will stuck at removing Linux
-interface, it won't handle another event and will block process holding
-rtnl lock.
-
-This can be simply solved by unregistering interface in a proper
-callback, right after receiving confirmation event from firmware. This
-only required modifying worker to don't unregister on its own if there
-is someone waiting for the event.
-
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
-@@ -18,6 +18,7 @@
- #include "brcmu_wifi.h"
- #include "brcmu_utils.h"
- 
-+#include "cfg80211.h"
- #include "core.h"
- #include "debug.h"
- #include "tracepoint.h"
-@@ -182,8 +183,13 @@ static void brcmf_fweh_handle_if_event(s
- 
- 	err = brcmf_fweh_call_event_handler(ifp, emsg->event_code, emsg, data);
- 
--	if (ifp && ifevent->action == BRCMF_E_IF_DEL)
--		brcmf_remove_interface(ifp, false);
-+	if (ifp && ifevent->action == BRCMF_E_IF_DEL) {
-+		bool armed = brcmf_cfg80211_vif_event_armed(drvr->config);
-+
-+		/* Default handling in case no-one waits for this event */
-+		if (!armed)
-+			brcmf_remove_interface(ifp, false);
-+	}
- }
- 
- /**
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -2290,8 +2290,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
- 		else
- 			err = 0;
- 	}
--	if (err)
--		brcmf_remove_interface(vif->ifp, true);
-+	brcmf_remove_interface(vif->ifp, true);
- 
- 	brcmf_cfg80211_arm_vif_event(cfg, NULL);
- 	if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE)
diff --git a/package/kernel/mac80211/patches/319-0006-brcmfmac-support-removing-AP-interfaces-with-interfa.patch b/package/kernel/mac80211/patches/319-0006-brcmfmac-support-removing-AP-interfaces-with-interfa.patch
deleted file mode 100644
index 2f7165eade..0000000000
--- a/package/kernel/mac80211/patches/319-0006-brcmfmac-support-removing-AP-interfaces-with-interfa.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Wed, 29 Jun 2016 21:54:27 +0200
-Subject: [PATCH] brcmfmac: support removing AP interfaces with
- "interface_remove"
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-New firmwares (e.g. 10.10.69.36 for BCM4366) support "interface_remove"
-for removing interfaces. Try to use this method on cfg80211 request. In
-case of older firmwares (e.g. 7.35.177.56 for BCM43602 as I tested) this
-will just result in firmware rejecting command and this won't change any
-behavior.
-
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -785,12 +785,48 @@ s32 brcmf_notify_escan_complete(struct b
- 	return err;
- }
- 
-+static int brcmf_cfg80211_del_ap_iface(struct wiphy *wiphy,
-+				       struct wireless_dev *wdev)
-+{
-+	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
-+	struct net_device *ndev = wdev->netdev;
-+	struct brcmf_if *ifp = netdev_priv(ndev);
-+	int ret;
-+	int err;
-+
-+	brcmf_cfg80211_arm_vif_event(cfg, ifp->vif);
-+
-+	err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
-+	if (err) {
-+		brcmf_err("interface_remove failed %d\n", err);
-+		goto err_unarm;
-+	}
-+
-+	/* wait for firmware event */
-+	ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
-+					    BRCMF_VIF_EVENT_TIMEOUT);
-+	if (!ret) {
-+		brcmf_err("timeout occurred\n");
-+		err = -EIO;
-+		goto err_unarm;
-+	}
-+
-+	brcmf_remove_interface(ifp, true);
-+
-+err_unarm:
-+	brcmf_cfg80211_arm_vif_event(cfg, NULL);
-+	return err;
-+}
-+
- static
- int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
- {
- 	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
- 	struct net_device *ndev = wdev->netdev;
- 
-+	if (ndev && ndev == cfg_to_ndev(cfg))
-+		return -ENOTSUPP;
-+
- 	/* vif event pending in firmware */
- 	if (brcmf_cfg80211_vif_event_armed(cfg))
- 		return -EBUSY;
-@@ -807,12 +843,13 @@ int brcmf_cfg80211_del_iface(struct wiph
- 	switch (wdev->iftype) {
- 	case NL80211_IFTYPE_ADHOC:
- 	case NL80211_IFTYPE_STATION:
--	case NL80211_IFTYPE_AP:
- 	case NL80211_IFTYPE_AP_VLAN:
- 	case NL80211_IFTYPE_WDS:
- 	case NL80211_IFTYPE_MONITOR:
- 	case NL80211_IFTYPE_MESH_POINT:
- 		return -EOPNOTSUPP;
-+	case NL80211_IFTYPE_AP:
-+		return brcmf_cfg80211_del_ap_iface(wiphy, wdev);
- 	case NL80211_IFTYPE_P2P_CLIENT:
- 	case NL80211_IFTYPE_P2P_GO:
- 	case NL80211_IFTYPE_P2P_DEVICE:
diff --git a/package/kernel/mac80211/patches/319-0007-brcmfmac-respect-hidden_ssid-for-AP-interfaces.patch b/package/kernel/mac80211/patches/319-0007-brcmfmac-respect-hidden_ssid-for-AP-interfaces.patch
deleted file mode 100644
index 26721d6f68..0000000000
--- a/package/kernel/mac80211/patches/319-0007-brcmfmac-respect-hidden_ssid-for-AP-interfaces.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From c940de10d45efc5664ee993a6da281f45c804e59 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Wed, 6 Jul 2016 12:22:54 +0200
-Subject: [PATCH] brcmfmac: respect hidden_ssid for AP interfaces
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This was succesfully tested with 4366B1. A small workaround is needed
-for the main interface otherwise it would stuck at the hidden state.
-
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 13 +++++++++++++
- 1 file changed, 13 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -4662,6 +4662,15 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
- 			brcmf_err("SET SSID error (%d)\n", err);
- 			goto exit;
- 		}
-+
-+		if (settings->hidden_ssid) {
-+			err = brcmf_fil_iovar_int_set(ifp, "closednet", 1);
-+			if (err) {
-+				brcmf_err("closednet error (%d)\n", err);
-+				goto exit;
-+			}
-+		}
-+
- 		brcmf_dbg(TRACE, "AP mode configuration complete\n");
- 	} else if (dev_role == NL80211_IFTYPE_P2P_GO) {
- 		err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
-@@ -4720,6 +4729,10 @@ static int brcmf_cfg80211_stop_ap(struct
- 			return err;
- 		}
- 
-+		/* First BSS doesn't get a full reset */
-+		if (ifp->bsscfgidx == 0)
-+			brcmf_fil_iovar_int_set(ifp, "closednet", 0);
-+
- 		memset(&join_params, 0, sizeof(join_params));
- 		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
- 					     &join_params, sizeof(join_params));
diff --git a/package/kernel/mac80211/patches/319-0008-brcmfmac-restore-stopping-netdev-queue-when-bus-clog.patch b/package/kernel/mac80211/patches/319-0008-brcmfmac-restore-stopping-netdev-queue-when-bus-clog.patch
deleted file mode 100644
index 740f84ef27..0000000000
--- a/package/kernel/mac80211/patches/319-0008-brcmfmac-restore-stopping-netdev-queue-when-bus-clog.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 82bc9ab6a8f577d2174a736c33f3d4ecf7d9ef47 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Fri, 15 Jul 2016 12:16:12 +0200
-Subject: [PATCH] brcmfmac: restore stopping netdev queue when bus clogs up
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When the host-interface bus has hard time handling transmit packets
-it informs higher layer about this and it would stop the netdev
-queue when needed. However, since commit 9cd18359d31e ("brcmfmac:
-Make FWS queueing configurable.") this was broken. With this patch
-the behaviour is restored.
-
-Cc: stable@vger.kernel.org # v4.5, v4.6, v4.7
-Fixes: 9cd18359d31e ("brcmfmac: Make FWS queueing configurable.")
-Tested-by: Per Förlin <per.forlin@gmail.com>
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/fwsignal.c         | 22 +++++++++++++++++-----
- 1 file changed, 17 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-@@ -2469,10 +2469,22 @@ void brcmf_fws_bustxfail(struct brcmf_fw
- void brcmf_fws_bus_blocked(struct brcmf_pub *drvr, bool flow_blocked)
- {
- 	struct brcmf_fws_info *fws = drvr->fws;
-+	struct brcmf_if *ifp;
-+	int i;
- 
--	fws->bus_flow_blocked = flow_blocked;
--	if (!flow_blocked)
--		brcmf_fws_schedule_deq(fws);
--	else
--		fws->stats.bus_flow_block++;
-+	if (fws->avoid_queueing) {
-+		for (i = 0; i < BRCMF_MAX_IFS; i++) {
-+			ifp = drvr->iflist[i];
-+			if (!ifp || !ifp->ndev)
-+				continue;
-+			brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_FLOW,
-+					     flow_blocked);
-+		}
-+	} else {
-+		fws->bus_flow_blocked = flow_blocked;
-+		if (!flow_blocked)
-+			brcmf_fws_schedule_deq(fws);
-+		else
-+			fws->stats.bus_flow_block++;
-+	}
- }
diff --git a/package/kernel/mac80211/patches/319-0009-brcmfmac-defer-DPC-processing-during-probe.patch b/package/kernel/mac80211/patches/319-0009-brcmfmac-defer-DPC-processing-during-probe.patch
deleted file mode 100644
index 2fbf5e3fdb..0000000000
--- a/package/kernel/mac80211/patches/319-0009-brcmfmac-defer-DPC-processing-during-probe.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From fd3ed33f51c2a586412d35b4f64803f019ab589f Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Fri, 15 Jul 2016 12:39:13 +0200
-Subject: [PATCH] brcmfmac: defer DPC processing during probe
-
-The sdio dpc starts processing when in SDIOD_STATE_DATA. This state was
-entered right after firmware download. This patch moves that transition
-just before enabling sdio interrupt handling thus avoiding watchdog
-expiry which would put the bus to sleep while probing.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 +++----
- 1 file changed, 3 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3305,10 +3305,6 @@ static int brcmf_sdio_download_firmware(
- 		goto err;
- 	}
- 
--	/* Allow full data communication using DPC from now on. */
--	brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DATA);
--	bcmerror = 0;
--
- err:
- 	brcmf_sdio_clkctl(bus, CLK_SDONLY, false);
- 	sdio_release_host(bus->sdiodev->func[1]);
-@@ -4046,6 +4042,9 @@ static void brcmf_sdio_firmware_callback
- 	}
- 
- 	if (err == 0) {
-+		/* Allow full data communication using DPC from now on. */
-+		brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DATA);
-+
- 		err = brcmf_sdiod_intr_register(sdiodev);
- 		if (err != 0)
- 			brcmf_err("intr register failed:%d\n", err);
diff --git a/package/kernel/mac80211/patches/319-0010-brcmfmac-Fix-glob_skb-leak-in-brcmf_sdiod_recv_chain.patch b/package/kernel/mac80211/patches/319-0010-brcmfmac-Fix-glob_skb-leak-in-brcmf_sdiod_recv_chain.patch
deleted file mode 100644
index c33aa2dab9..0000000000
--- a/package/kernel/mac80211/patches/319-0010-brcmfmac-Fix-glob_skb-leak-in-brcmf_sdiod_recv_chain.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 3bdae810721b33061d2e541bd78a70f86ca42af3 Mon Sep 17 00:00:00 2001
-From: Florian Fainelli <f.fainelli@gmail.com>
-Date: Mon, 18 Jul 2016 16:24:34 -0700
-Subject: [PATCH] brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain
-
-In case brcmf_sdiod_recv_chain() cannot complete a succeful call to
-brcmf_sdiod_buffrw, we would be leaking glom_skb and not free it as we
-should, fix this.
-
-Reported-by: coverity (CID 1164856)
-Fixes: a413e39a38573 ("brcmfmac: fix brcmf_sdcard_recv_chain() for host without sg support")
-Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -726,8 +726,10 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 			return -ENOMEM;
- 		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
- 					 glom_skb);
--		if (err)
-+		if (err) {
-+			brcmu_pkt_buf_free_skb(glom_skb);
- 			goto done;
-+		}
- 
- 		skb_queue_walk(pktq, skb) {
- 			memcpy(skb->data, glom_skb->data, skb->len);
diff --git a/package/kernel/mac80211/patches/319-0011-net-wireless-broadcom-brcm80211-brcmfmac-usb-don-t-p.patch b/package/kernel/mac80211/patches/319-0011-net-wireless-broadcom-brcm80211-brcmfmac-usb-don-t-p.patch
deleted file mode 100644
index 540b7f08bf..0000000000
--- a/package/kernel/mac80211/patches/319-0011-net-wireless-broadcom-brcm80211-brcmfmac-usb-don-t-p.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 938f89e50a41c2d56710805fb019ad7618cef84b Mon Sep 17 00:00:00 2001
-From: Wolfram Sang <wsa-dev@sang-engineering.com>
-Date: Thu, 11 Aug 2016 23:05:31 +0200
-Subject: [PATCH] net: wireless: broadcom: brcm80211: brcmfmac: usb: don't
- print error when allocating urb fails
-
-kmalloc will print enough information in case of failure.
-
-Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 8 ++------
- 1 file changed, 2 insertions(+), 6 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1099,15 +1099,11 @@ struct brcmf_usbdev *brcmf_usb_attach(st
- 	devinfo->tx_freecount = ntxq;
- 
- 	devinfo->ctl_urb = usb_alloc_urb(0, GFP_ATOMIC);
--	if (!devinfo->ctl_urb) {
--		brcmf_err("usb_alloc_urb (ctl) failed\n");
-+	if (!devinfo->ctl_urb)
- 		goto error;
--	}
- 	devinfo->bulk_urb = usb_alloc_urb(0, GFP_ATOMIC);
--	if (!devinfo->bulk_urb) {
--		brcmf_err("usb_alloc_urb (bulk) failed\n");
-+	if (!devinfo->bulk_urb)
- 		goto error;
--	}
- 
- 	return &devinfo->bus_pub;
- 
diff --git a/package/kernel/mac80211/patches/319-0012-brcmfmac-Check-rtnl_lock-is-locked-when-removing-int.patch b/package/kernel/mac80211/patches/319-0012-brcmfmac-Check-rtnl_lock-is-locked-when-removing-int.patch
deleted file mode 100644
index 6105e6e57f..0000000000
--- a/package/kernel/mac80211/patches/319-0012-brcmfmac-Check-rtnl_lock-is-locked-when-removing-int.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-From 15dacf880e49ce3ecee05eb1a0c6b8e363dbacdc Mon Sep 17 00:00:00 2001
-From: "mhiramat@kernel.org" <mhiramat@kernel.org>
-Date: Mon, 15 Aug 2016 18:40:57 +0900
-Subject: [PATCH] brcmfmac: Check rtnl_lock is locked when removing interface
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Check rtnl_lock is locked in brcmf_p2p_ifp_removed() by passing
-rtnl_locked flag. Actually the caller brcmf_del_if() checks whether
-the rtnl_lock is locked, but doesn't pass it to brcmf_p2p_ifp_removed().
-
-Without this fix, wpa_supplicant goes softlockup with rtnl_lock
-holding (this means all other process using netlink are locked up too)
-
-e.g.
-[ 4495.876627] INFO: task wpa_supplicant:7307 blocked for more than 10 seconds.
-[ 4495.876632]       Tainted: G        W       4.8.0-rc1+ #8
-[ 4495.876635] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
-[ 4495.876638] wpa_supplicant  D ffff974c647b39a0     0  7307      1 0x00000000
-[ 4495.876644]  ffff974c647b39a0 0000000000000000 ffff974c00000000 ffff974c7dc59c58
-[ 4495.876651]  ffff974c6b7417c0 ffff974c645017c0 ffff974c647b4000 ffffffff86f16c08
-[ 4495.876657]  ffff974c645017c0 0000000000000246 00000000ffffffff ffff974c647b39b8
-[ 4495.876664] Call Trace:
-[ 4495.876671]  [<ffffffff868aeccc>] schedule+0x3c/0x90
-[ 4495.876676]  [<ffffffff868af065>] schedule_preempt_disabled+0x15/0x20
-[ 4495.876682]  [<ffffffff868b0996>] mutex_lock_nested+0x176/0x3b0
-[ 4495.876686]  [<ffffffff867a2067>] ? rtnl_lock+0x17/0x20
-[ 4495.876690]  [<ffffffff867a2067>] rtnl_lock+0x17/0x20
-[ 4495.876720]  [<ffffffffc0ae9a5d>] brcmf_p2p_ifp_removed+0x4d/0x70 [brcmfmac]
-[ 4495.876741]  [<ffffffffc0aebde6>] brcmf_remove_interface+0x196/0x1b0 [brcmfmac]
-[ 4495.876760]  [<ffffffffc0ae9901>] brcmf_p2p_del_vif+0x111/0x220 [brcmfmac]
-[ 4495.876777]  [<ffffffffc0adefab>] brcmf_cfg80211_del_iface+0x21b/0x270 [brcmfmac]
-[ 4495.876820]  [<ffffffffc097b39e>] nl80211_del_interface+0xfe/0x3a0 [cfg80211]
-[ 4495.876825]  [<ffffffff867ca335>] genl_family_rcv_msg+0x1b5/0x370
-[ 4495.876832]  [<ffffffff860e5d8d>] ? trace_hardirqs_on+0xd/0x10
-[ 4495.876836]  [<ffffffff867ca56d>] genl_rcv_msg+0x7d/0xb0
-[ 4495.876839]  [<ffffffff867ca4f0>] ? genl_family_rcv_msg+0x370/0x370
-[ 4495.876846]  [<ffffffff867c9a47>] netlink_rcv_skb+0x97/0xb0
-[ 4495.876849]  [<ffffffff867ca168>] genl_rcv+0x28/0x40
-[ 4495.876854]  [<ffffffff867c93c3>] netlink_unicast+0x1d3/0x2f0
-[ 4495.876860]  [<ffffffff867c933b>] ? netlink_unicast+0x14b/0x2f0
-[ 4495.876866]  [<ffffffff867c97cb>] netlink_sendmsg+0x2eb/0x3a0
-[ 4495.876870]  [<ffffffff8676dad8>] sock_sendmsg+0x38/0x50
-[ 4495.876874]  [<ffffffff8676e4df>] ___sys_sendmsg+0x27f/0x290
-[ 4495.876882]  [<ffffffff8628b935>] ? mntput_no_expire+0x5/0x3f0
-[ 4495.876888]  [<ffffffff8628b9be>] ? mntput_no_expire+0x8e/0x3f0
-[ 4495.876894]  [<ffffffff8628b935>] ? mntput_no_expire+0x5/0x3f0
-[ 4495.876899]  [<ffffffff8628bd44>] ? mntput+0x24/0x40
-[ 4495.876904]  [<ffffffff86267830>] ? __fput+0x190/0x200
-[ 4495.876909]  [<ffffffff8676f125>] __sys_sendmsg+0x45/0x80
-[ 4495.876914]  [<ffffffff8676f172>] SyS_sendmsg+0x12/0x20
-[ 4495.876918]  [<ffffffff868b5680>] entry_SYSCALL_64_fastpath+0x23/0xc1
-[ 4495.876924]  [<ffffffff860e2b8f>] ? trace_hardirqs_off_caller+0x1f/0xc0
-
-Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
-Acked-by: Rafał Miłecki <rafal@milecki.pl>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 2 +-
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c  | 8 +++++---
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h  | 2 +-
- 3 files changed, 7 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -743,7 +743,7 @@ static void brcmf_del_if(struct brcmf_pu
- 		 * serious troublesome side effects. The p2p module will clean
- 		 * up the ifp if needed.
- 		 */
--		brcmf_p2p_ifp_removed(ifp);
-+		brcmf_p2p_ifp_removed(ifp, rtnl_locked);
- 		kfree(ifp);
- 	}
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -2299,7 +2299,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
- 	return err;
- }
- 
--void brcmf_p2p_ifp_removed(struct brcmf_if *ifp)
-+void brcmf_p2p_ifp_removed(struct brcmf_if *ifp, bool rtnl_locked)
- {
- 	struct brcmf_cfg80211_info *cfg;
- 	struct brcmf_cfg80211_vif *vif;
-@@ -2308,9 +2308,11 @@ void brcmf_p2p_ifp_removed(struct brcmf_
- 	vif = ifp->vif;
- 	cfg = wdev_to_cfg(&vif->wdev);
- 	cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
--	rtnl_lock();
-+	if (!rtnl_locked)
-+		rtnl_lock();
- 	cfg80211_unregister_wdev(&vif->wdev);
--	rtnl_unlock();
-+	if (!rtnl_locked)
-+		rtnl_unlock();
- 	brcmf_free_vif(vif);
- }
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
-@@ -155,7 +155,7 @@ struct wireless_dev *brcmf_p2p_add_vif(s
- int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev);
- int brcmf_p2p_ifchange(struct brcmf_cfg80211_info *cfg,
- 		       enum brcmf_fil_p2p_if_types if_type);
--void brcmf_p2p_ifp_removed(struct brcmf_if *ifp);
-+void brcmf_p2p_ifp_removed(struct brcmf_if *ifp, bool rtnl_locked);
- int brcmf_p2p_start_device(struct wiphy *wiphy, struct wireless_dev *wdev);
- void brcmf_p2p_stop_device(struct wiphy *wiphy, struct wireless_dev *wdev);
- int brcmf_p2p_scan_prep(struct wiphy *wiphy,
diff --git a/package/kernel/mac80211/patches/319-0013-brcmfmac-Change-vif_event_lock-to-spinlock.patch b/package/kernel/mac80211/patches/319-0013-brcmfmac-Change-vif_event_lock-to-spinlock.patch
deleted file mode 100644
index 6e788a728a..0000000000
--- a/package/kernel/mac80211/patches/319-0013-brcmfmac-Change-vif_event_lock-to-spinlock.patch
+++ /dev/null
@@ -1,175 +0,0 @@
-From b64abcb7dae6060c67ab0e548da3ef923c49641d Mon Sep 17 00:00:00 2001
-From: "mhiramat@kernel.org" <mhiramat@kernel.org>
-Date: Mon, 15 Aug 2016 18:41:12 +0900
-Subject: [PATCH] brcmfmac: Change vif_event_lock to spinlock
-
-Change vif_event_lock to spinlock from mutex, since this lock is
-used in wait_event_timeout() via vif_event_equals(). This caused
-a warning report as below.
-
-As far as I can see, this lock protects regions where updating
-structure members, not function calls. Also, since those
-regions are not called from interrupt handlers (of course, it
-was a mutex), spin_lock is used instead of spin_lock_irqsave.
-
-[  186.678550] ------------[ cut here ]------------
-[  186.678556] WARNING: CPU: 2 PID: 7140 at /home/mhiramat/ksrc/linux/kernel/sched/core.c:7545 __might_sleep+0x7c/0x80
-[  186.678560] do not call blocking ops when !TASK_RUNNING; state=2 set at [<ffffffff980d9090>] prepare_to_wait_event+0x60/0x100
-[  186.678560] Modules linked in: brcmfmac xt_CHECKSUM rfcomm ipt_MASQUERADE nf_nat_masquerade_ipv4 xt_addrtype br_netfilter xt_tcpudp ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_raw ip6table_security ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_filter ip6_tables iptable_raw iptable_security iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_filter ip_tables x_tables bnep nls_iso8859_1 i2c_designware_platform i2c_designware_core snd_hda_codec_hdmi snd_hda_codec_realtek dcdbas snd_hda_codec_generic snd_hda_intel snd_hda_codec intel_rapl snd_hda_core x86_pkg_temp_thermal intel_powerclamp coretemp
-[  186.678594]  snd_pcm crct10dif_pclmul crc32_pclmul aesni_intel aes_x86_64 joydev glue_helper snd_hwdep lrw gf128mul uvcvideo ablk_helper snd_seq_midi cryptd snd_seq_midi_event snd_rawmidi videobuf2_vmalloc videobuf2_memops snd_seq input_leds videobuf2_v4l2 cfg80211 videobuf2_core snd_timer videodev serio_raw btusb snd_seq_device media btrtl rtsx_pci_ms snd mei_me memstick hid_multitouch mei soundcore brcmutil idma64 virt_dma intel_lpss_pci processor_thermal_device intel_soc_dts_iosf hci_uart btbcm btqca btintel bluetooth int3403_thermal dell_smo8800 intel_lpss_acpi intel_lpss int3402_thermal int340x_thermal_zone intel_hid mac_hid int3400_thermal shpchp sparse_keymap acpi_pad acpi_thermal_rel acpi_als kfifo_buf industrialio kvm_intel kvm irqbypass parport_pc ppdev lp parport autofs4 btrfs xor raid6_pq
-[  186.678631]  usbhid nouveau ttm i915 rtsx_pci_sdmmc mxm_wmi i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops psmouse drm ahci rtsx_pci nvme nvme_core libahci i2c_hid hid pinctrl_sunrisepoint video wmi pinctrl_intel fjes [last unloaded: brcmfmac]
-[  186.678646] CPU: 2 PID: 7140 Comm: wpa_supplicant Not tainted 4.8.0-rc1+ #8
-[  186.678647] Hardware name: Dell Inc. XPS 15 9550/0N7TVV, BIOS 01.02.00 04/07/2016
-[  186.678648]  0000000000000000 ffff9d8c64b5b900 ffffffff98442f23 ffff9d8c64b5b950
-[  186.678651]  0000000000000000 ffff9d8c64b5b940 ffffffff9808b22b 00001d790000000d
-[  186.678653]  ffffffff98c75e78 000000000000026c 0000000000000000 ffff9d8c2706d058
-[  186.678655] Call Trace:
-[  186.678659]  [<ffffffff98442f23>] dump_stack+0x85/0xc2
-[  186.678666]  [<ffffffff9808b22b>] __warn+0xcb/0xf0
-[  186.678668]  [<ffffffff9808b29f>] warn_slowpath_fmt+0x4f/0x60
-[  186.678671]  [<ffffffff980d9090>] ? prepare_to_wait_event+0x60/0x100
-[  186.678672]  [<ffffffff980d9090>] ? prepare_to_wait_event+0x60/0x100
-[  186.678674]  [<ffffffff980b922c>] __might_sleep+0x7c/0x80
-[  186.678680]  [<ffffffff988b0853>] mutex_lock_nested+0x33/0x3b0
-[  186.678682]  [<ffffffff980e5d8d>] ? trace_hardirqs_on+0xd/0x10
-[  186.678689]  [<ffffffffc0c57d2d>] brcmf_cfg80211_wait_vif_event+0xcd/0x130 [brcmfmac]
-[  186.678691]  [<ffffffff980d9190>] ? wake_atomic_t_function+0x60/0x60
-[  186.678697]  [<ffffffffc0c628e9>] brcmf_p2p_del_vif+0xf9/0x220 [brcmfmac]
-[  186.678702]  [<ffffffffc0c57fab>] brcmf_cfg80211_del_iface+0x21b/0x270 [brcmfmac]
-[  186.678716]  [<ffffffffc0b0539e>] nl80211_del_interface+0xfe/0x3a0 [cfg80211]
-[  186.678718]  [<ffffffff987ca335>] genl_family_rcv_msg+0x1b5/0x370
-[  186.678720]  [<ffffffff980e5d8d>] ? trace_hardirqs_on+0xd/0x10
-[  186.678721]  [<ffffffff987ca56d>] genl_rcv_msg+0x7d/0xb0
-[  186.678722]  [<ffffffff987ca4f0>] ? genl_family_rcv_msg+0x370/0x370
-[  186.678724]  [<ffffffff987c9a47>] netlink_rcv_skb+0x97/0xb0
-[  186.678726]  [<ffffffff987ca168>] genl_rcv+0x28/0x40
-[  186.678727]  [<ffffffff987c93c3>] netlink_unicast+0x1d3/0x2f0
-[  186.678729]  [<ffffffff987c933b>] ? netlink_unicast+0x14b/0x2f0
-[  186.678731]  [<ffffffff987c97cb>] netlink_sendmsg+0x2eb/0x3a0
-[  186.678733]  [<ffffffff9876dad8>] sock_sendmsg+0x38/0x50
-[  186.678734]  [<ffffffff9876e4df>] ___sys_sendmsg+0x27f/0x290
-[  186.678737]  [<ffffffff9828b935>] ? mntput_no_expire+0x5/0x3f0
-[  186.678739]  [<ffffffff9828b9be>] ? mntput_no_expire+0x8e/0x3f0
-[  186.678741]  [<ffffffff9828b935>] ? mntput_no_expire+0x5/0x3f0
-[  186.678743]  [<ffffffff9828bd44>] ? mntput+0x24/0x40
-[  186.678744]  [<ffffffff98267830>] ? __fput+0x190/0x200
-[  186.678746]  [<ffffffff9876f125>] __sys_sendmsg+0x45/0x80
-[  186.678748]  [<ffffffff9876f172>] SyS_sendmsg+0x12/0x20
-[  186.678749]  [<ffffffff988b5680>] entry_SYSCALL_64_fastpath+0x23/0xc1
-[  186.678751]  [<ffffffff980e2b8f>] ? trace_hardirqs_off_caller+0x1f/0xc0
-[  186.678752] ---[ end trace e224d66c5d8408b5 ]---
-
-Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 26 +++++++++++-----------
- .../broadcom/brcm80211/brcmfmac/cfg80211.h         |  2 +-
- 2 files changed, 14 insertions(+), 14 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -5631,7 +5631,7 @@ static s32 brcmf_notify_vif_event(struct
- 		  ifevent->action, ifevent->flags, ifevent->ifidx,
- 		  ifevent->bsscfgidx);
- 
--	mutex_lock(&event->vif_event_lock);
-+	spin_lock(&event->vif_event_lock);
- 	event->action = ifevent->action;
- 	vif = event->vif;
- 
-@@ -5639,7 +5639,7 @@ static s32 brcmf_notify_vif_event(struct
- 	case BRCMF_E_IF_ADD:
- 		/* waiting process may have timed out */
- 		if (!cfg->vif_event.vif) {
--			mutex_unlock(&event->vif_event_lock);
-+			spin_unlock(&event->vif_event_lock);
- 			return -EBADF;
- 		}
- 
-@@ -5650,24 +5650,24 @@ static s32 brcmf_notify_vif_event(struct
- 			ifp->ndev->ieee80211_ptr = &vif->wdev;
- 			SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
- 		}
--		mutex_unlock(&event->vif_event_lock);
-+		spin_unlock(&event->vif_event_lock);
- 		wake_up(&event->vif_wq);
- 		return 0;
- 
- 	case BRCMF_E_IF_DEL:
--		mutex_unlock(&event->vif_event_lock);
-+		spin_unlock(&event->vif_event_lock);
- 		/* event may not be upon user request */
- 		if (brcmf_cfg80211_vif_event_armed(cfg))
- 			wake_up(&event->vif_wq);
- 		return 0;
- 
- 	case BRCMF_E_IF_CHANGE:
--		mutex_unlock(&event->vif_event_lock);
-+		spin_unlock(&event->vif_event_lock);
- 		wake_up(&event->vif_wq);
- 		return 0;
- 
- 	default:
--		mutex_unlock(&event->vif_event_lock);
-+		spin_unlock(&event->vif_event_lock);
- 		break;
- 	}
- 	return -EINVAL;
-@@ -5788,7 +5788,7 @@ static void wl_deinit_priv(struct brcmf_
- static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
- {
- 	init_waitqueue_head(&event->vif_wq);
--	mutex_init(&event->vif_event_lock);
-+	spin_lock_init(&event->vif_event_lock);
- }
- 
- static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
-@@ -6687,9 +6687,9 @@ static inline bool vif_event_equals(stru
- {
- 	u8 evt_action;
- 
--	mutex_lock(&event->vif_event_lock);
-+	spin_lock(&event->vif_event_lock);
- 	evt_action = event->action;
--	mutex_unlock(&event->vif_event_lock);
-+	spin_unlock(&event->vif_event_lock);
- 	return evt_action == action;
- }
- 
-@@ -6698,10 +6698,10 @@ void brcmf_cfg80211_arm_vif_event(struct
- {
- 	struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
- 
--	mutex_lock(&event->vif_event_lock);
-+	spin_lock(&event->vif_event_lock);
- 	event->vif = vif;
- 	event->action = 0;
--	mutex_unlock(&event->vif_event_lock);
-+	spin_unlock(&event->vif_event_lock);
- }
- 
- bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
-@@ -6709,9 +6709,9 @@ bool brcmf_cfg80211_vif_event_armed(stru
- 	struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
- 	bool armed;
- 
--	mutex_lock(&event->vif_event_lock);
-+	spin_lock(&event->vif_event_lock);
- 	armed = event->vif != NULL;
--	mutex_unlock(&event->vif_event_lock);
-+	spin_unlock(&event->vif_event_lock);
- 
- 	return armed;
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-@@ -227,7 +227,7 @@ struct escan_info {
-  */
- struct brcmf_cfg80211_vif_event {
- 	wait_queue_head_t vif_wq;
--	struct mutex vif_event_lock;
-+	spinlock_t vif_event_lock;
- 	u8 action;
- 	struct brcmf_cfg80211_vif *vif;
- };
diff --git a/package/kernel/mac80211/patches/319-0014-brcmfmac-add-missing-header-dependencies.patch b/package/kernel/mac80211/patches/319-0014-brcmfmac-add-missing-header-dependencies.patch
deleted file mode 100644
index 1a7947b39a..0000000000
--- a/package/kernel/mac80211/patches/319-0014-brcmfmac-add-missing-header-dependencies.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 8af92af3f2d55db143417a5d401696f4b642009a Mon Sep 17 00:00:00 2001
-From: Baoyou Xie <baoyou.xie@linaro.org>
-Date: Mon, 29 Aug 2016 20:39:35 +0800
-Subject: [PATCH] brcmfmac: add missing header dependencies
-
-We get 1 warning when building kernel with W=1:
-
-drivers/net/wireless/broadcom/brcm80211/brcmfmac/tracepoint.c:23:6: warning: no previous prototype for '__brcmf_err' [-Wmissing-prototypes]
-
-In fact, this function is declared in brcmfmac/debug.h, so this patch
-adds missing header dependencies.
-
-Signed-off-by: Baoyou Xie <baoyou.xie@linaro.org>
-Acked-by: Arnd Bergmann <arnd@arndb.de>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/tracepoint.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/tracepoint.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/tracepoint.c
-@@ -19,6 +19,7 @@
- #ifndef __CHECKER__
- #define CREATE_TRACE_POINTS
- #include "tracepoint.h"
-+#include "debug.h"
- 
- void __brcmf_err(const char *func, const char *fmt, ...)
- {
diff --git a/package/kernel/mac80211/patches/319-0015-brcmfmac-Add-USB-ID-for-Cisco-Linksys-AE1200.patch b/package/kernel/mac80211/patches/319-0015-brcmfmac-Add-USB-ID-for-Cisco-Linksys-AE1200.patch
deleted file mode 100644
index b33175e1f7..0000000000
--- a/package/kernel/mac80211/patches/319-0015-brcmfmac-Add-USB-ID-for-Cisco-Linksys-AE1200.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From bccf3ffc8c6d8e0251a15541bb4d12b423c4f729 Mon Sep 17 00:00:00 2001
-From: Ismael Luceno <ismael@iodev.co.uk>
-Date: Mon, 22 Aug 2016 19:40:07 -0300
-Subject: [PATCH] brcmfmac: Add USB ID for Cisco Linksys AE1200
-
-The AE1200 comes with different revisions of the BCM43235 chipset,
-but all have the same USB ID. Only revision 3 can be supported.
-
-Signed-off-by: Ismael Luceno <ismael@iodev.co.uk>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c        | 4 ++++
- drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 2 ++
- 2 files changed, 6 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1458,11 +1458,15 @@ static int brcmf_usb_reset_resume(struct
- #define BRCMF_USB_DEVICE(dev_id)	\
- 	{ USB_DEVICE(BRCM_USB_VENDOR_ID_BROADCOM, dev_id) }
- 
-+#define LINKSYS_USB_DEVICE(dev_id)	\
-+	{ USB_DEVICE(BRCM_USB_VENDOR_ID_LINKSYS, dev_id) }
-+
- static struct usb_device_id brcmf_usb_devid_table[] = {
- 	BRCMF_USB_DEVICE(BRCM_USB_43143_DEVICE_ID),
- 	BRCMF_USB_DEVICE(BRCM_USB_43236_DEVICE_ID),
- 	BRCMF_USB_DEVICE(BRCM_USB_43242_DEVICE_ID),
- 	BRCMF_USB_DEVICE(BRCM_USB_43569_DEVICE_ID),
-+	LINKSYS_USB_DEVICE(BRCM_USB_43235_LINKSYS_DEVICE_ID),
- 	{ USB_DEVICE(BRCM_USB_VENDOR_ID_LG, BRCM_USB_43242_LG_DEVICE_ID) },
- 	/* special entry for device with firmware loaded and running */
- 	BRCMF_USB_DEVICE(BRCM_USB_BCMFW_DEVICE_ID),
---- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
-@@ -22,6 +22,7 @@
- 
- #define BRCM_USB_VENDOR_ID_BROADCOM	0x0a5c
- #define BRCM_USB_VENDOR_ID_LG		0x043e
-+#define BRCM_USB_VENDOR_ID_LINKSYS	0x13b1
- #define BRCM_PCIE_VENDOR_ID_BROADCOM	PCI_VENDOR_ID_BROADCOM
- 
- /* Chipcommon Core Chip IDs */
-@@ -58,6 +59,7 @@
- 
- /* USB Device IDs */
- #define BRCM_USB_43143_DEVICE_ID	0xbd1e
-+#define BRCM_USB_43235_LINKSYS_DEVICE_ID	0x0039
- #define BRCM_USB_43236_DEVICE_ID	0xbd17
- #define BRCM_USB_43242_DEVICE_ID	0xbd1f
- #define BRCM_USB_43242_LG_DEVICE_ID	0x3101
diff --git a/package/kernel/mac80211/patches/319-0016-brcmfmac-fix-pmksa-bssid-usage.patch b/package/kernel/mac80211/patches/319-0016-brcmfmac-fix-pmksa-bssid-usage.patch
deleted file mode 100644
index c6bc1c8294..0000000000
--- a/package/kernel/mac80211/patches/319-0016-brcmfmac-fix-pmksa-bssid-usage.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 7703773ef1d85b40433902a8da20167331597e4a Mon Sep 17 00:00:00 2001
-From: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
-Date: Tue, 23 Aug 2016 11:37:17 +0200
-Subject: [PATCH] brcmfmac: fix pmksa->bssid usage
-
-The struct cfg80211_pmksa defines its bssid field as:
-
-    const u8 *bssid;
-
-contrary to struct brcmf_pmksa, which uses:
-
-    u8 bssid[ETH_ALEN];
-
-Therefore in brcmf_cfg80211_del_pmksa(), &pmksa->bssid takes the address
-of this field (of type u8**), not the one of its content (which would be
-u8*).  Remove the & operator to make brcmf_dbg("%pM") and memcmp()
-behave as expected.
-
-This bug have been found using a custom static checker (which checks the
-usage of %p... attributes at build time).  It has been introduced in
-commit 6c404f34f2bd ("brcmfmac: Cleanup pmksa cache handling code"),
-which replaced pmksa->bssid by &pmksa->bssid while refactoring the code,
-without modifying struct cfg80211_pmksa definition.
-
-Replace &pmk[i].bssid with pmk[i].bssid too to make the code clearer,
-this change does not affect the semantic.
-
-Fixes: 6c404f34f2bd ("brcmfmac: Cleanup pmksa cache handling code")
-Cc: stable@vger.kernel.org
-Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -3880,11 +3880,11 @@ brcmf_cfg80211_del_pmksa(struct wiphy *w
- 	if (!check_vif_up(ifp->vif))
- 		return -EIO;
- 
--	brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", &pmksa->bssid);
-+	brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
- 
- 	npmk = le32_to_cpu(cfg->pmk_list.npmk);
- 	for (i = 0; i < npmk; i++)
--		if (!memcmp(&pmksa->bssid, &pmk[i].bssid, ETH_ALEN))
-+		if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
- 			break;
- 
- 	if ((npmk > 0) && (i < npmk)) {
diff --git a/package/kernel/mac80211/patches/319-0017-brcmfmac-avoid-potential-stack-overflow-in-brcmf_cfg.patch b/package/kernel/mac80211/patches/319-0017-brcmfmac-avoid-potential-stack-overflow-in-brcmf_cfg.patch
deleted file mode 100644
index a56dd72c46..0000000000
--- a/package/kernel/mac80211/patches/319-0017-brcmfmac-avoid-potential-stack-overflow-in-brcmf_cfg.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From ded89912156b1a47d940a0c954c43afbabd0c42c Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Mon, 5 Sep 2016 10:45:47 +0100
-Subject: [PATCH] brcmfmac: avoid potential stack overflow in
- brcmf_cfg80211_start_ap()
-
-User-space can choose to omit NL80211_ATTR_SSID and only provide raw
-IE TLV data. When doing so it can provide SSID IE with length exceeding
-the allowed size. The driver further processes this IE copying it
-into a local variable without checking the length. Hence stack can be
-corrupted and used as exploit.
-
-Cc: stable@vger.kernel.org # v4.7
-Reported-by: Daxing Guo <freener.gdx@gmail.com>
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -4523,7 +4523,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
- 				(u8 *)&settings->beacon.head[ie_offset],
- 				settings->beacon.head_len - ie_offset,
- 				WLAN_EID_SSID);
--		if (!ssid_ie)
-+		if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
- 			return -EINVAL;
- 
- 		memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
diff --git a/package/kernel/mac80211/patches/319-0018-brcmfmac-add-support-for-bcm4339-chip-with-modalias-.patch b/package/kernel/mac80211/patches/319-0018-brcmfmac-add-support-for-bcm4339-chip-with-modalias-.patch
deleted file mode 100644
index 20461b7015..0000000000
--- a/package/kernel/mac80211/patches/319-0018-brcmfmac-add-support-for-bcm4339-chip-with-modalias-.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 634faf3686900ccdee87b77e2c56df8b2159912b Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Mon, 5 Sep 2016 11:42:12 +0100
-Subject: [PATCH] brcmfmac: add support for bcm4339 chip with modalias
- sdio:c00v02D0d4339
-
-The driver already supports the bcm4339 chipset but only for the variant
-that shares the same modalias as the bcm4335, ie. sdio:c00v02D0d4335.
-It turns out that there are also bcm4339 devices out there that have a
-more distiguishable modalias sdio:c00v02D0d4339.
-
-Reported-by: Steve deRosier <derosier@gmail.com>
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 1 +
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c   | 3 ++-
- include/linux/mmc/sdio_ids.h                              | 1 +
- 3 files changed, 4 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -1101,6 +1101,7 @@ static const struct sdio_device_id brcmf
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341),
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362),
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339),
-+	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4339),
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43430),
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4345),
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4354),
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3757,7 +3757,8 @@ static u32 brcmf_sdio_buscore_read32(voi
- 	u32 val, rev;
- 
- 	val = brcmf_sdiod_regrl(sdiodev, addr, NULL);
--	if (sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 &&
-+	if ((sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
-+	     sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
- 	    addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
- 		rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
- 		if (rev >= 2) {
---- a/include/linux/mmc/sdio_ids.h
-+++ b/include/linux/mmc/sdio_ids.h
-@@ -32,6 +32,7 @@
- #define SDIO_DEVICE_ID_BROADCOM_43340		0xa94c
- #define SDIO_DEVICE_ID_BROADCOM_43341		0xa94d
- #define SDIO_DEVICE_ID_BROADCOM_4335_4339	0x4335
-+#define SDIO_DEVICE_ID_BROADCOM_4339		0x4339
- #define SDIO_DEVICE_ID_BROADCOM_43362		0xa962
- #define SDIO_DEVICE_ID_BROADCOM_43430		0xa9a6
- #define SDIO_DEVICE_ID_BROADCOM_4345		0x4345
diff --git a/package/kernel/mac80211/patches/319-0019-brcmfmac-sdio-shorten-retry-loop-in-brcmf_sdio_kso_c.patch b/package/kernel/mac80211/patches/319-0019-brcmfmac-sdio-shorten-retry-loop-in-brcmf_sdio_kso_c.patch
deleted file mode 100644
index fb78fbe3ce..0000000000
--- a/package/kernel/mac80211/patches/319-0019-brcmfmac-sdio-shorten-retry-loop-in-brcmf_sdio_kso_c.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 5251b6be8bb5c5675bdf12347c7b83937a5c91e5 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Mon, 5 Sep 2016 11:42:13 +0100
-Subject: [PATCH] brcmfmac: sdio: shorten retry loop in
- brcmf_sdio_kso_control()
-
-In brcmf_sdio_kso_control() there is a retry loop as hardware may take
-time to settle. However, when the call to brcmf_sdiod_regrb() returns
-an error it is due to SDIO access failure and it makes no sense to wait
-for hardware to settle. This patch aborts the loop after a number of
-subsequent access errors.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -313,6 +313,7 @@ struct rte_console {
- 
- #define KSO_WAIT_US 50
- #define MAX_KSO_ATTEMPTS (PMU_MAX_TRANSITION_DLY/KSO_WAIT_US)
-+#define BRCMF_SDIO_MAX_ACCESS_ERRORS	5
- 
- /*
-  * Conversion of 802.1D priority to precedence level
-@@ -677,6 +678,7 @@ brcmf_sdio_kso_control(struct brcmf_sdio
- {
- 	u8 wr_val = 0, rd_val, cmp_val, bmask;
- 	int err = 0;
-+	int err_cnt = 0;
- 	int try_cnt = 0;
- 
- 	brcmf_dbg(TRACE, "Enter: on=%d\n", on);
-@@ -712,9 +714,14 @@ brcmf_sdio_kso_control(struct brcmf_sdio
- 		 */
- 		rd_val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
- 					   &err);
--		if (((rd_val & bmask) == cmp_val) && !err)
-+		if (!err) {
-+			if ((rd_val & bmask) == cmp_val)
-+				break;
-+			err_cnt = 0;
-+		}
-+		/* bail out upon subsequent access errors */
-+		if (err && (err_cnt++ > BRCMF_SDIO_MAX_ACCESS_ERRORS))
- 			break;
--
- 		udelay(KSO_WAIT_US);
- 		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
- 				  wr_val, &err);
diff --git a/package/kernel/mac80211/patches/319-0020-brcmfmac-ignore-11d-configuration-errors.patch b/package/kernel/mac80211/patches/319-0020-brcmfmac-ignore-11d-configuration-errors.patch
deleted file mode 100644
index 1c24f2dd94..0000000000
--- a/package/kernel/mac80211/patches/319-0020-brcmfmac-ignore-11d-configuration-errors.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From b3589dfe02123a0d0ea82076a9f8ef84a46852c0 Mon Sep 17 00:00:00 2001
-From: Hante Meuleman <hante.meuleman@broadcom.com>
-Date: Mon, 19 Sep 2016 12:09:51 +0100
-Subject: [PATCH] brcmfmac: ignore 11d configuration errors
-
-802.11d is not always supported by firmware anymore. Currently the
-AP configuration of 11d will cause an abort if the ioctl set is
-failing. This behavior is not correct and the error should be
-ignored.
-
-Reviewed-by: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Signed-off-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 27 ++++++++++++----------
- 1 file changed, 15 insertions(+), 12 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -4498,6 +4498,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
- 	u16 chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
- 	bool mbss;
- 	int is_11d;
-+	bool supports_11d;
- 
- 	brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
- 		  settings->chandef.chan->hw_value,
-@@ -4510,11 +4511,16 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
- 	mbss = ifp->vif->mbss;
- 
- 	/* store current 11d setting */
--	brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY, &ifp->vif->is_11d);
--	country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
--				      settings->beacon.tail_len,
--				      WLAN_EID_COUNTRY);
--	is_11d = country_ie ? 1 : 0;
-+	if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
-+				  &ifp->vif->is_11d)) {
-+		supports_11d = false;
-+	} else {
-+		country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
-+					      settings->beacon.tail_len,
-+					      WLAN_EID_COUNTRY);
-+		is_11d = country_ie ? 1 : 0;
-+		supports_11d = true;
-+	}
- 
- 	memset(&ssid_le, 0, sizeof(ssid_le));
- 	if (settings->ssid == NULL || settings->ssid_len == 0) {
-@@ -4573,7 +4579,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
- 
- 	/* Parameters shared by all radio interfaces */
- 	if (!mbss) {
--		if (is_11d != ifp->vif->is_11d) {
-+		if ((supports_11d) && (is_11d != ifp->vif->is_11d)) {
- 			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
- 						    is_11d);
- 			if (err < 0) {
-@@ -4615,7 +4621,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
- 			brcmf_err("SET INFRA error %d\n", err);
- 			goto exit;
- 		}
--	} else if (WARN_ON(is_11d != ifp->vif->is_11d)) {
-+	} else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
- 		/* Multiple-BSS should use same 11d configuration */
- 		err = -EINVAL;
- 		goto exit;
-@@ -4749,11 +4755,8 @@ static int brcmf_cfg80211_stop_ap(struct
- 			brcmf_err("setting INFRA mode failed %d\n", err);
- 		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
- 			brcmf_fil_iovar_int_set(ifp, "mbss", 0);
--		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
--					    ifp->vif->is_11d);
--		if (err < 0)
--			brcmf_err("restoring REGULATORY setting failed %d\n",
--				  err);
-+		brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
-+				      ifp->vif->is_11d);
- 		/* Bring device back up so it can be used again */
- 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
- 		if (err < 0)
diff --git a/package/kernel/mac80211/patches/319-0021-brcmfmac-rework-pointer-trickery-in-brcmf_proto_bcdc.patch b/package/kernel/mac80211/patches/319-0021-brcmfmac-rework-pointer-trickery-in-brcmf_proto_bcdc.patch
deleted file mode 100644
index 9461164523..0000000000
--- a/package/kernel/mac80211/patches/319-0021-brcmfmac-rework-pointer-trickery-in-brcmf_proto_bcdc.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 704d1c6b56f4ee2ad6a5f012a72a278d17c1a223 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Mon, 19 Sep 2016 12:09:52 +0100
-Subject: [PATCH] brcmfmac: rework pointer trickery in
- brcmf_proto_bcdc_query_dcmd()
-
-The variable info is assigned to point to bcdc->msg[1], which is the
-same as pointing to bcdc->buf. As that is what we want to access
-make it clear by fixing the assignment. This also avoid out-of-bounds
-errors from static analyzers are bcdc->msg[1] is not in the structure
-definition.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-@@ -194,7 +194,7 @@ retry:
- 	}
- 
- 	/* Check info buffer */
--	info = (void *)&msg[1];
-+	info = (void *)&bcdc->buf[0];
- 
- 	/* Copy info buffer */
- 	if (buf) {
diff --git a/package/kernel/mac80211/patches/319-0022-brcmfmac-fix-memory-leak-in-brcmf_flowring_add_tdls_.patch b/package/kernel/mac80211/patches/319-0022-brcmfmac-fix-memory-leak-in-brcmf_flowring_add_tdls_.patch
deleted file mode 100644
index 2ececdf197..0000000000
--- a/package/kernel/mac80211/patches/319-0022-brcmfmac-fix-memory-leak-in-brcmf_flowring_add_tdls_.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From bc981641360183990de59da17f9f560f9150b801 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Mon, 19 Sep 2016 12:09:53 +0100
-Subject: [PATCH] brcmfmac: fix memory leak in brcmf_flowring_add_tdls_peer()
-
-In the error paths in brcmf_flowring_add_tdls_peer() the allocated
-resource should be freed.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-@@ -495,14 +495,18 @@ void brcmf_flowring_add_tdls_peer(struct
- 	} else {
- 		search = flow->tdls_entry;
- 		if (memcmp(search->mac, peer, ETH_ALEN) == 0)
--			return;
-+			goto free_entry;
- 		while (search->next) {
- 			search = search->next;
- 			if (memcmp(search->mac, peer, ETH_ALEN) == 0)
--				return;
-+				goto free_entry;
- 		}
- 		search->next = tdls_entry;
- 	}
- 
- 	flow->tdls_active = true;
-+	return;
-+
-+free_entry:
-+	kfree(tdls_entry);
- }
diff --git a/package/kernel/mac80211/patches/319-0023-brcmfmac-initialize-variable-in-brcmf_sdiod_regrl.patch b/package/kernel/mac80211/patches/319-0023-brcmfmac-initialize-variable-in-brcmf_sdiod_regrl.patch
deleted file mode 100644
index a231100a55..0000000000
--- a/package/kernel/mac80211/patches/319-0023-brcmfmac-initialize-variable-in-brcmf_sdiod_regrl.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 26305d3d7298d1ddf8fd4ce95a382aa90534f0a3 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Mon, 19 Sep 2016 12:09:54 +0100
-Subject: [PATCH] brcmfmac: initialize variable in brcmf_sdiod_regrl()
-
-In case of an error the variable returned is uninitialized. The caller
-will probably check the error code before using it, but better assure
-it is set to zero.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -420,7 +420,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
- 
- u32 brcmf_sdiod_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
- {
--	u32 data;
-+	u32 data = 0;
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
diff --git a/package/kernel/mac80211/patches/319-0024-brcmfmac-remove-worker-from-.ndo_set_mac_address-cal.patch b/package/kernel/mac80211/patches/319-0024-brcmfmac-remove-worker-from-.ndo_set_mac_address-cal.patch
deleted file mode 100644
index 67af30e4fd..0000000000
--- a/package/kernel/mac80211/patches/319-0024-brcmfmac-remove-worker-from-.ndo_set_mac_address-cal.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From 8fa5fdec09cd379c9ecb8972f344f8f308e0ccf3 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Mon, 19 Sep 2016 12:09:55 +0100
-Subject: [PATCH] brcmfmac: remove worker from .ndo_set_mac_address() callback
-
-As it turns out there is no need to use a worker for the callback
-because it is not called from atomic context.
-
-Reported-by: Dan Williams <dcbw@redhat.com>
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 39 ++++++++--------------
- .../wireless/broadcom/brcm80211/brcmfmac/core.h    |  2 --
- 2 files changed, 13 insertions(+), 28 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -136,27 +136,6 @@ static void _brcmf_set_multicast_list(st
- 			  err);
- }
- 
--static void
--_brcmf_set_mac_address(struct work_struct *work)
--{
--	struct brcmf_if *ifp;
--	s32 err;
--
--	ifp = container_of(work, struct brcmf_if, setmacaddr_work);
--
--	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
--
--	err = brcmf_fil_iovar_data_set(ifp, "cur_etheraddr", ifp->mac_addr,
--				       ETH_ALEN);
--	if (err < 0) {
--		brcmf_err("Setting cur_etheraddr failed, %d\n", err);
--	} else {
--		brcmf_dbg(TRACE, "MAC address updated to %pM\n",
--			  ifp->mac_addr);
--		memcpy(ifp->ndev->dev_addr, ifp->mac_addr, ETH_ALEN);
--	}
--}
--
- #if IS_ENABLED(CONFIG_IPV6)
- static void _brcmf_update_ndtable(struct work_struct *work)
- {
-@@ -190,10 +169,20 @@ static int brcmf_netdev_set_mac_address(
- {
- 	struct brcmf_if *ifp = netdev_priv(ndev);
- 	struct sockaddr *sa = (struct sockaddr *)addr;
-+	int err;
- 
--	memcpy(&ifp->mac_addr, sa->sa_data, ETH_ALEN);
--	schedule_work(&ifp->setmacaddr_work);
--	return 0;
-+	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
-+
-+	err = brcmf_fil_iovar_data_set(ifp, "cur_etheraddr", sa->sa_data,
-+				       ETH_ALEN);
-+	if (err < 0) {
-+		brcmf_err("Setting cur_etheraddr failed, %d\n", err);
-+	} else {
-+		brcmf_dbg(TRACE, "updated to %pM\n", sa->sa_data);
-+		memcpy(ifp->mac_addr, sa->sa_data, ETH_ALEN);
-+		memcpy(ifp->ndev->dev_addr, ifp->mac_addr, ETH_ALEN);
-+	}
-+	return err;
- }
- 
- static void brcmf_netdev_set_multicast_list(struct net_device *ndev)
-@@ -525,7 +514,6 @@ int brcmf_net_attach(struct brcmf_if *if
- 	/* set the mac address */
- 	memcpy(ndev->dev_addr, ifp->mac_addr, ETH_ALEN);
- 
--	INIT_WORK(&ifp->setmacaddr_work, _brcmf_set_mac_address);
- 	INIT_WORK(&ifp->multicast_work, _brcmf_set_multicast_list);
- 	INIT_WORK(&ifp->ndoffload_work, _brcmf_update_ndtable);
- 
-@@ -730,7 +718,6 @@ static void brcmf_del_if(struct brcmf_pu
- 		}
- 
- 		if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
--			cancel_work_sync(&ifp->setmacaddr_work);
- 			cancel_work_sync(&ifp->multicast_work);
- 			cancel_work_sync(&ifp->ndoffload_work);
- 		}
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -176,7 +176,6 @@ enum brcmf_netif_stop_reason {
-  * @vif: points to cfg80211 specific interface information.
-  * @ndev: associated network device.
-  * @stats: interface specific network statistics.
-- * @setmacaddr_work: worker object for setting mac address.
-  * @multicast_work: worker object for multicast provisioning.
-  * @ndoffload_work: worker object for neighbor discovery offload configuration.
-  * @fws_desc: interface specific firmware-signalling descriptor.
-@@ -193,7 +192,6 @@ struct brcmf_if {
- 	struct brcmf_cfg80211_vif *vif;
- 	struct net_device *ndev;
- 	struct net_device_stats stats;
--	struct work_struct setmacaddr_work;
- 	struct work_struct multicast_work;
- 	struct work_struct ndoffload_work;
- 	struct brcmf_fws_mac_descriptor *fws_desc;
diff --git a/package/kernel/mac80211/patches/319-0025-brcmfmac-remove-unnecessary-null-pointer-check.patch b/package/kernel/mac80211/patches/319-0025-brcmfmac-remove-unnecessary-null-pointer-check.patch
deleted file mode 100644
index 5a08479329..0000000000
--- a/package/kernel/mac80211/patches/319-0025-brcmfmac-remove-unnecessary-null-pointer-check.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 835680b82f029818c813324aed3073cdcf63241f Mon Sep 17 00:00:00 2001
-From: Hante Meuleman <hante.meuleman@broadcom.com>
-Date: Mon, 19 Sep 2016 12:09:56 +0100
-Subject: [PATCH] brcmfmac: remove unnecessary null pointer check
-
-in the function brcmf_bus_start() in the exception handling a
-check is made to dermine whether ifp is null, though this is not
-possible. Removing the unnessary check.
-
-Reviewed-by: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Signed-off-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1048,8 +1048,7 @@ fail:
- 		brcmf_fws_del_interface(ifp);
- 		brcmf_fws_deinit(drvr);
- 	}
--	if (ifp)
--		brcmf_net_detach(ifp->ndev, false);
-+	brcmf_net_detach(ifp->ndev, false);
- 	if (p2p_ifp)
- 		brcmf_net_detach(p2p_ifp->ndev, false);
- 	drvr->iflist[0] = NULL;
diff --git a/package/kernel/mac80211/patches/319-0026-brcmfmac-fix-clearing-entry-IPv6-address.patch b/package/kernel/mac80211/patches/319-0026-brcmfmac-fix-clearing-entry-IPv6-address.patch
deleted file mode 100644
index 0b3a23edc0..0000000000
--- a/package/kernel/mac80211/patches/319-0026-brcmfmac-fix-clearing-entry-IPv6-address.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 2b7425f3629b38c438f890c20c5faeca64b144ff Mon Sep 17 00:00:00 2001
-From: Hante Meuleman <hante.meuleman@broadcom.com>
-Date: Mon, 19 Sep 2016 12:09:57 +0100
-Subject: [PATCH] brcmfmac: fix clearing entry IPv6 address
-
-When IPv6 address is to be cleared there is a possible out of
-bound access. But also the clearing of the last entry and the
-adjustment of total number of stored IPv6 addresses is not
-updated. This patch fixes that bug. Bug was found using coverity.
-
-Reviewed-by: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Signed-off-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -873,9 +873,12 @@ static int brcmf_inet6addr_changed(struc
- 		}
- 		break;
- 	case NETDEV_DOWN:
--		if (i < NDOL_MAX_ENTRIES)
--			for (; i < ifp->ipv6addr_idx; i++)
-+		if (i < NDOL_MAX_ENTRIES) {
-+			for (; i < ifp->ipv6addr_idx - 1; i++)
- 				table[i] = table[i + 1];
-+			memset(&table[i], 0, sizeof(table[i]));
-+			ifp->ipv6addr_idx--;
-+		}
- 		break;
- 	default:
- 		break;
diff --git a/package/kernel/mac80211/patches/319-0027-brcmfmac-fix-out-of-bound-access-on-clearing-wowl-wa.patch b/package/kernel/mac80211/patches/319-0027-brcmfmac-fix-out-of-bound-access-on-clearing-wowl-wa.patch
deleted file mode 100644
index 4a005d608a..0000000000
--- a/package/kernel/mac80211/patches/319-0027-brcmfmac-fix-out-of-bound-access-on-clearing-wowl-wa.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From a7ed7828ecda0c2b5e0d7f55dedd4230afd4b583 Mon Sep 17 00:00:00 2001
-From: Hante Meuleman <hante.meuleman@broadcom.com>
-Date: Mon, 19 Sep 2016 12:09:58 +0100
-Subject: [PATCH] brcmfmac: fix out of bound access on clearing wowl wake
- indicator
-
-Clearing the wowl wakeindicator happens with a rather odd
-construction where the string "clear" is used to set the iovar
-wowl_wakeind. This was implemented incorrectly as it caused an
-out of bound access. Use an intermediate variable of correct
-length and copy string in that. Problem was found using coverity.
-
-Reviewed-by: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Signed-off-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -3699,6 +3699,7 @@ static void brcmf_configure_wowl(struct
- 				 struct cfg80211_wowlan *wowl)
- {
- 	u32 wowl_config;
-+	struct brcmf_wowl_wakeind_le wowl_wakeind;
- 	u32 i;
- 
- 	brcmf_dbg(TRACE, "Suspend, wowl config.\n");
-@@ -3740,8 +3741,9 @@ static void brcmf_configure_wowl(struct
- 	if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
- 		wowl_config |= BRCMF_WOWL_UNASSOC;
- 
--	brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", "clear",
--				 sizeof(struct brcmf_wowl_wakeind_le));
-+	memcpy(&wowl_wakeind, "clear", 6);
-+	brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", &wowl_wakeind,
-+				 sizeof(wowl_wakeind));
- 	brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
- 	brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
- 	brcmf_bus_wowl_config(cfg->pub->bus_if, true);
diff --git a/package/kernel/mac80211/patches/319-0028-brcmfmac-simplify-mapping-of-auth-type.patch b/package/kernel/mac80211/patches/319-0028-brcmfmac-simplify-mapping-of-auth-type.patch
deleted file mode 100644
index cbefa6e676..0000000000
--- a/package/kernel/mac80211/patches/319-0028-brcmfmac-simplify-mapping-of-auth-type.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 92c313604711a0976def79dabb9e8da3cc2cc780 Mon Sep 17 00:00:00 2001
-From: Hante Meuleman <hante.meuleman@broadcom.com>
-Date: Mon, 19 Sep 2016 12:09:59 +0100
-Subject: [PATCH] brcmfmac: simplify mapping of auth type
-
-The 802.11 standard only has four valid auth type configurations of which
-our firmware only supports two, ie. Open System and Shared Key. Simplify
-the mapping falling back to automatic for other types specified by
-user-space.
-
-Reviewed-by: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Signed-off-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 8 +-------
- 1 file changed, 1 insertion(+), 7 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -1591,15 +1591,9 @@ static s32 brcmf_set_auth_type(struct ne
- 		val = 1;
- 		brcmf_dbg(CONN, "shared key\n");
- 		break;
--	case NL80211_AUTHTYPE_AUTOMATIC:
--		val = 2;
--		brcmf_dbg(CONN, "automatic\n");
--		break;
--	case NL80211_AUTHTYPE_NETWORK_EAP:
--		brcmf_dbg(CONN, "network eap\n");
- 	default:
- 		val = 2;
--		brcmf_err("invalid auth type (%d)\n", sme->auth_type);
-+		brcmf_dbg(CONN, "automatic, auth type (%d)\n", sme->auth_type);
- 		break;
- 	}
- 
diff --git a/package/kernel/mac80211/patches/319-0029-brcmfmac-fix-memory-leak-in-brcmf_fill_bss_param.patch b/package/kernel/mac80211/patches/319-0029-brcmfmac-fix-memory-leak-in-brcmf_fill_bss_param.patch
deleted file mode 100644
index fa7c27fdeb..0000000000
--- a/package/kernel/mac80211/patches/319-0029-brcmfmac-fix-memory-leak-in-brcmf_fill_bss_param.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 23e9c128adb2038c27a424a5f91136e7fa3e0dc6 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Wed, 21 Sep 2016 08:23:24 +0200
-Subject: [PATCH] brcmfmac: fix memory leak in brcmf_fill_bss_param
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This function is called from get_station callback which means that every
-time user space was getting/dumping station(s) we were leaking 2 KiB.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Fixes: 1f0dc59a6de ("brcmfmac: rework .get_station() callback")
-Cc: stable@vger.kernel.org # 4.2+
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2523,7 +2523,7 @@ static void brcmf_fill_bss_param(struct
- 				     WL_BSS_INFO_MAX);
- 	if (err) {
- 		brcmf_err("Failed to get bss info (%d)\n", err);
--		return;
-+		goto out_kfree;
- 	}
- 	si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
- 	si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
-@@ -2535,6 +2535,9 @@ static void brcmf_fill_bss_param(struct
- 		si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
- 	if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
- 		si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
-+
-+out_kfree:
-+	kfree(buf);
- }
- 
- static s32
diff --git a/package/kernel/mac80211/patches/319-0030-brcmfmac-drop-unused-fields-from-struct-brcmf_pub.patch b/package/kernel/mac80211/patches/319-0030-brcmfmac-drop-unused-fields-from-struct-brcmf_pub.patch
deleted file mode 100644
index 0dc2aa4114..0000000000
--- a/package/kernel/mac80211/patches/319-0030-brcmfmac-drop-unused-fields-from-struct-brcmf_pub.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 2df86ad959c9d1cdbeb2f23a0801857731156692 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Fri, 23 Sep 2016 15:27:46 +0200
-Subject: [PATCH] brcmfmac: drop unused fields from struct brcmf_pub
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-They seem to be there from the first day. We calculate these values but
-never use them.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c     | 3 ---
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h     | 4 ----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c | 2 --
- 3 files changed, 9 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -508,9 +508,6 @@ int brcmf_net_attach(struct brcmf_if *if
- 	ndev->needed_headroom += drvr->hdrlen;
- 	ndev->ethtool_ops = &brcmf_ethtool_ops;
- 
--	drvr->rxsz = ndev->mtu + ndev->hard_header_len +
--			      drvr->hdrlen;
--
- 	/* set the mac address */
- 	memcpy(ndev->dev_addr, ifp->mac_addr, ETH_ALEN);
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -112,15 +112,11 @@ struct brcmf_pub {
- 
- 	/* Internal brcmf items */
- 	uint hdrlen;		/* Total BRCMF header length (proto + bus) */
--	uint rxsz;		/* Rx buffer size bus module should use */
- 
- 	/* Dongle media info */
- 	char fwver[BRCMF_DRIVER_FIRMWARE_VERSION_LEN];
- 	u8 mac[ETH_ALEN];		/* MAC address obtained from dongle */
- 
--	/* Multicast data packets sent to dongle */
--	unsigned long tx_multicast;
--
- 	struct mac_address addresses[BRCMF_MAX_IFS];
- 
- 	struct brcmf_if *iflist[BRCMF_MAX_IFS];
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-@@ -2104,8 +2104,6 @@ int brcmf_fws_process_skb(struct brcmf_i
- 	if ((skb->priority == 0) || (skb->priority > 7))
- 		skb->priority = cfg80211_classify8021d(skb, NULL);
- 
--	drvr->tx_multicast += !!multicast;
--
- 	if (fws->avoid_queueing) {
- 		rc = brcmf_proto_txdata(drvr, ifp->ifidx, 0, skb);
- 		if (rc < 0)
diff --git a/package/kernel/mac80211/patches/319-0031-brcmfmac-replace-WARNING-on-timeout-with-a-simple-er.patch b/package/kernel/mac80211/patches/319-0031-brcmfmac-replace-WARNING-on-timeout-with-a-simple-er.patch
deleted file mode 100644
index 1a48f1b304..0000000000
--- a/package/kernel/mac80211/patches/319-0031-brcmfmac-replace-WARNING-on-timeout-with-a-simple-er.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 2f0e56fa37cce60a5ac5d451bcadec51cd711436 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Tue, 27 Sep 2016 12:12:24 +0200
-Subject: [PATCH] brcmfmac: replace WARNING on timeout with a simple error
- message
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Even with timeout increased to 950 ms we get WARNINGs from time to time.
-It mostly happens on A-MPDU stalls (e.g. when station goes out of
-range). It may take up to 5-10 secods for the firmware to recover and
-for that time it doesn't process packets.
-
-It's still useful to have a message on time out as it may indicate some
-firmware problem and incorrect key update. Raising a WARNING however
-wasn't really that necessary, it doesn't point to any driver bug anymore
-and backtrace wasn't much useful.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1155,7 +1155,8 @@ int brcmf_netdev_wait_pend8021x(struct b
- 				 !brcmf_get_pend_8021x_cnt(ifp),
- 				 MAX_WAIT_FOR_8021X_TX);
- 
--	WARN_ON(!err);
-+	if (!err)
-+		brcmf_err("Timed out waiting for no pending 802.1x packets\n");
- 
- 	return !err;
- }
diff --git a/package/kernel/mac80211/patches/319-0032-brcmfmac-use-correct-skb-freeing-helper-when-deletin.patch b/package/kernel/mac80211/patches/319-0032-brcmfmac-use-correct-skb-freeing-helper-when-deletin.patch
deleted file mode 100644
index 91c5dd5d4d..0000000000
--- a/package/kernel/mac80211/patches/319-0032-brcmfmac-use-correct-skb-freeing-helper-when-deletin.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 7f00ee2bbc630900ba16fc2690473f3e2db0e264 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Tue, 27 Sep 2016 14:11:04 +0200
-Subject: [PATCH] brcmfmac: use correct skb freeing helper when deleting
- flowring
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Flowrings contain skbs waiting for transmission that were passed to us
-by netif. It means we checked every one of them looking for 802.1x
-Ethernet type. When deleting flowring we have to use freeing function
-that will check for 802.1x type as well.
-
-Freeing skbs without a proper check was leading to counter not being
-properly decreased. This was triggering a WARNING every time
-brcmf_netdev_wait_pend8021x was called.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Acked-by: Arend van Spriel <arend@broadcom.com>
-Cc: stable@vger.kernel.org # 4.5+
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-@@ -234,13 +234,20 @@ static void brcmf_flowring_block(struct
- 
- void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid)
- {
-+	struct brcmf_bus *bus_if = dev_get_drvdata(flow->dev);
- 	struct brcmf_flowring_ring *ring;
-+	struct brcmf_if *ifp;
- 	u16 hash_idx;
-+	u8 ifidx;
- 	struct sk_buff *skb;
- 
- 	ring = flow->rings[flowid];
- 	if (!ring)
- 		return;
-+
-+	ifidx = brcmf_flowring_ifidx_get(flow, flowid);
-+	ifp = brcmf_get_ifp(bus_if->drvr, ifidx);
-+
- 	brcmf_flowring_block(flow, flowid, false);
- 	hash_idx = ring->hash_id;
- 	flow->hash[hash_idx].ifidx = BRCMF_FLOWRING_INVALID_IFIDX;
-@@ -249,7 +256,7 @@ void brcmf_flowring_delete(struct brcmf_
- 
- 	skb = skb_dequeue(&ring->skblist);
- 	while (skb) {
--		brcmu_pkt_buf_free_skb(skb);
-+		brcmf_txfinalize(ifp, skb, false);
- 		skb = skb_dequeue(&ring->skblist);
- 	}
- 
diff --git a/package/kernel/mac80211/patches/320-ath9k-fix-using-sta-drv_priv-before-initializing-it.patch b/package/kernel/mac80211/patches/320-ath9k-fix-using-sta-drv_priv-before-initializing-it.patch
deleted file mode 100644
index aaa6706764..0000000000
--- a/package/kernel/mac80211/patches/320-ath9k-fix-using-sta-drv_priv-before-initializing-it.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 2 Aug 2016 13:00:01 +0200
-Subject: [PATCH] ath9k: fix using sta->drv_priv before initializing it
-
-A station pointer can be passed to the driver on tx, before it has been
-marked as associated. Since ath9k_sta_state was initializing the entry
-too late, it resulted in some spurious crashes.
-
-Fixes: df3c6eb34da5 ("ath9k: Use sta_state() callback")
-Cc: stable@vger.kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -1563,13 +1563,13 @@ static int ath9k_sta_state(struct ieee80
- 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
- 	int ret = 0;
- 
--	if (old_state == IEEE80211_STA_AUTH &&
--	    new_state == IEEE80211_STA_ASSOC) {
-+	if (old_state == IEEE80211_STA_NOTEXIST &&
-+	    new_state == IEEE80211_STA_NONE) {
- 		ret = ath9k_sta_add(hw, vif, sta);
- 		ath_dbg(common, CONFIG,
- 			"Add station: %pM\n", sta->addr);
--	} else if (old_state == IEEE80211_STA_ASSOC &&
--		   new_state == IEEE80211_STA_AUTH) {
-+	} else if (old_state == IEEE80211_STA_NONE &&
-+		   new_state == IEEE80211_STA_NOTEXIST) {
- 		ret = ath9k_sta_remove(hw, vif, sta);
- 		ath_dbg(common, CONFIG,
- 			"Remove station: %pM\n", sta->addr);
diff --git a/package/kernel/mac80211/patches/323-ath9k-Fix-programming-of-minCCA-power-threshold.patch b/package/kernel/mac80211/patches/323-ath9k-Fix-programming-of-minCCA-power-threshold.patch
deleted file mode 100644
index 59ac29b1cf..0000000000
--- a/package/kernel/mac80211/patches/323-ath9k-Fix-programming-of-minCCA-power-threshold.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Sven Eckelmann <sven@narfation.org>
-Date: Fri, 17 Jun 2016 11:58:20 +0200
-Subject: [PATCH] ath9k: Fix programming of minCCA power threshold
-
-The function ar9003_hw_apply_minccapwr_thresh takes as second parameter not
-a pointer to the channel but a boolean value describing whether the channel
-is 2.4GHz or not. This broke (according to the origin commit) the ETSI
-regulatory compliance on 5GHz channels.
-
-Fixes: 3533bf6b15a0 ("ath9k: Fix regulatory compliance")
-Signed-off-by: Sven Eckelmann <sven@narfation.org>
-Cc: Simon Wunderlich <sw@simonwunderlich.de>
-Cc: Sujith Manoharan <c_manoha@qca.qualcomm.com>
----
-
---- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
-@@ -4175,7 +4175,7 @@ static void ath9k_hw_ar9300_set_board_va
- 	if (!AR_SREV_9330(ah) && !AR_SREV_9340(ah) && !AR_SREV_9531(ah))
- 		ar9003_hw_internal_regulator_apply(ah);
- 	ar9003_hw_apply_tuning_caps(ah);
--	ar9003_hw_apply_minccapwr_thresh(ah, chan);
-+	ar9003_hw_apply_minccapwr_thresh(ah, is2ghz);
- 	ar9003_hw_txend_to_xpa_off_apply(ah, is2ghz);
- 	ar9003_hw_thermometer_apply(ah);
- 	ar9003_hw_thermo_cal_apply(ah);
diff --git a/package/kernel/mac80211/patches/324-ath9k_hw-fix-spectral-scan-on-AR9285-and-newer.patch b/package/kernel/mac80211/patches/324-ath9k_hw-fix-spectral-scan-on-AR9285-and-newer.patch
deleted file mode 100644
index b6f48680b7..0000000000
--- a/package/kernel/mac80211/patches/324-ath9k_hw-fix-spectral-scan-on-AR9285-and-newer.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Mon, 11 Jul 2016 10:34:37 +0200
-Subject: [PATCH] ath9k_hw: fix spectral scan on AR9285 and newer
-
-The register layout of AR_PHY_SPECTRAL_SCAN has changed, only AR9280
-uses the old layout
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/ar9002_phy.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
-@@ -476,6 +476,7 @@ static void ar9002_hw_set_bt_ant_diversi
- static void ar9002_hw_spectral_scan_config(struct ath_hw *ah,
- 				    struct ath_spec_scan *param)
- {
-+	u32 repeat_bit;
- 	u8 count;
- 
- 	if (!param->enabled) {
-@@ -486,12 +487,15 @@ static void ar9002_hw_spectral_scan_conf
- 	REG_SET_BIT(ah, AR_PHY_RADAR_0, AR_PHY_RADAR_0_FFT_ENA);
- 	REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN, AR_PHY_SPECTRAL_SCAN_ENABLE);
- 
-+	if (AR_SREV_9280(ah))
-+		repeat_bit = AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT;
-+	else
-+		repeat_bit = AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT_KIWI;
-+
- 	if (param->short_repeat)
--		REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN,
--			    AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT);
-+		REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN, repeat_bit);
- 	else
--		REG_CLR_BIT(ah, AR_PHY_SPECTRAL_SCAN,
--			    AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT);
-+		REG_CLR_BIT(ah, AR_PHY_SPECTRAL_SCAN, repeat_bit);
- 
- 	/* on AR92xx, the highest bit of count will make the the chip send
- 	 * spectral samples endlessly. Check if this really was intended,
-@@ -499,15 +503,25 @@ static void ar9002_hw_spectral_scan_conf
- 	 */
- 	count = param->count;
- 	if (param->endless) {
--		if (AR_SREV_9271(ah))
--			count = 0;
--		else
-+		if (AR_SREV_9280(ah))
- 			count = 0x80;
-+		else
-+			count = 0;
- 	} else if (count & 0x80)
- 		count = 0x7f;
-+	else if (!count)
-+		count = 1;
-+
-+	if (AR_SREV_9280(ah)) {
-+		REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
-+			      AR_PHY_SPECTRAL_SCAN_COUNT, count);
-+	} else {
-+		REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
-+			      AR_PHY_SPECTRAL_SCAN_COUNT_KIWI, count);
-+		REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN,
-+			    AR_PHY_SPECTRAL_SCAN_PHYERR_MASK_SELECT);
-+	}
- 
--	REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
--		      AR_PHY_SPECTRAL_SCAN_COUNT, count);
- 	REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
- 		      AR_PHY_SPECTRAL_SCAN_PERIOD, param->period);
- 	REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
---- a/drivers/net/wireless/ath/ath9k/ar9002_phy.h
-+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.h
-@@ -177,8 +177,11 @@
- #define AR_PHY_SPECTRAL_SCAN_PERIOD_S		8
- #define AR_PHY_SPECTRAL_SCAN_COUNT		0x00FF0000  /* Number of reports, reg 68, bits 16-23*/
- #define AR_PHY_SPECTRAL_SCAN_COUNT_S		16
-+#define AR_PHY_SPECTRAL_SCAN_COUNT_KIWI		0x0FFF0000  /* Number of reports, reg 68, bits 16-27*/
-+#define AR_PHY_SPECTRAL_SCAN_COUNT_KIWI_S	16
- #define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT	0x01000000  /* Short repeat, reg 68, bit 24*/
--#define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT_S	24  /* Short repeat, reg 68, bit 24*/
-+#define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT_KIWI	0x10000000  /* Short repeat, reg 68, bit 28*/
-+#define AR_PHY_SPECTRAL_SCAN_PHYERR_MASK_SELECT	0x40000000
- 
- #define AR_PHY_RX_DELAY           0x9914
- #define AR_PHY_SEARCH_START_DELAY 0x9918
diff --git a/package/kernel/mac80211/patches/325-ath9k_hw-fix-duplicate-and-partially-wrong-definitio.patch b/package/kernel/mac80211/patches/325-ath9k_hw-fix-duplicate-and-partially-wrong-definitio.patch
deleted file mode 100644
index 6685f33989..0000000000
--- a/package/kernel/mac80211/patches/325-ath9k_hw-fix-duplicate-and-partially-wrong-definitio.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Mon, 11 Jul 2016 11:31:39 +0200
-Subject: [PATCH] ath9k_hw: fix duplicate (and partially wrong) definition
- of AR_CH0_THERM
-
-AR_PHY_65NM_CH0_THERM and AR_CH0_THERM were supposed to refer to the
-same register, however they had different SREV checks.
-
-Remove the duplicate and use the checks. Since there were other SREV
-checks present in the only place that uses this, this will probaby not
-affect runtime behavior.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
-@@ -689,13 +689,6 @@
- #define AR_CH0_TOP_XPABIASLVL (AR_SREV_9550(ah) ? 0x3c0 : 0x300)
- #define AR_CH0_TOP_XPABIASLVL_S (AR_SREV_9550(ah) ? 6 : 8)
- 
--#define AR_CH0_THERM	(AR_SREV_9300(ah) ? 0x16290 : \
--				((AR_SREV_9485(ah) ? 0x1628c : 0x16294)))
--#define AR_CH0_THERM_XPABIASLVL_MSB 0x3
--#define AR_CH0_THERM_XPABIASLVL_MSB_S 0
--#define AR_CH0_THERM_XPASHORT2GND 0x4
--#define AR_CH0_THERM_XPASHORT2GND_S 2
--
- #define AR_SWITCH_TABLE_COM_ALL (0xffff)
- #define AR_SWITCH_TABLE_COM_ALL_S (0)
- #define AR_SWITCH_TABLE_COM_AR9462_ALL (0xffffff)
-@@ -712,15 +705,17 @@
- #define AR_SWITCH_TABLE_ALL (0xfff)
- #define AR_SWITCH_TABLE_ALL_S (0)
- 
--#define AR_PHY_65NM_CH0_THERM       (AR_SREV_9300(ah) ? 0x16290 :\
--				     ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16294 : 0x1628c))
-+#define AR_CH0_THERM       (AR_SREV_9300(ah) ? 0x16290 :\
-+			    ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16294 : 0x1628c))
-+#define AR_CH0_THERM_XPABIASLVL_MSB 0x3
-+#define AR_CH0_THERM_XPABIASLVL_MSB_S 0
-+#define AR_CH0_THERM_XPASHORT2GND 0x4
-+#define AR_CH0_THERM_XPASHORT2GND_S 2
- 
--#define AR_PHY_65NM_CH0_THERM_LOCAL   0x80000000
