From 4d1bf340d13f9087831b224c50e30dd346421f4e Mon Sep 17 00:00:00 2001
From: coolsnowwolf <coolsnowwolf@gmail.com>
Date: Wed, 26 Sep 2018 23:33:12 +0800
Subject: [PATCH] wireless drivers upgreade to 4.19-rc4-1. fix many MTK driver
 issue. ath10k change to ath10k-ct

---
 package/firmware/ath10k-firmware/Makefile     |   14 +-
 package/firmware/linux-firmware/Makefile      |    8 +-
 package/firmware/linux-firmware/qca_ath10k.mk |  105 ++
 package/kernel/ath10k-ct/Makefile             |    2 +-
 .../081-ath10k-calibration-variant.patch      |    6 +-
 .../ath10k-ct/patches/100-kernel_compat.patch |   13 +-
 ...-IEs-for-variant-before-falling-back.patch |  207 +++-
 package/kernel/mac80211/Makefile              |   32 +-
 .../patches/005-revert-devcoredump.patch      |   11 -
 .../patches/006-fix-genl-multicast.patch      |   10 -
 .../007-fix-linux-verification-h.patch        |   11 -
 .../patches/008-fix-genl-family-id.patch      |   10 -
 .../mac80211/patches/015-ipw200-mtu.patch     |   34 -
 .../patches/060-no_local_ssb_bcma.patch       |  132 ---
 .../081-ath10k-calibration-variant.patch      |  111 --
 ...press-Unknown-eventid-36925-warnings.patch |   36 -
 ...00-use-TXOP_BACKOFF-for-probe-frames.patch |   45 -
 ...-IEs-for-variant-before-falling-back.patch |  237 ----
 ...h10k-fix-build-errors-with-CONFIG_PM.patch |   72 --
 ...y-free-requested-but-not-started-TX-.patch |   37 -
 ...-drop-frames-appearing-to-be-from-us.patch |   25 -
 ...mac-handle-FWHALT-mailbox-indication.patch |   60 -
 ...-packet-filtering-in-promiscuous-mod.patch |  133 ---
 ...leanup-brcmf_cfg80211_escan-function.patch |  133 ---
 ...cs_to_jiffies-instead-of-calculation.patch |   31 -
 ...rid-of-brcmf_cfg80211_escan-function.patch |   83 --
 ...-of-struct-brcmf_cfg80211_info-activ.patch |   86 --
 ...e-configuration-of-probe-request-IEs.patch |   55 -
 ...15-brcmfmac-add-CLM-download-support.patch |  434 -------
 ...driver-unbind-order-of-the-sdio-func.patch |   37 -
 ...fmac-Avoid-build-error-with-make-W-1.patch |   33 -
 ...-load-error-for-legacy-chips-when-us.patch |   40 -
 ...ral-scan-support-under-a-separate-co.patch |  103 --
 ...tral-scan-support-under-a-separate-c.patch |   91 --
 ....16-ath9k-discard-undersized-packets.patch |   25 -
 ...ameter-order-in-brcmf_sdiod_f0_write.patch |   39 -
 ...r-sizes-on-hardware-are-not-dependen.patch |  105 --
 ...ac-Split-brcmf_sdiod_regrw_helper-up.patch |  179 ---
 ...ean-up-brcmf_sdiod_set_sbaddr_window.patch |   62 -
 ...16-0005-brcmfmac-Remove-dead-IO-code.patch |   91 --
 ...brcmfmac-Remove-bandaid-for-SleepCSR.patch |   61 -
 ...fmac-Remove-brcmf_sdiod_request_data.patch |  344 ------
 ...brcmfmac-Fix-asymmetric-IO-functions.patch |   28 -
 ...0009-brcmfmac-Remove-noisy-debugging.patch |   53 -
 ...0010-brcmfmac-Rename-bcmerror-to-err.patch |   58 -
 ...Split-brcmf_sdiod_buffrw-function-up.patch |  143 ---
 ...espace-fixes-in-brcmf_sdiod_send_buf.patch |   34 -
 ...003-brcmfmac-Clarify-if-using-braces.patch |   36 -
 ...replace-old-IO-functions-with-simple.patch |  831 -------------
 ...c-Tidy-register-definitions-a-little.patch |   59 -
 ...brcmfmac-Remove-brcmf_sdiod_addrprep.patch |  190 ---
 ...unnecessary-call-to-brcmf_sdiod_set_.patch |   32 -
 ...v4.16-0008-brcmfmac-Cleanup-offsetof.patch |  134 ---
 ...16-0009-brcmfmac-Remove-unused-macro.patch |   26 -
 ...repeated-calls-to-brcmf_chip_get_cor.patch |  128 --
 ...rge-buffer-size-of-caps-to-512-bytes.patch |   44 -
 ...16-0001-brcmfmac-Remove-r-w-_sdreg32.patch |  227 ----
 ...name-buscore-to-core-for-consistency.patch |   33 -
 ...se-the-value-of-sbwad-in-use-for-som.patch |   82 --
 ...rectly-handle-accesses-to-SDIO-func0.patch |   45 -
 ...mac-Remove-func0-from-function-array.patch |  111 --
 ...ficient-and-slightly-easier-to-read-.patch |   40 -
 ...-function-index-with-function-pointe.patch |  347 ------
 ...8-brcmfmac-Clean-up-interrupt-macros.patch |   53 -
 ...-43455-save-restore-SR-feature-if-FW.patch |   27 -
 ...1-brcmfmac-Remove-array-of-functions.patch | 1043 -----------------
 ...ment-block-in-brcmf_sdio_buscore_rea.patch |   31 -
 ...brcmf_sdiod_buff_-read-write-functio.patch |  137 ---
 ...oing-memory-allocator-than-allocator.patch |   59 -
 ...EEE80211_TX_STATUS_HEADROOM-up-to-mu.patch |   26 -
 ...ames-with-unexpected-DS-bits-from-fa.patch |   21 -
 ...80211-support-AP-4-addr-mode-fast-rx.patch |   25 -
 ...-fast-rx-with-incompatible-PS-capabi.patch |   53 -
 ...-support-station-4-addr-mode-fast-rx.patch |   34 -
 ...7-mac80211-support-A-MSDU-in-fast-rx.patch |  256 ----
 ...bcdc-dcmd-api-does-not-return-value-.patch |   68 --
 ...rate-firmware-errors-from-i-o-errors.patch |  186 ---
 ...possibility-to-obtain-firmware-error.patch |   92 --
 ...P_DEVICE-ethernet-address-generation.patch |   64 -
 ...ter-Access-Point-Protocol-packets-by.patch |  157 ---
 ...-brcmfmac-Fix-check-for-ISO3166-code.patch |   29 -
 ...cmf_bus_preinit-call-just-after-chan.patch |   45 -
 ...location-of-control-rx-buffer-to-brc.patch |   69 --
 ...cmf_attach-just-before-calling-brcmf.patch |  106 --
 ...l-brcmf_usb_up-during-brcmf_bus_prei.patch |   41 -
 ...move-brcmf_attach-function-in-core.c.patch |  130 --
 ...emove-brcmf_bus_started-from-bus-api.patch |  190 ---
 ...log-level-for-some-low-level-sdio-fu.patch |   64 -
 ...duplicate-pointer-variable-from-brcm.patch |  126 --
 ...17-0001-brcmfmac-reject-too-long-PSK.patch |   27 -
 ...convert-linux-error-to-firmware-erro.patch |   31 -
 ...mf_chip_name-to-store-name-in-revinf.patch |  203 ----
 ...-use-brcmf_chip_name-for-consistency.patch |   69 --
 ...e-struct-brcmf_pub-instance-using-wi.patch |  452 -------
 ...brcmfmac-use-wiphy-debugfs-dir-entry.patch |  349 ------
 ...firmware-filenames-from-basename-map.patch |  286 -----
 ...ass-struct-in-brcmf_fw_get_firmwares.patch |  574 ---------
 ...duce-brcmf_fw_alloc_request-function.patch |  328 ------
 ...d-extension-to-.get_fwname-callbacks.patch |  231 ----
 ...get-rid-of-brcmf_fw_map_chip_to_name.patch |   92 --
 ...ac-get-rid-of-brcmf_fw_get_full_name.patch |   44 -
 ...erneldoc-for-struct-brcmf_bus-msgbuf.patch |   23 -
 ...mware-request-processing-if-nvram-lo.patch |   81 --
 ...mac-add-support-for-BCM4366E-chipset.patch |   48 -
 ...-check-p2pdev-mac-address-uniqueness.patch |   34 -
 ...orts-boottime_ns-while-informing-bss.patch |   76 --
 ...0211_band-directly-to-get-ieee80211-.patch |   43 -
 ...mac-constify-firmware-mapping-tables.patch |   76 --
 ...05-brcmfmac-add-hostready-indication.patch |   74 --
 ...support-for-PCIe-shared-structure-re.patch |   97 --
 ...upport-for-bcm43364-wireless-chipset.patch |   45 -
 ...fmac-set-WIPHY_FLAG_HAVE_AP_SME-flag.patch |   34 -
 ...tialization-of-struct-cfg80211_infor.patch |   29 -
 ...ugfs-entry-for-reading-firmware-capa.patch |   75 --
 ...ALLFFMAC-variable-in-flowring-module.patch |   52 -
 ...support-for-sysfs-initiated-coredump.patch |   76 --
 ...e-user-provided-data-for-memdump-bef.patch |   32 -
 ...-memory-dump-upon-firmware-halt-sign.patch |   38 -
 ...-memory-dump-on-SDIO-firmware-halt-m.patch |   30 -
 ...tchdog-before-detach-and-free-everyt.patch |   70 --
 ...ression-in-parsing-NVRAM-for-multipl.patch |   41 -
 ...firmware-support-for-monitor-interfa.patch |   59 -
 ...firmware-support-for-radiotap-monito.patch |   51 -
 ...msgbuf-packets-marked-with-monitor-m.patch |  137 ---
 ...more-bits-for-the-flags-of-struct-br.patch |   60 -
 ...mac-update-STA-info-struct-to-the-v5.patch |   75 --
 ...y-some-features-per-firmware-version.patch |   84 --
 ...ctral-scan-enable-bit-on-trigger-for.patch |   21 -
 ...periodic-and-nf-calibation-at-the-sa.patch |   27 -
 ...ata-bit-in-PS-buffered-frame-release.patch |   50 -
 ...ntially-stale-EOSP-status-bit-in-int.patch |   22 -
 .../362-ath9k-report-tx-status-on-EOSP.patch  |   19 -
 ...fix-block-ack-window-tracking-issues.patch |  114 --
 ...fix-channel-maximum-power-level-test.patch |   47 -
 ...ata-flag-for-buffered-multicast-pack.patch |   41 -
 ...sable-wake_tx_queue-for-older-device.patch |   27 -
 ...-fix-recent-bandwidth-conversion-bug.patch |   61 -
 ...e-only-1Mbps-for-basic-rates-in-mesh.patch |   55 -
 ...tect-queue-draining-by-rcu_read_lock.patch |   43 -
 ...ialize-sinfo-in-cfg80211_get_station.patch |   42 -
 ...-0000-ath10k-handle-tdls-peer-events.patch |  115 --
 ...odify-svc-bitmap-parsing-for-wcn3990.patch |  215 ----
 ...-TDLS-wider-bandwidth-support-for-5G.patch |   64 -
 ...upport-to-get-final-TPC-stats-for-10.patch |  824 -------------
 ...l-panic-while-using-worker-ath10k_st.patch |   99 --
 ...kernel-panic-while-reading-tpc_stats.patch |  119 --
 ...port-to-configure-channel-dwell-time.patch |   92 --
 ...to-get-the-detected-radar-specificat.patch |   94 --
 ...80-0008-ath10k-DFS-Host-Confirmation.patch |  546 ---------
 ...-ath10k-fix-memory-leak-of-tpc_stats.patch |   43 -
 ...10-ath10k-support-use-of-channel-173.patch |   52 -
 ...ral-scan-for-QCA9984-and-QCA9888-chi.patch |  156 ---
 ...-teardown-code-before-de-registering.patch |   38 -
 ...x-HWMP-sequence-numbering-to-follow-.patch |   28 -
 ...ernel-panic-when-building-AMSDU-from.patch |  102 --
 ..._update_ft_ies-to-validate-NL80211_A.patch |   27 -
 ...convert-to-A-MSDU-if-frag-subframe-l.patch |   37 -
 ...ys-account-for-A-MSDU-header-changes.patch |   51 -
 ...off-by-one-issue-in-A-MSDU-max_subfr.patch |   26 -
 ...ype-issue-in-ieee80211_chandef_to_op.patch |   33 -
 ...a-race-between-restart-and-CSA-flows.patch |   86 --
 ...tion-bandwidth-setting-after-channel.patch |   96 --
 ...x-a-deauth-frame-if-the-AP-forbade-T.patch |   78 --
 ...0211-shorten-the-IBSS-debug-messages.patch |   74 --
 ...o-add-a-workaround-for-spurious-TX_F.patch |  136 ---
 ...-mwl8k-add-non-DFS-5G-upper-channels.patch |   37 -
 ...0-0010-ath10k-limit-htt-rx-ring-size.patch |   11 -
 ...d-reported-build-errors-with-CONFIG_PM-off |   93 --
 ..._sdio_reinit_device-out-of-CONFIG_PM.patch |   96 --
 .../{ => ath}/070-ath_common_config.patch     |    0
 .../{ => ath}/080-ath10k_thermal_config.patch |   12 +-
 .../201-ath5k-WAR-for-AR71xx-PCI-bug.patch    |    0
 ...w-reset-AHB-WMAC-interface-on-AR91xx.patch |    2 +-
 ..._hw-issue-external-reset-for-QCA955x.patch |    4 +-
 ...h9k-force-rx_clear-when-disabling-rx.patch |    0
 ...erpret-requested-txpower-in-EIRP-dom.patch |    9 +-
 ...power-reduction-for-US-regulatory-do.patch |    6 +-
 ...fix-tx99-with-monitor-mode-interface.patch |    0
 ...upport-for-using-active-monitor-inte.patch |   96 ++
 .../{ => ath}/400-ath_move_debug_code.patch   |    4 +-
 .../{ => ath}/401-ath9k_blink_default.patch   |    2 +-
 .../{ => ath}/402-ath_regd_optional.patch     |    2 +-
 .../{ => ath}/403-world_regd_fixup.patch      |    0
 .../{ => ath}/404-regd_no_assoc_hints.patch   |    4 +-
 .../patches/{ => ath}/405-ath_regd_us.patch   |    6 +-
 .../406-ath_relax_default_regd.patch          |    0
 .../410-ath9k_allow_adhoc_and_ap.patch        |    2 +-
 .../411-ath5k_allow_adhoc_and_ap.patch        |    0
 .../{ => ath}/420-ath5k_disable_fast_cc.patch |    0
 .../{ => ath}/430-add_ath5k_platform.patch    |    0
 ...add_platform_eeprom_support_to_ath5k.patch |    0
 .../{ => ath}/432-ath5k_add_pciids.patch      |    0
 .../440-ath5k_channel_bw_debugfs.patch        |   13 +-
 .../{ => ath}/500-ath9k_eeprom_debugfs.patch  |    0
 .../{ => ath}/501-ath9k_ahb_init.patch        |    4 +-
 .../510-ath9k_intr_mitigation_tweak.patch     |    2 +-
 .../{ => ath}/511-ath9k_reduce_rxbuf.patch    |    0
 .../512-ath9k_channelbw_debugfs.patch         |    2 +-
 .../{ => ath}/513-ath9k_add_pci_ids.patch     |    4 +-
 .../{ => ath}/530-ath9k_extra_leds.patch      |    2 +-
 .../531-ath9k_extra_platform_leds.patch       |    0
 .../540-ath9k_reduce_ani_interval.patch       |    0
 .../{ => ath}/542-ath9k_debugfs_diag.patch    |    8 +-
 .../543-ath9k_entropy_from_adc.patch          |   10 +-
 ...544-ath9k-ar933x-usb-hang-workaround.patch |   10 +-
 .../{ => ath}/545-ath9k_ani_ws_detect.patch   |    2 +-
 .../547-ath9k_led_defstate_fix.patch          |    0
 .../548-ath9k_enable_gpio_chip.patch          |   17 +-
 .../549-ath9k_enable_gpio_buttons.patch       |    8 +-
 .../550-ath9k-disable-bands-via-dt.patch      |    2 +-
 .../551-ath9k_ubnt_uap_plus_hsr.patch         |    4 +-
 .../patches/{ => ath}/552-ahb_of.patch        |   14 +-
 ...21-ath10k_init_devices_synchronously.patch |    2 +-
 .../930-ath10k_add_tpt_led_trigger.patch      |    4 +-
 .../936-ath10k-fix-otp-failure-result.patch   |    2 +-
 ...0-0010-ath10k-limit-htt-rx-ring-size.patch |   11 +
 ...60-0011-ath10k-limit-pci-buffer-size.patch |    8 +-
 ...-of-peer_bw_rxnss_override-parameter.patch |   10 +-
 ...dling-for-VHT160-in-recent-firmwares.patch |    4 +-
 ...rolling-support-for-various-chipsets.patch |   58 +-
 ...75-ath10k-use-tpt-trigger-by-default.patch |    4 +-
 ...ilable-channels-via-DT-ieee80211-fre.patch |    4 +-
 .../{ => brcm}/040-brcmutil_option.patch      |    0
 ...cmfmac-add-CYW89342-mini-PCIe-device.patch |    0
 ...001-brcmfmac-fix-wrong-strnchr-usage.patch |    0
 ...r-proper-support-of-160MHz-bandwidth.patch |    0
 ...e-buffer-for-obtaining-firmware-capa.patch |    0
 .../810-b43-gpio-mask-module-option.patch     |    2 +-
 .../patches/{ => brcm}/811-b43_no_pio.patch   |    8 +-
 .../812-b43-add-antenna-control.patch         |    2 +-
 .../813-b43-reduce-number-of-RX-slots.patch   |    2 +-
 .../814-b43-only-use-gpio-0-1-for-led.patch   |    0
 ...815-b43-always-take-overlapping-devs.patch |    0
 ...-remove-extra-regulation-restriction.patch |    0
 ...-register-wiphy-s-during-module_init.patch |    0
 ...und-bug-with-some-inconsistent-BSSes.patch |    0
 ...62-brcmfmac-Disable-power-management.patch |    0
 ...-in-driver-tables-with-country-codes.patch |    0
 ...e-internal-roaming-engine-by-default.patch |    2 +-
 .../patches/{ => build}/000-fix_kconfig.patch |    0
 .../patches/{ => build}/001-fix_build.patch   |    0
 .../{ => build}/002-change_allconfig.patch    |    0
 .../003-remove_bogus_modparams.patch          |    0
 .../004-kconfig_backport_fix.patch            |    0
 .../build/005-revert-devcoredump.patch        |    8 +
 .../{ => build}/010-disable_rfkill.patch      |    0
 .../{ => build}/012-kernel_build_check.patch  |    0
 .../{ => build}/050-lib80211_option.patch     |    6 +-
 ...700-mwl8k-missing-pci-id-for-WNR854T.patch |    2 +-
 .../801-libertas-configure-sysfs-links.patch  |    2 +-
 .../802-libertas-set-wireless-macaddr.patch   |    2 +-
 ...940-mwl8k_init_devices_synchronously.patch |    4 +-
 .../{ => rt2x00}/030-rt2x00_options.patch     |    0
 ...to-build-rt2800soc-module-for-RT3883.patch |    0
 ...-rt2800lib-enable-support-for-RT3883.patch |    2 +-
 ...x00-rt2800lib-add-rf_vals-for-RF3853.patch |    4 +-
 ...ib-enable-VCO-calibration-for-RF3853.patch |    4 +-
 ...-add-channel-configuration-function-.patch |    4 +-
 ...2x00-rt2800lib-enable-RF3853-support.patch |    2 +-
 ...-add-MAC-register-initialization-for.patch |    6 +-
 ...-fix-rt2800soc_disable_radio-for-RT3.patch |    0
 ...-add-BBP-register-initialization-for.patch |    4 +-
 ...-add-RFCSR-initialization-for-RT3883.patch |    6 +-
 ...-use-the-extended-EEPROM-map-for-RT3.patch |    0
 ...ib-force-rf-type-to-RF3853-on-RT3883.patch |    2 +-
 ...-add-channel-configuration-code-for-.patch |   12 +-
 ...-fix-txpower_to_dev-function-for-RT3.patch |    2 +-
 ...-use-correct-txpower-calculation-fun.patch |    2 +-
 ...-hardcode-txmixer-gain-values-to-zer.patch |    4 +-
 ...b-use-correct-RT-XWI-size-for-RT3883.patch |    0
 ...-fix-antenna-configuration-for-RT388.patch |    2 +-
 ...-fix-LNA-gain-configuration-for-RT38.patch |    4 +-
 ...0-rt2800lib-fix-VGC-setup-for-RT3883.patch |    6 +-
 ...-fix-EEPROM-LNA-validation-for-RT388.patch |    6 +-
 ...-fix-txpower-compensation-for-RT3883.patch |    2 +-
 ...1-rt2x00-introduce-rt2x00_platform_h.patch |    0
 .../602-rt2x00-introduce-rt2x00eeprom.patch   |    4 +-
 .../603-rt2x00-of_load_eeprom_filename.patch  |    0
 ...om-on-SoC-from-a-mtd-device-defines-.patch |    0
 ...isabling_bands_through_platform_data.patch |    0
 ...07-rt2x00-add_platform_data_mac_addr.patch |    0
 ...00-allow_disabling_bands_through_dts.patch |    0
 ...c-loadable-via-OF-on-rt288x-305x-SoC.patch |    2 +-
 ...0-rt2x00-change-led-polarity-from-OF.patch |    2 +-
 .../611-rt2x00-add-AP+STA-support.patch       |    0
 ...dd-support-for-external-PA-on-MT7620.patch |    8 +-
 .../651-rt2x00-remove-unneccesary-code.patch  |    2 +-
 ...specific-txdone-txstatus-routines-to.patch |  356 ++++++
 ...se-txdone-txstatus-routines-from-lib.patch |  243 ++++
 ...eck-for-txstatus-timeout-every-time-.patch |   71 ++
 ...rent-txstatus-timeouts-when-flushing.patch |  111 ++
 ...h-and-txstatus-rework-for-rt2800mmio.patch |  239 ++++
 ...0-reduce-power-consumption-on-mt7620.patch |   43 +
 ...-rt2x00-add-rf-self-txdc-calibration.patch |   89 ++
 .../rt2x00/983-rt2x00-add-r-calibration.patch |  193 +++
 .../984-rt2x00-add-rxdcoc-calibration.patch   |  102 ++
 .../985-rt2x00-add-rxiq-calibration.patch     |  417 +++++++
 .../986-rt2x00-add-TX-LOFT-calibration.patch  | 1005 ++++++++++++++++
 .../100-remove-cryptoapi-dependencies.patch   |   24 +-
 .../110-mac80211_keep_keys_on_stop_ap.patch   |    2 +-
 .../120-cfg80211_allow_perm_addr_change.patch |    0
 .../{ => subsys}/130-disable-fils.patch       |    4 +-
 ...aes-cmac-switch-to-shash-CMAC-driver.patch |    0
 .../132-mac80211-remove-cmac-dependency.patch |    0
 .../{ => subsys}/140-tweak-TSQ-setting.patch  |    2 +-
 .../150-disable_addr_notifier.patch           |   18 +-
 .../patches/{ => subsys}/210-ap_scan.patch    |    2 +-
 ...0211-add-hdrlen-to-ieee80211_tx_data.patch |   24 +-
 ...80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch |   44 +-
 ...l-Enable-STBC-and-LDPC-for-VHT-Rates.patch |    2 +-
 ...l-remove-unnecessary-debugfs-cleanup.patch |   18 +-
 ...l-merge-with-minstrel_ht-always-enab.patch |   13 +-
 ...trel-reduce-minstrel_mcs_groups-size.patch |    0
 ...l-fix-using-short-preamble-CCK-rates.patch |    0
 ...rel-fix-CCK-rate-group-streams-value.patch |    0
 ...l-fix-sampling-reporting-of-CCK-rate.patch |    0
 ...l-do-not-sample-rates-3-times-slower.patch |    0
 ...ory-accounting-with-A-MSDU-aggregati.patch |   14 +-
 ...e-TXQs-for-active-monitor-interfaces.patch |   26 +
 .../522-mac80211_configure_antenna_gain.patch |   42 +-
 .../utils/iw/patches/001-nl80211_h_sync.patch |  624 +++++++++-
 .../ar71xx/image/generic-legacy-devices.mk    |   16 +-
 target/linux/ar71xx/image/generic-senao.mk    |    2 +-
 target/linux/ar71xx/image/generic-tp-link.mk  |   30 +-
 target/linux/ar71xx/image/generic-ubnt.mk     |    4 +-
 target/linux/ar71xx/image/generic.mk          |   36 +-
 target/linux/ar71xx/image/mikrotik.mk         |    4 +-
 target/linux/ar71xx/image/nand.mk             |    8 +-
 .../linux/ar71xx/image/tiny-legacy-devices.mk |    2 +-
 target/linux/ath79/image/generic-tp-link.mk   |    6 +-
 target/linux/ath79/image/generic-ubnt.mk      |    2 +-
 target/linux/ath79/image/generic.mk           |   10 +-
 target/linux/ipq40xx/Makefile                 |    4 +-
 target/linux/ipq40xx/image/Makefile           |    4 +-
 target/linux/ipq806x/Makefile                 |    2 +-
 target/linux/ipq806x/image/Makefile           |   24 +-
 target/linux/ipq806x/profiles/00-default.mk   |    2 +-
 target/linux/lantiq/image/Makefile            |    2 +-
 target/linux/mvebu/image/cortex-a9.mk         |    2 +-
 339 files changed, 4347 insertions(+), 17490 deletions(-)
 create mode 100644 package/firmware/linux-firmware/qca_ath10k.mk
 delete mode 100644 package/kernel/mac80211/patches/005-revert-devcoredump.patch
 delete mode 100644 package/kernel/mac80211/patches/006-fix-genl-multicast.patch
 delete mode 100644 package/kernel/mac80211/patches/007-fix-linux-verification-h.patch
 delete mode 100644 package/kernel/mac80211/patches/008-fix-genl-family-id.patch
 delete mode 100644 package/kernel/mac80211/patches/015-ipw200-mtu.patch
 delete mode 100644 package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
 delete mode 100644 package/kernel/mac80211/patches/081-ath10k-calibration-variant.patch
 delete mode 100644 package/kernel/mac80211/patches/082-ath10k-suppress-Unknown-eventid-36925-warnings.patch
 delete mode 100644 package/kernel/mac80211/patches/090-Revert-rt2800-use-TXOP_BACKOFF-for-probe-frames.patch
 delete mode 100644 package/kernel/mac80211/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch
 delete mode 100644 package/kernel/mac80211/patches/300-v4.15-ath10k-fix-build-errors-with-CONFIG_PM.patch
 delete mode 100644 package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch
 delete mode 100644 package/kernel/mac80211/patches/302-v4.15-mac80211-mesh-drop-frames-appearing-to-be-from-us.patch
 delete mode 100644 package/kernel/mac80211/patches/303-v4.15-0001-brcmfmac-handle-FWHALT-mailbox-indication.patch
 delete mode 100644 package/kernel/mac80211/patches/303-v4.15-0002-brcmfmac-disable-packet-filtering-in-promiscuous-mod.patch
 delete mode 100644 package/kernel/mac80211/patches/303-v4.15-0003-brcmfmac-cleanup-brcmf_cfg80211_escan-function.patch
 delete mode 100644 package/kernel/mac80211/patches/303-v4.15-0004-brcmfmac-use-msecs_to_jiffies-instead-of-calculation.patch
 delete mode 100644 package/kernel/mac80211/patches/303-v4.15-0005-brcmfmac-get-rid-of-brcmf_cfg80211_escan-function.patch
 delete mode 100644 package/kernel/mac80211/patches/303-v4.15-0006-brcmfmac-get-rid-of-struct-brcmf_cfg80211_info-activ.patch
 delete mode 100644 package/kernel/mac80211/patches/303-v4.15-0007-brcmfmac-move-configuration-of-probe-request-IEs.patch
 delete mode 100644 package/kernel/mac80211/patches/304-v4.15-brcmfmac-add-CLM-download-support.patch
 delete mode 100644 package/kernel/mac80211/patches/305-v4.15-brcmfmac-change-driver-unbind-order-of-the-sdio-func.patch
 delete mode 100644 package/kernel/mac80211/patches/306-v4.15-brcmfmac-Avoid-build-error-with-make-W-1.patch
 delete mode 100644 package/kernel/mac80211/patches/307-v4.15-brcmfmac-fix-CLM-load-error-for-legacy-chips-when-us.patch
 delete mode 100644 package/kernel/mac80211/patches/308-v4.16-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch
 delete mode 100644 package/kernel/mac80211/patches/309-v4.16-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch
 delete mode 100644 package/kernel/mac80211/patches/310-v4.16-ath9k-discard-undersized-packets.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0001-brcmfmac-Fix-parameter-order-in-brcmf_sdiod_f0_write.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0002-brcmfmac-Register-sizes-on-hardware-are-not-dependen.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0003-brcmfmac-Split-brcmf_sdiod_regrw_helper-up.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0004-brcmfmac-Clean-up-brcmf_sdiod_set_sbaddr_window.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0005-brcmfmac-Remove-dead-IO-code.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0006-brcmfmac-Remove-bandaid-for-SleepCSR.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0007-brcmfmac-Remove-brcmf_sdiod_request_data.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0008-brcmfmac-Fix-asymmetric-IO-functions.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0009-brcmfmac-Remove-noisy-debugging.patch
 delete mode 100644 package/kernel/mac80211/patches/311-v4.16-0010-brcmfmac-Rename-bcmerror-to-err.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0001-brcmfmac-Split-brcmf_sdiod_buffrw-function-up.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0002-brcmfmac-whitespace-fixes-in-brcmf_sdiod_send_buf.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0003-brcmfmac-Clarify-if-using-braces.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0004-brcmfmac-Rename-replace-old-IO-functions-with-simple.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0005-brcmfmac-Tidy-register-definitions-a-little.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0006-brcmfmac-Remove-brcmf_sdiod_addrprep.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0007-brcmfmac-remove-unnecessary-call-to-brcmf_sdiod_set_.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0008-brcmfmac-Cleanup-offsetof.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0009-brcmfmac-Remove-unused-macro.patch
 delete mode 100644 package/kernel/mac80211/patches/312-v4.16-0010-brcmfmac-Remove-repeated-calls-to-brcmf_chip_get_cor.patch
 delete mode 100644 package/kernel/mac80211/patches/313-v4.16-0001-brcmfmac-enlarge-buffer-size-of-caps-to-512-bytes.patch
 delete mode 100644 package/kernel/mac80211/patches/314-v4.16-0001-brcmfmac-Remove-r-w-_sdreg32.patch
 delete mode 100644 package/kernel/mac80211/patches/314-v4.16-0002-brcmfmac-Rename-buscore-to-core-for-consistency.patch
 delete mode 100644 package/kernel/mac80211/patches/314-v4.16-0003-brcmfmac-stabilise-the-value-of-sbwad-in-use-for-som.patch
 delete mode 100644 package/kernel/mac80211/patches/314-v4.16-0004-brcmfmac-Correctly-handle-accesses-to-SDIO-func0.patch
 delete mode 100644 package/kernel/mac80211/patches/314-v4.16-0005-brcmfmac-Remove-func0-from-function-array.patch
 delete mode 100644 package/kernel/mac80211/patches/314-v4.16-0006-brcmfmac-More-efficient-and-slightly-easier-to-read-.patch
 delete mode 100644 package/kernel/mac80211/patches/314-v4.16-0007-brcmfmac-Replace-function-index-with-function-pointe.patch
 delete mode 100644 package/kernel/mac80211/patches/314-v4.16-0008-brcmfmac-Clean-up-interrupt-macros.patch
 delete mode 100644 package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch
 delete mode 100644 package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch
 delete mode 100644 package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch
 delete mode 100644 package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch
 delete mode 100644 package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch
 delete mode 100644 package/kernel/mac80211/patches/318-v4.17-mac80211-round-IEEE80211_TX_STATUS_HEADROOM-up-to-mu.patch
 delete mode 100644 package/kernel/mac80211/patches/319-v4.17-0001-mac80211-drop-frames-with-unexpected-DS-bits-from-fa.patch
 delete mode 100644 package/kernel/mac80211/patches/319-v4.17-0002-mac80211-support-AP-4-addr-mode-fast-rx.patch
 delete mode 100644 package/kernel/mac80211/patches/319-v4.17-0003-mac80211-support-fast-rx-with-incompatible-PS-capabi.patch
 delete mode 100644 package/kernel/mac80211/patches/319-v4.17-0004-mac80211-support-station-4-addr-mode-fast-rx.patch
 delete mode 100644 package/kernel/mac80211/patches/320-v4.17-mac80211-support-A-MSDU-in-fast-rx.patch
 delete mode 100644 package/kernel/mac80211/patches/321-v4.16-0001-brcmfmac-assure-bcdc-dcmd-api-does-not-return-value-.patch
 delete mode 100644 package/kernel/mac80211/patches/321-v4.16-0002-brcmfmac-separate-firmware-errors-from-i-o-errors.patch
 delete mode 100644 package/kernel/mac80211/patches/322-v4.16-0001-brcmfmac-add-possibility-to-obtain-firmware-error.patch
 delete mode 100644 package/kernel/mac80211/patches/322-v4.16-0002-brcmfmac-fix-P2P_DEVICE-ethernet-address-generation.patch
 delete mode 100644 package/kernel/mac80211/patches/323-v4.16-0001-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch
 delete mode 100644 package/kernel/mac80211/patches/324-v4.16-0001-brcmfmac-Fix-check-for-ISO3166-code.patch
 delete mode 100644 package/kernel/mac80211/patches/325-v4.17-0001-brcmfmac-move-brcmf_bus_preinit-call-just-after-chan.patch
 delete mode 100644 package/kernel/mac80211/patches/325-v4.17-0002-brcmfmac-move-allocation-of-control-rx-buffer-to-brc.patch
 delete mode 100644 package/kernel/mac80211/patches/325-v4.17-0003-brcmfmac-call-brcmf_attach-just-before-calling-brcmf.patch
 delete mode 100644 package/kernel/mac80211/patches/325-v4.17-0004-brcmfmac-usb-call-brcmf_usb_up-during-brcmf_bus_prei.patch
 delete mode 100644 package/kernel/mac80211/patches/325-v4.17-0005-brcmfmac-move-brcmf_attach-function-in-core.c.patch
 delete mode 100644 package/kernel/mac80211/patches/325-v4.17-0006-brcmfmac-remove-brcmf_bus_started-from-bus-api.patch
 delete mode 100644 package/kernel/mac80211/patches/325-v4.17-0007-brcmfmac-change-log-level-for-some-low-level-sdio-fu.patch
 delete mode 100644 package/kernel/mac80211/patches/325-v4.17-0008-brcmfmac-remove-duplicate-pointer-variable-from-brcm.patch
 delete mode 100644 package/kernel/mac80211/patches/326-v4.17-0001-brcmfmac-reject-too-long-PSK.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0001-brcmfmac-do-not-convert-linux-error-to-firmware-erro.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0002-brcmfmac-use-brcmf_chip_name-to-store-name-in-revinf.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0003-brcmfmac-use-brcmf_chip_name-for-consistency.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0004-brcmfmac-allocate-struct-brcmf_pub-instance-using-wi.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0005-brcmfmac-use-wiphy-debugfs-dir-entry.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0006-brcmfmac-derive-firmware-filenames-from-basename-map.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0007-brcmfmac-pass-struct-in-brcmf_fw_get_firmwares.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0008-brcmfmac-introduce-brcmf_fw_alloc_request-function.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0009-brcmfmac-add-extension-to-.get_fwname-callbacks.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0010-brcmfmac-get-rid-of-brcmf_fw_map_chip_to_name.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0011-brcmfmac-get-rid-of-brcmf_fw_get_full_name.patch
 delete mode 100644 package/kernel/mac80211/patches/327-v4.17-0012-brcmfmac-add-kerneldoc-for-struct-brcmf_bus-msgbuf.patch
 delete mode 100644 package/kernel/mac80211/patches/328-v4.17-0001-brcmfmac-fix-firmware-request-processing-if-nvram-lo.patch
 delete mode 100644 package/kernel/mac80211/patches/329-v4.18-0001-brcmfmac-add-support-for-BCM4366E-chipset.patch
 delete mode 100644 package/kernel/mac80211/patches/330-v4.18-0001-brcmfmac-check-p2pdev-mac-address-uniqueness.patch
 delete mode 100644 package/kernel/mac80211/patches/330-v4.18-0002-brcmfmac-reports-boottime_ns-while-informing-bss.patch
 delete mode 100644 package/kernel/mac80211/patches/330-v4.18-0003-brcmfmac-use-nl80211_band-directly-to-get-ieee80211-.patch
 delete mode 100644 package/kernel/mac80211/patches/330-v4.18-0004-brcmfmac-constify-firmware-mapping-tables.patch
 delete mode 100644 package/kernel/mac80211/patches/330-v4.18-0005-brcmfmac-add-hostready-indication.patch
 delete mode 100644 package/kernel/mac80211/patches/330-v4.18-0006-brcmfmac-coarse-support-for-PCIe-shared-structure-re.patch
 delete mode 100644 package/kernel/mac80211/patches/331-v4.18-0001-brcmfmac-Add-support-for-bcm43364-wireless-chipset.patch
 delete mode 100644 package/kernel/mac80211/patches/332-v4.18-0001-brcmfmac-set-WIPHY_FLAG_HAVE_AP_SME-flag.patch
 delete mode 100644 package/kernel/mac80211/patches/333-v4.18-0001-brcmfmac-fix-initialization-of-struct-cfg80211_infor.patch
 delete mode 100644 package/kernel/mac80211/patches/334-v4.18-0001-brcmfmac-add-debugfs-entry-for-reading-firmware-capa.patch
 delete mode 100644 package/kernel/mac80211/patches/335-v4.18-0001-brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch
 delete mode 100644 package/kernel/mac80211/patches/335-v4.18-0002-brcmfmac-add-support-for-sysfs-initiated-coredump.patch
 delete mode 100644 package/kernel/mac80211/patches/335-v4.18-0004-brcmfmac-validate-user-provided-data-for-memdump-bef.patch
 delete mode 100644 package/kernel/mac80211/patches/335-v4.18-0005-brcmfmac-trigger-memory-dump-upon-firmware-halt-sign.patch
 delete mode 100644 package/kernel/mac80211/patches/335-v4.18-0006-brcmfmac-trigger-memory-dump-on-SDIO-firmware-halt-m.patch
 delete mode 100644 package/kernel/mac80211/patches/336-v4.18-brcmfmac-stop-watchdog-before-detach-and-free-everyt.patch
 delete mode 100644 package/kernel/mac80211/patches/337-v4.18-brcmfmac-fix-regression-in-parsing-NVRAM-for-multipl.patch
 delete mode 100644 package/kernel/mac80211/patches/338-v4.19-0001-brcmfmac-detect-firmware-support-for-monitor-interfa.patch
 delete mode 100644 package/kernel/mac80211/patches/338-v4.19-0002-brcmfmac-detect-firmware-support-for-radiotap-monito.patch
 delete mode 100644 package/kernel/mac80211/patches/338-v4.19-0003-brcmfmac-handle-msgbuf-packets-marked-with-monitor-m.patch
 delete mode 100644 package/kernel/mac80211/patches/339-v4.19-brcmfmac-define-more-bits-for-the-flags-of-struct-br.patch
 delete mode 100644 package/kernel/mac80211/patches/340-v4.19-brcmfmac-update-STA-info-struct-to-the-v5.patch
 delete mode 100644 package/kernel/mac80211/patches/341-v4.19-brcmfmac-specify-some-features-per-firmware-version.patch
 delete mode 100644 package/kernel/mac80211/patches/352-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch
 delete mode 100644 package/kernel/mac80211/patches/353-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch
 delete mode 100644 package/kernel/mac80211/patches/360-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
 delete mode 100644 package/kernel/mac80211/patches/361-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch
 delete mode 100644 package/kernel/mac80211/patches/362-ath9k-report-tx-status-on-EOSP.patch
 delete mode 100644 package/kernel/mac80211/patches/363-ath9k-fix-block-ack-window-tracking-issues.patch
 delete mode 100644 package/kernel/mac80211/patches/364-ath9k_hw-fix-channel-maximum-power-level-test.patch
 delete mode 100644 package/kernel/mac80211/patches/366-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch
 delete mode 100644 package/kernel/mac80211/patches/367-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch
 delete mode 100644 package/kernel/mac80211/patches/368-ath10k-fix-recent-bandwidth-conversion-bug.patch
 delete mode 100644 package/kernel/mac80211/patches/369-cfg80211-use-only-1Mbps-for-basic-rates-in-mesh.patch
 delete mode 100644 package/kernel/mac80211/patches/374-ath9k-Protect-queue-draining-by-rcu_read_lock.patch
 delete mode 100644 package/kernel/mac80211/patches/379-cfg80211-initialize-sinfo-in-cfg80211_get_station.patch
 delete mode 100644 package/kernel/mac80211/patches/380-0000-ath10k-handle-tdls-peer-events.patch
 delete mode 100644 package/kernel/mac80211/patches/380-0001-ath10k-wmi-modify-svc-bitmap-parsing-for-wcn3990.patch
 delete mode 100644 package/kernel/mac80211/patches/380-0002-ath10k-advertise-TDLS-wider-bandwidth-support-for-5G.patch
 delete mode 100644 package/kernel/mac80211/patches/380-0003-ath10k-debugfs-support-to-get-final-TPC-stats-for-10.patch
 delete mode 100644 package/kernel/mac80211/patches/380-0004-ath10k-Fix-kernel-panic-while-using-worker-ath10k_st.patch
 delete mode 100644 package/kernel/mac80211/patches/380-0005-ath10k-fix-kernel-panic-while-reading-tpc_stats.patch
 delete mode 100644 package/kernel/mac80211/patches/380-0006-ath10k-add-support-to-configure-channel-dwell-time.patch
 delete mode 100644 package/kernel/mac80211/patches/380-0007-ath-add-support-to-get-the-detected-radar-specificat.patch
 delete mode 100644 package/kernel/mac80211/patches/380-0008-ath10k-DFS-Host-Confirmation.patch
 delete mode 100644 package/kernel/mac80211/patches/380-0009-ath10k-fix-memory-leak-of-tpc_stats.patch
 delete mode 100644 package/kernel/mac80211/patches/380-0010-ath10k-support-use-of-channel-173.patch
 delete mode 100644 package/kernel/mac80211/patches/380-0011-ath10k-fix-spectral-scan-for-QCA9984-and-QCA9888-chi.patch
 delete mode 100644 package/kernel/mac80211/patches/382-mac80211-Run-TXQ-teardown-code-before-de-registering.patch
 delete mode 100644 package/kernel/mac80211/patches/383-mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch
 delete mode 100644 package/kernel/mac80211/patches/384-mac80211-avoid-kernel-panic-when-building-AMSDU-from.patch
 delete mode 100644 package/kernel/mac80211/patches/385-cfg80211-nl80211_update_ft_ies-to-validate-NL80211_A.patch
 delete mode 100644 package/kernel/mac80211/patches/386-mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch
 delete mode 100644 package/kernel/mac80211/patches/387-mac80211-always-account-for-A-MSDU-header-changes.patch
 delete mode 100644 package/kernel/mac80211/patches/388-mac80211-fix-an-off-by-one-issue-in-A-MSDU-max_subfr.patch
 delete mode 100644 package/kernel/mac80211/patches/389-cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch
 delete mode 100644 package/kernel/mac80211/patches/390-mac80211-fix-a-race-between-restart-and-CSA-flows.patch
 delete mode 100644 package/kernel/mac80211/patches/391-mac80211-Fix-station-bandwidth-setting-after-channel.patch
 delete mode 100644 package/kernel/mac80211/patches/392-mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch
 delete mode 100644 package/kernel/mac80211/patches/393-mac80211-shorten-the-IBSS-debug-messages.patch
 delete mode 100644 package/kernel/mac80211/patches/600-23-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch
 delete mode 100644 package/kernel/mac80211/patches/941-mwl8k-add-non-DFS-5G-upper-channels.patch
 delete mode 100644 package/kernel/mac80211/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch
 delete mode 100644 package/kernel/mac80211/patches/970-rsi-fix-kbuild-reported-build-errors-with-CONFIG_PM-off
 delete mode 100644 package/kernel/mac80211/patches/971-rsi-move-rsi_sdio_reinit_device-out-of-CONFIG_PM.patch
 rename package/kernel/mac80211/patches/{ => ath}/070-ath_common_config.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/080-ath10k_thermal_config.patch (85%)
 rename package/kernel/mac80211/patches/{ => ath}/201-ath5k-WAR-for-AR71xx-PCI-bug.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch (89%)
 rename package/kernel/mac80211/patches/{ => ath}/351-ath9k_hw-issue-external-reset-for-QCA955x.patch (95%)
 rename package/kernel/mac80211/patches/{ => ath}/354-ath9k-force-rx_clear-when-disabling-rx.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch (82%)
 rename package/kernel/mac80211/patches/{ => ath}/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch (81%)
 rename package/kernel/mac80211/patches/{ => ath}/381-ath9k-fix-tx99-with-monitor-mode-interface.patch (100%)
 create mode 100644 package/kernel/mac80211/patches/ath/395-ath9k-add-back-support-for-using-active-monitor-inte.patch
 rename package/kernel/mac80211/patches/{ => ath}/400-ath_move_debug_code.patch (88%)
 rename package/kernel/mac80211/patches/{ => ath}/401-ath9k_blink_default.patch (88%)
 rename package/kernel/mac80211/patches/{ => ath}/402-ath_regd_optional.patch (98%)
 rename package/kernel/mac80211/patches/{ => ath}/403-world_regd_fixup.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/404-regd_no_assoc_hints.patch (76%)
 rename package/kernel/mac80211/patches/{ => ath}/405-ath_regd_us.patch (83%)
 rename package/kernel/mac80211/patches/{ => ath}/406-ath_relax_default_regd.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/410-ath9k_allow_adhoc_and_ap.patch (83%)
 rename package/kernel/mac80211/patches/{ => ath}/411-ath5k_allow_adhoc_and_ap.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/420-ath5k_disable_fast_cc.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/430-add_ath5k_platform.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/431-add_platform_eeprom_support_to_ath5k.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/432-ath5k_add_pciids.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/440-ath5k_channel_bw_debugfs.patch (92%)
 rename package/kernel/mac80211/patches/{ => ath}/500-ath9k_eeprom_debugfs.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/501-ath9k_ahb_init.patch (86%)
 rename package/kernel/mac80211/patches/{ => ath}/510-ath9k_intr_mitigation_tweak.patch (87%)
 rename package/kernel/mac80211/patches/{ => ath}/511-ath9k_reduce_rxbuf.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/512-ath9k_channelbw_debugfs.patch (98%)
 rename package/kernel/mac80211/patches/{ => ath}/513-ath9k_add_pci_ids.patch (87%)
 rename package/kernel/mac80211/patches/{ => ath}/530-ath9k_extra_leds.patch (99%)
 rename package/kernel/mac80211/patches/{ => ath}/531-ath9k_extra_platform_leds.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/540-ath9k_reduce_ani_interval.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/542-ath9k_debugfs_diag.patch (94%)
 rename package/kernel/mac80211/patches/{ => ath}/543-ath9k_entropy_from_adc.patch (94%)
 rename package/kernel/mac80211/patches/{ => ath}/544-ath9k-ar933x-usb-hang-workaround.patch (84%)
 rename package/kernel/mac80211/patches/{ => ath}/545-ath9k_ani_ws_detect.patch (98%)
 rename package/kernel/mac80211/patches/{ => ath}/547-ath9k_led_defstate_fix.patch (100%)
 rename package/kernel/mac80211/patches/{ => ath}/548-ath9k_enable_gpio_chip.patch (93%)
 rename package/kernel/mac80211/patches/{ => ath}/549-ath9k_enable_gpio_buttons.patch (93%)
 rename package/kernel/mac80211/patches/{ => ath}/550-ath9k-disable-bands-via-dt.patch (88%)
 rename package/kernel/mac80211/patches/{ => ath}/551-ath9k_ubnt_uap_plus_hsr.patch (99%)
 rename package/kernel/mac80211/patches/{ => ath}/552-ahb_of.patch (95%)
 rename package/kernel/mac80211/patches/{ => ath}/921-ath10k_init_devices_synchronously.patch (94%)
 rename package/kernel/mac80211/patches/{ => ath}/930-ath10k_add_tpt_led_trigger.patch (90%)
 rename package/kernel/mac80211/patches/{ => ath}/936-ath10k-fix-otp-failure-result.patch (82%)
 create mode 100644 package/kernel/mac80211/patches/ath/960-0010-ath10k-limit-htt-rx-ring-size.patch
 rename package/kernel/mac80211/patches/{ => ath}/960-0011-ath10k-limit-pci-buffer-size.patch (75%)
 rename package/kernel/mac80211/patches/{ => ath}/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch (94%)
 rename package/kernel/mac80211/patches/{ => ath}/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch (94%)
 rename package/kernel/mac80211/patches/{ => ath}/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch (92%)
 rename package/kernel/mac80211/patches/{ => ath}/975-ath10k-use-tpt-trigger-by-default.patch (94%)
 rename package/kernel/mac80211/patches/{ => ath}/976-ath10k-Limit-available-channels-via-DT-ieee80211-fre.patch (93%)
 rename package/kernel/mac80211/patches/{ => brcm}/040-brcmutil_option.patch (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/342-0001-brcmfmac-add-CYW89342-mini-PCIe-device.patch (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/344-0001-brcmfmac-fix-wrong-strnchr-usage.patch (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/345-0001-brcmfmac-fix-for-proper-support-of-160MHz-bandwidth.patch (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/345-0002-brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/810-b43-gpio-mask-module-option.patch (97%)
 rename package/kernel/mac80211/patches/{ => brcm}/811-b43_no_pio.patch (91%)
 rename package/kernel/mac80211/patches/{ => brcm}/812-b43-add-antenna-control.patch (99%)
 rename package/kernel/mac80211/patches/{ => brcm}/813-b43-reduce-number-of-RX-slots.patch (88%)
 rename package/kernel/mac80211/patches/{ => brcm}/814-b43-only-use-gpio-0-1-for-led.patch (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/815-b43-always-take-overlapping-devs.patch (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/850-brcmsmac-remove-extra-regulation-restriction.patch (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/860-brcmfmac-register-wiphy-s-during-module_init.patch (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/862-brcmfmac-Disable-power-management.patch (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/863-brcmfmac-add-in-driver-tables-with-country-codes.patch (100%)
 rename package/kernel/mac80211/patches/{ => brcm}/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch (92%)
 rename package/kernel/mac80211/patches/{ => build}/000-fix_kconfig.patch (100%)
 rename package/kernel/mac80211/patches/{ => build}/001-fix_build.patch (100%)
 rename package/kernel/mac80211/patches/{ => build}/002-change_allconfig.patch (100%)
 rename package/kernel/mac80211/patches/{ => build}/003-remove_bogus_modparams.patch (100%)
 rename package/kernel/mac80211/patches/{ => build}/004-kconfig_backport_fix.patch (100%)
 create mode 100644 package/kernel/mac80211/patches/build/005-revert-devcoredump.patch
 rename package/kernel/mac80211/patches/{ => build}/010-disable_rfkill.patch (100%)
 rename package/kernel/mac80211/patches/{ => build}/012-kernel_build_check.patch (100%)
 rename package/kernel/mac80211/patches/{ => build}/050-lib80211_option.patch (78%)
 rename package/kernel/mac80211/patches/{ => mwl}/700-mwl8k-missing-pci-id-for-WNR854T.patch (87%)
 rename package/kernel/mac80211/patches/{ => mwl}/801-libertas-configure-sysfs-links.patch (89%)
 rename package/kernel/mac80211/patches/{ => mwl}/802-libertas-set-wireless-macaddr.patch (85%)
 rename package/kernel/mac80211/patches/{ => mwl}/940-mwl8k_init_devices_synchronously.patch (75%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/030-rt2x00_options.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-01-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-02-rt2x00-rt2800lib-enable-support-for-RT3883.patch (89%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-03-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch (95%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-04-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch (84%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-05-rt2x00-rt2800lib-add-channel-configuration-function-.patch (97%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-06-rt2x00-rt2800lib-enable-RF3853-support.patch (89%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-07-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch (93%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-08-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-09-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch (94%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-10-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch (97%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-11-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-12-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch (91%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-13-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch (91%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-14-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch (94%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-15-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch (93%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-16-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch (87%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-17-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-18-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch (92%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-19-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch (90%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-20-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch (87%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-21-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch (90%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/600-22-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch (91%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/601-rt2x00-introduce-rt2x00_platform_h.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/602-rt2x00-introduce-rt2x00eeprom.patch (98%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/603-rt2x00-of_load_eeprom_filename.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/606-rt2x00-allow_disabling_bands_through_platform_data.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/607-rt2x00-add_platform_data_mac_addr.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/608-rt2x00-allow_disabling_bands_through_dts.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch (94%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/610-rt2x00-change-led-polarity-from-OF.patch (95%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/611-rt2x00-add-AP+STA-support.patch (100%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/650-rt2x00-add-support-for-external-PA-on-MT7620.patch (94%)
 rename package/kernel/mac80211/patches/{ => rt2x00}/651-rt2x00-remove-unneccesary-code.patch (99%)
 create mode 100644 package/kernel/mac80211/patches/rt2x00/701-rt2800-move-usb-specific-txdone-txstatus-routines-to.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/702-rt2800mmio-use-txdone-txstatus-routines-from-lib.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/703-rt2x00-do-not-check-for-txstatus-timeout-every-time-.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/704-rt2x00-use-different-txstatus-timeouts-when-flushing.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/705-rt2800-flush-and-txstatus-rework-for-rt2800mmio.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/980-rt2x00-reduce-power-consumption-on-mt7620.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch
 create mode 100644 package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch
 rename package/kernel/mac80211/patches/{ => subsys}/100-remove-cryptoapi-dependencies.patch (96%)
 rename package/kernel/mac80211/patches/{ => subsys}/110-mac80211_keep_keys_on_stop_ap.patch (84%)
 rename package/kernel/mac80211/patches/{ => subsys}/120-cfg80211_allow_perm_addr_change.patch (100%)
 rename package/kernel/mac80211/patches/{ => subsys}/130-disable-fils.patch (91%)
 rename package/kernel/mac80211/patches/{ => subsys}/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch (100%)
 rename package/kernel/mac80211/patches/{ => subsys}/132-mac80211-remove-cmac-dependency.patch (100%)
 rename package/kernel/mac80211/patches/{ => subsys}/140-tweak-TSQ-setting.patch (93%)
 rename package/kernel/mac80211/patches/{ => subsys}/150-disable_addr_notifier.patch (82%)
 rename package/kernel/mac80211/patches/{ => subsys}/210-ap_scan.patch (83%)
 rename package/kernel/mac80211/patches/{ => subsys}/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch (90%)
 rename package/kernel/mac80211/patches/{ => subsys}/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch (84%)
 rename package/kernel/mac80211/patches/{ => subsys}/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch (97%)
 rename package/kernel/mac80211/patches/{ => subsys}/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch (89%)
 rename package/kernel/mac80211/patches/{ => subsys}/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch (97%)
 rename package/kernel/mac80211/patches/{ => subsys}/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch (100%)
 rename package/kernel/mac80211/patches/{ => subsys}/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch (100%)
 rename package/kernel/mac80211/patches/{ => subsys}/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch (100%)
 rename package/kernel/mac80211/patches/{ => subsys}/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch (100%)
 rename package/kernel/mac80211/patches/{ => subsys}/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch (100%)
 rename package/kernel/mac80211/patches/{ => subsys}/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch (83%)
 create mode 100644 package/kernel/mac80211/patches/subsys/394-mac80211-allocate-TXQs-for-active-monitor-interfaces.patch
 rename package/kernel/mac80211/patches/{ => subsys}/522-mac80211_configure_antenna_gain.patch (79%)

diff --git a/package/firmware/ath10k-firmware/Makefile b/package/firmware/ath10k-firmware/Makefile
index c124f4bb9..779765a42 100644
--- a/package/firmware/ath10k-firmware/Makefile
+++ b/package/firmware/ath10k-firmware/Makefile
@@ -606,13 +606,13 @@ define Package/ath10k-firmware-qca9888-ct-htt/install
 		$(1)/lib/firmware/ath10k/QCA9888/hw2.0/ct-firmware-5.bin
 endef
 
-$(eval $(call BuildPackage,ath10k-firmware-qca9887))
-$(eval $(call BuildPackage,ath10k-firmware-qca9888))
-$(eval $(call BuildPackage,ath10k-firmware-qca988x))
-$(eval $(call BuildPackage,ath10k-firmware-qca99x0))
-$(eval $(call BuildPackage,ath10k-firmware-qca6174))
-$(eval $(call BuildPackage,ath10k-firmware-qca9984))
-$(eval $(call BuildPackage,ath10k-firmware-qca4019))
+#$(eval $(call BuildPackage,ath10k-firmware-qca9887))
+#$(eval $(call BuildPackage,ath10k-firmware-qca9888))
+#$(eval $(call BuildPackage,ath10k-firmware-qca988x))
+#$(eval $(call BuildPackage,ath10k-firmware-qca99x0))
+#$(eval $(call BuildPackage,ath10k-firmware-qca6174))
+#$(eval $(call BuildPackage,ath10k-firmware-qca9984))
+#$(eval $(call BuildPackage,ath10k-firmware-qca4019))
 
 $(eval $(call BuildPackage,ath10k-firmware-qca9887-ct))
 $(eval $(call BuildPackage,ath10k-firmware-qca9887-ct-htt))
diff --git a/package/firmware/linux-firmware/Makefile b/package/firmware/linux-firmware/Makefile
index e42874af7..dc4ef9533 100644
--- a/package/firmware/linux-firmware/Makefile
+++ b/package/firmware/linux-firmware/Makefile
@@ -11,10 +11,10 @@ PKG_NAME:=linux-firmware
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
-PKG_SOURCE_DATE:=2017-09-06
-PKG_SOURCE_VERSION:=a61ac5cf8374edbfe692d12f805a1b194f7fead2
-PKG_MIRROR_HASH:=b827bf760de57b907df159c8d38d7c3fb5b4a691781114c47739e20bffb3a312
+PKG_SOURCE_DATE:=2018-08-03
+PKG_SOURCE_VERSION:=7b5835fd37630d18ac0c755329172f6a17c1af29
+PKG_MIRROR_HASH:=fd631e7d024b0da78ad930a64503f816be19f49b15bbd454e83d41fd8dfde793
+PKG_SOURCE_URL:=git://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 
diff --git a/package/firmware/linux-firmware/qca_ath10k.mk b/package/firmware/linux-firmware/qca_ath10k.mk
new file mode 100644
index 000000000..a7c5b13b8
--- /dev/null
+++ b/package/firmware/linux-firmware/qca_ath10k.mk
@@ -0,0 +1,105 @@
+QCA99X0_BOARD_REV:=ddcec9efd245da9365c474f513a855a55f3ac7fe
+QCA99X0_BOARD_FILE:=board-2.bin.$(QCA99X0_BOARD_REV)
+
+define Download/qca99x0-board
+  URL:=https://source.codeaurora.org/quic/qsdk/oss/firmware/ath10k-firmware/plain/ath10k/QCA99X0/hw2.0
+  URL_FILE:=board-2.bin?id=$(QCA99X0_BOARD_REV)
+  FILE:=$(QCA99X0_BOARD_FILE)
+  HASH:=03711ac21e60ef59d3815e235eb721c0c22851b5410299411085aa6f2af45401
+endef
+$(eval $(call Download,qca99x0-board))
+
+Package/ath10k-firmware-qca4019 = $(call Package/firmware-default,ath10k qca4019 firmware)
+define Package/ath10k-firmware-qca4019/install
+	$(INSTALL_DIR) $(1)/lib/firmware/ath10k/QCA4019/hw1.0
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath10k/QCA4019/hw1.0/board-2.bin \
+		$(1)/lib/firmware/ath10k/QCA4019/hw1.0/
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath10k/QCA4019/hw1.0/firmware-5.bin \
+		$(1)/lib/firmware/ath10k/QCA4019/hw1.0/firmware-5.bin
+endef
+$(eval $(call BuildPackage,ath10k-firmware-qca4019))
+
+Package/ath10k-firmware-qca9887 = $(call Package/firmware-default,ath10k qca9887 firmware)
+define Package/ath10k-firmware-qca9887/install
+	$(INSTALL_DIR) $(1)/lib/firmware/ath10k/QCA9887/hw1.0
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath10k/QCA9887/hw1.0/firmware-5.bin \
+		$(1)/lib/firmware/ath10k/QCA9887/hw1.0/firmware-5.bin
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath10k/QCA9887/hw1.0/board.bin \
+		$(1)/lib/firmware/ath10k/QCA9887/hw1.0/board.bin
+endef
+$(eval $(call BuildPackage,ath10k-firmware-qca9887))
+
+Package/ath10k-firmware-qca9888 = $(call Package/firmware-default,ath10k qca9888 firmware)
+define Package/ath10k-firmware-qca9888/install
+	$(INSTALL_DIR) $(1)/lib/firmware/ath10k/QCA9888/hw2.0
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath10k/QCA9888/hw2.0/board-2.bin \
+		$(1)/lib/firmware/ath10k/QCA9888/hw2.0/board-2.bin
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath10k/QCA9888/hw2.0/firmware-5.bin \
+		$(1)/lib/firmware/ath10k/QCA9888/hw2.0/firmware-5.bin
+endef
+$(eval $(call BuildPackage,ath10k-firmware-qca9888))
+
+Package/ath10k-firmware-qca988x = $(call Package/firmware-default,ath10k qca988x firmware)
+define Package/ath10k-firmware-qca988x/install
+	$(INSTALL_DIR) $(1)/lib/firmware/ath10k/QCA988X/hw2.0
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath10k/QCA988X/hw2.0/board.bin \
+		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath10k/QCA988X/hw2.0/firmware-5.bin \
+		$(1)/lib/firmware/ath10k/QCA988X/hw2.0/firmware-5.bin
+endef
+$(eval $(call BuildPackage,ath10k-firmware-qca988x))
+
+Package/ath10k-firmware-qca6174 = $(call Package/firmware-default,ath10k qca6174 firmware)
+define Package/ath10k-firmware-qca6174/install
+	$(INSTALL_DIR) $(1)/lib/firmware/ath10k/QCA6174/hw2.1
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath10k/QCA6174/hw2.1/board-2.bin \
+		$(1)/lib/firmware/ath10k/QCA6174/hw2.1/
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath10k/QCA6174/hw2.1/firmware-5.bin \
+		$(1)/lib/firmware/ath10k/QCA6174/hw2.1/firmware-5.bin
+	$(INSTALL_DIR) $(1)/lib/firmware/ath10k/QCA6174/hw3.0
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath10k/QCA6174/hw3.0/board-2.bin \
+		$(1)/lib/firmware/ath10k/QCA6174/hw3.0/
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath10k/QCA6174/hw3.0/firmware-6.bin \
+		$(1)/lib/firmware/ath10k/QCA6174/hw3.0/firmware-6.bin
+endef
+$(eval $(call BuildPackage,ath10k-firmware-qca6174))
+
+Package/ath10k-firmware-qca99x0 = $(call Package/firmware-default,ath10k qca99x0 firmware)
+define Package/ath10k-firmware-qca99x0/install
+	$(INSTALL_DIR) $(1)/lib/firmware/ath10k/QCA99X0/hw2.0
+	$(INSTALL_DATA) \
+		$(DL_DIR)/$(QCA99X0_BOARD_FILE) \
+		$(1)/lib/firmware/ath10k/QCA99X0/hw2.0/board-2.bin
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath10k/QCA99X0/hw2.0/board.bin \
+		$(1)/lib/firmware/ath10k/QCA99X0/hw2.0/board.bin
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath10k/QCA99X0/hw2.0/firmware-5.bin \
+		$(1)/lib/firmware/ath10k/QCA99X0/hw2.0/firmware-5.bin
+endef
+$(eval $(call BuildPackage,ath10k-firmware-qca99x0))
+
+Package/ath10k-firmware-qca9984 = $(call Package/firmware-default,ath10k qca9984 firmware)
+define Package/ath10k-firmware-qca9984/install
+	$(INSTALL_DIR) $(1)/lib/firmware/ath10k/QCA9984/hw1.0
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath10k/QCA9984/hw1.0/board-2.bin \
+		$(1)/lib/firmware/ath10k/QCA9984/hw1.0/board-2.bin
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath10k/QCA9984/hw1.0/firmware-5.bin \
+		$(1)/lib/firmware/ath10k/QCA9984/hw1.0/firmware-5.bin
+endef
+$(eval $(call BuildPackage,ath10k-firmware-qca9984))
+
diff --git a/package/kernel/ath10k-ct/Makefile b/package/kernel/ath10k-ct/Makefile
index 1a94582a6..366515189 100644
--- a/package/kernel/ath10k-ct/Makefile
+++ b/package/kernel/ath10k-ct/Makefile
@@ -15,7 +15,7 @@ PKG_MIRROR_HASH:=aa77f388727ff2201de615c3211ab5c0b2dc5e3c041bd1cde4d6eebde0ca437
 # Build the 4.13 ath10k-ct driver version.  Other options are "-4.9", or
 # leave un-defined for 4.7 kernel.  Probably this should match as closely as
 # possible to whatever mac80211 backports version is being used.
-CT_KVER="-4.13"
+CT_KVER="-4.16"
 
 PKG_MAINTAINER:=Ben Greear <greearb@candelatech.com>
 PKG_BUILD_PARALLEL:=1
diff --git a/package/kernel/ath10k-ct/patches/081-ath10k-calibration-variant.patch b/package/kernel/ath10k-ct/patches/081-ath10k-calibration-variant.patch
index d51451b59..1752bf8c9 100644
--- a/package/kernel/ath10k-ct/patches/081-ath10k-calibration-variant.patch
+++ b/package/kernel/ath10k-ct/patches/081-ath10k-calibration-variant.patch
@@ -43,7 +43,7 @@ Origin: upstream, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux
 
 --- a/ath10k-4.13/core.c
 +++ b/ath10k-4.13/core.c
-@@ -889,6 +889,28 @@ static int ath10k_core_check_smbios(stru
+@@ -891,6 +891,28 @@ static int ath10k_core_check_smbios(stru
  	return 0;
  }
  
@@ -72,7 +72,7 @@ Origin: upstream, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux
  static int ath10k_download_and_run_otp(struct ath10k *ar)
  {
  	u32 result, address = ar->hw_params.patch_load_addr;
-@@ -1522,19 +1544,19 @@ static int ath10k_core_create_board_name
+@@ -1530,19 +1552,19 @@ static int ath10k_core_create_board_name
  	/* strlen(',variant=') + strlen(ar->id.bdf_ext) */
  	char variant[9 + ATH10K_SMBIOS_BDF_EXT_STR_LENGTH] = { 0 };
  
@@ -98,7 +98,7 @@ Origin: upstream, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux
  	scnprintf(name, name_len,
  		  "bus=%s,vendor=%04x,device=%04x,subsystem-vendor=%04x,subsystem-device=%04x%s",
  		  ath10k_bus_str(ar->hif.bus),
-@@ -2964,7 +2986,11 @@ static int ath10k_core_probe_fw(struct a
+@@ -2975,7 +2997,11 @@ static int ath10k_core_probe_fw(struct a
  
  	ret = ath10k_core_check_smbios(ar);
  	if (ret)
diff --git a/package/kernel/ath10k-ct/patches/100-kernel_compat.patch b/package/kernel/ath10k-ct/patches/100-kernel_compat.patch
index b2ec10bb6..df7a3b2a8 100644
--- a/package/kernel/ath10k-ct/patches/100-kernel_compat.patch
+++ b/package/kernel/ath10k-ct/patches/100-kernel_compat.patch
@@ -97,7 +97,18 @@
  	ATH10K_DFS_STAT_INC(ar, pulses_total);
 --- a/ath10k-4.13/wmi.c
 +++ b/ath10k-4.13/wmi.c
-@@ -3990,7 +3990,7 @@ static void ath10k_dfs_radar_report(stru
+@@ -4031,7 +4031,7 @@ static void ath10k_dfs_radar_report(stru
+ 
+ 	ATH10K_DFS_STAT_INC(ar, pulses_detected);
+ 
+-	if (!ar->dfs_detector->add_pulse(ar->dfs_detector, &pe)) {
++	if (!ar->dfs_detector->add_pulse(ar->dfs_detector, &pe, NULL)) {
+ 		ath10k_dbg(ar, ATH10K_DBG_REGULATORY,
+ 			   "dfs no pulse pattern detected, yet\n");
+ 		return;
+--- a/ath10k-4.16/wmi.c
++++ b/ath10k-4.16/wmi.c
+@@ -4061,7 +4061,7 @@ static void ath10k_dfs_radar_report(stru
  
  	ATH10K_DFS_STAT_INC(ar, pulses_detected);
  
diff --git a/package/kernel/ath10k-ct/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch b/package/kernel/ath10k-ct/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch
index a82bbda3c..3788b8110 100644
--- a/package/kernel/ath10k-ct/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch
+++ b/package/kernel/ath10k-ct/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch
@@ -50,7 +50,7 @@ Origin: backport, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux
 
 --- a/ath10k-4.13/core.c
 +++ b/ath10k-4.13/core.c
-@@ -1419,14 +1419,61 @@ out:
+@@ -1427,14 +1427,61 @@ out:
  	return ret;
  }
  
@@ -115,7 +115,7 @@ Origin: backport, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux
  
  	ar->normal_mode_fw.board = ath10k_fetch_fw_file(ar,
  							ar->hw_params.fw.dir,
-@@ -1464,73 +1511,28 @@ static int ath10k_core_fetch_board_data_
+@@ -1472,73 +1519,28 @@ static int ath10k_core_fetch_board_data_
  	data += magic_len;
  	len -= magic_len;
  
@@ -198,7 +198,7 @@ Origin: backport, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux
  	return 0;
  
  err:
-@@ -1539,12 +1541,12 @@ err:
+@@ -1547,12 +1549,12 @@ err:
  }
  
  static int ath10k_core_create_board_name(struct ath10k *ar, char *name,
@@ -213,7 +213,206 @@ Origin: backport, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux
  		scnprintf(variant, sizeof(variant), ",variant=%s",
  			  ar->id.bdf_ext);
  
-@@ -1570,21 +1572,31 @@ out:
+@@ -1578,21 +1580,31 @@ out:
+ 
+ static int ath10k_core_fetch_board_file(struct ath10k *ar)
+ {
+-	char boardname[100];
++	char boardname[100], fallback_boardname[100];
+ 	int ret;
+ 
+-	ret = ath10k_core_create_board_name(ar, boardname, sizeof(boardname));
++	ret = ath10k_core_create_board_name(ar, boardname,
++					    sizeof(boardname), true);
+ 	if (ret) {
+ 		ath10k_err(ar, "failed to create board name: %d", ret);
+ 		return ret;
+ 	}
+ 
++	ret = ath10k_core_create_board_name(ar, fallback_boardname,
++					    sizeof(boardname), false);
++	if (ret) {
++		ath10k_err(ar, "failed to create fallback board name: %d", ret);
++		return ret;
++	}
++
+ 	ar->bd_api = 2;
+ 	if (ar->fwcfg.bname[0])
+ 		ret = ath10k_core_fetch_board_data_api_n(ar, boardname,
++							 fallback_boardname,
+ 							 ar->fwcfg.bname);
+ 	else
+ 		ret = ath10k_core_fetch_board_data_api_n(ar, boardname,
++							 fallback_boardname,
+ 							 ATH10K_BOARD_API2_FILE);
+ 	if (!ret)
+ 		goto success;
+--- a/ath10k-4.16/core.c
++++ b/ath10k-4.16/core.c
+@@ -1559,14 +1559,61 @@ out:
+ 	return ret;
+ }
+ 
++static int ath10k_core_search_bd(struct ath10k *ar,
++				 const char *boardname,
++				 const u8 *data,
++				 size_t len)
++{
++	size_t ie_len;
++	struct ath10k_fw_ie *hdr;
++	int ret = -ENOENT, ie_id;
++
++	while (len > sizeof(struct ath10k_fw_ie)) {
++		hdr = (struct ath10k_fw_ie *)data;
++		ie_id = le32_to_cpu(hdr->id);
++		ie_len = le32_to_cpu(hdr->len);
++
++		len -= sizeof(*hdr);
++		data = hdr->data;
++
++		if (len < ALIGN(ie_len, 4)) {
++			ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n",
++				   ie_id, ie_len, len);
++			return -EINVAL;
++		}
++
++		switch (ie_id) {
++		case ATH10K_BD_IE_BOARD:
++			ret = ath10k_core_parse_bd_ie_board(ar, data, ie_len,
++							    boardname);
++			if (ret == -ENOENT)
++				/* no match found, continue */
++				break;
++
++			/* either found or error, so stop searching */
++			goto out;
++		}
++
++		/* jump over the padding */
++		ie_len = ALIGN(ie_len, 4);
++
++		len -= ie_len;
++		data += ie_len;
++	}
++
++out:
++	/* return result of parse_bd_ie_board() or -ENOENT */
++	return ret;
++}
++
+ static int ath10k_core_fetch_board_data_api_n(struct ath10k *ar,
+ 					      const char *boardname,
++					      const char *fallback_boardname,
+ 					      const char *filename)
+ {
+-	size_t len, magic_len, ie_len;
+-	struct ath10k_fw_ie *hdr;
++	size_t len, magic_len;
+ 	const u8 *data;
+-	int ret, ie_id;
++	int ret;
+ 
+ 	ar->normal_mode_fw.board = ath10k_fetch_fw_file(ar,
+ 							ar->hw_params.fw.dir,
+@@ -1604,73 +1651,28 @@ static int ath10k_core_fetch_board_data_
+ 	data += magic_len;
+ 	len -= magic_len;
+ 
+-	while (len > sizeof(struct ath10k_fw_ie)) {
+-		hdr = (struct ath10k_fw_ie *)data;
+-		ie_id = le32_to_cpu(hdr->id);
+-		ie_len = le32_to_cpu(hdr->len);
+-
+-		len -= sizeof(*hdr);
+-		data = hdr->data;
+-
+-		if (len < ALIGN(ie_len, 4)) {
+-			ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n",
+-				   ie_id, ie_len, len);
+-			ret = -EINVAL;
+-			goto err;
+-		}
+-
+-		switch (ie_id) {
+-		case ATH10K_BD_IE_BOARD:
+-			ret = ath10k_core_parse_bd_ie_board(ar, data, ie_len,
+-							    boardname);
+-			if (ret == -ENOENT && ar->id.bdf_ext[0] != '\0') {
+-				/* try default bdf if variant was not found */
+-				char *s, *v = ",variant=";
+-				char boardname2[100];
+-
+-				strlcpy(boardname2, boardname,
+-					sizeof(boardname2));
+-
+-				s = strstr(boardname2, v);
+-				if (s)
+-					*s = '\0';  /* strip ",variant=%s" */
+-
+-				ret = ath10k_core_parse_bd_ie_board(ar, data,
+-								    ie_len,
+-								    boardname2);
+-			}
+-
+-			if (ret == -ENOENT)
+-				/* no match found, continue */
+-				break;
+-			else if (ret)
+-				/* there was an error, bail out */
+-				goto err;
+-
+-			/* board data found */
+-			goto out;
+-		}
++	/* attempt to find boardname in the IE list */
++	ret = ath10k_core_search_bd(ar, boardname, data, len);
+ 
+-		/* jump over the padding */
+-		ie_len = ALIGN(ie_len, 4);
+-
+-		len -= ie_len;
+-		data += ie_len;
+-	}
++	/* if we didn't find it and have a fallback name, try that */
++	if (ret == -ENOENT && fallback_boardname)
++		ret = ath10k_core_search_bd(ar, fallback_boardname, data, len);
+ 
+ out:
+-	if (!ar->normal_mode_fw.board_data || !ar->normal_mode_fw.board_len) {
++	if (ret == -ENOENT) {
+ 		ath10k_err(ar,
+ 			   "failed to fetch board data for %s from %s/%s\n",
+ 			   boardname, ar->hw_params.fw.dir, filename);
+ 		ret = -ENODATA;
+-		goto err;
+ 	}
+ 
+ 	/* Save firmware board name so we can display it later. */
+ 	strlcpy(ar->normal_mode_fw.fw_file.fw_board_name, filename,
+ 		sizeof(ar->normal_mode_fw.fw_file.fw_board_name));
+ 
++	if (ret)
++		goto err;
++
+ 	return 0;
+ 
+ err:
+@@ -1679,12 +1681,12 @@ err:
+ }
+ 
+ static int ath10k_core_create_board_name(struct ath10k *ar, char *name,
+-					 size_t name_len)
++					 size_t name_len, bool with_variant)
+ {
+ 	/* strlen(',variant=') + strlen(ar->id.bdf_ext) */
+ 	char variant[9 + ATH10K_SMBIOS_BDF_EXT_STR_LENGTH] = { 0 };
+ 
+-	if (ar->id.bdf_ext[0] != '\0')
++	if (with_variant && ar->id.bdf_ext[0] != '\0')
+ 		scnprintf(variant, sizeof(variant), ",variant=%s",
+ 			  ar->id.bdf_ext);
+ 
+@@ -1710,21 +1712,31 @@ out:
  
  static int ath10k_core_fetch_board_file(struct ath10k *ar)
  {
diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index 611d5a73d..82febda37 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -10,12 +10,12 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=mac80211
 
-PKG_VERSION:=2017-11-01
-PKG_RELEASE:=9
-PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
-PKG_HASH:=8437ab7886b988c8152e7a4db30b7f41009e49a3b2cb863edd05da1ecd7eb05a
+PKG_VERSION:=4.19-rc4-1
+PKG_RELEASE:=1
+PKG_SOURCE_URL:=https://hauke-m.de/files/
+PKG_HASH:=5502add3ecfae4c75177f069450297d3e0d980f190206a7a71f3887c67cefee4
 
-PKG_SOURCE:=backports-$(PKG_VERSION).tar.xz
+PKG_SOURCE:=backports-$(PKG_VERSION).tar.gz
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/backports-$(PKG_VERSION)
 PKG_BUILD_PARALLEL:=1
 
@@ -856,7 +856,7 @@ endef
 define KernelPackage/hermes-pcmcia
   $(call KernelPackage/mac80211/Default)
   TITLE:=Hermes based PCMCIA adaptors
-  DEPENDS:=@PCMCIA_SUPPORT +kmod-hermes @BROKEN
+  DEPENDS:=@PCMCIA_SUPPORT +kmod-hermes
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco_cs.ko
   AUTOLOAD:=$(call AutoProbe,orinoco_cs)
 endef
@@ -1839,6 +1839,26 @@ ifeq ($(strip $(CONFIG_EXTERNAL_KERNEL_TREE)),"")
   endif
 endif
 
