target/linux/mac80211: add Felix Fietkau 2014-09 pending work

22 files changed, 660 insertions, 96 deletions

diff --git a/package/kernel/mac80211/patches/008-fix_netdev_unregister.patch b/package/kernel/mac80211/patches/008-fix_netdev_unregister.patch
new file mode 100755
index 0000000..8340da8
--- /dev/null
+++ b/package/kernel/mac80211/patches/008-fix_netdev_unregister.patch
@@ -0,0 +1,14 @@
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1796,7 +1796,11 @@ void ieee80211_remove_interfaces(struct 
+ 	}
+ 	mutex_unlock(&local->iflist_mtx);
+ 	unregister_netdevice_many(&unreg_list);
++#if (!(LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,45) && \
++       LINUX_VERSION_CODE < KERNEL_VERSION(3,11,0)) && \
++     (LINUX_VERSION_CODE < KERNEL_VERSION(3,16,0)))
+ 	list_del(&unreg_list);
++#endif
+ 
+ 	list_for_each_entry_safe(sdata, tmp, &wdev_list, list) {
+ 		list_del(&sdata->list);
diff --git a/package/kernel/mac80211/patches/160-backports-only-add-net_get_random_once-when-not-avai.patch b/package/kernel/mac80211/patches/160-backports-only-add-net_get_random_once-when-not-avai.patch
deleted file mode 100644
index 3114c16..0000000
--- a/package/kernel/mac80211/patches/160-backports-only-add-net_get_random_once-when-not-avai.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 6e5603fa9e5b0d3c602eb1672473e81a1692f61e Mon Sep 17 00:00:00 2001
-From: Hauke Mehrtens <hauke@hauke-m.de>
-Date: Sat, 31 May 2014 15:52:42 +0200
-Subject: [PATCH] backports: only add net_get_random_once() when not available
-
-Upstream commit: d787b3dd3b4fcb5f40eb6532163dc3abdca4fd45
-
-net_get_random_once() was added unconditionally also when the kernel we
-are compiling against already provided this function, this patch checks
-that first.
-
-Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
----
- backport/backport-include/linux/net.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/backport-include/linux/net.h
-+++ b/backport-include/linux/net.h
-@@ -64,7 +64,7 @@ do {								\
-  * may affect tracing. My recommendation is that if you have a need for
-  * static keys you just require at least 3.5 to remain sane.
-  */
--#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,5,0)
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,5,0) && !defined(net_get_random_once)
- #define __BACKPORT_NET_GET_RANDOM_ONCE 1
- #endif
- #endif /* ___NET_RANDOM_STATIC_KEY_INIT */
diff --git a/package/kernel/mac80211/patches/300-pending_work.patch b/package/kernel/mac80211/patches/300-pending_work.patch
index 5ffcf63..10c5cad 100644
--- a/package/kernel/mac80211/patches/300-pending_work.patch
+++ b/package/kernel/mac80211/patches/300-pending_work.patch
@@ -1,3 +1,165 @@
+commit 228ee4473b89118993c17ead26381c490c44f9fb
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Sun Nov 30 20:34:16 2014 +0100
+
+    ath9k: fix BE/BK queue order
+    
+    Hardware queues are ordered by priority. Use queue index 0 for BK, which
+    has lower priority than BE.
+    
+    Cc: stable@vger.kernel.org
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+commit cae76a90c891c5f96895b9628060449e3deb08c6
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Sun Nov 30 20:30:46 2014 +0100
+
+    ath9k_hw: fix hardware queue allocation
+    
+    The driver passes the desired hardware queue index for a WMM data queue
+    in qinfo->tqi_subtype. This was ignored in ath9k_hw_setuptxqueue, which
+    instead relied on the order in which the function is called.
+    
+    Cc: stable@vger.kernel.org
+    Reported-by: Hubert Feurstein <h.feurstein@gmail.com>
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+commit 77980bee5f1f743b46f8749185aca28b8ec69741
+Author: Johannes Berg <johannes.berg@intel.com>
+Date:   Mon Nov 3 14:29:09 2014 +0100
+
+    mac80211: fix use-after-free in defragmentation
+    
+    Upon receiving the last fragment, all but the first fragment
+    are freed, but the multicast check for statistics at the end
+    of the function refers to the current skb (the last fragment)
+    causing a use-after-free bug.
+    
+    Since multicast frames cannot be fragmented and we check for
+    this early in the function, just modify that check to also
+    do the accounting to fix the issue.
+    
+    Cc: stable@vger.kernel.org
+    Reported-by: Yosef Khyal <yosefx.khyal@intel.com>
+    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+
+commit e252be2d718dada0abd72208a44b9f1b63919883
+Author: Hauke Mehrtens <hauke@hauke-m.de>
+Date:   Wed Nov 5 23:31:07 2014 +0100
+
+    b43: fix NULL pointer dereference in b43_phy_copy()
+    
+    phy_read and phy_write are not set for every phy any more sine this:
+    commit d342b95dd735014a590f9051b1ba227eb54ca8f6
+    Author: Rafał Miłecki <zajec5@gmail.com>
+    Date:   Thu Jul 31 21:59:43 2014 +0200
+    
+        b43: don't duplicate common PHY read/write ops
+    
+    b43_phy_copy() accesses phy_read and phy_write directly and will fail
+    with some phys. This patch fixes the regression by using the
+    b43_phy_read() and b43_phy_write() functions which should be used for
+    read and write access.
+    
+    This should fix this bug report:
+    https://bugzilla.kernel.org/show_bug.cgi?id=87731
+    
+    Reported-by: Volker Kempter <v.kempter@pe.tu-clausthal.de>
+    Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+
+commit ddf93ad61cb009ed05ff2547923fb269a3604408
+Author: Miaoqing Pan <miaoqing@qca.qualcomm.com>
+Date:   Thu Nov 6 10:52:23 2014 +0530
+
+    ath9k: Fix RTC_DERIVED_CLK usage
+    
+    Based on the reference clock, which could be 25MHz or 40MHz,
+    AR_RTC_DERIVED_CLK is programmed differently for AR9340 and AR9550.
+    But, when a chip reset is done, processing the initvals
+    sets the register back to the default value.
+    
+    Fix this by moving the code in ath9k_hw_init_pll() to
+    ar9003_hw_override_ini(). Also, do this override for AR9531.
+    
+    Cc: stable@vger.kernel.org
+    Signed-off-by: Miaoqing Pan <miaoqing@qca.qualcomm.com>
+    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+
+commit 536b05e91ac2715942f792184c26beb43dbaa522
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Mon Oct 27 11:50:28 2014 +0100
+
+    mac80211: flush keys for AP mode on ieee80211_do_stop
+    
+    Userspace can add keys to an AP mode interface before start_ap has been
+    called. If there have been no calls to start_ap/stop_ap in the mean
+    time, the keys will still be around when the interface is brought down.
+    
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+commit c35074725eb19f353beb5f71266f9e985e46f583
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Wed Oct 22 18:16:14 2014 +0200
+
+    ath9k_common: always update value in ath9k_cmn_update_txpow
+    
+    In some cases the limit may be the same as reg->power_limit, but the
+    actual value that the hardware uses is not up to date. In that case, a
+    wrong value for current tx power is tracked internally.
+    Fix this by unconditionally updating it.
+    
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+commit 11f17631d9bf2a9e910dac7d09ba4581f5693831
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Tue Sep 9 09:48:30 2014 +0200
+
+    ath9k_hw: fix PLL clock initialization for newer SoC
+    
+    On AR934x and newer SoC devices, the layout of the AR_RTC_PLL_CONTROL
+    register changed. This currently breaks at least 5/10 MHz operation.
+    AR933x uses the old layout.
+    
+    It might also have been causing other stability issues because of the
+    different location of the PLL_BYPASS bit which needs to be set during
+    PLL clock initialization.
+    
+    This patch also removes more instances of hardcoded register values in
+    favor of properly computed ones with the PLL_BYPASS bit added.
+    
+    Reported-by: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+commit 0fecedddd4a0945873db1bd230ec6a168b3cc4fe
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Mon Sep 8 18:35:08 2014 +0200
+
+    ath9k_hw: reduce ANI spur immunity setting on HT40 extension channel
+    
+    The cycpwr_thr1 value needs to be lower on the extension channel than on
+    the control channel, similar to how the register settings are programmed
+    in the initvals.
+    
+    Also drop the unnecessary check for HT40 - this register can always be
+    written. This patch has been reported to improve HT40 stability and
+    throughput in some environments.
+    
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+commit 30d7434ccb853b96de698a040888fa4dacd0cc19
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Mon Sep 8 18:31:26 2014 +0200
+
+    Revert "ath9k_hw: reduce ANI firstep range for older chips"
+    
+    This reverts commit 09efc56345be4146ab9fc87a55c837ed5d6ea1ab
+    
+    I've received reports that this change is decreasing throughput in some
+    rare conditions on an AR9280 based device
+    
+    Cc: stable@vger.kernel.org
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
 commit 15ed54948f508ad1baad79c30050e2d29a21696d
 Author: Felix Fietkau <nbd@openwrt.org>
 Date:   Fri Jul 25 16:18:03 2014 +0200
@@ -925,6 +1087,36 @@ Date:   Mon May 19 21:20:49 2014 +0200
  	ieee80211_sta_ps_deliver_wakeup(sta);
  }
  