--#define AR_PHY_65NM_CH0_THERM_LOCAL_S 31
--#define AR_PHY_65NM_CH0_THERM_START   0x20000000
--#define AR_PHY_65NM_CH0_THERM_START_S 29
--#define AR_PHY_65NM_CH0_THERM_SAR_ADC_OUT   0x0000ff00
--#define AR_PHY_65NM_CH0_THERM_SAR_ADC_OUT_S 8
-+#define AR_CH0_THERM_LOCAL   0x80000000
-+#define AR_CH0_THERM_START   0x20000000
-+#define AR_CH0_THERM_SAR_ADC_OUT   0x0000ff00
-+#define AR_CH0_THERM_SAR_ADC_OUT_S 8
- 
- #define AR_CH0_TOP2		(AR_SREV_9300(ah) ? 0x1628c : \
- 					(AR_SREV_9462(ah) ? 0x16290 : 0x16284))
diff --git a/package/kernel/mac80211/patches/326-ath9k_hw-simplify-ar9003_hw_per_calibration.patch b/package/kernel/mac80211/patches/326-ath9k_hw-simplify-ar9003_hw_per_calibration.patch
deleted file mode 100644
index 999d9934cd..0000000000
--- a/package/kernel/mac80211/patches/326-ath9k_hw-simplify-ar9003_hw_per_calibration.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Mon, 11 Jul 2016 11:34:47 +0200
-Subject: [PATCH] ath9k_hw: simplify ar9003_hw_per_calibration
-
-Reduce indentation, use a variable to save a few pointer dereferences
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-@@ -75,50 +75,49 @@ static bool ar9003_hw_per_calibration(st
- 				      struct ath9k_cal_list *currCal)
- {
- 	struct ath9k_hw_cal_data *caldata = ah->caldata;
--	/* Cal is assumed not done until explicitly set below */
--	bool iscaldone = false;
-+	const struct ath9k_percal_data *cur_caldata = currCal->calData;
- 
- 	/* Calibration in progress. */
- 	if (currCal->calState == CAL_RUNNING) {
- 		/* Check to see if it has finished. */
--		if (!(REG_READ(ah, AR_PHY_TIMING4) & AR_PHY_TIMING4_DO_CAL)) {
--			/*
--			* Accumulate cal measures for active chains
--			*/
--			currCal->calData->calCollect(ah);
--			ah->cal_samples++;
-+		if (REG_READ(ah, AR_PHY_TIMING4) & AR_PHY_TIMING4_DO_CAL)
-+			return false;
- 
--			if (ah->cal_samples >=
--			    currCal->calData->calNumSamples) {
--				unsigned int i, numChains = 0;
--				for (i = 0; i < AR9300_MAX_CHAINS; i++) {
--					if (rxchainmask & (1 << i))
--						numChains++;
--				}
-+		/*
-+		* Accumulate cal measures for active chains
-+		*/
-+		cur_caldata->calCollect(ah);
-+		ah->cal_samples++;
- 
--				/*
--				* Process accumulated data
--				*/
--				currCal->calData->calPostProc(ah, numChains);
-+		if (ah->cal_samples >= cur_caldata->calNumSamples) {
-+			unsigned int i, numChains = 0;
-+			for (i = 0; i < AR9300_MAX_CHAINS; i++) {
-+				if (rxchainmask & (1 << i))
-+					numChains++;
-+			}
- 
--				/* Calibration has finished. */
--				caldata->CalValid |= currCal->calData->calType;
--				currCal->calState = CAL_DONE;
--				iscaldone = true;
--			} else {
-+			/*
-+			* Process accumulated data
-+			*/
-+			cur_caldata->calPostProc(ah, numChains);
-+
-+			/* Calibration has finished. */
-+			caldata->CalValid |= cur_caldata->calType;
-+			currCal->calState = CAL_DONE;
-+			return true;
-+		} else {
- 			/*
- 			 * Set-up collection of another sub-sample until we
- 			 * get desired number
- 			 */
- 			ar9003_hw_setup_calibration(ah, currCal);
--			}
- 		}
--	} else if (!(caldata->CalValid & currCal->calData->calType)) {
-+	} else if (!(caldata->CalValid & cur_caldata->calType)) {
- 		/* If current cal is marked invalid in channel, kick it off */
- 		ath9k_hw_reset_calibration(ah, currCal);
- 	}
- 
--	return iscaldone;
-+	return false;
- }
- 
- static int ar9003_hw_calibrate(struct ath_hw *ah, struct ath9k_channel *chan,
diff --git a/package/kernel/mac80211/patches/327-ath9k_hw-get-rid-of-some-duplicate-code-in-calibrati.patch b/package/kernel/mac80211/patches/327-ath9k_hw-get-rid-of-some-duplicate-code-in-calibrati.patch
deleted file mode 100644
index b7f3823ee6..0000000000
--- a/package/kernel/mac80211/patches/327-ath9k_hw-get-rid-of-some-duplicate-code-in-calibrati.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Mon, 11 Jul 2016 11:35:20 +0200
-Subject: [PATCH] ath9k_hw: get rid of some duplicate code in calibration
- init
-
-Remove a misleading debug message as well
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-@@ -1373,6 +1373,26 @@ static void ar9003_hw_cl_cal_post_proc(s
- 	}
- }
- 
-+static void ar9003_hw_init_cal_common(struct ath_hw *ah)
-+{
-+	struct ath9k_hw_cal_data *caldata = ah->caldata;
-+
-+	/* Initialize list pointers */
-+	ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
-+
-+	INIT_CAL(&ah->iq_caldata);
-+	INSERT_CAL(ah, &ah->iq_caldata);
-+
-+	/* Initialize current pointer to first element in list */
-+	ah->cal_list_curr = ah->cal_list;
-+
-+	if (ah->cal_list_curr)
-+		ath9k_hw_reset_calibration(ah, ah->cal_list_curr);
-+
-+	if (caldata)
-+		caldata->CalValid = 0;
-+}
-+
- static bool ar9003_hw_init_cal_pcoem(struct ath_hw *ah,
- 				     struct ath9k_channel *chan)
- {
-@@ -1532,21 +1552,7 @@ skip_tx_iqcal:
- 	/* Revert chainmask to runtime parameters */
- 	ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
- 
--	/* Initialize list pointers */
--	ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
--
--	INIT_CAL(&ah->iq_caldata);
--	INSERT_CAL(ah, &ah->iq_caldata);
--	ath_dbg(common, CALIBRATE, "enabling IQ Calibration\n");
--
--	/* Initialize current pointer to first element in list */
--	ah->cal_list_curr = ah->cal_list;
--
--	if (ah->cal_list_curr)
--		ath9k_hw_reset_calibration(ah, ah->cal_list_curr);
--
--	if (caldata)
--		caldata->CalValid = 0;
-+	ar9003_hw_init_cal_common(ah);
- 
- 	return true;
- }
-@@ -1577,8 +1583,6 @@ static bool do_ar9003_agc_cal(struct ath
- static bool ar9003_hw_init_cal_soc(struct ath_hw *ah,
- 				   struct ath9k_channel *chan)
- {
--	struct ath_common *common = ath9k_hw_common(ah);
--	struct ath9k_hw_cal_data *caldata = ah->caldata;
- 	bool txiqcal_done = false;
- 	bool status = true;
- 	bool run_agc_cal = false, sep_iq_cal = false;
-@@ -1676,21 +1680,7 @@ skip_tx_iqcal:
- 	/* Revert chainmask to runtime parameters */
- 	ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
- 
--	/* Initialize list pointers */
--	ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
--
--	INIT_CAL(&ah->iq_caldata);
--	INSERT_CAL(ah, &ah->iq_caldata);
--	ath_dbg(common, CALIBRATE, "enabling IQ Calibration\n");
--
--	/* Initialize current pointer to first element in list */
--	ah->cal_list_curr = ah->cal_list;
--
--	if (ah->cal_list_curr)
--		ath9k_hw_reset_calibration(ah, ah->cal_list_curr);
--
--	if (caldata)
--		caldata->CalValid = 0;
-+	ar9003_hw_init_cal_common(ah);
- 
- 	return true;
- }
diff --git a/package/kernel/mac80211/patches/329-mac80211-fix-check-for-buffered-powersave-frames-wit.patch b/package/kernel/mac80211/patches/329-mac80211-fix-check-for-buffered-powersave-frames-wit.patch
deleted file mode 100644
index 38e541c715..0000000000
--- a/package/kernel/mac80211/patches/329-mac80211-fix-check-for-buffered-powersave-frames-wit.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Mon, 11 Jul 2016 15:07:06 +0200
-Subject: [PATCH] mac80211: fix check for buffered powersave frames with txq
-
-The logic was inverted here, set the bit if frames are pending.
-
-Fixes: ba8c3d6f16a1 ("mac80211: add an intermediate software queue implementation")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -1268,7 +1268,7 @@ static void sta_ps_start(struct sta_info
- 	for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
- 		struct txq_info *txqi = to_txq_info(sta->sta.txq[tid]);
- 
--		if (!txqi->tin.backlog_packets)
-+		if (txqi->tin.backlog_packets)
- 			set_bit(tid, &sta->txq_buffered_tids);
- 		else
- 			clear_bit(tid, &sta->txq_buffered_tids);
diff --git a/package/kernel/mac80211/patches/330-ath10k-fix-rx-status-reporting-for-A-MSDU-subframes.patch b/package/kernel/mac80211/patches/330-ath10k-fix-rx-status-reporting-for-A-MSDU-subframes.patch
deleted file mode 100644
index a6031b9c26..0000000000
--- a/package/kernel/mac80211/patches/330-ath10k-fix-rx-status-reporting-for-A-MSDU-subframes.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sun, 17 Jul 2016 12:49:59 +0200
-Subject: [PATCH] ath10k: fix rx status reporting for A-MSDU subframes
-
-Patch by Nagarajan, Ashok Raj <arnagara@qti.qualcomm.com>
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath10k/htt_rx.c
-+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
-@@ -1525,7 +1525,7 @@ static void ath10k_htt_rx_h_filter(struc
- static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
- {
- 	struct ath10k *ar = htt->ar;
--	static struct ieee80211_rx_status rx_status;
-+	struct ieee80211_rx_status *rx_status = &htt->rx_status;
- 	struct sk_buff_head amsdu;
- 	int ret;
- 
-@@ -1549,11 +1549,11 @@ static int ath10k_htt_rx_handle_amsdu(st
- 		return ret;
- 	}
- 
--	ath10k_htt_rx_h_ppdu(ar, &amsdu, &rx_status, 0xffff);
-+	ath10k_htt_rx_h_ppdu(ar, &amsdu, rx_status, 0xffff);
- 	ath10k_htt_rx_h_unchain(ar, &amsdu, ret > 0);
--	ath10k_htt_rx_h_filter(ar, &amsdu, &rx_status);
--	ath10k_htt_rx_h_mpdu(ar, &amsdu, &rx_status);
--	ath10k_htt_rx_h_deliver(ar, &amsdu, &rx_status);
-+	ath10k_htt_rx_h_filter(ar, &amsdu, rx_status);
-+	ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status);
-+	ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status);
- 
- 	return 0;
- }
diff --git a/package/kernel/mac80211/patches/331-mac80211-End-the-MPSP-even-if-EOSP-frame-was-not-rec.patch b/package/kernel/mac80211/patches/331-mac80211-End-the-MPSP-even-if-EOSP-frame-was-not-rec.patch
deleted file mode 100644
index 5d8a8fb4e3..0000000000
--- a/package/kernel/mac80211/patches/331-mac80211-End-the-MPSP-even-if-EOSP-frame-was-not-rec.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From: Masashi Honma <masashi.honma@gmail.com>
-Date: Wed, 13 Jul 2016 16:04:35 +0900
-Subject: [PATCH] mac80211: End the MPSP even if EOSP frame was not received
-
-The mesh STA sends QoS frame with EOSP (end of service period)
-subfiled=1 to end the MPSP(mesh peer service period). Previously, if
-the frame was not acked by peer, the mesh STA did not end the MPSP.
-This patch ends the MPSP even if the QoS frame was no acked.
-
-Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
----
-
---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -784,6 +784,13 @@ void ieee80211_tx_status(struct ieee8021
- 			clear_sta_flag(sta, WLAN_STA_SP);
- 
- 		acked = !!(info->flags & IEEE80211_TX_STAT_ACK);
-+
-+		/* mesh Peer Service Period support */
-+		if (ieee80211_vif_is_mesh(&sta->sdata->vif) &&
-+		    ieee80211_is_data_qos(fc))
-+			ieee80211_mpsp_trigger_process(
-+				ieee80211_get_qos_ctl(hdr), sta, true, acked);
-+
- 		if (!acked && test_sta_flag(sta, WLAN_STA_PS_STA)) {
- 			/*
- 			 * The STA is in power save mode, so assume
-@@ -794,13 +801,6 @@ void ieee80211_tx_status(struct ieee8021
- 			return;
- 		}
- 
--		/* mesh Peer Service Period support */
--		if (ieee80211_vif_is_mesh(&sta->sdata->vif) &&
--		    ieee80211_is_data_qos(fc))
--			ieee80211_mpsp_trigger_process(
--					ieee80211_get_qos_ctl(hdr),
--					sta, true, acked);
--
- 		if (ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL) &&
- 		    (ieee80211_is_data(hdr->frame_control)) &&
- 		    (rates_idx != -1))
diff --git a/package/kernel/mac80211/patches/332-ath10k-implement-NAPI-support.patch b/package/kernel/mac80211/patches/332-ath10k-implement-NAPI-support.patch
deleted file mode 100644
index c6cc145957..0000000000
--- a/package/kernel/mac80211/patches/332-ath10k-implement-NAPI-support.patch
+++ /dev/null
@@ -1,642 +0,0 @@
-From: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
-Date: Thu, 21 Jul 2016 11:50:00 +0530
-Subject: [PATCH] ath10k: implement NAPI support
-
-Add NAPI support for rx and tx completion. NAPI poll is scheduled
-from interrupt handler. The design is as below
-
- - on interrupt
-     - schedule napi and mask interrupts
- - on poll
-   - process all pipes (no actual Tx/Rx)
-   - process Rx within budget
-   - if quota exceeds budget reschedule napi poll by returning budget
-   - process Tx completions and update budget if necessary
-   - process Tx fetch indications (pull-push)
-   - push any other pending Tx (if possible)
-   - before resched or napi completion replenish htt rx ring buffer
-   - if work done < budget, complete napi poll and unmask interrupts
-
-This change also get rid of two tasklets (intr_tq and txrx_compl_task).
-
-Measured peak throughput with NAPI on IPQ4019 platform in controlled
-environment. No noticeable reduction in throughput is seen and also
-observed improvements in CPU usage. Approx. 15% CPU usage got reduced
-in UDP uplink case.
-
-DL: AP DUT Tx
-UL: AP DUT Rx
-
-IPQ4019 (avg. cpu usage %)
-========
-                TOT              +NAPI
-              ===========      =============
-TCP DL       644 Mbps (42%)    645 Mbps (36%)
-TCP UL       673 Mbps (30%)    675 Mbps (26%)
-UDP DL       682 Mbps (49%)    680 Mbps (49%)
-UDP UL       720 Mbps (28%)    717 Mbps (11%)
-
-Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
----
-
---- a/drivers/net/wireless/ath/ath10k/ahb.c
-+++ b/drivers/net/wireless/ath/ath10k/ahb.c
-@@ -462,13 +462,13 @@ static void ath10k_ahb_halt_chip(struct
- static irqreturn_t ath10k_ahb_interrupt_handler(int irq, void *arg)
- {
- 	struct ath10k *ar = arg;
--	struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
- 
- 	if (!ath10k_pci_irq_pending(ar))
- 		return IRQ_NONE;
- 
- 	ath10k_pci_disable_and_clear_legacy_irq(ar);
--	tasklet_schedule(&ar_pci->intr_tq);
-+	ath10k_pci_irq_msi_fw_mask(ar);
-+	napi_schedule(&ar->napi);
- 
- 	return IRQ_HANDLED;
- }
-@@ -831,7 +831,7 @@ static int ath10k_ahb_probe(struct platf
- 		goto err_resource_deinit;
- 	}
- 
--	ath10k_pci_init_irq_tasklets(ar);
-+	ath10k_pci_init_napi(ar);
- 
- 	ret = ath10k_ahb_request_irq_legacy(ar);
- 	if (ret)
---- a/drivers/net/wireless/ath/ath10k/core.c
-+++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -2226,6 +2226,8 @@ struct ath10k *ath10k_core_create(size_t
- 	INIT_WORK(&ar->register_work, ath10k_core_register_work);
- 	INIT_WORK(&ar->restart_work, ath10k_core_restart);
- 
-+	init_dummy_netdev(&ar->napi_dev);
-+
- 	ret = ath10k_debug_create(ar);
- 	if (ret)
- 		goto err_free_aux_wq;
---- a/drivers/net/wireless/ath/ath10k/core.h
-+++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -65,6 +65,10 @@
- #define ATH10K_KEEPALIVE_MAX_IDLE 3895
- #define ATH10K_KEEPALIVE_MAX_UNRESPONSIVE 3900
- 
-+/* NAPI poll budget */
-+#define ATH10K_NAPI_BUDGET      64
-+#define ATH10K_NAPI_QUOTA_LIMIT 60
-+
- struct ath10k;
- 
- enum ath10k_bus {
-@@ -933,6 +937,10 @@ struct ath10k {
- 	struct ath10k_thermal thermal;
- 	struct ath10k_wow wow;
- 
-+	/* NAPI */
-+	struct net_device napi_dev;
-+	struct napi_struct napi;
-+
- 	/* must be last */
- 	u8 drv_priv[0] __aligned(sizeof(void *));
- };
---- a/drivers/net/wireless/ath/ath10k/htt.h
-+++ b/drivers/net/wireless/ath/ath10k/htt.h
-@@ -1666,7 +1666,6 @@ struct ath10k_htt {
- 
- 	/* This is used to group tx/rx completions separately and process them
- 	 * in batches to reduce cache stalls */
--	struct tasklet_struct txrx_compl_task;
- 	struct sk_buff_head rx_compl_q;
- 	struct sk_buff_head rx_in_ord_compl_q;
- 	struct sk_buff_head tx_fetch_ind_q;
-@@ -1799,5 +1798,6 @@ int ath10k_htt_tx(struct ath10k_htt *htt
- 		  struct sk_buff *msdu);
- void ath10k_htt_rx_pktlog_completion_handler(struct ath10k *ar,
- 					     struct sk_buff *skb);
-+int ath10k_htt_txrx_compl_task(struct ath10k *ar, int budget);
- 
- #endif
---- a/drivers/net/wireless/ath/ath10k/htt_rx.c
-+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
-@@ -34,7 +34,6 @@
- #define HTT_RX_RING_REFILL_RESCHED_MS 5
- 
- static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb);
--static void ath10k_htt_txrx_compl_task(unsigned long ptr);
- 
- static struct sk_buff *
- ath10k_htt_rx_find_skb_paddr(struct ath10k *ar, u32 paddr)
-@@ -226,7 +225,6 @@ int ath10k_htt_rx_ring_refill(struct ath
- void ath10k_htt_rx_free(struct ath10k_htt *htt)
- {
- 	del_timer_sync(&htt->rx_ring.refill_retry_timer);
--	tasklet_kill(&htt->txrx_compl_task);
- 
- 	skb_queue_purge(&htt->rx_compl_q);
- 	skb_queue_purge(&htt->rx_in_ord_compl_q);
-@@ -520,9 +518,6 @@ int ath10k_htt_rx_alloc(struct ath10k_ht
- 	skb_queue_head_init(&htt->tx_fetch_ind_q);
- 	atomic_set(&htt->num_mpdus_ready, 0);
- 
--	tasklet_init(&htt->txrx_compl_task, ath10k_htt_txrx_compl_task,
--		     (unsigned long)htt);
--
- 	ath10k_dbg(ar, ATH10K_DBG_BOOT, "htt rx ring size %d fill_level %d\n",
- 		   htt->rx_ring.size, htt->rx_ring.fill_level);
- 	return 0;
-@@ -958,7 +953,7 @@ static void ath10k_process_rx(struct ath
- 	trace_ath10k_rx_hdr(ar, skb->data, skb->len);
- 	trace_ath10k_rx_payload(ar, skb->data, skb->len);
- 
--	ieee80211_rx(ar->hw, skb);
-+	ieee80211_rx_napi(ar->hw, NULL, skb, &ar->napi);
- }
- 
- static int ath10k_htt_rx_nwifi_hdrlen(struct ath10k *ar,
-@@ -1527,7 +1522,7 @@ static int ath10k_htt_rx_handle_amsdu(st
- 	struct ath10k *ar = htt->ar;
- 	struct ieee80211_rx_status *rx_status = &htt->rx_status;
- 	struct sk_buff_head amsdu;
--	int ret;
-+	int ret, num_msdus;
- 
- 	__skb_queue_head_init(&amsdu);
- 
-@@ -1549,13 +1544,14 @@ static int ath10k_htt_rx_handle_amsdu(st
- 		return ret;
- 	}
- 
-+	num_msdus = skb_queue_len(&amsdu);
- 	ath10k_htt_rx_h_ppdu(ar, &amsdu, rx_status, 0xffff);
- 	ath10k_htt_rx_h_unchain(ar, &amsdu, ret > 0);
- 	ath10k_htt_rx_h_filter(ar, &amsdu, rx_status);
- 	ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status);
- 	ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status);
- 
--	return 0;
-+	return num_msdus;
- }
- 
- static void ath10k_htt_rx_proc_rx_ind(struct ath10k_htt *htt,
-@@ -1579,15 +1575,6 @@ static void ath10k_htt_rx_proc_rx_ind(st
- 		mpdu_count += mpdu_ranges[i].mpdu_count;
- 
- 	atomic_add(mpdu_count, &htt->num_mpdus_ready);
--
--	tasklet_schedule(&htt->txrx_compl_task);
--}
--
--static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt)
--{
--	atomic_inc(&htt->num_mpdus_ready);
--
--	tasklet_schedule(&htt->txrx_compl_task);
- }
- 
- static void ath10k_htt_rx_tx_compl_ind(struct ath10k *ar,
-@@ -1772,14 +1759,15 @@ static void ath10k_htt_rx_h_rx_offload_p
- 			RX_FLAG_MMIC_STRIPPED;
- }
- 
--static void ath10k_htt_rx_h_rx_offload(struct ath10k *ar,
--				       struct sk_buff_head *list)
-+static int ath10k_htt_rx_h_rx_offload(struct ath10k *ar,
-+				      struct sk_buff_head *list)
- {
- 	struct ath10k_htt *htt = &ar->htt;
- 	struct ieee80211_rx_status *status = &htt->rx_status;
- 	struct htt_rx_offload_msdu *rx;
- 	struct sk_buff *msdu;
- 	size_t offset;
-+	int num_msdu = 0;
- 
- 	while ((msdu = __skb_dequeue(list))) {
- 		/* Offloaded frames don't have Rx descriptor. Instead they have
-@@ -1819,10 +1807,12 @@ static void ath10k_htt_rx_h_rx_offload(s
- 		ath10k_htt_rx_h_rx_offload_prot(status, msdu);
- 		ath10k_htt_rx_h_channel(ar, status, NULL, rx->vdev_id);
- 		ath10k_process_rx(ar, status, msdu);
-+		num_msdu++;
- 	}
-+	return num_msdu;
- }
- 
--static void ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb)
-+static int ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb)
- {
- 	struct ath10k_htt *htt = &ar->htt;
- 	struct htt_resp *resp = (void *)skb->data;
-@@ -1835,12 +1825,12 @@ static void ath10k_htt_rx_in_ord_ind(str
- 	u8 tid;
- 	bool offload;
- 	bool frag;
--	int ret;
-+	int ret, num_msdus = 0;
- 
- 	lockdep_assert_held(&htt->rx_ring.lock);
- 
- 	if (htt->rx_confused)
--		return;
-+		return -EIO;
- 
- 	skb_pull(skb, sizeof(resp->hdr));
- 	skb_pull(skb, sizeof(resp->rx_in_ord_ind));
-@@ -1859,7 +1849,7 @@ static void ath10k_htt_rx_in_ord_ind(str
- 
- 	if (skb->len < msdu_count * sizeof(*resp->rx_in_ord_ind.msdu_descs)) {
- 		ath10k_warn(ar, "dropping invalid in order rx indication\n");
--		return;
-+		return -EINVAL;
- 	}
- 
- 	/* The event can deliver more than 1 A-MSDU. Each A-MSDU is later
-@@ -1870,14 +1860,14 @@ static void ath10k_htt_rx_in_ord_ind(str
- 	if (ret < 0) {
- 		ath10k_warn(ar, "failed to pop paddr list: %d\n", ret);
- 		htt->rx_confused = true;
--		return;
-+		return -EIO;
- 	}
- 
- 	/* Offloaded frames are very different and need to be handled
- 	 * separately.
- 	 */
- 	if (offload)
--		ath10k_htt_rx_h_rx_offload(ar, &list);
-+		num_msdus = ath10k_htt_rx_h_rx_offload(ar, &list);
- 
- 	while (!skb_queue_empty(&list)) {
- 		__skb_queue_head_init(&amsdu);
-@@ -1890,6 +1880,7 @@ static void ath10k_htt_rx_in_ord_ind(str
- 			 * better to report something than nothing though. This
- 			 * should still give an idea about rx rate to the user.
- 			 */
-+			num_msdus += skb_queue_len(&amsdu);
- 			ath10k_htt_rx_h_ppdu(ar, &amsdu, status, vdev_id);
- 			ath10k_htt_rx_h_filter(ar, &amsdu, status);
- 			ath10k_htt_rx_h_mpdu(ar, &amsdu, status);
-@@ -1902,9 +1893,10 @@ static void ath10k_htt_rx_in_ord_ind(str
- 			ath10k_warn(ar, "failed to extract amsdu: %d\n", ret);
- 			htt->rx_confused = true;
- 			__skb_queue_purge(&list);
--			return;
-+			return -EIO;
- 		}
- 	}
-+	return num_msdus;
- }
- 
- static void ath10k_htt_rx_tx_fetch_resp_id_confirm(struct ath10k *ar,
-@@ -2267,7 +2259,6 @@ bool ath10k_htt_t2h_msg_handler(struct a
- 	}
- 	case HTT_T2H_MSG_TYPE_TX_COMPL_IND:
- 		ath10k_htt_rx_tx_compl_ind(htt->ar, skb);
--		tasklet_schedule(&htt->txrx_compl_task);
- 		break;
- 	case HTT_T2H_MSG_TYPE_SEC_IND: {
- 		struct ath10k *ar = htt->ar;
-@@ -2284,7 +2275,7 @@ bool ath10k_htt_t2h_msg_handler(struct a
- 	case HTT_T2H_MSG_TYPE_RX_FRAG_IND: {
- 		ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt event: ",
- 				skb->data, skb->len);
--		ath10k_htt_rx_frag_handler(htt);
-+		atomic_inc(&htt->num_mpdus_ready);
- 		break;
- 	}
- 	case HTT_T2H_MSG_TYPE_TEST:
-@@ -2322,8 +2313,7 @@ bool ath10k_htt_t2h_msg_handler(struct a
- 		break;
- 	}
- 	case HTT_T2H_MSG_TYPE_RX_IN_ORD_PADDR_IND: {
--		skb_queue_tail(&htt->rx_in_ord_compl_q, skb);
--		tasklet_schedule(&htt->txrx_compl_task);
-+		__skb_queue_tail(&htt->rx_in_ord_compl_q, skb);
- 		return false;
- 	}
- 	case HTT_T2H_MSG_TYPE_TX_CREDIT_UPDATE_IND:
-@@ -2349,7 +2339,6 @@ bool ath10k_htt_t2h_msg_handler(struct a
- 			break;
- 		}
- 		skb_queue_tail(&htt->tx_fetch_ind_q, tx_fetch_ind);
--		tasklet_schedule(&htt->txrx_compl_task);
- 		break;
- 	}
- 	case HTT_T2H_MSG_TYPE_TX_FETCH_CONFIRM:
-@@ -2378,27 +2367,77 @@ void ath10k_htt_rx_pktlog_completion_han
- }
- EXPORT_SYMBOL(ath10k_htt_rx_pktlog_completion_handler);
- 
--static void ath10k_htt_txrx_compl_task(unsigned long ptr)
-+int ath10k_htt_txrx_compl_task(struct ath10k *ar, int budget)
- {
--	struct ath10k_htt *htt = (struct ath10k_htt *)ptr;
--	struct ath10k *ar = htt->ar;
-+	struct ath10k_htt *htt = &ar->htt;
- 	struct htt_tx_done tx_done = {};
--	struct sk_buff_head rx_ind_q;
- 	struct sk_buff_head tx_ind_q;
- 	struct sk_buff *skb;
- 	unsigned long flags;
--	int num_mpdus;
-+	int quota = 0, done, num_rx_msdus;
-+	bool resched_napi = false;
- 
--	__skb_queue_head_init(&rx_ind_q);
- 	__skb_queue_head_init(&tx_ind_q);
- 
--	spin_lock_irqsave(&htt->rx_in_ord_compl_q.lock, flags);
--	skb_queue_splice_init(&htt->rx_in_ord_compl_q, &rx_ind_q);
--	spin_unlock_irqrestore(&htt->rx_in_ord_compl_q.lock, flags);
-+	/* Since in-ord-ind can deliver more than 1 A-MSDU in single event,
-+	 * process it first to utilize full available quota.
-+	 */
-+	while (quota < budget) {
-+		if (skb_queue_empty(&htt->rx_in_ord_compl_q))
-+			break;
- 
--	spin_lock_irqsave(&htt->tx_fetch_ind_q.lock, flags);
--	skb_queue_splice_init(&htt->tx_fetch_ind_q, &tx_ind_q);
--	spin_unlock_irqrestore(&htt->tx_fetch_ind_q.lock, flags);
-+		skb = __skb_dequeue(&htt->rx_in_ord_compl_q);
-+		if (!skb) {
-+			resched_napi = true;
-+			goto exit;
-+		}
-+
-+		spin_lock_bh(&htt->rx_ring.lock);
-+		num_rx_msdus = ath10k_htt_rx_in_ord_ind(ar, skb);
-+		spin_unlock_bh(&htt->rx_ring.lock);
-+		if (num_rx_msdus < 0) {
-+			resched_napi = true;
-+			goto exit;
-+		}
-+
-+		dev_kfree_skb_any(skb);
-+		if (num_rx_msdus > 0)
-+			quota += num_rx_msdus;
-+
-+		if ((quota > ATH10K_NAPI_QUOTA_LIMIT) &&
-+		    !skb_queue_empty(&htt->rx_in_ord_compl_q)) {
-+			resched_napi = true;
-+			goto exit;
-+		}
-+	}
-+
-+	while (quota < budget) {
-+		/* no more data to receive */
-+		if (!atomic_read(&htt->num_mpdus_ready))
-+			break;
-+
-+		num_rx_msdus = ath10k_htt_rx_handle_amsdu(htt);
-+		if (num_rx_msdus < 0) {
-+			resched_napi = true;
-+			goto exit;
-+		}
-+
-+		quota += num_rx_msdus;
-+		atomic_dec(&htt->num_mpdus_ready);
-+		if ((quota > ATH10K_NAPI_QUOTA_LIMIT) &&
-+		    atomic_read(&htt->num_mpdus_ready)) {
-+			resched_napi = true;
-+			goto exit;
-+		}
-+	}
-+
-+	/* From NAPI documentation:
-+	 *  The napi poll() function may also process TX completions, in which
-+	 *  case if it processes the entire TX ring then it should count that
-+	 *  work as the rest of the budget.
-+	 */
-+	if ((quota < budget) && !kfifo_is_empty(&htt->txdone_fifo))
-+		quota = budget;
- 
- 	/* kfifo_get: called only within txrx_tasklet so it's neatly serialized.
- 	 * From kfifo_get() documentation:
-@@ -2408,27 +2447,22 @@ static void ath10k_htt_txrx_compl_task(u
- 	while (kfifo_get(&htt->txdone_fifo, &tx_done))
- 		ath10k_txrx_tx_unref(htt, &tx_done);
- 
-+	spin_lock_irqsave(&htt->tx_fetch_ind_q.lock, flags);
-+	skb_queue_splice_init(&htt->tx_fetch_ind_q, &tx_ind_q);
-+	spin_unlock_irqrestore(&htt->tx_fetch_ind_q.lock, flags);
-+
- 	while ((skb = __skb_dequeue(&tx_ind_q))) {
- 		ath10k_htt_rx_tx_fetch_ind(ar, skb);
- 		dev_kfree_skb_any(skb);
- 	}
- 
--	num_mpdus = atomic_read(&htt->num_mpdus_ready);
--
--	while (num_mpdus) {
--		if (ath10k_htt_rx_handle_amsdu(htt))
--			break;
--
--		num_mpdus--;
--		atomic_dec(&htt->num_mpdus_ready);
--	}
--
--	while ((skb = __skb_dequeue(&rx_ind_q))) {
--		spin_lock_bh(&htt->rx_ring.lock);
--		ath10k_htt_rx_in_ord_ind(ar, skb);
--		spin_unlock_bh(&htt->rx_ring.lock);
--		dev_kfree_skb_any(skb);
--	}
--
-+exit:
- 	ath10k_htt_rx_msdu_buff_replenish(htt);
-+	/* In case of rx failure or more data to read, report budget
-+	 * to reschedule NAPI poll
-+	 */
-+	done = resched_napi ? budget : quota;
-+
-+	return done;
- }
-+EXPORT_SYMBOL(ath10k_htt_txrx_compl_task);
---- a/drivers/net/wireless/ath/ath10k/htt_tx.c
-+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
-@@ -388,8 +388,6 @@ void ath10k_htt_tx_free(struct ath10k_ht
- {
- 	int size;
- 
--	tasklet_kill(&htt->txrx_compl_task);
--
- 	idr_for_each(&htt->pending_tx, ath10k_htt_tx_clean_up_pending, htt->ar);
- 	idr_destroy(&htt->pending_tx);
- 
---- a/drivers/net/wireless/ath/ath10k/pci.c
-+++ b/drivers/net/wireless/ath/ath10k/pci.c
-@@ -1502,12 +1502,10 @@ void ath10k_pci_hif_send_complete_check(
- 	ath10k_ce_per_engine_service(ar, pipe);
- }
- 
--void ath10k_pci_kill_tasklet(struct ath10k *ar)
-+static void ath10k_pci_rx_retry_sync(struct ath10k *ar)
- {
- 	struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
- 
--	tasklet_kill(&ar_pci->intr_tq);
--
- 	del_timer_sync(&ar_pci->rx_post_retry);
- }
- 
-@@ -1566,7 +1564,7 @@ void ath10k_pci_hif_get_default_pipe(str
- 						 ul_pipe, dl_pipe);
- }
- 
--static void ath10k_pci_irq_msi_fw_mask(struct ath10k *ar)
-+void ath10k_pci_irq_msi_fw_mask(struct ath10k *ar)
- {
- 	u32 val;
- 
-@@ -1747,7 +1745,7 @@ void ath10k_pci_ce_deinit(struct ath10k
- 
- void ath10k_pci_flush(struct ath10k *ar)
- {
--	ath10k_pci_kill_tasklet(ar);
-+	ath10k_pci_rx_retry_sync(ar);
- 	ath10k_pci_buffer_cleanup(ar);
- }
- 
-@@ -2754,35 +2752,53 @@ static irqreturn_t ath10k_pci_interrupt_
- 		return IRQ_NONE;
- 	}
- 
--	if (ar_pci->oper_irq_mode == ATH10K_PCI_IRQ_LEGACY) {
--		if (!ath10k_pci_irq_pending(ar))
--			return IRQ_NONE;
--
--		ath10k_pci_disable_and_clear_legacy_irq(ar);
--	}
-+	if ((ar_pci->oper_irq_mode == ATH10K_PCI_IRQ_LEGACY) &&
-+	    !ath10k_pci_irq_pending(ar))
-+		return IRQ_NONE;
- 
--	tasklet_schedule(&ar_pci->intr_tq);
-+	ath10k_pci_disable_and_clear_legacy_irq(ar);
-+	ath10k_pci_irq_msi_fw_mask(ar);
-+	napi_schedule(&ar->napi);
- 
- 	return IRQ_HANDLED;
- }
- 
--static void ath10k_pci_tasklet(unsigned long data)
-+static int ath10k_pci_napi_poll(struct napi_struct *ctx, int budget)
- {
--	struct ath10k *ar = (struct ath10k *)data;
--	struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-+	struct ath10k *ar = container_of(ctx, struct ath10k, napi);
-+	int done = 0;
- 
- 	if (ath10k_pci_has_fw_crashed(ar)) {
--		ath10k_pci_irq_disable(ar);
- 		ath10k_pci_fw_crashed_clear(ar);
- 		ath10k_pci_fw_crashed_dump(ar);
--		return;
-+		napi_complete(ctx);
-+		return done;
- 	}
- 
- 	ath10k_ce_per_engine_service_any(ar);
- 
--	/* Re-enable legacy irq that was disabled in the irq handler */
--	if (ar_pci->oper_irq_mode == ATH10K_PCI_IRQ_LEGACY)
-+	done = ath10k_htt_txrx_compl_task(ar, budget);
-+
-+	if (done < budget) {
-+		napi_complete(ctx);
-+		/* In case of MSI, it is possible that interrupts are received
-+		 * while NAPI poll is inprogress. So pending interrupts that are
-+		 * received after processing all copy engine pipes by NAPI poll
-+		 * will not be handled again. This is causing failure to
-+		 * complete boot sequence in x86 platform. So before enabling
-+		 * interrupts safer to check for pending interrupts for
-+		 * immediate servicing.
-+		 */
-+		if (CE_INTERRUPT_SUMMARY(ar)) {
-+			napi_reschedule(&ar->napi);
-+			goto out;
-+		}
- 		ath10k_pci_enable_legacy_irq(ar);
-+		ath10k_pci_irq_msi_fw_unmask(ar);
-+	}
-+
-+out:
-+	return done;
- }
- 
- static int ath10k_pci_request_irq_msi(struct ath10k *ar)
-@@ -2840,11 +2856,11 @@ static void ath10k_pci_free_irq(struct a
- 	free_irq(ar_pci->pdev->irq, ar);
- }
- 
--void ath10k_pci_init_irq_tasklets(struct ath10k *ar)
-+void ath10k_pci_init_napi(struct ath10k *ar)
- {
--	struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
--
--	tasklet_init(&ar_pci->intr_tq, ath10k_pci_tasklet, (unsigned long)ar);
-+	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_pci_napi_poll,
-+		       ATH10K_NAPI_BUDGET);
-+	napi_enable(&ar->napi);
- }
- 
- static int ath10k_pci_init_irq(struct ath10k *ar)
-@@ -2852,7 +2868,7 @@ static int ath10k_pci_init_irq(struct at
- 	struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
- 	int ret;
- 
--	ath10k_pci_init_irq_tasklets(ar);
-+	ath10k_pci_init_napi(ar);
- 
- 	if (ath10k_pci_irq_mode != ATH10K_PCI_IRQ_AUTO)
- 		ath10k_info(ar, "limiting irq mode to: %d\n",
-@@ -3113,7 +3129,8 @@ int ath10k_pci_setup_resource(struct ath
- 
- void ath10k_pci_release_resource(struct ath10k *ar)
- {
--	ath10k_pci_kill_tasklet(ar);
-+	ath10k_pci_rx_retry_sync(ar);
-+	netif_napi_del(&ar->napi);
- 	ath10k_pci_ce_deinit(ar);
- 	ath10k_pci_free_pipes(ar);
- }
-@@ -3274,7 +3291,7 @@ static int ath10k_pci_probe(struct pci_d
- 
- err_free_irq:
- 	ath10k_pci_free_irq(ar);
--	ath10k_pci_kill_tasklet(ar);
-+	ath10k_pci_rx_retry_sync(ar);
- 
- err_deinit_irq:
- 	ath10k_pci_deinit_irq(ar);
---- a/drivers/net/wireless/ath/ath10k/pci.h
-+++ b/drivers/net/wireless/ath/ath10k/pci.h
-@@ -177,8 +177,6 @@ struct ath10k_pci {
- 	/* Operating interrupt mode */
- 	enum ath10k_pci_irq_mode oper_irq_mode;
- 
--	struct tasklet_struct intr_tq;
--
- 	struct ath10k_pci_pipe pipe_info[CE_COUNT_MAX];
- 
- 	/* Copy Engine used for Diagnostic Accesses */
-@@ -294,8 +292,7 @@ void ath10k_pci_free_pipes(struct ath10k
- void ath10k_pci_free_pipes(struct ath10k *ar);
- void ath10k_pci_rx_replenish_retry(unsigned long ptr);
- void ath10k_pci_ce_deinit(struct ath10k *ar);
--void ath10k_pci_init_irq_tasklets(struct ath10k *ar);
--void ath10k_pci_kill_tasklet(struct ath10k *ar);
-+void ath10k_pci_init_napi(struct ath10k *ar);
- int ath10k_pci_init_pipes(struct ath10k *ar);
- int ath10k_pci_init_config(struct ath10k *ar);
- void ath10k_pci_rx_post(struct ath10k *ar);
-@@ -303,6 +300,7 @@ void ath10k_pci_flush(struct ath10k *ar)
- void ath10k_pci_enable_legacy_irq(struct ath10k *ar);
- bool ath10k_pci_irq_pending(struct ath10k *ar);
- void ath10k_pci_disable_and_clear_legacy_irq(struct ath10k *ar);
-+void ath10k_pci_irq_msi_fw_mask(struct ath10k *ar);
- int ath10k_pci_wait_for_target_init(struct ath10k *ar);
- int ath10k_pci_setup_resource(struct ath10k *ar);
- void ath10k_pci_release_resource(struct ath10k *ar);
diff --git a/package/kernel/mac80211/patches/333-ath9k-fix-client-mode-beacon-configuration.patch b/package/kernel/mac80211/patches/333-ath9k-fix-client-mode-beacon-configuration.patch
deleted file mode 100644
index d008ceb706..0000000000
--- a/package/kernel/mac80211/patches/333-ath9k-fix-client-mode-beacon-configuration.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 26 Jul 2016 08:05:10 +0200
-Subject: [PATCH] ath9k: fix client mode beacon configuration
-
-For pure station mode, iter_data.primary_beacon_vif was used and passed
-to ath_beacon_config, but not set to the station vif.
-This was causing the following warning:
-
-[  100.310919] ------------[ cut here ]------------
-[  100.315683] WARNING: CPU: 0 PID: 7 at compat-wireless-2016-06-20/drivers/net/wireless/ath/ath9k/beacon.c:642 ath9k_calculate_summary_state+0x250/0x60c [ath9k]()
-[  100.402028] CPU: 0 PID: 7 Comm: kworker/u2:1 Tainted: G        W       4.4.15 #5
-[  100.409676] Workqueue: phy0 ieee80211_ibss_leave [mac80211]
-[  100.415351] Stack : 8736e98c 870b4b20 87a25b54 800a6800 8782a080 80400d63 8039b96c 00000007
-[  100.415351]    803c5edc 87875914 80400000 800a47cc 87a25b54 800a6800 803a0fd8 80400000
-[  100.415351]    00000003 87875914 80400000 80094ae0 87a25b54 8787594c 00000000 801ef308
-[  100.415351]    803ffe70 801ef300 87193d58 87b3a400 87b3ad00 70687930 00000000 00000000
-[  100.415351]    00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
-[  100.415351]    ...
-[  100.451703] Call Trace:
-[  100.454235] [<800a6800>] vprintk_default+0x24/0x30
-[  100.459110] [<800a47cc>] printk+0x2c/0x38
-[  100.463190] [<800a6800>] vprintk_default+0x24/0x30
-[  100.468072] [<80094ae0>] print_worker_info+0x148/0x174
-[  100.473378] [<801ef308>] serial8250_console_putchar+0x0/0x44
-[  100.479122] [<801ef300>] wait_for_xmitr+0xc4/0xcc
-[  100.484014] [<87193d58>] ieee80211_ibss_leave+0xb90/0x1900 [mac80211]
-[  100.490590] [<80081604>] warn_slowpath_common+0xa0/0xd0
-[  100.495922] [<801a359c>] dump_stack+0x14/0x28
-[  100.500350] [<80071a00>] show_stack+0x50/0x84
-[  100.504784] [<80081604>] warn_slowpath_common+0xa0/0xd0
-[  100.510106] [<87024c60>] ath9k_calculate_summary_state+0x250/0x60c [ath9k]
-[  100.517105] [<800816b8>] warn_slowpath_null+0x18/0x24
-[  100.522256] [<87024c60>] ath9k_calculate_summary_state+0x250/0x60c [ath9k]
-[  100.529273] [<87025418>] ath9k_set_txpower+0x148/0x498 [ath9k]
-[  100.535302] [<871d2c64>] cleanup_module+0xa74/0xd4c [mac80211]
-[  100.541237] [<801ef308>] serial8250_console_putchar+0x0/0x44
-[  100.547042] [<800a5d18>] wake_up_klogd+0x54/0x68
-[  100.551730] [<800a6650>] vprintk_emit+0x404/0x43c
-[  100.556623] [<871b9db8>] ieee80211_sta_rx_notify+0x258/0x32c [mac80211]
-[  100.563475] [<871ba6a4>] ieee80211_sta_rx_queued_mgmt+0x63c/0x734 [mac80211]
-[  100.570693] [<871aa49c>] ieee80211_tx_prepare_skb+0x210/0x230 [mac80211]
-[  100.577609] [<800af5d4>] mod_timer+0x15c/0x190
-[  100.582220] [<871ba8b8>] ieee80211_sta_work+0xfc/0xe1c [mac80211]
-[  100.588539] [<871940b4>] ieee80211_ibss_leave+0xeec/0x1900 [mac80211]
-[  100.595122] [<8009ec84>] dequeue_task_fair+0x44/0x130
-[  100.600281] [<80092a34>] process_one_work+0x1f8/0x334
-[  100.605454] [<80093830>] worker_thread+0x2b4/0x408
-[  100.610317] [<8009357c>] worker_thread+0x0/0x408
-[  100.615019] [<8009357c>] worker_thread+0x0/0x408
-[  100.619705] [<80097b68>] kthread+0xdc/0xe8
-[  100.623886] [<80097a8c>] kthread+0x0/0xe8
-[  100.627961] [<80060878>] ret_from_kernel_thread+0x14/0x1c
-[  100.633448]
-[  100.634956] ---[ end trace aafbe57e9ae6862f ]---
-
-Fixes: cfda2d8e2314 ("ath9k: Fix beacon configuration for addition/removal of interfaces")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -1154,6 +1154,7 @@ void ath9k_calculate_summary_state(struc
- 		bool changed = (iter_data.primary_sta != ctx->primary_sta);
- 
- 		if (iter_data.primary_sta) {
-+			iter_data.primary_beacon_vif = iter_data.primary_sta;
- 			iter_data.beacons = true;
- 			ath9k_set_assoc_state(sc, iter_data.primary_sta,
- 					      changed);
diff --git a/package/kernel/mac80211/patches/334-mac80211-fix-purging-multicast-PS-buffer-queue.patch b/package/kernel/mac80211/patches/334-mac80211-fix-purging-multicast-PS-buffer-queue.patch
deleted file mode 100644
index dfcc6e4565..0000000000
--- a/package/kernel/mac80211/patches/334-mac80211-fix-purging-multicast-PS-buffer-queue.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 2 Aug 2016 11:11:13 +0200
-Subject: [PATCH] mac80211: fix purging multicast PS buffer queue
-
-The code currently assumes that buffered multicast PS frames don't have
-a pending ACK frame for tx status reporting.
-However, hostapd sends a broadcast deauth frame on teardown for which tx
-status is requested. This can lead to the "Have pending ack frames"
-warning on module reload.
-Fix this by using ieee80211_free_txskb/ieee80211_purge_tx_queue.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -868,7 +868,7 @@ static int ieee80211_stop_ap(struct wiph
- 
- 	/* free all potentially still buffered bcast frames */
- 	local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf);
--	skb_queue_purge(&sdata->u.ap.ps.bc_buf);
-+	ieee80211_purge_tx_queue(&local->hw, &sdata->u.ap.ps.bc_buf);
- 
- 	mutex_lock(&local->mtx);
- 	ieee80211_vif_copy_chanctx_to_vlans(sdata, true);
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -368,7 +368,7 @@ static void purge_old_ps_buffers(struct
- 		skb = skb_dequeue(&ps->bc_buf);
- 		if (skb) {
- 			purged++;
--			dev_kfree_skb(skb);
-+			ieee80211_free_txskb(&local->hw, skb);
- 		}
- 		total += skb_queue_len(&ps->bc_buf);
- 	}
-@@ -451,7 +451,7 @@ ieee80211_tx_h_multicast_ps_buf(struct i
- 	if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {
- 		ps_dbg(tx->sdata,
- 		       "BC TX buffer full - dropping the oldest frame\n");
--		dev_kfree_skb(skb_dequeue(&ps->bc_buf));
-+		ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf));
- 	} else
- 		tx->local->total_ps_buffered++;
- 
-@@ -4276,7 +4276,7 @@ ieee80211_get_buffered_bc(struct ieee802
- 			sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
- 		if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb))
- 			break;
--		dev_kfree_skb_any(skb);
-+		ieee80211_free_txskb(hw, skb);
- 	}
- 
- 	info = IEEE80211_SKB_CB(skb);
diff --git a/package/kernel/mac80211/patches/335-ath9k-use-ieee80211_tx_status_noskb-where-possible.patch b/package/kernel/mac80211/patches/335-ath9k-use-ieee80211_tx_status_noskb-where-possible.patch
deleted file mode 100644
index dbb5b90fe6..0000000000
--- a/package/kernel/mac80211/patches/335-ath9k-use-ieee80211_tx_status_noskb-where-possible.patch
+++ /dev/null
@@ -1,305 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 2 Aug 2016 12:12:18 +0200
-Subject: [PATCH] ath9k: use ieee80211_tx_status_noskb where possible
-
-It removes the need for undoing the padding changes to skb->data and it
-improves performance by eliminating one tx status lookup per MPDU in the
-status path. It is also useful for preparing a follow-up fix to better
-handle powersave filtering.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -50,9 +50,11 @@ static u16 bits_per_symbol[][2] = {
- static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
- 			       struct ath_atx_tid *tid, struct sk_buff *skb);
- static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
--			    int tx_flags, struct ath_txq *txq);
-+			    int tx_flags, struct ath_txq *txq,
-+			    struct ieee80211_sta *sta);
- static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
- 				struct ath_txq *txq, struct list_head *bf_q,
-+				struct ieee80211_sta *sta,
- 				struct ath_tx_status *ts, int txok);
- static void ath_tx_txqaddbuf(struct ath_softc *sc, struct ath_txq *txq,
- 			     struct list_head *head, bool internal);
-@@ -77,6 +79,22 @@ enum {
- /* Aggregation logic */
- /*********************/
- 
-+static void ath_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
-+{
-+	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	struct ieee80211_sta *sta = info->status.status_driver_data[0];
-+
-+	if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) {
-+		ieee80211_tx_status(hw, skb);
-+		return;
-+	}
-+
-+	if (sta)
-+		ieee80211_tx_status_noskb(hw, sta, info);
-+
-+	dev_kfree_skb(skb);
-+}
-+
- void ath_txq_lock(struct ath_softc *sc, struct ath_txq *txq)
- 	__acquires(&txq->axq_lock)
- {
-@@ -92,6 +110,7 @@ void ath_txq_unlock(struct ath_softc *sc
- void ath_txq_unlock_complete(struct ath_softc *sc, struct ath_txq *txq)
- 	__releases(&txq->axq_lock)
- {
-+	struct ieee80211_hw *hw = sc->hw;
- 	struct sk_buff_head q;
- 	struct sk_buff *skb;
- 
-@@ -100,7 +119,7 @@ void ath_txq_unlock_complete(struct ath_
- 	spin_unlock_bh(&txq->axq_lock);
- 
- 	while ((skb = __skb_dequeue(&q)))
--		ieee80211_tx_status(sc->hw, skb);
-+		ath_tx_status(hw, skb);
- }
- 
- static void ath_tx_queue_tid(struct ath_softc *sc, struct ath_txq *txq,
-@@ -268,7 +287,7 @@ static void ath_tx_flush_tid(struct ath_
- 		}
- 
- 		list_add_tail(&bf->list, &bf_head);
--		ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
-+		ath_tx_complete_buf(sc, bf, txq, &bf_head, NULL, &ts, 0);
- 	}
- 
- 	if (sendbar) {
-@@ -333,12 +352,12 @@ static void ath_tid_drain(struct ath_sof
- 		bf = fi->bf;
- 
- 		if (!bf) {
--			ath_tx_complete(sc, skb, ATH_TX_ERROR, txq);
-+			ath_tx_complete(sc, skb, ATH_TX_ERROR, txq, NULL);
- 			continue;
- 		}
- 
- 		list_add_tail(&bf->list, &bf_head);
--		ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
-+		ath_tx_complete_buf(sc, bf, txq, &bf_head, NULL, &ts, 0);
- 	}
- }
- 
-@@ -441,12 +460,11 @@ static void ath_tx_count_frames(struct a
- 
- static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
- 				 struct ath_buf *bf, struct list_head *bf_q,
-+				 struct ieee80211_sta *sta,
- 				 struct ath_tx_status *ts, int txok)
- {
- 	struct ath_node *an = NULL;
- 	struct sk_buff *skb;
--	struct ieee80211_sta *sta;
--	struct ieee80211_hw *hw = sc->hw;
- 	struct ieee80211_hdr *hdr;
- 	struct ieee80211_tx_info *tx_info;
- 	struct ath_atx_tid *tid = NULL;
-@@ -475,12 +493,7 @@ static void ath_tx_complete_aggr(struct
- 	for (i = 0; i < ts->ts_rateindex; i++)
- 		retries += rates[i].count;
- 
--	rcu_read_lock();
--
--	sta = ieee80211_find_sta_by_ifaddr(hw, hdr->addr1, hdr->addr2);
- 	if (!sta) {
--		rcu_read_unlock();
--
- 		INIT_LIST_HEAD(&bf_head);
- 		while (bf) {
- 			bf_next = bf->bf_next;
-@@ -488,7 +501,7 @@ static void ath_tx_complete_aggr(struct
- 			if (!bf->bf_state.stale || bf_next != NULL)
- 				list_move_tail(&bf->list, &bf_head);
- 
--			ath_tx_complete_buf(sc, bf, txq, &bf_head, ts, 0);
-+			ath_tx_complete_buf(sc, bf, txq, &bf_head, NULL, ts, 0);
- 
- 			bf = bf_next;
- 		}
-@@ -598,7 +611,7 @@ static void ath_tx_complete_aggr(struct
- 								ts);
- 			}
- 
--			ath_tx_complete_buf(sc, bf, txq, &bf_head, ts,
-+			ath_tx_complete_buf(sc, bf, txq, &bf_head, sta, ts,
- 				!txfail);
- 		} else {
- 			if (tx_info->flags & IEEE80211_TX_STATUS_EOSP) {
-@@ -619,7 +632,8 @@ static void ath_tx_complete_aggr(struct
- 					ath_tx_update_baw(sc, tid, seqno);
- 
- 					ath_tx_complete_buf(sc, bf, txq,
--							    &bf_head, ts, 0);
-+							    &bf_head, NULL, ts,
-+							    0);
- 					bar_index = max_t(int, bar_index,
- 						ATH_BA_INDEX(seq_first, seqno));
- 					break;
-@@ -663,8 +677,6 @@ static void ath_tx_complete_aggr(struct
- 		ath_txq_lock(sc, txq);
- 	}
- 
--	rcu_read_unlock();
--
- 	if (needreset)
- 		ath9k_queue_reset(sc, RESET_TYPE_TX_ERROR);
- }
-@@ -679,7 +691,10 @@ static void ath_tx_process_buffer(struct
- 				  struct ath_tx_status *ts, struct ath_buf *bf,
- 				  struct list_head *bf_head)
- {
-+	struct ieee80211_hw *hw = sc->hw;
- 	struct ieee80211_tx_info *info;
-+	struct ieee80211_sta *sta;
-+	struct ieee80211_hdr *hdr;
- 	bool txok, flush;
- 
- 	txok = !(ts->ts_status & ATH9K_TXERR_MASK);
-@@ -692,6 +707,10 @@ static void ath_tx_process_buffer(struct
- 
- 	ts->duration = ath9k_hw_get_duration(sc->sc_ah, bf->bf_desc,
- 					     ts->ts_rateindex);
-+
-+	hdr = (struct ieee80211_hdr *) bf->bf_mpdu->data;
-+	sta = ieee80211_find_sta_by_ifaddr(hw, hdr->addr1, hdr->addr2);
-+
- 	if (!bf_isampdu(bf)) {
- 		if (!flush) {
- 			info = IEEE80211_SKB_CB(bf->bf_mpdu);
-@@ -700,9 +719,9 @@ static void ath_tx_process_buffer(struct
- 			ath_tx_rc_status(sc, bf, ts, 1, txok ? 0 : 1, txok);
- 			ath_dynack_sample_tx_ts(sc->sc_ah, bf->bf_mpdu, ts);
- 		}
--		ath_tx_complete_buf(sc, bf, txq, bf_head, ts, txok);
-+		ath_tx_complete_buf(sc, bf, txq, bf_head, sta, ts, txok);
- 	} else
--		ath_tx_complete_aggr(sc, txq, bf, bf_head, ts, txok);
-+		ath_tx_complete_aggr(sc, txq, bf, bf_head, sta, ts, txok);
- 
- 	if (!flush)
- 		ath_txq_schedule(sc, txq);
-@@ -938,7 +957,7 @@ ath_tx_get_tid_subframe(struct ath_softc
- 			list_add(&bf->list, &bf_head);
- 			__skb_unlink(skb, *q);
- 			ath_tx_update_baw(sc, tid, seqno);
--			ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
-+			ath_tx_complete_buf(sc, bf, txq, &bf_head, NULL, &ts, 0);
- 			continue;
- 		}
- 
-@@ -1847,6 +1866,7 @@ static void ath_drain_txq_list(struct at
-  */
- void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq)
- {
-+	rcu_read_lock();
- 	ath_txq_lock(sc, txq);
- 
- 	if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
-@@ -1865,6 +1885,7 @@ void ath_draintxq(struct ath_softc *sc,
- 	ath_drain_txq_list(sc, txq, &txq->axq_q);
- 
- 	ath_txq_unlock_complete(sc, txq);
-+	rcu_read_unlock();
- }
- 
- bool ath_drain_all_txq(struct ath_softc *sc)
-@@ -2487,7 +2508,8 @@ void ath_tx_cabq(struct ieee80211_hw *hw
- /*****************/
- 
- static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
--			    int tx_flags, struct ath_txq *txq)
-+			    int tx_flags, struct ath_txq *txq,
-+			    struct ieee80211_sta *sta)
- {
- 	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
- 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-@@ -2507,15 +2529,17 @@ static void ath_tx_complete(struct ath_s
- 			tx_info->flags |= IEEE80211_TX_STAT_ACK;
- 	}
- 
--	padpos = ieee80211_hdrlen(hdr->frame_control);
--	padsize = padpos & 3;
--	if (padsize && skb->len>padpos+padsize) {
--		/*
--		 * Remove MAC header padding before giving the frame back to
--		 * mac80211.
--		 */
--		memmove(skb->data + padsize, skb->data, padpos);
--		skb_pull(skb, padsize);
-+	if (tx_info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) {
-+		padpos = ieee80211_hdrlen(hdr->frame_control);
-+		padsize = padpos & 3;
-+		if (padsize && skb->len>padpos+padsize) {
-+			/*
-+			 * Remove MAC header padding before giving the frame back to
-+			 * mac80211.
-+			 */
-+			memmove(skb->data + padsize, skb->data, padpos);
-+			skb_pull(skb, padsize);
-+		}
- 	}
- 
- 	spin_lock_irqsave(&sc->sc_pm_lock, flags);
-@@ -2530,12 +2554,14 @@ static void ath_tx_complete(struct ath_s
- 	}
- 	spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
- 
--	__skb_queue_tail(&txq->complete_q, skb);
- 	ath_txq_skb_done(sc, txq, skb);
-+	tx_info->status.status_driver_data[0] = sta;
-+	__skb_queue_tail(&txq->complete_q, skb);
- }
- 
- static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
- 				struct ath_txq *txq, struct list_head *bf_q,
-+				struct ieee80211_sta *sta,
- 				struct ath_tx_status *ts, int txok)
- {
- 	struct sk_buff *skb = bf->bf_mpdu;
-@@ -2563,7 +2589,7 @@ static void ath_tx_complete_buf(struct a
- 			complete(&sc->paprd_complete);
- 	} else {
- 		ath_debug_stat_tx(sc, bf, ts, txq, tx_flags);
--		ath_tx_complete(sc, skb, tx_flags, txq);
-+		ath_tx_complete(sc, skb, tx_flags, txq, sta);
- 	}
- skip_tx_complete:
- 	/* At this point, skb (bf->bf_mpdu) is consumed...make sure we don't
-@@ -2715,10 +2741,12 @@ void ath_tx_tasklet(struct ath_softc *sc
- 	u32 qcumask = ((1 << ATH9K_NUM_TX_QUEUES) - 1) & ah->intr_txqs;
- 	int i;
- 
-+	rcu_read_lock();
- 	for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
- 		if (ATH_TXQ_SETUP(sc, i) && (qcumask & (1 << i)))
- 			ath_tx_processq(sc, &sc->tx.txq[i]);
- 	}
-+	rcu_read_unlock();
- }
- 
- void ath_tx_edma_tasklet(struct ath_softc *sc)
-@@ -2732,6 +2760,7 @@ void ath_tx_edma_tasklet(struct ath_soft
- 	struct list_head *fifo_list;
- 	int status;
- 
-+	rcu_read_lock();
- 	for (;;) {
- 		if (test_bit(ATH_OP_HW_RESET, &common->op_flags))
- 			break;
-@@ -2802,6 +2831,7 @@ void ath_tx_edma_tasklet(struct ath_soft
- 		ath_tx_process_buffer(sc, txq, &ts, bf, &bf_head);
- 		ath_txq_unlock_complete(sc, txq);
- 	}
-+	rcu_read_unlock();
- }
- 
- /*****************/
diff --git a/package/kernel/mac80211/patches/336-ath9k-improve-powersave-filter-handling.patch b/package/kernel/mac80211/patches/336-ath9k-improve-powersave-filter-handling.patch
deleted file mode 100644
index 67a6c631ee..0000000000
--- a/package/kernel/mac80211/patches/336-ath9k-improve-powersave-filter-handling.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 2 Aug 2016 12:13:35 +0200
-Subject: [PATCH] ath9k: improve powersave filter handling
-
-For non-aggregated frames, ath9k was leaving handling of powersave
-filtered packets to mac80211. This can be too slow if the intermediate
-queue is already filled with packets and mac80211 does not immediately
-send a new packet via drv_tx().
-
-Improve response time with filtered frames by triggering clearing the
-powersave filter internally.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -461,13 +461,13 @@ static void ath_tx_count_frames(struct a
- static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
- 				 struct ath_buf *bf, struct list_head *bf_q,
- 				 struct ieee80211_sta *sta,
-+				 struct ath_atx_tid *tid,
- 				 struct ath_tx_status *ts, int txok)
- {
- 	struct ath_node *an = NULL;
- 	struct sk_buff *skb;
- 	struct ieee80211_hdr *hdr;
- 	struct ieee80211_tx_info *tx_info;
--	struct ath_atx_tid *tid = NULL;
- 	struct ath_buf *bf_next, *bf_last = bf->bf_lastbf;
- 	struct list_head bf_head;
- 	struct sk_buff_head bf_pending;
-@@ -509,7 +509,6 @@ static void ath_tx_complete_aggr(struct
- 	}
- 
- 	an = (struct ath_node *)sta->drv_priv;
--	tid = ath_get_skb_tid(sc, an, skb);
- 	seq_first = tid->seq_start;
- 	isba = ts->ts_flags & ATH9K_TX_BA;
- 
-@@ -695,6 +694,7 @@ static void ath_tx_process_buffer(struct
- 	struct ieee80211_tx_info *info;
- 	struct ieee80211_sta *sta;
- 	struct ieee80211_hdr *hdr;
-+	struct ath_atx_tid *tid = NULL;
- 	bool txok, flush;
- 
- 	txok = !(ts->ts_status & ATH9K_TXERR_MASK);
-@@ -710,6 +710,12 @@ static void ath_tx_process_buffer(struct
- 
- 	hdr = (struct ieee80211_hdr *) bf->bf_mpdu->data;
- 	sta = ieee80211_find_sta_by_ifaddr(hw, hdr->addr1, hdr->addr2);
-+	if (sta) {
-+		struct ath_node *an = (struct ath_node *)sta->drv_priv;
-+		tid = ath_get_skb_tid(sc, an, bf->bf_mpdu);
-+		if (ts->ts_status & (ATH9K_TXERR_FILT | ATH9K_TXERR_XRETRY))
-+			tid->clear_ps_filter = true;
-+	}
- 
- 	if (!bf_isampdu(bf)) {
- 		if (!flush) {
-@@ -721,7 +727,7 @@ static void ath_tx_process_buffer(struct
- 		}
- 		ath_tx_complete_buf(sc, bf, txq, bf_head, sta, ts, txok);
- 	} else
--		ath_tx_complete_aggr(sc, txq, bf, bf_head, sta, ts, txok);
-+		ath_tx_complete_aggr(sc, txq, bf, bf_head, sta, tid, ts, txok);
- 
- 	if (!flush)
- 		ath_txq_schedule(sc, txq);
diff --git a/package/kernel/mac80211/patches/338-mac80211-fix-tim-recalculation-after-PS-response.patch b/package/kernel/mac80211/patches/338-mac80211-fix-tim-recalculation-after-PS-response.patch
deleted file mode 100644
index 6c0852e826..0000000000
--- a/package/kernel/mac80211/patches/338-mac80211-fix-tim-recalculation-after-PS-response.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 26 Aug 2016 21:57:16 +0200
-Subject: [PATCH] mac80211: fix tim recalculation after PS response
-
-Handle the case where the mac80211 intermediate queues are empty and the
-driver has buffered frames
-
-Fixes: ba8c3d6f16a1 ("mac80211: add an intermediate software queue implementation")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -1616,7 +1616,6 @@ ieee80211_sta_ps_deliver_response(struct
- 
- 		sta_info_recalc_tim(sta);
- 	} else {
--		unsigned long tids = sta->txq_buffered_tids & driver_release_tids;
- 		int tid;
- 
- 		/*
-@@ -1648,7 +1647,8 @@ ieee80211_sta_ps_deliver_response(struct
- 		for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
- 			struct txq_info *txqi = to_txq_info(sta->sta.txq[tid]);
- 
--			if (!(tids & BIT(tid)) || txqi->tin.backlog_packets)
-+			if (!(driver_release_tids & BIT(tid)) ||
-+			    txqi->tin.backlog_packets)
- 				continue;
- 
- 			sta_info_recalc_tim(sta);
diff --git a/package/kernel/mac80211/patches/343-mac80211-send-delBA-on-unexpected-BlockAck-data-fram.patch b/package/kernel/mac80211/patches/343-mac80211-send-delBA-on-unexpected-BlockAck-data-fram.patch
deleted file mode 100644
index 3bbca22b46..0000000000
--- a/package/kernel/mac80211/patches/343-mac80211-send-delBA-on-unexpected-BlockAck-data-fram.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Mon, 29 Aug 2016 23:25:18 +0300
-Subject: [PATCH] mac80211: send delBA on unexpected BlockAck data frames
-
-When we receive data frames with ACK policy BlockAck, send
-delBA as requested by the 802.11 spec. Since this would be
-happening for every frame inside an A-MPDU if it's really
-received outside a session, limit it to a single attempt.
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/agg-rx.c
-+++ b/net/mac80211/agg-rx.c
-@@ -388,8 +388,10 @@ void __ieee80211_start_rx_ba_session(str
- 	}
- 
- end:
--	if (status == WLAN_STATUS_SUCCESS)
-+	if (status == WLAN_STATUS_SUCCESS) {
- 		__set_bit(tid, sta->ampdu_mlme.agg_session_valid);
-+		__clear_bit(tid, sta->ampdu_mlme.unexpected_agg);
-+	}
- 	mutex_unlock(&sta->ampdu_mlme.mtx);
- 
- end_no_lock:
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -1072,8 +1072,15 @@ static void ieee80211_rx_reorder_ampdu(s
- 	tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
- 
- 	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
--	if (!tid_agg_rx)
-+	if (!tid_agg_rx) {
-+		if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
-+		    !test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
-+		    !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
-+			ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
-+					     WLAN_BACK_RECIPIENT,
-+					     WLAN_REASON_QSTA_REQUIRE_SETUP);
- 		goto dont_reorder;
-+	}
- 
- 	/* qos null data frames are excluded */
- 	if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
---- a/net/mac80211/sta_info.h
-+++ b/net/mac80211/sta_info.h
-@@ -230,6 +230,8 @@ struct tid_ampdu_rx {
-  * @tid_rx_stop_requested:  bitmap indicating which BA sessions per TID the
-  *	driver requested to close until the work for it runs
-  * @agg_session_valid: bitmap indicating which TID has a rx BA session open on
-+ * @unexpected_agg: bitmap indicating which TID already sent a delBA due to
-+ *	unexpected aggregation related frames outside a session
-  * @work: work struct for starting/stopping aggregation
-  * @tid_tx: aggregation info for Tx per TID
-  * @tid_start_tx: sessions where start was requested
-@@ -244,6 +246,7 @@ struct sta_ampdu_mlme {
- 	unsigned long tid_rx_timer_expired[BITS_TO_LONGS(IEEE80211_NUM_TIDS)];
- 	unsigned long tid_rx_stop_requested[BITS_TO_LONGS(IEEE80211_NUM_TIDS)];
- 	unsigned long agg_session_valid[BITS_TO_LONGS(IEEE80211_NUM_TIDS)];
-+	unsigned long unexpected_agg[BITS_TO_LONGS(IEEE80211_NUM_TIDS)];
- 	/* tx */
- 	struct work_struct work;
- 	struct tid_ampdu_tx __rcu *tid_tx[IEEE80211_NUM_TIDS];
diff --git a/package/kernel/mac80211/patches/344-mac80211-send-delBA-on-unexpected-BlockAck-Request.patch b/package/kernel/mac80211/patches/344-mac80211-send-delBA-on-unexpected-BlockAck-Request.patch
deleted file mode 100644
index c3d3118894..0000000000
--- a/package/kernel/mac80211/patches/344-mac80211-send-delBA-on-unexpected-BlockAck-Request.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Mon, 29 Aug 2016 23:25:19 +0300
-Subject: [PATCH] mac80211: send delBA on unexpected BlockAck Request
-
-If we don't have a BA session, send delBA, as requested by the
-IEEE 802.11 spec. Apply the same limit of sending such a delBA
-only once as in the previous patch.
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -2537,6 +2537,12 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_
- 
- 		tid = le16_to_cpu(bar_data.control) >> 12;
- 
-+		if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
-+		    !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
-+			ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
-+					     WLAN_BACK_RECIPIENT,
-+					     WLAN_REASON_QSTA_REQUIRE_SETUP);
-+
- 		tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
- 		if (!tid_agg_rx)
- 			return RX_DROP_MONITOR;
diff --git a/package/kernel/mac80211/patches/345-mac80211-Move-reorder-sensitive-TX-handlers-to-after.patch b/package/kernel/mac80211/patches/345-mac80211-Move-reorder-sensitive-TX-handlers-to-after.patch
deleted file mode 100644
index aba1ff4532..0000000000
--- a/package/kernel/mac80211/patches/345-mac80211-Move-reorder-sensitive-TX-handlers-to-after.patch
+++ /dev/null
@@ -1,478 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sun, 4 Sep 2016 17:46:24 +0200
-Subject: [PATCH] mac80211: fix sequence number assignment for PS response
- frames
-
-When using intermediate queues, sequence number allocation is deferred
-until dequeue. This doesn't work for PS response frames, which bypass
-those queues.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -38,6 +38,12 @@
- #include "wme.h"
- #include "rate.h"
- 
-+static int invoke_tx_handlers_late(struct ieee80211_tx_data *tx);
-+static bool ieee80211_xmit_fast_finish(struct ieee80211_sub_if_data *sdata,
-+				       struct sta_info *sta, u8 pn_offs,
-+				       struct ieee80211_key_conf *key_conf,
-+				       struct sk_buff *skb);
-+
- /* misc utils */
- 
- static inline void ieee80211_tx_stats(struct net_device *dev, u32 len)
-@@ -849,8 +855,7 @@ ieee80211_tx_h_sequence(struct ieee80211
- 	tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
- 	tx->sta->tx_stats.msdu[tid]++;
- 
--	if (!tx->sta->sta.txq[0])
--		hdr->seq_ctrl = ieee80211_tx_next_seq(tx->sta, tid);
-+	hdr->seq_ctrl = ieee80211_tx_next_seq(tx->sta, tid);
- 
- 	return TX_CONTINUE;
- }
-@@ -1398,6 +1403,7 @@ void ieee80211_txq_init(struct ieee80211
- 	fq_tin_init(&txqi->tin);
- 	fq_flow_init(&txqi->def_flow);
- 	codel_vars_init(&txqi->def_cvars);
-+	__skb_queue_head_init(&txqi->frags);
- 
- 	txqi->txq.vif = &sdata->vif;
- 
-@@ -1420,6 +1426,7 @@ void ieee80211_txq_purge(struct ieee8021
- 	struct fq_tin *tin = &txqi->tin;
- 
- 	fq_tin_reset(fq, tin, fq_skb_free_func);
-+	ieee80211_purge_tx_queue(&local->hw, &txqi->frags);
- }
- 
- int ieee80211_txq_setup_flows(struct ieee80211_local *local)
-@@ -1476,12 +1483,19 @@ struct sk_buff *ieee80211_tx_dequeue(str
- 	struct sk_buff *skb = NULL;
- 	struct fq *fq = &local->fq;
- 	struct fq_tin *tin = &txqi->tin;
-+	struct ieee80211_tx_info *info;
- 
- 	spin_lock_bh(&fq->lock);
- 
- 	if (test_bit(IEEE80211_TXQ_STOP, &txqi->flags))
- 		goto out;
- 
-+	/* Make sure fragments stay together. */
-+	skb = __skb_dequeue(&txqi->frags);
-+	if (skb)
-+		goto out;
-+
-+begin:
- 	skb = fq_tin_dequeue(fq, tin, fq_tin_dequeue_func);
- 	if (!skb)
- 		goto out;
-@@ -1489,16 +1503,38 @@ struct sk_buff *ieee80211_tx_dequeue(str
- 	ieee80211_set_skb_vif(skb, txqi);
- 
- 	hdr = (struct ieee80211_hdr *)skb->data;
--	if (txq->sta && ieee80211_is_data_qos(hdr->frame_control)) {
-+	info = IEEE80211_SKB_CB(skb);
-+	if (txq->sta && info->control.flags & IEEE80211_TX_CTRL_FAST_XMIT) {
- 		struct sta_info *sta = container_of(txq->sta, struct sta_info,
- 						    sta);
--		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+		u8 pn_offs = 0;
- 
--		hdr->seq_ctrl = ieee80211_tx_next_seq(sta, txq->tid);
--		if (test_bit(IEEE80211_TXQ_AMPDU, &txqi->flags))
--			info->flags |= IEEE80211_TX_CTL_AMPDU;
--		else
--			info->flags &= ~IEEE80211_TX_CTL_AMPDU;
-+		if (info->control.hw_key)
-+			pn_offs = ieee80211_padded_hdrlen(hw, hdr->frame_control);
-+
-+		ieee80211_xmit_fast_finish(sta->sdata, sta, pn_offs,
-+					   info->control.hw_key, skb);
-+	} else {
-+		struct ieee80211_tx_data tx = { };
-+
-+		__skb_queue_head_init(&tx.skbs);
-+		tx.local = local;
-+		tx.skb = skb;
-+		tx.hdrlen = ieee80211_padded_hdrlen(hw, hdr->frame_control);
-+		if (txq->sta) {
-+			tx.sta = container_of(txq->sta, struct sta_info, sta);
-+			tx.sdata = tx.sta->sdata;
-+		} else {
-+			tx.sdata = vif_to_sdata(info->control.vif);
-+		}
-+
-+		if (invoke_tx_handlers_late(&tx))
-+			goto begin;
-+
-+		skb = __skb_dequeue(&tx.skbs);
-+
-+		if (!skb_queue_empty(&tx.skbs))
-+			skb_queue_splice_tail(&tx.skbs, &txqi->frags);
- 	}
- 
- out:
-@@ -1512,6 +1548,47 @@ out:
- }
- EXPORT_SYMBOL(ieee80211_tx_dequeue);
- 
-+static bool ieee80211_queue_skb(struct ieee80211_local *local,
-+				struct ieee80211_sub_if_data *sdata,
-+				struct sta_info *sta,
-+				struct sk_buff *skb)
-+{
-+	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	struct fq *fq = &local->fq;
-+	struct ieee80211_vif *vif;
-+	struct txq_info *txqi;
-+	struct ieee80211_sta *pubsta;
-+
-+	if (!local->ops->wake_tx_queue ||
-+	    sdata->vif.type == NL80211_IFTYPE_MONITOR)
-+		return false;
-+
-+	if (sta && sta->uploaded)
-+		pubsta = &sta->sta;
-+	else
-+		pubsta = NULL;
-+
-+	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-+		sdata = container_of(sdata->bss,
-+				     struct ieee80211_sub_if_data, u.ap);
-+
-+	vif = &sdata->vif;
-+	txqi = ieee80211_get_txq(local, vif, pubsta, skb);
-+
-+	if (!txqi)
-+		return false;
-+
-+	info->control.vif = vif;
-+
-+	spin_lock_bh(&fq->lock);
-+	ieee80211_txq_enqueue(local, txqi, skb);
-+	spin_unlock_bh(&fq->lock);
-+
-+	drv_wake_tx_queue(local, txqi);
-+
-+	return true;
-+}
-+
- static bool ieee80211_tx_frags(struct ieee80211_local *local,
- 			       struct ieee80211_vif *vif,
- 			       struct ieee80211_sta *sta,
-@@ -1519,9 +1596,7 @@ static bool ieee80211_tx_frags(struct ie
- 			       bool txpending)
- {
- 	struct ieee80211_tx_control control = {};
--	struct fq *fq = &local->fq;
- 	struct sk_buff *skb, *tmp;
--	struct txq_info *txqi;
- 	unsigned long flags;
- 
- 	skb_queue_walk_safe(skbs, skb, tmp) {
-@@ -1536,21 +1611,6 @@ static bool ieee80211_tx_frags(struct ie
- 		}
- #endif
- 
--		txqi = ieee80211_get_txq(local, vif, sta, skb);
--		if (txqi) {
--			info->control.vif = vif;
--
--			__skb_unlink(skb, skbs);
--
--			spin_lock_bh(&fq->lock);
--			ieee80211_txq_enqueue(local, txqi, skb);
--			spin_unlock_bh(&fq->lock);
--
--			drv_wake_tx_queue(local, txqi);
--
--			continue;
--		}
--
- 		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
- 		if (local->queue_stop_reasons[q] ||
- 		    (!txpending && !skb_queue_empty(&local->pending[q]))) {
-@@ -1671,10 +1731,13 @@ static bool __ieee80211_tx(struct ieee80
- /*
-  * Invoke TX handlers, return 0 on success and non-zero if the
-  * frame was dropped or queued.
-+ *
-+ * The handlers are split into an early and late part. The latter is everything
-+ * that can be sensitive to reordering, and will be deferred to after packets
-+ * are dequeued from the intermediate queues (when they are enabled).
-  */
--static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
-+static int invoke_tx_handlers_early(struct ieee80211_tx_data *tx)
- {
--	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
- 	ieee80211_tx_result res = TX_DROP;
- 
- #define CALL_TXH(txh) \
-@@ -1688,16 +1751,42 @@ static int invoke_tx_handlers(struct iee
- 	CALL_TXH(ieee80211_tx_h_check_assoc);
- 	CALL_TXH(ieee80211_tx_h_ps_buf);
- 	CALL_TXH(ieee80211_tx_h_check_control_port_protocol);
--	CALL_TXH(ieee80211_tx_h_select_key);
-+
- 	if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
- 		CALL_TXH(ieee80211_tx_h_rate_ctrl);
- 
-+ txh_done:
-+	if (unlikely(res == TX_DROP)) {
-+		I802_DEBUG_INC(tx->local->tx_handlers_drop);
-+		if (tx->skb)
-+			ieee80211_free_txskb(&tx->local->hw, tx->skb);
-+		else
-+			ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
-+		return -1;
-+	} else if (unlikely(res == TX_QUEUED)) {
-+		I802_DEBUG_INC(tx->local->tx_handlers_queued);
-+		return -1;
-+	}
-+
-+	return 0;
-+}
-+
-+/*
-+ * Late handlers can be called while the sta lock is held. Handlers that can
-+ * cause packets to be generated will cause deadlock!
-+ */
-+static int invoke_tx_handlers_late(struct ieee80211_tx_data *tx)
-+{
-+	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
-+	ieee80211_tx_result res = TX_CONTINUE;
-+
- 	if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) {
- 		__skb_queue_tail(&tx->skbs, tx->skb);
- 		tx->skb = NULL;
- 		goto txh_done;
- 	}
- 
-+	CALL_TXH(ieee80211_tx_h_select_key);
- 	CALL_TXH(ieee80211_tx_h_michael_mic_add);
- 	CALL_TXH(ieee80211_tx_h_sequence);
- 	CALL_TXH(ieee80211_tx_h_fragment);
-@@ -1724,6 +1813,15 @@ static int invoke_tx_handlers(struct iee
- 	return 0;
- }
- 
-+static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
-+{
-+	int r = invoke_tx_handlers_early(tx);
-+	if (r)
-+		return r;
-+
-+	return invoke_tx_handlers_late(tx);
-+}
-+
- bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,
- 			      struct ieee80211_vif *vif, struct sk_buff *skb,
- 			      int band, struct ieee80211_sta **sta)
-@@ -1798,7 +1896,13 @@ static bool ieee80211_tx(struct ieee8021
- 		info->hw_queue =
- 			sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
- 
--	if (!invoke_tx_handlers(&tx))
-+	if (invoke_tx_handlers_early(&tx))
-+		return false;
-+
-+	if (ieee80211_queue_skb(local, sdata, tx.sta, tx.skb))
-+		return true;
-+
-+	if (!invoke_tx_handlers_late(&tx))
- 		result = __ieee80211_tx(local, &tx.skbs, led_len,
- 					tx.sta, txpending);
- 
-@@ -3181,7 +3285,7 @@ out:
- }
- 
- static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
--				struct net_device *dev, struct sta_info *sta,
-+				struct sta_info *sta,
- 				struct ieee80211_fast_tx *fast_tx,
- 				struct sk_buff *skb)
- {
-@@ -3192,9 +3296,9 @@ static bool ieee80211_xmit_fast(struct i
- 	struct ethhdr eth;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
--	struct ieee80211_tx_data tx;
--	ieee80211_tx_result r;
- 	struct tid_ampdu_tx *tid_tx = NULL;
-+	ieee80211_tx_result r;
-+	struct ieee80211_tx_data tx;
- 	u8 tid = IEEE80211_NUM_TIDS;
- 
- 	/* control port protocol needs a lot of special handling */
-@@ -3232,8 +3336,6 @@ static bool ieee80211_xmit_fast(struct i
- 			return true;
- 	}
- 
--	ieee80211_tx_stats(dev, skb->len + extra_head);
--
- 	if ((hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) &&
- 	    ieee80211_amsdu_aggregate(sdata, sta, fast_tx, skb))
- 		return true;
-@@ -3262,24 +3364,7 @@ static bool ieee80211_xmit_fast(struct i
- 	info->flags = IEEE80211_TX_CTL_FIRST_FRAGMENT |
- 		      IEEE80211_TX_CTL_DONTFRAG |
- 		      (tid_tx ? IEEE80211_TX_CTL_AMPDU : 0);
--
--	if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
--		*ieee80211_get_qos_ctl(hdr) = tid;
--		if (!sta->sta.txq[0])
--			hdr->seq_ctrl = ieee80211_tx_next_seq(sta, tid);
--	} else {
--		info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
--		hdr->seq_ctrl = cpu_to_le16(sdata->sequence_number);
--		sdata->sequence_number += 0x10;
--	}
--
--	if (skb_shinfo(skb)->gso_size)
--		sta->tx_stats.msdu[tid] +=
--			DIV_ROUND_UP(skb->len, skb_shinfo(skb)->gso_size);
--	else
--		sta->tx_stats.msdu[tid]++;
--
--	info->hw_queue = sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
-+	info->control.flags = IEEE80211_TX_CTRL_FAST_XMIT;
- 
- 	__skb_queue_head_init(&tx.skbs);
- 
-@@ -3305,22 +3390,71 @@ static bool ieee80211_xmit_fast(struct i
- 		}
- 	}
- 
-+	if (ieee80211_queue_skb(local, sdata, sta, skb))
-+		return true;
-+
-+	ieee80211_xmit_fast_finish(sdata, sta, fast_tx->pn_offs,
-+				   &fast_tx->key->conf, skb);
-+
-+	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-+		sdata = container_of(sdata->bss,
-+				     struct ieee80211_sub_if_data, u.ap);
-+
-+	__skb_queue_tail(&tx.skbs, skb);
-+	ieee80211_tx_frags(local, &sdata->vif, &sta->sta, &tx.skbs, false);
-+
-+	return true;
-+}
-+
-+/*
-+ * Can be called while the sta lock is held. Anything that can cause packets to
-+ * be generated will cause deadlock!
-+ */
-+static bool ieee80211_xmit_fast_finish(struct ieee80211_sub_if_data *sdata,
-+				       struct sta_info *sta, u8 pn_offs,
-+				       struct ieee80211_key_conf *key_conf,
-+				       struct sk_buff *skb)
-+{
-+	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	struct ieee80211_hdr *hdr = (void *)skb->data;
-+	u8 tid = IEEE80211_NUM_TIDS;
-+
-+	ieee80211_tx_stats(skb->dev, skb->len);
-+
-+	if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
-+		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
-+		*ieee80211_get_qos_ctl(hdr) = tid;
-+		hdr->seq_ctrl = ieee80211_tx_next_seq(sta, tid);
-+	} else {
-+		info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
-+		hdr->seq_ctrl = cpu_to_le16(sdata->sequence_number);
-+		sdata->sequence_number += 0x10;
-+	}
-+
-+	if (skb_shinfo(skb)->gso_size)
-+		sta->tx_stats.msdu[tid] +=
-+			DIV_ROUND_UP(skb->len, skb_shinfo(skb)->gso_size);
-+	else
-+		sta->tx_stats.msdu[tid]++;
-+
-+	info->hw_queue = sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
-+
- 	/* statistics normally done by ieee80211_tx_h_stats (but that
- 	 * has to consider fragmentation, so is more complex)
- 	 */
- 	sta->tx_stats.bytes[skb_get_queue_mapping(skb)] += skb->len;
- 	sta->tx_stats.packets[skb_get_queue_mapping(skb)]++;
- 
--	if (fast_tx->pn_offs) {
-+	if (pn_offs && (key_conf->flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
- 		u64 pn;
--		u8 *crypto_hdr = skb->data + fast_tx->pn_offs;
-+		u8 *crypto_hdr = skb->data + pn_offs;
- 
--		switch (fast_tx->key->conf.cipher) {
-+		switch (key_conf->cipher) {
- 		case WLAN_CIPHER_SUITE_CCMP:
- 		case WLAN_CIPHER_SUITE_CCMP_256:
- 		case WLAN_CIPHER_SUITE_GCMP:
- 		case WLAN_CIPHER_SUITE_GCMP_256:
--			pn = atomic64_inc_return(&fast_tx->key->conf.tx_pn);
-+			pn = atomic64_inc_return(&key_conf->tx_pn);
- 			crypto_hdr[0] = pn;
- 			crypto_hdr[1] = pn >> 8;
- 			crypto_hdr[4] = pn >> 16;
-@@ -3331,12 +3465,6 @@ static bool ieee80211_xmit_fast(struct i
- 		}
- 	}
- 
--	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
--		sdata = container_of(sdata->bss,
--				     struct ieee80211_sub_if_data, u.ap);
--
--	__skb_queue_tail(&tx.skbs, skb);
--	ieee80211_tx_frags(local, &sdata->vif, &sta->sta, &tx.skbs, false);
- 	return true;
- }
- 
-@@ -3364,7 +3492,7 @@ void __ieee80211_subif_start_xmit(struct
- 		fast_tx = rcu_dereference(sta->fast_tx);
- 
- 		if (fast_tx &&
--		    ieee80211_xmit_fast(sdata, dev, sta, fast_tx, skb))
-+		    ieee80211_xmit_fast(sdata, sta, fast_tx, skb))
- 			goto out;
- 	}
- 
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -715,6 +715,7 @@ enum mac80211_tx_info_flags {
-  *	frame (PS-Poll or uAPSD).
-  * @IEEE80211_TX_CTRL_RATE_INJECT: This frame is injected with rate information
-  * @IEEE80211_TX_CTRL_AMSDU: This frame is an A-MSDU frame
-+ * @IEEE80211_TX_CTRL_FAST_XMIT: This frame is going through the fast_xmit path
-  *
-  * These flags are used in tx_info->control.flags.
-  */
-@@ -723,6 +724,7 @@ enum mac80211_tx_control_flags {
- 	IEEE80211_TX_CTRL_PS_RESPONSE		= BIT(1),
- 	IEEE80211_TX_CTRL_RATE_INJECT		= BIT(2),
- 	IEEE80211_TX_CTRL_AMSDU			= BIT(3),
-+	IEEE80211_TX_CTRL_FAST_XMIT		= BIT(4),
- };
- 
- /*
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -814,11 +814,13 @@ enum txq_info_flags {
-  * @def_flow: used as a fallback flow when a packet destined to @tin hashes to
-  *	a fq_flow which is already owned by a different tin
-  * @def_cvars: codel vars for @def_flow
-+ * @frags: used to keep fragments created after dequeue
-  */
- struct txq_info {
- 	struct fq_tin tin;
- 	struct fq_flow def_flow;
- 	struct codel_vars def_cvars;
-+	struct sk_buff_head frags;
- 	unsigned long flags;
- 
- 	/* keep last! */
diff --git a/package/kernel/mac80211/patches/406-ath_relax_default_regd.patch b/package/kernel/mac80211/patches/406-ath_relax_default_regd.patch
index 6336f1f375..0598fa34f1 100644
--- a/package/kernel/mac80211/patches/406-ath_relax_default_regd.patch
+++ b/package/kernel/mac80211/patches/406-ath_relax_default_regd.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/regd.c
 +++ b/drivers/net/wireless/ath/regd.c
-@@ -114,10 +114,22 @@ static const struct ieee80211_regdomain
+@@ -114,11 +114,24 @@ static const struct ieee80211_regdomain
  	)
  };
  