+define Build/Patch
+	$(if $(QUILT),rm -rf $(PKG_BUILD_DIR)/patches; mkdir -p $(PKG_BUILD_DIR)/patches)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/build,build/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/subsys,subsys/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath,ath/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/brcm,brcm/)
+	$(if $(QUILT),touch $(PKG_BUILD_DIR)/.quilt_used)
+endef
+
+define Quilt/Refresh/Package
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/build,build/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/subsys,subsys/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath,ath/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/brcm,brcm/)
+endef
+
 define Build/Compile
 	$(SH_FUNC) var2file "$(call shvar,mac80211_config)" $(PKG_BUILD_DIR)/.config
 	$(MAKE) $(MAKE_OPTS) allnoconfig
diff --git a/package/kernel/mac80211/patches/005-revert-devcoredump.patch b/package/kernel/mac80211/patches/005-revert-devcoredump.patch
deleted file mode 100644
index d485d9558..000000000
--- a/package/kernel/mac80211/patches/005-revert-devcoredump.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/compat/Makefile
-+++ b/compat/Makefile
-@@ -70,8 +70,6 @@ quiet_cmd_build_OID_registry = GEN     $
- 	cmd_build_OID_registry = perl $(src)/build_OID_registry $< $@
- compat-$(CPTCFG_BPAUTO_ASN1_DECODER) += lib-asn1_decoder.o
- compat-$(CPTCFG_BPAUTO_BUILD_SYSTEM_DATA_VERIFICATION) += lib-oid_registry.o
--skcipher-objs += crypto-skcipher.o
--obj-$(CPTCFG_BPAUTO_CRYPTO_SKCIPHER) += skcipher.o
- compat-$(CPTCFG_BPAUTO_RHASHTABLE) += lib-rhashtable.o
- cordic-objs += lib-cordic.o
- obj-$(CPTCFG_BPAUTO_BUILD_CORDIC) += cordic.o
diff --git a/package/kernel/mac80211/patches/006-fix-genl-multicast.patch b/package/kernel/mac80211/patches/006-fix-genl-multicast.patch
deleted file mode 100644
index 42fd3e827..000000000
--- a/package/kernel/mac80211/patches/006-fix-genl-multicast.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/compat/backport-4.12.c
-+++ b/compat/backport-4.12.c
-@@ -225,6 +225,7 @@ int bp_extack_genl_register_family(struc
- 
- 	/* copy this since the family might access it directly */
- 	family->attrbuf = copy->family.attrbuf;
-+	family->mcgrp_offset = copy->family.mcgrp_offset;
- 
- 	mutex_lock(&copies_mutex);
- 	list_add_tail(&copy->list, &copies_list);
diff --git a/package/kernel/mac80211/patches/007-fix-linux-verification-h.patch b/package/kernel/mac80211/patches/007-fix-linux-verification-h.patch
deleted file mode 100644
index 4011f1d3b..000000000
--- a/package/kernel/mac80211/patches/007-fix-linux-verification-h.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/backport-include/linux/verification.h
-+++ b/backport-include/linux/verification.h
-@@ -1,7 +1,7 @@
- #ifndef __BP_VERIFICATION_H
- #define __BP_VERIFICATION_H
- #include <linux/version.h>
--#ifndef CPTCFG_BPAUTO_BUILD_SYSTEM_DATA_VERIFICATION
-+#if LINUX_VERSION_IS_GEQ(4,7,0) && !defined(CPTCFG_BPAUTO_BUILD_SYSTEM_DATA_VERIFICATION)
- #include_next <linux/verification.h>
- #else
- #include <linux/key.h>
diff --git a/package/kernel/mac80211/patches/008-fix-genl-family-id.patch b/package/kernel/mac80211/patches/008-fix-genl-family-id.patch
deleted file mode 100644
index ee8fa6c2b..000000000
--- a/package/kernel/mac80211/patches/008-fix-genl-family-id.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/compat/backport-4.12.c
-+++ b/compat/backport-4.12.c
-@@ -224,6 +224,7 @@ int bp_extack_genl_register_family(struc
- 	}
- 
- 	/* copy this since the family might access it directly */
-+	family->id = copy->family.id;
- 	family->attrbuf = copy->family.attrbuf;
- 	family->mcgrp_offset = copy->family.mcgrp_offset;
- 
diff --git a/package/kernel/mac80211/patches/015-ipw200-mtu.patch b/package/kernel/mac80211/patches/015-ipw200-mtu.patch
deleted file mode 100644
index 8d273a095..000000000
--- a/package/kernel/mac80211/patches/015-ipw200-mtu.patch
+++ /dev/null
@@ -1,34 +0,0 @@
---- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
-+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
-@@ -11506,6 +11506,15 @@ static const struct attribute_group ipw_
- 	.attrs = ipw_sysfs_entries,
- };
- 
-+#if LINUX_VERSION_IS_LESS(4,10,0)
-+static int __change_mtu(struct net_device *ndev, int new_mtu){
-+	if (new_mtu < 68 || new_mtu > LIBIPW_DATA_LEN)
-+		return -EINVAL;
-+	ndev->mtu = new_mtu;
-+	return 0;
-+}
-+#endif
-+
- #ifdef CPTCFG_IPW2200_PROMISCUOUS
- static int ipw_prom_open(struct net_device *dev)
- {
-@@ -11554,15 +11563,6 @@ static netdev_tx_t ipw_prom_hard_start_x
- 	return NETDEV_TX_OK;
- }
- 
--#if LINUX_VERSION_IS_LESS(4,10,0)
--static int __change_mtu(struct net_device *ndev, int new_mtu){
--	if (new_mtu < 68 || new_mtu > LIBIPW_DATA_LEN)
--		return -EINVAL;
--	ndev->mtu = new_mtu;
--	return 0;
--}
--#endif
--
- static const struct net_device_ops ipw_prom_netdev_ops = {
- #if LINUX_VERSION_IS_LESS(4,10,0)
- 	.ndo_change_mtu = __change_mtu,
diff --git a/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch b/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
deleted file mode 100644
index d897b2b40..000000000
--- a/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch
+++ /dev/null
@@ -1,132 +0,0 @@
---- a/local-symbols
-+++ b/local-symbols
-@@ -388,45 +388,6 @@ USB_IPHETH=
- USB_SIERRA_NET=
- USB_VL600=
- USB_NET_CH9200=
--SSB_POSSIBLE=
--SSB=
--SSB_SPROM=
--SSB_BLOCKIO=
--SSB_PCIHOST_POSSIBLE=
--SSB_PCIHOST=
--SSB_B43_PCI_BRIDGE=
--SSB_PCMCIAHOST_POSSIBLE=
--SSB_PCMCIAHOST=
--SSB_SDIOHOST_POSSIBLE=
--SSB_SDIOHOST=
--SSB_HOST_SOC=
--SSB_SILENT=
--SSB_DEBUG=
--SSB_SERIAL=
--SSB_DRIVER_PCICORE_POSSIBLE=
--SSB_DRIVER_PCICORE=
--SSB_PCICORE_HOSTMODE=
--SSB_DRIVER_MIPS=
--SSB_SFLASH=
--SSB_EMBEDDED=
--SSB_DRIVER_EXTIF=
--SSB_DRIVER_GIGE=
--SSB_DRIVER_GPIO=
--BCMA_POSSIBLE=
--BCMA=
--BCMA_BLOCKIO=
--BCMA_HOST_PCI_POSSIBLE=
--BCMA_HOST_PCI=
--BCMA_HOST_SOC=
--BCMA_DRIVER_PCI=
--BCMA_DRIVER_PCI_HOSTMODE=
--BCMA_DRIVER_MIPS=
--BCMA_PFLASH=
--BCMA_SFLASH=
--BCMA_NFLASH=
--BCMA_DRIVER_GMAC_CMN=
--BCMA_DRIVER_GPIO=
--BCMA_DEBUG=
- NFC=
- NFC_DIGITAL=
- NFC_NCI=
---- a/drivers/net/wireless/broadcom/b43/main.c
-+++ b/drivers/net/wireless/broadcom/b43/main.c
-@@ -2876,7 +2876,7 @@ static struct ssb_device *b43_ssb_gpio_d
- {
- 	struct ssb_bus *bus = dev->dev->sdev->bus;
- 
--#ifdef CPTCFG_SSB_DRIVER_PCICORE
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
- 	return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
- #else
- 	return bus->chipco.dev;
-@@ -4893,7 +4893,7 @@ static int b43_wireless_core_init(struct
- 	}
- 	if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
- 		hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
--#if defined(CPTCFG_B43_SSB) && defined(CPTCFG_SSB_DRIVER_PCICORE)
-+#if defined(CPTCFG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
- 	if (dev->dev->bus_type == B43_BUS_SSB &&
- 	    dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
- 	    dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
---- a/drivers/net/wireless/broadcom/b43legacy/main.c
-+++ b/drivers/net/wireless/broadcom/b43legacy/main.c
-@@ -1937,7 +1937,7 @@ static int b43legacy_gpio_init(struct b4
- 	if (dev->dev->id.revision >= 2)
- 		mask  |= 0x0010; /* FIXME: This is redundant. */
- 
--#ifdef CPTCFG_SSB_DRIVER_PCICORE
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
- 	pcidev = bus->pcicore.dev;
- #endif
- 	gpiodev = bus->chipco.dev ? : pcidev;
-@@ -1956,7 +1956,7 @@ static void b43legacy_gpio_cleanup(struc
- 	struct ssb_bus *bus = dev->dev->bus;
- 	struct ssb_device *gpiodev, *pcidev = NULL;
- 
--#ifdef CPTCFG_SSB_DRIVER_PCICORE
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
- 	pcidev = bus->pcicore.dev;
- #endif
- 	gpiodev = bus->chipco.dev ? : pcidev;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
-@@ -42,6 +42,6 @@ brcmsmac-y := \
- 	brcms_trace_events.o \
- 	debug.o
- 
--brcmsmac-$(CPTCFG_BCMA_DRIVER_GPIO) += led.o
-+brcmsmac-$(CONFIG_BCMA_DRIVER_GPIO) += led.o
- 
- obj-$(CPTCFG_BRCMSMAC)	+= brcmsmac.o
---- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
-@@ -22,7 +22,7 @@ struct brcms_led {
- 	bool active_low;
- };
- 
--#ifdef CPTCFG_BCMA_DRIVER_GPIO
-+#ifdef CONFIG_BCMA_DRIVER_GPIO
- void brcms_led_unregister(struct brcms_info *wl);
- int brcms_led_register(struct brcms_info *wl);
- #else
---- a/Kconfig.sources
-+++ b/Kconfig.sources
-@@ -9,9 +9,6 @@ source "$BACKPORT_DIR/drivers/net/wirele
- #source "$BACKPORT_DIR/drivers/net/ethernet/Kconfig"
- source "$BACKPORT_DIR/drivers/net/usb/Kconfig"
- 
--source "$BACKPORT_DIR/drivers/ssb/Kconfig"
--source "$BACKPORT_DIR/drivers/bcma/Kconfig"
--
- source "$BACKPORT_DIR/net/nfc/Kconfig"
- 
- #source "$BACKPORT_DIR/drivers/media/Kconfig"
---- a/Makefile.kernel
-+++ b/Makefile.kernel
-@@ -42,8 +42,6 @@ obj-$(CPTCFG_MAC80211) += net/mac80211/
- obj-$(CPTCFG_WLAN) += drivers/net/wireless/
- #obj-$(CPTCFG_BT) += net/bluetooth/
- #obj-$(CPTCFG_BT) += drivers/bluetooth/
--obj-$(CPTCFG_SSB) += drivers/ssb/
--obj-$(CPTCFG_BCMA) += drivers/bcma/
- #obj-$(CPTCFG_ETHERNET) += drivers/net/ethernet/
- obj-$(CPTCFG_USB_NET_RNDIS_WLAN) += drivers/net/usb/
- obj-$(CPTCFG_NFC) += net/nfc/
diff --git a/package/kernel/mac80211/patches/081-ath10k-calibration-variant.patch b/package/kernel/mac80211/patches/081-ath10k-calibration-variant.patch
deleted file mode 100644
index 272402786..000000000
--- a/package/kernel/mac80211/patches/081-ath10k-calibration-variant.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-From d06f26c5c8a41f246a9c40862a77a55725cedbd3 Mon Sep 17 00:00:00 2001
-From: Sven Eckelmann <sven.eckelmann@openmesh.com>
-Date: Fri, 8 Dec 2017 11:37:42 +0100
-Subject: ath10k: search DT for qcom,ath10k-calibration-variant
-
-Board Data File (BDF) is loaded upon driver boot-up procedure. The right
-board data file is identified on QCA4019 using bus, bmi-chip-id and
-bmi-board-id.
-
-The problem, however, can occur when the (default) board data file cannot
-fulfill with the vendor requirements and it is necessary to use a different
-board data file.
-
-This problem was solved for SMBIOS by adding a special SMBIOS type 0xF8.
-Something similar has to be provided for systems without SMBIOS but with
-device trees. No solution was specified by QCA and therefore a new one has
-to be found for ath10k.
-
-The device tree requires addition strings to define the variant name
-
-    wifi@a000000 {
-    	status = "okay";
-    	qcom,ath10k-calibration-variant = "RT-AC58U";
-    };
-
-    wifi@a800000 {
-    	status = "okay";
-    	qcom,ath10k-calibration-variant = "RT-AC58U";
-    };
-
-This would create the boarddata identifiers for the board-2.bin search
-
- *  bus=ahb,bmi-chip-id=0,bmi-board-id=16,variant=RT-AC58U
- *  bus=ahb,bmi-chip-id=0,bmi-board-id=17,variant=RT-AC58U
-
-Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
-Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
----
- drivers/net/wireless/ath/ath10k/core.c | 40 ++++++++++++++++++++++++++++------
- 1 file changed, 33 insertions(+), 7 deletions(-)
-
---- a/drivers/net/wireless/ath/ath10k/core.c
-+++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -860,6 +860,28 @@ static int ath10k_core_check_smbios(stru
- 	return 0;
- }
- 
-+static int ath10k_core_check_dt(struct ath10k *ar)
-+{
-+	struct device_node *node;
-+	const char *variant = NULL;
-+
-+	node = ar->dev->of_node;
-+	if (!node)
-+		return -ENOENT;
-+
-+	of_property_read_string(node, "qcom,ath10k-calibration-variant",
-+				&variant);
-+	if (!variant)
-+		return -ENODATA;
-+
-+	if (strscpy(ar->id.bdf_ext, variant, sizeof(ar->id.bdf_ext)) < 0)
-+		ath10k_dbg(ar, ATH10K_DBG_BOOT,
-+			   "bdf variant string is longer than the buffer can accommodate (variant: %s)\n",
-+			    variant);
-+
-+	return 0;
-+}
-+
- static int ath10k_download_and_run_otp(struct ath10k *ar)
- {
- 	u32 result, address = ar->hw_params.patch_load_addr;
-@@ -1231,19 +1253,19 @@ static int ath10k_core_create_board_name
- 	/* strlen(',variant=') + strlen(ar->id.bdf_ext) */
- 	char variant[9 + ATH10K_SMBIOS_BDF_EXT_STR_LENGTH] = { 0 };
- 
-+	if (ar->id.bdf_ext[0] != '\0')
-+		scnprintf(variant, sizeof(variant), ",variant=%s",
-+			  ar->id.bdf_ext);
-+
- 	if (ar->id.bmi_ids_valid) {
- 		scnprintf(name, name_len,
--			  "bus=%s,bmi-chip-id=%d,bmi-board-id=%d",
-+			  "bus=%s,bmi-chip-id=%d,bmi-board-id=%d%s",
- 			  ath10k_bus_str(ar->hif.bus),
- 			  ar->id.bmi_chip_id,
--			  ar->id.bmi_board_id);
-+			  ar->id.bmi_board_id, variant);
- 		goto out;
- 	}
- 
--	if (ar->id.bdf_ext[0] != '\0')
--		scnprintf(variant, sizeof(variant), ",variant=%s",
--			  ar->id.bdf_ext);
--
- 	scnprintf(name, name_len,
- 		  "bus=%s,vendor=%04x,device=%04x,subsystem-vendor=%04x,subsystem-device=%04x%s",
- 		  ath10k_bus_str(ar->hif.bus),
-@@ -2343,7 +2365,11 @@ static int ath10k_core_probe_fw(struct a
- 
- 	ret = ath10k_core_check_smbios(ar);
- 	if (ret)
--		ath10k_dbg(ar, ATH10K_DBG_BOOT, "bdf variant name not set.\n");
-+		ath10k_dbg(ar, ATH10K_DBG_BOOT, "SMBIOS bdf variant name not set.\n");
-+
-+	ret = ath10k_core_check_dt(ar);
-+	if (ret)
-+		ath10k_dbg(ar, ATH10K_DBG_BOOT, "DT bdf variant name not set.\n");
- 
- 	ret = ath10k_core_fetch_board_file(ar);
- 	if (ret) {
diff --git a/package/kernel/mac80211/patches/082-ath10k-suppress-Unknown-eventid-36925-warnings.patch b/package/kernel/mac80211/patches/082-ath10k-suppress-Unknown-eventid-36925-warnings.patch
deleted file mode 100644
index 9ddede3a6..000000000
--- a/package/kernel/mac80211/patches/082-ath10k-suppress-Unknown-eventid-36925-warnings.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 606204bb863fa3b0bb54929d79b4dc46338f9180 Mon Sep 17 00:00:00 2001
-From: Sathishkumar Muruganandam <murugana@codeaurora.org>
-Date: Tue, 27 Mar 2018 11:26:46 +0300
-Subject: [PATCH] ath10k: suppress "Unknown eventid: 36925" warnings
-
-FW has Smart Logging feature enabled by default for detecting failures
-and processing FATAL_CONDITION_EVENTID (36925 - 0x903D) back to host.
-
-Since ath10k doesn't implement the Smart Logging and FATAL CONDITION
-EVENT processing yet, suppressing the unknown event ID warning by moving
-this under ATH10K_DBG_WMI.
-
-Simulated the same issue by having associated STA powered off when
-ping flood was running from AP backbone. This triggerd STA KICKOUT
-in AP followed by FATAL CONDITION event 36925.
-
-Issue was reproduced and verified in below DUT
-------------------------------------------------
-AP mode of OpenWRT QCA9984 running 6.0.8 with FW ver 10.4-3.5.3-00053
-
-Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/ath/ath10k/wmi.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/wireless/ath/ath10k/wmi.c
-+++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -5462,6 +5462,7 @@ static void ath10k_wmi_10_4_op_rx(struct
- 	case WMI_10_4_WOW_WAKEUP_HOST_EVENTID:
- 	case WMI_10_4_PEER_RATECODE_LIST_EVENTID:
- 	case WMI_10_4_WDS_PEER_EVENTID:
-+	case WMI_10_4_DEBUG_FATAL_CONDITION_EVENTID:
- 		ath10k_dbg(ar, ATH10K_DBG_WMI,
- 			   "received event id %d not implemented\n", id);
- 		break;
diff --git a/package/kernel/mac80211/patches/090-Revert-rt2800-use-TXOP_BACKOFF-for-probe-frames.patch b/package/kernel/mac80211/patches/090-Revert-rt2800-use-TXOP_BACKOFF-for-probe-frames.patch
deleted file mode 100644
index 95feffa0e..000000000
--- a/package/kernel/mac80211/patches/090-Revert-rt2800-use-TXOP_BACKOFF-for-probe-frames.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From patchwork Mon May 28 11:25:06 2018
-Content-Type: text/plain; charset="utf-8"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 7bit
-Subject: Revert "rt2800: use TXOP_BACKOFF for probe frames"
-From: Stanislaw Gruszka <sgruszka@redhat.com>
-X-Patchwork-Id: 10431861
-Message-Id: <1527506706-6488-1-git-send-email-sgruszka@redhat.com>
-To: linux-wireless@vger.kernel.org
-Date: Mon, 28 May 2018 13:25:06 +0200
-
-This reverts commit fb47ada8dc3c30c8e7b415da155742b49536c61e.
-
-In some situations when we set TXOP_BACKOFF, the probe frame is
-not sent at all. What it worse then sending probe frame as part
-of AMPDU and can degrade 11n performance to 11g rates.
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
----
- drivers/net/wireless/ralink/rt2x00/rt2x00queue.c | 7 +++----
- 1 file changed, 3 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
-@@ -372,16 +372,15 @@ static void rt2x00queue_create_tx_descri
- 
- 	/*
- 	 * Determine IFS values
--	 * - Use TXOP_BACKOFF for probe and management frames except beacons
-+	 * - Use TXOP_BACKOFF for management frames except beacons
- 	 * - Use TXOP_SIFS for fragment bursts
- 	 * - Use TXOP_HTTXOP for everything else
- 	 *
- 	 * Note: rt2800 devices won't use CTS protection (if used)
- 	 * for frames not transmitted with TXOP_HTTXOP
- 	 */
--	if ((ieee80211_is_mgmt(hdr->frame_control) &&
--	     !ieee80211_is_beacon(hdr->frame_control)) ||
--	    (tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE))
-+	if (ieee80211_is_mgmt(hdr->frame_control) &&
-+	    !ieee80211_is_beacon(hdr->frame_control))
- 		txdesc->u.ht.txop = TXOP_BACKOFF;
- 	else if (!(tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT))
- 		txdesc->u.ht.txop = TXOP_SIFS;
diff --git a/package/kernel/mac80211/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch b/package/kernel/mac80211/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch
deleted file mode 100644
index 357b006bc..000000000
--- a/package/kernel/mac80211/patches/160-ath10k-search-all-IEs-for-variant-before-falling-back.patch
+++ /dev/null
@@ -1,237 +0,0 @@
-From: Thomas Hebb <tommyhebb@gmail.com>
-Subject: [PATCH] ath10k: search all IEs for variant before falling back
-Date: Wed, 21 Feb 2018 11:43:39 -0500
-
-commit f2593cb1b291 ("ath10k: Search SMBIOS for OEM board file
-extension") added a feature to ath10k that allows Board Data File
-(BDF) conflicts between multiple devices that use the same device IDs
-but have different calibration requirements to be resolved by allowing
-a "variant" string to be stored in SMBIOS [and later device tree, added
-by commit d06f26c5c8a4 ("ath10k: search DT for qcom,ath10k-calibration-
-variant")] that gets appended to the ID stored in board-2.bin.
-
-This original patch had a regression, however. Namely that devices with
-a variant present in SMBIOS that didn't need custom BDFs could no longer
-find the default BDF, which has no variant appended. The patch was
-reverted and re-applied with a fix for this issue in commit 1657b8f84ed9
-("search SMBIOS for OEM board file extension").
-
-But the fix to fall back to a default BDF introduced another issue: the
-driver currently parses IEs in board-2.bin one by one, and for each one
-it first checks to see if it matches the ID with the variant appended.
-If it doesn't, it checks to see if it matches the "fallback" ID with no
-variant. If a matching BDF is found at any point during this search, the
-search is terminated and that BDF is used. The issue is that it's very
-possible (and is currently the case for board-2.bin files present in the
-ath10k-firmware repository) for the default BDF to occur in an earlier
-IE than the variant-specific BDF. In this case, the current code will
-happily choose the default BDF even though a better-matching BDF is
-present later in the file.
-
-This patch fixes the issue by first searching the entire file for the ID
-with variant, and searching for the fallback ID only if that search
-fails. It also includes some code cleanup in the area, as
-ath10k_core_fetch_board_data_api_n() no longer does its own string
-mangling to remove the variant from an ID, instead leaving that job to a
-new flag passed to ath10k_core_create_board_name().
-
-I've tested this patch on a QCA4019 and verified that the driver behaves
-correctly for 1) both fallback and variant BDFs present, 2) only fallback
-BDF present, and 3) no matching BDFs present.
-
-Fixes: 1657b8f84ed9 ("ath10k: search SMBIOS for OEM board file extension")
-Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
----
- drivers/net/wireless/ath/ath10k/core.c | 134 ++++++++++++++++++---------------
- 1 file changed, 72 insertions(+), 62 deletions(-)
-
---- a/drivers/net/wireless/ath/ath10k/core.c
-+++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -1132,14 +1132,61 @@ out:
- 	return ret;
- }
- 
-+static int ath10k_core_search_bd(struct ath10k *ar,
-+				 const char *boardname,
-+				 const u8 *data,
-+				 size_t len)
-+{
-+	size_t ie_len;
-+	struct ath10k_fw_ie *hdr;
-+	int ret = -ENOENT, ie_id;
-+
-+	while (len > sizeof(struct ath10k_fw_ie)) {
-+		hdr = (struct ath10k_fw_ie *)data;
-+		ie_id = le32_to_cpu(hdr->id);
-+		ie_len = le32_to_cpu(hdr->len);
-+
-+		len -= sizeof(*hdr);
-+		data = hdr->data;
-+
-+		if (len < ALIGN(ie_len, 4)) {
-+			ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n",
-+				   ie_id, ie_len, len);
-+			return -EINVAL;
-+		}
-+
-+		switch (ie_id) {
-+		case ATH10K_BD_IE_BOARD:
-+			ret = ath10k_core_parse_bd_ie_board(ar, data, ie_len,
-+							    boardname);
-+			if (ret == -ENOENT)
-+				/* no match found, continue */
-+				break;
-+
-+			/* either found or error, so stop searching */
-+			goto out;
-+		}
-+
-+		/* jump over the padding */
-+		ie_len = ALIGN(ie_len, 4);
-+
-+		len -= ie_len;
-+		data += ie_len;
-+	}
-+
-+out:
-+	/* return result of parse_bd_ie_board() or -ENOENT */
-+	return ret;
-+}
-+
- static int ath10k_core_fetch_board_data_api_n(struct ath10k *ar,
- 					      const char *boardname,
-+					      const char *fallback_boardname,
- 					      const char *filename)
- {
--	size_t len, magic_len, ie_len;
--	struct ath10k_fw_ie *hdr;
-+	size_t len, magic_len;
- 	const u8 *data;
--	int ret, ie_id;
-+	int ret;
- 
- 	ar->normal_mode_fw.board = ath10k_fetch_fw_file(ar,
- 							ar->hw_params.fw.dir,
-@@ -1177,69 +1224,23 @@ static int ath10k_core_fetch_board_data_
- 	data += magic_len;
- 	len -= magic_len;
- 
--	while (len > sizeof(struct ath10k_fw_ie)) {
--		hdr = (struct ath10k_fw_ie *)data;
--		ie_id = le32_to_cpu(hdr->id);
--		ie_len = le32_to_cpu(hdr->len);
--
--		len -= sizeof(*hdr);
--		data = hdr->data;
--
--		if (len < ALIGN(ie_len, 4)) {
--			ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n",
--				   ie_id, ie_len, len);
--			ret = -EINVAL;
--			goto err;
--		}
-+	/* attempt to find boardname in the IE list */
-+	ret = ath10k_core_search_bd(ar, boardname, data, len);
- 
--		switch (ie_id) {
--		case ATH10K_BD_IE_BOARD:
--			ret = ath10k_core_parse_bd_ie_board(ar, data, ie_len,
--							    boardname);
--			if (ret == -ENOENT && ar->id.bdf_ext[0] != '\0') {
--				/* try default bdf if variant was not found */
--				char *s, *v = ",variant=";
--				char boardname2[100];
--
--				strlcpy(boardname2, boardname,
--					sizeof(boardname2));
--
--				s = strstr(boardname2, v);
--				if (s)
--					*s = '\0';  /* strip ",variant=%s" */
--
--				ret = ath10k_core_parse_bd_ie_board(ar, data,
--								    ie_len,
--								    boardname2);
--			}
-+	/* if we didn't find it and have a fallback name, try that */
-+	if (ret == -ENOENT && fallback_boardname)
-+		ret = ath10k_core_search_bd(ar, fallback_boardname, data, len);
- 
--			if (ret == -ENOENT)
--				/* no match found, continue */
--				break;
--			else if (ret)
--				/* there was an error, bail out */
--				goto err;
--
--			/* board data found */
--			goto out;
--		}
--
--		/* jump over the padding */
--		ie_len = ALIGN(ie_len, 4);
--
--		len -= ie_len;
--		data += ie_len;
--	}
--
--out:
--	if (!ar->normal_mode_fw.board_data || !ar->normal_mode_fw.board_len) {
-+	if (ret == -ENOENT) {
- 		ath10k_err(ar,
- 			   "failed to fetch board data for %s from %s/%s\n",
- 			   boardname, ar->hw_params.fw.dir, filename);
- 		ret = -ENODATA;
--		goto err;
- 	}
- 
-+	if (ret)
-+		goto err;
-+
- 	return 0;
- 
- err:
-@@ -1248,12 +1249,12 @@ err:
- }
- 
- static int ath10k_core_create_board_name(struct ath10k *ar, char *name,
--					 size_t name_len)
-+					 size_t name_len, bool with_variant)
- {
- 	/* strlen(',variant=') + strlen(ar->id.bdf_ext) */
- 	char variant[9 + ATH10K_SMBIOS_BDF_EXT_STR_LENGTH] = { 0 };
- 
--	if (ar->id.bdf_ext[0] != '\0')
-+	if (with_variant && ar->id.bdf_ext[0] != '\0')
- 		scnprintf(variant, sizeof(variant), ",variant=%s",
- 			  ar->id.bdf_ext);
- 
-@@ -1279,17 +1280,26 @@ out:
- 
- static int ath10k_core_fetch_board_file(struct ath10k *ar)
- {
--	char boardname[100];
-+	char boardname[100], fallback_boardname[100];
- 	int ret;
- 
--	ret = ath10k_core_create_board_name(ar, boardname, sizeof(boardname));
-+	ret = ath10k_core_create_board_name(ar, boardname,
-+					    sizeof(boardname), true);
- 	if (ret) {
- 		ath10k_err(ar, "failed to create board name: %d", ret);
- 		return ret;
- 	}
- 
-+	ret = ath10k_core_create_board_name(ar, fallback_boardname,
-+					    sizeof(boardname), false);
-+	if (ret) {
-+		ath10k_err(ar, "failed to create fallback board name: %d", ret);
-+		return ret;
-+	}
-+
- 	ar->bd_api = 2;
- 	ret = ath10k_core_fetch_board_data_api_n(ar, boardname,
-+						 fallback_boardname,
- 						 ATH10K_BOARD_API2_FILE);
- 	if (!ret)
- 		goto success;
diff --git a/package/kernel/mac80211/patches/300-v4.15-ath10k-fix-build-errors-with-CONFIG_PM.patch b/package/kernel/mac80211/patches/300-v4.15-ath10k-fix-build-errors-with-CONFIG_PM.patch
deleted file mode 100644
index 2aeb49dc1..000000000
--- a/package/kernel/mac80211/patches/300-v4.15-ath10k-fix-build-errors-with-CONFIG_PM.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From: Brian Norris <briannorris@chromium.org>
-Date: Thu, 19 Oct 2017 11:45:19 -0700
-Subject: [PATCH] ath10k: fix build errors with !CONFIG_PM
-
-Build errors have been reported with CONFIG_PM=n:
-
-drivers/net/wireless/ath/ath10k/pci.c:3416:8: error: implicit
-declaration of function 'ath10k_pci_suspend'
-[-Werror=implicit-function-declaration]
-
-drivers/net/wireless/ath/ath10k/pci.c:3428:8: error: implicit
-declaration of function 'ath10k_pci_resume'
-[-Werror=implicit-function-declaration]
-
-These are caused by the combination of the following two commits:
-
-6af1de2e4ec4 ("ath10k: mark PM functions as __maybe_unused")
-96378bd2c6cd ("ath10k: fix core PCI suspend when WoWLAN is supported but
-disabled")
-
-Both build fine on their own.
-
-But now that ath10k_pci_pm_{suspend,resume}() is compiled
-unconditionally, we should also compile ath10k_pci_{suspend,resume}()
-unconditionally.
-
-And drop the #ifdef around ath10k_pci_hif_{suspend,resume}() too; they
-are trivial (empty), so we're not saving much space by compiling them
-out. And the alternatives would be to sprinkle more __maybe_unused, or
-spread the #ifdef's further.
-
-Build tested with the following combinations:
-CONFIG_PM=y && CONFIG_PM_SLEEP=y
-CONFIG_PM=y && CONFIG_PM_SLEEP=n
-CONFIG_PM=n
-
-Fixes: 96378bd2c6cd ("ath10k: fix core PCI suspend when WoWLAN is supported but disabled")
-Fixes: 096ad2a15fd8 ("Merge branch 'ath-next'")
-Signed-off-by: Brian Norris <briannorris@chromium.org>
-Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
----
-
---- a/drivers/net/wireless/ath/ath10k/pci.c
-+++ b/drivers/net/wireless/ath/ath10k/pci.c
-@@ -2577,8 +2577,6 @@ void ath10k_pci_hif_power_down(struct at
- 	 */
- }
- 
--#ifdef CONFIG_PM
--
- static int ath10k_pci_hif_suspend(struct ath10k *ar)
- {
- 	/* Nothing to do; the important stuff is in the driver suspend. */
-@@ -2627,7 +2625,6 @@ static int ath10k_pci_resume(struct ath1
- 
- 	return ret;
- }
--#endif
- 
- static bool ath10k_pci_validate_cal(void *data, size_t size)
- {
-@@ -2782,10 +2779,8 @@ static const struct ath10k_hif_ops ath10
- 	.power_down		= ath10k_pci_hif_power_down,
- 	.read32			= ath10k_pci_read32,
- 	.write32		= ath10k_pci_write32,
--#ifdef CONFIG_PM
- 	.suspend		= ath10k_pci_hif_suspend,
- 	.resume			= ath10k_pci_hif_resume,
--#endif
- 	.fetch_cal_eeprom	= ath10k_pci_hif_fetch_cal_eeprom,
- };
- 
diff --git a/package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch b/package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch
deleted file mode 100644
index ecc5e4912..000000000
--- a/package/kernel/mac80211/patches/301-v4.15-mac80211-properly-free-requested-but-not-started-TX-.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Mon, 20 Nov 2017 17:01:44 +0100
-Subject: [PATCH] mac80211: properly free requested-but-not-started TX agg
- sessions
-
-When deleting a station or otherwise tearing down all aggregation
-sessions, make sure to delete requested but not yet started ones,
-to avoid the following scenario:
-
- * session is requested, added to tid_start_tx[]
- * ieee80211_ba_session_work() runs, gets past BLOCK_BA check
- * ieee80211_sta_tear_down_BA_sessions() runs, locks &sta->ampdu_mlme.mtx,
-   e.g. while deleting the station - deleting all active sessions
- * ieee80211_ba_session_work() continues since tear down flushes it, and
-   calls ieee80211_tx_ba_session_handle_start() for the new session, arms
-   the timer for it
- * station deletion continues to __cleanup_single_sta() and frees the
-   session struct, while the timer is armed
-
-Reported-by: Fengguang Wu <fengguang.wu@intel.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/agg-tx.c
-+++ b/net/mac80211/agg-tx.c
-@@ -330,6 +330,11 @@ int ___ieee80211_stop_tx_ba_session(stru
- 
- 	spin_lock_bh(&sta->lock);
- 
-+	/* free struct pending for start, if present */
-+	tid_tx = sta->ampdu_mlme.tid_start_tx[tid];
-+	kfree(tid_tx);
-+	sta->ampdu_mlme.tid_start_tx[tid] = NULL;
-+
- 	tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
- 	if (!tid_tx) {
- 		spin_unlock_bh(&sta->lock);
diff --git a/package/kernel/mac80211/patches/302-v4.15-mac80211-mesh-drop-frames-appearing-to-be-from-us.patch b/package/kernel/mac80211/patches/302-v4.15-mac80211-mesh-drop-frames-appearing-to-be-from-us.patch
deleted file mode 100644
index 839e92788..000000000
--- a/package/kernel/mac80211/patches/302-v4.15-mac80211-mesh-drop-frames-appearing-to-be-from-us.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Thu, 4 Jan 2018 15:51:53 +0100
-Subject: [PATCH] mac80211: mesh: drop frames appearing to be from us
-
-If there are multiple mesh stations with the same MAC address,
-they will both get confused and start throwing warnings.
-
-Obviously in this case nothing can actually work anyway, so just
-drop frames that look like they're from ourselves early on.
-
-Reported-by: Gui Iribarren <gui@altermundi.net>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -3632,6 +3632,8 @@ static bool ieee80211_accept_frame(struc
- 		}
- 		return true;
- 	case NL80211_IFTYPE_MESH_POINT:
-+		if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
-+			return false;
- 		if (multicast)
- 			return true;
- 		return ether_addr_equal(sdata->vif.addr, hdr->addr1);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0001-brcmfmac-handle-FWHALT-mailbox-indication.patch b/package/kernel/mac80211/patches/303-v4.15-0001-brcmfmac-handle-FWHALT-mailbox-indication.patch
deleted file mode 100644
index b8f3be1c8..000000000
--- a/package/kernel/mac80211/patches/303-v4.15-0001-brcmfmac-handle-FWHALT-mailbox-indication.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 2fd3877b5bb7d39782c3205a1dcda02023b8514a Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 8 Nov 2017 14:36:31 +0100
-Subject: [PATCH] brcmfmac: handle FWHALT mailbox indication
-
-The firmware uses a mailbox to communicate to the host what is going
-on. In the driver we validate the bit received. Various people seen
-the following message:
-
- brcmfmac: brcmf_sdio_hostmail: Unknown mailbox data content: 0x40012
-
-Bit 4 is cause of this message, but this actually indicates the firmware
-has halted. Handle this bit by giving a more meaningful error message.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 14 ++++++++++----
- 1 file changed, 10 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -260,10 +260,11 @@ struct rte_console {
- #define I_HMB_HOST_INT	I_HMB_SW3	/* Miscellaneous Interrupt */
- 
- /* tohostmailboxdata */
--#define HMB_DATA_NAKHANDLED	1	/* retransmit NAK'd frame */
--#define HMB_DATA_DEVREADY	2	/* talk to host after enable */
--#define HMB_DATA_FC		4	/* per prio flowcontrol update flag */
--#define HMB_DATA_FWREADY	8	/* fw ready for protocol activity */
-+#define HMB_DATA_NAKHANDLED	0x0001	/* retransmit NAK'd frame */
-+#define HMB_DATA_DEVREADY	0x0002	/* talk to host after enable */
-+#define HMB_DATA_FC		0x0004	/* per prio flowcontrol update flag */
-+#define HMB_DATA_FWREADY	0x0008	/* fw ready for protocol activity */
-+#define HMB_DATA_FWHALT		0x0010	/* firmware halted */
- 
- #define HMB_DATA_FCDATA_MASK	0xff000000
- #define HMB_DATA_FCDATA_SHIFT	24
-@@ -1094,6 +1095,10 @@ static u32 brcmf_sdio_hostmail(struct br
- 			  offsetof(struct sdpcmd_regs, tosbmailbox));
- 	bus->sdcnt.f1regdata += 2;
- 
-+	/* dongle indicates the firmware has halted/crashed */
-+	if (hmb_data & HMB_DATA_FWHALT)
-+		brcmf_err("mailbox indicates firmware halted\n");
-+
- 	/* Dongle recomposed rx frames, accept them again */
- 	if (hmb_data & HMB_DATA_NAKHANDLED) {
- 		brcmf_dbg(SDIO, "Dongle reports NAK handled, expect rtx of %d\n",
-@@ -1151,6 +1156,7 @@ static u32 brcmf_sdio_hostmail(struct br
- 			 HMB_DATA_NAKHANDLED |
- 			 HMB_DATA_FC |
- 			 HMB_DATA_FWREADY |
-+			 HMB_DATA_FWHALT |
- 			 HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
- 		brcmf_err("Unknown mailbox data content: 0x%02x\n",
- 			  hmb_data);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0002-brcmfmac-disable-packet-filtering-in-promiscuous-mod.patch b/package/kernel/mac80211/patches/303-v4.15-0002-brcmfmac-disable-packet-filtering-in-promiscuous-mod.patch
deleted file mode 100644
index 901663193..000000000
--- a/package/kernel/mac80211/patches/303-v4.15-0002-brcmfmac-disable-packet-filtering-in-promiscuous-mod.patch
+++ /dev/null
@@ -1,133 +0,0 @@
-From 6c219b0088158da839a5be63c5b3d96c145501d2 Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Wed, 8 Nov 2017 14:36:32 +0100
-Subject: [PATCH] brcmfmac: disable packet filtering in promiscuous mode
-
-Disable arp and nd offload to allow all packets sending to host.
-
-Reported-by: Phil Elwell <phil@raspberrypi.org>
-Tested-by: Phil Elwell <phil@raspberrypi.org>
-Reviewed-by: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 41 ----------------------
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 38 ++++++++++++++++++++
- .../wireless/broadcom/brcm80211/brcmfmac/core.h    |  1 +
- 3 files changed, 39 insertions(+), 41 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -472,47 +472,6 @@ send_key_to_dongle(struct brcmf_if *ifp,
- 	return err;
- }
- 
--static s32
--brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
--{
--	s32 err;
--	u32 mode;
--
--	if (enable)
--		mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
--	else
--		mode = 0;
--
--	/* Try to set and enable ARP offload feature, this may fail, then it  */
--	/* is simply not supported and err 0 will be returned                 */
--	err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
--	if (err) {
--		brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
--			  mode, err);
--		err = 0;
--	} else {
--		err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
--		if (err) {
--			brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
--				  enable, err);
--			err = 0;
--		} else
--			brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
--				  enable, mode);
--	}
--
--	err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
--	if (err) {
--		brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
--			  enable, err);
--		err = 0;
--	} else
--		brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
--			  enable, mode);
--
--	return err;
--}
--
- static void
- brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
- {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -71,6 +71,43 @@ struct brcmf_if *brcmf_get_ifp(struct br
- 	return ifp;
- }
- 
-+void brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
-+{
-+	s32 err;
-+	u32 mode;
-+
-+	if (enable)
-+		mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
-+	else
-+		mode = 0;
-+
-+	/* Try to set and enable ARP offload feature, this may fail, then it  */
-+	/* is simply not supported and err 0 will be returned                 */
-+	err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
-+	if (err) {
-+		brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
-+			  mode, err);
-+	} else {
-+		err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
-+		if (err) {
-+			brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
-+				  enable, err);
-+		} else {
-+			brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
-+				  enable, mode);
-+		}
-+	}
-+
-+	err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
-+	if (err) {
-+		brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
-+			  enable, err);
-+	} else {
-+		brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
-+			  enable, mode);
-+	}
-+}
-+
- static void _brcmf_set_multicast_list(struct work_struct *work)
- {
- 	struct brcmf_if *ifp;
-@@ -134,6 +171,7 @@ static void _brcmf_set_multicast_list(st
- 	if (err < 0)
- 		brcmf_err("Setting BRCMF_C_SET_PROMISC failed, %d\n",
- 			  err);
-+	brcmf_configure_arp_nd_offload(ifp, !cmd_value);
- }
- 
- #if IS_ENABLED(CONFIG_IPV6)
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -203,6 +203,7 @@ int brcmf_netdev_wait_pend8021x(struct b
- /* Return pointer to interface name */
- char *brcmf_ifname(struct brcmf_if *ifp);
- struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx);
-+void brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable);
- int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
- struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bsscfgidx, s32 ifidx,
- 			      bool is_p2pdev, const char *name, u8 *mac_addr);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0003-brcmfmac-cleanup-brcmf_cfg80211_escan-function.patch b/package/kernel/mac80211/patches/303-v4.15-0003-brcmfmac-cleanup-brcmf_cfg80211_escan-function.patch
deleted file mode 100644
index b6f3d0c69..000000000
--- a/package/kernel/mac80211/patches/303-v4.15-0003-brcmfmac-cleanup-brcmf_cfg80211_escan-function.patch
+++ /dev/null
@@ -1,133 +0,0 @@
-From 8c6efda22f5f9f73fc948f517424466be01ae84d Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 8 Nov 2017 14:36:33 +0100
-Subject: [PATCH] brcmfmac: cleanup brcmf_cfg80211_escan() function
-
-The function brcmf_cfg80211_escan() was always called with a non-null
-request parameter and null pointer for this_ssid parameter. Clean up
-the function removing the dead code path.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 76 ++++------------------
- 1 file changed, 11 insertions(+), 65 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -1072,18 +1072,10 @@ brcmf_do_escan(struct brcmf_if *ifp, str
- 
- static s32
- brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
--		     struct cfg80211_scan_request *request,
--		     struct cfg80211_ssid *this_ssid)
-+		     struct cfg80211_scan_request *request)
- {
--	struct brcmf_if *ifp = vif->ifp;
- 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
--	struct cfg80211_ssid *ssids;
--	u32 passive_scan;
--	bool escan_req;
--	bool spec_scan;
- 	s32 err;
--	struct brcmf_ssid_le ssid_le;
--	u32 SSID_len;
- 
- 	brcmf_dbg(SCAN, "START ESCAN\n");
- 
-@@ -1101,8 +1093,8 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
- 			  cfg->scan_status);
- 		return -EAGAIN;
- 	}
--	if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) {
--		brcmf_err("Connecting: status (%lu)\n", ifp->vif->sme_state);
-+	if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state)) {
-+		brcmf_err("Connecting: status (%lu)\n", vif->sme_state);
- 		return -EAGAIN;
- 	}
- 
-@@ -1110,63 +1102,17 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
- 	if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
- 		vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
- 
--	escan_req = false;
--	if (request) {
--		/* scan bss */
--		ssids = request->ssids;
--		escan_req = true;
--	} else {
--		/* scan in ibss */
--		/* we don't do escan in ibss */
--		ssids = this_ssid;
--	}
--
- 	cfg->scan_request = request;
- 	set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
--	if (escan_req) {
--		cfg->escan_info.run = brcmf_run_escan;
--		err = brcmf_p2p_scan_prep(wiphy, request, vif);
--		if (err)
--			goto scan_out;
--
--		err = brcmf_do_escan(vif->ifp, request);
--		if (err)
--			goto scan_out;
--	} else {
--		brcmf_dbg(SCAN, "ssid \"%s\", ssid_len (%d)\n",
--			  ssids->ssid, ssids->ssid_len);
--		memset(&ssid_le, 0, sizeof(ssid_le));
--		SSID_len = min_t(u8, sizeof(ssid_le.SSID), ssids->ssid_len);
--		ssid_le.SSID_len = cpu_to_le32(0);
--		spec_scan = false;
--		if (SSID_len) {
--			memcpy(ssid_le.SSID, ssids->ssid, SSID_len);
--			ssid_le.SSID_len = cpu_to_le32(SSID_len);
--			spec_scan = true;
--		} else
--			brcmf_dbg(SCAN, "Broadcast scan\n");
--
--		passive_scan = cfg->active_scan ? 0 : 1;
--		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
--					    passive_scan);
--		if (err) {
--			brcmf_err("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
--			goto scan_out;
--		}
--		brcmf_scan_config_mpc(ifp, 0);
--		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN, &ssid_le,
--					     sizeof(ssid_le));
--		if (err) {
--			if (err == -EBUSY)
--				brcmf_dbg(INFO, "BUSY: scan for \"%s\" canceled\n",
--					  ssid_le.SSID);
--			else
--				brcmf_err("WLC_SCAN error (%d)\n", err);
--
--			brcmf_scan_config_mpc(ifp, 1);
--			goto scan_out;
--		}
--	}
-+
-+	cfg->escan_info.run = brcmf_run_escan;
-+	err = brcmf_p2p_scan_prep(wiphy, request, vif);
-+	if (err)
-+		goto scan_out;
-+
-+	err = brcmf_do_escan(vif->ifp, request);
-+	if (err)
-+		goto scan_out;
- 
- 	/* Arm scan timeout timer */
- 	mod_timer(&cfg->escan_timeout, jiffies +
-@@ -1191,7 +1137,7 @@ brcmf_cfg80211_scan(struct wiphy *wiphy,
- 	if (!check_vif_up(vif))
- 		return -EIO;
- 
--	err = brcmf_cfg80211_escan(wiphy, vif, request, NULL);
-+	err = brcmf_cfg80211_escan(wiphy, vif, request);
- 
- 	if (err)
- 		brcmf_err("scan error (%d)\n", err);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0004-brcmfmac-use-msecs_to_jiffies-instead-of-calculation.patch b/package/kernel/mac80211/patches/303-v4.15-0004-brcmfmac-use-msecs_to_jiffies-instead-of-calculation.patch
deleted file mode 100644
index c2e3cba52..000000000
--- a/package/kernel/mac80211/patches/303-v4.15-0004-brcmfmac-use-msecs_to_jiffies-instead-of-calculation.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From df2d8388bc96c0f29d27d121f2a4cd054f8b3900 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 8 Nov 2017 14:36:34 +0100
-Subject: [PATCH] brcmfmac: use msecs_to_jiffies() instead of calculation using
- HZ
-
-Minor cleanup using provided macro to convert milliseconds interval
-to jiffies in brcmf_cfg80211_escan().
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -1115,8 +1115,8 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
- 		goto scan_out;
- 
- 	/* Arm scan timeout timer */
--	mod_timer(&cfg->escan_timeout, jiffies +
--			BRCMF_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
-+	mod_timer(&cfg->escan_timeout,
-+		  jiffies + msecs_to_jiffies(BRCMF_ESCAN_TIMER_INTERVAL_MS));
- 
- 	return 0;
- 
diff --git a/package/kernel/mac80211/patches/303-v4.15-0005-brcmfmac-get-rid-of-brcmf_cfg80211_escan-function.patch b/package/kernel/mac80211/patches/303-v4.15-0005-brcmfmac-get-rid-of-brcmf_cfg80211_escan-function.patch
deleted file mode 100644
index 575ffb018..000000000
--- a/package/kernel/mac80211/patches/303-v4.15-0005-brcmfmac-get-rid-of-brcmf_cfg80211_escan-function.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 588378f15cff285ac81c929239ccba01d7f71d50 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 8 Nov 2017 14:36:35 +0100
-Subject: [PATCH] brcmfmac: get rid of brcmf_cfg80211_escan() function
-
-The function brcmf_cfg80211_escan() is only called by brcmf_cfg80211_scan()
-so there is no reason to split in two function especially since the latter
-does not do an awful lot.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 34 +++++++---------------
- 1 file changed, 10 insertions(+), 24 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -1071,13 +1071,16 @@ brcmf_do_escan(struct brcmf_if *ifp, str
- }
- 
- static s32
--brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
--		     struct cfg80211_scan_request *request)
-+brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
- {
- 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
--	s32 err;
-+	struct brcmf_cfg80211_vif *vif;
-+	s32 err = 0;
- 
--	brcmf_dbg(SCAN, "START ESCAN\n");
-+	brcmf_dbg(TRACE, "Enter\n");
-+	vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
-+	if (!check_vif_up(vif))
-+		return -EIO;
- 
- 	if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
- 		brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
-@@ -1102,6 +1105,8 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
- 	if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
- 		vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
- 
-+	brcmf_dbg(SCAN, "START ESCAN\n");
-+
- 	cfg->scan_request = request;
- 	set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
- 
-@@ -1121,31 +1126,12 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
- 	return 0;
- 
- scan_out:
-+	brcmf_err("scan error (%d)\n", err);
- 	clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
- 	cfg->scan_request = NULL;
- 	return err;
- }
- 
--static s32
--brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
--{
--	struct brcmf_cfg80211_vif *vif;
--	s32 err = 0;
--
--	brcmf_dbg(TRACE, "Enter\n");
--	vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
--	if (!check_vif_up(vif))
--		return -EIO;
--
--	err = brcmf_cfg80211_escan(wiphy, vif, request);
--
--	if (err)
--		brcmf_err("scan error (%d)\n", err);
--
--	brcmf_dbg(TRACE, "Exit\n");
--	return err;
--}
--
- static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
- {
- 	s32 err = 0;
diff --git a/package/kernel/mac80211/patches/303-v4.15-0006-brcmfmac-get-rid-of-struct-brcmf_cfg80211_info-activ.patch b/package/kernel/mac80211/patches/303-v4.15-0006-brcmfmac-get-rid-of-struct-brcmf_cfg80211_info-activ.patch
deleted file mode 100644
index 4d4235f4b..000000000
--- a/package/kernel/mac80211/patches/303-v4.15-0006-brcmfmac-get-rid-of-struct-brcmf_cfg80211_info-activ.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From bbf35414cd23a9d7230bfd7046e1e2c26020e7eb Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 8 Nov 2017 14:36:36 +0100
-Subject: [PATCH] brcmfmac: get rid of struct brcmf_cfg80211_info::active_scan
- field
-
-The field struct brcmf_cfg80211_info::active_scan is set to true upon
-initializing the driver instance, but it is never changed so simply
-get rid of it.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 10 +---------
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h |  2 --
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c      |  5 +----
- 3 files changed, 2 insertions(+), 15 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -1043,7 +1043,6 @@ brcmf_do_escan(struct brcmf_if *ifp, str
- {
- 	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
- 	s32 err;
--	u32 passive_scan;
- 	struct brcmf_scan_results *results;
- 	struct escan_info *escan = &cfg->escan_info;
- 
-@@ -1051,13 +1050,7 @@ brcmf_do_escan(struct brcmf_if *ifp, str
- 	escan->ifp = ifp;
- 	escan->wiphy = cfg->wiphy;
- 	escan->escan_state = WL_ESCAN_STATE_SCANNING;
--	passive_scan = cfg->active_scan ? 0 : 1;
--	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
--				    passive_scan);
--	if (err) {
--		brcmf_err("error (%d)\n", err);
--		return err;
--	}
-+
- 	brcmf_scan_config_mpc(ifp, 0);
- 	results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
- 	results->version = 0;
-@@ -5767,7 +5760,6 @@ static s32 wl_init_priv(struct brcmf_cfg
- 
- 	cfg->scan_request = NULL;
- 	cfg->pwr_save = true;
--	cfg->active_scan = true;	/* we do active scan per default */
- 	cfg->dongle_up = false;		/* dongle is not up yet */
- 	err = brcmf_init_priv_mem(cfg);
- 	if (err)
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-@@ -283,7 +283,6 @@ struct brcmf_cfg80211_wowl {
-  * @scan_status: scan activity on the dongle.
-  * @pub: common driver information.
-  * @channel: current channel.
-- * @active_scan: current scan mode.
-  * @int_escan_map: bucket map for which internal e-scan is done.
-  * @ibss_starter: indicates this sta is ibss starter.
-  * @pwr_save: indicate whether dongle to support power save mode.
-@@ -316,7 +315,6 @@ struct brcmf_cfg80211_info {
- 	unsigned long scan_status;
- 	struct brcmf_pub *pub;
- 	u32 channel;
--	bool active_scan;
- 	u32 int_escan_map;
- 	bool ibss_starter;
- 	bool pwr_save;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -692,10 +692,7 @@ static s32 brcmf_p2p_escan(struct brcmf_
- 
- 	/* determine the scan engine parameters */
- 	sparams->bss_type = DOT11_BSSTYPE_ANY;
--	if (p2p->cfg->active_scan)
--		sparams->scan_type = 0;
--	else
--		sparams->scan_type = 1;
-+	sparams->scan_type = BRCMF_SCANTYPE_ACTIVE;
- 
- 	eth_broadcast_addr(sparams->bssid);
- 	sparams->home_time = cpu_to_le32(P2PAPI_SCAN_HOME_TIME_MS);
diff --git a/package/kernel/mac80211/patches/303-v4.15-0007-brcmfmac-move-configuration-of-probe-request-IEs.patch b/package/kernel/mac80211/patches/303-v4.15-0007-brcmfmac-move-configuration-of-probe-request-IEs.patch
deleted file mode 100644
index 3ad6e79db..000000000
--- a/package/kernel/mac80211/patches/303-v4.15-0007-brcmfmac-move-configuration-of-probe-request-IEs.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From bd99a3013bdc00f8fc7534c657b39616792b4467 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 8 Nov 2017 14:36:37 +0100
-Subject: [PATCH] brcmfmac: move configuration of probe request IEs
-
-The configuration of the IEs for probe requests was done in a P2P
-related function, which is not very obvious. Moving it to
-.scan callback function, ie. brcmf_cfg80211_scan().
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 5 +++++
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c      | 6 ++----
- 2 files changed, 7 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -1108,6 +1108,11 @@ brcmf_cfg80211_scan(struct wiphy *wiphy,
- 	if (err)
- 		goto scan_out;
- 
-+	err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBREQ_FLAG,
-+				    request->ie, request->ie_len);
-+	if (err)
-+		goto scan_out;
-+
- 	err = brcmf_do_escan(vif->ifp, request);
- 	if (err)
- 		goto scan_out;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -881,7 +881,7 @@ int brcmf_p2p_scan_prep(struct wiphy *wi
- {
- 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
- 	struct brcmf_p2p_info *p2p = &cfg->p2p;
--	int err = 0;
-+	int err;
- 
- 	if (brcmf_p2p_scan_is_p2p_request(request)) {
- 		/* find my listen channel */
-@@ -904,9 +904,7 @@ int brcmf_p2p_scan_prep(struct wiphy *wi
- 		/* override .run_escan() callback. */
- 		cfg->escan_info.run = brcmf_p2p_run_escan;
- 	}
--	err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBREQ_FLAG,
--				    request->ie, request->ie_len);
--	return err;
-+	return 0;
- }
- 
- 
diff --git a/package/kernel/mac80211/patches/304-v4.15-brcmfmac-add-CLM-download-support.patch b/package/kernel/mac80211/patches/304-v4.15-brcmfmac-add-CLM-download-support.patch
deleted file mode 100644
index 2cd5f7312..000000000
--- a/package/kernel/mac80211/patches/304-v4.15-brcmfmac-add-CLM-download-support.patch
+++ /dev/null
@@ -1,434 +0,0 @@
-From fdd0bd88ceaecf729db103ac8836af5805dd2dc1 Mon Sep 17 00:00:00 2001
-From: Chung-Hsien Hsu <stanley.hsu@cypress.com>
-Date: Fri, 10 Nov 2017 17:27:15 +0800
-Subject: [PATCH] brcmfmac: add CLM download support
-
-The firmware for brcmfmac devices includes information regarding
-regulatory constraints. For certain devices this information is kept
-separately in a binary form that needs to be downloaded to the device.
-This patch adds support to download this so-called CLM blob file. It
-uses the same naming scheme as the other firmware files with extension
-of .clm_blob.
-
-The CLM blob file is optional. If the file does not exist, the download
-process will be bypassed. It will not affect the driver loading.
-
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h |  10 ++
- .../wireless/broadcom/brcm80211/brcmfmac/common.c  | 157 +++++++++++++++++++++
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    |   2 +
- .../wireless/broadcom/brcm80211/brcmfmac/core.h    |   2 +
- .../broadcom/brcm80211/brcmfmac/fwil_types.h       |  31 ++++
- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |  19 +++
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |  19 +++
- .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c |  18 +++
- 8 files changed, 258 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -71,6 +71,7 @@ struct brcmf_bus_dcmd {
-  * @wowl_config: specify if dongle is configured for wowl when going to suspend
-  * @get_ramsize: obtain size of device memory.
-  * @get_memdump: obtain device memory dump in provided buffer.
-+ * @get_fwname: obtain firmware name.
-  *
-  * This structure provides an abstract interface towards the
-  * bus specific driver. For control messages to common driver
-@@ -87,6 +88,8 @@ struct brcmf_bus_ops {
- 	void (*wowl_config)(struct device *dev, bool enabled);
- 	size_t (*get_ramsize)(struct device *dev);
- 	int (*get_memdump)(struct device *dev, void *data, size_t len);
-+	int (*get_fwname)(struct device *dev, uint chip, uint chiprev,
-+			  unsigned char *fw_name);
- };
- 
- 
-@@ -224,6 +227,13 @@ int brcmf_bus_get_memdump(struct brcmf_b
- 	return bus->ops->get_memdump(bus->dev, data, len);
- }
- 
-+static inline
-+int brcmf_bus_get_fwname(struct brcmf_bus *bus, uint chip, uint chiprev,
-+			 unsigned char *fw_name)
-+{
-+	return bus->ops->get_fwname(bus->dev, chip, chiprev, fw_name);
-+}
-+
- /*
-  * interface functions from common layer
-  */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -18,6 +18,7 @@
- #include <linux/string.h>
- #include <linux/netdevice.h>
- #include <linux/module.h>
-+#include <linux/firmware.h>
- #include <brcmu_wifi.h>
- #include <brcmu_utils.h>
- #include "core.h"
-@@ -28,6 +29,7 @@
- #include "tracepoint.h"
- #include "common.h"
- #include "of.h"
-+#include "firmware.h"
- 
- MODULE_AUTHOR("Broadcom Corporation");
- MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
-@@ -104,12 +106,140 @@ void brcmf_c_set_joinpref_default(struct
- 		brcmf_err("Set join_pref error (%d)\n", err);
- }
- 
-+static int brcmf_c_download(struct brcmf_if *ifp, u16 flag,
-+			    struct brcmf_dload_data_le *dload_buf,
-+			    u32 len)
-+{
-+	s32 err;
-+
-+	flag |= (DLOAD_HANDLER_VER << DLOAD_FLAG_VER_SHIFT);
-+	dload_buf->flag = cpu_to_le16(flag);
-+	dload_buf->dload_type = cpu_to_le16(DL_TYPE_CLM);
-+	dload_buf->len = cpu_to_le32(len);
-+	dload_buf->crc = cpu_to_le32(0);
-+	len = sizeof(*dload_buf) + len - 1;
-+
-+	err = brcmf_fil_iovar_data_set(ifp, "clmload", dload_buf, len);
-+
-+	return err;
-+}
-+
-+static int brcmf_c_get_clm_name(struct brcmf_if *ifp, u8 *clm_name)
-+{
-+	struct brcmf_bus *bus = ifp->drvr->bus_if;
-+	struct brcmf_rev_info *ri = &ifp->drvr->revinfo;
-+	u8 fw_name[BRCMF_FW_NAME_LEN];
-+	u8 *ptr;
-+	size_t len;
-+	s32 err;
-+
-+	memset(fw_name, 0, BRCMF_FW_NAME_LEN);
-+	err = brcmf_bus_get_fwname(bus, ri->chipnum, ri->chiprev, fw_name);
-+	if (err) {
-+		brcmf_err("get firmware name failed (%d)\n", err);
-+		goto done;
-+	}
-+
-+	/* generate CLM blob file name */
-+	ptr = strrchr(fw_name, '.');
-+	if (!ptr) {
-+		err = -ENOENT;
-+		goto done;
-+	}
-+
-+	len = ptr - fw_name + 1;
-+	if (len + strlen(".clm_blob") > BRCMF_FW_NAME_LEN) {
-+		err = -E2BIG;
-+	} else {
-+		strlcpy(clm_name, fw_name, len);
-+		strlcat(clm_name, ".clm_blob", BRCMF_FW_NAME_LEN);
-+	}
-+done:
-+	return err;
-+}
-+
-+static int brcmf_c_process_clm_blob(struct brcmf_if *ifp)
-+{
-+	struct device *dev = ifp->drvr->bus_if->dev;
-+	struct brcmf_dload_data_le *chunk_buf;
-+	const struct firmware *clm = NULL;
-+	u8 clm_name[BRCMF_FW_NAME_LEN];
-+	u32 chunk_len;
-+	u32 datalen;
-+	u32 cumulative_len;
-+	u16 dl_flag = DL_BEGIN;
-+	u32 status;
-+	s32 err;
-+
-+	brcmf_dbg(TRACE, "Enter\n");
-+
-+	memset(clm_name, 0, BRCMF_FW_NAME_LEN);
-+	err = brcmf_c_get_clm_name(ifp, clm_name);
-+	if (err) {
-+		brcmf_err("get CLM blob file name failed (%d)\n", err);
-+		return err;
-+	}
-+
-+	err = request_firmware(&clm, clm_name, dev);
-+	if (err) {
-+		if (err == -ENOENT) {
-+			brcmf_dbg(INFO, "continue with CLM data currently present in firmware\n");
-+			return 0;
-+		}
-+		brcmf_err("request CLM blob file failed (%d)\n", err);
-+		return err;
-+	}
-+
-+	chunk_buf = kzalloc(sizeof(*chunk_buf) + MAX_CHUNK_LEN - 1, GFP_KERNEL);
-+	if (!chunk_buf) {
-+		err = -ENOMEM;
-+		goto done;
-+	}
-+
-+	datalen = clm->size;
-+	cumulative_len = 0;
-+	do {
-+		if (datalen > MAX_CHUNK_LEN) {
-+			chunk_len = MAX_CHUNK_LEN;
-+		} else {
-+			chunk_len = datalen;
-+			dl_flag |= DL_END;
-+		}
-+		memcpy(chunk_buf->data, clm->data + cumulative_len, chunk_len);
-+
-+		err = brcmf_c_download(ifp, dl_flag, chunk_buf, chunk_len);
-+
-+		dl_flag &= ~DL_BEGIN;
-+
-+		cumulative_len += chunk_len;
-+		datalen -= chunk_len;
-+	} while ((datalen > 0) && (err == 0));
-+
-+	if (err) {
-+		brcmf_err("clmload (%zu byte file) failed (%d); ",
-+			  clm->size, err);
-+		/* Retrieve clmload_status and print */
-+		err = brcmf_fil_iovar_int_get(ifp, "clmload_status", &status);
-+		if (err)
-+			brcmf_err("get clmload_status failed (%d)\n", err);
-+		else
-+			brcmf_dbg(INFO, "clmload_status=%d\n", status);
-+		err = -EIO;
-+	}
-+
-+	kfree(chunk_buf);
-+done:
-+	release_firmware(clm);
-+	return err;
-+}
-+
- int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
- {
- 	s8 eventmask[BRCMF_EVENTING_MASK_LEN];
- 	u8 buf[BRCMF_DCMD_SMLEN];
- 	struct brcmf_rev_info_le revinfo;
- 	struct brcmf_rev_info *ri;
-+	char *clmver;
- 	char *ptr;
- 	s32 err;
- 
-@@ -148,6 +278,13 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 	}
- 	ri->result = err;
- 
-+	/* Do any CLM downloading */
-+	err = brcmf_c_process_clm_blob(ifp);
-+	if (err < 0) {
-+		brcmf_err("download CLM blob file failed, %d\n", err);
-+		goto done;
-+	}
-+
- 	/* query for 'ver' to get version info from firmware */
- 	memset(buf, 0, sizeof(buf));
- 	strcpy(buf, "ver");
-@@ -167,6 +304,26 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 	ptr = strrchr(buf, ' ') + 1;
- 	strlcpy(ifp->drvr->fwver, ptr, sizeof(ifp->drvr->fwver));
- 
-+	/* Query for 'clmver' to get CLM version info from firmware */
-+	memset(buf, 0, sizeof(buf));
-+	err = brcmf_fil_iovar_data_get(ifp, "clmver", buf, sizeof(buf));
-+	if (err) {
-+		brcmf_dbg(TRACE, "retrieving clmver failed, %d\n", err);
-+	} else {
-+		clmver = (char *)buf;
-+		/* store CLM version for adding it to revinfo debugfs file */
-+		memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver));
-+
-+		/* Replace all newline/linefeed characters with space
-+		 * character
-+		 */
-+		ptr = clmver;
-+		while ((ptr = strnchr(ptr, '\n', sizeof(buf))) != NULL)
-+			*ptr = ' ';
-+
-+		brcmf_dbg(INFO, "CLM version = %s\n", clmver);
-+	}
-+
- 	/* set mpc */
- 	err = brcmf_fil_iovar_int_set(ifp, "mpc", 1);
- 	if (err) {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1009,6 +1009,8 @@ static int brcmf_revinfo_read(struct seq
- 	seq_printf(s, "anarev: %u\n", ri->anarev);
- 	seq_printf(s, "nvramrev: %08x\n", ri->nvramrev);
- 
-+	seq_printf(s, "clmver: %s\n", bus_if->drvr->clmver);
-+
- 	return 0;
- }
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -141,6 +141,8 @@ struct brcmf_pub {
- 	struct notifier_block inetaddr_notifier;
- 	struct notifier_block inet6addr_notifier;
- 	struct brcmf_mp_device *settings;
-+
-+	u8 clmver[BRCMF_DCMD_SMLEN];
- };
- 
- /* forward declarations */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-@@ -155,6 +155,21 @@
- #define BRCMF_MFP_CAPABLE		1
- #define BRCMF_MFP_REQUIRED		2
- 
-+/* MAX_CHUNK_LEN is the maximum length for data passing to firmware in each
-+ * ioctl. It is relatively small because firmware has small maximum size input
-+ * playload restriction for ioctls.
-+ */
-+#define MAX_CHUNK_LEN			1400
-+
-+#define DLOAD_HANDLER_VER		1	/* Downloader version */
-+#define DLOAD_FLAG_VER_MASK		0xf000	/* Downloader version mask */
-+#define DLOAD_FLAG_VER_SHIFT		12	/* Downloader version shift */
-+
-+#define DL_BEGIN			0x0002
-+#define DL_END				0x0004
-+
-+#define DL_TYPE_CLM			2
-+
- /* join preference types for join_pref iovar */
- enum brcmf_join_pref_types {
- 	BRCMF_JOIN_PREF_RSSI = 1,
-@@ -827,6 +842,22 @@ struct brcmf_pno_macaddr_le {
- };
- 
- /**
-+ * struct brcmf_dload_data_le - data passing to firmware for downloading
-+ * @flag: flags related to download data.
-+ * @dload_type: type of download data.
-+ * @len: length in bytes of download data.
-+ * @crc: crc of download data.
-+ * @data: download data.
-+ */
-+struct brcmf_dload_data_le {
-+	__le16 flag;
-+	__le16 dload_type;
-+	__le32 len;
-+	__le32 crc;
-+	u8 data[1];
-+};
-+
-+/**
-  * struct brcmf_pno_bssid_le - bssid configuration for PNO scan.
-  *
-  * @bssid: BSS network identifier.
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1350,6 +1350,24 @@ static int brcmf_pcie_get_memdump(struct
- 	return 0;
- }
- 
-+static int brcmf_pcie_get_fwname(struct device *dev, u32 chip, u32 chiprev,
-+				 u8 *fw_name)
-+{
-+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-+	struct brcmf_pciedev *buspub = bus_if->bus_priv.pcie;
-+	struct brcmf_pciedev_info *devinfo = buspub->devinfo;
-+	int ret = 0;
-+
-+	if (devinfo->fw_name[0] != '\0')
-+		strlcpy(fw_name, devinfo->fw_name, BRCMF_FW_NAME_LEN);
-+	else
-+		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
-+						brcmf_pcie_fwnames,
-+						ARRAY_SIZE(brcmf_pcie_fwnames),
-+						fw_name, NULL);
-+
-+	return ret;
-+}
- 
- static const struct brcmf_bus_ops brcmf_pcie_bus_ops = {
- 	.txdata = brcmf_pcie_tx,
-@@ -1359,6 +1377,7 @@ static const struct brcmf_bus_ops brcmf_
- 	.wowl_config = brcmf_pcie_wowl_config,
- 	.get_ramsize = brcmf_pcie_get_ramsize,
- 	.get_memdump = brcmf_pcie_get_memdump,
-+	.get_fwname = brcmf_pcie_get_fwname,
- };
- 
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3985,6 +3985,24 @@ brcmf_sdio_watchdog(unsigned long data)
- 	}
- }
- 
-+static int brcmf_sdio_get_fwname(struct device *dev, u32 chip, u32 chiprev,
-+				 u8 *fw_name)
-+{
-+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-+	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
-+	int ret = 0;
-+
-+	if (sdiodev->fw_name[0] != '\0')
-+		strlcpy(fw_name, sdiodev->fw_name, BRCMF_FW_NAME_LEN);
-+	else
-+		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
-+						brcmf_sdio_fwnames,
-+						ARRAY_SIZE(brcmf_sdio_fwnames),
-+						fw_name, NULL);
-+
-+	return ret;
-+}
-+
- static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
- 	.stop = brcmf_sdio_bus_stop,
- 	.preinit = brcmf_sdio_bus_preinit,
-@@ -3995,6 +4013,7 @@ static const struct brcmf_bus_ops brcmf_
- 	.wowl_config = brcmf_sdio_wowl_config,
- 	.get_ramsize = brcmf_sdio_bus_get_ramsize,
- 	.get_memdump = brcmf_sdio_bus_get_memdump,
-+	.get_fwname = brcmf_sdio_get_fwname,
- };
- 
- static void brcmf_sdio_firmware_callback(struct device *dev, int err,
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1128,12 +1128,30 @@ static void brcmf_usb_wowl_config(struct
- 		device_set_wakeup_enable(devinfo->dev, false);
- }
- 
-+static int brcmf_usb_get_fwname(struct device *dev, u32 chip, u32 chiprev,
-+				u8 *fw_name)
-+{
-+	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
-+	int ret = 0;
-+
-+	if (devinfo->fw_name[0] != '\0')
-+		strlcpy(fw_name, devinfo->fw_name, BRCMF_FW_NAME_LEN);
-+	else
-+		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
-+						brcmf_usb_fwnames,
-+						ARRAY_SIZE(brcmf_usb_fwnames),
-+						fw_name, NULL);
-+
-+	return ret;
-+}
-+
- static const struct brcmf_bus_ops brcmf_usb_bus_ops = {
- 	.txdata = brcmf_usb_tx,
- 	.stop = brcmf_usb_down,
- 	.txctl = brcmf_usb_tx_ctlpkt,
- 	.rxctl = brcmf_usb_rx_ctlpkt,
- 	.wowl_config = brcmf_usb_wowl_config,
-+	.get_fwname = brcmf_usb_get_fwname,
- };
- 
- static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo)
diff --git a/package/kernel/mac80211/patches/305-v4.15-brcmfmac-change-driver-unbind-order-of-the-sdio-func.patch b/package/kernel/mac80211/patches/305-v4.15-brcmfmac-change-driver-unbind-order-of-the-sdio-func.patch
deleted file mode 100644
index 3649bdda4..000000000
--- a/package/kernel/mac80211/patches/305-v4.15-brcmfmac-change-driver-unbind-order-of-the-sdio-func.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 5c3de777bdaf48bd0cfb43097c0d0fb85056cab7 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Sat, 25 Nov 2017 21:39:25 +0100
-Subject: [PATCH] brcmfmac: change driver unbind order of the sdio function
- devices
-
-In the function brcmf_sdio_firmware_callback() the driver is
-unbound from the sdio function devices in the error path.
-However, the order in which it is done resulted in a use-after-free
-issue (see brcmf_ops_sdio_remove() in bcmsdh.c). Hence change
-the order and first unbind sdio function #2 device and then
-unbind sdio function #1 device.
-
-Cc: stable@vger.kernel.org # v4.12.x
-Fixes: 7a51461fc2da ("brcmfmac: unbind all devices upon failure in firmware callback")
-Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4121,8 +4121,8 @@ release:
- 	sdio_release_host(sdiodev->func[1]);
- fail:
- 	brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
--	device_release_driver(dev);
- 	device_release_driver(&sdiodev->func[2]->dev);
-+	device_release_driver(dev);
- }
- 
- struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
diff --git a/package/kernel/mac80211/patches/306-v4.15-brcmfmac-Avoid-build-error-with-make-W-1.patch b/package/kernel/mac80211/patches/306-v4.15-brcmfmac-Avoid-build-error-with-make-W-1.patch
deleted file mode 100644
index 7344580d3..000000000
--- a/package/kernel/mac80211/patches/306-v4.15-brcmfmac-Avoid-build-error-with-make-W-1.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 51ef7925e10688c57186d438e784532e063492e4 Mon Sep 17 00:00:00 2001
-From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Date: Thu, 23 Nov 2017 17:57:04 +0200
-Subject: [PATCH] brcmfmac: Avoid build error with make W=1
-
-When I run make W=1 on gcc (Debian 7.2.0-16) 7.2.0 I got an error for
-the first run, all next ones are okay.
-
-  CC [M]  drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o
-drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:2078: error: Cannot parse struct or union!
-scripts/Makefile.build:310: recipe for target 'drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o' failed
-
-Seems like something happened with W=1 and wrong kernel doc format.
-As a quick fix remove dubious /** in the code.
-
-Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -2070,7 +2070,7 @@ static int brcmf_sdio_txpkt_hdalign(stru
- 	return head_pad;
- }
- 
--/**
-+/*
-  * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for
-  * bus layer usage.
-  */
diff --git a/package/kernel/mac80211/patches/307-v4.15-brcmfmac-fix-CLM-load-error-for-legacy-chips-when-us.patch b/package/kernel/mac80211/patches/307-v4.15-brcmfmac-fix-CLM-load-error-for-legacy-chips-when-us.patch
deleted file mode 100644
index ead5e7214..000000000
--- a/package/kernel/mac80211/patches/307-v4.15-brcmfmac-fix-CLM-load-error-for-legacy-chips-when-us.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From cc124d5cc8d81985c3511892d7a6d546552ff754 Mon Sep 17 00:00:00 2001
-From: Wright Feng <wright.feng@cypress.com>
-Date: Tue, 16 Jan 2018 17:26:50 +0800
-Subject: [PATCH] brcmfmac: fix CLM load error for legacy chips when user
- helper is enabled
-
-For legacy chips without CLM blob files, kernel with user helper function
-returns -EAGAIN when we request_firmware(), and then driver got failed
-when bringing up legacy chips. We expect the CLM blob file for legacy chip
-is not existence in firmware path, but the -ENOENT error is transferred to
--EAGAIN in firmware_class.c with user helper.
-Because of that, we continue with CLM data currently present in firmware
-if getting error from doing request_firmware().
-
-Cc: stable@vger.kernel.org # v4.15.y
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Wright Feng <wright.feng@cypress.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 9 +++------
- 1 file changed, 3 insertions(+), 6 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -182,12 +182,9 @@ static int brcmf_c_process_clm_blob(stru
- 
- 	err = request_firmware(&clm, clm_name, dev);
- 	if (err) {
--		if (err == -ENOENT) {
--			brcmf_dbg(INFO, "continue with CLM data currently present in firmware\n");
--			return 0;
--		}
--		brcmf_err("request CLM blob file failed (%d)\n", err);
--		return err;
-+		brcmf_info("no clm_blob available(err=%d), device may have limited channels available\n",
-+			   err);
-+		return 0;
- 	}
- 
- 	chunk_buf = kzalloc(sizeof(*chunk_buf) + MAX_CHUNK_LEN - 1, GFP_KERNEL);
diff --git a/package/kernel/mac80211/patches/308-v4.16-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch b/package/kernel/mac80211/patches/308-v4.16-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch
deleted file mode 100644
index 703051fe1..000000000
--- a/package/kernel/mac80211/patches/308-v4.16-0001-ath9k-move-spectral-scan-support-under-a-separate-co.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From 9df7ddc3ed25b7d3473f117a0680b9418adb5753 Mon Sep 17 00:00:00 2001
-Message-Id: <9df7ddc3ed25b7d3473f117a0680b9418adb5753.1515610034.git.mschiffer@universe-factory.net>
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Mon, 27 Nov 2017 18:56:22 +0100
-Subject: [PATCH 1/2] ath9k: move spectral scan support under a separate config
- symbol
-
-At the moment, spectral scan support, and with it RELAY, is always enabled
-with ATH9K[_HTC]_DEBUGFS. Spectral scan support is currently the only user
-of RELAY in ath9k, and it unconditionally reserves a relay channel.
-
-Having debugfs support in ath9k is often useful even on very small embedded
-routers, where we'd rather like to avoid the code size and RAM usage of the
-relay support.
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
----
- drivers/net/wireless/ath/ath9k/Kconfig           | 14 ++++++++++----
- drivers/net/wireless/ath/ath9k/Makefile          |  4 ++--
- drivers/net/wireless/ath/ath9k/common-spectral.h |  4 ++--
- 3 files changed, 14 insertions(+), 8 deletions(-)
-
---- a/drivers/net/wireless/ath/ath9k/Kconfig
-+++ b/drivers/net/wireless/ath/ath9k/Kconfig
-@@ -64,13 +64,12 @@ config ATH9K_DEBUGFS
- 	depends on ATH9K && DEBUG_FS
- 	select MAC80211_DEBUGFS
- 	select ATH9K_COMMON_DEBUG
--	depends on RELAY
- 	---help---
- 	  Say Y, if you need access to ath9k's statistics for
- 	  interrupts, rate control, etc.
- 
--	  Also required for changing debug message flags at run time.
--	  As well as access to the FFT/spectral data and TX99.
-+	  Also required for changing debug message flags at run time and for
-+	  TX99.
- 
- config ATH9K_STATION_STATISTICS
- 	bool "Detailed station statistics"
-@@ -181,7 +180,6 @@ config ATH9K_HTC_DEBUGFS
- 	bool "Atheros ath9k_htc debugging"
- 	depends on ATH9K_HTC && DEBUG_FS
- 	select ATH9K_COMMON_DEBUG
--	depends on RELAY
- 	---help---
- 	  Say Y, if you need access to ath9k_htc's statistics.
- 	  As well as access to the FFT/spectral data.
-@@ -197,3 +195,11 @@ config ATH9K_HWRNG
- 
- 	  Say Y, feeds the entropy directly from the WiFi driver to the input
- 	  pool.
-+
-+config ATH9K_COMMON_SPECTRAL
-+	bool "Atheros ath9k/ath9k_htc spectral scan support"
-+	depends on ATH9K_DEBUGFS || ATH9K_HTC_DEBUGFS
-+	depends on RELAY
-+	default n
-+	---help---
-+	  Say Y to enable access to the FFT/spectral data via debugfs.
---- a/drivers/net/wireless/ath/ath9k/Makefile
-+++ b/drivers/net/wireless/ath/ath9k/Makefile
-@@ -61,8 +61,8 @@ ath9k_common-y:=	common.o \
- 			common-init.o \
- 			common-beacon.o \
- 
--ath9k_common-$(CPTCFG_ATH9K_COMMON_DEBUG) += common-debug.o \
--					     common-spectral.o
-+ath9k_common-$(CPTCFG_ATH9K_COMMON_DEBUG) += common-debug.o
-+ath9k_common-$(CPTCFG_ATH9K_COMMON_SPECTRAL) += common-spectral.o
- 
- ath9k_htc-y +=	htc_hst.o \
- 		hif_usb.o \
---- a/drivers/net/wireless/ath/ath9k/common-spectral.h
-+++ b/drivers/net/wireless/ath/ath9k/common-spectral.h
-@@ -151,7 +151,7 @@ static inline u8 spectral_bitmap_weight(
- 	return bins[0] & 0x3f;
- }
- 
--#ifdef CPTCFG_ATH9K_COMMON_DEBUG
-+#ifdef CPTCFG_ATH9K_COMMON_SPECTRAL
- void ath9k_cmn_spectral_init_debug(struct ath_spec_scan_priv *spec_priv, struct dentry *debugfs_phy);
- void ath9k_cmn_spectral_deinit_debug(struct ath_spec_scan_priv *spec_priv);
- 
-@@ -183,6 +183,6 @@ static inline int ath_cmn_process_fft(st
- {
- 	return 0;
- }
--#endif /* CPTCFG_ATH9K_COMMON_DEBUG */
-+#endif /* CPTCFG_ATH9K_COMMON_SPECTRAL */
- 
- #endif /* SPECTRAL_H */
---- a/local-symbols
-+++ b/local-symbols
-@@ -116,6 +116,7 @@ ATH9K_PCOEM=
- ATH9K_HTC=
- ATH9K_HTC_DEBUGFS=
- ATH9K_HWRNG=
-+ATH9K_COMMON_SPECTRAL=
- CARL9170=
- CARL9170_LEDS=
- CARL9170_DEBUGFS=
diff --git a/package/kernel/mac80211/patches/309-v4.16-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch b/package/kernel/mac80211/patches/309-v4.16-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch
deleted file mode 100644
index 9eefdbce6..000000000
--- a/package/kernel/mac80211/patches/309-v4.16-0002-ath10k-move-spectral-scan-support-under-a-separate-c.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-From 42e01cb9cb109fb0bb4743f6c54d6aa67ac39b61 Mon Sep 17 00:00:00 2001
-Message-Id: <42e01cb9cb109fb0bb4743f6c54d6aa67ac39b61.1515610034.git.mschiffer@universe-factory.net>
-In-Reply-To: <9df7ddc3ed25b7d3473f117a0680b9418adb5753.1515610034.git.mschiffer@universe-factory.net>
-References: <9df7ddc3ed25b7d3473f117a0680b9418adb5753.1515610034.git.mschiffer@universe-factory.net>
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Mon, 27 Nov 2017 18:56:23 +0100
-Subject: [PATCH 2/2] ath10k: move spectral scan support under a separate
- config symbol
-
-At the moment, spectral scan support, and with it RELAY, is always enabled
-with ATH10K_DEBUGFS. Spectral scan support is currently the only user of
-RELAY in ath10k, and it unconditionally reserves a relay channel.
-
-Having debugfs support in ath10k is often useful even on very small
-embedded routers, where we'd rather like to avoid the code size and RAM
-usage of the relay support. While ath10k-based devices usually have more
-resources than ath9k-based ones, it makes sense to keep the configuration
-symmetric to ath9k, so the same base kernel without RELAY can be used for
-both ath9k and ath10k hardware.
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
----
- drivers/net/wireless/ath/ath10k/Kconfig    | 9 ++++++++-
- drivers/net/wireless/ath/ath10k/Makefile   | 2 +-
- drivers/net/wireless/ath/ath10k/spectral.h | 4 ++--
- 3 files changed, 11 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/ath/ath10k/Kconfig
-+++ b/drivers/net/wireless/ath/ath10k/Kconfig
-@@ -51,12 +51,19 @@ config ATH10K_DEBUG
- config ATH10K_DEBUGFS
- 	bool "Atheros ath10k debugfs support"
- 	depends on ATH10K && DEBUG_FS
--	depends on RELAY
- 	---help---
- 	  Enabled debugfs support
- 
- 	  If unsure, say Y to make it easier to debug problems.
- 
-+config ATH10K_SPECTRAL
-+	bool "Atheros ath10k spectral scan support"
-+	depends on ATH10K_DEBUGFS
-+	depends on RELAY
-+	default n
-+	---help---
-+	  Say Y to enable access to the FFT/spectral data via debugfs.
-+
- config ATH10K_TRACING
- 	depends on !KERNEL_3_4
- 	bool "Atheros ath10k tracing support"
---- a/drivers/net/wireless/ath/ath10k/Makefile
-+++ b/drivers/net/wireless/ath/ath10k/Makefile
-@@ -14,7 +14,7 @@ ath10k_core-y += mac.o \
- 		 p2p.o \
- 		 swap.o
- 
--ath10k_core-$(CPTCFG_ATH10K_DEBUGFS) += spectral.o
-+ath10k_core-$(CPTCFG_ATH10K_SPECTRAL) += spectral.o
- ath10k_core-$(CPTCFG_NL80211_TESTMODE) += testmode.o
- ath10k_core-$(CPTCFG_ATH10K_TRACING) += trace.o
- ath10k_core-$(CPTCFG_ATH10K_THERMAL) += thermal.o
---- a/drivers/net/wireless/ath/ath10k/spectral.h
-+++ b/drivers/net/wireless/ath/ath10k/spectral.h
-@@ -44,7 +44,7 @@ enum ath10k_spectral_mode {
- 	SPECTRAL_MANUAL,
- };
- 
--#ifdef CPTCFG_ATH10K_DEBUGFS
-+#ifdef CPTCFG_ATH10K_SPECTRAL
- 
- int ath10k_spectral_process_fft(struct ath10k *ar,
- 				struct wmi_phyerr_ev_arg *phyerr,
-@@ -85,6 +85,6 @@ static inline void ath10k_spectral_destr
- {
- }
- 
--#endif /* CPTCFG_ATH10K_DEBUGFS */
-+#endif /* CPTCFG_ATH10K_SPECTRAL */
- 
- #endif /* SPECTRAL_H */
---- a/local-symbols
-+++ b/local-symbols
-@@ -140,6 +140,7 @@ ATH10K_SDIO=
- ATH10K_USB=
- ATH10K_DEBUG=
- ATH10K_DEBUGFS=
-+ATH10K_SPECTRAL=
- ATH10K_THERMAL=
- ATH10K_TRACING=
- ATH10K_DFS_CERTIFIED=
diff --git a/package/kernel/mac80211/patches/310-v4.16-ath9k-discard-undersized-packets.patch b/package/kernel/mac80211/patches/310-v4.16-ath9k-discard-undersized-packets.patch
deleted file mode 100644
index b2b2fcf4a..000000000
--- a/package/kernel/mac80211/patches/310-v4.16-ath9k-discard-undersized-packets.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 17 Jan 2018 11:11:17 +0100
-Subject: [PATCH] ath9k: discard undersized packets
-
-Sometimes the hardware will push small packets that trigger a WARN_ON
-in mac80211. Discard them early to avoid this issue.
-
-Reported-by: Stijn Tintel <stijn@linux-ipv6.be>
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/recv.c
-+++ b/drivers/net/wireless/ath/ath9k/recv.c
-@@ -826,9 +826,9 @@ static int ath9k_rx_skb_preprocess(struc
- 	sc->rx.discard_next = false;
- 
- 	/*
--	 * Discard zero-length packets.
-+	 * Discard zero-length packets and packets smaller than an ACK
- 	 */
--	if (!rx_stats->rs_datalen) {
-+	if (rx_stats->rs_datalen < 10) {
- 		RX_STAT_INC(rx_len_err);
- 		goto corrupt;
- 	}
diff --git a/package/kernel/mac80211/patches/311-v4.16-0001-brcmfmac-Fix-parameter-order-in-brcmf_sdiod_f0_write.patch b/package/kernel/mac80211/patches/311-v4.16-0001-brcmfmac-Fix-parameter-order-in-brcmf_sdiod_f0_write.patch
deleted file mode 100644
index 616a82119..000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0001-brcmfmac-Fix-parameter-order-in-brcmf_sdiod_f0_write.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 1fd3ae124d5e675f57cf7e3c601fb8f7712e0329 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:38 +0100
-Subject: [PATCH] brcmfmac: Fix parameter order in brcmf_sdiod_f0_writeb()
-
-All the other IO functions are the other way round in this
-driver. Make this one match.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -230,8 +230,8 @@ void brcmf_sdiod_change_state(struct brc
- 	sdiodev->state = state;
- }
- 
--static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func,
--					uint regaddr, u8 byte)
-+static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func, u8 byte,
-+					uint regaddr)
- {
- 	int err_ret;
- 
-@@ -269,8 +269,8 @@ static int brcmf_sdiod_request_data(stru
- 			if (fn)
- 				sdio_writeb(func, *(u8 *)data, addr, &ret);
- 			else
--				ret = brcmf_sdiod_f0_writeb(func, addr,
--							    *(u8 *)data);
-+				ret = brcmf_sdiod_f0_writeb(func, *(u8 *)data,
-+							    addr);
- 		} else {
- 			if (fn)
- 				*(u8 *)data = sdio_readb(func, addr, &ret);
diff --git a/package/kernel/mac80211/patches/311-v4.16-0002-brcmfmac-Register-sizes-on-hardware-are-not-dependen.patch b/package/kernel/mac80211/patches/311-v4.16-0002-brcmfmac-Register-sizes-on-hardware-are-not-dependen.patch
deleted file mode 100644
index 719268f8f..000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0002-brcmfmac-Register-sizes-on-hardware-are-not-dependen.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 1e6f676f43aa4270ebc5cff8e32a55f72362e042 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:39 +0100
-Subject: [PATCH] brcmfmac: Register sizes on hardware are not dependent on
- compiler types
-
-The 4 IO functions in this patch are incorrect as they use compiler types
-to determine how many bytes to send to the hardware.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 22 +++++++++++-----------
- 1 file changed, 11 insertions(+), 11 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -264,7 +264,7 @@ static int brcmf_sdiod_request_data(stru
- 	func = sdiodev->func[fn];
- 
- 	switch (regsz) {
--	case sizeof(u8):
-+	case 1:
- 		if (write) {
- 			if (fn)
- 				sdio_writeb(func, *(u8 *)data, addr, &ret);
-@@ -278,13 +278,13 @@ static int brcmf_sdiod_request_data(stru
- 				*(u8 *)data = sdio_f0_readb(func, addr, &ret);
- 		}
- 		break;
--	case sizeof(u16):
-+	case 2:
- 		if (write)
- 			sdio_writew(func, *(u16 *)data, addr, &ret);
- 		else
- 			*(u16 *)data = sdio_readw(func, addr, &ret);
- 		break;
--	case sizeof(u32):
-+	case 4:
- 		if (write)
- 			sdio_writel(func, *(u32 *)data, addr, &ret);
- 		else
-@@ -368,7 +368,7 @@ brcmf_sdiod_set_sbaddr_window(struct brc
- 	for (i = 0; i < 3; i++) {
- 		err = brcmf_sdiod_regrw_helper(sdiodev,
- 					       SBSDIO_FUNC1_SBADDRLOW + i,
--					       sizeof(u8), &addr[i], true);
-+					       1, &addr[i], true);
- 		if (err) {
- 			brcmf_err("failed at addr: 0x%0x\n",
- 				  SBSDIO_FUNC1_SBADDRLOW + i);
-@@ -407,7 +407,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
--	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
-+	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 1, &data,
- 					  false);
- 	brcmf_dbg(SDIO, "data:0x%02x\n", data);
- 
-@@ -423,10 +423,10 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
--	retval = brcmf_sdiod_addrprep(sdiodev, sizeof(data), &addr);
-+	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
- 	if (retval)
- 		goto done;
--	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
-+	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 4, &data,
- 					  false);
- 	brcmf_dbg(SDIO, "data:0x%08x\n", data);
- 
-@@ -443,7 +443,7 @@ void brcmf_sdiod_regwb(struct brcmf_sdio
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%02x\n", addr, data);
--	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
-+	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 1, &data,
- 					  true);
- 	if (ret)
- 		*ret = retval;
-@@ -455,10 +455,10 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
--	retval = brcmf_sdiod_addrprep(sdiodev, sizeof(data), &addr);
-+	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
- 	if (retval)
- 		goto done;
--	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
-+	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 4, &data,
- 					  true);
- 
- done:
-@@ -876,7 +876,7 @@ int brcmf_sdiod_abort(struct brcmf_sdio_
- 
- 	/* issue abort cmd52 command through F0 */
- 	brcmf_sdiod_request_data(sdiodev, SDIO_FUNC_0, SDIO_CCCR_ABORT,
--				 sizeof(t_func), &t_func, true);
-+				 1, &t_func, true);
- 
- 	brcmf_dbg(SDIO, "Exit\n");
- 	return 0;
diff --git a/package/kernel/mac80211/patches/311-v4.16-0003-brcmfmac-Split-brcmf_sdiod_regrw_helper-up.patch b/package/kernel/mac80211/patches/311-v4.16-0003-brcmfmac-Split-brcmf_sdiod_regrw_helper-up.patch
deleted file mode 100644
index b04465ae4..000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0003-brcmfmac-Split-brcmf_sdiod_regrw_helper-up.patch
+++ /dev/null
@@ -1,179 +0,0 @@
-From 0fcc9fe0048422d66bb906eaa73cc75e11ff7345 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:40 +0100
-Subject: [PATCH] brcmfmac: Split brcmf_sdiod_regrw_helper() up.
-
-This large function is concealing a LOT of obscure logic about
-how the hardware functions. Time to split it up.
-
-This first patch splits the function into two pieces - read and write,
-doing away with the rw flag in the process.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 94 +++++++++++++++++-----
- 1 file changed, 73 insertions(+), 21 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -302,8 +302,8 @@ static int brcmf_sdiod_request_data(stru
- 	return ret;
- }
- 
--static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
--				   u8 regsz, void *data, bool write)
-+static int brcmf_sdiod_reg_write(struct brcmf_sdio_dev *sdiodev, u32 addr,
-+				 u8 regsz, void *data)
- {
- 	u8 func;
- 	s32 retry = 0;
-@@ -324,13 +324,66 @@ static int brcmf_sdiod_regrw_helper(stru
- 		func = SDIO_FUNC_1;
- 
- 	do {
--		if (!write)
--			memset(data, 0, regsz);
- 		/* for retry wait for 1 ms till bus get settled down */
- 		if (retry)
- 			usleep_range(1000, 2000);
-+
-+		ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
-+					       data, true);
-+
-+	} while (ret != 0 && ret != -ENOMEDIUM &&
-+		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
-+
-+	if (ret == -ENOMEDIUM) {
-+		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
-+	} else if (ret != 0) {
-+		/*
-+		 * SleepCSR register access can fail when
-+		 * waking up the device so reduce this noise
-+		 * in the logs.
-+		 */
-+		if (addr != SBSDIO_FUNC1_SLEEPCSR)
-+			brcmf_err("failed to write data F%d@0x%05x, err: %d\n",
-+				  func, addr, ret);
-+		else
-+			brcmf_dbg(SDIO, "failed to write data F%d@0x%05x, err: %d\n",
-+				  func, addr, ret);
-+	}
-+
-+	return ret;
-+}
-+
-+static int brcmf_sdiod_reg_read(struct brcmf_sdio_dev *sdiodev, u32 addr,
-+				u8 regsz, void *data)
-+{
-+	u8 func;
-+	s32 retry = 0;
-+	int ret;
-+
-+	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
-+		return -ENOMEDIUM;
-+
-+	/*
-+	 * figure out how to read the register based on address range
-+	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
-+	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
-+	 * The rest: function 1 silicon backplane core registers
-+	 */
-+	if ((addr & ~REG_F0_REG_MASK) == 0)
-+		func = SDIO_FUNC_0;
-+	else
-+		func = SDIO_FUNC_1;
-+
-+	do {
-+		memset(data, 0, regsz);
-+
-+		/* for retry wait for 1 ms till bus get settled down */
-+		if (retry)
-+			usleep_range(1000, 2000);
-+
- 		ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
--					       data, write);
-+					       data, false);
-+
- 	} while (ret != 0 && ret != -ENOMEDIUM &&
- 		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
- 
-@@ -343,12 +396,13 @@ static int brcmf_sdiod_regrw_helper(stru
- 		 * in the logs.
- 		 */
- 		if (addr != SBSDIO_FUNC1_SLEEPCSR)
--			brcmf_err("failed to %s data F%d@0x%05x, err: %d\n",
--				  write ? "write" : "read", func, addr, ret);
-+			brcmf_err("failed to read data F%d@0x%05x, err: %d\n",
-+				  func, addr, ret);
- 		else
--			brcmf_dbg(SDIO, "failed to %s data F%d@0x%05x, err: %d\n",
--				  write ? "write" : "read", func, addr, ret);
-+			brcmf_dbg(SDIO, "failed to read data F%d@0x%05x, err: %d\n",
-+				  func, addr, ret);
- 	}
-+
- 	return ret;
- }
- 
-@@ -366,13 +420,11 @@ brcmf_sdiod_set_sbaddr_window(struct brc
- 	addr[2] = (address >> 24) & SBSDIO_SBADDRHIGH_MASK;
- 
- 	for (i = 0; i < 3; i++) {
--		err = brcmf_sdiod_regrw_helper(sdiodev,
--					       SBSDIO_FUNC1_SBADDRLOW + i,
--					       1, &addr[i], true);
-+		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i, addr[i],
-+				  &err);
- 		if (err) {
- 			brcmf_err("failed at addr: 0x%0x\n",
- 				  SBSDIO_FUNC1_SBADDRLOW + i);
--			break;
- 		}
- 	}
- 
-@@ -407,8 +459,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
--	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 1, &data,
--					  false);
-+	retval = brcmf_sdiod_reg_read(sdiodev, addr, 1, &data);
- 	brcmf_dbg(SDIO, "data:0x%02x\n", data);
- 
- 	if (ret)
-@@ -426,8 +477,9 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
- 	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
- 	if (retval)
- 		goto done;
--	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 4, &data,
--					  false);
-+
-+	retval = brcmf_sdiod_reg_read(sdiodev, addr, 4, &data);
-+
- 	brcmf_dbg(SDIO, "data:0x%08x\n", data);
- 
- done:
-@@ -443,8 +495,8 @@ void brcmf_sdiod_regwb(struct brcmf_sdio
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%02x\n", addr, data);
--	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 1, &data,
--					  true);
-+	retval = brcmf_sdiod_reg_write(sdiodev, addr, 1, &data);
-+
- 	if (ret)
- 		*ret = retval;
- }
-@@ -458,8 +510,8 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
- 	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
- 	if (retval)
- 		goto done;
--	retval = brcmf_sdiod_regrw_helper(sdiodev, addr, 4, &data,
--					  true);
-+
-+	retval = brcmf_sdiod_reg_write(sdiodev, addr, 4, &data);
- 
- done:
- 	if (ret)
diff --git a/package/kernel/mac80211/patches/311-v4.16-0004-brcmfmac-Clean-up-brcmf_sdiod_set_sbaddr_window.patch b/package/kernel/mac80211/patches/311-v4.16-0004-brcmfmac-Clean-up-brcmf_sdiod_set_sbaddr_window.patch
deleted file mode 100644
index 1f0488a62..000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0004-brcmfmac-Clean-up-brcmf_sdiod_set_sbaddr_window.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From b9b0d290bc0c90a5a262bc89c9d995988ea98669 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:41 +0100
-Subject: [PATCH] brcmfmac: Clean up brcmf_sdiod_set_sbaddr_window()
-
-This function sets the address of the IO window used for
-SDIO accesses onto the backplane of the chip.
-
-It currently uses 3 separate masks despite the full mask being
-defined in the code already. Remove the separate masks and clean up.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c   | 17 +++++------------
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h |  3 ---
- 2 files changed, 5 insertions(+), 15 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -410,23 +410,16 @@ static int
- brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
- {
- 	int err = 0, i;
--	u8 addr[3];
-+	u32 addr;
- 
- 	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
- 		return -ENOMEDIUM;
- 
--	addr[0] = (address >> 8) & SBSDIO_SBADDRLOW_MASK;
--	addr[1] = (address >> 16) & SBSDIO_SBADDRMID_MASK;
--	addr[2] = (address >> 24) & SBSDIO_SBADDRHIGH_MASK;
-+	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
- 
--	for (i = 0; i < 3; i++) {
--		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i, addr[i],
--				  &err);
--		if (err) {
--			brcmf_err("failed at addr: 0x%0x\n",
--				  SBSDIO_FUNC1_SBADDRLOW + i);
--		}
--	}
-+	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
-+		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
-+				  addr & 0xff, &err);
- 
- 	return err;
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -133,9 +133,6 @@
- 
- /* valid bits in SBSDIO_FUNC1_SBADDRxxx regs */
- 
--#define SBSDIO_SBADDRLOW_MASK		0x80	/* Valid bits in SBADDRLOW */
--#define SBSDIO_SBADDRMID_MASK		0xff	/* Valid bits in SBADDRMID */
--#define SBSDIO_SBADDRHIGH_MASK		0xffU	/* Valid bits in SBADDRHIGH */
- /* Address bits from SBADDR regs */
- #define SBSDIO_SBWINDOW_MASK		0xffff8000
- 
diff --git a/package/kernel/mac80211/patches/311-v4.16-0005-brcmfmac-Remove-dead-IO-code.patch b/package/kernel/mac80211/patches/311-v4.16-0005-brcmfmac-Remove-dead-IO-code.patch
deleted file mode 100644
index 7d50ce923..000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0005-brcmfmac-Remove-dead-IO-code.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-From ea243e9077b3545f20d93884e91c50ac0719685a Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:42 +0100
-Subject: [PATCH] brcmfmac: Remove dead IO code
-
-The value passed to brcmf_sdiod_addrprep() is *always* 4
-remove this parameter and the unused code to handle it.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 18 ++++++++----------
- 1 file changed, 8 insertions(+), 10 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -425,7 +425,7 @@ brcmf_sdiod_set_sbaddr_window(struct brc
- }
- 
- static int
--brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, uint width, u32 *addr)
-+brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, u32 *addr)
- {
- 	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
- 	int err = 0;
-@@ -439,9 +439,7 @@ brcmf_sdiod_addrprep(struct brcmf_sdio_d
- 	}
- 
- 	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
--
--	if (width == 4)
--		*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
-+	*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 	return 0;
- }
-@@ -467,7 +465,7 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
--	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
-+	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
- 	if (retval)
- 		goto done;
- 
-@@ -500,7 +498,7 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
--	retval = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
-+	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
- 	if (retval)
- 		goto done;
- 
-@@ -736,7 +734,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
- 
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pkt->len);
- 
--	err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
-+	err = brcmf_sdiod_addrprep(sdiodev, &addr);
- 	if (err)
- 		goto done;
- 
-@@ -757,7 +755,7 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n",
- 		  addr, pktq->qlen);
- 
--	err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
-+	err = brcmf_sdiod_addrprep(sdiodev, &addr);
- 	if (err)
- 		goto done;
- 
-@@ -801,7 +799,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
- 
- 	memcpy(mypkt->data, buf, nbytes);
- 
--	err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
-+	err = brcmf_sdiod_addrprep(sdiodev, &addr);
- 
- 	if (!err)
- 		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, true, addr,
-@@ -821,7 +819,7 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
- 
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pktq->qlen);
- 
--	err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
-+	err = brcmf_sdiod_addrprep(sdiodev, &addr);
- 	if (err)
- 		return err;
- 
diff --git a/package/kernel/mac80211/patches/311-v4.16-0006-brcmfmac-Remove-bandaid-for-SleepCSR.patch b/package/kernel/mac80211/patches/311-v4.16-0006-brcmfmac-Remove-bandaid-for-SleepCSR.patch
deleted file mode 100644
index fef29fc71..000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0006-brcmfmac-Remove-bandaid-for-SleepCSR.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 4a3338ba2a7421db2260159cca5a27bd2ee36d00 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:43 +0100
-Subject: [PATCH] brcmfmac: Remove bandaid for SleepCSR
-
-Register access code is not the place for band-aid fixes like this.
-If this is a genuine problem, it should be fixed further up in the driver
-stack.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 28 +---------------------
- 1 file changed, 1 insertion(+), 27 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -334,21 +334,8 @@ static int brcmf_sdiod_reg_write(struct
- 	} while (ret != 0 && ret != -ENOMEDIUM &&
- 		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
- 
--	if (ret == -ENOMEDIUM) {
-+	if (ret == -ENOMEDIUM)
- 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
--	} else if (ret != 0) {
--		/*
--		 * SleepCSR register access can fail when
--		 * waking up the device so reduce this noise
--		 * in the logs.
--		 */
--		if (addr != SBSDIO_FUNC1_SLEEPCSR)
--			brcmf_err("failed to write data F%d@0x%05x, err: %d\n",
--				  func, addr, ret);
--		else
--			brcmf_dbg(SDIO, "failed to write data F%d@0x%05x, err: %d\n",
--				  func, addr, ret);
--	}
- 
- 	return ret;
- }
-@@ -389,19 +376,6 @@ static int brcmf_sdiod_reg_read(struct b
- 
- 	if (ret == -ENOMEDIUM)
- 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
--	else if (ret != 0) {
--		/*
--		 * SleepCSR register access can fail when
--		 * waking up the device so reduce this noise
--		 * in the logs.
--		 */
--		if (addr != SBSDIO_FUNC1_SLEEPCSR)
--			brcmf_err("failed to read data F%d@0x%05x, err: %d\n",
--				  func, addr, ret);
--		else
--			brcmf_dbg(SDIO, "failed to read data F%d@0x%05x, err: %d\n",
--				  func, addr, ret);
--	}
- 
- 	return ret;
- }
diff --git a/package/kernel/mac80211/patches/311-v4.16-0007-brcmfmac-Remove-brcmf_sdiod_request_data.patch b/package/kernel/mac80211/patches/311-v4.16-0007-brcmfmac-Remove-brcmf_sdiod_request_data.patch
deleted file mode 100644
index 552f9fb44..000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0007-brcmfmac-Remove-brcmf_sdiod_request_data.patch
+++ /dev/null
@@ -1,344 +0,0 @@
-From 993a98a42e6e790fd0d2bf7d55a031513c7ba7dc Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:44 +0100
-Subject: [PATCH] brcmfmac: Remove brcmf_sdiod_request_data()
-
-This function is obfuscating how IO works on this chip. Remove it
-and push its logic into brcmf_sdiod_reg_{read,write}().
-
-Handling of -ENOMEDIUM is altered, but as that's pretty much broken anyway
-we can ignore that.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 237 ++++++++-------------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |   2 +-
- 2 files changed, 87 insertions(+), 152 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -230,6 +230,43 @@ void brcmf_sdiod_change_state(struct brc
- 	sdiodev->state = state;
- }
- 
-+static int brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev,
-+					 u32 address)
-+{
-+	int err = 0, i;
-+	u32 addr;
-+
-+	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
-+		return -ENOMEDIUM;
-+
-+	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
-+
-+	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
-+		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
-+				  addr & 0xff, &err);
-+
-+	return err;
-+}
-+
-+static int brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, u32 *addr)
-+{
-+	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
-+	int err = 0;
-+
-+	if (bar0 != sdiodev->sbwad) {
-+		err = brcmf_sdiod_set_sbaddr_window(sdiodev, bar0);
-+		if (err)
-+			return err;
-+
-+		sdiodev->sbwad = bar0;
-+	}
-+
-+	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
-+	*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
-+
-+	return 0;
-+}
-+
- static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func, u8 byte,
- 					uint regaddr)
- {
-@@ -249,173 +286,84 @@ static inline int brcmf_sdiod_f0_writeb(
- 	return err_ret;
- }
- 
--static int brcmf_sdiod_request_data(struct brcmf_sdio_dev *sdiodev, u8 fn,
--				    u32 addr, u8 regsz, void *data, bool write)
--{
--	struct sdio_func *func;
--	int ret = -EINVAL;
--
--	brcmf_dbg(SDIO, "rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
--		  write, fn, addr, regsz);
--
--	/* only allow byte access on F0 */
--	if (WARN_ON(regsz > 1 && !fn))
--		return -EINVAL;
--	func = sdiodev->func[fn];
--
--	switch (regsz) {
--	case 1:
--		if (write) {
--			if (fn)
--				sdio_writeb(func, *(u8 *)data, addr, &ret);
--			else
--				ret = brcmf_sdiod_f0_writeb(func, *(u8 *)data,
--							    addr);
--		} else {
--			if (fn)
--				*(u8 *)data = sdio_readb(func, addr, &ret);
--			else
--				*(u8 *)data = sdio_f0_readb(func, addr, &ret);
--		}
--		break;
--	case 2:
--		if (write)
--			sdio_writew(func, *(u16 *)data, addr, &ret);
--		else
--			*(u16 *)data = sdio_readw(func, addr, &ret);
--		break;
--	case 4:
--		if (write)
--			sdio_writel(func, *(u32 *)data, addr, &ret);
--		else
--			*(u32 *)data = sdio_readl(func, addr, &ret);
--		break;
--	default:
--		brcmf_err("invalid size: %d\n", regsz);
--		break;
--	}
--
--	if (ret)
--		brcmf_dbg(SDIO, "failed to %s data F%d@0x%05x, err: %d\n",
--			  write ? "write" : "read", fn, addr, ret);
--
--	return ret;
--}
--
- static int brcmf_sdiod_reg_write(struct brcmf_sdio_dev *sdiodev, u32 addr,
- 				 u8 regsz, void *data)
- {
--	u8 func;
--	s32 retry = 0;
- 	int ret;
- 
--	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
--		return -ENOMEDIUM;
--
- 	/*
- 	 * figure out how to read the register based on address range
- 	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
- 	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
- 	 * The rest: function 1 silicon backplane core registers
-+	 * f0 writes must be bytewise
- 	 */
--	if ((addr & ~REG_F0_REG_MASK) == 0)
--		func = SDIO_FUNC_0;
--	else
--		func = SDIO_FUNC_1;
--
--	do {
--		/* for retry wait for 1 ms till bus get settled down */
--		if (retry)
--			usleep_range(1000, 2000);
- 
--		ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
--					       data, true);
--
--	} while (ret != 0 && ret != -ENOMEDIUM &&
--		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
-+	if ((addr & ~REG_F0_REG_MASK) == 0) {
-+		if (WARN_ON(regsz > 1))
-+			return -EINVAL;
-+		ret = brcmf_sdiod_f0_writeb(sdiodev->func[0],
-+					    *(u8 *)data, addr);
-+	} else {
-+		switch (regsz) {
-+		case 1:
-+			sdio_writeb(sdiodev->func[1], *(u8 *)data, addr, &ret);
-+			break;
-+		case 4:
-+			ret = brcmf_sdiod_addrprep(sdiodev, &addr);
-+			if (ret)
-+				goto done;
- 
--	if (ret == -ENOMEDIUM)
--		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
-+			sdio_writel(sdiodev->func[1], *(u32 *)data, addr, &ret);
-+			break;
-+		default:
-+			WARN(1, "Invalid reg size\n");
-+			ret = -EINVAL;
-+			break;
-+		}
-+	}
- 
-+done:
- 	return ret;
- }
- 
- static int brcmf_sdiod_reg_read(struct brcmf_sdio_dev *sdiodev, u32 addr,
- 				u8 regsz, void *data)
- {
--	u8 func;
--	s32 retry = 0;
- 	int ret;
- 
--	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
--		return -ENOMEDIUM;
--
- 	/*
- 	 * figure out how to read the register based on address range
- 	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
- 	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
- 	 * The rest: function 1 silicon backplane core registers
-+	 * f0 reads must be bytewise
- 	 */
--	if ((addr & ~REG_F0_REG_MASK) == 0)
--		func = SDIO_FUNC_0;
--	else
--		func = SDIO_FUNC_1;
--
--	do {
--		memset(data, 0, regsz);
--
--		/* for retry wait for 1 ms till bus get settled down */
--		if (retry)
--			usleep_range(1000, 2000);
--
--		ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
--					       data, false);
--
--	} while (ret != 0 && ret != -ENOMEDIUM &&
--		 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
--
--	if (ret == -ENOMEDIUM)
--		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
--
--	return ret;
--}
--
--static int
--brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
--{
--	int err = 0, i;
--	u32 addr;
--
--	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
--		return -ENOMEDIUM;
--
--	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
--
--	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
--		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
--				  addr & 0xff, &err);
--
--	return err;
--}
--
--static int
--brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, u32 *addr)
--{
--	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
--	int err = 0;
--
--	if (bar0 != sdiodev->sbwad) {
--		err = brcmf_sdiod_set_sbaddr_window(sdiodev, bar0);
--		if (err)
--			return err;
-+	if ((addr & ~REG_F0_REG_MASK) == 0) {
-+		if (WARN_ON(regsz > 1))
-+			return -EINVAL;
-+		*(u8 *)data = sdio_f0_readb(sdiodev->func[0], addr, &ret);
-+	} else {
-+		switch (regsz) {
-+		case 1:
-+			*(u8 *)data = sdio_readb(sdiodev->func[1], addr, &ret);
-+			break;
-+		case 4:
-+			ret = brcmf_sdiod_addrprep(sdiodev, &addr);
-+			if (ret)
-+				goto done;
- 
--		sdiodev->sbwad = bar0;
-+			*(u32 *)data = sdio_readl(sdiodev->func[1], addr, &ret);
-+			break;
-+		default:
-+			WARN(1, "Invalid reg size\n");
-+			ret = -EINVAL;
-+			break;
-+		}
- 	}
- 
--	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
--	*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
--
--	return 0;
-+done:
-+	return ret;
- }
- 
- u8 brcmf_sdiod_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
-@@ -439,15 +387,9 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
--	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
--	if (retval)
--		goto done;
--
- 	retval = brcmf_sdiod_reg_read(sdiodev, addr, 4, &data);
--
- 	brcmf_dbg(SDIO, "data:0x%08x\n", data);
- 
--done:
- 	if (ret)
- 		*ret = retval;
- 
-@@ -472,13 +414,8 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
--	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
--	if (retval)
--		goto done;
--
- 	retval = brcmf_sdiod_reg_write(sdiodev, addr, 4, &data);
- 
--done:
- 	if (ret)
- 		*ret = retval;
- }
-@@ -886,14 +823,12 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 	return bcmerror;
- }
- 
--int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn)
-+int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn)
- {
--	char t_func = (char)fn;
- 	brcmf_dbg(SDIO, "Enter\n");
- 
- 	/* issue abort cmd52 command through F0 */
--	brcmf_sdiod_request_data(sdiodev, SDIO_FUNC_0, SDIO_CCCR_ABORT,
--				 1, &t_func, true);
-+	brcmf_sdiod_reg_write(sdiodev, SDIO_CCCR_ABORT, 1, &fn);
- 
- 	brcmf_dbg(SDIO, "Exit\n");
- 	return 0;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -339,7 +339,7 @@ int brcmf_sdiod_ramrw(struct brcmf_sdio_
- 		      u8 *data, uint size);
- 
- /* Issue an abort to the specified function */
--int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn);
-+int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn);
- void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev);
- void brcmf_sdiod_change_state(struct brcmf_sdio_dev *sdiodev,
- 			      enum brcmf_sdiod_state state);
diff --git a/package/kernel/mac80211/patches/311-v4.16-0008-brcmfmac-Fix-asymmetric-IO-functions.patch b/package/kernel/mac80211/patches/311-v4.16-0008-brcmfmac-Fix-asymmetric-IO-functions.patch
deleted file mode 100644
index bcf59722b..000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0008-brcmfmac-Fix-asymmetric-IO-functions.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 3508a056a1f45d95c874fc9af8748bf4229432b6 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:45 +0100
-Subject: [PATCH] brcmfmac: Fix asymmetric IO functions.
-
-Unlikely to be a problem, but brcmf_sdiod_regrl() is
-not symmetric with brcmf_sdiod_regrb() in initializing
-the data value on stack. Fix that.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-[arend: reword the commit message a bit]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -383,7 +383,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
- 
- u32 brcmf_sdiod_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
- {
--	u32 data = 0;
-+	u32 data;
- 	int retval;
- 
- 	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
diff --git a/package/kernel/mac80211/patches/311-v4.16-0009-brcmfmac-Remove-noisy-debugging.patch b/package/kernel/mac80211/patches/311-v4.16-0009-brcmfmac-Remove-noisy-debugging.patch
deleted file mode 100644
index 9a570450a..000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0009-brcmfmac-Remove-noisy-debugging.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 12e3e74e2820e11d91ee44fd3a190cd80d109faa Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:46 +0100
-Subject: [PATCH] brcmfmac: Remove noisy debugging.
-
-If you need debugging this low level, you're doing something wrong.
-Remove these noisy debug statements so the code is more readable.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 6 ------
- 1 file changed, 6 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -371,9 +371,7 @@ u8 brcmf_sdiod_regrb(struct brcmf_sdio_d
- 	u8 data;
- 	int retval;
- 
--	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
- 	retval = brcmf_sdiod_reg_read(sdiodev, addr, 1, &data);
--	brcmf_dbg(SDIO, "data:0x%02x\n", data);
- 
- 	if (ret)
- 		*ret = retval;
-@@ -386,9 +384,7 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
- 	u32 data;
- 	int retval;
- 
--	brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
- 	retval = brcmf_sdiod_reg_read(sdiodev, addr, 4, &data);
--	brcmf_dbg(SDIO, "data:0x%08x\n", data);
- 
- 	if (ret)
- 		*ret = retval;
-@@ -401,7 +397,6 @@ void brcmf_sdiod_regwb(struct brcmf_sdio
- {
- 	int retval;
- 
--	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%02x\n", addr, data);
- 	retval = brcmf_sdiod_reg_write(sdiodev, addr, 1, &data);
- 
- 	if (ret)
-@@ -413,7 +408,6 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
- {
- 	int retval;
- 
--	brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
- 	retval = brcmf_sdiod_reg_write(sdiodev, addr, 4, &data);
- 
- 	if (ret)
diff --git a/package/kernel/mac80211/patches/311-v4.16-0010-brcmfmac-Rename-bcmerror-to-err.patch b/package/kernel/mac80211/patches/311-v4.16-0010-brcmfmac-Rename-bcmerror-to-err.patch
deleted file mode 100644
index dd153fe6c..000000000
--- a/package/kernel/mac80211/patches/311-v4.16-0010-brcmfmac-Rename-bcmerror-to-err.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From dd8a2d49e4ed321ab8e7b679499c3a98ccc5ca24 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Mon, 13 Nov 2017 21:35:47 +0100
-Subject: [PATCH] brcmfmac: Rename bcmerror to err
-
-Trivial cleanup of nasty variable name
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 14 +++++++-------
- 1 file changed, 7 insertions(+), 7 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -746,7 +746,7 @@ int
- brcmf_sdiod_ramrw(struct brcmf_sdio_dev *sdiodev, bool write, u32 address,
- 		  u8 *data, uint size)
- {
--	int bcmerror = 0;
-+	int err = 0;
- 	struct sk_buff *pkt;
- 	u32 sdaddr;
- 	uint dsize;
-@@ -771,8 +771,8 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 	/* Do the transfer(s) */
- 	while (size) {
- 		/* Set the backplane window to include the start address */
--		bcmerror = brcmf_sdiod_set_sbaddr_window(sdiodev, address);
--		if (bcmerror)
-+		err = brcmf_sdiod_set_sbaddr_window(sdiodev, address);
-+		if (err)
- 			break;
- 
- 		brcmf_dbg(SDIO, "%s %d bytes at offset 0x%08x in window 0x%08x\n",
-@@ -785,9 +785,9 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 		skb_put(pkt, dsize);
- 		if (write)
- 			memcpy(pkt->data, data, dsize);
--		bcmerror = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_1, write,
--					      sdaddr, pkt);
--		if (bcmerror) {
-+		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_1, write, sdaddr,
-+					 pkt);
-+		if (err) {
- 			brcmf_err("membytes transfer failed\n");
- 			break;
- 		}
-@@ -814,7 +814,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 
- 	sdio_release_host(sdiodev->func[1]);
- 
--	return bcmerror;
-+	return err;
- }
- 
- int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn)
diff --git a/package/kernel/mac80211/patches/312-v4.16-0001-brcmfmac-Split-brcmf_sdiod_buffrw-function-up.patch b/package/kernel/mac80211/patches/312-v4.16-0001-brcmfmac-Split-brcmf_sdiod_buffrw-function-up.patch
deleted file mode 100644
index c260b9655..000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0001-brcmfmac-Split-brcmf_sdiod_buffrw-function-up.patch
+++ /dev/null
@@ -1,143 +0,0 @@
-From 8f13c87ccc495e30de5f58bbda967f6edd5bec53 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:26 +0100
-Subject: [PATCH] brcmfmac: Split brcmf_sdiod_buffrw function up.
-
-This function needs to be split up into separate read / write variants
-for clarity.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 67 +++++++++++++++-------
- 1 file changed, 45 insertions(+), 22 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -414,8 +414,8 @@ void brcmf_sdiod_regwl(struct brcmf_sdio
- 		*ret = retval;
- }
- 
--static int brcmf_sdiod_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
--			     bool write, u32 addr, struct sk_buff *pkt)
-+static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev, uint fn,
-+				 u32 addr, struct sk_buff *pkt)
- {
- 	unsigned int req_sz;
- 	int err;
-@@ -424,18 +424,36 @@ static int brcmf_sdiod_buffrw(struct brc
- 	req_sz = pkt->len + 3;
- 	req_sz &= (uint)~3;
- 
--	if (write)
--		err = sdio_memcpy_toio(sdiodev->func[fn], addr,
--				       ((u8 *)(pkt->data)), req_sz);
--	else if (fn == 1)
--		err = sdio_memcpy_fromio(sdiodev->func[fn], ((u8 *)(pkt->data)),
--					 addr, req_sz);
-+	if (fn == 1)
-+		err = sdio_memcpy_fromio(sdiodev->func[fn],
-+					 ((u8 *)(pkt->data)), addr, req_sz);
- 	else
- 		/* function 2 read is FIFO operation */
--		err = sdio_readsb(sdiodev->func[fn], ((u8 *)(pkt->data)), addr,
--				  req_sz);
-+		err = sdio_readsb(sdiodev->func[fn],
-+				  ((u8 *)(pkt->data)), addr, req_sz);
-+
-+	if (err == -ENOMEDIUM)
-+		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
-+
-+	return err;
-+}
-+
-+static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev, uint fn,
-+				  u32 addr, struct sk_buff *pkt)
-+{
-+	unsigned int req_sz;
-+	int err;
-+
-+	/* Single skb use the standard mmc interface */
-+	req_sz = pkt->len + 3;
-+	req_sz &= (uint)~3;
-+
-+	err = sdio_memcpy_toio(sdiodev->func[fn], addr,
-+			       ((u8 *)(pkt->data)), req_sz);
-+
- 	if (err == -ENOMEDIUM)
- 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
-+
- 	return err;
- }
- 
-@@ -643,7 +661,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
- 	if (err)
- 		goto done;
- 
--	err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr, pkt);
-+	err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr, pkt);
- 
- done:
- 	return err;
-@@ -665,14 +683,14 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 		goto done;
- 
- 	if (pktq->qlen == 1)
--		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
--					 pktq->next);
-+		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
-+					    pktq->next);
- 	else if (!sdiodev->sg_support) {
- 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
- 		if (!glom_skb)
- 			return -ENOMEM;
--		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
--					 glom_skb);
-+		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
-+					    glom_skb);
- 		if (err)
- 			goto done;
- 
-@@ -707,8 +725,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
- 	err = brcmf_sdiod_addrprep(sdiodev, &addr);
- 
- 	if (!err)
--		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, true, addr,
--					 mypkt);
-+		err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2, addr, mypkt);
- 
- 	brcmu_pkt_buf_free_skb(mypkt);
- 	return err;
-@@ -730,8 +747,8 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
- 
- 	if (pktq->qlen == 1 || !sdiodev->sg_support)
- 		skb_queue_walk(pktq, skb) {
--			err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, true,
--						 addr, skb);
-+			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2,
-+						     addr, skb);
- 			if (err)
- 				break;
- 		}
-@@ -783,10 +800,16 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 		sdaddr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 		skb_put(pkt, dsize);
--		if (write)
-+
-+		if (write) {
- 			memcpy(pkt->data, data, dsize);
--		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_1, write, sdaddr,
--					 pkt);
-+			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_1,
-+						     sdaddr, pkt);
-+		} else {
-+			err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_1,
-+						    sdaddr, pkt);
-+		}
-+
- 		if (err) {
- 			brcmf_err("membytes transfer failed\n");
- 			break;
diff --git a/package/kernel/mac80211/patches/312-v4.16-0002-brcmfmac-whitespace-fixes-in-brcmf_sdiod_send_buf.patch b/package/kernel/mac80211/patches/312-v4.16-0002-brcmfmac-whitespace-fixes-in-brcmf_sdiod_send_buf.patch
deleted file mode 100644
index 088a6169f..000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0002-brcmfmac-whitespace-fixes-in-brcmf_sdiod_send_buf.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 6e24dd012bfda479d0046f7995058f167e1923bc Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:27 +0100
-Subject: [PATCH] brcmfmac: whitespace fixes in brcmf_sdiod_send_buf()
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-[arend: mention function in patch subject]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -714,6 +714,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
- 	int err;
- 
- 	mypkt = brcmu_pkt_buf_get_skb(nbytes);
-+
- 	if (!mypkt) {
- 		brcmf_err("brcmu_pkt_buf_get_skb failed: len %d\n",
- 			  nbytes);
-@@ -728,8 +729,8 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
- 		err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2, addr, mypkt);
- 
- 	brcmu_pkt_buf_free_skb(mypkt);
--	return err;
- 
-+	return err;
- }
- 
- int brcmf_sdiod_send_pkt(struct brcmf_sdio_dev *sdiodev,
diff --git a/package/kernel/mac80211/patches/312-v4.16-0003-brcmfmac-Clarify-if-using-braces.patch b/package/kernel/mac80211/patches/312-v4.16-0003-brcmfmac-Clarify-if-using-braces.patch
deleted file mode 100644
index a44155b61..000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0003-brcmfmac-Clarify-if-using-braces.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From a7323378dcf1f10a98f47b744e6f65e6fd671d84 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:28 +0100
-Subject: [PATCH] brcmfmac: Clarify if using braces.
-
-Whilst this if () statement is technically correct, it lacks clarity.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -746,16 +746,17 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
- 	if (err)
- 		return err;
- 
--	if (pktq->qlen == 1 || !sdiodev->sg_support)
-+	if (pktq->qlen == 1 || !sdiodev->sg_support) {
- 		skb_queue_walk(pktq, skb) {
- 			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2,
- 						     addr, skb);
- 			if (err)
- 				break;
- 		}
--	else
-+	} else {
- 		err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, true, addr,
- 					    pktq);
-+	}
- 
- 	return err;
- }
diff --git a/package/kernel/mac80211/patches/312-v4.16-0004-brcmfmac-Rename-replace-old-IO-functions-with-simple.patch b/package/kernel/mac80211/patches/312-v4.16-0004-brcmfmac-Rename-replace-old-IO-functions-with-simple.patch
deleted file mode 100644
index 7c27e1777..000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0004-brcmfmac-Rename-replace-old-IO-functions-with-simple.patch
+++ /dev/null
@@ -1,831 +0,0 @@
-From 71bd508d7ded8c504ef05d1b4befecfe25e54cb1 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:29 +0100
-Subject: [PATCH] brcmfmac: Rename / replace old IO functions with simpler
- ones.
-
-Primarily this patch removes:
-
-brcmf_sdiod_f0_writeb()
-brcmf_sdiod_reg_write()
-brcmf_sdiod_reg_read()
-
-Since we no longer use the quirky method of deciding which function to
-address via the address being accessed, take the opportunity to rename
-some IO functions more in line with common kernel code. We also convert
-those that map directly to sdio_{read,write}*() to macros.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 169 +++----------------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 186 ++++++++++-----------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |  28 +++-
- 3 files changed, 138 insertions(+), 245 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -137,27 +137,27 @@ int brcmf_sdiod_intr_register(struct brc
- 		if (sdiodev->bus_if->chip == BRCM_CC_43362_CHIP_ID) {
- 			/* assign GPIO to SDIO core */
- 			addr = CORE_CC_REG(SI_ENUM_BASE, gpiocontrol);
--			gpiocontrol = brcmf_sdiod_regrl(sdiodev, addr, &ret);
-+			gpiocontrol = brcmf_sdiod_readl(sdiodev, addr, &ret);
- 			gpiocontrol |= 0x2;
--			brcmf_sdiod_regwl(sdiodev, addr, gpiocontrol, &ret);
-+			brcmf_sdiod_writel(sdiodev, addr, gpiocontrol, &ret);
- 
--			brcmf_sdiod_regwb(sdiodev, SBSDIO_GPIO_SELECT, 0xf,
--					  &ret);
--			brcmf_sdiod_regwb(sdiodev, SBSDIO_GPIO_OUT, 0, &ret);
--			brcmf_sdiod_regwb(sdiodev, SBSDIO_GPIO_EN, 0x2, &ret);
-+			brcmf_sdiod_writeb(sdiodev, SBSDIO_GPIO_SELECT,
-+					   0xf, &ret);
-+			brcmf_sdiod_writeb(sdiodev, SBSDIO_GPIO_OUT, 0, &ret);
-+			brcmf_sdiod_writeb(sdiodev, SBSDIO_GPIO_EN, 0x2, &ret);
- 		}
- 
- 		/* must configure SDIO_CCCR_IENx to enable irq */
--		data = brcmf_sdiod_regrb(sdiodev, SDIO_CCCR_IENx, &ret);
-+		data = brcmf_sdiod_func0_rb(sdiodev, SDIO_CCCR_IENx, &ret);
- 		data |= 1 << SDIO_FUNC_1 | 1 << SDIO_FUNC_2 | 1;
--		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_IENx, data, &ret);
-+		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, data, &ret);
- 
- 		/* redirect, configure and enable io for interrupt signal */
- 		data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
- 		if (pdata->oob_irq_flags & IRQF_TRIGGER_HIGH)
- 			data |= SDIO_SEPINT_ACT_HI;
--		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, data, &ret);
--
-+		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT,
-+				     data, &ret);
- 		sdio_release_host(sdiodev->func[1]);
- 	} else {
- 		brcmf_dbg(SDIO, "Entering\n");
-@@ -183,8 +183,8 @@ void brcmf_sdiod_intr_unregister(struct
- 
- 		pdata = &sdiodev->settings->bus.sdio;
- 		sdio_claim_host(sdiodev->func[1]);
--		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
--		brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
-+		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
-+		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
- 		sdio_release_host(sdiodev->func[1]);
- 
- 		sdiodev->oob_irq_requested = false;
-@@ -242,8 +242,8 @@ static int brcmf_sdiod_set_sbaddr_window
- 	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
- 
- 	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
--		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
--				  addr & 0xff, &err);
-+		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
-+				   addr & 0xff, &err);
- 
- 	return err;
- }
-@@ -267,124 +267,15 @@ static int brcmf_sdiod_addrprep(struct b
- 	return 0;
- }
- 
--static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func, u8 byte,
--					uint regaddr)
--{
--	int err_ret;
--
--	/*
--	 * Can only directly write to some F0 registers.
--	 * Handle CCCR_IENx and CCCR_ABORT command
--	 * as a special case.
--	 */
--	if ((regaddr == SDIO_CCCR_ABORT) ||
--	    (regaddr == SDIO_CCCR_IENx))
--		sdio_writeb(func, byte, regaddr, &err_ret);
--	else
--		sdio_f0_writeb(func, byte, regaddr, &err_ret);
--
--	return err_ret;
--}
--
--static int brcmf_sdiod_reg_write(struct brcmf_sdio_dev *sdiodev, u32 addr,
--				 u8 regsz, void *data)
--{
--	int ret;
--
--	/*
--	 * figure out how to read the register based on address range
--	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
--	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
--	 * The rest: function 1 silicon backplane core registers
--	 * f0 writes must be bytewise
--	 */
--
--	if ((addr & ~REG_F0_REG_MASK) == 0) {
--		if (WARN_ON(regsz > 1))
--			return -EINVAL;
--		ret = brcmf_sdiod_f0_writeb(sdiodev->func[0],
--					    *(u8 *)data, addr);
--	} else {
--		switch (regsz) {
--		case 1:
--			sdio_writeb(sdiodev->func[1], *(u8 *)data, addr, &ret);
--			break;
--		case 4:
--			ret = brcmf_sdiod_addrprep(sdiodev, &addr);
--			if (ret)
--				goto done;
--
--			sdio_writel(sdiodev->func[1], *(u32 *)data, addr, &ret);
--			break;
--		default:
--			WARN(1, "Invalid reg size\n");
--			ret = -EINVAL;
--			break;
--		}
--	}
--
--done:
--	return ret;
--}
--
--static int brcmf_sdiod_reg_read(struct brcmf_sdio_dev *sdiodev, u32 addr,
--				u8 regsz, void *data)
--{
--	int ret;
--
--	/*
--	 * figure out how to read the register based on address range
--	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
--	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
--	 * The rest: function 1 silicon backplane core registers
--	 * f0 reads must be bytewise
--	 */
--	if ((addr & ~REG_F0_REG_MASK) == 0) {
--		if (WARN_ON(regsz > 1))
--			return -EINVAL;
--		*(u8 *)data = sdio_f0_readb(sdiodev->func[0], addr, &ret);
--	} else {
--		switch (regsz) {
--		case 1:
--			*(u8 *)data = sdio_readb(sdiodev->func[1], addr, &ret);
--			break;
--		case 4:
--			ret = brcmf_sdiod_addrprep(sdiodev, &addr);
--			if (ret)
--				goto done;
--
--			*(u32 *)data = sdio_readl(sdiodev->func[1], addr, &ret);
--			break;
--		default:
--			WARN(1, "Invalid reg size\n");
--			ret = -EINVAL;
--			break;
--		}
--	}
--
--done:
--	return ret;
--}
--
--u8 brcmf_sdiod_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
-+u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
- {
--	u8 data;
-+	u32 data = 0;
- 	int retval;
- 
--	retval = brcmf_sdiod_reg_read(sdiodev, addr, 1, &data);
--
--	if (ret)
--		*ret = retval;
--
--	return data;
--}
-+	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
- 
--u32 brcmf_sdiod_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
--{
--	u32 data;
--	int retval;
--
--	retval = brcmf_sdiod_reg_read(sdiodev, addr, 4, &data);
-+	if (!retval)
-+		data = sdio_readl(sdiodev->func[1], addr, &retval);
- 
- 	if (ret)
- 		*ret = retval;
-@@ -392,23 +283,15 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_
- 	return data;
- }
- 
--void brcmf_sdiod_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr,
--		      u8 data, int *ret)
-+void brcmf_sdiod_writel(struct brcmf_sdio_dev *sdiodev, u32 addr,
-+			u32 data, int *ret)
- {
- 	int retval;
- 
--	retval = brcmf_sdiod_reg_write(sdiodev, addr, 1, &data);
--
--	if (ret)
--		*ret = retval;
--}
--
--void brcmf_sdiod_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr,
--		      u32 data, int *ret)
--{
--	int retval;
-+	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
- 
--	retval = brcmf_sdiod_reg_write(sdiodev, addr, 4, &data);
-+	if (!retval)
-+		sdio_writel(sdiodev->func[1], data, addr, &retval);
- 
- 	if (ret)
- 		*ret = retval;
-@@ -846,8 +729,8 @@ int brcmf_sdiod_abort(struct brcmf_sdio_
- {
- 	brcmf_dbg(SDIO, "Enter\n");
- 
--	/* issue abort cmd52 command through F0 */
--	brcmf_sdiod_reg_write(sdiodev, SDIO_CCCR_ABORT, 1, &fn);
-+	/* Issue abort cmd52 command through F0 */
-+	brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_ABORT, fn, NULL);
- 
- 	brcmf_dbg(SDIO, "Exit\n");
- 	return 0;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -669,7 +669,7 @@ static int r_sdreg32(struct brcmf_sdio *
- 	int ret;
- 
- 	core = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
--	*regvar = brcmf_sdiod_regrl(bus->sdiodev, core->base + offset, &ret);
-+	*regvar = brcmf_sdiod_readl(bus->sdiodev, core->base + offset, &ret);
- 
- 	return ret;
- }
-@@ -680,7 +680,7 @@ static int w_sdreg32(struct brcmf_sdio *
- 	int ret;
- 
- 	core = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
--	brcmf_sdiod_regwl(bus->sdiodev, core->base + reg_offset, regval, &ret);
-+	brcmf_sdiod_writel(bus->sdiodev, core->base + reg_offset, regval, &ret);
- 
- 	return ret;
- }
-@@ -697,8 +697,7 @@ brcmf_sdio_kso_control(struct brcmf_sdio
- 
- 	wr_val = (on << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
- 	/* 1st KSO write goes to AOS wake up core if device is asleep  */
--	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
--			  wr_val, &err);
-+	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, wr_val, &err);
- 
- 	if (on) {
- 		/* device WAKEUP through KSO:
-@@ -724,7 +723,7 @@ brcmf_sdio_kso_control(struct brcmf_sdio
- 		 * just one write attempt may fail,
- 		 * read it back until it matches written value
- 		 */
--		rd_val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
-+		rd_val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
- 					   &err);
- 		if (!err) {
- 			if ((rd_val & bmask) == cmp_val)
-@@ -734,9 +733,11 @@ brcmf_sdio_kso_control(struct brcmf_sdio
- 		/* bail out upon subsequent access errors */
- 		if (err && (err_cnt++ > BRCMF_SDIO_MAX_ACCESS_ERRORS))
- 			break;
-+
- 		udelay(KSO_WAIT_US);
--		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
--				  wr_val, &err);
-+		brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, wr_val,
-+				   &err);
-+
- 	} while (try_cnt++ < MAX_KSO_ATTEMPTS);
- 
- 	if (try_cnt > 2)
-@@ -772,15 +773,15 @@ static int brcmf_sdio_htclk(struct brcmf
- 		clkreq =
- 		    bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
- 
--		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
--				  clkreq, &err);
-+		brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+				   clkreq, &err);
- 		if (err) {
- 			brcmf_err("HT Avail request error: %d\n", err);
- 			return -EBADE;
- 		}
- 
- 		/* Check current status */
--		clkctl = brcmf_sdiod_regrb(bus->sdiodev,
-+		clkctl = brcmf_sdiod_readb(bus->sdiodev,
- 					   SBSDIO_FUNC1_CHIPCLKCSR, &err);
- 		if (err) {
- 			brcmf_err("HT Avail read error: %d\n", err);
-@@ -790,35 +791,34 @@ static int brcmf_sdio_htclk(struct brcmf
- 		/* Go to pending and await interrupt if appropriate */
- 		if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
- 			/* Allow only clock-available interrupt */
--			devctl = brcmf_sdiod_regrb(bus->sdiodev,
-+			devctl = brcmf_sdiod_readb(bus->sdiodev,
- 						   SBSDIO_DEVICE_CTL, &err);
- 			if (err) {
--				brcmf_err("Devctl error setting CA: %d\n",
--					  err);
-+				brcmf_err("Devctl error setting CA: %d\n", err);
- 				return -EBADE;
- 			}
- 
- 			devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
--			brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
--					  devctl, &err);
-+			brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_DEVICE_CTL,
-+					   devctl, &err);
- 			brcmf_dbg(SDIO, "CLKCTL: set PENDING\n");
- 			bus->clkstate = CLK_PENDING;
- 
- 			return 0;
- 		} else if (bus->clkstate == CLK_PENDING) {
- 			/* Cancel CA-only interrupt filter */
--			devctl = brcmf_sdiod_regrb(bus->sdiodev,
-+			devctl = brcmf_sdiod_readb(bus->sdiodev,
- 						   SBSDIO_DEVICE_CTL, &err);
- 			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
--			brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
--					  devctl, &err);
-+			brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_DEVICE_CTL,
-+					   devctl, &err);
- 		}
- 
- 		/* Otherwise, wait here (polling) for HT Avail */
- 		timeout = jiffies +
- 			  msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
- 		while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
--			clkctl = brcmf_sdiod_regrb(bus->sdiodev,
-+			clkctl = brcmf_sdiod_readb(bus->sdiodev,
- 						   SBSDIO_FUNC1_CHIPCLKCSR,
- 						   &err);
- 			if (time_after(jiffies, timeout))
-@@ -852,16 +852,16 @@ static int brcmf_sdio_htclk(struct brcmf
- 
- 		if (bus->clkstate == CLK_PENDING) {
- 			/* Cancel CA-only interrupt filter */
--			devctl = brcmf_sdiod_regrb(bus->sdiodev,
-+			devctl = brcmf_sdiod_readb(bus->sdiodev,
- 						   SBSDIO_DEVICE_CTL, &err);
- 			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
--			brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
--					  devctl, &err);
-+			brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_DEVICE_CTL,
-+					   devctl, &err);
- 		}
- 
- 		bus->clkstate = CLK_SDONLY;
--		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
--				  clkreq, &err);
-+		brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+				   clkreq, &err);
- 		brcmf_dbg(SDIO, "CLKCTL: turned OFF\n");
- 		if (err) {
- 			brcmf_err("Failed access turning clock off: %d\n",
-@@ -951,14 +951,14 @@ brcmf_sdio_bus_sleep(struct brcmf_sdio *
- 
- 		/* Going to sleep */
- 		if (sleep) {
--			clkcsr = brcmf_sdiod_regrb(bus->sdiodev,
-+			clkcsr = brcmf_sdiod_readb(bus->sdiodev,
- 						   SBSDIO_FUNC1_CHIPCLKCSR,
- 						   &err);
- 			if ((clkcsr & SBSDIO_CSR_MASK) == 0) {
- 				brcmf_dbg(SDIO, "no clock, set ALP\n");
--				brcmf_sdiod_regwb(bus->sdiodev,
--						  SBSDIO_FUNC1_CHIPCLKCSR,
--						  SBSDIO_ALP_AVAIL_REQ, &err);
-+				brcmf_sdiod_writeb(bus->sdiodev,
-+						   SBSDIO_FUNC1_CHIPCLKCSR,
-+						   SBSDIO_ALP_AVAIL_REQ, &err);
- 			}
- 			err = brcmf_sdio_kso_control(bus, false);
- 		} else {
-@@ -1178,16 +1178,16 @@ static void brcmf_sdio_rxfail(struct brc
- 	if (abort)
- 		brcmf_sdiod_abort(bus->sdiodev, SDIO_FUNC_2);
- 
--	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
--			  SFC_RF_TERM, &err);
-+	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM,
-+			   &err);
- 	bus->sdcnt.f1regdata++;
- 
- 	/* Wait until the packet has been flushed (device/FIFO stable) */
- 	for (lastrbc = retries = 0xffff; retries > 0; retries--) {
--		hi = brcmf_sdiod_regrb(bus->sdiodev,
--				       SBSDIO_FUNC1_RFRAMEBCHI, &err);
--		lo = brcmf_sdiod_regrb(bus->sdiodev,
--				       SBSDIO_FUNC1_RFRAMEBCLO, &err);
-+		hi = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_RFRAMEBCHI,
-+				       &err);
-+		lo = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_RFRAMEBCLO,
-+				       &err);
- 		bus->sdcnt.f1regdata += 2;
- 
- 		if ((hi == 0) && (lo == 0))
-@@ -1229,12 +1229,12 @@ static void brcmf_sdio_txfail(struct brc
- 	bus->sdcnt.tx_sderrs++;
- 
- 	brcmf_sdiod_abort(sdiodev, SDIO_FUNC_2);
--	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
-+	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
- 	bus->sdcnt.f1regdata++;
- 
- 	for (i = 0; i < 3; i++) {
--		hi = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_WFRAMEBCHI, NULL);
--		lo = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_WFRAMEBCLO, NULL);
-+		hi = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_WFRAMEBCHI, NULL);
-+		lo = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_WFRAMEBCLO, NULL);
- 		bus->sdcnt.f1regdata += 2;
- 		if ((hi == 0) && (lo == 0))
- 			break;
-@@ -2446,11 +2446,11 @@ static void brcmf_sdio_bus_stop(struct d
- 		bus->hostintmask = 0;
- 
- 		/* Force backplane clocks to assure F2 interrupt propagates */
--		saveclk = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+		saveclk = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
- 					    &err);
- 		if (!err)
--			brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
--					  (saveclk | SBSDIO_FORCE_HT), &err);
-+			brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+					   (saveclk | SBSDIO_FORCE_HT), &err);
- 		if (err)
- 			brcmf_err("Failed to force clock for F2: err %d\n",
- 				  err);
-@@ -2509,7 +2509,7 @@ static int brcmf_sdio_intr_rstatus(struc
- 	buscore = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
- 	addr = buscore->base + offsetof(struct sdpcmd_regs, intstatus);
- 
--	val = brcmf_sdiod_regrl(bus->sdiodev, addr, &ret);
-+	val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
- 	bus->sdcnt.f1regdata++;
- 	if (ret != 0)
- 		return ret;
-@@ -2519,7 +2519,7 @@ static int brcmf_sdio_intr_rstatus(struc
- 
- 	/* Clear interrupts */
- 	if (val) {
--		brcmf_sdiod_regwl(bus->sdiodev, addr, val, &ret);
-+		brcmf_sdiod_writel(bus->sdiodev, addr, val, &ret);
- 		bus->sdcnt.f1regdata++;
- 		atomic_or(val, &bus->intstatus);
- 	}
-@@ -2545,23 +2545,23 @@ static void brcmf_sdio_dpc(struct brcmf_
- 
- #ifdef DEBUG
- 		/* Check for inconsistent device control */
--		devctl = brcmf_sdiod_regrb(bus->sdiodev,
--					   SBSDIO_DEVICE_CTL, &err);
-+		devctl = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_DEVICE_CTL,
-+					   &err);
- #endif				/* DEBUG */
- 
- 		/* Read CSR, if clock on switch to AVAIL, else ignore */
--		clkctl = brcmf_sdiod_regrb(bus->sdiodev,
-+		clkctl = brcmf_sdiod_readb(bus->sdiodev,
- 					   SBSDIO_FUNC1_CHIPCLKCSR, &err);
- 
- 		brcmf_dbg(SDIO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
- 			  devctl, clkctl);
- 
- 		if (SBSDIO_HTAV(clkctl)) {
--			devctl = brcmf_sdiod_regrb(bus->sdiodev,
-+			devctl = brcmf_sdiod_readb(bus->sdiodev,
- 						   SBSDIO_DEVICE_CTL, &err);
- 			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
--			brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
--					  devctl, &err);
-+			brcmf_sdiod_writeb(bus->sdiodev,
-+					   SBSDIO_DEVICE_CTL, devctl, &err);
- 			bus->clkstate = CLK_AVAIL;
- 		}
- 	}
-@@ -3347,31 +3347,31 @@ static void brcmf_sdio_sr_init(struct br
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
--	val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, &err);
-+	val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, &err);
- 	if (err) {
- 		brcmf_err("error reading SBSDIO_FUNC1_WAKEUPCTRL\n");
- 		return;
- 	}
- 
- 	val |= 1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
--	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, val, &err);
-+	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, val, &err);
- 	if (err) {
- 		brcmf_err("error writing SBSDIO_FUNC1_WAKEUPCTRL\n");
- 		return;
- 	}
- 
- 	/* Add CMD14 Support */
--	brcmf_sdiod_regwb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
--			  (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
--			   SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT),
--			  &err);
-+	brcmf_sdiod_func0_wb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
-+			     (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
-+			      SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT),
-+			     &err);
- 	if (err) {
- 		brcmf_err("error writing SDIO_CCCR_BRCM_CARDCAP\n");
- 		return;
- 	}
- 
--	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
--			  SBSDIO_FORCE_HT, &err);
-+	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+			   SBSDIO_FORCE_HT, &err);
- 	if (err) {
- 		brcmf_err("error writing SBSDIO_FUNC1_CHIPCLKCSR\n");
- 		return;
-@@ -3394,7 +3394,7 @@ static int brcmf_sdio_kso_init(struct br
- 	if (brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV)->rev < 12)
- 		return 0;
- 
--	val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
-+	val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
- 	if (err) {
- 		brcmf_err("error reading SBSDIO_FUNC1_SLEEPCSR\n");
- 		return err;
-@@ -3403,8 +3403,8 @@ static int brcmf_sdio_kso_init(struct br
- 	if (!(val & SBSDIO_FUNC1_SLEEPCSR_KSO_MASK)) {
- 		val |= (SBSDIO_FUNC1_SLEEPCSR_KSO_EN <<
- 			SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
--		brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
--				  val, &err);
-+		brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
-+				   val, &err);
- 		if (err) {
- 			brcmf_err("error writing SBSDIO_FUNC1_SLEEPCSR\n");
- 			return err;
-@@ -3565,9 +3565,9 @@ static void brcmf_sdio_bus_watchdog(stru
- 				u8 devpend;
- 
- 				sdio_claim_host(bus->sdiodev->func[1]);
--				devpend = brcmf_sdiod_regrb(bus->sdiodev,
--							    SDIO_CCCR_INTx,
--							    NULL);
-+				devpend = brcmf_sdiod_func0_rb(bus->sdiodev,
-+							       SDIO_CCCR_INTx,
-+							       NULL);
- 				sdio_release_host(bus->sdiodev->func[1]);
- 				intstatus = devpend & (INTR_STATUS_FUNC1 |
- 						       INTR_STATUS_FUNC2);
-@@ -3705,12 +3705,12 @@ brcmf_sdio_drivestrengthinit(struct brcm
- 			}
- 		}
- 		addr = CORE_CC_REG(pmu->base, chipcontrol_addr);
--		brcmf_sdiod_regwl(sdiodev, addr, 1, NULL);
--		cc_data_temp = brcmf_sdiod_regrl(sdiodev, addr, NULL);
-+		brcmf_sdiod_writel(sdiodev, addr, 1, NULL);
-+		cc_data_temp = brcmf_sdiod_readl(sdiodev, addr, NULL);
- 		cc_data_temp &= ~str_mask;
- 		drivestrength_sel <<= str_shift;
- 		cc_data_temp |= drivestrength_sel;
--		brcmf_sdiod_regwl(sdiodev, addr, cc_data_temp, NULL);
-+		brcmf_sdiod_writel(sdiodev, addr, cc_data_temp, NULL);
- 
- 		brcmf_dbg(INFO, "SDIO: %d mA (req=%d mA) drive strength selected, set to 0x%08x\n",
- 			  str_tab[i].strength, drivestrength, cc_data_temp);
-@@ -3725,7 +3725,7 @@ static int brcmf_sdio_buscoreprep(void *
- 
- 	/* Try forcing SDIO core to do ALPAvail request only */
- 	clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
--	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
-+	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
- 	if (err) {
- 		brcmf_err("error writing for HT off\n");
- 		return err;
-@@ -3733,8 +3733,7 @@ static int brcmf_sdio_buscoreprep(void *
- 
- 	/* If register supported, wait for ALPAvail and then force ALP */
- 	/* This may take up to 15 milliseconds */
--	clkval = brcmf_sdiod_regrb(sdiodev,
--				   SBSDIO_FUNC1_CHIPCLKCSR, NULL);
-+	clkval = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, NULL);
- 
- 	if ((clkval & ~SBSDIO_AVBITS) != clkset) {
- 		brcmf_err("ChipClkCSR access: wrote 0x%02x read 0x%02x\n",
-@@ -3742,10 +3741,11 @@ static int brcmf_sdio_buscoreprep(void *
- 		return -EACCES;
- 	}
- 
--	SPINWAIT(((clkval = brcmf_sdiod_regrb(sdiodev,
--					      SBSDIO_FUNC1_CHIPCLKCSR, NULL)),
--			!SBSDIO_ALPAV(clkval)),
--			PMU_MAX_TRANSITION_DLY);
-+	SPINWAIT(((clkval = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+					      NULL)),
-+		 !SBSDIO_ALPAV(clkval)),
-+		 PMU_MAX_TRANSITION_DLY);
-+
- 	if (!SBSDIO_ALPAV(clkval)) {
- 		brcmf_err("timeout on ALPAV wait, clkval 0x%02x\n",
- 			  clkval);
-@@ -3753,11 +3753,11 @@ static int brcmf_sdio_buscoreprep(void *
- 	}
- 
- 	clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP;
--	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
-+	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
- 	udelay(65);
- 
- 	/* Also, disable the extra SDIO pull-ups */
--	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
-+	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
- 
- 	return 0;
- }
-@@ -3772,7 +3772,7 @@ static void brcmf_sdio_buscore_activate(
- 	/* clear all interrupts */
- 	core = brcmf_chip_get_core(chip, BCMA_CORE_SDIO_DEV);
- 	reg_addr = core->base + offsetof(struct sdpcmd_regs, intstatus);
--	brcmf_sdiod_regwl(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
-+	brcmf_sdiod_writel(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
- 
- 	if (rstvec)
- 		/* Write reset vector to address 0 */
-@@ -3785,7 +3785,7 @@ static u32 brcmf_sdio_buscore_read32(voi
- 	struct brcmf_sdio_dev *sdiodev = ctx;
- 	u32 val, rev;
- 
--	val = brcmf_sdiod_regrl(sdiodev, addr, NULL);
-+	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
- 	if ((sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
- 	     sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
- 	    addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
-@@ -3802,7 +3802,7 @@ static void brcmf_sdio_buscore_write32(v
- {
- 	struct brcmf_sdio_dev *sdiodev = ctx;
- 
--	brcmf_sdiod_regwl(sdiodev, addr, val, NULL);
-+	brcmf_sdiod_writel(sdiodev, addr, val, NULL);
- }
- 
- static const struct brcmf_buscore_ops brcmf_sdio_buscore_ops = {
-@@ -3826,18 +3826,18 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 	sdio_claim_host(sdiodev->func[1]);
- 
- 	pr_debug("F1 signature read @0x18000000=0x%4x\n",
--		 brcmf_sdiod_regrl(sdiodev, SI_ENUM_BASE, NULL));
-+		 brcmf_sdiod_readl(sdiodev, SI_ENUM_BASE, NULL));
- 
- 	/*
- 	 * Force PLL off until brcmf_chip_attach()
- 	 * programs PLL control regs
- 	 */
- 
--	brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
--			  BRCMF_INIT_CLKCTL1, &err);
-+	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, BRCMF_INIT_CLKCTL1,
-+			   &err);
- 	if (!err)
--		clkctl = brcmf_sdiod_regrb(sdiodev,
--					   SBSDIO_FUNC1_CHIPCLKCSR, &err);
-+		clkctl = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+					   &err);
- 
- 	if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
- 		brcmf_err("ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
-@@ -3897,25 +3897,25 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 	brcmf_sdio_drivestrengthinit(sdiodev, bus->ci, drivestrength);
- 
- 	/* Set card control so an SDIO card reset does a WLAN backplane reset */
--	reg_val = brcmf_sdiod_regrb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, &err);
-+	reg_val = brcmf_sdiod_func0_rb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, &err);
- 	if (err)
- 		goto fail;
- 
- 	reg_val |= SDIO_CCCR_BRCM_CARDCTRL_WLANRESET;
- 
--	brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
-+	brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
- 	if (err)
- 		goto fail;
- 
- 	/* set PMUControl so a backplane reset does PMU state reload */
- 	reg_addr = CORE_CC_REG(brcmf_chip_get_pmu(bus->ci)->base, pmucontrol);
--	reg_val = brcmf_sdiod_regrl(sdiodev, reg_addr, &err);
-+	reg_val = brcmf_sdiod_readl(sdiodev, reg_addr, &err);
- 	if (err)
- 		goto fail;
- 
- 	reg_val |= (BCMA_CC_PMU_CTL_RES_RELOAD << BCMA_CC_PMU_CTL_RES_SHIFT);
- 
--	brcmf_sdiod_regwl(sdiodev, reg_addr, reg_val, &err);
-+	brcmf_sdiod_writel(sdiodev, reg_addr, reg_val, &err);
- 	if (err)
- 		goto fail;
- 
-@@ -4055,10 +4055,10 @@ static void brcmf_sdio_firmware_callback
- 		goto release;
- 
- 	/* Force clocks on backplane to be sure F2 interrupt propagates */
--	saveclk = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
-+	saveclk = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
- 	if (!err) {
--		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
--				  (saveclk | SBSDIO_FORCE_HT), &err);
-+		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+				   (saveclk | SBSDIO_FORCE_HT), &err);
- 	}
- 	if (err) {
- 		brcmf_err("Failed to force clock for F2: err %d\n", err);
-@@ -4080,7 +4080,7 @@ static void brcmf_sdio_firmware_callback
- 		w_sdreg32(bus, bus->hostintmask,
- 			  offsetof(struct sdpcmd_regs, hostintmask));
- 
--		brcmf_sdiod_regwb(sdiodev, SBSDIO_WATERMARK, 8, &err);
-+		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
- 	} else {
- 		/* Disable F2 again */
- 		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
-@@ -4091,8 +4091,8 @@ static void brcmf_sdio_firmware_callback
- 		brcmf_sdio_sr_init(bus);
- 	} else {
- 		/* Restore previous clock setting */
--		brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
--				  saveclk, &err);
-+		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+				   saveclk, &err);
- 	}
- 
- 	if (err == 0) {
-@@ -4225,7 +4225,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	bus->rxflow = false;
- 
- 	/* Done with backplane-dependent accesses, can drop clock... */
--	brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
-+	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
- 
- 	sdio_release_host(bus->sdiodev->func[1]);
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -50,6 +50,7 @@
- #define SBSDIO_NUM_FUNCTION		3
- 
- /* function 0 vendor specific CCCR registers */
-+
- #define SDIO_CCCR_BRCM_CARDCAP			0xf0
- #define SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT	0x02
- #define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT	0x04
-@@ -131,8 +132,6 @@
- /* with b15, maps to 32-bit SB access */
- #define SBSDIO_SB_ACCESS_2_4B_FLAG	0x08000
- 
--/* valid bits in SBSDIO_FUNC1_SBADDRxxx regs */
--
- /* Address bits from SBADDR regs */
- #define SBSDIO_SBWINDOW_MASK		0xffff8000
- 
-@@ -293,13 +292,24 @@ struct sdpcmd_regs {
- int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev);
- void brcmf_sdiod_intr_unregister(struct brcmf_sdio_dev *sdiodev);
- 
--/* sdio device register access interface */
--u8 brcmf_sdiod_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
--u32 brcmf_sdiod_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
--void brcmf_sdiod_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr, u8 data,
--		       int *ret);
--void brcmf_sdiod_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr, u32 data,
--		       int *ret);
-+/* SDIO device register access interface */
-+/* Accessors for SDIO Function 0 */
-+#define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
-+	sdio_readb((sdiodev)->func[0], (addr), (r))
-+
-+#define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
-+	sdio_writeb((sdiodev)->func[0], (v), (addr), (ret))
-+
-+/* Accessors for SDIO Function 1 */
-+#define brcmf_sdiod_readb(sdiodev, addr, r) \
-+	sdio_readb((sdiodev)->func[1], (addr), (r))
-+
-+#define brcmf_sdiod_writeb(sdiodev, addr, v, ret) \
-+	sdio_writeb((sdiodev)->func[1], (v), (addr), (ret))
-+
-+u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
-+void brcmf_sdiod_writel(struct brcmf_sdio_dev *sdiodev, u32 addr, u32 data,
-+			int *ret);
- 
- /* Buffer transfer to/from device (client) core via cmd53.
-  *   fn:       function number
diff --git a/package/kernel/mac80211/patches/312-v4.16-0005-brcmfmac-Tidy-register-definitions-a-little.patch b/package/kernel/mac80211/patches/312-v4.16-0005-brcmfmac-Tidy-register-definitions-a-little.patch
deleted file mode 100644
index e77d601a8..000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0005-brcmfmac-Tidy-register-definitions-a-little.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From eeef8a5da781e11746347b3cd9f1942be48ebaf0 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:30 +0100
-Subject: [PATCH] brcmfmac: Tidy register definitions a little
-
-Trivial tidy of register definitions.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c |  4 ++--
- .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 19 ++++++++++---------
- 2 files changed, 12 insertions(+), 11 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -153,9 +153,9 @@ int brcmf_sdiod_intr_register(struct brc
- 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, data, &ret);
- 
- 		/* redirect, configure and enable io for interrupt signal */
--		data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
-+		data = SDIO_CCCR_BRCM_SEPINT_MASK | SDIO_CCCR_BRCM_SEPINT_OE;
- 		if (pdata->oob_irq_flags & IRQF_TRIGGER_HIGH)
--			data |= SDIO_SEPINT_ACT_HI;
-+			data |= SDIO_CCCR_BRCM_SEPINT_ACT_HI;
- 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT,
- 				     data, &ret);
- 		sdio_release_host(sdiodev->func[1]);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -52,16 +52,17 @@
- /* function 0 vendor specific CCCR registers */
- 
- #define SDIO_CCCR_BRCM_CARDCAP			0xf0
--#define SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT	0x02
--#define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT	0x04
--#define SDIO_CCCR_BRCM_CARDCAP_CMD_NODEC	0x08
--#define SDIO_CCCR_BRCM_CARDCTRL		0xf1
--#define SDIO_CCCR_BRCM_CARDCTRL_WLANRESET	0x02
--#define SDIO_CCCR_BRCM_SEPINT			0xf2
-+#define SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT	BIT(1)
-+#define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT	BIT(2)
-+#define SDIO_CCCR_BRCM_CARDCAP_CMD_NODEC	BIT(3)
-+
-+#define SDIO_CCCR_BRCM_CARDCTRL			0xf1
-+#define SDIO_CCCR_BRCM_CARDCTRL_WLANRESET	BIT(1)
- 
--#define  SDIO_SEPINT_MASK		0x01
--#define  SDIO_SEPINT_OE			0x02
--#define  SDIO_SEPINT_ACT_HI		0x04
-+#define SDIO_CCCR_BRCM_SEPINT			0xf2
-+#define SDIO_CCCR_BRCM_SEPINT_MASK		BIT(0)
-+#define SDIO_CCCR_BRCM_SEPINT_OE		BIT(1)
-+#define SDIO_CCCR_BRCM_SEPINT_ACT_HI		BIT(2)
- 
- /* function 1 miscellaneous registers */
- 
diff --git a/package/kernel/mac80211/patches/312-v4.16-0006-brcmfmac-Remove-brcmf_sdiod_addrprep.patch b/package/kernel/mac80211/patches/312-v4.16-0006-brcmfmac-Remove-brcmf_sdiod_addrprep.patch
deleted file mode 100644
index dc598aa47..000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0006-brcmfmac-Remove-brcmf_sdiod_addrprep.patch
+++ /dev/null
@@ -1,190 +0,0 @@
-From a7c3aa1509e243a09c5b1660c8702d792ca76aed Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:31 +0100
-Subject: [PATCH] brcmfmac: Remove brcmf_sdiod_addrprep()
-
-This function has become trivial enough that it may as well be pushed into
-its callers, which has the side-benefit of clarifying what's going on.
-
-Remove it, and rename brcmf_sdiod_set_sbaddr_window() to
-brcmf_sdiod_set_backplane_window() as it's easier to understand.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 84 ++++++++++++----------
- 1 file changed, 46 insertions(+), 38 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -230,41 +230,25 @@ void brcmf_sdiod_change_state(struct brc
- 	sdiodev->state = state;
- }
- 
--static int brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev,
--					 u32 address)
-+static int brcmf_sdiod_set_backplane_window(struct brcmf_sdio_dev *sdiodev,
-+					    u32 addr)
- {
-+	u32 v, bar0 = addr & SBSDIO_SBWINDOW_MASK;
- 	int err = 0, i;
--	u32 addr;
- 
--	if (sdiodev->state == BRCMF_SDIOD_NOMEDIUM)
--		return -ENOMEDIUM;
-+	if (bar0 == sdiodev->sbwad)
-+		return 0;
- 
--	addr = (address & SBSDIO_SBWINDOW_MASK) >> 8;
-+	v = bar0 >> 8;
- 
--	for (i = 0 ; i < 3 && !err ; i++, addr >>= 8)
-+	for (i = 0 ; i < 3 && !err ; i++, v >>= 8)
- 		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_SBADDRLOW + i,
--				   addr & 0xff, &err);
--
--	return err;
--}
--
--static int brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, u32 *addr)
--{
--	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
--	int err = 0;
--
--	if (bar0 != sdiodev->sbwad) {
--		err = brcmf_sdiod_set_sbaddr_window(sdiodev, bar0);
--		if (err)
--			return err;
-+				   v & 0xff, &err);
- 
-+	if (!err)
- 		sdiodev->sbwad = bar0;
--	}
- 
--	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
--	*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
--
--	return 0;
-+	return err;
- }
- 
- u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
-@@ -272,11 +256,16 @@ u32 brcmf_sdiod_readl(struct brcmf_sdio_
- 	u32 data = 0;
- 	int retval;
- 
--	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
-+	retval = brcmf_sdiod_set_backplane_window(sdiodev, addr);
-+	if (retval)
-+		goto out;
-+
-+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
-+	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
--	if (!retval)
--		data = sdio_readl(sdiodev->func[1], addr, &retval);
-+	data = sdio_readl(sdiodev->func[1], addr, &retval);
- 
-+out:
- 	if (ret)
- 		*ret = retval;
- 
-@@ -288,11 +277,16 @@ void brcmf_sdiod_writel(struct brcmf_sdi
- {
- 	int retval;
- 
--	retval = brcmf_sdiod_addrprep(sdiodev, &addr);
-+	retval = brcmf_sdiod_set_backplane_window(sdiodev, addr);
-+	if (retval)
-+		goto out;
- 
--	if (!retval)
--		sdio_writel(sdiodev->func[1], data, addr, &retval);
-+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
-+	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
-+	sdio_writel(sdiodev->func[1], data, addr, &retval);
-+
-+out:
- 	if (ret)
- 		*ret = retval;
- }
-@@ -540,10 +534,13 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
- 
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pkt->len);
- 
--	err = brcmf_sdiod_addrprep(sdiodev, &addr);
-+	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
- 	if (err)
- 		goto done;
- 
-+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
-+	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
-+
- 	err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr, pkt);
- 
- done:
-@@ -561,10 +558,13 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n",
- 		  addr, pktq->qlen);
- 
--	err = brcmf_sdiod_addrprep(sdiodev, &addr);
-+	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
- 	if (err)
- 		goto done;
- 
-+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
-+	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
-+
- 	if (pktq->qlen == 1)
- 		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
- 					    pktq->next);
-@@ -606,7 +606,12 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
- 
- 	memcpy(mypkt->data, buf, nbytes);
- 
--	err = brcmf_sdiod_addrprep(sdiodev, &addr);
-+	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
-+	if (err)
-+		return err;
-+
-+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
-+	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 	if (!err)
- 		err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2, addr, mypkt);
-@@ -625,10 +630,13 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
- 
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pktq->qlen);
- 
--	err = brcmf_sdiod_addrprep(sdiodev, &addr);
-+	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
- 	if (err)
- 		return err;
- 
-+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
-+	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
-+
- 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
- 		skb_queue_walk(pktq, skb) {
- 			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2,
-@@ -673,7 +681,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 	/* Do the transfer(s) */
- 	while (size) {
- 		/* Set the backplane window to include the start address */
--		err = brcmf_sdiod_set_sbaddr_window(sdiodev, address);
-+		err = brcmf_sdiod_set_backplane_window(sdiodev, address);
- 		if (err)
- 			break;
- 
-@@ -716,7 +724,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 	dev_kfree_skb(pkt);
- 
- 	/* Return the window to backplane enumeration space for core access */
--	if (brcmf_sdiod_set_sbaddr_window(sdiodev, sdiodev->sbwad))
-+	if (brcmf_sdiod_set_backplane_window(sdiodev, sdiodev->sbwad))
- 		brcmf_err("FAILED to set window back to 0x%x\n",
- 			  sdiodev->sbwad);
- 
diff --git a/package/kernel/mac80211/patches/312-v4.16-0007-brcmfmac-remove-unnecessary-call-to-brcmf_sdiod_set_.patch b/package/kernel/mac80211/patches/312-v4.16-0007-brcmfmac-remove-unnecessary-call-to-brcmf_sdiod_set_.patch
deleted file mode 100644
index b9410dd7d..000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0007-brcmfmac-remove-unnecessary-call-to-brcmf_sdiod_set_.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From c900072bd6faff089aa4fb7b19136a2a0fe3baf0 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:32 +0100
-Subject: [PATCH] brcmfmac: remove unnecessary call to
- brcmf_sdiod_set_backplane_window()
-
-All functions that might require the window address changing call
-brcmf_sdiod_set_backplane_window() prior to access. Thus resetting
-the window is not required.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-[arend: corrected the driver prefix in the subject]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 5 -----
- 1 file changed, 5 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -723,11 +723,6 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 
- 	dev_kfree_skb(pkt);
- 
--	/* Return the window to backplane enumeration space for core access */
--	if (brcmf_sdiod_set_backplane_window(sdiodev, sdiodev->sbwad))
--		brcmf_err("FAILED to set window back to 0x%x\n",
--			  sdiodev->sbwad);
--
- 	sdio_release_host(sdiodev->func[1]);
- 
- 	return err;
diff --git a/package/kernel/mac80211/patches/312-v4.16-0008-brcmfmac-Cleanup-offsetof.patch b/package/kernel/mac80211/patches/312-v4.16-0008-brcmfmac-Cleanup-offsetof.patch
deleted file mode 100644
index f9e5df550..000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0008-brcmfmac-Cleanup-offsetof.patch
+++ /dev/null
@@ -1,134 +0,0 @@
-From e4c05fc3c0a6c79376f72f17d08014477e962ada Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:33 +0100
-Subject: [PATCH] brcmfmac: Cleanup offsetof()
-
-Create a macro to make the code a bit more readable, whilst we're stuck
-with using struct element offsets as register offsets.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-[arend: rename macro to SD_REG]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 35 +++++++++-------------
- 1 file changed, 14 insertions(+), 21 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -161,6 +161,8 @@ struct rte_console {
- 
- #define CORE_BUS_REG(base, field) \
- 		(base + offsetof(struct sdpcmd_regs, field))
-+#define SD_REG(field) \
-+		(offsetof(struct sdpcmd_regs, field))
- 
- /* SDIO function 1 register CHIPCLKCSR */
- /* Force ALP request to backplane */
-@@ -1087,12 +1089,10 @@ static u32 brcmf_sdio_hostmail(struct br
- 	brcmf_dbg(SDIO, "Enter\n");
- 
- 	/* Read mailbox data and ack that we did so */
--	ret = r_sdreg32(bus, &hmb_data,
--			offsetof(struct sdpcmd_regs, tohostmailboxdata));
-+	ret = r_sdreg32(bus, &hmb_data,	SD_REG(tohostmailboxdata));
- 
- 	if (ret == 0)
--		w_sdreg32(bus, SMB_INT_ACK,
--			  offsetof(struct sdpcmd_regs, tosbmailbox));
-+		w_sdreg32(bus, SMB_INT_ACK, SD_REG(tosbmailbox));
- 	bus->sdcnt.f1regdata += 2;
- 
- 	/* dongle indicates the firmware has halted/crashed */
-@@ -1207,8 +1207,7 @@ static void brcmf_sdio_rxfail(struct brc
- 
- 	if (rtx) {
- 		bus->sdcnt.rxrtx++;
--		err = w_sdreg32(bus, SMB_NAK,
--				offsetof(struct sdpcmd_regs, tosbmailbox));
-+		err = w_sdreg32(bus, SMB_NAK, SD_REG(tosbmailbox));
- 
- 		bus->sdcnt.f1regdata++;
- 		if (err == 0)
-@@ -2333,9 +2332,7 @@ static uint brcmf_sdio_sendfromq(struct
- 		if (!bus->intr) {
- 			/* Check device status, signal pending interrupt */
- 			sdio_claim_host(bus->sdiodev->func[1]);
--			ret = r_sdreg32(bus, &intstatus,
--					offsetof(struct sdpcmd_regs,
--						 intstatus));
-+			ret = r_sdreg32(bus, &intstatus, SD_REG(intstatus));
- 			sdio_release_host(bus->sdiodev->func[1]);
- 			bus->sdcnt.f2txdata++;
- 			if (ret != 0)
-@@ -2441,7 +2438,7 @@ static void brcmf_sdio_bus_stop(struct d
- 		brcmf_sdio_bus_sleep(bus, false, false);
- 
- 		/* Disable and clear interrupts at the chip level also */
--		w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask));
-+		w_sdreg32(bus, 0, SD_REG(hostintmask));
- 		local_hostintmask = bus->hostintmask;
- 		bus->hostintmask = 0;
- 
-@@ -2460,8 +2457,7 @@ static void brcmf_sdio_bus_stop(struct d
- 		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
- 
- 		/* Clear any pending interrupts now that F2 is disabled */
--		w_sdreg32(bus, local_hostintmask,
--			  offsetof(struct sdpcmd_regs, intstatus));
-+		w_sdreg32(bus, local_hostintmask, SD_REG(intstatus));
- 
- 		sdio_release_host(sdiodev->func[1]);
- 	}
-@@ -2507,7 +2503,7 @@ static int brcmf_sdio_intr_rstatus(struc
- 	int ret;
- 
- 	buscore = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
--	addr = buscore->base + offsetof(struct sdpcmd_regs, intstatus);
-+	addr = buscore->base + SD_REG(intstatus);
- 
- 	val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
- 	bus->sdcnt.f1regdata++;
-@@ -2584,11 +2580,9 @@ static void brcmf_sdio_dpc(struct brcmf_
- 	 */
- 	if (intstatus & I_HMB_FC_CHANGE) {
- 		intstatus &= ~I_HMB_FC_CHANGE;
--		err = w_sdreg32(bus, I_HMB_FC_CHANGE,
--				offsetof(struct sdpcmd_regs, intstatus));
-+		err = w_sdreg32(bus, I_HMB_FC_CHANGE, SD_REG(intstatus));
- 
--		err = r_sdreg32(bus, &newstatus,
--				offsetof(struct sdpcmd_regs, intstatus));
-+		err = r_sdreg32(bus, &newstatus, SD_REG(intstatus));
- 		bus->sdcnt.f1regdata += 2;
- 		atomic_set(&bus->fcstate,
- 			   !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE)));
-@@ -3771,7 +3765,7 @@ static void brcmf_sdio_buscore_activate(
- 
- 	/* clear all interrupts */
- 	core = brcmf_chip_get_core(chip, BCMA_CORE_SDIO_DEV);
--	reg_addr = core->base + offsetof(struct sdpcmd_regs, intstatus);
-+	reg_addr = core->base + SD_REG(intstatus);
- 	brcmf_sdiod_writel(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
- 
- 	if (rstvec)
-@@ -4067,7 +4061,7 @@ static void brcmf_sdio_firmware_callback
- 
- 	/* Enable function 2 (frame transfers) */
- 	w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
--		  offsetof(struct sdpcmd_regs, tosbmailboxdata));
-+		  SD_REG(tosbmailboxdata));
- 	err = sdio_enable_func(sdiodev->func[SDIO_FUNC_2]);
- 
- 
-@@ -4077,8 +4071,7 @@ static void brcmf_sdio_firmware_callback
- 	if (!err) {
- 		/* Set up the interrupt mask and enable interrupts */
- 		bus->hostintmask = HOSTINTMASK;
--		w_sdreg32(bus, bus->hostintmask,
--			  offsetof(struct sdpcmd_regs, hostintmask));
-+		w_sdreg32(bus, bus->hostintmask, SD_REG(hostintmask));
- 
- 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
- 	} else {
diff --git a/package/kernel/mac80211/patches/312-v4.16-0009-brcmfmac-Remove-unused-macro.patch b/package/kernel/mac80211/patches/312-v4.16-0009-brcmfmac-Remove-unused-macro.patch
deleted file mode 100644
index df72a70b3..000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0009-brcmfmac-Remove-unused-macro.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 5cfe38f1f8d3c6b98e15b8cfde05028a3c79930b Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:34 +0100
-Subject: [PATCH] brcmfmac: Remove unused macro.
-
-This macro is used exactly nowhere in the code. Delete it.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 --
- 1 file changed, 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -159,8 +159,6 @@ struct rte_console {
- /* manfid tuple length, include tuple, link bytes */
- #define SBSDIO_CIS_MANFID_TUPLE_LEN	6
- 
--#define CORE_BUS_REG(base, field) \
--		(base + offsetof(struct sdpcmd_regs, field))
- #define SD_REG(field) \
- 		(offsetof(struct sdpcmd_regs, field))
- 
diff --git a/package/kernel/mac80211/patches/312-v4.16-0010-brcmfmac-Remove-repeated-calls-to-brcmf_chip_get_cor.patch b/package/kernel/mac80211/patches/312-v4.16-0010-brcmfmac-Remove-repeated-calls-to-brcmf_chip_get_cor.patch
deleted file mode 100644
index 69fbf5c80..000000000
--- a/package/kernel/mac80211/patches/312-v4.16-0010-brcmfmac-Remove-repeated-calls-to-brcmf_chip_get_cor.patch
+++ /dev/null
@@ -1,128 +0,0 @@
-From 21a10846d09db3c5e3bdfb0be0fc7aa9fdc7000a Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Fri, 8 Dec 2017 13:10:35 +0100
-Subject: [PATCH] brcmfmac: Remove repeated calls to brcmf_chip_get_core()
-
-There is no need to repeatdly call brcmf_chip_get_core(), which
-traverses a list of cores every time its called (including during
-register access code!).
-
-Call it once, and store a pointer to the core structure. The existing
-code does nto keep track of users of the cores anyway, and even so, this
-will allow for easier refcounting in future.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 25 +++++++++++++---------
- 1 file changed, 15 insertions(+), 10 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -436,6 +436,7 @@ struct brcmf_sdio_count {
- struct brcmf_sdio {
- 	struct brcmf_sdio_dev *sdiodev;	/* sdio device handler */
- 	struct brcmf_chip *ci;	/* Chip info struct */
-+	struct brcmf_core *sdio_core; /* sdio core info struct */
- 
- 	u32 hostintmask;	/* Copy of Host Interrupt Mask */
- 	atomic_t intstatus;	/* Intstatus bits (events) pending */
-@@ -665,10 +666,9 @@ static bool data_ok(struct brcmf_sdio *b
-  */
- static int r_sdreg32(struct brcmf_sdio *bus, u32 *regvar, u32 offset)
- {
--	struct brcmf_core *core;
-+	struct brcmf_core *core = bus->sdio_core;
- 	int ret;
- 
--	core = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
- 	*regvar = brcmf_sdiod_readl(bus->sdiodev, core->base + offset, &ret);
- 
- 	return ret;
-@@ -676,10 +676,9 @@ static int r_sdreg32(struct brcmf_sdio *
- 
- static int w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset)
- {
--	struct brcmf_core *core;
-+	struct brcmf_core *core = bus->sdio_core;
- 	int ret;
- 
--	core = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
- 	brcmf_sdiod_writel(bus->sdiodev, core->base + reg_offset, regval, &ret);
- 
- 	return ret;
-@@ -2495,12 +2494,11 @@ static inline void brcmf_sdio_clrintr(st
- 
- static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
- {
--	struct brcmf_core *buscore;
-+	struct brcmf_core *buscore = bus->sdio_core;
- 	u32 addr;
- 	unsigned long val;
- 	int ret;
- 
--	buscore = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
- 	addr = buscore->base + SD_REG(intstatus);
- 
- 	val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
-@@ -3377,13 +3375,14 @@ static void brcmf_sdio_sr_init(struct br
- /* enable KSO bit */
- static int brcmf_sdio_kso_init(struct brcmf_sdio *bus)
- {
-+	struct brcmf_core *core = bus->sdio_core;
- 	u8 val;
- 	int err = 0;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
- 	/* KSO bit added in SDIO core rev 12 */
--	if (brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV)->rev < 12)
-+	if (core->rev < 12)
- 		return 0;
- 
- 	val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
-@@ -3412,6 +3411,7 @@ static int brcmf_sdio_bus_preinit(struct
- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
- 	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
- 	struct brcmf_sdio *bus = sdiodev->bus;
-+	struct brcmf_core *core = bus->sdio_core;
- 	uint pad_size;
- 	u32 value;
- 	int err;
-@@ -3420,7 +3420,7 @@ static int brcmf_sdio_bus_preinit(struct
- 	 * a device perspective, ie. bus:txglom affects the
- 	 * bus transfers from device to host.
- 	 */
--	if (brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV)->rev < 12) {
-+	if (core->rev < 12) {
- 		/* for sdio core rev < 12, disable txgloming */
- 		value = 0;
- 		err = brcmf_iovar_data_set(dev, "bus:txglom", &value,
-@@ -3758,11 +3758,10 @@ static void brcmf_sdio_buscore_activate(
- 					u32 rstvec)
- {
- 	struct brcmf_sdio_dev *sdiodev = ctx;
--	struct brcmf_core *core;
-+	struct brcmf_core *core = sdiodev->bus->sdio_core;
- 	u32 reg_addr;
- 
- 	/* clear all interrupts */
--	core = brcmf_chip_get_core(chip, BCMA_CORE_SDIO_DEV);
- 	reg_addr = core->base + SD_REG(intstatus);
- 	brcmf_sdiod_writel(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
- 
-@@ -3843,6 +3842,12 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 		bus->ci = NULL;
- 		goto fail;
- 	}
-+
-+	/* Pick up the SDIO core info struct from chip.c */
-+	bus->sdio_core   = brcmf_chip_get_core(bus->ci, BCMA_CORE_SDIO_DEV);
-+	if (!bus->sdio_core)
-+		goto fail;
-+
- 	sdiodev->settings = brcmf_get_module_param(sdiodev->dev,
- 						   BRCMF_BUSTYPE_SDIO,
- 						   bus->ci->chip,
diff --git a/package/kernel/mac80211/patches/313-v4.16-0001-brcmfmac-enlarge-buffer-size-of-caps-to-512-bytes.patch b/package/kernel/mac80211/patches/313-v4.16-0001-brcmfmac-enlarge-buffer-size-of-caps-to-512-bytes.patch
deleted file mode 100644
index 731b7eda1..000000000
--- a/package/kernel/mac80211/patches/313-v4.16-0001-brcmfmac-enlarge-buffer-size-of-caps-to-512-bytes.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 7762bb134e3b40e8ee2611365775b7432190a9c7 Mon Sep 17 00:00:00 2001
-From: Wright Feng <wright.feng@cypress.com>
-Date: Mon, 11 Dec 2017 15:38:21 +0800
-Subject: [PATCH] brcmfmac: enlarge buffer size of caps to 512 bytes
-
-The buffer size of return of cap iovar is greater than 256 bytes in some
-firmwares. For instance, the return size of cap iovar is 271 bytes in 4373
-13.10.246.79 firmare. It makes feature capability parsing failed because
-caps buffer is default value.
-So we enlarge caps buffer size to 512 bytes and add the error print for
-cap iovar error.
-
-Signed-off-by: Wright Feng <wright.feng@cypress.com>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 12 +++++++++---
- 1 file changed, 9 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -130,13 +130,19 @@ static void brcmf_feat_iovar_data_set(st
- 	}
- }
- 
-+#define MAX_CAPS_BUFFER_SIZE	512
- static void brcmf_feat_firmware_capabilities(struct brcmf_if *ifp)
- {
--	char caps[256];
-+	char caps[MAX_CAPS_BUFFER_SIZE];
- 	enum brcmf_feat_id id;
--	int i;
-+	int i, err;
-+
-+	err = brcmf_fil_iovar_data_get(ifp, "cap", caps, sizeof(caps));
-+	if (err) {
-+		brcmf_err("could not get firmware cap (%d)\n", err);
-+		return;
-+	}
- 
--	brcmf_fil_iovar_data_get(ifp, "cap", caps, sizeof(caps));
- 	brcmf_dbg(INFO, "[ %s]\n", caps);
- 
- 	for (i = 0; i < ARRAY_SIZE(brcmf_fwcap_map); i++) {
diff --git a/package/kernel/mac80211/patches/314-v4.16-0001-brcmfmac-Remove-r-w-_sdreg32.patch b/package/kernel/mac80211/patches/314-v4.16-0001-brcmfmac-Remove-r-w-_sdreg32.patch
deleted file mode 100644
index 291cd5d78..000000000
--- a/package/kernel/mac80211/patches/314-v4.16-0001-brcmfmac-Remove-r-w-_sdreg32.patch
+++ /dev/null
@@ -1,227 +0,0 @@
-From 3d110df8f74781354051e4bb1e3e97fa368b2f80 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Tue, 19 Dec 2017 13:47:07 +0100
-Subject: [PATCH] brcmfmac: Remove {r,w}_sdreg32
-
-Remove yet another IO function from the code and replace with one
-that already exists.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-[arend: keep address calculation, ie. (base + offset) in one line]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 88 +++++++++++-----------
- 1 file changed, 42 insertions(+), 46 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -660,30 +660,6 @@ static bool data_ok(struct brcmf_sdio *b
- 	       ((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0;
- }
- 
--/*
-- * Reads a register in the SDIO hardware block. This block occupies a series of
-- * adresses on the 32 bit backplane bus.
-- */
--static int r_sdreg32(struct brcmf_sdio *bus, u32 *regvar, u32 offset)
--{
--	struct brcmf_core *core = bus->sdio_core;
--	int ret;
--
--	*regvar = brcmf_sdiod_readl(bus->sdiodev, core->base + offset, &ret);
--
--	return ret;
--}
--
--static int w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset)
--{
--	struct brcmf_core *core = bus->sdio_core;
--	int ret;
--
--	brcmf_sdiod_writel(bus->sdiodev, core->base + reg_offset, regval, &ret);
--
--	return ret;
--}
--
- static int
- brcmf_sdio_kso_control(struct brcmf_sdio *bus, bool on)
- {
-@@ -1078,6 +1054,8 @@ static void brcmf_sdio_get_console_addr(
- 
- static u32 brcmf_sdio_hostmail(struct brcmf_sdio *bus)
- {
-+	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
-+	struct brcmf_core *core = bus->sdio_core;
- 	u32 intstatus = 0;
- 	u32 hmb_data;
- 	u8 fcbits;
-@@ -1086,10 +1064,14 @@ static u32 brcmf_sdio_hostmail(struct br
- 	brcmf_dbg(SDIO, "Enter\n");
- 
- 	/* Read mailbox data and ack that we did so */
--	ret = r_sdreg32(bus, &hmb_data,	SD_REG(tohostmailboxdata));
-+	hmb_data = brcmf_sdiod_readl(sdiod,
-+				     core->base + SD_REG(tohostmailboxdata),
-+				     &ret);
-+
-+	if (!ret)
-+		brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailbox),
-+				   SMB_INT_ACK, &ret);
- 
--	if (ret == 0)
--		w_sdreg32(bus, SMB_INT_ACK, SD_REG(tosbmailbox));
- 	bus->sdcnt.f1regdata += 2;
- 
- 	/* dongle indicates the firmware has halted/crashed */
-@@ -1163,6 +1145,8 @@ static u32 brcmf_sdio_hostmail(struct br
- 
- static void brcmf_sdio_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
- {
-+	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
-+	struct brcmf_core *core = bus->sdio_core;
- 	uint retries = 0;
- 	u16 lastrbc;
- 	u8 hi, lo;
-@@ -1204,7 +1188,8 @@ static void brcmf_sdio_rxfail(struct brc
- 
- 	if (rtx) {
- 		bus->sdcnt.rxrtx++;
--		err = w_sdreg32(bus, SMB_NAK, SD_REG(tosbmailbox));
-+		brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailbox),
-+				   SMB_NAK, &err);
- 
- 		bus->sdcnt.f1regdata++;
- 		if (err == 0)
-@@ -2291,6 +2276,7 @@ static uint brcmf_sdio_sendfromq(struct
- {
- 	struct sk_buff *pkt;
- 	struct sk_buff_head pktq;
-+	u32 intstat_addr = bus->sdio_core->base + SD_REG(intstatus);
- 	u32 intstatus = 0;
- 	int ret = 0, prec_out, i;
- 	uint cnt = 0;
-@@ -2329,7 +2315,8 @@ static uint brcmf_sdio_sendfromq(struct
- 		if (!bus->intr) {
- 			/* Check device status, signal pending interrupt */
- 			sdio_claim_host(bus->sdiodev->func[1]);
--			ret = r_sdreg32(bus, &intstatus, SD_REG(intstatus));
-+			intstatus = brcmf_sdiod_readl(bus->sdiodev,
-+						      intstat_addr, &ret);
- 			sdio_release_host(bus->sdiodev->func[1]);
- 			bus->sdcnt.f2txdata++;
- 			if (ret != 0)
-@@ -2413,12 +2400,13 @@ static int brcmf_sdio_tx_ctrlframe(struc
- 
- static void brcmf_sdio_bus_stop(struct device *dev)
- {
--	u32 local_hostintmask;
--	u8 saveclk;
--	int err;
- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
- 	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
- 	struct brcmf_sdio *bus = sdiodev->bus;
-+	struct brcmf_core *core = bus->sdio_core;
-+	u32 local_hostintmask;
-+	u8 saveclk;
-+	int err;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
-@@ -2435,7 +2423,9 @@ static void brcmf_sdio_bus_stop(struct d
- 		brcmf_sdio_bus_sleep(bus, false, false);
- 
- 		/* Disable and clear interrupts at the chip level also */
--		w_sdreg32(bus, 0, SD_REG(hostintmask));
-+		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(hostintmask),
-+				   0, NULL);
-+
- 		local_hostintmask = bus->hostintmask;
- 		bus->hostintmask = 0;
- 
-@@ -2454,7 +2444,8 @@ static void brcmf_sdio_bus_stop(struct d
- 		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
- 
- 		/* Clear any pending interrupts now that F2 is disabled */
--		w_sdreg32(bus, local_hostintmask, SD_REG(intstatus));
-+		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(intstatus),
-+				   local_hostintmask, NULL);
- 
- 		sdio_release_host(sdiodev->func[1]);
- 	}
-@@ -2521,7 +2512,9 @@ static int brcmf_sdio_intr_rstatus(struc
- 
- static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
- {
-+	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
- 	u32 newstatus = 0;
-+	u32 intstat_addr = bus->sdio_core->base + SD_REG(intstatus);
- 	unsigned long intstatus;
- 	uint txlimit = bus->txbound;	/* Tx frames to send before resched */
- 	uint framecnt;			/* Temporary counter of tx/rx frames */
-@@ -2576,9 +2569,10 @@ static void brcmf_sdio_dpc(struct brcmf_
- 	 */
- 	if (intstatus & I_HMB_FC_CHANGE) {
- 		intstatus &= ~I_HMB_FC_CHANGE;
--		err = w_sdreg32(bus, I_HMB_FC_CHANGE, SD_REG(intstatus));
-+		brcmf_sdiod_writel(sdiod, intstat_addr, I_HMB_FC_CHANGE, &err);
-+
-+		newstatus = brcmf_sdiod_readl(sdiod, intstat_addr, &err);
- 
--		err = r_sdreg32(bus, &newstatus, SD_REG(intstatus));
- 		bus->sdcnt.f1regdata += 2;
- 		atomic_set(&bus->fcstate,
- 			   !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE)));
-@@ -4017,22 +4011,21 @@ static void brcmf_sdio_firmware_callback
- 					 const struct firmware *code,
- 					 void *nvram, u32 nvram_len)
- {
--	struct brcmf_bus *bus_if;
--	struct brcmf_sdio_dev *sdiodev;
--	struct brcmf_sdio *bus;
-+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-+	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
-+	struct brcmf_sdio *bus = sdiodev->bus;
-+	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
-+	struct brcmf_core *core = bus->sdio_core;
- 	u8 saveclk;
- 
- 	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
--	bus_if = dev_get_drvdata(dev);
--	sdiodev = bus_if->bus_priv.sdio;
-+
- 	if (err)
- 		goto fail;
- 
- 	if (!bus_if->drvr)
- 		return;
- 
--	bus = sdiodev->bus;
--
- 	/* try to download image and nvram to the dongle */
- 	bus->alp_only = true;
- 	err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
-@@ -4063,8 +4056,9 @@ static void brcmf_sdio_firmware_callback
- 	}
- 
- 	/* Enable function 2 (frame transfers) */
--	w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
--		  SD_REG(tosbmailboxdata));
-+	brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
-+			   SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
-+
- 	err = sdio_enable_func(sdiodev->func[SDIO_FUNC_2]);
- 
- 
-@@ -4074,7 +4068,9 @@ static void brcmf_sdio_firmware_callback
- 	if (!err) {
- 		/* Set up the interrupt mask and enable interrupts */
- 		bus->hostintmask = HOSTINTMASK;
--		w_sdreg32(bus, bus->hostintmask, SD_REG(hostintmask));
-+		brcmf_sdiod_writel(sdiod, core->base + SD_REG(hostintmask),
-+				   bus->hostintmask, NULL);
-+
- 
- 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
- 	} else {
diff --git a/package/kernel/mac80211/patches/314-v4.16-0002-brcmfmac-Rename-buscore-to-core-for-consistency.patch b/package/kernel/mac80211/patches/314-v4.16-0002-brcmfmac-Rename-buscore-to-core-for-consistency.patch
deleted file mode 100644
index e9b562830..000000000
--- a/package/kernel/mac80211/patches/314-v4.16-0002-brcmfmac-Rename-buscore-to-core-for-consistency.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From dbda7dacb79a377e8ed9d38ce0e4a58b70aa9060 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 19 Dec 2017 13:47:08 +0100
-Subject: [PATCH] brcmfmac: Rename buscore to core for consistency
-
-Avoid confusion with unrelated _buscore labels.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-[arend: only do the rename]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -2485,12 +2485,12 @@ static inline void brcmf_sdio_clrintr(st
- 
- static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
- {
--	struct brcmf_core *buscore = bus->sdio_core;
-+	struct brcmf_core *core = bus->sdio_core;
- 	u32 addr;
- 	unsigned long val;
- 	int ret;
- 
--	addr = buscore->base + SD_REG(intstatus);
-+	addr = core->base + SD_REG(intstatus);
- 
- 	val = brcmf_sdiod_readl(bus->sdiodev, addr, &ret);
- 	bus->sdcnt.f1regdata++;
diff --git a/package/kernel/mac80211/patches/314-v4.16-0003-brcmfmac-stabilise-the-value-of-sbwad-in-use-for-som.patch b/package/kernel/mac80211/patches/314-v4.16-0003-brcmfmac-stabilise-the-value-of-sbwad-in-use-for-som.patch
deleted file mode 100644
index 3828c320f..000000000
--- a/package/kernel/mac80211/patches/314-v4.16-0003-brcmfmac-stabilise-the-value-of-sbwad-in-use-for-som.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From 874bb8e49b7c6368f8ff9f2566c7bd06a2249be0 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Tue, 19 Dec 2017 13:47:09 +0100
-Subject: [PATCH] brcmfmac: stabilise the value of ->sbwad in use for some xfer
- routines.
-
-The IO functions operate within the Chipcommon IO window. Explicitly
-set this, rather than relying on the last initialisation IO access to
-leave it set to the right value by chance.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 8 ++++----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c   | 5 +++++
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 1 +
- 3 files changed, 10 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -529,7 +529,7 @@ int brcmf_sdiod_recv_buf(struct brcmf_sd
- 
- int brcmf_sdiod_recv_pkt(struct brcmf_sdio_dev *sdiodev, struct sk_buff *pkt)
- {
--	u32 addr = sdiodev->sbwad;
-+	u32 addr = sdiodev->cc_core->base;
- 	int err = 0;
- 
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pkt->len);
-@@ -552,7 +552,7 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- {
- 	struct sk_buff *glom_skb = NULL;
- 	struct sk_buff *skb;
--	u32 addr = sdiodev->sbwad;
-+	u32 addr = sdiodev->cc_core->base;
- 	int err = 0;
- 
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n",
-@@ -593,7 +593,7 @@ done:
- int brcmf_sdiod_send_buf(struct brcmf_sdio_dev *sdiodev, u8 *buf, uint nbytes)
- {
- 	struct sk_buff *mypkt;
--	u32 addr = sdiodev->sbwad;
-+	u32 addr = sdiodev->cc_core->base;
- 	int err;
- 
- 	mypkt = brcmu_pkt_buf_get_skb(nbytes);
-@@ -625,7 +625,7 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
- 			 struct sk_buff_head *pktq)
- {
- 	struct sk_buff *skb;
--	u32 addr = sdiodev->sbwad;
-+	u32 addr = sdiodev->cc_core->base;
- 	int err;
- 
- 	brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pktq->qlen);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3842,6 +3842,11 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 	if (!bus->sdio_core)
- 		goto fail;
- 
-+	/* Pick up the CHIPCOMMON core info struct, for bulk IO in bcmsdh.c */
-+	sdiodev->cc_core = brcmf_chip_get_core(bus->ci, BCMA_CORE_CHIPCOMMON);
-+	if (!sdiodev->cc_core)
-+		goto fail;
-+
- 	sdiodev->settings = brcmf_get_module_param(sdiodev->dev,
- 						   BRCMF_BUSTYPE_SDIO,
- 						   bus->ci->chip,
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -178,6 +178,7 @@ struct brcmf_sdio_dev {
- 	struct sdio_func *func[SDIO_MAX_FUNCS];
- 	u8 num_funcs;			/* Supported funcs on client */
- 	u32 sbwad;			/* Save backplane window address */
-+	struct brcmf_core *cc_core;	/* chipcommon core info struct */
- 	struct brcmf_sdio *bus;
- 	struct device *dev;
- 	struct brcmf_bus *bus_if;
diff --git a/package/kernel/mac80211/patches/314-v4.16-0004-brcmfmac-Correctly-handle-accesses-to-SDIO-func0.patch b/package/kernel/mac80211/patches/314-v4.16-0004-brcmfmac-Correctly-handle-accesses-to-SDIO-func0.patch
deleted file mode 100644
index 86b269a34..000000000
--- a/package/kernel/mac80211/patches/314-v4.16-0004-brcmfmac-Correctly-handle-accesses-to-SDIO-func0.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 508422f3695bf66f7b85fb4723c22f5166003ec6 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Tue, 19 Dec 2017 13:47:10 +0100
-Subject: [PATCH] brcmfmac: Correctly handle accesses to SDIO func0
-
-Rather than workaround the restrictions on func0 addressing in the
-driver, set MMC_QUIRK_LENIENT_FN0
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 4 ++++
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 4 ++--
- 2 files changed, 6 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -995,6 +995,10 @@ static int brcmf_ops_sdio_probe(struct s
- 	brcmf_dbg(SDIO, "Function#: %d\n", func->num);
- 
- 	dev = &func->dev;
-+
-+	/* Set MMC_QUIRK_LENIENT_FN0 for this card */
-+	func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
-+
- 	/* prohibit ACPI power management for this device */
- 	brcmf_sdiod_acpi_set_power_manageable(dev, 0);
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -297,10 +297,10 @@ void brcmf_sdiod_intr_unregister(struct
- /* SDIO device register access interface */
- /* Accessors for SDIO Function 0 */
- #define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
--	sdio_readb((sdiodev)->func[0], (addr), (r))
-+	sdio_f0_readb((sdiodev)->func[0], (addr), (r))
- 
- #define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
--	sdio_writeb((sdiodev)->func[0], (v), (addr), (ret))
-+	sdio_f0_writeb((sdiodev)->func[0], (v), (addr), (ret))
- 
- /* Accessors for SDIO Function 1 */
- #define brcmf_sdiod_readb(sdiodev, addr, r) \
diff --git a/package/kernel/mac80211/patches/314-v4.16-0005-brcmfmac-Remove-func0-from-function-array.patch b/package/kernel/mac80211/patches/314-v4.16-0005-brcmfmac-Remove-func0-from-function-array.patch
deleted file mode 100644
index 715b86561..000000000
--- a/package/kernel/mac80211/patches/314-v4.16-0005-brcmfmac-Remove-func0-from-function-array.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-From 99d7b6fdfc8c24052c92c720330d31ca1332f996 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Tue, 19 Dec 2017 13:47:11 +0100
-Subject: [PATCH] brcmfmac: Remove func0 from function array
-
-func0 is not provided by the mmc stack as a function when probing.
-Instead providing specific access functions to read/write it.
-
-This prepares for a patch to remove the actual array entry itself.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-[arend: rephrased the commit message]
-[arend: removed unrelated comment for which separate patch is warranted]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c |  5 +----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c   |  7 ++++---
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 13 ++++++-------
- 3 files changed, 11 insertions(+), 14 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -1022,8 +1022,7 @@ static int brcmf_ops_sdio_probe(struct s
- 	/* store refs to functions used. mmc_card does
- 	 * not hold the F0 function pointer.
- 	 */
--	sdiodev->func[0] = kmemdup(func, sizeof(*func), GFP_KERNEL);
--	sdiodev->func[0]->num = 0;
-+	sdiodev->func[0] = NULL;
- 	sdiodev->func[1] = func->card->sdio_func[0];
- 	sdiodev->func[2] = func;
- 
-@@ -1049,7 +1048,6 @@ static int brcmf_ops_sdio_probe(struct s
- fail:
- 	dev_set_drvdata(&func->dev, NULL);
- 	dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
--	kfree(sdiodev->func[0]);
- 	kfree(sdiodev);
- 	kfree(bus_if);
- 	return err;
-@@ -1082,7 +1080,6 @@ static void brcmf_ops_sdio_remove(struct
- 		dev_set_drvdata(&sdiodev->func[2]->dev, NULL);
- 
- 		kfree(bus_if);
--		kfree(sdiodev->func[0]);
- 		kfree(sdiodev);
- 	}
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3771,9 +3771,10 @@ static u32 brcmf_sdio_buscore_read32(voi
- 	u32 val, rev;
- 
- 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
--	if ((sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
--	     sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
--	    addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
-+
-+	if ((sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
-+	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
-+	     addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
- 		rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
- 		if (rev >= 2) {
- 			val &= ~CID_ID_MASK;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -21,7 +21,9 @@
- #include <linux/firmware.h>
- #include "firmware.h"
- 
--#define SDIO_FUNC_0		0
-+/* Maximum number of I/O funcs */
-+#define NUM_SDIO_FUNCS	3
-+
- #define SDIO_FUNC_1		1
- #define SDIO_FUNC_2		2
- 
-@@ -39,9 +41,6 @@
- #define INTR_STATUS_FUNC1	0x2
- #define INTR_STATUS_FUNC2	0x4
- 
--/* Maximum number of I/O funcs */
--#define SDIOD_MAX_IOFUNCS	7
--
- /* mask of register map */
- #define REG_F0_REG_MASK		0x7FF
- #define REG_F1_MISC_MASK	0x1FFFF
-@@ -175,7 +174,7 @@ struct brcmf_sdio;
- struct brcmf_sdiod_freezer;
- 
- struct brcmf_sdio_dev {
--	struct sdio_func *func[SDIO_MAX_FUNCS];
-+	struct sdio_func *func[NUM_SDIO_FUNCS];
- 	u8 num_funcs;			/* Supported funcs on client */
- 	u32 sbwad;			/* Save backplane window address */
- 	struct brcmf_core *cc_core;	/* chipcommon core info struct */
-@@ -297,10 +296,10 @@ void brcmf_sdiod_intr_unregister(struct
- /* SDIO device register access interface */
- /* Accessors for SDIO Function 0 */
- #define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
--	sdio_f0_readb((sdiodev)->func[0], (addr), (r))
-+	sdio_f0_readb((sdiodev)->func[1], (addr), (r))
- 
- #define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
--	sdio_f0_writeb((sdiodev)->func[0], (v), (addr), (ret))
-+	sdio_f0_writeb((sdiodev)->func[1], (v), (addr), (ret))
- 
- /* Accessors for SDIO Function 1 */
- #define brcmf_sdiod_readb(sdiodev, addr, r) \
diff --git a/package/kernel/mac80211/patches/314-v4.16-0006-brcmfmac-More-efficient-and-slightly-easier-to-read-.patch b/package/kernel/mac80211/patches/314-v4.16-0006-brcmfmac-More-efficient-and-slightly-easier-to-read-.patch
deleted file mode 100644
index 71e4894b0..000000000
--- a/package/kernel/mac80211/patches/314-v4.16-0006-brcmfmac-More-efficient-and-slightly-easier-to-read-.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From bcadaaa097c7ec103fe75f9da41f8fe52693b644 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 19 Dec 2017 13:47:12 +0100
-Subject: [PATCH] brcmfmac: More efficient and slightly easier to read fixup
- for 4339 chips
-
-Its more efficient to test the register we're interested in first,
-potentially avoiding two more comparisons, and therefore always avoiding
-one comparison per call on all other chips.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-[arend: fix some checkpatch warnings]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3772,15 +3772,16 @@ static u32 brcmf_sdio_buscore_read32(voi
- 
- 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
- 
--	if ((sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 ||
--	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339) &&
--	     addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
-+	if (addr == CORE_CC_REG(SI_ENUM_BASE, chipid) &&
-+	    (sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
-+	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
- 		rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
- 		if (rev >= 2) {
- 			val &= ~CID_ID_MASK;
- 			val |= BRCM_CC_4339_CHIP_ID;
- 		}
- 	}
-+
- 	return val;
- }
- 
diff --git a/package/kernel/mac80211/patches/314-v4.16-0007-brcmfmac-Replace-function-index-with-function-pointe.patch b/package/kernel/mac80211/patches/314-v4.16-0007-brcmfmac-Replace-function-index-with-function-pointe.patch
deleted file mode 100644
index 4354a7081..000000000
--- a/package/kernel/mac80211/patches/314-v4.16-0007-brcmfmac-Replace-function-index-with-function-pointe.patch
+++ /dev/null
@@ -1,347 +0,0 @@
-From 00eb62cfc5f806b003fe5d54c8b5fe9a9665482f Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Tue, 19 Dec 2017 13:47:13 +0100
-Subject: [PATCH] brcmfmac: Replace function index with function pointer
-
-In preparation for removing the function array, remove all code that
-refers to function by index and replace with pointers to the function
-itself.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-[arend: replace BUG() with WARN() macro]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 85 ++++++++++++----------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 15 ++--
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |  6 +-
- 3 files changed, 56 insertions(+), 50 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -291,8 +291,9 @@ out:
- 		*ret = retval;
- }
- 
--static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev, uint fn,
--				 u32 addr, struct sk_buff *pkt)
-+static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev,
-+				 struct sdio_func *func, u32 addr,
-+				 struct sk_buff *pkt)
- {
- 	unsigned int req_sz;
- 	int err;
-@@ -301,13 +302,19 @@ static int brcmf_sdiod_buff_read(struct
- 	req_sz = pkt->len + 3;
- 	req_sz &= (uint)~3;
- 
--	if (fn == 1)
--		err = sdio_memcpy_fromio(sdiodev->func[fn],
--					 ((u8 *)(pkt->data)), addr, req_sz);
--	else
--		/* function 2 read is FIFO operation */
--		err = sdio_readsb(sdiodev->func[fn],
--				  ((u8 *)(pkt->data)), addr, req_sz);
-+	switch (func->num) {
-+	case 1:
-+		err = sdio_memcpy_fromio(func, ((u8 *)(pkt->data)), addr,
-+					 req_sz);
-+		break;
-+	case 2:
-+		err = sdio_readsb(func, ((u8 *)(pkt->data)), addr, req_sz);
-+		break;
-+	default:
-+		/* bail out as things are really fishy here */
-+		WARN(1, "invalid sdio function number: %d\n", func->num);
-+		err = -ENOMEDIUM;
-+	};
- 
- 	if (err == -ENOMEDIUM)
- 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
-@@ -315,8 +322,9 @@ static int brcmf_sdiod_buff_read(struct
- 	return err;
- }
- 
--static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev, uint fn,
--				  u32 addr, struct sk_buff *pkt)
-+static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev,
-+				  struct sdio_func *func, u32 addr,
-+				  struct sk_buff *pkt)
- {
- 	unsigned int req_sz;
- 	int err;
-@@ -325,8 +333,7 @@ static int brcmf_sdiod_buff_write(struct
- 	req_sz = pkt->len + 3;
- 	req_sz &= (uint)~3;
- 
--	err = sdio_memcpy_toio(sdiodev->func[fn], addr,
--			       ((u8 *)(pkt->data)), req_sz);
-+	err = sdio_memcpy_toio(func, addr, ((u8 *)(pkt->data)), req_sz);
- 
- 	if (err == -ENOMEDIUM)
- 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
-@@ -337,7 +344,7 @@ static int brcmf_sdiod_buff_write(struct
- /**
-  * brcmf_sdiod_sglist_rw - SDIO interface function for block data access
-  * @sdiodev: brcmfmac sdio device
-- * @fn: SDIO function number
-+ * @func: SDIO function
-  * @write: direction flag
-  * @addr: dongle memory address as source/destination
-  * @pkt: skb pointer
-@@ -346,7 +353,8 @@ static int brcmf_sdiod_buff_write(struct
-  * stack for block data access. It assumes that the skb passed down by the
-  * caller has already been padded and aligned.
-  */
--static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev, uint fn,
-+static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev,
-+				 struct sdio_func *func,
- 				 bool write, u32 addr,
- 				 struct sk_buff_head *pktlist)
- {
-@@ -372,7 +380,7 @@ static int brcmf_sdiod_sglist_rw(struct
- 		req_sz = 0;
- 		skb_queue_walk(pktlist, pkt_next)
- 			req_sz += pkt_next->len;
--		req_sz = ALIGN(req_sz, sdiodev->func[fn]->cur_blksize);
-+		req_sz = ALIGN(req_sz, func->cur_blksize);
- 		while (req_sz > PAGE_SIZE) {
- 			pkt_next = brcmu_pkt_buf_get_skb(PAGE_SIZE);
- 			if (pkt_next == NULL) {
-@@ -391,7 +399,7 @@ static int brcmf_sdiod_sglist_rw(struct
- 		target_list = &local_list;
- 	}
- 
--	func_blk_sz = sdiodev->func[fn]->cur_blksize;
-+	func_blk_sz = func->cur_blksize;
- 	max_req_sz = sdiodev->max_request_size;
- 	max_seg_cnt = min_t(unsigned short, sdiodev->max_segment_count,
- 			    target_list->qlen);
-@@ -408,10 +416,10 @@ static int brcmf_sdiod_sglist_rw(struct
- 	mmc_dat.flags = write ? MMC_DATA_WRITE : MMC_DATA_READ;
- 	mmc_cmd.opcode = SD_IO_RW_EXTENDED;
- 	mmc_cmd.arg = write ? 1<<31 : 0;	/* write flag  */
--	mmc_cmd.arg |= (fn & 0x7) << 28;	/* SDIO func num */
--	mmc_cmd.arg |= 1<<27;			/* block mode */
-+	mmc_cmd.arg |= (func->num & 0x7) << 28;	/* SDIO func num */
-+	mmc_cmd.arg |= 1 << 27;			/* block mode */
- 	/* for function 1 the addr will be incremented */
--	mmc_cmd.arg |= (fn == 1) ? 1<<26 : 0;
-+	mmc_cmd.arg |= (func->num == 1) ? 1 << 26 : 0;
- 	mmc_cmd.flags = MMC_RSP_SPI_R5 | MMC_RSP_R5 | MMC_CMD_ADTC;
- 	mmc_req.cmd = &mmc_cmd;
- 	mmc_req.data = &mmc_dat;
-@@ -457,11 +465,11 @@ static int brcmf_sdiod_sglist_rw(struct
- 		mmc_cmd.arg |= (addr & 0x1FFFF) << 9;	/* address */
- 		mmc_cmd.arg |= mmc_dat.blocks & 0x1FF;	/* block count */
- 		/* incrementing addr for function 1 */
--		if (fn == 1)
-+		if (func->num == 1)
- 			addr += req_sz;
- 
--		mmc_set_data_timeout(&mmc_dat, sdiodev->func[fn]->card);
--		mmc_wait_for_req(sdiodev->func[fn]->card->host, &mmc_req);
-+		mmc_set_data_timeout(&mmc_dat, func->card);
-+		mmc_wait_for_req(func->card->host, &mmc_req);
- 
- 		ret = mmc_cmd.error ? mmc_cmd.error : mmc_dat.error;
- 		if (ret == -ENOMEDIUM) {
-@@ -541,7 +549,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
- 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
--	err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr, pkt);
-+	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr, pkt);
- 
- done:
- 	return err;
-@@ -566,13 +574,13 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 	if (pktq->qlen == 1)
--		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
-+		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
- 					    pktq->next);
- 	else if (!sdiodev->sg_support) {
- 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
- 		if (!glom_skb)
- 			return -ENOMEM;
--		err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_2, addr,
-+		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
- 					    glom_skb);
- 		if (err)
- 			goto done;
-@@ -582,8 +590,8 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 			skb_pull(glom_skb, skb->len);
- 		}
- 	} else
--		err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, false, addr,
--					    pktq);
-+		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], false,
-+					    addr, pktq);
- 
- done:
- 	brcmu_pkt_buf_free_skb(glom_skb);
-@@ -614,7 +622,8 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 	if (!err)
--		err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2, addr, mypkt);
-+		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2], addr,
-+					     mypkt);
- 
- 	brcmu_pkt_buf_free_skb(mypkt);
- 
-@@ -639,14 +648,14 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
- 
- 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
- 		skb_queue_walk(pktq, skb) {
--			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_2,
-+			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2],
- 						     addr, skb);
- 			if (err)
- 				break;
- 		}
- 	} else {
--		err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, true, addr,
--					    pktq);
-+		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], true,
-+					    addr, pktq);
- 	}
- 
- 	return err;
-@@ -696,10 +705,10 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 
- 		if (write) {
- 			memcpy(pkt->data, data, dsize);
--			err = brcmf_sdiod_buff_write(sdiodev, SDIO_FUNC_1,
-+			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[1],
- 						     sdaddr, pkt);
- 		} else {
--			err = brcmf_sdiod_buff_read(sdiodev, SDIO_FUNC_1,
-+			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[1],
- 						    sdaddr, pkt);
- 		}
- 
-@@ -728,12 +737,12 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 	return err;
- }
- 
--int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn)
-+int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, struct sdio_func *func)
- {
- 	brcmf_dbg(SDIO, "Enter\n");
- 
- 	/* Issue abort cmd52 command through F0 */
--	brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_ABORT, fn, NULL);
-+	brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_ABORT, func->num, NULL);
- 
- 	brcmf_dbg(SDIO, "Exit\n");
- 	return 0;
-@@ -1105,7 +1114,7 @@ static int brcmf_ops_sdio_suspend(struct
- 
- 	func = container_of(dev, struct sdio_func, dev);
- 	brcmf_dbg(SDIO, "Enter: F%d\n", func->num);
--	if (func->num != SDIO_FUNC_1)
-+	if (func->num != 1)
- 		return 0;
- 
- 
-@@ -1134,7 +1143,7 @@ static int brcmf_ops_sdio_resume(struct
- 	struct sdio_func *func = container_of(dev, struct sdio_func, dev);
- 
- 	brcmf_dbg(SDIO, "Enter: F%d\n", func->num);
--	if (func->num != SDIO_FUNC_2)
-+	if (func->num != 2)
- 		return 0;
- 
- 	brcmf_sdiod_freezer_off(sdiodev);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -1157,7 +1157,7 @@ static void brcmf_sdio_rxfail(struct brc
- 		  rtx ? ", send NAK" : "");
- 
- 	if (abort)
--		brcmf_sdiod_abort(bus->sdiodev, SDIO_FUNC_2);
-+		brcmf_sdiod_abort(bus->sdiodev, bus->sdiodev->func[2]);
- 
- 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM,
- 			   &err);
-@@ -1209,7 +1209,7 @@ static void brcmf_sdio_txfail(struct brc
- 	brcmf_err("sdio error, abort command and terminate frame\n");
- 	bus->sdcnt.tx_sderrs++;
- 
--	brcmf_sdiod_abort(sdiodev, SDIO_FUNC_2);
-+	brcmf_sdiod_abort(sdiodev, sdiodev->func[2]);
- 	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
- 	bus->sdcnt.f1regdata++;
- 
-@@ -2072,7 +2072,7 @@ static int brcmf_sdio_txpkt_prep_sg(stru
- 	int ntail, ret;
- 
- 	sdiodev = bus->sdiodev;
--	blksize = sdiodev->func[SDIO_FUNC_2]->cur_blksize;
-+	blksize = sdiodev->func[2]->cur_blksize;
- 	/* sg entry alignment should be a divisor of block size */
- 	WARN_ON(blksize % bus->sgentry_align);
- 
-@@ -2441,7 +2441,7 @@ static void brcmf_sdio_bus_stop(struct d
- 
- 		/* Turn off the bus (F2), free any pending packets */
- 		brcmf_dbg(INTR, "disable SDIO interrupts\n");
--		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
-+		sdio_disable_func(sdiodev->func[2]);
- 
- 		/* Clear any pending interrupts now that F2 is disabled */
- 		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(intstatus),
-@@ -4066,8 +4066,7 @@ static void brcmf_sdio_firmware_callback
- 	brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
- 			   SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
- 
--	err = sdio_enable_func(sdiodev->func[SDIO_FUNC_2]);
--
-+	err = sdio_enable_func(sdiodev->func[2]);
- 
- 	brcmf_dbg(INFO, "enable F2: err=%d\n", err);
- 
-@@ -4082,7 +4081,7 @@ static void brcmf_sdio_firmware_callback
- 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
- 	} else {
- 		/* Disable F2 again */
--		sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
-+		sdio_disable_func(sdiodev->func[2]);
- 		goto release;
- 	}
- 
-@@ -4219,7 +4218,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	sdio_claim_host(bus->sdiodev->func[1]);
- 
- 	/* Disable F2 to clear any intermediate frame state on the dongle */
--	sdio_disable_func(bus->sdiodev->func[SDIO_FUNC_2]);
-+	sdio_disable_func(bus->sdiodev->func[2]);
- 
- 	bus->rxflow = false;
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -45,9 +45,6 @@
- #define REG_F0_REG_MASK		0x7FF
- #define REG_F1_MISC_MASK	0x1FFFF
- 
--/* as of sdiod rev 0, supports 3 functions */
--#define SBSDIO_NUM_FUNCTION		3
--
- /* function 0 vendor specific CCCR registers */
- 
- #define SDIO_CCCR_BRCM_CARDCAP			0xf0
-@@ -350,7 +347,8 @@ int brcmf_sdiod_ramrw(struct brcmf_sdio_
- 		      u8 *data, uint size);
- 
- /* Issue an abort to the specified function */
--int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, u8 fn);
-+int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, struct sdio_func *func);
-+
- void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev);
- void brcmf_sdiod_change_state(struct brcmf_sdio_dev *sdiodev,
- 			      enum brcmf_sdiod_state state);
diff --git a/package/kernel/mac80211/patches/314-v4.16-0008-brcmfmac-Clean-up-interrupt-macros.patch b/package/kernel/mac80211/patches/314-v4.16-0008-brcmfmac-Clean-up-interrupt-macros.patch
deleted file mode 100644
index d732c8e58..000000000
--- a/package/kernel/mac80211/patches/314-v4.16-0008-brcmfmac-Clean-up-interrupt-macros.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 9c3438ed215adba7025268ee1f0b6f7a2af12316 Mon Sep 17 00:00:00 2001
-From: Ian Molton <ian@mnementh.co.uk>
-Date: Tue, 19 Dec 2017 13:47:14 +0100
-Subject: [PATCH] brcmfmac: Clean up interrupt macros
-
-Make it more obvious that this code acually enables interrupts, and
-provide nice definitions for the bits in the register.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 3 ++-
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 8 +++++---
- 2 files changed, 7 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -149,7 +149,8 @@ int brcmf_sdiod_intr_register(struct brc
- 
- 		/* must configure SDIO_CCCR_IENx to enable irq */
- 		data = brcmf_sdiod_func0_rb(sdiodev, SDIO_CCCR_IENx, &ret);
--		data |= 1 << SDIO_FUNC_1 | 1 << SDIO_FUNC_2 | 1;
-+		data |= SDIO_CCCR_IEN_FUNC1 | SDIO_CCCR_IEN_FUNC2 |
-+			SDIO_CCCR_IEN_FUNC0;
- 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, data, &ret);
- 
- 		/* redirect, configure and enable io for interrupt signal */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -24,9 +24,6 @@
- /* Maximum number of I/O funcs */
- #define NUM_SDIO_FUNCS	3
- 
--#define SDIO_FUNC_1		1
--#define SDIO_FUNC_2		2
--
- #define SDIOD_FBR_SIZE		0x100
- 
- /* io_en */
-@@ -52,6 +49,11 @@
- #define SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT	BIT(2)
- #define SDIO_CCCR_BRCM_CARDCAP_CMD_NODEC	BIT(3)
- 
-+/* Interrupt enable bits for each function */
-+#define SDIO_CCCR_IEN_FUNC0			BIT(0)
-+#define SDIO_CCCR_IEN_FUNC1			BIT(1)
-+#define SDIO_CCCR_IEN_FUNC2			BIT(2)
-+
- #define SDIO_CCCR_BRCM_CARDCTRL			0xf1
- #define SDIO_CCCR_BRCM_CARDCTRL_WLANRESET	BIT(1)
- 
diff --git a/package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch b/package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch
deleted file mode 100644
index d010d23f0..000000000
--- a/package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From e3720dad99859251a8b0fe2807275a8afcfb560d Mon Sep 17 00:00:00 2001
-From: Double Lo <double.lo@cypress.com>
-Date: Tue, 19 Dec 2017 14:56:44 +0800
-Subject: [PATCH] brcmfmac: Support 43455 save-restore (SR) feature if FW
- include -sr
-
-This patch will add 43455 into the save-restore(SR) capable chip list, so
-the SR engine will be enabled with 43455 FW which built-in the -sr
-function.
-
-Signed-off-by: Double Lo <double.lo@cypress.com>
-Signed-off-by: Wright Feng <wright.feng@cypress.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-@@ -1338,6 +1338,7 @@ bool brcmf_chip_sr_capable(struct brcmf_
- 	switch (pub->chip) {
- 	case BRCM_CC_4354_CHIP_ID:
- 	case BRCM_CC_4356_CHIP_ID:
-+	case BRCM_CC_4345_CHIP_ID:
- 		/* explicitly check SR engine enable bit */
- 		pmu_cc3_mask = BIT(2);
- 		/* fall-through */
diff --git a/package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch b/package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch
deleted file mode 100644
index bd9de13d7..000000000
--- a/package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch
+++ /dev/null
@@ -1,1043 +0,0 @@
-From c9aa7a91de740c537dc8c2f9f3d36fc651371b13 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 9 Jan 2018 13:22:52 +0100
-Subject: [PATCH] brcmfmac: Remove array of functions
-
-Replace the array of functions with a pair of pointers to the
-relevant functions.
-
-Signed-off-by: Ian Molton <ian@mnementh.co.uk>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 115 +++++++-------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 168 ++++++++++-----------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |  15 +-
- 3 files changed, 146 insertions(+), 152 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -118,7 +118,7 @@ int brcmf_sdiod_intr_register(struct brc
- 
- 		ret = request_irq(pdata->oob_irq_nr, brcmf_sdiod_oob_irqhandler,
- 				  pdata->oob_irq_flags, "brcmf_oob_intr",
--				  &sdiodev->func[1]->dev);
-+				  &sdiodev->func1->dev);
- 		if (ret != 0) {
- 			brcmf_err("request_irq failed %d\n", ret);
- 			return ret;
-@@ -132,7 +132,7 @@ int brcmf_sdiod_intr_register(struct brc
- 		}
- 		sdiodev->irq_wake = true;
- 
--		sdio_claim_host(sdiodev->func[1]);
-+		sdio_claim_host(sdiodev->func1);
- 
- 		if (sdiodev->bus_if->chip == BRCM_CC_43362_CHIP_ID) {
- 			/* assign GPIO to SDIO core */
-@@ -159,13 +159,13 @@ int brcmf_sdiod_intr_register(struct brc
- 			data |= SDIO_CCCR_BRCM_SEPINT_ACT_HI;
- 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT,
- 				     data, &ret);
--		sdio_release_host(sdiodev->func[1]);
-+		sdio_release_host(sdiodev->func1);
- 	} else {
- 		brcmf_dbg(SDIO, "Entering\n");
--		sdio_claim_host(sdiodev->func[1]);
--		sdio_claim_irq(sdiodev->func[1], brcmf_sdiod_ib_irqhandler);
--		sdio_claim_irq(sdiodev->func[2], brcmf_sdiod_dummy_irqhandler);
--		sdio_release_host(sdiodev->func[1]);
-+		sdio_claim_host(sdiodev->func1);
-+		sdio_claim_irq(sdiodev->func1, brcmf_sdiod_ib_irqhandler);
-+		sdio_claim_irq(sdiodev->func2, brcmf_sdiod_dummy_irqhandler);
-+		sdio_release_host(sdiodev->func1);
- 		sdiodev->sd_irq_requested = true;
- 	}
- 
-@@ -183,26 +183,26 @@ void brcmf_sdiod_intr_unregister(struct
- 		struct brcmfmac_sdio_pd *pdata;
- 
- 		pdata = &sdiodev->settings->bus.sdio;
--		sdio_claim_host(sdiodev->func[1]);
-+		sdio_claim_host(sdiodev->func1);
- 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
- 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
--		sdio_release_host(sdiodev->func[1]);
-+		sdio_release_host(sdiodev->func1);
- 
- 		sdiodev->oob_irq_requested = false;
- 		if (sdiodev->irq_wake) {
- 			disable_irq_wake(pdata->oob_irq_nr);