+@@ -1646,11 +1648,14 @@ ieee80211_rx_h_defragment(struct ieee802
+ 	sc = le16_to_cpu(hdr->seq_ctrl);
+ 	frag = sc & IEEE80211_SCTL_FRAG;
+ 
+-	if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
+-		   is_multicast_ether_addr(hdr->addr1))) {
+-		/* not fragmented */
++	if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
++		goto out;
++
++	if (is_multicast_ether_addr(hdr->addr1)) {
++		rx->local->dot11MulticastReceivedFrameCount++;
+ 		goto out;
+ 	}
++
+ 	I802_DEBUG_INC(rx->local->rx_handlers_fragments);
+ 
+ 	if (skb_linearize(rx->skb))
+@@ -1743,10 +1748,7 @@ ieee80211_rx_h_defragment(struct ieee802
+  out:
+ 	if (rx->sta)
+ 		rx->sta->rx_packets++;
+-	if (is_multicast_ether_addr(hdr->addr1))
+-		rx->local->dot11MulticastReceivedFrameCount++;
+-	else
+-		ieee80211_led_rx(rx->local);
++	ieee80211_led_rx(rx->local);
+ 	return RX_CONTINUE;
+ }
+ 
 --- a/net/mac80211/sta_info.h
 +++ b/net/mac80211/sta_info.h
 @@ -82,6 +82,7 @@ enum ieee80211_sta_info_flags {
@@ -2017,7 +2209,15 @@ Date:   Mon May 19 21:20:49 2014 +0200
  	if (err < 0)
  		return err;
  	ieee80211_bss_info_change_notify(sdata, err);
-@@ -3073,7 +2766,8 @@ static int ieee80211_set_after_csa_beaco
+@@ -1164,7 +857,6 @@ static int ieee80211_stop_ap(struct wiph
+ 	sdata->u.ap.driver_smps_mode = IEEE80211_SMPS_OFF;
+ 
+ 	__sta_info_flush(sdata, true);
+-	ieee80211_free_keys(sdata, true);
+ 
+ 	sdata->vif.bss_conf.enable_beacon = false;
+ 	sdata->vif.bss_conf.ssid_len = 0;
+@@ -3073,7 +2765,8 @@ static int ieee80211_set_after_csa_beaco
  
  	switch (sdata->vif.type) {
  	case NL80211_IFTYPE_AP:
@@ -2027,7 +2227,7 @@ Date:   Mon May 19 21:20:49 2014 +0200
  		kfree(sdata->u.ap.next_beacon);
  		sdata->u.ap.next_beacon = NULL;
  
-@@ -3176,6 +2870,7 @@ static int ieee80211_set_csa_beacon(stru
+@@ -3176,6 +2869,7 @@ static int ieee80211_set_csa_beacon(stru
  				    struct cfg80211_csa_settings *params,
  				    u32 *changed)
  {
@@ -2035,7 +2235,7 @@ Date:   Mon May 19 21:20:49 2014 +0200
  	int err;
  
  	switch (sdata->vif.type) {
-@@ -3210,20 +2905,13 @@ static int ieee80211_set_csa_beacon(stru
+@@ -3210,20 +2904,13 @@ static int ieee80211_set_csa_beacon(stru
  		     IEEE80211_MAX_CSA_COUNTERS_NUM))
  			return -EINVAL;
  
@@ -2062,7 +2262,7 @@ Date:   Mon May 19 21:20:49 2014 +0200
  		if (err < 0) {
  			kfree(sdata->u.ap.next_beacon);
  			return err;
-@@ -3367,7 +3055,6 @@ __ieee80211_channel_switch(struct wiphy 
+@@ -3367,7 +3054,6 @@ __ieee80211_channel_switch(struct wiphy 
  	sdata->csa_radar_required = params->radar_required;
  	sdata->csa_chandef = params->chandef;
  	sdata->csa_block_tx = params->block_tx;
@@ -2070,7 +2270,7 @@ Date:   Mon May 19 21:20:49 2014 +0200
  	sdata->vif.csa_active = true;
  
  	if (sdata->csa_block_tx)
-@@ -3515,10 +3202,23 @@ static int ieee80211_mgmt_tx(struct wiph
+@@ -3515,10 +3201,23 @@ static int ieee80211_mgmt_tx(struct wiph
  	     sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
  	    params->n_csa_offsets) {
  		int i;
@@ -2097,7 +2297,7 @@ Date:   Mon May 19 21:20:49 2014 +0200
  	}
  