@@ -16,14 +16,16 @@
 +
  static bool dynamic_country_user_possible(struct ath_regulatory *reg)
  {
- 	if (config_enabled(CPTCFG_ATH_REG_DYNAMIC_USER_CERT_TESTING))
+ 	if (IS_ENABLED(CPTCFG_ATH_REG_DYNAMIC_USER_CERT_TESTING))
  		return true;
+ 
 +	if (is_default_regd(reg))
 +		return true;
- 
++
  	switch (reg->country_code) {
  	case CTRY_UNITED_STATES:
-@@ -202,11 +214,6 @@ static inline bool is_wwr_sku(u16 regd)
+ 	case CTRY_JAPAN1:
+@@ -202,11 +215,6 @@ static inline bool is_wwr_sku(u16 regd)
  		(regd == WORLD));
  }
  
@@ -35,7 +37,7 @@
  bool ath_is_world_regd(struct ath_regulatory *reg)
  {
  	return is_wwr_sku(ath_regd_get_eepromRD(reg));
-@@ -650,6 +657,9 @@ ath_regd_init_wiphy(struct ath_regulator
+@@ -650,6 +658,9 @@ ath_regd_init_wiphy(struct ath_regulator
  	return 0;
  #endif
  
diff --git a/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
index f2f52f93af..f3f5e1d779 100644
--- a/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
+++ b/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -727,6 +727,7 @@ static const struct ieee80211_iface_limi
+@@ -731,6 +731,7 @@ static const struct ieee80211_iface_limi
  				 BIT(NL80211_IFTYPE_AP) },
  	{ .max = 1,	.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
  				 BIT(NL80211_IFTYPE_P2P_GO) },
diff --git a/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch b/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch
index 1825d77b7f..c42bba6b0d 100644
--- a/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch
+++ b/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1030,23 +1030,23 @@ static int __init ath9k_init(void)
+@@ -1034,23 +1034,23 @@ static int __init ath9k_init(void)
  {
  	int error;
  
diff --git a/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch b/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch
index 167eeff2d2..78b22e71a9 100644
--- a/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch
+++ b/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -651,6 +651,7 @@ int ath9k_hw_init(struct ath_hw *ah)
+@@ -647,6 +647,7 @@ int ath9k_hw_init(struct ath_hw *ah)
  
  	/* These are all the AR5008/AR9001/AR9002/AR9003 hardware family of chipsets */
  	switch (ah->hw_version.devid) {
@@ -20,7 +20,7 @@
  #define AR9160_DEVID_PCI	0x0027
 --- a/drivers/net/wireless/ath/ath9k/pci.c
 +++ b/drivers/net/wireless/ath/ath9k/pci.c
-@@ -761,6 +761,7 @@ static const struct pci_device_id ath_pc
+@@ -760,6 +760,7 @@ static const struct pci_device_id ath_pc
  	  .driver_data = ATH9K_PCI_BT_ANT_DIV },
  #endif
  
diff --git a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
index aba065ee8e..6e4962b09d 100644
--- a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
+++ b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
@@ -1,6 +1,6 @@
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -2410,6 +2410,7 @@ struct cfg80211_qos_map {
+@@ -2562,6 +2562,7 @@ struct cfg80211_nan_func {
   *	(as advertised by the nl80211 feature flag.)
   * @get_tx_power: store the current TX power into the dbm variable;
   *	return 0 if successful
@@ -8,7 +8,7 @@
   *
   * @set_wds_peer: set the WDS peer for a WDS interface
   *
-@@ -2671,6 +2672,7 @@ struct cfg80211_ops {
+@@ -2836,6 +2837,7 @@ struct cfg80211_ops {
  				enum nl80211_tx_power_setting type, int mbm);
  	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
  				int *dbm);
@@ -36,9 +36,9 @@
  	u8 ps_dtim_period;
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -1829,6 +1829,9 @@ enum nl80211_commands {
-  *	%NL80211_ATTR_EXT_CAPA_MASK, to specify the extended capabilities per
-  *	interface type.
+@@ -1937,6 +1937,9 @@ enum nl80211_commands {
+  * @NL80211_ATTR_NAN_MATCH: used to report a match. This is a nested attribute.
+  *	See &enum nl80211_nan_match_attributes.
   *
 + * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
 + *	transmit power to stay within regulatory limits. u32, dBi.
@@ -46,9 +46,9 @@
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
   * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -2213,6 +2216,8 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_IFTYPE_EXT_CAPA,
+@@ -2336,6 +2339,8 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_NAN_FUNC,
+ 	NL80211_ATTR_NAN_MATCH,
  
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
 +
@@ -57,7 +57,7 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2238,6 +2238,19 @@ static int ieee80211_get_tx_power(struct
+@@ -2406,6 +2406,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -77,7 +77,7 @@
  static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
  				  const u8 *addr)
  {
-@@ -3412,6 +3425,7 @@ const struct cfg80211_ops mac80211_confi
+@@ -3633,6 +3646,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
@@ -87,7 +87,7 @@
  	CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1340,6 +1340,7 @@ struct ieee80211_local {
+@@ -1363,6 +1363,7 @@ struct ieee80211_local {
  	int dynamic_ps_forced_timeout;
  
  	int user_power_level; /* in dBm, for all interfaces */
@@ -129,15 +129,15 @@
  	local->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -407,6 +407,7 @@ static const struct nla_policy nl80211_p
- 	[NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
- 	[NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
- 	[NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
+@@ -416,6 +416,7 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
+ 	[NL80211_ATTR_NAN_DUAL] = { .type = NLA_U8 },
+ 	[NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 +	[NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
  };
  
  /* policy for the key attributes */
-@@ -2294,6 +2295,20 @@ static int nl80211_set_wiphy(struct sk_b
+@@ -2353,6 +2354,20 @@ static int nl80211_set_wiphy(struct sk_b
  		if (result)
  			return result;
  	}
diff --git a/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch b/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
index 69147f6bba..46f1dea15b 100644
--- a/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
+++ b/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
@@ -38,16 +38,7 @@
  #ifdef CPTCFG_ATH9K_DEBUGFS
 --- a/drivers/net/wireless/ath/ath9k/gpio.c
 +++ b/drivers/net/wireless/ath/ath9k/gpio.c
-@@ -22,7 +22,7 @@
- 
- #ifdef CPTCFG_MAC80211_LEDS
- 
--void ath_fill_led_pin(struct ath_softc *sc)
-+static void ath_fill_led_pin(struct ath_softc *sc)
- {
- 	struct ath_hw *ah = sc->sc_ah;
- 
-@@ -39,61 +39,111 @@ void ath_fill_led_pin(struct ath_softc *
+@@ -39,61 +39,111 @@ static void ath_fill_led_pin(struct ath_
  		else
  			ah->led_pin = ATH_LED_PIN_DEF;
  	}
@@ -190,7 +181,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -942,7 +942,7 @@ int ath9k_init_device(u16 devid, struct
+@@ -946,7 +946,7 @@ int ath9k_init_device(u16 devid, struct
  
  #ifdef CPTCFG_MAC80211_LEDS
  	/* must be initialized before ieee80211_register_hw */
diff --git a/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch b/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch
index f656697a07..35d8e8bd42 100644
--- a/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch
+++ b/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch
@@ -1,6 +1,6 @@
 --- a/include/linux/ath9k_platform.h
 +++ b/include/linux/ath9k_platform.h
-@@ -45,6 +45,9 @@ struct ath9k_platform_data {
+@@ -46,6 +46,9 @@ struct ath9k_platform_data {
  	int (*external_reset)(void);
  
  	bool use_eeprom;
diff --git a/package/kernel/mac80211/patches/532-ath9k_get_led_polarity_from_platform_data.patch b/package/kernel/mac80211/patches/532-ath9k_get_led_polarity_from_platform_data.patch
deleted file mode 100644
index 50d8a7abae..0000000000
--- a/package/kernel/mac80211/patches/532-ath9k_get_led_polarity_from_platform_data.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- a/include/linux/ath9k_platform.h
-+++ b/include/linux/ath9k_platform.h
-@@ -40,6 +40,7 @@ struct ath9k_platform_data {
- 	bool tx_gain_buffalo;
- 	bool disable_2ghz;
- 	bool disable_5ghz;
-+	bool led_active_high;
- 
- 	int (*get_mac_revision)(void);
- 	int (*external_reset)(void);
---- a/drivers/net/wireless/ath/ath9k/init.c
-+++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -580,6 +580,7 @@ static int ath9k_init_softc(u16 devid, s
- 		ah->external_reset = pdata->external_reset;
- 		ah->disable_2ghz = pdata->disable_2ghz;
- 		ah->disable_5ghz = pdata->disable_5ghz;
-+		ah->config.led_active_high = pdata->led_active_high;
- 		if (!pdata->endian_check)
- 			ah->ah_flags |= AH_NO_EEP_SWAP;
- 	}
diff --git a/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch b/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
index 6edef09754..a820e16c88 100644
--- a/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
+++ b/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
@@ -94,7 +94,7 @@
  struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1841,6 +1841,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
+@@ -1837,6 +1837,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
  }
  EXPORT_SYMBOL(ath9k_hw_get_tsf_offset);
  
@@ -115,7 +115,7 @@
  int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
  		   struct ath9k_hw_cal_data *caldata, bool fastcc)
  {
-@@ -2049,6 +2063,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2045,6 +2059,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		ar9003_hw_disable_phy_restart(ah);
  
  	ath9k_hw_apply_gpio_override(ah);
diff --git a/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch b/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
index 656ed439b9..a5977b7413 100644
--- a/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
+++ b/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
@@ -18,7 +18,7 @@
  	void (*spectral_scan_trigger)(struct ath_hw *ah);
 --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-@@ -1945,6 +1945,26 @@ void ar9003_hw_init_rate_txpower(struct
+@@ -1947,6 +1947,26 @@ void ar9003_hw_init_rate_txpower(struct
  	}
  }
  
@@ -45,7 +45,7 @@
  void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
  {
  	struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
-@@ -1981,6 +2001,7 @@ void ar9003_hw_attach_phy_ops(struct ath
+@@ -1983,6 +2003,7 @@ void ar9003_hw_attach_phy_ops(struct ath
  	priv_ops->set_radar_params = ar9003_hw_set_radar_params;
  	priv_ops->fast_chan_change = ar9003_hw_fast_chan_change;
  
@@ -55,7 +55,7 @@
  	ops->spectral_scan_config = ar9003_hw_spectral_scan_config;
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -716,7 +716,8 @@ static void ath9k_init_txpower_limits(st
+@@ -719,7 +719,8 @@ static void ath9k_init_txpower_limits(st
  	if (ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
  		ath9k_init_band_txpower(sc, NL80211_BAND_5GHZ);
  
@@ -65,7 +65,7 @@
  }
  
  static const struct ieee80211_iface_limit if_limits[] = {
-@@ -903,6 +904,18 @@ static void ath9k_set_hw_capab(struct at
+@@ -906,6 +907,18 @@ static void ath9k_set_hw_capab(struct at
  	SET_IEEE80211_PERM_ADDR(hw, common->macaddr);
  }
  
@@ -84,7 +84,7 @@
  int ath9k_init_device(u16 devid, struct ath_softc *sc,
  		    const struct ath_bus_ops *bus_ops)
  {
-@@ -948,6 +961,8 @@ int ath9k_init_device(u16 devid, struct
+@@ -951,6 +964,8 @@ int ath9k_init_device(u16 devid, struct
  		ARRAY_SIZE(ath9k_tpt_blink));
  #endif
  