- 			sdiodev->irq_wake = false;
- 		}
--		free_irq(pdata->oob_irq_nr, &sdiodev->func[1]->dev);
-+		free_irq(pdata->oob_irq_nr, &sdiodev->func1->dev);
- 		sdiodev->irq_en = false;
- 		sdiodev->oob_irq_requested = false;
- 	}
- 
- 	if (sdiodev->sd_irq_requested) {
--		sdio_claim_host(sdiodev->func[1]);
--		sdio_release_irq(sdiodev->func[2]);
--		sdio_release_irq(sdiodev->func[1]);
--		sdio_release_host(sdiodev->func[1]);
-+		sdio_claim_host(sdiodev->func1);
-+		sdio_release_irq(sdiodev->func2);
-+		sdio_release_irq(sdiodev->func1);
-+		sdio_release_host(sdiodev->func1);
- 		sdiodev->sd_irq_requested = false;
- 	}
- }
-@@ -264,7 +264,7 @@ u32 brcmf_sdiod_readl(struct brcmf_sdio_
- 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
--	data = sdio_readl(sdiodev->func[1], addr, &retval);
-+	data = sdio_readl(sdiodev->func1, addr, &retval);
- 
- out:
- 	if (ret)
-@@ -285,7 +285,7 @@ void brcmf_sdiod_writel(struct brcmf_sdi
- 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
--	sdio_writel(sdiodev->func[1], data, addr, &retval);
-+	sdio_writel(sdiodev->func1, data, addr, &retval);
- 
- out:
- 	if (ret)
-@@ -550,7 +550,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
- 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
--	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr, pkt);
-+	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr, pkt);
- 
- done:
- 	return err;
-@@ -575,13 +575,13 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 	if (pktq->qlen == 1)
--		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
-+		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
- 					    pktq->next);
- 	else if (!sdiodev->sg_support) {
- 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
- 		if (!glom_skb)
- 			return -ENOMEM;
--		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
-+		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
- 					    glom_skb);
- 		if (err)
- 			goto done;
-@@ -591,7 +591,7 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 			skb_pull(glom_skb, skb->len);
- 		}
- 	} else
--		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], false,
-+		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func2, false,
- 					    addr, pktq);
- 
- done:
-@@ -623,7 +623,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 	if (!err)
--		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2], addr,
-+		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2, addr,
- 					     mypkt);
- 
- 	brcmu_pkt_buf_free_skb(mypkt);
-@@ -649,13 +649,13 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
- 
- 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
- 		skb_queue_walk(pktq, skb) {
--			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2],
-+			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2,
- 						     addr, skb);
- 			if (err)
- 				break;
- 		}
- 	} else {
--		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], true,
-+		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func2, true,
- 					    addr, pktq);
- 	}
- 
-@@ -686,7 +686,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 	else
- 		dsize = size;
- 
--	sdio_claim_host(sdiodev->func[1]);
-+	sdio_claim_host(sdiodev->func1);
- 
- 	/* Do the transfer(s) */
- 	while (size) {
-@@ -706,10 +706,10 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 
- 		if (write) {
- 			memcpy(pkt->data, data, dsize);
--			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[1],
-+			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func1,
- 						     sdaddr, pkt);
- 		} else {
--			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[1],
-+			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func1,
- 						    sdaddr, pkt);
- 		}
- 
-@@ -733,7 +733,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 
- 	dev_kfree_skb(pkt);
- 
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func1);
- 
- 	return err;
- }
-@@ -757,7 +757,7 @@ void brcmf_sdiod_sgtable_alloc(struct br
- 	uint nents;
- 	int err;
- 
--	func = sdiodev->func[2];
-+	func = sdiodev->func2;
- 	host = func->card->host;
- 	sdiodev->sg_support = host->max_segs > 1;
- 	max_blocks = min_t(uint, host->max_blk_count, 511u);
-@@ -818,17 +818,17 @@ static int brcmf_sdiod_freezer_on(struct
- 	brcmf_sdio_trigger_dpc(sdiodev->bus);
- 	wait_event(sdiodev->freezer->thread_freeze,
- 		   atomic_read(expect) == sdiodev->freezer->frozen_count);
--	sdio_claim_host(sdiodev->func[1]);
-+	sdio_claim_host(sdiodev->func1);
- 	res = brcmf_sdio_sleep(sdiodev->bus, true);
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func1);
- 	return res;
- }
- 
- static void brcmf_sdiod_freezer_off(struct brcmf_sdio_dev *sdiodev)
- {
--	sdio_claim_host(sdiodev->func[1]);
-+	sdio_claim_host(sdiodev->func1);
- 	brcmf_sdio_sleep(sdiodev->bus, false);
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func1);
- 	atomic_set(&sdiodev->freezer->freezing, 0);
- 	complete_all(&sdiodev->freezer->resumed);
- }
-@@ -878,19 +878,19 @@ static int brcmf_sdiod_remove(struct brc
- 	brcmf_sdiod_freezer_detach(sdiodev);
- 
- 	/* Disable Function 2 */
--	sdio_claim_host(sdiodev->func[2]);
--	sdio_disable_func(sdiodev->func[2]);
--	sdio_release_host(sdiodev->func[2]);
-+	sdio_claim_host(sdiodev->func2);
-+	sdio_disable_func(sdiodev->func2);
-+	sdio_release_host(sdiodev->func2);
- 
- 	/* Disable Function 1 */
--	sdio_claim_host(sdiodev->func[1]);
--	sdio_disable_func(sdiodev->func[1]);
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_claim_host(sdiodev->func1);
-+	sdio_disable_func(sdiodev->func1);
-+	sdio_release_host(sdiodev->func1);
- 
- 	sg_free_table(&sdiodev->sgtable);
- 	sdiodev->sbwad = 0;
- 
--	pm_runtime_allow(sdiodev->func[1]->card->host->parent);
-+	pm_runtime_allow(sdiodev->func1->card->host->parent);
- 	return 0;
- }
- 
-@@ -906,29 +906,27 @@ static int brcmf_sdiod_probe(struct brcm
- {
- 	int ret = 0;
- 
--	sdiodev->num_funcs = 2;
-+	sdio_claim_host(sdiodev->func1);
- 
--	sdio_claim_host(sdiodev->func[1]);
--
--	ret = sdio_set_block_size(sdiodev->func[1], SDIO_FUNC1_BLOCKSIZE);
-+	ret = sdio_set_block_size(sdiodev->func1, SDIO_FUNC1_BLOCKSIZE);
- 	if (ret) {
- 		brcmf_err("Failed to set F1 blocksize\n");
--		sdio_release_host(sdiodev->func[1]);
-+		sdio_release_host(sdiodev->func1);
- 		goto out;
- 	}
--	ret = sdio_set_block_size(sdiodev->func[2], SDIO_FUNC2_BLOCKSIZE);
-+	ret = sdio_set_block_size(sdiodev->func2, SDIO_FUNC2_BLOCKSIZE);
- 	if (ret) {
- 		brcmf_err("Failed to set F2 blocksize\n");
--		sdio_release_host(sdiodev->func[1]);
-+		sdio_release_host(sdiodev->func1);
- 		goto out;
- 	}
- 
- 	/* increase F2 timeout */
--	sdiodev->func[2]->enable_timeout = SDIO_WAIT_F2RDY;
-+	sdiodev->func2->enable_timeout = SDIO_WAIT_F2RDY;
- 
- 	/* Enable Function 1 */
--	ret = sdio_enable_func(sdiodev->func[1]);
--	sdio_release_host(sdiodev->func[1]);
-+	ret = sdio_enable_func(sdiodev->func1);
-+	sdio_release_host(sdiodev->func1);
- 	if (ret) {
- 		brcmf_err("Failed to enable F1: err=%d\n", ret);
- 		goto out;
-@@ -944,7 +942,7 @@ static int brcmf_sdiod_probe(struct brcm
- 		ret = -ENODEV;
- 		goto out;
- 	}
--	brcmf_sdiod_host_fixup(sdiodev->func[2]->card->host);
-+	brcmf_sdiod_host_fixup(sdiodev->func2->card->host);
- out:
- 	if (ret)
- 		brcmf_sdiod_remove(sdiodev);
-@@ -1032,16 +1030,15 @@ static int brcmf_ops_sdio_probe(struct s
- 	/* store refs to functions used. mmc_card does
- 	 * not hold the F0 function pointer.
- 	 */
--	sdiodev->func[0] = NULL;
--	sdiodev->func[1] = func->card->sdio_func[0];
--	sdiodev->func[2] = func;
-+	sdiodev->func1 = func->card->sdio_func[0];
-+	sdiodev->func2 = func;
- 
- 	sdiodev->bus_if = bus_if;
- 	bus_if->bus_priv.sdio = sdiodev;
- 	bus_if->proto_type = BRCMF_PROTO_BCDC;
- 	dev_set_drvdata(&func->dev, bus_if);
--	dev_set_drvdata(&sdiodev->func[1]->dev, bus_if);
--	sdiodev->dev = &sdiodev->func[1]->dev;
-+	dev_set_drvdata(&sdiodev->func1->dev, bus_if);
-+	sdiodev->dev = &sdiodev->func1->dev;
- 
- 	brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_DOWN);
- 
-@@ -1057,7 +1054,7 @@ static int brcmf_ops_sdio_probe(struct s
- 
- fail:
- 	dev_set_drvdata(&func->dev, NULL);
--	dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
-+	dev_set_drvdata(&sdiodev->func1->dev, NULL);
- 	kfree(sdiodev);
- 	kfree(bus_if);
- 	return err;
-@@ -1086,8 +1083,8 @@ static void brcmf_ops_sdio_remove(struct
- 		/* only proceed with rest of cleanup if func 1 */
- 		brcmf_sdiod_remove(sdiodev);
- 
--		dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
--		dev_set_drvdata(&sdiodev->func[2]->dev, NULL);
-+		dev_set_drvdata(&sdiodev->func1->dev, NULL);
-+		dev_set_drvdata(&sdiodev->func2->dev, NULL);
- 
- 		kfree(bus_if);
- 		kfree(sdiodev);
-@@ -1132,7 +1129,7 @@ static int brcmf_ops_sdio_suspend(struct
- 		else
- 			sdio_flags |= MMC_PM_WAKE_SDIO_IRQ;
- 	}
--	if (sdio_set_host_pm_flags(sdiodev->func[1], sdio_flags))
-+	if (sdio_set_host_pm_flags(sdiodev->func1, sdio_flags))
- 		brcmf_err("Failed to set pm_flags %x\n", sdio_flags);
- 	return 0;
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -979,7 +979,7 @@ static int brcmf_sdio_readshared(struct
- 	struct sdpcm_shared_le sh_le;
- 	__le32 addr_le;
- 
--	sdio_claim_host(bus->sdiodev->func[1]);
-+	sdio_claim_host(bus->sdiodev->func1);
- 	brcmf_sdio_bus_sleep(bus, false, false);
- 
- 	/*
-@@ -1013,7 +1013,7 @@ static int brcmf_sdio_readshared(struct
- 	if (rv < 0)
- 		goto fail;
- 
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(bus->sdiodev->func1);
- 
- 	/* Endianness */
- 	sh->flags = le32_to_cpu(sh_le.flags);
-@@ -1035,7 +1035,7 @@ static int brcmf_sdio_readshared(struct
- fail:
- 	brcmf_err("unable to obtain sdpcm_shared info: rv=%d (addr=0x%x)\n",
- 		  rv, addr);
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(bus->sdiodev->func1);
- 	return rv;
- }
- 
-@@ -1157,7 +1157,7 @@ static void brcmf_sdio_rxfail(struct brc
- 		  rtx ? ", send NAK" : "");
- 
- 	if (abort)
--		brcmf_sdiod_abort(bus->sdiodev, bus->sdiodev->func[2]);
-+		brcmf_sdiod_abort(bus->sdiodev, bus->sdiodev->func2);
- 
- 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM,
- 			   &err);
-@@ -1209,7 +1209,7 @@ static void brcmf_sdio_txfail(struct brc
- 	brcmf_err("sdio error, abort command and terminate frame\n");
- 	bus->sdcnt.tx_sderrs++;
- 
--	brcmf_sdiod_abort(sdiodev, sdiodev->func[2]);
-+	brcmf_sdiod_abort(sdiodev, sdiodev->func2);
- 	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
- 	bus->sdcnt.f1regdata++;
- 
-@@ -1565,10 +1565,10 @@ static u8 brcmf_sdio_rxglom(struct brcmf
- 		 * read directly into the chained packet, or allocate a large
- 		 * packet and and copy into the chain.
- 		 */
--		sdio_claim_host(bus->sdiodev->func[1]);
-+		sdio_claim_host(bus->sdiodev->func1);
- 		errcode = brcmf_sdiod_recv_chain(bus->sdiodev,
- 						 &bus->glom, dlen);
--		sdio_release_host(bus->sdiodev->func[1]);
-+		sdio_release_host(bus->sdiodev->func1);
- 		bus->sdcnt.f2rxdata++;
- 
- 		/* On failure, kill the superframe */
-@@ -1576,11 +1576,11 @@ static u8 brcmf_sdio_rxglom(struct brcmf
- 			brcmf_err("glom read of %d bytes failed: %d\n",
- 				  dlen, errcode);
- 
--			sdio_claim_host(bus->sdiodev->func[1]);
-+			sdio_claim_host(bus->sdiodev->func1);
- 			brcmf_sdio_rxfail(bus, true, false);
- 			bus->sdcnt.rxglomfail++;
- 			brcmf_sdio_free_glom(bus);
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
- 			return 0;
- 		}
- 
-@@ -1590,10 +1590,10 @@ static u8 brcmf_sdio_rxglom(struct brcmf
- 
- 		rd_new.seq_num = rxseq;
- 		rd_new.len = dlen;
--		sdio_claim_host(bus->sdiodev->func[1]);
-+		sdio_claim_host(bus->sdiodev->func1);
- 		errcode = brcmf_sdio_hdparse(bus, pfirst->data, &rd_new,
- 					     BRCMF_SDIO_FT_SUPER);
--		sdio_release_host(bus->sdiodev->func[1]);
-+		sdio_release_host(bus->sdiodev->func1);
- 		bus->cur_read.len = rd_new.len_nxtfrm << 4;
- 
- 		/* Remove superframe header, remember offset */
-@@ -1609,10 +1609,10 @@ static u8 brcmf_sdio_rxglom(struct brcmf
- 
- 			rd_new.len = pnext->len;
- 			rd_new.seq_num = rxseq++;
--			sdio_claim_host(bus->sdiodev->func[1]);
-+			sdio_claim_host(bus->sdiodev->func1);
- 			errcode = brcmf_sdio_hdparse(bus, pnext->data, &rd_new,
- 						     BRCMF_SDIO_FT_SUB);
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
- 			brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
- 					   pnext->data, 32, "subframe:\n");
- 
-@@ -1621,11 +1621,11 @@ static u8 brcmf_sdio_rxglom(struct brcmf
- 
- 		if (errcode) {
- 			/* Terminate frame on error */
--			sdio_claim_host(bus->sdiodev->func[1]);
-+			sdio_claim_host(bus->sdiodev->func1);
- 			brcmf_sdio_rxfail(bus, true, false);
- 			bus->sdcnt.rxglomfail++;
- 			brcmf_sdio_free_glom(bus);
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
- 			bus->cur_read.len = 0;
- 			return 0;
- 		}
-@@ -1833,7 +1833,7 @@ static uint brcmf_sdio_readframes(struct
- 
- 		rd->len_left = rd->len;
- 		/* read header first for unknow frame length */
--		sdio_claim_host(bus->sdiodev->func[1]);
-+		sdio_claim_host(bus->sdiodev->func1);
- 		if (!rd->len) {
- 			ret = brcmf_sdiod_recv_buf(bus->sdiodev,
- 						   bus->rxhdr, BRCMF_FIRSTREAD);
-@@ -1843,7 +1843,7 @@ static uint brcmf_sdio_readframes(struct
- 					  ret);
- 				bus->sdcnt.rx_hdrfail++;
- 				brcmf_sdio_rxfail(bus, true, true);
--				sdio_release_host(bus->sdiodev->func[1]);
-+				sdio_release_host(bus->sdiodev->func1);
- 				continue;
- 			}
- 
-@@ -1853,7 +1853,7 @@ static uint brcmf_sdio_readframes(struct
- 
- 			if (brcmf_sdio_hdparse(bus, bus->rxhdr, rd,
- 					       BRCMF_SDIO_FT_NORMAL)) {
--				sdio_release_host(bus->sdiodev->func[1]);
-+				sdio_release_host(bus->sdiodev->func1);
- 				if (!bus->rxpending)
- 					break;
- 				else
-@@ -1869,7 +1869,7 @@ static uint brcmf_sdio_readframes(struct
- 				rd->len_nxtfrm = 0;
- 				/* treat all packet as event if we don't know */
- 				rd->channel = SDPCM_EVENT_CHANNEL;
--				sdio_release_host(bus->sdiodev->func[1]);
-+				sdio_release_host(bus->sdiodev->func1);
- 				continue;
- 			}
- 			rd->len_left = rd->len > BRCMF_FIRSTREAD ?
-@@ -1886,7 +1886,7 @@ static uint brcmf_sdio_readframes(struct
- 			brcmf_err("brcmu_pkt_buf_get_skb failed\n");
- 			brcmf_sdio_rxfail(bus, false,
- 					    RETRYCHAN(rd->channel));
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
- 			continue;
- 		}
- 		skb_pull(pkt, head_read);
-@@ -1894,16 +1894,16 @@ static uint brcmf_sdio_readframes(struct
- 
- 		ret = brcmf_sdiod_recv_pkt(bus->sdiodev, pkt);
- 		bus->sdcnt.f2rxdata++;
--		sdio_release_host(bus->sdiodev->func[1]);
-+		sdio_release_host(bus->sdiodev->func1);
- 
- 		if (ret < 0) {
- 			brcmf_err("read %d bytes from channel %d failed: %d\n",
- 				  rd->len, rd->channel, ret);
- 			brcmu_pkt_buf_free_skb(pkt);
--			sdio_claim_host(bus->sdiodev->func[1]);
-+			sdio_claim_host(bus->sdiodev->func1);
- 			brcmf_sdio_rxfail(bus, true,
- 					    RETRYCHAN(rd->channel));
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
- 			continue;
- 		}
- 
-@@ -1914,7 +1914,7 @@ static uint brcmf_sdio_readframes(struct
- 		} else {
- 			memcpy(bus->rxhdr, pkt->data, SDPCM_HDRLEN);
- 			rd_new.seq_num = rd->seq_num;
--			sdio_claim_host(bus->sdiodev->func[1]);
-+			sdio_claim_host(bus->sdiodev->func1);
- 			if (brcmf_sdio_hdparse(bus, bus->rxhdr, &rd_new,
- 					       BRCMF_SDIO_FT_NORMAL)) {
- 				rd->len = 0;
-@@ -1927,11 +1927,11 @@ static uint brcmf_sdio_readframes(struct
- 					  roundup(rd_new.len, 16) >> 4);
- 				rd->len = 0;
- 				brcmf_sdio_rxfail(bus, true, true);
--				sdio_release_host(bus->sdiodev->func[1]);
-+				sdio_release_host(bus->sdiodev->func1);
- 				brcmu_pkt_buf_free_skb(pkt);
- 				continue;
- 			}
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
- 			rd->len_nxtfrm = rd_new.len_nxtfrm;
- 			rd->channel = rd_new.channel;
- 			rd->dat_offset = rd_new.dat_offset;
-@@ -1947,9 +1947,9 @@ static uint brcmf_sdio_readframes(struct
- 					  rd_new.seq_num);
- 				/* Force retry w/normal header read */
- 				rd->len = 0;
--				sdio_claim_host(bus->sdiodev->func[1]);
-+				sdio_claim_host(bus->sdiodev->func1);
- 				brcmf_sdio_rxfail(bus, false, true);
--				sdio_release_host(bus->sdiodev->func[1]);
-+				sdio_release_host(bus->sdiodev->func1);
- 				brcmu_pkt_buf_free_skb(pkt);
- 				continue;
- 			}
-@@ -1972,9 +1972,9 @@ static uint brcmf_sdio_readframes(struct
- 			} else {
- 				brcmf_err("%s: glom superframe w/o "
- 					  "descriptor!\n", __func__);
--				sdio_claim_host(bus->sdiodev->func[1]);
-+				sdio_claim_host(bus->sdiodev->func1);
- 				brcmf_sdio_rxfail(bus, false, false);
--				sdio_release_host(bus->sdiodev->func[1]);
-+				sdio_release_host(bus->sdiodev->func1);
- 			}
- 			/* prepare the descriptor for the next read */
- 			rd->len = rd->len_nxtfrm << 4;
-@@ -2072,7 +2072,7 @@ static int brcmf_sdio_txpkt_prep_sg(stru
- 	int ntail, ret;
- 
- 	sdiodev = bus->sdiodev;
--	blksize = sdiodev->func[2]->cur_blksize;
-+	blksize = sdiodev->func2->cur_blksize;
- 	/* sg entry alignment should be a divisor of block size */
- 	WARN_ON(blksize % bus->sgentry_align);
- 
-@@ -2251,14 +2251,14 @@ static int brcmf_sdio_txpkt(struct brcmf
- 	if (ret)
- 		goto done;
- 
--	sdio_claim_host(bus->sdiodev->func[1]);
-+	sdio_claim_host(bus->sdiodev->func1);
- 	ret = brcmf_sdiod_send_pkt(bus->sdiodev, pktq);
- 	bus->sdcnt.f2txdata++;
- 
- 	if (ret < 0)
- 		brcmf_sdio_txfail(bus);
- 
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(bus->sdiodev->func1);
- 
- done:
- 	brcmf_sdio_txpkt_postp(bus, pktq);
-@@ -2314,10 +2314,11 @@ static uint brcmf_sdio_sendfromq(struct
- 		/* In poll mode, need to check for other events */
- 		if (!bus->intr) {
- 			/* Check device status, signal pending interrupt */
--			sdio_claim_host(bus->sdiodev->func[1]);
-+			sdio_claim_host(bus->sdiodev->func1);
- 			intstatus = brcmf_sdiod_readl(bus->sdiodev,
- 						      intstat_addr, &ret);
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
-+
- 			bus->sdcnt.f2txdata++;
- 			if (ret != 0)
- 				break;
-@@ -2417,7 +2418,7 @@ static void brcmf_sdio_bus_stop(struct d
- 	}
- 
- 	if (sdiodev->state != BRCMF_SDIOD_NOMEDIUM) {
--		sdio_claim_host(sdiodev->func[1]);
-+		sdio_claim_host(sdiodev->func1);
- 
- 		/* Enable clock for device interrupts */
- 		brcmf_sdio_bus_sleep(bus, false, false);
-@@ -2441,13 +2442,13 @@ static void brcmf_sdio_bus_stop(struct d
- 
- 		/* Turn off the bus (F2), free any pending packets */
- 		brcmf_dbg(INTR, "disable SDIO interrupts\n");
--		sdio_disable_func(sdiodev->func[2]);
-+		sdio_disable_func(sdiodev->func2);
- 
- 		/* Clear any pending interrupts now that F2 is disabled */
- 		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(intstatus),
- 				   local_hostintmask, NULL);
- 
--		sdio_release_host(sdiodev->func[1]);
-+		sdio_release_host(sdiodev->func1);
- 	}
- 	/* Clear the data packet queues */
- 	brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
-@@ -2522,7 +2523,7 @@ static void brcmf_sdio_dpc(struct brcmf_
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
--	sdio_claim_host(bus->sdiodev->func[1]);
-+	sdio_claim_host(bus->sdiodev->func1);
- 
- 	/* If waiting for HTAVAIL, check status */
- 	if (!bus->sr_enabled && bus->clkstate == CLK_PENDING) {
-@@ -2585,7 +2586,7 @@ static void brcmf_sdio_dpc(struct brcmf_
- 		intstatus |= brcmf_sdio_hostmail(bus);
- 	}
- 
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(bus->sdiodev->func1);
- 
- 	/* Generally don't ask for these, can get CRC errors... */
- 	if (intstatus & I_WR_OOSYNC) {
-@@ -2628,7 +2629,7 @@ static void brcmf_sdio_dpc(struct brcmf_
- 
- 	if (bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL) &&
- 	    data_ok(bus)) {
--		sdio_claim_host(bus->sdiodev->func[1]);
-+		sdio_claim_host(bus->sdiodev->func1);
- 		if (bus->ctrl_frame_stat) {
- 			err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
- 						      bus->ctrl_frame_len);
-@@ -2636,7 +2637,7 @@ static void brcmf_sdio_dpc(struct brcmf_
- 			wmb();
- 			bus->ctrl_frame_stat = false;
- 		}
--		sdio_release_host(bus->sdiodev->func[1]);
-+		sdio_release_host(bus->sdiodev->func1);
- 		brcmf_sdio_wait_event_wakeup(bus);
- 	}
- 	/* Send queued frames (limit 1 if rx may still be pending) */
-@@ -2652,14 +2653,14 @@ static void brcmf_sdio_dpc(struct brcmf_
- 		brcmf_err("failed backplane access over SDIO, halting operation\n");
- 		atomic_set(&bus->intstatus, 0);
- 		if (bus->ctrl_frame_stat) {
--			sdio_claim_host(bus->sdiodev->func[1]);
-+			sdio_claim_host(bus->sdiodev->func1);
- 			if (bus->ctrl_frame_stat) {
- 				bus->ctrl_frame_err = -ENODEV;
- 				wmb();
- 				bus->ctrl_frame_stat = false;
- 				brcmf_sdio_wait_event_wakeup(bus);
- 			}
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
- 		}
- 	} else if (atomic_read(&bus->intstatus) ||
- 		   atomic_read(&bus->ipend) > 0 ||
-@@ -2874,13 +2875,13 @@ brcmf_sdio_bus_txctl(struct device *dev,
- 					 CTL_DONE_TIMEOUT);
- 	ret = 0;
- 	if (bus->ctrl_frame_stat) {
--		sdio_claim_host(bus->sdiodev->func[1]);
-+		sdio_claim_host(bus->sdiodev->func1);
- 		if (bus->ctrl_frame_stat) {
- 			brcmf_dbg(SDIO, "ctrl_frame timeout\n");
- 			bus->ctrl_frame_stat = false;
- 			ret = -ETIMEDOUT;
- 		}
--		sdio_release_host(bus->sdiodev->func[1]);
-+		sdio_release_host(bus->sdiodev->func1);
- 	}
- 	if (!ret) {
- 		brcmf_dbg(SDIO, "ctrl_frame complete, err=%d\n",
-@@ -3004,7 +3005,7 @@ static int brcmf_sdio_assert_info(struct
- 		return 0;
- 	}
- 
--	sdio_claim_host(bus->sdiodev->func[1]);
-+	sdio_claim_host(bus->sdiodev->func1);
- 	if (sh->assert_file_addr != 0) {
- 		error = brcmf_sdiod_ramrw(bus->sdiodev, false,
- 					  sh->assert_file_addr, (u8 *)file, 80);
-@@ -3017,7 +3018,7 @@ static int brcmf_sdio_assert_info(struct
- 		if (error < 0)
- 			return error;
- 	}
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(bus->sdiodev->func1);
- 
- 	seq_printf(seq, "dongle assert: %s:%d: assert(%s)\n",
- 		   file, sh->assert_line, expr);
-@@ -3291,7 +3292,7 @@ static int brcmf_sdio_download_firmware(
- 	int bcmerror;
- 	u32 rstvec;
- 
--	sdio_claim_host(bus->sdiodev->func[1]);
-+	sdio_claim_host(bus->sdiodev->func1);
- 	brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
- 
- 	rstvec = get_unaligned_le32(fw->data);
-@@ -3320,7 +3321,7 @@ static int brcmf_sdio_download_firmware(
- 
- err:
- 	brcmf_sdio_clkctl(bus, CLK_SDONLY, false);
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(bus->sdiodev->func1);
- 	return bcmerror;
- }
- 
-@@ -3435,7 +3436,7 @@ static int brcmf_sdio_bus_preinit(struct
- 	if (sdiodev->sg_support) {
- 		bus->txglom = false;
- 		value = 1;
--		pad_size = bus->sdiodev->func[2]->cur_blksize << 1;
-+		pad_size = bus->sdiodev->func2->cur_blksize << 1;
- 		err = brcmf_iovar_data_set(bus->sdiodev->dev, "bus:rxglom",
- 					   &value, sizeof(u32));
- 		if (err < 0) {
-@@ -3477,7 +3478,7 @@ static int brcmf_sdio_bus_get_memdump(st
- 
- 	address = bus->ci->rambase;
- 	offset = err = 0;
--	sdio_claim_host(sdiodev->func[1]);
-+	sdio_claim_host(sdiodev->func1);
- 	while (offset < mem_size) {
- 		len = ((offset + MEMBLOCK) < mem_size) ? MEMBLOCK :
- 		      mem_size - offset;
-@@ -3493,7 +3494,7 @@ static int brcmf_sdio_bus_get_memdump(st
- 	}
- 
- done:
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func1);
- 	return err;
- }
- 
-@@ -3550,11 +3551,10 @@ static void brcmf_sdio_bus_watchdog(stru
- 			if (!bus->dpc_triggered) {
- 				u8 devpend;
- 
--				sdio_claim_host(bus->sdiodev->func[1]);
-+				sdio_claim_host(bus->sdiodev->func1);
- 				devpend = brcmf_sdiod_func0_rb(bus->sdiodev,
--							       SDIO_CCCR_INTx,
--							       NULL);
--				sdio_release_host(bus->sdiodev->func[1]);
-+						  SDIO_CCCR_INTx, NULL);
-+				sdio_release_host(bus->sdiodev->func1);
- 				intstatus = devpend & (INTR_STATUS_FUNC1 |
- 						       INTR_STATUS_FUNC2);
- 			}
-@@ -3580,13 +3580,13 @@ static void brcmf_sdio_bus_watchdog(stru
- 		bus->console.count += jiffies_to_msecs(BRCMF_WD_POLL);
- 		if (bus->console.count >= bus->console_interval) {
- 			bus->console.count -= bus->console_interval;
--			sdio_claim_host(bus->sdiodev->func[1]);
-+			sdio_claim_host(bus->sdiodev->func1);
- 			/* Make sure backplane clock is on */
- 			brcmf_sdio_bus_sleep(bus, false, false);
- 			if (brcmf_sdio_readconsole(bus) < 0)
- 				/* stop on error */
- 				bus->console_interval = 0;
--			sdio_release_host(bus->sdiodev->func[1]);
-+			sdio_release_host(bus->sdiodev->func1);
- 		}
- 	}
- #endif				/* DEBUG */
-@@ -3599,11 +3599,11 @@ static void brcmf_sdio_bus_watchdog(stru
- 			bus->idlecount++;
- 			if (bus->idlecount > bus->idletime) {
- 				brcmf_dbg(SDIO, "idle\n");
--				sdio_claim_host(bus->sdiodev->func[1]);
-+				sdio_claim_host(bus->sdiodev->func1);
- 				brcmf_sdio_wd_timer(bus, false);
- 				bus->idlecount = 0;
- 				brcmf_sdio_bus_sleep(bus, true, false);
--				sdio_release_host(bus->sdiodev->func[1]);
-+				sdio_release_host(bus->sdiodev->func1);
- 			}
- 		} else {
- 			bus->idlecount = 0;
-@@ -3773,8 +3773,8 @@ static u32 brcmf_sdio_buscore_read32(voi
- 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
- 
- 	if (addr == CORE_CC_REG(SI_ENUM_BASE, chipid) &&
--	    (sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
--	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
-+	    (sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
-+	     sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
- 		rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
- 		if (rev >= 2) {
- 			val &= ~CID_ID_MASK;
-@@ -3810,7 +3810,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 	u32 drivestrength;
- 
- 	sdiodev = bus->sdiodev;
--	sdio_claim_host(sdiodev->func[1]);
-+	sdio_claim_host(sdiodev->func1);
- 
- 	pr_debug("F1 signature read @0x18000000=0x%4x\n",
- 		 brcmf_sdiod_readl(sdiodev, SI_ENUM_BASE, NULL));
-@@ -3877,8 +3877,8 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 	/* wowl can be supported when KEEP_POWER is true and (WAKE_SDIO_IRQ
- 	 * is true or when platform data OOB irq is true).
- 	 */
--	if ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_KEEP_POWER) &&
--	    ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_WAKE_SDIO_IRQ) ||
-+	if ((sdio_get_host_pm_caps(sdiodev->func1) & MMC_PM_KEEP_POWER) &&
-+	    ((sdio_get_host_pm_caps(sdiodev->func1) & MMC_PM_WAKE_SDIO_IRQ) ||
- 	     (sdiodev->settings->bus.sdio.oob_irq_supported)))
- 		sdiodev->bus_if->wowl_supported = true;
- #endif
-@@ -3917,7 +3917,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 	if (err)
- 		goto fail;
- 
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func1);
- 
- 	brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
- 
-@@ -3938,7 +3938,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
- 	return true;
- 
- fail:
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func1);
- 	return false;
- }
- 
-@@ -4044,7 +4044,7 @@ static void brcmf_sdio_firmware_callback
- 	bus->sdcnt.tickcnt = 0;
- 	brcmf_sdio_wd_timer(bus, true);
- 
--	sdio_claim_host(sdiodev->func[1]);
-+	sdio_claim_host(sdiodev->func1);
- 
- 	/* Make sure backplane clock is on, needed to generate F2 interrupt */
- 	brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
-@@ -4066,7 +4066,7 @@ static void brcmf_sdio_firmware_callback
- 	brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
- 			   SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
- 
--	err = sdio_enable_func(sdiodev->func[2]);
-+	err = sdio_enable_func(sdiodev->func2);
- 
- 	brcmf_dbg(INFO, "enable F2: err=%d\n", err);
- 
-@@ -4081,7 +4081,7 @@ static void brcmf_sdio_firmware_callback
- 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
- 	} else {
- 		/* Disable F2 again */
--		sdio_disable_func(sdiodev->func[2]);
-+		sdio_disable_func(sdiodev->func2);
- 		goto release;
- 	}
- 
-@@ -4106,7 +4106,7 @@ static void brcmf_sdio_firmware_callback
- 	if (err != 0)
- 		brcmf_sdio_clkctl(bus, CLK_NONE, false);
- 
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func1);
- 
- 	err = brcmf_bus_started(dev);
- 	if (err != 0) {
-@@ -4116,10 +4116,10 @@ static void brcmf_sdio_firmware_callback
- 	return;
- 
- release:
--	sdio_release_host(sdiodev->func[1]);
-+	sdio_release_host(sdiodev->func1);
- fail:
- 	brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
--	device_release_driver(&sdiodev->func[2]->dev);
-+	device_release_driver(&sdiodev->func2->dev);
- 	device_release_driver(dev);
- }
- 
-@@ -4146,7 +4146,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 
- 	/* single-threaded workqueue */
- 	wq = alloc_ordered_workqueue("brcmf_wq/%s", WQ_MEM_RECLAIM,
--				     dev_name(&sdiodev->func[1]->dev));
-+				     dev_name(&sdiodev->func1->dev));
- 	if (!wq) {
- 		brcmf_err("insufficient memory to create txworkqueue\n");
- 		goto fail;
-@@ -4173,7 +4173,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	init_completion(&bus->watchdog_wait);
- 	bus->watchdog_tsk = kthread_run(brcmf_sdio_watchdog_thread,
- 					bus, "brcmf_wdog/%s",
--					dev_name(&sdiodev->func[1]->dev));
-+					dev_name(&sdiodev->func1->dev));
- 	if (IS_ERR(bus->watchdog_tsk)) {
- 		pr_warn("brcmf_watchdog thread failed to start\n");
- 		bus->watchdog_tsk = NULL;
-@@ -4199,7 +4199,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	}
- 
- 	/* Query the F2 block size, set roundup accordingly */
--	bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
-+	bus->blocksize = bus->sdiodev->func2->cur_blksize;
- 	bus->roundup = min(max_roundup, bus->blocksize);
- 
- 	/* Allocate buffers */
-@@ -4215,17 +4215,17 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 		}
- 	}
- 
--	sdio_claim_host(bus->sdiodev->func[1]);
-+	sdio_claim_host(bus->sdiodev->func1);
- 
- 	/* Disable F2 to clear any intermediate frame state on the dongle */
--	sdio_disable_func(bus->sdiodev->func[2]);
-+	sdio_disable_func(bus->sdiodev->func2);
- 
- 	bus->rxflow = false;
- 
- 	/* Done with backplane-dependent accesses, can drop clock... */
- 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
- 
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(bus->sdiodev->func1);
- 
- 	/* ...and initialize clock/power states */
- 	bus->clkstate = CLK_SDONLY;
-@@ -4277,7 +4277,7 @@ void brcmf_sdio_remove(struct brcmf_sdio
- 
- 		if (bus->ci) {
- 			if (bus->sdiodev->state != BRCMF_SDIOD_NOMEDIUM) {
--				sdio_claim_host(bus->sdiodev->func[1]);
-+				sdio_claim_host(bus->sdiodev->func1);
- 				brcmf_sdio_wd_timer(bus, false);
- 				brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
- 				/* Leave the device in state where it is
-@@ -4287,7 +4287,7 @@ void brcmf_sdio_remove(struct brcmf_sdio
- 				msleep(20);
- 				brcmf_chip_set_passive(bus->ci);
- 				brcmf_sdio_clkctl(bus, CLK_NONE, false);
--				sdio_release_host(bus->sdiodev->func[1]);
-+				sdio_release_host(bus->sdiodev->func1);
- 			}
- 			brcmf_chip_detach(bus->ci);
- 		}
-@@ -4334,9 +4334,9 @@ int brcmf_sdio_sleep(struct brcmf_sdio *
- {
- 	int ret;
- 
--	sdio_claim_host(bus->sdiodev->func[1]);
-+	sdio_claim_host(bus->sdiodev->func1);
- 	ret = brcmf_sdio_bus_sleep(bus, sleep, false);
--	sdio_release_host(bus->sdiodev->func[1]);
-+	sdio_release_host(bus->sdiodev->func1);
- 
- 	return ret;
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -21,9 +21,6 @@
- #include <linux/firmware.h>
- #include "firmware.h"
- 
--/* Maximum number of I/O funcs */
--#define NUM_SDIO_FUNCS	3
--
- #define SDIOD_FBR_SIZE		0x100
- 
- /* io_en */
-@@ -173,8 +170,8 @@ struct brcmf_sdio;
- struct brcmf_sdiod_freezer;
- 
- struct brcmf_sdio_dev {
--	struct sdio_func *func[NUM_SDIO_FUNCS];
--	u8 num_funcs;			/* Supported funcs on client */
-+	struct sdio_func *func1;
-+	struct sdio_func *func2;
- 	u32 sbwad;			/* Save backplane window address */
- 	struct brcmf_core *cc_core;	/* chipcommon core info struct */
- 	struct brcmf_sdio *bus;
-@@ -295,17 +292,17 @@ void brcmf_sdiod_intr_unregister(struct
- /* SDIO device register access interface */
- /* Accessors for SDIO Function 0 */
- #define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
--	sdio_f0_readb((sdiodev)->func[1], (addr), (r))
-+	sdio_f0_readb((sdiodev)->func1, (addr), (r))
- 
- #define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
--	sdio_f0_writeb((sdiodev)->func[1], (v), (addr), (ret))
-+	sdio_f0_writeb((sdiodev)->func1, (v), (addr), (ret))
- 
- /* Accessors for SDIO Function 1 */
- #define brcmf_sdiod_readb(sdiodev, addr, r) \
--	sdio_readb((sdiodev)->func[1], (addr), (r))
-+	sdio_readb((sdiodev)->func1, (addr), (r))
- 
- #define brcmf_sdiod_writeb(sdiodev, addr, v, ret) \
--	sdio_writeb((sdiodev)->func[1], (v), (addr), (ret))
-+	sdio_writeb((sdiodev)->func1, (v), (addr), (ret))
- 
- u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
- void brcmf_sdiod_writel(struct brcmf_sdio_dev *sdiodev, u32 addr, u32 data,
diff --git a/package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch b/package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch
deleted file mode 100644
index dc78000be..000000000
--- a/package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 32adbcaa5df49f1977441f7a4bf180a0bcfe9966 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 9 Jan 2018 13:22:53 +0100
-Subject: [PATCH] brcmfmac: add comment block in brcmf_sdio_buscore_read()
-
-In brcmf_sdio_buscore_read() there is some special handling upon
-register access to chipid register of the chipcommon core. Add
-comment explaining why it is done here.
-
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3772,6 +3772,13 @@ static u32 brcmf_sdio_buscore_read32(voi
- 
- 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
- 
-+	/*
-+	 * this is a bit of special handling if reading the chipcommon chipid
-+	 * register. The 4339 is a next-gen of the 4335. It uses the same
-+	 * SDIO device id as 4335 and the chipid register returns 4335 as well.
-+	 * It can be identified as 4339 by looking at the chip revision. It
-+	 * is corrected here so the chip.c module has the right info.
-+	 */
- 	if (addr == CORE_CC_REG(SI_ENUM_BASE, chipid) &&
- 	    (sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
- 	     sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
diff --git a/package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch b/package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch
deleted file mode 100644
index c587f413d..000000000
--- a/package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch
+++ /dev/null
@@ -1,137 +0,0 @@
-From 378f6a16043e5d3346301fc618f503e97aea335b Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 9 Jan 2018 13:22:54 +0100
-Subject: [PATCH] brcmfmac: rename brcmf_sdiod_buff_{read,write}() functions
-
-Rename functions to brcmf_sdio_skbuff_{read,write}() as we pass an
-skbuff to this function.
-
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 48 +++++++++++-----------
- 1 file changed, 24 insertions(+), 24 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -292,24 +292,24 @@ out:
- 		*ret = retval;
- }
- 
--static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev,
--				 struct sdio_func *func, u32 addr,
--				 struct sk_buff *pkt)
-+static int brcmf_sdiod_skbuff_read(struct brcmf_sdio_dev *sdiodev,
-+				   struct sdio_func *func, u32 addr,
-+				   struct sk_buff *skb)
- {
- 	unsigned int req_sz;
- 	int err;
- 
- 	/* Single skb use the standard mmc interface */
--	req_sz = pkt->len + 3;
-+	req_sz = skb->len + 3;
- 	req_sz &= (uint)~3;
- 
- 	switch (func->num) {
- 	case 1:
--		err = sdio_memcpy_fromio(func, ((u8 *)(pkt->data)), addr,
-+		err = sdio_memcpy_fromio(func, ((u8 *)(skb->data)), addr,
- 					 req_sz);
- 		break;
- 	case 2:
--		err = sdio_readsb(func, ((u8 *)(pkt->data)), addr, req_sz);
-+		err = sdio_readsb(func, ((u8 *)(skb->data)), addr, req_sz);
- 		break;
- 	default:
- 		/* bail out as things are really fishy here */
-@@ -323,18 +323,18 @@ static int brcmf_sdiod_buff_read(struct
- 	return err;
- }
- 
--static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev,
--				  struct sdio_func *func, u32 addr,
--				  struct sk_buff *pkt)
-+static int brcmf_sdiod_skbuff_write(struct brcmf_sdio_dev *sdiodev,
-+				    struct sdio_func *func, u32 addr,
-+				    struct sk_buff *skb)
- {
- 	unsigned int req_sz;
- 	int err;
- 
- 	/* Single skb use the standard mmc interface */
--	req_sz = pkt->len + 3;
-+	req_sz = skb->len + 3;
- 	req_sz &= (uint)~3;
- 
--	err = sdio_memcpy_toio(func, addr, ((u8 *)(pkt->data)), req_sz);
-+	err = sdio_memcpy_toio(func, addr, ((u8 *)(skb->data)), req_sz);
- 
- 	if (err == -ENOMEDIUM)
- 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
-@@ -550,7 +550,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
- 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
--	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr, pkt);
-+	err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func2, addr, pkt);
- 
- done:
- 	return err;
-@@ -575,14 +575,14 @@ int brcmf_sdiod_recv_chain(struct brcmf_
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 	if (pktq->qlen == 1)
--		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
--					    pktq->next);
-+		err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func2, addr,
-+					      pktq->next);
- 	else if (!sdiodev->sg_support) {
- 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
- 		if (!glom_skb)
- 			return -ENOMEM;
--		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
--					    glom_skb);
-+		err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func2, addr,
-+					      glom_skb);
- 		if (err)
- 			goto done;
- 
-@@ -623,8 +623,8 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
- 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- 
- 	if (!err)
--		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2, addr,
--					     mypkt);
-+		err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr,
-+					       mypkt);
- 
- 	brcmu_pkt_buf_free_skb(mypkt);
- 
-@@ -649,8 +649,8 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
- 
- 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
- 		skb_queue_walk(pktq, skb) {
--			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2,
--						     addr, skb);
-+			err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2,
-+						       addr, skb);
- 			if (err)
- 				break;
- 		}
-@@ -706,11 +706,11 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
- 
- 		if (write) {
- 			memcpy(pkt->data, data, dsize);
--			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func1,
--						     sdaddr, pkt);
-+			err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func1,
-+						       sdaddr, pkt);
- 		} else {
--			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func1,
--						    sdaddr, pkt);
-+			err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func1,
-+						      sdaddr, pkt);
- 		}
- 
- 		if (err) {
diff --git a/package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch b/package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch
deleted file mode 100644
index b60c81a3a..000000000
--- a/package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From b7acadaf038740c43515dc1548f43d01cc92823a Mon Sep 17 00:00:00 2001
-From: Himanshu Jha <himanshujha199640@gmail.com>
-Date: Tue, 9 Jan 2018 02:15:31 +0530
-Subject: [PATCH] brcmfmac: Use zeroing memory allocator than allocator/memset
-
-Use dma_zalloc_coherent for allocating zeroed
-memory and remove unnecessary memset function.
-
-Generated-by: scripts/coccinelle/api/alloc/kzalloc-simple.cocci
-
-Suggested-by: Luis R. Rodriguez <mcgrof@kernel.org>
-Signed-off-by: Himanshu Jha <himanshujha199640@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/pcie.c  | 20 ++++++++++----------
- 1 file changed, 10 insertions(+), 10 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1251,14 +1251,14 @@ static int brcmf_pcie_init_scratchbuffer
- 	u64 address;
- 	u32 addr;
- 
--	devinfo->shared.scratch = dma_alloc_coherent(&devinfo->pdev->dev,
--		BRCMF_DMA_D2H_SCRATCH_BUF_LEN,
--		&devinfo->shared.scratch_dmahandle, GFP_KERNEL);
-+	devinfo->shared.scratch =
-+		dma_zalloc_coherent(&devinfo->pdev->dev,
-+					BRCMF_DMA_D2H_SCRATCH_BUF_LEN,
-+					&devinfo->shared.scratch_dmahandle,
-+					GFP_KERNEL);
- 	if (!devinfo->shared.scratch)
- 		goto fail;
- 
--	memset(devinfo->shared.scratch, 0, BRCMF_DMA_D2H_SCRATCH_BUF_LEN);
--
- 	addr = devinfo->shared.tcm_base_address +
- 	       BRCMF_SHARED_DMA_SCRATCH_ADDR_OFFSET;
- 	address = (u64)devinfo->shared.scratch_dmahandle;
-@@ -1268,14 +1268,14 @@ static int brcmf_pcie_init_scratchbuffer
- 	       BRCMF_SHARED_DMA_SCRATCH_LEN_OFFSET;
- 	brcmf_pcie_write_tcm32(devinfo, addr, BRCMF_DMA_D2H_SCRATCH_BUF_LEN);
- 
--	devinfo->shared.ringupd = dma_alloc_coherent(&devinfo->pdev->dev,
--		BRCMF_DMA_D2H_RINGUPD_BUF_LEN,
--		&devinfo->shared.ringupd_dmahandle, GFP_KERNEL);
-+	devinfo->shared.ringupd =
-+		dma_zalloc_coherent(&devinfo->pdev->dev,
-+					BRCMF_DMA_D2H_RINGUPD_BUF_LEN,
-+					&devinfo->shared.ringupd_dmahandle,
-+					GFP_KERNEL);
- 	if (!devinfo->shared.ringupd)
- 		goto fail;
- 
--	memset(devinfo->shared.ringupd, 0, BRCMF_DMA_D2H_RINGUPD_BUF_LEN);
--
- 	addr = devinfo->shared.tcm_base_address +
- 	       BRCMF_SHARED_DMA_RINGUPD_ADDR_OFFSET;
- 	address = (u64)devinfo->shared.ringupd_dmahandle;
diff --git a/package/kernel/mac80211/patches/318-v4.17-mac80211-round-IEEE80211_TX_STATUS_HEADROOM-up-to-mu.patch b/package/kernel/mac80211/patches/318-v4.17-mac80211-round-IEEE80211_TX_STATUS_HEADROOM-up-to-mu.patch
deleted file mode 100644
index e955cb3a2..000000000
--- a/package/kernel/mac80211/patches/318-v4.17-mac80211-round-IEEE80211_TX_STATUS_HEADROOM-up-to-mu.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 9 Feb 2018 19:46:54 +0100
-Subject: [PATCH] mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple
- of 4
-
-This ensures that mac80211 allocated management frames are properly
-aligned, which makes copying them more efficient.
-For instance, mt76 uses iowrite32_copy to copy beacon frames to beacon
-template memory on the chip.
-Misaligned 32-bit accesses cause CPU exceptions on MIPS and should be
-avoided.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -4145,7 +4145,7 @@ void ieee80211_sta_uapsd_trigger(struct
-  * The TX headroom reserved by mac80211 for its own tx_status functions.
-  * This is enough for the radiotap header.
-  */
--#define IEEE80211_TX_STATUS_HEADROOM	14
-+#define IEEE80211_TX_STATUS_HEADROOM	ALIGN(14, 4)
- 
- /**
-  * ieee80211_sta_set_buffered - inform mac80211 about driver-buffered frames
diff --git a/package/kernel/mac80211/patches/319-v4.17-0001-mac80211-drop-frames-with-unexpected-DS-bits-from-fa.patch b/package/kernel/mac80211/patches/319-v4.17-0001-mac80211-drop-frames-with-unexpected-DS-bits-from-fa.patch
deleted file mode 100644
index a7562996b..000000000
--- a/package/kernel/mac80211/patches/319-v4.17-0001-mac80211-drop-frames-with-unexpected-DS-bits-from-fa.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 23 Feb 2018 09:59:35 +0100
-Subject: [PATCH] mac80211: drop frames with unexpected DS bits from
- fast-rx to slow path
-
-Fixes rx for 4-addr packets in AP mode
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -3928,7 +3928,7 @@ static bool ieee80211_invoke_fast_rx(str
- 	if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
- 					      IEEE80211_FCTL_TODS)) !=
- 	    fast_rx->expected_ds_bits)
--		goto drop;
-+		return false;
- 
- 	/* assign the key to drop unencrypted frames (later)
- 	 * and strip the IV/MIC if necessary
diff --git a/package/kernel/mac80211/patches/319-v4.17-0002-mac80211-support-AP-4-addr-mode-fast-rx.patch b/package/kernel/mac80211/patches/319-v4.17-0002-mac80211-support-AP-4-addr-mode-fast-rx.patch
deleted file mode 100644
index 3f3eb0a5e..000000000
--- a/package/kernel/mac80211/patches/319-v4.17-0002-mac80211-support-AP-4-addr-mode-fast-rx.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 23 Feb 2018 10:00:22 +0100
-Subject: [PATCH] mac80211: support AP 4-addr mode fast-rx
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -3774,6 +3774,15 @@ void ieee80211_check_fast_rx(struct sta_
- 			!(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
- 			(sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
- 			 !sdata->u.vlan.sta);
-+
-+		if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-+		    sdata->u.vlan.sta) {
-+			fastrx.expected_ds_bits |=
-+				cpu_to_le16(IEEE80211_FCTL_FROMDS);
-+			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
-+			fastrx.internal_forward = 0;
-+		}
-+
- 		break;
- 	default:
- 		goto clear;
diff --git a/package/kernel/mac80211/patches/319-v4.17-0003-mac80211-support-fast-rx-with-incompatible-PS-capabi.patch b/package/kernel/mac80211/patches/319-v4.17-0003-mac80211-support-fast-rx-with-incompatible-PS-capabi.patch
deleted file mode 100644
index 8c4c724ef..000000000
--- a/package/kernel/mac80211/patches/319-v4.17-0003-mac80211-support-fast-rx-with-incompatible-PS-capabi.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 23 Feb 2018 10:01:53 +0100
-Subject: [PATCH] mac80211: support fast-rx with incompatible PS
- capabilities when PS is disabled
-
-When powersave is disabled for the interface, we can do fast-rx anyway.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -2658,6 +2658,7 @@ static int ieee80211_set_power_mgmt(stru
- 
- 	ieee80211_recalc_ps(local);
- 	ieee80211_recalc_ps_vif(sdata);
-+	ieee80211_check_fast_rx_iface(sdata);
- 
- 	return 0;
- }
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -3741,12 +3741,7 @@ void ieee80211_check_fast_rx(struct sta_
- 		/* 4-addr is harder to deal with, later maybe */
- 		if (sdata->u.mgd.use_4addr)
- 			goto clear;
--		/* software powersave is a huge mess, avoid all of it */
--		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
--			goto clear;
--		if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
--		    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
--			goto clear;
-+
- 		if (sta->sta.tdls) {
- 			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
- 			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
-@@ -3758,6 +3753,16 @@ void ieee80211_check_fast_rx(struct sta_
- 			fastrx.expected_ds_bits =
- 				cpu_to_le16(IEEE80211_FCTL_FROMDS);
- 		}
-+
-+		if (!sdata->u.mgd.powersave)
-+		    break;
-+
-+		/* software powersave is a huge mess, avoid all of it */
-+		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
-+			goto clear;
-+		if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
-+		    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
-+			goto clear;
- 		break;
- 	case NL80211_IFTYPE_AP_VLAN:
- 	case NL80211_IFTYPE_AP:
diff --git a/package/kernel/mac80211/patches/319-v4.17-0004-mac80211-support-station-4-addr-mode-fast-rx.patch b/package/kernel/mac80211/patches/319-v4.17-0004-mac80211-support-station-4-addr-mode-fast-rx.patch
deleted file mode 100644
index 97a5d8beb..000000000
--- a/package/kernel/mac80211/patches/319-v4.17-0004-mac80211-support-station-4-addr-mode-fast-rx.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 23 Feb 2018 10:05:08 +0100
-Subject: [PATCH] mac80211: support station 4-addr mode fast-rx
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -3738,10 +3738,6 @@ void ieee80211_check_fast_rx(struct sta_
- 
- 	switch (sdata->vif.type) {
- 	case NL80211_IFTYPE_STATION:
--		/* 4-addr is harder to deal with, later maybe */
--		if (sdata->u.mgd.use_4addr)
--			goto clear;
--
- 		if (sta->sta.tdls) {
- 			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
- 			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
-@@ -3754,6 +3750,13 @@ void ieee80211_check_fast_rx(struct sta_
- 				cpu_to_le16(IEEE80211_FCTL_FROMDS);
- 		}
- 
-+		if (sdata->u.mgd.use_4addr && !sta->sta.tdls) {
-+			fastrx.expected_ds_bits |=
-+				cpu_to_le16(IEEE80211_FCTL_TODS);
-+			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
-+			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
-+		}
-+
- 		if (!sdata->u.mgd.powersave)
- 		    break;
- 
diff --git a/package/kernel/mac80211/patches/320-v4.17-mac80211-support-A-MSDU-in-fast-rx.patch b/package/kernel/mac80211/patches/320-v4.17-mac80211-support-A-MSDU-in-fast-rx.patch
deleted file mode 100644
index 3c6d342ff..000000000
--- a/package/kernel/mac80211/patches/320-v4.17-mac80211-support-A-MSDU-in-fast-rx.patch
+++ /dev/null
@@ -1,256 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Mon, 26 Feb 2018 22:09:29 +0100
-Subject: [PATCH] mac80211: support A-MSDU in fast-rx
-
-Only works if the IV was stripped from packets. Create a smaller
-variant of ieee80211_rx_h_amsdu, which bypasses checks already done
-within the fast-rx context.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -2358,39 +2358,17 @@ ieee80211_deliver_skb(struct ieee80211_r
- }
- 
- static ieee80211_rx_result debug_noinline
--ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
-+__ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
- {
- 	struct net_device *dev = rx->sdata->dev;
- 	struct sk_buff *skb = rx->skb;
- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
- 	__le16 fc = hdr->frame_control;
- 	struct sk_buff_head frame_list;
--	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
- 	struct ethhdr ethhdr;
- 	const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
- 
--	if (unlikely(!ieee80211_is_data(fc)))
--		return RX_CONTINUE;
--
--	if (unlikely(!ieee80211_is_data_present(fc)))
--		return RX_DROP_MONITOR;
--
--	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
--		return RX_CONTINUE;
--
- 	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
--		switch (rx->sdata->vif.type) {
--		case NL80211_IFTYPE_AP_VLAN:
--			if (!rx->sdata->u.vlan.sta)
--				return RX_DROP_UNUSABLE;
--			break;
--		case NL80211_IFTYPE_STATION:
--			if (!rx->sdata->u.mgd.use_4addr)
--				return RX_DROP_UNUSABLE;
--			break;
--		default:
--			return RX_DROP_UNUSABLE;
--		}
- 		check_da = NULL;
- 		check_sa = NULL;
- 	} else switch (rx->sdata->vif.type) {
-@@ -2410,15 +2388,13 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
- 			break;
- 	}
- 
--	if (is_multicast_ether_addr(hdr->addr1))
--		return RX_DROP_UNUSABLE;
--
- 	skb->dev = dev;
- 	__skb_queue_head_init(&frame_list);
- 
- 	if (ieee80211_data_to_8023_exthdr(skb, &ethhdr,
- 					  rx->sdata->vif.addr,
--					  rx->sdata->vif.type))
-+					  rx->sdata->vif.type,
-+					  data_offset))
- 		return RX_DROP_UNUSABLE;
- 
- 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
-@@ -2440,6 +2416,44 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
- 	return RX_QUEUED;
- }
- 
-+static ieee80211_rx_result debug_noinline
-+ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
-+{
-+	struct sk_buff *skb = rx->skb;
-+	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-+	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-+	__le16 fc = hdr->frame_control;
-+
-+	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
-+		return RX_CONTINUE;
-+
-+	if (unlikely(!ieee80211_is_data(fc)))
-+		return RX_CONTINUE;
-+
-+	if (unlikely(!ieee80211_is_data_present(fc)))
-+		return RX_DROP_MONITOR;
-+
-+	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
-+		switch (rx->sdata->vif.type) {
-+		case NL80211_IFTYPE_AP_VLAN:
-+			if (!rx->sdata->u.vlan.sta)
-+				return RX_DROP_UNUSABLE;
-+			break;
-+		case NL80211_IFTYPE_STATION:
-+			if (!rx->sdata->u.mgd.use_4addr)
-+				return RX_DROP_UNUSABLE;
-+			break;
-+		default:
-+			return RX_DROP_UNUSABLE;
-+		}
-+	}
-+
-+	if (is_multicast_ether_addr(hdr->addr1))
-+		return RX_DROP_UNUSABLE;
-+
-+	return __ieee80211_rx_h_amsdu(rx, 0);
-+}
-+
- #ifdef CPTCFG_MAC80211_MESH
- static ieee80211_rx_result
- ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
-@@ -3889,7 +3903,8 @@ static bool ieee80211_invoke_fast_rx(str
- 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
- 	struct sta_info *sta = rx->sta;
- 	int orig_len = skb->len;
--	int snap_offs = ieee80211_hdrlen(hdr->frame_control);
-+	int hdrlen = ieee80211_hdrlen(hdr->frame_control);
-+	int snap_offs = hdrlen;
- 	struct {
- 		u8 snap[sizeof(rfc1042_header)];
- 		__be16 proto;
-@@ -3920,10 +3935,6 @@ static bool ieee80211_invoke_fast_rx(str
- 	    (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
- 		return false;
- 
--	/* we don't deal with A-MSDU deaggregation here */
--	if (status->rx_flags & IEEE80211_RX_AMSDU)
--		return false;
--
- 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
- 		return false;
- 
-@@ -3955,21 +3966,24 @@ static bool ieee80211_invoke_fast_rx(str
- 		snap_offs += IEEE80211_CCMP_HDR_LEN;
- 	}
- 
--	if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
--		goto drop;
--	payload = (void *)(skb->data + snap_offs);
-+	if (!(status->rx_flags & IEEE80211_RX_AMSDU)) {
-+		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
-+			goto drop;
- 
--	if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
--		return false;
-+		payload = (void *)(skb->data + snap_offs);
- 
--	/* Don't handle these here since they require special code.
--	 * Accept AARP and IPX even though they should come with a
--	 * bridge-tunnel header - but if we get them this way then
--	 * there's little point in discarding them.
--	 */
--	if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
--		     payload->proto == fast_rx->control_port_protocol))
--		return false;
-+		if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
-+			return false;
-+
-+		/* Don't handle these here since they require special code.
-+		 * Accept AARP and IPX even though they should come with a
-+		 * bridge-tunnel header - but if we get them this way then
-+		 * there's little point in discarding them.
-+		 */
-+		if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
-+			     payload->proto == fast_rx->control_port_protocol))
-+			return false;
-+	}
- 
- 	/* after this point, don't punt to the slowpath! */
- 
-@@ -3983,12 +3997,6 @@ static bool ieee80211_invoke_fast_rx(str
- 	}
- 
- 	/* statistics part of ieee80211_rx_h_sta_process() */
--	stats->last_rx = jiffies;
--	stats->last_rate = sta_stats_encode_rate(status);
--
--	stats->fragments++;
--	stats->packets++;
--
- 	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
- 		stats->last_signal = status->signal;
- 		if (!fast_rx->uses_rss)
-@@ -4017,6 +4025,20 @@ static bool ieee80211_invoke_fast_rx(str
- 	if (rx->key && !ieee80211_has_protected(hdr->frame_control))
- 		goto drop;
- 
-+	if (status->rx_flags & IEEE80211_RX_AMSDU) {
-+		if (__ieee80211_rx_h_amsdu(rx, snap_offs - hdrlen) !=
-+		    RX_QUEUED)
-+			goto drop;
-+
-+		return true;
-+	}
-+
-+	stats->last_rx = jiffies;
-+	stats->last_rate = sta_stats_encode_rate(status);
-+
-+	stats->fragments++;
-+	stats->packets++;
-+
- 	/* do the header conversion - first grab the addresses */
- 	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
- 	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -4331,10 +4331,12 @@ unsigned int ieee80211_get_mesh_hdrlen(s
-  *	of it being pushed into the SKB
-  * @addr: the device MAC address
-  * @iftype: the virtual interface type
-+ * @data_offset: offset of payload after the 802.11 header
-  * Return: 0 on success. Non-zero on error.
-  */
- int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
--				  const u8 *addr, enum nl80211_iftype iftype);
-+				  const u8 *addr, enum nl80211_iftype iftype,
-+				  u8 data_offset);
- 
- /**
-  * ieee80211_data_to_8023 - convert an 802.11 data frame to 802.3
-@@ -4346,7 +4348,7 @@ int ieee80211_data_to_8023_exthdr(struct
- static inline int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
- 					 enum nl80211_iftype iftype)
- {
--	return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype);
-+	return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype, 0);
- }
- 
- /**
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -419,7 +419,8 @@ unsigned int ieee80211_get_mesh_hdrlen(s
- EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
- 
- int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
--				  const u8 *addr, enum nl80211_iftype iftype)
-+				  const u8 *addr, enum nl80211_iftype iftype,
-+				  u8 data_offset)
- {
- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
- 	struct {
-@@ -433,7 +434,7 @@ int ieee80211_data_to_8023_exthdr(struct
- 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
- 		return -1;
- 
--	hdrlen = ieee80211_hdrlen(hdr->frame_control);
-+	hdrlen = ieee80211_hdrlen(hdr->frame_control) + data_offset;
- 	if (skb->len < hdrlen + 8)
- 		return -1;
- 
diff --git a/package/kernel/mac80211/patches/321-v4.16-0001-brcmfmac-assure-bcdc-dcmd-api-does-not-return-value-.patch b/package/kernel/mac80211/patches/321-v4.16-0001-brcmfmac-assure-bcdc-dcmd-api-does-not-return-value-.patch
deleted file mode 100644
index 394fbfc5b..000000000
--- a/package/kernel/mac80211/patches/321-v4.16-0001-brcmfmac-assure-bcdc-dcmd-api-does-not-return-value-.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 5242a5444e0b6464d7455beb55d936dd192b5e9d Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Mon, 22 Jan 2018 21:46:39 +0100
-Subject: [PATCH] brcmfmac: assure bcdc dcmd api does not return value > 0
-
-The protocol layer api defines callbacks for dongle commands.
-Although not really well documented these should only return an
-error code in case of an error, or 0 upon success. In the bcdc
-protocol it can return value above 0 and we carry a fix in the
-caller of the protocol layer api. This patch makes it adhere to
-the intent of the api as described above.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 6 +++++-
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c | 8 +++-----
- 2 files changed, 8 insertions(+), 6 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-@@ -211,6 +211,8 @@ retry:
- 		memcpy(buf, info, len);
- 	}
- 
-+	ret = 0;
-+
- 	/* Check the ERROR flag */
- 	if (flags & BCDC_DCMD_ERROR)
- 		ret = le32_to_cpu(msg->status);
-@@ -225,7 +227,7 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
- {
- 	struct brcmf_bcdc *bcdc = (struct brcmf_bcdc *)drvr->proto->pd;
- 	struct brcmf_proto_bcdc_dcmd *msg = &bcdc->msg;
--	int ret = 0;
-+	int ret;
- 	u32 flags, id;
- 
- 	brcmf_dbg(BCDC, "Enter, cmd %d len %d\n", cmd, len);
-@@ -249,6 +251,8 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
- 		goto done;
- 	}
- 
-+	ret = 0;
-+
- 	/* Check the ERROR flag */
- 	if (flags & BCDC_DCMD_ERROR)
- 		ret = le32_to_cpu(msg->status);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-@@ -121,11 +121,9 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
- 	else
- 		err = brcmf_proto_query_dcmd(drvr, ifp->ifidx, cmd, data, len);
- 
--	if (err >= 0)
--		return 0;
--
--	brcmf_dbg(FIL, "Failed: %s (%d)\n",
--		  brcmf_fil_get_errstr((u32)(-err)), err);
-+	if (err)
-+		brcmf_dbg(FIL, "Failed: %s (%d)\n",
-+			  brcmf_fil_get_errstr((u32)(-err)), err);
- 
- 	return err;
- }
diff --git a/package/kernel/mac80211/patches/321-v4.16-0002-brcmfmac-separate-firmware-errors-from-i-o-errors.patch b/package/kernel/mac80211/patches/321-v4.16-0002-brcmfmac-separate-firmware-errors-from-i-o-errors.patch
deleted file mode 100644
index 28e3c1a65..000000000
--- a/package/kernel/mac80211/patches/321-v4.16-0002-brcmfmac-separate-firmware-errors-from-i-o-errors.patch
+++ /dev/null
@@ -1,186 +0,0 @@
-From b69c1df47281ad47bd2037a42b98f5c7115b7fd5 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Mon, 22 Jan 2018 21:46:40 +0100
-Subject: [PATCH] brcmfmac: separate firmware errors from i/o errors
-
-When using the firmware api it can fail simply because firmware does
-not like the request or it fails due to issues in the host interface.
-Currently, there is only a single error code which is confusing. So
-adding a parameter to pass the firmware error separately and in case
-of a firmware error always return -EBADE to user-space.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c  | 11 ++++++-----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c  | 16 +++++++++++-----
- .../net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c    | 10 ++++++----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h | 14 ++++++++------
- 4 files changed, 31 insertions(+), 20 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-@@ -165,7 +165,7 @@ static int brcmf_proto_bcdc_cmplt(struct
- 
- static int
- brcmf_proto_bcdc_query_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
--			    void *buf, uint len)
-+			    void *buf, uint len, int *fwerr)
- {
- 	struct brcmf_bcdc *bcdc = (struct brcmf_bcdc *)drvr->proto->pd;
- 	struct brcmf_proto_bcdc_dcmd *msg = &bcdc->msg;
-@@ -175,6 +175,7 @@ brcmf_proto_bcdc_query_dcmd(struct brcmf
- 
- 	brcmf_dbg(BCDC, "Enter, cmd %d len %d\n", cmd, len);
- 
-+	*fwerr = 0;
- 	ret = brcmf_proto_bcdc_msg(drvr, ifidx, cmd, buf, len, false);
- 	if (ret < 0) {
- 		brcmf_err("brcmf_proto_bcdc_msg failed w/status %d\n",
-@@ -215,15 +216,14 @@ retry:
- 
- 	/* Check the ERROR flag */
- 	if (flags & BCDC_DCMD_ERROR)
--		ret = le32_to_cpu(msg->status);
--
-+		*fwerr = le32_to_cpu(msg->status);
- done:
- 	return ret;
- }
- 
- static int
- brcmf_proto_bcdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
--			  void *buf, uint len)
-+			  void *buf, uint len, int *fwerr)
- {
- 	struct brcmf_bcdc *bcdc = (struct brcmf_bcdc *)drvr->proto->pd;
- 	struct brcmf_proto_bcdc_dcmd *msg = &bcdc->msg;
-@@ -232,6 +232,7 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
- 
- 	brcmf_dbg(BCDC, "Enter, cmd %d len %d\n", cmd, len);
- 
-+	*fwerr = 0;
- 	ret = brcmf_proto_bcdc_msg(drvr, ifidx, cmd, buf, len, true);
- 	if (ret < 0)
- 		goto done;
-@@ -255,7 +256,7 @@ brcmf_proto_bcdc_set_dcmd(struct brcmf_p
- 
- 	/* Check the ERROR flag */
- 	if (flags & BCDC_DCMD_ERROR)
--		ret = le32_to_cpu(msg->status);
-+		*fwerr = le32_to_cpu(msg->status);
- 
- done:
- 	return ret;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-@@ -107,7 +107,7 @@ static s32
- brcmf_fil_cmd_data(struct brcmf_if *ifp, u32 cmd, void *data, u32 len, bool set)
- {
- 	struct brcmf_pub *drvr = ifp->drvr;
--	s32 err;
-+	s32 err, fwerr;
- 
- 	if (drvr->bus_if->state != BRCMF_BUS_UP) {
- 		brcmf_err("bus is down. we have nothing to do.\n");
-@@ -117,14 +117,20 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
- 	if (data != NULL)
- 		len = min_t(uint, len, BRCMF_DCMD_MAXLEN);
- 	if (set)
--		err = brcmf_proto_set_dcmd(drvr, ifp->ifidx, cmd, data, len);
-+		err = brcmf_proto_set_dcmd(drvr, ifp->ifidx, cmd,
-+					   data, len, &fwerr);
- 	else
--		err = brcmf_proto_query_dcmd(drvr, ifp->ifidx, cmd, data, len);
-+		err = brcmf_proto_query_dcmd(drvr, ifp->ifidx, cmd,
-+					     data, len, &fwerr);
- 
--	if (err)
-+	if (err) {
- 		brcmf_dbg(FIL, "Failed: %s (%d)\n",
- 			  brcmf_fil_get_errstr((u32)(-err)), err);
--
-+	} else if (fwerr < 0) {
-+		brcmf_dbg(FIL, "Firmware error: %s (%d)\n",
-+			  brcmf_fil_get_errstr((u32)(-fwerr)), fwerr);
-+		err = -EBADE;
-+	}
- 	return err;
- }
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-@@ -477,7 +477,7 @@ static void brcmf_msgbuf_ioctl_resp_wake
- 
- 
- static int brcmf_msgbuf_query_dcmd(struct brcmf_pub *drvr, int ifidx,
--				   uint cmd, void *buf, uint len)
-+				   uint cmd, void *buf, uint len, int *fwerr)
- {
- 	struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
- 	struct sk_buff *skb = NULL;
-@@ -485,6 +485,7 @@ static int brcmf_msgbuf_query_dcmd(struc
- 	int err;
- 
- 	brcmf_dbg(MSGBUF, "ifidx=%d, cmd=%d, len=%d\n", ifidx, cmd, len);
-+	*fwerr = 0;
- 	msgbuf->ctl_completed = false;
- 	err = brcmf_msgbuf_tx_ioctl(drvr, ifidx, cmd, buf, len);
- 	if (err)
-@@ -508,14 +509,15 @@ static int brcmf_msgbuf_query_dcmd(struc
- 	}
- 	brcmu_pkt_buf_free_skb(skb);
- 
--	return msgbuf->ioctl_resp_status;
-+	*fwerr = msgbuf->ioctl_resp_status;
-+	return 0;
- }
- 
- 
- static int brcmf_msgbuf_set_dcmd(struct brcmf_pub *drvr, int ifidx,
--				 uint cmd, void *buf, uint len)
-+				 uint cmd, void *buf, uint len, int *fwerr)
- {
--	return brcmf_msgbuf_query_dcmd(drvr, ifidx, cmd, buf, len);
-+	return brcmf_msgbuf_query_dcmd(drvr, ifidx, cmd, buf, len, fwerr);
- }
- 
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
-@@ -30,9 +30,9 @@ struct brcmf_proto {
- 	int (*hdrpull)(struct brcmf_pub *drvr, bool do_fws,
- 		       struct sk_buff *skb, struct brcmf_if **ifp);
- 	int (*query_dcmd)(struct brcmf_pub *drvr, int ifidx, uint cmd,
--			  void *buf, uint len);
-+			  void *buf, uint len, int *fwerr);
- 	int (*set_dcmd)(struct brcmf_pub *drvr, int ifidx, uint cmd, void *buf,
--			uint len);
-+			uint len, int *fwerr);
- 	int (*tx_queue_data)(struct brcmf_pub *drvr, int ifidx,
- 			     struct sk_buff *skb);
- 	int (*txdata)(struct brcmf_pub *drvr, int ifidx, u8 offset,
-@@ -71,14 +71,16 @@ static inline int brcmf_proto_hdrpull(st
- 	return drvr->proto->hdrpull(drvr, do_fws, skb, ifp);
- }
- static inline int brcmf_proto_query_dcmd(struct brcmf_pub *drvr, int ifidx,
--					 uint cmd, void *buf, uint len)
-+					 uint cmd, void *buf, uint len,
-+					 int *fwerr)
- {
--	return drvr->proto->query_dcmd(drvr, ifidx, cmd, buf, len);
-+	return drvr->proto->query_dcmd(drvr, ifidx, cmd, buf, len,fwerr);
- }
- static inline int brcmf_proto_set_dcmd(struct brcmf_pub *drvr, int ifidx,
--				       uint cmd, void *buf, uint len)
-+				       uint cmd, void *buf, uint len,
-+				       int *fwerr)
- {
--	return drvr->proto->set_dcmd(drvr, ifidx, cmd, buf, len);
-+	return drvr->proto->set_dcmd(drvr, ifidx, cmd, buf, len, fwerr);
- }
- 
- static inline int brcmf_proto_tx_queue_data(struct brcmf_pub *drvr, int ifidx,
diff --git a/package/kernel/mac80211/patches/322-v4.16-0001-brcmfmac-add-possibility-to-obtain-firmware-error.patch b/package/kernel/mac80211/patches/322-v4.16-0001-brcmfmac-add-possibility-to-obtain-firmware-error.patch
deleted file mode 100644
index e6486160f..000000000
--- a/package/kernel/mac80211/patches/322-v4.16-0001-brcmfmac-add-possibility-to-obtain-firmware-error.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From 933897342d0714ae1c10729cbaeecea0c6178db5 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 28 Feb 2018 21:15:19 +0100
-Subject: [PATCH] brcmfmac: add possibility to obtain firmware error
-
-The feature module needs to evaluate the actual firmware error return
-upon a control command. This adds a flag to struct brcmf_if that the
-caller can set. This flag is checked to determine the error code that
-needs to be returned.
-
-Fixes: b69c1df47281 ("brcmfmac: separate firmware errors from i/o errors")
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h    |  2 ++
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 10 ++++++++++
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c    |  3 +++
- 3 files changed, 15 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -181,6 +181,7 @@ enum brcmf_netif_stop_reason {
-  * @netif_stop_lock: spinlock for update netif_stop from multiple sources.
-  * @pend_8021x_cnt: tracks outstanding number of 802.1x frames.
-  * @pend_8021x_wait: used for signalling change in count.
-+ * @fwil_fwerr: flag indicating fwil layer should return firmware error codes.
-  */
- struct brcmf_if {
- 	struct brcmf_pub *drvr;
-@@ -198,6 +199,7 @@ struct brcmf_if {
- 	wait_queue_head_t pend_8021x_wait;
- 	struct in6_addr ipv6_addr_tbl[NDOL_MAX_ENTRIES];
- 	u8 ipv6addr_idx;
-+	bool fwil_fwerr;
- };
- 
- int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -104,6 +104,9 @@ static void brcmf_feat_iovar_int_get(str
- 	u32 data;
- 	int err;
- 
-+	/* we need to know firmware error */
-+	ifp->fwil_fwerr = true;
-+
- 	err = brcmf_fil_iovar_int_get(ifp, name, &data);
- 	if (err == 0) {
- 		brcmf_dbg(INFO, "enabling feature: %s\n", brcmf_feat_names[id]);
-@@ -112,6 +115,8 @@ static void brcmf_feat_iovar_int_get(str
- 		brcmf_dbg(TRACE, "%s feature check failed: %d\n",
- 			  brcmf_feat_names[id], err);
- 	}
-+
-+	ifp->fwil_fwerr = false;
- }
- 
- static void brcmf_feat_iovar_data_set(struct brcmf_if *ifp,
-@@ -120,6 +125,9 @@ static void brcmf_feat_iovar_data_set(st
- {
- 	int err;
- 
-+	/* we need to know firmware error */
-+	ifp->fwil_fwerr = true;
-+
- 	err = brcmf_fil_iovar_data_set(ifp, name, data, len);
- 	if (err != -BRCMF_FW_UNSUPPORTED) {
- 		brcmf_dbg(INFO, "enabling feature: %s\n", brcmf_feat_names[id]);
-@@ -128,6 +136,8 @@ static void brcmf_feat_iovar_data_set(st
- 		brcmf_dbg(TRACE, "%s feature check failed: %d\n",
- 			  brcmf_feat_names[id], err);
- 	}
-+
-+	ifp->fwil_fwerr = false;
- }
- 
- #define MAX_CAPS_BUFFER_SIZE	512
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-@@ -131,6 +131,9 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
- 			  brcmf_fil_get_errstr((u32)(-fwerr)), fwerr);
- 		err = -EBADE;
- 	}
-+	if (ifp->fwil_fwerr)
-+		return fwerr;
-+
- 	return err;
- }
- 
diff --git a/package/kernel/mac80211/patches/322-v4.16-0002-brcmfmac-fix-P2P_DEVICE-ethernet-address-generation.patch b/package/kernel/mac80211/patches/322-v4.16-0002-brcmfmac-fix-P2P_DEVICE-ethernet-address-generation.patch
deleted file mode 100644
index 20e16ad23..000000000
--- a/package/kernel/mac80211/patches/322-v4.16-0002-brcmfmac-fix-P2P_DEVICE-ethernet-address-generation.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 455f3e76cfc0d893585a5f358b9ddbe9c1e1e53b Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 28 Feb 2018 21:15:20 +0100
-Subject: [PATCH] brcmfmac: fix P2P_DEVICE ethernet address generation
-
-The firmware has a requirement that the P2P_DEVICE address should
-be different from the address of the primary interface. When not
-specified by user-space, the driver generates the MAC address for
-the P2P_DEVICE interface using the MAC address of the primary
-interface and setting the locally administered bit. However, the MAC
-address of the primary interface may already have that bit set causing
-the creation of the P2P_DEVICE interface to fail with -EBUSY. Fix this
-by using a random address instead to determine the P2P_DEVICE address.
-
-Cc: stable@vger.kernel.org # 3.10.y
-Reported-by: Hans de Goede <hdegoede@redhat.com>
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 24 ++++++++++------------
- 1 file changed, 11 insertions(+), 13 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -462,25 +462,23 @@ static int brcmf_p2p_set_firmware(struct
-  * @dev_addr: optional device address.
-  *
-  * P2P needs mac addresses for P2P device and interface. If no device
-- * address it specified, these are derived from the primary net device, ie.
-- * the permanent ethernet address of the device.
-+ * address it specified, these are derived from a random ethernet
-+ * address.
-  */
- static void brcmf_p2p_generate_bss_mac(struct brcmf_p2p_info *p2p, u8 *dev_addr)
- {
--	struct brcmf_if *pri_ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
--	bool local_admin = false;
-+	bool random_addr = false;
- 
--	if (!dev_addr || is_zero_ether_addr(dev_addr)) {
--		dev_addr = pri_ifp->mac_addr;
--		local_admin = true;
--	}
-+	if (!dev_addr || is_zero_ether_addr(dev_addr))
-+		random_addr = true;
- 
--	/* Generate the P2P Device Address.  This consists of the device's
--	 * primary MAC address with the locally administered bit set.
-+	/* Generate the P2P Device Address obtaining a random ethernet
-+	 * address with the locally administered bit set.
- 	 */
--	memcpy(p2p->dev_addr, dev_addr, ETH_ALEN);
--	if (local_admin)
--		p2p->dev_addr[0] |= 0x02;
-+	if (random_addr)
-+		eth_random_addr(p2p->dev_addr);
-+	else
-+		memcpy(p2p->dev_addr, dev_addr, ETH_ALEN);
- 
- 	/* Generate the P2P Interface Address.  If the discovery and connection
- 	 * BSSCFGs need to simultaneously co-exist, then this address must be
diff --git a/package/kernel/mac80211/patches/323-v4.16-0001-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch b/package/kernel/mac80211/patches/323-v4.16-0001-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch
deleted file mode 100644
index f25dea01d..000000000
--- a/package/kernel/mac80211/patches/323-v4.16-0001-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch
+++ /dev/null
@@ -1,157 +0,0 @@
-From 1259055170287a350cad453e9eac139c81609860 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Thu, 15 Mar 2018 08:29:09 +0100
-Subject: [PATCH] brcmfmac: drop Inter-Access Point Protocol packets by default
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Testing brcmfmac with more recent firmwares resulted in AP interfaces
-not working in some specific setups. Debugging resulted in discovering
-support for IAPP in Broadcom's firmwares.
-
-Older firmwares were only generating 802.11f frames. Newer ones like:
-1) 10.10 (TOB) (r663589)
-2) 10.10.122.20 (r683106)
-for 4366b1 and 4366c0 respectively seem to also /respect/ 802.11f frames
-in the Tx path by performing a STA disassociation.
-
-This obsoleted standard and its implementation is something that:
-1) Most people don't need / want to use
-2) Can allow local DoS attacks
-3) Breaks AP interfaces in some specific bridge setups
-
-To solve issues it can cause this commit modifies brcmfmac to drop IAPP
-packets. If affects:
-1) Rx path: driver won't be sending these unwanted packets up.
-2) Tx path: driver will reject packets that would trigger STA
-   disassociation perfromed by a firmware (possible local DoS attack).
-
-It appears there are some Broadcom's clients/users who care about this
-feature despite the drawbacks. They can switch it on using a new module
-param.
-
-This change results in only two more comparisons (check for module param
-and check for Ethernet packet length) for 99.9% of packets. Its overhead
-should be very minimal.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/common.c  |  5 ++
- .../wireless/broadcom/brcm80211/brcmfmac/common.h  |  1 +
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 57 ++++++++++++++++++++++
- 3 files changed, 63 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -75,6 +75,10 @@ static int brcmf_roamoff;
- module_param_named(roamoff, brcmf_roamoff, int, S_IRUSR);
- MODULE_PARM_DESC(roamoff, "Do not use internal roaming engine");
- 
-+static int brcmf_iapp_enable;
-+module_param_named(iapp, brcmf_iapp_enable, int, 0);
-+MODULE_PARM_DESC(iapp, "Enable partial support for the obsoleted Inter-Access Point Protocol");
-+
- #ifdef DEBUG
- /* always succeed brcmf_bus_started() */
- static int brcmf_ignore_probe_fail;
-@@ -441,6 +445,7 @@ struct brcmf_mp_device *brcmf_get_module
- 	settings->feature_disable = brcmf_feature_disable;
- 	settings->fcmode = brcmf_fcmode;
- 	settings->roamoff = !!brcmf_roamoff;
-+	settings->iapp = !!brcmf_iapp_enable;
- #ifdef DEBUG
- 	settings->ignore_probe_fail = !!brcmf_ignore_probe_fail;
- #endif
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-@@ -58,6 +58,7 @@ struct brcmf_mp_device {
- 	unsigned int	feature_disable;
- 	int		fcmode;
- 	bool		roamoff;
-+	bool		iapp;
- 	bool		ignore_probe_fail;
- 	struct brcmfmac_pd_cc *country_codes;
- 	union {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -230,6 +230,37 @@ static void brcmf_netdev_set_multicast_l
- 	schedule_work(&ifp->multicast_work);
- }
- 
-+/**
-+ * brcmf_skb_is_iapp - checks if skb is an IAPP packet
-+ *
-+ * @skb: skb to check
-+ */
-+static bool brcmf_skb_is_iapp(struct sk_buff *skb)
-+{
-+	static const u8 iapp_l2_update_packet[6] __aligned(2) = {
-+		0x00, 0x01, 0xaf, 0x81, 0x01, 0x00,
-+	};
-+	unsigned char *eth_data;
-+#if !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
-+	const u16 *a, *b;
-+#endif
-+
-+	if (skb->len - skb->mac_len != 6 ||
-+	    !is_multicast_ether_addr(eth_hdr(skb)->h_dest))
-+		return false;
-+
-+	eth_data = skb_mac_header(skb) + ETH_HLEN;
-+#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
-+	return !(((*(const u32 *)eth_data) ^ (*(const u32 *)iapp_l2_update_packet)) |
-+		 ((*(const u16 *)(eth_data + 4)) ^ (*(const u16 *)(iapp_l2_update_packet + 4))));
-+#else
-+	a = (const u16 *)eth_data;
-+	b = (const u16 *)iapp_l2_update_packet;
-+
-+	return !((a[0] ^ b[0]) | (a[1] ^ b[1]) | (a[2] ^ b[2]));
-+#endif
-+}
-+
- static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
- 					   struct net_device *ndev)
- {
-@@ -250,6 +281,23 @@ static netdev_tx_t brcmf_netdev_start_xm
- 		goto done;
- 	}
- 
-+	/* Some recent Broadcom's firmwares disassociate STA when they receive
-+	 * an 802.11f ADD frame. This behavior can lead to a local DoS security
-+	 * issue. Attacker may trigger disassociation of any STA by sending a
-+	 * proper Ethernet frame to the wireless interface.
-+	 *
-+	 * Moreover this feature may break AP interfaces in some specific
-+	 * setups. This applies e.g. to the bridge with hairpin mode enabled and
-+	 * IFLA_BRPORT_MCAST_TO_UCAST set. IAPP packet generated by a firmware
-+	 * will get passed back to the wireless interface and cause immediate
-+	 * disassociation of a just-connected STA.
-+	 */
-+	if (!drvr->settings->iapp && brcmf_skb_is_iapp(skb)) {
-+		dev_kfree_skb(skb);
-+		ret = -EINVAL;
-+		goto done;
-+	}
-+
- 	/* Make sure there's enough writeable headroom */
- 	if (skb_headroom(skb) < drvr->hdrlen || skb_header_cloned(skb)) {
- 		head_delta = max_t(int, drvr->hdrlen - skb_headroom(skb), 0);
-@@ -325,6 +373,15 @@ void brcmf_txflowblock_if(struct brcmf_i
- 
- void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb)
- {
-+	/* Most of Broadcom's firmwares send 802.11f ADD frame every time a new
-+	 * STA connects to the AP interface. This is an obsoleted standard most
-+	 * users don't use, so don't pass these frames up unless requested.
-+	 */
-+	if (!ifp->drvr->settings->iapp && brcmf_skb_is_iapp(skb)) {
-+		brcmu_pkt_buf_free_skb(skb);
-+		return;
-+	}
-+
- 	if (skb->pkt_type == PACKET_MULTICAST)
- 		ifp->ndev->stats.multicast++;
- 
diff --git a/package/kernel/mac80211/patches/324-v4.16-0001-brcmfmac-Fix-check-for-ISO3166-code.patch b/package/kernel/mac80211/patches/324-v4.16-0001-brcmfmac-Fix-check-for-ISO3166-code.patch
deleted file mode 100644
index d45f64ff2..000000000
--- a/package/kernel/mac80211/patches/324-v4.16-0001-brcmfmac-Fix-check-for-ISO3166-code.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 9b9322db5c5a1917a66c71fe47c3848a9a31227e Mon Sep 17 00:00:00 2001
-From: Stefan Wahren <stefan.wahren@i2se.com>
-Date: Wed, 14 Mar 2018 20:02:59 +0100
-Subject: [PATCH] brcmfmac: Fix check for ISO3166 code
-
-The commit "regulatory: add NUL to request alpha2" increases the length of
-alpha2 to 3. This causes a regression on brcmfmac, because
-brcmf_cfg80211_reg_notifier() expect valid ISO3166 codes in the complete
-array. So fix this accordingly.
-
-Fixes: 657308f73e67 ("regulatory: add NUL to request alpha2")
-Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
-Acked-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6803,7 +6803,7 @@ static void brcmf_cfg80211_reg_notifier(
- 		return;
- 
- 	/* ignore non-ISO3166 country codes */
--	for (i = 0; i < sizeof(req->alpha2); i++)
-+	for (i = 0; i < 2; i++)
- 		if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
- 			brcmf_err("not an ISO3166 code (0x%02x 0x%02x)\n",
- 				  req->alpha2[0], req->alpha2[1]);
diff --git a/package/kernel/mac80211/patches/325-v4.17-0001-brcmfmac-move-brcmf_bus_preinit-call-just-after-chan.patch b/package/kernel/mac80211/patches/325-v4.17-0001-brcmfmac-move-brcmf_bus_preinit-call-just-after-chan.patch
deleted file mode 100644
index f4d9a84b2..000000000
--- a/package/kernel/mac80211/patches/325-v4.17-0001-brcmfmac-move-brcmf_bus_preinit-call-just-after-chan.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From da472385a29f1fddcac7cfa0499482704310bd16 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 20 Feb 2018 00:14:18 +0100
-Subject: [PATCH] brcmfmac: move brcmf_bus_preinit() call just after changing
- bus state
-
-Moving the brcmf_bus_preinit() call allows the bus code to do some
-required initialization before handling firmware control messages.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 3 ---
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c   | 5 +++++
- 2 files changed, 5 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -369,9 +369,6 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 
- 	/* Enable tx beamforming, errors can be ignored (not supported) */
- 	(void)brcmf_fil_iovar_int_set(ifp, "txbf", 1);
--
--	/* do bus specific preinit here */
--	err = brcmf_bus_preinit(ifp->drvr->bus_if);
- done:
- 	return err;
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1091,6 +1091,11 @@ int brcmf_bus_started(struct device *dev
- 	/* signal bus ready */
- 	brcmf_bus_change_state(bus_if, BRCMF_BUS_UP);
- 
-+	/* do bus specific preinit here */
-+	ret = brcmf_bus_preinit(ifp->drvr->bus_if);
-+	if (ret < 0)
-+		goto fail;
-+
- 	/* Bus is ready, do any initialization */
- 	ret = brcmf_c_preinit_dcmds(ifp);
- 	if (ret < 0)
diff --git a/package/kernel/mac80211/patches/325-v4.17-0002-brcmfmac-move-allocation-of-control-rx-buffer-to-brc.patch b/package/kernel/mac80211/patches/325-v4.17-0002-brcmfmac-move-allocation-of-control-rx-buffer-to-brc.patch
deleted file mode 100644
index 230e891ce..000000000
--- a/package/kernel/mac80211/patches/325-v4.17-0002-brcmfmac-move-allocation-of-control-rx-buffer-to-brc.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 4b5adc736828dc25ca33e263ad8c0b9dcd3bf325 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 20 Feb 2018 00:14:19 +0100
-Subject: [PATCH] brcmfmac: move allocation of control rx buffer to
- brcmf_sdio_bus_preinit()
-
-Allocate the control rx buffer needed for firmware control interface
-during brcmf_sdio_bus_preinit(). This relies on common layer setting
-struct brcmf_bus::maxctl during brcmf_attach(). By moving the allocation
-we can move brcmf_attach() in subsequent change.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 26 ++++++++++------------
- 1 file changed, 12 insertions(+), 14 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -1707,7 +1707,6 @@ brcmf_sdio_read_control(struct brcmf_sdi
- 	int sdret;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
--
- 	if (bus->rxblen)
- 		buf = vzalloc(bus->rxblen);
- 	if (!buf)
-@@ -3411,6 +3410,18 @@ static int brcmf_sdio_bus_preinit(struct
- 	u32 value;
- 	int err;
- 
-+	/* maxctl provided by common layer */
-+	if (WARN_ON(!bus_if->maxctl))
-+		return -EINVAL;
-+
-+	/* Allocate control receive buffer */
-+	bus_if->maxctl += bus->roundup;
-+	value = roundup((bus_if->maxctl + SDPCM_HDRLEN), ALIGNMENT);
-+	value += bus->head_align;
-+	bus->rxbuf = kmalloc(value, GFP_ATOMIC);
-+	if (bus->rxbuf)
-+		bus->rxblen = value;
-+
- 	/* the commands below use the terms tx and rx from
- 	 * a device perspective, ie. bus:txglom affects the
- 	 * bus transfers from device to host.
-@@ -4209,19 +4220,6 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	bus->blocksize = bus->sdiodev->func2->cur_blksize;
- 	bus->roundup = min(max_roundup, bus->blocksize);
- 
--	/* Allocate buffers */
--	if (bus->sdiodev->bus_if->maxctl) {
--		bus->sdiodev->bus_if->maxctl += bus->roundup;
--		bus->rxblen =
--		    roundup((bus->sdiodev->bus_if->maxctl + SDPCM_HDRLEN),
--			    ALIGNMENT) + bus->head_align;
--		bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
--		if (!(bus->rxbuf)) {
--			brcmf_err("rxbuf allocation failed\n");
--			goto fail;
--		}
--	}
--
- 	sdio_claim_host(bus->sdiodev->func1);
- 
- 	/* Disable F2 to clear any intermediate frame state on the dongle */
diff --git a/package/kernel/mac80211/patches/325-v4.17-0003-brcmfmac-call-brcmf_attach-just-before-calling-brcmf.patch b/package/kernel/mac80211/patches/325-v4.17-0003-brcmfmac-call-brcmf_attach-just-before-calling-brcmf.patch
deleted file mode 100644
index a8b0171cb..000000000
--- a/package/kernel/mac80211/patches/325-v4.17-0003-brcmfmac-call-brcmf_attach-just-before-calling-brcmf.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-From 262f2b53f67936b59cc8dfc6f3899ab8905bf1ed Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 20 Feb 2018 00:14:20 +0100
-Subject: [PATCH] brcmfmac: call brcmf_attach() just before calling
- brcmf_bus_started()
-
-Now we can move brcmf_attach() until after the firmware has been downloaded
-to the device. Make the call just before brcmf_bus_started().
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    |  6 ++++
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 34 +++++++++++-----------
- 2 files changed, 23 insertions(+), 17 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1268,6 +1268,12 @@ void brcmf_bus_change_state(struct brcmf
- 	int ifidx;
- 
- 	brcmf_dbg(TRACE, "%d -> %d\n", bus->state, state);
-+
-+	if (!drvr) {
-+		brcmf_dbg(INFO, "ignoring transition, bus not attached yet\n");
-+		return;
-+	}
-+
- 	bus->state = state;
- 
- 	if (state == BRCMF_BUS_UP) {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4048,9 +4048,6 @@ static void brcmf_sdio_firmware_callback
- 	if (err)
- 		goto fail;
- 
--	if (!bus_if->drvr)
--		return;
--
- 	/* try to download image and nvram to the dongle */
- 	bus->alp_only = true;
- 	err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
-@@ -4126,11 +4123,28 @@ static void brcmf_sdio_firmware_callback
- 
- 	sdio_release_host(sdiodev->func1);
- 
-+	/* Assign bus interface call back */
-+	sdiodev->bus_if->dev = sdiodev->dev;
-+	sdiodev->bus_if->ops = &brcmf_sdio_bus_ops;
-+	sdiodev->bus_if->chip = bus->ci->chip;
-+	sdiodev->bus_if->chiprev = bus->ci->chiprev;
-+
-+	/* Attach to the common layer, reserve hdr space */
-+	err = brcmf_attach(sdiodev->dev, sdiodev->settings);
-+	if (err != 0) {
-+		brcmf_err("brcmf_attach failed\n");
-+		goto fail;
-+	}
-+
-+	brcmf_sdio_debugfs_create(bus);
-+
- 	err = brcmf_bus_started(dev);
- 	if (err != 0) {
- 		brcmf_err("dongle is not responding\n");
- 		goto fail;
- 	}
-+
-+	/* ready */
- 	return;
- 
- release:
-@@ -4200,22 +4214,9 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	bus->dpc_triggered = false;
- 	bus->dpc_running = false;
- 
--	/* Assign bus interface call back */
--	bus->sdiodev->bus_if->dev = bus->sdiodev->dev;
--	bus->sdiodev->bus_if->ops = &brcmf_sdio_bus_ops;
--	bus->sdiodev->bus_if->chip = bus->ci->chip;
--	bus->sdiodev->bus_if->chiprev = bus->ci->chiprev;
--
- 	/* default sdio bus header length for tx packet */
- 	bus->tx_hdrlen = SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN;
- 
--	/* Attach to the common layer, reserve hdr space */
--	ret = brcmf_attach(bus->sdiodev->dev, bus->sdiodev->settings);
--	if (ret != 0) {
--		brcmf_err("brcmf_attach failed\n");
--		goto fail;
--	}
--
- 	/* Query the F2 block size, set roundup accordingly */
- 	bus->blocksize = bus->sdiodev->func2->cur_blksize;
- 	bus->roundup = min(max_roundup, bus->blocksize);
-@@ -4240,7 +4241,6 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	/* SR state */
- 	bus->sr_enabled = false;
- 
--	brcmf_sdio_debugfs_create(bus);
- 	brcmf_dbg(INFO, "completed!!\n");
- 
- 	ret = brcmf_fw_map_chip_to_name(bus->ci->chip, bus->ci->chiprev,
diff --git a/package/kernel/mac80211/patches/325-v4.17-0004-brcmfmac-usb-call-brcmf_usb_up-during-brcmf_bus_prei.patch b/package/kernel/mac80211/patches/325-v4.17-0004-brcmfmac-usb-call-brcmf_usb_up-during-brcmf_bus_prei.patch
deleted file mode 100644
index 00c4141cc..000000000
--- a/package/kernel/mac80211/patches/325-v4.17-0004-brcmfmac-usb-call-brcmf_usb_up-during-brcmf_bus_prei.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From a7f4a80c0070b673d4a4ce94b99979ea6d0c6296 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 20 Feb 2018 00:14:21 +0100
-Subject: [PATCH] brcmfmac: usb: call brcmf_usb_up() during brcmf_bus_preinit()
-
-By calling brcmf_usb_up() during brcmf_bus_preinit() it does not need
-to be called in brcmf_usb_bus_setup().
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 7 ++-----
- 1 file changed, 2 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1146,8 +1146,9 @@ static int brcmf_usb_get_fwname(struct d
- }
- 
- static const struct brcmf_bus_ops brcmf_usb_bus_ops = {
--	.txdata = brcmf_usb_tx,
-+	.preinit = brcmf_usb_up,
- 	.stop = brcmf_usb_down,
-+	.txdata = brcmf_usb_tx,
- 	.txctl = brcmf_usb_tx_ctlpkt,
- 	.rxctl = brcmf_usb_rx_ctlpkt,
- 	.wowl_config = brcmf_usb_wowl_config,
-@@ -1165,10 +1166,6 @@ static int brcmf_usb_bus_setup(struct br
- 		return ret;
- 	}
- 
--	ret = brcmf_usb_up(devinfo->dev);
--	if (ret)
--		goto fail;
--
- 	ret = brcmf_bus_started(devinfo->dev);
- 	if (ret)
- 		goto fail;
diff --git a/package/kernel/mac80211/patches/325-v4.17-0005-brcmfmac-move-brcmf_attach-function-in-core.c.patch b/package/kernel/mac80211/patches/325-v4.17-0005-brcmfmac-move-brcmf_attach-function-in-core.c.patch
deleted file mode 100644
index 086b5fadc..000000000
--- a/package/kernel/mac80211/patches/325-v4.17-0005-brcmfmac-move-brcmf_attach-function-in-core.c.patch
+++ /dev/null
@@ -1,130 +0,0 @@
-From 0542503c4c164c65cd1567b0f2b3f887af6c81eb Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 20 Feb 2018 00:14:22 +0100
-Subject: [PATCH] brcmfmac: move brcmf_attach() function in core.c
-
-Moving the function in preparation of subsequent patch.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 98 +++++++++++-----------
- 1 file changed, 49 insertions(+), 49 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -992,55 +992,6 @@ static int brcmf_inet6addr_changed(struc
- }
- #endif
- 
--int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings)
--{
--	struct brcmf_pub *drvr = NULL;
--	int ret = 0;
--	int i;
--
--	brcmf_dbg(TRACE, "Enter\n");
--
--	/* Allocate primary brcmf_info */
--	drvr = kzalloc(sizeof(struct brcmf_pub), GFP_ATOMIC);
--	if (!drvr)
--		return -ENOMEM;
--
--	for (i = 0; i < ARRAY_SIZE(drvr->if2bss); i++)
--		drvr->if2bss[i] = BRCMF_BSSIDX_INVALID;
--
--	mutex_init(&drvr->proto_block);
--
--	/* Link to bus module */
--	drvr->hdrlen = 0;
--	drvr->bus_if = dev_get_drvdata(dev);
--	drvr->bus_if->drvr = drvr;
--	drvr->settings = settings;
--
--	/* attach debug facilities */
--	brcmf_debug_attach(drvr);
--
--	/* Attach and link in the protocol */
--	ret = brcmf_proto_attach(drvr);
--	if (ret != 0) {
--		brcmf_err("brcmf_prot_attach failed\n");
--		goto fail;
--	}
--
--	/* Attach to events important for core code */
--	brcmf_fweh_register(drvr, BRCMF_E_PSM_WATCHDOG,
--			    brcmf_psm_watchdog_notify);
--
--	/* attach firmware event handler */
--	brcmf_fweh_attach(drvr);
--
--	return ret;
--
--fail:
--	brcmf_detach(dev);
--
--	return ret;
--}
--
- static int brcmf_revinfo_read(struct seq_file *s, void *data)
- {
- 	struct brcmf_bus *bus_if = dev_get_drvdata(s->private);
-@@ -1170,6 +1121,55 @@ fail:
- 
- 	return ret;
- }
-+
-+int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings)
-+{
-+	struct brcmf_pub *drvr = NULL;
-+	int ret = 0;
-+	int i;
-+
-+	brcmf_dbg(TRACE, "Enter\n");
-+
-+	/* Allocate primary brcmf_info */
-+	drvr = kzalloc(sizeof(*drvr), GFP_ATOMIC);
-+	if (!drvr)
-+		return -ENOMEM;
-+
-+	for (i = 0; i < ARRAY_SIZE(drvr->if2bss); i++)
-+		drvr->if2bss[i] = BRCMF_BSSIDX_INVALID;
-+
-+	mutex_init(&drvr->proto_block);
-+
-+	/* Link to bus module */
-+	drvr->hdrlen = 0;
-+	drvr->bus_if = dev_get_drvdata(dev);
-+	drvr->bus_if->drvr = drvr;
-+	drvr->settings = settings;
-+
-+	/* attach debug facilities */
-+	brcmf_debug_attach(drvr);
-+
-+	/* Attach and link in the protocol */
-+	ret = brcmf_proto_attach(drvr);
-+	if (ret != 0) {
-+		brcmf_err("brcmf_prot_attach failed\n");
-+		goto fail;
-+	}
-+
-+	/* Attach to events important for core code */
-+	brcmf_fweh_register(drvr, BRCMF_E_PSM_WATCHDOG,
-+			    brcmf_psm_watchdog_notify);
-+
-+	/* attach firmware event handler */
-+	brcmf_fweh_attach(drvr);
-+
-+	return ret;
-+
-+fail:
-+	brcmf_detach(dev);
-+
-+	return ret;
-+}
- 
- void brcmf_bus_add_txhdrlen(struct device *dev, uint len)
- {
diff --git a/package/kernel/mac80211/patches/325-v4.17-0006-brcmfmac-remove-brcmf_bus_started-from-bus-api.patch b/package/kernel/mac80211/patches/325-v4.17-0006-brcmfmac-remove-brcmf_bus_started-from-bus-api.patch
deleted file mode 100644
index 6d23ccdac..000000000
--- a/package/kernel/mac80211/patches/325-v4.17-0006-brcmfmac-remove-brcmf_bus_started-from-bus-api.patch
+++ /dev/null
@@ -1,190 +0,0 @@
-From de2a3027f6f15e2f6558dc4d178282ccc1f054db Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 20 Feb 2018 00:14:23 +0100
-Subject: [PATCH] brcmfmac: remove brcmf_bus_started() from bus api
-
-No longer needed to call this in bus layer so make it static and call
-it in the last phase of brcmf_attach() instead.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h |  1 -
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 14 +++++++----
- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    | 20 +---------------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 10 ++------
- .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 28 ++++------------------
- 5 files changed, 16 insertions(+), 57 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -253,7 +253,6 @@ void brcmf_dev_reset(struct device *dev)
- /* Configure the "global" bus state used by upper layers */
- void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state);
- 
--int brcmf_bus_started(struct device *dev);
- s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data, u32 len);
- void brcmf_bus_add_txhdrlen(struct device *dev, uint len);
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1022,11 +1022,10 @@ static int brcmf_revinfo_read(struct seq
- 	return 0;
- }
- 
--int brcmf_bus_started(struct device *dev)
-+static int brcmf_bus_started(struct brcmf_pub *drvr)
- {
- 	int ret = -1;
--	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
--	struct brcmf_pub *drvr = bus_if->drvr;
-+	struct brcmf_bus *bus_if = drvr->bus_if;
- 	struct brcmf_if *ifp;
- 	struct brcmf_if *p2p_ifp;
- 
-@@ -1043,7 +1042,7 @@ int brcmf_bus_started(struct device *dev
- 	brcmf_bus_change_state(bus_if, BRCMF_BUS_UP);
- 
- 	/* do bus specific preinit here */
--	ret = brcmf_bus_preinit(ifp->drvr->bus_if);
-+	ret = brcmf_bus_preinit(bus_if);
- 	if (ret < 0)
- 		goto fail;
- 
-@@ -1163,7 +1162,12 @@ int brcmf_attach(struct device *dev, str
- 	/* attach firmware event handler */
- 	brcmf_fweh_attach(drvr);
- 
--	return ret;
-+	ret = brcmf_bus_started(drvr);
-+	if (ret != 0) {
-+		brcmf_err("dongle is not responding: err=%d\n", ret);
-+		goto fail;
-+	}
-+	return 0;
- 
- fail:
- 	brcmf_detach(dev);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1581,24 +1581,6 @@ static void brcmf_pcie_release_resource(
- }
- 
- 
--static int brcmf_pcie_attach_bus(struct brcmf_pciedev_info *devinfo)
--{
--	int ret;
--
--	/* Attach to the common driver interface */
--	ret = brcmf_attach(&devinfo->pdev->dev, devinfo->settings);
--	if (ret) {
--		brcmf_err("brcmf_attach failed\n");
--	} else {
--		ret = brcmf_bus_started(&devinfo->pdev->dev);
--		if (ret)
--			brcmf_err("dongle is not responding\n");
--	}
--
--	return ret;
--}
--
--
- static u32 brcmf_pcie_buscore_prep_addr(const struct pci_dev *pdev, u32 addr)
- {
- 	u32 ret_addr;
-@@ -1735,7 +1717,7 @@ static void brcmf_pcie_setup(struct devi
- 	init_waitqueue_head(&devinfo->mbdata_resp_wait);
- 
- 	brcmf_pcie_intr_enable(devinfo);
--	if (brcmf_pcie_attach_bus(devinfo) == 0)
-+	if (brcmf_attach(&devinfo->pdev->dev, devinfo->settings) == 0)
- 		return;
- 
- 	brcmf_pcie_bus_console_read(devinfo);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3422,6 +3422,8 @@ static int brcmf_sdio_bus_preinit(struct
- 	if (bus->rxbuf)
- 		bus->rxblen = value;
- 
-+	brcmf_sdio_debugfs_create(bus);
-+
- 	/* the commands below use the terms tx and rx from
- 	 * a device perspective, ie. bus:txglom affects the
- 	 * bus transfers from device to host.
-@@ -4136,14 +4138,6 @@ static void brcmf_sdio_firmware_callback
- 		goto fail;
- 	}
- 
--	brcmf_sdio_debugfs_create(bus);
--
--	err = brcmf_bus_started(dev);
--	if (err != 0) {
--		brcmf_err("dongle is not responding\n");
--		goto fail;
--	}
--
- 	/* ready */
- 	return;
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1155,27 +1155,6 @@ static const struct brcmf_bus_ops brcmf_
- 	.get_fwname = brcmf_usb_get_fwname,
- };
- 
--static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo)
--{
--	int ret;
--
--	/* Attach to the common driver interface */
--	ret = brcmf_attach(devinfo->dev, devinfo->settings);
--	if (ret) {
--		brcmf_err("brcmf_attach failed\n");
--		return ret;
--	}
--
--	ret = brcmf_bus_started(devinfo->dev);
--	if (ret)
--		goto fail;
--
--	return 0;
--fail:
--	brcmf_detach(devinfo->dev);
--	return ret;
--}
--
- static void brcmf_usb_probe_phase2(struct device *dev, int ret,
- 				   const struct firmware *fw,
- 				   void *nvram, u32 nvlen)
-@@ -1203,7 +1182,8 @@ static void brcmf_usb_probe_phase2(struc
- 	if (ret)
- 		goto error;
- 
--	ret = brcmf_usb_bus_setup(devinfo);
-+	/* Attach to the common driver interface */
-+	ret = brcmf_attach(devinfo->dev, devinfo->settings);
- 	if (ret)
- 		goto error;
- 
-@@ -1253,7 +1233,7 @@ static int brcmf_usb_probe_cb(struct brc
- 	}
- 
- 	if (!brcmf_usb_dlneeded(devinfo)) {
--		ret = brcmf_usb_bus_setup(devinfo);
-+		ret = brcmf_attach(devinfo->dev, devinfo->settings);
- 		if (ret)
- 			goto fail;
- 		/* we are done */
-@@ -1456,7 +1436,7 @@ static int brcmf_usb_resume(struct usb_i
- 
- 	brcmf_dbg(USB, "Enter\n");
- 	if (!devinfo->wowl_enabled)
--		return brcmf_usb_bus_setup(devinfo);
-+		return brcmf_attach(devinfo->dev, devinfo->settings);
- 
- 	devinfo->bus_pub.state = BRCMFMAC_USB_STATE_UP;
- 	brcmf_usb_rx_fill_all(devinfo);
diff --git a/package/kernel/mac80211/patches/325-v4.17-0007-brcmfmac-change-log-level-for-some-low-level-sdio-fu.patch b/package/kernel/mac80211/patches/325-v4.17-0007-brcmfmac-change-log-level-for-some-low-level-sdio-fu.patch
deleted file mode 100644
index 344826912..000000000
--- a/package/kernel/mac80211/patches/325-v4.17-0007-brcmfmac-change-log-level-for-some-low-level-sdio-fu.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From d678296bfb9a630d0000222fc21f4ed0d0d65332 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 20 Feb 2018 00:14:24 +0100
-Subject: [PATCH] brcmfmac: change log level for some low-level sdio functions
-
-Reducing the number of trace level messages in sdio code giving
-them sdio log level instead.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -1706,7 +1706,7 @@ brcmf_sdio_read_control(struct brcmf_sdi
- 	u8 *buf = NULL, *rbuf;
- 	int sdret;
- 
--	brcmf_dbg(TRACE, "Enter\n");
-+	brcmf_dbg(SDIO, "Enter\n");
- 	if (bus->rxblen)
- 		buf = vzalloc(bus->rxblen);
- 	if (!buf)
-@@ -1809,7 +1809,7 @@ static uint brcmf_sdio_readframes(struct
- 	struct brcmf_sdio_hdrinfo *rd = &bus->cur_read, rd_new;
- 	u8 head_read = 0;
- 
--	brcmf_dbg(TRACE, "Enter\n");
-+	brcmf_dbg(SDIO, "Enter\n");
- 
- 	/* Not finished unless we encounter no more frames indication */
- 	bus->rxpending = true;
-@@ -2344,7 +2344,7 @@ static int brcmf_sdio_tx_ctrlframe(struc
- 	struct brcmf_sdio_hdrinfo hd_info = {0};
- 	int ret;
- 
--	brcmf_dbg(TRACE, "Enter\n");
-+	brcmf_dbg(SDIO, "Enter\n");
- 
- 	/* Back the pointer to make room for bus header */
- 	frame -= bus->tx_hdrlen;
-@@ -2520,7 +2520,7 @@ static void brcmf_sdio_dpc(struct brcmf_
- 	uint framecnt;			/* Temporary counter of tx/rx frames */
- 	int err = 0;
- 
--	brcmf_dbg(TRACE, "Enter\n");
-+	brcmf_dbg(SDIO, "Enter\n");
- 
- 	sdio_claim_host(bus->sdiodev->func1);
- 
-@@ -2605,7 +2605,7 @@ static void brcmf_sdio_dpc(struct brcmf_
- 
- 	/* Would be active due to wake-wlan in gSPI */
- 	if (intstatus & I_CHIPACTIVE) {
--		brcmf_dbg(INFO, "Dongle reports CHIPACTIVE\n");
-+		brcmf_dbg(SDIO, "Dongle reports CHIPACTIVE\n");
- 		intstatus &= ~I_CHIPACTIVE;
- 	}
- 
diff --git a/package/kernel/mac80211/patches/325-v4.17-0008-brcmfmac-remove-duplicate-pointer-variable-from-brcm.patch b/package/kernel/mac80211/patches/325-v4.17-0008-brcmfmac-remove-duplicate-pointer-variable-from-brcm.patch
deleted file mode 100644
index 39fba211f..000000000
--- a/package/kernel/mac80211/patches/325-v4.17-0008-brcmfmac-remove-duplicate-pointer-variable-from-brcm.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-From 2d6edad4b2da1991f74e7b02053eeb4a043b887f Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 20 Feb 2018 00:14:25 +0100
-Subject: [PATCH] brcmfmac: remove duplicate pointer variable from
- brcmf_sdio_firmware_callback()
-
-In brcmf_sdio_firmware_callback() two pointer variables were used
-pointing to the same construct. Get rid of sdiodev variable.
-
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 37 +++++++++++-----------
- 1 file changed, 18 insertions(+), 19 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4039,9 +4039,8 @@ static void brcmf_sdio_firmware_callback
- 					 void *nvram, u32 nvram_len)
- {
- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
--	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
--	struct brcmf_sdio *bus = sdiodev->bus;
--	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
-+	struct brcmf_sdio_dev *sdiod = bus_if->bus_priv.sdio;
-+	struct brcmf_sdio *bus = sdiod->bus;
- 	struct brcmf_core *core = bus->sdio_core;
- 	u8 saveclk;
- 
-@@ -4061,7 +4060,7 @@ static void brcmf_sdio_firmware_callback
- 	bus->sdcnt.tickcnt = 0;
- 	brcmf_sdio_wd_timer(bus, true);
- 
--	sdio_claim_host(sdiodev->func1);
-+	sdio_claim_host(sdiod->func1);
- 
- 	/* Make sure backplane clock is on, needed to generate F2 interrupt */
- 	brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
-@@ -4069,9 +4068,9 @@ static void brcmf_sdio_firmware_callback
- 		goto release;
- 
- 	/* Force clocks on backplane to be sure F2 interrupt propagates */
--	saveclk = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
-+	saveclk = brcmf_sdiod_readb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR, &err);
- 	if (!err) {
--		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+		brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR,
- 				   (saveclk | SBSDIO_FORCE_HT), &err);
- 	}
- 	if (err) {
-@@ -4083,7 +4082,7 @@ static void brcmf_sdio_firmware_callback
- 	brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
- 			   SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
- 
--	err = sdio_enable_func(sdiodev->func2);
-+	err = sdio_enable_func(sdiod->func2);
- 
- 	brcmf_dbg(INFO, "enable F2: err=%d\n", err);
- 
-@@ -4095,10 +4094,10 @@ static void brcmf_sdio_firmware_callback
- 				   bus->hostintmask, NULL);
- 
- 
--		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
-+		brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK, 8, &err);
- 	} else {
- 		/* Disable F2 again */
--		sdio_disable_func(sdiodev->func2);
-+		sdio_disable_func(sdiod->func2);
- 		goto release;
- 	}
- 
-@@ -4106,7 +4105,7 @@ static void brcmf_sdio_firmware_callback
- 		brcmf_sdio_sr_init(bus);
- 	} else {
- 		/* Restore previous clock setting */
--		brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-+		brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR,
- 				   saveclk, &err);
- 	}
- 
-@@ -4114,7 +4113,7 @@ static void brcmf_sdio_firmware_callback
- 		/* Allow full data communication using DPC from now on. */
- 		brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DATA);
- 
--		err = brcmf_sdiod_intr_register(sdiodev);
-+		err = brcmf_sdiod_intr_register(sdiod);
- 		if (err != 0)
- 			brcmf_err("intr register failed:%d\n", err);
- 	}
-@@ -4123,16 +4122,16 @@ static void brcmf_sdio_firmware_callback
- 	if (err != 0)
- 		brcmf_sdio_clkctl(bus, CLK_NONE, false);
- 
--	sdio_release_host(sdiodev->func1);
-+	sdio_release_host(sdiod->func1);
- 
- 	/* Assign bus interface call back */
--	sdiodev->bus_if->dev = sdiodev->dev;
--	sdiodev->bus_if->ops = &brcmf_sdio_bus_ops;
--	sdiodev->bus_if->chip = bus->ci->chip;
--	sdiodev->bus_if->chiprev = bus->ci->chiprev;
-+	sdiod->bus_if->dev = sdiod->dev;
-+	sdiod->bus_if->ops = &brcmf_sdio_bus_ops;
-+	sdiod->bus_if->chip = bus->ci->chip;
-+	sdiod->bus_if->chiprev = bus->ci->chiprev;
- 
- 	/* Attach to the common layer, reserve hdr space */
--	err = brcmf_attach(sdiodev->dev, sdiodev->settings);
-+	err = brcmf_attach(sdiod->dev, sdiod->settings);
- 	if (err != 0) {
- 		brcmf_err("brcmf_attach failed\n");
- 		goto fail;
-@@ -4142,10 +4141,10 @@ static void brcmf_sdio_firmware_callback
- 	return;
- 
- release:
--	sdio_release_host(sdiodev->func1);
-+	sdio_release_host(sdiod->func1);
- fail:
- 	brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
--	device_release_driver(&sdiodev->func2->dev);
-+	device_release_driver(&sdiod->func2->dev);
- 	device_release_driver(dev);
- }
- 
diff --git a/package/kernel/mac80211/patches/326-v4.17-0001-brcmfmac-reject-too-long-PSK.patch b/package/kernel/mac80211/patches/326-v4.17-0001-brcmfmac-reject-too-long-PSK.patch
deleted file mode 100644
index b83f2fce8..000000000
--- a/package/kernel/mac80211/patches/326-v4.17-0001-brcmfmac-reject-too-long-PSK.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 64d1519edc959f5b8f86a66a51c40971c215e4ec Mon Sep 17 00:00:00 2001
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Mon, 19 Feb 2018 13:30:45 +0100
-Subject: [PATCH] brcmfmac: reject too long PSK
-
-nl80211 already allows specifying 48 bytes, but brcmfmac
-only supports 32. Reject keys that are too long.
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +++
- 1 file changed, 3 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -5125,6 +5125,9 @@ static int brcmf_cfg80211_set_pmk(struct
- 	if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
- 		return -EINVAL;
- 
-+	if (conf->pmk_len > BRCMF_WSEC_MAX_PSK_LEN)
-+		return -ERANGE;
-+
- 	return brcmf_set_pmk(ifp, conf->pmk, conf->pmk_len);
- }
- 
diff --git a/package/kernel/mac80211/patches/327-v4.17-0001-brcmfmac-do-not-convert-linux-error-to-firmware-erro.patch b/package/kernel/mac80211/patches/327-v4.17-0001-brcmfmac-do-not-convert-linux-error-to-firmware-erro.patch
deleted file mode 100644
index 2e9ec8b96..000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0001-brcmfmac-do-not-convert-linux-error-to-firmware-erro.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 1170f6d1be6a39e1a115a2c0f50923eb4ce2a7ec Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:20 +0100
-Subject: [PATCH] brcmfmac: do not convert linux error to firmware error string
-
-In case of a linux error brcmf_fil_cmd_data() blurts an error message
-in which the error code is translated to an error string. However, it
-maps it to a firmware error string which should not happen. Simply
-print only the numeric error code and be done with it.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
-@@ -124,8 +124,7 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp,
- 					     data, len, &fwerr);
- 
- 	if (err) {
--		brcmf_dbg(FIL, "Failed: %s (%d)\n",
--			  brcmf_fil_get_errstr((u32)(-err)), err);
-+		brcmf_dbg(FIL, "Failed: error=%d\n", err);
- 	} else if (fwerr < 0) {
- 		brcmf_dbg(FIL, "Firmware error: %s (%d)\n",
- 			  brcmf_fil_get_errstr((u32)(-fwerr)), fwerr);
diff --git a/package/kernel/mac80211/patches/327-v4.17-0002-brcmfmac-use-brcmf_chip_name-to-store-name-in-revinf.patch b/package/kernel/mac80211/patches/327-v4.17-0002-brcmfmac-use-brcmf_chip_name-to-store-name-in-revinf.patch
deleted file mode 100644
index 790811957..000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0002-brcmfmac-use-brcmf_chip_name-to-store-name-in-revinf.patch
+++ /dev/null
@@ -1,203 +0,0 @@
-From 756a2b390874d274f2f615921318ef0856ff9313 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:21 +0100
-Subject: [PATCH] brcmfmac: use brcmf_chip_name() to store name in revinfo
-
-The chip id can either be four or five digits. For the chip name either
-the hexadecimal value needs to be taken (four digits) or the decimal
-value (five digits). The function brcmf_chip_name() does this conversion
-so use it to store the name in driver revision info.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/chip.c    |  9 +++++----
- .../wireless/broadcom/brcm80211/brcmfmac/chip.h    |  3 ++-
- .../wireless/broadcom/brcm80211/brcmfmac/common.c  | 23 ++++++++++++++++------
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 10 +---------
- .../wireless/broadcom/brcm80211/brcmfmac/core.h    |  3 +--
- 5 files changed, 26 insertions(+), 22 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-@@ -464,12 +464,12 @@ static void brcmf_chip_ai_resetcore(stru
- 	ci->ops->read32(ci->ctx, core->wrapbase + BCMA_IOCTL);
- }
- 
--static char *brcmf_chip_name(uint chipid, char *buf, uint len)
-+char *brcmf_chip_name(u32 id, u32 rev, char *buf, uint len)
- {
- 	const char *fmt;
- 
--	fmt = ((chipid > 0xa000) || (chipid < 0x4000)) ? "%d" : "%x";
--	snprintf(buf, len, fmt, chipid);
-+	fmt = ((id > 0xa000) || (id < 0x4000)) ? "BCM%d/%u" : "BCM%x/%u";
-+	snprintf(buf, len, fmt, id, rev);
- 	return buf;
- }
- 
-@@ -924,7 +924,8 @@ static int brcmf_chip_recognition(struct
- 	ci->pub.chiprev = (regdata & CID_REV_MASK) >> CID_REV_SHIFT;
- 	socitype = (regdata & CID_TYPE_MASK) >> CID_TYPE_SHIFT;
- 
--	brcmf_chip_name(ci->pub.chip, ci->pub.name, sizeof(ci->pub.name));
-+	brcmf_chip_name(ci->pub.chip, ci->pub.chiprev,
-+			ci->pub.name, sizeof(ci->pub.name));
- 	brcmf_dbg(INFO, "found %s chip: BCM%s, rev=%d\n",
- 		  socitype == SOCI_SB ? "SB" : "AXI", ci->pub.name,
- 		  ci->pub.chiprev);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
-@@ -45,7 +45,7 @@ struct brcmf_chip {
- 	u32 rambase;
- 	u32 ramsize;
- 	u32 srsize;
--	char name[8];
-+	char name[12];
- };
- 
- /**
-@@ -93,5 +93,6 @@ void brcmf_chip_resetcore(struct brcmf_c
- void brcmf_chip_set_passive(struct brcmf_chip *ci);
- bool brcmf_chip_set_active(struct brcmf_chip *ci, u32 rstvec);
- bool brcmf_chip_sr_capable(struct brcmf_chip *pub);
-+char *brcmf_chip_name(u32 chipid, u32 chiprev, char *buf, uint len);
- 
- #endif /* BRCMF_AXIDMP_H */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -30,6 +30,7 @@
- #include "common.h"
- #include "of.h"
- #include "firmware.h"
-+#include "chip.h"
- 
- MODULE_AUTHOR("Broadcom Corporation");
- MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
-@@ -131,14 +132,13 @@ static int brcmf_c_download(struct brcmf
- static int brcmf_c_get_clm_name(struct brcmf_if *ifp, u8 *clm_name)
- {
- 	struct brcmf_bus *bus = ifp->drvr->bus_if;
--	struct brcmf_rev_info *ri = &ifp->drvr->revinfo;
- 	u8 fw_name[BRCMF_FW_NAME_LEN];
- 	u8 *ptr;
- 	size_t len;
- 	s32 err;
- 
- 	memset(fw_name, 0, BRCMF_FW_NAME_LEN);
--	err = brcmf_bus_get_fwname(bus, ri->chipnum, ri->chiprev, fw_name);
-+	err = brcmf_bus_get_fwname(bus, bus->chip, bus->chiprev, fw_name);
- 	if (err) {
- 		brcmf_err("get firmware name failed (%d)\n", err);
- 		goto done;
-@@ -238,6 +238,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- {
- 	s8 eventmask[BRCMF_EVENTING_MASK_LEN];
- 	u8 buf[BRCMF_DCMD_SMLEN];
-+	struct brcmf_bus *bus;
- 	struct brcmf_rev_info_le revinfo;
- 	struct brcmf_rev_info *ri;
- 	char *clmver;
-@@ -253,16 +254,18 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 	}
- 	memcpy(ifp->drvr->mac, ifp->mac_addr, sizeof(ifp->drvr->mac));
- 
-+	bus = ifp->drvr->bus_if;
-+	ri = &ifp->drvr->revinfo;
-+
- 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_REVINFO,
- 				     &revinfo, sizeof(revinfo));
--	ri = &ifp->drvr->revinfo;
- 	if (err < 0) {
- 		brcmf_err("retrieving revision info failed, %d\n", err);
-+		strlcpy(ri->chipname, "UNKNOWN", sizeof(ri->chipname));
- 	} else {
- 		ri->vendorid = le32_to_cpu(revinfo.vendorid);
- 		ri->deviceid = le32_to_cpu(revinfo.deviceid);
- 		ri->radiorev = le32_to_cpu(revinfo.radiorev);
--		ri->chiprev = le32_to_cpu(revinfo.chiprev);
- 		ri->corerev = le32_to_cpu(revinfo.corerev);
- 		ri->boardid = le32_to_cpu(revinfo.boardid);
- 		ri->boardvendor = le32_to_cpu(revinfo.boardvendor);
-@@ -270,15 +273,23 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 		ri->driverrev = le32_to_cpu(revinfo.driverrev);
- 		ri->ucoderev = le32_to_cpu(revinfo.ucoderev);
- 		ri->bus = le32_to_cpu(revinfo.bus);
--		ri->chipnum = le32_to_cpu(revinfo.chipnum);
- 		ri->phytype = le32_to_cpu(revinfo.phytype);
- 		ri->phyrev = le32_to_cpu(revinfo.phyrev);
- 		ri->anarev = le32_to_cpu(revinfo.anarev);
- 		ri->chippkg = le32_to_cpu(revinfo.chippkg);
- 		ri->nvramrev = le32_to_cpu(revinfo.nvramrev);
-+
-+		if (!bus->chip) {
-+			bus->chip = le32_to_cpu(revinfo.chipnum);
-+			bus->chiprev = le32_to_cpu(revinfo.chiprev);
-+		}
- 	}
- 	ri->result = err;
- 
-+	if (bus->chip)
-+		brcmf_chip_name(bus->chip, bus->chiprev,
-+				ri->chipname, sizeof(ri->chipname));
-+
- 	/* Do any CLM downloading */
- 	err = brcmf_c_process_clm_blob(ifp);
- 	if (err < 0) {
-@@ -299,7 +310,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 	strsep(&ptr, "\n");
- 
- 	/* Print fw version info */
--	brcmf_info("Firmware version = %s\n", buf);
-+	brcmf_info("Firmware: %s %s\n", ri->chipname, buf);
- 
- 	/* locate firmware version number for ethtool */
- 	ptr = strrchr(buf, ' ') + 1;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1002,8 +1002,7 @@ static int brcmf_revinfo_read(struct seq
- 	seq_printf(s, "vendorid: 0x%04x\n", ri->vendorid);
- 	seq_printf(s, "deviceid: 0x%04x\n", ri->deviceid);
- 	seq_printf(s, "radiorev: %s\n", brcmu_dotrev_str(ri->radiorev, drev));
--	seq_printf(s, "chipnum: %u (%x)\n", ri->chipnum, ri->chipnum);
--	seq_printf(s, "chiprev: %u\n", ri->chiprev);
-+	seq_printf(s, "chip: %s\n", ri->chipname);
- 	seq_printf(s, "chippkg: %u\n", ri->chippkg);
- 	seq_printf(s, "corerev: %u\n", ri->corerev);
- 	seq_printf(s, "boardid: 0x%04x\n", ri->boardid);
-@@ -1053,13 +1052,6 @@ static int brcmf_bus_started(struct brcm
- 
- 	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
- 
--	/* assure we have chipid before feature attach */
--	if (!bus_if->chip) {
--		bus_if->chip = drvr->revinfo.chipnum;
--		bus_if->chiprev = drvr->revinfo.chiprev;
--		brcmf_dbg(INFO, "firmware revinfo: chip %x (%d) rev %d\n",
--			  bus_if->chip, bus_if->chip, bus_if->chiprev);
--	}
- 	brcmf_feat_attach(drvr);
- 
- 	ret = brcmf_proto_init_done(drvr);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -87,7 +87,6 @@ struct brcmf_rev_info {
- 	u32 vendorid;
- 	u32 deviceid;
- 	u32 radiorev;
--	u32 chiprev;
- 	u32 corerev;
- 	u32 boardid;
- 	u32 boardvendor;
-@@ -95,7 +94,7 @@ struct brcmf_rev_info {
- 	u32 driverrev;
- 	u32 ucoderev;
- 	u32 bus;
--	u32 chipnum;
-+	char chipname[12];
- 	u32 phytype;
- 	u32 phyrev;
- 	u32 anarev;
diff --git a/package/kernel/mac80211/patches/327-v4.17-0003-brcmfmac-use-brcmf_chip_name-for-consistency.patch b/package/kernel/mac80211/patches/327-v4.17-0003-brcmfmac-use-brcmf_chip_name-for-consistency.patch
deleted file mode 100644
index e3d06f32c..000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0003-brcmfmac-use-brcmf_chip_name-for-consistency.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From c88cfa075de356ddf40c668896b2126340f19ba4 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:22 +0100
-Subject: [PATCH] brcmfmac: use brcmf_chip_name() for consistency
-
-When logging the chip id/revision information make use of
-brcmf_chip_name() so it is always the same.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c     | 5 ++---
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 7 +++++--
- 2 files changed, 7 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-@@ -926,9 +926,8 @@ static int brcmf_chip_recognition(struct
- 
- 	brcmf_chip_name(ci->pub.chip, ci->pub.chiprev,
- 			ci->pub.name, sizeof(ci->pub.name));
--	brcmf_dbg(INFO, "found %s chip: BCM%s, rev=%d\n",
--		  socitype == SOCI_SB ? "SB" : "AXI", ci->pub.name,
--		  ci->pub.chiprev);
-+	brcmf_dbg(INFO, "found %s chip: %s\n",
-+		  socitype == SOCI_SB ? "SB" : "AXI", ci->pub.name);
- 
- 	if (socitype == SOCI_SB) {
- 		if (ci->pub.chip != BRCM_CC_4329_CHIP_ID) {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -25,6 +25,7 @@
- #include "firmware.h"
- #include "core.h"
- #include "common.h"
-+#include "chip.h"
- 
- #define BRCMF_FW_MAX_NVRAM_SIZE			64000
- #define BRCMF_FW_NVRAM_DEVPATH_LEN		19	/* devpath0=pcie/1/4/ */
-@@ -567,6 +568,7 @@ int brcmf_fw_map_chip_to_name(u32 chip,
- 			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
- 			      char nvram_name[BRCMF_FW_NAME_LEN])
- {
-+	char chipname[12];
- 	u32 i;
- 	char end;
- 
-@@ -581,6 +583,8 @@ int brcmf_fw_map_chip_to_name(u32 chip,
- 		return -ENODEV;
- 	}
- 
-+	brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
-+
- 	/* check if firmware path is provided by module parameter */
- 	if (brcmf_mp_global.firmware_path[0] != '\0') {
- 		strlcpy(fw_name, brcmf_mp_global.firmware_path,
-@@ -601,8 +605,7 @@ int brcmf_fw_map_chip_to_name(u32 chip,
- 	if ((nvram_name) && (mapping_table[i].nvram))
- 		strlcat(nvram_name, mapping_table[i].nvram, BRCMF_FW_NAME_LEN);
- 
--	brcmf_info("using %s for chip %#08x(%d) rev %#08x\n",
--		   fw_name, chip, chip, chiprev);
-+	brcmf_info("using %s for chip %s\n", fw_name, chipname);
- 
- 	return 0;
- }
diff --git a/package/kernel/mac80211/patches/327-v4.17-0004-brcmfmac-allocate-struct-brcmf_pub-instance-using-wi.patch b/package/kernel/mac80211/patches/327-v4.17-0004-brcmfmac-allocate-struct-brcmf_pub-instance-using-wi.patch
deleted file mode 100644
index 42adff61b..000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0004-brcmfmac-allocate-struct-brcmf_pub-instance-using-wi.patch
+++ /dev/null
@@ -1,452 +0,0 @@
-From 856d5a011c86b59f6564be4508912fb1d866adfc Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:23 +0100
-Subject: [PATCH] brcmfmac: allocate struct brcmf_pub instance using
- wiphy_new()
-
-Rework the driver so the wiphy instance holds the main driver information
-in its private buffer. Previously it held struct brcmf_cfg80211_info
-instance so a bit of reorg was needed. This was done so that the wiphy
-name or its parent device can be shown in debug output.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/btcoex.c  |  2 +-
- .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 86 ++++++++++------------
- .../broadcom/brcm80211/brcmfmac/cfg80211.h         | 17 +++--
- .../wireless/broadcom/brcm80211/brcmfmac/common.c  |  2 +
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 27 +++++--
- .../wireless/broadcom/brcm80211/brcmfmac/core.h    |  1 +
- .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c |  2 +-
- 7 files changed, 76 insertions(+), 61 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
-@@ -462,7 +462,7 @@ static void brcmf_btcoex_dhcp_end(struct
- int brcmf_btcoex_set_mode(struct brcmf_cfg80211_vif *vif,
- 			  enum brcmf_btcoex_mode mode, u16 duration)
- {
--	struct brcmf_cfg80211_info *cfg = wiphy_priv(vif->wdev.wiphy);
-+	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
- 	struct brcmf_btcoex_info *btci = cfg->btcoex;
- 	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -753,7 +753,7 @@ s32 brcmf_notify_escan_complete(struct b
- static int brcmf_cfg80211_del_ap_iface(struct wiphy *wiphy,
- 				       struct wireless_dev *wdev)
- {
--	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
-+	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
- 	struct net_device *ndev = wdev->netdev;
- 	struct brcmf_if *ifp = netdev_priv(ndev);
- 	int ret;
-@@ -786,7 +786,7 @@ err_unarm:
- static
- int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
- {
--	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
-+	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
- 	struct net_device *ndev = wdev->netdev;
- 
- 	if (ndev && ndev == cfg_to_ndev(cfg))
-@@ -831,7 +831,7 @@ brcmf_cfg80211_change_iface(struct wiphy
- 			 enum nl80211_iftype type,
- 			 struct vif_params *params)
- {
--	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
-+	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
- 	struct brcmf_if *ifp = netdev_priv(ndev);
- 	struct brcmf_cfg80211_vif *vif = ifp->vif;
- 	s32 infra = 0;
-@@ -2127,17 +2127,15 @@ static s32
- brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
- 			    s32 *dbm)
- {
--	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
--	struct net_device *ndev = cfg_to_ndev(cfg);
--	struct brcmf_if *ifp = netdev_priv(ndev);
-+	struct brcmf_cfg80211_vif *vif = wdev_to_vif(wdev);
- 	s32 qdbm = 0;
- 	s32 err;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
--	if (!check_vif_up(ifp->vif))
-+	if (!check_vif_up(vif))
- 		return -EIO;
- 
--	err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &qdbm);
-+	err = brcmf_fil_iovar_int_get(vif->ifp, "qtxpower", &qdbm);
- 	if (err) {
- 		brcmf_err("error (%d)\n", err);
- 		goto done;
-@@ -3359,7 +3357,7 @@ brcmf_cfg80211_sched_scan_start(struct w
- 				struct cfg80211_sched_scan_request *req)
- {
- 	struct brcmf_if *ifp = netdev_priv(ndev);
--	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
-+	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
- 
- 	brcmf_dbg(SCAN, "Enter: n_match_sets=%d n_ssids=%d\n",
- 		  req->n_match_sets, req->n_ssids);
-@@ -5191,6 +5189,12 @@ static struct cfg80211_ops brcmf_cfg8021
- 	.del_pmk = brcmf_cfg80211_del_pmk,
- };
- 
-+struct cfg80211_ops *brcmf_cfg80211_get_ops(void)
-+{
-+	return kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
-+		       GFP_KERNEL);
-+}
-+
- struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
- 					   enum nl80211_iftype type)
- {
-@@ -5898,7 +5902,7 @@ static void brcmf_update_bw40_channel_fl
- static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
- 				    u32 bw_cap[])
- {
--	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
-+	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
- 	struct ieee80211_supported_band *band;
- 	struct ieee80211_channel *channel;
- 	struct wiphy *wiphy;
-@@ -6013,7 +6017,7 @@ fail_pbuf:
- 
- static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
- {
--	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
-+	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
- 	struct ieee80211_supported_band *band;
- 	struct brcmf_fil_bwcap_le band_bwcap;
- 	struct brcmf_chanspec_list *list;
-@@ -6198,10 +6202,10 @@ static void brcmf_update_vht_cap(struct
- 	}
- }
- 
--static int brcmf_setup_wiphybands(struct wiphy *wiphy)
-+static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
- {
--	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
--	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
-+	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
-+	struct wiphy *wiphy;
- 	u32 nmode = 0;
- 	u32 vhtmode = 0;
- 	u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
-@@ -6795,8 +6799,8 @@ static s32 brcmf_translate_country_code(
- static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
- 					struct regulatory_request *req)
- {
--	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
--	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
-+	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
-+	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
- 	struct brcmf_fil_country_le ccreq;
- 	s32 err;
- 	int i;
-@@ -6831,7 +6835,7 @@ static void brcmf_cfg80211_reg_notifier(
- 		brcmf_err("Firmware rejected country setting\n");
- 		return;
- 	}
--	brcmf_setup_wiphybands(wiphy);
-+	brcmf_setup_wiphybands(cfg);
- }
- 
- static void brcmf_free_wiphy(struct wiphy *wiphy)
-@@ -6858,17 +6862,15 @@ static void brcmf_free_wiphy(struct wiph
- 	if (wiphy->wowlan != &brcmf_wowlan_support)
- 		kfree(wiphy->wowlan);
- #endif
--	wiphy_free(wiphy);
- }
- 
- struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
--						  struct device *busdev,
-+						  struct cfg80211_ops *ops,
- 						  bool p2pdev_forced)
- {
-+	struct wiphy *wiphy = drvr->wiphy;
- 	struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
- 	struct brcmf_cfg80211_info *cfg;
--	struct wiphy *wiphy;
--	struct cfg80211_ops *ops;
- 	struct brcmf_cfg80211_vif *vif;
- 	struct brcmf_if *ifp;
- 	s32 err = 0;
-@@ -6880,26 +6882,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
- 		return NULL;
- 	}
- 
--	ops = kmemdup(&brcmf_cfg80211_ops, sizeof(*ops), GFP_KERNEL);
--	if (!ops)
--		return NULL;
--
--	ifp = netdev_priv(ndev);
--#ifdef CONFIG_PM
--	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
--		ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
--#endif
--	wiphy = wiphy_new(ops, sizeof(struct brcmf_cfg80211_info));
--	if (!wiphy) {
-+	cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
-+	if (!cfg) {
- 		brcmf_err("Could not allocate wiphy device\n");
--		goto ops_out;
-+		return NULL;
- 	}
--	memcpy(wiphy->perm_addr, drvr->mac, ETH_ALEN);
--	set_wiphy_dev(wiphy, busdev);
- 
--	cfg = wiphy_priv(wiphy);
- 	cfg->wiphy = wiphy;
--	cfg->ops = ops;
- 	cfg->pub = drvr;
- 	init_vif_event(&cfg->vif_event);
- 	INIT_LIST_HEAD(&cfg->vif_list);
-@@ -6908,6 +6897,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
- 	if (IS_ERR(vif))
- 		goto wiphy_out;
- 
-+	ifp = netdev_priv(ndev);
- 	vif->ifp = ifp;
- 	vif->wdev.netdev = ndev;
- 	ndev->ieee80211_ptr = &vif->wdev;
-@@ -6934,6 +6924,11 @@ struct brcmf_cfg80211_info *brcmf_cfg802
- 	if (err < 0)
- 		goto priv_out;
- 
-+	/* regulatory notifer below needs access to cfg so
-+	 * assign it now.
-+	 */
-+	drvr->config = cfg;
-+
- 	brcmf_dbg(INFO, "Registering custom regulatory\n");
- 	wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
- 	wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
-@@ -6947,13 +6942,17 @@ struct brcmf_cfg80211_info *brcmf_cfg802
- 		cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
- 		*cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
- 	}
-+#ifdef CONFIG_PM
-+	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
-+		ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
-+#endif
- 	err = wiphy_register(wiphy);
- 	if (err < 0) {
- 		brcmf_err("Could not register wiphy device (%d)\n", err);
- 		goto priv_out;
- 	}
- 
--	err = brcmf_setup_wiphybands(wiphy);
-+	err = brcmf_setup_wiphybands(cfg);
- 	if (err) {
- 		brcmf_err("Setting wiphy bands failed (%d)\n", err);
- 		goto wiphy_unreg_out;
-@@ -6970,12 +6969,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
- 		else
- 			*cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
- 	}
--	/* p2p might require that "if-events" get processed by fweh. So
--	 * activate the already registered event handlers now and activate
--	 * the rest when initialization has completed. drvr->config needs to
--	 * be assigned before activating events.
--	 */
--	drvr->config = cfg;
-+
- 	err = brcmf_fweh_activate_events(ifp);
- 	if (err) {
- 		brcmf_err("FWEH activation failed (%d)\n", err);
-@@ -7043,8 +7037,7 @@ priv_out:
- 	ifp->vif = NULL;
- wiphy_out:
- 	brcmf_free_wiphy(wiphy);
--ops_out:
--	kfree(ops);
-+	kfree(cfg);
- 	return NULL;
- }
- 
-@@ -7059,4 +7052,5 @@ void brcmf_cfg80211_detach(struct brcmf_
- 	kfree(cfg->ops);
- 	wl_deinit_priv(cfg);
- 	brcmf_free_wiphy(cfg->wiphy);
-+	kfree(cfg);
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-@@ -355,20 +355,24 @@ static inline struct wiphy *cfg_to_wiphy
- 
- static inline struct brcmf_cfg80211_info *wiphy_to_cfg(struct wiphy *w)
- {
--	return (struct brcmf_cfg80211_info *)(wiphy_priv(w));
-+	struct brcmf_pub *drvr = wiphy_priv(w);
-+	return drvr->config;
- }
- 
- static inline struct brcmf_cfg80211_info *wdev_to_cfg(struct wireless_dev *wd)
- {
--	return (struct brcmf_cfg80211_info *)(wdev_priv(wd));
-+	return wiphy_to_cfg(wd->wiphy);
-+}
-+
-+static inline struct brcmf_cfg80211_vif *wdev_to_vif(struct wireless_dev *wdev)
-+{
-+	return container_of(wdev, struct brcmf_cfg80211_vif, wdev);
- }
- 
- static inline
- struct net_device *cfg_to_ndev(struct brcmf_cfg80211_info *cfg)
- {
--	struct brcmf_cfg80211_vif *vif;
--	vif = list_first_entry(&cfg->vif_list, struct brcmf_cfg80211_vif, list);
--	return vif->wdev.netdev;
-+	return brcmf_get_ifp(cfg->pub, 0)->ndev;
- }
- 
- static inline struct brcmf_cfg80211_info *ndev_to_cfg(struct net_device *ndev)
-@@ -395,11 +399,12 @@ brcmf_cfg80211_connect_info *cfg_to_conn
- }
- 
- struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
--						  struct device *busdev,
-+						  struct cfg80211_ops *ops,
- 						  bool p2pdev_forced);
- void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg);
- s32 brcmf_cfg80211_up(struct net_device *ndev);
- s32 brcmf_cfg80211_down(struct net_device *ndev);
-+struct cfg80211_ops *brcmf_cfg80211_get_ops(void);
- enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp);
- 
- struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -252,6 +252,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 		brcmf_err("Retreiving cur_etheraddr failed, %d\n", err);
- 		goto done;
- 	}
-+	memcpy(ifp->drvr->wiphy->perm_addr, ifp->drvr->mac, ETH_ALEN);
- 	memcpy(ifp->drvr->mac, ifp->mac_addr, sizeof(ifp->drvr->mac));
- 
- 	bus = ifp->drvr->bus_if;
-@@ -279,6 +280,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
- 		ri->chippkg = le32_to_cpu(revinfo.chippkg);
- 		ri->nvramrev = le32_to_cpu(revinfo.nvramrev);
- 
-+		/* use revinfo if not known yet */
- 		if (!bus->chip) {
- 			bus->chip = le32_to_cpu(revinfo.chipnum);
- 			bus->chiprev = le32_to_cpu(revinfo.chiprev);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1021,7 +1021,7 @@ static int brcmf_revinfo_read(struct seq
- 	return 0;
- }
- 
--static int brcmf_bus_started(struct brcmf_pub *drvr)
-+static int brcmf_bus_started(struct brcmf_pub *drvr, struct cfg80211_ops *ops)
- {
- 	int ret = -1;
- 	struct brcmf_bus *bus_if = drvr->bus_if;
-@@ -1060,7 +1060,7 @@ static int brcmf_bus_started(struct brcm
- 
- 	brcmf_proto_add_if(drvr, ifp);
- 
--	drvr->config = brcmf_cfg80211_attach(drvr, bus_if->dev,
-+	drvr->config = brcmf_cfg80211_attach(drvr, ops,
- 					     drvr->settings->p2p_enable);
- 	if (drvr->config == NULL) {
- 		ret = -ENOMEM;
-@@ -1115,17 +1115,26 @@ fail:
- 
- int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings)
- {
-+	struct wiphy *wiphy;
-+	struct cfg80211_ops *ops;
- 	struct brcmf_pub *drvr = NULL;
- 	int ret = 0;
- 	int i;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
--	/* Allocate primary brcmf_info */
--	drvr = kzalloc(sizeof(*drvr), GFP_ATOMIC);
--	if (!drvr)
-+	ops = brcmf_cfg80211_get_ops();
-+	if (!ops)
- 		return -ENOMEM;
- 
-+	wiphy = wiphy_new(ops, sizeof(*drvr));
-+	if (!wiphy)
-+		return -ENOMEM;
-+
-+	set_wiphy_dev(wiphy, dev);
-+	drvr = wiphy_priv(wiphy);
-+	drvr->wiphy = wiphy;
-+
- 	for (i = 0; i < ARRAY_SIZE(drvr->if2bss); i++)
- 		drvr->if2bss[i] = BRCMF_BSSIDX_INVALID;
- 
-@@ -1154,15 +1163,18 @@ int brcmf_attach(struct device *dev, str
- 	/* attach firmware event handler */
- 	brcmf_fweh_attach(drvr);
- 
--	ret = brcmf_bus_started(drvr);
-+	ret = brcmf_bus_started(drvr, ops);
- 	if (ret != 0) {
- 		brcmf_err("dongle is not responding: err=%d\n", ret);
- 		goto fail;
- 	}
-+
-+	drvr->config->ops = ops;
- 	return 0;
- 
- fail:
- 	brcmf_detach(dev);
-+	kfree(ops);
- 
- 	return ret;
- }
-@@ -1220,6 +1232,7 @@ void brcmf_detach(struct device *dev)
- 		brcmf_remove_interface(drvr->iflist[i], false);
- 
- 	brcmf_cfg80211_detach(drvr->config);
-+	drvr->config = NULL;
- 
- 	brcmf_bus_stop(drvr->bus_if);
- 
-@@ -1227,7 +1240,7 @@ void brcmf_detach(struct device *dev)
- 
- 	brcmf_debug_detach(drvr);
- 	bus_if->drvr = NULL;
--	kfree(drvr);
-+	wiphy_free(drvr->wiphy);
- }
- 
- s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data, u32 len)
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -107,6 +107,7 @@ struct brcmf_pub {
- 	/* Linkage ponters */
- 	struct brcmf_bus *bus_if;
- 	struct brcmf_proto *proto;
-+	struct wiphy *wiphy;
- 	struct brcmf_cfg80211_info *config;
- 
- 	/* Internal brcmf items */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -2229,7 +2229,7 @@ fail:
-  */
- int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
- {
--	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
-+	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
- 	struct brcmf_p2p_info *p2p = &cfg->p2p;
- 	struct brcmf_cfg80211_vif *vif;
- 	enum nl80211_iftype iftype;
diff --git a/package/kernel/mac80211/patches/327-v4.17-0005-brcmfmac-use-wiphy-debugfs-dir-entry.patch b/package/kernel/mac80211/patches/327-v4.17-0005-brcmfmac-use-wiphy-debugfs-dir-entry.patch
deleted file mode 100644
index c5485c390..000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0005-brcmfmac-use-wiphy-debugfs-dir-entry.patch
+++ /dev/null
@@ -1,349 +0,0 @@
-From 34789d0cf682c643862792750a06c31ccf016cbc Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:24 +0100
-Subject: [PATCH] brcmfmac: use wiphy debugfs dir entry
-
-The driver used to create a brcmfmac dir entry at the top level
-debugfs mount point. This moves the debugfs entries into the
-wiphy debugfs dir entry.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c    |  6 ++++
- .../wireless/broadcom/brcm80211/brcmfmac/common.c  |  5 ---
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 11 +++---
- .../wireless/broadcom/brcm80211/brcmfmac/debug.c   | 42 ++--------------------
- .../wireless/broadcom/brcm80211/brcmfmac/debug.h   | 17 ---------
- .../wireless/broadcom/brcm80211/brcmfmac/feature.c |  3 ++
- .../wireless/broadcom/brcm80211/brcmfmac/feature.h |  7 ++++
- .../broadcom/brcm80211/brcmfmac/fwsignal.c         | 11 +++---
- .../broadcom/brcm80211/brcmfmac/fwsignal.h         |  1 +
- .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c  |  8 +++--
- .../wireless/broadcom/brcm80211/brcmfmac/proto.c   |  3 +-
- .../wireless/broadcom/brcm80211/brcmfmac/proto.h   |  7 ++++
- 12 files changed, 47 insertions(+), 74 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
-@@ -445,6 +445,11 @@ brcmf_proto_bcdc_init_done(struct brcmf_
- 	return 0;
- }
- 
-+static void brcmf_proto_bcdc_debugfs_create(struct brcmf_pub *drvr)
-+{
-+	brcmf_fws_debugfs_create(drvr);
-+}
-+
- int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr)
- {
- 	struct brcmf_bcdc *bcdc;
-@@ -472,6 +477,7 @@ int brcmf_proto_bcdc_attach(struct brcmf
- 	drvr->proto->del_if = brcmf_proto_bcdc_del_if;
- 	drvr->proto->reset_if = brcmf_proto_bcdc_reset_if;
- 	drvr->proto->init_done = brcmf_proto_bcdc_init_done;
-+	drvr->proto->debugfs_create = brcmf_proto_bcdc_debugfs_create;
- 	drvr->proto->pd = bcdc;
- 
- 	drvr->hdrlen += BCDC_HEADER_LEN + BRCMF_PROT_FW_SIGNAL_MAX_TXBYTES;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -529,9 +529,6 @@ static int __init brcmfmac_module_init(v
- {
- 	int err;
- 
--	/* Initialize debug system first */
--	brcmf_debugfs_init();
--
- 	/* Get the platform data (if available) for our devices */
- 	err = platform_driver_probe(&brcmf_pd, brcmf_common_pd_probe);
- 	if (err == -ENODEV)
-@@ -543,7 +540,6 @@ static int __init brcmfmac_module_init(v
- 	/* Continue the initialization by registering the different busses */
- 	err = brcmf_core_init();
- 	if (err) {
--		brcmf_debugfs_exit();
- 		if (brcmfmac_pdata)
- 			platform_driver_unregister(&brcmf_pd);
- 	}
-@@ -556,7 +552,6 @@ static void __exit brcmfmac_module_exit(
- 	brcmf_core_exit();
- 	if (brcmfmac_pdata)
- 		platform_driver_unregister(&brcmf_pd);
--	brcmf_debugfs_exit();
- }
- 
- module_init(brcmfmac_module_init);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1050,8 +1050,6 @@ static int brcmf_bus_started(struct brcm
- 	if (ret < 0)
- 		goto fail;
- 
--	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
--
- 	brcmf_feat_attach(drvr);
- 
- 	ret = brcmf_proto_init_done(drvr);
-@@ -1094,6 +1092,11 @@ static int brcmf_bus_started(struct brcm
- #endif
- #endif /* CONFIG_INET */
- 
-+	/* populate debugfs */
-+	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
-+	brcmf_feat_debugfs_create(drvr);
-+	brcmf_proto_debugfs_create(drvr);
-+
- 	return 0;
- 
- fail:
-@@ -1146,9 +1149,6 @@ int brcmf_attach(struct device *dev, str
- 	drvr->bus_if->drvr = drvr;
- 	drvr->settings = settings;
- 
--	/* attach debug facilities */
--	brcmf_debug_attach(drvr);
--
- 	/* Attach and link in the protocol */
- 	ret = brcmf_proto_attach(drvr);
- 	if (ret != 0) {
-@@ -1238,7 +1238,6 @@ void brcmf_detach(struct device *dev)
- 
- 	brcmf_proto_detach(drvr);
- 
--	brcmf_debug_detach(drvr);
- 	bus_if->drvr = NULL;
- 	wiphy_free(drvr->wiphy);
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
-@@ -25,8 +25,6 @@
- #include "fweh.h"
- #include "debug.h"
- 
--static struct dentry *root_folder;
--
- int brcmf_debug_create_memdump(struct brcmf_bus *bus, const void *data,
- 			       size_t len)
- {
-@@ -54,44 +52,9 @@ int brcmf_debug_create_memdump(struct br
- 	return 0;
- }
- 
--void brcmf_debugfs_init(void)
--{
--	root_folder = debugfs_create_dir(KBUILD_MODNAME, NULL);
--	if (IS_ERR(root_folder))
--		root_folder = NULL;
--}
--
--void brcmf_debugfs_exit(void)
--{
--	if (!root_folder)
--		return;
--
--	debugfs_remove_recursive(root_folder);
--	root_folder = NULL;
--}
--
--int brcmf_debug_attach(struct brcmf_pub *drvr)
--{
--	struct device *dev = drvr->bus_if->dev;
--
--	if (!root_folder)
--		return -ENODEV;
--
--	drvr->dbgfs_dir = debugfs_create_dir(dev_name(dev), root_folder);
--	return PTR_ERR_OR_ZERO(drvr->dbgfs_dir);
--}
--
--void brcmf_debug_detach(struct brcmf_pub *drvr)
--{
--	brcmf_fweh_unregister(drvr, BRCMF_E_PSM_WATCHDOG);
--
--	if (!IS_ERR_OR_NULL(drvr->dbgfs_dir))
--		debugfs_remove_recursive(drvr->dbgfs_dir);
--}
--
- struct dentry *brcmf_debugfs_get_devdir(struct brcmf_pub *drvr)
- {
--	return drvr->dbgfs_dir;
-+	return drvr->wiphy->debugfsdir;
- }
- 
- int brcmf_debugfs_add_entry(struct brcmf_pub *drvr, const char *fn,
-@@ -99,7 +62,8 @@ int brcmf_debugfs_add_entry(struct brcmf
- {
- 	struct dentry *e;
- 
-+	WARN(!drvr->wiphy->debugfsdir, "wiphy not (yet) registered\n");
- 	e = debugfs_create_devm_seqfile(drvr->bus_if->dev, fn,
--					drvr->dbgfs_dir, read_fn);
-+					drvr->wiphy->debugfsdir, read_fn);
- 	return PTR_ERR_OR_ZERO(e);
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
-@@ -113,29 +113,12 @@ extern int brcmf_msg_level;
- struct brcmf_bus;
- struct brcmf_pub;
- #ifdef DEBUG
--void brcmf_debugfs_init(void);
--void brcmf_debugfs_exit(void);
--int brcmf_debug_attach(struct brcmf_pub *drvr);
--void brcmf_debug_detach(struct brcmf_pub *drvr);
- struct dentry *brcmf_debugfs_get_devdir(struct brcmf_pub *drvr);
- int brcmf_debugfs_add_entry(struct brcmf_pub *drvr, const char *fn,
- 			    int (*read_fn)(struct seq_file *seq, void *data));
- int brcmf_debug_create_memdump(struct brcmf_bus *bus, const void *data,
- 			       size_t len);
- #else
--static inline void brcmf_debugfs_init(void)
--{
--}
--static inline void brcmf_debugfs_exit(void)
--{
--}
--static inline int brcmf_debug_attach(struct brcmf_pub *drvr)
--{
--	return 0;
--}
--static inline void brcmf_debug_detach(struct brcmf_pub *drvr)
--{
--}
- static inline
- int brcmf_debugfs_add_entry(struct brcmf_pub *drvr, const char *fn,
- 			    int (*read_fn)(struct seq_file *seq, void *data))
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -228,7 +228,10 @@ void brcmf_feat_attach(struct brcmf_pub
- 		/* no quirks */
- 		break;
- 	}
-+}
- 
-+void brcmf_feat_debugfs_create(struct brcmf_pub *drvr)
-+{
- 	brcmf_debugfs_add_entry(drvr, "features", brcmf_feat_debugfs_read);
- }
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-@@ -90,6 +90,13 @@ enum brcmf_feat_quirk {
- void brcmf_feat_attach(struct brcmf_pub *drvr);
- 
- /**
-+ * brcmf_feat_debugfs_create() - create debugfs entries.
-+ *
-+ * @drvr: driver instance.
-+ */
-+void brcmf_feat_debugfs_create(struct brcmf_pub *drvr);
-+
-+/**
-  * brcmf_feat_is_enabled() - query feature.
-  *
-  * @ifp: interface instance.
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-@@ -2399,10 +2399,6 @@ struct brcmf_fws_info *brcmf_fws_attach(
- 	brcmu_pktq_init(&fws->desc.other.psq, BRCMF_FWS_PSQ_PREC_COUNT,
- 			BRCMF_FWS_PSQ_LEN);
- 
--	/* create debugfs file for statistics */
--	brcmf_debugfs_add_entry(drvr, "fws_stats",
--				brcmf_debugfs_fws_stats_read);
--
- 	brcmf_dbg(INFO, "%s bdcv2 tlv signaling [%x]\n",
- 		  fws->fw_signals ? "enabled" : "disabled", tlv);
- 	return fws;
-@@ -2429,6 +2425,13 @@ void brcmf_fws_detach(struct brcmf_fws_i
- 	kfree(fws);
- }
- 
-+void brcmf_fws_debugfs_create(struct brcmf_pub *drvr)
-+{
-+	/* create debugfs file for statistics */
-+	brcmf_debugfs_add_entry(drvr, "fws_stats",
-+				brcmf_debugfs_fws_stats_read);
-+}
-+
- bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws)
- {
- 	return !fws->avoid_queueing;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
-@@ -20,6 +20,7 @@
- 
- struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr);
- void brcmf_fws_detach(struct brcmf_fws_info *fws);
-+void brcmf_fws_debugfs_create(struct brcmf_pub *drvr);
- bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws);
- bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
- void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-@@ -1418,6 +1418,11 @@ static int brcmf_msgbuf_stats_read(struc
- }
- #endif
- 
-+static void brcmf_msgbuf_debugfs_create(struct brcmf_pub *drvr)
-+{
-+	brcmf_debugfs_add_entry(drvr, "msgbuf_stats", brcmf_msgbuf_stats_read);
-+}
-+
- int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
- {
- 	struct brcmf_bus_msgbuf *if_msgbuf;
-@@ -1472,6 +1477,7 @@ int brcmf_proto_msgbuf_attach(struct brc
- 	drvr->proto->delete_peer = brcmf_msgbuf_delete_peer;
- 	drvr->proto->add_tdls_peer = brcmf_msgbuf_add_tdls_peer;
- 	drvr->proto->rxreorder = brcmf_msgbuf_rxreorder;
-+	drvr->proto->debugfs_create = brcmf_msgbuf_debugfs_create;
- 	drvr->proto->pd = msgbuf;
- 
- 	init_waitqueue_head(&msgbuf->ioctl_resp_wait);
-@@ -1525,8 +1531,6 @@ int brcmf_proto_msgbuf_attach(struct brc
- 	spin_lock_init(&msgbuf->flowring_work_lock);
- 	INIT_LIST_HEAD(&msgbuf->work_queue);
- 
--	brcmf_debugfs_add_entry(drvr, "msgbuf_stats", brcmf_msgbuf_stats_read);
--
- 	return 0;
- 
- fail:
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
-@@ -54,7 +54,8 @@ int brcmf_proto_attach(struct brcmf_pub
- 	if (!proto->tx_queue_data || (proto->hdrpull == NULL) ||
- 	    (proto->query_dcmd == NULL) || (proto->set_dcmd == NULL) ||
- 	    (proto->configure_addr_mode == NULL) ||
--	    (proto->delete_peer == NULL) || (proto->add_tdls_peer == NULL)) {
-+	    (proto->delete_peer == NULL) || (proto->add_tdls_peer == NULL) ||
-+	    (proto->debugfs_create == NULL)) {
- 		brcmf_err("Not all proto handlers have been installed\n");
- 		goto fail;
- 	}
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
-@@ -48,6 +48,7 @@ struct brcmf_proto {
- 	void (*del_if)(struct brcmf_if *ifp);
- 	void (*reset_if)(struct brcmf_if *ifp);
- 	int (*init_done)(struct brcmf_pub *drvr);
-+	void (*debugfs_create)(struct brcmf_pub *drvr);
- 	void *pd;
- };
- 
-@@ -156,4 +157,10 @@ brcmf_proto_init_done(struct brcmf_pub *
- 	return drvr->proto->init_done(drvr);
- }
- 
-+static inline void
-+brcmf_proto_debugfs_create(struct brcmf_pub *drvr)
-+{
-+	drvr->proto->debugfs_create(drvr);
-+}
-+
- #endif /* BRCMFMAC_PROTO_H */
diff --git a/package/kernel/mac80211/patches/327-v4.17-0006-brcmfmac-derive-firmware-filenames-from-basename-map.patch b/package/kernel/mac80211/patches/327-v4.17-0006-brcmfmac-derive-firmware-filenames-from-basename-map.patch
deleted file mode 100644
index 0b1ae56bc..000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0006-brcmfmac-derive-firmware-filenames-from-basename-map.patch
+++ /dev/null
@@ -1,286 +0,0 @@
-From 41f573dbb534f14e62a4a5411f602c970cad1d77 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:25 +0100
-Subject: [PATCH] brcmfmac: derive firmware filenames from basename mapping
-
-Instead of defining individual filenames for firmware and nvram
-use a basename and derive the names from that.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/firmware.c         | 31 ++++++---
- .../broadcom/brcm80211/brcmfmac/firmware.h         | 24 ++-----
- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    | 56 ++++++++---------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 73 +++++++++++-----------
- .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 10 +--
- 5 files changed, 96 insertions(+), 98 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -563,6 +563,13 @@ int brcmf_fw_get_firmwares(struct device
- 					   0);
- }
- 
-+static void brcmf_fw_get_full_name(char fw_name[BRCMF_FW_NAME_LEN],
-+				   const char *fw_base, const char *extension)
-+{
-+	strlcat(fw_name, fw_base, BRCMF_FW_NAME_LEN);
-+	strlcat(fw_name, extension, BRCMF_FW_NAME_LEN);
-+}
-+
- int brcmf_fw_map_chip_to_name(u32 chip, u32 chiprev,
- 			      struct brcmf_firmware_mapping mapping_table[],
- 			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
-@@ -587,25 +594,31 @@ int brcmf_fw_map_chip_to_name(u32 chip,
- 
- 	/* check if firmware path is provided by module parameter */
- 	if (brcmf_mp_global.firmware_path[0] != '\0') {
--		strlcpy(fw_name, brcmf_mp_global.firmware_path,
--			BRCMF_FW_NAME_LEN);
--		if ((nvram_name) && (mapping_table[i].nvram))
-+		if (fw_name)
-+			strlcpy(fw_name, brcmf_mp_global.firmware_path,
-+				BRCMF_FW_NAME_LEN);
-+		if (nvram_name)
- 			strlcpy(nvram_name, brcmf_mp_global.firmware_path,
- 				BRCMF_FW_NAME_LEN);
- 
- 		end = brcmf_mp_global.firmware_path[
- 				strlen(brcmf_mp_global.firmware_path) - 1];
- 		if (end != '/') {
--			strlcat(fw_name, "/", BRCMF_FW_NAME_LEN);
--			if ((nvram_name) && (mapping_table[i].nvram))
-+			if (fw_name)
-+				strlcat(fw_name, "/", BRCMF_FW_NAME_LEN);
-+			if (nvram_name)
- 				strlcat(nvram_name, "/", BRCMF_FW_NAME_LEN);
- 		}
- 	}
--	strlcat(fw_name, mapping_table[i].fw, BRCMF_FW_NAME_LEN);
--	if ((nvram_name) && (mapping_table[i].nvram))
--		strlcat(nvram_name, mapping_table[i].nvram, BRCMF_FW_NAME_LEN);
- 
--	brcmf_info("using %s for chip %s\n", fw_name, chipname);
-+	brcmf_info("using %s for chip %s\n",
-+		   mapping_table[i].fw_base, chipname);
-+	if (fw_name)
-+		brcmf_fw_get_full_name(fw_name,
-+				       mapping_table[i].fw_base, ".bin");
-+	if (nvram_name)
-+		brcmf_fw_get_full_name(nvram_name,
-+				       mapping_table[i].fw_base, ".txt");
- 
- 	return 0;
- }
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-@@ -38,28 +38,16 @@
- struct brcmf_firmware_mapping {
- 	u32 chipid;
- 	u32 revmask;
--	const char *fw;
--	const char *nvram;
-+	const char *fw_base;
- };
- 
--#define BRCMF_FW_NVRAM_DEF(fw_nvram_name, fw, nvram) \
--static const char BRCM_ ## fw_nvram_name ## _FIRMWARE_NAME[] = \
--	BRCMF_FW_DEFAULT_PATH fw; \
--static const char BRCM_ ## fw_nvram_name ## _NVRAM_NAME[] = \
--	BRCMF_FW_DEFAULT_PATH nvram; \
--MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH fw);
--
--#define BRCMF_FW_DEF(fw_name, fw) \
--static const char BRCM_ ## fw_name ## _FIRMWARE_NAME[] = \
--	BRCMF_FW_DEFAULT_PATH fw; \
--MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH fw) \
--
--#define BRCMF_FW_NVRAM_ENTRY(chipid, mask, name) \
--	{ chipid, mask, \
--	  BRCM_ ## name ## _FIRMWARE_NAME, BRCM_ ## name ## _NVRAM_NAME }
-+#define BRCMF_FW_DEF(fw_name, fw_base) \
-+static const char BRCM_ ## fw_name ## _FIRMWARE_BASENAME[] = \
-+	BRCMF_FW_DEFAULT_PATH fw_base; \
-+MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH fw_base ".bin")
- 
- #define BRCMF_FW_ENTRY(chipid, mask, name) \
--	{ chipid, mask, BRCM_ ## name ## _FIRMWARE_NAME, NULL }
-+	{ chipid, mask, BRCM_ ## name ## _FIRMWARE_BASENAME }
- 
- int brcmf_fw_map_chip_to_name(u32 chip, u32 chiprev,
- 			      struct brcmf_firmware_mapping mapping_table[],
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -46,36 +46,36 @@ enum brcmf_pcie_state {
- 	BRCMFMAC_PCIE_STATE_UP
- };
- 
--BRCMF_FW_NVRAM_DEF(43602, "brcmfmac43602-pcie.bin", "brcmfmac43602-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4350, "brcmfmac4350-pcie.bin", "brcmfmac4350-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4350C, "brcmfmac4350c2-pcie.bin", "brcmfmac4350c2-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4356, "brcmfmac4356-pcie.bin", "brcmfmac4356-pcie.txt");
--BRCMF_FW_NVRAM_DEF(43570, "brcmfmac43570-pcie.bin", "brcmfmac43570-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4358, "brcmfmac4358-pcie.bin", "brcmfmac4358-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4359, "brcmfmac4359-pcie.bin", "brcmfmac4359-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4365B, "brcmfmac4365b-pcie.bin", "brcmfmac4365b-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4365C, "brcmfmac4365c-pcie.bin", "brcmfmac4365c-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4366B, "brcmfmac4366b-pcie.bin", "brcmfmac4366b-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4366C, "brcmfmac4366c-pcie.bin", "brcmfmac4366c-pcie.txt");
--BRCMF_FW_NVRAM_DEF(4371, "brcmfmac4371-pcie.bin", "brcmfmac4371-pcie.txt");
-+BRCMF_FW_DEF(43602, "brcmfmac43602-pcie");
-+BRCMF_FW_DEF(4350, "brcmfmac4350-pcie");
-+BRCMF_FW_DEF(4350C, "brcmfmac4350c2-pcie");
-+BRCMF_FW_DEF(4356, "brcmfmac4356-pcie");
-+BRCMF_FW_DEF(43570, "brcmfmac43570-pcie");
-+BRCMF_FW_DEF(4358, "brcmfmac4358-pcie");
-+BRCMF_FW_DEF(4359, "brcmfmac4359-pcie");
-+BRCMF_FW_DEF(4365B, "brcmfmac4365b-pcie");
-+BRCMF_FW_DEF(4365C, "brcmfmac4365c-pcie");
-+BRCMF_FW_DEF(4366B, "brcmfmac4366b-pcie");
-+BRCMF_FW_DEF(4366C, "brcmfmac4366c-pcie");
-+BRCMF_FW_DEF(4371, "brcmfmac4371-pcie");
- 
- static struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43602_CHIP_ID, 0xFFFFFFFF, 43602),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43465_CHIP_ID, 0xFFFFFFF0, 4366C),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4350_CHIP_ID, 0x000000FF, 4350C),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4350_CHIP_ID, 0xFFFFFF00, 4350),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43525_CHIP_ID, 0xFFFFFFF0, 4365C),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43567_CHIP_ID, 0xFFFFFFFF, 43570),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43569_CHIP_ID, 0xFFFFFFFF, 43570),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43570_CHIP_ID, 0xFFFFFFFF, 43570),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4358_CHIP_ID, 0xFFFFFFFF, 4358),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4365_CHIP_ID, 0x0000000F, 4365B),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFF0, 4365C),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4366_CHIP_ID, 0x0000000F, 4366B),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4366_CHIP_ID, 0xFFFFFFF0, 4366C),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371),
-+	BRCMF_FW_ENTRY(BRCM_CC_43602_CHIP_ID, 0xFFFFFFFF, 43602),
-+	BRCMF_FW_ENTRY(BRCM_CC_43465_CHIP_ID, 0xFFFFFFF0, 4366C),
-+	BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0x000000FF, 4350C),
-+	BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0xFFFFFF00, 4350),
-+	BRCMF_FW_ENTRY(BRCM_CC_43525_CHIP_ID, 0xFFFFFFF0, 4365C),
-+	BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
-+	BRCMF_FW_ENTRY(BRCM_CC_43567_CHIP_ID, 0xFFFFFFFF, 43570),
-+	BRCMF_FW_ENTRY(BRCM_CC_43569_CHIP_ID, 0xFFFFFFFF, 43570),
-+	BRCMF_FW_ENTRY(BRCM_CC_43570_CHIP_ID, 0xFFFFFFFF, 43570),
-+	BRCMF_FW_ENTRY(BRCM_CC_4358_CHIP_ID, 0xFFFFFFFF, 4358),
-+	BRCMF_FW_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359),
-+	BRCMF_FW_ENTRY(BRCM_CC_4365_CHIP_ID, 0x0000000F, 4365B),
-+	BRCMF_FW_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFF0, 4365C),
-+	BRCMF_FW_ENTRY(BRCM_CC_4366_CHIP_ID, 0x0000000F, 4366B),
-+	BRCMF_FW_ENTRY(BRCM_CC_4366_CHIP_ID, 0xFFFFFFF0, 4366C),
-+	BRCMF_FW_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371),
- };
- 
- #define BRCMF_PCIE_FW_UP_TIMEOUT		2000 /* msec */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -600,47 +600,44 @@ static const struct sdiod_drive_str sdio
- 	{4,  0x1}
- };
- 
--BRCMF_FW_NVRAM_DEF(43143, "brcmfmac43143-sdio.bin", "brcmfmac43143-sdio.txt");
--BRCMF_FW_NVRAM_DEF(43241B0, "brcmfmac43241b0-sdio.bin",
--		   "brcmfmac43241b0-sdio.txt");
--BRCMF_FW_NVRAM_DEF(43241B4, "brcmfmac43241b4-sdio.bin",
--		   "brcmfmac43241b4-sdio.txt");
--BRCMF_FW_NVRAM_DEF(43241B5, "brcmfmac43241b5-sdio.bin",
--		   "brcmfmac43241b5-sdio.txt");
--BRCMF_FW_NVRAM_DEF(4329, "brcmfmac4329-sdio.bin", "brcmfmac4329-sdio.txt");
--BRCMF_FW_NVRAM_DEF(4330, "brcmfmac4330-sdio.bin", "brcmfmac4330-sdio.txt");
--BRCMF_FW_NVRAM_DEF(4334, "brcmfmac4334-sdio.bin", "brcmfmac4334-sdio.txt");
--BRCMF_FW_NVRAM_DEF(43340, "brcmfmac43340-sdio.bin", "brcmfmac43340-sdio.txt");
--BRCMF_FW_NVRAM_DEF(4335, "brcmfmac4335-sdio.bin", "brcmfmac4335-sdio.txt");
--BRCMF_FW_NVRAM_DEF(43362, "brcmfmac43362-sdio.bin", "brcmfmac43362-sdio.txt");
--BRCMF_FW_NVRAM_DEF(4339, "brcmfmac4339-sdio.bin", "brcmfmac4339-sdio.txt");
--BRCMF_FW_NVRAM_DEF(43430A0, "brcmfmac43430a0-sdio.bin", "brcmfmac43430a0-sdio.txt");
-+BRCMF_FW_DEF(43143, "brcmfmac43143-sdio");
-+BRCMF_FW_DEF(43241B0, "brcmfmac43241b0-sdio");
-+BRCMF_FW_DEF(43241B4, "brcmfmac43241b4-sdio");
-+BRCMF_FW_DEF(43241B5, "brcmfmac43241b5-sdio");
-+BRCMF_FW_DEF(4329, "brcmfmac4329-sdio");
-+BRCMF_FW_DEF(4330, "brcmfmac4330-sdio");
-+BRCMF_FW_DEF(4334, "brcmfmac4334-sdio");
-+BRCMF_FW_DEF(43340, "brcmfmac43340-sdio");
-+BRCMF_FW_DEF(4335, "brcmfmac4335-sdio");
-+BRCMF_FW_DEF(43362, "brcmfmac43362-sdio");
-+BRCMF_FW_DEF(4339, "brcmfmac4339-sdio");
-+BRCMF_FW_DEF(43430A0, "brcmfmac43430a0-sdio");
- /* Note the names are not postfixed with a1 for backward compatibility */
--BRCMF_FW_NVRAM_DEF(43430A1, "brcmfmac43430-sdio.bin", "brcmfmac43430-sdio.txt");
--BRCMF_FW_NVRAM_DEF(43455, "brcmfmac43455-sdio.bin", "brcmfmac43455-sdio.txt");
--BRCMF_FW_NVRAM_DEF(4354, "brcmfmac4354-sdio.bin", "brcmfmac4354-sdio.txt");
--BRCMF_FW_NVRAM_DEF(4356, "brcmfmac4356-sdio.bin", "brcmfmac4356-sdio.txt");
--BRCMF_FW_NVRAM_DEF(4373, "brcmfmac4373-sdio.bin", "brcmfmac4373-sdio.txt");
-+BRCMF_FW_DEF(43430A1, "brcmfmac43430-sdio");
-+BRCMF_FW_DEF(43455, "brcmfmac43455-sdio");
-+BRCMF_FW_DEF(4354, "brcmfmac4354-sdio");
-+BRCMF_FW_DEF(4356, "brcmfmac4356-sdio");
-+BRCMF_FW_DEF(4373, "brcmfmac4373-sdio");
- 
- static struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43241_CHIP_ID, 0x0000001F, 43241B0),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43241_CHIP_ID, 0x00000020, 43241B4),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43241_CHIP_ID, 0xFFFFFFC0, 43241B5),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4329_CHIP_ID, 0xFFFFFFFF, 4329),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, 4330),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, 4334),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, 43340),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43341_CHIP_ID, 0xFFFFFFFF, 43340),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, 4335),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, 43362),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43430_CHIP_ID, 0x00000001, 43430A0),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43430_CHIP_ID, 0xFFFFFFFE, 43430A1),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFFC0, 43455),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, 4354),
--	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
--	BRCMF_FW_NVRAM_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373)
-+	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
-+	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x0000001F, 43241B0),
-+	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x00000020, 43241B4),
-+	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0xFFFFFFC0, 43241B5),
-+	BRCMF_FW_ENTRY(BRCM_CC_4329_CHIP_ID, 0xFFFFFFFF, 4329),
-+	BRCMF_FW_ENTRY(BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, 4330),
-+	BRCMF_FW_ENTRY(BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, 4334),
-+	BRCMF_FW_ENTRY(BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, 43340),
-+	BRCMF_FW_ENTRY(BRCM_CC_43341_CHIP_ID, 0xFFFFFFFF, 43340),
-+	BRCMF_FW_ENTRY(BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, 4335),
-+	BRCMF_FW_ENTRY(BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, 43362),
-+	BRCMF_FW_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),
-+	BRCMF_FW_ENTRY(BRCM_CC_43430_CHIP_ID, 0x00000001, 43430A0),
-+	BRCMF_FW_ENTRY(BRCM_CC_43430_CHIP_ID, 0xFFFFFFFE, 43430A1),
-+	BRCMF_FW_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFFC0, 43455),
-+	BRCMF_FW_ENTRY(BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, 4354),
-+	BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
-+	BRCMF_FW_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373)
- };
- 
- static void pkt_align(struct sk_buff *p, int len, int align)
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -46,11 +46,11 @@
- #define BRCMF_USB_CBCTL_READ		1
- #define BRCMF_USB_MAX_PKT_SIZE		1600
- 
--BRCMF_FW_DEF(43143, "brcmfmac43143.bin");
--BRCMF_FW_DEF(43236B, "brcmfmac43236b.bin");
--BRCMF_FW_DEF(43242A, "brcmfmac43242a.bin");
--BRCMF_FW_DEF(43569, "brcmfmac43569.bin");
--BRCMF_FW_DEF(4373, "brcmfmac4373.bin");
-+BRCMF_FW_DEF(43143, "brcmfmac43143");
-+BRCMF_FW_DEF(43236B, "brcmfmac43236b");
-+BRCMF_FW_DEF(43242A, "brcmfmac43242a");
-+BRCMF_FW_DEF(43569, "brcmfmac43569");
-+BRCMF_FW_DEF(4373, "brcmfmac4373");
- 
- static struct brcmf_firmware_mapping brcmf_usb_fwnames[] = {
- 	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
diff --git a/package/kernel/mac80211/patches/327-v4.17-0007-brcmfmac-pass-struct-in-brcmf_fw_get_firmwares.patch b/package/kernel/mac80211/patches/327-v4.17-0007-brcmfmac-pass-struct-in-brcmf_fw_get_firmwares.patch
deleted file mode 100644
index a75465a89..000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0007-brcmfmac-pass-struct-in-brcmf_fw_get_firmwares.patch
+++ /dev/null
@@ -1,574 +0,0 @@
-From d09ae51a4b676151edaf572bcd5f272b5532639f Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:26 +0100
-Subject: [PATCH] brcmfmac: pass struct in brcmf_fw_get_firmwares()
-
-Make the function brcmf_fw_get_firmwares() a bit more easy to extend
-using a structure to pass the request parameters.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/firmware.c         | 175 ++++++++++++++-------
- .../broadcom/brcm80211/brcmfmac/firmware.h         |  43 +++--
- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |  38 ++++-
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |  32 +++-
- .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c |  43 ++++-
- 5 files changed, 245 insertions(+), 86 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -438,18 +438,31 @@ void brcmf_fw_nvram_free(void *nvram)
- 
- struct brcmf_fw {
- 	struct device *dev;
--	u16 flags;
--	const struct firmware *code;
--	const char *nvram_name;
--	u16 domain_nr;
--	u16 bus_nr;
--	void (*done)(struct device *dev, int err, const struct firmware *fw,
--		     void *nvram_image, u32 nvram_len);
-+	struct brcmf_fw_request *req;
-+	u32 curpos;
-+	void (*done)(struct device *dev, int err, struct brcmf_fw_request *req);
- };
- 
-+static void brcmf_fw_request_done(const struct firmware *fw, void *ctx);
-+
-+static void brcmf_fw_free_request(struct brcmf_fw_request *req)
-+{
-+	struct brcmf_fw_item *item;
-+	int i;
-+
-+	for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
-+		if (item->type == BRCMF_FW_TYPE_BINARY)
-+			release_firmware(item->binary);
-+		else if (item->type == BRCMF_FW_TYPE_NVRAM)
-+			brcmf_fw_nvram_free(item->nv_data.data);
-+	}
-+	kfree(req);
-+}
-+
- static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
- {
- 	struct brcmf_fw *fwctx = ctx;
-+	struct brcmf_fw_item *cur;
- 	u32 nvram_length = 0;
- 	void *nvram = NULL;
- 	u8 *data = NULL;
-@@ -457,83 +470,150 @@ static void brcmf_fw_request_nvram_done(
- 	bool raw_nvram;
- 
- 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
-+
-+	cur = &fwctx->req->items[fwctx->curpos];
-+
- 	if (fw && fw->data) {
- 		data = (u8 *)fw->data;
- 		data_len = fw->size;
- 		raw_nvram = false;
- 	} else {
- 		data = bcm47xx_nvram_get_contents(&data_len);
--		if (!data && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
-+		if (!data && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
- 			goto fail;
- 		raw_nvram = true;
- 	}
- 
- 	if (data)
- 		nvram = brcmf_fw_nvram_strip(data, data_len, &nvram_length,
--					     fwctx->domain_nr, fwctx->bus_nr);
-+					     fwctx->req->domain_nr,
-+					     fwctx->req->bus_nr);
- 
- 	if (raw_nvram)
- 		bcm47xx_nvram_release_contents(data);
- 	release_firmware(fw);
--	if (!nvram && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
-+	if (!nvram && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
- 		goto fail;
- 
--	fwctx->done(fwctx->dev, 0, fwctx->code, nvram, nvram_length);
--	kfree(fwctx);
-+	brcmf_dbg(TRACE, "nvram %p len %d\n", nvram, nvram_length);
-+	cur->nv_data.data = nvram;
-+	cur->nv_data.len = nvram_length;
- 	return;
- 
- fail:
- 	brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
--	release_firmware(fwctx->code);
--	fwctx->done(fwctx->dev, -ENOENT, NULL, NULL, 0);
-+	fwctx->done(fwctx->dev, -ENOENT, NULL);
-+	brcmf_fw_free_request(fwctx->req);
- 	kfree(fwctx);
- }
- 
--static void brcmf_fw_request_code_done(const struct firmware *fw, void *ctx)
-+static int brcmf_fw_request_next_item(struct brcmf_fw *fwctx, bool async)
-+{
-+	struct brcmf_fw_item *cur;
-+	const struct firmware *fw = NULL;
-+	int ret;
-+
-+	cur = &fwctx->req->items[fwctx->curpos];
-+
-+	brcmf_dbg(TRACE, "%srequest for %s\n", async ? "async " : "",
-+		  cur->path);
-+
-+	if (async)
-+		ret = request_firmware_nowait(THIS_MODULE, true, cur->path,
-+					      fwctx->dev, GFP_KERNEL, fwctx,
-+					      brcmf_fw_request_done);
-+	else
-+		ret = request_firmware(&fw, cur->path, fwctx->dev);
-+
-+	if (ret < 0) {
-+		brcmf_fw_request_done(NULL, fwctx);
-+	} else if (!async && fw) {
-+		brcmf_dbg(TRACE, "firmware %s %sfound\n", cur->path,
-+			  fw ? "" : "not ");
-+		if (cur->type == BRCMF_FW_TYPE_BINARY)
-+			cur->binary = fw;
-+		else if (cur->type == BRCMF_FW_TYPE_NVRAM)
-+			brcmf_fw_request_nvram_done(fw, fwctx);
-+		else
-+			release_firmware(fw);
-+
-+		return -EAGAIN;
-+	}
-+	return 0;
-+}
-+
-+static void brcmf_fw_request_done(const struct firmware *fw, void *ctx)
- {
- 	struct brcmf_fw *fwctx = ctx;
-+	struct brcmf_fw_item *cur;
- 	int ret = 0;
- 
--	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
--	if (!fw) {
-+	cur = &fwctx->req->items[fwctx->curpos];
-+
-+	brcmf_dbg(TRACE, "enter: firmware %s %sfound\n", cur->path,
-+		  fw ? "" : "not ");
-+
-+	if (fw) {
-+		if (cur->type == BRCMF_FW_TYPE_BINARY)
-+			cur->binary = fw;
-+		else if (cur->type == BRCMF_FW_TYPE_NVRAM)
-+			brcmf_fw_request_nvram_done(fw, fwctx);
-+		else
-+			release_firmware(fw);
-+	} else if (cur->type == BRCMF_FW_TYPE_NVRAM) {
-+		brcmf_fw_request_nvram_done(NULL, fwctx);
-+	} else if (!(cur->flags & BRCMF_FW_REQF_OPTIONAL)) {
- 		ret = -ENOENT;
- 		goto fail;
- 	}
--	/* only requested code so done here */
--	if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM))
--		goto done;
--
--	fwctx->code = fw;
--	ret = request_firmware_nowait(THIS_MODULE, true, fwctx->nvram_name,
--				      fwctx->dev, GFP_KERNEL, fwctx,
--				      brcmf_fw_request_nvram_done);
- 
--	/* pass NULL to nvram callback for bcm47xx fallback */
--	if (ret)
--		brcmf_fw_request_nvram_done(NULL, fwctx);
-+	do {
-+		if (++fwctx->curpos == fwctx->req->n_items) {
-+			ret = 0;
-+			goto done;
-+		}
-+
-+		ret = brcmf_fw_request_next_item(fwctx, false);
-+	} while (ret == -EAGAIN);
-+
- 	return;
- 
- fail:
--	brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
-+	brcmf_dbg(TRACE, "failed err=%d: dev=%s, fw=%s\n", ret,
-+		  dev_name(fwctx->dev), cur->path);
-+	brcmf_fw_free_request(fwctx->req);
-+	fwctx->req = NULL;
- done:
--	fwctx->done(fwctx->dev, ret, fw, NULL, 0);
-+	fwctx->done(fwctx->dev, ret, fwctx->req);
- 	kfree(fwctx);
- }
- 
--int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
--				const char *code, const char *nvram,
--				void (*fw_cb)(struct device *dev, int err,
--					      const struct firmware *fw,
--					      void *nvram_image, u32 nvram_len),
--				u16 domain_nr, u16 bus_nr)
-+static bool brcmf_fw_request_is_valid(struct brcmf_fw_request *req)
-+{
-+	struct brcmf_fw_item *item;
-+	int i;
-+
-+	if (!req->n_items)
-+		return false;
-+
-+	for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
-+		if (!item->path)
-+			return false;
-+	}
-+	return true;
-+}
-+
-+int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req,
-+			   void (*fw_cb)(struct device *dev, int err,
-+					 struct brcmf_fw_request *req))
- {
- 	struct brcmf_fw *fwctx;
- 
- 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
--	if (!fw_cb || !code)
-+	if (!fw_cb)
- 		return -EINVAL;
- 
--	if ((flags & BRCMF_FW_REQUEST_NVRAM) && !nvram)
-+	if (!brcmf_fw_request_is_valid(req))
- 		return -EINVAL;
- 
- 	fwctx = kzalloc(sizeof(*fwctx), GFP_KERNEL);
-@@ -541,26 +621,11 @@ int brcmf_fw_get_firmwares_pcie(struct d
- 		return -ENOMEM;
- 
- 	fwctx->dev = dev;
--	fwctx->flags = flags;
-+	fwctx->req = req;
- 	fwctx->done = fw_cb;
--	if (flags & BRCMF_FW_REQUEST_NVRAM)
--		fwctx->nvram_name = nvram;
--	fwctx->domain_nr = domain_nr;
--	fwctx->bus_nr = bus_nr;
--
--	return request_firmware_nowait(THIS_MODULE, true, code, dev,
--				       GFP_KERNEL, fwctx,
--				       brcmf_fw_request_code_done);
--}
- 
--int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
--			   const char *code, const char *nvram,
--			   void (*fw_cb)(struct device *dev, int err,
--					 const struct firmware *fw,
--					 void *nvram_image, u32 nvram_len))
--{
--	return brcmf_fw_get_firmwares_pcie(dev, flags, code, nvram, fw_cb, 0,
--					   0);
-+	brcmf_fw_request_next_item(fwctx, true);
-+	return 0;
- }
- 
- static void brcmf_fw_get_full_name(char fw_name[BRCMF_FW_NAME_LEN],
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-@@ -16,10 +16,7 @@
- #ifndef BRCMFMAC_FIRMWARE_H
- #define BRCMFMAC_FIRMWARE_H
- 
--#define BRCMF_FW_REQUEST		0x000F
--#define  BRCMF_FW_REQUEST_NVRAM		0x0001
--#define BRCMF_FW_REQ_FLAGS		0x00F0
--#define  BRCMF_FW_REQ_NV_OPTIONAL	0x0010
-+#define BRCMF_FW_REQF_OPTIONAL		0x0001
- 
- #define	BRCMF_FW_NAME_LEN		320
- 
-@@ -54,21 +51,39 @@ int brcmf_fw_map_chip_to_name(u32 chip,
- 			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
- 			      char nvram_name[BRCMF_FW_NAME_LEN]);
- void brcmf_fw_nvram_free(void *nvram);
-+
-+enum brcmf_fw_type {
-+	BRCMF_FW_TYPE_BINARY,
-+	BRCMF_FW_TYPE_NVRAM
-+};
-+
-+struct brcmf_fw_item {
-+	const char *path;
-+	enum brcmf_fw_type type;
-+	u16 flags;
-+	union {
-+		const struct firmware *binary;
-+		struct {
-+			void *data;
-+			u32 len;
-+		} nv_data;
-+	};
-+};
-+
-+struct brcmf_fw_request {
-+	u16 domain_nr;
-+	u16 bus_nr;
-+	u32 n_items;
-+	struct brcmf_fw_item items[0];
-+};
-+
- /*
-  * Request firmware(s) asynchronously. When the asynchronous request
-  * fails it will not use the callback, but call device_release_driver()
-  * instead which will call the driver .remove() callback.
-  */
--int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
--				const char *code, const char *nvram,
--				void (*fw_cb)(struct device *dev, int err,
--					      const struct firmware *fw,
--					      void *nvram_image, u32 nvram_len),
--				u16 domain_nr, u16 bus_nr);
--int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
--			   const char *code, const char *nvram,
-+int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req,
- 			   void (*fw_cb)(struct device *dev, int err,
--					 const struct firmware *fw,
--					 void *nvram_image, u32 nvram_len));
-+					 struct brcmf_fw_request *req));
- 
- #endif /* BRCMFMAC_FIRMWARE_H */
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1651,15 +1651,19 @@ static const struct brcmf_buscore_ops br
- 	.write32 = brcmf_pcie_buscore_write32,
- };
- 
-+#define BRCMF_PCIE_FW_CODE	0
-+#define BRCMF_PCIE_FW_NVRAM	1
-+
- static void brcmf_pcie_setup(struct device *dev, int ret,
--			     const struct firmware *fw,
--			     void *nvram, u32 nvram_len)
-+			     struct brcmf_fw_request *fwreq)
- {
-+	const struct firmware *fw;
-+	void *nvram;
- 	struct brcmf_bus *bus;
- 	struct brcmf_pciedev *pcie_bus_dev;
- 	struct brcmf_pciedev_info *devinfo;
- 	struct brcmf_commonring **flowrings;
--	u32 i;
-+	u32 i, nvram_len;
- 
- 	/* check firmware loading result */
- 	if (ret)
-@@ -1670,6 +1674,11 @@ static void brcmf_pcie_setup(struct devi
- 	devinfo = pcie_bus_dev->devinfo;
- 	brcmf_pcie_attach(devinfo);
- 
-+	fw = fwreq->items[BRCMF_PCIE_FW_CODE].binary;
-+	nvram = fwreq->items[BRCMF_PCIE_FW_NVRAM].nv_data.data;
-+	nvram_len = fwreq->items[BRCMF_PCIE_FW_NVRAM].nv_data.len;
-+	kfree(fwreq);
-+
- 	/* Some of the firmwares have the size of the memory of the device
- 	 * defined inside the firmware. This is because part of the memory in
- 	 * the device is shared and the devision is determined by FW. Parse
-@@ -1730,6 +1739,7 @@ static int
- brcmf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
- {
- 	int ret;
-+	struct brcmf_fw_request *fwreq;
- 	struct brcmf_pciedev_info *devinfo;
- 	struct brcmf_pciedev *pcie_bus_dev;
- 	struct brcmf_bus *bus;
-@@ -1800,12 +1810,26 @@ brcmf_pcie_probe(struct pci_dev *pdev, c
- 	if (ret)
- 		goto fail_bus;
- 
--	ret = brcmf_fw_get_firmwares_pcie(bus->dev, BRCMF_FW_REQUEST_NVRAM |
--						    BRCMF_FW_REQ_NV_OPTIONAL,
--					  devinfo->fw_name, devinfo->nvram_name,
--					  brcmf_pcie_setup, domain_nr, bus_nr);
-+	fwreq = kzalloc(sizeof(*fwreq) + 2 * sizeof(struct brcmf_fw_item),
-+			GFP_KERNEL);
-+	if (!fwreq) {
-+		ret = -ENOMEM;
-+		goto fail_bus;
-+	}
-+
-+	fwreq->items[BRCMF_PCIE_FW_CODE].path = devinfo->fw_name;
-+	fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
-+	fwreq->items[BRCMF_PCIE_FW_NVRAM].path = devinfo->nvram_name;
-+	fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
-+	fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL;
-+	fwreq->n_items = 2;
-+	fwreq->domain_nr = domain_nr;
-+	fwreq->bus_nr = bus_nr;
-+	ret = brcmf_fw_get_firmwares(bus->dev, fwreq, brcmf_pcie_setup);
- 	if (ret == 0)
- 		return 0;
-+
-+	kfree(fwreq);
- fail_bus:
- 	kfree(bus->msgbuf);
- 	kfree(bus);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4031,14 +4031,19 @@ static const struct brcmf_bus_ops brcmf_
- 	.get_fwname = brcmf_sdio_get_fwname,
- };
- 
-+#define BRCMF_SDIO_FW_CODE	0
-+#define BRCMF_SDIO_FW_NVRAM	1
-+
- static void brcmf_sdio_firmware_callback(struct device *dev, int err,
--					 const struct firmware *code,
--					 void *nvram, u32 nvram_len)
-+					 struct brcmf_fw_request *fwreq)
- {
- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
- 	struct brcmf_sdio_dev *sdiod = bus_if->bus_priv.sdio;
- 	struct brcmf_sdio *bus = sdiod->bus;
- 	struct brcmf_core *core = bus->sdio_core;
-+	const struct firmware *code;
-+	void *nvram;
-+	u32 nvram_len;
- 	u8 saveclk;
- 
- 	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
-@@ -4046,6 +4051,11 @@ static void brcmf_sdio_firmware_callback
- 	if (err)
- 		goto fail;
- 
-+	code = fwreq->items[BRCMF_SDIO_FW_CODE].binary;
-+	nvram = fwreq->items[BRCMF_SDIO_FW_NVRAM].nv_data.data;
-+	nvram_len = fwreq->items[BRCMF_SDIO_FW_NVRAM].nv_data.len;
-+	kfree(fwreq);
-+
- 	/* try to download image and nvram to the dongle */
- 	bus->alp_only = true;
- 	err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
-@@ -4150,6 +4160,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	int ret;
- 	struct brcmf_sdio *bus;
- 	struct workqueue_struct *wq;
-+	struct brcmf_fw_request *fwreq;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
-@@ -4240,11 +4251,24 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 	if (ret)
- 		goto fail;
- 
--	ret = brcmf_fw_get_firmwares(sdiodev->dev, BRCMF_FW_REQUEST_NVRAM,
--				     sdiodev->fw_name, sdiodev->nvram_name,
-+	fwreq = kzalloc(sizeof(fwreq) + 2 * sizeof(struct brcmf_fw_item),
-+			GFP_KERNEL);
-+	if (!fwreq) {
-+		ret = -ENOMEM;
-+		goto fail;
-+	}
-+
-+	fwreq->items[BRCMF_SDIO_FW_CODE].path = sdiodev->fw_name;
-+	fwreq->items[BRCMF_SDIO_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
-+	fwreq->items[BRCMF_SDIO_FW_NVRAM].path = sdiodev->nvram_name;
-+	fwreq->items[BRCMF_SDIO_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
-+	fwreq->n_items = 2;
-+
-+	ret = brcmf_fw_get_firmwares(sdiodev->dev, fwreq,
- 				     brcmf_sdio_firmware_callback);
- 	if (ret != 0) {
- 		brcmf_err("async firmware request failed: %d\n", ret);
-+		kfree(fwreq);
- 		goto fail;
- 	}
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1155,18 +1155,23 @@ static const struct brcmf_bus_ops brcmf_
- 	.get_fwname = brcmf_usb_get_fwname,
- };
- 
-+#define BRCMF_USB_FW_CODE	0
-+
- static void brcmf_usb_probe_phase2(struct device *dev, int ret,
--				   const struct firmware *fw,
--				   void *nvram, u32 nvlen)
-+				   struct brcmf_fw_request *fwreq)
- {
- 	struct brcmf_bus *bus = dev_get_drvdata(dev);
- 	struct brcmf_usbdev_info *devinfo = bus->bus_priv.usb->devinfo;
-+	const struct firmware *fw;
- 
- 	if (ret)
- 		goto error;
- 
- 	brcmf_dbg(USB, "Start fw downloading\n");
- 
-+	fw = fwreq->items[BRCMF_USB_FW_CODE].binary;
-+	kfree(fwreq);
-+
- 	ret = check_file(fw->data);
- 	if (ret < 0) {
- 		brcmf_err("invalid firmware\n");
-@@ -1200,6 +1205,7 @@ static int brcmf_usb_probe_cb(struct brc
- 	struct brcmf_bus *bus = NULL;
- 	struct brcmf_usbdev *bus_pub = NULL;
- 	struct device *dev = devinfo->dev;
-+	struct brcmf_fw_request *fwreq;
- 	int ret;
- 
- 	brcmf_dbg(USB, "Enter\n");
-@@ -1250,11 +1256,22 @@ static int brcmf_usb_probe_cb(struct brc
- 	if (ret)
- 		goto fail;
- 
-+	fwreq = kzalloc(sizeof(*fwreq) + sizeof(struct brcmf_fw_item),
-+			GFP_KERNEL);
-+	if (!fwreq) {
-+		ret = -ENOMEM;
-+		goto fail;
-+	}
-+
-+	fwreq->items[BRCMF_USB_FW_CODE].path = devinfo->fw_name;
-+	fwreq->items[BRCMF_USB_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
-+	fwreq->n_items = 1;
-+
- 	/* request firmware here */
--	ret = brcmf_fw_get_firmwares(dev, 0, devinfo->fw_name, NULL,
--				     brcmf_usb_probe_phase2);
-+	ret = brcmf_fw_get_firmwares(dev, fwreq, brcmf_usb_probe_phase2);
- 	if (ret) {
- 		brcmf_err("firmware request failed: %d\n", ret);
-+		kfree(fwreq);
- 		goto fail;
- 	}
- 
-@@ -1447,11 +1464,25 @@ static int brcmf_usb_reset_resume(struct
- {
- 	struct usb_device *usb = interface_to_usbdev(intf);
- 	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
-+	struct brcmf_fw_request *fwreq;
-+	int ret;
- 
- 	brcmf_dbg(USB, "Enter\n");
- 
--	return brcmf_fw_get_firmwares(&usb->dev, 0, devinfo->fw_name, NULL,
--				      brcmf_usb_probe_phase2);
-+	fwreq = kzalloc(sizeof(*fwreq) + sizeof(struct brcmf_fw_item),
-+			GFP_KERNEL);
-+	if (!fwreq)
-+		return -ENOMEM;
-+
-+	fwreq->items[BRCMF_USB_FW_CODE].path = devinfo->fw_name;
-+	fwreq->items[BRCMF_USB_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
-+	fwreq->n_items = 1;
-+
-+	ret = brcmf_fw_get_firmwares(&usb->dev, fwreq, brcmf_usb_probe_phase2);
-+	if (ret < 0)
-+		kfree(fwreq);
-+
-+	return ret;
- }
- 
- #define BRCMF_USB_DEVICE(dev_id)	\
diff --git a/package/kernel/mac80211/patches/327-v4.17-0008-brcmfmac-introduce-brcmf_fw_alloc_request-function.patch b/package/kernel/mac80211/patches/327-v4.17-0008-brcmfmac-introduce-brcmf_fw_alloc_request-function.patch
deleted file mode 100644
index 408154ef0..000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0008-brcmfmac-introduce-brcmf_fw_alloc_request-function.patch
+++ /dev/null
@@ -1,328 +0,0 @@
-From 2baa3aaee27f137b8db9a9224d0fe9b281d28e34 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:27 +0100
-Subject: [PATCH] brcmfmac: introduce brcmf_fw_alloc_request() function
-
-The function brcmf_fw_alloc_request() takes a list of required files
-and allocated the struct brcmf_fw_request instance accordingly. The
-request can be modified by the caller before being passed to the
-brcmf_fw_request_firmwares() function.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/firmware.c         | 58 ++++++++++++++++++++++
- .../broadcom/brcm80211/brcmfmac/firmware.h         | 11 ++++
- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    | 58 ++++++++++++----------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 38 ++++++++------
- .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 42 +++++++++-------
- 5 files changed, 147 insertions(+), 60 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -688,3 +688,61 @@ int brcmf_fw_map_chip_to_name(u32 chip,
- 	return 0;
- }
- 
-+struct brcmf_fw_request *
-+brcmf_fw_alloc_request(u32 chip, u32 chiprev,
-+		       struct brcmf_firmware_mapping mapping_table[],
-+		       u32 table_size, struct brcmf_fw_name *fwnames,
-+		       u32 n_fwnames)
-+{
-+	struct brcmf_fw_request *fwreq;
-+	char chipname[12];
-+	const char *mp_path;
-+	u32 i, j;
-+	char end;
-+	size_t reqsz;
-+
-+	for (i = 0; i < table_size; i++) {
-+		if (mapping_table[i].chipid == chip &&
-+		    mapping_table[i].revmask & BIT(chiprev))
-+			break;
-+	}
-+
-+	if (i == table_size) {
-+		brcmf_err("Unknown chipid %d [%d]\n", chip, chiprev);
-+		return NULL;
-+	}
-+
-+	reqsz = sizeof(*fwreq) + n_fwnames * sizeof(struct brcmf_fw_item);
-+	fwreq = kzalloc(reqsz, GFP_KERNEL);
-+	if (!fwreq)
-+		return NULL;
-+
-+	brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
-+
-+	brcmf_info("using %s for chip %s\n",
-+		   mapping_table[i].fw_base, chipname);
-+
-+	mp_path = brcmf_mp_global.firmware_path;
-+	end = mp_path[strlen(mp_path) - 1];
-+	fwreq->n_items = n_fwnames;
-+
-+	for (j = 0; j < n_fwnames; j++) {
-+		fwreq->items[j].path = fwnames[j].path;
-+		/* check if firmware path is provided by module parameter */
-+		if (brcmf_mp_global.firmware_path[0] != '\0') {
-+			strlcpy(fwnames[j].path, mp_path,
-+				BRCMF_FW_NAME_LEN);
-+
-+			if (end != '/') {
-+				strlcat(fwnames[j].path, "/",
-+					BRCMF_FW_NAME_LEN);
-+			}
-+		}
-+		brcmf_fw_get_full_name(fwnames[j].path,
-+				       mapping_table[i].fw_base,
-+				       fwnames[j].extension);
-+		fwreq->items[j].path = fwnames[j].path;
-+	}
-+
-+	return fwreq;
-+}
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-@@ -77,6 +77,17 @@ struct brcmf_fw_request {
- 	struct brcmf_fw_item items[0];
- };
- 
-+struct brcmf_fw_name {
-+	const char *extension;
-+	char *path;
-+};
-+
-+struct brcmf_fw_request *
-+brcmf_fw_alloc_request(u32 chip, u32 chiprev,
-+		       struct brcmf_firmware_mapping mapping_table[],
-+		       u32 table_size, struct brcmf_fw_name *fwnames,
-+		       u32 n_fwnames);
-+
- /*
-  * Request firmware(s) asynchronously. When the asynchronous request
-  * fails it will not use the callback, but call device_release_driver()
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1735,6 +1735,31 @@ fail:
- 	device_release_driver(dev);
- }
- 
-+static struct brcmf_fw_request *
-+brcmf_pcie_prepare_fw_request(struct brcmf_pciedev_info *devinfo)
-+{
-+	struct brcmf_fw_request *fwreq;
-+	struct brcmf_fw_name fwnames[] = {
-+		{ ".bin", devinfo->fw_name },
-+		{ ".txt", devinfo->nvram_name },
-+	};
-+
-+	fwreq = brcmf_fw_alloc_request(devinfo->ci->chip, devinfo->ci->chiprev,
-+				       brcmf_pcie_fwnames,
-+				       ARRAY_SIZE(brcmf_pcie_fwnames),
-+				       fwnames, ARRAY_SIZE(fwnames));
-+	if (!fwreq)
-+		return NULL;
-+
-+	fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
-+	fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
-+	fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL;
-+	fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus);
-+	fwreq->bus_nr = devinfo->pdev->bus->number;
-+
-+	return fwreq;
-+}
-+
- static int
- brcmf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
- {
-@@ -1743,13 +1768,8 @@ brcmf_pcie_probe(struct pci_dev *pdev, c
- 	struct brcmf_pciedev_info *devinfo;
- 	struct brcmf_pciedev *pcie_bus_dev;
- 	struct brcmf_bus *bus;
--	u16 domain_nr;
--	u16 bus_nr;
- 
--	domain_nr = pci_domain_nr(pdev->bus) + 1;
--	bus_nr = pdev->bus->number;
--	brcmf_dbg(PCIE, "Enter %x:%x (%d/%d)\n", pdev->vendor, pdev->device,
--		  domain_nr, bus_nr);
-+	brcmf_dbg(PCIE, "Enter %x:%x\n", pdev->vendor, pdev->device);
- 
- 	ret = -ENOMEM;
- 	devinfo = kzalloc(sizeof(*devinfo), GFP_KERNEL);
-@@ -1803,33 +1823,19 @@ brcmf_pcie_probe(struct pci_dev *pdev, c
- 	bus->wowl_supported = pci_pme_capable(pdev, PCI_D3hot);
- 	dev_set_drvdata(&pdev->dev, bus);
- 
--	ret = brcmf_fw_map_chip_to_name(devinfo->ci->chip, devinfo->ci->chiprev,
--					brcmf_pcie_fwnames,
--					ARRAY_SIZE(brcmf_pcie_fwnames),
--					devinfo->fw_name, devinfo->nvram_name);
--	if (ret)
--		goto fail_bus;
--
--	fwreq = kzalloc(sizeof(*fwreq) + 2 * sizeof(struct brcmf_fw_item),
--			GFP_KERNEL);
-+	fwreq = brcmf_pcie_prepare_fw_request(devinfo);
- 	if (!fwreq) {
- 		ret = -ENOMEM;
- 		goto fail_bus;
- 	}
- 
--	fwreq->items[BRCMF_PCIE_FW_CODE].path = devinfo->fw_name;
--	fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
--	fwreq->items[BRCMF_PCIE_FW_NVRAM].path = devinfo->nvram_name;
--	fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
--	fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL;
--	fwreq->n_items = 2;
--	fwreq->domain_nr = domain_nr;
--	fwreq->bus_nr = bus_nr;
- 	ret = brcmf_fw_get_firmwares(bus->dev, fwreq, brcmf_pcie_setup);
--	if (ret == 0)
--		return 0;
-+	if (ret < 0) {
-+		kfree(fwreq);
-+		goto fail_bus;
-+	}
-+	return 0;
- 
--	kfree(fwreq);
- fail_bus:
- 	kfree(bus->msgbuf);
- 	kfree(bus);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4155,6 +4155,28 @@ fail:
- 	device_release_driver(dev);
- }
- 
-+static struct brcmf_fw_request *
-+brcmf_sdio_prepare_fw_request(struct brcmf_sdio *bus)
-+{
-+	struct brcmf_fw_request *fwreq;
-+	struct brcmf_fw_name fwnames[] = {
-+		{ ".bin", bus->sdiodev->fw_name },
-+		{ ".txt", bus->sdiodev->nvram_name },
-+	};
-+
-+	fwreq = brcmf_fw_alloc_request(bus->ci->chip, bus->ci->chiprev,
-+				       brcmf_sdio_fwnames,
-+				       ARRAY_SIZE(brcmf_sdio_fwnames),
-+				       fwnames, ARRAY_SIZE(fwnames));
-+	if (!fwreq)
-+		return NULL;
-+
-+	fwreq->items[BRCMF_SDIO_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
-+	fwreq->items[BRCMF_SDIO_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
-+
-+	return fwreq;
-+}
-+
- struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
- {
- 	int ret;
-@@ -4244,26 +4266,12 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
- 
- 	brcmf_dbg(INFO, "completed!!\n");
- 
--	ret = brcmf_fw_map_chip_to_name(bus->ci->chip, bus->ci->chiprev,
--					brcmf_sdio_fwnames,
--					ARRAY_SIZE(brcmf_sdio_fwnames),
--					sdiodev->fw_name, sdiodev->nvram_name);
--	if (ret)
--		goto fail;
--
--	fwreq = kzalloc(sizeof(fwreq) + 2 * sizeof(struct brcmf_fw_item),
--			GFP_KERNEL);
-+	fwreq = brcmf_sdio_prepare_fw_request(bus);
- 	if (!fwreq) {
- 		ret = -ENOMEM;
- 		goto fail;
- 	}
- 
--	fwreq->items[BRCMF_SDIO_FW_CODE].path = sdiodev->fw_name;
--	fwreq->items[BRCMF_SDIO_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
--	fwreq->items[BRCMF_SDIO_FW_NVRAM].path = sdiodev->nvram_name;
--	fwreq->items[BRCMF_SDIO_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
--	fwreq->n_items = 2;
--
- 	ret = brcmf_fw_get_firmwares(sdiodev->dev, fwreq,
- 				     brcmf_sdio_firmware_callback);
- 	if (ret != 0) {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1200,6 +1200,27 @@ error:
- 	device_release_driver(dev);
- }
- 
-+static struct brcmf_fw_request *
-+brcmf_usb_prepare_fw_request(struct brcmf_usbdev_info *devinfo)
-+{
-+	struct brcmf_fw_request *fwreq;
-+	struct brcmf_fw_name fwnames[] = {
-+		{ ".bin", devinfo->fw_name },
-+	};
-+
-+	fwreq = brcmf_fw_alloc_request(devinfo->bus_pub.devid,
-+				       devinfo->bus_pub.chiprev,
-+				       brcmf_usb_fwnames,
-+				       ARRAY_SIZE(brcmf_usb_fwnames),
-+				       fwnames, ARRAY_SIZE(fwnames));
-+	if (!fwreq)
-+		return NULL;
-+
-+	fwreq->items[BRCMF_USB_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
-+
-+	return fwreq;
-+}
-+
- static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
- {
- 	struct brcmf_bus *bus = NULL;
-@@ -1249,24 +1270,12 @@ static int brcmf_usb_probe_cb(struct brc
- 	bus->chip = bus_pub->devid;
- 	bus->chiprev = bus_pub->chiprev;
- 
--	ret = brcmf_fw_map_chip_to_name(bus_pub->devid, bus_pub->chiprev,
--					brcmf_usb_fwnames,
--					ARRAY_SIZE(brcmf_usb_fwnames),
--					devinfo->fw_name, NULL);
--	if (ret)
--		goto fail;
--
--	fwreq = kzalloc(sizeof(*fwreq) + sizeof(struct brcmf_fw_item),
--			GFP_KERNEL);
-+	fwreq = brcmf_usb_prepare_fw_request(devinfo);
- 	if (!fwreq) {
- 		ret = -ENOMEM;
- 		goto fail;
- 	}
- 
--	fwreq->items[BRCMF_USB_FW_CODE].path = devinfo->fw_name;
--	fwreq->items[BRCMF_USB_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
--	fwreq->n_items = 1;
--
- 	/* request firmware here */
- 	ret = brcmf_fw_get_firmwares(dev, fwreq, brcmf_usb_probe_phase2);
- 	if (ret) {
-@@ -1469,15 +1478,10 @@ static int brcmf_usb_reset_resume(struct
- 
- 	brcmf_dbg(USB, "Enter\n");
- 
--	fwreq = kzalloc(sizeof(*fwreq) + sizeof(struct brcmf_fw_item),
--			GFP_KERNEL);
-+	fwreq = brcmf_usb_prepare_fw_request(devinfo);
- 	if (!fwreq)
- 		return -ENOMEM;
- 
--	fwreq->items[BRCMF_USB_FW_CODE].path = devinfo->fw_name;
--	fwreq->items[BRCMF_USB_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
--	fwreq->n_items = 1;
--
- 	ret = brcmf_fw_get_firmwares(&usb->dev, fwreq, brcmf_usb_probe_phase2);
- 	if (ret < 0)
- 		kfree(fwreq);
diff --git a/package/kernel/mac80211/patches/327-v4.17-0009-brcmfmac-add-extension-to-.get_fwname-callbacks.patch b/package/kernel/mac80211/patches/327-v4.17-0009-brcmfmac-add-extension-to-.get_fwname-callbacks.patch
deleted file mode 100644
index 391229a86..000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0009-brcmfmac-add-extension-to-.get_fwname-callbacks.patch
+++ /dev/null
@@ -1,231 +0,0 @@
-From bf7a7b37f6ef5090a2bae7e7ae23cd26b741cca4 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:28 +0100
-Subject: [PATCH] brcmfmac: add extension to .get_fwname() callbacks
-
-This changes the bus layer api by having the caller provide an
-extension. With this the callback can use brcmf_fw_alloc_request()
-to get the needed firmware name.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h |  6 +--
- .../wireless/broadcom/brcm80211/brcmfmac/common.c  | 43 +++-------------------
- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    | 27 +++++++-------
- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 26 +++++++------
- .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 27 ++++++++------
- 5 files changed, 51 insertions(+), 78 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -88,7 +88,7 @@ struct brcmf_bus_ops {
- 	void (*wowl_config)(struct device *dev, bool enabled);
- 	size_t (*get_ramsize)(struct device *dev);
- 	int (*get_memdump)(struct device *dev, void *data, size_t len);
--	int (*get_fwname)(struct device *dev, uint chip, uint chiprev,
-+	int (*get_fwname)(struct device *dev, const char *ext,
- 			  unsigned char *fw_name);
- };
- 
-@@ -228,10 +228,10 @@ int brcmf_bus_get_memdump(struct brcmf_b
- }
- 
- static inline
--int brcmf_bus_get_fwname(struct brcmf_bus *bus, uint chip, uint chiprev,
-+int brcmf_bus_get_fwname(struct brcmf_bus *bus, const char *ext,
- 			 unsigned char *fw_name)
- {
--	return bus->ops->get_fwname(bus->dev, chip, chiprev, fw_name);
-+	return bus->ops->get_fwname(bus->dev, ext, fw_name);
- }
- 
- /*
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -129,42 +129,9 @@ static int brcmf_c_download(struct brcmf
- 	return err;
- }
- 
--static int brcmf_c_get_clm_name(struct brcmf_if *ifp, u8 *clm_name)
--{
--	struct brcmf_bus *bus = ifp->drvr->bus_if;
--	u8 fw_name[BRCMF_FW_NAME_LEN];
--	u8 *ptr;
--	size_t len;
--	s32 err;
--
--	memset(fw_name, 0, BRCMF_FW_NAME_LEN);
--	err = brcmf_bus_get_fwname(bus, bus->chip, bus->chiprev, fw_name);
--	if (err) {
--		brcmf_err("get firmware name failed (%d)\n", err);
--		goto done;
--	}
--
--	/* generate CLM blob file name */
--	ptr = strrchr(fw_name, '.');
--	if (!ptr) {
--		err = -ENOENT;
--		goto done;
--	}
--
--	len = ptr - fw_name + 1;
--	if (len + strlen(".clm_blob") > BRCMF_FW_NAME_LEN) {
--		err = -E2BIG;
--	} else {
--		strlcpy(clm_name, fw_name, len);
--		strlcat(clm_name, ".clm_blob", BRCMF_FW_NAME_LEN);
--	}
--done:
--	return err;
--}
--
- static int brcmf_c_process_clm_blob(struct brcmf_if *ifp)
- {
--	struct device *dev = ifp->drvr->bus_if->dev;
-+	struct brcmf_bus *bus = ifp->drvr->bus_if;
- 	struct brcmf_dload_data_le *chunk_buf;
- 	const struct firmware *clm = NULL;
- 	u8 clm_name[BRCMF_FW_NAME_LEN];
-@@ -177,16 +144,16 @@ static int brcmf_c_process_clm_blob(stru
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
--	memset(clm_name, 0, BRCMF_FW_NAME_LEN);
--	err = brcmf_c_get_clm_name(ifp, clm_name);
-+	memset(clm_name, 0, sizeof(clm_name));
-+	err = brcmf_bus_get_fwname(bus, ".clm_blob", clm_name);
- 	if (err) {
- 		brcmf_err("get CLM blob file name failed (%d)\n", err);
- 		return err;
- 	}
- 
--	err = request_firmware(&clm, clm_name, dev);
-+	err = request_firmware(&clm, clm_name, bus->dev);
- 	if (err) {
--		brcmf_info("no clm_blob available(err=%d), device may have limited channels available\n",
-+		brcmf_info("no clm_blob available (err=%d), device may have limited channels available\n",
- 			   err);
- 		return 0;
- 	}
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1350,23 +1350,24 @@ static int brcmf_pcie_get_memdump(struct
- 	return 0;
- }
- 
--static int brcmf_pcie_get_fwname(struct device *dev, u32 chip, u32 chiprev,
--				 u8 *fw_name)
-+static
-+int brcmf_pcie_get_fwname(struct device *dev, const char *ext, u8 *fw_name)
- {
- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
--	struct brcmf_pciedev *buspub = bus_if->bus_priv.pcie;
--	struct brcmf_pciedev_info *devinfo = buspub->devinfo;
--	int ret = 0;
-+	struct brcmf_fw_request *fwreq;
-+	struct brcmf_fw_name fwnames[] = {
-+		{ ext, fw_name },
-+	};
- 
--	if (devinfo->fw_name[0] != '\0')
--		strlcpy(fw_name, devinfo->fw_name, BRCMF_FW_NAME_LEN);
--	else
--		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
--						brcmf_pcie_fwnames,
--						ARRAY_SIZE(brcmf_pcie_fwnames),
--						fw_name, NULL);
-+	fwreq = brcmf_fw_alloc_request(bus_if->chip, bus_if->chiprev,
-+				       brcmf_pcie_fwnames,
-+				       ARRAY_SIZE(brcmf_pcie_fwnames),
-+				       fwnames, ARRAY_SIZE(fwnames));
-+	if (!fwreq)
-+		return -ENOMEM;
- 
--	return ret;
-+	kfree(fwreq);
-+	return 0;
- }
- 
- static const struct brcmf_bus_ops brcmf_pcie_bus_ops = {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4000,22 +4000,24 @@ brcmf_sdio_watchdog(unsigned long data)
- 	}
- }
- 
--static int brcmf_sdio_get_fwname(struct device *dev, u32 chip, u32 chiprev,
--				 u8 *fw_name)
-+static
-+int brcmf_sdio_get_fwname(struct device *dev, const char *ext, u8 *fw_name)
- {
- 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
--	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
--	int ret = 0;
-+	struct brcmf_fw_request *fwreq;
-+	struct brcmf_fw_name fwnames[] = {
-+		{ ext, fw_name },
-+	};
- 
--	if (sdiodev->fw_name[0] != '\0')
--		strlcpy(fw_name, sdiodev->fw_name, BRCMF_FW_NAME_LEN);
--	else
--		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
--						brcmf_sdio_fwnames,
--						ARRAY_SIZE(brcmf_sdio_fwnames),
--						fw_name, NULL);
-+	fwreq = brcmf_fw_alloc_request(bus_if->chip, bus_if->chiprev,
-+				       brcmf_sdio_fwnames,
-+				       ARRAY_SIZE(brcmf_sdio_fwnames),
-+				       fwnames, ARRAY_SIZE(fwnames));
-+	if (!fwreq)
-+		return -ENOMEM;
- 
--	return ret;
-+	kfree(fwreq);
-+	return 0;
- }
- 
- static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1128,21 +1128,24 @@ static void brcmf_usb_wowl_config(struct
- 		device_set_wakeup_enable(devinfo->dev, false);
- }
- 
--static int brcmf_usb_get_fwname(struct device *dev, u32 chip, u32 chiprev,
--				u8 *fw_name)
-+static
-+int brcmf_usb_get_fwname(struct device *dev, const char *ext, u8 *fw_name)
- {
--	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
--	int ret = 0;
-+	struct brcmf_bus *bus = dev_get_drvdata(dev);
-+	struct brcmf_fw_request *fwreq;
-+	struct brcmf_fw_name fwnames[] = {
-+		{ ext, fw_name },
-+	};
- 
--	if (devinfo->fw_name[0] != '\0')
--		strlcpy(fw_name, devinfo->fw_name, BRCMF_FW_NAME_LEN);
--	else
--		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
--						brcmf_usb_fwnames,
--						ARRAY_SIZE(brcmf_usb_fwnames),
--						fw_name, NULL);
-+	fwreq = brcmf_fw_alloc_request(bus->chip, bus->chiprev,
-+				       brcmf_usb_fwnames,
-+				       ARRAY_SIZE(brcmf_usb_fwnames),
-+				       fwnames, ARRAY_SIZE(fwnames));
-+	if (!fwreq)
-+		return -ENOMEM;
- 
--	return ret;
-+	kfree(fwreq);
-+	return 0;
- }
- 
- static const struct brcmf_bus_ops brcmf_usb_bus_ops = {
diff --git a/package/kernel/mac80211/patches/327-v4.17-0010-brcmfmac-get-rid-of-brcmf_fw_map_chip_to_name.patch b/package/kernel/mac80211/patches/327-v4.17-0010-brcmfmac-get-rid-of-brcmf_fw_map_chip_to_name.patch
deleted file mode 100644
index becf7cf3f..000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0010-brcmfmac-get-rid-of-brcmf_fw_map_chip_to_name.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From 18c2b20e276e04476a3350b4a92c1dfad725d45d Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:29 +0100
-Subject: [PATCH] brcmfmac: get rid of brcmf_fw_map_chip_to_name()
-
-The function is no longer used so removing it.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/firmware.c         | 53 ----------------------
- .../broadcom/brcm80211/brcmfmac/firmware.h         |  4 --
- 2 files changed, 57 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -635,59 +635,6 @@ static void brcmf_fw_get_full_name(char
- 	strlcat(fw_name, extension, BRCMF_FW_NAME_LEN);
- }
- 
--int brcmf_fw_map_chip_to_name(u32 chip, u32 chiprev,
--			      struct brcmf_firmware_mapping mapping_table[],
--			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
--			      char nvram_name[BRCMF_FW_NAME_LEN])
--{
--	char chipname[12];
--	u32 i;
--	char end;
--
--	for (i = 0; i < table_size; i++) {
--		if (mapping_table[i].chipid == chip &&
--		    mapping_table[i].revmask & BIT(chiprev))
--			break;
--	}
--
--	if (i == table_size) {
--		brcmf_err("Unknown chipid %d [%d]\n", chip, chiprev);
--		return -ENODEV;
--	}
--
--	brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
--
--	/* check if firmware path is provided by module parameter */
--	if (brcmf_mp_global.firmware_path[0] != '\0') {
--		if (fw_name)
--			strlcpy(fw_name, brcmf_mp_global.firmware_path,
--				BRCMF_FW_NAME_LEN);
--		if (nvram_name)
--			strlcpy(nvram_name, brcmf_mp_global.firmware_path,
--				BRCMF_FW_NAME_LEN);
--
--		end = brcmf_mp_global.firmware_path[
--				strlen(brcmf_mp_global.firmware_path) - 1];
--		if (end != '/') {
--			if (fw_name)
--				strlcat(fw_name, "/", BRCMF_FW_NAME_LEN);
--			if (nvram_name)
--				strlcat(nvram_name, "/", BRCMF_FW_NAME_LEN);
--		}
--	}
--
--	brcmf_info("using %s for chip %s\n",
--		   mapping_table[i].fw_base, chipname);
--	if (fw_name)
--		brcmf_fw_get_full_name(fw_name,
--				       mapping_table[i].fw_base, ".bin");
--	if (nvram_name)
--		brcmf_fw_get_full_name(nvram_name,
--				       mapping_table[i].fw_base, ".txt");
--
--	return 0;
--}
--
- struct brcmf_fw_request *
- brcmf_fw_alloc_request(u32 chip, u32 chiprev,
- 		       struct brcmf_firmware_mapping mapping_table[],
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-@@ -46,10 +46,6 @@ MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH fw
- #define BRCMF_FW_ENTRY(chipid, mask, name) \
- 	{ chipid, mask, BRCM_ ## name ## _FIRMWARE_BASENAME }
- 
--int brcmf_fw_map_chip_to_name(u32 chip, u32 chiprev,
--			      struct brcmf_firmware_mapping mapping_table[],
--			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
--			      char nvram_name[BRCMF_FW_NAME_LEN]);
- void brcmf_fw_nvram_free(void *nvram);
- 
- enum brcmf_fw_type {
diff --git a/package/kernel/mac80211/patches/327-v4.17-0011-brcmfmac-get-rid-of-brcmf_fw_get_full_name.patch b/package/kernel/mac80211/patches/327-v4.17-0011-brcmfmac-get-rid-of-brcmf_fw_get_full_name.patch
deleted file mode 100644
index d831f44fc..000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0011-brcmfmac-get-rid-of-brcmf_fw_get_full_name.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From bf291b7247e53f52a4236c0b55a5df046d6177df Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:30 +0100
-Subject: [PATCH] brcmfmac: get rid of brcmf_fw_get_full_name()
-
-The function was pretty minimal and now it is called only from one
-place so just get rid of it.
-
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/firmware.c    | 14 ++++----------
- 1 file changed, 4 insertions(+), 10 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -628,13 +628,6 @@ int brcmf_fw_get_firmwares(struct device
- 	return 0;
- }
- 
--static void brcmf_fw_get_full_name(char fw_name[BRCMF_FW_NAME_LEN],
--				   const char *fw_base, const char *extension)
--{
--	strlcat(fw_name, fw_base, BRCMF_FW_NAME_LEN);
--	strlcat(fw_name, extension, BRCMF_FW_NAME_LEN);
--}
--
- struct brcmf_fw_request *
- brcmf_fw_alloc_request(u32 chip, u32 chiprev,
- 		       struct brcmf_firmware_mapping mapping_table[],
-@@ -685,9 +678,10 @@ brcmf_fw_alloc_request(u32 chip, u32 chi
- 					BRCMF_FW_NAME_LEN);
- 			}
- 		}
--		brcmf_fw_get_full_name(fwnames[j].path,
--				       mapping_table[i].fw_base,
--				       fwnames[j].extension);
-+		strlcat(fwnames[j].path, mapping_table[i].fw_base,
-+			BRCMF_FW_NAME_LEN);
-+		strlcat(fwnames[j].path, fwnames[j].extension,
-+			BRCMF_FW_NAME_LEN);
- 		fwreq->items[j].path = fwnames[j].path;
- 	}
- 
diff --git a/package/kernel/mac80211/patches/327-v4.17-0012-brcmfmac-add-kerneldoc-for-struct-brcmf_bus-msgbuf.patch b/package/kernel/mac80211/patches/327-v4.17-0012-brcmfmac-add-kerneldoc-for-struct-brcmf_bus-msgbuf.patch
deleted file mode 100644
index 1c9c99599..000000000
--- a/package/kernel/mac80211/patches/327-v4.17-0012-brcmfmac-add-kerneldoc-for-struct-brcmf_bus-msgbuf.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From 48eaee3f272a5bfe6986d07c51f6975d3c2f74d1 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 22 Mar 2018 21:28:31 +0100
-Subject: [PATCH] brcmfmac: add kerneldoc for struct brcmf_bus::msgbuf
-
-This field did not have kerneldoc description so adding it now.
-
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -140,6 +140,7 @@ struct brcmf_bus_stats {
-  * @always_use_fws_queue: bus wants use queue also when fwsignal is inactive.
-  * @wowl_supported: is wowl supported by bus driver.
-  * @chiprev: revision of the dongle chip.
-+ * @msgbuf: msgbuf protocol parameters provided by bus layer.
-  */
- struct brcmf_bus {
- 	union {
diff --git a/package/kernel/mac80211/patches/328-v4.17-0001-brcmfmac-fix-firmware-request-processing-if-nvram-lo.patch b/package/kernel/mac80211/patches/328-v4.17-0001-brcmfmac-fix-firmware-request-processing-if-nvram-lo.patch
deleted file mode 100644
index cd2279dd6..000000000
--- a/package/kernel/mac80211/patches/328-v4.17-0001-brcmfmac-fix-firmware-request-processing-if-nvram-lo.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From 0b5c0305e57ca940713bcb2b202fd2b412c62f31 Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Tue, 3 Apr 2018 10:18:15 +0200
-Subject: [PATCH] brcmfmac: fix firmware request processing if nvram load fails
-
-When nvram loading fails a double free occurred. Fix this and reorg the
-code a little.
-
-Fixes: d09ae51a4b67 ("brcmfmac: pass struct in brcmf_fw_get_firmwares()")
-Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/firmware.c         | 36 ++++++++++++----------
- 1 file changed, 20 insertions(+), 16 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -459,7 +459,7 @@ static void brcmf_fw_free_request(struct
- 	kfree(req);
- }
- 
--static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
-+static int brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
- {
- 	struct brcmf_fw *fwctx = ctx;
- 	struct brcmf_fw_item *cur;
-@@ -498,13 +498,10 @@ static void brcmf_fw_request_nvram_done(
- 	brcmf_dbg(TRACE, "nvram %p len %d\n", nvram, nvram_length);
- 	cur->nv_data.data = nvram;
- 	cur->nv_data.len = nvram_length;
--	return;
-+	return 0;
- 
- fail:
--	brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
--	fwctx->done(fwctx->dev, -ENOENT, NULL);
--	brcmf_fw_free_request(fwctx->req);
--	kfree(fwctx);
-+	return -ENOENT;
- }
- 
- static int brcmf_fw_request_next_item(struct brcmf_fw *fwctx, bool async)
-@@ -553,20 +550,27 @@ static void brcmf_fw_request_done(const
- 	brcmf_dbg(TRACE, "enter: firmware %s %sfound\n", cur->path,
- 		  fw ? "" : "not ");
- 
--	if (fw) {
--		if (cur->type == BRCMF_FW_TYPE_BINARY)
--			cur->binary = fw;
--		else if (cur->type == BRCMF_FW_TYPE_NVRAM)
--			brcmf_fw_request_nvram_done(fw, fwctx);
--		else
--			release_firmware(fw);
--	} else if (cur->type == BRCMF_FW_TYPE_NVRAM) {
--		brcmf_fw_request_nvram_done(NULL, fwctx);
--	} else if (!(cur->flags & BRCMF_FW_REQF_OPTIONAL)) {
-+	if (!fw)
- 		ret = -ENOENT;
-+
-+	switch (cur->type) {
-+	case BRCMF_FW_TYPE_NVRAM:
-+		ret = brcmf_fw_request_nvram_done(fw, fwctx);
-+		break;
-+	case BRCMF_FW_TYPE_BINARY:
-+		cur->binary = fw;
-+		break;
-+	default:
-+		/* something fishy here so bail out early */
-+		brcmf_err("unknown fw type: %d\n", cur->type);
-+		release_firmware(fw);
-+		ret = -EINVAL;
- 		goto fail;
- 	}
- 
-+	if (ret < 0 && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
-+		goto fail;
-+
- 	do {
- 		if (++fwctx->curpos == fwctx->req->n_items) {
- 			ret = 0;
diff --git a/package/kernel/mac80211/patches/329-v4.18-0001-brcmfmac-add-support-for-BCM4366E-chipset.patch b/package/kernel/mac80211/patches/329-v4.18-0001-brcmfmac-add-support-for-BCM4366E-chipset.patch
deleted file mode 100644
index e31d69826..000000000
--- a/package/kernel/mac80211/patches/329-v4.18-0001-brcmfmac-add-support-for-BCM4366E-chipset.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 1f589e2510d5df1192dca7c089103a2cbd028101 Mon Sep 17 00:00:00 2001
-From: Dan Haab <dhaab@luxul.com>
-Date: Tue, 3 Apr 2018 10:21:56 +0200
-Subject: [PATCH] brcmfmac: add support for BCM4366E chipset
-
-BCM4366E is a wireless chipset with a BCM43664 ChipCommon. It's
-supported by the same firmware as 4366c0.
-
-Signed-off-by: Dan Haab <dan.haab@luxul.com>
-[arend: rebase patch and remove unnecessary definition]
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c       | 1 +
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c       | 1 +
- drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 1 +
- 3 files changed, 3 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
-@@ -689,6 +689,7 @@ static u32 brcmf_chip_tcm_rambase(struct
- 	case BRCM_CC_43525_CHIP_ID:
- 	case BRCM_CC_4365_CHIP_ID:
- 	case BRCM_CC_4366_CHIP_ID:
-+	case BRCM_CC_43664_CHIP_ID:
- 		return 0x200000;
- 	case CY_CC_4373_CHIP_ID:
- 		return 0x160000;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -75,6 +75,7 @@ static struct brcmf_firmware_mapping brc
- 	BRCMF_FW_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFF0, 4365C),
- 	BRCMF_FW_ENTRY(BRCM_CC_4366_CHIP_ID, 0x0000000F, 4366B),
- 	BRCMF_FW_ENTRY(BRCM_CC_4366_CHIP_ID, 0xFFFFFFF0, 4366C),
-+	BRCMF_FW_ENTRY(BRCM_CC_43664_CHIP_ID, 0xFFFFFFF0, 4366C),
- 	BRCMF_FW_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371),
- };
- 
---- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
-@@ -57,6 +57,7 @@
- #define BRCM_CC_43602_CHIP_ID		43602
- #define BRCM_CC_4365_CHIP_ID		0x4365
- #define BRCM_CC_4366_CHIP_ID		0x4366
-+#define BRCM_CC_43664_CHIP_ID		43664
- #define BRCM_CC_4371_CHIP_ID		0x4371
- #define CY_CC_4373_CHIP_ID		0x4373
- 
diff --git a/package/kernel/mac80211/patches/330-v4.18-0001-brcmfmac-check-p2pdev-mac-address-uniqueness.patch b/package/kernel/mac80211/patches/330-v4.18-0001-brcmfmac-check-p2pdev-mac-address-uniqueness.patch
deleted file mode 100644
index 909000cc5..000000000
--- a/package/kernel/mac80211/patches/330-v4.18-0001-brcmfmac-check-p2pdev-mac-address-uniqueness.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From cb746e47837ad0f35c8ae28e9aacc8eb07916d2a Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 26 Apr 2018 12:16:47 +0200
-Subject: [PATCH] brcmfmac: check p2pdev mac address uniqueness
-
-The mac address for p2pdev must be different from the primary interface
-due to firmware requirement. Add an explicit check for this requirement
-if user-space provides a mac address.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -2073,6 +2073,13 @@ static struct wireless_dev *brcmf_p2p_cr
- 	}
- 
- 	pri_ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
-+
-+	/* firmware requires unique mac address for p2pdev interface */
-+	if (addr && ether_addr_equal(addr, pri_ifp->mac_addr)) {
-+		brcmf_err("discovery vif must be different from primary interface\n");
-+		return ERR_PTR(-EINVAL);
-+	}
-+
- 	brcmf_p2p_generate_bss_mac(p2p, addr);
- 	brcmf_p2p_set_firmware(pri_ifp, p2p->dev_addr);
- 
diff --git a/package/kernel/mac80211/patches/330-v4.18-0002-brcmfmac-reports-boottime_ns-while-informing-bss.patch b/package/kernel/mac80211/patches/330-v4.18-0002-brcmfmac-reports-boottime_ns-while-informing-bss.patch
deleted file mode 100644
index 4f59507ca..000000000
--- a/package/kernel/mac80211/patches/330-v4.18-0002-brcmfmac-reports-boottime_ns-while-informing-bss.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 7742fce4c007141617dab9bcb90034b3c0fe2347 Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Thu, 26 Apr 2018 12:18:35 +0200
-Subject: [PATCH] brcmfmac: reports boottime_ns while informing bss
-
-Provides a timestamp in bss information so user space can see when the
-bss info was updated. Since tsf is not available from the dongle events
-boottime is reported instead.
-
-Reported-by: Dmitry Shmidt <dimitrysh@google.com>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 26 +++++++++++-----------
- 1 file changed, 13 insertions(+), 13 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2728,7 +2728,6 @@ static s32 brcmf_inform_single_bss(struc
- 				   struct brcmf_bss_info_le *bi)
- {
- 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
--	struct ieee80211_channel *notify_channel;
- 	struct cfg80211_bss *bss;
- 	struct ieee80211_supported_band *band;
- 	struct brcmu_chan ch;
-@@ -2738,7 +2737,7 @@ static s32 brcmf_inform_single_bss(struc
- 	u16 notify_interval;
- 	u8 *notify_ie;
- 	size_t notify_ielen;
--	s32 notify_signal;
-+	struct cfg80211_inform_bss bss_data = { 0 };
- 
- 	if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
- 		brcmf_err("Bss info is larger than buffer. Discarding\n");
-@@ -2758,27 +2757,28 @@ static s32 brcmf_inform_single_bss(struc
- 		band = wiphy->bands[NL80211_BAND_5GHZ];
- 
- 	freq = ieee80211_channel_to_frequency(channel, band->band);
--	notify_channel = ieee80211_get_channel(wiphy, freq);
-+	bss_data.chan = ieee80211_get_channel(wiphy, freq);
-+	bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
-+	bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
- 
- 	notify_capability = le16_to_cpu(bi->capability);
- 	notify_interval = le16_to_cpu(bi->beacon_period);
- 	notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
- 	notify_ielen = le32_to_cpu(bi->ie_length);
--	notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
-+	bss_data.signal = (s16)le16_to_cpu(bi->RSSI) * 100;
- 
- 	brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
- 	brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
- 	brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
- 	brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
--	brcmf_dbg(CONN, "Signal: %d\n", notify_signal);
-+	brcmf_dbg(CONN, "Signal: %d\n", bss_data.signal);
- 
--	bss = cfg80211_inform_bss(wiphy, notify_channel,
--				  CFG80211_BSS_FTYPE_UNKNOWN,
--				  (const u8 *)bi->BSSID,
--				  0, notify_capability,
--				  notify_interval, notify_ie,
--				  notify_ielen, notify_signal,
--				  GFP_KERNEL);
-+	bss = cfg80211_inform_bss_data(wiphy, &bss_data,
-+				       CFG80211_BSS_FTYPE_UNKNOWN,
-+				       (const u8 *)bi->BSSID,
-+				       0, notify_capability,
-+				       notify_interval, notify_ie,
-+				       notify_ielen, GFP_KERNEL);
- 
- 	if (!bss)
- 		return -ENOMEM;
diff --git a/package/kernel/mac80211/patches/330-v4.18-0003-brcmfmac-use-nl80211_band-directly-to-get-ieee80211-.patch b/package/kernel/mac80211/patches/330-v4.18-0003-brcmfmac-use-nl80211_band-directly-to-get-ieee80211-.patch
deleted file mode 100644
index 2d60c0d9e..000000000
--- a/package/kernel/mac80211/patches/330-v4.18-0003-brcmfmac-use-nl80211_band-directly-to-get-ieee80211-.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From aed14219067ab96e5eeb7730e9bceed10d9be989 Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Thu, 26 Apr 2018 12:16:48 +0200
-Subject: [PATCH] brcmfmac: use nl80211_band directly to get ieee80211 channel
-
-The enum nl80211_band used to retrieve wiphy->bands is the same as
-wiphy->bands->band which is checked by wiphy_register(). So it can be used
-directly as parameter of ieee80211_channel_to_frequency().