  	IEEE80211_SKB_CB(skb)->flags = flags;
-@@ -3598,21 +3298,6 @@ static int ieee80211_get_antenna(struct 
+@@ -3598,21 +3297,6 @@ static int ieee80211_get_antenna(struct 
  	return drv_get_antenna(local, tx_ant, rx_ant);
  }
  
@@ -2119,7 +2319,7 @@ Date:   Mon May 19 21:20:49 2014 +0200
  static int ieee80211_set_rekey_data(struct wiphy *wiphy,
  				    struct net_device *dev,
  				    struct cfg80211_gtk_rekey_data *data)
-@@ -3844,8 +3529,6 @@ const struct cfg80211_ops mac80211_confi
+@@ -3844,8 +3528,6 @@ const struct cfg80211_ops mac80211_confi
  	.mgmt_frame_register = ieee80211_mgmt_frame_register,
  	.set_antenna = ieee80211_set_antenna,
  	.get_antenna = ieee80211_get_antenna,
@@ -2128,7 +2328,7 @@ Date:   Mon May 19 21:20:49 2014 +0200
  	.set_rekey_data = ieee80211_set_rekey_data,
  	.tdls_oper = ieee80211_tdls_oper,
  	.tdls_mgmt = ieee80211_tdls_mgmt,
-@@ -3854,9 +3537,6 @@ const struct cfg80211_ops mac80211_confi
+@@ -3854,9 +3536,6 @@ const struct cfg80211_ops mac80211_confi
  #ifdef CONFIG_PM
  	.set_wakeup = ieee80211_set_wakeup,
  #endif
@@ -2312,7 +2512,17 @@ Date:   Mon May 19 21:20:49 2014 +0200
  
  	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
  
-@@ -1303,6 +1304,7 @@ static void ieee80211_setup_sdata(struct
+@@ -928,9 +929,6 @@ static void ieee80211_do_stop(struct iee
+ 		 * another CPU.
+ 		 */
+ 		ieee80211_free_keys(sdata, true);
+-
+-		/* fall through */
+-	case NL80211_IFTYPE_AP:
+ 		skb_queue_purge(&sdata->skb_queue);
+ 	}
+ 
+@@ -1303,6 +1301,7 @@ static void ieee80211_setup_sdata(struct
  	sdata->control_port_protocol = cpu_to_be16(ETH_P_PAE);
  	sdata->control_port_no_encrypt = false;
  	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
@@ -2320,7 +2530,7 @@ Date:   Mon May 19 21:20:49 2014 +0200
  
  	sdata->noack_map = 0;
  
-@@ -1721,6 +1723,8 @@ int ieee80211_if_add(struct ieee80211_lo
+@@ -1721,6 +1720,8 @@ int ieee80211_if_add(struct ieee80211_lo
  
  		ndev->features |= local->hw.netdev_features;
  