@@ -110,7 +110,7 @@
  static inline void ath9k_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-@@ -1325,9 +1325,30 @@ void ar5008_hw_init_rate_txpower(struct
+@@ -1322,9 +1322,30 @@ void ar5008_hw_init_rate_txpower(struct
  	}
  }
  
@@ -141,7 +141,7 @@
  	static const u32 ar5416_cca_regs[6] = {
  		AR_PHY_CCA,
  		AR_PHY_CH1_CCA,
-@@ -1342,6 +1363,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
+@@ -1339,6 +1360,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
  	if (ret)
  	    return ret;
  
diff --git a/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch b/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
index b9c962e1b5..bb4c121af8 100644
--- a/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
+++ b/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
@@ -20,7 +20,7 @@
  /******************/
  /* Chip Revisions */
  /******************/
-@@ -1417,6 +1430,9 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1413,6 +1426,9 @@ static bool ath9k_hw_set_reset(struct at
  		udelay(50);
  	}
  
@@ -30,7 +30,7 @@
  	return true;
  }
  
-@@ -1516,6 +1532,9 @@ static bool ath9k_hw_chip_reset(struct a
+@@ -1512,6 +1528,9 @@ static bool ath9k_hw_chip_reset(struct a
  		ar9003_hw_internal_regulator_apply(ah);
  	ath9k_hw_init_pll(ah, chan);
  
@@ -40,7 +40,7 @@
  	return true;
  }
  
-@@ -1819,8 +1838,14 @@ static int ath9k_hw_do_fastcc(struct ath
+@@ -1815,8 +1834,14 @@ static int ath9k_hw_do_fastcc(struct ath
  	if (AR_SREV_9271(ah))
  		ar9002_hw_load_ani_reg(ah, chan);
  
@@ -55,7 +55,7 @@
  	return -EINVAL;
  }
  
-@@ -2074,6 +2099,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2070,6 +2095,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		ath9k_hw_set_radar_params(ah);
  	}
  