-
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2729,7 +2729,7 @@ static s32 brcmf_inform_single_bss(struc
- {
- 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
- 	struct cfg80211_bss *bss;
--	struct ieee80211_supported_band *band;
-+	enum nl80211_band band;
- 	struct brcmu_chan ch;
- 	u16 channel;
- 	u32 freq;
-@@ -2752,11 +2752,11 @@ static s32 brcmf_inform_single_bss(struc
- 	channel = bi->ctl_ch;
- 
- 	if (channel <= CH_MAX_2G_CHANNEL)
--		band = wiphy->bands[NL80211_BAND_2GHZ];
-+		band = NL80211_BAND_2GHZ;
- 	else
--		band = wiphy->bands[NL80211_BAND_5GHZ];
-+		band = NL80211_BAND_5GHZ;
- 
--	freq = ieee80211_channel_to_frequency(channel, band->band);
-+	freq = ieee80211_channel_to_frequency(channel, band);
- 	bss_data.chan = ieee80211_get_channel(wiphy, freq);
- 	bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
- 	bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
diff --git a/package/kernel/mac80211/patches/330-v4.18-0004-brcmfmac-constify-firmware-mapping-tables.patch b/package/kernel/mac80211/patches/330-v4.18-0004-brcmfmac-constify-firmware-mapping-tables.patch
deleted file mode 100644
index df2648374..000000000
--- a/package/kernel/mac80211/patches/330-v4.18-0004-brcmfmac-constify-firmware-mapping-tables.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From ff68c9f9c06d1fd437c8f90fc05ca28c47f7d85e Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Thu, 26 Apr 2018 12:16:49 +0200
-Subject: [PATCH] brcmfmac: constify firmware mapping tables
-
-The information in the firmware mapping does not need to be modified
-so it can be static const.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 2 +-
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h | 2 +-
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c     | 2 +-
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c     | 2 +-
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c      | 2 +-
- 5 files changed, 5 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -634,7 +634,7 @@ int brcmf_fw_get_firmwares(struct device
- 
- struct brcmf_fw_request *
- brcmf_fw_alloc_request(u32 chip, u32 chiprev,
--		       struct brcmf_firmware_mapping mapping_table[],
-+		       const struct brcmf_firmware_mapping mapping_table[],
- 		       u32 table_size, struct brcmf_fw_name *fwnames,
- 		       u32 n_fwnames)
- {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
-@@ -80,7 +80,7 @@ struct brcmf_fw_name {
- 
- struct brcmf_fw_request *
- brcmf_fw_alloc_request(u32 chip, u32 chiprev,
--		       struct brcmf_firmware_mapping mapping_table[],
-+		       const struct brcmf_firmware_mapping mapping_table[],
- 		       u32 table_size, struct brcmf_fw_name *fwnames,
- 		       u32 n_fwnames);
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -59,7 +59,7 @@ BRCMF_FW_DEF(4366B, "brcmfmac4366b-pcie"
- BRCMF_FW_DEF(4366C, "brcmfmac4366c-pcie");
- BRCMF_FW_DEF(4371, "brcmfmac4371-pcie");
- 
--static struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
-+static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
- 	BRCMF_FW_ENTRY(BRCM_CC_43602_CHIP_ID, 0xFFFFFFFF, 43602),
- 	BRCMF_FW_ENTRY(BRCM_CC_43465_CHIP_ID, 0xFFFFFFF0, 4366C),
- 	BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0x000000FF, 4350C),
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -619,7 +619,7 @@ BRCMF_FW_DEF(4354, "brcmfmac4354-sdio");
- BRCMF_FW_DEF(4356, "brcmfmac4356-sdio");
- BRCMF_FW_DEF(4373, "brcmfmac4373-sdio");
- 
--static struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
-+static const struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
- 	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
- 	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x0000001F, 43241B0),
- 	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x00000020, 43241B4),
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -52,7 +52,7 @@ BRCMF_FW_DEF(43242A, "brcmfmac43242a");
- BRCMF_FW_DEF(43569, "brcmfmac43569");
- BRCMF_FW_DEF(4373, "brcmfmac4373");
- 
--static struct brcmf_firmware_mapping brcmf_usb_fwnames[] = {
-+static const struct brcmf_firmware_mapping brcmf_usb_fwnames[] = {
- 	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
- 	BRCMF_FW_ENTRY(BRCM_CC_43235_CHIP_ID, 0x00000008, 43236B),
- 	BRCMF_FW_ENTRY(BRCM_CC_43236_CHIP_ID, 0x00000008, 43236B),
diff --git a/package/kernel/mac80211/patches/330-v4.18-0005-brcmfmac-add-hostready-indication.patch b/package/kernel/mac80211/patches/330-v4.18-0005-brcmfmac-add-hostready-indication.patch
deleted file mode 100644
index e3d4441f7..000000000
--- a/package/kernel/mac80211/patches/330-v4.18-0005-brcmfmac-add-hostready-indication.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 84ad327d18debe19b8d509059b61db445d048b02 Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Thu, 26 Apr 2018 12:16:50 +0200
-Subject: [PATCH] brcmfmac: add hostready indication
-
-A hostready signal is introduced to inform firmware through mailbox
-doorbell1 when common ring initialized or D3 exited.
-
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 14 ++++++++++++--
- 1 file changed, 12 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -105,7 +105,8 @@ static const struct brcmf_firmware_mappi
- #define BRCMF_PCIE_PCIE2REG_MAILBOXMASK		0x4C
- #define BRCMF_PCIE_PCIE2REG_CONFIGADDR		0x120
- #define BRCMF_PCIE_PCIE2REG_CONFIGDATA		0x124
--#define BRCMF_PCIE_PCIE2REG_H2D_MAILBOX		0x140
-+#define BRCMF_PCIE_PCIE2REG_H2D_MAILBOX_0	0x140
-+#define BRCMF_PCIE_PCIE2REG_H2D_MAILBOX_1	0x144
- 
- #define BRCMF_PCIE2_INTA			0x01
- #define BRCMF_PCIE2_INTB			0x02
-@@ -140,6 +141,7 @@ static const struct brcmf_firmware_mappi
- #define BRCMF_PCIE_SHARED_VERSION_MASK		0x00FF
- #define BRCMF_PCIE_SHARED_DMA_INDEX		0x10000
- #define BRCMF_PCIE_SHARED_DMA_2B_IDX		0x100000
-+#define BRCMF_PCIE_SHARED_HOSTRDY_DB1		0x10000000
- 
- #define BRCMF_PCIE_FLAGS_HTOD_SPLIT		0x4000
- #define BRCMF_PCIE_FLAGS_DTOH_SPLIT		0x8000
-@@ -782,6 +784,12 @@ static void brcmf_pcie_intr_enable(struc
- 			       BRCMF_PCIE_MB_INT_FN0_1);
- }
- 
-+static void brcmf_pcie_hostready(struct brcmf_pciedev_info *devinfo)
-+{
-+	if (devinfo->shared.flags & BRCMF_PCIE_SHARED_HOSTRDY_DB1)
-+		brcmf_pcie_write_reg32(devinfo,
-+				       BRCMF_PCIE_PCIE2REG_H2D_MAILBOX_1, 1);
-+}
- 
- static irqreturn_t brcmf_pcie_quick_check_isr(int irq, void *arg)
- {
-@@ -924,7 +932,7 @@ static int brcmf_pcie_ring_mb_ring_bell(
- 
- 	brcmf_dbg(PCIE, "RING !\n");
- 	/* Any arbitrary value will do, lets use 1 */
--	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_H2D_MAILBOX, 1);
-+	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_H2D_MAILBOX_0, 1);
- 
- 	return 0;
- }
-@@ -1728,6 +1736,7 @@ static void brcmf_pcie_setup(struct devi
- 	init_waitqueue_head(&devinfo->mbdata_resp_wait);
- 
- 	brcmf_pcie_intr_enable(devinfo);
-+	brcmf_pcie_hostready(devinfo);
- 	if (brcmf_attach(&devinfo->pdev->dev, devinfo->settings) == 0)
- 		return;
- 
-@@ -1950,6 +1959,7 @@ static int brcmf_pcie_pm_leave_D3(struct
- 		brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
- 		brcmf_bus_change_state(bus, BRCMF_BUS_UP);
- 		brcmf_pcie_intr_enable(devinfo);
-+		brcmf_pcie_hostready(devinfo);
- 		return 0;
- 	}
- 
diff --git a/package/kernel/mac80211/patches/330-v4.18-0006-brcmfmac-coarse-support-for-PCIe-shared-structure-re.patch b/package/kernel/mac80211/patches/330-v4.18-0006-brcmfmac-coarse-support-for-PCIe-shared-structure-re.patch
deleted file mode 100644
index 8750037d8..000000000
--- a/package/kernel/mac80211/patches/330-v4.18-0006-brcmfmac-coarse-support-for-PCIe-shared-structure-re.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From f56324baf329bc9362a52ad77a4a1a0f3356d1bc Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Thu, 26 Apr 2018 12:16:51 +0200
-Subject: [PATCH] brcmfmac: coarse support for PCIe shared structure rev7
-
-Revision 7 of PCIe dongle interface increases the item size of tx and rx
-complete rings to accommodate extra payload for new feature. This patch
-simply bump up the size of these two rings without adding the support
-for utilizing the new space. This makes brcmfmac compatible with rev7
-firmware.
-
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.h  |  6 ++++--
- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    | 23 ++++++++++++++++++----
- 2 files changed, 23 insertions(+), 6 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
-@@ -27,8 +27,10 @@
- #define BRCMF_H2D_MSGRING_CONTROL_SUBMIT_ITEMSIZE	40
- #define BRCMF_H2D_MSGRING_RXPOST_SUBMIT_ITEMSIZE	32
- #define BRCMF_D2H_MSGRING_CONTROL_COMPLETE_ITEMSIZE	24
--#define BRCMF_D2H_MSGRING_TX_COMPLETE_ITEMSIZE		16
--#define BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE		32
-+#define BRCMF_D2H_MSGRING_TX_COMPLETE_ITEMSIZE_PRE_V7	16
-+#define BRCMF_D2H_MSGRING_TX_COMPLETE_ITEMSIZE		24
-+#define BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE_PRE_V7	32
-+#define BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE		40
- #define BRCMF_H2D_TXFLOWRING_ITEMSIZE			48
- 
- struct msgbuf_buf_addr {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -136,8 +136,9 @@ static const struct brcmf_firmware_mappi
- 						 BRCMF_PCIE_MB_INT_D2H3_DB0 | \
- 						 BRCMF_PCIE_MB_INT_D2H3_DB1)
- 
-+#define BRCMF_PCIE_SHARED_VERSION_7		7
- #define BRCMF_PCIE_MIN_SHARED_VERSION		5
--#define BRCMF_PCIE_MAX_SHARED_VERSION		6
-+#define BRCMF_PCIE_MAX_SHARED_VERSION		BRCMF_PCIE_SHARED_VERSION_7
- #define BRCMF_PCIE_SHARED_VERSION_MASK		0x00FF
- #define BRCMF_PCIE_SHARED_DMA_INDEX		0x10000
- #define BRCMF_PCIE_SHARED_DMA_2B_IDX		0x100000
-@@ -318,6 +319,14 @@ static const u32 brcmf_ring_max_item[BRC
- 	BRCMF_D2H_MSGRING_RX_COMPLETE_MAX_ITEM
- };
- 
-+static const u32 brcmf_ring_itemsize_pre_v7[BRCMF_NROF_COMMON_MSGRINGS] = {
-+	BRCMF_H2D_MSGRING_CONTROL_SUBMIT_ITEMSIZE,
-+	BRCMF_H2D_MSGRING_RXPOST_SUBMIT_ITEMSIZE,
-+	BRCMF_D2H_MSGRING_CONTROL_COMPLETE_ITEMSIZE,
-+	BRCMF_D2H_MSGRING_TX_COMPLETE_ITEMSIZE_PRE_V7,
-+	BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE_PRE_V7
-+};
-+
- static const u32 brcmf_ring_itemsize[BRCMF_NROF_COMMON_MSGRINGS] = {
- 	BRCMF_H2D_MSGRING_CONTROL_SUBMIT_ITEMSIZE,
- 	BRCMF_H2D_MSGRING_RXPOST_SUBMIT_ITEMSIZE,
-@@ -1007,8 +1016,14 @@ brcmf_pcie_alloc_dma_and_ring(struct brc
- 	struct brcmf_pcie_ringbuf *ring;
- 	u32 size;
- 	u32 addr;
-+	const u32 *ring_itemsize_array;
-+
-+	if (devinfo->shared.version < BRCMF_PCIE_SHARED_VERSION_7)
-+		ring_itemsize_array = brcmf_ring_itemsize_pre_v7;
-+	else
-+		ring_itemsize_array = brcmf_ring_itemsize;
- 
--	size = brcmf_ring_max_item[ring_id] * brcmf_ring_itemsize[ring_id];
-+	size = brcmf_ring_max_item[ring_id] * ring_itemsize_array[ring_id];
- 	dma_buf = brcmf_pcie_init_dmabuffer_for_device(devinfo, size,
- 			tcm_ring_phys_addr + BRCMF_RING_MEM_BASE_ADDR_OFFSET,
- 			&dma_handle);
-@@ -1018,7 +1033,7 @@ brcmf_pcie_alloc_dma_and_ring(struct brc
- 	addr = tcm_ring_phys_addr + BRCMF_RING_MAX_ITEM_OFFSET;
- 	brcmf_pcie_write_tcm16(devinfo, addr, brcmf_ring_max_item[ring_id]);
- 	addr = tcm_ring_phys_addr + BRCMF_RING_LEN_ITEMS_OFFSET;
--	brcmf_pcie_write_tcm16(devinfo, addr, brcmf_ring_itemsize[ring_id]);
-+	brcmf_pcie_write_tcm16(devinfo, addr, ring_itemsize_array[ring_id]);
- 
- 	ring = kzalloc(sizeof(*ring), GFP_KERNEL);
- 	if (!ring) {
-@@ -1027,7 +1042,7 @@ brcmf_pcie_alloc_dma_and_ring(struct brc
- 		return NULL;
- 	}
- 	brcmf_commonring_config(&ring->commonring, brcmf_ring_max_item[ring_id],
--				brcmf_ring_itemsize[ring_id], dma_buf);
-+				ring_itemsize_array[ring_id], dma_buf);
- 	ring->dma_handle = dma_handle;
- 	ring->devinfo = devinfo;
- 	brcmf_commonring_register_cb(&ring->commonring,
diff --git a/package/kernel/mac80211/patches/331-v4.18-0001-brcmfmac-Add-support-for-bcm43364-wireless-chipset.patch b/package/kernel/mac80211/patches/331-v4.18-0001-brcmfmac-Add-support-for-bcm43364-wireless-chipset.patch
deleted file mode 100644
index 13f169be9..000000000
--- a/package/kernel/mac80211/patches/331-v4.18-0001-brcmfmac-Add-support-for-bcm43364-wireless-chipset.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 9c4a121e82634aa000a702c98cd6f05b27d6e186 Mon Sep 17 00:00:00 2001
-From: Sean Lanigan <sean@lano.id.au>
-Date: Fri, 4 May 2018 16:48:23 +1000
-Subject: [PATCH] brcmfmac: Add support for bcm43364 wireless chipset
-
-Add support for the BCM43364 chipset via an SDIO interface, as used in
-e.g. the Murata 1FX module.
-
-The BCM43364 uses the same firmware as the BCM43430 (which is already
-included), the only difference is the omission of Bluetooth.
-
-However, the SDIO_ID for the BCM43364 is 02D0:A9A4, giving it a MODALIAS
-of sdio:c00v02D0dA9A4, which doesn't get recognised and hence doesn't
-load the brcmfmac module. Adding the 'A9A4' ID in the appropriate place
-triggers the brcmfmac driver to load, and then correctly use the
-firmware file 'brcmfmac43430-sdio.bin'.
-
-Signed-off-by: Sean Lanigan <sean@lano.id.au>
-Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 1 +
- include/linux/mmc/sdio_ids.h                              | 1 +
- 2 files changed, 2 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -963,6 +963,7 @@ static const struct sdio_device_id brcmf
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43340),
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341),
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362),
-+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43364),
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339),
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4339),
- 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43430),
---- a/include/linux/mmc/sdio_ids.h
-+++ b/include/linux/mmc/sdio_ids.h
-@@ -34,6 +34,7 @@
- #define SDIO_DEVICE_ID_BROADCOM_4335_4339	0x4335
- #define SDIO_DEVICE_ID_BROADCOM_4339		0x4339
- #define SDIO_DEVICE_ID_BROADCOM_43362		0xa962
-+#define SDIO_DEVICE_ID_BROADCOM_43364		0xa9a4
- #define SDIO_DEVICE_ID_BROADCOM_43430		0xa9a6
- #define SDIO_DEVICE_ID_BROADCOM_4345		0x4345
- #define SDIO_DEVICE_ID_BROADCOM_43455		0xa9bf
diff --git a/package/kernel/mac80211/patches/332-v4.18-0001-brcmfmac-set-WIPHY_FLAG_HAVE_AP_SME-flag.patch b/package/kernel/mac80211/patches/332-v4.18-0001-brcmfmac-set-WIPHY_FLAG_HAVE_AP_SME-flag.patch
deleted file mode 100644
index de41e1c45..000000000
--- a/package/kernel/mac80211/patches/332-v4.18-0001-brcmfmac-set-WIPHY_FLAG_HAVE_AP_SME-flag.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 1204aa17f3b4f63e67ac9b7c9afa9496485969c5 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Thu, 10 May 2018 15:21:39 +0200
-Subject: [PATCH] brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-brcmfmac is a FullMAC driver and it implements/uses cfg80211 interface
-for stations management. At the same time it doesn't receive or pass up
-management frames.
-
-This flag indicates that authenticator doesn't have to subscribe to or
-handle management frames. Some authenticators (e.g. hostapd) were
-working with brcmfmac thanks to some extra assumptions. This commit
-clears up the situation.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6513,6 +6513,7 @@ static int brcmf_setup_wiphy(struct wiph
- 
- 	wiphy->flags |= WIPHY_FLAG_NETNS_OK |
- 			WIPHY_FLAG_PS_ON_BY_DEFAULT |
-+			WIPHY_FLAG_HAVE_AP_SME |
- 			WIPHY_FLAG_OFFCHAN_TX |
- 			WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
- 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
diff --git a/package/kernel/mac80211/patches/333-v4.18-0001-brcmfmac-fix-initialization-of-struct-cfg80211_infor.patch b/package/kernel/mac80211/patches/333-v4.18-0001-brcmfmac-fix-initialization-of-struct-cfg80211_infor.patch
deleted file mode 100644
index 2436bb8a8..000000000
--- a/package/kernel/mac80211/patches/333-v4.18-0001-brcmfmac-fix-initialization-of-struct-cfg80211_infor.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 763ece85f45a6b93268e25a0abf02922f911dab4 Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Tue, 15 May 2018 11:14:44 +0200
-Subject: [PATCH] brcmfmac: fix initialization of struct cfg80211_inform_bss
- variable
-
-This patch fixes a sparse warning "Using plain integer as NULL pointer"
-about cfg80211_inform_bss structure initialization.
-
-Reported-by: kbuild test robot <lkp@intel.com>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2737,7 +2737,7 @@ static s32 brcmf_inform_single_bss(struc
- 	u16 notify_interval;
- 	u8 *notify_ie;
- 	size_t notify_ielen;
--	struct cfg80211_inform_bss bss_data = { 0 };
-+	struct cfg80211_inform_bss bss_data = {};
- 
- 	if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
- 		brcmf_err("Bss info is larger than buffer. Discarding\n");
diff --git a/package/kernel/mac80211/patches/334-v4.18-0001-brcmfmac-add-debugfs-entry-for-reading-firmware-capa.patch b/package/kernel/mac80211/patches/334-v4.18-0001-brcmfmac-add-debugfs-entry-for-reading-firmware-capa.patch
deleted file mode 100644
index f350d1e81..000000000
--- a/package/kernel/mac80211/patches/334-v4.18-0001-brcmfmac-add-debugfs-entry-for-reading-firmware-capa.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 88001968245c42c26416476bf0ef960442371605 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Mon, 14 May 2018 08:48:20 +0200
-Subject: [PATCH] brcmfmac: add debugfs entry for reading firmware capabilities
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This allows reading all capabilities as reported by a firmware. They are
-printed using native (raw) names, just like developers like it the most.
-It's how firmware reports support for various features, e.g. supported
-modes, supported standards, power saving details, max BSS-es.
-
-Access to all that info is useful for trying new firmwares, comparing
-them and debugging features AKA bugs.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/feature.c | 36 ++++++++++++++++++++++
- 1 file changed, 36 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -165,6 +165,41 @@ static void brcmf_feat_firmware_capabili
- 	}
- }
- 
-+/**
-+ * brcmf_feat_fwcap_debugfs_read() - expose firmware capabilities to debugfs.
-+ *
-+ * @seq: sequence for debugfs entry.
-+ * @data: raw data pointer.
-+ */
-+static int brcmf_feat_fwcap_debugfs_read(struct seq_file *seq, void *data)
-+{
-+	struct brcmf_bus *bus_if = dev_get_drvdata(seq->private);
-+	struct brcmf_if *ifp = brcmf_get_ifp(bus_if->drvr, 0);
-+	char caps[MAX_CAPS_BUFFER_SIZE + 1] = { };
-+	char *tmp;
-+	int err;
-+
-+	err = brcmf_fil_iovar_data_get(ifp, "cap", caps, sizeof(caps));
-+	if (err) {
-+		brcmf_err("could not get firmware cap (%d)\n", err);
-+		return err;
-+	}
-+
-+	/* Put every capability in a new line */
-+	for (tmp = caps; *tmp; tmp++) {
-+		if (*tmp == ' ')
-+			*tmp = '\n';
-+	}
-+
-+	/* Usually there is a space at the end of capabilities string */
-+	seq_printf(seq, "%s", caps);
-+	/* So make sure we don't print two line breaks */
-+	if (tmp > caps && *(tmp - 1) != '\n')
-+		seq_printf(seq, "\n");
-+
-+	return 0;
-+}
-+
- void brcmf_feat_attach(struct brcmf_pub *drvr)
- {
- 	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
-@@ -233,6 +268,7 @@ void brcmf_feat_attach(struct brcmf_pub
- void brcmf_feat_debugfs_create(struct brcmf_pub *drvr)
- {
- 	brcmf_debugfs_add_entry(drvr, "features", brcmf_feat_debugfs_read);
-+	brcmf_debugfs_add_entry(drvr, "fwcap", brcmf_feat_fwcap_debugfs_read);
- }
- 
- bool brcmf_feat_is_enabled(struct brcmf_if *ifp, enum brcmf_feat_id id)
diff --git a/package/kernel/mac80211/patches/335-v4.18-0001-brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch b/package/kernel/mac80211/patches/335-v4.18-0001-brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch
deleted file mode 100644
index f353a60b8..000000000
--- a/package/kernel/mac80211/patches/335-v4.18-0001-brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From f8793c26fe586659d6da3fa277e63961a69d314b Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 16 May 2018 14:11:58 +0200
-Subject: [PATCH] brcmfmac: move ALLFFMAC variable in flowring module
-
-The only user of ALLFFMAC is the flowring module so no need to
-expose it in a header file.
-
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c   | 2 --
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h   | 2 --
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c | 2 ++
- 3 files changed, 2 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -36,8 +36,6 @@ MODULE_AUTHOR("Broadcom Corporation");
- MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
- MODULE_LICENSE("Dual BSD/GPL");
- 
--const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
--
- #define BRCMF_DEFAULT_SCAN_CHANNEL_TIME	40
- #define BRCMF_DEFAULT_SCAN_UNASSOC_TIME	40
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
-@@ -19,8 +19,6 @@
- #include <linux/platform_data/brcmfmac.h>
- #include "fwil_types.h"
- 
--extern const u8 ALLFFMAC[ETH_ALEN];
--
- #define BRCMF_FW_ALTPATH_LEN			256
- 
- /* Definitions for the module global and device specific settings are defined
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-@@ -46,6 +46,8 @@ static const u8 brcmf_flowring_prio2fifo
- 	3
- };
- 
-+static const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-+
- 
- static bool
- brcmf_flowring_is_tdls_mac(struct brcmf_flowring *flow, u8 mac[ETH_ALEN])
diff --git a/package/kernel/mac80211/patches/335-v4.18-0002-brcmfmac-add-support-for-sysfs-initiated-coredump.patch b/package/kernel/mac80211/patches/335-v4.18-0002-brcmfmac-add-support-for-sysfs-initiated-coredump.patch
deleted file mode 100644
index 86533b95b..000000000
--- a/package/kernel/mac80211/patches/335-v4.18-0002-brcmfmac-add-support-for-sysfs-initiated-coredump.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 8e072168f75ebce85b96cbcefea2b10ddbd5913f Mon Sep 17 00:00:00 2001
-From: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Date: Wed, 16 May 2018 14:11:59 +0200
-Subject: [PATCH] brcmfmac: add support for sysfs initiated coredump
-
-The driver already supports device coredump initiated by firmware
-event. Since commit 3c47d19ff4dc ("drivers: base: add coredump driver
-ops") it is also possible to initiate it from user-space through
-sysfs. This patch adds support for SDIO and PCIe devices.
-
-[rafal@milecki.pl: use LINUX_VERSION_CODE]
-Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
-Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Reviewed-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 1 +
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h    | 2 ++
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c   | 8 ++++++++
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c   | 1 +
- 4 files changed, 12 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -1165,6 +1165,9 @@ static struct sdio_driver brcmf_sdmmc_dr
- #ifdef CONFIG_PM_SLEEP
- 		.pm = &brcmf_sdio_pm_ops,
- #endif	/* CONFIG_PM_SLEEP */
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0)
-+		.coredump = brcmf_dev_coredump,
-+#endif
- 	},
- };
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -250,6 +250,8 @@ int brcmf_attach(struct device *dev, str
- void brcmf_detach(struct device *dev);
- /* Indication from bus module that dongle should be reset */
- void brcmf_dev_reset(struct device *dev);
-+/* Request from bus module to initiate a coredump */
-+void brcmf_dev_coredump(struct device *dev);
- 
- /* Configure the "global" bus state used by upper layers */
- void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1201,6 +1201,14 @@ void brcmf_dev_reset(struct device *dev)
- 		brcmf_fil_cmd_int_set(drvr->iflist[0], BRCMF_C_TERMINATED, 1);
- }
- 
-+void brcmf_dev_coredump(struct device *dev)
-+{
-+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-+
-+	if (brcmf_debug_create_memdump(bus_if, NULL, 0) < 0)
-+		brcmf_dbg(TRACE, "failed to create coredump\n");
-+}
-+
- void brcmf_detach(struct device *dev)
- {
- 	s32 i;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -2044,6 +2044,9 @@ static struct pci_driver brcmf_pciedrvr
- #ifdef CONFIG_PM
- 	.driver.pm = &brcmf_pciedrvr_pm,
- #endif
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0)
-+	.driver.coredump = brcmf_dev_coredump,
-+#endif
- };
- 
- 
diff --git a/package/kernel/mac80211/patches/335-v4.18-0004-brcmfmac-validate-user-provided-data-for-memdump-bef.patch b/package/kernel/mac80211/patches/335-v4.18-0004-brcmfmac-validate-user-provided-data-for-memdump-bef.patch
deleted file mode 100644
index 455009ef1..000000000
--- a/package/kernel/mac80211/patches/335-v4.18-0004-brcmfmac-validate-user-provided-data-for-memdump-bef.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From d2af9b566554e01f9ad67b330ce569dbc130e5d3 Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Wed, 16 May 2018 14:12:01 +0200
-Subject: [PATCH] brcmfmac: validate user provided data for memdump before
- copying
-
-In patch "brcmfmac: add support for sysfs initiated coredump", a new
-scenario of brcmf_debug_create_memdump was added in which the user of
-the function might not necessarily provide prefix data. Hence the
-function should not assume the data is always valid and should perform a
-check before copying.
-
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
-@@ -40,7 +40,8 @@ int brcmf_debug_create_memdump(struct br
- 	if (!dump)
- 		return -ENOMEM;
- 
--	memcpy(dump, data, len);
-+	if (data && len > 0)
-+		memcpy(dump, data, len);
- 	err = brcmf_bus_get_memdump(bus, dump + len, ramsize);
- 	if (err) {
- 		vfree(dump);
diff --git a/package/kernel/mac80211/patches/335-v4.18-0005-brcmfmac-trigger-memory-dump-upon-firmware-halt-sign.patch b/package/kernel/mac80211/patches/335-v4.18-0005-brcmfmac-trigger-memory-dump-upon-firmware-halt-sign.patch
deleted file mode 100644
index b94e06fa4..000000000
--- a/package/kernel/mac80211/patches/335-v4.18-0005-brcmfmac-trigger-memory-dump-upon-firmware-halt-sign.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 8a3ab2f38f1669e3be6433a1f6b82a077b38c4c7 Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Wed, 16 May 2018 14:12:02 +0200
-Subject: [PATCH] brcmfmac: trigger memory dump upon firmware halt signal
-
-PCIe dongle firmware signals a halt/trap through mailbox interrupt.
-Trigger a memory dump upon receiving such signal could help to provide
-useful information for issue debug.
-
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -182,6 +182,7 @@ static const struct brcmf_firmware_mappi
- #define BRCMF_D2H_DEV_D3_ACK			0x00000001
- #define BRCMF_D2H_DEV_DS_ENTER_REQ		0x00000002
- #define BRCMF_D2H_DEV_DS_EXIT_NOTE		0x00000004
-+#define BRCMF_D2H_DEV_FWHALT			0x10000000
- 
- #define BRCMF_H2D_HOST_D3_INFORM		0x00000001
- #define BRCMF_H2D_HOST_DS_ACK			0x00000002
-@@ -717,6 +718,10 @@ static void brcmf_pcie_handle_mb_data(st
- 		devinfo->mbdata_completed = true;
- 		wake_up(&devinfo->mbdata_resp_wait);
- 	}
-+	if (dtoh_mb_data & BRCMF_D2H_DEV_FWHALT) {
-+		brcmf_dbg(PCIE, "D2H_MB_DATA: FW HALT\n");
-+		brcmf_dev_coredump(&devinfo->pdev->dev);
-+	}
- }
- 
- 
diff --git a/package/kernel/mac80211/patches/335-v4.18-0006-brcmfmac-trigger-memory-dump-on-SDIO-firmware-halt-m.patch b/package/kernel/mac80211/patches/335-v4.18-0006-brcmfmac-trigger-memory-dump-on-SDIO-firmware-halt-m.patch
deleted file mode 100644
index 045e20acf..000000000
--- a/package/kernel/mac80211/patches/335-v4.18-0006-brcmfmac-trigger-memory-dump-on-SDIO-firmware-halt-m.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From b8248236e92790ac635caeb4156e46ea2417e037 Mon Sep 17 00:00:00 2001
-From: Franky Lin <franky.lin@broadcom.com>
-Date: Wed, 16 May 2018 14:12:03 +0200
-Subject: [PATCH] brcmfmac: trigger memory dump on SDIO firmware halt message
-
-Attempt to dump dongle memory for debug upon receiving firmware halt
-message through dongle to host mail box interrupt.
-
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -1072,8 +1072,10 @@ static u32 brcmf_sdio_hostmail(struct br
- 	bus->sdcnt.f1regdata += 2;
- 
- 	/* dongle indicates the firmware has halted/crashed */
--	if (hmb_data & HMB_DATA_FWHALT)
-+	if (hmb_data & HMB_DATA_FWHALT) {
- 		brcmf_err("mailbox indicates firmware halted\n");
-+		brcmf_dev_coredump(&sdiod->func1->dev);
-+	}
- 
- 	/* Dongle recomposed rx frames, accept them again */
- 	if (hmb_data & HMB_DATA_NAKHANDLED) {
diff --git a/package/kernel/mac80211/patches/336-v4.18-brcmfmac-stop-watchdog-before-detach-and-free-everyt.patch b/package/kernel/mac80211/patches/336-v4.18-brcmfmac-stop-watchdog-before-detach-and-free-everyt.patch
deleted file mode 100644
index a478b675c..000000000
--- a/package/kernel/mac80211/patches/336-v4.18-brcmfmac-stop-watchdog-before-detach-and-free-everyt.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From 373c83a801f15b1e3d02d855fad89112bd4ccbe0 Mon Sep 17 00:00:00 2001
-From: Michael Trimarchi <michael@amarulasolutions.com>
-Date: Wed, 30 May 2018 11:06:34 +0200
-Subject: [PATCH] brcmfmac: stop watchdog before detach and free everything
-
-Using built-in in kernel image without a firmware in filesystem
-or in the kernel image can lead to a kernel NULL pointer deference.
-Watchdog need to be stopped in brcmf_sdio_remove
-
-The system is going down NOW!
-[ 1348.110759] Unable to handle kernel NULL pointer dereference at virtual address 000002f8
-Sent SIGTERM to all processes
-[ 1348.121412] Mem abort info:
-[ 1348.126962]   ESR = 0x96000004
-[ 1348.130023]   Exception class = DABT (current EL), IL = 32 bits
-[ 1348.135948]   SET = 0, FnV = 0
-[ 1348.138997]   EA = 0, S1PTW = 0
-[ 1348.142154] Data abort info:
-[ 1348.145045]   ISV = 0, ISS = 0x00000004
-[ 1348.148884]   CM = 0, WnR = 0
-[ 1348.151861] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____)
-[ 1348.158475] [00000000000002f8] pgd=0000000000000000
-[ 1348.163364] Internal error: Oops: 96000004 [#1] PREEMPT SMP
-[ 1348.168927] Modules linked in: ipv6
-[ 1348.172421] CPU: 3 PID: 1421 Comm: brcmf_wdog/mmc0 Not tainted 4.17.0-rc5-next-20180517 #18
-[ 1348.180757] Hardware name: Amarula A64-Relic (DT)
-[ 1348.185455] pstate: 60000005 (nZCv daif -PAN -UAO)
-[ 1348.190251] pc : brcmf_sdiod_freezer_count+0x0/0x20
-[ 1348.195124] lr : brcmf_sdio_watchdog_thread+0x64/0x290
-[ 1348.200253] sp : ffff00000b85be30
-[ 1348.203561] x29: ffff00000b85be30 x28: 0000000000000000
-[ 1348.208868] x27: ffff00000b6cb918 x26: ffff80003b990638
-[ 1348.214176] x25: ffff0000087b1a20 x24: ffff80003b94f800
-[ 1348.219483] x23: ffff000008e620c8 x22: ffff000008f0b660
-[ 1348.224790] x21: ffff000008c6a858 x20: 00000000fffffe00
-[ 1348.230097] x19: ffff80003b94f800 x18: 0000000000000001
-[ 1348.235404] x17: 0000ffffab2e8a74 x16: ffff0000080d7de8
-[ 1348.240711] x15: 0000000000000000 x14: 0000000000000400
-[ 1348.246018] x13: 0000000000000400 x12: 0000000000000001
-[ 1348.251324] x11: 00000000000002c4 x10: 0000000000000a10
-[ 1348.256631] x9 : ffff00000b85bc40 x8 : ffff80003be11870
-[ 1348.261937] x7 : ffff80003dfc7308 x6 : 000000078ff08b55
-[ 1348.267243] x5 : 00000139e1058400 x4 : 0000000000000000
-[ 1348.272550] x3 : dead000000000100 x2 : 958f2788d6618100
-[ 1348.277856] x1 : 00000000fffffe00 x0 : 0000000000000000
-
-Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Tested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4297,6 +4297,13 @@ void brcmf_sdio_remove(struct brcmf_sdio
- 	brcmf_dbg(TRACE, "Enter\n");
- 
- 	if (bus) {
-+		/* Stop watchdog task */
-+		if (bus->watchdog_tsk) {
-+			send_sig(SIGTERM, bus->watchdog_tsk, 1);
-+			kthread_stop(bus->watchdog_tsk);
-+			bus->watchdog_tsk = NULL;
-+		}
-+
- 		/* De-register interrupt handler */
- 		brcmf_sdiod_intr_unregister(bus->sdiodev);
- 
diff --git a/package/kernel/mac80211/patches/337-v4.18-brcmfmac-fix-regression-in-parsing-NVRAM-for-multipl.patch b/package/kernel/mac80211/patches/337-v4.18-brcmfmac-fix-regression-in-parsing-NVRAM-for-multipl.patch
deleted file mode 100644
index 2e265a2f3..000000000
--- a/package/kernel/mac80211/patches/337-v4.18-brcmfmac-fix-regression-in-parsing-NVRAM-for-multipl.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 299b6365a3b7cf7f5ea1c945a420e9ee4841d6f7 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Sun, 22 Jul 2018 23:46:25 +0200
-Subject: [PATCH] brcmfmac: fix regression in parsing NVRAM for multiple
- devices
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-NVRAM is designed to work with Broadcom's SDK Linux kernel which fakes
-PCI domain 0 for all internal MMIO devices. Since official Linux kernel
-uses platform devices for that purpose there is a mismatch in numbering
-PCI domains.
-
-There used to be a fix for that problem but it was accidentally dropped
-during the last firmware loading rework. That resulted in brcmfmac not
-being able to extract device specific NVRAM content and all kind of
-calibration problems.
-
-Reported-by: Aditya Xavier <adityaxavier@gmail.com>
-Fixes: 2baa3aaee27f ("brcmfmac: introduce brcmf_fw_alloc_request() function")
-Cc: stable@vger.kernel.org # v4.17+
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1785,7 +1785,8 @@ brcmf_pcie_prepare_fw_request(struct brc
- 	fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
- 	fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
- 	fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL;
--	fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus);
-+	/* NVRAM reserves PCI domain 0 for Broadcom's SDK faked bus */
-+	fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus) + 1;
- 	fwreq->bus_nr = devinfo->pdev->bus->number;
- 
- 	return fwreq;
diff --git a/package/kernel/mac80211/patches/338-v4.19-0001-brcmfmac-detect-firmware-support-for-monitor-interfa.patch b/package/kernel/mac80211/patches/338-v4.19-0001-brcmfmac-detect-firmware-support-for-monitor-interfa.patch
deleted file mode 100644
index b0eec163f..000000000
--- a/package/kernel/mac80211/patches/338-v4.19-0001-brcmfmac-detect-firmware-support-for-monitor-interfa.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 01f69dfafdbe7deff58b58053bc3a4a75c6a570c Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Sun, 24 Jun 2018 21:44:35 +0200
-Subject: [PATCH] brcmfmac: detect firmware support for monitor interface
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Many/most of firmwares support creating monitor interface but only the
-most recent ones explicitly /announce/ it using a "monitor" entry in the
-list of capabilities.
-
-Check for that entry and store internally info about monitor mode
-support using a new feature flag. Once we sort out all details of
-handling monitor interface it will be used when reporting available
-interfaces to the cfg80211.
-
-Later some fallback detecion method may be added for older firmwares.
-For now just stick to the "monitor" capability which should be 100%
-reliable.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 1 +
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h | 4 +++-
- 2 files changed, 4 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -48,6 +48,7 @@ static const struct brcmf_feat_fwcap brc
- 	{ BRCMF_FEAT_MBSS, "mbss" },
- 	{ BRCMF_FEAT_MCHAN, "mchan" },
- 	{ BRCMF_FEAT_P2P, "p2p" },
-+	{ BRCMF_FEAT_MONITOR, "monitor" },
- };
- 
- #ifdef DEBUG
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-@@ -33,6 +33,7 @@
-  * MFP: 802.11w Management Frame Protection.
-  * GSCAN: enhanced scan offload feature.
-  * FWSUP: Firmware supplicant.
-+ * MONITOR: firmware can pass monitor packets to host.
-  */
- #define BRCMF_FEAT_LIST \
- 	BRCMF_FEAT_DEF(MBSS) \
-@@ -48,7 +49,8 @@
- 	BRCMF_FEAT_DEF(WOWL_ARP_ND) \
- 	BRCMF_FEAT_DEF(MFP) \
- 	BRCMF_FEAT_DEF(GSCAN) \
--	BRCMF_FEAT_DEF(FWSUP)
-+	BRCMF_FEAT_DEF(FWSUP) \
-+	BRCMF_FEAT_DEF(MONITOR)
- 
- /*
-  * Quirks:
diff --git a/package/kernel/mac80211/patches/338-v4.19-0002-brcmfmac-detect-firmware-support-for-radiotap-monito.patch b/package/kernel/mac80211/patches/338-v4.19-0002-brcmfmac-detect-firmware-support-for-radiotap-monito.patch
deleted file mode 100644
index e733468bc..000000000
--- a/package/kernel/mac80211/patches/338-v4.19-0002-brcmfmac-detect-firmware-support-for-radiotap-monito.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From e63410ac65e0ead2040bbd3927c116889edf87e4 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Sun, 24 Jun 2018 21:44:36 +0200
-Subject: [PATCH] brcmfmac: detect firmware support for radiotap monitor frames
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Depending on used build-time options some firmwares may already include
-radiotap header in passed monitor frames. Add a new feature flag to
-store info about it. It's needed for proper handling of received frames
-before passing them up.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 1 +
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h | 4 +++-
- 2 files changed, 4 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -49,6 +49,7 @@ static const struct brcmf_feat_fwcap brc
- 	{ BRCMF_FEAT_MCHAN, "mchan" },
- 	{ BRCMF_FEAT_P2P, "p2p" },
- 	{ BRCMF_FEAT_MONITOR, "monitor" },
-+	{ BRCMF_FEAT_MONITOR_FMT_RADIOTAP, "rtap" },
- };
- 
- #ifdef DEBUG
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
-@@ -34,6 +34,7 @@
-  * GSCAN: enhanced scan offload feature.
-  * FWSUP: Firmware supplicant.
-  * MONITOR: firmware can pass monitor packets to host.
-+ * MONITOR_FMT_RADIOTAP: firmware provides monitor packets with radiotap header
-  */
- #define BRCMF_FEAT_LIST \
- 	BRCMF_FEAT_DEF(MBSS) \
-@@ -50,7 +51,8 @@
- 	BRCMF_FEAT_DEF(MFP) \
- 	BRCMF_FEAT_DEF(GSCAN) \
- 	BRCMF_FEAT_DEF(FWSUP) \
--	BRCMF_FEAT_DEF(MONITOR)
-+	BRCMF_FEAT_DEF(MONITOR) \
-+	BRCMF_FEAT_DEF(MONITOR_FMT_RADIOTAP)
- 
- /*
-  * Quirks:
diff --git a/package/kernel/mac80211/patches/338-v4.19-0003-brcmfmac-handle-msgbuf-packets-marked-with-monitor-m.patch b/package/kernel/mac80211/patches/338-v4.19-0003-brcmfmac-handle-msgbuf-packets-marked-with-monitor-m.patch
deleted file mode 100644
index d640bcfec..000000000
--- a/package/kernel/mac80211/patches/338-v4.19-0003-brcmfmac-handle-msgbuf-packets-marked-with-monitor-m.patch
+++ /dev/null
@@ -1,137 +0,0 @@
-From a8d7631858aff156b72f807ee7cc062048e63836 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Sun, 24 Jun 2018 21:44:37 +0200
-Subject: [PATCH] brcmfmac: handle msgbuf packets marked with monitor mode flag
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-New Broadcom firmwares mark monitor mode packets using a newly defined
-bit in the flags field. Use it to filter them out and pass to the
-monitor interface. These defines were found in bcmmsgbuf.h from SDK.
-
-As not every firmware generates radiotap header this commit introduces
-BRCMF_FEAT_MONITOR_FMT_RADIOTAP flag. It has to be has based on firmware
-capabilities. If not present brcmf_netif_mon_rx() will assume packet is
-a raw 802.11 frame and will prepend it with an empty radiotap header.
-
-This new code is limited to the msgbuf protocol at this point. Adding
-support for SDIO/USB devices will require some extra work (possibly a
-new firmware release).
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 25 ++++++++++++++++++++++
- .../wireless/broadcom/brcm80211/brcmfmac/core.h    |  2 ++
- .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c  | 18 ++++++++++++++++
- 3 files changed, 45 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -21,6 +21,7 @@
- #include <net/cfg80211.h>
- #include <net/rtnetlink.h>
- #include <net/addrconf.h>
-+#include <net/ieee80211_radiotap.h>
- #include <net/ipv6.h>
- #include <brcmu_utils.h>
- #include <brcmu_wifi.h>
-@@ -404,6 +405,30 @@ void brcmf_netif_rx(struct brcmf_if *ifp
- 		netif_rx_ni(skb);
- }
- 
-+void brcmf_netif_mon_rx(struct brcmf_if *ifp, struct sk_buff *skb)
-+{
-+	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FMT_RADIOTAP)) {
-+		/* Do nothing */
-+	} else {
-+		struct ieee80211_radiotap_header *radiotap;
-+
-+		/* TODO: use RX status to fill some radiotap data */
-+		radiotap = skb_push(skb, sizeof(*radiotap));
-+		memset(radiotap, 0, sizeof(*radiotap));
-+		radiotap->it_len = cpu_to_le16(sizeof(*radiotap));
-+
-+		/* TODO: 4 bytes with receive status? */
-+		skb->len -= 4;
-+	}
-+
-+	skb->dev = ifp->ndev;
-+	skb_reset_mac_header(skb);
-+	skb->pkt_type = PACKET_OTHERHOST;
-+	skb->protocol = htons(ETH_P_802_2);
-+
-+	brcmf_netif_rx(ifp, skb);
-+}
-+
- static int brcmf_rx_hdrpull(struct brcmf_pub *drvr, struct sk_buff *skb,
- 			    struct brcmf_if **ifp)
- {
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -121,6 +121,7 @@ struct brcmf_pub {
- 
- 	struct brcmf_if *iflist[BRCMF_MAX_IFS];
- 	s32 if2bss[BRCMF_MAX_IFS];
-+	struct brcmf_if *mon_if;
- 
- 	struct mutex proto_block;
- 	unsigned char proto_buf[BRCMF_DCMD_MAXLEN];
-@@ -216,6 +217,7 @@ void brcmf_txflowblock_if(struct brcmf_i
- 			  enum brcmf_netif_stop_reason reason, bool state);
- void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success);
- void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb);
-+void brcmf_netif_mon_rx(struct brcmf_if *ifp, struct sk_buff *skb);
- void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on);
- int __init brcmf_core_init(void);
- void __exit brcmf_core_exit(void);
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
-@@ -69,6 +69,8 @@
- #define BRCMF_MSGBUF_MAX_EVENTBUF_POST		8
- 
- #define BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3	0x01
-+#define BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_11	0x02
-+#define BRCMF_MSGBUF_PKT_FLAGS_FRAME_MASK	0x07
- #define BRCMF_MSGBUF_PKT_FLAGS_PRIO_SHIFT	5
- 
- #define BRCMF_MSGBUF_TX_FLUSH_CNT1		32
-@@ -1128,6 +1130,7 @@ brcmf_msgbuf_process_rx_complete(struct
- 	struct sk_buff *skb;
- 	u16 data_offset;
- 	u16 buflen;
-+	u16 flags;
- 	u32 idx;
- 	struct brcmf_if *ifp;
- 
-@@ -1137,6 +1140,7 @@ brcmf_msgbuf_process_rx_complete(struct
- 	data_offset = le16_to_cpu(rx_complete->data_offset);
- 	buflen = le16_to_cpu(rx_complete->data_len);
- 	idx = le32_to_cpu(rx_complete->msg.request_id);
-+	flags = le16_to_cpu(rx_complete->flags);
- 
- 	skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
- 				     msgbuf->rx_pktids, idx);
-@@ -1150,6 +1154,20 @@ brcmf_msgbuf_process_rx_complete(struct
- 
- 	skb_trim(skb, buflen);
- 
-+	if ((flags & BRCMF_MSGBUF_PKT_FLAGS_FRAME_MASK) ==
-+	    BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_11) {
-+		ifp = msgbuf->drvr->mon_if;
-+
-+		if (!ifp) {
-+			brcmf_err("Received unexpected monitor pkt\n");
-+			brcmu_pkt_buf_free_skb(skb);
-+			return;
-+		}
-+
-+		brcmf_netif_mon_rx(ifp, skb);
-+		return;
-+	}
-+
- 	ifp = brcmf_get_ifp(msgbuf->drvr, rx_complete->msg.ifidx);
- 	if (!ifp || !ifp->ndev) {
- 		brcmf_err("Received pkt for invalid ifidx %d\n",
diff --git a/package/kernel/mac80211/patches/339-v4.19-brcmfmac-define-more-bits-for-the-flags-of-struct-br.patch b/package/kernel/mac80211/patches/339-v4.19-brcmfmac-define-more-bits-for-the-flags-of-struct-br.patch
deleted file mode 100644
index 050370de4..000000000
--- a/package/kernel/mac80211/patches/339-v4.19-brcmfmac-define-more-bits-for-the-flags-of-struct-br.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 4b4a8d808c58fc0defc32a26b2fea35d66692c45 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Thu, 28 Jun 2018 08:16:13 +0200
-Subject: [PATCH] brcmfmac: define more bits for the flags of struct
- brcmf_sta_info_le
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-That struct is passed by a firmware when querying for STA info. Flags
-are used to indicate what info could be obtained.
-
-These new defines may allow passing more info to the cfg80211 in the
-future. They had been obtained from Broadcom's SDK file wlioctl_defs.h
-used by DD-WRT.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/fwil_types.h       | 29 ++++++++++++++++++----
- 1 file changed, 24 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-@@ -32,11 +32,30 @@
- #define	BRCMF_BSS_INFO_VERSION	109 /* curr ver of brcmf_bss_info_le struct */
- #define BRCMF_BSS_RSSI_ON_CHANNEL	0x0002
- 
--#define BRCMF_STA_WME              0x00000002      /* WMM association */
--#define BRCMF_STA_AUTHE            0x00000008      /* Authenticated */
--#define BRCMF_STA_ASSOC            0x00000010      /* Associated */
--#define BRCMF_STA_AUTHO            0x00000020      /* Authorized */
--#define BRCMF_STA_SCBSTATS         0x00004000      /* Per STA debug stats */
-+#define BRCMF_STA_BRCM			0x00000001	/* Running a Broadcom driver */
-+#define BRCMF_STA_WME			0x00000002	/* WMM association */
-+#define BRCMF_STA_NONERP		0x00000004	/* No ERP */
-+#define BRCMF_STA_AUTHE			0x00000008	/* Authenticated */
-+#define BRCMF_STA_ASSOC			0x00000010	/* Associated */
-+#define BRCMF_STA_AUTHO			0x00000020	/* Authorized */
-+#define BRCMF_STA_WDS			0x00000040	/* Wireless Distribution System */
-+#define BRCMF_STA_WDS_LINKUP		0x00000080	/* WDS traffic/probes flowing properly */
-+#define BRCMF_STA_PS			0x00000100	/* STA is in power save mode from AP's viewpoint */
-+#define BRCMF_STA_APSD_BE		0x00000200	/* APSD delv/trigger for AC_BE is default enabled */
-+#define BRCMF_STA_APSD_BK		0x00000400	/* APSD delv/trigger for AC_BK is default enabled */
-+#define BRCMF_STA_APSD_VI		0x00000800	/* APSD delv/trigger for AC_VI is default enabled */
-+#define BRCMF_STA_APSD_VO		0x00001000	/* APSD delv/trigger for AC_VO is default enabled */
-+#define BRCMF_STA_N_CAP			0x00002000	/* STA 802.11n capable */
-+#define BRCMF_STA_SCBSTATS		0x00004000	/* Per STA debug stats */
-+#define BRCMF_STA_AMPDU_CAP		0x00008000	/* STA AMPDU capable */
-+#define BRCMF_STA_AMSDU_CAP		0x00010000	/* STA AMSDU capable */
-+#define BRCMF_STA_MIMO_PS		0x00020000	/* mimo ps mode is enabled */
-+#define BRCMF_STA_MIMO_RTS		0x00040000	/* send rts in mimo ps mode */
-+#define BRCMF_STA_RIFS_CAP		0x00080000	/* rifs enabled */
-+#define BRCMF_STA_VHT_CAP		0x00100000	/* STA VHT(11ac) capable */
-+#define BRCMF_STA_WPS			0x00200000	/* WPS state */
-+#define BRCMF_STA_DWDS_CAP		0x01000000	/* DWDS CAP */
-+#define BRCMF_STA_DWDS			0x02000000	/* DWDS active */
- 
- /* size of brcmf_scan_params not including variable length array */
- #define BRCMF_SCAN_PARAMS_FIXED_SIZE	64
diff --git a/package/kernel/mac80211/patches/340-v4.19-brcmfmac-update-STA-info-struct-to-the-v5.patch b/package/kernel/mac80211/patches/340-v4.19-brcmfmac-update-STA-info-struct-to-the-v5.patch
deleted file mode 100644
index e0fd8d9ea..000000000
--- a/package/kernel/mac80211/patches/340-v4.19-brcmfmac-update-STA-info-struct-to-the-v5.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 07b1ae46874949252625c96f309f96ca0f337020 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Thu, 28 Jun 2018 12:36:23 +0200
-Subject: [PATCH] brcmfmac: update STA info struct to the v5
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-That struct is used when querying firmware for the STA. It seem is has
-been changing during the time. Luckily its format seems to be backward
-compatible starting with v2 (the only breakage was v1 -> v2).
-
-The version that was supported by brcmfmac so far was v4. It was what
-43602a1 and 4366b1 firmwares (7.35.177.56 and 10.10.69.3309 accordingly)
-were using. It also seems to be used by early 4366c0 firmwares
-(10.10.69.6908 and 10.10.69.69017).
-
-The problem appears when switching to the 10.10.122.20 firmware. It uses
-v5 and instead of falling back to v4 when submitted buffer isn't big
-enough it fallbacks to the v3.
-
-To receive all v4 specific info with the newest firmware we have to
-submit a struct (buffer) that matches v5.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h  | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
-@@ -174,6 +174,8 @@
- #define BRCMF_MFP_CAPABLE		1
- #define BRCMF_MFP_REQUIRED		2
- 
-+#define BRCMF_VHT_CAP_MCS_MAP_NSS_MAX	8
-+
- /* MAX_CHUNK_LEN is the maximum length for data passing to firmware in each
-  * ioctl. It is relatively small because firmware has small maximum size input
-  * playload restriction for ioctls.
-@@ -550,6 +552,8 @@ struct brcmf_sta_info_le {
- 						/* w/hi bit set if basic */
- 	__le32 in;		/* seconds elapsed since associated */
- 	__le32 listen_interval_inms; /* Min Listen interval in ms for STA */
-+
-+	/* Fields valid for ver >= 3 */
- 	__le32 tx_pkts;	/* # of packets transmitted */
- 	__le32 tx_failures;	/* # of packets failed */
- 	__le32 rx_ucast_pkts;	/* # of unicast packets received */
-@@ -558,6 +562,8 @@ struct brcmf_sta_info_le {
- 	__le32 rx_rate;	/* Rate of last successful rx frame */
- 	__le32 rx_decrypt_succeeds;	/* # of packet decrypted successfully */
- 	__le32 rx_decrypt_failures;	/* # of packet decrypted failed */
-+
-+	/* Fields valid for ver >= 4 */
- 	__le32 tx_tot_pkts;    /* # of tx pkts (ucast + mcast) */
- 	__le32 rx_tot_pkts;    /* # of data packets recvd (uni + mcast) */
- 	__le32 tx_mcast_pkts;  /* # of mcast pkts txed */
-@@ -594,6 +600,14 @@ struct brcmf_sta_info_le {
- 						*/
- 	__le32 rx_pkts_retried;        /* # rx with retry bit set */
- 	__le32 tx_rate_fallback;       /* lowest fallback TX rate */
-+
-+	/* Fields valid for ver >= 5 */
-+	struct {
-+		__le32 count;					/* # rates in this set */
-+		u8 rates[BRCMF_MAXRATES_IN_SET];		/* rates in 500kbps units w/hi bit set if basic */
-+		u8 mcs[BRCMF_MCSSET_LEN];			/* supported mcs index bit map */
-+		__le16 vht_mcs[BRCMF_VHT_CAP_MCS_MAP_NSS_MAX];	/* supported mcs index bit map per nss */
-+	} rateset_adv;
- };
- 
- struct brcmf_chanspec_list {
diff --git a/package/kernel/mac80211/patches/341-v4.19-brcmfmac-specify-some-features-per-firmware-version.patch b/package/kernel/mac80211/patches/341-v4.19-brcmfmac-specify-some-features-per-firmware-version.patch
deleted file mode 100644
index 6ebcdfdf2..000000000
--- a/package/kernel/mac80211/patches/341-v4.19-brcmfmac-specify-some-features-per-firmware-version.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 1e591c56a65fbbcd5754a4210a0ef0402d5e5f33 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Mon, 9 Jul 2018 06:55:43 +0200
-Subject: [PATCH] brcmfmac: specify some features per firmware version
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Some features supported by firmware aren't advertised and there is no
-way for a driver to query them. This includes e.g. monitor mode details.
-
-Most firmwares support monitor interface but only the latest ones
-/announce/ it with a "monitor" flag in the "cap" iovar. There isn't any
-reliable detection method for older firmwares (BRCMF_C_MONITOR was tried
-but "it only indicates the core part of the stack supports").
-
-Similarly support for tagging monitor frames and building radiotap
-headers can't be reliably detected for all firmwares.
-
-This commit adds table that allows mapping features to firmware version.
-It adds mappings for 43602a1 and 4366b1 firmwares from
-linux-firmware.git. Both were confirmed to be passing monitor frames.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/feature.c | 38 ++++++++++++++++++++++
- 1 file changed, 38 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
-@@ -93,6 +93,42 @@ static int brcmf_feat_debugfs_read(struc
- }
- #endif /* DEBUG */
- 
-+struct brcmf_feat_fwfeat {
-+	const char * const fwid;
-+	u32 feat_flags;
-+};
-+
-+static const struct brcmf_feat_fwfeat brcmf_feat_fwfeat_map[] = {
-+	/* brcmfmac43602-pcie.ap.bin from linux-firmware.git commit ea1178515b88 */
-+	{ "01-6cb8e269", BIT(BRCMF_FEAT_MONITOR) },
-+	/* brcmfmac4366b-pcie.bin from linux-firmware.git commit 52442afee990 */
-+	{ "01-c47a91a4", BIT(BRCMF_FEAT_MONITOR) },
-+};
-+
-+static void brcmf_feat_firmware_overrides(struct brcmf_pub *drv)
-+{
-+	const struct brcmf_feat_fwfeat *e;
-+	u32 feat_flags = 0;
-+	int i;
-+
-+	for (i = 0; i < ARRAY_SIZE(brcmf_feat_fwfeat_map); i++) {
-+		e = &brcmf_feat_fwfeat_map[i];
-+		if (!strcmp(e->fwid, drv->fwver)) {
-+			feat_flags = e->feat_flags;
-+			break;
-+		}
-+	}
-+
-+	if (!feat_flags)
-+		return;
-+
-+	for (i = 0; i < BRCMF_FEAT_LAST; i++)
-+		if (feat_flags & BIT(i))
-+			brcmf_dbg(INFO, "enabling firmware feature: %s\n",
-+				  brcmf_feat_names[i]);
-+	drv->feat_flags |= feat_flags;
-+}
-+
- /**
-  * brcmf_feat_iovar_int_get() - determine feature through iovar query.
-  *
-@@ -253,6 +289,8 @@ void brcmf_feat_attach(struct brcmf_pub
- 	}
- 	brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_FWSUP, "sup_wpa");
- 
-+	brcmf_feat_firmware_overrides(drvr);
-+
- 	/* set chip related quirks */
- 	switch (drvr->bus_if->chip) {
- 	case BRCM_CC_43236_CHIP_ID:
diff --git a/package/kernel/mac80211/patches/352-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch b/package/kernel/mac80211/patches/352-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch
deleted file mode 100644
index dfe9aae26..000000000
--- a/package/kernel/mac80211/patches/352-ath9k_hw-set-spectral-scan-enable-bit-on-trigger-for.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Mon, 11 Jul 2016 12:07:40 +0200
-Subject: [PATCH] ath9k_hw: set spectral scan enable bit on trigger for
- AR9003+
-
-AR9002 code and QCA AR9003+ code do the same.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-@@ -1800,6 +1800,8 @@ static void ar9003_hw_spectral_scan_conf
- 
- static void ar9003_hw_spectral_scan_trigger(struct ath_hw *ah)
- {
-+	REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN,
-+		    AR_PHY_SPECTRAL_SCAN_ENABLE);
- 	/* Activate spectral scan */
- 	REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN,
- 		    AR_PHY_SPECTRAL_SCAN_ACTIVE);
diff --git a/package/kernel/mac80211/patches/353-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch b/package/kernel/mac80211/patches/353-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch
deleted file mode 100644
index 22f515414..000000000
--- a/package/kernel/mac80211/patches/353-ath9k-don-t-run-periodic-and-nf-calibation-at-the-sa.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 27 Dec 2016 23:16:23 +0100
-Subject: [PATCH] ath9k: don't run periodic and nf calibation at the same
- time
-
-The checks already prevents periodic cal from being started while noise
-floor calibration runs. It is missing checks for the other way around.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
-@@ -676,10 +676,10 @@ static int ar9002_hw_calibrate(struct at
- 			return 0;
- 
- 		ah->cal_list_curr = currCal = currCal->calNext;
--		if (currCal->calState == CAL_WAITING) {
-+		if (currCal->calState == CAL_WAITING)
- 			ath9k_hw_reset_calibration(ah, currCal);
--			return 0;
--		}
-+
-+		return 0;
- 	}
- 
- 	/* Do NF cal only at longer intervals */
diff --git a/package/kernel/mac80211/patches/360-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch b/package/kernel/mac80211/patches/360-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
deleted file mode 100644
index d651e6ce3..000000000
--- a/package/kernel/mac80211/patches/360-ath9k-fix-moredata-bit-in-PS-buffered-frame-release.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sun, 28 Aug 2016 13:13:01 +0200
-Subject: [PATCH] ath9k: fix moredata bit in PS buffered frame release
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -1659,6 +1659,22 @@ void ath_tx_aggr_wakeup(struct ath_softc
- 	}
- }
- 
-+
-+static void
-+ath9k_set_moredata(struct ath_softc *sc, struct ath_buf *bf, bool val)
-+{
-+	struct ieee80211_hdr *hdr;
-+	u16 mask = cpu_to_le16(IEEE80211_FCTL_MOREDATA);
-+	u16 mask_val = mask * val;
-+
-+	hdr = (struct ieee80211_hdr *) bf->bf_mpdu->data;
-+	if ((hdr->frame_control & mask) != mask_val) {
-+		hdr->frame_control = (hdr->frame_control & ~mask) | mask_val;
-+		dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
-+			sizeof(*hdr), DMA_TO_DEVICE);
-+	}
-+}
-+
- void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
- 				   struct ieee80211_sta *sta,
- 				   u16 tids, int nframes,
-@@ -1689,6 +1705,7 @@ void ath9k_release_buffered_frames(struc
- 			if (!bf)
- 				break;
- 
-+			ath9k_set_moredata(sc, bf, true);
- 			list_add_tail(&bf->list, &bf_q);
- 			ath_set_rates(tid->an->vif, tid->an->sta, bf);
- 			if (bf_isampdu(bf)) {
-@@ -1712,6 +1729,9 @@ void ath9k_release_buffered_frames(struc
- 	if (list_empty(&bf_q))
- 		return;
- 
-+	if (!more_data)
-+		ath9k_set_moredata(sc, bf_tail, false);
-+
- 	info = IEEE80211_SKB_CB(bf_tail->bf_mpdu);
- 	info->flags |= IEEE80211_TX_STATUS_EOSP;
- 
diff --git a/package/kernel/mac80211/patches/361-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch b/package/kernel/mac80211/patches/361-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch
deleted file mode 100644
index 319de2a76..000000000
--- a/package/kernel/mac80211/patches/361-ath9k-clear-potentially-stale-EOSP-status-bit-in-int.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sun, 28 Aug 2016 13:13:42 +0200
-Subject: [PATCH] ath9k: clear potentially stale EOSP status bit in
- intermediate queues
-
-Prevents spurious ieee80211_sta_eosp calls.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -969,7 +969,8 @@ ath_tx_get_tid_subframe(struct ath_softc
- 		bf->bf_lastbf = bf;
- 
- 		tx_info = IEEE80211_SKB_CB(skb);
--		tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
-+		tx_info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
-+				    IEEE80211_TX_STATUS_EOSP);
- 
- 		/*
- 		 * No aggregation session is running, but there may be frames
diff --git a/package/kernel/mac80211/patches/362-ath9k-report-tx-status-on-EOSP.patch b/package/kernel/mac80211/patches/362-ath9k-report-tx-status-on-EOSP.patch
deleted file mode 100644
index 80a3074a4..000000000
--- a/package/kernel/mac80211/patches/362-ath9k-report-tx-status-on-EOSP.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sun, 28 Aug 2016 13:23:27 +0200
-Subject: [PATCH] ath9k: report tx status on EOSP
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -86,7 +86,8 @@ static void ath_tx_status(struct ieee802
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_sta *sta = info->status.status_driver_data[0];
- 
--	if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) {
-+	if (info->flags & (IEEE80211_TX_CTL_REQ_TX_STATUS |
-+			   IEEE80211_TX_STATUS_EOSP)) {
- 		ieee80211_tx_status(hw, skb);
- 		return;
- 	}
diff --git a/package/kernel/mac80211/patches/363-ath9k-fix-block-ack-window-tracking-issues.patch b/package/kernel/mac80211/patches/363-ath9k-fix-block-ack-window-tracking-issues.patch
deleted file mode 100644
index e25e92dda..000000000
--- a/package/kernel/mac80211/patches/363-ath9k-fix-block-ack-window-tracking-issues.patch
+++ /dev/null
@@ -1,114 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 30 Aug 2016 12:44:08 +0200
-Subject: [PATCH] ath9k: fix block-ack window tracking issues
-
-Ensure that a buffer gets tracked as part of the block-ack window as
-soon as it's dequeued from the tid for the first time. Ensure that
-double calls to ath_tx_addto_baw (e.g. on retransmission) don't cause
-any issues.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -62,7 +62,7 @@ static void ath_tx_rc_status(struct ath_
- 			     struct ath_tx_status *ts, int nframes, int nbad,
- 			     int txok);
- static void ath_tx_update_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
--			      int seqno);
-+			      struct ath_buf *bf);
- static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
- 					   struct ath_txq *txq,
- 					   struct ath_atx_tid *tid,
-@@ -296,7 +296,7 @@ static void ath_tx_flush_tid(struct ath_
- 		}
- 
- 		if (fi->baw_tracked) {
--			ath_tx_update_baw(sc, tid, bf->bf_state.seqno);
-+			ath_tx_update_baw(sc, tid, bf);
- 			sendbar = true;
- 		}
- 
-@@ -312,10 +312,15 @@ static void ath_tx_flush_tid(struct ath_
- }
- 
- static void ath_tx_update_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
--			      int seqno)
-+			      struct ath_buf *bf)
- {
-+	struct ath_frame_info *fi = get_frame_info(bf->bf_mpdu);
-+	u16 seqno = bf->bf_state.seqno;
- 	int index, cindex;
- 
-+	if (!fi->baw_tracked)
-+		return;
-+
- 	index  = ATH_BA_INDEX(tid->seq_start, seqno);
- 	cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
- 
-@@ -336,6 +341,9 @@ static void ath_tx_addto_baw(struct ath_
- 	u16 seqno = bf->bf_state.seqno;
- 	int index, cindex;
- 
-+	if (fi->baw_tracked)
-+		return;
-+
- 	index  = ATH_BA_INDEX(tid->seq_start, seqno);
- 	cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
- 	__set_bit(cindex, tid->tx_buf);
-@@ -612,7 +620,7 @@ static void ath_tx_complete_aggr(struct
- 			 * complete the acked-ones/xretried ones; update
- 			 * block-ack window
- 			 */
--			ath_tx_update_baw(sc, tid, seqno);
-+			ath_tx_update_baw(sc, tid, bf);
- 
- 			if (rc_update && (acked_cnt == 1 || txfail_cnt == 1)) {
- 				memcpy(tx_info->control.rates, rates, sizeof(rates));
-@@ -642,7 +650,7 @@ static void ath_tx_complete_aggr(struct
- 				 * run out of tx buf.
- 				 */
- 				if (!tbf) {
--					ath_tx_update_baw(sc, tid, seqno);
-+					ath_tx_update_baw(sc, tid, bf);
- 
- 					ath_tx_complete_buf(sc, bf, txq,
- 							    &bf_head, NULL, ts,
-@@ -1011,11 +1019,14 @@ ath_tx_get_tid_subframe(struct ath_softc
- 
- 			INIT_LIST_HEAD(&bf_head);
- 			list_add(&bf->list, &bf_head);
--			ath_tx_update_baw(sc, tid, seqno);
-+			ath_tx_update_baw(sc, tid, bf);
- 			ath_tx_complete_buf(sc, bf, txq, &bf_head, NULL, &ts, 0);
- 			continue;
- 		}
- 
-+		if (bf_isampdu(bf))
-+			ath_tx_addto_baw(sc, tid, bf);
-+
- 		return bf;
- 	}
- 
-@@ -1073,8 +1084,6 @@ ath_tx_form_aggr(struct ath_softc *sc, s
- 		bf->bf_next = NULL;
- 
- 		/* link buffers of this frame to the aggregate */
--		if (!fi->baw_tracked)
--			ath_tx_addto_baw(sc, tid, bf);
- 		bf->bf_state.ndelim = ndelim;
- 
- 		list_add_tail(&bf->list, bf_q);
-@@ -1710,10 +1719,8 @@ void ath9k_release_buffered_frames(struc
- 			ath9k_set_moredata(sc, bf, true);
- 			list_add_tail(&bf->list, &bf_q);
- 			ath_set_rates(tid->an->vif, tid->an->sta, bf);
--			if (bf_isampdu(bf)) {
--				ath_tx_addto_baw(sc, tid, bf);
-+			if (bf_isampdu(bf))
- 				bf->bf_state.bf_type &= ~BUF_AGGR;
--			}
- 			if (bf_tail)
- 				bf_tail->bf_next = bf;
- 
diff --git a/package/kernel/mac80211/patches/364-ath9k_hw-fix-channel-maximum-power-level-test.patch b/package/kernel/mac80211/patches/364-ath9k_hw-fix-channel-maximum-power-level-test.patch
deleted file mode 100644
index 67cbe92e5..000000000
--- a/package/kernel/mac80211/patches/364-ath9k_hw-fix-channel-maximum-power-level-test.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 22 Mar 2017 20:37:04 +0100
-Subject: [PATCH] ath9k_hw: fix channel maximum power level test
-
-The tx power applied by set_txpower is limited by the CTL (conformance
-test limit) entries in the EEPROM. These can change based on the user
-configured regulatory domain.
-Depending on the EEPROM data this can cause the tx power to become too
-limited, if the original regdomain CTLs impose lowr limits than the CTLs
-of the user configured regdomain.
-
-To fix this issue, set the initial channel limits without any CTL
-restrictions and only apply the CTL at run time when setting the channel
-and the real tx power.
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/hw.c
-+++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2937,10 +2937,14 @@ void ath9k_hw_apply_txpower(struct ath_h
- 	struct ieee80211_channel *channel;
- 	int chan_pwr, new_pwr, max_gain;
- 	int ant_gain, ant_reduction = 0;
-+	u16 ctl = NO_CTL;
- 
- 	if (!chan)
- 		return;
- 
-+	if (!test)
-+		ctl = ath9k_regd_get_ctl(reg, chan);
-+
- 	channel = chan->chan;
- 	chan_pwr = min_t(int, channel->max_power * 2, MAX_RATE_POWER);
- 	new_pwr = min_t(int, chan_pwr, reg->power_limit);
-@@ -2950,9 +2954,7 @@ void ath9k_hw_apply_txpower(struct ath_h
- 	if (ant_gain > max_gain)
- 		ant_reduction = ant_gain - max_gain;
- 
--	ah->eep_ops->set_txpower(ah, chan,
--				 ath9k_regd_get_ctl(reg, chan),
--				 ant_reduction, new_pwr, test);
-+	ah->eep_ops->set_txpower(ah, chan, ctl, ant_reduction, new_pwr, test);
- }
- 
- void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit, bool test)
diff --git a/package/kernel/mac80211/patches/366-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch b/package/kernel/mac80211/patches/366-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch
deleted file mode 100644
index 0f3120d67..000000000
--- a/package/kernel/mac80211/patches/366-ath9k-fix-more-data-flag-for-buffered-multicast-pack.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sun, 23 Jul 2017 14:58:22 +0200
-Subject: [PATCH] ath9k: fix more-data flag for buffered multicast
- packets
-
-The flag needs to be cleared for the last packet in the list, not the
-first one. Fixes some issues with multicast packet loss for powersave
-clients connected to an ath9k AP.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -2436,7 +2436,6 @@ void ath_tx_cabq(struct ieee80211_hw *hw
- 		.txq = sc->beacon.cabq
- 	};
- 	struct ath_tx_info info = {};
--	struct ieee80211_hdr *hdr;
- 	struct ath_buf *bf_tail = NULL;
- 	struct ath_buf *bf;
- 	LIST_HEAD(bf_q);
-@@ -2480,15 +2479,10 @@ void ath_tx_cabq(struct ieee80211_hw *hw
- 	if (list_empty(&bf_q))
- 		return;
- 
--	bf = list_first_entry(&bf_q, struct ath_buf, list);
--	hdr = (struct ieee80211_hdr *) bf->bf_mpdu->data;
--
--	if (hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_MOREDATA)) {
--		hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_MOREDATA);
--		dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
--			sizeof(*hdr), DMA_TO_DEVICE);
--	}
-+	bf = list_last_entry(&bf_q, struct ath_buf, list);
-+	ath9k_set_moredata(sc, bf, false);
- 
-+	bf = list_first_entry(&bf_q, struct ath_buf, list);
- 	ath_txq_lock(sc, txctl.txq);
- 	ath_tx_fill_desc(sc, bf, txctl.txq, 0);
- 	ath_tx_txqaddbuf(sc, txctl.txq, &bf_q, false);
diff --git a/package/kernel/mac80211/patches/367-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch b/package/kernel/mac80211/patches/367-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch
deleted file mode 100644
index 56d86c152..000000000
--- a/package/kernel/mac80211/patches/367-Revert-ath10k-disable-wake_tx_queue-for-older-device.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From: dave taht <dave@taht.net>
-Date: Wed, 5 Oct 2016 20:09:15 -0700
-Subject: [PATCH] Revert "ath10k: disable wake_tx_queue for older
- devices"
-
-This reverts commit 4ca1807815aa6801aaced7fdefa9edacc2521767
-in the hope that we've fixed all the performance problems now.
----
-
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -8319,15 +8319,6 @@ int ath10k_mac_register(struct ath10k *a
- 			ath10k_warn(ar, "failed to initialise DFS pattern detector\n");
- 	}
- 
--	/* Current wake_tx_queue implementation imposes a significant
--	 * performance penalty in some setups. The tx scheduling code needs
--	 * more work anyway so disable the wake_tx_queue unless firmware
--	 * supports the pull-push mechanism.
--	 */
--	if (!test_bit(ATH10K_FW_FEATURE_PEER_FLOW_CONTROL,
--		      ar->running_fw->fw_file.fw_features))
--		ar->ops->wake_tx_queue = NULL;
--
- 	ret = ath10k_mac_init_rd(ar);
- 	if (ret) {
- 		ath10k_err(ar, "failed to derive regdom: %d\n", ret);
diff --git a/package/kernel/mac80211/patches/368-ath10k-fix-recent-bandwidth-conversion-bug.patch b/package/kernel/mac80211/patches/368-ath10k-fix-recent-bandwidth-conversion-bug.patch
deleted file mode 100644
index 5d5329f27..000000000
--- a/package/kernel/mac80211/patches/368-ath10k-fix-recent-bandwidth-conversion-bug.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From: Christian Lamparter <chunkeey@gmail.com>
-Date: Wed, 1 Nov 2017 21:01:57 +0100
-Subject: [PATCH] ath10k: fix recent bandwidth conversion bug
-
-The commit "cfg80211: make RATE_INFO_BW_20 the default" changed
-the index of RATE_INFO_BW_20, but the updates to ath10k missed
-the special bandwidth calculation case in
-ath10k_update_per_peer_tx_stats().
-
-Fixes: 842be75c77cb ("cfg80211: make RATE_INFO_BW_20 the default")
-Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
-Patchwork-Id: 10037035
-Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
----
-
---- a/drivers/net/wireless/ath/ath10k/htt_rx.c
-+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
-@@ -592,6 +592,9 @@ struct amsdu_subframe_hdr {
- 
- #define GROUP_ID_IS_SU_MIMO(x) ((x) == 0 || (x) == 63)
- 
-+static const u8 ath10k_bw_to_mac80211[] = { RATE_INFO_BW_20, RATE_INFO_BW_40,
-+	RATE_INFO_BW_80, RATE_INFO_BW_160 };
-+
- static void ath10k_htt_rx_h_rates(struct ath10k *ar,
- 				  struct ieee80211_rx_status *status,
- 				  struct htt_rx_desc *rxd)
-@@ -694,23 +697,7 @@ static void ath10k_htt_rx_h_rates(struct
- 		if (sgi)
- 			status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
- 
--		switch (bw) {
--		/* 20MHZ */
--		case 0:
--			break;
--		/* 40MHZ */
--		case 1:
--			status->bw = RATE_INFO_BW_40;
--			break;
--		/* 80MHZ */
--		case 2:
--			status->bw = RATE_INFO_BW_80;
--			break;
--		case 3:
--			status->bw = RATE_INFO_BW_160;
--			break;
--		}
--
-+		status->bw = ath10k_bw_to_mac80211[bw];
- 		status->encoding = RX_ENC_VHT;
- 		break;
- 	default:
-@@ -2297,7 +2284,7 @@ ath10k_update_per_peer_tx_stats(struct a
- 		arsta->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
- 
- 	arsta->txrate.nss = txrate.nss;
--	arsta->txrate.bw = txrate.bw + RATE_INFO_BW_20;
-+	arsta->txrate.bw = ath10k_bw_to_mac80211[txrate.bw];
- }
- 
- static void ath10k_htt_fetch_peer_stats(struct ath10k *ar,
diff --git a/package/kernel/mac80211/patches/369-cfg80211-use-only-1Mbps-for-basic-rates-in-mesh.patch b/package/kernel/mac80211/patches/369-cfg80211-use-only-1Mbps-for-basic-rates-in-mesh.patch
deleted file mode 100644
index bc4174e4c..000000000
--- a/package/kernel/mac80211/patches/369-cfg80211-use-only-1Mbps-for-basic-rates-in-mesh.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Tue, 30 Jan 2018 13:17:38 +0100
-Subject: [PATCH] cfg80211: use only 1Mbps for basic rates in mesh
-
-Mesh used to use the mandatory rates as basic rates, but we got
-the calculation of mandatory rates wrong until some time ago.
-Fix this this broke interoperability with older versions since
-now more basic rates are required, and thus the MBSS isn't the
-same and the network stops working.
-
-Fix this by simply using only 1Mbps as the basic rate in 2.4GHz.
-Since the changed mandatory rates only affected 2.4GHz, this is
-all we need to make it work again.
-
-Reported-and-tested-by: Matthias Schiffer <mschiffer@universe-factory.net>
-Fixes: 1bd773c077de ("wireless: set correct mandatory rate flags")
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- net/wireless/mesh.c | 25 ++++++++++++++++++++++---
- 1 file changed, 22 insertions(+), 3 deletions(-)
-
---- a/net/wireless/mesh.c
-+++ b/net/wireless/mesh.c
-@@ -169,9 +169,28 @@ int __cfg80211_join_mesh(struct cfg80211
- 		enum nl80211_bss_scan_width scan_width;
- 		struct ieee80211_supported_band *sband =
- 				rdev->wiphy.bands[setup->chandef.chan->band];
--		scan_width = cfg80211_chandef_to_scan_width(&setup->chandef);
--		setup->basic_rates = ieee80211_mandatory_rates(sband,
--							       scan_width);
-+
-+		if (setup->chandef.chan->band == NL80211_BAND_2GHZ) {
-+			int i;
-+
-+			/*
-+			 * Older versions selected the mandatory rates for
-+			 * 2.4 GHz as well, but were broken in that only
-+			 * 1 Mbps was regarded as a mandatory rate. Keep
-+			 * using just 1 Mbps as the default basic rate for
-+			 * mesh to be interoperable with older versions.
-+			 */
-+			for (i = 0; i < sband->n_bitrates; i++) {
-+				if (sband->bitrates[i].bitrate == 10) {
-+					setup->basic_rates = BIT(i);
-+					break;
-+				}
-+			}
-+		} else {
-+			scan_width = cfg80211_chandef_to_scan_width(&setup->chandef);
-+			setup->basic_rates = ieee80211_mandatory_rates(sband,
-+								       scan_width);
-+		}
- 	}
- 
- 	err = cfg80211_chandef_dfs_required(&rdev->wiphy,
diff --git a/package/kernel/mac80211/patches/374-ath9k-Protect-queue-draining-by-rcu_read_lock.patch b/package/kernel/mac80211/patches/374-ath9k-Protect-queue-draining-by-rcu_read_lock.patch
deleted file mode 100644
index 0b599b73a..000000000
--- a/package/kernel/mac80211/patches/374-ath9k-Protect-queue-draining-by-rcu_read_lock.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>
-Date: Fri, 2 Feb 2018 11:36:45 +0100
-Subject: [PATCH] ath9k: Protect queue draining by rcu_read_lock()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When ath9k was switched over to use the mac80211 intermediate queues,
-node cleanup now drains the mac80211 queues. However, this call path is
-not protected by rcu_read_lock() as it was previously entirely internal
-to the driver which uses its own locking.
-
-This leads to a possible rcu_dereference() without holding
-rcu_read_lock(); but only if a station is cleaned up while having
-packets queued on the TXQ. Fix this by adding the rcu_read_lock() to the
-caller in ath9k.
-
-Fixes: 50f08edf9809 ("ath9k: Switch to using mac80211 intermediate software queues.")
-Cc: stable@vger.kernel.org
-Reported-by: Ben Greear <greearb@candelatech.com>
-Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
----
-
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -2915,6 +2915,8 @@ void ath_tx_node_cleanup(struct ath_soft
- 	struct ath_txq *txq;
- 	int tidno;
- 
-+	rcu_read_lock();
-+
- 	for (tidno = 0; tidno < IEEE80211_NUM_TIDS; tidno++) {
- 		tid = ath_node_to_tid(an, tidno);
- 		txq = tid->txq;
-@@ -2932,6 +2934,8 @@ void ath_tx_node_cleanup(struct ath_soft
- 		if (!an->sta)
- 			break; /* just one multicast ath_atx_tid */
- 	}
-+
-+	rcu_read_unlock();
- }
- 
- #ifdef CPTCFG_ATH9K_TX99
diff --git a/package/kernel/mac80211/patches/379-cfg80211-initialize-sinfo-in-cfg80211_get_station.patch b/package/kernel/mac80211/patches/379-cfg80211-initialize-sinfo-in-cfg80211_get_station.patch
deleted file mode 100644
index 37323c1f7..000000000
--- a/package/kernel/mac80211/patches/379-cfg80211-initialize-sinfo-in-cfg80211_get_station.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 4f717a2589be649afddbbd3ac58b67ebfa7426f7 Mon Sep 17 00:00:00 2001
-From: Sven Eckelmann <sven@narfation.org>
-Date: Wed, 6 Jun 2018 10:18:31 +0200
-Subject: [PATCH v2] cfg80211: initialize sinfo in cfg80211_get_station
-
-Most of the implementations behind cfg80211_get_station will not initialize
-sinfo to zero before manipulating it. For example, the member "filled",
-which indicates the filled in parts of this struct, is often only modified
-by enabling certain bits in the bitfield while keeping the remaining bits
-in their original state. A caller without a preinitialized sinfo.filled can
-then no longer decide which parts of sinfo were filled in by
-cfg80211_get_station (or actually the underlying implementations).
-
-cfg80211_get_station must therefore take care that sinfo is initialized to
-zero. Otherwise, the caller may tries to read information which was not
-filled in and which must therefore also be considered uninitialized. In
-batadv_v_elp_get_throughput's case, an invalid "random" expected throughput
-may be stored for this neighbor and thus the B.A.T.M.A.N V algorithm may
-switch to non-optimal neighbors for certain destinations.
-
-Fixes: 7406353d43c8 ("cfg80211: implement cfg80211_get_station cfg80211 API")
-Reported-by: Thomas Lauer <holminateur@gmail.com>
-Reported-by: Marcel Schmidt <ff.z-casparistrasse@mailbox.org>
-Cc: b.a.t.m.a.n@lists.open-mesh.org
-Signed-off-by: Sven Eckelmann <sven@narfation.org>
-
-Forwarded: https://patchwork.kernel.org/patch/10449857/
----
- net/wireless/util.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -1749,6 +1749,8 @@ int cfg80211_get_station(struct net_devi
- 	if (!rdev->ops->get_station)
- 		return -EOPNOTSUPP;
- 
-+	memset(sinfo, 0, sizeof(*sinfo));
-+
- 	return rdev_get_station(rdev, dev, mac_addr, sinfo);
- }
- EXPORT_SYMBOL(cfg80211_get_station);
diff --git a/package/kernel/mac80211/patches/380-0000-ath10k-handle-tdls-peer-events.patch b/package/kernel/mac80211/patches/380-0000-ath10k-handle-tdls-peer-events.patch
deleted file mode 100644
index 02c54600a..000000000
--- a/package/kernel/mac80211/patches/380-0000-ath10k-handle-tdls-peer-events.patch
+++ /dev/null
@@ -1,115 +0,0 @@
-From 8ed05ed06fca0136cf4546e804318f57ef823348 Mon Sep 17 00:00:00 2001
-From: Manikanta Pubbisetty <mpubbise@qti.qualcomm.com>
-Date: Mon, 6 Nov 2017 13:39:32 +0530
-Subject: [PATCH] ath10k: handle tdls peer events
-
-Handle tdls peer events from the target. TDLS events for the peer
-could be discover, teardown, etc. As of now, adding the logic to
-handle tdls teardown events alone.
-
-Teardown due to peer traffic indication(PTR) timeout is one such
-teardown event from the target.
-
-Tested this change on QCA9888 with 10.4-3.5.1-00018 fw version.
-
-Signed-off-by: Manikanta Pubbisetty <mpubbise@qti.qualcomm.com>
-Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
----
- drivers/net/wireless/ath/ath10k/wmi.c | 72 +++++++++++++++++++++++++++++++++++
- 1 file changed, 72 insertions(+)
-
---- a/drivers/net/wireless/ath/ath10k/wmi.c
-+++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -29,6 +29,7 @@
- #include "p2p.h"
- #include "hw.h"
- #include "hif.h"
-+#include "txrx.h"
- 
- #define ATH10K_WMI_BARRIER_ECHO_ID 0xBA991E9
- #define ATH10K_WMI_BARRIER_TIMEOUT_HZ (3 * HZ)
-@@ -4456,6 +4457,74 @@ void ath10k_wmi_event_pdev_tpc_config(st
- 		   __le32_to_cpu(ev->rate_max));
- }
- 
-+static void
-+ath10k_wmi_handle_tdls_peer_event(struct ath10k *ar, struct sk_buff *skb)
-+{
-+	struct wmi_tdls_peer_event *ev;
-+	struct ath10k_peer *peer;
-+	struct ath10k_vif *arvif;
-+	int vdev_id;
-+	int peer_status;
-+	int peer_reason;
-+	u8 reason;
-+
-+	if (skb->len < sizeof(*ev)) {
-+		ath10k_err(ar, "received tdls peer event with invalid size (%d bytes)\n",
-+			   skb->len);
-+		return;
-+	}
-+
-+	ev = (struct wmi_tdls_peer_event *)skb->data;
-+	vdev_id = __le32_to_cpu(ev->vdev_id);
-+	peer_status = __le32_to_cpu(ev->peer_status);
-+	peer_reason = __le32_to_cpu(ev->peer_reason);
-+
-+	spin_lock_bh(&ar->data_lock);
-+	peer = ath10k_peer_find(ar, vdev_id, ev->peer_macaddr.addr);
-+	spin_unlock_bh(&ar->data_lock);
-+
-+	if (!peer) {
-+		ath10k_warn(ar, "failed to find peer entry for %pM\n",
-+			    ev->peer_macaddr.addr);
-+		return;
-+	}
-+
-+	switch (peer_status) {
-+	case WMI_TDLS_SHOULD_TEARDOWN:
-+		switch (peer_reason) {
-+		case WMI_TDLS_TEARDOWN_REASON_PTR_TIMEOUT:
-+		case WMI_TDLS_TEARDOWN_REASON_NO_RESPONSE:
-+		case WMI_TDLS_TEARDOWN_REASON_RSSI:
-+			reason = WLAN_REASON_TDLS_TEARDOWN_UNREACHABLE;
-+			break;
-+		default:
-+			reason = WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED;
-+			break;
-+		}
-+
-+		arvif = ath10k_get_arvif(ar, vdev_id);
-+		if (!arvif) {
-+			ath10k_warn(ar, "received tdls peer event for invalid vdev id %u\n",
-+				    vdev_id);
-+			return;
-+		}
-+
-+		ieee80211_tdls_oper_request(arvif->vif, ev->peer_macaddr.addr,
-+					    NL80211_TDLS_TEARDOWN, reason,
-+					    GFP_ATOMIC);
-+
-+		ath10k_dbg(ar, ATH10K_DBG_WMI,
-+			   "received tdls teardown event for peer %pM reason %u\n",
-+			   ev->peer_macaddr.addr, peer_reason);
-+		break;
-+	default:
-+		ath10k_dbg(ar, ATH10K_DBG_WMI,
-+			   "received unknown tdls peer event %u\n",
-+			   peer_status);
-+		break;
-+	}
-+}
-+
- void ath10k_wmi_event_pdev_ftm_intg(struct ath10k *ar, struct sk_buff *skb)
- {
- 	ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_PDEV_FTM_INTG_EVENTID\n");
-@@ -5478,6 +5547,9 @@ static void ath10k_wmi_10_4_op_rx(struct
- 	case WMI_10_4_PDEV_TPC_CONFIG_EVENTID:
- 		ath10k_wmi_event_pdev_tpc_config(ar, skb);
- 		break;
-+	case WMI_10_4_TDLS_PEER_EVENTID:
-+		ath10k_wmi_handle_tdls_peer_event(ar, skb);
-+		break;
- 	default:
- 		ath10k_warn(ar, "Unknown eventid: %d\n", id);
- 		break;
diff --git a/package/kernel/mac80211/patches/380-0001-ath10k-wmi-modify-svc-bitmap-parsing-for-wcn3990.patch b/package/kernel/mac80211/patches/380-0001-ath10k-wmi-modify-svc-bitmap-parsing-for-wcn3990.patch
deleted file mode 100644
index 678813627..000000000
--- a/package/kernel/mac80211/patches/380-0001-ath10k-wmi-modify-svc-bitmap-parsing-for-wcn3990.patch
+++ /dev/null
@@ -1,215 +0,0 @@
-From 229329ff345f80c95202eaf2d7a0f2910c06144e Mon Sep 17 00:00:00 2001
-From: Rakesh Pillai <pillair@qti.qualcomm.com>
-Date: Mon, 11 Dec 2017 19:52:52 +0530
-Subject: [PATCH] ath10k: wmi: modify svc bitmap parsing for wcn3990
-
-Due to the limitation of wmi tlv parsing logic, if there are
-two parameters in a wmi event with same tlv tag, we can get only
-the last value, as it overwrites the prev value of the same tlv tag.
-
-The service ready event in wcn3990 contains two parameters of the
-same tag UINT32, due to which the svc bitmap is overwritten with the
-DBS support parameter.
-
-Refactor the service ready event parsing to allow parsing two tlv
-of the same tag UINT32 for wcn3990.
-
-Signed-off-by: Rakesh Pillai <pillair@qti.qualcomm.com>
-Signed-off-by: Govind Singh <govinds@qti.qualcomm.com>
-Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
----
- drivers/net/wireless/ath/ath10k/mac.c     |  4 +-
- drivers/net/wireless/ath/ath10k/wmi-tlv.c | 61 ++++++++++++++++++++++++-------
- drivers/net/wireless/ath/ath10k/wmi-tlv.h | 46 +++++++++++++++++++++++
- drivers/net/wireless/ath/ath10k/wmi.h     |  1 +
- 4 files changed, 97 insertions(+), 15 deletions(-)
-
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -3574,7 +3574,9 @@ ath10k_mac_tx_h_get_txpath(struct ath10k
- 		return ATH10K_MAC_TX_HTT;
- 	case ATH10K_HW_TXRX_MGMT:
- 		if (test_bit(ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX,
--			     ar->running_fw->fw_file.fw_features))
-+			     ar->running_fw->fw_file.fw_features) ||
-+			     test_bit(WMI_SERVICE_MGMT_TX_WMI,
-+				      ar->wmi.svc_map))
- 			return ATH10K_MAC_TX_WMI_MGMT;
- 		else if (ar->htt.target_version_major >= 3)
- 			return ATH10K_MAC_TX_HTT;
---- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
-+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
-@@ -917,33 +917,69 @@ ath10k_wmi_tlv_parse_mem_reqs(struct ath
- 	return -ENOMEM;
- }
- 
-+struct wmi_tlv_svc_rdy_parse {
-+	const struct hal_reg_capabilities *reg;
-+	const struct wmi_tlv_svc_rdy_ev *ev;
-+	const __le32 *svc_bmap;
-+	const struct wlan_host_mem_req *mem_reqs;
-+	bool svc_bmap_done;
-+	bool dbs_hw_mode_done;
-+};
-+
-+static int ath10k_wmi_tlv_svc_rdy_parse(struct ath10k *ar, u16 tag, u16 len,
-+					const void *ptr, void *data)
-+{
-+	struct wmi_tlv_svc_rdy_parse *svc_rdy = data;
-+
-+	switch (tag) {
-+	case WMI_TLV_TAG_STRUCT_SERVICE_READY_EVENT:
-+		svc_rdy->ev = ptr;
-+		break;
-+	case WMI_TLV_TAG_STRUCT_HAL_REG_CAPABILITIES:
-+		svc_rdy->reg = ptr;
-+		break;
-+	case WMI_TLV_TAG_ARRAY_STRUCT:
-+		svc_rdy->mem_reqs = ptr;
-+		break;
-+	case WMI_TLV_TAG_ARRAY_UINT32:
-+		if (!svc_rdy->svc_bmap_done) {
-+			svc_rdy->svc_bmap_done = true;
-+			svc_rdy->svc_bmap = ptr;
-+		} else if (!svc_rdy->dbs_hw_mode_done) {
-+			svc_rdy->dbs_hw_mode_done = true;
-+		}
-+		break;
-+	default:
-+		break;
-+	}
-+	return 0;
-+}
-+
- static int ath10k_wmi_tlv_op_pull_svc_rdy_ev(struct ath10k *ar,
- 					     struct sk_buff *skb,
- 					     struct wmi_svc_rdy_ev_arg *arg)
- {
--	const void **tb;
- 	const struct hal_reg_capabilities *reg;
- 	const struct wmi_tlv_svc_rdy_ev *ev;
- 	const __le32 *svc_bmap;
- 	const struct wlan_host_mem_req *mem_reqs;
-+	struct wmi_tlv_svc_rdy_parse svc_rdy = { };
- 	int ret;
- 
--	tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
--	if (IS_ERR(tb)) {
--		ret = PTR_ERR(tb);
-+	ret = ath10k_wmi_tlv_iter(ar, skb->data, skb->len,
-+				  ath10k_wmi_tlv_svc_rdy_parse, &svc_rdy);
-+	if (ret) {
- 		ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
- 		return ret;
- 	}
- 
--	ev = tb[WMI_TLV_TAG_STRUCT_SERVICE_READY_EVENT];
--	reg = tb[WMI_TLV_TAG_STRUCT_HAL_REG_CAPABILITIES];
--	svc_bmap = tb[WMI_TLV_TAG_ARRAY_UINT32];
--	mem_reqs = tb[WMI_TLV_TAG_ARRAY_STRUCT];
-+	ev = svc_rdy.ev;
-+	reg = svc_rdy.reg;
-+	svc_bmap = svc_rdy.svc_bmap;
-+	mem_reqs = svc_rdy.mem_reqs;
- 
--	if (!ev || !reg || !svc_bmap || !mem_reqs) {
--		kfree(tb);
-+	if (!ev || !reg || !svc_bmap || !mem_reqs)
- 		return -EPROTO;
--	}
- 
- 	/* This is an internal ABI compatibility check for WMI TLV so check it
- 	 * here instead of the generic WMI code.
-@@ -961,7 +997,6 @@ static int ath10k_wmi_tlv_op_pull_svc_rd
- 	    __le32_to_cpu(ev->abi.abi_ver_ns1) != WMI_TLV_ABI_VER_NS1 ||
- 	    __le32_to_cpu(ev->abi.abi_ver_ns2) != WMI_TLV_ABI_VER_NS2 ||
- 	    __le32_to_cpu(ev->abi.abi_ver_ns3) != WMI_TLV_ABI_VER_NS3) {
--		kfree(tb);
- 		return -ENOTSUPP;
- 	}
- 
-@@ -982,12 +1017,10 @@ static int ath10k_wmi_tlv_op_pull_svc_rd
- 	ret = ath10k_wmi_tlv_iter(ar, mem_reqs, ath10k_wmi_tlv_len(mem_reqs),
- 				  ath10k_wmi_tlv_parse_mem_reqs, arg);
- 	if (ret) {
--		kfree(tb);
- 		ath10k_warn(ar, "failed to parse mem_reqs tlv: %d\n", ret);
- 		return ret;
- 	}
- 
--	kfree(tb);
- 	return 0;
- }
- 
---- a/drivers/net/wireless/ath/ath10k/wmi-tlv.h
-+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.h
-@@ -965,6 +965,50 @@ enum wmi_tlv_service {
- 	WMI_TLV_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT,
- 	WMI_TLV_SERVICE_MDNS_OFFLOAD,
- 	WMI_TLV_SERVICE_SAP_AUTH_OFFLOAD,
-+	WMI_TLV_SERVICE_DUAL_BAND_SIMULTANEOUS_SUPPORT,
-+	WMI_TLV_SERVICE_OCB,
-+	WMI_TLV_SERVICE_AP_ARPNS_OFFLOAD,
-+	WMI_TLV_SERVICE_PER_BAND_CHAINMASK_SUPPORT,
-+	WMI_TLV_SERVICE_PACKET_FILTER_OFFLOAD,
-+	WMI_TLV_SERVICE_MGMT_TX_HTT,
-+	WMI_TLV_SERVICE_MGMT_TX_WMI,
-+	WMI_TLV_SERVICE_EXT_MSG,
-+	WMI_TLV_SERVICE_MAWC,
-+	WMI_TLV_SERVICE_PEER_ASSOC_CONF,
-+	WMI_TLV_SERVICE_EGAP,
-+	WMI_TLV_SERVICE_STA_PMF_OFFLOAD,
-+	WMI_TLV_SERVICE_UNIFIED_WOW_CAPABILITY,
-+	WMI_TLV_SERVICE_ENHANCED_PROXY_STA,
-+	WMI_TLV_SERVICE_ATF,
-+	WMI_TLV_SERVICE_COEX_GPIO,
-+	WMI_TLV_SERVICE_AUX_SPECTRAL_INTF,
-+	WMI_TLV_SERVICE_AUX_CHAN_LOAD_INTF,
-+	WMI_TLV_SERVICE_BSS_CHANNEL_INFO_64,
-+	WMI_TLV_SERVICE_ENTERPRISE_MESH,
-+	WMI_TLV_SERVICE_RESTRT_CHNL_SUPPORT,
-+	WMI_TLV_SERVICE_BPF_OFFLOAD,
-+	WMI_TLV_SERVICE_SYNC_DELETE_CMDS,
-+	WMI_TLV_SERVICE_SMART_ANTENNA_SW_SUPPORT,
-+	WMI_TLV_SERVICE_SMART_ANTENNA_HW_SUPPORT,
-+	WMI_TLV_SERVICE_RATECTRL_LIMIT_MAX_MIN_RATES,
-+	WMI_TLV_SERVICE_NAN_DATA,
-+	WMI_TLV_SERVICE_NAN_RTT,
-+	WMI_TLV_SERVICE_11AX,
-+	WMI_TLV_SERVICE_DEPRECATED_REPLACE,
-+	WMI_TLV_SERVICE_TDLS_CONN_TRACKER_IN_HOST_MODE,
-+	WMI_TLV_SERVICE_ENHANCED_MCAST_FILTER,
-+	WMI_TLV_SERVICE_PERIODIC_CHAN_STAT_SUPPORT,
-+	WMI_TLV_SERVICE_MESH_11S,
-+	WMI_TLV_SERVICE_HALF_RATE_QUARTER_RATE_SUPPORT,
-+	WMI_TLV_SERVICE_VDEV_RX_FILTER,
-+	WMI_TLV_SERVICE_P2P_LISTEN_OFFLOAD_SUPPORT,
-+	WMI_TLV_SERVICE_MARK_FIRST_WAKEUP_PACKET,
-+	WMI_TLV_SERVICE_MULTIPLE_MCAST_FILTER_SET,
-+	WMI_TLV_SERVICE_HOST_MANAGED_RX_REORDER,
-+	WMI_TLV_SERVICE_FLASH_RDWR_SUPPORT,
-+	WMI_TLV_SERVICE_WLAN_STATS_REPORT,
-+	WMI_TLV_SERVICE_TX_MSDU_ID_NEW_PARTITION_SUPPORT,
-+	WMI_TLV_SERVICE_DFS_PHYERR_OFFLOAD,
- };
- 
- #define WMI_SERVICE_IS_ENABLED(wmi_svc_bmap, svc_id, len) \
-@@ -1121,6 +1165,8 @@ wmi_tlv_svc_map(const __le32 *in, unsign
- 	       WMI_SERVICE_MDNS_OFFLOAD, len);
- 	SVCMAP(WMI_TLV_SERVICE_SAP_AUTH_OFFLOAD,
- 	       WMI_SERVICE_SAP_AUTH_OFFLOAD, len);
-+	SVCMAP(WMI_TLV_SERVICE_MGMT_TX_WMI,
-+	       WMI_SERVICE_MGMT_TX_WMI, len);
- }
- 
- #undef SVCMAP
---- a/drivers/net/wireless/ath/ath10k/wmi.h
-+++ b/drivers/net/wireless/ath/ath10k/wmi.h
-@@ -195,6 +195,7 @@ enum wmi_service {
- 	WMI_SERVICE_SMART_LOGGING_SUPPORT,
- 	WMI_SERVICE_TDLS_CONN_TRACKER_IN_HOST_MODE,
- 	WMI_SERVICE_TDLS_EXPLICIT_MODE_ONLY,
-+	WMI_SERVICE_MGMT_TX_WMI,
- 
- 	/* keep last */
- 	WMI_SERVICE_MAX,
diff --git a/package/kernel/mac80211/patches/380-0002-ath10k-advertise-TDLS-wider-bandwidth-support-for-5G.patch b/package/kernel/mac80211/patches/380-0002-ath10k-advertise-TDLS-wider-bandwidth-support-for-5G.patch
deleted file mode 100644
index b52451c92..000000000
--- a/package/kernel/mac80211/patches/380-0002-ath10k-advertise-TDLS-wider-bandwidth-support-for-5G.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 14d65775687cb3a6f76a52f48f4be27a522bb396 Mon Sep 17 00:00:00 2001
-From: Balaji Pothunoori <bpothuno@qti.qualcomm.com>
-Date: Thu, 21 Dec 2017 20:00:42 +0530
-Subject: [PATCH] ath10k: advertise TDLS wider bandwidth support for 5GHz
-
-Enable TDLS wider bandwidth support for 5GHz based on firmware wmi capabilities.
-
-This patch is required for chipset QCA9888. Tested with firmware version
-10.4-3.5.1-00018.
-
-Signed-off-by: Balaji Pothunoori <bpothuno@qti.qualcomm.com>
-Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
----
- drivers/net/wireless/ath/ath10k/mac.c | 3 ++-
- drivers/net/wireless/ath/ath10k/wmi.h | 5 +++++
- 2 files changed, 7 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -8236,7 +8236,8 @@ int ath10k_mac_register(struct ath10k *a
- 	if (test_bit(WMI_SERVICE_TDLS, ar->wmi.svc_map) ||
- 	    test_bit(WMI_SERVICE_TDLS_EXPLICIT_MODE_ONLY, ar->wmi.svc_map)) {
- 		ar->hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
--		ieee80211_hw_set(ar->hw, TDLS_WIDER_BW);
-+		if (test_bit(WMI_SERVICE_TDLS_WIDER_BANDWIDTH, ar->wmi.svc_map))
-+			ieee80211_hw_set(ar->hw, TDLS_WIDER_BW);
- 	}
- 
- 	ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
---- a/drivers/net/wireless/ath/ath10k/wmi.h
-+++ b/drivers/net/wireless/ath/ath10k/wmi.h
-@@ -196,6 +196,7 @@ enum wmi_service {
- 	WMI_SERVICE_TDLS_CONN_TRACKER_IN_HOST_MODE,
- 	WMI_SERVICE_TDLS_EXPLICIT_MODE_ONLY,
- 	WMI_SERVICE_MGMT_TX_WMI,
-+	WMI_SERVICE_TDLS_WIDER_BANDWIDTH,
- 
- 	/* keep last */
- 	WMI_SERVICE_MAX,
-@@ -337,6 +338,7 @@ enum wmi_10_4_service {
- 	WMI_10_4_SERVICE_TDLS_UAPSD_SLEEP_STA,
- 	WMI_10_4_SERVICE_TDLS_CONN_TRACKER_IN_HOST_MODE,
- 	WMI_10_4_SERVICE_TDLS_EXPLICIT_MODE_ONLY,
-+	WMI_10_4_SERVICE_TDLS_WIDER_BANDWIDTH,
- };
- 
- static inline char *wmi_service_name(int service_id)
-@@ -445,6 +447,7 @@ static inline char *wmi_service_name(int
- 	SVCSTR(WMI_SERVICE_SMART_LOGGING_SUPPORT);
- 	SVCSTR(WMI_SERVICE_TDLS_CONN_TRACKER_IN_HOST_MODE);
- 	SVCSTR(WMI_SERVICE_TDLS_EXPLICIT_MODE_ONLY);
-+	SVCSTR(WMI_SERVICE_TDLS_WIDER_BANDWIDTH);
- 	default:
- 		return NULL;
- 	}
-@@ -741,6 +744,8 @@ static inline void wmi_10_4_svc_map(cons
- 	       WMI_SERVICE_TDLS_CONN_TRACKER_IN_HOST_MODE, len);
- 	SVCMAP(WMI_10_4_SERVICE_TDLS_EXPLICIT_MODE_ONLY,
- 	       WMI_SERVICE_TDLS_EXPLICIT_MODE_ONLY, len);
-+	SVCMAP(WMI_10_4_SERVICE_TDLS_WIDER_BANDWIDTH,
-+	       WMI_SERVICE_TDLS_WIDER_BANDWIDTH, len);
- }
- 
- #undef SVCMAP
diff --git a/package/kernel/mac80211/patches/380-0003-ath10k-debugfs-support-to-get-final-TPC-stats-for-10.patch b/package/kernel/mac80211/patches/380-0003-ath10k-debugfs-support-to-get-final-TPC-stats-for-10.patch
deleted file mode 100644
index 2e828c426..000000000
--- a/package/kernel/mac80211/patches/380-0003-ath10k-debugfs-support-to-get-final-TPC-stats-for-10.patch
+++ /dev/null
@@ -1,824 +0,0 @@
-From bc64d05220f3e34cf432a166b83c8fff14cd7a3d Mon Sep 17 00:00:00 2001
-From: Maharaja Kennadyrajan <mkenna@codeaurora.org>
-Date: Wed, 14 Mar 2018 12:14:08 +0200
-Subject: [PATCH] ath10k: debugfs support to get final TPC stats for 10.4
- variants
-
-Export the final Transmit Power Control (TPC) value, which is the
-minimum of control power and existing TPC value to user space via
-a new debugfs file "tpc_stats_final" to help with debugging.
-It works with the new wmi cmd and event introduced in 10.4 firmware
-branch.
-
-WMI command ID: WMI_PDEV_GET_TPC_TABLE_CMDID
-WMI event ID: WMI_PDEV_TPC_TABLE_EVENTID
-
-cat /sys/kernel/debug/ieee80211/phyX/ath10k/tpc_stats_final
-
-$ cat /sys/kernel/debug/ieee80211/phyX/ath10k/tpc_stats_final
-
-TPC config for channel 5180 mode 10
-
-CTL             =  0x 0 Reg. Domain             = 58
-Antenna Gain    =  0 Reg. Max Antenna Gain      =   0
-Power Limit     = 60 Reg. Max Power             = 60
-Num tx chains   =  2 Num supported rates        = 109
-
-******************* CDD POWER TABLE ****************
-
-No.  Preamble Rate_code tpc_value1 tpc_value2 tpc_value3
-0    CCK      0x40        0          0
-1    CCK      0x41        0          0
-[...]
-107  HTCUP    0x 0       46          46
-108  HTCUP    0x 0       46          46
-
-******************* STBC POWER TABLE ****************
-
-No.  Preamble Rate_code tpc_value1 tpc_value2 tpc_value3
-0    CCK      0x40        0          0
-1    CCK      0x41        0          0
-[...]
-107  HTCUP    0x 0        46         46
-108  HTCUP    0x 0        46         46
-
-***********************************
-TXBF not supported
-**********************************
-
-The existing tpc_stats debugfs file provides the dump
-which is minimum of target power and regulatory domain.
-
-cat /sys/kernel/debug/ieee80211/phyX/ath10k/tpc_stats
-
-Hardware_used: QCA4019
-Firmware version: firmware-5.bin_10.4-3.0-00209
-
-Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/ath/ath10k/core.h    |  22 +++
- drivers/net/wireless/ath/ath10k/debug.c   | 107 +++++++++++
- drivers/net/wireless/ath/ath10k/debug.h   |  10 +
- drivers/net/wireless/ath/ath10k/wmi-ops.h |  20 ++
- drivers/net/wireless/ath/ath10k/wmi.c     | 308 ++++++++++++++++++++++++++++--
- drivers/net/wireless/ath/ath10k/wmi.h     |  66 +++++++
- 6 files changed, 518 insertions(+), 15 deletions(-)
-
---- a/drivers/net/wireless/ath/ath10k/core.h
-+++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -322,6 +322,27 @@ struct ath10k_tpc_stats {
- 	struct ath10k_tpc_table tpc_table[WMI_TPC_FLAG];
- };
- 
-+struct ath10k_tpc_table_final {
-+	u32 pream_idx[WMI_TPC_FINAL_RATE_MAX];
-+	u8 rate_code[WMI_TPC_FINAL_RATE_MAX];
-+	char tpc_value[WMI_TPC_FINAL_RATE_MAX][WMI_TPC_TX_N_CHAIN * WMI_TPC_BUF_SIZE];
-+};
-+
-+struct ath10k_tpc_stats_final {
-+	u32 reg_domain;
-+	u32 chan_freq;
-+	u32 phy_mode;
-+	u32 twice_antenna_reduction;
-+	u32 twice_max_rd_power;
-+	s32 twice_antenna_gain;
-+	u32 power_limit;
-+	u32 num_tx_chain;
-+	u32 ctl;
-+	u32 rate_max;
-+	u8 flag[WMI_TPC_FLAG];
-+	struct ath10k_tpc_table_final tpc_table_final[WMI_TPC_FLAG];
-+};
-+
- struct ath10k_dfs_stats {
- 	u32 phy_errors;
- 	u32 pulses_total;
-@@ -482,6 +503,7 @@ struct ath10k_debug {
- 
- 	/* used for tpc-dump storage, protected by data-lock */
- 	struct ath10k_tpc_stats *tpc_stats;
-+	struct ath10k_tpc_stats_final *tpc_stats_final;
- 
- 	struct completion tpc_complete;
- 
---- a/drivers/net/wireless/ath/ath10k/debug.c
-+++ b/drivers/net/wireless/ath/ath10k/debug.c
-@@ -1737,6 +1737,19 @@ void ath10k_debug_tpc_stats_process(stru
- 	spin_unlock_bh(&ar->data_lock);
- }
- 
-+void
-+ath10k_debug_tpc_stats_final_process(struct ath10k *ar,
-+				     struct ath10k_tpc_stats_final *tpc_stats)
-+{
-+	spin_lock_bh(&ar->data_lock);
-+
-+	kfree(ar->debug.tpc_stats_final);
-+	ar->debug.tpc_stats_final = tpc_stats;
-+	complete(&ar->debug.tpc_complete);
-+
-+	spin_unlock_bh(&ar->data_lock);
-+}
-+
- static void ath10k_tpc_stats_print(struct ath10k_tpc_stats *tpc_stats,
- 				   unsigned int j, char *buf, size_t *len)
- {
-@@ -2400,6 +2413,95 @@ static const struct file_operations fops
- 	.llseek = default_llseek,
- };
- 
-+static int ath10k_debug_tpc_stats_final_request(struct ath10k *ar)
-+{
-+	int ret;
-+	unsigned long time_left;
-+
-+	lockdep_assert_held(&ar->conf_mutex);
-+
-+	reinit_completion(&ar->debug.tpc_complete);
-+
-+	ret = ath10k_wmi_pdev_get_tpc_table_cmdid(ar, WMI_TPC_CONFIG_PARAM);
-+	if (ret) {
-+		ath10k_warn(ar, "failed to request tpc table cmdid: %d\n", ret);
-+		return ret;
-+	}
-+
-+	time_left = wait_for_completion_timeout(&ar->debug.tpc_complete,
-+						1 * HZ);
-+	if (time_left == 0)
-+		return -ETIMEDOUT;
-+
-+	return 0;
-+}
-+
-+static int ath10k_tpc_stats_final_open(struct inode *inode, struct file *file)
-+{
-+	struct ath10k *ar = inode->i_private;
-+	void *buf;
-+	int ret;
-+
-+	mutex_lock(&ar->conf_mutex);
-+
-+	if (ar->state != ATH10K_STATE_ON) {
-+		ret = -ENETDOWN;
-+		goto err_unlock;
-+	}
-+
-+	buf = vmalloc(ATH10K_TPC_CONFIG_BUF_SIZE);
-+	if (!buf) {
-+		ret = -ENOMEM;
-+		goto err_unlock;
-+	}
-+
-+	ret = ath10k_debug_tpc_stats_final_request(ar);
-+	if (ret) {
-+		ath10k_warn(ar, "failed to request tpc stats final: %d\n",
-+			    ret);
-+		goto err_free;
-+	}
-+
-+	ath10k_tpc_stats_fill(ar, ar->debug.tpc_stats, buf);
-+	file->private_data = buf;
-+
-+	mutex_unlock(&ar->conf_mutex);
-+	return 0;
-+
-+err_free:
-+	vfree(buf);
-+
-+err_unlock:
-+	mutex_unlock(&ar->conf_mutex);
-+	return ret;
-+}
-+
-+static int ath10k_tpc_stats_final_release(struct inode *inode,
-+					  struct file *file)
-+{
-+	vfree(file->private_data);
-+
-+	return 0;
-+}
-+
-+static ssize_t ath10k_tpc_stats_final_read(struct file *file,
-+					   char __user *user_buf,
-+					   size_t count, loff_t *ppos)
-+{
-+	const char *buf = file->private_data;
-+	unsigned int len = strlen(buf);
-+
-+	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-+}
-+
-+static const struct file_operations fops_tpc_stats_final = {
-+	.open = ath10k_tpc_stats_final_open,
-+	.release = ath10k_tpc_stats_final_release,
-+	.read = ath10k_tpc_stats_final_read,
-+	.owner = THIS_MODULE,
-+	.llseek = default_llseek,
-+};
-+
- int ath10k_debug_create(struct ath10k *ar)
- {
- 	ar->debug.fw_crash_data = vzalloc(sizeof(*ar->debug.fw_crash_data));
-@@ -2525,6 +2627,11 @@ int ath10k_debug_register(struct ath10k
- 	debugfs_create_file("fw_checksums", 0400, ar->debug.debugfs_phy, ar,
- 			    &fops_fw_checksums);
- 
-+	if (test_bit(WMI_SERVICE_TPC_STATS_FINAL, ar->wmi.svc_map))
-+		debugfs_create_file("tpc_stats_final", 0400,
-+				    ar->debug.debugfs_phy, ar,
-+				    &fops_tpc_stats_final);
-+
- 	return 0;
- }
- 
---- a/drivers/net/wireless/ath/ath10k/debug.h
-+++ b/drivers/net/wireless/ath/ath10k/debug.h
-@@ -84,6 +84,9 @@ void ath10k_debug_unregister(struct ath1
- void ath10k_debug_fw_stats_process(struct ath10k *ar, struct sk_buff *skb);
- void ath10k_debug_tpc_stats_process(struct ath10k *ar,
- 				    struct ath10k_tpc_stats *tpc_stats);
-+void
-+ath10k_debug_tpc_stats_final_process(struct ath10k *ar,
-+				     struct ath10k_tpc_stats_final *tpc_stats);
- struct ath10k_fw_crash_data *
- ath10k_debug_get_new_fw_crash_data(struct ath10k *ar);
- 
-@@ -151,6 +154,13 @@ static inline void ath10k_debug_tpc_stat
- {
- 	kfree(tpc_stats);
- }
-+
-+static inline void
-+ath10k_debug_tpc_stats_final_process(struct ath10k *ar,
-+				     struct ath10k_tpc_stats_final *tpc_stats)
-+{
-+	kfree(tpc_stats);
-+}
- 
- static inline void ath10k_debug_dbglog_add(struct ath10k *ar, u8 *buffer,
- 					   int len)
---- a/drivers/net/wireless/ath/ath10k/wmi-ops.h
-+++ b/drivers/net/wireless/ath/ath10k/wmi-ops.h
-@@ -197,6 +197,9 @@ struct wmi_ops {
- 					(struct ath10k *ar,
- 					 enum wmi_bss_survey_req_type type);
- 	struct sk_buff *(*gen_echo)(struct ath10k *ar, u32 value);
-+	struct sk_buff *(*gen_pdev_get_tpc_table_cmdid)(struct ath10k *ar,
-+							u32 param);
-+
- };
- 
- int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id);
-@@ -1418,4 +1421,21 @@ ath10k_wmi_echo(struct ath10k *ar, u32 v
- 	return ath10k_wmi_cmd_send(ar, skb, wmi->cmd->echo_cmdid);
- }
- 
-+static inline int
-+ath10k_wmi_pdev_get_tpc_table_cmdid(struct ath10k *ar, u32 param)
-+{
-+	struct sk_buff *skb;
-+
-+	if (!ar->wmi.ops->gen_pdev_get_tpc_table_cmdid)
-+		return -EOPNOTSUPP;
-+
-+	skb = ar->wmi.ops->gen_pdev_get_tpc_table_cmdid(ar, param);
-+
-+	if (IS_ERR(skb))
-+		return PTR_ERR(skb);
-+
-+	return ath10k_wmi_cmd_send(ar, skb,
-+				   ar->wmi.cmd->pdev_get_tpc_table_cmdid);
-+}
-+
- #endif
---- a/drivers/net/wireless/ath/ath10k/wmi.c
-+++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -1,6 +1,7 @@
- /*
-  * Copyright (c) 2005-2011 Atheros Communications Inc.
-  * Copyright (c) 2011-2013 Qualcomm Atheros, Inc.
-+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
-  *
-  * Permission to use, copy, modify, and/or distribute this software for any
-  * purpose with or without fee is hereby granted, provided that the above
-@@ -196,6 +197,7 @@ static struct wmi_cmd_map wmi_cmd_map =
- 	.mu_cal_start_cmdid = WMI_CMD_UNSUPPORTED,
- 	.set_cca_params_cmdid = WMI_CMD_UNSUPPORTED,
- 	.pdev_bss_chan_info_request_cmdid = WMI_CMD_UNSUPPORTED,
-+	.pdev_get_tpc_table_cmdid = WMI_CMD_UNSUPPORTED,
- };
- 
- /* 10.X WMI cmd track */
-@@ -362,6 +364,7 @@ static struct wmi_cmd_map wmi_10x_cmd_ma
- 	.mu_cal_start_cmdid = WMI_CMD_UNSUPPORTED,
- 	.set_cca_params_cmdid = WMI_CMD_UNSUPPORTED,
- 	.pdev_bss_chan_info_request_cmdid = WMI_CMD_UNSUPPORTED,
-+	.pdev_get_tpc_table_cmdid = WMI_CMD_UNSUPPORTED,
- };
- 
- /* 10.2.4 WMI cmd track */
-@@ -528,6 +531,7 @@ static struct wmi_cmd_map wmi_10_2_4_cmd
- 	.set_cca_params_cmdid = WMI_CMD_UNSUPPORTED,
- 	.pdev_bss_chan_info_request_cmdid =
- 		WMI_10_2_PDEV_BSS_CHAN_INFO_REQUEST_CMDID,
-+	.pdev_get_tpc_table_cmdid = WMI_CMD_UNSUPPORTED,
- };
- 
- /* 10.4 WMI cmd track */
-@@ -1480,6 +1484,7 @@ static struct wmi_cmd_map wmi_10_2_cmd_m
- 	.pdev_get_ani_cck_config_cmdid = WMI_CMD_UNSUPPORTED,
- 	.pdev_get_ani_ofdm_config_cmdid = WMI_CMD_UNSUPPORTED,
- 	.pdev_reserve_ast_entry_cmdid = WMI_CMD_UNSUPPORTED,
-+	.pdev_get_tpc_table_cmdid = WMI_CMD_UNSUPPORTED,
- };
- 
- static struct wmi_pdev_param_map wmi_10_4_pdev_param_map = {
-@@ -4313,19 +4318,11 @@ static void ath10k_tpc_config_disp_table
- 	}
- }
- 
--void ath10k_wmi_event_pdev_tpc_config(struct ath10k *ar, struct sk_buff *skb)
-+void ath10k_wmi_tpc_config_get_rate_code(u8 *rate_code, u16 *pream_table,
-+					 u32 num_tx_chain)
- {
--	u32 i, j, pream_idx, num_tx_chain;
--	u8 rate_code[WMI_TPC_RATE_MAX], rate_idx;
--	u16 pream_table[WMI_TPC_PREAM_TABLE_MAX];
--	struct wmi_pdev_tpc_config_event *ev;
--	struct ath10k_tpc_stats *tpc_stats;
--
--	ev = (struct wmi_pdev_tpc_config_event *)skb->data;
--
--	tpc_stats = kzalloc(sizeof(*tpc_stats), GFP_ATOMIC);
--	if (!tpc_stats)
--		return;
-+	u32 i, j, pream_idx;
-+	u8 rate_idx;
- 
- 	/* Create the rate code table based on the chains supported */
- 	rate_idx = 0;
-@@ -4349,8 +4346,6 @@ void ath10k_wmi_event_pdev_tpc_config(st
- 	pream_table[pream_idx] = rate_idx;
- 	pream_idx++;
- 
--	num_tx_chain = __le32_to_cpu(ev->num_tx_chain);
--
- 	/* Fill HT20 rate code */
- 	for (i = 0; i < num_tx_chain; i++) {
- 		for (j = 0; j < 8; j++) {
-@@ -4374,7 +4369,7 @@ void ath10k_wmi_event_pdev_tpc_config(st
- 	pream_idx++;
- 
- 	/* Fill VHT20 rate code */
--	for (i = 0; i < __le32_to_cpu(ev->num_tx_chain); i++) {
-+	for (i = 0; i < num_tx_chain; i++) {
- 		for (j = 0; j < 10; j++) {
- 			rate_code[rate_idx] =
- 			ATH10K_HW_RATECODE(j, i, WMI_RATE_PREAMBLE_VHT);
-@@ -4418,6 +4413,26 @@ void ath10k_wmi_event_pdev_tpc_config(st
- 		ATH10K_HW_RATECODE(0, 0, WMI_RATE_PREAMBLE_OFDM);
- 
- 	pream_table[pream_idx] = ATH10K_TPC_PREAM_TABLE_END;
-+}
-+
-+void ath10k_wmi_event_pdev_tpc_config(struct ath10k *ar, struct sk_buff *skb)
-+{
-+	u32 num_tx_chain;
-+	u8 rate_code[WMI_TPC_RATE_MAX];
-+	u16 pream_table[WMI_TPC_PREAM_TABLE_MAX];
-+	struct wmi_pdev_tpc_config_event *ev;
-+	struct ath10k_tpc_stats *tpc_stats;
-+
-+	ev = (struct wmi_pdev_tpc_config_event *)skb->data;
-+
-+	tpc_stats = kzalloc(sizeof(*tpc_stats), GFP_ATOMIC);
-+	if (!tpc_stats)
-+		return;
-+
-+	num_tx_chain = __le32_to_cpu(ev->num_tx_chain);
-+
-+	ath10k_wmi_tpc_config_get_rate_code(rate_code, pream_table,
-+					    num_tx_chain);
- 
- 	tpc_stats->chan_freq = __le32_to_cpu(ev->chan_freq);
- 	tpc_stats->phy_mode = __le32_to_cpu(ev->phy_mode);
-@@ -4457,6 +4472,246 @@ void ath10k_wmi_event_pdev_tpc_config(st
- 		   __le32_to_cpu(ev->rate_max));
- }
- 
-+static u8
-+ath10k_wmi_tpc_final_get_rate(struct ath10k *ar,
-+			      struct wmi_pdev_tpc_final_table_event *ev,
-+			      u32 rate_idx, u32 num_chains,
-+			      u32 rate_code, u8 type, u32 pream_idx)
-+{
-+	u8 tpc, num_streams, preamble, ch, stm_idx;
-+	s8 pow_agcdd, pow_agstbc, pow_agtxbf;
-+	int pream;
-+
-+	num_streams = ATH10K_HW_NSS(rate_code);
-+	preamble = ATH10K_HW_PREAMBLE(rate_code);
-+	ch = num_chains - 1;
-+	stm_idx = num_streams - 1;
-+	pream = -1;
-+
-+	if (__le32_to_cpu(ev->chan_freq) <= 2483) {
-+		switch (pream_idx) {
-+		case WMI_TPC_PREAM_2GHZ_CCK:
-+			pream = 0;
-+			break;
-+		case WMI_TPC_PREAM_2GHZ_OFDM:
-+			pream = 1;
-+			break;
-+		case WMI_TPC_PREAM_2GHZ_HT20:
-+		case WMI_TPC_PREAM_2GHZ_VHT20:
-+			pream = 2;
-+			break;
-+		case WMI_TPC_PREAM_2GHZ_HT40:
-+		case WMI_TPC_PREAM_2GHZ_VHT40:
-+			pream = 3;
-+			break;
-+		case WMI_TPC_PREAM_2GHZ_VHT80:
-+			pream = 4;
-+			break;
-+		default:
-+			pream = -1;
-+			break;
-+		}
-+	}
-+
-+	if (__le32_to_cpu(ev->chan_freq) >= 5180) {
-+		switch (pream_idx) {
-+		case WMI_TPC_PREAM_5GHZ_OFDM:
-+			pream = 0;
-+			break;
-+		case WMI_TPC_PREAM_5GHZ_HT20:
-+		case WMI_TPC_PREAM_5GHZ_VHT20:
-+			pream = 1;
-+			break;
-+		case WMI_TPC_PREAM_5GHZ_HT40:
-+		case WMI_TPC_PREAM_5GHZ_VHT40:
-+			pream = 2;
-+			break;
-+		case WMI_TPC_PREAM_5GHZ_VHT80:
-+			pream = 3;
-+			break;
-+		case WMI_TPC_PREAM_5GHZ_HTCUP:
-+			pream = 4;
-+			break;
-+		default:
-+			pream = -1;
-+			break;
-+		}
-+	}
-+
-+	if (pream == 4)
-+		tpc = min_t(u8, ev->rates_array[rate_idx],
-+			    ev->max_reg_allow_pow[ch]);
-+	else
-+		tpc = min_t(u8, min_t(u8, ev->rates_array[rate_idx],
-+				      ev->max_reg_allow_pow[ch]),
-+			    ev->ctl_power_table[0][pream][stm_idx]);
-+
-+	if (__le32_to_cpu(ev->num_tx_chain) <= 1)
-+		goto out;
-+
-+	if (preamble == WMI_RATE_PREAMBLE_CCK)
-+		goto out;
-+
-+	if (num_chains <= num_streams)
-+		goto out;
-+
-+	switch (type) {
-+	case WMI_TPC_TABLE_TYPE_STBC:
-+		pow_agstbc = ev->max_reg_allow_pow_agstbc[ch - 1][stm_idx];
-+		if (pream == 4)
-+			tpc = min_t(u8, tpc, pow_agstbc);
-+		else
-+			tpc = min_t(u8, min_t(u8, tpc, pow_agstbc),
-+				    ev->ctl_power_table[0][pream][stm_idx]);
-+		break;
-+	case WMI_TPC_TABLE_TYPE_TXBF:
-+		pow_agtxbf = ev->max_reg_allow_pow_agtxbf[ch - 1][stm_idx];
-+		if (pream == 4)
-+			tpc = min_t(u8, tpc, pow_agtxbf);
-+		else
-+			tpc = min_t(u8, min_t(u8, tpc, pow_agtxbf),
-+				    ev->ctl_power_table[1][pream][stm_idx]);
-+		break;
-+	case WMI_TPC_TABLE_TYPE_CDD:
-+		pow_agcdd = ev->max_reg_allow_pow_agcdd[ch - 1][stm_idx];
-+		if (pream == 4)
-+			tpc = min_t(u8, tpc, pow_agcdd);
-+		else
-+			tpc = min_t(u8, min_t(u8, tpc, pow_agcdd),
-+				    ev->ctl_power_table[0][pream][stm_idx]);
-+		break;
-+	default:
-+		ath10k_warn(ar, "unknown wmi tpc final table type: %d\n", type);
-+		tpc = 0;
-+		break;
-+	}
-+
-+out:
-+	return tpc;
-+}
-+
-+static void
-+ath10k_wmi_tpc_stats_final_disp_tables(struct ath10k *ar,
-+				       struct wmi_pdev_tpc_final_table_event *ev,
-+				       struct ath10k_tpc_stats_final *tpc_stats,
-+				       u8 *rate_code, u16 *pream_table, u8 type)
-+{
-+	u32 i, j, pream_idx, flags;
-+	u8 tpc[WMI_TPC_TX_N_CHAIN];
-+	char tpc_value[WMI_TPC_TX_N_CHAIN * WMI_TPC_BUF_SIZE];
-+	char buff[WMI_TPC_BUF_SIZE];
-+
-+	flags = __le32_to_cpu(ev->flags);
-+
-+	switch (type) {
-+	case WMI_TPC_TABLE_TYPE_CDD:
-+		if (!(flags & WMI_TPC_CONFIG_EVENT_FLAG_TABLE_CDD)) {
-+			ath10k_dbg(ar, ATH10K_DBG_WMI, "CDD not supported\n");
-+			tpc_stats->flag[type] = ATH10K_TPC_TABLE_TYPE_FLAG;
-+			return;
-+		}
-+		break;
-+	case WMI_TPC_TABLE_TYPE_STBC:
-+		if (!(flags & WMI_TPC_CONFIG_EVENT_FLAG_TABLE_STBC)) {
-+			ath10k_dbg(ar, ATH10K_DBG_WMI, "STBC not supported\n");
-+			tpc_stats->flag[type] = ATH10K_TPC_TABLE_TYPE_FLAG;
-+			return;
-+		}
-+		break;
-+	case WMI_TPC_TABLE_TYPE_TXBF:
-+		if (!(flags & WMI_TPC_CONFIG_EVENT_FLAG_TABLE_TXBF)) {
-+			ath10k_dbg(ar, ATH10K_DBG_WMI, "TXBF not supported\n");
-+			tpc_stats->flag[type] = ATH10K_TPC_TABLE_TYPE_FLAG;
-+			return;
-+		}
-+		break;
-+	default:
-+		ath10k_dbg(ar, ATH10K_DBG_WMI,
-+			   "invalid table type in wmi tpc event: %d\n", type);
-+		return;
-+	}
-+
-+	pream_idx = 0;
-+	for (i = 0; i < __le32_to_cpu(ev->rate_max); i++) {
-+		memset(tpc_value, 0, sizeof(tpc_value));
-+		memset(buff, 0, sizeof(buff));
-+		if (i == pream_table[pream_idx])
-+			pream_idx++;
-+
-+		for (j = 0; j < WMI_TPC_TX_N_CHAIN; j++) {
-+			if (j >= __le32_to_cpu(ev->num_tx_chain))
-+				break;
-+
-+			tpc[j] = ath10k_wmi_tpc_final_get_rate(ar, ev, i, j + 1,
-+							       rate_code[i],
-+							       type, pream_idx);
-+			snprintf(buff, sizeof(buff), "%8d ", tpc[j]);
-+			strncat(tpc_value, buff, strlen(buff));
-+		}
-+		tpc_stats->tpc_table_final[type].pream_idx[i] = pream_idx;
-+		tpc_stats->tpc_table_final[type].rate_code[i] = rate_code[i];
-+		memcpy(tpc_stats->tpc_table_final[type].tpc_value[i],
-+		       tpc_value, sizeof(tpc_value));
-+	}
-+}
-+
-+void ath10k_wmi_event_tpc_final_table(struct ath10k *ar, struct sk_buff *skb)
-+{
-+	u32 num_tx_chain;
-+	u8 rate_code[WMI_TPC_FINAL_RATE_MAX];
-+	u16 pream_table[WMI_TPC_PREAM_TABLE_MAX];
-+	struct wmi_pdev_tpc_final_table_event *ev;
-+	struct ath10k_tpc_stats_final *tpc_stats;
-+
-+	ev = (struct wmi_pdev_tpc_final_table_event *)skb->data;
-+
-+	tpc_stats = kzalloc(sizeof(*tpc_stats), GFP_ATOMIC);
-+	if (!tpc_stats)
-+		return;
-+
-+	num_tx_chain = __le32_to_cpu(ev->num_tx_chain);
-+
-+	ath10k_wmi_tpc_config_get_rate_code(rate_code, pream_table,
-+					    num_tx_chain);
-+
-+	tpc_stats->chan_freq = __le32_to_cpu(ev->chan_freq);
-+	tpc_stats->phy_mode = __le32_to_cpu(ev->phy_mode);
-+	tpc_stats->ctl = __le32_to_cpu(ev->ctl);
-+	tpc_stats->reg_domain = __le32_to_cpu(ev->reg_domain);
-+	tpc_stats->twice_antenna_gain = a_sle32_to_cpu(ev->twice_antenna_gain);
-+	tpc_stats->twice_antenna_reduction =
-+		__le32_to_cpu(ev->twice_antenna_reduction);
-+	tpc_stats->power_limit = __le32_to_cpu(ev->power_limit);
-+	tpc_stats->twice_max_rd_power = __le32_to_cpu(ev->twice_max_rd_power);
-+	tpc_stats->num_tx_chain = __le32_to_cpu(ev->num_tx_chain);
-+	tpc_stats->rate_max = __le32_to_cpu(ev->rate_max);
-+
-+	ath10k_wmi_tpc_stats_final_disp_tables(ar, ev, tpc_stats,
-+					       rate_code, pream_table,
-+					       WMI_TPC_TABLE_TYPE_CDD);
-+	ath10k_wmi_tpc_stats_final_disp_tables(ar, ev,  tpc_stats,
-+					       rate_code, pream_table,
-+					       WMI_TPC_TABLE_TYPE_STBC);
-+	ath10k_wmi_tpc_stats_final_disp_tables(ar, ev, tpc_stats,
-+					       rate_code, pream_table,
-+					       WMI_TPC_TABLE_TYPE_TXBF);
-+
-+	ath10k_debug_tpc_stats_final_process(ar, tpc_stats);
-+
-+	ath10k_dbg(ar, ATH10K_DBG_WMI,
-+		   "wmi event tpc final table channel %d mode %d ctl %d regd %d gain %d %d limit %d max_power %d tx_chanins %d rates %d\n",
-+		   __le32_to_cpu(ev->chan_freq),
-+		   __le32_to_cpu(ev->phy_mode),
-+		   __le32_to_cpu(ev->ctl),
-+		   __le32_to_cpu(ev->reg_domain),
-+		   a_sle32_to_cpu(ev->twice_antenna_gain),
-+		   __le32_to_cpu(ev->twice_antenna_reduction),
-+		   __le32_to_cpu(ev->power_limit),
-+		   __le32_to_cpu(ev->twice_max_rd_power) / 2,
-+		   __le32_to_cpu(ev->num_tx_chain),
-+		   __le32_to_cpu(ev->rate_max));
-+}
-+
- static void
- ath10k_wmi_handle_tdls_peer_event(struct ath10k *ar, struct sk_buff *skb)
- {
-@@ -5550,6 +5805,9 @@ static void ath10k_wmi_10_4_op_rx(struct
- 	case WMI_10_4_TDLS_PEER_EVENTID:
- 		ath10k_wmi_handle_tdls_peer_event(ar, skb);
- 		break;
-+	case WMI_10_4_PDEV_TPC_TABLE_EVENTID:
-+		ath10k_wmi_event_tpc_final_table(ar, skb);
-+		break;
- 	default:
- 		ath10k_warn(ar, "Unknown eventid: %d\n", id);
- 		break;
-@@ -7990,6 +8248,24 @@ static u32 ath10k_wmi_prepare_peer_qos(u
- }
- 
- static struct sk_buff *
-+ath10k_wmi_10_4_op_gen_pdev_get_tpc_table_cmdid(struct ath10k *ar, u32 param)
-+{
-+	struct wmi_pdev_get_tpc_table_cmd *cmd;
-+	struct sk_buff *skb;
-+
-+	skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
-+	if (!skb)
-+		return ERR_PTR(-ENOMEM);
-+
-+	cmd = (struct wmi_pdev_get_tpc_table_cmd *)skb->data;
-+	cmd->param = __cpu_to_le32(param);
-+
-+	ath10k_dbg(ar, ATH10K_DBG_WMI,
-+		   "wmi pdev get tpc table param:%d\n", param);
-+	return skb;
-+}
-+
-+static struct sk_buff *
- ath10k_wmi_10_4_gen_tdls_peer_update(struct ath10k *ar,
- 				     const struct wmi_tdls_peer_update_cmd_arg *arg,
- 				     const struct wmi_tdls_peer_capab_arg *cap,
-@@ -8430,6 +8706,8 @@ static const struct wmi_ops wmi_10_4_ops
- 	.ext_resource_config = ath10k_wmi_10_4_ext_resource_config,
- 	.gen_update_fw_tdls_state = ath10k_wmi_10_4_gen_update_fw_tdls_state,
- 	.gen_tdls_peer_update = ath10k_wmi_10_4_gen_tdls_peer_update,
-+	.gen_pdev_get_tpc_table_cmdid =
-+			ath10k_wmi_10_4_op_gen_pdev_get_tpc_table_cmdid,
- 
- 	/* shared with 10.2 */
- 	.pull_echo_ev = ath10k_wmi_op_pull_echo_ev,
---- a/drivers/net/wireless/ath/ath10k/wmi.h
-+++ b/drivers/net/wireless/ath/ath10k/wmi.h
-@@ -1,6 +1,7 @@
- /*
-  * Copyright (c) 2005-2011 Atheros Communications Inc.
-  * Copyright (c) 2011-2013 Qualcomm Atheros, Inc.
-+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
-  *
-  * Permission to use, copy, modify, and/or distribute this software for any
-  * purpose with or without fee is hereby granted, provided that the above
-@@ -197,6 +198,9 @@ enum wmi_service {
- 	WMI_SERVICE_TDLS_EXPLICIT_MODE_ONLY,
- 	WMI_SERVICE_MGMT_TX_WMI,
- 	WMI_SERVICE_TDLS_WIDER_BANDWIDTH,
-+	WMI_SERVICE_HTT_MGMT_TX_COMP_VALID_FLAGS,
-+	WMI_SERVICE_HOST_DFS_CHECK_SUPPORT,
-+	WMI_SERVICE_TPC_STATS_FINAL,
- 
- 	/* keep last */
- 	WMI_SERVICE_MAX,
-@@ -339,6 +343,9 @@ enum wmi_10_4_service {
- 	WMI_10_4_SERVICE_TDLS_CONN_TRACKER_IN_HOST_MODE,
- 	WMI_10_4_SERVICE_TDLS_EXPLICIT_MODE_ONLY,
- 	WMI_10_4_SERVICE_TDLS_WIDER_BANDWIDTH,
-+	WMI_10_4_SERVICE_HTT_MGMT_TX_COMP_VALID_FLAGS,
-+	WMI_10_4_SERVICE_HOST_DFS_CHECK_SUPPORT,
-+	WMI_10_4_SERVICE_TPC_STATS_FINAL,
- };
- 
- static inline char *wmi_service_name(int service_id)
-@@ -448,6 +455,9 @@ static inline char *wmi_service_name(int
- 	SVCSTR(WMI_SERVICE_TDLS_CONN_TRACKER_IN_HOST_MODE);
- 	SVCSTR(WMI_SERVICE_TDLS_EXPLICIT_MODE_ONLY);
- 	SVCSTR(WMI_SERVICE_TDLS_WIDER_BANDWIDTH);
-+	SVCSTR(WMI_SERVICE_HTT_MGMT_TX_COMP_VALID_FLAGS);
-+	SVCSTR(WMI_SERVICE_HOST_DFS_CHECK_SUPPORT);
-+	SVCSTR(WMI_SERVICE_TPC_STATS_FINAL);
- 	default:
- 		return NULL;
- 	}
-@@ -746,6 +756,12 @@ static inline void wmi_10_4_svc_map(cons
- 	       WMI_SERVICE_TDLS_EXPLICIT_MODE_ONLY, len);
- 	SVCMAP(WMI_10_4_SERVICE_TDLS_WIDER_BANDWIDTH,
- 	       WMI_SERVICE_TDLS_WIDER_BANDWIDTH, len);
-+	SVCMAP(WMI_10_4_SERVICE_HTT_MGMT_TX_COMP_VALID_FLAGS,
-+	       WMI_SERVICE_HTT_MGMT_TX_COMP_VALID_FLAGS, len);
-+	SVCMAP(WMI_10_4_SERVICE_HOST_DFS_CHECK_SUPPORT,
-+	       WMI_SERVICE_HOST_DFS_CHECK_SUPPORT, len);
-+	SVCMAP(WMI_10_4_SERVICE_TPC_STATS_FINAL,
-+	       WMI_SERVICE_TPC_STATS_FINAL, len);
- }
- 
- #undef SVCMAP
-@@ -3992,10 +4008,12 @@ struct wmi_pdev_get_tpc_config_cmd {
- 
- #define WMI_TPC_CONFIG_PARAM		1
- #define WMI_TPC_RATE_MAX		160
-+#define WMI_TPC_FINAL_RATE_MAX		240
- #define WMI_TPC_TX_N_CHAIN		4
- #define WMI_TPC_PREAM_TABLE_MAX		10
- #define WMI_TPC_FLAG			3
- #define WMI_TPC_BUF_SIZE		10
-+#define WMI_TPC_BEAMFORMING		2
- 
- enum wmi_tpc_table_type {
- 	WMI_TPC_TABLE_TYPE_CDD = 0,
-@@ -4038,6 +4056,51 @@ enum wmi_tp_scale {
- 	WMI_TP_SCALE_SIZE   = 5,	/* max num of enum     */
- };
- 
-+struct wmi_pdev_tpc_final_table_event {
-+	__le32 reg_domain;
-+	__le32 chan_freq;
-+	__le32 phy_mode;
-+	__le32 twice_antenna_reduction;
-+	__le32 twice_max_rd_power;
-+	a_sle32 twice_antenna_gain;
-+	__le32 power_limit;
-+	__le32 rate_max;
-+	__le32 num_tx_chain;
-+	__le32 ctl;
-+	__le32 flags;
-+	s8 max_reg_allow_pow[WMI_TPC_TX_N_CHAIN];
-+	s8 max_reg_allow_pow_agcdd[WMI_TPC_TX_N_CHAIN][WMI_TPC_TX_N_CHAIN];
-+	s8 max_reg_allow_pow_agstbc[WMI_TPC_TX_N_CHAIN][WMI_TPC_TX_N_CHAIN];
-+	s8 max_reg_allow_pow_agtxbf[WMI_TPC_TX_N_CHAIN][WMI_TPC_TX_N_CHAIN];
-+	u8 rates_array[WMI_TPC_FINAL_RATE_MAX];
-+	u8 ctl_power_table[WMI_TPC_BEAMFORMING][WMI_TPC_TX_N_CHAIN]
-+	   [WMI_TPC_TX_N_CHAIN];
-+} __packed;
-+
-+struct wmi_pdev_get_tpc_table_cmd {
-+	__le32 param;
-+} __packed;
-+
-+enum wmi_tpc_pream_2ghz {
-+	WMI_TPC_PREAM_2GHZ_CCK = 0,
-+	WMI_TPC_PREAM_2GHZ_OFDM,
-+	WMI_TPC_PREAM_2GHZ_HT20,
-+	WMI_TPC_PREAM_2GHZ_HT40,
-+	WMI_TPC_PREAM_2GHZ_VHT20,
-+	WMI_TPC_PREAM_2GHZ_VHT40,
-+	WMI_TPC_PREAM_2GHZ_VHT80,
-+};
-+
-+enum wmi_tpc_pream_5ghz {
-+	WMI_TPC_PREAM_5GHZ_OFDM = 1,
-+	WMI_TPC_PREAM_5GHZ_HT20,
-+	WMI_TPC_PREAM_5GHZ_HT40,
-+	WMI_TPC_PREAM_5GHZ_VHT20,
-+	WMI_TPC_PREAM_5GHZ_VHT40,
-+	WMI_TPC_PREAM_5GHZ_VHT80,
-+	WMI_TPC_PREAM_5GHZ_HTCUP,
-+};
-+
- struct wmi_pdev_chanlist_update_event {
- 	/* number of channels */
- 	__le32 num_chan;
-@@ -6977,5 +7040,8 @@ void ath10k_wmi_10_4_op_fw_stats_fill(st
- int ath10k_wmi_op_get_vdev_subtype(struct ath10k *ar,
- 				   enum wmi_vdev_subtype subtype);
- int ath10k_wmi_barrier(struct ath10k *ar);
-+void ath10k_wmi_tpc_config_get_rate_code(u8 *rate_code, u16 *pream_table,
-+					 u32 num_tx_chain);
-+void ath10k_wmi_event_tpc_final_table(struct ath10k *ar, struct sk_buff *skb);
- 
- #endif /* _WMI_H_ */
diff --git a/package/kernel/mac80211/patches/380-0004-ath10k-Fix-kernel-panic-while-using-worker-ath10k_st.patch b/package/kernel/mac80211/patches/380-0004-ath10k-Fix-kernel-panic-while-using-worker-ath10k_st.patch
deleted file mode 100644
index 888cedd8d..000000000
--- a/package/kernel/mac80211/patches/380-0004-ath10k-Fix-kernel-panic-while-using-worker-ath10k_st.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From 8b2d93dd22615cb7f3046a5a2083a6f8bb8052ed Mon Sep 17 00:00:00 2001
-From: Karthikeyan Periyasamy <periyasa@codeaurora.org>
-Date: Mon, 12 Mar 2018 17:09:40 +0530
-Subject: [PATCH] ath10k: Fix kernel panic while using worker
- (ath10k_sta_rc_update_wk)
-
-When attempt to run worker (ath10k_sta_rc_update_wk) after the station object
-(ieee80211_sta) delete will trigger the kernel panic.
-
-This problem arise in AP + Mesh configuration, Where the current node AP VAP
-and neighbor node mesh VAP MAC address are same. When the current mesh node
-try to establish the mesh link with neighbor node, driver peer creation for
-the neighbor mesh node fails due to duplication MAC address. Already the AP
-VAP created with same MAC address.
-
-It is caused by the following scenario steps.
-
-Steps:
-1. In above condition, ath10k driver sta_state callback (ath10k_sta_state)
-   fails to do the state change for a station from IEEE80211_STA_NOTEXIST
-   to IEEE80211_STA_NONE due to peer creation fails. Sta_state callback is
-   called from ieee80211_add_station() to handle the new station
-   (neighbor mesh node) request from the wpa_supplicant.
-2. Concurrently ath10k receive the sta_rc_update callback notification from
-   the mesh_neighbour_update() to handle the beacon frames of the above
-   neighbor mesh node. since its atomic callback, ath10k driver queue the
-   work (ath10k_sta_rc_update_wk) to handle rc update.
-3. Due to driver sta_state callback fails (step 1), mac80211 free the station
-   object.
-4. When the worker (ath10k_sta_rc_update_wk) scheduled to run, it will access
-   the station object which is already deleted. so it will trigger kernel
-   panic.
-
-Added the peer exist check in sta_rc_update callback before queue the work.
-
-Kernel Panic log:
-
-Unable to handle kernel NULL pointer dereference at virtual address 00000000
-pgd = c0204000
-[00000000] *pgd=00000000
-Internal error: Oops: 17 [#1] PREEMPT SMP ARM
-CPU: 1 PID: 1833 Comm: kworker/u4:2 Not tainted 3.14.77 #1
-task: dcef0000 ti: d72b6000 task.ti: d72b6000
-PC is at pwq_activate_delayed_work+0x10/0x40
-LR is at pwq_activate_delayed_work+0xc/0x40
-pc : [<c023f988>]    lr : [<c023f984>]    psr: 40000193
-sp : d72b7f18  ip : 0000007a  fp : d72b6000
-r10: 00000000  r9 : dd404414  r8 : d8c31998
-r7 : d72b6038  r6 : 00000004  r5 : d4907ec8  r4 : dcee1300
-r3 : ffffffe0  r2 : 00000000  r1 : 00000001  r0 : 00000000
-Flags: nZcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
-Control: 10c5787d  Table: 595bc06a  DAC: 00000015
-...
-Process kworker/u4:2 (pid: 1833, stack limit = 0xd72b6238)
-Stack: (0xd72b7f18 to 0xd72b8000)
-7f00:                                                       00000001 dcee1300
-7f20: 00000001 c02410dc d8c31980 dd404400 dd404400 c0242790 d8c31980 00000089
-7f40: 00000000 d93e1340 00000000 d8c31980 c0242568 00000000 00000000 00000000
-7f60: 00000000 c02474dc 00000000 00000000 000000f8 d8c31980 00000000 00000000
-7f80: d72b7f80 d72b7f80 00000000 00000000 d72b7f90 d72b7f90 d72b7fac d93e1340
-7fa0: c0247404 00000000 00000000 c0208d20 00000000 00000000 00000000 00000000
-7fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
-7fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
-[<c023f988>] (pwq_activate_delayed_work) from [<c02410dc>] (pwq_dec_nr_in_flight+0x58/0xc4)
-[<c02410dc>] (pwq_dec_nr_in_flight) from [<c0242790>] (worker_thread+0x228/0x360)
-[<c0242790>] (worker_thread) from [<c02474dc>] (kthread+0xd8/0xec)
-[<c02474dc>] (kthread) from [<c0208d20>] (ret_from_fork+0x14/0x34)
-Code: e92d4038 e1a05000 ebffffbc[69210.619376] SMP: failed to stop secondary CPUs
-Rebooting in 3 seconds..
-
-Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/ath/ath10k/mac.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -7065,10 +7065,20 @@ static void ath10k_sta_rc_update(struct
- {
- 	struct ath10k *ar = hw->priv;
- 	struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
-+	struct ath10k_vif *arvif = (void *)vif->drv_priv;
-+	struct ath10k_peer *peer;
- 	u32 bw, smps;
- 
- 	spin_lock_bh(&ar->data_lock);
- 
-+	peer = ath10k_peer_find(ar, arvif->vdev_id, sta->addr);
-+	if (!peer) {
-+		spin_unlock_bh(&ar->data_lock);
-+		ath10k_warn(ar, "mac sta rc update failed to find peer %pM on vdev %i\n",
-+			    sta->addr, arvif->vdev_id);
-+		return;
-+	}
-+
- 	ath10k_dbg(ar, ATH10K_DBG_MAC,
- 		   "mac sta rc update for %pM changed %08x bw %d nss %d smps %d\n",
- 		   sta->addr, changed, sta->bandwidth, sta->rx_nss,
diff --git a/package/kernel/mac80211/patches/380-0005-ath10k-fix-kernel-panic-while-reading-tpc_stats.patch b/package/kernel/mac80211/patches/380-0005-ath10k-fix-kernel-panic-while-reading-tpc_stats.patch
deleted file mode 100644
index 5cc97efaf..000000000
--- a/package/kernel/mac80211/patches/380-0005-ath10k-fix-kernel-panic-while-reading-tpc_stats.patch
+++ /dev/null
@@ -1,119 +0,0 @@
-From 4b190675ad06f5a6ecbeef0b01890c5fb372e3eb Mon Sep 17 00:00:00 2001
-From: Tamizh Chelvam <tamizhr@codeaurora.org>
-Date: Wed, 25 Apr 2018 11:36:44 +0300
-Subject: [PATCH] ath10k: fix kernel panic while reading tpc_stats
-
-When attempt to read tpc_stats for the chipsets which support
-more than 3 tx chain will trigger kernel panic(kernel stack is corrupted)
-due to writing values on rate_code array out of range.
-This patch changes the array size depends on the WMI_TPC_TX_N_CHAIN and
-added check to avoid write values on the array if the num tx chain
-get in tpc config event is greater than WMI_TPC_TX_N_CHAIN.
-
-Tested on QCA9984 with firmware-5.bin_10.4-3.5.3-00057
-
-Kernel panic log :
-
-[  323.510944] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: bf90c654
-[  323.510944]
-[  323.524390] CPU: 0 PID: 1908 Comm: cat Not tainted 3.14.77 #31
-[  323.530224] [<c021db48>] (unwind_backtrace) from [<c021ac08>] (show_stack+0x10/0x14)
-[  323.537941] [<c021ac08>] (show_stack) from [<c03c53c0>] (dump_stack+0x80/0xa0)
-[  323.545146] [<c03c53c0>] (dump_stack) from [<c022e4ac>] (panic+0x84/0x1e4)
-[  323.552000] [<c022e4ac>] (panic) from [<c022e61c>] (__stack_chk_fail+0x10/0x14)
-[  323.559350] [<c022e61c>] (__stack_chk_fail) from [<bf90c654>] (ath10k_wmi_event_pdev_tpc_config+0x424/0x438 [ath10k_core])
-[  323.570471] [<bf90c654>] (ath10k_wmi_event_pdev_tpc_config [ath10k_core]) from [<bf90d800>] (ath10k_wmi_10_4_op_rx+0x2f0/0x39c [ath10k_core])
-[  323.583047] [<bf90d800>] (ath10k_wmi_10_4_op_rx [ath10k_core]) from [<bf8fcc18>] (ath10k_htc_rx_completion_handler+0x170/0x1a0 [ath10k_core])
-[  323.595702] [<bf8fcc18>] (ath10k_htc_rx_completion_handler [ath10k_core]) from [<bf961f44>] (ath10k_pci_hif_send_complete_check+0x1f0/0x220 [ath10k_pci])
-[  323.609421] [<bf961f44>] (ath10k_pci_hif_send_complete_check [ath10k_pci]) from [<bf96562c>] (ath10k_ce_per_engine_service+0x74/0xc4 [ath10k_pci])
-[  323.622490] [<bf96562c>] (ath10k_ce_per_engine_service [ath10k_pci]) from [<bf9656f0>] (ath10k_ce_per_engine_service_any+0x74/0x80 [ath10k_pci])
-[  323.635423] [<bf9656f0>] (ath10k_ce_per_engine_service_any [ath10k_pci]) from [<bf96365c>] (ath10k_pci_napi_poll+0x44/0xe8 [ath10k_pci])
-[  323.647665] [<bf96365c>] (ath10k_pci_napi_poll [ath10k_pci]) from [<c0599994>] (net_rx_action+0xac/0x160)
-[  323.657208] [<c0599994>] (net_rx_action) from [<c02324a4>] (__do_softirq+0x104/0x294)
-[  323.665017] [<c02324a4>] (__do_softirq) from [<c0232920>] (irq_exit+0x9c/0x11c)
-[  323.672314] [<c0232920>] (irq_exit) from [<c0217fc0>] (handle_IRQ+0x6c/0x90)
-[  323.679341] [<c0217fc0>] (handle_IRQ) from [<c02084e0>] (gic_handle_irq+0x3c/0x60)
-[  323.686893] [<c02084e0>] (gic_handle_irq) from [<c02095c0>] (__irq_svc+0x40/0x70)
-[  323.694349] Exception stack(0xdd489c58 to 0xdd489ca0)
-[  323.699384] 9c40:                                                       00000000 a0000013
-[  323.707547] 9c60: 00000000 dc4bce40 60000013 ddc1d800 dd488000 00000990 00000000 c085c800
-[  323.715707] 9c80: 00000000 dd489d44 0000092d dd489ca0 c026e664 c026e668 60000013 ffffffff
-[  323.723877] [<c02095c0>] (__irq_svc) from [<c026e668>] (rcu_note_context_switch+0x170/0x184)
-[  323.732298] [<c026e668>] (rcu_note_context_switch) from [<c020e928>] (__schedule+0x50/0x4d4)
-[  323.740716] [<c020e928>] (__schedule) from [<c020e490>] (schedule_timeout+0x148/0x178)
-[  323.748611] [<c020e490>] (schedule_timeout) from [<c020f804>] (wait_for_common+0x114/0x154)
-[  323.756972] [<c020f804>] (wait_for_common) from [<bf8f6ef0>] (ath10k_tpc_stats_open+0xc8/0x340 [ath10k_core])
-[  323.766873] [<bf8f6ef0>] (ath10k_tpc_stats_open [ath10k_core]) from [<c02bb598>] (do_dentry_open+0x1ac/0x274)
-[  323.776741] [<c02bb598>] (do_dentry_open) from [<c02c838c>] (do_last+0x8c0/0xb08)
-[  323.784201] [<c02c838c>] (do_last) from [<c02c87e4>] (path_openat+0x210/0x598)
-[  323.791408] [<c02c87e4>] (path_openat) from [<c02c9d1c>] (do_filp_open+0x2c/0x78)
-[  323.798873] [<c02c9d1c>] (do_filp_open) from [<c02bc85c>] (do_sys_open+0x114/0x1b4)
-[  323.806509] [<c02bc85c>] (do_sys_open) from [<c0208c80>] (ret_fast_syscall+0x0/0x44)
-[  323.814241] CPU1: stopping
-[  323.816927] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 3.14.77 #31
-[  323.823008] [<c021db48>] (unwind_backtrace) from [<c021ac08>] (show_stack+0x10/0x14)
-[  323.830731] [<c021ac08>] (show_stack) from [<c03c53c0>] (dump_stack+0x80/0xa0)
-[  323.837934] [<c03c53c0>] (dump_stack) from [<c021cfac>] (handle_IPI+0xb8/0x140)
-[  323.845224] [<c021cfac>] (handle_IPI) from [<c02084fc>] (gic_handle_irq+0x58/0x60)
-[  323.852774] [<c02084fc>] (gic_handle_irq) from [<c02095c0>] (__irq_svc+0x40/0x70)
-[  323.860233] Exception stack(0xdd499fa0 to 0xdd499fe8)
-[  323.865273] 9fa0: ffffffed 00000000 1d3c9000 00000000 dd498000 dd498030 10c0387d c08b62c8
-[  323.873432] 9fc0: 4220406a 512f04d0 00000000 00000000 00000001 dd499fe8 c021838c c0218390
-[  323.881588] 9fe0: 60000013 ffffffff
-[  323.885070] [<c02095c0>] (__irq_svc) from [<c0218390>] (arch_cpu_idle+0x30/0x50)
-[  323.892454] [<c0218390>] (arch_cpu_idle) from [<c026500c>] (cpu_startup_entry+0xa4/0x108)
-[  323.900690] [<c026500c>] (cpu_startup_entry) from [<422085a4>] (0x422085a4)
-
-Signed-off-by: Tamizh chelvam <tamizhr@codeaurora.org>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/ath/ath10k/debug.c | 8 +++++++-
- drivers/net/wireless/ath/ath10k/wmi.c   | 6 ++++++
- drivers/net/wireless/ath/ath10k/wmi.h   | 2 +-
- 3 files changed, 14 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/ath/ath10k/debug.c
-+++ b/drivers/net/wireless/ath/ath10k/debug.c
-@@ -1776,7 +1776,13 @@ static void ath10k_tpc_stats_print(struc
- 	*len += scnprintf(buf + *len, buf_len - *len,
- 			  "********************************\n");
- 	*len += scnprintf(buf + *len, buf_len - *len,
--			  "No.  Preamble Rate_code tpc_value1 tpc_value2 tpc_value3\n");
-+			  "No.  Preamble Rate_code ");
-+
-+	for (i = 0; i < WMI_TPC_TX_N_CHAIN; i++)
-+		*len += scnprintf(buf + *len, buf_len - *len,
-+				  "tpc_value%d ", i);
-+
-+	*len += scnprintf(buf + *len, buf_len - *len, "\n");
- 
- 	for (i = 0; i < tpc_stats->rate_max; i++) {
- 		*len += scnprintf(buf + *len, buf_len - *len,
---- a/drivers/net/wireless/ath/ath10k/wmi.c
-+++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -4431,6 +4431,12 @@ void ath10k_wmi_event_pdev_tpc_config(st
- 
- 	num_tx_chain = __le32_to_cpu(ev->num_tx_chain);
- 
-+	if (num_tx_chain > WMI_TPC_TX_N_CHAIN) {
-+		ath10k_warn(ar, "number of tx chain is %d greater than TPC configured tx chain %d\n",
-+			    num_tx_chain, WMI_TPC_TX_N_CHAIN);
-+		return;
-+	}
-+
- 	ath10k_wmi_tpc_config_get_rate_code(rate_code, pream_table,
- 					    num_tx_chain);
- 
---- a/drivers/net/wireless/ath/ath10k/wmi.h
-+++ b/drivers/net/wireless/ath/ath10k/wmi.h
-@@ -4007,9 +4007,9 @@ struct wmi_pdev_get_tpc_config_cmd {
- } __packed;
- 
- #define WMI_TPC_CONFIG_PARAM		1
--#define WMI_TPC_RATE_MAX		160
- #define WMI_TPC_FINAL_RATE_MAX		240
- #define WMI_TPC_TX_N_CHAIN		4
-+#define WMI_TPC_RATE_MAX               (WMI_TPC_TX_N_CHAIN * 65)
- #define WMI_TPC_PREAM_TABLE_MAX		10
- #define WMI_TPC_FLAG			3
- #define WMI_TPC_BUF_SIZE		10
diff --git a/package/kernel/mac80211/patches/380-0006-ath10k-add-support-to-configure-channel-dwell-time.patch b/package/kernel/mac80211/patches/380-0006-ath10k-add-support-to-configure-channel-dwell-time.patch
deleted file mode 100644
index 3451a9930..000000000
--- a/package/kernel/mac80211/patches/380-0006-ath10k-add-support-to-configure-channel-dwell-time.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From be8cce96f14dc925ecfb702be0392a52cf78adb5 Mon Sep 17 00:00:00 2001
-From: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
-Date: Wed, 23 May 2018 11:09:09 +0300
-Subject: [PATCH] ath10k: add support to configure channel dwell time
-
-Configure channel dwell time from duration of the scan request
-received from mac80211 when the duration is non-zero. When the
-scan request does not have duration value, use the default ones,
-the current implementation.
-
-Corresponding flag NL80211_EXT_FEATURE_SET_SCAN_DWELL is
-advertized.
-
-Supported Chipsets:
- -QCA988X/QCA9887 PCI
- -QCA99X0/QCA9984/QCA9888/QCA4019 PCI
- -QCA6174/QCA9377 PCI/USB/SDIO
- -WCN3990 SNOC
-
-Tested on QCA9984 with firmware ver 10.4-3.6-0010
-
-Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/ath/ath10k/core.h |  1 +
- drivers/net/wireless/ath/ath10k/mac.c  | 23 ++++++++++++++++++++---
- 2 files changed, 21 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/ath/ath10k/core.h
-+++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -43,6 +43,7 @@
- #define WO(_f)      ((_f##_OFFSET) >> 2)
- 
- #define ATH10K_SCAN_ID 0
-+#define ATH10K_SCAN_CHANNEL_SWITCH_WMI_EVT_OVERHEAD 10 /* msec */
- #define WMI_READY_TIMEOUT (5 * HZ)
- #define ATH10K_FLUSH_TIMEOUT_HZ (5 * HZ)
- #define ATH10K_CONNECTION_LOSS_HZ (3 * HZ)
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -5597,6 +5597,7 @@ static int ath10k_hw_scan(struct ieee802
- 	struct wmi_start_scan_arg arg;
- 	int ret = 0;
- 	int i;
-+	u32 scan_timeout;
- 
- 	mutex_lock(&ar->conf_mutex);
- 
-@@ -5647,6 +5648,22 @@ static int ath10k_hw_scan(struct ieee802
- 			arg.channels[i] = req->channels[i]->center_freq;
- 	}
- 
-+	/* if duration is set, default dwell times will be overwritten */
-+	if (req->duration) {
-+		arg.dwell_time_active = req->duration;
-+		arg.dwell_time_passive = req->duration;
-+		arg.burst_duration_ms = req->duration;
-+
-+		scan_timeout = min_t(u32, arg.max_rest_time *
-+				(arg.n_channels - 1) + (req->duration +
-+				ATH10K_SCAN_CHANNEL_SWITCH_WMI_EVT_OVERHEAD) *
-+				arg.n_channels, arg.max_scan_time + 200);
-+
-+	} else {
-+		/* Add a 200ms margin to account for event/command processing */
-+		scan_timeout = arg.max_scan_time + 200;
-+	}
-+
- 	ret = ath10k_start_scan(ar, &arg);
- 	if (ret) {
- 		ath10k_warn(ar, "failed to start hw scan: %d\n", ret);
-@@ -5655,10 +5672,8 @@ static int ath10k_hw_scan(struct ieee802
- 		spin_unlock_bh(&ar->data_lock);
- 	}
- 
--	/* Add a 200ms margin to account for event/command processing */
- 	ieee80211_queue_delayed_work(ar->hw, &ar->scan.timeout,
--				     msecs_to_jiffies(arg.max_scan_time +
--						      200));
-+				     msecs_to_jiffies(scan_timeout));
- 
- exit:
- 	mutex_unlock(&ar->conf_mutex);
-@@ -8267,6 +8282,8 @@ int ath10k_mac_register(struct ath10k *a
- 	}
- 
- 	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
-+	wiphy_ext_feature_set(ar->hw->wiphy,
-+			      NL80211_EXT_FEATURE_SET_SCAN_DWELL);
- 
- 	/*
- 	 * on LL hardware queues are managed entirely by the FW
diff --git a/package/kernel/mac80211/patches/380-0007-ath-add-support-to-get-the-detected-radar-specificat.patch b/package/kernel/mac80211/patches/380-0007-ath-add-support-to-get-the-detected-radar-specificat.patch
deleted file mode 100644
index 020dfbd3a..000000000
--- a/package/kernel/mac80211/patches/380-0007-ath-add-support-to-get-the-detected-radar-specificat.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From f40105e6747892e8edab94020567c158c9bec0df Mon Sep 17 00:00:00 2001
-From: Sriram R <srirrama@codeaurora.org>
-Date: Tue, 15 May 2018 14:39:48 +0530
-Subject: [PATCH] ath: add support to get the detected radar specifications
-
-This enables ath10k/ath9k drivers to collect the specifications of the
-radar type once it is detected by the dfs pattern detector unit.
-Usage of the collected info is specific to driver implementation.
-For example, collected radar info could be used by the host driver
-to send to co-processors for additional processing/validation.
-
-Note: 'radar_detector_specs' data containing the specifications of
-different radar types which was private within dfs_pattern_detector/
-dfs_pri_detector is now shared with drivers as well for making use
-of this information.
-
-Signed-off-by: Sriram R <srirrama@codeaurora.org>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/ath/ath10k/wmi.c           | 2 +-
- drivers/net/wireless/ath/ath9k/dfs.c            | 2 +-
- drivers/net/wireless/ath/dfs_pattern_detector.c | 5 ++++-
- drivers/net/wireless/ath/dfs_pattern_detector.h | 3 ++-
- drivers/net/wireless/ath/dfs_pri_detector.h     | 3 ++-
- 5 files changed, 10 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/ath/ath10k/wmi.c
-+++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -3712,7 +3712,7 @@ static void ath10k_dfs_radar_report(stru
- 
- 	ATH10K_DFS_STAT_INC(ar, pulses_detected);
- 
--	if (!ar->dfs_detector->add_pulse(ar->dfs_detector, &pe)) {
-+	if (!ar->dfs_detector->add_pulse(ar->dfs_detector, &pe, NULL)) {
- 		ath10k_dbg(ar, ATH10K_DBG_REGULATORY,
- 			   "dfs no pulse pattern detected, yet\n");
- 		return;
---- a/drivers/net/wireless/ath/ath9k/dfs.c
-+++ b/drivers/net/wireless/ath/ath9k/dfs.c
-@@ -279,7 +279,7 @@ ath9k_dfs_process_radar_pulse(struct ath
- 	DFS_STAT_INC(sc, pulses_processed);
- 	if (pd == NULL)
- 		return;
--	if (!pd->add_pulse(pd, pe))
-+	if (!pd->add_pulse(pd, pe, NULL))
- 		return;
- 	DFS_STAT_INC(sc, radar_detected);
- 	ieee80211_radar_detected(sc->hw);
---- a/drivers/net/wireless/ath/dfs_pattern_detector.c
-+++ b/drivers/net/wireless/ath/dfs_pattern_detector.c
-@@ -268,7 +268,8 @@ static void dpd_exit(struct dfs_pattern_
- }
- 
- static bool
--dpd_add_pulse(struct dfs_pattern_detector *dpd, struct pulse_event *event)
-+dpd_add_pulse(struct dfs_pattern_detector *dpd, struct pulse_event *event,
-+	      struct radar_detector_specs *rs)
- {
- 	u32 i;
- 	struct channel_detector *cd;
-@@ -294,6 +295,8 @@ dpd_add_pulse(struct dfs_pattern_detecto
- 		struct pri_detector *pd = cd->detectors[i];
- 		struct pri_sequence *ps = pd->add_pulse(pd, event);
- 		if (ps != NULL) {
-+			if (rs != NULL)
-+				memcpy(rs, pd->rs, sizeof(*rs));
- 			ath_dbg(dpd->common, DFS,
- 				"DFS: radar found on freq=%d: id=%d, pri=%d, "
- 				"count=%d, count_false=%d\n",
---- a/drivers/net/wireless/ath/dfs_pattern_detector.h
-+++ b/drivers/net/wireless/ath/dfs_pattern_detector.h
-@@ -97,7 +97,8 @@ struct dfs_pattern_detector {
- 	bool (*set_dfs_domain)(struct dfs_pattern_detector *dpd,
- 			   enum nl80211_dfs_regions region);
- 	bool (*add_pulse)(struct dfs_pattern_detector *dpd,
--			  struct pulse_event *pe);
-+			  struct pulse_event *pe,
-+			  struct radar_detector_specs *rs);
- 
- 	struct ath_dfs_pool_stats (*get_stats)(struct dfs_pattern_detector *dpd);
- 	enum nl80211_dfs_regions region;
---- a/drivers/net/wireless/ath/dfs_pri_detector.h
-+++ b/drivers/net/wireless/ath/dfs_pri_detector.h
-@@ -62,8 +62,9 @@ struct pri_detector {
- 	     (*add_pulse)(struct pri_detector *de, struct pulse_event *e);
- 	void (*reset)    (struct pri_detector *de, u64 ts);
- 
--/* private: internal use only */
- 	const struct radar_detector_specs *rs;
-+
-+/* private: internal use only */
- 	u64 last_ts;
- 	struct list_head sequences;
- 	struct list_head pulses;
diff --git a/package/kernel/mac80211/patches/380-0008-ath10k-DFS-Host-Confirmation.patch b/package/kernel/mac80211/patches/380-0008-ath10k-DFS-Host-Confirmation.patch
deleted file mode 100644
index 9e0c10085..000000000
--- a/package/kernel/mac80211/patches/380-0008-ath10k-DFS-Host-Confirmation.patch
+++ /dev/null
@@ -1,546 +0,0 @@
-From 6f6eb1bcbeff48c875617b800f00f1c5d1b12290 Mon Sep 17 00:00:00 2001
-From: Sriram R <srirrama@codeaurora.org>
-Date: Tue, 15 May 2018 14:39:49 +0530
-Subject: [PATCH] ath10k: DFS Host Confirmation
-
-In the 10.4-3.6 firmware branch there's a new DFS Host confirmation
-feature which is advertised using WMI_SERVICE_HOST_DFS_CHECK_SUPPORT flag.
-
-This new features enables the ath10k host to send information to the
-firmware on the specifications of detected radar type. This allows the
-firmware to validate if the host's radar pattern detector unit is
-operational and check if the radar information shared by host matches
-the radar pulses sent as phy error events from firmware. If the check
-fails the firmware won't allow use of DFS channels on AP mode when using
-FCC regulatory region.
-
-Hence this patch is mandatory when using a firmware from 10.4-3.6 branch.
-Else, DFS channels on FCC regions cannot be used.
-
-Supported Chipsets : QCA9984/QCA9888/QCA4019
-Firmware Version : 10.4-3.6-00104
-
-Signed-off-by: Sriram R <srirrama@codeaurora.org>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/ath/ath10k/core.h    |  21 ++++
- drivers/net/wireless/ath/ath10k/mac.c     |  12 ++
- drivers/net/wireless/ath/ath10k/wmi-ops.h |  32 +++++
- drivers/net/wireless/ath/ath10k/wmi.c     | 186 ++++++++++++++++++++++++++++--
- drivers/net/wireless/ath/ath10k/wmi.h     |  32 +++++
- 5 files changed, 273 insertions(+), 10 deletions(-)
-
---- a/drivers/net/wireless/ath/ath10k/core.h
-+++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -171,6 +171,7 @@ struct ath10k_wmi {
- 	struct completion service_ready;
- 	struct completion unified_ready;
- 	struct completion barrier;
-+	struct completion radar_confirm;
- 	wait_queue_head_t tx_credits_wq;
- 	DECLARE_BITMAP(svc_map, WMI_SERVICE_MAX);
- 	struct wmi_cmd_map *cmd;
-@@ -352,6 +353,21 @@ struct ath10k_dfs_stats {
- 	u32 radar_detected;
- };
- 
-+enum ath10k_radar_confirmation_state {
-+	ATH10K_RADAR_CONFIRMATION_IDLE = 0,
-+	ATH10K_RADAR_CONFIRMATION_INPROGRESS,
-+	ATH10K_RADAR_CONFIRMATION_STOPPED,
-+};
-+
-+struct ath10k_radar_found_info {
-+	u32 pri_min;
-+	u32 pri_max;
-+	u32 width_min;
-+	u32 width_max;
-+	u32 sidx_min;
-+	u32 sidx_max;
-+};
-+
- #define ATH10K_MAX_NUM_PEER_IDS (1 << 11) /* htt rx_desc limit */
- 
- struct ath10k_peer {
-@@ -1026,6 +1042,11 @@ struct ath10k {
- 
- 	void *ce_priv;
- 
-+	/* protected by data_lock */
-+	enum ath10k_radar_confirmation_state radar_conf_state;
-+	struct ath10k_radar_found_info last_radar_info;
-+	struct work_struct radar_confirmation_work;
-+
- 	/* must be last */
- 	u8 drv_priv[0] __aligned(sizeof(void *));
- };
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -3216,6 +3216,15 @@ static void ath10k_reg_notifier(struct w
- 					       ar->hw->wiphy->bands[NL80211_BAND_5GHZ]);
- }
- 
-+static void ath10k_stop_radar_confirmation(struct ath10k *ar)
-+{
-+	spin_lock_bh(&ar->data_lock);
-+	ar->radar_conf_state = ATH10K_RADAR_CONFIRMATION_STOPPED;
-+	spin_unlock_bh(&ar->data_lock);
-+
-+	cancel_work_sync(&ar->radar_confirmation_work);
-+}
-+
- /***************/
- /* TX handlers */
- /***************/
-@@ -4315,6 +4324,7 @@ void ath10k_halt(struct ath10k *ar)
- 
- 	ath10k_scan_finish(ar);
- 	ath10k_peer_cleanup_all(ar);
-+	ath10k_stop_radar_confirmation(ar);
- 	ath10k_core_stop(ar);
- 	ath10k_hif_power_down(ar);
- 
-@@ -4733,6 +4743,8 @@ static int ath10k_start(struct ieee80211
- 	ath10k_spectral_start(ar);
- 	ath10k_thermal_set_throttling(ar);
- 
-+	ar->radar_conf_state = ATH10K_RADAR_CONFIRMATION_IDLE;
-+
- 	mutex_unlock(&ar->conf_mutex);
- 	return 0;
- 
---- a/drivers/net/wireless/ath/ath10k/wmi-ops.h
-+++ b/drivers/net/wireless/ath/ath10k/wmi-ops.h
-@@ -53,6 +53,8 @@ struct wmi_ops {
- 			      struct wmi_wow_ev_arg *arg);
- 	int (*pull_echo_ev)(struct ath10k *ar, struct sk_buff *skb,
- 			    struct wmi_echo_ev_arg *arg);
-+	int (*pull_dfs_status_ev)(struct ath10k *ar, struct sk_buff *skb,
-+				  struct wmi_dfs_status_ev_arg *arg);
- 	enum wmi_txbf_conf (*get_txbf_conf_scheme)(struct ath10k *ar);
- 
- 	struct sk_buff *(*gen_pdev_suspend)(struct ath10k *ar, u32 suspend_opt);
-@@ -178,6 +180,9 @@ struct wmi_ops {
- 						const struct wmi_tdls_peer_update_cmd_arg *arg,
- 						const struct wmi_tdls_peer_capab_arg *cap,
- 						const struct wmi_channel_arg *chan);
-+	struct sk_buff *(*gen_radar_found)
-+			(struct ath10k *ar,
-+			 const struct ath10k_radar_found_info *arg);
- 	struct sk_buff *(*gen_adaptive_qcs)(struct ath10k *ar, bool enable);
- 	struct sk_buff *(*gen_pdev_get_tpc_config)(struct ath10k *ar,
- 						   u32 param);
-@@ -365,6 +370,16 @@ ath10k_wmi_pull_echo_ev(struct ath10k *a
- 	return ar->wmi.ops->pull_echo_ev(ar, skb, arg);
- }
- 
-+static inline int
-+ath10k_wmi_pull_dfs_status(struct ath10k *ar, struct sk_buff *skb,
-+			   struct wmi_dfs_status_ev_arg *arg)
-+{
-+	if (!ar->wmi.ops->pull_dfs_status_ev)
-+		return -EOPNOTSUPP;
-+
-+	return ar->wmi.ops->pull_dfs_status_ev(ar, skb, arg);
-+}
-+
- static inline enum wmi_txbf_conf
- ath10k_wmi_get_txbf_conf_scheme(struct ath10k *ar)
- {
-@@ -1438,4 +1453,21 @@ ath10k_wmi_pdev_get_tpc_table_cmdid(stru
- 				   ar->wmi.cmd->pdev_get_tpc_table_cmdid);
- }
- 
-+static inline int
-+ath10k_wmi_report_radar_found(struct ath10k *ar,
-+			      const struct ath10k_radar_found_info *arg)
-+{
-+	struct sk_buff *skb;
-+
-+	if (!ar->wmi.ops->gen_radar_found)
-+		return -EOPNOTSUPP;
-+
-+	skb = ar->wmi.ops->gen_radar_found(ar, arg);
-+	if (IS_ERR(skb))
-+		return PTR_ERR(skb);
-+
-+	return ath10k_wmi_cmd_send(ar, skb,
-+				   ar->wmi.cmd->radar_found_cmdid);
-+}
-+
- #endif
---- a/drivers/net/wireless/ath/ath10k/wmi.c
-+++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -34,6 +34,7 @@
- 
- #define ATH10K_WMI_BARRIER_ECHO_ID 0xBA991E9
- #define ATH10K_WMI_BARRIER_TIMEOUT_HZ (3 * HZ)
-+#define ATH10K_WMI_DFS_CONF_TIMEOUT_HZ (HZ / 6)
- 
- /* MAIN WMI cmd track */
- static struct wmi_cmd_map wmi_cmd_map = {
-@@ -198,6 +199,7 @@ static struct wmi_cmd_map wmi_cmd_map =
- 	.set_cca_params_cmdid = WMI_CMD_UNSUPPORTED,
- 	.pdev_bss_chan_info_request_cmdid = WMI_CMD_UNSUPPORTED,
- 	.pdev_get_tpc_table_cmdid = WMI_CMD_UNSUPPORTED,
-+	.radar_found_cmdid = WMI_CMD_UNSUPPORTED,
- };
- 
- /* 10.X WMI cmd track */
-@@ -365,6 +367,7 @@ static struct wmi_cmd_map wmi_10x_cmd_ma
- 	.set_cca_params_cmdid = WMI_CMD_UNSUPPORTED,
- 	.pdev_bss_chan_info_request_cmdid = WMI_CMD_UNSUPPORTED,
- 	.pdev_get_tpc_table_cmdid = WMI_CMD_UNSUPPORTED,
-+	.radar_found_cmdid = WMI_CMD_UNSUPPORTED,
- };
- 
- /* 10.2.4 WMI cmd track */
-@@ -532,6 +535,7 @@ static struct wmi_cmd_map wmi_10_2_4_cmd
- 	.pdev_bss_chan_info_request_cmdid =
- 		WMI_10_2_PDEV_BSS_CHAN_INFO_REQUEST_CMDID,
- 	.pdev_get_tpc_table_cmdid = WMI_CMD_UNSUPPORTED,
-+	.radar_found_cmdid = WMI_CMD_UNSUPPORTED,
- };
- 
- /* 10.4 WMI cmd track */
-@@ -741,6 +745,7 @@ static struct wmi_cmd_map wmi_10_4_cmd_m
- 	.tdls_set_state_cmdid = WMI_10_4_TDLS_SET_STATE_CMDID,
- 	.tdls_peer_update_cmdid = WMI_10_4_TDLS_PEER_UPDATE_CMDID,
- 	.tdls_set_offchan_mode_cmdid = WMI_10_4_TDLS_SET_OFFCHAN_MODE_CMDID,
-+	.radar_found_cmdid = WMI_10_4_RADAR_FOUND_CMDID,
- };
- 
- /* MAIN WMI VDEV param map */
-@@ -1485,6 +1490,7 @@ static struct wmi_cmd_map wmi_10_2_cmd_m
- 	.pdev_get_ani_ofdm_config_cmdid = WMI_CMD_UNSUPPORTED,
- 	.pdev_reserve_ast_entry_cmdid = WMI_CMD_UNSUPPORTED,
- 	.pdev_get_tpc_table_cmdid = WMI_CMD_UNSUPPORTED,
-+	.radar_found_cmdid = WMI_CMD_UNSUPPORTED,
- };
- 
- static struct wmi_pdev_param_map wmi_10_4_pdev_param_map = {
-@@ -3638,6 +3644,68 @@ void ath10k_wmi_event_tbttoffset_update(
- 	ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_TBTTOFFSET_UPDATE_EVENTID\n");
- }
- 
-+static void ath10k_radar_detected(struct ath10k *ar)
-+{
-+	ath10k_dbg(ar, ATH10K_DBG_REGULATORY, "dfs radar detected\n");
-+	ATH10K_DFS_STAT_INC(ar, radar_detected);
-+
-+	/* Control radar events reporting in debugfs file
-+	 * dfs_block_radar_events
-+	 */
-+	if (ar->dfs_block_radar_events)
-+		ath10k_info(ar, "DFS Radar detected, but ignored as requested\n");
-+	else
-+		ieee80211_radar_detected(ar->hw);
-+}
-+
-+static void ath10k_radar_confirmation_work(struct work_struct *work)
-+{
-+	struct ath10k *ar = container_of(work, struct ath10k,
-+					 radar_confirmation_work);
-+	struct ath10k_radar_found_info radar_info;
-+	int ret, time_left;
-+
-+	reinit_completion(&ar->wmi.radar_confirm);
-+
-+	spin_lock_bh(&ar->data_lock);
-+	memcpy(&radar_info, &ar->last_radar_info, sizeof(radar_info));
-+	spin_unlock_bh(&ar->data_lock);
-+
-+	ret = ath10k_wmi_report_radar_found(ar, &radar_info);
-+	if (ret) {
-+		ath10k_warn(ar, "failed to send radar found %d\n", ret);
-+		goto wait_complete;
-+	}
-+
-+	time_left = wait_for_completion_timeout(&ar->wmi.radar_confirm,
-+						ATH10K_WMI_DFS_CONF_TIMEOUT_HZ);
-+	if (time_left) {
-+		/* DFS Confirmation status event received and
-+		 * necessary action completed.
-+		 */
-+		goto wait_complete;
-+	} else {
-+		/* DFS Confirmation event not received from FW.Considering this
-+		 * as real radar.
-+		 */
-+		ath10k_dbg(ar, ATH10K_DBG_REGULATORY,
-+			   "dfs confirmation not received from fw, considering as radar\n");
-+		goto radar_detected;
-+	}
-+
-+radar_detected:
-+	ath10k_radar_detected(ar);
-+
-+	/* Reset state to allow sending confirmation on consecutive radar
-+	 * detections, unless radar confirmation is disabled/stopped.
-+	 */
-+wait_complete:
-+	spin_lock_bh(&ar->data_lock);
-+	if (ar->radar_conf_state != ATH10K_RADAR_CONFIRMATION_STOPPED)
-+		ar->radar_conf_state = ATH10K_RADAR_CONFIRMATION_IDLE;
-+	spin_unlock_bh(&ar->data_lock);
-+}
-+
- static void ath10k_dfs_radar_report(struct ath10k *ar,
- 				    struct wmi_phyerr_ev_arg *phyerr,
- 				    const struct phyerr_radar_report *rr,
-@@ -3646,8 +3714,10 @@ static void ath10k_dfs_radar_report(stru
- 	u32 reg0, reg1, tsf32l;
- 	struct ieee80211_channel *ch;
- 	struct pulse_event pe;
-+	struct radar_detector_specs rs;
- 	u64 tsf64;
- 	u8 rssi, width;
-+	struct ath10k_radar_found_info *radar_info;
- 
- 	reg0 = __le32_to_cpu(rr->reg0);
- 	reg1 = __le32_to_cpu(rr->reg1);
-@@ -3712,25 +3782,46 @@ static void ath10k_dfs_radar_report(stru
- 
- 	ATH10K_DFS_STAT_INC(ar, pulses_detected);
- 
--	if (!ar->dfs_detector->add_pulse(ar->dfs_detector, &pe, NULL)) {
-+	if (!ar->dfs_detector->add_pulse(ar->dfs_detector, &pe, &rs)) {
- 		ath10k_dbg(ar, ATH10K_DBG_REGULATORY,
- 			   "dfs no pulse pattern detected, yet\n");
- 		return;
- 	}
- 
--radar_detected:
--	ath10k_dbg(ar, ATH10K_DBG_REGULATORY, "dfs radar detected\n");
--	ATH10K_DFS_STAT_INC(ar, radar_detected);
-+	if ((test_bit(WMI_SERVICE_HOST_DFS_CHECK_SUPPORT, ar->wmi.svc_map)) &&
-+	    ar->dfs_detector->region == NL80211_DFS_FCC) {
-+		/* Consecutive radar indications need not be
-+		 * sent to the firmware until we get confirmation
-+		 * for the previous detected radar.
-+		 */
-+		spin_lock_bh(&ar->data_lock);
-+		if (ar->radar_conf_state != ATH10K_RADAR_CONFIRMATION_IDLE) {
-+			spin_unlock_bh(&ar->data_lock);
-+			return;
-+		}
-+		ar->radar_conf_state = ATH10K_RADAR_CONFIRMATION_INPROGRESS;
-+		radar_info = &ar->last_radar_info;
- 
--	/* Control radar events reporting in debugfs file
--	 * dfs_block_radar_events
--	 */
--	if (ar->dfs_block_radar_events) {
--		ath10k_info(ar, "DFS Radar detected, but ignored as requested\n");
-+		radar_info->pri_min = rs.pri_min;
-+		radar_info->pri_max = rs.pri_max;
-+		radar_info->width_min = rs.width_min;
-+		radar_info->width_max = rs.width_max;
-+		/*TODO Find sidx_min and sidx_max */
-+		radar_info->sidx_min = MS(reg0, RADAR_REPORT_REG0_PULSE_SIDX);
-+		radar_info->sidx_max = MS(reg0, RADAR_REPORT_REG0_PULSE_SIDX);
-+
-+		ath10k_dbg(ar, ATH10K_DBG_REGULATORY,
-+			   "sending wmi radar found cmd pri_min %d pri_max %d width_min %d width_max %d sidx_min %d sidx_max %d\n",
-+			   radar_info->pri_min, radar_info->pri_max,
-+			   radar_info->width_min, radar_info->width_max,
-+			   radar_info->sidx_min, radar_info->sidx_max);
-+		ieee80211_queue_work(ar->hw, &ar->radar_confirmation_work);
-+		spin_unlock_bh(&ar->data_lock);
- 		return;
- 	}
- 
--	ieee80211_radar_detected(ar->hw);
-+radar_detected:
-+	ath10k_radar_detected(ar);
- }
- 
- static int ath10k_dfs_fft_report(struct ath10k *ar,
-@@ -4080,6 +4171,47 @@ void ath10k_wmi_event_phyerr(struct ath1
- 	}
- }
- 
-+static int
-+ath10k_wmi_10_4_op_pull_dfs_status_ev(struct ath10k *ar, struct sk_buff *skb,
-+				      struct wmi_dfs_status_ev_arg *arg)
-+{
-+	struct wmi_dfs_status_ev_arg *ev = (void *)skb->data;
-+
-+	if (skb->len < sizeof(*ev))
-+		return -EPROTO;
-+
-+	arg->status = ev->status;
-+
-+	return 0;
-+}
-+
-+static void
-+ath10k_wmi_event_dfs_status_check(struct ath10k *ar, struct sk_buff *skb)
-+{
-+	struct wmi_dfs_status_ev_arg status_arg = {};
-+	int ret;
-+
-+	ret = ath10k_wmi_pull_dfs_status(ar, skb, &status_arg);
-+
-+	if (ret) {
-+		ath10k_warn(ar, "failed to parse dfs status event: %d\n", ret);
-+		return;
-+	}
-+
-+	ath10k_dbg(ar, ATH10K_DBG_REGULATORY,
-+		   "dfs status event received from fw: %d\n",
-+		   status_arg.status);
-+
-+	/* Even in case of radar detection failure we follow the same
-+	 * behaviour as if radar is detected i.e to switch to a different
-+	 * channel.
-+	 */
-+	if (status_arg.status == WMI_HW_RADAR_DETECTED ||
-+	    status_arg.status == WMI_RADAR_DETECTION_FAIL)
-+		ath10k_radar_detected(ar);
-+	complete(&ar->wmi.radar_confirm);
-+}
-+
- void ath10k_wmi_event_roam(struct ath10k *ar, struct sk_buff *skb)
- {
- 	struct wmi_roam_ev_arg arg = {};
-@@ -5814,6 +5946,9 @@ static void ath10k_wmi_10_4_op_rx(struct
- 	case WMI_10_4_PDEV_TPC_TABLE_EVENTID:
- 		ath10k_wmi_event_tpc_final_table(ar, skb);
- 		break;
-+	case WMI_10_4_DFS_STATUS_CHECK_EVENTID:
-+		ath10k_wmi_event_dfs_status_check(ar, skb);
-+		break;
- 	default:
- 		ath10k_warn(ar, "Unknown eventid: %d\n", id);
- 		break;
-@@ -8332,6 +8467,32 @@ ath10k_wmi_10_4_gen_tdls_peer_update(str
- }
- 
- static struct sk_buff *
-+ath10k_wmi_10_4_gen_radar_found(struct ath10k *ar,
-+				const struct ath10k_radar_found_info *arg)
-+{
-+	struct wmi_radar_found_info *cmd;
-+	struct sk_buff *skb;
-+
-+	skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
-+	if (!skb)
-+		return ERR_PTR(-ENOMEM);
-+
-+	cmd = (struct wmi_radar_found_info *)skb->data;
-+	cmd->pri_min   = __cpu_to_le32(arg->pri_min);
-+	cmd->pri_max   = __cpu_to_le32(arg->pri_max);
-+	cmd->width_min = __cpu_to_le32(arg->width_min);
-+	cmd->width_max = __cpu_to_le32(arg->width_max);
-+	cmd->sidx_min  = __cpu_to_le32(arg->sidx_min);
-+	cmd->sidx_max  = __cpu_to_le32(arg->sidx_max);
-+
-+	ath10k_dbg(ar, ATH10K_DBG_WMI,
-+		   "wmi radar found pri_min %d pri_max %d width_min %d width_max %d sidx_min %d sidx_max %d\n",
-+		   arg->pri_min, arg->pri_max, arg->width_min,
-+		   arg->width_max, arg->sidx_min, arg->sidx_max);
-+	return skb;
-+}
-+
-+static struct sk_buff *
- ath10k_wmi_op_gen_echo(struct ath10k *ar, u32 value)
- {
- 	struct wmi_echo_cmd *cmd;
-@@ -8668,6 +8829,7 @@ static const struct wmi_ops wmi_10_4_ops
- 	.pull_svc_rdy = ath10k_wmi_main_op_pull_svc_rdy_ev,
- 	.pull_rdy = ath10k_wmi_op_pull_rdy_ev,
- 	.pull_roam_ev = ath10k_wmi_op_pull_roam_ev,
-+	.pull_dfs_status_ev = ath10k_wmi_10_4_op_pull_dfs_status_ev,
- 	.get_txbf_conf_scheme = ath10k_wmi_10_4_txbf_conf_scheme,
- 
- 	.gen_pdev_suspend = ath10k_wmi_op_gen_pdev_suspend,
-@@ -8714,6 +8876,7 @@ static const struct wmi_ops wmi_10_4_ops
- 	.gen_tdls_peer_update = ath10k_wmi_10_4_gen_tdls_peer_update,
- 	.gen_pdev_get_tpc_table_cmdid =
- 			ath10k_wmi_10_4_op_gen_pdev_get_tpc_table_cmdid,
-+	.gen_radar_found = ath10k_wmi_10_4_gen_radar_found,
- 
- 	/* shared with 10.2 */
- 	.pull_echo_ev = ath10k_wmi_op_pull_echo_ev,
-@@ -8776,8 +8939,11 @@ int ath10k_wmi_attach(struct ath10k *ar)
- 	init_completion(&ar->wmi.service_ready);
- 	init_completion(&ar->wmi.unified_ready);
- 	init_completion(&ar->wmi.barrier);
-+	init_completion(&ar->wmi.radar_confirm);
- 
- 	INIT_WORK(&ar->svc_rdy_work, ath10k_wmi_event_service_ready_work);
-+	INIT_WORK(&ar->radar_confirmation_work,
-+		  ath10k_radar_confirmation_work);
- 
- 	return 0;
- }
---- a/drivers/net/wireless/ath/ath10k/wmi.h
-+++ b/drivers/net/wireless/ath/ath10k/wmi.h
-@@ -959,6 +959,7 @@ struct wmi_cmd_map {
- 	u32 vdev_sifs_trigger_time_cmdid;
- 	u32 pdev_wds_entry_list_cmdid;
- 	u32 tdls_set_offchan_mode_cmdid;
-+	u32 radar_found_cmdid;
- };
- 
- /*
-@@ -1792,6 +1793,11 @@ enum wmi_10_4_cmd_id {
- 	WMI_10_4_TDLS_SET_STATE_CMDID,
- 	WMI_10_4_TDLS_PEER_UPDATE_CMDID,
- 	WMI_10_4_TDLS_SET_OFFCHAN_MODE_CMDID,
-+	WMI_10_4_PDEV_SEND_FD_CMDID,
-+	WMI_10_4_ENABLE_FILS_CMDID,
-+	WMI_10_4_PDEV_SET_BRIDGE_MACADDR_CMDID,
-+	WMI_10_4_ATF_GROUP_WMM_AC_CONFIG_REQUEST_CMDID,
-+	WMI_10_4_RADAR_FOUND_CMDID,
- 	WMI_10_4_PDEV_UTF_CMDID = WMI_10_4_END_CMDID - 1,
- };
- 
-@@ -1867,6 +1873,9 @@ enum wmi_10_4_event_id {
- 	WMI_10_4_PDEV_TPC_TABLE_EVENTID,
- 	WMI_10_4_PDEV_WDS_ENTRY_LIST_EVENTID,
- 	WMI_10_4_TDLS_PEER_EVENTID,
-+	WMI_10_4_HOST_SWFDA_EVENTID,
-+	WMI_10_4_ESP_ESTIMATE_EVENTID,
-+	WMI_10_4_DFS_STATUS_CHECK_EVENTID,
- 	WMI_10_4_PDEV_UTF_EVENTID = WMI_10_4_END_EVENTID - 1,
- };
- 
-@@ -3379,6 +3388,25 @@ struct wmi_10_4_phyerr_event {
- 	u8 buf[0];
- } __packed;
- 
-+struct wmi_radar_found_info {
-+	__le32 pri_min;
-+	__le32 pri_max;
-+	__le32 width_min;
-+	__le32 width_max;
-+	__le32 sidx_min;
-+	__le32 sidx_max;
-+} __packed;
-+
-+enum wmi_radar_confirmation_status {
-+	/* Detected radar was due to SW pulses */
-+	WMI_SW_RADAR_DETECTED    = 0,
-+
-+	WMI_RADAR_DETECTION_FAIL = 1,
-+
-+	/* Real radar detected */
-+	WMI_HW_RADAR_DETECTED    = 2,
-+};
-+
- #define PHYERR_TLV_SIG				0xBB
- #define PHYERR_TLV_TAG_SEARCH_FFT_REPORT	0xFB
- #define PHYERR_TLV_TAG_RADAR_PULSE_SUMMARY	0xF8
-@@ -6586,6 +6614,10 @@ struct wmi_phyerr_hdr_arg {
- 	const void *phyerrs;
- };
- 
-+struct wmi_dfs_status_ev_arg {
-+	u32 status;
-+};
-+
- struct wmi_svc_rdy_ev_arg {
- 	__le32 min_tx_power;
- 	__le32 max_tx_power;
diff --git a/package/kernel/mac80211/patches/380-0009-ath10k-fix-memory-leak-of-tpc_stats.patch b/package/kernel/mac80211/patches/380-0009-ath10k-fix-memory-leak-of-tpc_stats.patch
deleted file mode 100644
index 196a2bc86..000000000
--- a/package/kernel/mac80211/patches/380-0009-ath10k-fix-memory-leak-of-tpc_stats.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 260e629bbf441585860e21d5e10d2e88437f47c8 Mon Sep 17 00:00:00 2001
-From: Colin Ian King <colin.king@canonical.com>
-Date: Sun, 27 May 2018 22:17:02 +0100
-Subject: [PATCH] ath10k: fix memory leak of tpc_stats
-
-Currently tpc_stats is allocated and is leaked on the return
-path if num_tx_chain is greater than WMI_TPC_TX_N_CHAIN. Avoid
-this leak by performing the check on num_tx_chain before the
-allocation of tpc_stats.
-
-Detected by CoverityScan, CID#1469422 ("Resource Leak")
-Fixes: 4b190675ad06 ("ath10k: fix kernel panic while reading tpc_stats")
-
-Signed-off-by: Colin Ian King <colin.king@canonical.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/ath/ath10k/wmi.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/ath/ath10k/wmi.c
-+++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -4557,10 +4557,6 @@ void ath10k_wmi_event_pdev_tpc_config(st
- 
- 	ev = (struct wmi_pdev_tpc_config_event *)skb->data;
- 
--	tpc_stats = kzalloc(sizeof(*tpc_stats), GFP_ATOMIC);
--	if (!tpc_stats)
--		return;
--
- 	num_tx_chain = __le32_to_cpu(ev->num_tx_chain);
- 
- 	if (num_tx_chain > WMI_TPC_TX_N_CHAIN) {
-@@ -4569,6 +4565,10 @@ void ath10k_wmi_event_pdev_tpc_config(st
- 		return;
- 	}
- 
-+	tpc_stats = kzalloc(sizeof(*tpc_stats), GFP_ATOMIC);
-+	if (!tpc_stats)
-+		return;
-+
- 	ath10k_wmi_tpc_config_get_rate_code(rate_code, pream_table,
- 					    num_tx_chain);
- 
diff --git a/package/kernel/mac80211/patches/380-0010-ath10k-support-use-of-channel-173.patch b/package/kernel/mac80211/patches/380-0010-ath10k-support-use-of-channel-173.patch
deleted file mode 100644
index 06b68b280..000000000
--- a/package/kernel/mac80211/patches/380-0010-ath10k-support-use-of-channel-173.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 38441fb6fcbb97817dff5c012609860a2b39c3e9 Mon Sep 17 00:00:00 2001
-From: Ben Greear <greearb@candelatech.com>
-Date: Tue, 2 Jan 2018 16:51:01 -0800
-Subject: [PATCH] ath10k: support use of channel 173
-
-The India regulatory domain allows CH 173, so add that to the
-available channel list.  I verified basic connectivity between
-a 9880 and 9984 NIC.
-
-Signed-off-by: Ben Greear <greearb@candelatech.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/ath/ath10k/core.h | 3 ++-
- drivers/net/wireless/ath/ath10k/mac.c  | 3 +++
- drivers/net/wireless/ath/ath10k/wmi.c  | 2 +-
- 3 files changed, 6 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/ath/ath10k/core.h
-+++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -47,7 +47,8 @@
- #define WMI_READY_TIMEOUT (5 * HZ)
- #define ATH10K_FLUSH_TIMEOUT_HZ (5 * HZ)
- #define ATH10K_CONNECTION_LOSS_HZ (3 * HZ)
--#define ATH10K_NUM_CHANS 40
-+#define ATH10K_NUM_CHANS 41
-+#define ATH10K_MAX_5G_CHAN 173
- 
- /* Antenna noise floor */
- #define ATH10K_DEFAULT_NOISE_FLOOR -95
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -7766,6 +7766,9 @@ static const struct ieee80211_channel at
- 	CHAN5G(161, 5805, 0),
- 	CHAN5G(165, 5825, 0),
- 	CHAN5G(169, 5845, 0),
-+	CHAN5G(173, 5865, 0),
-+	/* If you add more, you may need to change ATH10K_MAX_5G_CHAN */
-+	/* And you will definitely need to change ATH10K_NUM_CHANS in core.h */
- };
- 
- struct ath10k *ath10k_mac_create(size_t priv_size)
---- a/drivers/net/wireless/ath/ath10k/wmi.c
-+++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -2363,7 +2363,7 @@ int ath10k_wmi_event_mgmt_rx(struct ath1
- 	 */
- 	if (channel >= 1 && channel <= 14) {
- 		status->band = NL80211_BAND_2GHZ;
--	} else if (channel >= 36 && channel <= 169) {
-+	} else if (channel >= 36 && channel <= ATH10K_MAX_5G_CHAN) {
- 		status->band = NL80211_BAND_5GHZ;
- 	} else {
- 		/* Shouldn't happen unless list of advertised channels to
diff --git a/package/kernel/mac80211/patches/380-0011-ath10k-fix-spectral-scan-for-QCA9984-and-QCA9888-chi.patch b/package/kernel/mac80211/patches/380-0011-ath10k-fix-spectral-scan-for-QCA9984-and-QCA9888-chi.patch
deleted file mode 100644
index b974113b5..000000000
--- a/package/kernel/mac80211/patches/380-0011-ath10k-fix-spectral-scan-for-QCA9984-and-QCA9888-chi.patch
+++ /dev/null
@@ -1,156 +0,0 @@
-From 2e9bcd0d73243f5e49daf92508d64cc33c30da01 Mon Sep 17 00:00:00 2001
-From: Karthikeyan Periyasamy <periyasa@codeaurora.org>
-Date: Tue, 29 May 2018 17:01:13 +0530
-Subject: [PATCH] ath10k: fix spectral scan for QCA9984 and QCA9888 chipsets
-
-The spectral scan has been always broken on QCA9984 and QCA9888.
-
-Introduce a hardware parameter 'spectral_bin_offset' to resolve this issue for
-QCA9984 and QCA9888 chipsets. For other chipsets, the hardware parameter
-'spectral_bin_offset' is zero so that existing behaviour is retained as it is.
-
-In QCA9984 and QCA9888 chipsets, hardware param value 'spectral_bin_discard'
-is 12 bytes. This 12 bytes is derived as the sum of segment index (4 bytes),
-extra bins before the actual data (4 bytes) and extra bins after the actual
-data (4 bytes). Always discarding (12 bytes) happens at end of the samples and
-incorrect samples got dumped, so that user can find incorrect arrangement
-samples in spectral scan dump.
-
-To fix this issue, we have to discard first 8 bytes and last 4 bytes in every
-samples, so totally 12 bytes are discarded. In every sample we need to consider
-the offset while taking the actual spectral data. For QCA9984, QCA9888 the
-offset is 8 bytes (segment index + extra bins before actual data).
-
-Hardware tested: QCA9984 and QCA9888
-Firmware tested: 10.4-3.5.3-00053
-
-Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/ath/ath10k/core.c     | 13 +++++++++++++
- drivers/net/wireless/ath/ath10k/hw.h       |  3 +++
- drivers/net/wireless/ath/ath10k/spectral.c |  2 +-
- 3 files changed, 17 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/ath/ath10k/core.c
-+++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -72,6 +72,7 @@ static const struct ath10k_hw_params ath
- 		.hw_ops = &qca988x_ops,
- 		.decap_align_bytes = 4,
- 		.spectral_bin_discard = 0,
-+		.spectral_bin_offset = 0,
- 		.vht160_mcs_rx_highest = 0,
- 		.vht160_mcs_tx_highest = 0,
- 		.n_cipher_suites = 8,
-@@ -96,6 +97,7 @@ static const struct ath10k_hw_params ath
- 		.hw_ops = &qca988x_ops,
- 		.decap_align_bytes = 4,
- 		.spectral_bin_discard = 0,
-+		.spectral_bin_offset = 0,
- 		.vht160_mcs_rx_highest = 0,
- 		.vht160_mcs_tx_highest = 0,
- 		.n_cipher_suites = 8,
-@@ -119,6 +121,7 @@ static const struct ath10k_hw_params ath
- 		.hw_ops = &qca988x_ops,
- 		.decap_align_bytes = 4,
- 		.spectral_bin_discard = 0,
-+		.spectral_bin_offset = 0,
- 		.vht160_mcs_rx_highest = 0,
- 		.vht160_mcs_tx_highest = 0,
- 		.n_cipher_suites = 8,
-@@ -142,6 +145,7 @@ static const struct ath10k_hw_params ath
- 		.hw_ops = &qca988x_ops,
- 		.decap_align_bytes = 4,
- 		.spectral_bin_discard = 0,
-+		.spectral_bin_offset = 0,
- 		.vht160_mcs_rx_highest = 0,
- 		.vht160_mcs_tx_highest = 0,
- 		.n_cipher_suites = 8,
-@@ -165,6 +169,8 @@ static const struct ath10k_hw_params ath
- 		.hw_ops = &qca988x_ops,
- 		.decap_align_bytes = 4,
- 		.spectral_bin_discard = 0,
-+		.spectral_bin_offset = 0,
-+		.spectral_bin_offset = 0,
- 		.vht160_mcs_rx_highest = 0,
- 		.vht160_mcs_tx_highest = 0,
- 		.n_cipher_suites = 8,
-@@ -191,6 +197,7 @@ static const struct ath10k_hw_params ath
- 		.target_cpu_freq = 176000000,
- 		.decap_align_bytes = 4,
- 		.spectral_bin_discard = 0,
-+		.spectral_bin_offset = 0,
- 		.vht160_mcs_rx_highest = 0,
- 		.vht160_mcs_tx_highest = 0,
- 		.n_cipher_suites = 8,
-@@ -220,6 +227,7 @@ static const struct ath10k_hw_params ath
- 		.hw_ops = &qca99x0_ops,
- 		.decap_align_bytes = 1,
- 		.spectral_bin_discard = 4,
-+		.spectral_bin_offset = 0,
- 		.vht160_mcs_rx_highest = 0,
- 		.vht160_mcs_tx_highest = 0,
- 		.n_cipher_suites = 11,
-@@ -250,6 +258,7 @@ static const struct ath10k_hw_params ath
- 		.hw_ops = &qca99x0_ops,
- 		.decap_align_bytes = 1,
- 		.spectral_bin_discard = 12,
-+		.spectral_bin_offset = 8,
- 
- 		/* Can do only 2x2 VHT160 or 80+80. 1560Mbps is 4x4 80Mhz
- 		 * or 2x2 160Mhz, long-guard-interval.
-@@ -283,6 +292,7 @@ static const struct ath10k_hw_params ath
- 		.hw_ops = &qca99x0_ops,
- 		.decap_align_bytes = 1,
- 		.spectral_bin_discard = 12,
-+		.spectral_bin_offset = 8,
- 
- 		/* Can do only 1x1 VHT160 or 80+80. 780Mbps is 2x2 80Mhz or
- 		 * 1x1 160Mhz, long-guard-interval.
-@@ -310,6 +320,7 @@ static const struct ath10k_hw_params ath
- 		.hw_ops = &qca988x_ops,
- 		.decap_align_bytes = 4,
- 		.spectral_bin_discard = 0,
-+		.spectral_bin_offset = 0,
- 		.vht160_mcs_rx_highest = 0,
- 		.vht160_mcs_tx_highest = 0,
- 		.n_cipher_suites = 8,
-@@ -335,6 +346,7 @@ static const struct ath10k_hw_params ath
- 		.target_cpu_freq = 176000000,
- 		.decap_align_bytes = 4,
- 		.spectral_bin_discard = 0,
-+		.spectral_bin_offset = 0,
- 		.vht160_mcs_rx_highest = 0,
- 		.vht160_mcs_tx_highest = 0,
- 		.n_cipher_suites = 8,
-@@ -365,6 +377,7 @@ static const struct ath10k_hw_params ath
- 		.hw_ops = &qca99x0_ops,
- 		.decap_align_bytes = 1,
- 		.spectral_bin_discard = 4,
-+		.spectral_bin_offset = 0,
- 		.vht160_mcs_rx_highest = 0,
- 		.vht160_mcs_tx_highest = 0,
- 		.n_cipher_suites = 11,
---- a/drivers/net/wireless/ath/ath10k/hw.h
-+++ b/drivers/net/wireless/ath/ath10k/hw.h
-@@ -553,6 +553,9 @@ struct ath10k_hw_params {
- 
- 	/* Number of ciphers supported (i.e First N) in cipher_suites array */
- 	int n_cipher_suites;
-+
-+	/* Number of bytes to be the offset for each FFT sample */
-+	int spectral_bin_offset;
- };
- 
- struct htt_rx_desc;
---- a/drivers/net/wireless/ath/ath10k/spectral.c
-+++ b/drivers/net/wireless/ath/ath10k/spectral.c
-@@ -145,7 +145,7 @@ int ath10k_spectral_process_fft(struct a
- 	fft_sample->noise = __cpu_to_be16(phyerr->nf_chains[chain_idx]);
- 
- 	bins = (u8 *)fftr;
--	bins += sizeof(*fftr);
-+	bins += sizeof(*fftr) + ar->hw_params.spectral_bin_offset;
- 
- 	fft_sample->tsf = __cpu_to_be64(tsf);
- 
diff --git a/package/kernel/mac80211/patches/382-mac80211-Run-TXQ-teardown-code-before-de-registering.patch b/package/kernel/mac80211/patches/382-mac80211-Run-TXQ-teardown-code-before-de-registering.patch
deleted file mode 100644
index ad282f989..000000000
--- a/package/kernel/mac80211/patches/382-mac80211-Run-TXQ-teardown-code-before-de-registering.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>
-Date: Mon, 13 Aug 2018 14:16:25 +0200
-Subject: [PATCH] mac80211: Run TXQ teardown code before de-registering
- interfaces
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The TXQ teardown code can reference the vif data structures that are
-stored in the netdev private memory area if there are still packets on
-the queue when it is being freed. Since the TXQ teardown code is run
-after the netdevs are freed, this can lead to a use-after-free. Fix this
-by moving the TXQ teardown code to earlier in ieee80211_unregister_hw().
-
-Reported-by: Ben Greear <greearb@candelatech.com>
-Tested-by: Ben Greear <greearb@candelatech.com>
-Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -1172,6 +1172,7 @@ void ieee80211_unregister_hw(struct ieee
- #if IS_ENABLED(__disabled__CONFIG_IPV6)
- 	unregister_inet6addr_notifier(&local->ifa6_notifier);
- #endif
-+	ieee80211_txq_teardown_flows(local);
- 
- 	rtnl_lock();
- 
-@@ -1200,7 +1201,6 @@ void ieee80211_unregister_hw(struct ieee
- 	skb_queue_purge(&local->skb_queue);
- 	skb_queue_purge(&local->skb_queue_unreliable);
- 	skb_queue_purge(&local->skb_queue_tdls_chsw);
--	ieee80211_txq_teardown_flows(local);
- 
- 	destroy_workqueue(local->workqueue);
- 	wiphy_unregister(local->hw.wiphy);
diff --git a/package/kernel/mac80211/patches/383-mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch b/package/kernel/mac80211/patches/383-mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch
deleted file mode 100644
index e7b279af5..000000000
--- a/package/kernel/mac80211/patches/383-mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From: Yuan-Chi Pang <fu3mo6goo@gmail.com>
-Date: Wed, 29 Aug 2018 09:30:08 +0800
-Subject: [PATCH] mac80211: mesh: fix HWMP sequence numbering to follow
- standard
-
-IEEE 802.11-2016 14.10.8.3 HWMP sequence numbering says:
-If it is a target mesh STA, it shall update its own HWMP SN to
-maximum (current HWMP SN, target HWMP SN in the PREQ element) + 1
-immediately before it generates a PREP element in response to a
-PREQ element.
-
-Signed-off-by: Yuan-Chi Pang <fu3mo6goo@gmail.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/mesh_hwmp.c
-+++ b/net/mac80211/mesh_hwmp.c
-@@ -572,6 +572,10 @@ static void hwmp_preq_frame_process(stru
- 		forward = false;
- 		reply = true;
- 		target_metric = 0;
-+
-+		if (SN_GT(target_sn, ifmsh->sn))
-+			ifmsh->sn = target_sn;
-+
- 		if (time_after(jiffies, ifmsh->last_sn_update +
- 					net_traversal_jiffies(sdata)) ||
- 		    time_before(jiffies, ifmsh->last_sn_update)) {
diff --git a/package/kernel/mac80211/patches/384-mac80211-avoid-kernel-panic-when-building-AMSDU-from.patch b/package/kernel/mac80211/patches/384-mac80211-avoid-kernel-panic-when-building-AMSDU-from.patch
deleted file mode 100644
index 66993839e..000000000
--- a/package/kernel/mac80211/patches/384-mac80211-avoid-kernel-panic-when-building-AMSDU-from.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From: Sara Sharon <sara.sharon@intel.com>
-Date: Wed, 29 Aug 2018 08:57:02 +0200
-Subject: [PATCH] mac80211: avoid kernel panic when building AMSDU from
- non-linear SKB
-
-When building building AMSDU from non-linear SKB, we hit a
-kernel panic when trying to push the padding to the tail.
-Instead, put the padding at the head of the next subframe.
-This also fixes the A-MSDU subframes to not have the padding
-accounted in the length field and not have pad at all for
-the last subframe, both required by the spec.
-
-Fixes: 6e0456b54545 ("mac80211: add A-MSDU tx support")
-Signed-off-by: Sara Sharon <sara.sharon@intel.com>
-Reviewed-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3064,27 +3064,18 @@ void ieee80211_clear_fast_xmit(struct st
- }
- 
- static bool ieee80211_amsdu_realloc_pad(struct ieee80211_local *local,
--					struct sk_buff *skb, int headroom,
--					int *subframe_len)
-+					struct sk_buff *skb, int headroom)
- {
--	int amsdu_len = *subframe_len + sizeof(struct ethhdr);
--	int padding = (4 - amsdu_len) & 3;
--
--	if (skb_headroom(skb) < headroom || skb_tailroom(skb) < padding) {
-+	if (skb_headroom(skb) < headroom) {
- 		I802_DEBUG_INC(local->tx_expand_skb_head);
- 
--		if (pskb_expand_head(skb, headroom, padding, GFP_ATOMIC)) {
-+		if (pskb_expand_head(skb, headroom, 0, GFP_ATOMIC)) {
- 			wiphy_debug(local->hw.wiphy,
- 				    "failed to reallocate TX buffer\n");
- 			return false;
- 		}
- 	}
- 
--	if (padding) {
--		*subframe_len += padding;
--		skb_put_zero(skb, padding);
--	}
--
- 	return true;
- }
- 
-@@ -3108,8 +3099,7 @@ static bool ieee80211_amsdu_prepare_head
- 	if (info->control.flags & IEEE80211_TX_CTRL_AMSDU)
- 		return true;
- 
--	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr),
--					 &subframe_len))
-+	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr)))
- 		return false;
- 
- 	data = skb_push(skb, sizeof(*amsdu_hdr));
-@@ -3176,7 +3166,8 @@ static bool ieee80211_amsdu_aggregate(st
- 	void *data;
- 	bool ret = false;
- 	unsigned int orig_len;
--	int n = 1, nfrags;
-+	int n = 1, nfrags, pad = 0;
-+	u16 hdrlen;
- 
- 	if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
- 		return false;
-@@ -3228,8 +3219,19 @@ static bool ieee80211_amsdu_aggregate(st
- 	if (max_frags && nfrags > max_frags)
- 		goto out;
- 
--	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) + 2,
--					 &subframe_len))
-+	/*
-+	 * Pad out the previous subframe to a multiple of 4 by adding the
-+	 * padding to the next one, that's being added. Note that head->len
-+	 * is the length of the full A-MSDU, but that works since each time
-+	 * we add a new subframe we pad out the previous one to a multiple
-+	 * of 4 and thus it no longer matters in the next round.
-+	 */
-+	hdrlen = fast_tx->hdr_len - sizeof(rfc1042_header);
-+	if ((head->len - hdrlen) & 3)
-+		pad = 4 - ((head->len - hdrlen) & 3);
-+
-+	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) +
-+						     2 + pad))
- 		goto out;
- 
- 	ret = true;
-@@ -3241,6 +3243,8 @@ static bool ieee80211_amsdu_aggregate(st
- 	memcpy(data, &len, 2);
- 	memcpy(data + 2, rfc1042_header, sizeof(rfc1042_header));
- 
-+	memset(skb_push(skb, pad), 0, pad);
-+
- 	head->len += skb->len;
- 	head->data_len += skb->len;
- 	*frag_tail = skb;
diff --git a/package/kernel/mac80211/patches/385-cfg80211-nl80211_update_ft_ies-to-validate-NL80211_A.patch b/package/kernel/mac80211/patches/385-cfg80211-nl80211_update_ft_ies-to-validate-NL80211_A.patch
deleted file mode 100644
index f4b14506a..000000000
--- a/package/kernel/mac80211/patches/385-cfg80211-nl80211_update_ft_ies-to-validate-NL80211_A.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From: Arunk Khandavalli <akhandav@codeaurora.org>
-Date: Thu, 30 Aug 2018 00:40:16 +0300
-Subject: [PATCH] cfg80211: nl80211_update_ft_ies() to validate
- NL80211_ATTR_IE
-
-nl80211_update_ft_ies() tried to validate NL80211_ATTR_IE with
-is_valid_ie_attr() before dereferencing it, but that helper function
-returns true in case of NULL pointer (i.e., attribute not included).
-This can result to dereferencing a NULL pointer. Fix that by explicitly
-checking that NL80211_ATTR_IE is included.
-
-Fixes: 355199e02b83 ("cfg80211: Extend support for IEEE 802.11r Fast BSS Transition")
-Signed-off-by: Arunk Khandavalli <akhandav@codeaurora.org>
-Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -11763,6 +11763,7 @@ static int nl80211_update_ft_ies(struct
- 		return -EOPNOTSUPP;
- 
- 	if (!info->attrs[NL80211_ATTR_MDID] ||
-+	    !info->attrs[NL80211_ATTR_IE] ||
- 	    !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
- 		return -EINVAL;
- 
diff --git a/package/kernel/mac80211/patches/386-mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch b/package/kernel/mac80211/patches/386-mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch
deleted file mode 100644
index 1d8890225..000000000
--- a/package/kernel/mac80211/patches/386-mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
-Date: Wed, 29 Aug 2018 21:03:25 +0200
-Subject: [PATCH] mac80211: do not convert to A-MSDU if frag/subframe
- limited
-
-Do not start to aggregate packets in a A-MSDU frame (converting the
-first subframe to A-MSDU, adding the header) if max_tx_fragments or
-max_amsdu_subframes limits are already exceeded by it. In particular,
-this happens when drivers set the limit to 1 to avoid A-MSDUs at all.
-
-Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
-[reword commit message to be more precise]
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3201,9 +3201,6 @@ static bool ieee80211_amsdu_aggregate(st
- 	if (skb->len + head->len > max_amsdu_len)
- 		goto unlock;
- 
--	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
--		goto out;
--
- 	nfrags = 1 + skb_shinfo(skb)->nr_frags;
- 	nfrags += 1 + skb_shinfo(head)->nr_frags;
- 	frag_tail = &skb_shinfo(head)->frag_list;
-@@ -3219,6 +3216,9 @@ static bool ieee80211_amsdu_aggregate(st
- 	if (max_frags && nfrags > max_frags)
- 		goto out;
- 
-+	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
-+		goto out;
-+
- 	/*
- 	 * Pad out the previous subframe to a multiple of 4 by adding the
- 	 * padding to the next one, that's being added. Note that head->len
diff --git a/package/kernel/mac80211/patches/387-mac80211-always-account-for-A-MSDU-header-changes.patch b/package/kernel/mac80211/patches/387-mac80211-always-account-for-A-MSDU-header-changes.patch
deleted file mode 100644
index 47942116b..000000000
--- a/package/kernel/mac80211/patches/387-mac80211-always-account-for-A-MSDU-header-changes.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Thu, 30 Aug 2018 10:55:49 +0200
-Subject: [PATCH] mac80211: always account for A-MSDU header changes
-
-In the error path of changing the SKB headroom of the second
-A-MSDU subframe, we would not account for the already-changed
-length of the first frame that just got converted to be in
-A-MSDU format and thus is a bit longer now.
-
-Fix this by doing the necessary accounting.
-
-It would be possible to reorder the operations, but that would
-make the code more complex (to calculate the necessary pad),
-and the headroom expansion should not fail frequently enough
-to make that worthwhile.
-
-Fixes: 6e0456b54545 ("mac80211: add A-MSDU tx support")
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Acked-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3232,7 +3232,7 @@ static bool ieee80211_amsdu_aggregate(st
- 
- 	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) +
- 						     2 + pad))
--		goto out;
-+		goto out_recalc;
- 
- 	ret = true;
- 	data = skb_push(skb, ETH_ALEN + 2);
-@@ -3249,11 +3249,13 @@ static bool ieee80211_amsdu_aggregate(st
- 	head->data_len += skb->len;
- 	*frag_tail = skb;
- 
--	flow->backlog += head->len - orig_len;
--	tin->backlog_bytes += head->len - orig_len;
--
--	fq_recalc_backlog(fq, tin, flow);
-+out_recalc:
-+	if (head->len != orig_len) {
-+		flow->backlog += head->len - orig_len;
-+		tin->backlog_bytes += head->len - orig_len;
- 
-+		fq_recalc_backlog(fq, tin, flow);
-+	}
- out:
- 	fq->memory_usage += head->truesize - orig_truesize;
- 
diff --git a/package/kernel/mac80211/patches/388-mac80211-fix-an-off-by-one-issue-in-A-MSDU-max_subfr.patch b/package/kernel/mac80211/patches/388-mac80211-fix-an-off-by-one-issue-in-A-MSDU-max_subfr.patch
deleted file mode 100644
index 455fa2983..000000000
--- a/package/kernel/mac80211/patches/388-mac80211-fix-an-off-by-one-issue-in-A-MSDU-max_subfr.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
-Date: Fri, 31 Aug 2018 01:04:13 +0200
-Subject: [PATCH] mac80211: fix an off-by-one issue in A-MSDU
- max_subframe computation
-
-Initialize 'n' to 2 in order to take into account also the first
-packet in the estimation of max_subframe limit for a given A-MSDU
-since frag_tail pointer is NULL when ieee80211_amsdu_aggregate
-routine analyzes the second frame.
-
-Fixes: 6e0456b54545 ("mac80211: add A-MSDU tx support")
-Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3166,7 +3166,7 @@ static bool ieee80211_amsdu_aggregate(st
- 	void *data;
- 	bool ret = false;
- 	unsigned int orig_len;
--	int n = 1, nfrags, pad = 0;
-+	int n = 2, nfrags, pad = 0;
- 	u16 hdrlen;
- 
- 	if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
diff --git a/package/kernel/mac80211/patches/389-cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch b/package/kernel/mac80211/patches/389-cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch
deleted file mode 100644
index 8437aad6a..000000000
--- a/package/kernel/mac80211/patches/389-cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From: Dan Carpenter <dan.carpenter@oracle.com>
-Date: Fri, 31 Aug 2018 11:10:55 +0300
-Subject: [PATCH] cfg80211: fix a type issue in
- ieee80211_chandef_to_operating_class()
-
-The "chandef->center_freq1" variable is a u32 but "freq" is a u16 so we
-are truncating away the high bits.  I noticed this bug because in commit
-9cf0a0b4b64a ("cfg80211: Add support for 60GHz band channels 5 and 6")
-we made "freq <= 56160 + 2160 * 6" a valid requency when before it was
-only "freq <= 56160 + 2160 * 4" that was valid.  It introduces a static
-checker warning:
-
-    net/wireless/util.c:1571 ieee80211_chandef_to_operating_class()
-    warn: always true condition '(freq <= 56160 + 2160 * 6) => (0-u16max <= 69120)'
-
-But really we probably shouldn't have been truncating the high bits
-away to begin with.
-
-Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -1377,7 +1377,7 @@ bool ieee80211_chandef_to_operating_clas
- 					  u8 *op_class)
- {
- 	u8 vht_opclass;
--	u16 freq = chandef->center_freq1;
-+	u32 freq = chandef->center_freq1;
- 
- 	if (freq >= 2412 && freq <= 2472) {
- 		if (chandef->width > NL80211_CHAN_WIDTH_40)
diff --git a/package/kernel/mac80211/patches/390-mac80211-fix-a-race-between-restart-and-CSA-flows.patch b/package/kernel/mac80211/patches/390-mac80211-fix-a-race-between-restart-and-CSA-flows.patch
deleted file mode 100644
index db2aa0443..000000000
--- a/package/kernel/mac80211/patches/390-mac80211-fix-a-race-between-restart-and-CSA-flows.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-Date: Fri, 31 Aug 2018 11:31:06 +0300
-Subject: [PATCH] mac80211: fix a race between restart and CSA flows
-
-We hit a problem with iwlwifi that was caused by a bug in
-mac80211. A bug in iwlwifi caused the firwmare to crash in
-certain cases in channel switch. Because of that bug,
-drv_pre_channel_switch would fail and trigger the restart
-flow.
-Now we had the hw restart worker which runs on the system's
-workqueue and the csa_connection_drop_work worker that runs
-on mac80211's workqueue that can run together. This is
-obviously problematic since the restart work wants to
-reconfigure the connection, while the csa_connection_drop_work
-worker does the exact opposite: it tries to disconnect.
-
-Fix this by cancelling the csa_connection_drop_work worker
-in the restart worker.
-
-Note that this can sound racy: we could have:
-
-driver   iface_work   CSA_work   restart_work
-+++++++++++++++++++++++++++++++++++++++++++++
-              |
- <--drv_cs ---|
-<FW CRASH!>
--CS FAILED-->
-              |                       |
-              |                 cancel_work(CSA)
-           schedule                   |
-           CSA work                   |
-                         |            |
-                        Race between those 2
-
-But this is not possible because we flush the workqueue
-in the restart worker before we cancel the CSA worker.
-That would be bullet proof if we could guarantee that
-we schedule the CSA worker only from the iface_work
-which runs on the workqueue (and not on the system's
-workqueue), but unfortunately we do have an instance
-in which we schedule the CSA work outside the context
-of the workqueue (ieee80211_chswitch_done).
-
-Note also that we should probably cancel other workers
-like beacon_connection_loss_work and possibly others
-for different types of interfaces, at the very least,
-IBSS should suffer from the exact same problem, but for
-now, do the minimum to fix the actual bug that was actually
-experienced and reproduced.
-
-Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -255,8 +255,27 @@ static void ieee80211_restart_work(struc
- 
- 	flush_work(&local->radar_detected_work);
- 	rtnl_lock();
--	list_for_each_entry(sdata, &local->interfaces, list)
-+	list_for_each_entry(sdata, &local->interfaces, list) {
-+		/*
-+		 * XXX: there may be more work for other vif types and even
-+		 * for station mode: a good thing would be to run most of
-+		 * the iface type's dependent _stop (ieee80211_mg_stop,
-+		 * ieee80211_ibss_stop) etc...
-+		 * For now, fix only the specific bug that was seen: race
-+		 * between csa_connection_drop_work and us.
-+		 */
-+		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-+			/*
-+			 * This worker is scheduled from the iface worker that
-+			 * runs on mac80211's workqueue, so we can't be
-+			 * scheduling this worker after the cancel right here.
-+			 * The exception is ieee80211_chswitch_done.
-+			 * Then we can have a race...
-+			 */
-+			cancel_work_sync(&sdata->u.mgd.csa_connection_drop_work);
-+		}
- 		flush_delayed_work(&sdata->dec_tailroom_needed_wk);
-+	}
- 	ieee80211_scan_cancel(local);
- 
- 	/* make sure any new ROC will consider local->in_reconfig */
diff --git a/package/kernel/mac80211/patches/391-mac80211-Fix-station-bandwidth-setting-after-channel.patch b/package/kernel/mac80211/patches/391-mac80211-Fix-station-bandwidth-setting-after-channel.patch
deleted file mode 100644
index aa8db32e7..000000000
--- a/package/kernel/mac80211/patches/391-mac80211-Fix-station-bandwidth-setting-after-channel.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From: Ilan Peer <ilan.peer@intel.com>
-Date: Fri, 31 Aug 2018 11:31:10 +0300
-Subject: [PATCH] mac80211: Fix station bandwidth setting after channel
- switch
-
-When performing a channel switch flow for a managed interface, the
-flow did not update the bandwidth of the AP station and the rate
-scale algorithm. In case of a channel width downgrade, this would
-result with the rate scale algorithm using a bandwidth that does not
-match the interface channel configuration.
-
-Fix this by updating the AP station bandwidth and rate scaling algorithm
-before the actual channel change in case of a bandwidth downgrade, or
-after the actual channel change in case of a bandwidth upgrade.
-
-Signed-off-by: Ilan Peer <ilan.peer@intel.com>
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -975,6 +975,10 @@ static void ieee80211_chswitch_work(stru
- 	 */
- 
- 	if (sdata->reserved_chanctx) {
-+		struct ieee80211_supported_band *sband = NULL;
-+		struct sta_info *mgd_sta = NULL;
-+		enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;
-+
- 		/*
- 		 * with multi-vif csa driver may call ieee80211_csa_finish()
- 		 * many times while waiting for other interfaces to use their
-@@ -983,6 +987,48 @@ static void ieee80211_chswitch_work(stru
- 		if (sdata->reserved_ready)
- 			goto out;
- 
-+		if (sdata->vif.bss_conf.chandef.width !=
-+		    sdata->csa_chandef.width) {
-+			/*
-+			 * For managed interface, we need to also update the AP
-+			 * station bandwidth and align the rate scale algorithm
-+			 * on the bandwidth change. Here we only consider the
-+			 * bandwidth of the new channel definition (as channel
-+			 * switch flow does not have the full HT/VHT/HE
-+			 * information), assuming that if additional changes are
-+			 * required they would be done as part of the processing
-+			 * of the next beacon from the AP.
-+			 */
-+			switch (sdata->csa_chandef.width) {
-+			case NL80211_CHAN_WIDTH_20_NOHT:
-+			case NL80211_CHAN_WIDTH_20:
-+			default:
-+				bw = IEEE80211_STA_RX_BW_20;
-+				break;
-+			case NL80211_CHAN_WIDTH_40:
-+				bw = IEEE80211_STA_RX_BW_40;
-+				break;
-+			case NL80211_CHAN_WIDTH_80:
-+				bw = IEEE80211_STA_RX_BW_80;
-+				break;
-+			case NL80211_CHAN_WIDTH_80P80:
-+			case NL80211_CHAN_WIDTH_160:
-+				bw = IEEE80211_STA_RX_BW_160;
-+				break;
-+			}
-+
-+			mgd_sta = sta_info_get(sdata, ifmgd->bssid);
-+			sband =
-+				local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
-+		}
-+
-+		if (sdata->vif.bss_conf.chandef.width >
-+		    sdata->csa_chandef.width) {
-+			mgd_sta->sta.bandwidth = bw;
-+			rate_control_rate_update(local, sband, mgd_sta,
-+						 IEEE80211_RC_BW_CHANGED);
-+		}
-+
- 		ret = ieee80211_vif_use_reserved_context(sdata);
- 		if (ret) {
- 			sdata_info(sdata,
-@@ -993,6 +1039,13 @@ static void ieee80211_chswitch_work(stru
- 			goto out;
- 		}
- 
-+		if (sdata->vif.bss_conf.chandef.width <
-+		    sdata->csa_chandef.width) {
-+			mgd_sta->sta.bandwidth = bw;
-+			rate_control_rate_update(local, sband, mgd_sta,
-+						 IEEE80211_RC_BW_CHANGED);
-+		}
-+
- 		goto out;
- 	}
- 
diff --git a/package/kernel/mac80211/patches/392-mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch b/package/kernel/mac80211/patches/392-mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch
deleted file mode 100644
index 74dd3d377..000000000
--- a/package/kernel/mac80211/patches/392-mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-Date: Fri, 31 Aug 2018 11:31:12 +0300
-Subject: [PATCH] mac80211: don't Tx a deauth frame if the AP forbade Tx
-
-If the driver fails to properly prepare for the channel
-switch, mac80211 will disconnect. If the CSA IE had mode
-set to 1, it means that the clients are not allowed to send
-any Tx on the current channel, and that includes the
-deauthentication frame.
-
-Make sure that we don't send the deauthentication frame in
-this case.
-
-In iwlwifi, this caused a failure to flush queues since the
-firmware already closed the queues after having parsed the
-CSA IE. Then mac80211 would wait until the deauthentication
-frame would go out (drv_flush(drop=false)) and that would
-never happen.
-
-Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -1267,6 +1267,16 @@ ieee80211_sta_process_chanswitch(struct
- 					 cbss->beacon_interval));
- 	return;
-  drop_connection:
-+	/*
-+	 * This is just so that the disconnect flow will know that
-+	 * we were trying to switch channel and failed. In case the
-+	 * mode is 1 (we are not allowed to Tx), we will know not to
-+	 * send a deauthentication frame. Those two fields will be
-+	 * reset when the disconnection worker runs.
-+	 */
-+	sdata->vif.csa_active = true;
-+	sdata->csa_block_tx = csa_ie.mode;
-+
- 	ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
- 	mutex_unlock(&local->chanctx_mtx);
- 	mutex_unlock(&local->mtx);
-@@ -2437,6 +2447,7 @@ static void __ieee80211_disconnect(struc
- 	struct ieee80211_local *local = sdata->local;
- 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
- 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
-+	bool tx;
- 
- 	sdata_lock(sdata);
- 	if (!ifmgd->associated) {
-@@ -2444,6 +2455,8 @@ static void __ieee80211_disconnect(struc
- 		return;
- 	}
- 
-+	tx = !sdata->csa_block_tx;
-+
- 	/* AP is probably out of range (or not reachable for another reason) so
- 	 * remove the bss struct for that AP.
- 	 */
-@@ -2451,7 +2464,7 @@ static void __ieee80211_disconnect(struc
- 
- 	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
- 			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
--			       true, frame_buf);
-+			       tx, frame_buf);
- 	mutex_lock(&local->mtx);
- 	sdata->vif.csa_active = false;
- 	ifmgd->csa_waiting_bcn = false;
-@@ -2462,7 +2475,7 @@ static void __ieee80211_disconnect(struc
- 	}
- 	mutex_unlock(&local->mtx);
- 
--	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
-+	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
- 				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
- 
- 	sdata_unlock(sdata);
diff --git a/package/kernel/mac80211/patches/393-mac80211-shorten-the-IBSS-debug-messages.patch b/package/kernel/mac80211/patches/393-mac80211-shorten-the-IBSS-debug-messages.patch
deleted file mode 100644
index fb5b282d1..000000000
--- a/package/kernel/mac80211/patches/393-mac80211-shorten-the-IBSS-debug-messages.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-Date: Fri, 31 Aug 2018 11:31:13 +0300
-Subject: [PATCH] mac80211: shorten the IBSS debug messages
-
-When tracing is enabled, all the debug messages are recorded and must
-not exceed MAX_MSG_LEN (100) columns. Longer debug messages grant the
-user with:
-
-WARNING: CPU: 3 PID: 32642 at /tmp/wifi-core-20180806094828/src/iwlwifi-stack-dev/net/mac80211/./trace_msg.h:32 trace_event_raw_event_mac80211_msg_event+0xab/0xc0 [mac80211]
-Workqueue: phy1 ieee80211_iface_work [mac80211]
- RIP: 0010:trace_event_raw_event_mac80211_msg_event+0xab/0xc0 [mac80211]
- Call Trace:
-  __sdata_dbg+0xbd/0x120 [mac80211]
-  ieee80211_ibss_rx_queued_mgmt+0x15f/0x510 [mac80211]
-  ieee80211_iface_work+0x21d/0x320 [mac80211]
-
-Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/ibss.c
-+++ b/net/mac80211/ibss.c
-@@ -947,8 +947,8 @@ static void ieee80211_rx_mgmt_deauth_ibs
- 	if (len < IEEE80211_DEAUTH_FRAME_LEN)
- 		return;
- 
--	ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM BSSID=%pM (reason: %d)\n",
--		 mgmt->sa, mgmt->da, mgmt->bssid, reason);
-+	ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
-+	ibss_dbg(sdata, "\tBSSID=%pM (reason: %d)\n", mgmt->bssid, reason);
- 	sta_info_destroy_addr(sdata, mgmt->sa);
- }
- 
-@@ -966,9 +966,9 @@ static void ieee80211_rx_mgmt_auth_ibss(
- 	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
- 	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
- 
--	ibss_dbg(sdata,
--		 "RX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=%d)\n",
--		 mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction);
-+	ibss_dbg(sdata, "RX Auth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
-+	ibss_dbg(sdata, "\tBSSID=%pM (auth_transaction=%d)\n",
-+		 mgmt->bssid, auth_transaction);
- 
- 	if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
- 		return;
-@@ -1175,10 +1175,10 @@ static void ieee80211_rx_bss_info(struct
- 		rx_timestamp = drv_get_tsf(local, sdata);
- 	}
- 
--	ibss_dbg(sdata,
--		 "RX beacon SA=%pM BSSID=%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
-+	ibss_dbg(sdata, "RX beacon SA=%pM BSSID=%pM TSF=0x%llx\n",
- 		 mgmt->sa, mgmt->bssid,
--		 (unsigned long long)rx_timestamp,
-+		 (unsigned long long)rx_timestamp);
-+	ibss_dbg(sdata, "\tBCN=0x%llx diff=%lld @%lu\n",
- 		 (unsigned long long)beacon_timestamp,
- 		 (unsigned long long)(rx_timestamp - beacon_timestamp),
- 		 jiffies);
-@@ -1537,9 +1537,9 @@ static void ieee80211_rx_mgmt_probe_req(
- 
- 	tx_last_beacon = drv_tx_last_beacon(local);
- 
--	ibss_dbg(sdata,
--		 "RX ProbeReq SA=%pM DA=%pM BSSID=%pM (tx_last_beacon=%d)\n",
--		 mgmt->sa, mgmt->da, mgmt->bssid, tx_last_beacon);
-+	ibss_dbg(sdata, "RX ProbeReq SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
-+	ibss_dbg(sdata, "\tBSSID=%pM (tx_last_beacon=%d)\n",
-+		 mgmt->bssid, tx_last_beacon);
- 
- 	if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da))
- 		return;
diff --git a/package/kernel/mac80211/patches/600-23-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch b/package/kernel/mac80211/patches/600-23-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch
deleted file mode 100644
index 342174f8d..000000000
--- a/package/kernel/mac80211/patches/600-23-rt2x00-rt2800mmio-add-a-workaround-for-spurious-TX_F.patch
+++ /dev/null
@@ -1,136 +0,0 @@
-From 5e67d4f8a46d19748b501c2ef86de3f50d3cfd51 Mon Sep 17 00:00:00 2001
-From: Gabor Juhos <juhosg@openwrt.org>
-Date: Sun, 24 Mar 2013 19:26:27 +0100
-Subject: [PATCH] rt2x00: rt2800mmio: add a workaround for spurious
- TX_FIFO_STATUS interrupts
-
-Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
----
- drivers/net/wireless/ralink/rt2x00/rt2800mmio.c |   72 +++++++++++++++++++++++++-----
- drivers/net/wireless/ralink/rt2x00/rt2x00.h     |    5 +++
- 2 files changed, 65 insertions(+), 12 deletions(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
-@@ -424,9 +424,9 @@ void rt2800mmio_autowake_tasklet(unsigne
- }
- EXPORT_SYMBOL_GPL(rt2800mmio_autowake_tasklet);
- 
--static void rt2800mmio_txstatus_interrupt(struct rt2x00_dev *rt2x00dev)
-+static void rt2800mmio_txstatus_interrupt(struct rt2x00_dev *rt2x00dev,
-+					  u32 status)
- {
--	u32 status;
- 	int i;
- 
- 	/*
-@@ -447,29 +447,77 @@ static void rt2800mmio_txstatus_interrup
- 	 * Since we have only one producer and one consumer we don't
- 	 * need to lock the kfifo.
- 	 */
--	for (i = 0; i < rt2x00dev->tx->limit; i++) {
--		status = rt2x00mmio_register_read(rt2x00dev, TX_STA_FIFO);
--
--		if (!rt2x00_get_field32(status, TX_STA_FIFO_VALID))
--			break;
--
-+	i = 0;
-+	do {
- 		if (!kfifo_put(&rt2x00dev->txstatus_fifo, status)) {
--			rt2x00_warn(rt2x00dev, "TX status FIFO overrun, drop tx status report\n");
-+			rt2x00_warn(rt2x00dev,
-+				    "TX status FIFO overrun, drop TX status report\n");
- 			break;
- 		}
--	}
-+
-+		if (++i >= rt2x00dev->tx->limit)
-+			break;
-+
-+		status = rt2x00mmio_register_read(rt2x00dev, TX_STA_FIFO);
-+	} while (rt2x00_get_field32(status, TX_STA_FIFO_VALID));
- 
- 	/* Schedule the tasklet for processing the tx status. */
- 	tasklet_schedule(&rt2x00dev->txstatus_tasklet);
- }
- 
-+#define RT2800MMIO_TXSTATUS_IRQ_MAX_RETRIES	4
-+
-+static bool rt2800mmio_txstatus_is_spurious(struct rt2x00_dev *rt2x00dev,
-+					   u32 txstatus)
-+{
-+	if (likely(rt2x00_get_field32(txstatus, TX_STA_FIFO_VALID))) {
-+		rt2x00dev->txstatus_irq_retries = 0;
-+		return false;
-+	}
-+
-+	rt2x00dev->txstatus_irq_retries++;
-+
-+	/* Ensure that we don't go into an infinite IRQ loop. */
-+	if (rt2x00dev->txstatus_irq_retries >=
-+	    RT2800MMIO_TXSTATUS_IRQ_MAX_RETRIES) {
-+		rt2x00_warn(rt2x00dev,
-+			    "%u spurious TX_FIFO_STATUS interrupt(s)\n",
-+			    rt2x00dev->txstatus_irq_retries);
-+		rt2x00dev->txstatus_irq_retries = 0;
-+		return false;
-+	}
-+
-+	return true;
-+}
-+
- irqreturn_t rt2800mmio_interrupt(int irq, void *dev_instance)
- {
- 	struct rt2x00_dev *rt2x00dev = dev_instance;
- 	u32 reg, mask;
-+	u32 txstatus = 0;
- 
--	/* Read status and ACK all interrupts */
-+	/* Read status */
- 	reg = rt2x00mmio_register_read(rt2x00dev, INT_SOURCE_CSR);
-+
-+	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS)) {
-+		/* Due to unknown reason the hardware generates a
-+		 * TX_FIFO_STATUS interrupt before the TX_STA_FIFO
-+		 * register contain valid data. Read the TX status
-+		 * here to see if we have to process the actual
-+		 * request.
-+		 */
-+		txstatus = rt2x00mmio_register_read(rt2x00dev, TX_STA_FIFO);
-+		if (rt2800mmio_txstatus_is_spurious(rt2x00dev, txstatus)) {
-+			/* Remove the TX_FIFO_STATUS bit so it won't be
-+			 * processed in this turn. The hardware will
-+			 * generate another IRQ for us.
-+			 */
-+			rt2x00_set_field32(&reg,
-+					   INT_SOURCE_CSR_TX_FIFO_STATUS, 0);
-+		}
-+	}
-+
-+	/* ACK interrupts */
- 	rt2x00mmio_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
- 
- 	if (!reg)
-@@ -486,7 +534,7 @@ irqreturn_t rt2800mmio_interrupt(int irq
- 	mask = ~reg;
- 
- 	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS)) {
--		rt2800mmio_txstatus_interrupt(rt2x00dev);
-+		rt2800mmio_txstatus_interrupt(rt2x00dev, txstatus);
- 		/*
- 		 * Never disable the TX_FIFO_STATUS interrupt.
- 		 */
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -1000,6 +1000,11 @@ struct rt2x00_dev {
- 	int rf_channel;
- 
- 	/*
-+	 * Counter for tx status irq retries (rt2800pci).
-+	 */
-+	unsigned int txstatus_irq_retries;
-+
-+	/*
- 	 * Protect the interrupt mask register.
- 	 */
- 	spinlock_t irqmask_lock;
diff --git a/package/kernel/mac80211/patches/941-mwl8k-add-non-DFS-5G-upper-channels.patch b/package/kernel/mac80211/patches/941-mwl8k-add-non-DFS-5G-upper-channels.patch
deleted file mode 100644
index e82db4d67..000000000
--- a/package/kernel/mac80211/patches/941-mwl8k-add-non-DFS-5G-upper-channels.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 4628257bf3006c18e0037459922624f02a138aed Mon Sep 17 00:00:00 2001
-From: Weixiao Zhang <waveletboy@gmail.com>
-Date: Thu, 16 Nov 2017 01:59:55 -0600
-Subject: [PATCH] mwl8k: Expand non-DFS 5G channels
-
-Add non-DFS 5G upper channels (149-165) besides existed 4 lower channels
-(36, 40, 44, 48).
-
-Signed-off-by: Weixiao Zhang <waveletboy@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/marvell/mwl8k.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/marvell/mwl8k.c
-+++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -199,7 +199,7 @@ struct mwl8k_priv {
- 	struct ieee80211_channel channels_24[14];
- 	struct ieee80211_rate rates_24[13];
- 	struct ieee80211_supported_band band_50;
--	struct ieee80211_channel channels_50[4];
-+	struct ieee80211_channel channels_50[9];
- 	struct ieee80211_rate rates_50[8];
- 	u32 ap_macids_supported;
- 	u32 sta_macids_supported;
-@@ -383,6 +383,11 @@ static const struct ieee80211_channel mw
- 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5200, .hw_value = 40, },
- 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5220, .hw_value = 44, },
- 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5240, .hw_value = 48, },
-+	{ .band = NL80211_BAND_5GHZ, .center_freq = 5745, .hw_value = 149, },
-+	{ .band = NL80211_BAND_5GHZ, .center_freq = 5765, .hw_value = 153, },
-+	{ .band = NL80211_BAND_5GHZ, .center_freq = 5785, .hw_value = 157, },
-+	{ .band = NL80211_BAND_5GHZ, .center_freq = 5805, .hw_value = 161, },
-+	{ .band = NL80211_BAND_5GHZ, .center_freq = 5825, .hw_value = 165, },
- };
- 
- static const struct ieee80211_rate mwl8k_rates_50[] = {
diff --git a/package/kernel/mac80211/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch b/package/kernel/mac80211/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch
deleted file mode 100644
index 914472aab..000000000
--- a/package/kernel/mac80211/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/drivers/net/wireless/ath/ath10k/htt.h
-+++ b/drivers/net/wireless/ath/ath10k/htt.h
-@@ -200,7 +200,7 @@ enum htt_rx_ring_flags {
- };
- 
- #define HTT_RX_RING_SIZE_MIN 128
--#define HTT_RX_RING_SIZE_MAX 2048
-+#define HTT_RX_RING_SIZE_MAX 512
- 
- struct htt_rx_ring_setup_ring {
- 	__le32 fw_idx_shadow_reg_paddr;
diff --git a/package/kernel/mac80211/patches/970-rsi-fix-kbuild-reported-build-errors-with-CONFIG_PM-off b/package/kernel/mac80211/patches/970-rsi-fix-kbuild-reported-build-errors-with-CONFIG_PM-off
deleted file mode 100644
index 3b139ee32..000000000
--- a/package/kernel/mac80211/patches/970-rsi-fix-kbuild-reported-build-errors-with-CONFIG_PM-off
+++ /dev/null
@@ -1,93 +0,0 @@
-From e6b3b2ed3d270b3c7080c9cf7d28636dc74b0387 Mon Sep 17 00:00:00 2001
-From: Amitkumar Karwar <amit.karwar@redpinesignals.com>
-Date: Wed, 1 Nov 2017 17:42:45 +0530
-Subject: rsi: fix kbuild reported build errors with CONFIG_PM off
-
-Some wowlan related code was outside CONFIG_PM flag which caused these
-build errors. They are fixed by moving that code under CONFIG_PM flag.
-
-Reported-by: kbuild test robot <fengguang.wu@intel.com>
-Fixes: ef71ed0608c ("rsi: sdio: Add WOWLAN support for S5 shutdown state")
-Fixes: a24e35fcee0 ("rsi: sdio: Add WOWLAN support for S4 hibernate state")
-Fixes: e1ced6422a3 ("rsi: sdio: add WOWLAN support for S3 suspend state")
-Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/rsi/rsi_91x_mac80211.c | 5 ++++-
- drivers/net/wireless/rsi/rsi_91x_mgmt.c     | 2 ++
- drivers/net/wireless/rsi/rsi_common.h       | 2 ++
- drivers/net/wireless/rsi/rsi_mgmt.h         | 2 ++
- 4 files changed, 10 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
-+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
-@@ -1752,6 +1752,7 @@ static int rsi_mac80211_cancel_roc(struc
- 	return 0;
- }
- 
-+#ifdef CONFIG_PM
- static const struct wiphy_wowlan_support rsi_wowlan_support = {
- 	.flags = WIPHY_WOWLAN_ANY |
- 		 WIPHY_WOWLAN_MAGIC_PKT |
-@@ -1824,7 +1825,6 @@ int rsi_config_wowlan(struct rsi_hw *ada
- }
- EXPORT_SYMBOL(rsi_config_wowlan);
- 
--#ifdef CONFIG_PM
- static int rsi_mac80211_suspend(struct ieee80211_hw *hw,
- 				struct cfg80211_wowlan *wowlan)
- {
-@@ -1977,7 +1977,10 @@ int rsi_mac80211_attach(struct rsi_commo
- 	wiphy->features |= NL80211_FEATURE_INACTIVITY_TIMER;
- 	wiphy->reg_notifier = rsi_reg_notify;
- 
-+#ifdef CONFIG_PM
- 	wiphy->wowlan = &rsi_wowlan_support;
-+#endif
-+
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
- 
- 	/* Wi-Fi direct parameters */
---- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
-+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
-@@ -1597,6 +1597,7 @@ static int rsi_send_beacon(struct rsi_co
- 	return 0;
- }
- 
-+#ifdef CONFIG_PM
- int rsi_send_wowlan_request(struct rsi_common *common, u16 flags,
- 			    u16 sleep_status)
- {
-@@ -1630,6 +1631,7 @@ int rsi_send_wowlan_request(struct rsi_c
- 
- 	return rsi_send_internal_mgmt_frame(common, skb);
- }
-+#endif
- 
- /**
-  * rsi_handle_ta_confirm_type() - This function handles the confirm frames.
---- a/drivers/net/wireless/rsi/rsi_common.h
-+++ b/drivers/net/wireless/rsi/rsi_common.h
-@@ -83,7 +83,9 @@ u16 rsi_get_connected_channel(struct iee
- struct rsi_hw *rsi_91x_init(void);
- void rsi_91x_deinit(struct rsi_hw *adapter);
- int rsi_read_pkt(struct rsi_common *common, s32 rcv_pkt_len);
-+#ifdef CONFIG_PM
- int rsi_config_wowlan(struct rsi_hw *adapter, struct cfg80211_wowlan *wowlan);
-+#endif
- struct rsi_sta *rsi_find_sta(struct rsi_common *common, u8 *mac_addr);
- struct ieee80211_vif *rsi_get_vif(struct rsi_hw *adapter, u8 *mac);
- void rsi_roc_timeout(struct timer_list *t);
---- a/drivers/net/wireless/rsi/rsi_mgmt.h
-+++ b/drivers/net/wireless/rsi/rsi_mgmt.h
-@@ -668,8 +668,10 @@ int rsi_band_check(struct rsi_common *co
- int rsi_send_rx_filter_frame(struct rsi_common *common, u16 rx_filter_word);
- int rsi_send_radio_params_update(struct rsi_common *common);
- int rsi_set_antenna(struct rsi_common *common, u8 antenna);
-+#ifdef CONFIG_PM
- int rsi_send_wowlan_request(struct rsi_common *common, u16 flags,
- 			    u16 sleep_status);
-+#endif
- int rsi_send_ps_request(struct rsi_hw *adapter, bool enable,
- 			struct ieee80211_vif *vif);
- #endif
diff --git a/package/kernel/mac80211/patches/971-rsi-move-rsi_sdio_reinit_device-out-of-CONFIG_PM.patch b/package/kernel/mac80211/patches/971-rsi-move-rsi_sdio_reinit_device-out-of-CONFIG_PM.patch
deleted file mode 100644
index 499b4ee7f..000000000
--- a/package/kernel/mac80211/patches/971-rsi-move-rsi_sdio_reinit_device-out-of-CONFIG_PM.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From 39f1332c526cd9d6de59a72520e8334e54b62cda Mon Sep 17 00:00:00 2001
-From: Amitkumar Karwar <amit.karwar@redpinesignals.com>
-Date: Wed, 1 Nov 2017 17:42:44 +0530
-Subject: rsi: move rsi_sdio_reinit_device() out of CONFIG_PM
-
-This function is generic. It doesn't contain wowlan specific code.
-It should not be under CONFIG_PM. This patch resolves compilation
-errors observed when CONFIG_PM flag is disabled.
-
-Reported-by: kbuild test robot <fengguang.wu@intel.com>
-Fixes: ef71ed0608c ("rsi: sdio: Add WOWLAN support for S5 shutdown state")
-Fixes: a24e35fcee0 ("rsi: sdio: Add WOWLAN support for S4 hibernate state")
-Fixes: e1ced6422a3 ("rsi: sdio: add WOWLAN support for S3 suspend state")
-Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/rsi/rsi_91x_sdio.c | 52 ++++++++++++++++-----------------
- drivers/net/wireless/rsi/rsi_sdio.h     |  1 -
- 2 files changed, 26 insertions(+), 27 deletions(-)
-
---- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
-+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
-@@ -871,6 +871,32 @@ fail:
- 	return status;
- }
- 
-+static int rsi_sdio_reinit_device(struct rsi_hw *adapter)
-+{
-+	struct rsi_91x_sdiodev *sdev = adapter->rsi_dev;
-+	struct sdio_func *pfunction = sdev->pfunction;
-+	int ii;
-+
-+	for (ii = 0; ii < NUM_SOFT_QUEUES; ii++)
-+		skb_queue_purge(&adapter->priv->tx_queue[ii]);
-+
-+	/* Initialize device again */
-+	sdio_claim_host(pfunction);
-+
-+	sdio_release_irq(pfunction);
-+	rsi_reset_card(pfunction);
-+
-+	sdio_enable_func(pfunction);
-+	rsi_setupcard(adapter);
-+	rsi_init_sdio_slave_regs(adapter);
-+	sdio_claim_irq(pfunction, rsi_handle_interrupt);
-+	rsi_hal_device_init(adapter);
-+
-+	sdio_release_host(pfunction);
-+
-+	return 0;
-+}
-+
- static struct rsi_host_intf_ops sdio_host_intf_ops = {
- 	.write_pkt		= rsi_sdio_host_intf_write_pkt,
- 	.read_pkt		= rsi_sdio_host_intf_read_pkt,
-@@ -1281,32 +1307,6 @@ static void rsi_shutdown(struct device *
- 	rsi_dbg(INFO_ZONE, "***** RSI module shut down *****\n");
- }
- 
--int rsi_sdio_reinit_device(struct rsi_hw *adapter)
--{
--	struct rsi_91x_sdiodev *sdev = adapter->rsi_dev;
--	struct sdio_func *pfunction = sdev->pfunction;
--	int ii;
--
--	for (ii = 0; ii < NUM_SOFT_QUEUES; ii++)
--		skb_queue_purge(&adapter->priv->tx_queue[ii]);
--
--	/* Initialize device again */
--	sdio_claim_host(pfunction);
--
--	sdio_release_irq(pfunction);
--	rsi_reset_card(pfunction);
--
--	sdio_enable_func(pfunction);
--	rsi_setupcard(adapter);
--	rsi_init_sdio_slave_regs(adapter);
--	sdio_claim_irq(pfunction, rsi_handle_interrupt);
--	rsi_hal_device_init(adapter);
--
--	sdio_release_host(pfunction);
--
--	return 0;
--}
--
- static int rsi_restore(struct device *dev)
- {
- 	struct sdio_func *pfunction = dev_to_sdio_func(dev);
---- a/drivers/net/wireless/rsi/rsi_sdio.h
-+++ b/drivers/net/wireless/rsi/rsi_sdio.h
-@@ -131,5 +131,4 @@ int rsi_sdio_master_access_msword(struct
- void rsi_sdio_ack_intr(struct rsi_hw *adapter, u8 int_bit);
- int rsi_sdio_determine_event_timeout(struct rsi_hw *adapter);
- int rsi_sdio_check_buffer_status(struct rsi_hw *adapter, u8 q_num);
--int rsi_sdio_reinit_device(struct rsi_hw *adapter);
- #endif
diff --git a/package/kernel/mac80211/patches/070-ath_common_config.patch b/package/kernel/mac80211/patches/ath/070-ath_common_config.patch
similarity index 100%
rename from package/kernel/mac80211/patches/070-ath_common_config.patch
rename to package/kernel/mac80211/patches/ath/070-ath_common_config.patch
diff --git a/package/kernel/mac80211/patches/080-ath10k_thermal_config.patch b/package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch
similarity index 85%
rename from package/kernel/mac80211/patches/080-ath10k_thermal_config.patch
rename to package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch
index adcd788bd..a04abb2d2 100644
--- a/package/kernel/mac80211/patches/080-ath10k_thermal_config.patch
+++ b/package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/Kconfig
 +++ b/drivers/net/wireless/ath/ath10k/Kconfig
-@@ -65,6 +65,12 @@ config ATH10K_TRACING
+@@ -85,6 +85,12 @@ config ATH10K_TRACING
  	---help---
  	  Select this to ath10k use tracing infrastructure.
  