@@ -3109,3 +3319,236 @@ Date:   Mon May 19 21:20:49 2014 +0200
  
  		if (!compat)
  			compat = &sdata->vif.bss_conf.chandef;
+--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+@@ -1004,9 +1004,11 @@ static bool ar5008_hw_ani_control_new(st
+ 	case ATH9K_ANI_FIRSTEP_LEVEL:{
+ 		u32 level = param;
+ 
+-		value = level;
++		value = level * 2;
+ 		REG_RMW_FIELD(ah, AR_PHY_FIND_SIG,
+ 			      AR_PHY_FIND_SIG_FIRSTEP, value);
++		REG_RMW_FIELD(ah, AR_PHY_FIND_SIG_LOW,
++			      AR_PHY_FIND_SIG_FIRSTEP_LOW, value);
+ 
+ 		if (level != aniState->firstepLevel) {
+ 			ath_dbg(common, ANI,
+@@ -1040,9 +1042,8 @@ static bool ar5008_hw_ani_control_new(st
+ 		REG_RMW_FIELD(ah, AR_PHY_TIMING5,
+ 			      AR_PHY_TIMING5_CYCPWR_THR1, value);
+ 
+-		if (IS_CHAN_HT40(ah->curchan))
+-			REG_RMW_FIELD(ah, AR_PHY_EXT_CCA,
+-				      AR_PHY_EXT_TIMING5_CYCPWR_THR1, value);
++		REG_RMW_FIELD(ah, AR_PHY_EXT_CCA,
++				  AR_PHY_EXT_TIMING5_CYCPWR_THR1, value - 1);
+ 
+ 		if (level != aniState->spurImmunityLevel) {
+ 			ath_dbg(common, ANI,
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -517,6 +517,23 @@ static void ar9003_hw_spur_mitigate(stru
+ 	ar9003_hw_spur_mitigate_ofdm(ah, chan);
+ }
+ 
++static u32 ar9003_hw_compute_pll_control_soc(struct ath_hw *ah,
++					     struct ath9k_channel *chan)
++{
++	u32 pll;
++
++	pll = SM(0x5, AR_RTC_9300_SOC_PLL_REFDIV);
++
++	if (chan && IS_CHAN_HALF_RATE(chan))
++		pll |= SM(0x1, AR_RTC_9300_SOC_PLL_CLKSEL);
++	else if (chan && IS_CHAN_QUARTER_RATE(chan))
++		pll |= SM(0x2, AR_RTC_9300_SOC_PLL_CLKSEL);
++
++	pll |= SM(0x2c, AR_RTC_9300_SOC_PLL_DIV_INT);
++
++	return pll;
++}
++
+ static u32 ar9003_hw_compute_pll_control(struct ath_hw *ah,
+ 					 struct ath9k_channel *chan)
+ {
+@@ -647,6 +664,19 @@ static void ar9003_hw_override_ini(struc
+ 		ah->enabled_cals |= TX_CL_CAL;
+ 	else
+ 		ah->enabled_cals &= ~TX_CL_CAL;
++
++	if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah)) {
++		if (ah->is_clk_25mhz) {
++			REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
++			REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
++			REG_WRITE(ah, AR_SLP32_INC, 0x0001e7ae);
++		} else {
++			REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x261 << 1);
++			REG_WRITE(ah, AR_SLP32_MODE, 0x0010f400);
++			REG_WRITE(ah, AR_SLP32_INC, 0x0001e800);
++		}
++		udelay(100);
++	}
+ }
+ 
+ static void ar9003_hw_prog_ini(struct ath_hw *ah,
+@@ -1779,7 +1809,12 @@ void ar9003_hw_attach_phy_ops(struct ath
+ 
+ 	priv_ops->rf_set_freq = ar9003_hw_set_channel;
+ 	priv_ops->spur_mitigate_freq = ar9003_hw_spur_mitigate;
+-	priv_ops->compute_pll_control = ar9003_hw_compute_pll_control;
++
++	if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah))
++		priv_ops->compute_pll_control = ar9003_hw_compute_pll_control_soc;
++	else
++		priv_ops->compute_pll_control = ar9003_hw_compute_pll_control;
++
+ 	priv_ops->set_channel_regs = ar9003_hw_set_channel_regs;
+ 	priv_ops->init_bb = ar9003_hw_init_bb;
+ 	priv_ops->process_ini = ar9003_hw_process_ini;
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -702,6 +702,8 @@ static void ath9k_hw_init_pll(struct ath
+ {
+ 	u32 pll;
+ 
++	pll = ath9k_hw_compute_pll_control(ah, chan);
++
+ 	if (AR_SREV_9485(ah) || AR_SREV_9565(ah)) {
+ 		/* program BB PLL ki and kd value, ki=0x4, kd=0x40 */
+ 		REG_RMW_FIELD(ah, AR_CH0_BB_DPLL2,
+@@ -752,7 +754,8 @@ static void ath9k_hw_init_pll(struct ath
+ 		REG_RMW_FIELD(ah, AR_CH0_DDR_DPLL3,
+ 			      AR_CH0_DPLL3_PHASE_SHIFT, 0x1);
+ 
+-		REG_WRITE(ah, AR_RTC_PLL_CONTROL, 0x1142c);
++		REG_WRITE(ah, AR_RTC_PLL_CONTROL,
++			  pll | AR_RTC_9300_PLL_BYPASS);
+ 		udelay(1000);
+ 
+ 		/* program refdiv, nint, frac to RTC register */
+@@ -768,7 +771,8 @@ static void ath9k_hw_init_pll(struct ath
+ 	} else if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+ 		u32 regval, pll2_divint, pll2_divfrac, refdiv;
+ 
+-		REG_WRITE(ah, AR_RTC_PLL_CONTROL, 0x1142c);
++		REG_WRITE(ah, AR_RTC_PLL_CONTROL,
++			  pll | AR_RTC_9300_SOC_PLL_BYPASS);
+ 		udelay(1000);
+ 
+ 		REG_SET_BIT(ah, AR_PHY_PLL_MODE, 0x1 << 16);
+@@ -840,7 +844,6 @@ static void ath9k_hw_init_pll(struct ath
+ 		udelay(1000);
+ 	}
+ 
+-	pll = ath9k_hw_compute_pll_control(ah, chan);
+ 	if (AR_SREV_9565(ah))
+ 		pll |= 0x40000;
+ 	REG_WRITE(ah, AR_RTC_PLL_CONTROL, pll);
+@@ -858,19 +861,6 @@ static void ath9k_hw_init_pll(struct ath
+ 	udelay(RTC_PLL_SETTLE_DELAY);
+ 
+ 	REG_WRITE(ah, AR_RTC_SLEEP_CLK, AR_RTC_FORCE_DERIVED_CLK);
+-
+-	if (AR_SREV_9340(ah) || AR_SREV_9550(ah)) {
+-		if (ah->is_clk_25mhz) {
+-			REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
+-			REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
+-			REG_WRITE(ah,  AR_SLP32_INC, 0x0001e7ae);
+-		} else {
+-			REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x261 << 1);
+-			REG_WRITE(ah, AR_SLP32_MODE, 0x0010f400);
+-			REG_WRITE(ah,  AR_SLP32_INC, 0x0001e800);
+-		}
+-		udelay(100);
+-	}
+ }
+ 
+ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
+--- a/drivers/net/wireless/ath/ath9k/reg.h
++++ b/drivers/net/wireless/ath/ath9k/reg.h
+@@ -1236,12 +1236,23 @@ enum {
+ #define AR_CH0_DPLL3_PHASE_SHIFT_S   23
+ #define AR_PHY_CCA_NOM_VAL_2GHZ      -118
+ 
++#define AR_RTC_9300_SOC_PLL_DIV_INT          0x0000003f
++#define AR_RTC_9300_SOC_PLL_DIV_INT_S        0
++#define AR_RTC_9300_SOC_PLL_DIV_FRAC         0x000fffc0
++#define AR_RTC_9300_SOC_PLL_DIV_FRAC_S       6
++#define AR_RTC_9300_SOC_PLL_REFDIV           0x01f00000
++#define AR_RTC_9300_SOC_PLL_REFDIV_S         20
++#define AR_RTC_9300_SOC_PLL_CLKSEL           0x06000000
++#define AR_RTC_9300_SOC_PLL_CLKSEL_S         25
++#define AR_RTC_9300_SOC_PLL_BYPASS           0x08000000
++
+ #define AR_RTC_9300_PLL_DIV          0x000003ff
+ #define AR_RTC_9300_PLL_DIV_S        0
+ #define AR_RTC_9300_PLL_REFDIV       0x00003C00
+ #define AR_RTC_9300_PLL_REFDIV_S     10
+ #define AR_RTC_9300_PLL_CLKSEL       0x0000C000
+ #define AR_RTC_9300_PLL_CLKSEL_S     14
++#define AR_RTC_9300_PLL_BYPASS       0x00010000
+ 
+ #define AR_RTC_9160_PLL_DIV	0x000003ff
+ #define AR_RTC_9160_PLL_DIV_S   0
+--- a/drivers/net/wireless/ath/ath9k/common.c
++++ b/drivers/net/wireless/ath/ath9k/common.c
+@@ -368,11 +368,11 @@ void ath9k_cmn_update_txpow(struct ath_h
+ {
+ 	struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
+ 
+-	if (reg->power_limit != new_txpow) {
++	if (reg->power_limit != new_txpow)
+ 		ath9k_hw_set_txpowerlimit(ah, new_txpow, false);
+-		/* read back in case value is clamped */
+-		*txpower = reg->max_power_level;
+-	}
++
++	/* read back in case value is clamped */
++	*txpower = reg->max_power_level;
+ }
+ EXPORT_SYMBOL(ath9k_cmn_update_txpow);
+ 
+--- a/drivers/net/wireless/b43/phy_common.c
++++ b/drivers/net/wireless/b43/phy_common.c
+@@ -276,8 +276,7 @@ void b43_phy_write(struct b43_wldev *dev
+ void b43_phy_copy(struct b43_wldev *dev, u16 destreg, u16 srcreg)
+ {
+ 	assert_mac_suspended(dev);
+-	dev->phy.ops->phy_write(dev, destreg,
+-		dev->phy.ops->phy_read(dev, srcreg));
++	b43_phy_write(dev, destreg, b43_phy_read(dev, srcreg));
+ }
+ 
+ void b43_phy_mask(struct b43_wldev *dev, u16 offset, u16 mask)
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -216,8 +216,8 @@
+ #define AH_WOW_BEACON_MISS		BIT(3)
+ 
+ enum ath_hw_txq_subtype {
+-	ATH_TXQ_AC_BE = 0,
+-	ATH_TXQ_AC_BK = 1,
++	ATH_TXQ_AC_BK = 0,
++	ATH_TXQ_AC_BE = 1,
+ 	ATH_TXQ_AC_VI = 2,
+ 	ATH_TXQ_AC_VO = 3,
+ };
+--- a/drivers/net/wireless/ath/ath9k/mac.c
++++ b/drivers/net/wireless/ath/ath9k/mac.c
+@@ -311,14 +311,7 @@ int ath9k_hw_setuptxqueue(struct ath_hw 
+ 		q = ATH9K_NUM_TX_QUEUES - 3;
+ 		break;
+ 	case ATH9K_TX_QUEUE_DATA:
+-		for (q = 0; q < ATH9K_NUM_TX_QUEUES; q++)
+-			if (ah->txq[q].tqi_type ==
+-			    ATH9K_TX_QUEUE_INACTIVE)
+-				break;
+-		if (q == ATH9K_NUM_TX_QUEUES) {
+-			ath_err(common, "No available TX queue\n");
+-			return -1;
+-		}
++		q = qinfo->tqi_subtype;
+ 		break;
+ 	default:
+ 		ath_err(common, "Invalid TX queue type: %u\n", type);
diff --git a/package/kernel/mac80211/patches/310-ap_scan.patch b/package/kernel/mac80211/patches/310-ap_scan.patch
index 23ecd37..0f620a3 100644
--- a/package/kernel/mac80211/patches/310-ap_scan.patch
+++ b/package/kernel/mac80211/patches/310-ap_scan.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1903,7 +1903,7 @@ static int ieee80211_scan(struct wiphy *
+@@ -1902,7 +1902,7 @@ static int ieee80211_scan(struct wiphy *
  		 * the  frames sent while scanning on other channel will be
  		 * lost)
  		 */
diff --git a/package/kernel/mac80211/patches/403-ath_regd_optional.patch b/package/kernel/mac80211/patches/403-ath_regd_optional.patch
index 808e729..3af2e52 100644
--- a/package/kernel/mac80211/patches/403-ath_regd_optional.patch
+++ b/package/kernel/mac80211/patches/403-ath_regd_optional.patch
@@ -33,17 +33,18 @@
  	if (!wiphy->bands[IEEE80211_BAND_5GHZ])
  		return;
  