diff --git a/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch b/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
index b639f972d8..22a2308a0b 100644
--- a/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
+++ b/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-@@ -954,55 +954,6 @@ static bool ar5008_hw_ani_control_new(st
+@@ -951,55 +951,6 @@ static bool ar5008_hw_ani_control_new(st
  		 * on == 0 means more noise imm
  		 */
  		u32 on = param ? 1 : 0;
diff --git a/package/kernel/mac80211/patches/650-0001-rtl8xxxu-Add-bit-definitions-for-REG_USB_SPECIAL_OPT.patch b/package/kernel/mac80211/patches/650-0001-rtl8xxxu-Add-bit-definitions-for-REG_USB_SPECIAL_OPT.patch
deleted file mode 100644
index 0a0caecbfd..0000000000
--- a/package/kernel/mac80211/patches/650-0001-rtl8xxxu-Add-bit-definitions-for-REG_USB_SPECIAL_OPT.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From e4ac0a8ac8ba3cbcafcc3c6142c022245439d057 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Thu, 9 Jun 2016 14:38:47 -0400
-Subject: [PATCH] rtl8xxxu: Add bit definitions for REG_USB_SPECIAL_OPTION
-
-Documentation for enabling USB aggregation and whether to select
-interrupt or bulk delivery of interrupt events.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h | 4 ++++
- 1 file changed, 4 insertions(+)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h
-@@ -1052,6 +1052,10 @@
- #define  USB_HIMR_ROK			BIT(0)	/*  Receive DMA OK Interrupt */
- 
- #define REG_USB_SPECIAL_OPTION		0xfe55
-+#define  USB_SPEC_USB_AGG_ENABLE	BIT(3)	/* Enable USB aggregation */
-+#define  USB_SPEC_INT_BULK_SELECT	BIT(4)	/* Use interrupt endpoint to
-+						   deliver interrupt packet.
-+						   0: Use int, 1: use bulk */
- #define REG_USB_HRPWM			0xfe58
- #define REG_USB_DMA_AGG_TO		0xfe5b
- #define REG_USB_AGG_TO			0xfe5c
diff --git a/package/kernel/mac80211/patches/657-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch b/package/kernel/mac80211/patches/650-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch
similarity index 100%
rename from package/kernel/mac80211/patches/657-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch
rename to package/kernel/mac80211/patches/650-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch
diff --git a/package/kernel/mac80211/patches/650-0002-rtl8xxxu-Add-additional-documentation-for-RX-DMA-reg.patch b/package/kernel/mac80211/patches/650-0002-rtl8xxxu-Add-additional-documentation-for-RX-DMA-reg.patch
deleted file mode 100644
index aa9334a38b..0000000000
--- a/package/kernel/mac80211/patches/650-0002-rtl8xxxu-Add-additional-documentation-for-RX-DMA-reg.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 08eca32ebc891e9501802522dc4bff5136edde86 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Thu, 9 Jun 2016 14:38:48 -0400
-Subject: [PATCH] rtl8xxxu: Add additional documentation for RX DMA registers
-
-This also renames REG_USB_AGG_{TO,TH} to REG_USB_AGG_{TIMEOUT,THRESH}
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h
-@@ -405,7 +405,11 @@
- #define REG_DWBCN1_CTRL_8723B		0x0228
- 
- /* 0x0280 ~ 0x02FF	RXDMA Configuration */
--#define REG_RXDMA_AGG_PG_TH		0x0280
-+#define REG_RXDMA_AGG_PG_TH		0x0280	/* 0-7 : USB DMA size bits
-+						   8-14: USB DMA timeout
-+						   15  : Aggregation enable
-+						         Only seems to be used
-+							 on 8723bu/8192eu */
- #define  RXDMA_USB_AGG_ENABLE		BIT(31)
- #define REG_RXPKT_NUM			0x0284
- #define  RXPKT_NUM_RXDMA_IDLE		BIT(17)
-@@ -1058,8 +1062,8 @@
- 						   0: Use int, 1: use bulk */
- #define REG_USB_HRPWM			0xfe58
- #define REG_USB_DMA_AGG_TO		0xfe5b
--#define REG_USB_AGG_TO			0xfe5c
--#define REG_USB_AGG_TH			0xfe5d
-+#define REG_USB_AGG_TIMEOUT		0xfe5c
-+#define REG_USB_AGG_THRESH		0xfe5d
- 
- #define REG_NORMAL_SIE_VID		0xfe60	/* 0xfe60 - 0xfe61 */
- #define REG_NORMAL_SIE_PID		0xfe62	/* 0xfe62 - 0xfe63 */
diff --git a/package/kernel/mac80211/patches/657-0002-rtl8xxxu-Fix-big-endian-problem-reporting-mactime.patch b/package/kernel/mac80211/patches/650-0002-rtl8xxxu-Fix-big-endian-problem-reporting-mactime.patch
similarity index 100%
rename from package/kernel/mac80211/patches/657-0002-rtl8xxxu-Fix-big-endian-problem-reporting-mactime.patch
rename to package/kernel/mac80211/patches/650-0002-rtl8xxxu-Fix-big-endian-problem-reporting-mactime.patch
diff --git a/package/kernel/mac80211/patches/650-0003-rtl8xxxu-tuse-ph-to-dump-buffers.patch b/package/kernel/mac80211/patches/650-0003-rtl8xxxu-tuse-ph-to-dump-buffers.patch
deleted file mode 100644
index ee0e0d6756..0000000000
--- a/package/kernel/mac80211/patches/650-0003-rtl8xxxu-tuse-ph-to-dump-buffers.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 2b9c9f52dc03b298c845def62ea890a2d77e9f21 Mon Sep 17 00:00:00 2001
-From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Date: Thu, 9 Jun 2016 14:38:49 -0400
-Subject: [PATCH] rtl8xxxu: tuse %*ph to dump buffers
-
-Use %*ph specifier to dump small buffers in hex format instead of doing this
-byte-by-byte.
-
-Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192c.c | 9 ++-------
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 9 ++-------
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c | 9 ++-------
- 3 files changed, 6 insertions(+), 21 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192c.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192c.c
-@@ -413,13 +413,8 @@ static int rtl8192cu_parse_efuse(struct
- 		dev_info(&priv->udev->dev,
- 			 "%s: dumping efuse (0x%02zx bytes):\n",
- 			 __func__, sizeof(struct rtl8192cu_efuse));
--		for (i = 0; i < sizeof(struct rtl8192cu_efuse); i += 8) {
--			dev_info(&priv->udev->dev, "%02x: "
--				 "%02x %02x %02x %02x %02x %02x %02x %02x\n", i,
--				 raw[i], raw[i + 1], raw[i + 2],
--				 raw[i + 3], raw[i + 4], raw[i + 5],
--				 raw[i + 6], raw[i + 7]);
--		}
-+		for (i = 0; i < sizeof(struct rtl8192cu_efuse); i += 8)
-+			dev_info(&priv->udev->dev, "%02x: %8ph\n", i, &raw[i]);
- 	}
- 	return 0;
- }
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
-@@ -622,13 +622,8 @@ static int rtl8192eu_parse_efuse(struct
- 		dev_info(&priv->udev->dev,
- 			 "%s: dumping efuse (0x%02zx bytes):\n",
- 			 __func__, sizeof(struct rtl8192eu_efuse));
--		for (i = 0; i < sizeof(struct rtl8192eu_efuse); i += 8) {
--			dev_info(&priv->udev->dev, "%02x: "
--				 "%02x %02x %02x %02x %02x %02x %02x %02x\n", i,
--				 raw[i], raw[i + 1], raw[i + 2],
--				 raw[i + 3], raw[i + 4], raw[i + 5],
--				 raw[i + 6], raw[i + 7]);
--		}
-+		for (i = 0; i < sizeof(struct rtl8192eu_efuse); i += 8)
-+			dev_info(&priv->udev->dev, "%02x: %8ph\n", i, &raw[i]);
- 	}
- 	return 0;
- }
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
-@@ -466,13 +466,8 @@ static int rtl8723bu_parse_efuse(struct
- 		dev_info(&priv->udev->dev,
- 			 "%s: dumping efuse (0x%02zx bytes):\n",
- 			 __func__, sizeof(struct rtl8723bu_efuse));
--		for (i = 0; i < sizeof(struct rtl8723bu_efuse); i += 8) {
--			dev_info(&priv->udev->dev, "%02x: "
--				 "%02x %02x %02x %02x %02x %02x %02x %02x\n", i,
--				 raw[i], raw[i + 1], raw[i + 2],
--				 raw[i + 3], raw[i + 4], raw[i + 5],
--				 raw[i + 6], raw[i + 7]);
--		}
-+		for (i = 0; i < sizeof(struct rtl8723bu_efuse); i += 8)
-+			dev_info(&priv->udev->dev, "%02x: %8ph\n", i, &raw[i]);
- 	}
- 
- 	return 0;
diff --git a/package/kernel/mac80211/patches/658-0001-rtl8xxxu-Fix-rtl8723bu-driver-reload-issue.patch b/package/kernel/mac80211/patches/651-0001-rtl8xxxu-Fix-rtl8723bu-driver-reload-issue.patch
similarity index 100%
rename from package/kernel/mac80211/patches/658-0001-rtl8xxxu-Fix-rtl8723bu-driver-reload-issue.patch
rename to package/kernel/mac80211/patches/651-0001-rtl8xxxu-Fix-rtl8723bu-driver-reload-issue.patch
diff --git a/package/kernel/mac80211/patches/651-0001-rtl8xxxu-remove-unneeded-assignments.patch b/package/kernel/mac80211/patches/651-0001-rtl8xxxu-remove-unneeded-assignments.patch
deleted file mode 100644
index 05324f0de9..0000000000
--- a/package/kernel/mac80211/patches/651-0001-rtl8xxxu-remove-unneeded-assignments.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From efcb32883f365cb458a5cb376132965eacaf5571 Mon Sep 17 00:00:00 2001
-From: Luis de Bethencourt <luisbg@osg.samsung.com>
-Date: Thu, 23 Jun 2016 14:35:52 -0400
-Subject: [PATCH] rtl8xxxu: remove unneeded assignments
-
-reg_eac and reg_ecc are only used if candidate is bigger than 0, and in
-that case new values will be given to them. Removing the unused
-assignments.
-
-Signed-off-by: Luis de Bethencourt <luisbg@osg.samsung.com>
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 2 --
- 1 file changed, 2 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
-@@ -1244,11 +1244,9 @@ static void rtl8192eu_phy_iq_calibrate(s
- 		reg_e94 = result[i][0];
- 		reg_e9c = result[i][1];
- 		reg_ea4 = result[i][2];
--		reg_eac = result[i][3];
- 		reg_eb4 = result[i][4];
- 		reg_ebc = result[i][5];
- 		reg_ec4 = result[i][6];
--		reg_ecc = result[i][7];
- 	}
- 
- 	if (candidate >= 0) {
diff --git a/package/kernel/mac80211/patches/658-0002-rtl8xxxu-Fix-rtl8192eu-driver-reload-issue.patch b/package/kernel/mac80211/patches/651-0002-rtl8xxxu-Fix-rtl8192eu-driver-reload-issue.patch
similarity index 100%
rename from package/kernel/mac80211/patches/658-0002-rtl8xxxu-Fix-rtl8192eu-driver-reload-issue.patch
rename to package/kernel/mac80211/patches/651-0002-rtl8xxxu-Fix-rtl8192eu-driver-reload-issue.patch
diff --git a/package/kernel/mac80211/patches/651-0002-rtl8xxxu-Reduce-console-noise-when-removing-the-kern.patch b/package/kernel/mac80211/patches/651-0002-rtl8xxxu-Reduce-console-noise-when-removing-the-kern.patch
deleted file mode 100644
index e8b3848375..0000000000
--- a/package/kernel/mac80211/patches/651-0002-rtl8xxxu-Reduce-console-noise-when-removing-the-kern.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 78383ac951816a64657ca3e17868ad8c7c1b9393 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Thu, 23 Jun 2016 14:35:53 -0400
-Subject: [PATCH] rtl8xxxu: Reduce console noise when removing the kernel
- module
-
-USB urbs will return with a status != 0 when rmmod'ing the driver. No
-need to fill the log with messages from rtl8xxxu_int_complete()
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -5267,7 +5267,7 @@ static void rtl8xxxu_int_complete(struct
- 		if (ret)
- 			usb_unanchor_urb(urb);
- 	} else {
--		dev_info(dev, "%s: Error %i\n", __func__, urb->status);
-+		dev_dbg(dev, "%s: Error %i\n", __func__, urb->status);
- 	}
- }
- 
diff --git a/package/kernel/mac80211/patches/659-0001-rtl8xxxu-Obtain-RTS-rates-from-mac80211.patch b/package/kernel/mac80211/patches/652-0001-rtl8xxxu-Obtain-RTS-rates-from-mac80211.patch
similarity index 100%
rename from package/kernel/mac80211/patches/659-0001-rtl8xxxu-Obtain-RTS-rates-from-mac80211.patch
rename to package/kernel/mac80211/patches/652-0001-rtl8xxxu-Obtain-RTS-rates-from-mac80211.patch
diff --git a/package/kernel/mac80211/patches/652-0001-rtl8xxxu-Set-all-ieee80211_rx_status-values-in-parse.patch b/package/kernel/mac80211/patches/652-0001-rtl8xxxu-Set-all-ieee80211_rx_status-values-in-parse.patch
deleted file mode 100644
index ccbd11097d..0000000000
--- a/package/kernel/mac80211/patches/652-0001-rtl8xxxu-Set-all-ieee80211_rx_status-values-in-parse.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From c14ee43b8ae2fe0777335daaf278b86a9f6691a1 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Mon, 27 Jun 2016 12:31:59 -0400
-Subject: [PATCH] rtl8xxxu: Set all ieee80211_rx_status values in
- parse_rx_desc()
-
-This needs to be handled locally in the parse_rx_desc() function in
-order to be able to handle aggregated packets in the future.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 17 ++++++++++++-----
- 1 file changed, 12 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -5048,6 +5048,7 @@ static void rtl8xxxu_rx_urb_work(struct
- int rtl8xxxu_parse_rxdesc16(struct rtl8xxxu_priv *priv, struct sk_buff *skb,
- 			    struct ieee80211_rx_status *rx_status)
- {
-+	struct ieee80211_hw *hw = priv->hw;
- 	struct rtl8xxxu_rxdesc16 *rx_desc =
- 		(struct rtl8xxxu_rxdesc16 *)skb->data;
- 	struct rtl8723au_phy_stats *phy_stats;
-@@ -5059,6 +5060,8 @@ int rtl8xxxu_parse_rxdesc16(struct rtl8x
- 	for (i = 0; i < (sizeof(struct rtl8xxxu_rxdesc16) / sizeof(u32)); i++)
- 		_rx_desc[i] = le32_to_cpu(_rx_desc_le[i]);
- 
-+	memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
-+
- 	skb_pull(skb, sizeof(struct rtl8xxxu_rxdesc16));
- 
- 	phy_stats = (struct rtl8723au_phy_stats *)skb->data;
-@@ -5088,12 +5091,16 @@ int rtl8xxxu_parse_rxdesc16(struct rtl8x
- 		rx_status->rate_idx = rx_desc->rxmcs;
- 	}
- 
-+	rx_status->freq = hw->conf.chandef.chan->center_freq;
-+	rx_status->band = hw->conf.chandef.chan->band;
-+
- 	return RX_TYPE_DATA_PKT;
- }
- 
- int rtl8xxxu_parse_rxdesc24(struct rtl8xxxu_priv *priv, struct sk_buff *skb,
- 			    struct ieee80211_rx_status *rx_status)
- {
-+	struct ieee80211_hw *hw = priv->hw;
- 	struct rtl8xxxu_rxdesc24 *rx_desc =
- 		(struct rtl8xxxu_rxdesc24 *)skb->data;
- 	struct rtl8723au_phy_stats *phy_stats;
-@@ -5105,6 +5112,8 @@ int rtl8xxxu_parse_rxdesc24(struct rtl8x
- 	for (i = 0; i < (sizeof(struct rtl8xxxu_rxdesc24) / sizeof(u32)); i++)
- 		_rx_desc[i] = le32_to_cpu(_rx_desc_le[i]);
- 
-+	memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
-+
- 	skb_pull(skb, sizeof(struct rtl8xxxu_rxdesc24));
- 
- 	phy_stats = (struct rtl8723au_phy_stats *)skb->data;
-@@ -5140,6 +5149,9 @@ int rtl8xxxu_parse_rxdesc24(struct rtl8x
- 		rx_status->rate_idx = rx_desc->rxmcs;
- 	}
- 
-+	rx_status->freq = hw->conf.chandef.chan->center_freq;
-+	rx_status->band = hw->conf.chandef.chan->band;
-+
- 	return RX_TYPE_DATA_PKT;
- }
- 
-@@ -5202,13 +5214,8 @@ static void rtl8xxxu_rx_complete(struct
- 	skb_put(skb, urb->actual_length);
- 
- 	if (urb->status == 0) {
--		memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
--
- 		rx_type = priv->fops->parse_rx_desc(priv, skb, rx_status);
- 
--		rx_status->freq = hw->conf.chandef.chan->center_freq;
--		rx_status->band = hw->conf.chandef.chan->band;
--
- 		if (rx_type == RX_TYPE_DATA_PKT)
- 			ieee80211_rx_irqsafe(hw, skb);
- 		else {
diff --git a/package/kernel/mac80211/patches/652-0002-rtl8xxxu-Move-skb-delivery-into-parse_tx_desc-handle.patch b/package/kernel/mac80211/patches/652-0002-rtl8xxxu-Move-skb-delivery-into-parse_tx_desc-handle.patch
deleted file mode 100644
index e61ba5bc5a..0000000000
--- a/package/kernel/mac80211/patches/652-0002-rtl8xxxu-Move-skb-delivery-into-parse_tx_desc-handle.patch
+++ /dev/null
@@ -1,165 +0,0 @@
-From a635df8a41ace30d15cb6fa22a04ba5b4c364cff Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Mon, 27 Jun 2016 12:32:00 -0400
-Subject: [PATCH] rtl8xxxu: Move skb delivery into parse_tx_desc() handler
-
-This is another prepatory patch to be able to handle aggregated RX
-packets.
-
-In order to avoid adding a prototype, this also moves the
-rtl8723bu_handle_c2h() function.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c  | 104 ++++++++++-----------
- 1 file changed, 50 insertions(+), 54 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -5045,6 +5045,51 @@ static void rtl8xxxu_rx_urb_work(struct
- 	}
- }
- 
-+static void rtl8723bu_handle_c2h(struct rtl8xxxu_priv *priv,
-+				 struct sk_buff *skb)
-+{
-+	struct rtl8723bu_c2h *c2h = (struct rtl8723bu_c2h *)skb->data;
-+	struct device *dev = &priv->udev->dev;
-+	int len;
-+
-+	len = skb->len - 2;
-+
-+	dev_dbg(dev, "C2H ID %02x seq %02x, len %02x source %02x\n",
-+		c2h->id, c2h->seq, len, c2h->bt_info.response_source);
-+
-+	switch(c2h->id) {
-+	case C2H_8723B_BT_INFO:
-+		if (c2h->bt_info.response_source >
-+		    BT_INFO_SRC_8723B_BT_ACTIVE_SEND)
-+			dev_dbg(dev, "C2H_BT_INFO WiFi only firmware\n");
-+		else
-+			dev_dbg(dev, "C2H_BT_INFO BT/WiFi coexist firmware\n");
-+
-+		if (c2h->bt_info.bt_has_reset)
-+			dev_dbg(dev, "BT has been reset\n");
-+		if (c2h->bt_info.tx_rx_mask)
-+			dev_dbg(dev, "BT TRx mask\n");
-+
-+		break;
-+	case C2H_8723B_BT_MP_INFO:
-+		dev_dbg(dev, "C2H_MP_INFO ext ID %02x, status %02x\n",
-+			c2h->bt_mp_info.ext_id, c2h->bt_mp_info.status);
-+		break;
-+	case C2H_8723B_RA_REPORT:
-+		dev_dbg(dev,
-+			"C2H RA RPT: rate %02x, unk %i, macid %02x, noise %i\n",
-+			c2h->ra_report.rate, c2h->ra_report.dummy0_0,
-+			c2h->ra_report.macid, c2h->ra_report.noisy_state);
-+		break;
-+	default:
-+		dev_info(dev, "Unhandled C2H event %02x seq %02x\n",
-+			 c2h->id, c2h->seq);
-+		print_hex_dump(KERN_INFO, "C2H content: ", DUMP_PREFIX_NONE,
-+			       16, 1, c2h->raw.payload, len, false);
-+		break;
-+	}
-+}
-+
- int rtl8xxxu_parse_rxdesc16(struct rtl8xxxu_priv *priv, struct sk_buff *skb,
- 			    struct ieee80211_rx_status *rx_status)
- {
-@@ -5094,6 +5139,7 @@ int rtl8xxxu_parse_rxdesc16(struct rtl8x
- 	rx_status->freq = hw->conf.chandef.chan->center_freq;
- 	rx_status->band = hw->conf.chandef.chan->band;
- 
-+	ieee80211_rx_irqsafe(hw, skb);
- 	return RX_TYPE_DATA_PKT;
- }
- 
-@@ -5125,6 +5171,8 @@ int rtl8xxxu_parse_rxdesc24(struct rtl8x
- 	if (rx_desc->rpt_sel) {
- 		struct device *dev = &priv->udev->dev;
- 		dev_dbg(dev, "%s: C2H packet\n", __func__);
-+		rtl8723bu_handle_c2h(priv, skb);
-+		dev_kfree_skb(skb);
- 		return RX_TYPE_C2H;
- 	}
- 
-@@ -5152,54 +5200,10 @@ int rtl8xxxu_parse_rxdesc24(struct rtl8x
- 	rx_status->freq = hw->conf.chandef.chan->center_freq;
- 	rx_status->band = hw->conf.chandef.chan->band;
- 
-+	ieee80211_rx_irqsafe(hw, skb);
- 	return RX_TYPE_DATA_PKT;
- }
- 
--static void rtl8723bu_handle_c2h(struct rtl8xxxu_priv *priv,
--				 struct sk_buff *skb)
--{
--	struct rtl8723bu_c2h *c2h = (struct rtl8723bu_c2h *)skb->data;
--	struct device *dev = &priv->udev->dev;
--	int len;
--
--	len = skb->len - 2;
--
--	dev_dbg(dev, "C2H ID %02x seq %02x, len %02x source %02x\n",
--		c2h->id, c2h->seq, len, c2h->bt_info.response_source);
--
--	switch(c2h->id) {
--	case C2H_8723B_BT_INFO:
--		if (c2h->bt_info.response_source >
--		    BT_INFO_SRC_8723B_BT_ACTIVE_SEND)
--			dev_dbg(dev, "C2H_BT_INFO WiFi only firmware\n");
--		else
--			dev_dbg(dev, "C2H_BT_INFO BT/WiFi coexist firmware\n");
--
--		if (c2h->bt_info.bt_has_reset)
--			dev_dbg(dev, "BT has been reset\n");
--		if (c2h->bt_info.tx_rx_mask)
--			dev_dbg(dev, "BT TRx mask\n");
--
--		break;
--	case C2H_8723B_BT_MP_INFO:
--		dev_dbg(dev, "C2H_MP_INFO ext ID %02x, status %02x\n",
--			c2h->bt_mp_info.ext_id, c2h->bt_mp_info.status);
--		break;
--	case C2H_8723B_RA_REPORT:
--		dev_dbg(dev,
--			"C2H RA RPT: rate %02x, unk %i, macid %02x, noise %i\n",
--			c2h->ra_report.rate, c2h->ra_report.dummy0_0,
--			c2h->ra_report.macid, c2h->ra_report.noisy_state);
--		break;
--	default:
--		dev_info(dev, "Unhandled C2H event %02x seq %02x\n",
--			 c2h->id, c2h->seq);
--		print_hex_dump(KERN_INFO, "C2H content: ", DUMP_PREFIX_NONE,
--			       16, 1, c2h->raw.payload, len, false);
--		break;
--	}
--}
--
- static void rtl8xxxu_rx_complete(struct urb *urb)
- {
- 	struct rtl8xxxu_rx_urb *rx_urb =
-@@ -5209,19 +5213,11 @@ static void rtl8xxxu_rx_complete(struct
- 	struct sk_buff *skb = (struct sk_buff *)urb->context;
- 	struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
- 	struct device *dev = &priv->udev->dev;
--	int rx_type;
- 
- 	skb_put(skb, urb->actual_length);
- 
- 	if (urb->status == 0) {
--		rx_type = priv->fops->parse_rx_desc(priv, skb, rx_status);
--
--		if (rx_type == RX_TYPE_DATA_PKT)
--			ieee80211_rx_irqsafe(hw, skb);
--		else {
--			rtl8723bu_handle_c2h(priv, skb);
--			dev_kfree_skb(skb);
--		}
-+		priv->fops->parse_rx_desc(priv, skb, rx_status);
- 
- 		skb = NULL;
- 		rx_urb->urb.context = NULL;
diff --git a/package/kernel/mac80211/patches/659-0002-rtl8xxxu-Pass-tx_info-to-fill_txdesc-in-order-to-hav.patch b/package/kernel/mac80211/patches/652-0002-rtl8xxxu-Pass-tx_info-to-fill_txdesc-in-order-to-hav.patch
similarity index 100%
rename from package/kernel/mac80211/patches/659-0002-rtl8xxxu-Pass-tx_info-to-fill_txdesc-in-order-to-hav.patch
rename to package/kernel/mac80211/patches/652-0002-rtl8xxxu-Pass-tx_info-to-fill_txdesc-in-order-to-hav.patch
diff --git a/package/kernel/mac80211/patches/652-0003-rtl8xxxu-Obtain-ieee80211_rx_status-within-parse_rx_.patch b/package/kernel/mac80211/patches/652-0003-rtl8xxxu-Obtain-ieee80211_rx_status-within-parse_rx_.patch
deleted file mode 100644
index 62f4679c44..0000000000
--- a/package/kernel/mac80211/patches/652-0003-rtl8xxxu-Obtain-ieee80211_rx_status-within-parse_rx_.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 2db125d4af4c503564b66c615488e6e7a4583b86 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Mon, 27 Jun 2016 12:32:01 -0400
-Subject: [PATCH] rtl8xxxu: Obtain ieee80211_rx_status within parse_rx_desc()
-
-When handling aggregated packets, we'll get a new ieee80211_rx_status
-for each cloned skb, so passing in the pointer from the outside
-doesn't make sense.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h      |  9 +++------
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 11 +++++------
- 2 files changed, 8 insertions(+), 12 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-@@ -1315,8 +1315,7 @@ struct rtl8xxxu_fileops {
- 	void (*phy_init_antenna_selection) (struct rtl8xxxu_priv *priv);
- 	void (*phy_iq_calibrate) (struct rtl8xxxu_priv *priv);
- 	void (*config_channel) (struct ieee80211_hw *hw);
--	int (*parse_rx_desc) (struct rtl8xxxu_priv *priv, struct sk_buff *skb,
--			      struct ieee80211_rx_status *rx_status);
-+	int (*parse_rx_desc) (struct rtl8xxxu_priv *priv, struct sk_buff *skb);
- 	void (*init_aggregation) (struct rtl8xxxu_priv *priv);
- 	void (*init_statistics) (struct rtl8xxxu_priv *priv);
- 	void (*enable_rf) (struct rtl8xxxu_priv *priv);
-@@ -1412,10 +1411,8 @@ void rtl8xxxu_gen2_report_connect(struct
- void rtl8xxxu_gen1_enable_rf(struct rtl8xxxu_priv *priv);
- void rtl8xxxu_gen1_disable_rf(struct rtl8xxxu_priv *priv);
- void rtl8xxxu_gen2_disable_rf(struct rtl8xxxu_priv *priv);
--int rtl8xxxu_parse_rxdesc16(struct rtl8xxxu_priv *priv, struct sk_buff *skb,
--			    struct ieee80211_rx_status *rx_status);
--int rtl8xxxu_parse_rxdesc24(struct rtl8xxxu_priv *priv, struct sk_buff *skb,
--			    struct ieee80211_rx_status *rx_status);
-+int rtl8xxxu_parse_rxdesc16(struct rtl8xxxu_priv *priv, struct sk_buff *skb);
-+int rtl8xxxu_parse_rxdesc24(struct rtl8xxxu_priv *priv, struct sk_buff *skb);
- int rtl8xxxu_gen2_channel_to_group(int channel);
- bool rtl8xxxu_gen2_simularity_compare(struct rtl8xxxu_priv *priv,
- 				      int result[][8], int c1, int c2);
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -5090,10 +5090,10 @@ static void rtl8723bu_handle_c2h(struct
- 	}
- }
- 
--int rtl8xxxu_parse_rxdesc16(struct rtl8xxxu_priv *priv, struct sk_buff *skb,
--			    struct ieee80211_rx_status *rx_status)
-+int rtl8xxxu_parse_rxdesc16(struct rtl8xxxu_priv *priv, struct sk_buff *skb)
- {
- 	struct ieee80211_hw *hw = priv->hw;
-+	struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
- 	struct rtl8xxxu_rxdesc16 *rx_desc =
- 		(struct rtl8xxxu_rxdesc16 *)skb->data;
- 	struct rtl8723au_phy_stats *phy_stats;
-@@ -5143,10 +5143,10 @@ int rtl8xxxu_parse_rxdesc16(struct rtl8x
- 	return RX_TYPE_DATA_PKT;
- }
- 
--int rtl8xxxu_parse_rxdesc24(struct rtl8xxxu_priv *priv, struct sk_buff *skb,
--			    struct ieee80211_rx_status *rx_status)
-+int rtl8xxxu_parse_rxdesc24(struct rtl8xxxu_priv *priv, struct sk_buff *skb)
- {
- 	struct ieee80211_hw *hw = priv->hw;
-+	struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
- 	struct rtl8xxxu_rxdesc24 *rx_desc =
- 		(struct rtl8xxxu_rxdesc24 *)skb->data;
- 	struct rtl8723au_phy_stats *phy_stats;
-@@ -5211,13 +5211,12 @@ static void rtl8xxxu_rx_complete(struct
- 	struct ieee80211_hw *hw = rx_urb->hw;
- 	struct rtl8xxxu_priv *priv = hw->priv;
- 	struct sk_buff *skb = (struct sk_buff *)urb->context;
--	struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
- 	struct device *dev = &priv->udev->dev;
- 
- 	skb_put(skb, urb->actual_length);
- 
- 	if (urb->status == 0) {
--		priv->fops->parse_rx_desc(priv, skb, rx_status);
-+		priv->fops->parse_rx_desc(priv, skb);
- 
- 		skb = NULL;
- 		rx_urb->urb.context = NULL;
diff --git a/package/kernel/mac80211/patches/652-0004-rtl8xxxu-Correct-rxdesc16-definition.patch b/package/kernel/mac80211/patches/652-0004-rtl8xxxu-Correct-rxdesc16-definition.patch
deleted file mode 100644
index ea953290a7..0000000000
--- a/package/kernel/mac80211/patches/652-0004-rtl8xxxu-Correct-rxdesc16-definition.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 41892729cf60a600fb14ed924f0d18440e2dfac9 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Mon, 27 Jun 2016 12:32:02 -0400
-Subject: [PATCH] rtl8xxxu: Correct rxdesc16 definition
-
-This corrects the definition of rxdesc16 to correctly specify pkt_cnt
-for aggregated packets. This is based on the code of the vendor
-rtl8723au driver, as opposed to the struct definitions they use.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-@@ -135,7 +135,8 @@ struct rtl8xxxu_rxdesc16 {
- 
- 	u32 seq:12;
- 	u32 frag:4;
--	u32 nextpktlen:14;
-+	u32 pkt_cnt:8;
-+	u32 reserved:6;
- 	u32 nextind:1;
- 	u32 reserved0:1;
- 
-@@ -198,7 +199,8 @@ struct rtl8xxxu_rxdesc16 {
- 
- 	u32 reserved0:1;
- 	u32 nextind:1;
--	u32 nextpktlen:14;
-+	u32 reserved:6;
-+	u32 pkt_cnt:8;
- 	u32 frag:4;
- 	u32 seq:12;
- 
diff --git a/package/kernel/mac80211/patches/652-0005-rtl8xxxu-Add-support-for-aggregated-RX-packets-on-ge.patch b/package/kernel/mac80211/patches/652-0005-rtl8xxxu-Add-support-for-aggregated-RX-packets-on-ge.patch
deleted file mode 100644
index 199d158b87..0000000000
--- a/package/kernel/mac80211/patches/652-0005-rtl8xxxu-Add-support-for-aggregated-RX-packets-on-ge.patch
+++ /dev/null
@@ -1,141 +0,0 @@
-From 040b97be60567b819b97442d30533884bd266874 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Mon, 27 Jun 2016 12:32:03 -0400
-Subject: [PATCH] rtl8xxxu: Add support for aggregated RX packets on gen1 parts
-
-This implements support for demuxing aggregated RX packets on gen1
-devices, using the rxdesc16 format.
-
-So far this has only been tested with rtl8723au devices.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c  | 103 ++++++++++++++-------
- 1 file changed, 69 insertions(+), 34 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -5093,53 +5093,88 @@ static void rtl8723bu_handle_c2h(struct
- int rtl8xxxu_parse_rxdesc16(struct rtl8xxxu_priv *priv, struct sk_buff *skb)
- {
- 	struct ieee80211_hw *hw = priv->hw;
--	struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
--	struct rtl8xxxu_rxdesc16 *rx_desc =
--		(struct rtl8xxxu_rxdesc16 *)skb->data;
-+	struct ieee80211_rx_status *rx_status;
-+	struct rtl8xxxu_rxdesc16 *rx_desc;
- 	struct rtl8723au_phy_stats *phy_stats;
--	__le32 *_rx_desc_le = (__le32 *)skb->data;
--	u32 *_rx_desc = (u32 *)skb->data;
-+	struct sk_buff *next_skb = NULL;
-+	__le32 *_rx_desc_le;
-+	u32 *_rx_desc;
- 	int drvinfo_sz, desc_shift;
--	int i;
-+	int i, pkt_cnt, pkt_len, urb_len, pkt_offset;
- 
--	for (i = 0; i < (sizeof(struct rtl8xxxu_rxdesc16) / sizeof(u32)); i++)
--		_rx_desc[i] = le32_to_cpu(_rx_desc_le[i]);
-+	urb_len = skb->len;
-+	pkt_cnt = 0;
- 
--	memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
-+	do {
-+		rx_desc = (struct rtl8xxxu_rxdesc16 *)skb->data;
-+		_rx_desc_le = (__le32 *)skb->data;
-+		_rx_desc = (u32 *)skb->data;
- 
--	skb_pull(skb, sizeof(struct rtl8xxxu_rxdesc16));
-+		for (i = 0;
-+		     i < (sizeof(struct rtl8xxxu_rxdesc16) / sizeof(u32)); i++)
-+			_rx_desc[i] = le32_to_cpu(_rx_desc_le[i]);
- 
--	phy_stats = (struct rtl8723au_phy_stats *)skb->data;
-+		/*
-+		 * Only read pkt_cnt from the header if we're parsing the
-+		 * first packet
-+		 */
-+		if (!pkt_cnt)
-+			pkt_cnt = rx_desc->pkt_cnt;
-+		pkt_len = rx_desc->pktlen;
- 
--	drvinfo_sz = rx_desc->drvinfo_sz * 8;
--	desc_shift = rx_desc->shift;
--	skb_pull(skb, drvinfo_sz + desc_shift);
-+		drvinfo_sz = rx_desc->drvinfo_sz * 8;
-+		desc_shift = rx_desc->shift;
-+		pkt_offset = roundup(pkt_len + drvinfo_sz + desc_shift +
-+				     sizeof(struct rtl8xxxu_rxdesc16), 128);
- 
--	if (rx_desc->phy_stats)
--		rtl8xxxu_rx_parse_phystats(priv, rx_status, phy_stats,
--					   rx_desc->rxmcs);
-+		if (pkt_cnt > 1)
-+			next_skb = skb_clone(skb, GFP_ATOMIC);
- 
--	rx_status->mactime = le32_to_cpu(rx_desc->tsfl);
--	rx_status->flag |= RX_FLAG_MACTIME_START;
-+		rx_status = IEEE80211_SKB_RXCB(skb);
-+		memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
- 
--	if (!rx_desc->swdec)
--		rx_status->flag |= RX_FLAG_DECRYPTED;
--	if (rx_desc->crc32)
--		rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
--	if (rx_desc->bw)
--		rx_status->flag |= RX_FLAG_40MHZ;
-+		skb_pull(skb, sizeof(struct rtl8xxxu_rxdesc16));
- 
--	if (rx_desc->rxht) {
--		rx_status->flag |= RX_FLAG_HT;
--		rx_status->rate_idx = rx_desc->rxmcs - DESC_RATE_MCS0;
--	} else {
--		rx_status->rate_idx = rx_desc->rxmcs;
--	}
-+		phy_stats = (struct rtl8723au_phy_stats *)skb->data;
- 
--	rx_status->freq = hw->conf.chandef.chan->center_freq;
--	rx_status->band = hw->conf.chandef.chan->band;
-+		skb_pull(skb, drvinfo_sz + desc_shift);
-+
-+		skb_trim(skb, pkt_len);
-+
-+		if (rx_desc->phy_stats)
-+			rtl8xxxu_rx_parse_phystats(priv, rx_status, phy_stats,
-+						   rx_desc->rxmcs);
-+
-+		rx_status->mactime = le32_to_cpu(rx_desc->tsfl);
-+		rx_status->flag |= RX_FLAG_MACTIME_START;
-+
-+		if (!rx_desc->swdec)
-+			rx_status->flag |= RX_FLAG_DECRYPTED;
-+		if (rx_desc->crc32)
-+			rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
-+		if (rx_desc->bw)
-+			rx_status->flag |= RX_FLAG_40MHZ;
-+
-+		if (rx_desc->rxht) {
-+			rx_status->flag |= RX_FLAG_HT;
-+			rx_status->rate_idx = rx_desc->rxmcs - DESC_RATE_MCS0;
-+		} else {
-+			rx_status->rate_idx = rx_desc->rxmcs;
-+		}
-+
-+		rx_status->freq = hw->conf.chandef.chan->center_freq;
-+		rx_status->band = hw->conf.chandef.chan->band;
-+
-+		ieee80211_rx_irqsafe(hw, skb);
-+
-+		skb = next_skb;
-+		if (skb)
-+			skb_pull(next_skb, pkt_offset);
-+
-+		pkt_cnt--;
-+		urb_len -= pkt_offset;
-+	} while (skb && urb_len > 0 && pkt_cnt > 0);
- 
--	ieee80211_rx_irqsafe(hw, skb);
- 	return RX_TYPE_DATA_PKT;
- }
- 
diff --git a/package/kernel/mac80211/patches/652-0006-rtl8xxxu-Allocate-larger-RX-skbs-when-aggregation-is.patch b/package/kernel/mac80211/patches/652-0006-rtl8xxxu-Allocate-larger-RX-skbs-when-aggregation-is.patch
deleted file mode 100644
index 1355826bfb..0000000000
--- a/package/kernel/mac80211/patches/652-0006-rtl8xxxu-Allocate-larger-RX-skbs-when-aggregation-is.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 04319ae2f60974fa218f16fdf7a8576d1db6d673 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Mon, 27 Jun 2016 12:32:04 -0400
-Subject: [PATCH] rtl8xxxu: Allocate larger RX skbs when aggregation is enabled
-
-This adds support for allocating larger skbs for devices which
-indicate they support it.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h      |  2 ++
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 13 +++++++++----
- 2 files changed, 11 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-@@ -1247,6 +1247,7 @@ struct rtl8xxxu_priv {
- 	u32 ep_tx_normal_queue:1;
- 	u32 ep_tx_low_queue:1;
- 	u32 has_xtalk:1;
-+	u32 rx_buf_aggregation:1;
- 	u8 xtalk;
- 	unsigned int pipe_interrupt;
- 	unsigned int pipe_in;
-@@ -1330,6 +1331,7 @@ struct rtl8xxxu_fileops {
- 	void (*report_connect) (struct rtl8xxxu_priv *priv,
- 				u8 macid, bool connect);
- 	int writeN_block_size;
-+	int rx_agg_buf_size;
- 	char tx_desc_size;
- 	char rx_desc_size;
- 	char has_s0s1;
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -64,8 +64,6 @@ module_param_named(ht40_2g, rtl8xxxu_ht4
- MODULE_PARM_DESC(ht40_2g, "Enable HT40 support on the 2.4GHz band");
- 
- #define USB_VENDOR_ID_REALTEK		0x0bda
--/* Minimum IEEE80211_MAX_FRAME_LEN */
--#define RTL_RX_BUFFER_SIZE		IEEE80211_MAX_FRAME_LEN
- #define RTL8XXXU_RX_URBS		32
- #define RTL8XXXU_RX_URB_PENDING_WATER	8
- #define RTL8XXXU_TX_URBS		64
-@@ -5271,12 +5269,19 @@ cleanup:
- static int rtl8xxxu_submit_rx_urb(struct rtl8xxxu_priv *priv,
- 				  struct rtl8xxxu_rx_urb *rx_urb)
- {
-+	struct rtl8xxxu_fileops *fops = priv->fops;
- 	struct sk_buff *skb;
- 	int skb_size;
- 	int ret, rx_desc_sz;
- 
--	rx_desc_sz = priv->fops->rx_desc_size;
--	skb_size = rx_desc_sz + RTL_RX_BUFFER_SIZE;
-+	rx_desc_sz = fops->rx_desc_size;
-+
-+	if (priv->rx_buf_aggregation && fops->rx_agg_buf_size)
-+		skb_size = fops->rx_agg_buf_size;
-+	else
-+		skb_size = IEEE80211_MAX_FRAME_LEN;
-+	skb_size += rx_desc_sz;
-+
- 	skb = __netdev_alloc_skb(NULL, skb_size, GFP_KERNEL);
- 	if (!skb)
- 		return -ENOMEM;
diff --git a/package/kernel/mac80211/patches/652-0007-rtl8xxxu-Adjust-RX-skb-size-to-include-space-for-phy.patch b/package/kernel/mac80211/patches/652-0007-rtl8xxxu-Adjust-RX-skb-size-to-include-space-for-phy.patch
deleted file mode 100644
index 58fa1d7bc4..0000000000
--- a/package/kernel/mac80211/patches/652-0007-rtl8xxxu-Adjust-RX-skb-size-to-include-space-for-phy.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 1e5b3b3fe9e00a3afe3092dbe1a3fc1e9079bf35 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Mon, 27 Jun 2016 12:32:05 -0400
-Subject: [PATCH] rtl8xxxu: Adjust RX skb size to include space for phystats
-
-The old allocation didn't leave space for phystats in the buffer,
-allowing the packet to be rejected if a frame size of size
-IEEE80211_MAX_FRAME_LEN was received.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -5276,11 +5276,12 @@ static int rtl8xxxu_submit_rx_urb(struct
- 
- 	rx_desc_sz = fops->rx_desc_size;
- 
--	if (priv->rx_buf_aggregation && fops->rx_agg_buf_size)
-+	if (priv->rx_buf_aggregation && fops->rx_agg_buf_size) {
- 		skb_size = fops->rx_agg_buf_size;
--	else
-+		skb_size += (rx_desc_sz + sizeof(struct rtl8723au_phy_stats));
-+	} else {
- 		skb_size = IEEE80211_MAX_FRAME_LEN;
--	skb_size += rx_desc_sz;
-+	}
- 
- 	skb = __netdev_alloc_skb(NULL, skb_size, GFP_KERNEL);
- 	if (!skb)
diff --git a/package/kernel/mac80211/patches/652-0008-rtl8xxxu-Enable-aggregation-for-rtl8723au.patch b/package/kernel/mac80211/patches/652-0008-rtl8xxxu-Enable-aggregation-for-rtl8723au.patch
deleted file mode 100644
index bf2075819f..0000000000
--- a/package/kernel/mac80211/patches/652-0008-rtl8xxxu-Enable-aggregation-for-rtl8723au.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From 91dcbb7175317da7caafc3b05b002addd42cdabd Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Mon, 27 Jun 2016 12:32:06 -0400
-Subject: [PATCH] rtl8xxxu: Enable aggregation for rtl8723au
-
-Implement rtl8xxxu_gen1_init_aggregation(). Aggregation should be the
-same for all gen1 parts. We may want to allow for tuning parameters in
-the fileopes struct. For now this is based allocating 16KB RX buffers,
-leaving 16000 bytes for actual packets, and the rest for the skb
-overhead.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h   |  1 +
- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723a.c |  2 ++
- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c  | 34 ++++++++++++++++++++++
- 3 files changed, 37 insertions(+)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-@@ -1412,6 +1412,7 @@ void rtl8xxxu_gen1_report_connect(struct
- 				  u8 macid, bool connect);
- void rtl8xxxu_gen2_report_connect(struct rtl8xxxu_priv *priv,
- 				  u8 macid, bool connect);
-+void rtl8xxxu_gen1_init_aggregation(struct rtl8xxxu_priv *priv);
- void rtl8xxxu_gen1_enable_rf(struct rtl8xxxu_priv *priv);
- void rtl8xxxu_gen1_disable_rf(struct rtl8xxxu_priv *priv);
- void rtl8xxxu_gen2_disable_rf(struct rtl8xxxu_priv *priv);
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723a.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723a.c
-@@ -377,6 +377,7 @@ struct rtl8xxxu_fileops rtl8723au_fops =
- 	.phy_iq_calibrate = rtl8xxxu_gen1_phy_iq_calibrate,
- 	.config_channel = rtl8xxxu_gen1_config_channel,
- 	.parse_rx_desc = rtl8xxxu_parse_rxdesc16,
-+	.init_aggregation = rtl8xxxu_gen1_init_aggregation,
- 	.enable_rf = rtl8xxxu_gen1_enable_rf,
- 	.disable_rf = rtl8xxxu_gen1_disable_rf,
- 	.usb_quirks = rtl8xxxu_gen1_usb_quirks,
-@@ -384,6 +385,7 @@ struct rtl8xxxu_fileops rtl8723au_fops =
- 	.update_rate_mask = rtl8xxxu_update_rate_mask,
- 	.report_connect = rtl8xxxu_gen1_report_connect,
- 	.writeN_block_size = 1024,
-+	.rx_agg_buf_size = 16000,
- 	.tx_desc_size = sizeof(struct rtl8xxxu_txdesc32),
- 	.rx_desc_size = sizeof(struct rtl8xxxu_rxdesc16),
- 	.adda_1t_init = 0x0b1b25a0,
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -4405,6 +4405,40 @@ void rtl8xxxu_gen2_report_connect(struct
- 	rtl8xxxu_gen2_h2c_cmd(priv, &h2c, sizeof(h2c.media_status_rpt));
- }
- 
-+void rtl8xxxu_gen1_init_aggregation(struct rtl8xxxu_priv *priv)
-+{
-+	u8 agg_ctrl, usb_spec, page_thresh;
-+
-+	usb_spec = rtl8xxxu_read8(priv, REG_USB_SPECIAL_OPTION);
-+	usb_spec &= ~USB_SPEC_USB_AGG_ENABLE;
-+
-+	agg_ctrl = rtl8xxxu_read8(priv, REG_TRXDMA_CTRL);
-+	agg_ctrl &= ~TRXDMA_CTRL_RXDMA_AGG_EN;
-+
-+	agg_ctrl |= TRXDMA_CTRL_RXDMA_AGG_EN;
-+
-+	rtl8xxxu_write8(priv, REG_TRXDMA_CTRL, agg_ctrl);
-+	rtl8xxxu_write8(priv, REG_USB_SPECIAL_OPTION, usb_spec);
-+
-+	/*
-+	 * The number of packets we can take looks to be buffer size / 512
-+	 * which matches the 512 byte rounding we have to do when de-muxing
-+	 * the packets.
-+	 *
-+	 * Sample numbers from the vendor driver:
-+	 * USB High-Speed mode values:
-+	 *   RxAggBlockCount = 8 : 512 byte unit
-+	 *   RxAggBlockTimeout = 6
-+	 *   RxAggPageCount = 48 : 128 byte unit
-+	 *   RxAggPageTimeout = 4 or 6 (absolute time 34ms/(2^6))
-+	 */
-+
-+	page_thresh = (priv->fops->rx_agg_buf_size / 512);
-+	rtl8xxxu_write8(priv, REG_RXDMA_AGG_PG_TH, page_thresh);
-+	rtl8xxxu_write8(priv, REG_USB_DMA_AGG_TO, 4);
-+	priv->rx_buf_aggregation = 1;
-+}
-+
- static void rtl8xxxu_set_basic_rates(struct rtl8xxxu_priv *priv, u32 rate_cfg)
- {
- 	u32 val32;
diff --git a/package/kernel/mac80211/patches/652-0009-rtl8xxxu-Enable-aggregation-for-rtl8192cu-rtl8188cu-.patch b/package/kernel/mac80211/patches/652-0009-rtl8xxxu-Enable-aggregation-for-rtl8192cu-rtl8188cu-.patch
deleted file mode 100644
index e1074fe61f..0000000000
--- a/package/kernel/mac80211/patches/652-0009-rtl8xxxu-Enable-aggregation-for-rtl8192cu-rtl8188cu-.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 0a20ed8bd057c05ed138d8d39ac496d874c3ccb6 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Mon, 27 Jun 2016 12:32:07 -0400
-Subject: [PATCH] rtl8xxxu: Enable aggregation for
- rtl8192cu/rtl8188cu/rtl8188ru
-
-This enables aggregation on rtl8192cu and derivative parts. This uses
-the same parameters as for rtl8723au.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192c.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192c.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192c.c
-@@ -560,6 +560,7 @@ struct rtl8xxxu_fileops rtl8192cu_fops =
- 	.phy_iq_calibrate = rtl8xxxu_gen1_phy_iq_calibrate,
- 	.config_channel = rtl8xxxu_gen1_config_channel,
- 	.parse_rx_desc = rtl8xxxu_parse_rxdesc16,
-+	.init_aggregation = rtl8xxxu_gen1_init_aggregation,
- 	.enable_rf = rtl8xxxu_gen1_enable_rf,
- 	.disable_rf = rtl8xxxu_gen1_disable_rf,
- 	.usb_quirks = rtl8xxxu_gen1_usb_quirks,
-@@ -567,6 +568,7 @@ struct rtl8xxxu_fileops rtl8192cu_fops =
- 	.update_rate_mask = rtl8xxxu_update_rate_mask,
- 	.report_connect = rtl8xxxu_gen1_report_connect,
- 	.writeN_block_size = 128,
-+	.rx_agg_buf_size = 16000,
- 	.tx_desc_size = sizeof(struct rtl8xxxu_txdesc32),
- 	.rx_desc_size = sizeof(struct rtl8xxxu_rxdesc16),
- 	.adda_1t_init = 0x0b1b25a0,
diff --git a/package/kernel/mac80211/patches/652-0010-rtl8xxxu-Make-DMA-aggregation-optional-by-setting-a-.patch b/package/kernel/mac80211/patches/652-0010-rtl8xxxu-Make-DMA-aggregation-optional-by-setting-a-.patch
deleted file mode 100644
index 27a8522f2a..0000000000
--- a/package/kernel/mac80211/patches/652-0010-rtl8xxxu-Make-DMA-aggregation-optional-by-setting-a-.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 82cce22acd8ec7c75087825f23c053a642e7b672 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Mon, 27 Jun 2016 12:32:08 -0400
-Subject: [PATCH] rtl8xxxu: Make DMA aggregation optional by setting a module
- parameter
-
-Let the default to off until we have more data on the right default
-tuning values.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -44,6 +44,7 @@
- 
- int rtl8xxxu_debug = RTL8XXXU_DEBUG_EFUSE;
- static bool rtl8xxxu_ht40_2g;
-+static bool rtl8xxxu_dma_aggregation;
- 
- MODULE_AUTHOR("Jes Sorensen <Jes.Sorensen@redhat.com>");
- MODULE_DESCRIPTION("RTL8XXXu USB mac80211 Wireless LAN Driver");
-@@ -62,6 +63,8 @@ module_param_named(debug, rtl8xxxu_debug
- MODULE_PARM_DESC(debug, "Set debug mask");
- module_param_named(ht40_2g, rtl8xxxu_ht40_2g, bool, 0600);
- MODULE_PARM_DESC(ht40_2g, "Enable HT40 support on the 2.4GHz band");
-+module_param_named(dma_aggregation, rtl8xxxu_dma_aggregation, bool, 0600);
-+MODULE_PARM_DESC(dma_aggregation, "Enable DMA packet aggregation");
- 
- #define USB_VENDOR_ID_REALTEK		0x0bda
- #define RTL8XXXU_RX_URBS		32
-@@ -4411,14 +4414,18 @@ void rtl8xxxu_gen1_init_aggregation(stru
- 
- 	usb_spec = rtl8xxxu_read8(priv, REG_USB_SPECIAL_OPTION);
- 	usb_spec &= ~USB_SPEC_USB_AGG_ENABLE;
-+	rtl8xxxu_write8(priv, REG_USB_SPECIAL_OPTION, usb_spec);
- 
- 	agg_ctrl = rtl8xxxu_read8(priv, REG_TRXDMA_CTRL);
- 	agg_ctrl &= ~TRXDMA_CTRL_RXDMA_AGG_EN;
- 
--	agg_ctrl |= TRXDMA_CTRL_RXDMA_AGG_EN;
-+	if (!rtl8xxxu_dma_aggregation) {
-+		rtl8xxxu_write8(priv, REG_TRXDMA_CTRL, agg_ctrl);
-+		return;
-+	}
- 
-+	agg_ctrl |= TRXDMA_CTRL_RXDMA_AGG_EN;
- 	rtl8xxxu_write8(priv, REG_TRXDMA_CTRL, agg_ctrl);
--	rtl8xxxu_write8(priv, REG_USB_SPECIAL_OPTION, usb_spec);
- 
- 	/*
- 	 * The number of packets we can take looks to be buffer size / 512
diff --git a/package/kernel/mac80211/patches/652-0011-rtl8xxxu-gen1-Set-aggregation-timeout-REG_RXDMA_AGG_.patch b/package/kernel/mac80211/patches/652-0011-rtl8xxxu-gen1-Set-aggregation-timeout-REG_RXDMA_AGG_.patch
deleted file mode 100644
index f4deb234fe..0000000000
--- a/package/kernel/mac80211/patches/652-0011-rtl8xxxu-gen1-Set-aggregation-timeout-REG_RXDMA_AGG_.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 614e389f36a9d709469a74508d76c5df5141149a Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Mon, 27 Jun 2016 12:32:09 -0400
-Subject: [PATCH] rtl8xxxu: gen1: Set aggregation timeout (REG_RXDMA_AGG_PG_TH
- + 1) as well
-
-gen2 chips as well as 8188eu seems to use this register for setting
-DMA timeout threshold values, however the 8192cu is using
-REG_USB_DMA_AGG_TO. Set both to be on the safe side.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -4410,7 +4410,7 @@ void rtl8xxxu_gen2_report_connect(struct
- 
- void rtl8xxxu_gen1_init_aggregation(struct rtl8xxxu_priv *priv)
- {
--	u8 agg_ctrl, usb_spec, page_thresh;
-+	u8 agg_ctrl, usb_spec, page_thresh, timeout;
- 
- 	usb_spec = rtl8xxxu_read8(priv, REG_USB_SPECIAL_OPTION);
- 	usb_spec &= ~USB_SPEC_USB_AGG_ENABLE;
-@@ -4442,7 +4442,14 @@ void rtl8xxxu_gen1_init_aggregation(stru
- 
- 	page_thresh = (priv->fops->rx_agg_buf_size / 512);
- 	rtl8xxxu_write8(priv, REG_RXDMA_AGG_PG_TH, page_thresh);
--	rtl8xxxu_write8(priv, REG_USB_DMA_AGG_TO, 4);
-+	/*
-+	 * REG_RXDMA_AGG_PG_TH + 1 seems to be the timeout register on
-+	 * gen2 chips and rtl8188eu. The rtl8723au seems unhappy if we
-+	 * don't set it, so better set both.
-+	 */
-+	timeout = 4;
-+	rtl8xxxu_write8(priv, REG_RXDMA_AGG_PG_TH + 1, timeout);
-+	rtl8xxxu_write8(priv, REG_USB_DMA_AGG_TO, timeout);
- 	priv->rx_buf_aggregation = 1;
- }
- 
diff --git a/package/kernel/mac80211/patches/652-0012-rtl8xxxu-gen1-Add-module-parameters-to-adjust-DMA-ag.patch b/package/kernel/mac80211/patches/652-0012-rtl8xxxu-gen1-Add-module-parameters-to-adjust-DMA-ag.patch
deleted file mode 100644
index 90c2a4af27..0000000000
--- a/package/kernel/mac80211/patches/652-0012-rtl8xxxu-gen1-Add-module-parameters-to-adjust-DMA-ag.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From fd83f12278262feccd012b62c30643bd6a6c2888 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Mon, 27 Jun 2016 12:32:10 -0400
-Subject: [PATCH] rtl8xxxu: gen1: Add module parameters to adjust DMA
- aggregation parameters
-
-This allows the user to specify DMA aggregation timout and block
-count. Blocks are presumably always 512 bytes, so the minimum block
-count is 6 for 802.11 packets.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c  | 28 ++++++++++++++++++++++
- 1 file changed, 28 insertions(+)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -45,6 +45,8 @@
- int rtl8xxxu_debug = RTL8XXXU_DEBUG_EFUSE;
- static bool rtl8xxxu_ht40_2g;
- static bool rtl8xxxu_dma_aggregation;
-+static int rtl8xxxu_dma_agg_timeout = -1;
-+static int rtl8xxxu_dma_agg_pages = -1;
- 
- MODULE_AUTHOR("Jes Sorensen <Jes.Sorensen@redhat.com>");
- MODULE_DESCRIPTION("RTL8XXXu USB mac80211 Wireless LAN Driver");
-@@ -65,6 +67,10 @@ module_param_named(ht40_2g, rtl8xxxu_ht4
- MODULE_PARM_DESC(ht40_2g, "Enable HT40 support on the 2.4GHz band");
- module_param_named(dma_aggregation, rtl8xxxu_dma_aggregation, bool, 0600);
- MODULE_PARM_DESC(dma_aggregation, "Enable DMA packet aggregation");
-+module_param_named(dma_agg_timeout, rtl8xxxu_dma_agg_timeout, int, 0600);
-+MODULE_PARM_DESC(dma_agg_timeout, "Set DMA aggregation timeout (range 1-127)");
-+module_param_named(dma_agg_pages, rtl8xxxu_dma_agg_pages, int, 0600);
-+MODULE_PARM_DESC(dma_agg_pages, "Set DMA aggregation pages (range 1-127, 0 to disable)");
- 
- #define USB_VENDOR_ID_REALTEK		0x0bda
- #define RTL8XXXU_RX_URBS		32
-@@ -4441,6 +4447,18 @@ void rtl8xxxu_gen1_init_aggregation(stru
- 	 */
- 
- 	page_thresh = (priv->fops->rx_agg_buf_size / 512);
-+	if (rtl8xxxu_dma_agg_pages >= 0) {
-+		if (rtl8xxxu_dma_agg_pages <= page_thresh)
-+			timeout = page_thresh;
-+		else if (rtl8xxxu_dma_agg_pages <= 6)
-+			dev_err(&priv->udev->dev,
-+				"%s: dma_agg_pages=%i too small, minium is 6\n",
-+				__func__, rtl8xxxu_dma_agg_pages);
-+		else
-+			dev_err(&priv->udev->dev,
-+				"%s: dma_agg_pages=%i larger than limit %i\n",