@@ -15,15 +15,15 @@
  	depends on ATH10K && CFG80211_CERTIFICATION_ONUS
 --- a/drivers/net/wireless/ath/ath10k/Makefile
 +++ b/drivers/net/wireless/ath/ath10k/Makefile
-@@ -17,7 +17,7 @@ ath10k_core-y += mac.o \
- ath10k_core-$(CPTCFG_ATH10K_DEBUGFS) += spectral.o
+@@ -18,7 +18,7 @@ ath10k_core-y += mac.o \
+ ath10k_core-$(CPTCFG_ATH10K_SPECTRAL) += spectral.o
  ath10k_core-$(CPTCFG_NL80211_TESTMODE) += testmode.o
  ath10k_core-$(CPTCFG_ATH10K_TRACING) += trace.o
 -ath10k_core-$(CONFIG_THERMAL) += thermal.o
 +ath10k_core-$(CPTCFG_ATH10K_THERMAL) += thermal.o
  ath10k_core-$(CPTCFG_MAC80211_DEBUGFS) += debugfs_sta.o
  ath10k_core-$(CONFIG_PM) += wow.o
- 
+ ath10k_core-$(CONFIG_DEV_COREDUMP) += coredump.o
 --- a/drivers/net/wireless/ath/ath10k/thermal.h
 +++ b/drivers/net/wireless/ath/ath10k/thermal.h
 @@ -36,7 +36,7 @@ struct ath10k_thermal {
@@ -37,10 +37,10 @@
  void ath10k_thermal_event_temperature(struct ath10k *ar, int temperature);
 --- a/local-symbols
 +++ b/local-symbols
-@@ -139,6 +139,7 @@ ATH10K_SDIO=
- ATH10K_USB=
+@@ -140,6 +140,7 @@ ATH10K_SNOC=
  ATH10K_DEBUG=
  ATH10K_DEBUGFS=
+ ATH10K_SPECTRAL=
 +ATH10K_THERMAL=
  ATH10K_TRACING=
  ATH10K_DFS_CERTIFIED=
diff --git a/package/kernel/mac80211/patches/201-ath5k-WAR-for-AR71xx-PCI-bug.patch b/package/kernel/mac80211/patches/ath/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
similarity index 100%
rename from package/kernel/mac80211/patches/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
rename to package/kernel/mac80211/patches/ath/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
diff --git a/package/kernel/mac80211/patches/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch b/package/kernel/mac80211/patches/ath/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
similarity index 89%
rename from package/kernel/mac80211/patches/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
rename to package/kernel/mac80211/patches/ath/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
index a7bcfa549..cadbf6809 100644
--- a/package/kernel/mac80211/patches/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
+++ b/package/kernel/mac80211/patches/ath/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
@@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1394,8 +1394,12 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1421,8 +1421,12 @@ static bool ath9k_hw_set_reset(struct at
  	if (!AR_SREV_9100(ah))
  		REG_WRITE(ah, AR_RC, 0);
  