-@@ -631,6 +643,10 @@ ath_regd_init_wiphy(struct ath_regulator
- {
+@@ -632,6 +644,11 @@ ath_regd_init_wiphy(struct ath_regulator
  	const struct ieee80211_regdomain *regd;
  
+ 	wiphy->reg_notifier = reg_notifier;
++
 +#ifdef CPTCFG_ATH_USER_REGD
 +	return 0;
 +#endif
 +
- 	wiphy->reg_notifier = reg_notifier;
  	wiphy->regulatory_flags |= REGULATORY_STRICT_REG |
  				   REGULATORY_CUSTOM_REG;
+ 
 --- a/drivers/net/wireless/ath/Kconfig
 +++ b/drivers/net/wireless/ath/Kconfig
 @@ -21,6 +21,9 @@ menuconfig ATH_CARDS
diff --git a/package/kernel/mac80211/patches/520-mac80211_cur_txpower.patch b/package/kernel/mac80211/patches/520-mac80211_cur_txpower.patch
index ef7906e..e7f5f92 100644
--- a/package/kernel/mac80211/patches/520-mac80211_cur_txpower.patch
+++ b/package/kernel/mac80211/patches/520-mac80211_cur_txpower.patch
@@ -10,7 +10,7 @@
  	u8 uapsd_queues;
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2084,7 +2084,9 @@ static int ieee80211_get_tx_power(struct
+@@ -2083,7 +2083,9 @@ static int ieee80211_get_tx_power(struct
  	struct ieee80211_local *local = wiphy_priv(wiphy);
  	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
  
diff --git a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
index 2109d2e..a61cea0 100644
--- a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
+++ b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
@@ -57,7 +57,7 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2094,6 +2094,19 @@ static int ieee80211_get_tx_power(struct
+@@ -2093,6 +2093,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -77,7 +77,7 @@
  static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
  				  const u8 *addr)
  {
-@@ -3517,6 +3530,7 @@ const struct cfg80211_ops mac80211_confi
+@@ -3516,6 +3529,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
diff --git a/package/kernel/mac80211/patches/523-ath9k_use_configured_antenna_gain.patch b/package/kernel/mac80211/patches/523-ath9k_use_configured_antenna_gain.patch
index 0b28ab8..9b51c4c 100644
--- a/package/kernel/mac80211/patches/523-ath9k_use_configured_antenna_gain.patch
+++ b/package/kernel/mac80211/patches/523-ath9k_use_configured_antenna_gain.patch
@@ -10,7 +10,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2721,7 +2721,7 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2711,7 +2711,7 @@ void ath9k_hw_apply_txpower(struct ath_h
  	channel = chan->chan;
  	chan_pwr = min_t(int, channel->max_power * 2, MAX_RATE_POWER);
  	new_pwr = min_t(int, chan_pwr, reg->power_limit);
diff --git a/package/kernel/mac80211/patches/541-ath9k_rx_dma_stop_check.patch b/package/kernel/mac80211/patches/541-ath9k_rx_dma_stop_check.patch
index a521525..b01555c 100644
--- a/package/kernel/mac80211/patches/541-ath9k_rx_dma_stop_check.patch
+++ b/package/kernel/mac80211/patches/541-ath9k_rx_dma_stop_check.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/mac.c
 +++ b/drivers/net/wireless/ath/ath9k/mac.c
-@@ -700,7 +700,7 @@ bool ath9k_hw_stopdmarecv(struct ath_hw 
+@@ -693,7 +693,7 @@ bool ath9k_hw_stopdmarecv(struct ath_hw 
  {
  #define AH_RX_STOP_DMA_TIMEOUT 10000   /* usec */
  	struct ath_common *common = ath9k_hw_common(ah);
@@ -9,7 +9,7 @@
  	int i;
  
  	/* Enable access to the DMA observation bus */
-@@ -730,6 +730,16 @@ bool ath9k_hw_stopdmarecv(struct ath_hw 
+@@ -723,6 +723,16 @@ bool ath9k_hw_stopdmarecv(struct ath_hw 
  	}
  
  	if (i == 0) {
diff --git a/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch b/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
index 2a56352..f36a0e6 100644
--- a/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
+++ b/package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch
@@ -94,7 +94,7 @@
  struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1735,6 +1735,20 @@ fail:
+@@ -1725,6 +1725,20 @@ fail:
  	return -EINVAL;
  }
  