-+				__func__, rtl8xxxu_dma_agg_pages, page_thresh);
-+	}
- 	rtl8xxxu_write8(priv, REG_RXDMA_AGG_PG_TH, page_thresh);
- 	/*
- 	 * REG_RXDMA_AGG_PG_TH + 1 seems to be the timeout register on
-@@ -4448,6 +4466,16 @@ void rtl8xxxu_gen1_init_aggregation(stru
- 	 * don't set it, so better set both.
- 	 */
- 	timeout = 4;
-+
-+	if (rtl8xxxu_dma_agg_timeout >= 0) {
-+		if (rtl8xxxu_dma_agg_timeout <= 127)
-+			timeout = rtl8xxxu_dma_agg_timeout;
-+		else
-+			dev_err(&priv->udev->dev,
-+				"%s: Invalid dma_agg_timeout: %i\n",
-+				__func__, rtl8xxxu_dma_agg_timeout);
-+	}
-+
- 	rtl8xxxu_write8(priv, REG_RXDMA_AGG_PG_TH + 1, timeout);
- 	rtl8xxxu_write8(priv, REG_USB_DMA_AGG_TO, timeout);
- 	priv->rx_buf_aggregation = 1;
diff --git a/package/kernel/mac80211/patches/660-0001-rtl8xxxu-Accept-firmware-signature-0x88e0.patch b/package/kernel/mac80211/patches/653-0001-rtl8xxxu-Accept-firmware-signature-0x88e0.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0001-rtl8xxxu-Accept-firmware-signature-0x88e0.patch
rename to package/kernel/mac80211/patches/653-0001-rtl8xxxu-Accept-firmware-signature-0x88e0.patch
diff --git a/package/kernel/mac80211/patches/653-0001-rtl8xxxu-Mark-0x20f4-0x648b-as-tested.patch b/package/kernel/mac80211/patches/653-0001-rtl8xxxu-Mark-0x20f4-0x648b-as-tested.patch
deleted file mode 100644
index 6459c6b0a2..0000000000
--- a/package/kernel/mac80211/patches/653-0001-rtl8xxxu-Mark-0x20f4-0x648b-as-tested.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From b81669b9e0b4864f59421e7681512731fae01ab9 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:23 -0400
-Subject: [PATCH] rtl8xxxu: Mark 0x20f4:0x648b as tested
-
-Successfully tested by Jocelyn Mayer
-
-Reported-by: J. Mayer <l_indien@magic.fr>
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 9 +++++++--
- 1 file changed, 7 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -5971,6 +5971,10 @@ static int rtl8xxxu_probe(struct usb_int
- 		if (id->idProduct == 0x1004)
- 			untested = 0;
- 		break;
-+	case 0x20f4:
-+		if (id->idProduct == 0x648b)
-+			untested = 0;
-+		break;
- 	default:
- 		break;
- 	}
-@@ -6140,6 +6144,9 @@ static struct usb_device_id dev_table[]
- /* Tested by Andrea Merello */
- {USB_DEVICE_AND_INTERFACE_INFO(0x050d, 0x1004, 0xff, 0xff, 0xff),
- 	.driver_info = (unsigned long)&rtl8192cu_fops},
-+/* Tested by Jocelyn Mayer */
-+{USB_DEVICE_AND_INTERFACE_INFO(0x20f4, 0x648b, 0xff, 0xff, 0xff),
-+	.driver_info = (unsigned long)&rtl8192cu_fops},
- /* Currently untested 8188 series devices */
- {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_REALTEK, 0x8191, 0xff, 0xff, 0xff),
- 	.driver_info = (unsigned long)&rtl8192cu_fops},
-@@ -6199,8 +6206,6 @@ static struct usb_device_id dev_table[]
- 	.driver_info = (unsigned long)&rtl8192cu_fops},
- {USB_DEVICE_AND_INTERFACE_INFO(0x2019, 0xed17, 0xff, 0xff, 0xff),
- 	.driver_info = (unsigned long)&rtl8192cu_fops},
--{USB_DEVICE_AND_INTERFACE_INFO(0x20f4, 0x648b, 0xff, 0xff, 0xff),
--	.driver_info = (unsigned long)&rtl8192cu_fops},
- {USB_DEVICE_AND_INTERFACE_INFO(0x4855, 0x0090, 0xff, 0xff, 0xff),
- 	.driver_info = (unsigned long)&rtl8192cu_fops},
- {USB_DEVICE_AND_INTERFACE_INFO(0x4856, 0x0091, 0xff, 0xff, 0xff),
diff --git a/package/kernel/mac80211/patches/660-0002-rtl8xxxu-Add-initial-code-to-detect-8188eu-devices.patch b/package/kernel/mac80211/patches/653-0002-rtl8xxxu-Add-initial-code-to-detect-8188eu-devices.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0002-rtl8xxxu-Add-initial-code-to-detect-8188eu-devices.patch
rename to package/kernel/mac80211/patches/653-0002-rtl8xxxu-Add-initial-code-to-detect-8188eu-devices.patch
diff --git a/package/kernel/mac80211/patches/653-0002-rtl8xxxu-Mark-0x2001-0x3308-as-tested.patch b/package/kernel/mac80211/patches/653-0002-rtl8xxxu-Mark-0x2001-0x3308-as-tested.patch
deleted file mode 100644
index 0da8f36a1f..0000000000
--- a/package/kernel/mac80211/patches/653-0002-rtl8xxxu-Mark-0x2001-0x3308-as-tested.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 76a8e07d49b65294ed006ff1e37fa152a1bfd230 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:24 -0400
-Subject: [PATCH] rtl8xxxu: Mark 0x2001:0x3308 as tested
-
-D-Link DWA-121 is reported as working.
-
-Reported-by: Stefano Bravi <stefanobravi69@libero.it>
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 9 +++++++--
- 1 file changed, 7 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -5975,6 +5975,10 @@ static int rtl8xxxu_probe(struct usb_int
- 		if (id->idProduct == 0x648b)
- 			untested = 0;
- 		break;
-+	case 0x2001:
-+		if (id->idProduct == 0x3308)
-+			untested = 0;
-+		break;
- 	default:
- 		break;
- 	}
-@@ -6147,6 +6151,9 @@ static struct usb_device_id dev_table[]
- /* Tested by Jocelyn Mayer */
- {USB_DEVICE_AND_INTERFACE_INFO(0x20f4, 0x648b, 0xff, 0xff, 0xff),
- 	.driver_info = (unsigned long)&rtl8192cu_fops},
-+/* Tested by Stefano Bravi */
-+{USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3308, 0xff, 0xff, 0xff),
-+	.driver_info = (unsigned long)&rtl8192cu_fops},
- /* Currently untested 8188 series devices */
- {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_REALTEK, 0x8191, 0xff, 0xff, 0xff),
- 	.driver_info = (unsigned long)&rtl8192cu_fops},
-@@ -6194,8 +6201,6 @@ static struct usb_device_id dev_table[]
- 	.driver_info = (unsigned long)&rtl8192cu_fops},
- {USB_DEVICE_AND_INTERFACE_INFO(0x13d3, 0x3357, 0xff, 0xff, 0xff),
- 	.driver_info = (unsigned long)&rtl8192cu_fops},
--{USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3308, 0xff, 0xff, 0xff),
--	.driver_info = (unsigned long)&rtl8192cu_fops},
- {USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x330b, 0xff, 0xff, 0xff),
- 	.driver_info = (unsigned long)&rtl8192cu_fops},
- {USB_DEVICE_AND_INTERFACE_INFO(0x2019, 0x4902, 0xff, 0xff, 0xff),
diff --git a/package/kernel/mac80211/patches/660-0003-rtl8xxxu-Add-initial-code-to-parse-8188eu-efuse.patch b/package/kernel/mac80211/patches/653-0003-rtl8xxxu-Add-initial-code-to-parse-8188eu-efuse.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0003-rtl8xxxu-Add-initial-code-to-parse-8188eu-efuse.patch
rename to package/kernel/mac80211/patches/653-0003-rtl8xxxu-Add-initial-code-to-parse-8188eu-efuse.patch
diff --git a/package/kernel/mac80211/patches/653-0003-rtl8xxxu-Fix-error-handling-if-rtl8xxxu_init_device-.patch b/package/kernel/mac80211/patches/653-0003-rtl8xxxu-Fix-error-handling-if-rtl8xxxu_init_device-.patch
deleted file mode 100644
index d19f48f0eb..0000000000
--- a/package/kernel/mac80211/patches/653-0003-rtl8xxxu-Fix-error-handling-if-rtl8xxxu_init_device-.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From deb6176e561324884652dd6a49a862bd8b152959 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:25 -0400
-Subject: [PATCH] rtl8xxxu: Fix error handling if rtl8xxxu_init_device() fails
-
-For some reason we lost the code bailing if rtl8xxxu_init_device()
-returned an error.
-
-This catches the error and also cleans up the error handling.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c    | 20 +++++++++++++++++---
- 1 file changed, 17 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -5947,7 +5947,7 @@ static int rtl8xxxu_probe(struct usb_int
- 	struct ieee80211_hw *hw;
- 	struct usb_device *udev;
- 	struct ieee80211_supported_band *sband;
--	int ret = 0;
-+	int ret;
- 	int untested = 1;
- 
- 	udev = usb_get_dev(interface_to_usbdev(interface));
-@@ -5995,6 +5995,7 @@ static int rtl8xxxu_probe(struct usb_int
- 	hw = ieee80211_alloc_hw(sizeof(struct rtl8xxxu_priv), &rtl8xxxu_ops);
- 	if (!hw) {
- 		ret = -ENOMEM;
-+		priv = NULL;
- 		goto exit;
- 	}
- 
-@@ -6043,6 +6044,8 @@ static int rtl8xxxu_probe(struct usb_int
- 	}
- 
- 	ret = rtl8xxxu_init_device(hw);
-+	if (ret)
-+		goto exit;
- 
- 	hw->wiphy->max_scan_ssids = 1;
- 	hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
-@@ -6093,9 +6096,20 @@ static int rtl8xxxu_probe(struct usb_int
- 		goto exit;
- 	}
- 
-+	return 0;
-+
- exit:
--	if (ret < 0)
--		usb_put_dev(udev);
-+	usb_set_intfdata(interface, NULL);
-+
-+	if (priv) {
-+		kfree(priv->fw_data);
-+		mutex_destroy(&priv->usb_buf_mutex);
-+		mutex_destroy(&priv->h2c_mutex);
-+	}
-+	usb_put_dev(udev);
-+
-+	ieee80211_free_hw(hw);
-+
- 	return ret;
- }
- 
diff --git a/package/kernel/mac80211/patches/653-0004-rtl8xxxu-Add-TP-Link-TL-WN823N-v2-to-list-of-support.patch b/package/kernel/mac80211/patches/653-0004-rtl8xxxu-Add-TP-Link-TL-WN823N-v2-to-list-of-support.patch
deleted file mode 100644
index 8475a82757..0000000000
--- a/package/kernel/mac80211/patches/653-0004-rtl8xxxu-Add-TP-Link-TL-WN823N-v2-to-list-of-support.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 690a6d268bdf85f8d233823a18d3200b99e5568d Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:26 -0400
-Subject: [PATCH] rtl8xxxu: Add TP-Link TL-WN823N v2 to list of supported
- devices
-
-This is an rtl8192eu based dongle (the v1 is an rtl8192cu). Reported
-and tested by Myckel Habets.
-
-Reported-by: Myckel Habets <myckel@sdf.lonestar.org>
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -5979,6 +5979,10 @@ static int rtl8xxxu_probe(struct usb_int
- 		if (id->idProduct == 0x3308)
- 			untested = 0;
- 		break;
-+	case 0x2357:
-+		if (id->idProduct == 0x0109)
-+			untested = 0;
-+		break;
- 	default:
- 		break;
- 	}
-@@ -6146,6 +6150,9 @@ static struct usb_device_id dev_table[]
- 	.driver_info = (unsigned long)&rtl8723au_fops},
- {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_REALTEK, 0x818b, 0xff, 0xff, 0xff),
- 	.driver_info = (unsigned long)&rtl8192eu_fops},
-+/* Tested by Myckel Habets */
-+{USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0109, 0xff, 0xff, 0xff),
-+	.driver_info = (unsigned long)&rtl8192eu_fops},
- {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_REALTEK, 0xb720, 0xff, 0xff, 0xff),
- 	.driver_info = (unsigned long)&rtl8723bu_fops},
- #ifdef CPTCFG_RTL8XXXU_UNTESTED
diff --git a/package/kernel/mac80211/patches/660-0004-rtl8xxxu-Detect-8188eu-parts-correctly.patch b/package/kernel/mac80211/patches/653-0004-rtl8xxxu-Detect-8188eu-parts-correctly.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0004-rtl8xxxu-Detect-8188eu-parts-correctly.patch
rename to package/kernel/mac80211/patches/653-0004-rtl8xxxu-Detect-8188eu-parts-correctly.patch
diff --git a/package/kernel/mac80211/patches/653-0005-rtl8xxxu-Add-TX-page-defines-for-8723b.patch b/package/kernel/mac80211/patches/653-0005-rtl8xxxu-Add-TX-page-defines-for-8723b.patch
deleted file mode 100644
index 34bd5d85bf..0000000000
--- a/package/kernel/mac80211/patches/653-0005-rtl8xxxu-Add-TX-page-defines-for-8723b.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 44abaa08d002235e1bbc2b9e0fd46a64e4694596 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:27 -0400
-Subject: [PATCH] rtl8xxxu: Add TX page defines for 8723b
-
-This switches the 8723b driver to use the new
-rtl8xxxu_init_queue_reserved_page() function.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h       | 6 ++++++
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c | 4 ++++
- 2 files changed, 10 insertions(+)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-@@ -43,6 +43,7 @@
- 
- #define TX_TOTAL_PAGE_NUM		0xf8
- #define TX_TOTAL_PAGE_NUM_8192E		0xf3
-+#define TX_TOTAL_PAGE_NUM_8723B		0xf7
- /* (HPQ + LPQ + NPQ + PUBQ) = TX_TOTAL_PAGE_NUM */
- #define TX_PAGE_NUM_PUBQ		0xe7
- #define TX_PAGE_NUM_HI_PQ		0x0c
-@@ -54,6 +55,11 @@
- #define TX_PAGE_NUM_LO_PQ_8192E		0x0c
- #define TX_PAGE_NUM_NORM_PQ_8192E	0x00
- 
-+#define TX_PAGE_NUM_PUBQ_8723B		0xe7
-+#define TX_PAGE_NUM_HI_PQ_8723B		0x0c
-+#define TX_PAGE_NUM_LO_PQ_8723B		0x02
-+#define TX_PAGE_NUM_NORM_PQ_8723B	0x02
-+
- #define RTL_FW_PAGE_SIZE		4096
- #define RTL8XXXU_FIRMWARE_POLL_MAX	1000
- 
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
-@@ -1674,4 +1674,8 @@ struct rtl8xxxu_fileops rtl8723bu_fops =
- 	.pbp_rx = PBP_PAGE_SIZE_256,
- 	.pbp_tx = PBP_PAGE_SIZE_256,
- 	.mactable = rtl8723b_mac_init_table,
-+	.total_page_num = TX_TOTAL_PAGE_NUM_8723B,
-+	.page_num_hi = TX_PAGE_NUM_HI_PQ_8723B,
-+	.page_num_lo = TX_PAGE_NUM_LO_PQ_8723B,
-+	.page_num_norm = TX_PAGE_NUM_NORM_PQ_8723B,
- };
diff --git a/package/kernel/mac80211/patches/660-0005-rtl8xxxu-First-stab-at-rtl8188e_power_on.patch b/package/kernel/mac80211/patches/653-0005-rtl8xxxu-First-stab-at-rtl8188e_power_on.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0005-rtl8xxxu-First-stab-at-rtl8188e_power_on.patch
rename to package/kernel/mac80211/patches/653-0005-rtl8xxxu-First-stab-at-rtl8188e_power_on.patch
diff --git a/package/kernel/mac80211/patches/660-0006-rtl8xxxu-Add-rtl8188e_disabled_to_emu.patch b/package/kernel/mac80211/patches/653-0006-rtl8xxxu-Add-rtl8188e_disabled_to_emu.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0006-rtl8xxxu-Add-rtl8188e_disabled_to_emu.patch
rename to package/kernel/mac80211/patches/653-0006-rtl8xxxu-Add-rtl8188e_disabled_to_emu.patch
diff --git a/package/kernel/mac80211/patches/653-0006-rtl8xxxu-Switch-8723a-to-use-new-rtl8xxxu_init_queue.patch b/package/kernel/mac80211/patches/653-0006-rtl8xxxu-Switch-8723a-to-use-new-rtl8xxxu_init_queue.patch
deleted file mode 100644
index 151337ca0f..0000000000
--- a/package/kernel/mac80211/patches/653-0006-rtl8xxxu-Switch-8723a-to-use-new-rtl8xxxu_init_queue.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From e366f45d36275b80a5615c68123c88a3de75cc22 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:28 -0400
-Subject: [PATCH] rtl8xxxu: Switch 8723a to use new
- rtl8xxxu_init_queue_reserved_page() routine
-
-This changes the pub-queue value written to REQ_RQPN, however the old
-code used a hard coded minimum value assuming there would always be an
-active lo-queue, even when no USB EP was found for it.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723a.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723a.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723a.c
-@@ -396,4 +396,8 @@ struct rtl8xxxu_fileops rtl8723au_fops =
- 	.pbp_rx = PBP_PAGE_SIZE_128,
- 	.pbp_tx = PBP_PAGE_SIZE_128,
- 	.mactable = rtl8xxxu_gen1_mac_init_table,
-+	.total_page_num = TX_TOTAL_PAGE_NUM,
-+	.page_num_hi = TX_PAGE_NUM_HI_PQ,
-+	.page_num_lo = TX_PAGE_NUM_LO_PQ,
-+	.page_num_norm = TX_PAGE_NUM_NORM_PQ,
- };
diff --git a/package/kernel/mac80211/patches/660-0007-rtl8xxxu-8188e-Enable-scheduler.patch b/package/kernel/mac80211/patches/653-0007-rtl8xxxu-8188e-Enable-scheduler.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0007-rtl8xxxu-8188e-Enable-scheduler.patch
rename to package/kernel/mac80211/patches/653-0007-rtl8xxxu-8188e-Enable-scheduler.patch
diff --git a/package/kernel/mac80211/patches/653-0007-rtl8xxxu-Switch-8192cu-8188cu-devices-to-use-rtl8xxx.patch b/package/kernel/mac80211/patches/653-0007-rtl8xxxu-Switch-8192cu-8188cu-devices-to-use-rtl8xxx.patch
deleted file mode 100644
index e5ccf97be3..0000000000
--- a/package/kernel/mac80211/patches/653-0007-rtl8xxxu-Switch-8192cu-8188cu-devices-to-use-rtl8xxx.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From b492940dc1f7372fb95930dc5bde8d7dbc560cd3 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:29 -0400
-Subject: [PATCH] rtl8xxxu: Switch 8192cu/8188cu devices to use
- rtl8xxxu_init_queue_reserved_page()
-
-This was the last user of the old
-rtl8xxxu_old_init_queue_reserved_page() which can now be removed.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192c.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192c.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192c.c
-@@ -579,5 +579,9 @@ struct rtl8xxxu_fileops rtl8192cu_fops =
- 	.pbp_rx = PBP_PAGE_SIZE_128,
- 	.pbp_tx = PBP_PAGE_SIZE_128,
- 	.mactable = rtl8xxxu_gen1_mac_init_table,
-+	.total_page_num = TX_TOTAL_PAGE_NUM,
-+	.page_num_hi = TX_PAGE_NUM_HI_PQ,
-+	.page_num_lo = TX_PAGE_NUM_LO_PQ,
-+	.page_num_norm = TX_PAGE_NUM_NORM_PQ,
- };
- #endif
diff --git a/package/kernel/mac80211/patches/660-0008-rtl8xxxu-Add-rtl8188e_usb_quirk-for-enabling-MAC-TX-.patch b/package/kernel/mac80211/patches/653-0008-rtl8xxxu-Add-rtl8188e_usb_quirk-for-enabling-MAC-TX-.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0008-rtl8xxxu-Add-rtl8188e_usb_quirk-for-enabling-MAC-TX-.patch
rename to package/kernel/mac80211/patches/653-0008-rtl8xxxu-Add-rtl8188e_usb_quirk-for-enabling-MAC-TX-.patch
diff --git a/package/kernel/mac80211/patches/653-0008-rtl8xxxu-Remove-now-obsolete-rtl8xxxu_old_init_queue.patch b/package/kernel/mac80211/patches/653-0008-rtl8xxxu-Remove-now-obsolete-rtl8xxxu_old_init_queue.patch
deleted file mode 100644
index 9cb4d46e14..0000000000
--- a/package/kernel/mac80211/patches/653-0008-rtl8xxxu-Remove-now-obsolete-rtl8xxxu_old_init_queue.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From efeb8ce7a98cfb60932c6a53ce86359bf6b33b67 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:30 -0400
-Subject: [PATCH] rtl8xxxu: Remove now obsolete
- rtl8xxxu_old_init_queue_reserved_page()
-
-Switching over the old devices to use the new function allows us to
-get rid of this legacy.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c  | 30 ++--------------------
- 1 file changed, 2 insertions(+), 28 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -3847,28 +3847,6 @@ void rtl8xxxu_gen2_disable_rf(struct rtl
- 	rtl8xxxu_write32(priv, REG_RX_WAIT_CCA, val32);
- }
- 
--static void rtl8xxxu_old_init_queue_reserved_page(struct rtl8xxxu_priv *priv)
--{
--	u8 val8;
--	u32 val32;
--
--	if (priv->ep_tx_normal_queue)
--		val8 = TX_PAGE_NUM_NORM_PQ;
--	else
--		val8 = 0;
--
--	rtl8xxxu_write8(priv, REG_RQPN_NPQ, val8);
--
--	val32 = (TX_PAGE_NUM_PUBQ << RQPN_PUB_PQ_SHIFT) | RQPN_LOAD;
--
--	if (priv->ep_tx_high_queue)
--		val32 |= (TX_PAGE_NUM_HI_PQ << RQPN_HI_PQ_SHIFT);
--	if (priv->ep_tx_low_queue)
--		val32 |= (TX_PAGE_NUM_LO_PQ << RQPN_LO_PQ_SHIFT);
--
--	rtl8xxxu_write32(priv, REG_RQPN, val32);
--}
--
- static void rtl8xxxu_init_queue_reserved_page(struct rtl8xxxu_priv *priv)
- {
- 	struct rtl8xxxu_fileops *fops = priv->fops;
-@@ -3929,12 +3907,8 @@ static int rtl8xxxu_init_device(struct i
- 		goto exit;
- 	}
- 
--	if (!macpower) {
--		if (priv->fops->total_page_num)
--			rtl8xxxu_init_queue_reserved_page(priv);
--		else
--			rtl8xxxu_old_init_queue_reserved_page(priv);
--	}
-+	if (!macpower)
-+		rtl8xxxu_init_queue_reserved_page(priv);
- 
- 	ret = rtl8xxxu_init_queue_priority(priv);
- 	dev_dbg(dev, "%s: init_queue_priority %i\n", __func__, ret);
diff --git a/package/kernel/mac80211/patches/660-0009-rtl8xxxu-8188e-add-REG_TXDMA_OFFSET_CHK-quirk.patch b/package/kernel/mac80211/patches/653-0009-rtl8xxxu-8188e-add-REG_TXDMA_OFFSET_CHK-quirk.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0009-rtl8xxxu-8188e-add-REG_TXDMA_OFFSET_CHK-quirk.patch
rename to package/kernel/mac80211/patches/653-0009-rtl8xxxu-8188e-add-REG_TXDMA_OFFSET_CHK-quirk.patch
diff --git a/package/kernel/mac80211/patches/653-0009-rtl8xxxu-Simplify-code-setting-TX-buffer-boundary.patch b/package/kernel/mac80211/patches/653-0009-rtl8xxxu-Simplify-code-setting-TX-buffer-boundary.patch
deleted file mode 100644
index 836fbc7744..0000000000
--- a/package/kernel/mac80211/patches/653-0009-rtl8xxxu-Simplify-code-setting-TX-buffer-boundary.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From e02aa3eef786aab82f9929fea25f5f7e9f77ba69 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:31 -0400
-Subject: [PATCH] rtl8xxxu: Simplify code setting TX buffer boundary
-
-With all devices now offering fops->total_page_num, get rid of the
-if mess for setting the TX buffer boundary.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 +-------
- 1 file changed, 1 insertion(+), 7 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -3968,13 +3968,7 @@ static int rtl8xxxu_init_device(struct i
- 		/*
- 		 * Set TX buffer boundary
- 		 */
--		if (priv->rtl_chip == RTL8192E)
--			val8 = TX_TOTAL_PAGE_NUM_8192E + 1;
--		else
--			val8 = TX_TOTAL_PAGE_NUM + 1;
--
--		if (priv->rtl_chip == RTL8723B)
--			val8 -= 1;
-+		val8 = priv->fops->total_page_num + 1;
- 
- 		rtl8xxxu_write8(priv, REG_TXPKTBUF_BCNQ_BDNY, val8);
- 		rtl8xxxu_write8(priv, REG_TXPKTBUF_MGQ_BDNY, val8);
diff --git a/package/kernel/mac80211/patches/653-0010-rtl8xxxu-Add-bit-definitions-for-REG_FPGA0_TX_INFO.patch b/package/kernel/mac80211/patches/653-0010-rtl8xxxu-Add-bit-definitions-for-REG_FPGA0_TX_INFO.patch
deleted file mode 100644
index 975211c644..0000000000
--- a/package/kernel/mac80211/patches/653-0010-rtl8xxxu-Add-bit-definitions-for-REG_FPGA0_TX_INFO.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From dce7548fd9700c4c4ecda936dcf7326b9241a6d3 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:32 -0400
-Subject: [PATCH] rtl8xxxu: Add bit definitions for REG_FPGA0_TX_INFO
-
-This adds TX antenna selection bit defines for OFDM mode.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h | 4 ++++
- 1 file changed, 4 insertions(+)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h
-@@ -780,6 +780,10 @@
- #define  FPGA_RF_MODE_OFDM		BIT(25)
- 
- #define REG_FPGA0_TX_INFO		0x0804
-+#define  FPGA0_TX_INFO_OFDM_PATH_A	BIT(0)
-+#define  FPGA0_TX_INFO_OFDM_PATH_B	BIT(1)
-+#define  FPGA0_TX_INFO_OFDM_PATH_C	BIT(2)
-+#define  FPGA0_TX_INFO_OFDM_PATH_D	BIT(3)
- #define REG_FPGA0_PSD_FUNC		0x0808
- #define REG_FPGA0_TX_GAIN		0x080c
- #define REG_FPGA0_RF_TIMING1		0x0810
diff --git a/package/kernel/mac80211/patches/660-0010-rtl8xxxu-Add-reserved-page-init-parameters-for-8188e.patch b/package/kernel/mac80211/patches/653-0010-rtl8xxxu-Add-reserved-page-init-parameters-for-8188e.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0010-rtl8xxxu-Add-reserved-page-init-parameters-for-8188e.patch
rename to package/kernel/mac80211/patches/653-0010-rtl8xxxu-Add-reserved-page-init-parameters-for-8188e.patch
diff --git a/package/kernel/mac80211/patches/653-0011-rtl8xxxu-Add-interrupt-bit-definitions-for-gen2-part.patch b/package/kernel/mac80211/patches/653-0011-rtl8xxxu-Add-interrupt-bit-definitions-for-gen2-part.patch
deleted file mode 100644
index d29579d494..0000000000
--- a/package/kernel/mac80211/patches/653-0011-rtl8xxxu-Add-interrupt-bit-definitions-for-gen2-part.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 0b09628948bce970e14ef61a6788caa93285a132 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:33 -0400
-Subject: [PATCH] rtl8xxxu: Add interrupt bit definitions for gen2 parts
-
-These are primarily needed for SDIO/PCI parts, but the vendor driver
-still sets them for some USB devices.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h  | 56 ++++++++++++++++++++++
- 1 file changed, 56 insertions(+)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h
-@@ -213,10 +213,66 @@
- #define REG_HMBOX_EXT_1			0x008a
- #define REG_HMBOX_EXT_2			0x008c
- #define REG_HMBOX_EXT_3			0x008e
-+
- /* Interrupt registers for 8192e/8723bu/8812 */
- #define REG_HIMR0			0x00b0
-+#define	 IMR0_TXCCK			BIT(30)	/* TXRPT interrupt when CCX bit
-+						   of the packet is set */
-+#define	 IMR0_PSTIMEOUT			BIT(29)	/* Power Save Time Out Int */
-+#define	 IMR0_GTINT4			BIT(28)	/* Set when GTIMER4 expires */
-+#define	 IMR0_GTINT3			BIT(27)	/* Set when GTIMER3 expires */
-+#define	 IMR0_TBDER			BIT(26)	/* Transmit Beacon0 Error */
-+#define	 IMR0_TBDOK			BIT(25)	/* Transmit Beacon0 OK */
-+#define	 IMR0_TSF_BIT32_TOGGLE		BIT(24)	/* TSF Timer BIT32 toggle
-+						   indication interrupt */
-+#define	 IMR0_BCNDMAINT0		BIT(20)	/* Beacon DMA Interrupt 0 */
-+#define	 IMR0_BCNDERR0			BIT(16)	/* Beacon Queue DMA Error 0 */
-+#define	 IMR0_HSISR_IND_ON_INT		BIT(15)	/* HSISR Indicator (HSIMR &
-+						   HSISR is true) */
-+#define	 IMR0_BCNDMAINT_E		BIT(14)	/* Beacon DMA Interrupt
-+						   Extension for Win7 */
-+#define	 IMR0_ATIMEND			BIT(12)	/* CTWidnow End or
-+						   ATIM Window End */
-+#define	 IMR0_HISR1_IND_INT		BIT(11)	/* HISR1 Indicator
-+						   (HISR1 & HIMR1 is true) */
-+#define	 IMR0_C2HCMD			BIT(10)	/* CPU to Host Command INT
-+						   Status, Write 1 to clear */
-+#define	 IMR0_CPWM2			BIT(9)	/* CPU power Mode exchange INT
-+						   Status, Write 1 to clear */
-+#define	 IMR0_CPWM			BIT(8)	/* CPU power Mode exchange INT
-+						   Status, Write 1 to clear */
-+#define	 IMR0_HIGHDOK			BIT(7)	/* High Queue DMA OK */
-+#define	 IMR0_MGNTDOK			BIT(6)	/* Management Queue DMA OK */
-+#define	 IMR0_BKDOK			BIT(5)	/* AC_BK DMA OK */
-+#define	 IMR0_BEDOK			BIT(4)	/* AC_BE DMA OK */
-+#define	 IMR0_VIDOK			BIT(3)	/* AC_VI DMA OK */
-+#define	 IMR0_VODOK			BIT(2)	/* AC_VO DMA OK */
-+#define	 IMR0_RDU			BIT(1)	/* Rx Descriptor Unavailable */
-+#define	 IMR0_ROK			BIT(0)	/* Receive DMA OK */
- #define REG_HISR0			0x00b4
- #define REG_HIMR1			0x00b8
-+#define	 IMR1_BCNDMAINT7		BIT(27)	/* Beacon DMA Interrupt 7 */
-+#define	 IMR1_BCNDMAINT6		BIT(26)	/* Beacon DMA Interrupt 6 */
-+#define	 IMR1_BCNDMAINT5		BIT(25)	/* Beacon DMA Interrupt 5 */
-+#define	 IMR1_BCNDMAINT4		BIT(24)	/* Beacon DMA Interrupt 4 */
-+#define	 IMR1_BCNDMAINT3		BIT(23)	/* Beacon DMA Interrupt 3 */
-+#define	 IMR1_BCNDMAINT2		BIT(22)	/* Beacon DMA Interrupt 2 */
-+#define	 IMR1_BCNDMAINT1		BIT(21)	/* Beacon DMA Interrupt 1 */
-+#define	 IMR1_BCNDERR7			BIT(20)	/* Beacon Queue DMA Err Int 7 */
-+#define	 IMR1_BCNDERR6			BIT(19)	/* Beacon Queue DMA Err Int 6 */
-+#define	 IMR1_BCNDERR5			BIT(18)	/* Beacon Queue DMA Err Int 5 */
-+#define	 IMR1_BCNDERR4			BIT(17)	/* Beacon Queue DMA Err Int 4 */
-+#define	 IMR1_BCNDERR3			BIT(16)	/* Beacon Queue DMA Err Int 3 */
-+#define	 IMR1_BCNDERR2			BIT(15)	/* Beacon Queue DMA Err Int 2 */
-+#define	 IMR1_BCNDERR1			BIT(14)	/* Beacon Queue DMA Err Int 1 */
-+#define	 IMR1_ATIMEND_E			BIT(13)	/* ATIM Window End Extension
-+						   for Win7 */
-+#define	 IMR1_TXERR			BIT(11)	/* Tx Error Flag Int Status,
-+						   write 1 to clear */
-+#define	 IMR1_RXERR			BIT(10)	/* Rx Error Flag Int Status,
-+						   write 1 to clear */
-+#define	 IMR1_TXFOVW			BIT(9)	/* Transmit FIFO Overflow */
-+#define	 IMR1_RXFOVW			BIT(8)	/* Receive FIFO Overflow */
- #define REG_HISR1			0x00bc
- 
- /*  Host suspend counter on FPGA platform */
diff --git a/package/kernel/mac80211/patches/660-0011-rtl8xxxu-Correct-TX_TOTAL_PAGE_NUM-for-8188eu.patch b/package/kernel/mac80211/patches/653-0011-rtl8xxxu-Correct-TX_TOTAL_PAGE_NUM-for-8188eu.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0011-rtl8xxxu-Correct-TX_TOTAL_PAGE_NUM-for-8188eu.patch
rename to package/kernel/mac80211/patches/653-0011-rtl8xxxu-Correct-TX_TOTAL_PAGE_NUM-for-8188eu.patch
diff --git a/package/kernel/mac80211/patches/660-0012-rtl8xxxu-Add-trxff_boundary-for-8188e.patch b/package/kernel/mac80211/patches/653-0012-rtl8xxxu-Add-trxff_boundary-for-8188e.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0012-rtl8xxxu-Add-trxff_boundary-for-8188e.patch
rename to package/kernel/mac80211/patches/653-0012-rtl8xxxu-Add-trxff_boundary-for-8188e.patch
diff --git a/package/kernel/mac80211/patches/653-0012-rtl8xxxu-Use-flag-to-indicate-whether-device-has-TX-.patch b/package/kernel/mac80211/patches/653-0012-rtl8xxxu-Use-flag-to-indicate-whether-device-has-TX-.patch
deleted file mode 100644
index e1b085f0d2..0000000000
--- a/package/kernel/mac80211/patches/653-0012-rtl8xxxu-Use-flag-to-indicate-whether-device-has-TX-.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From e3ebcd7428c142fb7b74ded9a624cddfb403d2c5 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:34 -0400
-Subject: [PATCH] rtl8xxxu: Use flag to indicate whether device has TX report
- timer support
-
-Use a fileops flag to indicate whether the device has TX report timer
-support. This will make it easier to include future devices such as
-8188eu to use the TX report timer.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h       | 1 +
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c | 1 +
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c  | 5 ++---
- 3 files changed, 4 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-@@ -1341,6 +1341,7 @@ struct rtl8xxxu_fileops {
- 	char tx_desc_size;
- 	char rx_desc_size;
- 	char has_s0s1;
-+	char has_tx_report;
- 	u32 adda_1t_init;
- 	u32 adda_1t_path_on;
- 	u32 adda_2t_path_on_a;
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
-@@ -1666,6 +1666,7 @@ struct rtl8xxxu_fileops rtl8723bu_fops =
- 	.tx_desc_size = sizeof(struct rtl8xxxu_txdesc40),
- 	.rx_desc_size = sizeof(struct rtl8xxxu_rxdesc24),
- 	.has_s0s1 = 1,
-+	.has_tx_report = 1,
- 	.adda_1t_init = 0x01c00014,
- 	.adda_1t_path_on = 0x01c00014,
- 	.adda_2t_path_on_a = 0x01c00014,
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -4000,10 +4000,9 @@ static int rtl8xxxu_init_device(struct i
- 		priv->fops->usb_quirks(priv);
- 
- 		/*
--		 * Presumably this is for 8188EU as well
--		 * Enable TX report and TX report timer
-+		 * Enable TX report and TX report timer for 8723bu/8188eu/...
- 		 */
--		if (priv->rtl_chip == RTL8723B) {
-+		if (priv->fops->has_tx_report) {
- 			val8 = rtl8xxxu_read8(priv, REG_TX_REPORT_CTRL);
- 			val8 |= TX_REPORT_CTRL_TIMER_ENABLE;
- 			rtl8xxxu_write8(priv, REG_TX_REPORT_CTRL, val8);
diff --git a/package/kernel/mac80211/patches/660-0013-rtl8xxxu-8188eu-specify-firmware-block-size-and-set-.patch b/package/kernel/mac80211/patches/653-0013-rtl8xxxu-8188eu-specify-firmware-block-size-and-set-.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0013-rtl8xxxu-8188eu-specify-firmware-block-size-and-set-.patch
rename to package/kernel/mac80211/patches/653-0013-rtl8xxxu-8188eu-specify-firmware-block-size-and-set-.patch
diff --git a/package/kernel/mac80211/patches/653-0013-rtl8xxxu-Convert-flags-in-rtl8xxxu_fileops-to-bitfla.patch b/package/kernel/mac80211/patches/653-0013-rtl8xxxu-Convert-flags-in-rtl8xxxu_fileops-to-bitfla.patch
deleted file mode 100644
index 7191243b85..0000000000
--- a/package/kernel/mac80211/patches/653-0013-rtl8xxxu-Convert-flags-in-rtl8xxxu_fileops-to-bitfla.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From ee675cc30e07cc925489e9663539e69873b04100 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:35 -0400
-Subject: [PATCH] rtl8xxxu: Convert flags in rtl8xxxu_fileops to bitflags
-
-This leaves space for a few more flags within the same space.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-@@ -1340,8 +1340,8 @@ struct rtl8xxxu_fileops {
- 	int rx_agg_buf_size;
- 	char tx_desc_size;
- 	char rx_desc_size;
--	char has_s0s1;
--	char has_tx_report;
-+	u8 has_s0s1:1;
-+	u8 has_tx_report:1;
- 	u32 adda_1t_init;
- 	u32 adda_1t_path_on;
- 	u32 adda_2t_path_on_a;
diff --git a/package/kernel/mac80211/patches/660-0014-rtl8xxxu-Add-8188e-mac-init-table.patch b/package/kernel/mac80211/patches/653-0014-rtl8xxxu-Add-8188e-mac-init-table.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0014-rtl8xxxu-Add-8188e-mac-init-table.patch
rename to package/kernel/mac80211/patches/653-0014-rtl8xxxu-Add-8188e-mac-init-table.patch
diff --git a/package/kernel/mac80211/patches/653-0014-rtl8xxxu-Introduce-fops-bitflag-indicating-type-of-t.patch b/package/kernel/mac80211/patches/653-0014-rtl8xxxu-Introduce-fops-bitflag-indicating-type-of-t.patch
deleted file mode 100644
index a2b944a894..0000000000
--- a/package/kernel/mac80211/patches/653-0014-rtl8xxxu-Introduce-fops-bitflag-indicating-type-of-t.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From eed145ab25a3eeba4caf2d4be0b5c7a3097f39bd Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:36 -0400
-Subject: [PATCH] rtl8xxxu: Introduce fops bitflag indicating type of thermal
- meter
-
-Do not rely on TX descriptor size to determine the thermal meter
-type.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h       | 1 +
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 1 +
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c | 1 +
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c  | 2 +-
- 4 files changed, 4 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-@@ -1342,6 +1342,7 @@ struct rtl8xxxu_fileops {
- 	char rx_desc_size;
- 	u8 has_s0s1:1;
- 	u8 has_tx_report:1;
-+	u8 gen2_thermal_meter:1;
- 	u32 adda_1t_init;
- 	u32 adda_1t_path_on;
- 	u32 adda_2t_path_on_a;
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
-@@ -1505,6 +1505,7 @@ struct rtl8xxxu_fileops rtl8192eu_fops =
- 	.tx_desc_size = sizeof(struct rtl8xxxu_txdesc40),
- 	.rx_desc_size = sizeof(struct rtl8xxxu_rxdesc24),
- 	.has_s0s1 = 0,
-+	.gen2_thermal_meter = 1,
- 	.adda_1t_init = 0x0fc01616,
- 	.adda_1t_path_on = 0x0fc01616,
- 	.adda_2t_path_on_a = 0x0fc01616,
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
-@@ -1667,6 +1667,7 @@ struct rtl8xxxu_fileops rtl8723bu_fops =
- 	.rx_desc_size = sizeof(struct rtl8xxxu_rxdesc24),
- 	.has_s0s1 = 1,
- 	.has_tx_report = 1,
-+	.gen2_thermal_meter = 1,
- 	.adda_1t_init = 0x01c00014,
- 	.adda_1t_path_on = 0x01c00014,
- 	.adda_2t_path_on_a = 0x01c00014,
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -4195,7 +4195,7 @@ static int rtl8xxxu_init_device(struct i
- 	/*
- 	 * This should enable thermal meter
- 	 */
--	if (priv->fops->tx_desc_size == sizeof(struct rtl8xxxu_txdesc40))
-+	if (priv->fops->gen2_thermal_meter)
- 		rtl8xxxu_write_rfreg(priv,
- 				     RF_A, RF6052_REG_T_METER_8723B, 0x37cf8);
- 	else
diff --git a/package/kernel/mac80211/patches/660-0015-rtl8xxxu-Implement-rtl8188eu_init_phy_bb.patch b/package/kernel/mac80211/patches/653-0015-rtl8xxxu-Implement-rtl8188eu_init_phy_bb.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0015-rtl8xxxu-Implement-rtl8188eu_init_phy_bb.patch
rename to package/kernel/mac80211/patches/653-0015-rtl8xxxu-Implement-rtl8188eu_init_phy_bb.patch
diff --git a/package/kernel/mac80211/patches/653-0015-rtl8xxxu-Simplify-calculating-of-hw-value-used-for-s.patch b/package/kernel/mac80211/patches/653-0015-rtl8xxxu-Simplify-calculating-of-hw-value-used-for-s.patch
deleted file mode 100644
index eb2fbbb236..0000000000
--- a/package/kernel/mac80211/patches/653-0015-rtl8xxxu-Simplify-calculating-of-hw-value-used-for-s.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From be49b1f111c76ce20a60a90587e2b8e8ab809a06 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:37 -0400
-Subject: [PATCH] rtl8xxxu: Simplify calculating of hw value used for setting
- TX rate
-
-Calculating the value in one place rather than using one calculation
-in one place and a different one for management frames in another
-location makes little sense.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -4848,7 +4848,8 @@ static void rtl8xxxu_tx(struct ieee80211
- 		}
- 	}
- 
--	if (rate_flag & IEEE80211_TX_RC_MCS)
-+	if (rate_flag & IEEE80211_TX_RC_MCS &&
-+	    !ieee80211_is_mgmt(hdr->frame_control))
- 		rate = tx_info->control.rates[0].idx + DESC_RATE_MCS0;
- 	else
- 		rate = tx_rate->hw_value;
-@@ -4869,7 +4870,7 @@ static void rtl8xxxu_tx(struct ieee80211
- 			tx_desc->txdw1 |= cpu_to_le32(TXDESC32_AGG_BREAK);
- 
- 		if (ieee80211_is_mgmt(hdr->frame_control)) {
--			tx_desc->txdw5 = cpu_to_le32(tx_rate->hw_value);
-+			tx_desc->txdw5 = cpu_to_le32(rate);
- 			tx_desc->txdw4 |=
- 				cpu_to_le32(TXDESC32_USE_DRIVER_RATE);
- 			tx_desc->txdw5 |=
-@@ -4923,7 +4924,7 @@ static void rtl8xxxu_tx(struct ieee80211
- 			tx_desc40->txdw2 |= cpu_to_le32(TXDESC40_AGG_BREAK);
- 
- 		if (ieee80211_is_mgmt(hdr->frame_control)) {
--			tx_desc40->txdw4 = cpu_to_le32(tx_rate->hw_value);
-+			tx_desc40->txdw4 = cpu_to_le32(rate);
- 			tx_desc40->txdw3 |=
- 				cpu_to_le32(TXDESC40_USE_DRIVER_RATE);
- 			tx_desc40->txdw4 |=
diff --git a/package/kernel/mac80211/patches/653-0016-rtl8xxxu-Determine-the-need-for-SGI-before-handling-.patch b/package/kernel/mac80211/patches/653-0016-rtl8xxxu-Determine-the-need-for-SGI-before-handling-.patch
deleted file mode 100644
index c87a49ee80..0000000000
--- a/package/kernel/mac80211/patches/653-0016-rtl8xxxu-Determine-the-need-for-SGI-before-handling-.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 3972cc579140e48e8390fff5e94f6e9e78c3dd87 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:38 -0400
-Subject: [PATCH] rtl8xxxu: Determine the need for SGI before handling specific
- TX desc formats
-
-In order to be able to split out the TX descriptor handling code,
-determine in advance the need to mark SGI.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 14 ++++++++------
- 1 file changed, 8 insertions(+), 6 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -4770,7 +4770,7 @@ static void rtl8xxxu_tx(struct ieee80211
- 	u16 rate_flag = tx_info->control.rates[0].flags;
- 	int tx_desc_size = priv->fops->tx_desc_size;
- 	int ret;
--	bool usedesc40, ampdu_enable;
-+	bool usedesc40, ampdu_enable, sgi = false;
- 
- 	if (skb_headroom(skb) < tx_desc_size) {
- 		dev_warn(dev,
-@@ -4854,6 +4854,12 @@ static void rtl8xxxu_tx(struct ieee80211
- 	else
- 		rate = tx_rate->hw_value;
- 
-+	if (rate_flag & IEEE80211_TX_RC_SHORT_GI ||
-+	    (ieee80211_is_data_qos(hdr->frame_control) &&
-+	     sta && sta->ht_cap.cap &
-+	     (IEEE80211_HT_CAP_SGI_40 | IEEE80211_HT_CAP_SGI_20)))
-+		sgi = true;
-+
- 	seq_number = IEEE80211_SEQ_TO_SN(le16_to_cpu(hdr->seq_ctrl));
- 	if (!usedesc40) {
- 		tx_desc->txdw5 = cpu_to_le32(rate);
-@@ -4886,12 +4892,8 @@ static void rtl8xxxu_tx(struct ieee80211
- 		    (sta && vif && vif->bss_conf.use_short_preamble))
- 			tx_desc->txdw4 |= cpu_to_le32(TXDESC32_SHORT_PREAMBLE);
- 
--		if (rate_flag & IEEE80211_TX_RC_SHORT_GI ||
--		    (ieee80211_is_data_qos(hdr->frame_control) &&
--		     sta && sta->ht_cap.cap &
--		     (IEEE80211_HT_CAP_SGI_40 | IEEE80211_HT_CAP_SGI_20))) {
-+		if (sgi)
- 			tx_desc->txdw5 |= cpu_to_le32(TXDESC32_SHORT_GI);
--		}
- 
- 		if (rate_flag & IEEE80211_TX_RC_USE_RTS_CTS) {
- 			/*
diff --git a/package/kernel/mac80211/patches/660-0016-rtl8xxxu-Implement-rtl8188eu_init_phy_rf.patch b/package/kernel/mac80211/patches/653-0016-rtl8xxxu-Implement-rtl8188eu_init_phy_rf.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0016-rtl8xxxu-Implement-rtl8188eu_init_phy_rf.patch
rename to package/kernel/mac80211/patches/653-0016-rtl8xxxu-Implement-rtl8188eu_init_phy_rf.patch
diff --git a/package/kernel/mac80211/patches/653-0017-rtl8xxxu-Determine-need-for-shore-preamble-before-up.patch b/package/kernel/mac80211/patches/653-0017-rtl8xxxu-Determine-need-for-shore-preamble-before-up.patch
deleted file mode 100644
index 4d19127cac..0000000000
--- a/package/kernel/mac80211/patches/653-0017-rtl8xxxu-Determine-need-for-shore-preamble-before-up.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 99afaac4278c9581cef17ddc0c842b51f9b6206d Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:39 -0400
-Subject: [PATCH] rtl8xxxu: Determine need for shore preamble before updating
- TX descriptors
-
-Another patch to move this detection out of the code handling the TX
-descriptor update.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 12 +++++++-----
- 1 file changed, 7 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -4770,7 +4770,7 @@ static void rtl8xxxu_tx(struct ieee80211
- 	u16 rate_flag = tx_info->control.rates[0].flags;
- 	int tx_desc_size = priv->fops->tx_desc_size;
- 	int ret;
--	bool usedesc40, ampdu_enable, sgi = false;
-+	bool usedesc40, ampdu_enable, sgi = false, short_preamble = false;
- 
- 	if (skb_headroom(skb) < tx_desc_size) {
- 		dev_warn(dev,
-@@ -4860,6 +4860,10 @@ static void rtl8xxxu_tx(struct ieee80211
- 	     (IEEE80211_HT_CAP_SGI_40 | IEEE80211_HT_CAP_SGI_20)))
- 		sgi = true;
- 
-+	if (rate_flag & IEEE80211_TX_RC_USE_SHORT_PREAMBLE ||
-+	    (sta && vif && vif->bss_conf.use_short_preamble))
-+		short_preamble = true;
-+
- 	seq_number = IEEE80211_SEQ_TO_SN(le16_to_cpu(hdr->seq_ctrl));
- 	if (!usedesc40) {
- 		tx_desc->txdw5 = cpu_to_le32(rate);
-@@ -4888,8 +4892,7 @@ static void rtl8xxxu_tx(struct ieee80211
- 		if (ieee80211_is_data_qos(hdr->frame_control))
- 			tx_desc->txdw4 |= cpu_to_le32(TXDESC32_QOS);
- 
--		if (rate_flag & IEEE80211_TX_RC_USE_SHORT_PREAMBLE ||
--		    (sta && vif && vif->bss_conf.use_short_preamble))
-+		if (short_preamble)
- 			tx_desc->txdw4 |= cpu_to_le32(TXDESC32_SHORT_PREAMBLE);
- 
- 		if (sgi)
-@@ -4935,8 +4938,7 @@ static void rtl8xxxu_tx(struct ieee80211
- 				cpu_to_le32(TXDESC40_RETRY_LIMIT_ENABLE);
- 		}
- 
--		if (rate_flag & IEEE80211_TX_RC_USE_SHORT_PREAMBLE ||
--		    (sta && vif && vif->bss_conf.use_short_preamble))
-+		if (short_preamble)
- 			tx_desc40->txdw5 |=
- 				cpu_to_le32(TXDESC40_SHORT_PREAMBLE);
- 
diff --git a/package/kernel/mac80211/patches/660-0017-rtl8xxxu-Use-auto-LLT-init-for-8188e.patch b/package/kernel/mac80211/patches/653-0017-rtl8xxxu-Use-auto-LLT-init-for-8188e.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0017-rtl8xxxu-Use-auto-LLT-init-for-8188e.patch
rename to package/kernel/mac80211/patches/653-0017-rtl8xxxu-Use-auto-LLT-init-for-8188e.patch
diff --git a/package/kernel/mac80211/patches/660-0018-rtl8xxxu-Do-not-set-REG_FPGA0_TX_INFO-on-8188eu.patch b/package/kernel/mac80211/patches/653-0018-rtl8xxxu-Do-not-set-REG_FPGA0_TX_INFO-on-8188eu.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0018-rtl8xxxu-Do-not-set-REG_FPGA0_TX_INFO-on-8188eu.patch
rename to package/kernel/mac80211/patches/653-0018-rtl8xxxu-Do-not-set-REG_FPGA0_TX_INFO-on-8188eu.patch
diff --git a/package/kernel/mac80211/patches/653-0018-rtl8xxxu-Split-filling-of-TX-descriptors-into-separa.patch b/package/kernel/mac80211/patches/653-0018-rtl8xxxu-Split-filling-of-TX-descriptors-into-separa.patch
deleted file mode 100644
index 9f3cf07637..0000000000
--- a/package/kernel/mac80211/patches/653-0018-rtl8xxxu-Split-filling-of-TX-descriptors-into-separa.patch
+++ /dev/null
@@ -1,315 +0,0 @@
-From b59415c2dd088ffce62fbde737c8b2d04fb6e015 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:40 -0400
-Subject: [PATCH] rtl8xxxu: Split filling of TX descriptors into separate
- functions
-
-Split the filling of TX descriptors into a generic portion used on all
-devices, and format specific helper functions provided in the fops
-structure.
-
-This also cleaned up some mess, even if non harmful, in the handling
-of txdesc40 descriptors, where the code randomly would switch between
-the pointer to tx_desc and tx_desc40.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h   |  12 ++
- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192c.c |   1 +
- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c |   1 +
- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723a.c |   1 +
- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c |   1 +
- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c  | 198 ++++++++++++---------
- 6 files changed, 125 insertions(+), 89 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-@@ -1336,6 +1336,10 @@ struct rtl8xxxu_fileops {
- 				  u32 ramask, int sgi);
- 	void (*report_connect) (struct rtl8xxxu_priv *priv,
- 				u8 macid, bool connect);
-+	void (*fill_txdesc) (struct ieee80211_hdr *hdr,
-+			     struct rtl8xxxu_txdesc32 *tx_desc, u32 rate,
-+			     u16 rate_flag, bool sgi, bool short_preamble,
-+			     bool ampdu_enable);
- 	int writeN_block_size;
- 	int rx_agg_buf_size;
- 	char tx_desc_size;
-@@ -1429,6 +1433,14 @@ int rtl8xxxu_parse_rxdesc24(struct rtl8x
- int rtl8xxxu_gen2_channel_to_group(int channel);
- bool rtl8xxxu_gen2_simularity_compare(struct rtl8xxxu_priv *priv,
- 				      int result[][8], int c1, int c2);
-+void rtl8xxxu_fill_txdesc_v1(struct ieee80211_hdr *hdr,
-+			     struct rtl8xxxu_txdesc32 *tx_desc, u32 rate,
-+			     u16 rate_flag, bool sgi, bool short_preamble,
-+			     bool ampdu_enable);
-+void rtl8xxxu_fill_txdesc_v2(struct ieee80211_hdr *hdr,
-+			     struct rtl8xxxu_txdesc32 *tx_desc32, u32 rate,
-+			     u16 rate_flag, bool sgi, bool short_preamble,
-+			     bool ampdu_enable);
- 
- extern struct rtl8xxxu_fileops rtl8192cu_fops;
- extern struct rtl8xxxu_fileops rtl8192eu_fops;
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192c.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192c.c
-@@ -567,6 +567,7 @@ struct rtl8xxxu_fileops rtl8192cu_fops =
- 	.set_tx_power = rtl8xxxu_gen1_set_tx_power,
- 	.update_rate_mask = rtl8xxxu_update_rate_mask,
- 	.report_connect = rtl8xxxu_gen1_report_connect,
-+	.fill_txdesc = rtl8xxxu_fill_txdesc_v1,
- 	.writeN_block_size = 128,
- 	.rx_agg_buf_size = 16000,
- 	.tx_desc_size = sizeof(struct rtl8xxxu_txdesc32),
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
-@@ -1501,6 +1501,7 @@ struct rtl8xxxu_fileops rtl8192eu_fops =
- 	.set_tx_power = rtl8192e_set_tx_power,
- 	.update_rate_mask = rtl8xxxu_gen2_update_rate_mask,
- 	.report_connect = rtl8xxxu_gen2_report_connect,
-+	.fill_txdesc = rtl8xxxu_fill_txdesc_v2,
- 	.writeN_block_size = 128,
- 	.tx_desc_size = sizeof(struct rtl8xxxu_txdesc40),
- 	.rx_desc_size = sizeof(struct rtl8xxxu_rxdesc24),
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723a.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723a.c
-@@ -384,6 +384,7 @@ struct rtl8xxxu_fileops rtl8723au_fops =
- 	.set_tx_power = rtl8xxxu_gen1_set_tx_power,
- 	.update_rate_mask = rtl8xxxu_update_rate_mask,
- 	.report_connect = rtl8xxxu_gen1_report_connect,
-+	.fill_txdesc = rtl8xxxu_fill_txdesc_v1,
- 	.writeN_block_size = 1024,
- 	.rx_agg_buf_size = 16000,
- 	.tx_desc_size = sizeof(struct rtl8xxxu_txdesc32),
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
-@@ -1662,6 +1662,7 @@ struct rtl8xxxu_fileops rtl8723bu_fops =
- 	.set_tx_power = rtl8723b_set_tx_power,
- 	.update_rate_mask = rtl8xxxu_gen2_update_rate_mask,
- 	.report_connect = rtl8xxxu_gen2_report_connect,
-+	.fill_txdesc = rtl8xxxu_fill_txdesc_v2,
- 	.writeN_block_size = 1024,
- 	.tx_desc_size = sizeof(struct rtl8xxxu_txdesc40),
- 	.rx_desc_size = sizeof(struct rtl8xxxu_rxdesc24),
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -4750,6 +4750,113 @@ static void rtl8xxxu_dump_action(struct
- 	}
- }
- 
-+/*
-+ * Fill in v1 (gen1) specific TX descriptor bits.
-+ * This format is used on 8188cu/8192cu/8723au
-+ */
-+void
-+rtl8xxxu_fill_txdesc_v1(struct ieee80211_hdr *hdr,
-+			struct rtl8xxxu_txdesc32 *tx_desc, u32 rate,
-+			u16 rate_flag, bool sgi, bool short_preamble,
-+			bool ampdu_enable)
-+{
-+	u16 seq_number;
-+
-+	seq_number = IEEE80211_SEQ_TO_SN(le16_to_cpu(hdr->seq_ctrl));
-+
-+	tx_desc->txdw5 = cpu_to_le32(rate);