diff --git a/package/kernel/mac80211/patches/351-ath9k_hw-issue-external-reset-for-QCA955x.patch b/package/kernel/mac80211/patches/ath/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
similarity index 95%
rename from package/kernel/mac80211/patches/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
rename to package/kernel/mac80211/patches/ath/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
index 5eb69b898..ac9e112f5 100644
--- a/package/kernel/mac80211/patches/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
+++ b/package/kernel/mac80211/patches/ath/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1271,39 +1271,56 @@ void ath9k_hw_get_delta_slope_vals(struc
+@@ -1298,39 +1298,56 @@ void ath9k_hw_get_delta_slope_vals(struc
  	*coef_exponent = coef_exp - 16;
  }
  
@@ -94,7 +94,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	return true;
  }
  
-@@ -1356,24 +1373,24 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1383,24 +1400,24 @@ static bool ath9k_hw_set_reset(struct at
  			rst_flags |= AR_RTC_RC_MAC_COLD;
  	}
  
diff --git a/package/kernel/mac80211/patches/354-ath9k-force-rx_clear-when-disabling-rx.patch b/package/kernel/mac80211/patches/ath/354-ath9k-force-rx_clear-when-disabling-rx.patch
similarity index 100%
rename from package/kernel/mac80211/patches/354-ath9k-force-rx_clear-when-disabling-rx.patch
rename to package/kernel/mac80211/patches/ath/354-ath9k-force-rx_clear-when-disabling-rx.patch
diff --git a/package/kernel/mac80211/patches/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch b/package/kernel/mac80211/patches/ath/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
similarity index 82%
rename from package/kernel/mac80211/patches/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
rename to package/kernel/mac80211/patches/ath/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
index 35d07430e..3adcb8b79 100644
--- a/package/kernel/mac80211/patches/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
+++ b/package/kernel/mac80211/patches/ath/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
@@ -8,17 +8,17 @@ This reverts commit 71f5137bf010c6faffab50c0ec15374c59c4a411.
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2935,7 +2935,8 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2962,7 +2962,8 @@ void ath9k_hw_apply_txpower(struct ath_h
  {
  	struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
  	struct ieee80211_channel *channel;
 -	int chan_pwr, new_pwr;
 +	int chan_pwr, new_pwr, max_gain;
 +	int ant_gain, ant_reduction = 0;
+ 	u16 ctl = NO_CTL;
  
  	if (!chan)
- 		return;
-@@ -2943,10 +2944,15 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2974,9 +2975,14 @@ void ath9k_hw_apply_txpower(struct ath_h
  	channel = chan->chan;
  	chan_pwr = min_t(int, channel->max_power * 2, MAX_RATE_POWER);
  	new_pwr = min_t(int, chan_pwr, reg->power_limit);
@@ -28,8 +28,7 @@ This reverts commit 71f5137bf010c6faffab50c0ec15374c59c4a411.
 +	if (ant_gain > max_gain)
 +		ant_reduction = ant_gain - max_gain;
  
- 	ah->eep_ops->set_txpower(ah, chan,
- 				 ath9k_regd_get_ctl(reg, chan),
+ 	ah->eep_ops->set_txpower(ah, chan, ctl,
 -				 get_antenna_gain(ah, chan), new_pwr, test);
 +				 ant_reduction, new_pwr, test);
  }
diff --git a/package/kernel/mac80211/patches/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch b/package/kernel/mac80211/patches/ath/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
similarity index 81%
rename from package/kernel/mac80211/patches/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
rename to package/kernel/mac80211/patches/ath/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
index 78083517b..cbc2f5ad9 100644
--- a/package/kernel/mac80211/patches/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
+++ b/package/kernel/mac80211/patches/ath/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
@@ -11,7 +11,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2954,6 +2954,10 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2981,6 +2981,10 @@ void ath9k_hw_apply_txpower(struct ath_h
  	if (ant_gain > max_gain)
  		ant_reduction = ant_gain - max_gain;
  
@@ -19,6 +19,6 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +	if (reg->region == NL80211_DFS_FCC)
 +		ant_reduction = max_t(int, ant_reduction - 6, 0);
 +
- 	ah->eep_ops->set_txpower(ah, chan, ctl, ant_reduction, new_pwr, test);
+ 	ah->eep_ops->set_txpower(ah, chan, ctl,
+ 				 ant_reduction, new_pwr, test);
  }
- 
diff --git a/package/kernel/mac80211/patches/381-ath9k-fix-tx99-with-monitor-mode-interface.patch b/package/kernel/mac80211/patches/ath/381-ath9k-fix-tx99-with-monitor-mode-interface.patch
similarity index 100%
rename from package/kernel/mac80211/patches/381-ath9k-fix-tx99-with-monitor-mode-interface.patch
rename to package/kernel/mac80211/patches/ath/381-ath9k-fix-tx99-with-monitor-mode-interface.patch
diff --git a/package/kernel/mac80211/patches/ath/395-ath9k-add-back-support-for-using-active-monitor-inte.patch b/package/kernel/mac80211/patches/ath/395-ath9k-add-back-support-for-using-active-monitor-inte.patch
new file mode 100644
index 000000000..abd0fdc21
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath/395-ath9k-add-back-support-for-using-active-monitor-inte.patch
@@ -0,0 +1,96 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 22 Sep 2018 15:20:50 +0200
+Subject: [PATCH] ath9k: add back support for using active monitor interfaces
+ for tx99
+
+Various documented examples on how to set up tx99 with ath9k rely
+on setting up a regular monitor interface for setting the channel.
+My previous patch "ath9k: fix tx99 with monitor mode interface" made
+it possible to set it up this way again. However, it was removing support
+for using an active monitor interface, which is required for controlling
+the bitrate as well, since the bitrate is not passed down with a regular
+monitor interface.
+
+This patch partially reverts the previous one, but keeps support for using
+a regular monitor interface to keep documented steps working in cases
+where the bitrate does not matter
+
+Fixes: d9c52fd17cb48 ("ath9k: fix tx99 with monitor mode interface")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -1074,6 +1074,7 @@ struct ath_softc {
+ 
+ 	struct ath_spec_scan_priv spec_priv;
+ 
++	struct ieee80211_vif *tx99_vif;
+ 	struct sk_buff *tx99_skb;
+ 	bool tx99_state;
+ 	s16 tx99_power;
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1251,8 +1251,13 @@ static int ath9k_add_interface(struct ie
+ 	struct ath_vif *avp = (void *)vif->drv_priv;
+ 	struct ath_node *an = &avp->mcast_node;
+ 
+-	if (IS_ENABLED(CPTCFG_ATH9K_TX99))
+-		return -EOPNOTSUPP;
++	if (IS_ENABLED(CPTCFG_ATH9K_TX99)) {
++		if (sc->cur_chan->nvifs >= 1) {
++			mutex_unlock(&sc->mutex);
++			return -EOPNOTSUPP;
++		}
++		sc->tx99_vif = vif;
++	}
+ 
+ 	mutex_lock(&sc->mutex);
+ 
+@@ -1337,6 +1342,7 @@ static void ath9k_remove_interface(struc
+ 	ath9k_p2p_remove_vif(sc, vif);
+ 
+ 	sc->cur_chan->nvifs--;
++	sc->tx99_vif = NULL;
+ 	if (!ath9k_is_chanctx_enabled())
+ 		list_del(&avp->list);
+ 
+--- a/drivers/net/wireless/ath/ath9k/tx99.c
++++ b/drivers/net/wireless/ath/ath9k/tx99.c
+@@ -54,6 +54,7 @@ static struct sk_buff *ath9k_build_tx99_
+ 	struct ieee80211_hdr *hdr;
+ 	struct ieee80211_tx_info *tx_info;
+ 	struct sk_buff *skb;
++	struct ath_vif *avp;
+ 
+ 	skb = alloc_skb(len, GFP_KERNEL);
+ 	if (!skb)
+@@ -71,11 +72,17 @@ static struct sk_buff *ath9k_build_tx99_
+ 	memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN);
+ 	memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
+ 
++	if (sc->tx99_vif) {
++		avp = (struct ath_vif *) sc->tx99_vif->drv_priv;
++		hdr->seq_ctrl |= cpu_to_le16(avp->seq_no);
++	}
++
+ 	tx_info = IEEE80211_SKB_CB(skb);
+ 	memset(tx_info, 0, sizeof(*tx_info));
+ 	rate = &tx_info->control.rates[0];
+ 	tx_info->band = sc->cur_chan->chandef.chan->band;
+ 	tx_info->flags = IEEE80211_TX_CTL_NO_ACK;
++	tx_info->control.vif = sc->tx99_vif;
+ 	rate->count = 1;
+ 	if (ah->curchan && IS_CHAN_HT(ah->curchan)) {
+ 		rate->flags |= IEEE80211_TX_RC_MCS;
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2973,7 +2973,7 @@ int ath9k_tx99_send(struct ath_softc *sc
+ 		return -EINVAL;
+ 	}
+ 
+-	ath_set_rates(NULL, NULL, bf);
++	ath_set_rates(sc->tx99_vif, NULL, bf);
+ 
+ 	ath9k_hw_set_desc_link(sc->sc_ah, bf->bf_desc, bf->bf_daddr);
+ 	ath9k_hw_tx99_start(sc->sc_ah, txctl->txq->axq_qnum);
diff --git a/package/kernel/mac80211/patches/400-ath_move_debug_code.patch b/package/kernel/mac80211/patches/ath/400-ath_move_debug_code.patch
similarity index 88%
rename from package/kernel/mac80211/patches/400-ath_move_debug_code.patch
rename to package/kernel/mac80211/patches/ath/400-ath_move_debug_code.patch
index ed65053d7..e7df0e14b 100644
--- a/package/kernel/mac80211/patches/400-ath_move_debug_code.patch
+++ b/package/kernel/mac80211/patches/ath/400-ath_move_debug_code.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/Makefile
 +++ b/drivers/net/wireless/ath/Makefile
-@@ -13,10 +13,10 @@ ath-objs :=	main.o \
+@@ -14,10 +14,10 @@ ath-objs :=	main.o \
  		regd.o \
  		hw.o \
  		key.o \
@@ -14,7 +14,7 @@
  CFLAGS_trace.o := -I$(src)
 --- a/drivers/net/wireless/ath/ath.h
 +++ b/drivers/net/wireless/ath/ath.h
-@@ -318,14 +318,7 @@ void _ath_dbg(struct ath_common *common,
+@@ -316,14 +316,7 @@ void _ath_dbg(struct ath_common *common,
  #endif /* CPTCFG_ATH_DEBUG */
  
  /** Returns string describing opmode, or NULL if unknown mode. */
diff --git a/package/kernel/mac80211/patches/401-ath9k_blink_default.patch b/package/kernel/mac80211/patches/ath/401-ath9k_blink_default.patch
similarity index 88%
rename from package/kernel/mac80211/patches/401-ath9k_blink_default.patch
rename to package/kernel/mac80211/patches/ath/401-ath9k_blink_default.patch
index 7405e594f..3eb57bb1c 100644
--- a/package/kernel/mac80211/patches/401-ath9k_blink_default.patch
+++ b/package/kernel/mac80211/patches/ath/401-ath9k_blink_default.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -47,7 +47,7 @@ int ath9k_modparam_nohwcrypt;
+@@ -48,7 +48,7 @@ int ath9k_modparam_nohwcrypt;
  module_param_named(nohwcrypt, ath9k_modparam_nohwcrypt, int, 0444);
  MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption");
  
diff --git a/package/kernel/mac80211/patches/402-ath_regd_optional.patch b/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
similarity index 98%
rename from package/kernel/mac80211/patches/402-ath_regd_optional.patch
rename to package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
index 8fa56f40a..26fcd5614 100644
--- a/package/kernel/mac80211/patches/402-ath_regd_optional.patch
+++ b/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
@@ -82,7 +82,7 @@
  	---help---
 --- a/local-symbols
 +++ b/local-symbols
-@@ -87,6 +87,7 @@ ADM8211=
+@@ -84,6 +84,7 @@ ADM8211=
  ATH_COMMON=
  WLAN_VENDOR_ATH=
  ATH_DEBUG=
diff --git a/package/kernel/mac80211/patches/403-world_regd_fixup.patch b/package/kernel/mac80211/patches/ath/403-world_regd_fixup.patch
similarity index 100%
rename from package/kernel/mac80211/patches/403-world_regd_fixup.patch
rename to package/kernel/mac80211/patches/ath/403-world_regd_fixup.patch
diff --git a/package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch b/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
similarity index 76%
rename from package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch
rename to package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
index 00be2ef98..6e4794a76 100644
--- a/package/kernel/mac80211/patches/404-regd_no_assoc_hints.patch
+++ b/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
@@ -1,6 +1,6 @@
 --- a/net/wireless/reg.c
 +++ b/net/wireless/reg.c
-@@ -2860,6 +2860,8 @@ void regulatory_hint_country_ie(struct w
+@@ -2980,6 +2980,8 @@ void regulatory_hint_country_ie(struct w
  	enum environment_cap env = ENVIRON_ANY;
  	struct regulatory_request *request = NULL, *lr;
  
@@ -9,7 +9,7 @@
  	/* IE len must be evenly divisible by 2 */
  	if (country_ie_len & 0x01)
  		return;
-@@ -3066,6 +3068,7 @@ static void restore_regulatory_settings(
+@@ -3186,6 +3188,7 @@ static void restore_regulatory_settings(
  
  void regulatory_hint_disconnect(void)
  {
diff --git a/package/kernel/mac80211/patches/405-ath_regd_us.patch b/package/kernel/mac80211/patches/ath/405-ath_regd_us.patch
similarity index 83%
rename from package/kernel/mac80211/patches/405-ath_regd_us.patch
rename to package/kernel/mac80211/patches/ath/405-ath_regd_us.patch
index cc5587780..8cb7f00ff 100644
--- a/package/kernel/mac80211/patches/405-ath_regd_us.patch
+++ b/package/kernel/mac80211/patches/ath/405-ath_regd_us.patch
@@ -8,15 +8,15 @@
  	FRANCE_RES = 0x31,
  	FCC3_FCCA = 0x3A,
  	FCC3_WORLD = 0x3B,
-@@ -167,6 +168,7 @@ static struct reg_dmn_pair_mapping regDo
+@@ -172,6 +173,7 @@ static struct reg_dmn_pair_mapping regDo
  	{FCC2_WORLD, CTL_FCC, CTL_ETSI},
  	{FCC2_ETSIC, CTL_FCC, CTL_ETSI},
  	{FCC3_FCCA, CTL_FCC, CTL_FCC},
 +	{FCC3_FCCA_2, CTL_FCC, CTL_FCC},
  	{FCC3_WORLD, CTL_FCC, CTL_ETSI},
+ 	{FCC3_ETSIC, CTL_FCC, CTL_ETSI},
  	{FCC4_FCCA, CTL_FCC, CTL_FCC},
- 	{FCC5_FCCA, CTL_FCC, CTL_FCC},
-@@ -463,6 +465,7 @@ static struct country_code_to_enum_rd al
+@@ -483,6 +485,7 @@ static struct country_code_to_enum_rd al
  	{CTRY_UAE, NULL1_WORLD, "AE"},
  	{CTRY_UNITED_KINGDOM, ETSI1_WORLD, "GB"},
  	{CTRY_UNITED_STATES, FCC3_FCCA, "US"},
diff --git a/package/kernel/mac80211/patches/406-ath_relax_default_regd.patch b/package/kernel/mac80211/patches/ath/406-ath_relax_default_regd.patch
similarity index 100%
rename from package/kernel/mac80211/patches/406-ath_relax_default_regd.patch
rename to package/kernel/mac80211/patches/ath/406-ath_relax_default_regd.patch
diff --git a/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/ath/410-ath9k_allow_adhoc_and_ap.patch
similarity index 83%
rename from package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
rename to package/kernel/mac80211/patches/ath/410-ath9k_allow_adhoc_and_ap.patch
index 86f96e8e9..25c236b12 100644
--- a/package/kernel/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
+++ b/package/kernel/mac80211/patches/ath/410-ath9k_allow_adhoc_and_ap.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -777,6 +777,7 @@ static const struct ieee80211_iface_limi
+@@ -833,6 +833,7 @@ static const struct ieee80211_iface_limi
  				 BIT(NL80211_IFTYPE_AP) },
  	{ .max = 1,	.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
  				 BIT(NL80211_IFTYPE_P2P_GO) },
diff --git a/package/kernel/mac80211/patches/411-ath5k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/ath/411-ath5k_allow_adhoc_and_ap.patch
similarity index 100%
rename from package/kernel/mac80211/patches/411-ath5k_allow_adhoc_and_ap.patch
rename to package/kernel/mac80211/patches/ath/411-ath5k_allow_adhoc_and_ap.patch
diff --git a/package/kernel/mac80211/patches/420-ath5k_disable_fast_cc.patch b/package/kernel/mac80211/patches/ath/420-ath5k_disable_fast_cc.patch
similarity index 100%
rename from package/kernel/mac80211/patches/420-ath5k_disable_fast_cc.patch
rename to package/kernel/mac80211/patches/ath/420-ath5k_disable_fast_cc.patch
diff --git a/package/kernel/mac80211/patches/430-add_ath5k_platform.patch b/package/kernel/mac80211/patches/ath/430-add_ath5k_platform.patch
similarity index 100%
rename from package/kernel/mac80211/patches/430-add_ath5k_platform.patch
rename to package/kernel/mac80211/patches/ath/430-add_ath5k_platform.patch
diff --git a/package/kernel/mac80211/patches/431-add_platform_eeprom_support_to_ath5k.patch b/package/kernel/mac80211/patches/ath/431-add_platform_eeprom_support_to_ath5k.patch
similarity index 100%
rename from package/kernel/mac80211/patches/431-add_platform_eeprom_support_to_ath5k.patch
rename to package/kernel/mac80211/patches/ath/431-add_platform_eeprom_support_to_ath5k.patch
diff --git a/package/kernel/mac80211/patches/432-ath5k_add_pciids.patch b/package/kernel/mac80211/patches/ath/432-ath5k_add_pciids.patch
similarity index 100%
rename from package/kernel/mac80211/patches/432-ath5k_add_pciids.patch
rename to package/kernel/mac80211/patches/ath/432-ath5k_add_pciids.patch
diff --git a/package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch b/package/kernel/mac80211/patches/ath/440-ath5k_channel_bw_debugfs.patch
similarity index 92%
rename from package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch
rename to package/kernel/mac80211/patches/ath/440-ath5k_channel_bw_debugfs.patch
index 3ae01a5c3..57d336327 100644
--- a/package/kernel/mac80211/patches/440-ath5k_channel_bw_debugfs.patch
+++ b/package/kernel/mac80211/patches/ath/440-ath5k_channel_bw_debugfs.patch
@@ -109,16 +109,15 @@ drivers/net/wireless/ath/ath5k/debug.c |   86 ++++++++++++++++++++++++++++++++
  
  /* debugfs: queues etc */
  
-@@ -1012,6 +1103,9 @@ ath5k_debug_init_device(struct ath5k_hw
- 	debugfs_create_file("beacon", S_IWUSR | S_IRUSR, phydir, ah,
- 			    &fops_beacon);
- 
+@@ -1016,6 +1107,8 @@ ath5k_debug_init_device(struct ath5k_hw
+ 	debugfs_create_file("queue", 0600, phydir, ah, &fops_queue);
+ 	debugfs_create_bool("32khz_clock", 0600, phydir,
+ 			    &ah->ah_use_32khz_clock);
 +	debugfs_create_file("bwmode", S_IWUSR | S_IRUSR, phydir, ah,
 +			    &fops_bwmode);
-+
- 	debugfs_create_file("reset", S_IWUSR, phydir, ah, &fops_reset);
+ }
  
- 	debugfs_create_file("antenna", S_IWUSR | S_IRUSR, phydir, ah,
+ /* functions used in other places */
 --- a/drivers/net/wireless/ath/ath5k/ath5k.h
 +++ b/drivers/net/wireless/ath/ath5k/ath5k.h
 @@ -1372,6 +1372,7 @@ struct ath5k_hw {
diff --git a/package/kernel/mac80211/patches/500-ath9k_eeprom_debugfs.patch b/package/kernel/mac80211/patches/ath/500-ath9k_eeprom_debugfs.patch
similarity index 100%
rename from package/kernel/mac80211/patches/500-ath9k_eeprom_debugfs.patch
rename to package/kernel/mac80211/patches/ath/500-ath9k_eeprom_debugfs.patch
diff --git a/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch b/package/kernel/mac80211/patches/ath/501-ath9k_ahb_init.patch
similarity index 86%
rename from package/kernel/mac80211/patches/501-ath9k_ahb_init.patch
rename to package/kernel/mac80211/patches/ath/501-ath9k_ahb_init.patch
index 53225dbc3..5fc60dd0a 100644
--- a/package/kernel/mac80211/patches/501-ath9k_ahb_init.patch
+++ b/package/kernel/mac80211/patches/ath/501-ath9k_ahb_init.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1088,23 +1088,23 @@ static int __init ath9k_init(void)
+@@ -1144,25 +1144,25 @@ static int __init ath9k_init(void)
  {
  	int error;
  
@@ -21,6 +21,8 @@
 +		goto err_ahb_exit;
  	}
  
+ 	dmi_check_system(ath9k_quirks);
+ 
  	return 0;
  
 - err_pci_exit:
diff --git a/package/kernel/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch b/package/kernel/mac80211/patches/ath/510-ath9k_intr_mitigation_tweak.patch
similarity index 87%
rename from package/kernel/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
rename to package/kernel/mac80211/patches/ath/510-ath9k_intr_mitigation_tweak.patch
index d2a3b9657..356939a35 100644
--- a/package/kernel/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
+++ b/package/kernel/mac80211/patches/ath/510-ath9k_intr_mitigation_tweak.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -390,13 +390,8 @@ static void ath9k_hw_init_config(struct
+@@ -392,13 +392,8 @@ static void ath9k_hw_init_config(struct
  
  	ah->config.rx_intr_mitigation = true;
  
diff --git a/package/kernel/mac80211/patches/511-ath9k_reduce_rxbuf.patch b/package/kernel/mac80211/patches/ath/511-ath9k_reduce_rxbuf.patch
similarity index 100%
rename from package/kernel/mac80211/patches/511-ath9k_reduce_rxbuf.patch
rename to package/kernel/mac80211/patches/ath/511-ath9k_reduce_rxbuf.patch
diff --git a/package/kernel/mac80211/patches/512-ath9k_channelbw_debugfs.patch b/package/kernel/mac80211/patches/ath/512-ath9k_channelbw_debugfs.patch
similarity index 98%
rename from package/kernel/mac80211/patches/512-ath9k_channelbw_debugfs.patch
rename to package/kernel/mac80211/patches/ath/512-ath9k_channelbw_debugfs.patch
index 2ebb73d68..2d4a5688c 100644
--- a/package/kernel/mac80211/patches/512-ath9k_channelbw_debugfs.patch
+++ b/package/kernel/mac80211/patches/ath/512-ath9k_channelbw_debugfs.patch
@@ -64,7 +64,7 @@
  	debugfs_create_devm_seqfile(sc->dev, "interrupt", sc->debug.debugfs_phy,
 --- a/drivers/net/wireless/ath/ath.h
 +++ b/drivers/net/wireless/ath/ath.h
-@@ -151,6 +151,7 @@ struct ath_common {
+@@ -149,6 +149,7 @@ struct ath_common {
  	int debug_mask;
  	enum ath_device_state state;
  	unsigned long op_flags;
diff --git a/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch b/package/kernel/mac80211/patches/ath/513-ath9k_add_pci_ids.patch
similarity index 87%
rename from package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch
rename to package/kernel/mac80211/patches/ath/513-ath9k_add_pci_ids.patch
index fdeaed05e..e536e6079 100644
--- a/package/kernel/mac80211/patches/513-ath9k_add_pci_ids.patch
+++ b/package/kernel/mac80211/patches/ath/513-ath9k_add_pci_ids.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -647,6 +647,7 @@ int ath9k_hw_init(struct ath_hw *ah)
+@@ -649,6 +649,7 @@ int ath9k_hw_init(struct ath_hw *ah)
  
  	/* These are all the AR5008/AR9001/AR9002/AR9003 hardware family of chipsets */
  	switch (ah->hw_version.devid) {
@@ -20,7 +20,7 @@
  #define AR9160_DEVID_PCI	0x0027
 --- a/drivers/net/wireless/ath/ath9k/pci.c
 +++ b/drivers/net/wireless/ath/ath9k/pci.c
-@@ -773,6 +773,7 @@ static const struct pci_device_id ath_pc
+@@ -774,6 +774,7 @@ static const struct pci_device_id ath_pc
  	  .driver_data = ATH9K_PCI_BT_ANT_DIV },
  #endif
  
diff --git a/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch b/package/kernel/mac80211/patches/ath/530-ath9k_extra_leds.patch
similarity index 99%
rename from package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
rename to package/kernel/mac80211/patches/ath/530-ath9k_extra_leds.patch
index 8ea2f79a2..c13a72cbb 100644
--- a/package/kernel/mac80211/patches/530-ath9k_extra_leds.patch
+++ b/package/kernel/mac80211/patches/ath/530-ath9k_extra_leds.patch
@@ -181,7 +181,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1000,7 +1000,7 @@ int ath9k_init_device(u16 devid, struct
+@@ -1056,7 +1056,7 @@ int ath9k_init_device(u16 devid, struct
  
  #ifdef CPTCFG_MAC80211_LEDS
  	/* must be initialized before ieee80211_register_hw */
diff --git a/package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch b/package/kernel/mac80211/patches/ath/531-ath9k_extra_platform_leds.patch
similarity index 100%
rename from package/kernel/mac80211/patches/531-ath9k_extra_platform_leds.patch
rename to package/kernel/mac80211/patches/ath/531-ath9k_extra_platform_leds.patch
diff --git a/package/kernel/mac80211/patches/540-ath9k_reduce_ani_interval.patch b/package/kernel/mac80211/patches/ath/540-ath9k_reduce_ani_interval.patch
similarity index 100%
rename from package/kernel/mac80211/patches/540-ath9k_reduce_ani_interval.patch
rename to package/kernel/mac80211/patches/ath/540-ath9k_reduce_ani_interval.patch
diff --git a/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch b/package/kernel/mac80211/patches/ath/542-ath9k_debugfs_diag.patch
similarity index 94%
rename from package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
rename to package/kernel/mac80211/patches/ath/542-ath9k_debugfs_diag.patch
index 6dd03fd28..55896c834 100644
--- a/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
+++ b/package/kernel/mac80211/patches/ath/542-ath9k_debugfs_diag.patch
@@ -75,7 +75,7 @@
  struct ath9k_hw_version {
  	u32 magic;
  	u16 devid;
-@@ -806,6 +812,8 @@ struct ath_hw {
+@@ -808,6 +814,8 @@ struct ath_hw {
  	u32 ah_flags;
  	s16 nf_override;
  
@@ -84,7 +84,7 @@
  	bool reset_power_on;
  	bool htc_reset_init;
  
-@@ -1068,6 +1076,7 @@ void ath9k_hw_check_nav(struct ath_hw *a
+@@ -1073,6 +1081,7 @@ void ath9k_hw_check_nav(struct ath_hw *a
  bool ath9k_hw_check_alive(struct ath_hw *ah);
  
  bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode);
@@ -94,7 +94,7 @@
  struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1842,6 +1842,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
+@@ -1869,6 +1869,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
  }
  EXPORT_SYMBOL(ath9k_hw_get_tsf_offset);
  
@@ -115,7 +115,7 @@
  int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
  		   struct ath9k_hw_cal_data *caldata, bool fastcc)
  {
-@@ -2050,6 +2064,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2077,6 +2091,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		ar9003_hw_disable_phy_restart(ah);
  
  	ath9k_hw_apply_gpio_override(ah);
diff --git a/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch b/package/kernel/mac80211/patches/ath/543-ath9k_entropy_from_adc.patch
similarity index 94%
rename from package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
rename to package/kernel/mac80211/patches/ath/543-ath9k_entropy_from_adc.patch
index f9d3251c2..b0a027564 100644
--- a/package/kernel/mac80211/patches/543-ath9k_entropy_from_adc.patch
+++ b/package/kernel/mac80211/patches/ath/543-ath9k_entropy_from_adc.patch
@@ -55,7 +55,7 @@
  	ops->spectral_scan_config = ar9003_hw_spectral_scan_config;
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -765,7 +765,8 @@ static void ath9k_init_txpower_limits(st
+@@ -821,7 +821,8 @@ static void ath9k_init_txpower_limits(st
  	if (ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
  		ath9k_init_band_txpower(sc, NL80211_BAND_5GHZ);
  
@@ -65,7 +65,7 @@
  }
  
  static const struct ieee80211_iface_limit if_limits[] = {
-@@ -960,6 +961,18 @@ static void ath9k_set_hw_capab(struct at
+@@ -1016,6 +1017,18 @@ static void ath9k_set_hw_capab(struct at
  	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
  }
  
@@ -84,7 +84,7 @@
  int ath9k_init_device(u16 devid, struct ath_softc *sc,
  		    const struct ath_bus_ops *bus_ops)
  {
-@@ -1005,6 +1018,8 @@ int ath9k_init_device(u16 devid, struct
+@@ -1061,6 +1074,8 @@ int ath9k_init_device(u16 devid, struct
  		ARRAY_SIZE(ath9k_tpt_blink));
  #endif
  
@@ -110,7 +110,7 @@
  static inline void ath9k_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-@@ -1322,9 +1322,30 @@ void ar5008_hw_init_rate_txpower(struct
+@@ -1324,9 +1324,30 @@ void ar5008_hw_init_rate_txpower(struct
  	}
  }
  
@@ -141,7 +141,7 @@
  	static const u32 ar5416_cca_regs[6] = {
  		AR_PHY_CCA,
  		AR_PHY_CH1_CCA,
-@@ -1339,6 +1360,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
+@@ -1341,6 +1362,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
  	if (ret)
  	    return ret;
  
diff --git a/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch b/package/kernel/mac80211/patches/ath/544-ath9k-ar933x-usb-hang-workaround.patch
similarity index 84%
rename from package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
rename to package/kernel/mac80211/patches/ath/544-ath9k-ar933x-usb-hang-workaround.patch
index 680bb6d59..ba8f1e5d6 100644
--- a/package/kernel/mac80211/patches/544-ath9k-ar933x-usb-hang-workaround.patch
+++ b/package/kernel/mac80211/patches/ath/544-ath9k-ar933x-usb-hang-workaround.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -246,6 +246,19 @@ void ath9k_hw_get_channel_centers(struct
+@@ -248,6 +248,19 @@ void ath9k_hw_get_channel_centers(struct
  		centers->synth_center + (extoff * HT40_CHANNEL_CENTER_SHIFT);
  }
  
@@ -20,7 +20,7 @@
  /******************/
  /* Chip Revisions */
  /******************/
-@@ -1414,6 +1427,9 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1441,6 +1454,9 @@ static bool ath9k_hw_set_reset(struct at
  		udelay(50);
  	}
  
@@ -30,7 +30,7 @@
  	return true;
  }
  
-@@ -1513,6 +1529,9 @@ static bool ath9k_hw_chip_reset(struct a
+@@ -1540,6 +1556,9 @@ static bool ath9k_hw_chip_reset(struct a
  		ar9003_hw_internal_regulator_apply(ah);
  	ath9k_hw_init_pll(ah, chan);
  
@@ -40,7 +40,7 @@
  	return true;
  }
  
-@@ -1820,8 +1839,14 @@ static int ath9k_hw_do_fastcc(struct ath
+@@ -1847,8 +1866,14 @@ static int ath9k_hw_do_fastcc(struct ath
  	if (AR_SREV_9271(ah))
  		ar9002_hw_load_ani_reg(ah, chan);
  
@@ -55,7 +55,7 @@
  	return -EINVAL;
  }
  
-@@ -2075,6 +2100,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2102,6 +2127,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		ath9k_hw_set_radar_params(ah);
  	}
  
diff --git a/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch b/package/kernel/mac80211/patches/ath/545-ath9k_ani_ws_detect.patch
similarity index 98%
rename from package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
rename to package/kernel/mac80211/patches/ath/545-ath9k_ani_ws_detect.patch
index 22a2308a0..3a3f244b9 100644
--- a/package/kernel/mac80211/patches/545-ath9k_ani_ws_detect.patch
+++ b/package/kernel/mac80211/patches/ath/545-ath9k_ani_ws_detect.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-@@ -951,55 +951,6 @@ static bool ar5008_hw_ani_control_new(st
+@@ -953,55 +953,6 @@ static bool ar5008_hw_ani_control_new(st
  		 * on == 0 means more noise imm
  		 */
  		u32 on = param ? 1 : 0;
diff --git a/package/kernel/mac80211/patches/547-ath9k_led_defstate_fix.patch b/package/kernel/mac80211/patches/ath/547-ath9k_led_defstate_fix.patch
similarity index 100%
rename from package/kernel/mac80211/patches/547-ath9k_led_defstate_fix.patch
rename to package/kernel/mac80211/patches/ath/547-ath9k_led_defstate_fix.patch
diff --git a/package/kernel/mac80211/patches/548-ath9k_enable_gpio_chip.patch b/package/kernel/mac80211/patches/ath/548-ath9k_enable_gpio_chip.patch
similarity index 93%
rename from package/kernel/mac80211/patches/548-ath9k_enable_gpio_chip.patch
rename to package/kernel/mac80211/patches/ath/548-ath9k_enable_gpio_chip.patch
index 31dac29ad..0b76d330c 100644
--- a/package/kernel/mac80211/patches/548-ath9k_enable_gpio_chip.patch
+++ b/package/kernel/mac80211/patches/ath/548-ath9k_enable_gpio_chip.patch
@@ -45,7 +45,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #ifdef CPTCFG_ATH9K_DEBUGFS
 --- a/drivers/net/wireless/ath/ath9k/gpio.c
 +++ b/drivers/net/wireless/ath/ath9k/gpio.c
-@@ -16,13 +16,135 @@
+@@ -16,13 +16,130 @@
  
  #include "ath9k.h"
  #include <linux/ath9k_platform.h>
@@ -126,11 +126,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +	gc->sc = sc;
 +	snprintf(gc->label, sizeof(gc->label), "ath9k-%s",
 +		 wiphy_name(sc->hw->wiphy));
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,5,0)
-+	gc->gchip.parent = sc->dev;
-+#else
-+	gc->gchip.dev = sc->dev;
-+#endif
++
 +	gc->gchip.label = gc->label;
 +	gc->gchip.base = -1;	/* determine base automatically */
 +	gc->gchip.ngpio = ah->caps.num_gpio_pins;
@@ -145,7 +141,6 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +		return;
 +	}
 +
-+	gc->gchip.owner = NULL;
 +	sc->gpiochip = gc;
 +}
 +
@@ -183,7 +178,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static void ath_fill_led_pin(struct ath_softc *sc)
  {
  	struct ath_hw *ah = sc->sc_ah;
-@@ -80,6 +202,12 @@ static int ath_add_led(struct ath_softc
+@@ -80,6 +197,12 @@ static int ath_add_led(struct ath_softc
  	else
  		ath9k_hw_set_gpio(sc->sc_ah, gpio->gpio, gpio->active_low);
  
@@ -196,7 +191,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	return 0;
  }
  
-@@ -136,17 +264,24 @@ void ath_deinit_leds(struct ath_softc *s
+@@ -136,17 +259,24 @@ void ath_deinit_leds(struct ath_softc *s
  
  	while (!list_empty(&sc->leds)) {
  		led = list_first_entry(&sc->leds, struct ath_led, list);
@@ -221,7 +216,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	char led_name[32];
  	const char *trigger;
  	int i;
-@@ -156,6 +291,15 @@ void ath_init_leds(struct ath_softc *sc)
+@@ -156,6 +286,15 @@ void ath_init_leds(struct ath_softc *sc)
  	if (AR_SREV_9100(sc->sc_ah))
  		return;
  
@@ -237,7 +232,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	ath_fill_led_pin(sc);
  
  	if (pdata && pdata->leds && pdata->num_leds)
-@@ -180,6 +324,7 @@ void ath_init_leds(struct ath_softc *sc)
+@@ -180,6 +319,7 @@ void ath_init_leds(struct ath_softc *sc)
  	ath_create_gpio_led(sc, sc->sc_ah->led_pin, led_name, trigger,
  			   !sc->sc_ah->config.led_active_high);
  }
diff --git a/package/kernel/mac80211/patches/549-ath9k_enable_gpio_buttons.patch b/package/kernel/mac80211/patches/ath/549-ath9k_enable_gpio_buttons.patch
similarity index 93%
rename from package/kernel/mac80211/patches/549-ath9k_enable_gpio_buttons.patch
rename to package/kernel/mac80211/patches/ath/549-ath9k_enable_gpio_buttons.patch
index e86e3e38b..e7282ab6b 100644
--- a/package/kernel/mac80211/patches/549-ath9k_enable_gpio_buttons.patch
+++ b/package/kernel/mac80211/patches/ath/549-ath9k_enable_gpio_buttons.patch
@@ -29,7 +29,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  #ifdef CPTCFG_MAC80211_LEDS
  
-@@ -129,6 +131,67 @@ static void ath9k_unregister_gpio_chip(s
+@@ -124,6 +126,67 @@ static void ath9k_unregister_gpio_chip(s
  	sc->gpiochip = NULL;
  }
  
@@ -97,7 +97,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #else /* CONFIG_GPIOLIB */
  
  static inline void ath9k_register_gpio_chip(struct ath_softc *sc)
-@@ -139,6 +202,14 @@ static inline void ath9k_unregister_gpio
+@@ -134,6 +197,14 @@ static inline void ath9k_unregister_gpio
  {
  }
  
@@ -112,7 +112,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #endif /* CONFIG_GPIOLIB */
  
  /********************************/
-@@ -262,6 +333,7 @@ void ath_deinit_leds(struct ath_softc *s
+@@ -257,6 +328,7 @@ void ath_deinit_leds(struct ath_softc *s
  {
  	struct ath_led *led;
  
@@ -120,7 +120,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	while (!list_empty(&sc->leds)) {
  		led = list_first_entry(&sc->leds, struct ath_led, list);
  #ifdef CONFIG_GPIOLIB
-@@ -301,6 +373,7 @@ void ath_init_leds(struct ath_softc *sc)
+@@ -296,6 +368,7 @@ void ath_init_leds(struct ath_softc *sc)
  	}
  
  	ath_fill_led_pin(sc);
diff --git a/package/kernel/mac80211/patches/550-ath9k-disable-bands-via-dt.patch b/package/kernel/mac80211/patches/ath/550-ath9k-disable-bands-via-dt.patch
similarity index 88%
rename from package/kernel/mac80211/patches/550-ath9k-disable-bands-via-dt.patch
rename to package/kernel/mac80211/patches/ath/550-ath9k-disable-bands-via-dt.patch
index 55f040f17..7d3a334c4 100644
--- a/package/kernel/mac80211/patches/550-ath9k-disable-bands-via-dt.patch
+++ b/package/kernel/mac80211/patches/ath/550-ath9k-disable-bands-via-dt.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -571,6 +571,12 @@ static int ath9k_of_init(struct ath_soft
+@@ -627,6 +627,12 @@ static int ath9k_of_init(struct ath_soft
  
  	ath_dbg(common, CONFIG, "parsing configuration from OF node\n");
  
diff --git a/package/kernel/mac80211/patches/551-ath9k_ubnt_uap_plus_hsr.patch b/package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch
similarity index 99%
rename from package/kernel/mac80211/patches/551-ath9k_ubnt_uap_plus_hsr.patch
rename to package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch
index 82b8109e0..c24b7409b 100644
--- a/package/kernel/mac80211/patches/551-ath9k_ubnt_uap_plus_hsr.patch
+++ b/package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch
@@ -365,7 +365,7 @@
  	 * semi-random values after suspend/resume.
 --- a/drivers/net/wireless/ath/ath9k/Makefile
 +++ b/drivers/net/wireless/ath/ath9k/Makefile
-@@ -16,6 +16,7 @@ ath9k-$(CPTCFG_ATH9K_DFS_CERTIFIED) += d
+@@ -17,6 +17,7 @@ ath9k-$(CPTCFG_ATH9K_DFS_CERTIFIED) += d
  ath9k-$(CPTCFG_ATH9K_TX99) += tx99.o
  ath9k-$(CPTCFG_ATH9K_WOW) += wow.o
  ath9k-$(CPTCFG_ATH9K_HWRNG) += rng.o
@@ -386,7 +386,7 @@
  #endif /* _LINUX_ATH9K_PLATFORM_H */
 --- a/local-symbols
 +++ b/local-symbols
-@@ -114,6 +114,7 @@ ATH9K_WOW=
+@@ -111,6 +111,7 @@ ATH9K_WOW=
  ATH9K_RFKILL=
  ATH9K_CHANNEL_CONTEXT=
  ATH9K_PCOEM=
diff --git a/package/kernel/mac80211/patches/552-ahb_of.patch b/package/kernel/mac80211/patches/ath/552-ahb_of.patch
similarity index 95%
rename from package/kernel/mac80211/patches/552-ahb_of.patch
rename to package/kernel/mac80211/patches/ath/552-ahb_of.patch
index 8c20b00dd..08735d287 100644
--- a/package/kernel/mac80211/patches/552-ahb_of.patch
+++ b/package/kernel/mac80211/patches/ath/552-ahb_of.patch
@@ -1,9 +1,9 @@
 --- a/drivers/net/wireless/ath/ath9k/ahb.c
 +++ b/drivers/net/wireless/ath/ath9k/ahb.c
-@@ -19,7 +19,15 @@
- #include <linux/nl80211.h>
+@@ -20,7 +20,15 @@
  #include <linux/platform_device.h>
  #include <linux/module.h>
+ #include <linux/mod_devicetable.h>
 +#include <linux/of_device.h>
  #include "ath9k.h"
 +#include <linux/ath9k_platform.h>
@@ -16,7 +16,7 @@
  
  static const struct platform_device_id ath9k_platform_id_table[] = {
  	{
-@@ -68,6 +76,235 @@ static const struct ath_bus_ops ath_ahb_
+@@ -69,6 +77,235 @@ static const struct ath_bus_ops ath_ahb_
  	.eeprom_read = ath_ahb_eeprom_read,
  };
  
@@ -252,7 +252,7 @@
  static int ath_ahb_probe(struct platform_device *pdev)
  {
  	void __iomem *mem;
-@@ -79,6 +316,17 @@ static int ath_ahb_probe(struct platform
+@@ -80,6 +317,17 @@ static int ath_ahb_probe(struct platform
  	int ret = 0;
  	struct ath_hw *ah;
  	char hw_name[64];
@@ -270,7 +270,7 @@
  
  	if (!dev_get_platdata(&pdev->dev)) {
  		dev_err(&pdev->dev, "no platform data specified\n");
-@@ -121,13 +369,16 @@ static int ath_ahb_probe(struct platform
+@@ -122,13 +370,16 @@ static int ath_ahb_probe(struct platform
  	sc->mem = mem;
  	sc->irq = irq;
  
@@ -288,7 +288,7 @@
  	if (ret) {
  		dev_err(&pdev->dev, "failed to initialize device\n");
  		goto err_irq;
-@@ -158,6 +409,9 @@ static int ath_ahb_remove(struct platfor
+@@ -159,6 +410,9 @@ static int ath_ahb_remove(struct platfor
  		free_irq(sc->irq, sc);
  		ieee80211_free_hw(sc->hw);
  	}
@@ -298,7 +298,7 @@
  
  	return 0;
  }
-@@ -167,6 +421,9 @@ static struct platform_driver ath_ahb_dr
+@@ -168,6 +422,9 @@ static struct platform_driver ath_ahb_dr
  	.remove     = ath_ahb_remove,
  	.driver		= {
  		.name	= "ath9k",
diff --git a/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch
similarity index 94%
rename from package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
rename to package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch
index fbf33a213..16f252fdc 100644
--- a/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch
@@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
 
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -2507,6 +2507,16 @@ int ath10k_core_register(struct ath10k *
+@@ -2719,6 +2719,16 @@ int ath10k_core_register(struct ath10k *
  	ar->chip_id = chip_id;
  	queue_work(ar->workqueue, &ar->register_work);
  
diff --git a/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch b/package/kernel/mac80211/patches/ath/930-ath10k_add_tpt_led_trigger.patch
similarity index 90%
rename from package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
rename to package/kernel/mac80211/patches/ath/930-ath10k_add_tpt_led_trigger.patch
index 9df469691..3fd6bca81 100644
--- a/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch
+++ b/package/kernel/mac80211/patches/ath/930-ath10k_add_tpt_led_trigger.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -8122,6 +8122,21 @@ static int ath10k_mac_init_rd(struct ath
+@@ -8282,6 +8282,21 @@ static int ath10k_mac_init_rd(struct ath
  	return 0;
  }
  
@@ -22,7 +22,7 @@
  int ath10k_mac_register(struct ath10k *ar)
  {
  	static const u32 cipher_suites[] = {
-@@ -8397,6 +8412,12 @@ int ath10k_mac_register(struct ath10k *a
+@@ -8571,6 +8586,12 @@ int ath10k_mac_register(struct ath10k *a
  
  	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
  
diff --git a/package/kernel/mac80211/patches/936-ath10k-fix-otp-failure-result.patch b/package/kernel/mac80211/patches/ath/936-ath10k-fix-otp-failure-result.patch
similarity index 82%
rename from package/kernel/mac80211/patches/936-ath10k-fix-otp-failure-result.patch
rename to package/kernel/mac80211/patches/ath/936-ath10k-fix-otp-failure-result.patch
index e1aaefd03..e1990b801 100644
--- a/package/kernel/mac80211/patches/936-ath10k-fix-otp-failure-result.patch
+++ b/package/kernel/mac80211/patches/ath/936-ath10k-fix-otp-failure-result.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -783,7 +783,7 @@ static int ath10k_core_get_board_id_from
+@@ -943,7 +943,7 @@ static int ath10k_core_get_board_id_from
  	if (ret) {
  		ath10k_err(ar, "could not execute otp for board id check: %d\n",
  			   ret);
diff --git a/package/kernel/mac80211/patches/ath/960-0010-ath10k-limit-htt-rx-ring-size.patch b/package/kernel/mac80211/patches/ath/960-0010-ath10k-limit-htt-rx-ring-size.patch
new file mode 100644
index 000000000..810e97a78
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath/960-0010-ath10k-limit-htt-rx-ring-size.patch
@@ -0,0 +1,11 @@
+--- a/drivers/net/wireless/ath/ath10k/htt.h
++++ b/drivers/net/wireless/ath/ath10k/htt.h
+@@ -238,7 +238,7 @@ enum htt_rx_ring_flags {
+ };
+ 
+ #define HTT_RX_RING_SIZE_MIN 128
+-#define HTT_RX_RING_SIZE_MAX 2048
++#define HTT_RX_RING_SIZE_MAX 512
+ #define HTT_RX_RING_SIZE HTT_RX_RING_SIZE_MAX
+ #define HTT_RX_RING_FILL_LEVEL (((HTT_RX_RING_SIZE) / 2) - 1)
+ #define HTT_RX_RING_FILL_LEVEL_DUAL_MAC (HTT_RX_RING_SIZE - 1)
diff --git a/package/kernel/mac80211/patches/960-0011-ath10k-limit-pci-buffer-size.patch b/package/kernel/mac80211/patches/ath/960-0011-ath10k-limit-pci-buffer-size.patch
similarity index 75%
rename from package/kernel/mac80211/patches/960-0011-ath10k-limit-pci-buffer-size.patch
rename to package/kernel/mac80211/patches/ath/960-0011-ath10k-limit-pci-buffer-size.patch
index a101282d0..283f4d819 100644
--- a/package/kernel/mac80211/patches/960-0011-ath10k-limit-pci-buffer-size.patch
+++ b/package/kernel/mac80211/patches/ath/960-0011-ath10k-limit-pci-buffer-size.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/pci.c
 +++ b/drivers/net/wireless/ath/ath10k/pci.c
-@@ -128,7 +128,7 @@ static struct ce_attr host_ce_config_wla
+@@ -142,7 +142,7 @@ static struct ce_attr host_ce_config_wla
  		.flags = CE_ATTR_FLAGS,
  		.src_nentries = 0,
  		.src_sz_max = 2048,
@@ -9,7 +9,7 @@
  		.recv_cb = ath10k_pci_htt_htc_rx_cb,
  	},
  
-@@ -137,7 +137,7 @@ static struct ce_attr host_ce_config_wla
+@@ -151,7 +151,7 @@ static struct ce_attr host_ce_config_wla
  		.flags = CE_ATTR_FLAGS,
  		.src_nentries = 0,
  		.src_sz_max = 2048,
@@ -18,7 +18,7 @@
  		.recv_cb = ath10k_pci_htc_rx_cb,
  	},
  
-@@ -164,7 +164,7 @@ static struct ce_attr host_ce_config_wla
+@@ -178,7 +178,7 @@ static struct ce_attr host_ce_config_wla
  		.flags = CE_ATTR_FLAGS,
  		.src_nentries = 0,
  		.src_sz_max = 512,
@@ -27,7 +27,7 @@
  		.recv_cb = ath10k_pci_htt_rx_cb,
  	},
  
-@@ -189,7 +189,7 @@ static struct ce_attr host_ce_config_wla
+@@ -203,7 +203,7 @@ static struct ce_attr host_ce_config_wla
  		.flags = CE_ATTR_FLAGS,
  		.src_nentries = 0,
  		.src_sz_max = 2048,
diff --git a/package/kernel/mac80211/patches/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch b/package/kernel/mac80211/patches/ath/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch
similarity index 94%
rename from package/kernel/mac80211/patches/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch
rename to package/kernel/mac80211/patches/ath/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch
index a7eb0a0d8..b10e575b2 100644
--- a/package/kernel/mac80211/patches/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch
+++ b/package/kernel/mac80211/patches/ath/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch
@@ -23,7 +23,7 @@ v9: use SM/MS macros from code.h to simplify shift/mask handling
  3 files changed, 52 insertions(+), 23 deletions(-)
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -2466,7 +2466,7 @@ static void ath10k_peer_assoc_h_vht(stru
+@@ -2469,7 +2469,7 @@ static void ath10k_peer_assoc_h_vht(stru
  	const u16 *vht_mcs_mask;
  	u8 ampdu_factor;
  	u8 max_nss, vht_mcs;
@@ -32,7 +32,7 @@ v9: use SM/MS macros from code.h to simplify shift/mask handling
  
  	if (WARN_ON(ath10k_mac_vif_chan(vif, &def)))
  		return;
-@@ -2526,23 +2526,45 @@ static void ath10k_peer_assoc_h_vht(stru
+@@ -2529,23 +2529,45 @@ static void ath10k_peer_assoc_h_vht(stru
  		__le16_to_cpu(vht_cap->vht_mcs.tx_highest);
  	arg->peer_vht_rates.tx_mcs_set = ath10k_peer_assoc_h_vht_limit(
  		__le16_to_cpu(vht_cap->vht_mcs.tx_mcs_map), vht_mcs_mask);
@@ -92,7 +92,7 @@ v9: use SM/MS macros from code.h to simplify shift/mask handling
  }
  
  static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
-@@ -2694,9 +2716,9 @@ static int ath10k_peer_assoc_prepare(str
+@@ -2697,9 +2719,9 @@ static int ath10k_peer_assoc_prepare(str
  	ath10k_peer_assoc_h_crypto(ar, vif, sta, arg);
  	ath10k_peer_assoc_h_rates(ar, vif, sta, arg);
  	ath10k_peer_assoc_h_ht(ar, vif, sta, arg);
@@ -105,7 +105,7 @@ v9: use SM/MS macros from code.h to simplify shift/mask handling
  }
 --- a/drivers/net/wireless/ath/ath10k/wmi.c
 +++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -7231,12 +7231,7 @@ ath10k_wmi_peer_assoc_fill_10_4(struct a
+@@ -7346,12 +7346,7 @@ ath10k_wmi_peer_assoc_fill_10_4(struct a
  	struct wmi_10_4_peer_assoc_complete_cmd *cmd = buf;
  
  	ath10k_wmi_peer_assoc_fill_10_2(ar, buf, arg);
@@ -121,7 +121,7 @@ v9: use SM/MS macros from code.h to simplify shift/mask handling
  static int
 --- a/drivers/net/wireless/ath/ath10k/wmi.h
 +++ b/drivers/net/wireless/ath/ath10k/wmi.h
-@@ -6306,7 +6306,19 @@ struct wmi_10_2_peer_assoc_complete_cmd
+@@ -6357,7 +6357,19 @@ struct wmi_10_2_peer_assoc_complete_cmd
  	__le32 info0; /* WMI_PEER_ASSOC_INFO0_ */
  } __packed;
  
diff --git a/package/kernel/mac80211/patches/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch b/package/kernel/mac80211/patches/ath/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch
similarity index 94%
rename from package/kernel/mac80211/patches/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch
rename to package/kernel/mac80211/patches/ath/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch
index c5c8b1063..9a7c749cb 100644
--- a/package/kernel/mac80211/patches/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch
+++ b/package/kernel/mac80211/patches/ath/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch
@@ -13,7 +13,7 @@ v2: fix trailing whitespace issue and fix some typos within the commit note
  2 files changed, 8 insertions(+), 10 deletions(-)
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -4445,13 +4445,6 @@ static struct ieee80211_sta_vht_cap ath1
+@@ -4473,13 +4473,6 @@ static struct ieee80211_sta_vht_cap ath1
  		vht_cap.cap |= val;
  	}
  
@@ -29,7 +29,7 @@ v2: fix trailing whitespace issue and fix some typos within the commit note
  		if ((i < ar->num_rf_chains) && (ar->cfg_tx_chainmask & BIT(i)))
 --- a/drivers/net/wireless/ath/ath10k/wmi.c
 +++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -1672,13 +1672,18 @@ void ath10k_wmi_put_wmi_channel(struct w
+@@ -1677,13 +1677,18 @@ void ath10k_wmi_put_wmi_channel(struct w
  		flags |= WMI_CHAN_FLAG_HT40_PLUS;
  	if (arg->chan_radar)
  		flags |= WMI_CHAN_FLAG_DFS;
diff --git a/package/kernel/mac80211/patches/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch b/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
similarity index 92%
rename from package/kernel/mac80211/patches/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
rename to package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
index 009cbfa88..f2cec9ddf 100644
--- a/package/kernel/mac80211/patches/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
+++ b/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
@@ -85,7 +85,7 @@ v13:
  create mode 100644 drivers/net/wireless/ath/ath10k/leds.h
 --- a/drivers/net/wireless/ath/ath10k/Kconfig
 +++ b/drivers/net/wireless/ath/ath10k/Kconfig
-@@ -56,6 +56,16 @@ config ATH10K_DEBUGFS
+@@ -69,6 +69,16 @@ config ATH10K_DEBUGFS
  
  	  If unsure, say Y to make it easier to debug problems.
  