@@ -115,7 +115,7 @@
  int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
  		   struct ath9k_hw_cal_data *caldata, bool fastcc)
  {
-@@ -1940,6 +1954,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -1930,6 +1944,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		ar9003_hw_disable_phy_restart(ah);
  
  	ath9k_hw_apply_gpio_override(ah);
diff --git a/package/kernel/mac80211/patches/543-ath9k-allow-to-disable-bands-via-platform-data.patch b/package/kernel/mac80211/patches/543-ath9k-allow-to-disable-bands-via-platform-data.patch
index 0501582..2483744 100644
--- a/package/kernel/mac80211/patches/543-ath9k-allow-to-disable-bands-via-platform-data.patch
+++ b/package/kernel/mac80211/patches/543-ath9k-allow-to-disable-bands-via-platform-data.patch
@@ -11,7 +11,7 @@
  	int (*external_reset)(void);
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2328,17 +2328,25 @@ int ath9k_hw_fill_cap_info(struct ath_hw
+@@ -2318,17 +2318,25 @@ int ath9k_hw_fill_cap_info(struct ath_hw
  	}
  
  	eeval = ah->eep_ops->get_eeprom(ah, EEP_OP_MODE);
diff --git a/package/kernel/mac80211/patches/550-ath9k_entropy_from_adc.patch b/package/kernel/mac80211/patches/550-ath9k_entropy_from_adc.patch
index 757d741..f16f6b0 100644
--- a/package/kernel/mac80211/patches/550-ath9k_entropy_from_adc.patch
+++ b/package/kernel/mac80211/patches/550-ath9k_entropy_from_adc.patch
@@ -18,7 +18,7 @@
  	void (*spectral_scan_trigger)(struct ath_hw *ah);
 --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-@@ -1764,6 +1764,26 @@ static void ar9003_hw_tx99_set_txpower(s
+@@ -1794,6 +1794,26 @@ static void ar9003_hw_tx99_set_txpower(s
  		  ATH9K_POW_SM(p_pwr_array[ALL_TARGET_HT40_14],  0));
  }
  
@@ -45,7 +45,7 @@
  void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
  {
  	struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
-@@ -1794,6 +1814,7 @@ void ar9003_hw_attach_phy_ops(struct ath
+@@ -1829,6 +1849,7 @@ void ar9003_hw_attach_phy_ops(struct ath
  	priv_ops->set_radar_params = ar9003_hw_set_radar_params;
  	priv_ops->fast_chan_change = ar9003_hw_fast_chan_change;
  
@@ -110,7 +110,7 @@
  static inline void ath9k_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-@@ -1231,9 +1231,30 @@ static void ar5008_hw_set_radar_conf(str
+@@ -1232,9 +1232,30 @@ static void ar5008_hw_set_radar_conf(str
  	conf->radar_inband = 8;
  }
  
@@ -141,7 +141,7 @@
  	static const u32 ar5416_cca_regs[6] = {
  		AR_PHY_CCA,
  		AR_PHY_CH1_CCA,
-@@ -1248,6 +1269,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
+@@ -1249,6 +1270,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
  	if (ret)
  	    return ret;
  
diff --git a/package/kernel/mac80211/patches/551-ath9k-ar933x-usb-hang-workaround.patch b/package/kernel/mac80211/patches/551-ath9k-ar933x-usb-hang-workaround.patch
index 10280d97..feadd2d 100644
--- a/package/kernel/mac80211/patches/551-ath9k-ar933x-usb-hang-workaround.patch
+++ b/package/kernel/mac80211/patches/551-ath9k-ar933x-usb-hang-workaround.patch
@@ -20,7 +20,7 @@
  /******************/
  /* Chip Revisions */
  /******************/
-@@ -1337,6 +1350,9 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1327,6 +1340,9 @@ static bool ath9k_hw_set_reset(struct at
  	if (AR_SREV_9100(ah))
  		udelay(50);
  
@@ -30,7 +30,7 @@
  	return true;
  }
  
-@@ -1436,6 +1452,9 @@ static bool ath9k_hw_chip_reset(struct a
+@@ -1426,6 +1442,9 @@ static bool ath9k_hw_chip_reset(struct a
  		ar9003_hw_internal_regulator_apply(ah);
  	ath9k_hw_init_pll(ah, chan);
  
@@ -40,7 +40,7 @@
  	return true;
  }
  
-@@ -1730,8 +1749,14 @@ static int ath9k_hw_do_fastcc(struct ath
+@@ -1720,8 +1739,14 @@ static int ath9k_hw_do_fastcc(struct ath
  	if (AR_SREV_9271(ah))
  		ar9002_hw_load_ani_reg(ah, chan);
  
@@ -55,7 +55,7 @@
  	return -EINVAL;
  }
  
-@@ -1959,6 +1984,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -1949,6 +1974,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  	if (AR_SREV_9565(ah) && common->bt_ant_diversity)
  		REG_SET_BIT(ah, AR_BTCOEX_WL_LNADIV, AR_BTCOEX_WL_LNADIV_FORCE_ON);
  
diff --git a/package/kernel/mac80211/patches/562-ath9k_ani_ws_detect.patch b/package/kernel/mac80211/patches/562-ath9k_ani_ws_detect.patch
index 1e4f451..5db8c4a 100644
--- a/package/kernel/mac80211/patches/562-ath9k_ani_ws_detect.patch
+++ b/package/kernel/mac80211/patches/562-ath9k_ani_ws_detect.patch
@@ -79,7 +79,7 @@
  /**
   * ar9003_hw_set_channel - set channel on single-chip device
   * @ah: atheros hardware structure
-@@ -954,11 +940,6 @@ static bool ar9003_hw_ani_control(struct
+@@ -984,11 +970,6 @@ static bool ar9003_hw_ani_control(struct
  	struct ath_common *common = ath9k_hw_common(ah);
  	struct ath9k_channel *chan = ah->curchan;
  	struct ar5416AniState *aniState = &ah->ani;
@@ -91,7 +91,7 @@
  	s32 value, value2;
  
  	switch (cmd & ah->ani_function) {
-@@ -972,61 +953,6 @@ static bool ar9003_hw_ani_control(struct
+@@ -1002,61 +983,6 @@ static bool ar9003_hw_ani_control(struct
  		 */
  		u32 on = param ? 1 : 0;
  
diff --git a/package/kernel/mac80211/patches/565-ath9k_restart_after_nfcal_failure.patch b/package/kernel/mac80211/patches/565-ath9k_restart_after_nfcal_failure.patch
index 366cc3c..bed6d0f 100644
--- a/package/kernel/mac80211/patches/565-ath9k_restart_after_nfcal_failure.patch
+++ b/package/kernel/mac80211/patches/565-ath9k_restart_after_nfcal_failure.patch
@@ -152,7 +152,7 @@
  	unsigned int len = 0;
 --- a/drivers/net/wireless/ath/ath9k/link.c
 +++ b/drivers/net/wireless/ath/ath9k/link.c
-@@ -376,9 +376,14 @@ void ath_ani_calibrate(unsigned long dat
+@@ -371,9 +371,14 @@ void ath_ani_calibrate(unsigned long dat
  