-+
-+	if (ieee80211_is_data(hdr->frame_control))
-+		tx_desc->txdw5 |= cpu_to_le32(0x0001ff00);
-+
-+	tx_desc->txdw3 = cpu_to_le32((u32)seq_number << TXDESC32_SEQ_SHIFT);
-+
-+	if (ampdu_enable)
-+		tx_desc->txdw1 |= cpu_to_le32(TXDESC32_AGG_ENABLE);
-+	else
-+		tx_desc->txdw1 |= cpu_to_le32(TXDESC32_AGG_BREAK);
-+
-+	if (ieee80211_is_mgmt(hdr->frame_control)) {
-+		tx_desc->txdw5 = cpu_to_le32(rate);
-+		tx_desc->txdw4 |= cpu_to_le32(TXDESC32_USE_DRIVER_RATE);
-+		tx_desc->txdw5 |= cpu_to_le32(6 << TXDESC32_RETRY_LIMIT_SHIFT);
-+		tx_desc->txdw5 |= cpu_to_le32(TXDESC32_RETRY_LIMIT_ENABLE);
-+	}
-+
-+	if (ieee80211_is_data_qos(hdr->frame_control))
-+		tx_desc->txdw4 |= cpu_to_le32(TXDESC32_QOS);
-+
-+	if (short_preamble)
-+		tx_desc->txdw4 |= cpu_to_le32(TXDESC32_SHORT_PREAMBLE);
-+
-+	if (sgi)
-+		tx_desc->txdw5 |= cpu_to_le32(TXDESC32_SHORT_GI);
-+
-+	if (rate_flag & IEEE80211_TX_RC_USE_RTS_CTS) {
-+		/*
-+		 * Use RTS rate 24M - does the mac80211 tell
-+		 * us which to use?
-+		 */
-+		tx_desc->txdw4 |= cpu_to_le32(DESC_RATE_24M <<
-+					      TXDESC32_RTS_RATE_SHIFT);
-+		tx_desc->txdw4 |= cpu_to_le32(TXDESC32_RTS_CTS_ENABLE);
-+		tx_desc->txdw4 |= cpu_to_le32(TXDESC32_HW_RTS_ENABLE);
-+	}
-+}
-+
-+/*
-+ * Fill in v2 (gen2) specific TX descriptor bits.
-+ * This format is used on 8192eu/8723bu
-+ */
-+void
-+rtl8xxxu_fill_txdesc_v2(struct ieee80211_hdr *hdr,
-+			struct rtl8xxxu_txdesc32 *tx_desc32, u32 rate,
-+			u16 rate_flag, bool sgi, bool short_preamble,
-+			bool ampdu_enable)
-+{
-+	struct rtl8xxxu_txdesc40 *tx_desc40;
-+	u16 seq_number;
-+
-+	tx_desc40 = (struct rtl8xxxu_txdesc40 *)tx_desc32;
-+
-+	seq_number = IEEE80211_SEQ_TO_SN(le16_to_cpu(hdr->seq_ctrl));
-+
-+	tx_desc40->txdw4 = cpu_to_le32(rate);
-+	if (ieee80211_is_data(hdr->frame_control)) {
-+		tx_desc40->txdw4 |= cpu_to_le32(0x1f <<
-+						TXDESC40_DATA_RATE_FB_SHIFT);
-+	}
-+
-+	tx_desc40->txdw9 = cpu_to_le32((u32)seq_number << TXDESC40_SEQ_SHIFT);
-+
-+	if (ampdu_enable)
-+		tx_desc40->txdw2 |= cpu_to_le32(TXDESC40_AGG_ENABLE);
-+	else
-+		tx_desc40->txdw2 |= cpu_to_le32(TXDESC40_AGG_BREAK);
-+
-+	if (ieee80211_is_mgmt(hdr->frame_control)) {
-+		tx_desc40->txdw4 = cpu_to_le32(rate);
-+		tx_desc40->txdw3 |= cpu_to_le32(TXDESC40_USE_DRIVER_RATE);
-+		tx_desc40->txdw4 |=
-+			cpu_to_le32(6 << TXDESC40_RETRY_LIMIT_SHIFT);
-+		tx_desc40->txdw4 |= cpu_to_le32(TXDESC40_RETRY_LIMIT_ENABLE);
-+	}
-+
-+	if (short_preamble)
-+		tx_desc40->txdw5 |= cpu_to_le32(TXDESC40_SHORT_PREAMBLE);
-+
-+	if (rate_flag & IEEE80211_TX_RC_USE_RTS_CTS) {
-+		/*
-+		 * Use RTS rate 24M - does the mac80211 tell
-+		 * us which to use?
-+		 */
-+		tx_desc40->txdw4 |= cpu_to_le32(DESC_RATE_24M <<
-+						TXDESC40_RTS_RATE_SHIFT);
-+		tx_desc40->txdw3 |= cpu_to_le32(TXDESC40_RTS_CTS_ENABLE);
-+		tx_desc40->txdw3 |= cpu_to_le32(TXDESC40_HW_RTS_ENABLE);
-+	}
-+}
-+
- static void rtl8xxxu_tx(struct ieee80211_hw *hw,
- 			struct ieee80211_tx_control *control,
- 			struct sk_buff *skb)
-@@ -4759,7 +4866,6 @@ static void rtl8xxxu_tx(struct ieee80211
- 	struct ieee80211_rate *tx_rate = ieee80211_get_tx_rate(hw, tx_info);
- 	struct rtl8xxxu_priv *priv = hw->priv;
- 	struct rtl8xxxu_txdesc32 *tx_desc;
--	struct rtl8xxxu_txdesc40 *tx_desc40;
- 	struct rtl8xxxu_tx_urb *tx_urb;
- 	struct ieee80211_sta *sta = NULL;
- 	struct ieee80211_vif *vif = tx_info->control.vif;
-@@ -4865,95 +4971,9 @@ static void rtl8xxxu_tx(struct ieee80211
- 		short_preamble = true;
- 
- 	seq_number = IEEE80211_SEQ_TO_SN(le16_to_cpu(hdr->seq_ctrl));
--	if (!usedesc40) {
--		tx_desc->txdw5 = cpu_to_le32(rate);
--
--		if (ieee80211_is_data(hdr->frame_control))
--			tx_desc->txdw5 |= cpu_to_le32(0x0001ff00);
--
--		tx_desc->txdw3 =
--			cpu_to_le32((u32)seq_number << TXDESC32_SEQ_SHIFT);
--
--		if (ampdu_enable)
--			tx_desc->txdw1 |= cpu_to_le32(TXDESC32_AGG_ENABLE);
--		else
--			tx_desc->txdw1 |= cpu_to_le32(TXDESC32_AGG_BREAK);
--
--		if (ieee80211_is_mgmt(hdr->frame_control)) {
--			tx_desc->txdw5 = cpu_to_le32(rate);
--			tx_desc->txdw4 |=
--				cpu_to_le32(TXDESC32_USE_DRIVER_RATE);
--			tx_desc->txdw5 |=
--				cpu_to_le32(6 << TXDESC32_RETRY_LIMIT_SHIFT);
--			tx_desc->txdw5 |=
--				cpu_to_le32(TXDESC32_RETRY_LIMIT_ENABLE);
--		}
--
--		if (ieee80211_is_data_qos(hdr->frame_control))
--			tx_desc->txdw4 |= cpu_to_le32(TXDESC32_QOS);
- 
--		if (short_preamble)
--			tx_desc->txdw4 |= cpu_to_le32(TXDESC32_SHORT_PREAMBLE);
--
--		if (sgi)
--			tx_desc->txdw5 |= cpu_to_le32(TXDESC32_SHORT_GI);
--
--		if (rate_flag & IEEE80211_TX_RC_USE_RTS_CTS) {
--			/*
--			 * Use RTS rate 24M - does the mac80211 tell
--			 * us which to use?
--			 */
--			tx_desc->txdw4 |=
--				cpu_to_le32(DESC_RATE_24M <<
--					    TXDESC32_RTS_RATE_SHIFT);
--			tx_desc->txdw4 |=
--				cpu_to_le32(TXDESC32_RTS_CTS_ENABLE);
--			tx_desc->txdw4 |= cpu_to_le32(TXDESC32_HW_RTS_ENABLE);
--		}
--	} else {
--		tx_desc40 = (struct rtl8xxxu_txdesc40 *)tx_desc;
--
--		tx_desc40->txdw4 = cpu_to_le32(rate);
--		if (ieee80211_is_data(hdr->frame_control)) {
--			tx_desc->txdw4 |=
--				cpu_to_le32(0x1f <<
--					    TXDESC40_DATA_RATE_FB_SHIFT);
--		}
--
--		tx_desc40->txdw9 =
--			cpu_to_le32((u32)seq_number << TXDESC40_SEQ_SHIFT);
--
--		if (ampdu_enable)
--			tx_desc40->txdw2 |= cpu_to_le32(TXDESC40_AGG_ENABLE);
--		else
--			tx_desc40->txdw2 |= cpu_to_le32(TXDESC40_AGG_BREAK);
--
--		if (ieee80211_is_mgmt(hdr->frame_control)) {
--			tx_desc40->txdw4 = cpu_to_le32(rate);
--			tx_desc40->txdw3 |=
--				cpu_to_le32(TXDESC40_USE_DRIVER_RATE);
--			tx_desc40->txdw4 |=
--				cpu_to_le32(6 << TXDESC40_RETRY_LIMIT_SHIFT);
--			tx_desc40->txdw4 |=
--				cpu_to_le32(TXDESC40_RETRY_LIMIT_ENABLE);
--		}
--
--		if (short_preamble)
--			tx_desc40->txdw5 |=
--				cpu_to_le32(TXDESC40_SHORT_PREAMBLE);
--
--		if (rate_flag & IEEE80211_TX_RC_USE_RTS_CTS) {
--			/*
--			 * Use RTS rate 24M - does the mac80211 tell
--			 * us which to use?
--			 */
--			tx_desc->txdw4 |=
--				cpu_to_le32(DESC_RATE_24M <<
--					    TXDESC40_RTS_RATE_SHIFT);
--			tx_desc->txdw3 |= cpu_to_le32(TXDESC40_RTS_CTS_ENABLE);
--			tx_desc->txdw3 |= cpu_to_le32(TXDESC40_HW_RTS_ENABLE);
--		}
--	}
-+	priv->fops->fill_txdesc(hdr, tx_desc, rate, rate_flag,
-+				sgi, short_preamble, ampdu_enable);
- 
- 	rtl8xxxu_calc_tx_desc_csum(tx_desc);
- 
diff --git a/package/kernel/mac80211/patches/660-0019-rtl8xxxu-Do-not-mess-with-REG_FPGA0_XA_RF_INT_OE-eit.patch b/package/kernel/mac80211/patches/653-0019-rtl8xxxu-Do-not-mess-with-REG_FPGA0_XA_RF_INT_OE-eit.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0019-rtl8xxxu-Do-not-mess-with-REG_FPGA0_XA_RF_INT_OE-eit.patch
rename to package/kernel/mac80211/patches/653-0019-rtl8xxxu-Do-not-mess-with-REG_FPGA0_XA_RF_INT_OE-eit.patch
diff --git a/package/kernel/mac80211/patches/653-0019-rtl8xxxu-gen1-Fix-non-static-symbol-warning.patch b/package/kernel/mac80211/patches/653-0019-rtl8xxxu-gen1-Fix-non-static-symbol-warning.patch
deleted file mode 100644
index 4cfdd7cd1e..0000000000
--- a/package/kernel/mac80211/patches/653-0019-rtl8xxxu-gen1-Fix-non-static-symbol-warning.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 77e3980201e7d54b2e63653b46a6baba26040cef Mon Sep 17 00:00:00 2001
-From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
-Date: Fri, 19 Aug 2016 17:46:41 -0400
-Subject: [PATCH] rtl8xxxu: gen1: Fix non static symbol warning
-
-Fixes the following sparse warning:
-
-drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c:898:1: warning:
- symbol 'rtl8xxxu_gen1_h2c_cmd' was not declared. Should it be static?
-
-Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -894,7 +894,7 @@ int rtl8xxxu_write_rfreg(struct rtl8xxxu
- 	return retval;
- }
- 
--int
-+static int
- rtl8xxxu_gen1_h2c_cmd(struct rtl8xxxu_priv *priv, struct h2c_cmd *h2c, int len)
- {
- 	struct device *dev = &priv->udev->dev;
diff --git a/package/kernel/mac80211/patches/653-0020-rtl8xxxu-Make-rtl8xxxu_ampdu_action-less-chatty.patch b/package/kernel/mac80211/patches/653-0020-rtl8xxxu-Make-rtl8xxxu_ampdu_action-less-chatty.patch
deleted file mode 100644
index 306faab657..0000000000
--- a/package/kernel/mac80211/patches/653-0020-rtl8xxxu-Make-rtl8xxxu_ampdu_action-less-chatty.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 7329dc13107b2315a7b8ba5a75048935304c55a0 Mon Sep 17 00:00:00 2001
-From: Hans de Goede <hdegoede@redhat.com>
-Date: Fri, 19 Aug 2016 17:46:42 -0400
-Subject: [PATCH] rtl8xxxu: Make rtl8xxxu_ampdu_action less chatty
-
-On my home network rtl8xxxu is spamming the log with
-IEEE80211_AMPDU_RX_START / IEEE80211_AMPDU_RX_STOP every few seconds
-turn these messages into debug messages.
-
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-[kvalo@codeaurora.org: fix commit title]
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -5696,7 +5696,7 @@ rtl8xxxu_ampdu_action(struct ieee80211_h
- 
- 	switch (action) {
- 	case IEEE80211_AMPDU_TX_START:
--		dev_info(dev, "%s: IEEE80211_AMPDU_TX_START\n", __func__);
-+		dev_dbg(dev, "%s: IEEE80211_AMPDU_TX_START\n", __func__);
- 		ampdu_factor = sta->ht_cap.ampdu_factor;
- 		ampdu_density = sta->ht_cap.ampdu_density;
- 		rtl8xxxu_set_ampdu_factor(priv, ampdu_factor);
-@@ -5706,21 +5706,21 @@ rtl8xxxu_ampdu_action(struct ieee80211_h
- 			ampdu_factor, ampdu_density);
- 		break;
- 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
--		dev_info(dev, "%s: IEEE80211_AMPDU_TX_STOP_FLUSH\n", __func__);
-+		dev_dbg(dev, "%s: IEEE80211_AMPDU_TX_STOP_FLUSH\n", __func__);
- 		rtl8xxxu_set_ampdu_factor(priv, 0);
- 		rtl8xxxu_set_ampdu_min_space(priv, 0);
- 		break;
- 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
--		dev_info(dev, "%s: IEEE80211_AMPDU_TX_STOP_FLUSH_CONT\n",
-+		dev_dbg(dev, "%s: IEEE80211_AMPDU_TX_STOP_FLUSH_CONT\n",
- 			 __func__);
- 		rtl8xxxu_set_ampdu_factor(priv, 0);
- 		rtl8xxxu_set_ampdu_min_space(priv, 0);
- 		break;
- 	case IEEE80211_AMPDU_RX_START:
--		dev_info(dev, "%s: IEEE80211_AMPDU_RX_START\n", __func__);
-+		dev_dbg(dev, "%s: IEEE80211_AMPDU_RX_START\n", __func__);
- 		break;
- 	case IEEE80211_AMPDU_RX_STOP:
--		dev_info(dev, "%s: IEEE80211_AMPDU_RX_STOP\n", __func__);
-+		dev_dbg(dev, "%s: IEEE80211_AMPDU_RX_STOP\n", __func__);
- 		break;
- 	default:
- 		break;
diff --git a/package/kernel/mac80211/patches/660-0020-rtl8xxxu-Set-transfer-page-size-for-8188eu.patch b/package/kernel/mac80211/patches/653-0020-rtl8xxxu-Set-transfer-page-size-for-8188eu.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0020-rtl8xxxu-Set-transfer-page-size-for-8188eu.patch
rename to package/kernel/mac80211/patches/653-0020-rtl8xxxu-Set-transfer-page-size-for-8188eu.patch
diff --git a/package/kernel/mac80211/patches/660-0021-rtl8xxxu-Enable-TX-report-timer-on-8188eu.patch b/package/kernel/mac80211/patches/653-0021-rtl8xxxu-Enable-TX-report-timer-on-8188eu.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0021-rtl8xxxu-Enable-TX-report-timer-on-8188eu.patch
rename to package/kernel/mac80211/patches/653-0021-rtl8xxxu-Enable-TX-report-timer-on-8188eu.patch
diff --git a/package/kernel/mac80211/patches/660-0022-rtl8xxxu-Setup-interrupts-for-8188eu.patch b/package/kernel/mac80211/patches/653-0022-rtl8xxxu-Setup-interrupts-for-8188eu.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0022-rtl8xxxu-Setup-interrupts-for-8188eu.patch
rename to package/kernel/mac80211/patches/653-0022-rtl8xxxu-Setup-interrupts-for-8188eu.patch
diff --git a/package/kernel/mac80211/patches/660-0023-rtl8xxxu-Use-rxdesc16-and-32-byte-tx-descriptors-for.patch b/package/kernel/mac80211/patches/653-0023-rtl8xxxu-Use-rxdesc16-and-32-byte-tx-descriptors-for.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0023-rtl8xxxu-Use-rxdesc16-and-32-byte-tx-descriptors-for.patch
rename to package/kernel/mac80211/patches/653-0023-rtl8xxxu-Use-rxdesc16-and-32-byte-tx-descriptors-for.patch
diff --git a/package/kernel/mac80211/patches/660-0024-rtl8xxxu-8188eu-use-same-ADDA-on-parameters-as-8723a.patch b/package/kernel/mac80211/patches/653-0024-rtl8xxxu-8188eu-use-same-ADDA-on-parameters-as-8723a.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0024-rtl8xxxu-8188eu-use-same-ADDA-on-parameters-as-8723a.patch
rename to package/kernel/mac80211/patches/653-0024-rtl8xxxu-8188eu-use-same-ADDA-on-parameters-as-8723a.patch
diff --git a/package/kernel/mac80211/patches/660-0025-rtl8xxxu-Add-PHY-IQ-calibration-code-for-8188eu.patch b/package/kernel/mac80211/patches/653-0025-rtl8xxxu-Add-PHY-IQ-calibration-code-for-8188eu.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0025-rtl8xxxu-Add-PHY-IQ-calibration-code-for-8188eu.patch
rename to package/kernel/mac80211/patches/653-0025-rtl8xxxu-Add-PHY-IQ-calibration-code-for-8188eu.patch
diff --git a/package/kernel/mac80211/patches/660-0026-rtl8xxxu-8188eu-uses-the-gen2-thermal-meter.patch b/package/kernel/mac80211/patches/653-0026-rtl8xxxu-8188eu-uses-the-gen2-thermal-meter.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0026-rtl8xxxu-8188eu-uses-the-gen2-thermal-meter.patch
rename to package/kernel/mac80211/patches/653-0026-rtl8xxxu-8188eu-uses-the-gen2-thermal-meter.patch
diff --git a/package/kernel/mac80211/patches/660-0027-rtl8xxxu-Set-REG_USB_HRPWM-to-0-for-8188eu.patch b/package/kernel/mac80211/patches/653-0027-rtl8xxxu-Set-REG_USB_HRPWM-to-0-for-8188eu.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0027-rtl8xxxu-Set-REG_USB_HRPWM-to-0-for-8188eu.patch
rename to package/kernel/mac80211/patches/653-0027-rtl8xxxu-Set-REG_USB_HRPWM-to-0-for-8188eu.patch
diff --git a/package/kernel/mac80211/patches/660-0028-rtl8xxxu-Implement-rtl8188eu_config_channel.patch b/package/kernel/mac80211/patches/653-0028-rtl8xxxu-Implement-rtl8188eu_config_channel.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0028-rtl8xxxu-Implement-rtl8188eu_config_channel.patch
rename to package/kernel/mac80211/patches/653-0028-rtl8xxxu-Implement-rtl8188eu_config_channel.patch
diff --git a/package/kernel/mac80211/patches/660-0029-rtl8xxxu-Use-gen2-H2C-commands-for-8188eu.patch b/package/kernel/mac80211/patches/653-0029-rtl8xxxu-Use-gen2-H2C-commands-for-8188eu.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0029-rtl8xxxu-Use-gen2-H2C-commands-for-8188eu.patch
rename to package/kernel/mac80211/patches/653-0029-rtl8xxxu-Use-gen2-H2C-commands-for-8188eu.patch
diff --git a/package/kernel/mac80211/patches/660-0030-rtl8xxxu-Initialize-GPIO-settings-for-8188eu.patch b/package/kernel/mac80211/patches/653-0030-rtl8xxxu-Initialize-GPIO-settings-for-8188eu.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0030-rtl8xxxu-Initialize-GPIO-settings-for-8188eu.patch
rename to package/kernel/mac80211/patches/653-0030-rtl8xxxu-Initialize-GPIO-settings-for-8188eu.patch
diff --git a/package/kernel/mac80211/patches/660-0031-rtl8xxxu-Add-simple-rtl8188eu_rf_on-routine.patch b/package/kernel/mac80211/patches/653-0031-rtl8xxxu-Add-simple-rtl8188eu_rf_on-routine.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0031-rtl8xxxu-Add-simple-rtl8188eu_rf_on-routine.patch
rename to package/kernel/mac80211/patches/653-0031-rtl8xxxu-Add-simple-rtl8188eu_rf_on-routine.patch
diff --git a/package/kernel/mac80211/patches/660-0032-rtl8xxxu-Implement-rtl8188e_disable_rf.patch b/package/kernel/mac80211/patches/653-0032-rtl8xxxu-Implement-rtl8188e_disable_rf.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0032-rtl8xxxu-Implement-rtl8188e_disable_rf.patch
rename to package/kernel/mac80211/patches/653-0032-rtl8xxxu-Implement-rtl8188e_disable_rf.patch
diff --git a/package/kernel/mac80211/patches/660-0033-rtl8xxxu-Update-8188e-efuse-definition-for-power-val.patch b/package/kernel/mac80211/patches/653-0033-rtl8xxxu-Update-8188e-efuse-definition-for-power-val.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0033-rtl8xxxu-Update-8188e-efuse-definition-for-power-val.patch
rename to package/kernel/mac80211/patches/653-0033-rtl8xxxu-Update-8188e-efuse-definition-for-power-val.patch
diff --git a/package/kernel/mac80211/patches/660-0034-rtl8xxxu-Implement-rtl8188e_set_tx_power.patch b/package/kernel/mac80211/patches/653-0034-rtl8xxxu-Implement-rtl8188e_set_tx_power.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0034-rtl8xxxu-Implement-rtl8188e_set_tx_power.patch
rename to package/kernel/mac80211/patches/653-0034-rtl8xxxu-Implement-rtl8188e_set_tx_power.patch
diff --git a/package/kernel/mac80211/patches/660-0035-rtl8xxxu-Implement-rtl8xxxu_fill_txdesc_v3-for-8188e.patch b/package/kernel/mac80211/patches/653-0035-rtl8xxxu-Implement-rtl8xxxu_fill_txdesc_v3-for-8188e.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0035-rtl8xxxu-Implement-rtl8xxxu_fill_txdesc_v3-for-8188e.patch
rename to package/kernel/mac80211/patches/653-0035-rtl8xxxu-Implement-rtl8xxxu_fill_txdesc_v3-for-8188e.patch
diff --git a/package/kernel/mac80211/patches/660-0036-rtl8xxxu-Add-some-8188eu-registers-and-update-CCK0_A.patch b/package/kernel/mac80211/patches/653-0036-rtl8xxxu-Add-some-8188eu-registers-and-update-CCK0_A.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0036-rtl8xxxu-Add-some-8188eu-registers-and-update-CCK0_A.patch
rename to package/kernel/mac80211/patches/653-0036-rtl8xxxu-Add-some-8188eu-registers-and-update-CCK0_A.patch
diff --git a/package/kernel/mac80211/patches/660-0037-rtl8xxxu-Improve-register-description-for-REG_FPGA1_.patch b/package/kernel/mac80211/patches/653-0037-rtl8xxxu-Improve-register-description-for-REG_FPGA1_.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0037-rtl8xxxu-Improve-register-description-for-REG_FPGA1_.patch
rename to package/kernel/mac80211/patches/653-0037-rtl8xxxu-Improve-register-description-for-REG_FPGA1_.patch
diff --git a/package/kernel/mac80211/patches/660-0038-rtl8xxxu-properly-detect-RTL8188EU-devices.patch b/package/kernel/mac80211/patches/653-0038-rtl8xxxu-properly-detect-RTL8188EU-devices.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0038-rtl8xxxu-properly-detect-RTL8188EU-devices.patch
rename to package/kernel/mac80211/patches/653-0038-rtl8xxxu-properly-detect-RTL8188EU-devices.patch
diff --git a/package/kernel/mac80211/patches/660-0039-rtl8xxxu-Implement-8188eu-specific-8051-reset-functi.patch b/package/kernel/mac80211/patches/653-0039-rtl8xxxu-Implement-8188eu-specific-8051-reset-functi.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0039-rtl8xxxu-Implement-8188eu-specific-8051-reset-functi.patch
rename to package/kernel/mac80211/patches/653-0039-rtl8xxxu-Implement-8188eu-specific-8051-reset-functi.patch
diff --git a/package/kernel/mac80211/patches/660-0040-rtl8xxxu-Disable-packet-DMA-aggregation-on-8188eu.patch b/package/kernel/mac80211/patches/653-0040-rtl8xxxu-Disable-packet-DMA-aggregation-on-8188eu.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0040-rtl8xxxu-Disable-packet-DMA-aggregation-on-8188eu.patch
rename to package/kernel/mac80211/patches/653-0040-rtl8xxxu-Disable-packet-DMA-aggregation-on-8188eu.patch
diff --git a/package/kernel/mac80211/patches/660-0041-rtl8xxxu-8188eu-set-REG_OFDM0_XA_AGC_CORE1-to-match-.patch b/package/kernel/mac80211/patches/653-0041-rtl8xxxu-8188eu-set-REG_OFDM0_XA_AGC_CORE1-to-match-.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0041-rtl8xxxu-8188eu-set-REG_OFDM0_XA_AGC_CORE1-to-match-.patch
rename to package/kernel/mac80211/patches/653-0041-rtl8xxxu-8188eu-set-REG_OFDM0_XA_AGC_CORE1-to-match-.patch
diff --git a/package/kernel/mac80211/patches/660-0042-rtl8xxxu-Fix-rtl8188eu-connection-fail.patch b/package/kernel/mac80211/patches/653-0042-rtl8xxxu-Fix-rtl8188eu-connection-fail.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0042-rtl8xxxu-Fix-rtl8188eu-connection-fail.patch
rename to package/kernel/mac80211/patches/653-0042-rtl8xxxu-Fix-rtl8188eu-connection-fail.patch
diff --git a/package/kernel/mac80211/patches/660-0043-rtl8xxxu-Do-not-set-auto-rate-fallback-on-8188eu.patch b/package/kernel/mac80211/patches/653-0043-rtl8xxxu-Do-not-set-auto-rate-fallback-on-8188eu.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0043-rtl8xxxu-Do-not-set-auto-rate-fallback-on-8188eu.patch
rename to package/kernel/mac80211/patches/653-0043-rtl8xxxu-Do-not-set-auto-rate-fallback-on-8188eu.patch
diff --git a/package/kernel/mac80211/patches/660-0044-rtl8xxxu-Enable-8188eu-driver.patch b/package/kernel/mac80211/patches/653-0044-rtl8xxxu-Enable-8188eu-driver.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0044-rtl8xxxu-Enable-8188eu-driver.patch
rename to package/kernel/mac80211/patches/653-0044-rtl8xxxu-Enable-8188eu-driver.patch
diff --git a/package/kernel/mac80211/patches/660-0045-rtl8xxxu-Add-rtl8188etv-to-USB-device-list.patch b/package/kernel/mac80211/patches/653-0045-rtl8xxxu-Add-rtl8188etv-to-USB-device-list.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0045-rtl8xxxu-Add-rtl8188etv-to-USB-device-list.patch
rename to package/kernel/mac80211/patches/653-0045-rtl8xxxu-Add-rtl8188etv-to-USB-device-list.patch
diff --git a/package/kernel/mac80211/patches/660-0046-rtl8xxxu-Add-sitecom-dongle-to-USB-device-list.patch b/package/kernel/mac80211/patches/653-0046-rtl8xxxu-Add-sitecom-dongle-to-USB-device-list.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0046-rtl8xxxu-Add-sitecom-dongle-to-USB-device-list.patch
rename to package/kernel/mac80211/patches/653-0046-rtl8xxxu-Add-sitecom-dongle-to-USB-device-list.patch
diff --git a/package/kernel/mac80211/patches/660-0047-rtl8xxxu-Implement-rtl8188eu_active_to_emu.patch b/package/kernel/mac80211/patches/653-0047-rtl8xxxu-Implement-rtl8188eu_active_to_emu.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0047-rtl8xxxu-Implement-rtl8188eu_active_to_emu.patch
rename to package/kernel/mac80211/patches/653-0047-rtl8xxxu-Implement-rtl8188eu_active_to_emu.patch
diff --git a/package/kernel/mac80211/patches/660-0048-rtl8xxxu-Implement-rtl8188eu_power_off.patch b/package/kernel/mac80211/patches/653-0048-rtl8xxxu-Implement-rtl8188eu_power_off.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0048-rtl8xxxu-Implement-rtl8188eu_power_off.patch
rename to package/kernel/mac80211/patches/653-0048-rtl8xxxu-Implement-rtl8188eu_power_off.patch
diff --git a/package/kernel/mac80211/patches/660-0049-rtl8xxxu-Add-rtl8188eu-USB-ID-for-D-Link-USB-GO-N150.patch b/package/kernel/mac80211/patches/653-0049-rtl8xxxu-Add-rtl8188eu-USB-ID-for-D-Link-USB-GO-N150.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0049-rtl8xxxu-Add-rtl8188eu-USB-ID-for-D-Link-USB-GO-N150.patch
rename to package/kernel/mac80211/patches/653-0049-rtl8xxxu-Add-rtl8188eu-USB-ID-for-D-Link-USB-GO-N150.patch
diff --git a/package/kernel/mac80211/patches/660-0050-rtl8xxxu-Clear-SYS_FUNC_UPLL-during-power-up-on-8188.patch b/package/kernel/mac80211/patches/653-0050-rtl8xxxu-Clear-SYS_FUNC_UPLL-during-power-up-on-8188.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0050-rtl8xxxu-Clear-SYS_FUNC_UPLL-during-power-up-on-8188.patch
rename to package/kernel/mac80211/patches/653-0050-rtl8xxxu-Clear-SYS_FUNC_UPLL-during-power-up-on-8188.patch
diff --git a/package/kernel/mac80211/patches/660-0051-rtl8xxxu-Early-enable-of-WEP-TKIP-security-on-8188eu.patch b/package/kernel/mac80211/patches/653-0051-rtl8xxxu-Early-enable-of-WEP-TKIP-security-on-8188eu.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0051-rtl8xxxu-Early-enable-of-WEP-TKIP-security-on-8188eu.patch
rename to package/kernel/mac80211/patches/653-0051-rtl8xxxu-Early-enable-of-WEP-TKIP-security-on-8188eu.patch
diff --git a/package/kernel/mac80211/patches/660-0052-rtl8xxxu-Correct-power-down-sequence-for-8188eu.patch b/package/kernel/mac80211/patches/653-0052-rtl8xxxu-Correct-power-down-sequence-for-8188eu.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0052-rtl8xxxu-Correct-power-down-sequence-for-8188eu.patch
rename to package/kernel/mac80211/patches/653-0052-rtl8xxxu-Correct-power-down-sequence-for-8188eu.patch
diff --git a/package/kernel/mac80211/patches/660-0053-rtl8xxxu-Reset-8188eu-REG_GPIO_MUXCFG-on-power-off.patch b/package/kernel/mac80211/patches/653-0053-rtl8xxxu-Reset-8188eu-REG_GPIO_MUXCFG-on-power-off.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0053-rtl8xxxu-Reset-8188eu-REG_GPIO_MUXCFG-on-power-off.patch
rename to package/kernel/mac80211/patches/653-0053-rtl8xxxu-Reset-8188eu-REG_GPIO_MUXCFG-on-power-off.patch
diff --git a/package/kernel/mac80211/patches/660-0054-rtl8xxxu-Handle-devices-with-a-smaller-LLT-buffer.patch b/package/kernel/mac80211/patches/653-0054-rtl8xxxu-Handle-devices-with-a-smaller-LLT-buffer.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0054-rtl8xxxu-Handle-devices-with-a-smaller-LLT-buffer.patch
rename to package/kernel/mac80211/patches/653-0054-rtl8xxxu-Handle-devices-with-a-smaller-LLT-buffer.patch
diff --git a/package/kernel/mac80211/patches/660-0055-rtl8xxxu-Fix-reloading-of-driver-for-8188eu-devices.patch b/package/kernel/mac80211/patches/653-0055-rtl8xxxu-Fix-reloading-of-driver-for-8188eu-devices.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0055-rtl8xxxu-Fix-reloading-of-driver-for-8188eu-devices.patch
rename to package/kernel/mac80211/patches/653-0055-rtl8xxxu-Fix-reloading-of-driver-for-8188eu-devices.patch
diff --git a/package/kernel/mac80211/patches/660-0056-rtl8xxxu-Make-sure-to-enable-OFDM-paths-for-8188eu-i.patch b/package/kernel/mac80211/patches/653-0056-rtl8xxxu-Make-sure-to-enable-OFDM-paths-for-8188eu-i.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0056-rtl8xxxu-Make-sure-to-enable-OFDM-paths-for-8188eu-i.patch
rename to package/kernel/mac80211/patches/653-0056-rtl8xxxu-Make-sure-to-enable-OFDM-paths-for-8188eu-i.patch
diff --git a/package/kernel/mac80211/patches/660-0057-rtl8xxxu-Add-rpt_sel-entry-to-struct-rtl8xxxu_rxdesc.patch b/package/kernel/mac80211/patches/653-0057-rtl8xxxu-Add-rpt_sel-entry-to-struct-rtl8xxxu_rxdesc.patch
similarity index 100%
rename from package/kernel/mac80211/patches/660-0057-rtl8xxxu-Add-rpt_sel-entry-to-struct-rtl8xxxu_rxdesc.patch
rename to package/kernel/mac80211/patches/653-0057-rtl8xxxu-Add-rpt_sel-entry-to-struct-rtl8xxxu_rxdesc.patch
diff --git a/package/kernel/mac80211/patches/654-0001-rtl8xxxu-Reset-device-on-module-unload-if-still-atta.patch b/package/kernel/mac80211/patches/654-0001-rtl8xxxu-Reset-device-on-module-unload-if-still-atta.patch
deleted file mode 100644
index a9ae368dbf..0000000000
--- a/package/kernel/mac80211/patches/654-0001-rtl8xxxu-Reset-device-on-module-unload-if-still-atta.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 54cdf5c727cb3d3124e61433a13e9724a7a4a952 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Fri, 9 Sep 2016 14:01:24 -0400
-Subject: [PATCH] rtl8xxxu: Reset device on module unload if still attached
-
-If the USB dongle is still attached, reset it on module unload to
-avoid scans failing when reloading the driver.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -6129,6 +6129,11 @@ static void rtl8xxxu_disconnect(struct u
- 	mutex_destroy(&priv->usb_buf_mutex);
- 	mutex_destroy(&priv->h2c_mutex);
- 
-+	if (priv->udev->state != USB_STATE_NOTATTACHED) {
-+		dev_info(&priv->udev->dev,
-+			 "Device still attached, trying to reset\n");
-+		usb_reset_device(priv->udev);
-+	}
- 	usb_put_dev(priv->udev);
- 	ieee80211_free_hw(hw);
- }
diff --git a/package/kernel/mac80211/patches/654-0002-rtl8xxxu-fix-spelling-mistake-firmare-firmware.patch b/package/kernel/mac80211/patches/654-0002-rtl8xxxu-fix-spelling-mistake-firmare-firmware.patch
deleted file mode 100644
index afe6cd0680..0000000000
--- a/package/kernel/mac80211/patches/654-0002-rtl8xxxu-fix-spelling-mistake-firmare-firmware.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 0cd7f70399f71fdd87b34d28670248c36e4db455 Mon Sep 17 00:00:00 2001
-From: Colin Ian King <colin.king@canonical.com>
-Date: Fri, 9 Sep 2016 14:01:25 -0400
-Subject: [PATCH] rtl8xxxu: fix spelling mistake "firmare" -> "firmware"
-
-Trivial fix to spelling mistakes in dev_dbg message.
-
-Signed-off-by: Colin Ian King <colin.king@canonical.com>
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -3921,11 +3921,11 @@ static int rtl8xxxu_init_device(struct i
- 	rtl8xxxu_write16(priv, REG_TRXFF_BNDY + 2, priv->fops->trxff_boundary);
- 
- 	ret = rtl8xxxu_download_firmware(priv);
--	dev_dbg(dev, "%s: download_fiwmare %i\n", __func__, ret);
-+	dev_dbg(dev, "%s: download_firmware %i\n", __func__, ret);
- 	if (ret)
- 		goto exit;
- 	ret = rtl8xxxu_start_firmware(priv);
--	dev_dbg(dev, "%s: start_fiwmare %i\n", __func__, ret);
-+	dev_dbg(dev, "%s: start_firmware %i\n", __func__, ret);
- 	if (ret)
- 		goto exit;
- 
diff --git a/package/kernel/mac80211/patches/655-rtl8xxxu-Implement-8192e-specific-power-down-sequenc.patch b/package/kernel/mac80211/patches/655-rtl8xxxu-Implement-8192e-specific-power-down-sequenc.patch
deleted file mode 100644
index 8dcced6cb2..0000000000
--- a/package/kernel/mac80211/patches/655-rtl8xxxu-Implement-8192e-specific-power-down-sequenc.patch
+++ /dev/null
@@ -1,192 +0,0 @@
-From f1785fbf7c0bc17211c299a647ebc38968a42181 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Tue, 13 Sep 2016 15:03:15 -0400
-Subject: [PATCH] rtl8xxxu: Implement 8192e specific power down sequence
-
-This powers down the 8192e correctly, or at least to the point where
-the firmware will load again, when reloading the driver module.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 144 ++++++++++++++++++++-
- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h  |   1 +
- 2 files changed, 144 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
-@@ -1396,6 +1396,114 @@ exit:
- 	return ret;
- }
- 
-+static int rtl8192eu_active_to_lps(struct rtl8xxxu_priv *priv)
-+{
-+	struct device *dev = &priv->udev->dev;
-+	u8 val8;
-+	u16 val16;
-+	u32 val32;
-+	int retry, retval;
-+
-+	rtl8xxxu_write8(priv, REG_TXPAUSE, 0xff);
-+
-+	retry = 100;
-+	retval = -EBUSY;
-+	/*
-+	 * Poll 32 bit wide 0x05f8 for 0x00000000 to ensure no TX is pending.
-+	 */
-+	do {
-+		val32 = rtl8xxxu_read32(priv, REG_SCH_TX_CMD);
-+		if (!val32) {
-+			retval = 0;
-+			break;
-+		}
-+	} while (retry--);
-+
-+	if (!retry) {
-+		dev_warn(dev, "Failed to flush TX queue\n");
-+		retval = -EBUSY;
-+		goto out;
-+	}
-+
-+	/* Disable CCK and OFDM, clock gated */
-+	val8 = rtl8xxxu_read8(priv, REG_SYS_FUNC);
-+	val8 &= ~SYS_FUNC_BBRSTB;
-+	rtl8xxxu_write8(priv, REG_SYS_FUNC, val8);
-+
-+	udelay(2);
-+
-+	/* Reset whole BB */
-+	val8 = rtl8xxxu_read8(priv, REG_SYS_FUNC);
-+	val8 &= ~SYS_FUNC_BB_GLB_RSTN;
-+	rtl8xxxu_write8(priv, REG_SYS_FUNC, val8);
-+
-+	/* Reset MAC TRX */
-+	val16 = rtl8xxxu_read16(priv, REG_CR);
-+	val16 &= 0xff00;
-+	val16 |= (CR_HCI_TXDMA_ENABLE | CR_HCI_RXDMA_ENABLE);
-+	rtl8xxxu_write16(priv, REG_CR, val16);
-+
-+	val16 = rtl8xxxu_read16(priv, REG_CR);
-+	val16 &= ~CR_SECURITY_ENABLE;
-+	rtl8xxxu_write16(priv, REG_CR, val16);
-+
-+	val8 = rtl8xxxu_read8(priv, REG_DUAL_TSF_RST);
-+	val8 |= DUAL_TSF_TX_OK;
-+	rtl8xxxu_write8(priv, REG_DUAL_TSF_RST, val8);
-+
-+out:
-+	return retval;
-+}
-+
-+static int rtl8192eu_active_to_emu(struct rtl8xxxu_priv *priv)
-+{
-+	u8 val8;
-+	int count, ret = 0;
-+
-+	/* Turn off RF */
-+	rtl8xxxu_write8(priv, REG_RF_CTRL, 0);
-+
-+	/* Switch DPDT_SEL_P output from register 0x65[2] */
-+	val8 = rtl8xxxu_read8(priv, REG_LEDCFG2);
-+	val8 &= ~LEDCFG2_DPDT_SELECT;
-+	rtl8xxxu_write8(priv, REG_LEDCFG2, val8);
-+
-+	/* 0x0005[1] = 1 turn off MAC by HW state machine*/
-+	val8 = rtl8xxxu_read8(priv, REG_APS_FSMCO + 1);
-+	val8 |= BIT(1);
-+	rtl8xxxu_write8(priv, REG_APS_FSMCO + 1, val8);
-+
-+	for (count = RTL8XXXU_MAX_REG_POLL; count; count--) {
-+		val8 = rtl8xxxu_read8(priv, REG_APS_FSMCO + 1);
-+		if ((val8 & BIT(1)) == 0)
-+			break;
-+		udelay(10);
-+	}
-+
-+	if (!count) {
-+		dev_warn(&priv->udev->dev, "%s: Disabling MAC timed out\n",
-+			 __func__);
-+		ret = -EBUSY;
-+		goto exit;
-+	}
-+
-+exit:
-+	return ret;
-+}
-+
-+static int rtl8192eu_emu_to_disabled(struct rtl8xxxu_priv *priv)
-+{
-+	u8 val8;
-+
-+	/* 0x04[12:11] = 01 enable WL suspend */
-+	val8 = rtl8xxxu_read8(priv, REG_APS_FSMCO + 1);
-+	val8 &= ~(BIT(3) | BIT(4));
-+	val8 |= BIT(3);
-+	rtl8xxxu_write8(priv, REG_APS_FSMCO + 1, val8);
-+
-+	return 0;
-+}
-+
- static int rtl8192eu_power_on(struct rtl8xxxu_priv *priv)
- {
- 	u16 val16;
-@@ -1446,6 +1554,40 @@ exit:
- 	return ret;
- }
- 
-+void rtl8192eu_power_off(struct rtl8xxxu_priv *priv)
-+{
-+	u8 val8;
-+	u16 val16;
-+
-+	rtl8xxxu_flush_fifo(priv);
-+
-+	val8 = rtl8xxxu_read8(priv, REG_TX_REPORT_CTRL);
-+	val8 &= ~TX_REPORT_CTRL_TIMER_ENABLE;
-+	rtl8xxxu_write8(priv, REG_TX_REPORT_CTRL, val8);
-+
-+	/* Turn off RF */
-+	rtl8xxxu_write8(priv, REG_RF_CTRL, 0x00);
-+
-+	rtl8192eu_active_to_lps(priv);
-+
-+	/* Reset Firmware if running in RAM */
-+	if (rtl8xxxu_read8(priv, REG_MCU_FW_DL) & MCU_FW_RAM_SEL)
-+		rtl8xxxu_firmware_self_reset(priv);
-+
-+	/* Reset MCU */
-+	val16 = rtl8xxxu_read16(priv, REG_SYS_FUNC);
-+	val16 &= ~SYS_FUNC_CPU_ENABLE;
-+	rtl8xxxu_write16(priv, REG_SYS_FUNC, val16);
-+
-+	/* Reset MCU ready status */
-+	rtl8xxxu_write8(priv, REG_MCU_FW_DL, 0x00);
-+
-+	rtl8xxxu_reset_8051(priv);
-+
-+	rtl8192eu_active_to_emu(priv);
-+	rtl8192eu_emu_to_disabled(priv);
-+}
-+
- static void rtl8192e_enable_rf(struct rtl8xxxu_priv *priv)
- {
- 	u32 val32;
-@@ -1487,7 +1629,7 @@ struct rtl8xxxu_fileops rtl8192eu_fops =
- 	.parse_efuse = rtl8192eu_parse_efuse,
- 	.load_firmware = rtl8192eu_load_firmware,
- 	.power_on = rtl8192eu_power_on,
--	.power_off = rtl8xxxu_power_off,
-+	.power_off = rtl8192eu_power_off,
- 	.reset_8051 = rtl8xxxu_reset_8051,
- 	.llt_init = rtl8xxxu_auto_llt_table,
- 	.init_phy_bb = rtl8192eu_init_phy_bb,
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_regs.h
-@@ -676,6 +676,7 @@
- #define REG_SCH_TXCMD			0x05d0
- 
- /* define REG_FW_TSF_SYNC_CNT		0x04a0 */
-+#define REG_SCH_TX_CMD			0x05f8
- #define REG_FW_RESET_TSF_CNT_1		0x05fc
- #define REG_FW_RESET_TSF_CNT_0		0x05fd
- #define REG_FW_BCN_DIS_CNT		0x05fe
diff --git a/package/kernel/mac80211/patches/656-0001-rtl8xxxu-Fix-off-by-one-error-calculating-pubq.patch b/package/kernel/mac80211/patches/656-0001-rtl8xxxu-Fix-off-by-one-error-calculating-pubq.patch
deleted file mode 100644
index 9db015c099..0000000000
--- a/package/kernel/mac80211/patches/656-0001-rtl8xxxu-Fix-off-by-one-error-calculating-pubq.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 3a589fae4a2cff317c3cabd4f76578ffd2761808 Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Tue, 20 Sep 2016 21:19:26 -0400
-Subject: [PATCH] rtl8xxxu: Fix off by one error calculating pubq
-
-This was detected tracing the 8188eu driver, but doesn't seem to make
-any difference when using it.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -3869,7 +3869,7 @@ static void rtl8xxxu_init_queue_reserved
- 	val32 = (nq << RQPN_NPQ_SHIFT) | (eq << RQPN_EPQ_SHIFT);
- 	rtl8xxxu_write32(priv, REG_RQPN_NPQ, val32);
- 
--	pubq = fops->total_page_num - hq - lq - nq;
-+	pubq = fops->total_page_num - hq - lq - nq - 1;
- 
- 	val32 = RQPN_LOAD;
- 	val32 |= (hq << RQPN_HI_PQ_SHIFT);
diff --git a/package/kernel/mac80211/patches/656-0002-rtl8xxxu-Clean-up-llt_init-API.patch b/package/kernel/mac80211/patches/656-0002-rtl8xxxu-Clean-up-llt_init-API.patch
deleted file mode 100644
index 61e509a7b4..0000000000
--- a/package/kernel/mac80211/patches/656-0002-rtl8xxxu-Clean-up-llt_init-API.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From c0a99bbb1b7a11605a53f84f5c444be3ef25a8ab Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Tue, 20 Sep 2016 21:19:27 -0400
-Subject: [PATCH] rtl8xxxu: Clean up llt_init() API
-
-Remove last_tx_page argument from the llt_init() function. The
-rtl8xxxu_fileops structure contains the correct TX_TOTAL_PAGE_NUM
-value for the device, and rtl8xxxu_auto_llt_table() doesn't need to
-know the value in the first place.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h      | 6 +++---
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 9 ++++++---
- 2 files changed, 9 insertions(+), 6 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-@@ -1318,7 +1318,7 @@ struct rtl8xxxu_fileops {
- 	int (*power_on) (struct rtl8xxxu_priv *priv);
- 	void (*power_off) (struct rtl8xxxu_priv *priv);
- 	void (*reset_8051) (struct rtl8xxxu_priv *priv);
--	int (*llt_init) (struct rtl8xxxu_priv *priv, u8 last_tx_page);
-+	int (*llt_init) (struct rtl8xxxu_priv *priv);
- 	void (*init_phy_bb) (struct rtl8xxxu_priv *priv);
- 	int (*init_phy_rf) (struct rtl8xxxu_priv *priv);
- 	void (*phy_init_antenna_selection) (struct rtl8xxxu_priv *priv);
-@@ -1400,14 +1400,14 @@ int rtl8xxxu_load_firmware(struct rtl8xx
- void rtl8xxxu_firmware_self_reset(struct rtl8xxxu_priv *priv);
- void rtl8xxxu_power_off(struct rtl8xxxu_priv *priv);
- void rtl8xxxu_reset_8051(struct rtl8xxxu_priv *priv);
--int rtl8xxxu_auto_llt_table(struct rtl8xxxu_priv *priv, u8 last_tx_page);
-+int rtl8xxxu_auto_llt_table(struct rtl8xxxu_priv *priv);
- void rtl8xxxu_gen2_prepare_calibrate(struct rtl8xxxu_priv *priv, u8 start);
- int rtl8xxxu_flush_fifo(struct rtl8xxxu_priv *priv);
- int rtl8xxxu_gen2_h2c_cmd(struct rtl8xxxu_priv *priv,
- 			  struct h2c_cmd *h2c, int len);
- int rtl8xxxu_active_to_lps(struct rtl8xxxu_priv *priv);
- void rtl8xxxu_disabled_to_emu(struct rtl8xxxu_priv *priv);
--int rtl8xxxu_init_llt_table(struct rtl8xxxu_priv *priv, u8 last_tx_page);
-+int rtl8xxxu_init_llt_table(struct rtl8xxxu_priv *priv);
- void rtl8xxxu_gen1_phy_iq_calibrate(struct rtl8xxxu_priv *priv);
- void rtl8xxxu_gen1_init_phy_bb(struct rtl8xxxu_priv *priv);
- void rtl8xxxu_gen1_set_tx_power(struct rtl8xxxu_priv *priv,
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -2472,10 +2472,13 @@ static int rtl8xxxu_llt_write(struct rtl
- 	return ret;
- }
- 
--int rtl8xxxu_init_llt_table(struct rtl8xxxu_priv *priv, u8 last_tx_page)
-+int rtl8xxxu_init_llt_table(struct rtl8xxxu_priv *priv)
- {
- 	int ret;
- 	int i;
-+	u8 last_tx_page;
-+
-+	last_tx_page = priv->fops->total_page_num;
- 
- 	for (i = 0; i < last_tx_page; i++) {
- 		ret = rtl8xxxu_llt_write(priv, i, i + 1);
-@@ -2503,7 +2506,7 @@ exit:
- 	return ret;
- }
- 
--int rtl8xxxu_auto_llt_table(struct rtl8xxxu_priv *priv, u8 last_tx_page)
-+int rtl8xxxu_auto_llt_table(struct rtl8xxxu_priv *priv)
- {
- 	u32 val32;
- 	int ret = 0;
-@@ -3988,7 +3991,7 @@ static int rtl8xxxu_init_device(struct i
- 
- 	dev_dbg(dev, "%s: macpower %i\n", __func__, macpower);
- 	if (!macpower) {
--		ret = priv->fops->llt_init(priv, TX_TOTAL_PAGE_NUM);
-+		ret = priv->fops->llt_init(priv);
- 		if (ret) {
- 			dev_warn(dev, "%s: LLT table init failed\n", __func__);
- 			goto exit;
diff --git a/package/kernel/mac80211/patches/656-0003-rtl8xxxu-Use-a-struct-rtl8xxxu_fileops-in-rtl8xxxu_i.patch b/package/kernel/mac80211/patches/656-0003-rtl8xxxu-Use-a-struct-rtl8xxxu_fileops-in-rtl8xxxu_i.patch
deleted file mode 100644
index c423a2c544..0000000000
--- a/package/kernel/mac80211/patches/656-0003-rtl8xxxu-Use-a-struct-rtl8xxxu_fileops-in-rtl8xxxu_i.patch
+++ /dev/null
@@ -1,150 +0,0 @@
-From 2fc5dd27bf9b75d83a7071d13cca044bc39748fb Mon Sep 17 00:00:00 2001
-From: Jes Sorensen <Jes.Sorensen@redhat.com>
-Date: Tue, 20 Sep 2016 21:19:28 -0400
-Subject: [PATCH] rtl8xxxu: Use a struct rtl8xxxu_fileops * in
- rtl8xxxu_init_device()
-
-This saves some 217, or about, derefences of priv->fops.
-
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c  | 37 +++++++++++-----------
- 1 file changed, 19 insertions(+), 18 deletions(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -3886,6 +3886,7 @@ static int rtl8xxxu_init_device(struct i
- {
- 	struct rtl8xxxu_priv *priv = hw->priv;
- 	struct device *dev = &priv->udev->dev;
-+	struct rtl8xxxu_fileops *fops = priv->fops;
- 	bool macpower;
- 	int ret;
- 	u8 val8;
-@@ -3904,7 +3905,7 @@ static int rtl8xxxu_init_device(struct i
- 	else
- 		macpower = true;
- 
--	ret = priv->fops->power_on(priv);
-+	ret = fops->power_on(priv);
- 	if (ret < 0) {
- 		dev_warn(dev, "%s: Failed power on\n", __func__);
- 		goto exit;
-@@ -3921,7 +3922,7 @@ static int rtl8xxxu_init_device(struct i
- 	/*
- 	 * Set RX page boundary
- 	 */
--	rtl8xxxu_write16(priv, REG_TRXFF_BNDY + 2, priv->fops->trxff_boundary);
-+	rtl8xxxu_write16(priv, REG_TRXFF_BNDY + 2, fops->trxff_boundary);
- 
- 	ret = rtl8xxxu_download_firmware(priv);
- 	dev_dbg(dev, "%s: download_firmware %i\n", __func__, ret);
-@@ -3932,8 +3933,8 @@ static int rtl8xxxu_init_device(struct i
- 	if (ret)
- 		goto exit;
- 
--	if (priv->fops->phy_init_antenna_selection)
--		priv->fops->phy_init_antenna_selection(priv);
-+	if (fops->phy_init_antenna_selection)
-+		fops->phy_init_antenna_selection(priv);
- 
- 	ret = rtl8xxxu_init_mac(priv);
- 
-@@ -3946,7 +3947,7 @@ static int rtl8xxxu_init_device(struct i
- 	if (ret)
- 		goto exit;
- 
--	ret = priv->fops->init_phy_rf(priv);
-+	ret = fops->init_phy_rf(priv);
- 	if (ret)
- 		goto exit;
- 
-@@ -3971,7 +3972,7 @@ static int rtl8xxxu_init_device(struct i
- 		/*
- 		 * Set TX buffer boundary
- 		 */
--		val8 = priv->fops->total_page_num + 1;
-+		val8 = fops->total_page_num + 1;
- 
- 		rtl8xxxu_write8(priv, REG_TXPKTBUF_BCNQ_BDNY, val8);
- 		rtl8xxxu_write8(priv, REG_TXPKTBUF_MGQ_BDNY, val8);
-@@ -3984,14 +3985,14 @@ static int rtl8xxxu_init_device(struct i
- 	 * The vendor drivers set PBP for all devices, except 8192e.
- 	 * There is no explanation for this in any of the sources.
- 	 */
--	val8 = (priv->fops->pbp_rx << PBP_PAGE_SIZE_RX_SHIFT) |
--		(priv->fops->pbp_tx << PBP_PAGE_SIZE_TX_SHIFT);
-+	val8 = (fops->pbp_rx << PBP_PAGE_SIZE_RX_SHIFT) |
-+		(fops->pbp_tx << PBP_PAGE_SIZE_TX_SHIFT);
- 	if (priv->rtl_chip != RTL8192E)
- 		rtl8xxxu_write8(priv, REG_PBP, val8);
- 
- 	dev_dbg(dev, "%s: macpower %i\n", __func__, macpower);
- 	if (!macpower) {
--		ret = priv->fops->llt_init(priv);
-+		ret = fops->llt_init(priv);
- 		if (ret) {
- 			dev_warn(dev, "%s: LLT table init failed\n", __func__);
- 			goto exit;
-@@ -4000,12 +4001,12 @@ static int rtl8xxxu_init_device(struct i
- 		/*
- 		 * Chip specific quirks
- 		 */
--		priv->fops->usb_quirks(priv);
-+		fops->usb_quirks(priv);
- 
- 		/*
- 		 * Enable TX report and TX report timer for 8723bu/8188eu/...
- 		 */
--		if (priv->fops->has_tx_report) {
-+		if (fops->has_tx_report) {
- 			val8 = rtl8xxxu_read8(priv, REG_TX_REPORT_CTRL);
- 			val8 |= TX_REPORT_CTRL_TIMER_ENABLE;
- 			rtl8xxxu_write8(priv, REG_TX_REPORT_CTRL, val8);
-@@ -4140,8 +4141,8 @@ static int rtl8xxxu_init_device(struct i
- 		rtl8xxxu_write8(priv, REG_RSV_CTRL, val8);
- 	}
- 
--	if (priv->fops->init_aggregation)
--		priv->fops->init_aggregation(priv);
-+	if (fops->init_aggregation)
-+		fops->init_aggregation(priv);
- 
- 	/*
- 	 * Enable CCK and OFDM block
-@@ -4158,7 +4159,7 @@ static int rtl8xxxu_init_device(struct i
- 	/*
- 	 * Start out with default power levels for channel 6, 20MHz
- 	 */
--	priv->fops->set_tx_power(priv, 1, false);
-+	fops->set_tx_power(priv, 1, false);
- 
- 	/* Let the 8051 take control of antenna setting */
- 	if (priv->rtl_chip != RTL8192E) {
-@@ -4174,8 +4175,8 @@ static int rtl8xxxu_init_device(struct i
- 
- 	rtl8xxxu_write16(priv, REG_FAST_EDCA_CTRL, 0);
- 
--	if (priv->fops->init_statistics)
--		priv->fops->init_statistics(priv);
-+	if (fops->init_statistics)
-+		fops->init_statistics(priv);
- 
- 	if (priv->rtl_chip == RTL8192E) {
- 		/*
-@@ -4193,12 +4194,12 @@ static int rtl8xxxu_init_device(struct i
- 
- 	rtl8723a_phy_lc_calibrate(priv);
- 
--	priv->fops->phy_iq_calibrate(priv);
-+	fops->phy_iq_calibrate(priv);
- 
- 	/*
- 	 * This should enable thermal meter
- 	 */
--	if (priv->fops->gen2_thermal_meter)
-+	if (fops->gen2_thermal_meter)
- 		rtl8xxxu_write_rfreg(priv,
- 				     RF_A, RF6052_REG_T_METER_8723B, 0x37cf8);
- 	else
diff --git a/package/kernel/mac80211/patches/656-0004-rtl8xxxu-Stop-log-spam-from-each-successful-interrup.patch b/package/kernel/mac80211/patches/656-0004-rtl8xxxu-Stop-log-spam-from-each-successful-interrup.patch
deleted file mode 100644
index e8d158ccf1..0000000000
--- a/package/kernel/mac80211/patches/656-0004-rtl8xxxu-Stop-log-spam-from-each-successful-interrup.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From b42fbed6b8a5942e9f76ec8c7f9c9fd798a2d3af Mon Sep 17 00:00:00 2001
-From: Larry Finger <Larry.Finger@lwfinger.net>
-Date: Tue, 20 Sep 2016 21:19:29 -0400
-Subject: [PATCH] rtl8xxxu: Stop log spam from each successful interrupt
-
-As soon as debugging is turned on, the logs are filled with messages
-reporting the interrupt status. As this quantity is usually zero, this
-output is not needed. In fact, there will be a report if the status is
-not zero, thus the debug line in question could probably be deleted.
-Rather than taking that action, I have changed it to only be printed
-when the newly added RTL8XXXU_DEBUG_INTERRUPT bit is set in the debug
-mask.
-
-Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
-Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h      | 1 +
- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 3 ++-
- 2 files changed, 3 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-@@ -29,6 +29,7 @@
- #define RTL8XXXU_DEBUG_H2C		0x800
- #define RTL8XXXU_DEBUG_ACTION		0x1000
- #define RTL8XXXU_DEBUG_EFUSE		0x2000
-+#define RTL8XXXU_DEBUG_INTERRUPT	0x4000
- 
- #define RTW_USB_CONTROL_MSG_TIMEOUT	500
- #define RTL8XXXU_MAX_REG_POLL		500
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -5375,7 +5375,8 @@ static void rtl8xxxu_int_complete(struct
- 	struct device *dev = &priv->udev->dev;
- 	int ret;
- 
--	dev_dbg(dev, "%s: status %i\n", __func__, urb->status);
-+	if (rtl8xxxu_debug & RTL8XXXU_DEBUG_INTERRUPT)
-+		dev_dbg(dev, "%s: status %i\n", __func__, urb->status);
- 	if (urb->status == 0) {
- 		usb_anchor_urb(urb, &priv->int_anchor);
- 		ret = usb_submit_urb(urb, GFP_ATOMIC);
diff --git a/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch b/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
index 02f3053b2f..40e1f9f30c 100644
--- a/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
+++ b/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/libertas/cfg.c
 +++ b/drivers/net/wireless/marvell/libertas/cfg.c
-@@ -2122,6 +2122,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
+@@ -2127,6 +2127,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
  		goto err_wiphy_new;
  	}
  