@@ -104,17 +104,17 @@ v13:
  	depends on ATH10K_DEBUGFS
 --- a/drivers/net/wireless/ath/ath10k/Makefile
 +++ b/drivers/net/wireless/ath/ath10k/Makefile
-@@ -18,6 +18,7 @@ ath10k_core-$(CPTCFG_ATH10K_SPECTRAL) +=
+@@ -19,6 +19,7 @@ ath10k_core-$(CPTCFG_ATH10K_SPECTRAL) +=
  ath10k_core-$(CPTCFG_NL80211_TESTMODE) += testmode.o
  ath10k_core-$(CPTCFG_ATH10K_TRACING) += trace.o
  ath10k_core-$(CPTCFG_ATH10K_THERMAL) += thermal.o
 +ath10k_core-$(CPTCFG_ATH10K_LEDS) += leds.o
  ath10k_core-$(CPTCFG_MAC80211_DEBUGFS) += debugfs_sta.o
  ath10k_core-$(CONFIG_PM) += wow.o
- 
+ ath10k_core-$(CONFIG_DEV_COREDUMP) += coredump.o
 --- a/local-symbols
 +++ b/local-symbols
-@@ -144,6 +144,7 @@ ATH10K_DEBUG=
+@@ -143,6 +143,7 @@ ATH10K_DEBUG=
  ATH10K_DEBUGFS=
  ATH10K_SPECTRAL=
  ATH10K_THERMAL=
@@ -124,15 +124,15 @@ v13:
  WCN36XX=
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -32,6 +32,7 @@
- #include "htt.h"
+@@ -34,6 +34,7 @@
  #include "testmode.h"
  #include "wmi-ops.h"
+ #include "coredump.h"
 +#include "leds.h"
  
  unsigned int ath10k_debug_mask;
  static unsigned int ath10k_cryptmode_param;
-@@ -56,6 +57,7 @@ static const struct ath10k_hw_params ath
+@@ -64,6 +65,7 @@ static const struct ath10k_hw_params ath
  		.id = QCA988X_HW_2_0_VERSION,
  		.dev_id = QCA988X_2_0_DEVICE_ID,
  		.name = "qca988x hw2.0",
@@ -140,7 +140,7 @@ v13:
  		.patch_load_addr = QCA988X_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -81,6 +83,7 @@ static const struct ath10k_hw_params ath
+@@ -129,6 +131,7 @@ static const struct ath10k_hw_params ath
  		.id = QCA9887_HW_1_0_VERSION,
  		.dev_id = QCA9887_1_0_DEVICE_ID,
  		.name = "qca9887 hw1.0",
@@ -148,7 +148,7 @@ v13:
  		.patch_load_addr = QCA9887_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -206,6 +209,7 @@ static const struct ath10k_hw_params ath
+@@ -293,6 +296,7 @@ static const struct ath10k_hw_params ath
  		.id = QCA99X0_HW_2_0_DEV_VERSION,
  		.dev_id = QCA99X0_2_0_DEVICE_ID,
  		.name = "qca99x0 hw2.0",
@@ -156,7 +156,7 @@ v13:
  		.patch_load_addr = QCA99X0_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.otp_exe_param = 0x00000700,
-@@ -236,6 +240,7 @@ static const struct ath10k_hw_params ath
+@@ -331,6 +335,7 @@ static const struct ath10k_hw_params ath
  		.id = QCA9984_HW_1_0_DEV_VERSION,
  		.dev_id = QCA9984_1_0_DEVICE_ID,
  		.name = "qca9984/qca9994 hw1.0",
@@ -164,7 +164,7 @@ v13:
  		.patch_load_addr = QCA9984_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -271,6 +276,7 @@ static const struct ath10k_hw_params ath
+@@ -374,6 +379,7 @@ static const struct ath10k_hw_params ath
  		.id = QCA9888_HW_2_0_DEV_VERSION,
  		.dev_id = QCA9888_2_0_DEVICE_ID,
  		.name = "qca9888 hw2.0",
@@ -172,7 +172,7 @@ v13:
  		.patch_load_addr = QCA9888_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -2267,6 +2273,10 @@ int ath10k_core_start(struct ath10k *ar,
+@@ -2440,6 +2446,10 @@ int ath10k_core_start(struct ath10k *ar,
  	if (status)
  		goto err_hif_stop;
  
@@ -183,7 +183,7 @@ v13:
  	return 0;
  
  err_hif_stop:
-@@ -2484,9 +2494,18 @@ static void ath10k_core_register_work(st
+@@ -2694,9 +2704,18 @@ static void ath10k_core_register_work(st
  		goto err_spectral_destroy;
  	}
  
@@ -202,7 +202,7 @@ v13:
  err_spectral_destroy:
  	ath10k_spectral_destroy(ar);
  err_debug_destroy:
-@@ -2528,6 +2547,8 @@ void ath10k_core_unregister(struct ath10
+@@ -2740,6 +2759,8 @@ void ath10k_core_unregister(struct ath10
  	if (!test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags))
  		return;
  
@@ -213,7 +213,7 @@ v13:
  	 * relayfs debugfs file cleanly. Otherwise the parent debugfs tree
 --- a/drivers/net/wireless/ath/ath10k/core.h
 +++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -24,6 +24,7 @@
+@@ -25,6 +25,7 @@
  #include <linux/pci.h>
  #include <linux/uuid.h>
  #include <linux/time.h>
@@ -221,7 +221,7 @@ v13:
  
  #include "htt.h"
  #include "htc.h"
-@@ -829,7 +830,6 @@ struct ath10k {
+@@ -908,7 +909,6 @@ struct ath10k {
  	u32 low_5ghz_chan;
  	u32 high_5ghz_chan;
  	bool ani_enabled;
@@ -229,7 +229,7 @@ v13:
  	bool p2p;
  
  	struct {
-@@ -1012,6 +1012,13 @@ struct ath10k {
+@@ -1099,6 +1099,13 @@ struct ath10k {
  	} testmode;
  
  	struct {
@@ -245,7 +245,7 @@ v13:
  		u32 fw_warm_reset_counter;
 --- a/drivers/net/wireless/ath/ath10k/hw.h
 +++ b/drivers/net/wireless/ath/ath10k/hw.h
-@@ -490,6 +490,7 @@ struct ath10k_hw_params {
+@@ -504,6 +504,7 @@ struct ath10k_hw_params {
  	const char *name;
  	u32 patch_load_addr;
  	int uart_pin;
@@ -405,7 +405,7 @@ v13:
 +#endif /* _LEDS_H_ */
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -32,6 +32,7 @@
+@@ -33,6 +33,7 @@
  #include "wmi-tlv.h"
  #include "wmi-ops.h"
  #include "wow.h"
@@ -415,7 +415,7 @@ v13:
  /* Rates */
 --- a/drivers/net/wireless/ath/ath10k/wmi-ops.h
 +++ b/drivers/net/wireless/ath/ath10k/wmi-ops.h
-@@ -204,7 +204,10 @@ struct wmi_ops {
+@@ -216,7 +216,10 @@ struct wmi_ops {
  	struct sk_buff *(*gen_echo)(struct ath10k *ar, u32 value);
  	struct sk_buff *(*gen_pdev_get_tpc_table_cmdid)(struct ath10k *ar,
  							u32 param);
@@ -426,7 +426,7 @@ v13:
  };
  
  int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id);
-@@ -969,6 +972,35 @@ ath10k_wmi_force_fw_hang(struct ath10k *
+@@ -1054,6 +1057,35 @@ ath10k_wmi_force_fw_hang(struct ath10k *
  	return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->force_fw_hang_cmdid);
  }
  
@@ -464,7 +464,7 @@ v13:
  {
 --- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
 +++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
-@@ -3652,6 +3652,8 @@ static const struct wmi_ops wmi_tlv_ops
+@@ -3976,6 +3976,8 @@ static const struct wmi_ops wmi_tlv_ops
  	.gen_echo = ath10k_wmi_tlv_op_gen_echo,
  	.gen_vdev_spectral_conf = ath10k_wmi_tlv_op_gen_vdev_spectral_conf,
  	.gen_vdev_spectral_enable = ath10k_wmi_tlv_op_gen_vdev_spectral_enable,
@@ -475,7 +475,7 @@ v13:
  static const struct wmi_peer_flags_map wmi_tlv_peer_flags_map = {
 --- a/drivers/net/wireless/ath/ath10k/wmi.c
 +++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -7051,6 +7051,49 @@ ath10k_wmi_op_gen_peer_set_param(struct
+@@ -7166,6 +7166,49 @@ ath10k_wmi_op_gen_peer_set_param(struct
  	return skb;
  }
  
@@ -525,7 +525,7 @@ v13:
  static struct sk_buff *
  ath10k_wmi_op_gen_set_psmode(struct ath10k *ar, u32 vdev_id,
  			     enum wmi_sta_ps_mode psmode)
-@@ -8596,6 +8639,9 @@ static const struct wmi_ops wmi_ops = {
+@@ -8777,6 +8820,9 @@ static const struct wmi_ops wmi_ops = {
  	.fw_stats_fill = ath10k_wmi_main_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
  	.gen_echo = ath10k_wmi_op_gen_echo,
@@ -535,7 +535,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -8666,6 +8712,8 @@ static const struct wmi_ops wmi_10_1_ops
+@@ -8847,6 +8893,8 @@ static const struct wmi_ops wmi_10_1_ops
  	.fw_stats_fill = ath10k_wmi_10x_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
  	.gen_echo = ath10k_wmi_op_gen_echo,
@@ -544,7 +544,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -8737,6 +8785,8 @@ static const struct wmi_ops wmi_10_2_ops
+@@ -8918,6 +8966,8 @@ static const struct wmi_ops wmi_10_2_ops
  	.gen_delba_send = ath10k_wmi_op_gen_delba_send,
  	.fw_stats_fill = ath10k_wmi_10x_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
@@ -553,7 +553,7 @@ v13:
  	/* .gen_pdev_enable_adaptive_cca not implemented */
  };
  
-@@ -8807,6 +8857,8 @@ static const struct wmi_ops wmi_10_2_4_o
+@@ -8988,6 +9038,8 @@ static const struct wmi_ops wmi_10_2_4_o
  	.gen_pdev_enable_adaptive_cca =
  		ath10k_wmi_op_gen_pdev_enable_adaptive_cca,
  	.get_vdev_subtype = ath10k_wmi_10_2_4_op_get_vdev_subtype,
@@ -562,7 +562,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -8886,6 +8938,8 @@ static const struct wmi_ops wmi_10_4_ops
+@@ -9067,6 +9119,8 @@ static const struct wmi_ops wmi_10_4_ops
  	.gen_pdev_bss_chan_info_req = ath10k_wmi_10_2_op_gen_pdev_bss_chan_info,
  	.gen_echo = ath10k_wmi_op_gen_echo,
  	.gen_pdev_get_tpc_config = ath10k_wmi_10_2_4_op_gen_pdev_get_tpc_config,
@@ -573,7 +573,7 @@ v13:
  int ath10k_wmi_attach(struct ath10k *ar)
 --- a/drivers/net/wireless/ath/ath10k/wmi.h
 +++ b/drivers/net/wireless/ath/ath10k/wmi.h
-@@ -2930,6 +2930,41 @@ enum wmi_10_4_feature_mask {
+@@ -2942,6 +2942,41 @@ enum wmi_10_4_feature_mask {
  
  };
  
diff --git a/package/kernel/mac80211/patches/975-ath10k-use-tpt-trigger-by-default.patch b/package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch
similarity index 94%
rename from package/kernel/mac80211/patches/975-ath10k-use-tpt-trigger-by-default.patch
rename to package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch
index 80db9ec43..dfe282946 100644
--- a/package/kernel/mac80211/patches/975-ath10k-use-tpt-trigger-by-default.patch
+++ b/package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch
@@ -16,7 +16,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
 
 --- a/drivers/net/wireless/ath/ath10k/core.h
 +++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -1055,6 +1055,10 @@ struct ath10k {
+@@ -1144,6 +1144,10 @@ struct ath10k {
  	struct ath10k_radar_found_info last_radar_info;
  	struct work_struct radar_confirmation_work;
  
@@ -42,7 +42,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
  	if (ret)
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -8429,7 +8429,7 @@ int ath10k_mac_register(struct ath10k *a
+@@ -8603,7 +8603,7 @@ int ath10k_mac_register(struct ath10k *a
  	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
  
  #ifdef CPTCFG_MAC80211_LEDS
diff --git a/package/kernel/mac80211/patches/976-ath10k-Limit-available-channels-via-DT-ieee80211-fre.patch b/package/kernel/mac80211/patches/ath/976-ath10k-Limit-available-channels-via-DT-ieee80211-fre.patch
similarity index 93%
rename from package/kernel/mac80211/patches/976-ath10k-Limit-available-channels-via-DT-ieee80211-fre.patch
rename to package/kernel/mac80211/patches/ath/976-ath10k-Limit-available-channels-via-DT-ieee80211-fre.patch
index ea57d1114..260c0c786 100644
--- a/package/kernel/mac80211/patches/976-ath10k-Limit-available-channels-via-DT-ieee80211-fre.patch
+++ b/package/kernel/mac80211/patches/ath/976-ath10k-Limit-available-channels-via-DT-ieee80211-fre.patch
@@ -21,7 +21,7 @@ Forwarded: https://patchwork.kernel.org/patch/10549245/
 
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -17,6 +17,7 @@
+@@ -18,6 +18,7 @@
  
  #include "mac.h"
  
@@ -29,7 +29,7 @@ Forwarded: https://patchwork.kernel.org/patch/10549245/
  #include <net/mac80211.h>
  #include <linux/etherdevice.h>
  #include <linux/acpi.h>
-@@ -8230,6 +8231,7 @@ int ath10k_mac_register(struct ath10k *a
+@@ -8390,6 +8391,7 @@ int ath10k_mac_register(struct ath10k *a
  		ar->hw->wiphy->bands[NL80211_BAND_5GHZ] = band;
  	}
  
diff --git a/package/kernel/mac80211/patches/040-brcmutil_option.patch b/package/kernel/mac80211/patches/brcm/040-brcmutil_option.patch
similarity index 100%
rename from package/kernel/mac80211/patches/040-brcmutil_option.patch
rename to package/kernel/mac80211/patches/brcm/040-brcmutil_option.patch
diff --git a/package/kernel/mac80211/patches/342-0001-brcmfmac-add-CYW89342-mini-PCIe-device.patch b/package/kernel/mac80211/patches/brcm/342-0001-brcmfmac-add-CYW89342-mini-PCIe-device.patch
similarity index 100%
rename from package/kernel/mac80211/patches/342-0001-brcmfmac-add-CYW89342-mini-PCIe-device.patch
rename to package/kernel/mac80211/patches/brcm/342-0001-brcmfmac-add-CYW89342-mini-PCIe-device.patch
diff --git a/package/kernel/mac80211/patches/344-0001-brcmfmac-fix-wrong-strnchr-usage.patch b/package/kernel/mac80211/patches/brcm/344-0001-brcmfmac-fix-wrong-strnchr-usage.patch
similarity index 100%
rename from package/kernel/mac80211/patches/344-0001-brcmfmac-fix-wrong-strnchr-usage.patch
rename to package/kernel/mac80211/patches/brcm/344-0001-brcmfmac-fix-wrong-strnchr-usage.patch
diff --git a/package/kernel/mac80211/patches/345-0001-brcmfmac-fix-for-proper-support-of-160MHz-bandwidth.patch b/package/kernel/mac80211/patches/brcm/345-0001-brcmfmac-fix-for-proper-support-of-160MHz-bandwidth.patch
similarity index 100%
rename from package/kernel/mac80211/patches/345-0001-brcmfmac-fix-for-proper-support-of-160MHz-bandwidth.patch
rename to package/kernel/mac80211/patches/brcm/345-0001-brcmfmac-fix-for-proper-support-of-160MHz-bandwidth.patch
diff --git a/package/kernel/mac80211/patches/345-0002-brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch b/package/kernel/mac80211/patches/brcm/345-0002-brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch
similarity index 100%
rename from package/kernel/mac80211/patches/345-0002-brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch
rename to package/kernel/mac80211/patches/brcm/345-0002-brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch
diff --git a/package/kernel/mac80211/patches/810-b43-gpio-mask-module-option.patch b/package/kernel/mac80211/patches/brcm/810-b43-gpio-mask-module-option.patch
similarity index 97%
rename from package/kernel/mac80211/patches/810-b43-gpio-mask-module-option.patch
rename to package/kernel/mac80211/patches/brcm/810-b43-gpio-mask-module-option.patch
index 5ce49d3a0..6861667b2 100644
--- a/package/kernel/mac80211/patches/810-b43-gpio-mask-module-option.patch
+++ b/package/kernel/mac80211/patches/brcm/810-b43-gpio-mask-module-option.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/b43/b43.h
 +++ b/drivers/net/wireless/broadcom/b43/b43.h
-@@ -839,6 +839,7 @@ struct b43_wldev {
+@@ -840,6 +840,7 @@ struct b43_wldev {
  	bool qos_enabled;		/* TRUE, if QoS is used. */
  	bool hwcrypto_enabled;		/* TRUE, if HW crypto acceleration is enabled. */
  	bool use_pio;			/* TRUE if next init should use PIO */
diff --git a/package/kernel/mac80211/patches/811-b43_no_pio.patch b/package/kernel/mac80211/patches/brcm/811-b43_no_pio.patch
similarity index 91%
rename from package/kernel/mac80211/patches/811-b43_no_pio.patch
rename to package/kernel/mac80211/patches/brcm/811-b43_no_pio.patch
index d23387c8c..5eb1dc550 100644
--- a/package/kernel/mac80211/patches/811-b43_no_pio.patch
+++ b/package/kernel/mac80211/patches/brcm/811-b43_no_pio.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/b43/Makefile
 +++ b/drivers/net/wireless/broadcom/b43/Makefile
-@@ -17,7 +17,7 @@ b43-$(CPTCFG_B43_PHY_AC)	+= phy_ac.o
+@@ -18,7 +18,7 @@ b43-$(CPTCFG_B43_PHY_AC)	+= phy_ac.o
  b43-y				+= sysfs.o
  b43-y				+= xmit.o
  b43-y				+= dma.o
@@ -26,7 +26,7 @@
  	}
 --- a/drivers/net/wireless/broadcom/b43/pio.h
 +++ b/drivers/net/wireless/broadcom/b43/pio.h
-@@ -150,7 +150,7 @@ static inline void b43_piorx_write32(str
+@@ -151,7 +151,7 @@ static inline void b43_piorx_write32(str
  	b43_write32(q->dev, q->mmio_base + offset, value);
  }
  
@@ -35,7 +35,7 @@
  int b43_pio_init(struct b43_wldev *dev);
  void b43_pio_free(struct b43_wldev *dev);
  
-@@ -161,5 +161,37 @@ void b43_pio_rx(struct b43_pio_rxqueue *
+@@ -162,5 +162,37 @@ void b43_pio_rx(struct b43_pio_rxqueue *
  
  void b43_pio_tx_suspend(struct b43_wldev *dev);
  void b43_pio_tx_resume(struct b43_wldev *dev);
@@ -82,5 +82,5 @@
 -	bool
 +	bool "Broadcom 43xx PIO support"
  	depends on B43 && B43_SSB
- 	select SSB_BLOCKIO
+ 	depends on SSB_BLOCKIO
  	default y
diff --git a/package/kernel/mac80211/patches/812-b43-add-antenna-control.patch b/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
similarity index 99%
rename from package/kernel/mac80211/patches/812-b43-add-antenna-control.patch
rename to package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
index 932c83b48..d643d2f82 100644
--- a/package/kernel/mac80211/patches/812-b43-add-antenna-control.patch
+++ b/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
@@ -120,7 +120,7 @@
  	SET_IEEE80211_DEV(hw, dev->dev);
 --- a/drivers/net/wireless/broadcom/b43/b43.h
 +++ b/drivers/net/wireless/broadcom/b43/b43.h
-@@ -840,6 +840,8 @@ struct b43_wldev {
+@@ -841,6 +841,8 @@ struct b43_wldev {
  	bool hwcrypto_enabled;		/* TRUE, if HW crypto acceleration is enabled. */
  	bool use_pio;			/* TRUE if next init should use PIO */
  	int gpiomask;			/* GPIO LED mask as a module parameter */
diff --git a/package/kernel/mac80211/patches/813-b43-reduce-number-of-RX-slots.patch b/package/kernel/mac80211/patches/brcm/813-b43-reduce-number-of-RX-slots.patch
similarity index 88%
rename from package/kernel/mac80211/patches/813-b43-reduce-number-of-RX-slots.patch
rename to package/kernel/mac80211/patches/brcm/813-b43-reduce-number-of-RX-slots.patch
index 589970689..85c52c028 100644
--- a/package/kernel/mac80211/patches/813-b43-reduce-number-of-RX-slots.patch
+++ b/package/kernel/mac80211/patches/brcm/813-b43-reduce-number-of-RX-slots.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/b43/dma.h
 +++ b/drivers/net/wireless/broadcom/b43/dma.h
-@@ -169,7 +169,7 @@ struct b43_dmadesc_generic {
+@@ -170,7 +170,7 @@ struct b43_dmadesc_generic {
  
  /* DMA engine tuning knobs */
  #define B43_TXRING_SLOTS		256
diff --git a/package/kernel/mac80211/patches/814-b43-only-use-gpio-0-1-for-led.patch b/package/kernel/mac80211/patches/brcm/814-b43-only-use-gpio-0-1-for-led.patch
similarity index 100%
rename from package/kernel/mac80211/patches/814-b43-only-use-gpio-0-1-for-led.patch
rename to package/kernel/mac80211/patches/brcm/814-b43-only-use-gpio-0-1-for-led.patch
diff --git a/package/kernel/mac80211/patches/815-b43-always-take-overlapping-devs.patch b/package/kernel/mac80211/patches/brcm/815-b43-always-take-overlapping-devs.patch
similarity index 100%
rename from package/kernel/mac80211/patches/815-b43-always-take-overlapping-devs.patch
rename to package/kernel/mac80211/patches/brcm/815-b43-always-take-overlapping-devs.patch
diff --git a/package/kernel/mac80211/patches/850-brcmsmac-remove-extra-regulation-restriction.patch b/package/kernel/mac80211/patches/brcm/850-brcmsmac-remove-extra-regulation-restriction.patch
similarity index 100%
rename from package/kernel/mac80211/patches/850-brcmsmac-remove-extra-regulation-restriction.patch
rename to package/kernel/mac80211/patches/brcm/850-brcmsmac-remove-extra-regulation-restriction.patch
diff --git a/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch b/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch
similarity index 100%
rename from package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch
rename to package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch
diff --git a/package/kernel/mac80211/patches/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch b/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
similarity index 100%
rename from package/kernel/mac80211/patches/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
rename to package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
diff --git a/package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch b/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
similarity index 100%
rename from package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch
rename to package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
diff --git a/package/kernel/mac80211/patches/863-brcmfmac-add-in-driver-tables-with-country-codes.patch b/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
similarity index 100%
rename from package/kernel/mac80211/patches/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
rename to package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
diff --git a/package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch b/package/kernel/mac80211/patches/brcm/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
similarity index 92%
rename from package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
rename to package/kernel/mac80211/patches/brcm/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
index 417b6ec86..249c3036b 100644
--- a/package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
+++ b/package/kernel/mac80211/patches/brcm/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
@@ -18,6 +18,6 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 +#else
  static int brcmf_roamoff;
 +#endif
- module_param_named(roamoff, brcmf_roamoff, int, S_IRUSR);
+ module_param_named(roamoff, brcmf_roamoff, int, 0400);
  MODULE_PARM_DESC(roamoff, "Do not use internal roaming engine");
  
diff --git a/package/kernel/mac80211/patches/000-fix_kconfig.patch b/package/kernel/mac80211/patches/build/000-fix_kconfig.patch
similarity index 100%
rename from package/kernel/mac80211/patches/000-fix_kconfig.patch
rename to package/kernel/mac80211/patches/build/000-fix_kconfig.patch
diff --git a/package/kernel/mac80211/patches/001-fix_build.patch b/package/kernel/mac80211/patches/build/001-fix_build.patch
similarity index 100%
rename from package/kernel/mac80211/patches/001-fix_build.patch
rename to package/kernel/mac80211/patches/build/001-fix_build.patch
diff --git a/package/kernel/mac80211/patches/002-change_allconfig.patch b/package/kernel/mac80211/patches/build/002-change_allconfig.patch
similarity index 100%
rename from package/kernel/mac80211/patches/002-change_allconfig.patch
rename to package/kernel/mac80211/patches/build/002-change_allconfig.patch
diff --git a/package/kernel/mac80211/patches/003-remove_bogus_modparams.patch b/package/kernel/mac80211/patches/build/003-remove_bogus_modparams.patch
similarity index 100%
rename from package/kernel/mac80211/patches/003-remove_bogus_modparams.patch
rename to package/kernel/mac80211/patches/build/003-remove_bogus_modparams.patch
diff --git a/package/kernel/mac80211/patches/004-kconfig_backport_fix.patch b/package/kernel/mac80211/patches/build/004-kconfig_backport_fix.patch
similarity index 100%
rename from package/kernel/mac80211/patches/004-kconfig_backport_fix.patch
rename to package/kernel/mac80211/patches/build/004-kconfig_backport_fix.patch
diff --git a/package/kernel/mac80211/patches/build/005-revert-devcoredump.patch b/package/kernel/mac80211/patches/build/005-revert-devcoredump.patch
new file mode 100644
index 000000000..283f1bf02
--- /dev/null
+++ b/package/kernel/mac80211/patches/build/005-revert-devcoredump.patch
@@ -0,0 +1,8 @@
+--- a/compat/Makefile
++++ b/compat/Makefile
+@@ -79,5 +79,3 @@ obj-$(CPTCFG_BPAUTO_BUILD_CORDIC) += cor
+ compat-$(CPTCFG_BPAUTO_PUBLIC_KEY) += 
+ compat-$(CPTCFG_BPAUTO_BUCKET_LOCKS) += lib-bucket_locks.o
+ compat-$(CPTCFG_BPAUTO_PKCS7) += 
+-skcipher-objs += crypto-skcipher.o
+-obj-$(CPTCFG_BPAUTO_CRYPTO_SKCIPHER) += skcipher.o
diff --git a/package/kernel/mac80211/patches/010-disable_rfkill.patch b/package/kernel/mac80211/patches/build/010-disable_rfkill.patch
similarity index 100%
rename from package/kernel/mac80211/patches/010-disable_rfkill.patch
rename to package/kernel/mac80211/patches/build/010-disable_rfkill.patch
diff --git a/package/kernel/mac80211/patches/012-kernel_build_check.patch b/package/kernel/mac80211/patches/build/012-kernel_build_check.patch
similarity index 100%
rename from package/kernel/mac80211/patches/012-kernel_build_check.patch
rename to package/kernel/mac80211/patches/build/012-kernel_build_check.patch
diff --git a/package/kernel/mac80211/patches/050-lib80211_option.patch b/package/kernel/mac80211/patches/build/050-lib80211_option.patch
similarity index 78%
rename from package/kernel/mac80211/patches/050-lib80211_option.patch
rename to package/kernel/mac80211/patches/build/050-lib80211_option.patch
index 28a0d905b..6282cdab5 100644
--- a/package/kernel/mac80211/patches/050-lib80211_option.patch
+++ b/package/kernel/mac80211/patches/build/050-lib80211_option.patch
@@ -1,7 +1,7 @@
 --- a/net/wireless/Kconfig
 +++ b/net/wireless/Kconfig
-@@ -181,7 +181,7 @@ config CFG80211_WEXT_EXPORT
- 	  wext compatibility symbols to be exported.
+@@ -185,7 +185,7 @@ config CFG80211_WEXT_EXPORT
+ endif # CFG80211
  
  config LIB80211
 -	tristate
@@ -9,7 +9,7 @@
  	depends on m
  	default n
  	help
-@@ -191,15 +191,15 @@ config LIB80211
+@@ -195,15 +195,15 @@ config LIB80211
  	  Drivers should select this themselves if needed.
  
  config LIB80211_CRYPT_WEP
diff --git a/package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch b/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
similarity index 87%
rename from package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
rename to package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
index a901a44ba..f3e311a2e 100644
--- a/package/kernel/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
+++ b/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/mwl8k.c
 +++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -5681,6 +5681,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
+@@ -5686,6 +5686,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
  MODULE_FIRMWARE(MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API));
  
  static const struct pci_device_id mwl8k_pci_id_table[] = {
diff --git a/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch b/package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch
similarity index 89%
rename from package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
rename to package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch
index 885bc246b..c3e6db8f0 100644
--- a/package/kernel/mac80211/patches/801-libertas-configure-sysfs-links.patch
+++ b/package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/libertas/cfg.c
 +++ b/drivers/net/wireless/marvell/libertas/cfg.c
-@@ -2040,6 +2040,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
+@@ -2041,6 +2041,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
  		goto err_wiphy_new;
  	}
  
diff --git a/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch b/package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch
similarity index 85%
rename from package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
rename to package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch
index 089ad2fe7..f1966d88e 100644
--- a/package/kernel/mac80211/patches/802-libertas-set-wireless-macaddr.patch
+++ b/package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/libertas/cfg.c
 +++ b/drivers/net/wireless/marvell/libertas/cfg.c
-@@ -2116,6 +2116,8 @@ int lbs_cfg_register(struct lbs_private
+@@ -2117,6 +2117,8 @@ int lbs_cfg_register(struct lbs_private
  	wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
  	wdev->wiphy->reg_notifier = lbs_reg_notifier;
  
diff --git a/package/kernel/mac80211/patches/940-mwl8k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
similarity index 75%
rename from package/kernel/mac80211/patches/940-mwl8k_init_devices_synchronously.patch
rename to package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
index a958c78b4..61a6c4c70 100644
--- a/package/kernel/mac80211/patches/940-mwl8k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/mwl8k.c
 +++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -6266,6 +6266,8 @@ static int mwl8k_probe(struct pci_dev *p
+@@ -6271,6 +6271,8 @@ static int mwl8k_probe(struct pci_dev *p
  
  	priv->running_bsses = 0;
  
@@ -9,7 +9,7 @@
  	return rc;
  
  err_stop_firmware:
-@@ -6299,8 +6301,6 @@ static void mwl8k_remove(struct pci_dev
+@@ -6304,8 +6306,6 @@ static void mwl8k_remove(struct pci_dev
  		return;
  	priv = hw->priv;
  
diff --git a/package/kernel/mac80211/patches/030-rt2x00_options.patch b/package/kernel/mac80211/patches/rt2x00/030-rt2x00_options.patch
similarity index 100%
rename from package/kernel/mac80211/patches/030-rt2x00_options.patch
rename to package/kernel/mac80211/patches/rt2x00/030-rt2x00_options.patch
diff --git a/package/kernel/mac80211/patches/600-01-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch b/package/kernel/mac80211/patches/rt2x00/600-01-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
similarity index 100%
rename from package/kernel/mac80211/patches/600-01-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
rename to package/kernel/mac80211/patches/rt2x00/600-01-rt2x00-allow-to-build-rt2800soc-module-for-RT3883.patch
diff --git a/package/kernel/mac80211/patches/600-02-rt2x00-rt2800lib-enable-support-for-RT3883.patch b/package/kernel/mac80211/patches/rt2x00/600-02-rt2x00-rt2800lib-enable-support-for-RT3883.patch
similarity index 89%
rename from package/kernel/mac80211/patches/600-02-rt2x00-rt2800lib-enable-support-for-RT3883.patch
rename to package/kernel/mac80211/patches/rt2x00/600-02-rt2x00-rt2800lib-enable-support-for-RT3883.patch
index 5127c5cfe..c7927aeae 100644
--- a/package/kernel/mac80211/patches/600-02-rt2x00-rt2800lib-enable-support-for-RT3883.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-02-rt2x00-rt2800lib-enable-support-for-RT3883.patch
@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -9403,6 +9403,7 @@ static int rt2800_probe_rt(struct rt2x00
+@@ -9409,6 +9409,7 @@ static int rt2800_probe_rt(struct rt2x00
  	case RT3390:
  	case RT3572:
  	case RT3593:
diff --git a/package/kernel/mac80211/patches/600-03-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch b/package/kernel/mac80211/patches/rt2x00/600-03-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
similarity index 95%
rename from package/kernel/mac80211/patches/600-03-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
rename to package/kernel/mac80211/patches/rt2x00/600-03-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
index 60e57c1ba..bacbf1947 100644
--- a/package/kernel/mac80211/patches/600-03-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-03-rt2x00-rt2800lib-add-rf_vals-for-RF3853.patch
@@ -31,7 +31,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  #define RF5362				0x5362
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8981,6 +8981,66 @@ static const struct rf_channel rf_vals_3
+@@ -8987,6 +8987,66 @@ static const struct rf_channel rf_vals_3
  	{14,   0xF0,	 2,  0x18},
  };
  
@@ -98,7 +98,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  static const struct rf_channel rf_vals_5592_xtal20[] = {
  	/* Channel, N, K, mod, R */
  	{1, 482, 4, 10, 3},
-@@ -9244,6 +9304,11 @@ static int rt2800_probe_hw_mode(struct r
+@@ -9250,6 +9310,11 @@ static int rt2800_probe_hw_mode(struct r
  		spec->channels = rf_vals_3x;
  		break;
  
diff --git a/package/kernel/mac80211/patches/600-04-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch b/package/kernel/mac80211/patches/rt2x00/600-04-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
similarity index 84%
rename from package/kernel/mac80211/patches/600-04-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
rename to package/kernel/mac80211/patches/rt2x00/600-04-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
index def2c397f..227c6923f 100644
--- a/package/kernel/mac80211/patches/600-04-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-04-rt2x00-rt2800lib-enable-VCO-calibration-for-RF3853.patch
@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -4881,6 +4881,7 @@ void rt2800_vco_calibration(struct rt2x0
+@@ -4884,6 +4884,7 @@ void rt2800_vco_calibration(struct rt2x0
  	case RF3053:
  	case RF3070:
  	case RF3290:
@@ -18,7 +18,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  	case RF5350:
  	case RF5360:
  	case RF5362:
-@@ -9426,6 +9427,7 @@ static int rt2800_probe_hw_mode(struct r
+@@ -9432,6 +9433,7 @@ static int rt2800_probe_hw_mode(struct r
  	case RF3053:
  	case RF3070:
  	case RF3290:
diff --git a/package/kernel/mac80211/patches/600-05-rt2x00-rt2800lib-add-channel-configuration-function-.patch b/package/kernel/mac80211/patches/rt2x00/600-05-rt2x00-rt2800lib-add-channel-configuration-function-.patch
similarity index 97%
rename from package/kernel/mac80211/patches/600-05-rt2x00-rt2800lib-add-channel-configuration-function-.patch
rename to package/kernel/mac80211/patches/rt2x00/600-05-rt2x00-rt2800lib-add-channel-configuration-function-.patch
index 1d6e31203..1890b1ec1 100644
--- a/package/kernel/mac80211/patches/600-05-rt2x00-rt2800lib-add-channel-configuration-function-.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-05-rt2x00-rt2800lib-add-channel-configuration-function-.patch
@@ -11,7 +11,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -2713,6 +2713,211 @@ static void rt2800_config_channel_rf3053
+@@ -2716,6 +2716,211 @@ static void rt2800_config_channel_rf3053
  	}
  }
  
@@ -223,7 +223,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  #define POWER_BOUND		0x27
  #define POWER_BOUND_5G		0x2b
  
-@@ -3570,6 +3775,9 @@ static void rt2800_config_channel(struct
+@@ -3573,6 +3778,9 @@ static void rt2800_config_channel(struct
  	case RF3322:
  		rt2800_config_channel_rf3322(rt2x00dev, conf, rf, info);
  		break;
diff --git a/package/kernel/mac80211/patches/600-06-rt2x00-rt2800lib-enable-RF3853-support.patch b/package/kernel/mac80211/patches/rt2x00/600-06-rt2x00-rt2800lib-enable-RF3853-support.patch
similarity index 89%
rename from package/kernel/mac80211/patches/600-06-rt2x00-rt2800lib-enable-RF3853-support.patch
rename to package/kernel/mac80211/patches/rt2x00/600-06-rt2x00-rt2800lib-enable-RF3853-support.patch
index 6476dc107..69ed4d7de 100644
--- a/package/kernel/mac80211/patches/600-06-rt2x00-rt2800lib-enable-RF3853-support.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-06-rt2x00-rt2800lib-enable-RF3853-support.patch
@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8906,6 +8906,7 @@ static int rt2800_init_eeprom(struct rt2
+@@ -8910,6 +8910,7 @@ static int rt2800_init_eeprom(struct rt2
  	case RF3290:
  	case RF3320:
  	case RF3322:
diff --git a/package/kernel/mac80211/patches/600-07-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch b/package/kernel/mac80211/patches/rt2x00/600-07-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
similarity index 93%
rename from package/kernel/mac80211/patches/600-07-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
rename to package/kernel/mac80211/patches/rt2x00/600-07-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
index 0a931e202..fc5a72cba 100644
--- a/package/kernel/mac80211/patches/600-07-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-07-rt2x00-rt2800lib-add-MAC-register-initialization-for.patch
@@ -12,7 +12,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
-@@ -1727,6 +1727,20 @@
+@@ -1728,6 +1728,20 @@
  #define TX_PWR_CFG_9B_STBC_MCS7		FIELD32(0x000000ff)
  
  /*
@@ -35,7 +35,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  #define RX_FILTER_CFG			0x1400
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -5509,6 +5509,12 @@ static int rt2800_init_registers(struct
+@@ -5512,6 +5512,12 @@ static int rt2800_init_registers(struct
  			rt2800_register_write(rt2x00dev, TX_SW_CFG2,
  					      0x00000000);
  		}
@@ -48,7 +48,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  	} else if (rt2x00_rt(rt2x00dev, RT5390) ||
  		   rt2x00_rt(rt2x00dev, RT5392) ||
  		   rt2x00_rt(rt2x00dev, RT6352)) {
-@@ -5722,6 +5728,11 @@ static int rt2800_init_registers(struct
+@@ -5725,6 +5731,11 @@ static int rt2800_init_registers(struct
  	reg = rt2x00_rt(rt2x00dev, RT5592) ? 0x00000082 : 0x00000002;
  	rt2800_register_write(rt2x00dev, TXOP_HLDR_ET, reg);
  
diff --git a/package/kernel/mac80211/patches/600-08-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch b/package/kernel/mac80211/patches/rt2x00/600-08-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch
similarity index 100%
rename from package/kernel/mac80211/patches/600-08-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch
rename to package/kernel/mac80211/patches/rt2x00/600-08-rt2x00-rt2800soc-fix-rt2800soc_disable_radio-for-RT3.patch
diff --git a/package/kernel/mac80211/patches/600-09-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch b/package/kernel/mac80211/patches/rt2x00/600-09-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
similarity index 94%
rename from package/kernel/mac80211/patches/600-09-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
rename to package/kernel/mac80211/patches/rt2x00/600-09-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
index 99f57bcd3..e53b64df7 100644
--- a/package/kernel/mac80211/patches/600-09-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-09-rt2x00-rt2800lib-add-BBP-register-initialization-for.patch
@@ -11,7 +11,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -6349,6 +6349,47 @@ static void rt2800_init_bbp_3593(struct
+@@ -6352,6 +6352,47 @@ static void rt2800_init_bbp_3593(struct
  		rt2800_bbp_write(rt2x00dev, 103, 0xc0);
  }
  
@@ -59,7 +59,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
  {
  	int ant, div_mode;
-@@ -6792,6 +6833,9 @@ static void rt2800_init_bbp(struct rt2x0
+@@ -6796,6 +6837,9 @@ static void rt2800_init_bbp(struct rt2x0
  	case RT3593:
  		rt2800_init_bbp_3593(rt2x00dev);
  		return;
diff --git a/package/kernel/mac80211/patches/600-10-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch b/package/kernel/mac80211/patches/rt2x00/600-10-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
similarity index 97%
rename from package/kernel/mac80211/patches/600-10-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
rename to package/kernel/mac80211/patches/rt2x00/600-10-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
index c0f1f5863..c16cf4101 100644
--- a/package/kernel/mac80211/patches/600-10-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-10-rt2x00-rt2800lib-add-RFCSR-initialization-for-RT3883.patch
@@ -11,7 +11,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
-@@ -2311,6 +2311,7 @@ struct mac_iveiv_entry {
+@@ -2312,6 +2312,7 @@ struct mac_iveiv_entry {
  /*
   * RFCSR 2:
   */
@@ -21,7 +21,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  #define RFCSR2_TX2_EN_MT7620		FIELD8(0x20)
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -7707,6 +7707,144 @@ static void rt2800_init_rfcsr_5350(struc
+@@ -7711,6 +7711,144 @@ static void rt2800_init_rfcsr_5350(struc
  	rt2800_rfcsr_write(rt2x00dev, 63, 0x00);
  }
  
@@ -166,7 +166,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
  {
  	rt2800_rf_init_calibration(rt2x00dev, 2);
-@@ -8549,6 +8687,9 @@ static void rt2800_init_rfcsr(struct rt2
+@@ -8553,6 +8691,9 @@ static void rt2800_init_rfcsr(struct rt2
  	case RT3390:
  		rt2800_init_rfcsr_3390(rt2x00dev);
  		break;
diff --git a/package/kernel/mac80211/patches/600-11-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch b/package/kernel/mac80211/patches/rt2x00/600-11-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch
similarity index 100%
rename from package/kernel/mac80211/patches/600-11-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch
rename to package/kernel/mac80211/patches/rt2x00/600-11-rt2x00-rt2800lib-use-the-extended-EEPROM-map-for-RT3.patch
diff --git a/package/kernel/mac80211/patches/600-12-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch b/package/kernel/mac80211/patches/rt2x00/600-12-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
similarity index 91%
rename from package/kernel/mac80211/patches/600-12-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
rename to package/kernel/mac80211/patches/rt2x00/600-12-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
index 2e917c8eb..55e703b75 100644
--- a/package/kernel/mac80211/patches/600-12-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-12-rt2x00-rt2800lib-force-rf-type-to-RF3853-on-RT3883.patch
@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -9083,6 +9083,8 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9087,6 +9087,8 @@ static int rt2800_init_eeprom(struct rt2
  		rf = rt2800_eeprom_read(rt2x00dev, EEPROM_CHIP_ID);
  	else if (rt2x00_rt(rt2x00dev, RT3352))
  		rf = RF3322;
diff --git a/package/kernel/mac80211/patches/600-13-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch b/package/kernel/mac80211/patches/rt2x00/600-13-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
similarity index 91%
rename from package/kernel/mac80211/patches/600-13-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
rename to package/kernel/mac80211/patches/rt2x00/600-13-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
index 0bb2d3357..7a8d1c06b 100644
--- a/package/kernel/mac80211/patches/600-13-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-13-rt2x00-rt2800lib-add-channel-configuration-code-for-.patch
@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -3738,6 +3738,36 @@ static char rt2800_txpower_to_dev(struct
+@@ -3741,6 +3741,36 @@ static char rt2800_txpower_to_dev(struct
  		return clamp_t(char, txpower, MIN_A_TXPOWER, MAX_A_TXPOWER);
  }
  
@@ -47,7 +47,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
  				  struct ieee80211_conf *conf,
  				  struct rf_channel *rf,
-@@ -3756,6 +3786,12 @@ static void rt2800_config_channel(struct
+@@ -3759,6 +3789,12 @@ static void rt2800_config_channel(struct
  			rt2800_txpower_to_dev(rt2x00dev, rf->channel,
  					      info->default_power3);
  
@@ -60,7 +60,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  	switch (rt2x00dev->chip.rf) {
  	case RF2020:
  	case RF3020:
-@@ -3860,6 +3896,15 @@ static void rt2800_config_channel(struct
+@@ -3863,6 +3899,15 @@ static void rt2800_config_channel(struct
  		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
  		rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
  		rt2800_bbp_write(rt2x00dev, 77, 0x98);
@@ -76,7 +76,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  	} else {
  		rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
  		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
-@@ -3873,6 +3918,7 @@ static void rt2800_config_channel(struct
+@@ -3876,6 +3921,7 @@ static void rt2800_config_channel(struct
  		    !rt2x00_rt(rt2x00dev, RT6352)) {
  			if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
  				rt2800_bbp_write(rt2x00dev, 82, 0x62);
@@ -84,7 +84,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  				rt2800_bbp_write(rt2x00dev, 75, 0x46);
  			} else {
  				if (rt2x00_rt(rt2x00dev, RT3593))
-@@ -3881,19 +3927,22 @@ static void rt2800_config_channel(struct
+@@ -3884,19 +3930,22 @@ static void rt2800_config_channel(struct
  					rt2800_bbp_write(rt2x00dev, 82, 0x84);
  				rt2800_bbp_write(rt2x00dev, 75, 0x50);
  			}
@@ -110,7 +110,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  			rt2800_bbp_write(rt2x00dev, 83, 0x9a);
  
  		if (rt2x00_has_cap_external_lna_a(rt2x00dev))
-@@ -4019,6 +4068,23 @@ static void rt2800_config_channel(struct
+@@ -4022,6 +4071,23 @@ static void rt2800_config_channel(struct
  
  		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
  
diff --git a/package/kernel/mac80211/patches/600-14-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch b/package/kernel/mac80211/patches/rt2x00/600-14-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
similarity index 94%
rename from package/kernel/mac80211/patches/600-14-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
rename to package/kernel/mac80211/patches/rt2x00/600-14-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
index 56157510e..723f0b769 100644
--- a/package/kernel/mac80211/patches/600-14-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-14-rt2x00-rt2800lib-fix-txpower_to_dev-function-for-RT3.patch
@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -3725,13 +3725,15 @@ static char rt2800_txpower_to_dev(struct
+@@ -3728,13 +3728,15 @@ static char rt2800_txpower_to_dev(struct
  				  unsigned int channel,
  				  char txpower)
  {
diff --git a/package/kernel/mac80211/patches/600-15-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch b/package/kernel/mac80211/patches/rt2x00/600-15-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
similarity index 93%
rename from package/kernel/mac80211/patches/600-15-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
rename to package/kernel/mac80211/patches/rt2x00/600-15-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
index c1409bcfa..c7d37e8bd 100644
--- a/package/kernel/mac80211/patches/600-15-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-15-rt2x00-rt2800lib-use-correct-txpower-calculation-fun.patch
@@ -11,7 +11,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -5111,7 +5111,8 @@ static void rt2800_config_txpower(struct
+@@ -5114,7 +5114,8 @@ static void rt2800_config_txpower(struct
  				  struct ieee80211_channel *chan,
  				  int power_level)
  {
diff --git a/package/kernel/mac80211/patches/600-16-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch b/package/kernel/mac80211/patches/rt2x00/600-16-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
similarity index 87%
rename from package/kernel/mac80211/patches/600-16-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
rename to package/kernel/mac80211/patches/rt2x00/600-16-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
index a4ccb2851..d4b5f4ce0 100644
--- a/package/kernel/mac80211/patches/600-16-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-16-rt2x00-rt2800lib-hardcode-txmixer-gain-values-to-zer.patch
@@ -11,7 +11,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8965,7 +8965,8 @@ static u8 rt2800_get_txmixer_gain_24g(st
+@@ -8969,7 +8969,8 @@ static u8 rt2800_get_txmixer_gain_24g(st
  {
  	u16 word;
  
@@ -21,7 +21,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  		return 0;
  
  	word = rt2800_eeprom_read(rt2x00dev, EEPROM_TXMIXER_GAIN_BG);
-@@ -8979,7 +8980,8 @@ static u8 rt2800_get_txmixer_gain_5g(str
+@@ -8983,7 +8984,8 @@ static u8 rt2800_get_txmixer_gain_5g(str
  {
  	u16 word;
  
diff --git a/package/kernel/mac80211/patches/600-17-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch b/package/kernel/mac80211/patches/rt2x00/600-17-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch
similarity index 100%
rename from package/kernel/mac80211/patches/600-17-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch
rename to package/kernel/mac80211/patches/rt2x00/600-17-rt2x00-rt2800lib-use-correct-RT-XWI-size-for-RT3883.patch
diff --git a/package/kernel/mac80211/patches/600-18-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch b/package/kernel/mac80211/patches/rt2x00/600-18-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
similarity index 92%
rename from package/kernel/mac80211/patches/600-18-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
rename to package/kernel/mac80211/patches/rt2x00/600-18-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
index 24c0ef91b..0b5541a4f 100644
--- a/package/kernel/mac80211/patches/600-18-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-18-rt2x00-rt2800lib-fix-antenna-configuration-for-RT388.patch
@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -2017,7 +2017,8 @@ void rt2800_config_ant(struct rt2x00_dev
+@@ -2020,7 +2020,8 @@ void rt2800_config_ant(struct rt2x00_dev
  	rt2800_bbp_write(rt2x00dev, 3, r3);
  	rt2800_bbp_write(rt2x00dev, 1, r1);
  
diff --git a/package/kernel/mac80211/patches/600-19-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch b/package/kernel/mac80211/patches/rt2x00/600-19-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
similarity index 90%
rename from package/kernel/mac80211/patches/600-19-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
rename to package/kernel/mac80211/patches/rt2x00/600-19-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
index 52733ffeb..4c0c88258 100644
--- a/package/kernel/mac80211/patches/600-19-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-19-rt2x00-rt2800lib-fix-LNA-gain-configuration-for-RT38.patch
@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -2040,7 +2040,8 @@ static void rt2800_config_lna_gain(struc
+@@ -2043,7 +2043,8 @@ static void rt2800_config_lna_gain(struc
  		eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_LNA);
  		lna_gain = rt2x00_get_field16(eeprom, EEPROM_LNA_A0);
  	} else if (libconf->rf.channel <= 128) {
@@ -20,7 +20,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  			eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_EXT_LNA2);
  			lna_gain = rt2x00_get_field16(eeprom,
  						      EEPROM_EXT_LNA2_A1);
-@@ -2050,7 +2051,8 @@ static void rt2800_config_lna_gain(struc
+@@ -2053,7 +2054,8 @@ static void rt2800_config_lna_gain(struc
  						      EEPROM_RSSI_BG2_LNA_A1);
  		}
  	} else {
diff --git a/package/kernel/mac80211/patches/600-20-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch b/package/kernel/mac80211/patches/rt2x00/600-20-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
similarity index 87%
rename from package/kernel/mac80211/patches/600-20-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
rename to package/kernel/mac80211/patches/rt2x00/600-20-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
index 301928d28..749d2bd62 100644
--- a/package/kernel/mac80211/patches/600-20-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-20-rt2x00-rt2800lib-fix-VGC-setup-for-RT3883.patch
@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -5364,7 +5364,8 @@ static u8 rt2800_get_default_vgc(struct
+@@ -5367,7 +5367,8 @@ static u8 rt2800_get_default_vgc(struct
  		else
  			vgc = 0x2e + rt2x00dev->lna_gain;
  	} else { /* 5GHZ band */
@@ -20,7 +20,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  			vgc = 0x20 + (rt2x00dev->lna_gain * 5) / 3;
  		else if (rt2x00_rt(rt2x00dev, RT5592))
  			vgc = 0x24 + (2 * rt2x00dev->lna_gain);
-@@ -5384,7 +5385,8 @@ static inline void rt2800_set_vgc(struct
+@@ -5387,7 +5388,8 @@ static inline void rt2800_set_vgc(struct
  {
  	if (qual->vgc_level != vgc_level) {
  		if (rt2x00_rt(rt2x00dev, RT3572) ||
@@ -30,7 +30,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  			rt2800_bbp_write_with_rx_chain(rt2x00dev, 66,
  						       vgc_level);
  		} else if (rt2x00_rt(rt2x00dev, RT5592)) {
-@@ -5431,6 +5433,11 @@ void rt2800_link_tuner(struct rt2x00_dev
+@@ -5434,6 +5436,11 @@ void rt2800_link_tuner(struct rt2x00_dev
  		}
  		break;
  
diff --git a/package/kernel/mac80211/patches/600-21-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch b/package/kernel/mac80211/patches/rt2x00/600-21-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
similarity index 90%
rename from package/kernel/mac80211/patches/600-21-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
rename to package/kernel/mac80211/patches/rt2x00/600-21-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
index 4bbc7ae44..d6e9dd0c4 100644
--- a/package/kernel/mac80211/patches/600-21-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-21-rt2x00-rt2800lib-fix-EEPROM-LNA-validation-for-RT388.patch
@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -9098,7 +9098,8 @@ static int rt2800_validate_eeprom(struct
+@@ -9102,7 +9102,8 @@ static int rt2800_validate_eeprom(struct
  	word = rt2800_eeprom_read(rt2x00dev, EEPROM_RSSI_BG2);
  	if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG2_OFFSET2)) > 10)
  		rt2x00_set_field16(&word, EEPROM_RSSI_BG2_OFFSET2, 0);
@@ -20,7 +20,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  		if (rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0x00 ||
  		    rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0xff)
  			rt2x00_set_field16(&word, EEPROM_RSSI_BG2_LNA_A1,
-@@ -9118,7 +9119,8 @@ static int rt2800_validate_eeprom(struct
+@@ -9122,7 +9123,8 @@ static int rt2800_validate_eeprom(struct
  	word = rt2800_eeprom_read(rt2x00dev, EEPROM_RSSI_A2);
  	if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A2_OFFSET2)) > 10)
  		rt2x00_set_field16(&word, EEPROM_RSSI_A2_OFFSET2, 0);
@@ -30,7 +30,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  		if (rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0x00 ||
  		    rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0xff)
  			rt2x00_set_field16(&word, EEPROM_RSSI_A2_LNA_A2,
-@@ -9126,7 +9128,8 @@ static int rt2800_validate_eeprom(struct
+@@ -9130,7 +9132,8 @@ static int rt2800_validate_eeprom(struct
  	}
  	rt2800_eeprom_write(rt2x00dev, EEPROM_RSSI_A2, word);
  
diff --git a/package/kernel/mac80211/patches/600-22-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch b/package/kernel/mac80211/patches/rt2x00/600-22-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
similarity index 91%
rename from package/kernel/mac80211/patches/600-22-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
rename to package/kernel/mac80211/patches/rt2x00/600-22-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
index e752efd0e..3fe503aaf 100644
--- a/package/kernel/mac80211/patches/600-22-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
+++ b/package/kernel/mac80211/patches/rt2x00/600-22-rt2x00-rt2800lib-fix-txpower-compensation-for-RT3883.patch
@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -4354,6 +4354,9 @@ static u8 rt2800_compensate_txpower(stru
+@@ -4357,6 +4357,9 @@ static u8 rt2800_compensate_txpower(stru
  	if (rt2x00_rt(rt2x00dev, RT3593))
  		return min_t(u8, txpower, 0xc);
  
diff --git a/package/kernel/mac80211/patches/601-rt2x00-introduce-rt2x00_platform_h.patch b/package/kernel/mac80211/patches/rt2x00/601-rt2x00-introduce-rt2x00_platform_h.patch
similarity index 100%
rename from package/kernel/mac80211/patches/601-rt2x00-introduce-rt2x00_platform_h.patch
rename to package/kernel/mac80211/patches/rt2x00/601-rt2x00-introduce-rt2x00_platform_h.patch
diff --git a/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00eeprom.patch b/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
similarity index 98%
rename from package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00eeprom.patch
rename to package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
index 86a95a09f..d238072b9 100644
--- a/package/kernel/mac80211/patches/602-rt2x00-introduce-rt2x00eeprom.patch
+++ b/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
@@ -1,6 +1,6 @@
 --- a/local-symbols
 +++ b/local-symbols
-@@ -299,6 +299,7 @@ RT2X00_LIB_FIRMWARE=
+@@ -305,6 +305,7 @@ RT2X00_LIB_FIRMWARE=
  RT2X00_LIB_CRYPTO=
  RT2X00_LIB_LEDS=
  RT2X00_LIB_DEBUGFS=
@@ -38,7 +38,7 @@
  	default y if (RT2X00_LIB=y && LEDS_CLASS=y) || (RT2X00_LIB=m && LEDS_CLASS!=n)
 --- a/drivers/net/wireless/ralink/rt2x00/Makefile
 +++ b/drivers/net/wireless/ralink/rt2x00/Makefile
-@@ -7,6 +7,7 @@ rt2x00lib-$(CPTCFG_RT2X00_LIB_DEBUGFS)	+
+@@ -8,6 +8,7 @@ rt2x00lib-$(CPTCFG_RT2X00_LIB_DEBUGFS)	+
  rt2x00lib-$(CPTCFG_RT2X00_LIB_CRYPTO)	+= rt2x00crypto.o
  rt2x00lib-$(CPTCFG_RT2X00_LIB_FIRMWARE)	+= rt2x00firmware.o
  rt2x00lib-$(CPTCFG_RT2X00_LIB_LEDS)	+= rt2x00leds.o
diff --git a/package/kernel/mac80211/patches/603-rt2x00-of_load_eeprom_filename.patch b/package/kernel/mac80211/patches/rt2x00/603-rt2x00-of_load_eeprom_filename.patch
similarity index 100%
rename from package/kernel/mac80211/patches/603-rt2x00-of_load_eeprom_filename.patch
rename to package/kernel/mac80211/patches/rt2x00/603-rt2x00-of_load_eeprom_filename.patch
diff --git a/package/kernel/mac80211/patches/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch b/package/kernel/mac80211/patches/rt2x00/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
similarity index 100%
rename from package/kernel/mac80211/patches/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
rename to package/kernel/mac80211/patches/rt2x00/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
diff --git a/package/kernel/mac80211/patches/606-rt2x00-allow_disabling_bands_through_platform_data.patch b/package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch
similarity index 100%
rename from package/kernel/mac80211/patches/606-rt2x00-allow_disabling_bands_through_platform_data.patch
rename to package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch
diff --git a/package/kernel/mac80211/patches/607-rt2x00-add_platform_data_mac_addr.patch b/package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch
similarity index 100%
rename from package/kernel/mac80211/patches/607-rt2x00-add_platform_data_mac_addr.patch
rename to package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch
diff --git a/package/kernel/mac80211/patches/608-rt2x00-allow_disabling_bands_through_dts.patch b/package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch
similarity index 100%
rename from package/kernel/mac80211/patches/608-rt2x00-allow_disabling_bands_through_dts.patch
rename to package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch
diff --git a/package/kernel/mac80211/patches/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch b/package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
similarity index 94%
rename from package/kernel/mac80211/patches/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
rename to package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
index 02b66e3bc..ed219c801 100644
--- a/package/kernel/mac80211/patches/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
+++ b/package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
@@ -13,7 +13,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
-@@ -234,10 +234,17 @@ static int rt2800soc_probe(struct platfo
+@@ -232,10 +232,17 @@ static int rt2800soc_probe(struct platfo
  	return rt2x00soc_probe(pdev, &rt2800soc_ops);
  }
  
diff --git a/package/kernel/mac80211/patches/610-rt2x00-change-led-polarity-from-OF.patch b/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
similarity index 95%
rename from package/kernel/mac80211/patches/610-rt2x00-change-led-polarity-from-OF.patch
rename to package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
index ad70aa782..3d6b33518 100644
--- a/package/kernel/mac80211/patches/610-rt2x00-change-led-polarity-from-OF.patch
+++ b/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
@@ -8,7 +8,7 @@
  
  #include "rt2x00.h"
  #include "rt2800lib.h"
-@@ -9285,6 +9286,17 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9291,6 +9292,17 @@ static int rt2800_init_eeprom(struct rt2
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_assoc, LED_TYPE_ASSOC);
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_qual, LED_TYPE_QUALITY);
  
diff --git a/package/kernel/mac80211/patches/611-rt2x00-add-AP+STA-support.patch b/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
similarity index 100%
rename from package/kernel/mac80211/patches/611-rt2x00-add-AP+STA-support.patch
rename to package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
diff --git a/package/kernel/mac80211/patches/650-rt2x00-add-support-for-external-PA-on-MT7620.patch b/package/kernel/mac80211/patches/rt2x00/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
similarity index 94%
rename from package/kernel/mac80211/patches/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
rename to package/kernel/mac80211/patches/rt2x00/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
index 9fad80b67..7f80e110a 100644
--- a/package/kernel/mac80211/patches/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
+++ b/package/kernel/mac80211/patches/rt2x00/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
@@ -15,7 +15,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
-@@ -2749,6 +2749,7 @@ enum rt2800_eeprom_word {
+@@ -2750,6 +2750,7 @@ enum rt2800_eeprom_word {
  #define EEPROM_NIC_CONF2_RX_STREAM	FIELD16(0x000f)
  #define EEPROM_NIC_CONF2_TX_STREAM	FIELD16(0x00f0)
  #define EEPROM_NIC_CONF2_CRYSTAL	FIELD16(0x0600)
@@ -25,7 +25,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
   * EEPROM LNA
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -4120,6 +4120,61 @@ static void rt2800_config_channel(struct
+@@ -4123,6 +4123,61 @@ static void rt2800_config_channel(struct
  		rt2800_iq_calibrate(rt2x00dev, rf->channel);
  	}
  
@@ -87,7 +87,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	bbp = rt2800_bbp_read(rt2x00dev, 4);
  	rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * conf_is_ht40(conf));
  	rt2800_bbp_write(rt2x00dev, 4, bbp);
-@@ -9314,7 +9369,8 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9320,7 +9375,8 @@ static int rt2800_init_eeprom(struct rt2
  	 */
  	eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1);
  
@@ -97,7 +97,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		if (rt2x00_get_field16(eeprom,
  		    EEPROM_NIC_CONF1_EXTERNAL_TX0_PA_3352))
  		    __set_bit(CAPABILITY_EXTERNAL_PA_TX0,
-@@ -9325,6 +9381,18 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9331,6 +9387,18 @@ static int rt2800_init_eeprom(struct rt2
  			      &rt2x00dev->cap_flags);
  	}
  
diff --git a/package/kernel/mac80211/patches/651-rt2x00-remove-unneccesary-code.patch b/package/kernel/mac80211/patches/rt2x00/651-rt2x00-remove-unneccesary-code.patch
similarity index 99%
rename from package/kernel/mac80211/patches/651-rt2x00-remove-unneccesary-code.patch
rename to package/kernel/mac80211/patches/rt2x00/651-rt2x00-remove-unneccesary-code.patch
index 475fcbc22..eb4996350 100644
--- a/package/kernel/mac80211/patches/651-rt2x00-remove-unneccesary-code.patch
+++ b/package/kernel/mac80211/patches/rt2x00/651-rt2x00-remove-unneccesary-code.patch
@@ -75,7 +75,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -4133,38 +4133,22 @@ static void rt2800_config_channel(struct
+@@ -4136,38 +4136,22 @@ static void rt2800_config_channel(struct
  			reg |= 0x00000101;
  			rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
  
diff --git a/package/kernel/mac80211/patches/rt2x00/701-rt2800-move-usb-specific-txdone-txstatus-routines-to.patch b/package/kernel/mac80211/patches/rt2x00/701-rt2800-move-usb-specific-txdone-txstatus-routines-to.patch
new file mode 100644
index 000000000..12abf8fde
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/701-rt2800-move-usb-specific-txdone-txstatus-routines-to.patch
@@ -0,0 +1,356 @@
+From 0381bfbc400ce4c3000b0b31c577ad9e8071e4f6 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Fri, 18 May 2018 12:25:08 +0200
+Subject: [PATCH 1/5] rt2800: move usb specific txdone/txstatus routines to
+ rt2800lib
+
+In order to reuse usb txdone/txstatus routines for mmio, move them
+to common rt2800lib.c file.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 138 +++++++++++++++++
+ .../net/wireless/ralink/rt2x00/rt2800lib.h    |   3 +
+ .../net/wireless/ralink/rt2x00/rt2800usb.c    | 143 +-----------------
+ 3 files changed, 145 insertions(+), 139 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -960,6 +960,47 @@ static void rt2800_rate_from_status(stru
+ 	skbdesc->tx_rate_flags = flags;
+ }
+ 
++static bool rt2800_txdone_entry_check(struct queue_entry *entry, u32 reg)
++{
++	__le32 *txwi;
++	u32 word;
++	int wcid, ack, pid;
++	int tx_wcid, tx_ack, tx_pid, is_agg;
++
++	/*
++	 * This frames has returned with an IO error,
++	 * so the status report is not intended for this
++	 * frame.
++	 */
++	if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
++		return false;
++
++	wcid	= rt2x00_get_field32(reg, TX_STA_FIFO_WCID);
++	ack	= rt2x00_get_field32(reg, TX_STA_FIFO_TX_ACK_REQUIRED);
++	pid	= rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE);
++	is_agg	= rt2x00_get_field32(reg, TX_STA_FIFO_TX_AGGRE);
++
++	/*
++	 * Validate if this TX status report is intended for
++	 * this entry by comparing the WCID/ACK/PID fields.
++	 */
++	txwi = rt2800_drv_get_txwi(entry);
++
++	word = rt2x00_desc_read(txwi, 1);
++	tx_wcid = rt2x00_get_field32(word, TXWI_W1_WIRELESS_CLI_ID);
++	tx_ack  = rt2x00_get_field32(word, TXWI_W1_ACK);
++	tx_pid  = rt2x00_get_field32(word, TXWI_W1_PACKETID);
++
++	if (wcid != tx_wcid || ack != tx_ack || (!is_agg && pid != tx_pid)) {
++		rt2x00_dbg(entry->queue->rt2x00dev,
++			   "TX status report missed for queue %d entry %d\n",
++			   entry->queue->qid, entry->entry_idx);
++		return false;
++	}
++
++	return true;
++}
++
+ void rt2800_txdone_entry(struct queue_entry *entry, u32 status, __le32 *txwi,
+ 			 bool match)
+ {
+@@ -1062,6 +1103,103 @@ void rt2800_txdone_entry(struct queue_en
+ }
+ EXPORT_SYMBOL_GPL(rt2800_txdone_entry);
+ 
++void rt2800_txdone(struct rt2x00_dev *rt2x00dev)
++{
++	struct data_queue *queue;
++	struct queue_entry *entry;
++	u32 reg;
++	u8 qid;
++	bool match;
++
++	while (kfifo_get(&rt2x00dev->txstatus_fifo, &reg)) {
++		/*
++		 * TX_STA_FIFO_PID_QUEUE is a 2-bit field, thus qid is
++		 * guaranteed to be one of the TX QIDs .
++		 */
++		qid = rt2x00_get_field32(reg, TX_STA_FIFO_PID_QUEUE);
++		queue = rt2x00queue_get_tx_queue(rt2x00dev, qid);
++
++		if (unlikely(rt2x00queue_empty(queue))) {
++			rt2x00_dbg(rt2x00dev, "Got TX status for an empty queue %u, dropping\n",
++				   qid);
++			break;
++		}
++
++		entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
++
++		if (unlikely(test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
++			     !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))) {
++			rt2x00_warn(rt2x00dev, "Data pending for entry %u in queue %u\n",
++				    entry->entry_idx, qid);
++			break;
++		}
++
++		match = rt2800_txdone_entry_check(entry, reg);
++		rt2800_txdone_entry(entry, reg, rt2800_drv_get_txwi(entry), match);
++	}
++}
++EXPORT_SYMBOL_GPL(rt2800_txdone);
++
++static inline bool rt2800_entry_txstatus_timeout(struct queue_entry *entry)
++{
++	bool tout;
++
++	if (!test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
++		return false;
++
++	tout = time_after(jiffies, entry->last_action + msecs_to_jiffies(500));
++	if (unlikely(tout))
++		rt2x00_dbg(entry->queue->rt2x00dev,
++			   "TX status timeout for entry %d in queue %d\n",
++			   entry->entry_idx, entry->queue->qid);
++	return tout;
++
++}
++
++bool rt2800_txstatus_timeout(struct rt2x00_dev *rt2x00dev)
++{
++	struct data_queue *queue;
++	struct queue_entry *entry;
++
++	tx_queue_for_each(rt2x00dev, queue) {
++		entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
++		if (rt2800_entry_txstatus_timeout(entry))
++			return true;
++	}
++	return false;
++}
++EXPORT_SYMBOL_GPL(rt2800_txstatus_timeout);
++
++void rt2800_txdone_nostatus(struct rt2x00_dev *rt2x00dev)
++{
++	struct data_queue *queue;
++	struct queue_entry *entry;
++
++	/*
++	 * Process any trailing TX status reports for IO failures,
++	 * we loop until we find the first non-IO error entry. This
++	 * can either be a frame which is free, is being uploaded,
++	 * or has completed the upload but didn't have an entry
++	 * in the TX_STAT_FIFO register yet.
++	 */
++	tx_queue_for_each(rt2x00dev, queue) {
++		while (!rt2x00queue_empty(queue)) {
++			entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
++
++			if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
++			    !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
++				break;
++
++			if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags) ||
++			    rt2800_entry_txstatus_timeout(entry))
++				rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
++			else
++				break;
++		}
++	}
++}
++EXPORT_SYMBOL_GPL(rt2800_txdone_nostatus);
++
+ static unsigned int rt2800_hw_beacon_base(struct rt2x00_dev *rt2x00dev,
+ 					  unsigned int index)
+ {
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+@@ -206,6 +206,9 @@ void rt2800_process_rxwi(struct queue_en
+ 
+ void rt2800_txdone_entry(struct queue_entry *entry, u32 status, __le32 *txwi,
+ 			 bool match);
++void rt2800_txdone(struct rt2x00_dev *rt2x00dev);
++void rt2800_txdone_nostatus(struct rt2x00_dev *rt2x00dev);
++bool rt2800_txstatus_timeout(struct rt2x00_dev *rt2x00dev);
+ 
+ void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc);
+ void rt2800_clear_beacon(struct queue_entry *entry);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
+@@ -116,35 +116,6 @@ static bool rt2800usb_txstatus_pending(s
+ 	return false;
+ }
+ 
+-static inline bool rt2800usb_entry_txstatus_timeout(struct queue_entry *entry)
+-{
+-	bool tout;
+-
+-	if (!test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
+-		return false;
+-
+-	tout = time_after(jiffies, entry->last_action + msecs_to_jiffies(500));
+-	if (unlikely(tout))
+-		rt2x00_dbg(entry->queue->rt2x00dev,
+-			   "TX status timeout for entry %d in queue %d\n",
+-			   entry->entry_idx, entry->queue->qid);
+-	return tout;
+-
+-}
+-
+-static bool rt2800usb_txstatus_timeout(struct rt2x00_dev *rt2x00dev)
+-{
+-	struct data_queue *queue;
+-	struct queue_entry *entry;
+-
+-	tx_queue_for_each(rt2x00dev, queue) {
+-		entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+-		if (rt2800usb_entry_txstatus_timeout(entry))
+-			return true;
+-	}
+-	return false;
+-}
+-
+ #define TXSTATUS_READ_INTERVAL 1000000
+ 
+ static bool rt2800usb_tx_sta_fifo_read_completed(struct rt2x00_dev *rt2x00dev,
+@@ -171,7 +142,7 @@ static bool rt2800usb_tx_sta_fifo_read_c
+ 	}
+ 
+ 	/* Check if there is any entry that timedout waiting on TX status */
+-	if (rt2800usb_txstatus_timeout(rt2x00dev))
++	if (rt2800_txstatus_timeout(rt2x00dev))
+ 		queue_work(rt2x00dev->workqueue, &rt2x00dev->txdone_work);
+ 
+ 	if (rt2800usb_txstatus_pending(rt2x00dev)) {
+@@ -501,123 +472,17 @@ static int rt2800usb_get_tx_data_len(str
+ /*
+  * TX control handlers
+  */
+-static bool rt2800usb_txdone_entry_check(struct queue_entry *entry, u32 reg)
+-{
+-	__le32 *txwi;
+-	u32 word;
+-	int wcid, ack, pid;
+-	int tx_wcid, tx_ack, tx_pid, is_agg;
+-
+-	/*
+-	 * This frames has returned with an IO error,
+-	 * so the status report is not intended for this
+-	 * frame.
+-	 */
+-	if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
+-		return false;
+-
+-	wcid	= rt2x00_get_field32(reg, TX_STA_FIFO_WCID);
+-	ack	= rt2x00_get_field32(reg, TX_STA_FIFO_TX_ACK_REQUIRED);
+-	pid	= rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE);
+-	is_agg	= rt2x00_get_field32(reg, TX_STA_FIFO_TX_AGGRE);
+-
+-	/*
+-	 * Validate if this TX status report is intended for
+-	 * this entry by comparing the WCID/ACK/PID fields.
+-	 */
+-	txwi = rt2800usb_get_txwi(entry);
+-
+-	word = rt2x00_desc_read(txwi, 1);
+-	tx_wcid = rt2x00_get_field32(word, TXWI_W1_WIRELESS_CLI_ID);
+-	tx_ack  = rt2x00_get_field32(word, TXWI_W1_ACK);
+-	tx_pid  = rt2x00_get_field32(word, TXWI_W1_PACKETID);
+-
+-	if (wcid != tx_wcid || ack != tx_ack || (!is_agg && pid != tx_pid)) {
+-		rt2x00_dbg(entry->queue->rt2x00dev,
+-			   "TX status report missed for queue %d entry %d\n",
+-			   entry->queue->qid, entry->entry_idx);
+-		return false;
+-	}
+-
+-	return true;
+-}
+-
+-static void rt2800usb_txdone(struct rt2x00_dev *rt2x00dev)
+-{
+-	struct data_queue *queue;
+-	struct queue_entry *entry;
+-	u32 reg;
+-	u8 qid;
+-	bool match;
+-
+-	while (kfifo_get(&rt2x00dev->txstatus_fifo, &reg)) {
+-		/*
+-		 * TX_STA_FIFO_PID_QUEUE is a 2-bit field, thus qid is
+-		 * guaranteed to be one of the TX QIDs .
+-		 */
+-		qid = rt2x00_get_field32(reg, TX_STA_FIFO_PID_QUEUE);
+-		queue = rt2x00queue_get_tx_queue(rt2x00dev, qid);
+-
+-		if (unlikely(rt2x00queue_empty(queue))) {
+-			rt2x00_dbg(rt2x00dev, "Got TX status for an empty queue %u, dropping\n",
+-				   qid);
+-			break;
+-		}
+-
+-		entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+-
+-		if (unlikely(test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
+-			     !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))) {
+-			rt2x00_warn(rt2x00dev, "Data pending for entry %u in queue %u\n",
+-				    entry->entry_idx, qid);
+-			break;
+-		}
+-
+-		match = rt2800usb_txdone_entry_check(entry, reg);
+-		rt2800_txdone_entry(entry, reg, rt2800usb_get_txwi(entry), match);
+-	}
+-}
+-
+-static void rt2800usb_txdone_nostatus(struct rt2x00_dev *rt2x00dev)
+-{
+-	struct data_queue *queue;
+-	struct queue_entry *entry;
+-
+-	/*
+-	 * Process any trailing TX status reports for IO failures,
+-	 * we loop until we find the first non-IO error entry. This
+-	 * can either be a frame which is free, is being uploaded,
+-	 * or has completed the upload but didn't have an entry
+-	 * in the TX_STAT_FIFO register yet.
+-	 */
+-	tx_queue_for_each(rt2x00dev, queue) {
+-		while (!rt2x00queue_empty(queue)) {
+-			entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+-
+-			if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
+-			    !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
+-				break;
+-
+-			if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags) ||
+-			    rt2800usb_entry_txstatus_timeout(entry))
+-				rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
+-			else
+-				break;
+-		}
+-	}
+-}
+-
+ static void rt2800usb_work_txdone(struct work_struct *work)
+ {
+ 	struct rt2x00_dev *rt2x00dev =
+ 	    container_of(work, struct rt2x00_dev, txdone_work);
+ 
+ 	while (!kfifo_is_empty(&rt2x00dev->txstatus_fifo) ||
+-	       rt2800usb_txstatus_timeout(rt2x00dev)) {
++	       rt2800_txstatus_timeout(rt2x00dev)) {
+ 
+-		rt2800usb_txdone(rt2x00dev);
++		rt2800_txdone(rt2x00dev);
+ 
+-		rt2800usb_txdone_nostatus(rt2x00dev);
++		rt2800_txdone_nostatus(rt2x00dev);
+ 
+ 		/*
+ 		 * The hw may delay sending the packet after DMA complete
diff --git a/package/kernel/mac80211/patches/rt2x00/702-rt2800mmio-use-txdone-txstatus-routines-from-lib.patch b/package/kernel/mac80211/patches/rt2x00/702-rt2800mmio-use-txdone-txstatus-routines-from-lib.patch
new file mode 100644
index 000000000..9f7f65da3
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/702-rt2800mmio-use-txdone-txstatus-routines-from-lib.patch
@@ -0,0 +1,243 @@
+From 7993486bbab17f8916993710a8660eb47fd991e9 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Mon, 9 Jul 2018 16:07:42 +0200
+Subject: [PATCH 2/5] rt2800mmio: use txdone/txstatus routines from lib
+
+Use usb txdone/txstatus routines (now in rt2800libc) for mmio devices.
+
+Note this also change how we handle INT_SOURCE_CSR_TX_FIFO_STATUS
+interrupt. Now it is disabled since IRQ routine till end of the txstatus
+tasklet (the same behaviour like others interrupts). Reason to do not
+disable this interrupt was not to miss any tx status from 16 entries
+FIFO register. Now, since we check for tx status timeout, we can
+allow to miss some tx statuses. However this will be improved in further
+patch where I also implement read status FIFO register in the tasklet.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ .../net/wireless/ralink/rt2x00/rt2800mmio.c   | 180 +-----------------
+ .../net/wireless/ralink/rt2x00/rt2x00queue.c  |   1 +
+ 2 files changed, 9 insertions(+), 172 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
+@@ -175,161 +175,6 @@ static void rt2800mmio_wakeup(struct rt2
+ 	rt2800_config(rt2x00dev, &libconf, IEEE80211_CONF_CHANGE_PS);
+ }
+ 
+-static bool rt2800mmio_txdone_entry_check(struct queue_entry *entry, u32 status)
+-{
+-	__le32 *txwi;
+-	u32 word;
+-	int wcid, tx_wcid;
+-
+-	wcid = rt2x00_get_field32(status, TX_STA_FIFO_WCID);
+-
+-	txwi = rt2800_drv_get_txwi(entry);
+-	word = rt2x00_desc_read(txwi, 1);
+-	tx_wcid = rt2x00_get_field32(word, TXWI_W1_WIRELESS_CLI_ID);
+-
+-	return (tx_wcid == wcid);
+-}
+-
+-static bool rt2800mmio_txdone_find_entry(struct queue_entry *entry, void *data)
+-{
+-	u32 status = *(u32 *)data;
+-
+-	/*
+-	 * rt2800pci hardware might reorder frames when exchanging traffic
+-	 * with multiple BA enabled STAs.
+-	 *
+-	 * For example, a tx queue
+-	 *    [ STA1 | STA2 | STA1 | STA2 ]
+-	 * can result in tx status reports
+-	 *    [ STA1 | STA1 | STA2 | STA2 ]
+-	 * when the hw decides to aggregate the frames for STA1 into one AMPDU.
+-	 *
+-	 * To mitigate this effect, associate the tx status to the first frame
+-	 * in the tx queue with a matching wcid.
+-	 */
+-	if (rt2800mmio_txdone_entry_check(entry, status) &&
+-	    !test_bit(ENTRY_DATA_STATUS_SET, &entry->flags)) {
+-		/*
+-		 * Got a matching frame, associate the tx status with
+-		 * the frame
+-		 */
+-		entry->status = status;
+-		set_bit(ENTRY_DATA_STATUS_SET, &entry->flags);
+-		return true;
+-	}
+-
+-	/* Check the next frame */
+-	return false;
+-}
+-
+-static bool rt2800mmio_txdone_match_first(struct queue_entry *entry, void *data)
+-{
+-	u32 status = *(u32 *)data;
+-
+-	/*
+-	 * Find the first frame without tx status and assign this status to it
+-	 * regardless if it matches or not.
+-	 */
+-	if (!test_bit(ENTRY_DATA_STATUS_SET, &entry->flags)) {
+-		/*
+-		 * Got a matching frame, associate the tx status with
+-		 * the frame
+-		 */
+-		entry->status = status;
+-		set_bit(ENTRY_DATA_STATUS_SET, &entry->flags);
+-		return true;
+-	}
+-
+-	/* Check the next frame */
+-	return false;
+-}
+-static bool rt2800mmio_txdone_release_entries(struct queue_entry *entry,
+-					      void *data)
+-{
+-	if (test_bit(ENTRY_DATA_STATUS_SET, &entry->flags)) {
+-		rt2800_txdone_entry(entry, entry->status,
+-				    rt2800mmio_get_txwi(entry), true);
+-		return false;
+-	}
+-
+-	/* No more frames to release */
+-	return true;
+-}
+-
+-static bool rt2800mmio_txdone(struct rt2x00_dev *rt2x00dev)
+-{
+-	struct data_queue *queue;
+-	u32 status;
+-	u8 qid;
+-	int max_tx_done = 16;
+-
+-	while (kfifo_get(&rt2x00dev->txstatus_fifo, &status)) {
+-		qid = rt2x00_get_field32(status, TX_STA_FIFO_PID_QUEUE);
+-		if (unlikely(qid >= QID_RX)) {
+-			/*
+-			 * Unknown queue, this shouldn't happen. Just drop
+-			 * this tx status.
+-			 */
+-			rt2x00_warn(rt2x00dev, "Got TX status report with unexpected pid %u, dropping\n",
+-				    qid);
+-			break;
+-		}
+-
+-		queue = rt2x00queue_get_tx_queue(rt2x00dev, qid);
+-		if (unlikely(queue == NULL)) {
+-			/*
+-			 * The queue is NULL, this shouldn't happen. Stop
+-			 * processing here and drop the tx status
+-			 */
+-			rt2x00_warn(rt2x00dev, "Got TX status for an unavailable queue %u, dropping\n",
+-				    qid);
+-			break;
+-		}
+-
+-		if (unlikely(rt2x00queue_empty(queue))) {
+-			/*
+-			 * The queue is empty. Stop processing here
+-			 * and drop the tx status.
+-			 */
+-			rt2x00_warn(rt2x00dev, "Got TX status for an empty queue %u, dropping\n",
+-				    qid);
+-			break;
+-		}
+-
+-		/*
+-		 * Let's associate this tx status with the first
+-		 * matching frame.
+-		 */
+-		if (!rt2x00queue_for_each_entry(queue, Q_INDEX_DONE,
+-						Q_INDEX, &status,
+-						rt2800mmio_txdone_find_entry)) {
+-			/*
+-			 * We cannot match the tx status to any frame, so just
+-			 * use the first one.
+-			 */
+-			if (!rt2x00queue_for_each_entry(queue, Q_INDEX_DONE,
+-							Q_INDEX, &status,
+-							rt2800mmio_txdone_match_first)) {
+-				rt2x00_warn(rt2x00dev, "No frame found for TX status on queue %u, dropping\n",
+-					    qid);
+-				break;
+-			}
+-		}
+-
+-		/*
+-		 * Release all frames with a valid tx status.
+-		 */
+-		rt2x00queue_for_each_entry(queue, Q_INDEX_DONE,
+-					   Q_INDEX, NULL,
+-					   rt2800mmio_txdone_release_entries);
+-
+-		if (--max_tx_done == 0)
+-			break;
+-	}
+-
+-	return !max_tx_done;
+-}
+-
+ static inline void rt2800mmio_enable_interrupt(struct rt2x00_dev *rt2x00dev,
+ 					       struct rt2x00_field32 irq_field)
+ {
+@@ -349,14 +194,14 @@ static inline void rt2800mmio_enable_int
+ void rt2800mmio_txstatus_tasklet(unsigned long data)
+ {
+ 	struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
+-	if (rt2800mmio_txdone(rt2x00dev))
+-		tasklet_schedule(&rt2x00dev->txstatus_tasklet);
+ 
+-	/*
+-	 * No need to enable the tx status interrupt here as we always
+-	 * leave it enabled to minimize the possibility of a tx status
+-	 * register overflow. See comment in interrupt handler.
+-	 */
++	rt2800_txdone(rt2x00dev);
++
++	rt2800_txdone_nostatus(rt2x00dev);
++
++	if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
++		rt2800mmio_enable_interrupt(rt2x00dev,
++					    INT_SOURCE_CSR_TX_FIFO_STATUS);
+ }
+ EXPORT_SYMBOL_GPL(rt2800mmio_txstatus_tasklet);
+ 
+@@ -440,10 +285,6 @@ static void rt2800mmio_txstatus_interrup
+ 	 * because we can schedule the tasklet multiple times (when the
+ 	 * interrupt fires again during tx status processing).
+ 	 *
+-	 * Furthermore we don't disable the TX_FIFO_STATUS
+-	 * interrupt here but leave it enabled so that the TX_STA_FIFO
+-	 * can also be read while the tx status tasklet gets executed.
+-	 *
+ 	 * Since we have only one producer and one consumer we don't
+ 	 * need to lock the kfifo.
+ 	 */
+@@ -485,13 +326,8 @@ irqreturn_t rt2800mmio_interrupt(int irq
+ 	 */
+ 	mask = ~reg;
+ 
+-	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS)) {
++	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS))
+ 		rt2800mmio_txstatus_interrupt(rt2x00dev);
+-		/*
+-		 * Never disable the TX_FIFO_STATUS interrupt.
+-		 */
+-		rt2x00_set_field32(&mask, INT_MASK_CSR_TX_FIFO_STATUS, 1);
+-	}
+ 
+ 	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_PRE_TBTT))
+ 		tasklet_hi_schedule(&rt2x00dev->pretbtt_tasklet);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+@@ -113,6 +113,7 @@ int rt2x00queue_map_txskb(struct queue_e
+ 		return -ENOMEM;
+ 
+ 	skbdesc->flags |= SKBDESC_DMA_MAPPED_TX;
++	rt2x00lib_dmadone(entry);
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(rt2x00queue_map_txskb);
diff --git a/package/kernel/mac80211/patches/rt2x00/703-rt2x00-do-not-check-for-txstatus-timeout-every-time-.patch b/package/kernel/mac80211/patches/rt2x00/703-rt2x00-do-not-check-for-txstatus-timeout-every-time-.patch
new file mode 100644
index 000000000..111f4c7e8
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/703-rt2x00-do-not-check-for-txstatus-timeout-every-time-.patch
@@ -0,0 +1,71 @@
+From b5d6e37ea15949a126907050d8cfa4408153a0cd Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Fri, 18 May 2018 12:25:10 +0200
+Subject: [PATCH 3/5] rt2x00: do not check for txstatus timeout every time on
+ tasklet
+
+Do not check for tx status timeout everytime we perform txstatus tasklet.
+Perform check once per half a second.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c   | 7 +++++++
+ drivers/net/wireless/ralink/rt2x00/rt2800mmio.c  | 3 ++-
+ drivers/net/wireless/ralink/rt2x00/rt2x00.h      | 2 ++
+ drivers/net/wireless/ralink/rt2x00/rt2x00queue.c | 1 +
+ 4 files changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -1161,11 +1161,18 @@ bool rt2800_txstatus_timeout(struct rt2x
+ 	struct data_queue *queue;
+ 	struct queue_entry *entry;
+ 
++	if (time_before(jiffies,
++			rt2x00dev->last_nostatus_check + msecs_to_jiffies(500)))
++		return false;
++
++	rt2x00dev->last_nostatus_check = jiffies;
++
+ 	tx_queue_for_each(rt2x00dev, queue) {
+ 		entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+ 		if (rt2800_entry_txstatus_timeout(entry))
+ 			return true;
+ 	}
++
+ 	return false;
+ }
+ EXPORT_SYMBOL_GPL(rt2800_txstatus_timeout);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
+@@ -197,7 +197,8 @@ void rt2800mmio_txstatus_tasklet(unsigne
+ 
+ 	rt2800_txdone(rt2x00dev);
+ 
+-	rt2800_txdone_nostatus(rt2x00dev);
++	if (rt2800_txstatus_timeout(rt2x00dev))
++		rt2800_txdone_nostatus(rt2x00dev);
+ 
+ 	if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
+ 		rt2800mmio_enable_interrupt(rt2x00dev,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -988,6 +988,8 @@ struct rt2x00_dev {
+ 	 */
+ 	DECLARE_KFIFO_PTR(txstatus_fifo, u32);
+ 
++	unsigned long last_nostatus_check;
++
+ 	/*
+ 	 * Timer to ensure tx status reports are read (rt2800usb).
+ 	 */
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+@@ -1039,6 +1039,7 @@ void rt2x00queue_start_queues(struct rt2
+ 	 */
+ 	tx_queue_for_each(rt2x00dev, queue)
+ 		rt2x00queue_start_queue(queue);
++	rt2x00dev->last_nostatus_check = jiffies;
+ 
+ 	rt2x00queue_start_queue(rt2x00dev->rx);
+ }
diff --git a/package/kernel/mac80211/patches/rt2x00/704-rt2x00-use-different-txstatus-timeouts-when-flushing.patch b/package/kernel/mac80211/patches/rt2x00/704-rt2x00-use-different-txstatus-timeouts-when-flushing.patch
new file mode 100644
index 000000000..6c4d42b6f
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/704-rt2x00-use-different-txstatus-timeouts-when-flushing.patch
@@ -0,0 +1,111 @@
+From feb87977b6d251fb01a329905719e45908f6c939 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Fri, 10 Aug 2018 12:31:55 +0200
+Subject: [PATCH 4/5] rt2x00: use different txstatus timeouts when flushing
+
+Use different tx status timeouts for normal operation and when flushing.
+This increase timeout to 2s for normal operation as when there are bad
+radio conditions and frames are reposted many times device can not provide
+the status for quite long. With new timeout we can still get valid status
+on such bad conditions.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 31 +++++++++++++------
+ drivers/net/wireless/ralink/rt2x00/rt2x00.h   |  1 +
+ .../net/wireless/ralink/rt2x00/rt2x00mac.c    |  4 +++
+ 3 files changed, 26 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -1140,36 +1140,47 @@ void rt2800_txdone(struct rt2x00_dev *rt
+ }
+ EXPORT_SYMBOL_GPL(rt2800_txdone);
+ 
+-static inline bool rt2800_entry_txstatus_timeout(struct queue_entry *entry)
++static inline bool rt2800_entry_txstatus_timeout(struct rt2x00_dev *rt2x00dev,
++						 struct queue_entry *entry)
+ {
+-	bool tout;
++	bool ret;
++	unsigned long tout;
+ 
+ 	if (!test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
+ 		return false;
+ 
+-	tout = time_after(jiffies, entry->last_action + msecs_to_jiffies(500));
+-	if (unlikely(tout))
++	if (test_bit(DEVICE_STATE_FLUSHING, &rt2x00dev->flags))
++		tout = msecs_to_jiffies(100);
++	else
++		tout = msecs_to_jiffies(2000);
++
++	ret = time_after(jiffies, entry->last_action + tout);
++	if (unlikely(ret))
+ 		rt2x00_dbg(entry->queue->rt2x00dev,
+ 			   "TX status timeout for entry %d in queue %d\n",
+ 			   entry->entry_idx, entry->queue->qid);
+-	return tout;
+-
++	return ret;
+ }
+ 
+ bool rt2800_txstatus_timeout(struct rt2x00_dev *rt2x00dev)
+ {
+ 	struct data_queue *queue;
+ 	struct queue_entry *entry;
++	unsigned long tout;
++
++	if (test_bit(DEVICE_STATE_FLUSHING, &rt2x00dev->flags))
++		tout = msecs_to_jiffies(50);
++	else
++		tout = msecs_to_jiffies(1000);
+ 
+-	if (time_before(jiffies,
+-			rt2x00dev->last_nostatus_check + msecs_to_jiffies(500)))
++	if (time_before(jiffies, rt2x00dev->last_nostatus_check + tout))
+ 		return false;
+ 
+ 	rt2x00dev->last_nostatus_check = jiffies;
+ 
+ 	tx_queue_for_each(rt2x00dev, queue) {
+ 		entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+-		if (rt2800_entry_txstatus_timeout(entry))
++		if (rt2800_entry_txstatus_timeout(rt2x00dev, entry))
+ 			return true;
+ 	}
+ 
+@@ -1198,7 +1209,7 @@ void rt2800_txdone_nostatus(struct rt2x0
+ 				break;
+ 
+ 			if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags) ||
+-			    rt2800_entry_txstatus_timeout(entry))
++			    rt2800_entry_txstatus_timeout(rt2x00dev, entry))
+ 				rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
+ 			else
+ 				break;
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -667,6 +667,7 @@ enum rt2x00_state_flags {
+ 	DEVICE_STATE_STARTED,
+ 	DEVICE_STATE_ENABLED_RADIO,
+ 	DEVICE_STATE_SCANNING,
++	DEVICE_STATE_FLUSHING,
+ 
+ 	/*
+ 	 * Driver configuration
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+@@ -720,8 +720,12 @@ void rt2x00mac_flush(struct ieee80211_hw
+ 	if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
+ 		return;
+ 
++	set_bit(DEVICE_STATE_FLUSHING, &rt2x00dev->flags);
++
+ 	tx_queue_for_each(rt2x00dev, queue)
+ 		rt2x00queue_flush_queue(queue, drop);
++
++	clear_bit(DEVICE_STATE_FLUSHING, &rt2x00dev->flags);
+ }
+ EXPORT_SYMBOL_GPL(rt2x00mac_flush);
+ 
diff --git a/package/kernel/mac80211/patches/rt2x00/705-rt2800-flush-and-txstatus-rework-for-rt2800mmio.patch b/package/kernel/mac80211/patches/rt2x00/705-rt2800-flush-and-txstatus-rework-for-rt2800mmio.patch
new file mode 100644
index 000000000..22310185c
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/705-rt2800-flush-and-txstatus-rework-for-rt2800mmio.patch
@@ -0,0 +1,239 @@
+From 0d9fbb738a5eadc7abc8060f43ebcc71f6324c07 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 14 Aug 2018 08:58:48 +0200
+Subject: [PATCH 5/5] rt2800: flush and txstatus rework for rt2800mmio
+
+Implement custom rt2800mmio flush routine and change txstatus
+routine to read TX_STA_FIFO also in the tasklet.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    |  14 +-
+ .../net/wireless/ralink/rt2x00/rt2800mmio.c   | 120 +++++++++++++-----
+ .../net/wireless/ralink/rt2x00/rt2800mmio.h   |   1 +
+ .../net/wireless/ralink/rt2x00/rt2800pci.c    |   2 +-
+ 4 files changed, 99 insertions(+), 38 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -1150,7 +1150,7 @@ static inline bool rt2800_entry_txstatus
+ 		return false;
+ 
+ 	if (test_bit(DEVICE_STATE_FLUSHING, &rt2x00dev->flags))
+-		tout = msecs_to_jiffies(100);
++		tout = msecs_to_jiffies(50);
+ 	else
+ 		tout = msecs_to_jiffies(2000);
+ 
+@@ -1166,15 +1166,13 @@ bool rt2800_txstatus_timeout(struct rt2x
+ {
+ 	struct data_queue *queue;
+ 	struct queue_entry *entry;
+-	unsigned long tout;
+ 
+-	if (test_bit(DEVICE_STATE_FLUSHING, &rt2x00dev->flags))
+-		tout = msecs_to_jiffies(50);
+-	else
+-		tout = msecs_to_jiffies(1000);
++	if (!test_bit(DEVICE_STATE_FLUSHING, &rt2x00dev->flags)) {
++		unsigned long tout = msecs_to_jiffies(1000);
+ 
+-	if (time_before(jiffies, rt2x00dev->last_nostatus_check + tout))
+-		return false;
++		if (time_before(jiffies, rt2x00dev->last_nostatus_check + tout))
++			return false;
++	}
+ 
+ 	rt2x00dev->last_nostatus_check = jiffies;
+ 
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
+@@ -191,21 +191,6 @@ static inline void rt2800mmio_enable_int
+ 	spin_unlock_irq(&rt2x00dev->irqmask_lock);
+ }
+ 
+-void rt2800mmio_txstatus_tasklet(unsigned long data)
+-{
+-	struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
+-
+-	rt2800_txdone(rt2x00dev);
+-
+-	if (rt2800_txstatus_timeout(rt2x00dev))
+-		rt2800_txdone_nostatus(rt2x00dev);
+-
+-	if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
+-		rt2800mmio_enable_interrupt(rt2x00dev,
+-					    INT_SOURCE_CSR_TX_FIFO_STATUS);
+-}
+-EXPORT_SYMBOL_GPL(rt2800mmio_txstatus_tasklet);
+-
+ void rt2800mmio_pretbtt_tasklet(unsigned long data)
+ {
+ 	struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
+@@ -270,12 +255,26 @@ void rt2800mmio_autowake_tasklet(unsigne
+ }
+ EXPORT_SYMBOL_GPL(rt2800mmio_autowake_tasklet);
+ 
+-static void rt2800mmio_txstatus_interrupt(struct rt2x00_dev *rt2x00dev)
++static void rt2800mmio_txdone(struct rt2x00_dev *rt2x00dev)
++{
++	bool timeout = false;
++
++	while (!kfifo_is_empty(&rt2x00dev->txstatus_fifo) ||
++	       (timeout = rt2800_txstatus_timeout(rt2x00dev))) {
++
++		rt2800_txdone(rt2x00dev);
++
++		if (timeout)
++			rt2800_txdone_nostatus(rt2x00dev);
++	}
++}
++
++static bool rt2800mmio_fetch_txstatus(struct rt2x00_dev *rt2x00dev)
+ {
+ 	u32 status;
+-	int i;
++	bool more = false;
+ 
+-	/*
++	/* FIXEME: rewrite this comment
+ 	 * The TX_FIFO_STATUS interrupt needs special care. We should
+ 	 * read TX_STA_FIFO but we should do it immediately as otherwise
+ 	 * the register can overflow and we would lose status reports.
+@@ -286,25 +285,37 @@ static void rt2800mmio_txstatus_interrup
+ 	 * because we can schedule the tasklet multiple times (when the
+ 	 * interrupt fires again during tx status processing).
+ 	 *
+-	 * Since we have only one producer and one consumer we don't
++	 * txstatus tasklet is called with INT_SOURCE_CSR_TX_FIFO_STATUS
++	 * disabled so have only one producer and one consumer - we don't
+ 	 * need to lock the kfifo.
+ 	 */
+-	for (i = 0; i < rt2x00dev->tx->limit; i++) {
++	while (!kfifo_is_full(&rt2x00dev->txstatus_fifo)) {
+ 		status = rt2x00mmio_register_read(rt2x00dev, TX_STA_FIFO);
+-
+ 		if (!rt2x00_get_field32(status, TX_STA_FIFO_VALID))
+ 			break;
+ 
+-		if (!kfifo_put(&rt2x00dev->txstatus_fifo, status)) {
+-			rt2x00_warn(rt2x00dev, "TX status FIFO overrun, drop tx status report\n");
+-			break;
+-		}
++		kfifo_put(&rt2x00dev->txstatus_fifo, status);
++		more = true;
+ 	}
+ 
+-	/* Schedule the tasklet for processing the tx status. */
+-	tasklet_schedule(&rt2x00dev->txstatus_tasklet);
++	return more;
+ }
+ 
++void rt2800mmio_txstatus_tasklet(unsigned long data)
++{
++	struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
++
++	do {
++		rt2800mmio_txdone(rt2x00dev);
++
++	} while (rt2800mmio_fetch_txstatus(rt2x00dev));
++
++	if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
++		rt2800mmio_enable_interrupt(rt2x00dev,
++					    INT_SOURCE_CSR_TX_FIFO_STATUS);
++}
++EXPORT_SYMBOL_GPL(rt2800mmio_txstatus_tasklet);
++
+ irqreturn_t rt2800mmio_interrupt(int irq, void *dev_instance)
+ {
+ 	struct rt2x00_dev *rt2x00dev = dev_instance;
+@@ -327,8 +338,10 @@ irqreturn_t rt2800mmio_interrupt(int irq
+ 	 */
+ 	mask = ~reg;
+ 
+-	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS))
+-		rt2800mmio_txstatus_interrupt(rt2x00dev);
++	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS)) {
++		rt2800mmio_fetch_txstatus(rt2x00dev);
++		tasklet_schedule(&rt2x00dev->txstatus_tasklet);
++	}
+ 
+ 	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_PRE_TBTT))
+ 		tasklet_hi_schedule(&rt2x00dev->pretbtt_tasklet);
+@@ -453,6 +466,55 @@ void rt2800mmio_kick_queue(struct data_q
+ }
+ EXPORT_SYMBOL_GPL(rt2800mmio_kick_queue);
+ 
++void rt2800mmio_flush_queue(struct data_queue *queue, bool drop)
++{
++	struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
++	bool tx_queue = false;
++	unsigned int i;
++
++	//printk("FLUSH queue %d len %d drop %d\n", queue->qid, queue->length, drop);
++
++	switch (queue->qid) {
++	case QID_AC_VO:
++	case QID_AC_VI:
++	case QID_AC_BE:
++	case QID_AC_BK:
++		tx_queue = true;
++		break;
++	case QID_RX:
++		break;
++	default:
++		return;
++	}
++
++	for (i = 0; i < 5; i++) {
++		/*
++		 * Check if the driver is already done, otherwise we
++		 * have to sleep a little while to give the driver/hw
++		 * the oppurtunity to complete interrupt process itself.
++		 */
++		if (rt2x00queue_empty(queue))
++			break;
++
++		/*
++		 * For TX queues schedule completion tasklet to catch
++		 * tx status timeouts, othewise just wait.
++		 */
++		if (tx_queue) {
++			tasklet_disable(&rt2x00dev->txstatus_tasklet);
++			rt2800mmio_txdone(rt2x00dev);
++			tasklet_enable(&rt2x00dev->txstatus_tasklet);
++		} 
++
++		/*
++		 * Wait for a little while to give the driver
++		 * the oppurtunity to recover itself.
++		 */
++		msleep(50);
++	}
++}
++EXPORT_SYMBOL_GPL(rt2800mmio_flush_queue);
++
+ void rt2800mmio_stop_queue(struct data_queue *queue)
+ {
+ 	struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.h
+@@ -148,6 +148,7 @@ void rt2800mmio_toggle_irq(struct rt2x00
+ /* Queue handlers */
+ void rt2800mmio_start_queue(struct data_queue *queue);
+ void rt2800mmio_kick_queue(struct data_queue *queue);
++void rt2800mmio_flush_queue(struct data_queue *queue, bool drop);
+ void rt2800mmio_stop_queue(struct data_queue *queue);
+ void rt2800mmio_queue_init(struct data_queue *queue);
+ 
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
+@@ -364,7 +364,7 @@ static const struct rt2x00lib_ops rt2800
+ 	.start_queue		= rt2800mmio_start_queue,
+ 	.kick_queue		= rt2800mmio_kick_queue,
+ 	.stop_queue		= rt2800mmio_stop_queue,
+-	.flush_queue		= rt2x00mmio_flush_queue,
++	.flush_queue		= rt2800mmio_flush_queue,
+ 	.write_tx_desc		= rt2800mmio_write_tx_desc,
+ 	.write_tx_data		= rt2800_write_tx_data,
+ 	.write_beacon		= rt2800_write_beacon,
diff --git a/package/kernel/mac80211/patches/rt2x00/980-rt2x00-reduce-power-consumption-on-mt7620.patch b/package/kernel/mac80211/patches/rt2x00/980-rt2x00-reduce-power-consumption-on-mt7620.patch
new file mode 100644
index 000000000..87f9e8f7c
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/980-rt2x00-reduce-power-consumption-on-mt7620.patch
@@ -0,0 +1,43 @@
+From: Tomislav Požega <pozega.tomislav@gmail.com>
+
+rt2x00: write registers required for reducing power consumption
+
+Write registers required for reducing power consumption like the vendor
+driver does when ADJUST_POWER_CONSUMPTION_SUPPORT is set.
+This helps devices to sync at better TX/RX rates and improves overall
+performance.
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+[daniel@makrotopia.org: edited commit message]
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+), 0 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8875,6 +8875,24 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x02);
+ 	rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xC7);
+ 
++	/* reduce power consumption */
++	rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0x53);
++	rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0x53);
++	rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0x53);
++	rt2800_rfcsr_write_bank(rt2x00dev, 4, 47, 0x24);
++	rt2800_rfcsr_write_bank(rt2x00dev, 6, 47, 0x64);
++	rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0x4F);
++	rt2800_rfcsr_write_chanreg(rt2x00dev, 49, 0x02);
++	rt2800_rfcsr_write_bank(rt2x00dev, 4, 55, 0x24);
++	rt2800_rfcsr_write_bank(rt2x00dev, 6, 55, 0x64);
++	rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0x4F);
++	rt2800_rfcsr_write_chanreg(rt2x00dev, 57, 0x02);
++	rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x27);
++	rt2800_rfcsr_write_bank(rt2x00dev, 4, 59, 0x24);
++	rt2800_rfcsr_write_bank(rt2x00dev, 6, 59, 0x64);
++	rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0x4F);
++	rt2800_rfcsr_write_chanreg(rt2x00dev, 61, 0x02);
++
+ 	/* Initialize RF DC calibration register to default value */
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 0, 0x47);
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 1, 0x00);
diff --git a/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch b/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch
new file mode 100644
index 000000000..ff5b0d2e1
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch
@@ -0,0 +1,89 @@
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8331,6 +8331,58 @@ static void rt2800_init_rfcsr_5592(struc
+ 	rt2800_led_open_drain_enable(rt2x00dev);
+ }
+ 
++void rt2800_rf_self_txdc_cal(struct rt2x00_dev *rt2x00dev)
++{
++	u8 rfb5r1_org, rfb7r1_org, rfvalue;
++	u32 mac0518, mac051c, mac0528, mac052c;
++	u8 i;
++
++	rt2x00_info(rt2x00dev, "RF Tx self calibration start\n");
++	mac0518 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
++	mac051c = rt2800_register_read(rt2x00dev, RF_BYPASS0);
++	mac0528 = rt2800_register_read(rt2x00dev, RF_CONTROL2);
++	mac052c = rt2800_register_read(rt2x00dev, RF_BYPASS2);
++
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x0);
++	rt2800_register_write(rt2x00dev, RF_BYPASS2, 0x0);
++
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0xC);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x3306);
++	rt2800_register_write(rt2x00dev, RF_CONTROL2, 0x3330);
++	rt2800_register_write(rt2x00dev, RF_BYPASS2, 0xfffff);
++	rfb5r1_org = rt2800_rfcsr_read_bank(rt2x00dev, 5, 1);
++	rfb7r1_org = rt2800_rfcsr_read_bank(rt2x00dev, 7, 1);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 1, 0x4);
++	for (i = 0; i < 100; i = i + 1) {
++		udelay(50);
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 1);
++		if((rfvalue & 0x04) != 0x4)
++			break;
++	}
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 1, rfb5r1_org);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 1, 0x4);
++	for (i = 0; i < 100; i = i + 1) {
++		udelay(50);
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 1);
++		if((rfvalue & 0x04) != 0x4)
++			break;
++	}
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 1, rfb7r1_org);
++
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x0);
++	rt2800_register_write(rt2x00dev, RF_BYPASS2, 0x0);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, mac0518);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, mac051c);
++	rt2800_register_write(rt2x00dev, RF_CONTROL2, mac0528);
++	rt2800_register_write(rt2x00dev, RF_BYPASS2, mac052c);
++
++	rt2x00_info(rt2x00dev, "RF Tx self calibration end\n");
++
++}
++EXPORT_SYMBOL_GPL(rt2800_rf_self_txdc_cal);
++
+ static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
+ 				       bool set_bw, bool is_ht40)
+ {
+@@ -8956,6 +9008,7 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
+ 
++	rt2800_rf_self_txdc_cal(rt2x00dev);
+ 	rt2800_bw_filter_calibration(rt2x00dev, true);
+ 	rt2800_bw_filter_calibration(rt2x00dev, false);
+ }
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+@@ -242,6 +242,7 @@ void rt2800_link_tuner(struct rt2x00_dev
+ 		       const u32 count);
+ void rt2800_gain_calibration(struct rt2x00_dev *rt2x00dev);
+ void rt2800_vco_calibration(struct rt2x00_dev *rt2x00dev);
++void rt2800_rf_self_txdc_cal(struct rt2x00_dev *rt2x00dev);
+ 
+ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
+ void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -572,6 +572,7 @@ struct rt2x00lib_ops {
+ 			    struct link_qual *qual, const u32 count);
+ 	void (*gain_calibration) (struct rt2x00_dev *rt2x00dev);
+ 	void (*vco_calibration) (struct rt2x00_dev *rt2x00dev);
++	void (*rf_self_txdc_cal) (struct rt2x00_dev *rt2x00dev);
+ 
+ 	/*
+ 	 * Data queue handlers.
diff --git a/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch b/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch
new file mode 100644
index 000000000..cacede960
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch
@@ -0,0 +1,193 @@
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8383,6 +8383,160 @@ void rt2800_rf_self_txdc_cal(struct rt2x
+ }
+ EXPORT_SYMBOL_GPL(rt2800_rf_self_txdc_cal);
+ 
++int rt2800_calcrcalibrationcode(struct rt2x00_dev *rt2x00dev, int d1, int d2)
++{
++	int calcode;
++	calcode = ((d2 - d1) * 1000) / 43;
++	if ((calcode%10) >= 5)
++		calcode += 10;
++	calcode = (calcode / 10);
++
++	return calcode;
++}
++EXPORT_SYMBOL_GPL(rt2800_calcrcalibrationcode);
++
++void rt2800_r_calibration(struct rt2x00_dev *rt2x00dev)
++{
++	u32 savemacsysctrl;
++	u8 saverfb0r1, saverfb0r34, saverfb0r35;
++	u8 saverfb5r4, saverfb5r17, saverfb5r18;
++	u8 saverfb5r19, saverfb5r20;
++	u8 savebbpr22, savebbpr47, savebbpr49;
++	u8 bytevalue = 0;
++	int rcalcode;
++	u8 r_cal_code = 0;
++	char d1 = 0, d2 = 0;
++	u8 rfvalue;
++	u32 MAC_RF_BYPASS0, MAC_RF_CONTROL0, MAC_PWR_PIN_CFG;
++
++	saverfb0r1 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
++	saverfb0r34 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 34);
++	saverfb0r35 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 35);
++	saverfb5r4 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 4);
++	saverfb5r17 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 17);
++	saverfb5r18 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 18);
++	saverfb5r19 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 19);
++	saverfb5r20 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 20);
++
++	savebbpr22 = rt2800_bbp_read(rt2x00dev, 22);
++	savebbpr47 = rt2800_bbp_read(rt2x00dev, 47);
++	savebbpr49 = rt2800_bbp_read(rt2x00dev, 49);
++
++	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	MAC_RF_BYPASS0 = rt2800_register_read(rt2x00dev, RF_BYPASS0);
++	MAC_RF_CONTROL0 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
++	MAC_PWR_PIN_CFG = rt2800_register_read(rt2x00dev, PWR_PIN_CFG);
++
++	{
++	u32 maccfg, macstatus;
++	int i;
++
++	maccfg = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	maccfg &= (~0x04);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, maccfg);
++
++	for (i = 0; i < 10000; i++) {
++		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (macstatus & 0x1)
++			udelay(50);
++		else
++			break;
++		}
++
++	if (i == 10000)
++		rt2x00_warn(rt2x00dev, "Wait MAC Tx Status to MAX !!!\n");
++
++	maccfg = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	maccfg &= (~0x04);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, maccfg);
++
++	for (i = 0; i < 10000; i++) {
++		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (macstatus & 0x2)
++			udelay(50);
++		else
++			break;
++		}
++
++	if (i == 10000)
++		rt2x00_warn(rt2x00dev, "Wait MAC Rx Status to MAX !!!\n");
++	}
++
++	rfvalue = (MAC_RF_BYPASS0 | 0x3004);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, rfvalue);
++	rfvalue = (MAC_RF_CONTROL0 | (~0x3002));
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, rfvalue);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, 0x27);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 17, 0x80);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 18, 0x83);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 19, 0x00);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 20, 0x20);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, 0x00);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 34, 0x13);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x00);
++
++	rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0x1);
++
++	rt2800_bbp_write(rt2x00dev, 47, 0x04);
++	rt2800_bbp_write(rt2x00dev, 22, 0x80);
++	udelay(100);
++	bytevalue = rt2800_bbp_read(rt2x00dev, 49);
++	if (bytevalue > 128)
++		d1 = bytevalue - 256;
++	else
++		d1 = (char)bytevalue;
++	rt2800_bbp_write(rt2x00dev, 22, 0x0);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x01);
++
++	rt2800_bbp_write(rt2x00dev, 22, 0x80);
++	udelay(100);
++	bytevalue = rt2800_bbp_read(rt2x00dev, 49);
++	if (bytevalue > 128)
++		d2 = bytevalue - 256;
++	else
++		d2 = (char)bytevalue;
++	rt2800_bbp_write(rt2x00dev, 22, 0x0);
++
++	rcalcode = rt2800_calcrcalibrationcode(rt2x00dev, d1, d2);
++	if (rcalcode < 0)
++		r_cal_code = 256 + rcalcode;
++	else
++		r_cal_code = (u8)rcalcode;
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 7, r_cal_code);
++
++	rt2800_bbp_write(rt2x00dev, 22, 0x0);
++
++	bytevalue = rt2800_bbp_read(rt2x00dev, 21);
++	bytevalue |= 0x1;
++	rt2800_bbp_write(rt2x00dev, 21, bytevalue);
++	bytevalue = rt2800_bbp_read(rt2x00dev, 21);
++	bytevalue &= (~0x1);
++	rt2800_bbp_write(rt2x00dev, 21, bytevalue);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, saverfb0r1);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 34, saverfb0r34);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, saverfb0r35);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, saverfb5r4);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 17, saverfb5r17);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 18, saverfb5r18);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 19, saverfb5r19);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 20, saverfb5r20);
++
++	rt2800_bbp_write(rt2x00dev, 22, savebbpr22);
++	rt2800_bbp_write(rt2x00dev, 47, savebbpr47);
++	rt2800_bbp_write(rt2x00dev, 49, savebbpr49);
++
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, MAC_RF_BYPASS0);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, MAC_RF_CONTROL0);
++
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
++	rt2800_register_write(rt2x00dev, PWR_PIN_CFG, MAC_PWR_PIN_CFG);
++}
++EXPORT_SYMBOL_GPL(rt2800_r_calibration);
++
+ static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
+ 				       bool set_bw, bool is_ht40)
+ {
+@@ -9008,6 +9162,7 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
+ 
++	rt2800_r_calibration(rt2x00dev);
+ 	rt2800_rf_self_txdc_cal(rt2x00dev);
+ 	rt2800_bw_filter_calibration(rt2x00dev, true);
+ 	rt2800_bw_filter_calibration(rt2x00dev, false);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+@@ -243,6 +243,8 @@ void rt2800_link_tuner(struct rt2x00_dev
+ void rt2800_gain_calibration(struct rt2x00_dev *rt2x00dev);
+ void rt2800_vco_calibration(struct rt2x00_dev *rt2x00dev);
+ void rt2800_rf_self_txdc_cal(struct rt2x00_dev *rt2x00dev);
++int rt2800_calcrcalibrationcode(struct rt2x00_dev *rt2x00dev, int d1, int d2);
++void rt2800_r_calibration(struct rt2x00_dev *rt2x00dev);
+ 
+ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
+ void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -573,6 +573,8 @@ struct rt2x00lib_ops {
+ 	void (*gain_calibration) (struct rt2x00_dev *rt2x00dev);
+ 	void (*vco_calibration) (struct rt2x00_dev *rt2x00dev);
+ 	void (*rf_self_txdc_cal) (struct rt2x00_dev *rt2x00dev);
++	int (*calcrcalibrationcode) (struct rt2x00_dev *rt2x00dev, int d1, int d2);
++	void (*r_calibration) (struct rt2x00_dev *rt2x00dev);
+ 
+ 	/*
+ 	 * Data queue handlers.
diff --git a/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch b/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch
new file mode 100644
index 000000000..6deac1209
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch
@@ -0,0 +1,102 @@
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8537,6 +8537,71 @@ void rt2800_r_calibration(struct rt2x00_
+ }
+ EXPORT_SYMBOL_GPL(rt2800_r_calibration);
+ 
++void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev)
++{
++	u8 bbpreg = 0;
++	u32 macvalue = 0, macvalue1 = 0;
++	u8 saverfb0r2, saverfb5r4, saverfb7r4, rfvalue;
++	int i;
++
++	saverfb0r2 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 2);
++	rfvalue = saverfb0r2;
++	rfvalue |= 0x03;
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfvalue);
++
++	rt2800_bbp_write(rt2x00dev, 158, 141);
++	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
++	bbpreg |= 0x10;
++	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
++
++	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x8);
++
++	for (i = 0; i < 10000; i++) {
++		macvalue1 = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (macvalue1 & 0x1)
++			udelay(50);
++		else
++			break;
++	}
++
++	saverfb5r4 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 0);
++	saverfb7r4 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 4);
++	saverfb5r4 = saverfb5r4 & (~0x40);
++	saverfb7r4 = saverfb7r4 & (~0x40);
++	rt2800_rfcsr_write_dccal(rt2x00dev, 4, 0x64);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, saverfb5r4);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 4, saverfb7r4);
++
++	rt2800_bbp_write(rt2x00dev, 158, 141);
++	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
++	bbpreg = bbpreg & (~0x40);
++	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
++	bbpreg |= 0x48;
++	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
++
++	for (i = 0; i < 10000; i++) {
++		bbpreg = rt2800_bbp_read(rt2x00dev, 159);
++		if ((bbpreg & 0x40)==0)
++			break;
++		udelay(50);
++	}
++
++	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
++	bbpreg = bbpreg & (~0x40);
++	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
++
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
++
++	rt2800_bbp_write(rt2x00dev, 158, 141);
++	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
++	bbpreg &= (~0x10);
++	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, saverfb0r2);
++}
++EXPORT_SYMBOL_GPL(rt2800_rxdcoc_calibration);
++
+ static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
+ 				       bool set_bw, bool is_ht40)
+ {
+@@ -9164,6 +9229,7 @@ static void rt2800_init_rfcsr_6352(struc
+ 
+ 	rt2800_r_calibration(rt2x00dev);
+ 	rt2800_rf_self_txdc_cal(rt2x00dev);
++	rt2800_rxdcoc_calibration(rt2x00dev);
+ 	rt2800_bw_filter_calibration(rt2x00dev, true);
+ 	rt2800_bw_filter_calibration(rt2x00dev, false);
+ }
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+@@ -245,6 +245,7 @@ void rt2800_vco_calibration(struct rt2x0
+ void rt2800_rf_self_txdc_cal(struct rt2x00_dev *rt2x00dev);
+ int rt2800_calcrcalibrationcode(struct rt2x00_dev *rt2x00dev, int d1, int d2);
+ void rt2800_r_calibration(struct rt2x00_dev *rt2x00dev);
++void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev);
+ 
+ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
+ void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -575,6 +575,7 @@ struct rt2x00lib_ops {
+ 	void (*rf_self_txdc_cal) (struct rt2x00_dev *rt2x00dev);
+ 	int (*calcrcalibrationcode) (struct rt2x00_dev *rt2x00dev, int d1, int d2);
+ 	void (*r_calibration) (struct rt2x00_dev *rt2x00dev);
++	void (*rxdcoc_calibration) (struct rt2x00_dev *rt2x00dev);
+ 
+ 	/*
+ 	 * Data queue handlers.
diff --git a/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch b/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch
new file mode 100644
index 000000000..212c7444e
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch
@@ -0,0 +1,417 @@
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8602,6 +8602,386 @@ void rt2800_rxdcoc_calibration(struct rt
+ }
+ EXPORT_SYMBOL_GPL(rt2800_rxdcoc_calibration);
+ 
++static u32 rt2800_do_sqrt_accumulation(u32 si) {
++	u32 root, root_pre, bit;
++	char i;
++	bit = 1 << 15;
++	root = 0;
++	for (i = 15; i >= 0; i = i - 1) {
++		root_pre = root + bit;
++		if ((root_pre*root_pre) <= si)
++			root = root_pre;
++		bit = bit >> 1;
++	}
++
++	return root;
++}
++EXPORT_SYMBOL_GPL(rt2800_do_sqrt_accumulation);
++
++void rt2800_rxiq_calibration(struct rt2x00_dev *rt2x00dev) {
++	u8 rfb0r1, rfb0r2, rfb0r42;
++	u8 rfb4r0, rfb4r19;
++	u8 rfb5r3, rfb5r4, rfb5r17, rfb5r18, rfb5r19, rfb5r20;
++	u8 rfb6r0, rfb6r19;
++	u8 rfb7r3, rfb7r4, rfb7r17, rfb7r18, rfb7r19, rfb7r20;
++
++	u8 bbp1, bbp4;
++	u8 bbpr241, bbpr242;
++	u32 i;
++	u8 ch_idx;
++	u8 bbpval;
++	u8 rfval, vga_idx = 0;
++	int mi = 0, mq = 0, si = 0, sq = 0, riq = 0;
++	int sigma_i, sigma_q, r_iq, g_rx;
++	int g_imb;
++	int ph_rx;
++	u32 savemacsysctrl = 0;
++	u32 orig_RF_CONTROL0 = 0;
++	u32 orig_RF_BYPASS0 = 0;
++	u32 orig_RF_CONTROL1 = 0;
++	u32 orig_RF_BYPASS1 = 0;
++	u32 orig_RF_CONTROL3 = 0;
++	u32 orig_RF_BYPASS3 = 0;
++	u32 macstatus, bbpval1 = 0;
++	u8 rf_vga_table[] = {0x20, 0x21, 0x22, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f};
++
++	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	orig_RF_CONTROL0 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
++	orig_RF_BYPASS0 = rt2800_register_read(rt2x00dev, RF_BYPASS0);
++	orig_RF_CONTROL1 = rt2800_register_read(rt2x00dev, RF_CONTROL1);
++	orig_RF_BYPASS1 = rt2800_register_read(rt2x00dev, RF_BYPASS1);
++	orig_RF_CONTROL3 = rt2800_register_read(rt2x00dev, RF_CONTROL3);
++	orig_RF_BYPASS3 = rt2800_register_read(rt2x00dev, RF_BYPASS3);
++
++	bbp1 = rt2800_bbp_read(rt2x00dev, 1);
++	bbp4 = rt2800_bbp_read(rt2x00dev, 4);
++
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x0);
++
++	for (i = 0; i < 10000; i++) {
++		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (macstatus & 0x3)
++			udelay(50);
++		else
++			break;
++	}
++
++	if (i == 10000)
++		rt2x00_warn(rt2x00dev, "Wait MAC Status to MAX !!!\n");
++
++	bbpval = bbp4 & (~0x18);
++	bbpval = bbp4 | 0x00;
++	rt2800_bbp_write(rt2x00dev, 4, bbpval);
++
++	bbpval = rt2800_bbp_read(rt2x00dev, 21);
++	bbpval = bbpval | 1;
++	rt2800_bbp_write(rt2x00dev, 21, bbpval);
++	bbpval = bbpval & 0xfe;
++	rt2800_bbp_write(rt2x00dev, 21, bbpval);
++
++	rt2800_register_write(rt2x00dev, RF_CONTROL1, 0x00000202);
++	rt2800_register_write(rt2x00dev, RF_BYPASS1, 0x00000303);
++	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x0101);
++	} else {
++		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x0000);
++	}
++	rt2800_register_write(rt2x00dev, RF_BYPASS3, 0xf1f1);
++
++	rfb0r1 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
++	rfb0r2 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 2);
++	rfb0r42 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 42);
++	rfb4r0 = rt2800_rfcsr_read_bank(rt2x00dev, 4, 0);
++	rfb4r19 = rt2800_rfcsr_read_bank(rt2x00dev, 4, 19);
++	rfb5r3 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 3);
++	rfb5r4 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 4);
++	rfb5r17 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 17);
++	rfb5r18 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 18);
++	rfb5r19 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 19);
++	rfb5r20 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 20);
++
++	rfb6r0 = rt2800_rfcsr_read_bank(rt2x00dev, 6, 0);
++	rfb6r19 = rt2800_rfcsr_read_bank(rt2x00dev, 6, 19);
++	rfb7r3 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 3);
++	rfb7r4 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 4);
++	rfb7r17 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 17);
++	rfb7r18 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 18);
++	rfb7r19 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 19);
++	rfb7r20 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 20);
++
++	rt2800_rfcsr_write_chanreg(rt2x00dev, 0, 0x87);
++	rt2800_rfcsr_write_chanreg(rt2x00dev, 19, 0x27);
++	rt2800_rfcsr_write_dccal(rt2x00dev, 3, 0x38);
++	rt2800_rfcsr_write_dccal(rt2x00dev, 4, 0x38);
++	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x80);
++	rt2800_rfcsr_write_dccal(rt2x00dev, 18, 0xC1);
++	rt2800_rfcsr_write_dccal(rt2x00dev, 19, 0x60);
++	rt2800_rfcsr_write_dccal(rt2x00dev, 20, 0x00);
++
++	rt2800_bbp_write(rt2x00dev, 23, 0x0);
++	rt2800_bbp_write(rt2x00dev, 24, 0x0);
++
++	rt2800_bbp_dcoc_write(rt2x00dev, 5, 0x0);
++
++	bbpr241 = rt2800_bbp_read(rt2x00dev, 241);
++	bbpr242 = rt2800_bbp_read(rt2x00dev, 242);
++
++	rt2800_bbp_write(rt2x00dev, 241, 0x10);
++	rt2800_bbp_write(rt2x00dev, 242, 0x84);
++	rt2800_bbp_write(rt2x00dev, 244, 0x31);
++
++	bbpval = rt2800_bbp_dcoc_read(rt2x00dev, 3);
++	bbpval = bbpval & (~0x7);
++	rt2800_bbp_dcoc_write(rt2x00dev, 3, bbpval);
++
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000004);
++	udelay(1);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000006);
++	usleep_range(1, 200);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00003376);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001006);
++	udelay(1);
++	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++		rt2800_bbp_write(rt2x00dev, 23, 0x06);
++		rt2800_bbp_write(rt2x00dev, 24, 0x06);
++	} else {
++		rt2800_bbp_write(rt2x00dev, 23, 0x02);
++		rt2800_bbp_write(rt2x00dev, 24, 0x02);
++	}
++
++	for (ch_idx = 0; ch_idx < 2; ch_idx = ch_idx + 1) {
++		if (ch_idx == 0) {
++			rfval = rfb0r1 & (~0x3);
++			rfval = rfb0r1 | 0x1;
++			rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, rfval);
++			rfval = rfb0r2 & (~0x33);
++			rfval = rfb0r2 | 0x11;
++			rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfval);
++			rfval = rfb0r42 & (~0x50);
++			rfval = rfb0r42 | 0x10;
++			rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfval);
++
++			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001006);
++			udelay(1);
++
++			bbpval = bbp1 & (~ 0x18);
++			bbpval = bbpval | 0x00;
++			rt2800_bbp_write(rt2x00dev, 1, bbpval);
++
++			rt2800_bbp_dcoc_write(rt2x00dev, 1, 0x00);
++		} else {
++			rfval = rfb0r1 & (~0x3);
++			rfval = rfb0r1 | 0x2;
++			rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, rfval);
++			rfval = rfb0r2 & (~0x33);
++			rfval = rfb0r2 | 0x22;
++			rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfval);
++			rfval = rfb0r42 & (~0x50);
++			rfval = rfb0r42 | 0x40;
++			rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfval);
++
++			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002006);
++			udelay(1);
++
++			bbpval = bbp1 & (~ 0x18);
++			bbpval = bbpval | 0x08;
++			rt2800_bbp_write(rt2x00dev, 1, bbpval);
++
++			rt2800_bbp_dcoc_write(rt2x00dev, 1, 0x01);
++		}
++		udelay(500);
++
++		vga_idx = 0;
++			while (vga_idx < 11) {
++				rt2800_rfcsr_write_dccal(rt2x00dev, 3, rf_vga_table[vga_idx]);
++				rt2800_rfcsr_write_dccal(rt2x00dev, 4, rf_vga_table[vga_idx]);
++
++				rt2800_bbp_dcoc_write(rt2x00dev, 0, 0x93);
++
++				for (i = 0; i < 10000; i++) {
++					bbpval = rt2800_bbp_read(rt2x00dev, 159);
++					if ((bbpval & 0xff) == 0x93)
++						udelay(50);
++					else
++						break;
++					}
++
++				if ((bbpval & 0xff) == 0x93) {
++					rt2x00_warn(rt2x00dev, "Fatal Error: Calibration doesn't finish");
++					goto restore_value;
++				}
++
++				for (i = 0; i < 5; i++) {
++					u32 bbptemp = 0;
++					u8 value = 0;
++					int result = 0;
++
++					rt2800_bbp_write(rt2x00dev, 158, 0x1e);
++					rt2800_bbp_write(rt2x00dev, 159, i);
++					rt2800_bbp_write(rt2x00dev, 158, 0x22);
++					value = rt2800_bbp_read(rt2x00dev, 159);
++					bbptemp = bbptemp + (value << 24);
++					rt2800_bbp_write(rt2x00dev, 158, 0x21);
++					value = rt2800_bbp_read(rt2x00dev, 159);
++					bbptemp = bbptemp + (value << 16);
++					rt2800_bbp_write(rt2x00dev, 158, 0x20);
++					value = rt2800_bbp_read(rt2x00dev, 159);
++					bbptemp = bbptemp + (value << 8);
++					rt2800_bbp_write(rt2x00dev, 158, 0x1f);
++					value = rt2800_bbp_read(rt2x00dev, 159);
++					bbptemp = bbptemp + value;
++
++					if ((i < 2) && (bbptemp & 0x800000))
++						result = (bbptemp & 0xffffff) - 0x1000000;
++					else if (i == 4)
++						result = bbptemp;
++					else
++						result = bbptemp;
++
++					if (i == 0)
++						mi = result/4096;
++					else if (i == 1)
++						mq = result/4096;
++					else if (i == 2)
++						si = bbptemp/4096;
++					else if (i == 3)
++						sq = bbptemp/4096;
++					else
++						riq = result/4096;
++				}
++
++				bbpval1 = si - mi*mi;
++				rt2x00_dbg(rt2x00dev, "RXIQ si=%d, sq=%d, riq=%d, bbpval %d, vga_idx %d", si, sq, riq, bbpval1, vga_idx);
++
++				if (bbpval1 >= (100*100))
++					break;
++
++				if (bbpval1 <= 100)
++					vga_idx = vga_idx + 9;
++				else if (bbpval1 <= 158)
++					vga_idx = vga_idx + 8;
++				else if (bbpval1 <= 251)
++					vga_idx = vga_idx + 7;
++				else if (bbpval1 <= 398)
++					vga_idx = vga_idx + 6;
++				else if (bbpval1 <= 630)
++					vga_idx = vga_idx + 5;
++				else if (bbpval1 <= 1000)
++					vga_idx = vga_idx + 4;
++				else if (bbpval1 <= 1584)
++					vga_idx = vga_idx + 3;
++				else if (bbpval1 <= 2511)
++					vga_idx = vga_idx + 2;
++				else 
++					vga_idx = vga_idx + 1;
++			}
++
++		sigma_i = rt2800_do_sqrt_accumulation(100*(si - mi*mi));
++		sigma_q = rt2800_do_sqrt_accumulation(100*(sq - mq*mq));
++		r_iq = 10*(riq-(mi*mq));
++
++		rt2x00_dbg(rt2x00dev, "Sigma_i=%d, Sigma_q=%d, R_iq=%d", sigma_i, sigma_q, r_iq);
++
++		if (((sigma_i <= 1400 ) && (sigma_i >= 1000))
++			&& ((sigma_i - sigma_q) <= 112)			
++			&& ((sigma_i - sigma_q) >= -112)
++			&& ((mi <= 32) && (mi >= -32))
++			&& ((mq <= 32) && (mq >= -32))) {
++				r_iq = 10*(riq-(mi*mq));
++				rt2x00_dbg(rt2x00dev, "RXIQ Sigma_i=%d, Sigma_q=%d, R_iq=%d\n", sigma_i, sigma_q, r_iq);
++
++				g_rx = (1000 * sigma_q) / sigma_i;
++				g_imb = ((-2) * 128 * (1000 - g_rx)) / (1000 + g_rx);
++				ph_rx = (r_iq * 2292) / (sigma_i * sigma_q);
++				rt2x00_info(rt2x00dev, "RXIQ G_imb=%d, Ph_rx=%d\n", g_imb, ph_rx);
++
++				if ((ph_rx > 20) || (ph_rx < -20)) {
++					ph_rx = 0;
++					rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
++				}
++
++				if ((g_imb > 12) || (g_imb < -12)) {
++					g_imb = 0;
++					rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
++				}
++			}
++		else {
++			g_imb = 0;
++			ph_rx = 0;
++			rt2x00_dbg(rt2x00dev, "RXIQ Sigma_i=%d, Sigma_q=%d, R_iq=%d\n", sigma_i, sigma_q, r_iq);
++			rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
++		}
++
++		if (ch_idx == 0) {
++			rt2800_bbp_write(rt2x00dev, 158, 0x37);
++			rt2800_bbp_write(rt2x00dev, 159, g_imb & 0x3f);
++			rt2800_bbp_write(rt2x00dev, 158, 0x35);
++			rt2800_bbp_write(rt2x00dev, 159, ph_rx & 0x3f);
++		} else {
++			rt2800_bbp_write(rt2x00dev, 158, 0x55);
++			rt2800_bbp_write(rt2x00dev, 159, g_imb & 0x3f);
++			rt2800_bbp_write(rt2x00dev, 158, 0x53);
++			rt2800_bbp_write(rt2x00dev, 159, ph_rx & 0x3f);
++		}
++	}
++
++restore_value:
++	rt2800_bbp_write(rt2x00dev, 158, 0x3);
++	bbpval = rt2800_bbp_read(rt2x00dev, 159);
++	rt2800_bbp_write(rt2x00dev, 159, (bbpval | 0x07));
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x00);
++	rt2800_bbp_write(rt2x00dev, 159, 0x00);
++	rt2800_bbp_write(rt2x00dev, 1, bbp1);
++	rt2800_bbp_write(rt2x00dev, 4, bbp4);
++	rt2800_bbp_write(rt2x00dev, 241, bbpr241);
++	rt2800_bbp_write(rt2x00dev, 242, bbpr242);
++
++	rt2800_bbp_write(rt2x00dev, 244, 0x00);
++	bbpval = rt2800_bbp_read(rt2x00dev, 21);
++	bbpval = (bbpval | 0x1);
++	rt2800_bbp_write(rt2x00dev, 21, bbpval);
++	usleep_range(10, 200);
++	bbpval = (bbpval & 0xfe);
++	rt2800_bbp_write(rt2x00dev, 21, bbpval);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, rfb0r1);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfb0r2);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfb0r42);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 4, 0, rfb4r0);
++	rt2800_rfcsr_write_bank(rt2x00dev, 4, 19, rfb4r19);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 3, rfb5r3);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, rfb5r4);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 17, rfb5r17);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 18, rfb5r18);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 19, rfb5r19);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 20, rfb5r20);
++
++	rt2800_rfcsr_write_bank(rt2x00dev, 6, 0, rfb6r0);
++	rt2800_rfcsr_write_bank(rt2x00dev, 6, 19, rfb6r19);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 3, rfb7r3);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 4, rfb7r4);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 17, rfb7r17);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 18, rfb7r18);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 19, rfb7r19);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 20, rfb7r20);
++
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000006);
++	udelay(1);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000004);
++	udelay(1);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, orig_RF_CONTROL0);
++	udelay(1);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, orig_RF_BYPASS0);
++	rt2800_register_write(rt2x00dev, RF_CONTROL1, orig_RF_CONTROL1);
++	rt2800_register_write(rt2x00dev, RF_BYPASS1, orig_RF_BYPASS1);
++	rt2800_register_write(rt2x00dev, RF_CONTROL3, orig_RF_CONTROL3);
++	rt2800_register_write(rt2x00dev, RF_BYPASS3, orig_RF_BYPASS3);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
++}
++EXPORT_SYMBOL_GPL(rt2800_rxiq_calibration);
++
+ static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
+ 				       bool set_bw, bool is_ht40)
+ {
+@@ -9232,6 +9612,7 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_rxdcoc_calibration(rt2x00dev);
+ 	rt2800_bw_filter_calibration(rt2x00dev, true);
+ 	rt2800_bw_filter_calibration(rt2x00dev, false);
++	rt2800_rxiq_calibration(rt2x00dev);
+ }
+ 
+ static void rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+@@ -246,6 +246,7 @@ void rt2800_rf_self_txdc_cal(struct rt2x
+ int rt2800_calcrcalibrationcode(struct rt2x00_dev *rt2x00dev, int d1, int d2);
+ void rt2800_r_calibration(struct rt2x00_dev *rt2x00dev);
+ void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev);
++void rt2800_rxiq_calibration(struct rt2x00_dev *rt2x00dev);
+ 
+ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
+ void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -576,6 +576,7 @@ struct rt2x00lib_ops {
+ 	int (*calcrcalibrationcode) (struct rt2x00_dev *rt2x00dev, int d1, int d2);
+ 	void (*r_calibration) (struct rt2x00_dev *rt2x00dev);
+ 	void (*rxdcoc_calibration) (struct rt2x00_dev *rt2x00dev);
++	void (*rxiq_calibration) (struct rt2x00_dev *rt2x00dev);
+ 
+ 	/*
+ 	 * Data queue handlers.
diff --git a/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch b/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch
new file mode 100644
index 000000000..078490a69
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch
@@ -0,0 +1,1005 @@
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8982,6 +8982,957 @@ restore_value:
+ }
+ EXPORT_SYMBOL_GPL(rt2800_rxiq_calibration);
+ 
++static void rt2800_rf_configstore(struct rt2x00_dev *rt2x00dev, rf_reg_pair rf_reg_record[][13], u8 chain)
++{
++	u8 rfvalue = 0;
++
++	if (chain == CHAIN_0) {
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
++		rf_reg_record[CHAIN_0][0].bank = 0;
++		rf_reg_record[CHAIN_0][0].reg = 1;
++		rf_reg_record[CHAIN_0][0].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 2);
++		rf_reg_record[CHAIN_0][1].bank = 0;
++		rf_reg_record[CHAIN_0][1].reg = 2;
++		rf_reg_record[CHAIN_0][1].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 35);
++		rf_reg_record[CHAIN_0][2].bank = 0;
++		rf_reg_record[CHAIN_0][2].reg = 35;
++		rf_reg_record[CHAIN_0][2].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 42);
++		rf_reg_record[CHAIN_0][3].bank = 0;
++		rf_reg_record[CHAIN_0][3].reg = 42;
++		rf_reg_record[CHAIN_0][3].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 4, 0);
++		rf_reg_record[CHAIN_0][4].bank = 4;
++		rf_reg_record[CHAIN_0][4].reg = 0;
++		rf_reg_record[CHAIN_0][4].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 4, 2);
++		rf_reg_record[CHAIN_0][5].bank = 4;
++		rf_reg_record[CHAIN_0][5].reg = 2;
++		rf_reg_record[CHAIN_0][5].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 4, 34);
++		rf_reg_record[CHAIN_0][6].bank = 4;
++		rf_reg_record[CHAIN_0][6].reg = 34;
++		rf_reg_record[CHAIN_0][6].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 3);
++		rf_reg_record[CHAIN_0][7].bank = 5;
++		rf_reg_record[CHAIN_0][7].reg = 3;
++		rf_reg_record[CHAIN_0][7].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 4);
++		rf_reg_record[CHAIN_0][8].bank = 5;
++		rf_reg_record[CHAIN_0][8].reg = 4;
++		rf_reg_record[CHAIN_0][8].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 17);
++		rf_reg_record[CHAIN_0][9].bank = 5;
++		rf_reg_record[CHAIN_0][9].reg = 17;
++		rf_reg_record[CHAIN_0][9].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 18);
++		rf_reg_record[CHAIN_0][10].bank = 5;
++		rf_reg_record[CHAIN_0][10].reg = 18;
++		rf_reg_record[CHAIN_0][10].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 19);
++		rf_reg_record[CHAIN_0][11].bank = 5;
++		rf_reg_record[CHAIN_0][11].reg = 19;
++		rf_reg_record[CHAIN_0][11].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 20);
++		rf_reg_record[CHAIN_0][12].bank = 5;
++		rf_reg_record[CHAIN_0][12].reg = 20;
++		rf_reg_record[CHAIN_0][12].value = rfvalue;
++	} else if (chain == CHAIN_1) {
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
++		rf_reg_record[CHAIN_1][0].bank = 0;
++		rf_reg_record[CHAIN_1][0].reg = 1;
++		rf_reg_record[CHAIN_1][0].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 2);
++		rf_reg_record[CHAIN_1][1].bank = 0;
++		rf_reg_record[CHAIN_1][1].reg = 2;
++		rf_reg_record[CHAIN_1][1].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 35);
++		rf_reg_record[CHAIN_1][2].bank = 0;
++		rf_reg_record[CHAIN_1][2].reg = 35;
++		rf_reg_record[CHAIN_1][2].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 42);
++		rf_reg_record[CHAIN_1][3].bank = 0;
++		rf_reg_record[CHAIN_1][3].reg = 42;
++		rf_reg_record[CHAIN_1][3].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 6, 0);
++		rf_reg_record[CHAIN_1][4].bank = 6;
++		rf_reg_record[CHAIN_1][4].reg = 0;
++		rf_reg_record[CHAIN_1][4].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 6, 2);
++		rf_reg_record[CHAIN_1][5].bank = 6;
++		rf_reg_record[CHAIN_1][5].reg = 2;
++		rf_reg_record[CHAIN_1][5].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 6, 34);
++		rf_reg_record[CHAIN_1][6].bank = 6;
++		rf_reg_record[CHAIN_1][6].reg = 34;
++		rf_reg_record[CHAIN_1][6].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 3);
++		rf_reg_record[CHAIN_1][7].bank = 7;
++		rf_reg_record[CHAIN_1][7].reg = 3;
++		rf_reg_record[CHAIN_1][7].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 4);
++		rf_reg_record[CHAIN_1][8].bank = 7;
++		rf_reg_record[CHAIN_1][8].reg = 4;
++		rf_reg_record[CHAIN_1][8].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 17);
++		rf_reg_record[CHAIN_1][9].bank = 7;
++		rf_reg_record[CHAIN_1][9].reg = 17;
++		rf_reg_record[CHAIN_1][9].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 18);
++		rf_reg_record[CHAIN_1][10].bank = 7;
++		rf_reg_record[CHAIN_1][10].reg = 18;
++		rf_reg_record[CHAIN_1][10].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 19);
++		rf_reg_record[CHAIN_1][11].bank = 7;
++		rf_reg_record[CHAIN_1][11].reg = 19;
++		rf_reg_record[CHAIN_1][11].value = rfvalue;
++		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 20);
++		rf_reg_record[CHAIN_1][12].bank = 7;
++		rf_reg_record[CHAIN_1][12].reg = 20;
++		rf_reg_record[CHAIN_1][12].value = rfvalue;
++	} else {
++		rt2x00_warn(rt2x00dev, "Unknown chain = %u\n", chain);
++		return;
++	}
++
++	return;
++}
++EXPORT_SYMBOL_GPL(rt2800_rf_configstore);
++
++static void rt2800_rf_configrecover(struct rt2x00_dev *rt2x00dev, rf_reg_pair rf_record[][13])
++{
++	u8 chain_index = 0, record_index = 0;
++	u8 bank = 0, rf_register = 0, value = 0;
++
++	for (chain_index = 0; chain_index < 2; chain_index++) {
++		for (record_index = 0; record_index < 13; record_index++) {
++			bank = rf_record[chain_index][record_index].bank;
++			rf_register = rf_record[chain_index][record_index].reg;
++			value = rf_record[chain_index][record_index].value;			
++			rt2800_rfcsr_write_bank(rt2x00dev, bank, rf_register, value);
++			rt2x00_dbg(rt2x00dev, "bank: %d, rf_register: %d, value: %x\n", bank, rf_register, value);
++		}
++	}
++
++	return;
++}
++EXPORT_SYMBOL_GPL(rt2800_rf_configrecover);
++
++static void rt2800_setbbptonegenerator(struct rt2x00_dev *rt2x00dev)
++{
++	rt2800_bbp_write(rt2x00dev, 158, 0xAA);
++	rt2800_bbp_write(rt2x00dev, 159, 0x00);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0xAB);
++	rt2800_bbp_write(rt2x00dev, 159, 0x0A);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0xAC);
++	rt2800_bbp_write(rt2x00dev, 159, 0x3F);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0xAD);
++	rt2800_bbp_write(rt2x00dev, 159, 0x3F);
++
++	rt2800_bbp_write(rt2x00dev, 244, 0x40);
++
++	return;
++}
++EXPORT_SYMBOL_GPL(rt2800_setbbptonegenerator);
++
++u32 rt2800_do_fft_accumulation(struct rt2x00_dev *rt2x00dev, u8 tidx, u8 read_neg)
++{
++	u32 macvalue = 0;
++	int fftout_i = 0, fftout_q = 0;
++	u32 ptmp=0, pint = 0;
++	u8 bbp = 0;
++	u8 tidxi;
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x00);
++	rt2800_bbp_write(rt2x00dev, 159, 0x9b);
++
++	bbp = 0x9b;
++
++	while (bbp == 0x9b) {
++		udelay(10);
++		bbp = rt2800_bbp_read(rt2x00dev, 159);
++		bbp = bbp & 0xff;
++	}
++
++	rt2800_bbp_write(rt2x00dev, 158, 0xba);
++	rt2800_bbp_write(rt2x00dev, 159, tidx);
++	rt2800_bbp_write(rt2x00dev, 159, tidx);
++	rt2800_bbp_write(rt2x00dev, 159, tidx);
++
++	macvalue = rt2800_register_read(rt2x00dev, 0x057C);
++
++	fftout_i = (macvalue >> 16);
++	fftout_i = (fftout_i & 0x8000) ? (fftout_i - 0x10000) : fftout_i;
++	fftout_q = (macvalue & 0xffff);
++	fftout_q = (fftout_q & 0x8000) ? (fftout_q - 0x10000) : fftout_q;
++	ptmp = (fftout_i * fftout_i);
++	ptmp = ptmp + (fftout_q * fftout_q);
++	pint = ptmp;
++	rt2x00_dbg(rt2x00dev, "I = %d,  Q = %d, power = %x\n", fftout_i, fftout_q, pint);
++	if (read_neg) {
++		pint = pint >> 1;
++		tidxi = 0x40 - tidx;
++		tidxi = tidxi & 0x3f;
++
++		rt2800_bbp_write(rt2x00dev, 158, 0xba);
++		rt2800_bbp_write(rt2x00dev, 159, tidxi);
++		rt2800_bbp_write(rt2x00dev, 159, tidxi);
++		rt2800_bbp_write(rt2x00dev, 159, tidxi);
++	
++		macvalue = rt2800_register_read(rt2x00dev, 0x057C);
++	
++		fftout_i = (macvalue >> 16);
++		fftout_i = (fftout_i & 0x8000) ? (fftout_i - 0x10000) : fftout_i;
++		fftout_q = (macvalue & 0xffff);
++		fftout_q = (fftout_q & 0x8000) ? (fftout_q - 0x10000) : fftout_q;
++		ptmp = (fftout_i * fftout_i);
++		ptmp = ptmp + (fftout_q * fftout_q);
++		ptmp = ptmp >> 1;
++		pint = pint + ptmp;	
++		
++	}
++
++	return pint;
++}
++EXPORT_SYMBOL_GPL(rt2800_do_fft_accumulation);
++
++u32 rt2800_read_fft_accumulation(struct rt2x00_dev *rt2x00dev, u8 tidx) {
++	u32 macvalue = 0;
++	int fftout_i = 0, fftout_q = 0;
++	u32 ptmp=0, pint = 0;
++
++	rt2800_bbp_write(rt2x00dev, 158, 0xBA);
++	rt2800_bbp_write(rt2x00dev, 159, tidx);
++	rt2800_bbp_write(rt2x00dev, 159, tidx);
++	rt2800_bbp_write(rt2x00dev, 159, tidx);
++
++	macvalue = rt2800_register_read(rt2x00dev, 0x057C);
++
++	fftout_i = (macvalue >> 16);
++	fftout_i = (fftout_i & 0x8000) ? (fftout_i - 0x10000) : fftout_i;
++	fftout_q = (macvalue & 0xffff);
++	fftout_q = (fftout_q & 0x8000) ? (fftout_q - 0x10000) : fftout_q;
++	ptmp = (fftout_i * fftout_i);
++	ptmp = ptmp + (fftout_q * fftout_q);
++	pint = ptmp;
++	rt2x00_info(rt2x00dev, "I = %d,  Q = %d, power = %x\n", fftout_i, fftout_q, pint);
++
++	return pint;
++}
++EXPORT_SYMBOL_GPL(rt2800_read_fft_accumulation);
++
++static void rt2800_write_dc(struct rt2x00_dev *rt2x00dev, u8 ch_idx, u8 alc, u8 iorq, u8 dc)
++{
++	u8 bbp = 0;
++
++	rt2800_bbp_write(rt2x00dev, 158, 0xb0);
++	bbp = alc | 0x80;
++	rt2800_bbp_write(rt2x00dev, 159, bbp);
++
++	if (ch_idx == 0)
++		bbp = (iorq == 0) ? 0xb1: 0xb2;
++	else
++		bbp = (iorq == 0) ? 0xb8: 0xb9;
++
++	rt2800_bbp_write(rt2x00dev, 158, bbp);
++	bbp = dc;
++	rt2800_bbp_write(rt2x00dev, 159, bbp);
++
++	return;
++}
++EXPORT_SYMBOL_GPL(rt2800_write_dc);
++
++static void rt2800_loft_search(struct rt2x00_dev *rt2x00dev, u8 ch_idx, u8 alc_idx, u8 dc_result[][RF_ALC_NUM][2])	
++{
++	u32 p0 = 0, p1 = 0, pf = 0;
++	char idx0 = 0, idx1 = 0;
++	u8 idxf[] = {0x00, 0x00};
++	u8 ibit = 0x20;
++	u8 iorq;
++	char bidx;
++
++	rt2800_bbp_write(rt2x00dev, 158, 0xb0);
++	rt2800_bbp_write(rt2x00dev, 159, 0x80);
++
++	for (bidx = 5; bidx >= 0; bidx--) {
++		for (iorq = 0; iorq <= 1; iorq++) {
++			rt2x00_dbg(rt2x00dev, "\n========================================================\n");                 
++
++			if (idxf[iorq] == 0x20) {
++				idx0 = 0x20;
++				p0 = pf;
++			} else {
++				idx0 = idxf[iorq] - ibit;
++				idx0 = idx0 & 0x3F;
++				rt2800_write_dc(rt2x00dev, ch_idx, 0, iorq, idx0);
++				p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
++			}
++
++			idx1 = idxf[iorq] + ((bidx == 5) ? 0 : ibit);
++			idx1 = idx1 & 0x3F;
++			rt2800_write_dc(rt2x00dev, ch_idx, 0, iorq, idx1);
++			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
++
++			rt2x00_dbg(rt2x00dev, "alc=%u, IorQ=%u, idx_final=%2x\n", alc_idx, iorq, idxf[iorq]); 
++			rt2x00_dbg(rt2x00dev, "p0=%x, p1=%x, pf=%x, idx_0=%x, idx_1=%x, ibit=%x !\n", p0, p1, pf, idx0, idx1, ibit);
++
++			if ((bidx != 5) && (pf <= p0) && (pf < p1)) {
++				pf = pf;
++				idxf[iorq] = idxf[iorq];
++			} else if (p0 < p1) {
++				pf = p0;
++				idxf[iorq] = idx0 & 0x3F;
++			} else {
++				pf = p1;
++				idxf[iorq] = idx1 & 0x3F;
++			}
++			rt2x00_dbg(rt2x00dev, "IorQ=%u, idx_final[%u]:%x, pf:%8x\n", iorq, iorq, idxf[iorq], pf);
++
++			rt2800_write_dc(rt2x00dev, ch_idx, 0, iorq, idxf[iorq]);
++
++		}
++		ibit = ibit >> 1;
++	}
++	dc_result[ch_idx][alc_idx][0] = idxf[0];
++	dc_result[ch_idx][alc_idx][1] = idxf[1];
++
++	return;
++}
++EXPORT_SYMBOL_GPL(rt2800_loft_search);
++
++static void rt2800_iq_search(struct rt2x00_dev *rt2x00dev, u8 ch_idx, u8 *ges, u8 *pes)	
++{
++	u32 p0 = 0, p1 = 0, pf = 0;
++	char perr = 0, gerr = 0, iq_err = 0;
++	char pef = 0, gef = 0;
++	char psta, pend;
++	char gsta, gend;
++
++	u8 ibit = 0x20;
++	u8 first_search = 0x00, touch_neg_max = 0x00;
++	char idx0 = 0, idx1 = 0;
++	u8 gop;
++	u8 bbp = 0;
++	char bidx;
++
++	rt2x00_info(rt2x00dev, "IQCalibration Start!\n");
++	for (bidx = 5; bidx >= 1; bidx--) {
++		for (gop = 0; gop < 2; gop++) {
++			rt2x00_dbg(rt2x00dev, "\n========================================================\n");
++
++			if ((gop == 1) || (bidx < 4)) {
++				if (gop == 0)
++					iq_err = gerr;
++				else
++					iq_err = perr;
++
++				first_search = (gop == 0) ? (bidx == 3) : (bidx == 5);
++				touch_neg_max = (gop) ? ((iq_err & 0x0F) == 0x08) : ((iq_err & 0x3F) == 0x20);
++
++				if (touch_neg_max) {
++					p0 = pf;
++					idx0 = iq_err;
++				} else {
++					idx0 = iq_err - ibit;
++					bbp = (ch_idx == 0) ? ((gop == 0) ? 0x28 : 0x29): ((gop == 0) ? 0x46 : 0x47);
++
++					rt2800_bbp_write(rt2x00dev, 158, bbp);
++					rt2800_bbp_write(rt2x00dev, 159, idx0);
++
++					p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 1);
++				}
++
++				idx1 = iq_err + (first_search ? 0 : ibit);
++				idx1 = (gop == 0) ? (idx1 & 0x0F) : (idx1 & 0x3F);
++
++				bbp = (ch_idx == 0) ? (gop == 0) ? 0x28 : 0x29 : (gop == 0) ? 0x46 : 0x47;
++
++				rt2800_bbp_write(rt2x00dev, 158, bbp);
++				rt2800_bbp_write(rt2x00dev, 159, idx1);
++
++				p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 1);
++
++				rt2x00_dbg(rt2x00dev, "p0=%x, p1=%x, pwer_final=%x, idx0=%x, idx1=%x, iq_err=%x, gop=%d, ibit=%x !\n", p0, p1, pf, idx0, idx1, iq_err, gop, ibit);
++
++				if ((!first_search) && (pf <= p0) && (pf < p1)) {
++					pf = pf;
++				} else if (p0 < p1) {
++					pf = p0;
++					iq_err = idx0;
++				} else {
++					pf = p1;
++					iq_err = idx1;
++				}
++				
++				bbp = (ch_idx == 0) ? (gop == 0) ? 0x28 : 0x29 : (gop == 0) ? 0x46 : 0x47;
++
++				rt2800_bbp_write(rt2x00dev, 158, bbp);
++				rt2800_bbp_write(rt2x00dev, 159, iq_err);
++
++				if (gop == 0)
++					gerr = iq_err;
++				else
++					perr = iq_err;
++					
++				rt2x00_dbg(rt2x00dev, "IQCalibration pf=%8x (%2x, %2x) !\n", pf, gerr & 0x0F, perr & 0x3F);
++
++			}
++		}
++
++		if (bidx > 0)
++			ibit = (ibit >> 1);
++	} 
++	gerr = (gerr & 0x08) ? (gerr & 0x0F) - 0x10 : (gerr & 0x0F);
++	perr = (perr & 0x20) ? (perr & 0x3F) - 0x40 : (perr & 0x3F);
++	
++	gerr = (gerr < -0x07) ? -0x07 : (gerr > 0x05) ? 0x05 : gerr;
++	gsta = gerr - 1;
++	gend = gerr + 2;
++	
++	perr = (perr < -0x1f) ? -0x1f : (perr > 0x1d) ? 0x1d : perr;
++	psta = perr - 1;
++	pend = perr + 2;
++
++	for (gef = gsta; gef <= gend; gef = gef + 1)
++		for (pef = psta; pef <= pend; pef = pef + 1) {
++			bbp = (ch_idx == 0) ? 0x28 : 0x46;
++			rt2800_bbp_write(rt2x00dev, 158, bbp);
++			rt2800_bbp_write(rt2x00dev, 159, gef & 0x0F);
++			
++			bbp = (ch_idx == 0) ? 0x29 : 0x47;
++			rt2800_bbp_write(rt2x00dev, 158, bbp);
++			rt2800_bbp_write(rt2x00dev, 159, pef & 0x3F);
++			
++			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 1);
++			if ((gef == gsta) && (pef == psta)) {
++				pf = p1;
++				gerr = gef;
++				perr = pef;
++			}
++			else if (pf > p1){
++				pf = p1;
++				gerr = gef;
++				perr = pef;
++			}
++			rt2x00_dbg(rt2x00dev, "Fine IQCalibration p1=%8x pf=%8x (%2x, %2x) !\n", p1, pf, gef & 0x0F, pef & 0x3F);
++		}
++		
++	ges[ch_idx] = gerr & 0x0F;
++	pes[ch_idx] = perr & 0x3F;
++	
++	rt2x00_info(rt2x00dev, "IQCalibration Done! CH = %u, (gain=%2x, phase=%2x)\n", ch_idx, gerr & 0x0F, perr & 0x3F);
++
++	return;
++}
++EXPORT_SYMBOL_GPL(rt2800_iq_search);
++
++static void rt2800_rf_aux_tx0_loopback(struct rt2x00_dev *rt2x00dev)
++{
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, 0x21);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, 0x10);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x00);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, 0x1b);
++	rt2800_rfcsr_write_bank(rt2x00dev, 4, 0, 0x81);
++	rt2800_rfcsr_write_bank(rt2x00dev, 4, 2, 0x81);
++	rt2800_rfcsr_write_bank(rt2x00dev, 4, 34, 0xee);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 3, 0x2d);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, 0x2d);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 17, 0x80);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 18, 0xd7);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 19, 0xa2);
++	rt2800_rfcsr_write_bank(rt2x00dev, 5, 20, 0x20);
++}
++EXPORT_SYMBOL_GPL(rt2800_rf_aux_tx0_loopback);
++
++static void rt2800_rf_aux_tx1_loopback(struct rt2x00_dev *rt2x00dev)
++{
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, 0x22);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, 0x20);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x00);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, 0x4b);
++	rt2800_rfcsr_write_bank(rt2x00dev, 6, 0, 0x81);
++	rt2800_rfcsr_write_bank(rt2x00dev, 6, 2, 0x81);
++	rt2800_rfcsr_write_bank(rt2x00dev, 6, 34, 0xee);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 3, 0x2d);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 4, 0x2d);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 17, 0x80);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 18, 0xd7);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 19, 0xa2);
++	rt2800_rfcsr_write_bank(rt2x00dev, 7, 20, 0x20);
++}
++EXPORT_SYMBOL_GPL(rt2800_rf_aux_tx1_loopback);
++
++void rt2800_loft_iq_calibration(struct rt2x00_dev *rt2x00dev)
++{
++	rf_reg_pair rf_store[CHAIN_NUM][13];
++	u32 macorg1 = 0;
++	u32 macorg2 = 0;
++	u32 macorg3 = 0;
++	u32 macorg4 = 0;
++	u32 macorg5 = 0;
++	u32 orig528 = 0;
++	u32 orig52c = 0;
++
++	u32 savemacsysctrl = 0, mtxcycle = 0;
++	u32 macvalue = 0;
++	u32 mac13b8 = 0;
++	u32 p0 = 0, p1 = 0;
++	u32 p0_idx10 = 0, p1_idx10 = 0;
++
++	u8 rfvalue;
++	u8 loft_dc_search_result[CHAIN_NUM][RF_ALC_NUM][2];
++	u8 ger[CHAIN_NUM], per[CHAIN_NUM];
++	u8 rf_gain[] = {0x00, 0x01, 0x02, 0x04, 0x08, 0x0c};
++	u8 rfvga_gain_table[] = {0x24, 0x25, 0x26, 0x27, 0x28, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3F};
++
++	u8 vga_gain[] = {14, 14};   
++	u8 bbp_2324gain[] = {0x16, 0x14, 0x12, 0x10, 0x0c, 0x08};
++	u8 bbp = 0, ch_idx = 0, rf_alc_idx = 0, idx = 0;
++	u8 bbpr30, rfb0r39, rfb0r42;
++	u8 bbpr1;
++	u8 bbpr4;
++	u8 bbpr241, bbpr242;
++	u8 count_step;
++
++	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	macorg1 = rt2800_register_read(rt2x00dev, TX_PIN_CFG);
++	macorg2 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
++	macorg3 = rt2800_register_read(rt2x00dev, RF_BYPASS0);
++	macorg4 = rt2800_register_read(rt2x00dev, RF_CONTROL3);
++	macorg5 = rt2800_register_read(rt2x00dev, RF_BYPASS3);
++	mac13b8 = rt2800_register_read(rt2x00dev, 0x13b8);
++	orig528 = rt2800_register_read(rt2x00dev, RF_CONTROL2);
++	orig52c = rt2800_register_read(rt2x00dev, RF_BYPASS2);
++
++	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	macvalue &= (~0x04);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
++
++	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
++		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (macvalue & 0x01)
++			udelay(50);
++		else
++			break;
++	}
++
++	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	macvalue &= (~0x08);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
++
++	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
++		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (macvalue & 0x02)
++			udelay(50);
++		else
++			break;
++	} 
++
++	for (ch_idx = 0; ch_idx < 2; ch_idx++) {
++		rt2800_rf_configstore(rt2x00dev, rf_store, ch_idx);
++	}
++
++	bbpr30 = rt2800_bbp_read(rt2x00dev, 30);
++	rfb0r39 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 39);
++	rfb0r42 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 42);
++
++	rt2800_bbp_write(rt2x00dev, 30, 0x1F);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 39, 0x80);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, 0x5B);
++
++	rt2800_bbp_write(rt2x00dev, 23, 0x00);
++	rt2800_bbp_write(rt2x00dev, 24, 0x00);
++
++	rt2800_setbbptonegenerator(rt2x00dev);
++
++	for (ch_idx = 0; ch_idx < 2; ch_idx ++) {
++		rt2800_bbp_write(rt2x00dev, 23, 0x00);
++		rt2800_bbp_write(rt2x00dev, 24, 0x00);
++		rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00);
++		rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0x0000000F);
++		rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000004);
++		rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00003306);
++		rt2800_register_write(rt2x00dev, 0x13b8, 0x10);
++		udelay(1);
++
++		if (ch_idx == 0) {
++			rt2800_rf_aux_tx0_loopback(rt2x00dev);
++		} else {
++			rt2800_rf_aux_tx1_loopback(rt2x00dev);
++		}
++		udelay(1);
++
++		if (ch_idx == 0) {
++			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001004);
++		} else {
++			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002004);
++		}
++
++		rt2800_bbp_write(rt2x00dev, 158, 0x05);
++		rt2800_bbp_write(rt2x00dev, 159, 0x00);
++	
++		rt2800_bbp_write(rt2x00dev, 158, 0x01);
++		if (ch_idx == 0)
++			rt2800_bbp_write(rt2x00dev, 159, 0x00);
++		else
++			rt2800_bbp_write(rt2x00dev, 159, 0x01);
++	
++		vga_gain[ch_idx] = 18;
++		for (rf_alc_idx = 0; rf_alc_idx < 3; rf_alc_idx++) {
++			rt2800_bbp_write(rt2x00dev, 23, bbp_2324gain[rf_alc_idx]);
++			rt2800_bbp_write(rt2x00dev, 24, bbp_2324gain[rf_alc_idx]);
++
++			macvalue = rt2800_register_read(rt2x00dev, RF_CONTROL3);
++			macvalue &= (~0x0000F1F1);
++			macvalue |= (rf_gain[rf_alc_idx] << 4);
++			macvalue |= (rf_gain[rf_alc_idx] << 12);
++			rt2800_register_write(rt2x00dev, RF_CONTROL3, macvalue);
++			macvalue = (0x0000F1F1);
++			rt2800_register_write(rt2x00dev, RF_BYPASS3, macvalue);
++
++ 			if (rf_alc_idx == 0) {
++				rt2800_write_dc(rt2x00dev, ch_idx, 0, 1, 0x21);
++				for (;vga_gain[ch_idx] > 0;vga_gain[ch_idx] = vga_gain[ch_idx] - 2) {
++					rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
++					rt2800_rfcsr_write_dccal(rt2x00dev, 3, rfvalue);
++					rt2800_rfcsr_write_dccal(rt2x00dev, 4, rfvalue);
++					rt2800_write_dc(rt2x00dev, ch_idx, 0, 1, 0x00);
++					rt2800_write_dc(rt2x00dev, ch_idx, 0, 0, 0x00);
++					p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
++					rt2800_write_dc(rt2x00dev, ch_idx, 0, 0, 0x21);
++					p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
++					rt2x00_dbg(rt2x00dev, "LOFT AGC %d %d\n", p0, p1); 
++					if ((p0 < 7000*7000) && (p1 < (7000*7000))) {						
++						break;
++					}
++				}
++
++				rt2800_write_dc(rt2x00dev, ch_idx, 0, 0, 0x00);
++				rt2800_write_dc(rt2x00dev, ch_idx, 0, 1, 0x00);
++				
++				rt2x00_dbg(rt2x00dev, "Used VGA %d %x\n",vga_gain[ch_idx], rfvga_gain_table[vga_gain[ch_idx]]); 
++
++				if (vga_gain[ch_idx] < 0)
++					vga_gain[ch_idx] = 0;
++		 	}			
++
++			rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
++			
++			rt2800_rfcsr_write_dccal(rt2x00dev, 3, rfvalue);
++			rt2800_rfcsr_write_dccal(rt2x00dev, 4, rfvalue);
++	
++			rt2800_loft_search(rt2x00dev, ch_idx, rf_alc_idx, loft_dc_search_result);
++		}
++	}
++
++	for (rf_alc_idx = 0; rf_alc_idx < 3; rf_alc_idx++) {
++		for (idx = 0; idx < 4; idx++) {
++			rt2800_bbp_write(rt2x00dev, 158, 0xB0);
++			bbp = (idx<<2) + rf_alc_idx;
++			rt2800_bbp_write(rt2x00dev, 159, bbp);
++			rt2x00_dbg(rt2x00dev, " ALC %2x,", bbp);
++
++			rt2800_bbp_write(rt2x00dev, 158, 0xb1);
++			bbp = loft_dc_search_result[CHAIN_0][rf_alc_idx][0x00]; 
++			bbp = bbp & 0x3F; 
++			rt2800_bbp_write(rt2x00dev, 159, bbp);
++			rt2x00_dbg(rt2x00dev, " I0 %2x,", bbp);
++
++			rt2800_bbp_write(rt2x00dev, 158, 0xb2);
++			bbp = loft_dc_search_result[CHAIN_0][rf_alc_idx][0x01]; 
++			bbp = bbp & 0x3F; 
++			rt2800_bbp_write(rt2x00dev, 159, bbp);
++			rt2x00_dbg(rt2x00dev, " Q0 %2x,", bbp);
++
++			rt2800_bbp_write(rt2x00dev, 158, 0xb8);
++			bbp = loft_dc_search_result[CHAIN_1][rf_alc_idx][0x00]; 
++			bbp = bbp & 0x3F; 
++			rt2800_bbp_write(rt2x00dev, 159, bbp);
++			rt2x00_dbg(rt2x00dev, " I1 %2x,", bbp);
++
++			rt2800_bbp_write(rt2x00dev, 158, 0xb9);
++			bbp = loft_dc_search_result[CHAIN_1][rf_alc_idx][0x01]; 
++			bbp = bbp & 0x3F; 
++			rt2800_bbp_write(rt2x00dev, 159, bbp);
++			rt2x00_dbg(rt2x00dev, " Q1 %2x\n", bbp);
++		} 
++	}
++
++	rt2800_bbp_write(rt2x00dev, 23, 0x00);
++	rt2800_bbp_write(rt2x00dev, 24, 0x00);
++
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x04);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x00);
++	rt2800_bbp_write(rt2x00dev, 159, 0x00);
++
++	bbp = 0x00;
++	rt2800_bbp_write(rt2x00dev, 244, 0x00);
++
++	rt2800_bbp_write(rt2x00dev, 21, 0x01);
++	udelay(1);
++	rt2800_bbp_write(rt2x00dev, 21, 0x00);
++
++	rt2800_rf_configrecover(rt2x00dev, rf_store);
++
++	rt2800_register_write(rt2x00dev, TX_PIN_CFG, macorg1);
++  	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x04);
++  	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, macorg2);
++	udelay(1);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, macorg3);
++	rt2800_register_write(rt2x00dev, RF_CONTROL3, macorg4);
++	rt2800_register_write(rt2x00dev, RF_BYPASS3, macorg5);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
++	rt2800_register_write(rt2x00dev, RF_CONTROL2, orig528);
++	rt2800_register_write(rt2x00dev, RF_BYPASS2, orig52c);
++	rt2800_register_write(rt2x00dev, 0x13b8, mac13b8);
++
++	rt2x00_info(rt2x00dev, "LOFT Calibration Done!\n");
++
++	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	macorg1 = rt2800_register_read(rt2x00dev, TX_PIN_CFG);
++	macorg2 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
++	macorg3 = rt2800_register_read(rt2x00dev, RF_BYPASS0);
++	macorg4 = rt2800_register_read(rt2x00dev, RF_CONTROL3);
++	macorg5 = rt2800_register_read(rt2x00dev, RF_BYPASS3);
++
++	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++		bbpr1 = rt2800_bbp_read(rt2x00dev, 1);
++		bbpr4 = rt2800_bbp_read(rt2x00dev, 4);
++		bbpr241 = rt2800_bbp_read(rt2x00dev, 241);
++		bbpr242 = rt2800_bbp_read(rt2x00dev, 242);
++	}
++	mac13b8 = rt2800_register_read(rt2x00dev, 0x13b8);
++
++	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	macvalue &= (~0x04);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
++	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
++		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (macvalue & 0x01)
++			udelay(50);
++		else
++			break;
++	}
++
++	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
++	macvalue &= (~0x08);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
++	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
++		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (macvalue & 0x02)
++			udelay(50);
++		else
++			break;
++	}
++
++	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x00000101);
++		rt2800_register_write(rt2x00dev, RF_BYPASS3, 0x0000F1F1);
++	}
++
++	rt2800_bbp_write(rt2x00dev, 23, 0x00);
++	rt2800_bbp_write(rt2x00dev, 24, 0x00);
++
++	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++		rt2800_bbp_write(rt2x00dev, 4, bbpr4 & (~0x18));
++		rt2800_bbp_write(rt2x00dev, 21, 0x01);
++		udelay(1);
++		rt2800_bbp_write(rt2x00dev, 21, 0x00);
++
++		rt2800_bbp_write(rt2x00dev, 241, 0x14);
++		rt2800_bbp_write(rt2x00dev, 242, 0x80);
++		rt2800_bbp_write(rt2x00dev, 244, 0x31);
++	} else {
++		rt2800_setbbptonegenerator(rt2x00dev);
++	}
++
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000004);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00003306);
++	udelay(1);
++	
++	rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0x0000000F);
++
++	if (!test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x00000000);
++		rt2800_register_write(rt2x00dev, RF_BYPASS3, 0x0000F1F1);
++	}
++
++	rt2800_register_write(rt2x00dev, 0x13b8, 0x00000010);
++
++	for (ch_idx = 0; ch_idx < 2; ch_idx++) {
++		rt2800_rf_configstore(rt2x00dev, rf_store, ch_idx);
++	}
++
++	rt2800_rfcsr_write_dccal(rt2x00dev, 3, 0x3B);
++	rt2800_rfcsr_write_dccal(rt2x00dev, 4, 0x3B);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x03);
++	rt2800_bbp_write(rt2x00dev, 159, 0x60);
++	rt2800_bbp_write(rt2x00dev, 158, 0xB0);
++	rt2800_bbp_write(rt2x00dev, 159, 0x80);
++
++	for (ch_idx = 0; ch_idx < 2; ch_idx ++) {
++		rt2800_bbp_write(rt2x00dev, 23, 0x00);
++		rt2800_bbp_write(rt2x00dev, 24, 0x00);
++
++		if (ch_idx == 0) {
++			rt2800_bbp_write(rt2x00dev, 158, 0x01);
++			rt2800_bbp_write(rt2x00dev, 159, 0x00);
++			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++				bbp = bbpr1 & (~0x18);
++				bbp = bbp | 0x00;
++				rt2800_bbp_write(rt2x00dev, 1, bbp);
++			}
++			rt2800_rf_aux_tx0_loopback(rt2x00dev);
++			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001004);
++		} else {
++			rt2800_bbp_write(rt2x00dev, 158, 0x01);
++			rt2800_bbp_write(rt2x00dev, 159, 0x01);
++			if (test_bit(CAPABILITY_EXTERNAL_PA_TX1, &rt2x00dev->cap_flags)) {
++				bbp = bbpr1 & (~0x18);
++				bbp = bbp | 0x08;
++				rt2800_bbp_write(rt2x00dev, 1, bbp);
++			}
++			rt2800_rf_aux_tx1_loopback(rt2x00dev);
++			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002004);
++		}
++
++		rt2800_bbp_write(rt2x00dev, 158, 0x05);
++		rt2800_bbp_write(rt2x00dev, 159, 0x04);
++
++		bbp = (ch_idx == 0) ? 0x28 : 0x46;
++		rt2800_bbp_write(rt2x00dev, 158, bbp);
++		rt2800_bbp_write(rt2x00dev, 159, 0x00);
++		
++		if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++			rt2800_bbp_write(rt2x00dev, 23, 0x06);
++			rt2800_bbp_write(rt2x00dev, 24, 0x06);
++			count_step = 1;
++		} else {
++			rt2800_bbp_write(rt2x00dev, 23, 0x1F);
++			rt2800_bbp_write(rt2x00dev, 24, 0x1F);
++			count_step = 2;
++		}
++
++		for (;vga_gain[ch_idx] < 19; vga_gain[ch_idx]=(vga_gain[ch_idx] + count_step)) {
++			rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
++			rt2800_rfcsr_write_dccal(rt2x00dev, 3, rfvalue);
++			rt2800_rfcsr_write_dccal(rt2x00dev, 4, rfvalue);
++			
++			bbp = (ch_idx == 0) ? 0x29 : 0x47;
++			rt2800_bbp_write(rt2x00dev, 158, bbp);
++			rt2800_bbp_write(rt2x00dev, 159, 0x00);
++			p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 0);
++			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++				p0_idx10 = rt2800_read_fft_accumulation(rt2x00dev, 0x0A);
++			}
++
++			bbp = (ch_idx == 0) ? 0x29 : 0x47;
++			rt2800_bbp_write(rt2x00dev, 158, bbp);
++			rt2800_bbp_write(rt2x00dev, 159, 0x21);
++			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 0);
++			if (test_bit(CAPABILITY_EXTERNAL_PA_TX1, &rt2x00dev->cap_flags)) {
++				p1_idx10 = rt2800_read_fft_accumulation(rt2x00dev, 0x0A);
++			}
++
++			rt2x00_dbg(rt2x00dev, "IQ AGC %d %d\n", p0, p1);
++
++			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++				rt2x00_dbg(rt2x00dev, "IQ AGC IDX 10 %d %d\n", p0_idx10, p1_idx10);
++				if ((p0_idx10 > 7000*7000) || (p1_idx10 > 7000*7000)) {
++					if (vga_gain[ch_idx]!=0)
++						vga_gain[ch_idx] = vga_gain[ch_idx]-1;
++					break;
++				}
++			}
++
++			if ((p0 > 2500*2500) || (p1 > 2500*2500)) {
++				break;
++			}
++		}
++
++		if (vga_gain[ch_idx] > 18)
++			vga_gain[ch_idx] = 18;
++		rt2x00_dbg(rt2x00dev, "Used VGA %d %x\n",vga_gain[ch_idx], rfvga_gain_table[vga_gain[ch_idx]]); 
++
++		bbp = (ch_idx == 0) ? 0x29 : 0x47;
++		rt2800_bbp_write(rt2x00dev, 158, bbp);
++		rt2800_bbp_write(rt2x00dev, 159, 0x00);
++
++		rt2800_iq_search(rt2x00dev, ch_idx, ger, per);
++	}	
++
++	rt2800_bbp_write(rt2x00dev, 23, 0x00);
++	rt2800_bbp_write(rt2x00dev, 24, 0x00);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x04);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x28);
++	bbp = ger[CHAIN_0] & 0x0F;
++	rt2800_bbp_write(rt2x00dev, 159, bbp);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x29);
++	bbp = per[CHAIN_0] & 0x3F; 
++	rt2800_bbp_write(rt2x00dev, 159, bbp);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x46);
++	bbp = ger[CHAIN_1] & 0x0F; 
++	rt2800_bbp_write(rt2x00dev, 159, bbp);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x47);
++	bbp = per[CHAIN_1] & 0x3F; 
++	rt2800_bbp_write(rt2x00dev, 159, bbp); 
++ 
++	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++		rt2800_bbp_write(rt2x00dev, 1, bbpr1);
++		rt2800_bbp_write(rt2x00dev, 241, bbpr241);
++		rt2800_bbp_write(rt2x00dev, 242, bbpr242);
++	}
++	rt2800_bbp_write(rt2x00dev, 244, 0x00);
++
++	rt2800_bbp_write(rt2x00dev, 158, 0x00);
++	rt2800_bbp_write(rt2x00dev, 159, 0x00);
++	rt2800_bbp_write(rt2x00dev, 158, 0xB0);
++	rt2800_bbp_write(rt2x00dev, 159, 0x00);
++
++	rt2800_bbp_write(rt2x00dev, 30, bbpr30);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 39, rfb0r39);
++	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfb0r42);
++
++	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++		rt2800_bbp_write(rt2x00dev, 4, bbpr4);
++	}
++
++	rt2800_bbp_write(rt2x00dev, 21, 0x01);
++	udelay(1);
++	rt2800_bbp_write(rt2x00dev, 21, 0x00);
++
++	rt2800_rf_configrecover(rt2x00dev, rf_store);
++
++	rt2800_register_write(rt2x00dev, TX_PIN_CFG, macorg1);
++  	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00);
++	rt2800_register_write(rt2x00dev, RF_CONTROL0, macorg2);
++	udelay(1);
++	rt2800_register_write(rt2x00dev, RF_BYPASS0, macorg3);
++	rt2800_register_write(rt2x00dev, RF_CONTROL3, macorg4);
++	rt2800_register_write(rt2x00dev, RF_BYPASS3, macorg5);
++	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
++	rt2800_register_write(rt2x00dev, 0x13b8, mac13b8);
++
++	rt2x00_info(rt2x00dev, "TX IQ Calibration Done!\n");
++
++	return;
++}
++EXPORT_SYMBOL_GPL(rt2800_loft_iq_calibration);
++
+ static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
+ 				       bool set_bw, bool is_ht40)
+ {
+@@ -9612,6 +10563,7 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_rxdcoc_calibration(rt2x00dev);
+ 	rt2800_bw_filter_calibration(rt2x00dev, true);
+ 	rt2800_bw_filter_calibration(rt2x00dev, false);
++	rt2800_loft_iq_calibration(rt2x00dev);
+ 	rt2800_rxiq_calibration(rt2x00dev);
+ }
+ 
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
+@@ -28,6 +28,16 @@
+ #define WCID_START	33
+ #define WCID_END	222
+ #define STA_IDS_SIZE	(WCID_END - WCID_START + 2)
++#define CHAIN_0		0x0
++#define CHAIN_1		0x1
++#define RF_ALC_NUM	6 
++#define CHAIN_NUM	2
++
++typedef struct rf_reg_pair {
++	u8 bank;
++	u8 reg;
++	u8 value;
++} rf_reg_pair;
+ 
+ /* RT2800 driver data structure */
+ struct rt2800_drv_data {
+@@ -247,6 +257,7 @@ int rt2800_calcrcalibrationcode(struct r
+ void rt2800_r_calibration(struct rt2x00_dev *rt2x00dev);
+ void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev);
+ void rt2800_rxiq_calibration(struct rt2x00_dev *rt2x00dev);
++void rt2800_loft_iq_calibration(struct rt2x00_dev *rt2x00dev);
+ 
+ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
+ void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -577,6 +577,7 @@ struct rt2x00lib_ops {
+ 	void (*r_calibration) (struct rt2x00_dev *rt2x00dev);
+ 	void (*rxdcoc_calibration) (struct rt2x00_dev *rt2x00dev);
+ 	void (*rxiq_calibration) (struct rt2x00_dev *rt2x00dev);
++	void (*loft_iq_calibration) (struct rt2x00_dev *rt2x00dev);
+ 
+ 	/*
+ 	 * Data queue handlers.
diff --git a/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch b/package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch
similarity index 96%
rename from package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
rename to package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch
index 8d7a39a6d..0fe6ee196 100644
--- a/package/kernel/mac80211/patches/100-remove-cryptoapi-dependencies.patch
+++ b/package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/Makefile
 +++ b/net/mac80211/Makefile
-@@ -6,7 +6,6 @@ mac80211-y := \
+@@ -7,7 +7,6 @@ mac80211-y := \
  	driver-ops.o \
  	sta_info.o \
  	wep.o \
@@ -8,7 +8,7 @@
  	wpa.o \
  	scan.o offchannel.o \
  	ht.o agg-tx.o agg-rx.o \
-@@ -16,8 +15,8 @@ mac80211-y := \
+@@ -18,8 +17,8 @@ mac80211-y := \
  	rate.o \
  	michael.o \
  	tkip.o \
@@ -385,7 +385,7 @@
  #endif /* AES_GCM_H */
 --- a/net/mac80211/wpa.c
 +++ b/net/mac80211/wpa.c
-@@ -306,7 +306,8 @@ ieee80211_crypto_tkip_decrypt(struct iee
+@@ -314,7 +314,8 @@ ieee80211_crypto_tkip_decrypt(struct iee
  }
  