  	/* Perform calibration if necessary */
  	if (longcal || shortcal) {
diff --git a/package/kernel/mac80211/patches/567-ath9k_fix_init_nfcal.patch b/package/kernel/mac80211/patches/567-ath9k_fix_init_nfcal.patch
index 8a4be73..e407b23 100644
--- a/package/kernel/mac80211/patches/567-ath9k_fix_init_nfcal.patch
+++ b/package/kernel/mac80211/patches/567-ath9k_fix_init_nfcal.patch
@@ -10,7 +10,7 @@
  		set_bit(NFCAL_PENDING, &ah->caldata->cal_flags);
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1969,8 +1969,10 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -1959,8 +1959,10 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  	if (ath9k_hw_mci_is_enabled(ah))
  		ar9003_mci_check_bt(ah);
  
diff --git a/package/kernel/mac80211/patches/609-rt2x00-allow_disabling_bands_through_dts.patch b/package/kernel/mac80211/patches/609-rt2x00-allow_disabling_bands_through_dts.patch
new file mode 100755
index 0000000..63a8641
--- /dev/null
+++ b/package/kernel/mac80211/patches/609-rt2x00-allow_disabling_bands_through_dts.patch
@@ -0,0 +1,27 @@
+--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
+@@ -26,6 +26,7 @@
+ #include <linux/module.h>
+ #include <linux/slab.h>
+ #include <linux/log2.h>
++#include <linux/of.h>
+ 
+ #include "rt2x00.h"
+ #include "rt2x00lib.h"
+@@ -951,6 +952,16 @@ static int rt2x00lib_probe_hw_modes(stru
+ 	struct ieee80211_rate *rates;
+ 	unsigned int num_rates;
+ 	unsigned int i;
++#ifdef CONFIG_OF
++	struct device_node *np = rt2x00dev->dev->of_node;
++	unsigned int enabled;
++	if (!of_property_read_u32(np, "ralink,2ghz",
++                                          &enabled) && !enabled)
++		spec->supported_bands &= ~SUPPORT_BAND_2GHZ;
++	if (!of_property_read_u32(np, "ralink,5ghz",
++                                          &enabled) && !enabled)
++		spec->supported_bands &= ~SUPPORT_BAND_5GHZ;
++#endif /* CONFIG_OF */
+ 
+ 	if (rt2x00dev->dev->platform_data) {
+ 		struct rt2x00_platform_data *pdata;
diff --git a/package/kernel/mac80211/patches/620-rt2x00-add-AP+STA-support.patch b/package/kernel/mac80211/patches/620-rt2x00-add-AP+STA-support.patch
index ce667b8..6ec0478 100644
--- a/package/kernel/mac80211/patches/620-rt2x00-add-AP+STA-support.patch
+++ b/package/kernel/mac80211/patches/620-rt2x00-add-AP+STA-support.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
-@@ -1265,7 +1265,7 @@ static inline void rt2x00lib_set_if_comb
+@@ -1276,7 +1276,7 @@ static inline void rt2x00lib_set_if_comb
  	 */
  	if_limit = &rt2x00dev->if_limits_ap;
  	if_limit->max = rt2x00dev->ops->max_ap_intf;
diff --git a/package/kernel/mac80211/patches/621-rt2x00-ht20_40_fix.patch b/package/kernel/mac80211/patches/621-rt2x00-ht20_40_fix.patch
new file mode 100755
index 0000000..e05c525
--- /dev/null
+++ b/package/kernel/mac80211/patches/621-rt2x00-ht20_40_fix.patch
@@ -0,0 +1,29 @@
+--- a/drivers/net/wireless/rt2x00/rt2800.h
++++ b/drivers/net/wireless/rt2x00/rt2800.h
+@@ -2319,6 +2319,8 @@ struct mac_iveiv_entry {
+ #define RFCSR30_RX_H20M			FIELD8(0x04)
+ #define RFCSR30_RX_VCM			FIELD8(0x18)
+ #define RFCSR30_RF_CALIBRATION		FIELD8(0x80)
++#define RF3322_RFCSR30_TX_H20M		FIELD8(0x01)
++#define RF3322_RFCSR30_RX_H20M		FIELD8(0x02)
+ 
+ /*
+  * RFCSR 31:
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -3549,8 +3549,13 @@ static void rt2800_config_channel(struct
+ 	    rt2x00_rf(rt2x00dev, RF5390) ||
+ 	    rt2x00_rf(rt2x00dev, RF5392)) {
+ 		rt2800_rfcsr_read(rt2x00dev, 30, &rfcsr);
+-		rt2x00_set_field8(&rfcsr, RFCSR30_TX_H20M, 0);
+-		rt2x00_set_field8(&rfcsr, RFCSR30_RX_H20M, 0);
++		if(rt2x00_rf(rt2x00dev, RF3322)) {
++			rt2x00_set_field8(&rfcsr, RF3322_RFCSR30_TX_H20M, conf_is_ht40(conf));
++			rt2x00_set_field8(&rfcsr, RF3322_RFCSR30_RX_H20M, conf_is_ht40(conf));
++		} else {
++			rt2x00_set_field8(&rfcsr, RFCSR30_TX_H20M, conf_is_ht40(conf));
++			rt2x00_set_field8(&rfcsr, RFCSR30_RX_H20M, conf_is_ht40(conf));
++		}
+ 		rt2800_rfcsr_write(rt2x00dev, 30, rfcsr);
+ 
+ 		rt2800_rfcsr_read(rt2x00dev, 3, &rfcsr);
diff --git a/package/kernel/mac80211/patches/800-b43-backports-form-wireless-testing-master-master-20.patch b/package/kernel/mac80211/patches/800-b43-backports-form-wireless-testing-master-master-20.patch
index bf66120..947b54e 100644
--- a/package/kernel/mac80211/patches/800-b43-backports-form-wireless-testing-master-master-20.patch
+++ b/package/kernel/mac80211/patches/800-b43-backports-form-wireless-testing-master-master-20.patch
@@ -433,7 +433,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  
  	phy->gmode = gmode;
  	b43_phy_put_into_reset(dev);
-@@ -3796,38 +3903,29 @@ static void b43_set_retry_limits(struct
+@@ -3796,38 +3903,29 @@ static void b43_set_retry_limits(struct 
  static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
  {
  	struct b43_wl *wl = hw_to_b43_wl(hw);
@@ -817,7 +817,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  	if (ops->exit)
  		ops->exit(dev);
  }
-@@ -403,9 +411,6 @@ int b43_switch_channel(struct b43_wldev
+@@ -402,9 +410,6 @@ int b43_switch_channel(struct b43_wldev 
  	u16 channelcookie, savedcookie;
  	int err;
  