diff --git a/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch b/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
index ad306083da..04b4954d29 100644
--- a/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
+++ b/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/libertas/cfg.c
 +++ b/drivers/net/wireless/marvell/libertas/cfg.c
-@@ -2212,6 +2212,8 @@ int lbs_cfg_register(struct lbs_private
+@@ -2217,6 +2217,8 @@ int lbs_cfg_register(struct lbs_private
  	wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
  	wdev->wiphy->reg_notifier = lbs_reg_notifier;
  
diff --git a/package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch b/package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch
index 26ef5c7426..6df1236222 100644
--- a/package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch
+++ b/package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch
@@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2780,6 +2780,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+@@ -2784,6 +2784,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
  	 * preference in cfg struct to apply this to
  	 * FW later while initializing the dongle
  	 */
diff --git a/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
index e842d612b7..e417eb8ffa 100644
--- a/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
@@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
 
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -2107,6 +2107,16 @@ int ath10k_core_register(struct ath10k *
+@@ -2220,6 +2220,16 @@ int ath10k_core_register(struct ath10k *
  	ar->chip_id = chip_id;
  	queue_work(ar->workqueue, &ar->register_work);
  
diff --git a/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch b/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
index a501b998d0..3177c812fb 100644
--- a/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
+++ b/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -7742,6 +7742,21 @@ struct ath10k_vif *ath10k_get_arvif(stru
+@@ -7815,6 +7815,21 @@ struct ath10k_vif *ath10k_get_arvif(stru
  	return arvif_iter.arvif;
  }
  
@@ -22,7 +22,7 @@
  int ath10k_mac_register(struct ath10k *ar)
  {
  	static const u32 cipher_suites[] = {
-@@ -7975,6 +7990,12 @@ int ath10k_mac_register(struct ath10k *a
+@@ -8048,6 +8063,12 @@ int ath10k_mac_register(struct ath10k *a
  	ar->hw->wiphy->cipher_suites = cipher_suites;
  	ar->hw->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
  
diff --git a/package/kernel/mac80211/patches/936-ath10k_skip_otp_check.patch b/package/kernel/mac80211/patches/936-ath10k_skip_otp_check.patch
index 596ef98639..fbda8d5ac1 100644
--- a/package/kernel/mac80211/patches/936-ath10k_skip_otp_check.patch
+++ b/package/kernel/mac80211/patches/936-ath10k_skip_otp_check.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -1243,9 +1243,6 @@ static int ath10k_core_fetch_firmware_fi
+@@ -1282,9 +1282,6 @@ static int ath10k_core_fetch_firmware_fi
  {
  	int ret;
  
@@ -10,7 +10,7 @@
  	ar->fw_api = 5;
  	ath10k_dbg(ar, ATH10K_DBG_BOOT, "trying fw api %d\n", ar->fw_api);
  
-@@ -1944,7 +1941,7 @@ EXPORT_SYMBOL(ath10k_core_stop);
+@@ -2054,7 +2051,7 @@ EXPORT_SYMBOL(ath10k_core_stop);
  static int ath10k_core_probe_fw(struct ath10k *ar)
  {
  	struct bmi_target_info target_info;
@@ -19,7 +19,7 @@
  
  	ret = ath10k_hif_power_up(ar);
  	if (ret) {
-@@ -1968,6 +1965,9 @@ static int ath10k_core_probe_fw(struct a
+@@ -2078,6 +2075,9 @@ static int ath10k_core_probe_fw(struct a
  		goto err_power_down;
  	}
  
@@ -29,7 +29,7 @@
  	ret = ath10k_core_fetch_firmware_files(ar);
  	if (ret) {
  		ath10k_err(ar, "could not fetch firmware files (%d)\n", ret);
-@@ -1990,11 +1990,14 @@ static int ath10k_core_probe_fw(struct a
+@@ -2100,11 +2100,14 @@ static int ath10k_core_probe_fw(struct a
  			   "could not load pre cal data: %d\n", ret);
  	}