  
@@ -395,7 +395,7 @@
  {
  	__le16 mask_fc;
  	int a4_included, mgmt;
-@@ -336,14 +337,8 @@ static void ccmp_special_blocks(struct s
+@@ -344,14 +345,8 @@ static void ccmp_special_blocks(struct s
  	else
  		qos_tid = 0;
  
@@ -412,7 +412,7 @@
  
  	/* Nonce: Nonce Flags | A2 | PN
  	 * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
-@@ -351,6 +346,8 @@ static void ccmp_special_blocks(struct s
+@@ -359,6 +354,8 @@ static void ccmp_special_blocks(struct s
  	b_0[1] = qos_tid | (mgmt << 4);
  	memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
  	memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
@@ -421,7 +421,7 @@
  
  	/* AAD (extra authenticate-only data) / masked 802.11 header
  	 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
-@@ -407,7 +404,7 @@ static int ccmp_encrypt_skb(struct ieee8
+@@ -415,7 +412,7 @@ static int ccmp_encrypt_skb(struct ieee8
  	u8 *pos;
  	u8 pn[6];
  	u64 pn64;
@@ -430,7 +430,7 @@
  	u8 b_0[AES_BLOCK_SIZE];
  
  	if (info->control.hw_key &&
-@@ -462,9 +459,11 @@ static int ccmp_encrypt_skb(struct ieee8
+@@ -470,9 +467,11 @@ static int ccmp_encrypt_skb(struct ieee8
  		return 0;
  
  	pos += IEEE80211_CCMP_HDR_LEN;
@@ -445,7 +445,7 @@
  }
  
  
-@@ -537,13 +536,13 @@ ieee80211_crypto_ccmp_decrypt(struct iee
+@@ -545,13 +544,13 @@ ieee80211_crypto_ccmp_decrypt(struct iee
  			u8 aad[2 * AES_BLOCK_SIZE];
  			u8 b_0[AES_BLOCK_SIZE];
  			/* hardware didn't decrypt/verify MIC */
@@ -461,7 +461,7 @@
  				return RX_DROP_UNUSABLE;
  		}
  
-@@ -639,7 +638,7 @@ static int gcmp_encrypt_skb(struct ieee8
+@@ -646,7 +645,7 @@ static int gcmp_encrypt_skb(struct ieee8
  	u8 *pos;
  	u8 pn[6];
  	u64 pn64;
@@ -470,7 +470,7 @@
  	u8 j_0[AES_BLOCK_SIZE];
  
  	if (info->control.hw_key &&
-@@ -696,8 +695,10 @@ static int gcmp_encrypt_skb(struct ieee8
+@@ -703,8 +702,10 @@ static int gcmp_encrypt_skb(struct ieee8
  
  	pos += IEEE80211_GCMP_HDR_LEN;
  	gcmp_special_blocks(skb, pn, j_0, aad);
@@ -483,7 +483,7 @@
  }
  
  ieee80211_tx_result
-@@ -1121,9 +1122,9 @@ ieee80211_crypto_aes_gmac_encrypt(struct
+@@ -1127,9 +1128,9 @@ ieee80211_crypto_aes_gmac_encrypt(struct
  	struct ieee80211_key *key = tx->key;
  	struct ieee80211_mmie_16 *mmie;
  	struct ieee80211_hdr *hdr;
@@ -495,7 +495,7 @@
  
  	if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
  		return TX_DROP;
-@@ -1169,7 +1170,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct
+@@ -1175,7 +1176,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct
  	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  	struct ieee80211_key *key = rx->key;
  	struct ieee80211_mmie_16 *mmie;
diff --git a/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
similarity index 84%
rename from package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
rename to package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
index 3b1fcdf9c..4630274cb 100644
--- a/package/kernel/mac80211/patches/110-mac80211_keep_keys_on_stop_ap.patch
+++ b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
@@ -2,7 +2,7 @@ Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnects
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1058,7 +1058,6 @@ static int ieee80211_stop_ap(struct wiph
+@@ -1063,7 +1063,6 @@ static int ieee80211_stop_ap(struct wiph
  	sdata->u.ap.driver_smps_mode = IEEE80211_SMPS_OFF;
  
  	__sta_info_flush(sdata, true);
diff --git a/package/kernel/mac80211/patches/120-cfg80211_allow_perm_addr_change.patch b/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
similarity index 100%
rename from package/kernel/mac80211/patches/120-cfg80211_allow_perm_addr_change.patch
rename to package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
diff --git a/package/kernel/mac80211/patches/130-disable-fils.patch b/package/kernel/mac80211/patches/subsys/130-disable-fils.patch
similarity index 91%
rename from package/kernel/mac80211/patches/130-disable-fils.patch
rename to package/kernel/mac80211/patches/subsys/130-disable-fils.patch
index 1f0358987..f1163764a 100644
--- a/package/kernel/mac80211/patches/130-disable-fils.patch
+++ b/package/kernel/mac80211/patches/subsys/130-disable-fils.patch
@@ -21,7 +21,7 @@ Disable FILS support, since it pulls in crypto hash support
   * Copyright 2016, Qualcomm Atheros, Inc.
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -550,7 +550,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -570,7 +570,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  			   NL80211_FEATURE_MAC_ON_CREATE |
  			   NL80211_FEATURE_USERSPACE_MPM |
  			   NL80211_FEATURE_FULL_AP_CLIENT_STATE;
@@ -29,4 +29,4 @@ Disable FILS support, since it pulls in crypto hash support
 +#if 0 /* LINUX_VERSION_IS_GEQ(4,3,0) */
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_STA);
  #endif
- 
+ 	wiphy_ext_feature_set(wiphy,
diff --git a/package/kernel/mac80211/patches/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch b/package/kernel/mac80211/patches/subsys/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
similarity index 100%
rename from package/kernel/mac80211/patches/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
rename to package/kernel/mac80211/patches/subsys/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
diff --git a/package/kernel/mac80211/patches/132-mac80211-remove-cmac-dependency.patch b/package/kernel/mac80211/patches/subsys/132-mac80211-remove-cmac-dependency.patch
similarity index 100%
rename from package/kernel/mac80211/patches/132-mac80211-remove-cmac-dependency.patch
rename to package/kernel/mac80211/patches/subsys/132-mac80211-remove-cmac-dependency.patch
diff --git a/package/kernel/mac80211/patches/140-tweak-TSQ-setting.patch b/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch
similarity index 93%
rename from package/kernel/mac80211/patches/140-tweak-TSQ-setting.patch
rename to package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch
index 6e9a07a92..e0fe5a1b7 100644
--- a/package/kernel/mac80211/patches/140-tweak-TSQ-setting.patch
+++ b/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -3750,6 +3750,12 @@ out:
+@@ -3787,6 +3787,12 @@ out:
  netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
  				       struct net_device *dev)
  {
diff --git a/package/kernel/mac80211/patches/150-disable_addr_notifier.patch b/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch
similarity index 82%
rename from package/kernel/mac80211/patches/150-disable_addr_notifier.patch
rename to package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch
index 781dd3c1b..db3c693fd 100644
--- a/package/kernel/mac80211/patches/150-disable_addr_notifier.patch
+++ b/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -292,7 +292,7 @@ void ieee80211_restart_hw(struct ieee802
+@@ -315,7 +315,7 @@ void ieee80211_restart_hw(struct ieee802
  }
  EXPORT_SYMBOL(ieee80211_restart_hw);
  
@@ -9,7 +9,7 @@
  static int ieee80211_ifa_changed(struct notifier_block *nb,
  				 unsigned long data, void *arg)
  {
-@@ -351,7 +351,7 @@ static int ieee80211_ifa_changed(struct
+@@ -374,7 +374,7 @@ static int ieee80211_ifa_changed(struct
  }
  #endif
  
@@ -18,9 +18,9 @@
  static int ieee80211_ifa6_changed(struct notifier_block *nb,
  				  unsigned long data, void *arg)
  {
-@@ -1114,14 +1114,14 @@ int ieee80211_register_hw(struct ieee802
- 	if (result)
- 		goto fail_flows;
+@@ -1168,14 +1168,14 @@ int ieee80211_register_hw(struct ieee802
+ 
+ 	rtnl_unlock();
  
 -#ifdef CONFIG_INET
 +#ifdef __disabled__CONFIG_INET
@@ -35,7 +35,7 @@
  	local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
  	result = register_inet6addr_notifier(&local->ifa6_notifier);
  	if (result)
-@@ -1130,13 +1130,13 @@ int ieee80211_register_hw(struct ieee802
+@@ -1184,13 +1184,13 @@ int ieee80211_register_hw(struct ieee802
  
  	return 0;
  
@@ -51,8 +51,8 @@
 +#if defined(__disabled__CONFIG_INET) || defined(__disabled__CONFIG_IPV6)
   fail_ifa:
  #endif
- 	ieee80211_txq_teardown_flows(local);
-@@ -1166,10 +1166,10 @@ void ieee80211_unregister_hw(struct ieee
+ 	rtnl_lock();
+@@ -1220,10 +1220,10 @@ void ieee80211_unregister_hw(struct ieee
  	tasklet_kill(&local->tx_pending_tasklet);
  	tasklet_kill(&local->tasklet);
  
@@ -64,4 +64,4 @@
 +#if IS_ENABLED(__disabled__CONFIG_IPV6)
  	unregister_inet6addr_notifier(&local->ifa6_notifier);
  #endif
- 
+ 	ieee80211_txq_teardown_flows(local);
diff --git a/package/kernel/mac80211/patches/210-ap_scan.patch b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
similarity index 83%
rename from package/kernel/mac80211/patches/210-ap_scan.patch
rename to package/kernel/mac80211/patches/subsys/210-ap_scan.patch
index 8ade963c9..174096f5e 100644
--- a/package/kernel/mac80211/patches/210-ap_scan.patch
+++ b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2215,7 +2215,7 @@ static int ieee80211_scan(struct wiphy *
+@@ -2229,7 +2229,7 @@ static int ieee80211_scan(struct wiphy *
  		 * the  frames sent while scanning on other channel will be
  		 * lost)
  		 */
diff --git a/package/kernel/mac80211/patches/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch b/package/kernel/mac80211/patches/subsys/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
similarity index 90%
rename from package/kernel/mac80211/patches/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
rename to package/kernel/mac80211/patches/subsys/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
index 83c613434..f4fc431f3 100644
--- a/package/kernel/mac80211/patches/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
+++ b/package/kernel/mac80211/patches/subsys/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch
@@ -11,7 +11,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -177,6 +177,7 @@ struct ieee80211_tx_data {
+@@ -179,6 +179,7 @@ struct ieee80211_tx_data {
  	struct ieee80211_tx_rate rate;
  
  	unsigned int flags;
@@ -39,7 +39,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	/* internal error, why isn't DONTFRAG set? */
  	if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
  		return TX_DROP;
-@@ -1175,6 +1173,8 @@ ieee80211_tx_prepare(struct ieee80211_su
+@@ -1174,6 +1172,8 @@ ieee80211_tx_prepare(struct ieee80211_su
  
  	hdr = (struct ieee80211_hdr *) skb->data;
  
@@ -48,7 +48,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	if (likely(sta)) {
  		if (!IS_ERR(sta))
  			tx->sta = sta;
-@@ -3468,6 +3468,7 @@ begin:
+@@ -3497,6 +3497,7 @@ begin:
  	tx.local = local;
  	tx.skb = skb;
  	tx.sdata = vif_to_sdata(info->control.vif);
@@ -56,7 +56,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  
  	if (txq->sta)
  		tx.sta = container_of(txq->sta, struct sta_info, sta);
-@@ -3796,6 +3797,7 @@ ieee80211_build_data_template(struct iee
+@@ -3833,6 +3834,7 @@ ieee80211_build_data_template(struct iee
  	hdr = (void *)skb->data;
  	tx.sta = sta_info_get(sdata, hdr->addr1);
  	tx.skb = skb;
@@ -66,7 +66,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  		rcu_read_unlock();
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -1232,6 +1232,7 @@ void ieee80211_send_auth(struct ieee8021
+@@ -1290,6 +1290,7 @@ void ieee80211_send_auth(struct ieee8021
  	struct ieee80211_local *local = sdata->local;
  	struct sk_buff *skb;
  	struct ieee80211_mgmt *mgmt;
@@ -74,7 +74,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	int err;
  
  	/* 24 + 6 = header + auth_algo + auth_transaction + status_code */
-@@ -1255,8 +1256,10 @@ void ieee80211_send_auth(struct ieee8021
+@@ -1313,8 +1314,10 @@ void ieee80211_send_auth(struct ieee8021
  		skb_put_data(skb, extra, extra_len);
  
  	if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) {
@@ -164,7 +164,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	if (skb->len < hdrlen)
  		return TX_DROP;
  
-@@ -187,7 +187,6 @@ mic_fail_no_key:
+@@ -195,7 +195,6 @@ mic_fail_no_key:
  
  static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
  {
@@ -172,7 +172,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	struct ieee80211_key *key = tx->key;
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  	unsigned int hdrlen;
-@@ -202,7 +201,7 @@ static int tkip_encrypt_skb(struct ieee8
+@@ -210,7 +209,7 @@ static int tkip_encrypt_skb(struct ieee8
  		return 0;
  	}
  
@@ -181,7 +181,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	len = skb->len - hdrlen;
  
  	if (info->control.hw_key)
-@@ -420,7 +419,7 @@ static int ccmp_encrypt_skb(struct ieee8
+@@ -428,7 +427,7 @@ static int ccmp_encrypt_skb(struct ieee8
  		return 0;
  	}
  
@@ -190,7 +190,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	len = skb->len - hdrlen;
  
  	if (info->control.hw_key)
-@@ -653,7 +652,7 @@ static int gcmp_encrypt_skb(struct ieee8
+@@ -660,7 +659,7 @@ static int gcmp_encrypt_skb(struct ieee8
  		return 0;
  	}
  
@@ -199,7 +199,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	len = skb->len - hdrlen;
  
  	if (info->control.hw_key)
-@@ -793,7 +792,6 @@ static ieee80211_tx_result
+@@ -800,7 +799,6 @@ static ieee80211_tx_result
  ieee80211_crypto_cs_encrypt(struct ieee80211_tx_data *tx,
  			    struct sk_buff *skb)
  {
@@ -207,7 +207,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	struct ieee80211_key *key = tx->key;
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  	int hdrlen;
-@@ -809,8 +807,7 @@ ieee80211_crypto_cs_encrypt(struct ieee8
+@@ -816,8 +814,7 @@ ieee80211_crypto_cs_encrypt(struct ieee8
  		     pskb_expand_head(skb, iv_len, 0, GFP_ATOMIC)))
  		return TX_DROP;
  
diff --git a/package/kernel/mac80211/patches/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch b/package/kernel/mac80211/patches/subsys/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
similarity index 84%
rename from package/kernel/mac80211/patches/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
rename to package/kernel/mac80211/patches/subsys/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
index a9f01b368..c52a4f61a 100644
--- a/package/kernel/mac80211/patches/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
+++ b/package/kernel/mac80211/patches/subsys/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch
@@ -23,9 +23,9 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2059,6 +2059,9 @@ struct ieee80211_txq {
-  * @IEEE80211_HW_SUPPORTS_TDLS_BUFFER_STA: Hardware supports buffer STA on
-  *	TDLS links.
+@@ -2127,6 +2127,9 @@ struct ieee80211_txq {
+  * @IEEE80211_HW_DOESNT_SUPPORT_QOS_NDP: The driver (or firmware) doesn't
+  *	support QoS NDP for AP probing - that's most likely a driver bug.
   *
 + * @IEEE80211_HW_NEEDS_ALIGNED4_SKBS: Driver need aligned skbs to four-byte.
 + *	Padding will be added after ieee80211_hdr, before IV/LLC.
@@ -33,27 +33,27 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2102,6 +2105,7 @@ enum ieee80211_hw_flags {
- 	IEEE80211_HW_REPORTS_LOW_ACK,
- 	IEEE80211_HW_SUPPORTS_TX_FRAG,
+@@ -2172,6 +2175,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_SUPPORTS_TDLS_BUFFER_STA,
+ 	IEEE80211_HW_DEAUTH_NEED_MGD_TX_PREP,
+ 	IEEE80211_HW_DOESNT_SUPPORT_QOS_NDP,
 +	IEEE80211_HW_NEEDS_ALIGNED4_SKBS,
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
 --- a/net/mac80211/debugfs.c
 +++ b/net/mac80211/debugfs.c
-@@ -212,6 +212,7 @@ static const char *hw_flag_names[] = {
- 	FLAG(REPORTS_LOW_ACK),
- 	FLAG(SUPPORTS_TX_FRAG),
+@@ -214,6 +214,7 @@ static const char *hw_flag_names[] = {
  	FLAG(SUPPORTS_TDLS_BUFFER_STA),
+ 	FLAG(DEAUTH_NEED_MGD_TX_PREP),
+ 	FLAG(DOESNT_SUPPORT_QOS_NDP),
 +	FLAG(NEEDS_ALIGNED4_SKBS),
  #undef FLAG
  };
  
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1548,6 +1548,29 @@ ieee80211_vif_get_num_mcast_if(struct ie
+@@ -1557,6 +1557,29 @@ ieee80211_vif_get_num_mcast_if(struct ie
  	return -1;
  }
  
@@ -85,7 +85,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  				     unsigned int mpdu_len,
 --- a/net/mac80211/sta_info.h
 +++ b/net/mac80211/sta_info.h
-@@ -300,7 +300,7 @@ struct ieee80211_fast_tx {
+@@ -301,7 +301,7 @@ struct ieee80211_fast_tx {
  	u8 hdr_len;
  	u8 sa_offs, da_offs, pn_offs;
  	u8 band;
@@ -96,7 +96,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	struct rcu_head rcu_head;
 --- a/net/mac80211/status.c
 +++ b/net/mac80211/status.c
-@@ -642,9 +642,22 @@ void ieee80211_tx_monitor(struct ieee802
+@@ -653,9 +653,22 @@ void ieee80211_tx_monitor(struct ieee802
  	struct sk_buff *skb2;
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  	struct ieee80211_sub_if_data *sdata;
@@ -137,7 +137,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -1172,8 +1172,7 @@ ieee80211_tx_prepare(struct ieee80211_su
+@@ -1171,8 +1171,7 @@ ieee80211_tx_prepare(struct ieee80211_su
  	info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING;
  
  	hdr = (struct ieee80211_hdr *) skb->data;
@@ -147,7 +147,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  
  	if (likely(sta)) {
  		if (!IS_ERR(sta))
-@@ -2184,7 +2183,7 @@ netdev_tx_t ieee80211_monitor_start_xmit
+@@ -2205,7 +2204,7 @@ netdev_tx_t ieee80211_monitor_start_xmit
  		goto fail;
  
  	hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
@@ -156,7 +156,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  
  	if (skb->len < len_rthdr + hdrlen)
  		goto fail;
-@@ -2402,7 +2401,7 @@ static struct sk_buff *ieee80211_build_h
+@@ -2423,7 +2422,7 @@ static struct sk_buff *ieee80211_build_h
  	struct ieee80211_chanctx_conf *chanctx_conf;
  	struct ieee80211_sub_if_data *ap_sdata;
  	enum nl80211_band band;
@@ -165,7 +165,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  
  	if (IS_ERR(sta))
  		sta = NULL;
-@@ -2622,6 +2621,9 @@ static struct sk_buff *ieee80211_build_h
+@@ -2643,6 +2642,9 @@ static struct sk_buff *ieee80211_build_h
  		hdrlen += 2;
  	}
  
@@ -175,7 +175,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	/*
  	 * Drop unicast frames to unauthorised stations unless they are
  	 * EAPOL frames from the local station.
-@@ -2702,6 +2704,7 @@ static struct sk_buff *ieee80211_build_h
+@@ -2723,6 +2725,7 @@ static struct sk_buff *ieee80211_build_h
  
  	skb_pull(skb, skip_header_bytes);
  	head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
@@ -183,7 +183,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  
  	/*
  	 * So we need to modify the skb header and hence need a copy of
-@@ -2734,6 +2737,9 @@ static struct sk_buff *ieee80211_build_h
+@@ -2755,6 +2758,9 @@ static struct sk_buff *ieee80211_build_h
  		memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
  #endif
  
@@ -193,7 +193,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	if (ieee80211_is_data_qos(fc)) {
  		__le16 *qos_control;
  
-@@ -2909,6 +2915,9 @@ void ieee80211_check_fast_xmit(struct st
+@@ -2930,6 +2936,9 @@ void ieee80211_check_fast_xmit(struct st
  		fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
  	}
  
@@ -203,7 +203,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	/* We store the key here so there's no point in using rcu_dereference()
  	 * but that's fine because the code that changes the pointers will call
  	 * this function after doing so. For a single CPU that would be enough,
-@@ -3495,7 +3504,7 @@ begin:
+@@ -3524,7 +3533,7 @@ begin:
  
  		if (tx.key &&
  		    (tx.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV))
@@ -214,7 +214,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  					   tx.key, skb);
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -1230,6 +1230,7 @@ void ieee80211_send_auth(struct ieee8021
+@@ -1288,6 +1288,7 @@ void ieee80211_send_auth(struct ieee8021
  			 u32 tx_flags)
  {
  	struct ieee80211_local *local = sdata->local;
@@ -222,7 +222,7 @@ Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
  	struct sk_buff *skb;
  	struct ieee80211_mgmt *mgmt;
  	unsigned int hdrlen;
-@@ -1256,7 +1257,7 @@ void ieee80211_send_auth(struct ieee8021
+@@ -1314,7 +1315,7 @@ void ieee80211_send_auth(struct ieee8021
  		skb_put_data(skb, extra, extra_len);
  
  	if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) {
diff --git a/package/kernel/mac80211/patches/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch b/package/kernel/mac80211/patches/subsys/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
similarity index 97%
rename from package/kernel/mac80211/patches/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
rename to package/kernel/mac80211/patches/subsys/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
index 609b15b83..661fb46ea 100644
--- a/package/kernel/mac80211/patches/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
+++ b/package/kernel/mac80211/patches/subsys/359-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch
@@ -10,7 +10,7 @@ Signed-off-by: Chaitanya TK <chaitanya.mgit@gmail.com>
 
 --- a/include/linux/ieee80211.h
 +++ b/include/linux/ieee80211.h
-@@ -1556,6 +1556,7 @@ struct ieee80211_vht_operation {
+@@ -1659,6 +1659,7 @@ struct ieee80211_mu_edca_param_set {
  #define IEEE80211_VHT_CAP_RXSTBC_3				0x00000300
  #define IEEE80211_VHT_CAP_RXSTBC_4				0x00000400
  #define IEEE80211_VHT_CAP_RXSTBC_MASK				0x00000700
diff --git a/package/kernel/mac80211/patches/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch b/package/kernel/mac80211/patches/subsys/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
similarity index 89%
rename from package/kernel/mac80211/patches/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
rename to package/kernel/mac80211/patches/subsys/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
index 14cf6641d..95d4f294a 100644
--- a/package/kernel/mac80211/patches/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
+++ b/package/kernel/mac80211/patches/subsys/370-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch
@@ -15,7 +15,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #ifdef CPTCFG_MAC80211_DEBUGFS
  	mp->fixed_rate_idx = (u32) -1;
 -	mp->dbg_fixed_rate = debugfs_create_u32("fixed_rate_idx",
--			S_IRUGO | S_IWUGO, debugfsdir, &mp->fixed_rate_idx);
+-			0666, debugfsdir, &mp->fixed_rate_idx);
 +	debugfs_create_u32("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir,
 +			   &mp->fixed_rate_idx);
  #endif
@@ -75,11 +75,11 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  {
  	struct minstrel_sta_info *mi = priv_sta;
  
--	mi->dbg_stats = debugfs_create_file("rc_stats", S_IRUGO, dir, mi,
--			&minstrel_stat_fops);
+-	mi->dbg_stats = debugfs_create_file("rc_stats", 0444, dir, mi,
+-					    &minstrel_stat_fops);
 -
--	mi->dbg_stats_csv = debugfs_create_file("rc_stats_csv", S_IRUGO, dir,
--			mi, &minstrel_stat_csv_fops);
+-	mi->dbg_stats_csv = debugfs_create_file("rc_stats_csv", 0444, dir, mi,
+-						&minstrel_stat_csv_fops);
 -}
 -
 -void
@@ -130,10 +130,10 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  {
  	struct minstrel_ht_sta_priv *msp = priv_sta;
  
--	msp->dbg_stats = debugfs_create_file("rc_stats", S_IRUGO, dir, msp,
--			&minstrel_ht_stat_fops);
--	msp->dbg_stats_csv = debugfs_create_file("rc_stats_csv", S_IRUGO,
--			     dir, msp, &minstrel_ht_stat_csv_fops);
+-	msp->dbg_stats = debugfs_create_file("rc_stats", 0444, dir, msp,
+-					     &minstrel_ht_stat_fops);
+-	msp->dbg_stats_csv = debugfs_create_file("rc_stats_csv", 0444, dir, msp,
+-						 &minstrel_ht_stat_csv_fops);
 -}
 -
 -void
diff --git a/package/kernel/mac80211/patches/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch b/package/kernel/mac80211/patches/subsys/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
similarity index 97%
rename from package/kernel/mac80211/patches/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
rename to package/kernel/mac80211/patches/subsys/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
index a2bdfd81a..055472206 100644
--- a/package/kernel/mac80211/patches/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
+++ b/package/kernel/mac80211/patches/subsys/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch
@@ -45,7 +45,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  endif
 --- a/net/mac80211/Makefile
 +++ b/net/mac80211/Makefile
-@@ -50,13 +50,14 @@ mac80211-$(CONFIG_PM) += pm.o
+@@ -52,13 +52,14 @@ mac80211-$(CONFIG_PM) += pm.o
  
  CFLAGS_trace.o := -I$(src)
  
@@ -67,7 +67,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  ccflags-y += -DDEBUG
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -1252,18 +1252,12 @@ static int __init ieee80211_init(void)
+@@ -1306,18 +1306,12 @@ static int __init ieee80211_init(void)
  	if (ret)
  		return ret;
  
@@ -86,7 +86,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	rc80211_minstrel_exit();
  
  	return ret;
-@@ -1271,7 +1265,6 @@ static int __init ieee80211_init(void)
+@@ -1325,7 +1319,6 @@ static int __init ieee80211_init(void)
  
  static void __exit ieee80211_exit(void)
  {
@@ -141,11 +141,11 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 -			max_rates = sband->n_bitrates;
 -	}
 -
--	mi->r = kzalloc(sizeof(struct minstrel_rate) * max_rates, gfp);
+-	mi->r = kcalloc(max_rates, sizeof(struct minstrel_rate), gfp);
 -	if (!mi->r)
 -		goto error;
 -
--	mi->sample_table = kmalloc(SAMPLE_COLUMNS * max_rates, gfp);
+-	mi->sample_table = kmalloc_array(max_rates, SAMPLE_COLUMNS, gfp);
 -	if (!mi->sample_table)
 -		goto error1;
 -
@@ -256,7 +256,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static u32 minstrel_get_expected_throughput(void *priv_sta)
  {
  	struct minstrel_sta_info *mi = priv_sta;
-@@ -722,29 +590,8 @@ static u32 minstrel_get_expected_through
+@@ -722,28 +590,8 @@ static u32 minstrel_get_expected_through
  }
  
  const struct rate_control_ops mac80211_minstrel = {
@@ -285,7 +285,6 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 -{
 -	ieee80211_rate_control_unregister(&mac80211_minstrel);
 -}
--
 --- a/net/mac80211/rc80211_minstrel.h
 +++ b/net/mac80211/rc80211_minstrel.h
 @@ -158,7 +158,5 @@ int minstrel_get_tp_avg(struct minstrel_
diff --git a/package/kernel/mac80211/patches/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch b/package/kernel/mac80211/patches/subsys/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch
similarity index 100%
rename from package/kernel/mac80211/patches/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch
rename to package/kernel/mac80211/patches/subsys/372-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch
diff --git a/package/kernel/mac80211/patches/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch b/package/kernel/mac80211/patches/subsys/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch
similarity index 100%
rename from package/kernel/mac80211/patches/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch
rename to package/kernel/mac80211/patches/subsys/373-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch
diff --git a/package/kernel/mac80211/patches/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch b/package/kernel/mac80211/patches/subsys/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch
similarity index 100%
rename from package/kernel/mac80211/patches/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch
rename to package/kernel/mac80211/patches/subsys/375-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch
diff --git a/package/kernel/mac80211/patches/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch b/package/kernel/mac80211/patches/subsys/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch
similarity index 100%
rename from package/kernel/mac80211/patches/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch
rename to package/kernel/mac80211/patches/subsys/376-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch
diff --git a/package/kernel/mac80211/patches/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch b/package/kernel/mac80211/patches/subsys/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch
similarity index 100%
rename from package/kernel/mac80211/patches/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch
rename to package/kernel/mac80211/patches/subsys/377-mac80211-minstrel-do-not-sample-rates-3-times-slower.patch
diff --git a/package/kernel/mac80211/patches/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch b/package/kernel/mac80211/patches/subsys/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
similarity index 83%
rename from package/kernel/mac80211/patches/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
rename to package/kernel/mac80211/patches/subsys/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
index c64457a17..54bb114f6 100644
--- a/package/kernel/mac80211/patches/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
+++ b/package/kernel/mac80211/patches/subsys/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch
@@ -22,7 +22,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -3171,6 +3171,7 @@ static bool ieee80211_amsdu_aggregate(st
+@@ -3184,6 +3184,7 @@ static bool ieee80211_amsdu_aggregate(st
  	u8 max_subframes = sta->sta.max_amsdu_subframes;
  	int max_frags = local->hw.max_tx_fragments;
  	int max_amsdu_len = sta->sta.max_amsdu_len;
@@ -30,7 +30,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	__be16 len;
  	void *data;
  	bool ret = false;
-@@ -3201,12 +3202,13 @@ static bool ieee80211_amsdu_aggregate(st
+@@ -3215,12 +3216,13 @@ static bool ieee80211_amsdu_aggregate(st
  	flow = fq_flow_classify(fq, tin, skb, fq_flow_get_default_func);
  	head = skb_peek_tail(&flow->queue);
  	if (!head)
@@ -44,11 +44,11 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 -		goto out;
 +		goto unlock;
  
- 	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
- 		goto out;
-@@ -3249,6 +3251,9 @@ static bool ieee80211_amsdu_aggregate(st
- 	fq_recalc_backlog(fq, tin, flow);
- 
+ 	nfrags = 1 + skb_shinfo(skb)->nr_frags;
+ 	nfrags += 1 + skb_shinfo(head)->nr_frags;
+@@ -3278,6 +3280,9 @@ out_recalc:
+ 		fq_recalc_backlog(fq, tin, flow);
+ 	}
  out:
 +	fq->memory_usage += head->truesize - orig_truesize;
 +
diff --git a/package/kernel/mac80211/patches/subsys/394-mac80211-allocate-TXQs-for-active-monitor-interfaces.patch b/package/kernel/mac80211/patches/subsys/394-mac80211-allocate-TXQs-for-active-monitor-interfaces.patch
new file mode 100644
index 000000000..e959bc91a
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/394-mac80211-allocate-TXQs-for-active-monitor-interfaces.patch
@@ -0,0 +1,26 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 22 Sep 2018 15:05:59 +0200
+Subject: [PATCH] mac80211: allocate TXQs for active monitor interfaces
+
+Monitor mode interfaces with the active flag are passed down to the driver.
+Drivers using TXQ expect that all interfaces have allocated TXQs before
+they get added.
+
+Fixes: 79af1f866193d ("mac80211: avoid allocating TXQs that won't be used")
+Cc: stable@vger.kernel.org
+Reported-by: Catrinel Catrinescu <cc@80211.de>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1834,7 +1834,8 @@ int ieee80211_if_add(struct ieee80211_lo
+ 
+ 		if (local->ops->wake_tx_queue &&
+ 		    type != NL80211_IFTYPE_AP_VLAN &&
+-		    type != NL80211_IFTYPE_MONITOR)
++		    (type != NL80211_IFTYPE_MONITOR ||
++		     (params->flags & MONITOR_FLAG_ACTIVE)))
+ 			txq_size += sizeof(struct txq_info) +
+ 				    local->hw.txq_data_size;
+ 
diff --git a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/subsys/522-mac80211_configure_antenna_gain.patch
similarity index 79%
rename from package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
rename to package/kernel/mac80211/patches/subsys/522-mac80211_configure_antenna_gain.patch
index b815f5f22..86bd2905a 100644
--- a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
+++ b/package/kernel/mac80211/patches/subsys/522-mac80211_configure_antenna_gain.patch
@@ -1,6 +1,6 @@
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -2750,6 +2750,7 @@ struct cfg80211_pmk_conf {
+@@ -2959,6 +2959,7 @@ struct cfg80211_external_auth_params {
   *	(as advertised by the nl80211 feature flag.)
   * @get_tx_power: store the current TX power into the dbm variable;
   *	return 0 if successful
@@ -8,7 +8,7 @@
   *
   * @set_wds_peer: set the WDS peer for a WDS interface
   *
-@@ -3041,6 +3042,7 @@ struct cfg80211_ops {
+@@ -3259,6 +3260,7 @@ struct cfg80211_ops {
  				enum nl80211_tx_power_setting type, int mbm);
  	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
  				int *dbm);
@@ -18,7 +18,7 @@
  				const u8 *addr);
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1338,6 +1338,7 @@ enum ieee80211_smps_mode {
+@@ -1389,6 +1389,7 @@ enum ieee80211_smps_mode {
   *
   * @power_level: requested transmit power (in dBm), backward compatibility
   *	value only that is set to the minimum of all interfaces
@@ -26,7 +26,7 @@
   *
   * @chandef: the channel definition to tune to
   * @radar_enabled: whether radar detection is enabled
-@@ -1358,6 +1359,7 @@ enum ieee80211_smps_mode {
+@@ -1409,6 +1410,7 @@ enum ieee80211_smps_mode {
  struct ieee80211_conf {
  	u32 flags;
  	int power_level, dynamic_ps_timeout;
@@ -36,9 +36,9 @@
  	u8 ps_dtim_period;
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -2153,6 +2153,9 @@ enum nl80211_commands {
-  * @NL80211_ATTR_PMKR0_NAME: PMK-R0 Name for offloaded FT.
-  * @NL80211_ATTR_PORT_AUTHORIZED: (reserved)
+@@ -2241,6 +2241,9 @@ enum nl80211_commands {
+  *	association request when used with NL80211_CMD_NEW_STATION). Can be set
+  *	only if %NL80211_STA_FLAG_WME is set.
   *
 + * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
 + *	transmit power to stay within regulatory limits. u32, dBi.
@@ -46,9 +46,9 @@
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
   * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -2579,6 +2582,8 @@ enum nl80211_attrs {
- 	NL80211_ATTR_PMKR0_NAME,
- 	NL80211_ATTR_PORT_AUTHORIZED,
+@@ -2682,6 +2685,8 @@ enum nl80211_attrs {
+ 
+ 	NL80211_ATTR_HE_CAPABILITY,
  
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
 +
@@ -57,7 +57,7 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2447,6 +2447,19 @@ static int ieee80211_get_tx_power(struct
+@@ -2494,6 +2494,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -77,7 +77,7 @@
  static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
  				  const u8 *addr)
  {
-@@ -3721,6 +3734,7 @@ const struct cfg80211_ops mac80211_confi
+@@ -3861,6 +3874,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
@@ -87,7 +87,7 @@
  	CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1348,6 +1348,7 @@ struct ieee80211_local {
+@@ -1352,6 +1352,7 @@ struct ieee80211_local {
  	int dynamic_ps_forced_timeout;
  
  	int user_power_level; /* in dBm, for all interfaces */
@@ -97,7 +97,7 @@
  
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -93,7 +93,7 @@ static u32 ieee80211_hw_conf_chan(struct
+@@ -94,7 +94,7 @@ static u32 ieee80211_hw_conf_chan(struct
  	struct ieee80211_sub_if_data *sdata;
  	struct cfg80211_chan_def chandef = {};
  	u32 changed = 0;
@@ -106,7 +106,7 @@
  	u32 offchannel_flag;
  
  	offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
-@@ -150,6 +150,12 @@ static u32 ieee80211_hw_conf_chan(struct
+@@ -151,6 +151,12 @@ static u32 ieee80211_hw_conf_chan(struct
  	}
  	rcu_read_unlock();
  
@@ -119,7 +119,7 @@
  	if (local->hw.conf.power_level != power) {
  		changed |= IEEE80211_CONF_CHANGE_POWER;
  		local->hw.conf.power_level = power;
-@@ -611,6 +617,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -626,6 +632,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  					 IEEE80211_RADIOTAP_MCS_HAVE_BW;
  	local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
  					 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
@@ -129,15 +129,15 @@
  	local->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -420,6 +420,7 @@ static const struct nla_policy nl80211_p
- 	[NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
- 	[NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
- 	[NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
+@@ -430,6 +430,7 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
+ 	[NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
+ 					 .len = NL80211_HE_MAX_CAPABILITY_LEN },
 +	[NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
  };
  
  /* policy for the key attributes */
-@@ -2395,6 +2396,20 @@ static int nl80211_set_wiphy(struct sk_b
+@@ -2587,6 +2588,20 @@ static int nl80211_set_wiphy(struct sk_b
  		if (result)
  			return result;
  	}
diff --git a/package/network/utils/iw/patches/001-nl80211_h_sync.patch b/package/network/utils/iw/patches/001-nl80211_h_sync.patch
index 2052cb2af..4fd37579a 100644
--- a/package/network/utils/iw/patches/001-nl80211_h_sync.patch
+++ b/package/network/utils/iw/patches/001-nl80211_h_sync.patch
@@ -1,39 +1,629 @@
+diff --git a/nl80211.h b/nl80211.h
+index c587a61..255a971 100644
 --- a/nl80211.h
 +++ b/nl80211.h
-@@ -2153,6 +2153,9 @@ enum nl80211_commands {
+@@ -11,6 +11,7 @@
+  * Copyright 2008 Jouni Malinen <jouni.malinen@atheros.com>
+  * Copyright 2008 Colin McCabe <colin@cozybit.com>
+  * Copyright 2015-2017	Intel Deutschland GmbH
++ * Copyright (C) 2018 Intel Corporation
+  *
+  * Permission to use, copy, modify, and/or distribute this software for any
+  * purpose with or without fee is hereby granted, provided that the above
+@@ -203,7 +204,8 @@
+  * FILS shared key authentication offload should be able to construct the
+  * authentication and association frames for FILS shared key authentication and
+  * eventually do a key derivation as per IEEE 802.11ai. The below additional
+- * parameters should be given to driver in %NL80211_CMD_CONNECT.
++ * parameters should be given to driver in %NL80211_CMD_CONNECT and/or in
++ * %NL80211_CMD_UPDATE_CONNECT_PARAMS.
+  *	%NL80211_ATTR_FILS_ERP_USERNAME - used to construct keyname_nai
+  *	%NL80211_ATTR_FILS_ERP_REALM - used to construct keyname_nai
+  *	%NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM - used to construct erp message
+@@ -214,7 +216,8 @@
+  * as specified in IETF RFC 6696.
+  *
+  * When FILS shared key authentication is completed, driver needs to provide the
+- * below additional parameters to userspace.
++ * below additional parameters to userspace, which can be either after setting
++ * up a connection or after roaming.
+  *	%NL80211_ATTR_FILS_KEK - used for key renewal
+  *	%NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM - used in further EAP-RP exchanges
+  *	%NL80211_ATTR_PMKID - used to identify the PMKSA used/generated
+@@ -542,7 +545,8 @@
+  *	IEs in %NL80211_ATTR_IE, %NL80211_ATTR_AUTH_TYPE, %NL80211_ATTR_USE_MFP,
+  *	%NL80211_ATTR_MAC, %NL80211_ATTR_WIPHY_FREQ, %NL80211_ATTR_CONTROL_PORT,
+  *	%NL80211_ATTR_CONTROL_PORT_ETHERTYPE,
+- *	%NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT, %NL80211_ATTR_MAC_HINT, and
++ *	%NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT,
++ *	%NL80211_ATTR_CONTROL_PORT_OVER_NL80211, %NL80211_ATTR_MAC_HINT, and
+  *	%NL80211_ATTR_WIPHY_FREQ_HINT.
+  *	If included, %NL80211_ATTR_MAC and %NL80211_ATTR_WIPHY_FREQ are
+  *	restrictions on BSS selection, i.e., they effectively prevent roaming
+@@ -977,21 +981,58 @@
+  *	only the %NL80211_ATTR_IE data is used and updated with this command.
+  *
+  * @NL80211_CMD_SET_PMK: For offloaded 4-Way handshake, set the PMK or PMK-R0
+- *	for the given authenticator address (specified with &NL80211_ATTR_MAC).
+- *	When &NL80211_ATTR_PMKR0_NAME is set, &NL80211_ATTR_PMK specifies the
++ *	for the given authenticator address (specified with %NL80211_ATTR_MAC).
++ *	When %NL80211_ATTR_PMKR0_NAME is set, %NL80211_ATTR_PMK specifies the
+  *	PMK-R0, otherwise it specifies the PMK.
+  * @NL80211_CMD_DEL_PMK: For offloaded 4-Way handshake, delete the previously
+  *	configured PMK for the authenticator address identified by
+- *	&NL80211_ATTR_MAC.
++ *	%NL80211_ATTR_MAC.
+  * @NL80211_CMD_PORT_AUTHORIZED: An event that indicates that the 4 way
+  *	handshake was completed successfully by the driver. The BSSID is
+- *	specified with &NL80211_ATTR_MAC. Drivers that support 4 way handshake
++ *	specified with %NL80211_ATTR_MAC. Drivers that support 4 way handshake
+  *	offload should send this event after indicating 802.11 association with
+- *	&NL80211_CMD_CONNECT or &NL80211_CMD_ROAM. If the 4 way handshake failed
+- *	&NL80211_CMD_DISCONNECT should be indicated instead.
++ *	%NL80211_CMD_CONNECT or %NL80211_CMD_ROAM. If the 4 way handshake failed
++ *	%NL80211_CMD_DISCONNECT should be indicated instead.
++ *
++ * @NL80211_CMD_CONTROL_PORT_FRAME: Control Port (e.g. PAE) frame TX request
++ *	and RX notification.  This command is used both as a request to transmit
++ *	a control port frame and as a notification that a control port frame
++ *	has been received. %NL80211_ATTR_FRAME is used to specify the
++ *	frame contents.  The frame is the raw EAPoL data, without ethernet or
++ *	802.11 headers.
++ *	When used as an event indication %NL80211_ATTR_CONTROL_PORT_ETHERTYPE,
++ *	%NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT and %NL80211_ATTR_MAC are added
++ *	indicating the protocol type of the received frame; whether the frame
++ *	was received unencrypted and the MAC address of the peer respectively.
+  *
+  * @NL80211_CMD_RELOAD_REGDB: Request that the regdb firmware file is reloaded.
+  *
++ * @NL80211_CMD_EXTERNAL_AUTH: This interface is exclusively defined for host
++ *	drivers that do not define separate commands for authentication and
++ *	association, but rely on user space for the authentication to happen.
++ *	This interface acts both as the event request (driver to user space)
++ *	to trigger the authentication and command response (userspace to
++ *	driver) to indicate the authentication status.
++ *
++ *	User space uses the %NL80211_CMD_CONNECT command to the host driver to
++ *	trigger a connection. The host driver selects a BSS and further uses
++ *	this interface to offload only the authentication part to the user
++ *	space. Authentication frames are passed between the driver and user
++ *	space through the %NL80211_CMD_FRAME interface. Host driver proceeds
++ *	further with the association after getting successful authentication
++ *	status. User space indicates the authentication status through
++ *	%NL80211_ATTR_STATUS_CODE attribute in %NL80211_CMD_EXTERNAL_AUTH
++ *	command interface.
++ *
++ *	Host driver reports this status on an authentication failure to the
++ *	user space through the connect result as the user space would have
++ *	initiated the connection through the connect request.
++ *
++ * @NL80211_CMD_STA_OPMODE_CHANGED: An event that notify station's
++ *	ht opmode or vht opmode changes using any of %NL80211_ATTR_SMPS_MODE,
++ *	%NL80211_ATTR_CHANNEL_WIDTH,%NL80211_ATTR_NSS attributes with its
++ *	address(specified in %NL80211_ATTR_MAC).
++ *
+  * @NL80211_CMD_MAX: highest used command number
+  * @__NL80211_CMD_AFTER_LAST: internal use
+  */
+@@ -1198,6 +1239,12 @@ enum nl80211_commands {
+ 
+ 	NL80211_CMD_RELOAD_REGDB,
+ 
++	NL80211_CMD_EXTERNAL_AUTH,
++
++	NL80211_CMD_STA_OPMODE_CHANGED,
++
++	NL80211_CMD_CONTROL_PORT_FRAME,
++
+ 	/* add new commands above here */
+ 
+ 	/* used to define NL80211_CMD_MAX below */
+@@ -1445,6 +1492,15 @@ enum nl80211_commands {
+  * @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT: When included along with
+  *	%NL80211_ATTR_CONTROL_PORT_ETHERTYPE, indicates that the custom
+  *	ethertype frames used for key negotiation must not be encrypted.
++ * @NL80211_ATTR_CONTROL_PORT_OVER_NL80211: A flag indicating whether control
++ *	port frames (e.g. of type given in %NL80211_ATTR_CONTROL_PORT_ETHERTYPE)
++ *	will be sent directly to the network interface or sent via the NL80211
++ *	socket.  If this attribute is missing, then legacy behavior of sending
++ *	control port frames directly to the network interface is used.  If the
++ *	flag is included, then control port frames are sent over NL80211 instead
++ *	using %CMD_CONTROL_PORT_FRAME.  If control port routing over NL80211 is
++ *	to be used then userspace must also use the %NL80211_ATTR_SOCKET_OWNER
++ *	flag.
+  *
+  * @NL80211_ATTR_TESTDATA: Testmode data blob, passed through to the driver.
+  *	We recommend using nested, driver-specific attributes within this.
+@@ -1932,6 +1988,12 @@ enum nl80211_commands {
+  *	multicast group.
+  *	If set during %NL80211_CMD_ASSOCIATE or %NL80211_CMD_CONNECT the
+  *	station will deauthenticate when the socket is closed.
++ *	If set during %NL80211_CMD_JOIN_IBSS the IBSS will be automatically
++ *	torn down when the socket is closed.
++ *	If set during %NL80211_CMD_JOIN_MESH the mesh setup will be
++ *	automatically torn down when the socket is closed.
++ *	If set during %NL80211_CMD_START_AP the AP will be automatically
++ *	disabled when the socket is closed.
+  *
+  * @NL80211_ATTR_TDLS_INITIATOR: flag attribute indicating the current end is
+  *	the TDLS link initiator.
+@@ -2153,6 +2215,35 @@ enum nl80211_commands {
   * @NL80211_ATTR_PMKR0_NAME: PMK-R0 Name for offloaded FT.
   * @NL80211_ATTR_PORT_AUTHORIZED: (reserved)
   *
++ * @NL80211_ATTR_EXTERNAL_AUTH_ACTION: Identify the requested external
++ *     authentication operation (u32 attribute with an
++ *     &enum nl80211_external_auth_action value). This is used with the
++ *     %NL80211_CMD_EXTERNAL_AUTH request event.
++ * @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT: Flag attribute indicating that the user
++ *     space supports external authentication. This attribute shall be used
++ *     only with %NL80211_CMD_CONNECT request. The driver may offload
++ *     authentication processing to user space if this capability is indicated
++ *     in NL80211_CMD_CONNECT requests from the user space.
++ *
++ * @NL80211_ATTR_NSS: Station's New/updated  RX_NSS value notified using this
++ *	u8 attribute. This is used with %NL80211_CMD_STA_OPMODE_CHANGED.
++ *
++ * @NL80211_ATTR_TXQ_STATS: TXQ statistics (nested attribute, see &enum
++ *      nl80211_txq_stats)
++ * @NL80211_ATTR_TXQ_LIMIT: Total packet limit for the TXQ queues for this phy.
++ *      The smaller of this and the memory limit is enforced.
++ * @NL80211_ATTR_TXQ_MEMORY_LIMIT: Total memory memory limit (in bytes) for the
++ *      TXQ queues for this phy. The smaller of this and the packet limit is
++ *      enforced.
++ * @NL80211_ATTR_TXQ_QUANTUM: TXQ scheduler quantum (bytes). Number of bytes
++ *      a flow is assigned on each round of the DRR scheduler.
++ * @NL80211_ATTR_HE_CAPABILITY: HE Capability information element (from
++ *	association request when used with NL80211_CMD_NEW_STATION). Can be set
++ *	only if %NL80211_STA_FLAG_WME is set.
++ *
 + * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
 + *	transmit power to stay within regulatory limits. u32, dBi.
 + *
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
   * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -2579,6 +2582,8 @@ enum nl80211_attrs {
+@@ -2579,6 +2670,23 @@ enum nl80211_attrs {
  	NL80211_ATTR_PMKR0_NAME,
  	NL80211_ATTR_PORT_AUTHORIZED,
  
++	NL80211_ATTR_EXTERNAL_AUTH_ACTION,
++	NL80211_ATTR_EXTERNAL_AUTH_SUPPORT,
++
++	NL80211_ATTR_NSS,
++	NL80211_ATTR_ACK_SIGNAL,
++
++	NL80211_ATTR_CONTROL_PORT_OVER_NL80211,
++
++	NL80211_ATTR_TXQ_STATS,
++	NL80211_ATTR_TXQ_LIMIT,
++	NL80211_ATTR_TXQ_MEMORY_LIMIT,
++	NL80211_ATTR_TXQ_QUANTUM,
++
++	NL80211_ATTR_HE_CAPABILITY,
++
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
 +
  	/* add attributes here, update the policy in nl80211.c */
  
  	__NL80211_ATTR_AFTER_LAST,
-@@ -3862,9 +3867,6 @@ enum nl80211_bss_scan_width {
-  *	@NL80211_BSS_PARENT_BSSID. (u64).
-  * @NL80211_BSS_PARENT_BSSID: the BSS according to which @NL80211_BSS_PARENT_TSF
-  *	is set.
-- * @NL80211_BSS_CHAIN_SIGNAL: per-chain signal strength of last BSS update.
-- *	Contains a nested array of signal strength attributes (u8, dBm),
-- *	using the nesting index as the antenna number.
-  * @__NL80211_BSS_AFTER_LAST: internal
-  * @NL80211_BSS_MAX: highest BSS attribute
+@@ -2618,6 +2726,8 @@ enum nl80211_attrs {
+ #define NL80211_ATTR_KEYS NL80211_ATTR_KEYS
+ #define NL80211_ATTR_FEATURE_FLAGS NL80211_ATTR_FEATURE_FLAGS
+ 
++#define NL80211_WIPHY_NAME_MAXLEN		64
++
+ #define NL80211_MAX_SUPP_RATES			32
+ #define NL80211_MAX_SUPP_HT_RATES		77
+ #define NL80211_MAX_SUPP_REG_RULES		64
+@@ -2626,7 +2736,8 @@ enum nl80211_attrs {
+ #define NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY	24
+ #define NL80211_HT_CAPABILITY_LEN		26
+ #define NL80211_VHT_CAPABILITY_LEN		12
+-
++#define NL80211_HE_MIN_CAPABILITY_LEN           16
++#define NL80211_HE_MAX_CAPABILITY_LEN           51
+ #define NL80211_MAX_NR_CIPHER_SUITES		5
+ #define NL80211_MAX_NR_AKM_SUITES		2
+ 
+@@ -2754,6 +2865,38 @@ struct nl80211_sta_flag_update {
+ } __attribute__((packed));
+ 
+ /**
++ * enum nl80211_he_gi - HE guard interval
++ * @NL80211_RATE_INFO_HE_GI_0_8: 0.8 usec
++ * @NL80211_RATE_INFO_HE_GI_1_6: 1.6 usec
++ * @NL80211_RATE_INFO_HE_GI_3_2: 3.2 usec
++ */
++enum nl80211_he_gi {
++	NL80211_RATE_INFO_HE_GI_0_8,
++	NL80211_RATE_INFO_HE_GI_1_6,
++	NL80211_RATE_INFO_HE_GI_3_2,
++};
++
++/**
++ * enum nl80211_he_ru_alloc - HE RU allocation values
++ * @NL80211_RATE_INFO_HE_RU_ALLOC_26: 26-tone RU allocation
++ * @NL80211_RATE_INFO_HE_RU_ALLOC_52: 52-tone RU allocation
++ * @NL80211_RATE_INFO_HE_RU_ALLOC_106: 106-tone RU allocation
++ * @NL80211_RATE_INFO_HE_RU_ALLOC_242: 242-tone RU allocation
++ * @NL80211_RATE_INFO_HE_RU_ALLOC_484: 484-tone RU allocation
++ * @NL80211_RATE_INFO_HE_RU_ALLOC_996: 996-tone RU allocation
++ * @NL80211_RATE_INFO_HE_RU_ALLOC_2x996: 2x996-tone RU allocation
++ */
++enum nl80211_he_ru_alloc {
++	NL80211_RATE_INFO_HE_RU_ALLOC_26,
++	NL80211_RATE_INFO_HE_RU_ALLOC_52,
++	NL80211_RATE_INFO_HE_RU_ALLOC_106,
++	NL80211_RATE_INFO_HE_RU_ALLOC_242,
++	NL80211_RATE_INFO_HE_RU_ALLOC_484,
++	NL80211_RATE_INFO_HE_RU_ALLOC_996,
++	NL80211_RATE_INFO_HE_RU_ALLOC_2x996,
++};
++
++/**
+  * enum nl80211_rate_info - bitrate information
+  *
+  * These attribute types are used with %NL80211_STA_INFO_TXRATE
+@@ -2785,6 +2928,13 @@ struct nl80211_sta_flag_update {
+  * @NL80211_RATE_INFO_5_MHZ_WIDTH: 5 MHz width - note that this is
+  *	a legacy rate and will be reported as the actual bitrate, i.e.
+  *	a quarter of the base (20 MHz) rate
++ * @NL80211_RATE_INFO_HE_MCS: HE MCS index (u8, 0-11)
++ * @NL80211_RATE_INFO_HE_NSS: HE NSS value (u8, 1-8)
++ * @NL80211_RATE_INFO_HE_GI: HE guard interval identifier
++ *	(u8, see &enum nl80211_he_gi)
++ * @NL80211_RATE_INFO_HE_DCM: HE DCM value (u8, 0/1)
++ * @NL80211_RATE_INFO_RU_ALLOC: HE RU allocation, if not present then
++ *	non-OFDMA was used (u8, see &enum nl80211_he_ru_alloc)
+  * @__NL80211_RATE_INFO_AFTER_LAST: internal use
   */
-@@ -3888,7 +3890,6 @@ enum nl80211_bss {
- 	NL80211_BSS_PAD,
- 	NL80211_BSS_PARENT_TSF,
- 	NL80211_BSS_PARENT_BSSID,
--	NL80211_BSS_CHAIN_SIGNAL,
+ enum nl80211_rate_info {
+@@ -2801,6 +2951,11 @@ enum nl80211_rate_info {
+ 	NL80211_RATE_INFO_160_MHZ_WIDTH,
+ 	NL80211_RATE_INFO_10_MHZ_WIDTH,
+ 	NL80211_RATE_INFO_5_MHZ_WIDTH,
++	NL80211_RATE_INFO_HE_MCS,
++	NL80211_RATE_INFO_HE_NSS,
++	NL80211_RATE_INFO_HE_GI,
++	NL80211_RATE_INFO_HE_DCM,
++	NL80211_RATE_INFO_HE_RU_ALLOC,
  
  	/* keep last */
- 	__NL80211_BSS_AFTER_LAST,
+ 	__NL80211_RATE_INFO_AFTER_LAST,
+@@ -2899,6 +3054,9 @@ enum nl80211_sta_bss_param {
+  * @NL80211_STA_INFO_RX_DURATION: aggregate PPDU duration for all frames
+  *	received from the station (u64, usec)
+  * @NL80211_STA_INFO_PAD: attribute used for padding for 64-bit alignment
++ * @NL80211_STA_INFO_ACK_SIGNAL: signal strength of the last ACK frame(u8, dBm)
++ * @NL80211_STA_INFO_DATA_ACK_SIGNAL_AVG: avg signal strength of (data)
++ *	ACK frame (s8, dBm)
+  * @__NL80211_STA_INFO_AFTER_LAST: internal
+  * @NL80211_STA_INFO_MAX: highest possible station info attribute
+  */
+@@ -2937,6 +3095,8 @@ enum nl80211_sta_info {
+ 	NL80211_STA_INFO_TID_STATS,
+ 	NL80211_STA_INFO_RX_DURATION,
+ 	NL80211_STA_INFO_PAD,
++	NL80211_STA_INFO_ACK_SIGNAL,
++	NL80211_STA_INFO_DATA_ACK_SIGNAL_AVG,
+ 
+ 	/* keep last */
+ 	__NL80211_STA_INFO_AFTER_LAST,
+@@ -2954,6 +3114,7 @@ enum nl80211_sta_info {
+  * @NL80211_TID_STATS_TX_MSDU_FAILED: number of failed transmitted
+  *	MSDUs (u64)
+  * @NL80211_TID_STATS_PAD: attribute used for padding for 64-bit alignment
++ * @NL80211_TID_STATS_TXQ_STATS: TXQ stats (nested attribute)
+  * @NUM_NL80211_TID_STATS: number of attributes here
+  * @NL80211_TID_STATS_MAX: highest numbered attribute here
+  */
+@@ -2964,6 +3125,7 @@ enum nl80211_tid_stats {
+ 	NL80211_TID_STATS_TX_MSDU_RETRIES,
+ 	NL80211_TID_STATS_TX_MSDU_FAILED,
+ 	NL80211_TID_STATS_PAD,
++	NL80211_TID_STATS_TXQ_STATS,
+ 
+ 	/* keep last */
+ 	NUM_NL80211_TID_STATS,
+@@ -2971,6 +3133,44 @@ enum nl80211_tid_stats {
+ };
+ 
+ /**
++ * enum nl80211_txq_stats - per TXQ statistics attributes
++ * @__NL80211_TXQ_STATS_INVALID: attribute number 0 is reserved
++ * @NUM_NL80211_TXQ_STATS: number of attributes here
++ * @NL80211_TXQ_STATS_BACKLOG_BYTES: number of bytes currently backlogged
++ * @NL80211_TXQ_STATS_BACKLOG_PACKETS: number of packets currently
++ *      backlogged
++ * @NL80211_TXQ_STATS_FLOWS: total number of new flows seen
++ * @NL80211_TXQ_STATS_DROPS: total number of packet drops
++ * @NL80211_TXQ_STATS_ECN_MARKS: total number of packet ECN marks
++ * @NL80211_TXQ_STATS_OVERLIMIT: number of drops due to queue space overflow
++ * @NL80211_TXQ_STATS_OVERMEMORY: number of drops due to memory limit overflow
++ *      (only for per-phy stats)
++ * @NL80211_TXQ_STATS_COLLISIONS: number of hash collisions
++ * @NL80211_TXQ_STATS_TX_BYTES: total number of bytes dequeued from TXQ
++ * @NL80211_TXQ_STATS_TX_PACKETS: total number of packets dequeued from TXQ
++ * @NL80211_TXQ_STATS_MAX_FLOWS: number of flow buckets for PHY
++ * @NL80211_TXQ_STATS_MAX: highest numbered attribute here
++ */
++enum nl80211_txq_stats {
++	__NL80211_TXQ_STATS_INVALID,
++	NL80211_TXQ_STATS_BACKLOG_BYTES,
++	NL80211_TXQ_STATS_BACKLOG_PACKETS,
++	NL80211_TXQ_STATS_FLOWS,
++	NL80211_TXQ_STATS_DROPS,
++	NL80211_TXQ_STATS_ECN_MARKS,
++	NL80211_TXQ_STATS_OVERLIMIT,
++	NL80211_TXQ_STATS_OVERMEMORY,
++	NL80211_TXQ_STATS_COLLISIONS,
++	NL80211_TXQ_STATS_TX_BYTES,
++	NL80211_TXQ_STATS_TX_PACKETS,
++	NL80211_TXQ_STATS_MAX_FLOWS,
++
++	/* keep last */
++	NUM_NL80211_TXQ_STATS,
++	NL80211_TXQ_STATS_MAX = NUM_NL80211_TXQ_STATS - 1
++};
++
++/**
+  * enum nl80211_mpath_flags - nl80211 mesh path flags
+  *
+  * @NL80211_MPATH_FLAG_ACTIVE: the mesh path is active
+@@ -3022,6 +3222,38 @@ enum nl80211_mpath_info {
+ };
+ 
+ /**
++ * enum nl80211_band_iftype_attr - Interface type data attributes
++ *
++ * @__NL80211_BAND_IFTYPE_ATTR_INVALID: attribute number 0 is reserved
++ * @NL80211_BAND_IFTYPE_ATTR_IFTYPES: nested attribute containing a flag attribute
++ *     for each interface type that supports the band data
++ * @NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC: HE MAC capabilities as in HE
++ *     capabilities IE
++ * @NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY: HE PHY capabilities as in HE
++ *     capabilities IE
++ * @NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET: HE supported NSS/MCS as in HE
++ *     capabilities IE
++ * @NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE: HE PPE thresholds information as
++ *     defined in HE capabilities IE
++ * @NL80211_BAND_IFTYPE_ATTR_MAX: highest band HE capability attribute currently
++ *     defined
++ * @__NL80211_BAND_IFTYPE_ATTR_AFTER_LAST: internal use
++ */
++enum nl80211_band_iftype_attr {
++	__NL80211_BAND_IFTYPE_ATTR_INVALID,
++
++	NL80211_BAND_IFTYPE_ATTR_IFTYPES,
++	NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
++	NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
++	NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
++	NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
++
++	/* keep last */
++	__NL80211_BAND_IFTYPE_ATTR_AFTER_LAST,
++	NL80211_BAND_IFTYPE_ATTR_MAX = __NL80211_BAND_IFTYPE_ATTR_AFTER_LAST - 1
++};
++
++/**
+  * enum nl80211_band_attr - band attributes
+  * @__NL80211_BAND_ATTR_INVALID: attribute number 0 is reserved
+  * @NL80211_BAND_ATTR_FREQS: supported frequencies in this band,
+@@ -3036,6 +3268,8 @@ enum nl80211_mpath_info {
+  * @NL80211_BAND_ATTR_VHT_MCS_SET: 32-byte attribute containing the MCS set as
+  *	defined in 802.11ac
+  * @NL80211_BAND_ATTR_VHT_CAPA: VHT capabilities, as in the HT information IE
++ * @NL80211_BAND_ATTR_IFTYPE_DATA: nested array attribute, with each entry using
++ *	attributes from &enum nl80211_band_iftype_attr
+  * @NL80211_BAND_ATTR_MAX: highest band attribute currently defined
+  * @__NL80211_BAND_ATTR_AFTER_LAST: internal use
+  */
+@@ -3051,6 +3285,7 @@ enum nl80211_band_attr {
+ 
+ 	NL80211_BAND_ATTR_VHT_MCS_SET,
+ 	NL80211_BAND_ATTR_VHT_CAPA,
++	NL80211_BAND_ATTR_IFTYPE_DATA,
+ 
+ 	/* keep last */
+ 	__NL80211_BAND_ATTR_AFTER_LAST,
+@@ -3060,6 +3295,29 @@ enum nl80211_band_attr {
+ #define NL80211_BAND_ATTR_HT_CAPA NL80211_BAND_ATTR_HT_CAPA
+ 
+ /**
++ * enum nl80211_wmm_rule - regulatory wmm rule
++ *
++ * @__NL80211_WMMR_INVALID: attribute number 0 is reserved
++ * @NL80211_WMMR_CW_MIN: Minimum contention window slot.
++ * @NL80211_WMMR_CW_MAX: Maximum contention window slot.
++ * @NL80211_WMMR_AIFSN: Arbitration Inter Frame Space.
++ * @NL80211_WMMR_TXOP: Maximum allowed tx operation time.
++ * @nl80211_WMMR_MAX: highest possible wmm rule.
++ * @__NL80211_WMMR_LAST: Internal use.
++ */
++enum nl80211_wmm_rule {
++	__NL80211_WMMR_INVALID,
++	NL80211_WMMR_CW_MIN,
++	NL80211_WMMR_CW_MAX,
++	NL80211_WMMR_AIFSN,
++	NL80211_WMMR_TXOP,
++
++	/* keep last */
++	__NL80211_WMMR_LAST,
++	NL80211_WMMR_MAX = __NL80211_WMMR_LAST - 1
++};
++
++/**
+  * enum nl80211_frequency_attr - frequency attributes
+  * @__NL80211_FREQUENCY_ATTR_INVALID: attribute number 0 is reserved
+  * @NL80211_FREQUENCY_ATTR_FREQ: Frequency in MHz
+@@ -3108,6 +3366,9 @@ enum nl80211_band_attr {
+  *	on this channel in current regulatory domain.
+  * @NL80211_FREQUENCY_ATTR_NO_10MHZ: 10 MHz operation is not allowed
+  *	on this channel in current regulatory domain.
++ * @NL80211_FREQUENCY_ATTR_WMM: this channel has wmm limitations.
++ *	This is a nested attribute that contains the wmm limitation per AC.
++ *	(see &enum nl80211_wmm_rule)
+  * @NL80211_FREQUENCY_ATTR_MAX: highest frequency attribute number
+  *	currently defined
+  * @__NL80211_FREQUENCY_ATTR_AFTER_LAST: internal use
+@@ -3136,6 +3397,7 @@ enum nl80211_frequency_attr {
+ 	NL80211_FREQUENCY_ATTR_IR_CONCURRENT,
+ 	NL80211_FREQUENCY_ATTR_NO_20MHZ,
+ 	NL80211_FREQUENCY_ATTR_NO_10MHZ,
++	NL80211_FREQUENCY_ATTR_WMM,
+ 
+ 	/* keep last */
+ 	__NL80211_FREQUENCY_ATTR_AFTER_LAST,
+@@ -3319,7 +3581,7 @@ enum nl80211_sched_scan_match_attr {
+  * @NL80211_RRF_AUTO_BW: maximum available bandwidth should be calculated
+  *	base on contiguous rules and wider channels will be allowed to cross
+  *	multiple contiguous/overlapping frequency ranges.
+- * @NL80211_RRF_IR_CONCURRENT: See &NL80211_FREQUENCY_ATTR_IR_CONCURRENT
++ * @NL80211_RRF_IR_CONCURRENT: See %NL80211_FREQUENCY_ATTR_IR_CONCURRENT
+  * @NL80211_RRF_NO_HT40MINUS: channels can't be used in HT40- operation
+  * @NL80211_RRF_NO_HT40PLUS: channels can't be used in HT40+ operation
+  * @NL80211_RRF_NO_80MHZ: 80MHz operation not allowed
+@@ -4945,6 +5207,27 @@ enum nl80211_feature_flags {
+  *	probe request tx deferral and suppression
+  * @NL80211_EXT_FEATURE_MFP_OPTIONAL: Driver supports the %NL80211_MFP_OPTIONAL
+  *	value in %NL80211_ATTR_USE_MFP.
++ * @NL80211_EXT_FEATURE_LOW_SPAN_SCAN: Driver supports low span scan.
++ * @NL80211_EXT_FEATURE_LOW_POWER_SCAN: Driver supports low power scan.
++ * @NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN: Driver supports high accuracy scan.
++ * @NL80211_EXT_FEATURE_DFS_OFFLOAD: HW/driver will offload DFS actions.
++ *	Device or driver will do all DFS-related actions by itself,
++ *	informing user-space about CAC progress, radar detection event,
++ *	channel change triggered by radar detection event.
++ *	No need to start CAC from user-space, no need to react to
++ *	"radar detected" event.
++ * @NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211: Driver supports sending and
++ *	receiving control port frames over nl80211 instead of the netdevice.
++ * @NL80211_EXT_FEATURE_DATA_ACK_SIGNAL_SUPPORT: This Driver support data ack
++ *	rssi if firmware support, this flag is to intimate about ack rssi
++ *	support to nl80211.
++ * @NL80211_EXT_FEATURE_TXQS: Driver supports FQ-CoDel-enabled intermediate
++ *      TXQs.
++ * @NL80211_EXT_FEATURE_SCAN_RANDOM_SN: Driver/device supports randomizing the
++ *	SN in probe request frames if requested by %NL80211_SCAN_FLAG_RANDOM_SN.
++ * @NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT: Driver/device can omit all data
++ *	except for supported rates from the probe request content if requested
++ *	by the %NL80211_SCAN_FLAG_MIN_PREQ_CONTENT flag.
+  *
+  * @NUM_NL80211_EXT_FEATURES: number of extended features.
+  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
+@@ -4972,6 +5255,15 @@ enum nl80211_ext_feature_index {
+ 	NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE,
+ 	NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
+ 	NL80211_EXT_FEATURE_MFP_OPTIONAL,
++	NL80211_EXT_FEATURE_LOW_SPAN_SCAN,
++	NL80211_EXT_FEATURE_LOW_POWER_SCAN,
++	NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN,
++	NL80211_EXT_FEATURE_DFS_OFFLOAD,
++	NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211,
++	NL80211_EXT_FEATURE_DATA_ACK_SIGNAL_SUPPORT,
++	NL80211_EXT_FEATURE_TXQS,
++	NL80211_EXT_FEATURE_SCAN_RANDOM_SN,
++	NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT,
+ 
+ 	/* add new features before the definition below */
+ 	NUM_NL80211_EXT_FEATURES,
+@@ -5032,6 +5324,10 @@ enum nl80211_timeout_reason {
+  * of NL80211_CMD_TRIGGER_SCAN and NL80211_CMD_START_SCHED_SCAN
+  * requests.
+  *
++ * NL80211_SCAN_FLAG_LOW_SPAN, NL80211_SCAN_FLAG_LOW_POWER, and
++ * NL80211_SCAN_FLAG_HIGH_ACCURACY flags are exclusive of each other, i.e., only
++ * one of them can be used in the request.
++ *
+  * @NL80211_SCAN_FLAG_LOW_PRIORITY: scan request has low priority
+  * @NL80211_SCAN_FLAG_FLUSH: flush cache before scanning
+  * @NL80211_SCAN_FLAG_AP: force a scan even if the interface is configured
+@@ -5059,7 +5355,26 @@ enum nl80211_timeout_reason {
+  *	and suppression (if it has received a broadcast Probe Response frame,
+  *	Beacon frame or FILS Discovery frame from an AP that the STA considers
+  *	a suitable candidate for (re-)association - suitable in terms of
+- *	SSID and/or RSSI
++ *	SSID and/or RSSI.
++ * @NL80211_SCAN_FLAG_LOW_SPAN: Span corresponds to the total time taken to
++ *	accomplish the scan. Thus, this flag intends the driver to perform the
++ *	scan request with lesser span/duration. It is specific to the driver
++ *	implementations on how this is accomplished. Scan accuracy may get
++ *	impacted with this flag.
++ * @NL80211_SCAN_FLAG_LOW_POWER: This flag intends the scan attempts to consume
++ *	optimal possible power. Drivers can resort to their specific means to
++ *	optimize the power. Scan accuracy may get impacted with this flag.
++ * @NL80211_SCAN_FLAG_HIGH_ACCURACY: Accuracy here intends to the extent of scan
++ *	results obtained. Thus HIGH_ACCURACY scan flag aims to get maximum
++ *	possible scan results. This flag hints the driver to use the best
++ *	possible scan configuration to improve the accuracy in scanning.
++ *	Latency and power use may get impacted with this flag.
++ * @NL80211_SCAN_FLAG_RANDOM_SN: randomize the sequence number in probe
++ *	request frames from this scan to avoid correlation/tracking being
++ *	possible.
++ * @NL80211_SCAN_FLAG_MIN_PREQ_CONTENT: minimize probe request content to
++ *	only have supported rates and no additional capabilities (unless
++ *	added by userspace explicitly.)
+  */
+ enum nl80211_scan_flags {
+ 	NL80211_SCAN_FLAG_LOW_PRIORITY				= 1<<0,
+@@ -5070,6 +5385,11 @@ enum nl80211_scan_flags {
+ 	NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP		= 1<<5,
+ 	NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE		= 1<<6,
+ 	NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION	= 1<<7,
++	NL80211_SCAN_FLAG_LOW_SPAN				= 1<<8,
++	NL80211_SCAN_FLAG_LOW_POWER				= 1<<9,
++	NL80211_SCAN_FLAG_HIGH_ACCURACY				= 1<<10,
++	NL80211_SCAN_FLAG_RANDOM_SN				= 1<<11,
++	NL80211_SCAN_FLAG_MIN_PREQ_CONTENT			= 1<<12,
+ };
+ 
+ /**
+@@ -5127,6 +5447,8 @@ enum nl80211_smps_mode {
+  *	non-operating channel is expired and no longer valid. New CAC must
+  *	be done on this channel before starting the operation. This is not
+  *	applicable for ETSI dfs domain where pre-CAC is valid for ever.
++ * @NL80211_RADAR_CAC_STARTED: Channel Availability Check has been started,
++ *	should be generated by HW if NL80211_EXT_FEATURE_DFS_OFFLOAD is enabled.
+  */
+ enum nl80211_radar_event {
+ 	NL80211_RADAR_DETECTED,
+@@ -5134,6 +5456,7 @@ enum nl80211_radar_event {
+ 	NL80211_RADAR_CAC_ABORTED,
+ 	NL80211_RADAR_NOP_FINISHED,
+ 	NL80211_RADAR_PRE_CAC_EXPIRED,
++	NL80211_RADAR_CAC_STARTED,
+ };
+ 
+ /**
+@@ -5425,11 +5748,11 @@ enum nl80211_nan_func_attributes {
+  * @NL80211_NAN_SRF_INCLUDE: present if the include bit of the SRF set.
+  *	This is a flag.
+  * @NL80211_NAN_SRF_BF: Bloom Filter. Present if and only if
+- *	&NL80211_NAN_SRF_MAC_ADDRS isn't present. This attribute is binary.
++ *	%NL80211_NAN_SRF_MAC_ADDRS isn't present. This attribute is binary.
+  * @NL80211_NAN_SRF_BF_IDX: index of the Bloom Filter. Mandatory if
+- *	&NL80211_NAN_SRF_BF is present. This is a u8.
++ *	%NL80211_NAN_SRF_BF is present. This is a u8.
+  * @NL80211_NAN_SRF_MAC_ADDRS: list of MAC addresses for the SRF. Present if
+- *	and only if &NL80211_NAN_SRF_BF isn't present. This is a nested
++ *	and only if %NL80211_NAN_SRF_BF isn't present. This is a nested
+  *	attribute. Each nested attribute is a MAC address.
+  * @NUM_NL80211_NAN_SRF_ATTR: internal
+  * @NL80211_NAN_SRF_ATTR_MAX: highest NAN SRF attribute
+@@ -5469,4 +5792,15 @@ enum nl80211_nan_match_attributes {
+ 	NL80211_NAN_MATCH_ATTR_MAX = NUM_NL80211_NAN_MATCH_ATTR - 1
+ };
+ 
++/**
++ * nl80211_external_auth_action - Action to perform with external
++ *     authentication request. Used by NL80211_ATTR_EXTERNAL_AUTH_ACTION.
++ * @NL80211_EXTERNAL_AUTH_START: Start the authentication.
++ * @NL80211_EXTERNAL_AUTH_ABORT: Abort the ongoing authentication.
++ */
++enum nl80211_external_auth_action {
++	NL80211_EXTERNAL_AUTH_START,
++	NL80211_EXTERNAL_AUTH_ABORT,
++};
++
+ #endif /* __LINUX_NL80211_H */
diff --git a/target/linux/ar71xx/image/generic-legacy-devices.mk b/target/linux/ar71xx/image/generic-legacy-devices.mk
index a784a1a20..9cf405d48 100644
--- a/target/linux/ar71xx/image/generic-legacy-devices.mk
+++ b/target/linux/ar71xx/image/generic-legacy-devices.mk
@@ -1,6 +1,6 @@
 define LegacyDevice/A60
    DEVICE_TITLE := OpenMesh A40/A60
-   DEVICE_PACKAGES := om-watchdog kmod-ath10k ath10k-firmware-qca988x \
+   DEVICE_PACKAGES := om-watchdog kmod-ath10k-ct ath10k-firmware-qca988x-ct \
 	mod-usb-core kmod-usb2
 endef
 LEGACY_DEVICES += A60
@@ -151,13 +151,13 @@ LEGACY_DEVICES += DIR505A1
 
 define LegacyDevice/DGL5500A1
   DEVICE_TITLE := D-Link DGL-5500 rev. A1
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca988x-ct
 endef
 LEGACY_DEVICES += DGL5500A1
 
 define LegacyDevice/TEW823DRU
   DEVICE_TITLE := TRENDNet TEW-823DRU
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca988x-ct
 endef
 LEGACY_DEVICES += TEW823DRU
 
@@ -226,7 +226,7 @@ LEGACY_DEVICES += dLAN_pro_500_wp
 
 define LegacyDevice/dLAN_pro_1200_ac
   DEVICE_TITLE := devolo dLAN pro 1200+ WiFi ac
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
 endef
 LEGACY_DEVICES += dLAN_pro_1200_ac
 
@@ -238,13 +238,13 @@ LEGACY_DEVICES += ESR900
 
 define LegacyDevice/ESR1750
   DEVICE_TITLE := EnGenius ESR1750
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-storage kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-storage kmod-ath10k-ct ath10k-firmware-qca988x-ct
 endef
 LEGACY_DEVICES += ESR1750
 
 define LegacyDevice/EPG5000
   DEVICE_TITLE := EnGenius EPG5000
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-storage kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-storage kmod-ath10k-ct ath10k-firmware-qca988x-ct
 endef
 LEGACY_DEVICES += EPG5000
 
@@ -292,7 +292,7 @@ LEGACY_DEVICES += OM5P
 
 define LegacyDevice/OM5PAC
   DEVICE_TITLE := OpenMesh OM5P-AC
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x om-watchdog
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct om-watchdog
 endef
 LEGACY_DEVICES += OM5PAC
 
@@ -310,7 +310,7 @@ LEGACY_DEVICES += MR900
 
 define LegacyDevice/MR1750
   DEVICE_TITLE := OpenMesh MR1750
-  DEVICE_PACKAGES := om-watchdog kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := om-watchdog kmod-ath10k-ct ath10k-firmware-qca988x-ct
 endef
 LEGACY_DEVICES += MR1750
 
diff --git a/target/linux/ar71xx/image/generic-senao.mk b/target/linux/ar71xx/image/generic-senao.mk
index f5473126d..a241e4a6f 100644
--- a/target/linux/ar71xx/image/generic-senao.mk
+++ b/target/linux/ar71xx/image/generic-senao.mk
@@ -30,7 +30,7 @@ TARGET_DEVICES += ens202ext
 define Device/koala
   DEVICE_TITLE := OCEDO Koala
   BOARDNAME := KOALA
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
   KERNEL_SIZE := 1536k
   IMAGE_SIZE := 7424k
   MTDPARTS := spi0.0:256k(u-boot)ro,64k(u-boot-env),1536k(kernel),5888k(rootfs),1536k(kernel2),5888k(rootfs2),1088k(data)ro,64k(id)ro,64k(art)ro,7424k@0x50000(firmware)
diff --git a/target/linux/ar71xx/image/generic-tp-link.mk b/target/linux/ar71xx/image/generic-tp-link.mk
index 3c0a89d2b..39d3ab08f 100644
--- a/target/linux/ar71xx/image/generic-tp-link.mk
+++ b/target/linux/ar71xx/image/generic-tp-link.mk
@@ -9,7 +9,7 @@ endef
 define Device/archer-c25-v1
   $(Device/archer-cxx)
   DEVICE_TITLE := TP-LINK Archer C25 v1
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca9887
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9887-ct
   BOARDNAME := ARCHER-C25-V1
   TPLINK_BOARD_ID := ARCHER-C25-V1
   DEVICE_PROFILE := ARCHERC25V1
@@ -22,7 +22,7 @@ TARGET_DEVICES += archer-c25-v1
 define Device/archer-c58-v1
   $(Device/archer-cxx)
   DEVICE_TITLE := TP-LINK Archer C58 v1
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca9888
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9888-ct
   BOARDNAME := ARCHER-C58-V1
   TPLINK_BOARD_ID := ARCHER-C58-V1
   DEVICE_PROFILE := ARCHERC58V1
@@ -35,7 +35,7 @@ TARGET_DEVICES += archer-c58-v1
 define Device/archer-c59-v1
   $(Device/archer-cxx)
   DEVICE_TITLE := TP-LINK Archer C59 v1
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k ath10k-firmware-qca9888
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k-ct ath10k-firmware-qca9888-ct
   BOARDNAME := ARCHER-C59-V1
   TPLINK_BOARD_ID := ARCHER-C59-V1
   DEVICE_PROFILE := ARCHERC59V1
@@ -60,7 +60,7 @@ TARGET_DEVICES += archer-c59-v2
 define Device/archer-c60-v1
   $(Device/archer-cxx)
   DEVICE_TITLE := TP-LINK Archer C60 v1
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca9888
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9888-ct
   BOARDNAME := ARCHER-C60-V1
   TPLINK_BOARD_ID := ARCHER-C60-V1
   DEVICE_PROFILE := ARCHERC60V1
@@ -85,7 +85,7 @@ TARGET_DEVICES += archer-c60-v2
 define Device/archer-c5-v1
   $(Device/tplink-16mlzma)
   DEVICE_TITLE := TP-LINK Archer C5 v1
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BOARDNAME := ARCHER-C5
   DEVICE_PROFILE := ARCHERC7
   TPLINK_HWID := 0xc5000001
@@ -95,7 +95,7 @@ TARGET_DEVICES += archer-c5-v1
 define Device/archer-c7-v1
   $(Device/tplink-8mlzma)
   DEVICE_TITLE := TP-LINK Archer C7 v1
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BOARDNAME := ARCHER-C7
   DEVICE_PROFILE := ARCHERC7
   TPLINK_HWID := 0x75000001
@@ -105,7 +105,7 @@ TARGET_DEVICES += archer-c7-v1
 define Device/archer-c7-v2
   $(Device/tplink-16mlzma)
   DEVICE_TITLE := TP-LINK Archer C7 v2
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BOARDNAME := ARCHER-C7-V2
   DEVICE_PROFILE := ARCHERC7
   TPLINK_HWID := 0xc7000002
@@ -118,7 +118,7 @@ TARGET_DEVICES += archer-c7-v2
 define Device/archer-c7-v2-il
   $(Device/tplink-16mlzma)
   DEVICE_TITLE := TP-LINK Archer C7 v2 (IL)
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BOARDNAME := ARCHER-C7-V2
   DEVICE_PROFILE := ARCHERC7
   TPLINK_HWID := 0xc7000002
@@ -129,7 +129,7 @@ TARGET_DEVICES += archer-c7-v2-il
 define Device/tl-wdr7500-v3
   $(Device/tplink-8mlzma)
   DEVICE_TITLE := TP-LINK Archer C7 v3
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BOARDNAME := ARCHER-C7
   DEVICE_PROFILE := ARCHERC7
   TPLINK_HWID := 0x75000003
@@ -139,7 +139,7 @@ TARGET_DEVICES += tl-wdr7500-v3
 define Device/archer-c7-v4
   $(Device/archer-cxx)
   DEVICE_TITLE := TP-LINK Archer C7 v4
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BOARDNAME := ARCHER-C7-V4
   TPLINK_BOARD_ID := ARCHER-C7-V4
   IMAGE_SIZE := 15104k
@@ -232,7 +232,7 @@ TARGET_DEVICES += eap120-v1
 define Device/re355-v1
   $(Device/tplink-safeloader)
   DEVICE_TITLE := TP-LINK RE355 v1
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
   MTDPARTS := spi0.0:128k(u-boot)ro,6016k(firmware),64k(partition-table)ro,64k(product-info)ro,1856k(config)ro,64k(art)ro
   IMAGE_SIZE := 7936k
   BOARDNAME := RE355
@@ -246,7 +246,7 @@ TARGET_DEVICES += re355-v1
 define Device/re450-v1
   $(Device/tplink-safeloader)
   DEVICE_TITLE := TP-LINK RE450 v1
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
   MTDPARTS := spi0.0:128k(u-boot)ro,6016k(firmware),64k(partition-table)ro,64k(product-info)ro,1856k(config)ro,64k(art)ro
   IMAGE_SIZE := 7936k
   BOARDNAME := RE450
@@ -321,7 +321,7 @@ TARGET_DEVICES += tl-wdr4900-v2
 define Device/tl-wdr6500-v2
   $(Device/tplink-8mlzma)
   DEVICE_TITLE := TP-LINK TL-WDR6500 v2
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k-ct ath10k-firmware-qca988x-ct
   KERNEL := kernel-bin | patch-cmdline | lzma | uImage lzma
   KERNEL_INITRAMFS := kernel-bin | patch-cmdline | lzma | uImage lzma | tplink-v1-header
   BOARDNAME := TL-WDR6500-v2
@@ -341,7 +341,7 @@ TARGET_DEVICES += mw4530r-v1
 define Device/tl-wpa8630-v1
   $(Device/tplink-8mlzma)
   DEVICE_TITLE := TP-LINK TL-WPA8630 v1
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BOARDNAME := TL-WPA8630
   DEVICE_PROFILE := TL-WPA8630
   TPLINK_HWID := 0x86300001
@@ -487,7 +487,7 @@ define Device/tl-wr902ac-v1
   $(Device/tplink-safeloader)
   DEVICE_TITLE := TP-LINK TL-WR902AC v1
   DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport \
-	kmod-ath10k ath10k-firmware-qca9887 -swconfig -uboot-envtools
+	kmod-ath10k-ct ath10k-firmware-qca9887-ct -swconfig -uboot-envtools
   BOARDNAME := TL-WR902AC-V1
   DEVICE_PROFILE := TLWR902
   TPLINK_BOARD_ID := TL-WR902AC-V1
diff --git a/target/linux/ar71xx/image/generic-ubnt.mk b/target/linux/ar71xx/image/generic-ubnt.mk
index 07c029550..b9ce32bd3 100644
--- a/target/linux/ar71xx/image/generic-ubnt.mk
+++ b/target/linux/ar71xx/image/generic-ubnt.mk
@@ -122,7 +122,7 @@ endef
 define Device/ubnt-unifiac-lite
   $(Device/ubnt-unifiac)
   DEVICE_TITLE := Ubiquiti UniFi AC-Lite
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
   DEVICE_PROFILE += UBNTUNIFIACLITE
   BOARDNAME := UBNT-UF-AC-LITE
 endef
@@ -137,7 +137,7 @@ TARGET_DEVICES += ubnt-unifiac-mesh
 define Device/ubnt-unifiac-pro
   $(Device/ubnt-unifiac)
   DEVICE_TITLE := Ubiquiti UniFi AC-Pro
-  DEVICE_PACKAGES += kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES += kmod-ath10k-ct ath10k-firmware-qca988x-ct
   DEVICE_PROFILE += UBNTUNIFIACPRO
   BOARDNAME := UBNT-UF-AC-PRO
 endef
diff --git a/target/linux/ar71xx/image/generic.mk b/target/linux/ar71xx/image/generic.mk
index 55963c576..a0d578046 100644
--- a/target/linux/ar71xx/image/generic.mk
+++ b/target/linux/ar71xx/image/generic.mk
@@ -199,7 +199,7 @@ TARGET_DEVICES += cf-e320n-v2
 
 define Device/cf-e355ac-v1
   DEVICE_TITLE := COMFAST CF-E355AC v1
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k ath10k-firmware-qca988x \
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca988x-ct \
 	-swconfig -uboot-envtools
   BOARDNAME := CF-E355AC-V1
   IMAGE_SIZE := 16192k
@@ -210,7 +210,7 @@ TARGET_DEVICES += cf-e355ac-v1
 define Device/cf-e355ac-v2
   $(Device/cf-e355ac-v1)
   DEVICE_TITLE := COMFAST CF-E355AC v2
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k ath10k-firmware-qca9888 \
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca9888-ct \
 	-swconfig -uboot-envtools
   BOARDNAME := CF-E355AC-V2
 endef
@@ -218,7 +218,7 @@ TARGET_DEVICES += cf-e355ac-v2
 
 define Device/cf-e375ac
   DEVICE_TITLE := COMFAST CF-E375AC
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k ath10k-firmware-qca9888 \
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca9888-ct \
 	-uboot-envtools
   BOARDNAME := CF-E375AC
   IMAGE_SIZE := 16000k
@@ -228,7 +228,7 @@ TARGET_DEVICES += cf-e375ac
 
 define Device/cf-e380ac-v1
   DEVICE_TITLE := COMFAST CF-E380AC v1
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k ath10k-firmware-qca988x \
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca988x-ct \
 	-swconfig -uboot-envtools
   BOARDNAME := CF-E380AC-V1
   IMAGE_SIZE := 16128k
@@ -247,7 +247,7 @@ TARGET_DEVICES += cf-e380ac-v2
 
 define Device/cf-e385ac
   DEVICE_TITLE := COMFAST CF-E385AC
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k ath10k-firmware-qca9984 \
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca9984-ct \
 	-uboot-envtools
   BOARDNAME := CF-E385AC
   IMAGE_SIZE := 16000k
@@ -308,7 +308,7 @@ TARGET_DEVICES += dragino2
 
 define Device/e1700ac-v2-16M
   DEVICE_TITLE := Qxwlan E1700AC v2 (16MB flash)
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x kmod-usb-core \
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct kmod-usb-core \
 	kmod-usb2 kmod-usb-ledtrig-usbport
   BOARDNAME := E1700AC-V2
   SUPPORTED_DEVICES := e1700ac-v2
@@ -366,7 +366,7 @@ TARGET_DEVICES += e600g-v2-8M
 
 define Device/e600gac-v2-16M
   DEVICE_TITLE := Qxwlan E600GAC v2 (16MB flash)
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca9887 kmod-usb-core \
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9887-ct kmod-usb-core \
 	kmod-usb2 -swconfig
   BOARDNAME := E600GAC-V2
   SUPPORTED_DEVICES := e600gac-v2
@@ -499,7 +499,7 @@ TARGET_DEVICES += gl-ar300m
 
 define Device/gl-ar750
   DEVICE_TITLE := GL.iNet GL-AR750
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca9887 kmod-usb-core \
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9887-ct kmod-usb-core \
 	kmod-usb2 kmod-usb-storage
   BOARDNAME := GL-AR750
   SUPPORTED_DEVICES := gl-ar750
@@ -512,7 +512,7 @@ TARGET_DEVICES += gl-ar750
 
 define Device/gl-ar750s
   DEVICE_TITLE := GL.iNet GL-AR750S
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca9887 kmod-usb-core \
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9887-ct kmod-usb-core \
 	kmod-usb2 kmod-usb-storage
   BOARDNAME := GL-AR750S
   SUPPORTED_DEVICES := gl-ar750s
@@ -868,7 +868,7 @@ TARGET_DEVICES += rut900
 define Device/mc-mac1200r
   $(Device/tplink-8mlzma)
   DEVICE_TITLE := Mercury MAC1200R
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BOARDNAME := MC-MAC1200R
   DEVICE_PROFILE := MAC1200R
   TPLINK_HWID := 0x12000001
@@ -899,7 +899,7 @@ TARGET_DEVICES += oolite-v1
 define Device/oolite-v5.2
   $(Device/tplink-16mlzma)
   DEVICE_TITLE := GainStrong Oolite V5.2
-  DEVICE_PACKAGES := ath10k-firmware-qca9887 kmod-ath10k kmod-usb-core kmod-usb2
+  DEVICE_PACKAGES := ath10k-firmware-qca9887-ct kmod-ath10k-ct kmod-usb-core kmod-usb2
   BOARDNAME := OOLITE-V5-2
   DEVICE_PROFILE := OOLITEV52
   TPLINK_HWID := 0x3C00010B
@@ -994,7 +994,7 @@ TARGET_DEVICES += som9331
 
 define Device/sr3200
   DEVICE_TITLE := YunCore SR3200
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BOARDNAME := SR3200
   IMAGE_SIZE := 16000k
   MTDPARTS := spi0.0:256k(u-boot)ro,64k(u-boot-env),16000k(firmware),64k(art)ro
@@ -1004,7 +1004,7 @@ TARGET_DEVICES += sr3200
 define Device/xd3200
   $(Device/sr3200)
   DEVICE_TITLE := YunCore XD3200
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BOARDNAME := XD3200
 endef
 TARGET_DEVICES += xd3200
@@ -1057,7 +1057,7 @@ TARGET_DEVICES += n5q
 
 define Device/NBG6616
   DEVICE_TITLE := ZyXEL NBG6616
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-usb-storage kmod-rtc-pcf8563 kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-usb-storage kmod-rtc-pcf8563 kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BOARDNAME := NBG6616
   KERNEL_SIZE := 2048k
   IMAGE_SIZE := 15323k
@@ -1143,7 +1143,7 @@ endef
 define Device/dir-869-a1
   $(Device/seama)
   DEVICE_TITLE := D-Link DIR-869 rev. A1
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BOARDNAME := DIR-869-A1
   IMAGE_SIZE := 15872k
   MTDPARTS := spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,64k(devdata)ro,64k(devconf)ro,15872k(firmware),64k(radiocfg)ro
@@ -1180,7 +1180,7 @@ TARGET_DEVICES += mynet-n750
 define Device/qihoo-c301
   $(Device/seama)
   DEVICE_TITLE := Qihoo C301
-  DEVICE_PACKAGES :=  kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES :=  kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BOARDNAME := QIHOO-C301
   IMAGE_SIZE := 15744k
   MTDPARTS := spi0.0:256k(u-boot)ro,64k(u-boot-env),64k(devdata),64k(devconf),15744k(firmware),64k(warm_start),64k(action_image_config),64k(radiocfg)ro;spi0.1:15360k(upgrade2),1024k(privatedata)
@@ -1202,7 +1202,7 @@ TARGET_DEVICES += dap-1330-a1
 
 define Device/dap-2695-a1
   DEVICE_TITLE := D-Link DAP-2695 rev. A1
-  DEVICE_PACKAGES := ath10k-firmware-qca988x kmod-ath10k
+  DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct
   BOARDNAME := DAP-2695-A1
   IMAGES := factory.img sysupgrade.bin
   IMAGE_SIZE := 15360k
@@ -1243,7 +1243,7 @@ TARGET_DEVICES += wifi-pineapple-nano
 define Device/wlr8100
   DEVICE_TITLE := Sitecom WLR-8100
   DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-usb3 \
-	kmod-ath10k ath10k-firmware-qca988x
+	kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BOARDNAME := WLR8100
   IMAGE_SIZE := 15424k
   MTDPARTS := spi0.0:192k(u-boot)ro,64k(u-boot-env)ro,15424k(firmware),256k(manufacture)ro,64k(backup)ro,320k(storage)ro,64k(art)ro
diff --git a/target/linux/ar71xx/image/mikrotik.mk b/target/linux/ar71xx/image/mikrotik.mk
index afef8f761..8f9234901 100644
--- a/target/linux/ar71xx/image/mikrotik.mk
+++ b/target/linux/ar71xx/image/mikrotik.mk
@@ -35,7 +35,7 @@ define Device/nand-large-ac
   $(Device/mikrotik-nand)
   MIKROTIK_CHUNKSIZE := 2048
   DEVICE_TITLE := MikroTik RouterBoard (>= 128 MB NAND, 802.11ac)
-  DEVICE_PACKAGES += kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES += kmod-ath10k-ct ath10k-firmware-qca988x-ct
   SUPPORTED_DEVICES := rb-921gs-5hpacd-r2
 endef
 TARGET_DEVICES += nand-large-ac
@@ -55,7 +55,7 @@ TARGET_DEVICES += rb-nor-flash-16M
 define Device/rb-nor-flash-16M-ac
   $(Device/rb-nor-flash-16M)
   DEVICE_TITLE := MikroTik RouterBoard (16 MB SPI NOR, 802.11ac)
-  DEVICE_PACKAGES += kmod-ath10k ath10k-firmware-qca988x ath10k-firmware-qca9887 kmod-usb-ehci
+  DEVICE_PACKAGES += kmod-ath10k-ct ath10k-firmware-qca988x-ct ath10k-firmware-qca9887-ct kmod-usb-ehci
   SUPPORTED_DEVICES += rb-wapg-5hact2hnd
 endef
 TARGET_DEVICES += rb-nor-flash-16M-ac
diff --git a/target/linux/ar71xx/image/nand.mk b/target/linux/ar71xx/image/nand.mk
index ba9e1ba62..96365e652 100644
--- a/target/linux/ar71xx/image/nand.mk
+++ b/target/linux/ar71xx/image/nand.mk
@@ -31,7 +31,7 @@ TARGET_DEVICES += c-60
 
 define Device/domywifi-dw33d
   DEVICE_TITLE := DomyWifi DW33D
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-storage kmod-usb-ledtrig-usbport kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-storage kmod-usb-ledtrig-usbport kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BOARDNAME := DW33D
   IMAGE_SIZE := 16000k
   MTDPARTS := spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,14528k(rootfs),1472k(kernel),64k(art)ro,16000k@0x50000(firmware);ar934x-nfc:96m(rootfs_data),32m(backup)ro
@@ -87,7 +87,7 @@ TARGET_DEVICES += rambutan
 define Device/wi2a-ac200i
   SUPPORTED_DEVICES = $(1)
   DEVICE_TITLE := Nokia WI2A-AC200i
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath9k kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath9k kmod-ath10k-ct ath10k-firmware-qca988x-ct
   BOARDNAME := WI2A-AC200i
   BLOCKSIZE := 64k
   KERNEL_SIZE := 3648k
@@ -114,7 +114,7 @@ TARGET_DEVICES += z1
 
 define LegacyDevice/R6100
   DEVICE_TITLE := NETGEAR R6100
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport
 endef
 LEGACY_DEVICES += R6100
 
@@ -132,6 +132,6 @@ LEGACY_DEVICES += WNDR4300V1
 
 define LegacyDevice/NBG6716
   DEVICE_TITLE := Zyxel NBG 6716
-  DEVICE_PACKAGES := kmod-rtc-pcf8563 kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-rtc-pcf8563 kmod-ath10k-ct ath10k-firmware-qca988x-ct
 endef
 LEGACY_DEVICES += NBG6716
diff --git a/target/linux/ar71xx/image/tiny-legacy-devices.mk b/target/linux/ar71xx/image/tiny-legacy-devices.mk
index ab8205fef..bcf77de44 100644
--- a/target/linux/ar71xx/image/tiny-legacy-devices.mk
+++ b/target/linux/ar71xx/image/tiny-legacy-devices.mk
@@ -1,7 +1,7 @@
 define LegacyDevice/F9K1115V2
   DEVICE_TITLE := Belkin AC1750DB (F9K1115V2)
   DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb3 kmod-usb-ledtrig-usbport \
-        kmod-ath10k ath10k-firmware-qca988x
+        kmod-ath10k-ct ath10k-firmware-qca988x-ct
 endef
 LEGACY_DEVICES += F9K1115V2
 
diff --git a/target/linux/ath79/image/generic-tp-link.mk b/target/linux/ath79/image/generic-tp-link.mk
index 926c3cb61..a9485c457 100644
--- a/target/linux/ath79/image/generic-tp-link.mk
+++ b/target/linux/ath79/image/generic-tp-link.mk
@@ -4,7 +4,7 @@ define Device/tplink_archer-c7-v1
   $(Device/tplink-8mlzma)
   ATH_SOC := qca9558
   DEVICE_TITLE := TP-LINK Archer C7 v1
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k-ct ath10k-firmware-qca988x-ct
   TPLINK_HWID := 0x75000001
 endef
 TARGET_DEVICES += tplink_archer-c7-v1
@@ -13,7 +13,7 @@ define Device/tplink_archer-c7-v2
   $(Device/tplink-16mlzma)
   ATH_SOC := qca9558
   DEVICE_TITLE := TP-LINK Archer C7 v2
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k-ct ath10k-firmware-qca988x-ct
   TPLINK_HWID := 0xc7000002
   IMAGES := sysupgrade.bin factory.bin factory-us.bin factory-eu.bin
   IMAGE/factory-us.bin := append-rootfs | mktplinkfw factory -C US
@@ -26,7 +26,7 @@ define Device/tplink_re450-v2
   ATH_SOC := qca9563
   IMAGE_SIZE := 6016k
   DEVICE_TITLE := TP-LINK RE450 v2
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
   TPLINK_HWID := 0x0
   TPLINK_HWREV := 0
   TPLINK_BOARD_ID := RE450-V2
diff --git a/target/linux/ath79/image/generic-ubnt.mk b/target/linux/ath79/image/generic-ubnt.mk
index d9411c6c2..4ef9f8de3 100644
--- a/target/linux/ath79/image/generic-ubnt.mk
+++ b/target/linux/ath79/image/generic-ubnt.mk
@@ -85,7 +85,7 @@ define Device/ubnt_unifiac
   IMAGE_SIZE := 7744k
   IMAGES := sysupgrade.bin
   IMAGE/sysupgrade.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | append-rootfs | pad-rootfs | append-metadata | check-size $$$$(IMAGE_SIZE)
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
 endef
 
 
diff --git a/target/linux/ath79/image/generic.mk b/target/linux/ath79/image/generic.mk
index e968dcf92..2727fb6ca 100644
--- a/target/linux/ath79/image/generic.mk
+++ b/target/linux/ath79/image/generic.mk
@@ -161,7 +161,7 @@ define Device/iodata_wn-ac1167dgr
   IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
     append-rootfs | pad-rootfs | check-size $$$$(IMAGE_SIZE) | \
     senao-header -r 0x30a -p 0x61 -t 2
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca988x-ct
 endef
 TARGET_DEVICES += iodata_wn-ac1167dgr
 
@@ -173,14 +173,14 @@ define Device/iodata_wn-ac1600dgr2
   IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
     append-rootfs | pad-rootfs | check-size $$$$(IMAGE_SIZE) | \
     senao-header -r 0x30a -p 0x60 -t 2 -v 200
-  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca988x-ct
 endef
 TARGET_DEVICES += iodata_wn-ac1600dgr2
 
 define Device/ocedo_koala
   ATH_SOC := qca9558
   DEVICE_TITLE := OCEDO Koala
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
   SUPPORTED_DEVICES += koala
   IMAGE_SIZE := 7424k
   IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata | check-size $$$$(IMAGE_SIZE)
@@ -198,7 +198,7 @@ TARGET_DEVICES += ocedo_raccoon
 define Device/openmesh_om5p-ac-v2
   ATH_SOC := qca9558
   DEVICE_TITLE := OpenMesh OM5P-AC v2
-  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca988x om-watchdog
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct om-watchdog
   IMAGE_SIZE := 7808k
   SUPPORTED_DEVICES += om5p-acv2
 endef
@@ -295,7 +295,7 @@ define Device/phicomm_k2t
   IMAGES := sysupgrade.bin
   IMAGE/default := append-kernel | append-rootfs | pad-rootfs
   IMAGE/sysupgrade.bin := $$(IMAGE/default) | append-metadata | check-size $$$$(IMAGE_SIZE)
-  DEVICE_PACKAGES := kmod-leds-reset kmod-ath10k ath10k-firmware-qca9888
+  DEVICE_PACKAGES := kmod-leds-reset kmod-ath10k-ct ath10k-firmware-qca9888-ct
 endef
 TARGET_DEVICES += phicomm_k2t
 
diff --git a/target/linux/ipq40xx/Makefile b/target/linux/ipq40xx/Makefile
index ef7c0f56c..d3da63b55 100644
--- a/target/linux/ipq40xx/Makefile
+++ b/target/linux/ipq40xx/Makefile
@@ -15,8 +15,8 @@ KERNELNAME:=zImage Image dtbs
 include $(INCLUDE_DIR)/target.mk
 DEFAULT_PACKAGES += \
 	kmod-leds-gpio kmod-gpio-button-hotplug swconfig \
-	kmod-ath10k wpad-mini \
+	kmod-ath10k-ct wpad-mini \
 	kmod-usb3 kmod-usb-dwc3-of-simple kmod-usb-phy-qcom-dwc3 \
-	ath10k-firmware-qca4019
+	ath10k-firmware-qca4019-ct-ct
 
 $(eval $(call BuildTarget))
diff --git a/target/linux/ipq40xx/image/Makefile b/target/linux/ipq40xx/image/Makefile
index 89e882173..5af9b3eac 100644
--- a/target/linux/ipq40xx/image/Makefile
+++ b/target/linux/ipq40xx/image/Makefile
@@ -143,7 +143,7 @@ define Device/meraki_mr33
 	PAGESIZE := 2048
 	DEVICE_TITLE := Cisco Meraki MR33
 	IMAGES = sysupgrade.bin
-	DEVICE_PACKAGES := -swconfig ath10k-firmware-qca9887
+	DEVICE_PACKAGES := -swconfig ath10k-firmware-qca9887-ct
 endef
 TARGET_DEVICES += meraki_mr33
 
@@ -195,7 +195,7 @@ define Device/openmesh_a62
 	IMAGES = factory.bin sysupgrade.bin
 	IMAGE/factory.bin := append-rootfs | pad-rootfs | openmesh-image ce_type=A62
 	IMAGE/sysupgrade.bin/squashfs := append-rootfs | pad-rootfs | sysupgrade-tar rootfs=$$$$@ | append-metadata
-	DEVICE_PACKAGES := ath10k-firmware-qca9888 uboot-envtools
+	DEVICE_PACKAGES := ath10k-firmware-qca9888-ct uboot-envtools
 endef
 
 TARGET_DEVICES += openmesh_a62
diff --git a/target/linux/ipq806x/Makefile b/target/linux/ipq806x/Makefile
index 13be76e7b..178bf9791 100644
--- a/target/linux/ipq806x/Makefile
+++ b/target/linux/ipq806x/Makefile
@@ -20,7 +20,7 @@ DEFAULT_PACKAGES += \
 	kmod-ata-core kmod-ata-ahci kmod-ata-ahci-platform \
 	kmod-usb-core kmod-usb-ohci kmod-usb2 kmod-usb-ledtrig-usbport \
 	kmod-usb3 kmod-usb-dwc3-of-simple kmod-usb-phy-qcom-dwc3 \
-	kmod-ath10k wpad-mini \
+	kmod-ath10k-ct wpad-mini \
 	uboot-envtools
 
 $(eval $(call BuildTarget))
diff --git a/target/linux/ipq806x/image/Makefile b/target/linux/ipq806x/image/Makefile
index a7f740ff6..b82d54b0f 100644
--- a/target/linux/ipq806x/image/Makefile
+++ b/target/linux/ipq806x/image/Makefile
@@ -98,7 +98,7 @@ define Device/linksys_ea8500
 	IMAGES := factory.bin sysupgrade.bin
 	IMAGE/factory.bin := append-kernel | pad-to $$$${KERNEL_SIZE} | append-ubi
 	DEVICE_TITLE := Linksys EA8500
-	DEVICE_PACKAGES := ath10k-firmware-qca99x0
+	DEVICE_PACKAGES := ath10k-firmware-qca99x0-ct
 endef
 TARGET_DEVICES += linksys_ea8500
 
@@ -110,7 +110,7 @@ define Device/nec_wg2600hp
 	DEVICE_TITLE := NEC Aterm WG2600HP
 	IMAGES := sysupgrade.bin
 	IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
-	DEVICE_PACKAGES := ath10k-firmware-qca99x0
+	DEVICE_PACKAGES := ath10k-firmware-qca99x0-ct
 endef
 TARGET_DEVICES += nec_wg2600hp
 
@@ -125,7 +125,7 @@ define Device/netgear_d7800
 	BOARD_NAME := d7800
 	SUPPORTED_DEVICES += d7800
 	DEVICE_TITLE := Netgear Nighthawk X4 D7800
-	DEVICE_PACKAGES := ath10k-firmware-qca99x0
+	DEVICE_PACKAGES := ath10k-firmware-qca99x0-ct
 endef
 TARGET_DEVICES += netgear_d7800
 
@@ -140,7 +140,7 @@ define Device/netgear_r7500
 	BOARD_NAME := r7500
 	SUPPORTED_DEVICES += r7500
 	DEVICE_TITLE := Netgear Nighthawk X4 R7500
-	DEVICE_PACKAGES := ath10k-firmware-qca988x
+	DEVICE_PACKAGES := ath10k-firmware-qca988x-ct
 endef
 TARGET_DEVICES += netgear_r7500
 
@@ -155,7 +155,7 @@ define Device/netgear_r7500v2
 	BOARD_NAME := r7500v2
 	SUPPORTED_DEVICES += r7500v2
 	DEVICE_TITLE := Netgear Nighthawk X4 R7500v2
-	DEVICE_PACKAGES := ath10k-firmware-qca99x0 ath10k-firmware-qca988x
+	DEVICE_PACKAGES := ath10k-firmware-qca99x0-ct ath10k-firmware-qca988x-ct
 endef
 TARGET_DEVICES += netgear_r7500v2
 
@@ -170,7 +170,7 @@ define Device/netgear_r7800
 	BOARD_NAME := r7800
 	SUPPORTED_DEVICES += r7800
 	DEVICE_TITLE := Netgear Nighthawk X4S R7800
-	DEVICE_PACKAGES := ath10k-firmware-qca9984
+	DEVICE_PACKAGES := ath10k-firmware-qca9984-ct
 endef
 TARGET_DEVICES += netgear_r7800
 
@@ -184,7 +184,7 @@ define Device/qcom_ipq8064-ap148
 	BOARD_NAME := ap148
 	SUPPORTED_DEVICES += ap148
 	DEVICE_TITLE := Qualcomm AP148
-	DEVICE_PACKAGES := ath10k-firmware-qca99x0
+	DEVICE_PACKAGES := ath10k-firmware-qca99x0-ct
 endef
 TARGET_DEVICES += qcom_ipq8064-ap148
 
@@ -197,7 +197,7 @@ define Device/qcom_ipq8064-ap148-legacy
 	BOARD_NAME := ap148
 	SUPPORTED_DEVICES := qcom,ipq8064-ap148 ap148
 	DEVICE_TITLE := Qualcomm AP148 (legacy)
-	DEVICE_PACKAGES := ath10k-firmware-qca99x0
+	DEVICE_PACKAGES := ath10k-firmware-qca99x0-ct
 endef
 TARGET_DEVICES += qcom_ipq8064-ap148-legacy
 
@@ -207,7 +207,7 @@ define Device/qcom_ipq8064-db149
 	KERNEL_INSTALL := 1
 	BOARD_NAME := db149
 	DEVICE_TITLE := Qualcomm DB149
-	DEVICE_PACKAGES := ath10k-firmware-qca99x0
+	DEVICE_PACKAGES := ath10k-firmware-qca99x0-ct
 endef
 TARGET_DEVICES += qcom_ipq8064-db149
 
@@ -220,7 +220,7 @@ define Device/tplink_c2600
 	SUPPORTED_DEVICES += c2600
 	TPLINK_BOARD_ID := C2600
 	DEVICE_TITLE := TP-Link Archer C2600
-	DEVICE_PACKAGES := ath10k-firmware-qca99x0
+	DEVICE_PACKAGES := ath10k-firmware-qca99x0-ct
 endef
 TARGET_DEVICES += tplink_c2600
 
@@ -235,7 +235,7 @@ define Device/tplink_vr2600v
 	BOARD_NAME := vr2600v
 	SUPPORTED_DEVICES += vr2600v
 	DEVICE_TITLE := TP-Link Archer VR2600v
-	DEVICE_PACKAGES := ath10k-firmware-qca99x0
+	DEVICE_PACKAGES := ath10k-firmware-qca99x0-ct
 	IMAGES := sysupgrade.bin
 	IMAGE/sysupgrade.bin := pad-extra 512 | append-kernel | pad-to $$$${KERNEL_SIZE} | append-rootfs | pad-rootfs | append-metadata
 endef
@@ -251,7 +251,7 @@ define Device/zyxel_nbg6817
 	RAS_VERSION := "V1.99(OWRT.9999)C0"
 	SUPPORTED_DEVICES += nbg6817
 	DEVICE_TITLE := ZyXEL NBG6817
-	DEVICE_PACKAGES := ath10k-firmware-qca9984 e2fsprogs kmod-fs-ext4 losetup
+	DEVICE_PACKAGES := ath10k-firmware-qca9984-ct e2fsprogs kmod-fs-ext4 losetup
 	$(call Device/ZyXELImage)
 endef
 TARGET_DEVICES += zyxel_nbg6817
diff --git a/target/linux/ipq806x/profiles/00-default.mk b/target/linux/ipq806x/profiles/00-default.mk
index 9baa24fa9..ea0c5623f 100644
--- a/target/linux/ipq806x/profiles/00-default.mk
+++ b/target/linux/ipq806x/profiles/00-default.mk
@@ -1,7 +1,7 @@
 define Profile/Default
   NAME:=Default Profile
   PRIORITY:=1
-  PACKAGES:=ath10k-firmware-qca99x0 ath10k-firmware-qca988x ath10k-firmware-qca9984
+  PACKAGES:=ath10k-firmware-qca99x0-ct-ct ath10k-firmware-qca988x-ct-ct ath10k-firmware-qca9984-ct-ct
 endef
 
 define Profile/Default/Description
diff --git a/target/linux/lantiq/image/Makefile b/target/linux/lantiq/image/Makefile
index 0bedfcf0a..44cfc57e7 100644
--- a/target/linux/lantiq/image/Makefile
+++ b/target/linux/lantiq/image/Makefile
@@ -589,7 +589,7 @@ define Device/bt_homehub-v5a
   DEVICE_DTS := BTHOMEHUBV5A
   DEVICE_TITLE := BT Home Hub 5A
   DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader \
-	kmod-ath10k ath10k-firmware-qca988x wpad-mini kmod-usb-dwc2
+	kmod-ath10k-ct ath10k-firmware-qca988x-ct wpad-mini kmod-usb-dwc2
   SUPPORTED_DEVICES += BTHOMEHUBV5A
 endef
 TARGET_DEVICES += bt_homehub-v5a
diff --git a/target/linux/mvebu/image/cortex-a9.mk b/target/linux/mvebu/image/cortex-a9.mk
index 6bc6269da..917228c42 100644
--- a/target/linux/mvebu/image/cortex-a9.mk
+++ b/target/linux/mvebu/image/cortex-a9.mk
@@ -162,7 +162,7 @@ define Device/turris-omnia
   DEVICE_TITLE := Turris Omnia
   DEVICE_PACKAGES :=  \
     mkf2fs e2fsprogs kmod-fs-vfat kmod-nls-cp437 kmod-nls-iso8859-1 \
-    wpad-mini kmod-ath9k kmod-ath10k ath10k-firmware-qca988x
+    wpad-mini kmod-ath9k kmod-ath10k-ct ath10k-firmware-qca988x-ct
   IMAGES := $$(IMAGE_PREFIX)-sysupgrade.img.gz omnia-medkit-$$(IMAGE_PREFIX)-initramfs.tar.gz
   IMAGE/$$(IMAGE_PREFIX)-sysupgrade.img.gz := boot-img | sdcard-img | gzip | append-metadata
   IMAGE/omnia-medkit-$$(IMAGE_PREFIX)-initramfs.tar.gz := omnia-medkit-initramfs | gzip