@@ -827,7 +827,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  	/* First we set the channel radio code to prevent the
  	 * firmware from sending ghost packets.
  	 */
-@@ -423,7 +428,6 @@ int b43_switch_channel(struct b43_wldev
+@@ -422,7 +427,6 @@ int b43_switch_channel(struct b43_wldev 
  	if (err)
  		goto err_restore_cookie;
  
@@ -835,7 +835,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  	/* Wait for the radio to tune to the channel and stabilize. */
  	msleep(8);
  
-@@ -542,10 +546,9 @@ void b43_phyop_switch_analog_generic(str
+@@ -541,10 +545,9 @@ void b43_phyop_switch_analog_generic(str
  }
  
  
@@ -1496,7 +1496,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  	struct ssb_sprom *sprom = dev->dev->bus_sprom;
  	enum ieee80211_band band = b43_current_band(dev->wl);
  	u16 offset;
-@@ -897,7 +1230,7 @@ static void b43_radio_2056_setup(struct
+@@ -897,7 +1230,7 @@ static void b43_radio_2056_setup(struct 
  					offset | B2056_TX_MIXG_BOOST_TUNE,
  					mixg_boost);
  			} else {
@@ -1505,7 +1505,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  				b43_radio_write(dev,
  					offset | B2056_TX_INTPAG_IMAIN_STAT,
  					bias);
-@@ -911,7 +1244,7 @@ static void b43_radio_2056_setup(struct
+@@ -911,7 +1244,7 @@ static void b43_radio_2056_setup(struct 
  			b43_radio_write(dev, offset | B2056_TX_PA_SPARE1, 0xee);
  		}
  	} else if (dev->phy.n->ipa5g_on && band == IEEE80211_BAND_5GHZ) {
@@ -1563,7 +1563,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  	struct b43_phy_n *nphy = dev->phy.n;
  	int i;
  	u16 seq_mode;
-@@ -1261,17 +1593,35 @@ static void b43_nphy_run_samples(struct
+@@ -1261,17 +1593,35 @@ static void b43_nphy_run_samples(struct 
  
  	b43_nphy_stay_in_carrier_search(dev, true);
  
@@ -1605,7 +1605,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  
  	b43_phy_write(dev, B43_NPHY_SAMP_DEPCNT, (samps - 1));
  
-@@ -1289,10 +1639,8 @@ static void b43_nphy_run_samples(struct
+@@ -1289,10 +1639,8 @@ static void b43_nphy_run_samples(struct 
  		b43_phy_mask(dev, B43_NPHY_IQLOCAL_CMDGCTL, 0x7FFF);
  		b43_phy_set(dev, B43_NPHY_IQLOCAL_CMDGCTL, 0x8000);
  	} else {
@@ -2274,7 +2274,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  		b43_ntab_write(dev, B43_NTAB32(16, 3), 0x18D);
  		b43_ntab_write(dev, B43_NTAB32(16, 127), 0x18D);
  	} else {
-@@ -2930,6 +3461,7 @@ static void b43_nphy_workarounds(struct
+@@ -2930,6 +3461,7 @@ static void b43_nphy_workarounds(struct 
  	b43_phy_set(dev, B43_NPHY_IQFLIP,
  		    B43_NPHY_IQFLIP_ADC1 | B43_NPHY_IQFLIP_ADC2);
  
@@ -2282,7 +2282,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  	if (dev->phy.rev >= 7)
  		b43_nphy_workarounds_rev7plus(dev);
  	else if (dev->phy.rev >= 3)
-@@ -2950,12 +3482,13 @@ static void b43_nphy_workarounds(struct
+@@ -2950,12 +3482,13 @@ static void b43_nphy_workarounds(struct 
   * http://bcm-v4.sipsolutions.net/802.11/PHY/N/TXTone
   */
  static int b43_nphy_tx_tone(struct b43_wldev *dev, u32 freq, u16 max_val,
@@ -2609,7 +2609,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  	}
  }
  
-@@ -3688,7 +4285,9 @@ static void b43_nphy_pa_override(struct
+@@ -3688,7 +4285,9 @@ static void b43_nphy_pa_override(struct 
  		nphy->rfctrl_intc2_save = b43_phy_read(dev,
  						       B43_NPHY_RFCTL_INTC2);
  		band = b43_current_band(dev->wl);
@@ -2620,7 +2620,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  			if (band == IEEE80211_BAND_5GHZ)
  				tmp = 0x600;
  			else
-@@ -3709,21 +4308,28 @@ static void b43_nphy_pa_override(struct
+@@ -3709,21 +4308,28 @@ static void b43_nphy_pa_override(struct 
  	}
  }
  
@@ -2995,7 +2995,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  	struct b43_phy_n *nphy = dev->phy.n;
  
  	u16 coef[4];
-@@ -4562,7 +5329,26 @@ static void b43_nphy_restore_cal(struct
+@@ -4562,7 +5329,26 @@ static void b43_nphy_restore_cal(struct 
  	}
  
  	/* TODO use some definitions */
@@ -3023,7 +3023,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  		b43_radio_write(dev, 0x2021, txcal_radio_regs[0]);
  		b43_radio_write(dev, 0x2022, txcal_radio_regs[1]);
  		b43_radio_write(dev, 0x3021, txcal_radio_regs[2]);
-@@ -4585,6 +5371,7 @@ static int b43_nphy_cal_tx_iq_lo(struct
+@@ -4585,6 +5371,7 @@ static int b43_nphy_cal_tx_iq_lo(struct 
  				struct nphy_txgains target,
  				bool full, bool mphase)
  {
@@ -3031,7 +3031,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  	struct b43_phy_n *nphy = dev->phy.n;
  	int i;
  	int error = 0;
-@@ -4625,7 +5412,7 @@ static int b43_nphy_cal_tx_iq_lo(struct
+@@ -4625,7 +5412,7 @@ static int b43_nphy_cal_tx_iq_lo(struct 
  		(dev->phy.rev == 5 && nphy->ipa2g_on &&
  		b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ);
  	if (phy6or5x) {
@@ -3040,7 +3040,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  			b43_ntab_write_bulk(dev, B43_NTAB16(15, 0), 18,
  					tbl_tx_iqlo_cal_loft_ladder_40);
  			b43_ntab_write_bulk(dev, B43_NTAB16(15, 32), 18,
-@@ -4638,18 +5425,24 @@ static int b43_nphy_cal_tx_iq_lo(struct
+@@ -4638,18 +5425,24 @@ static int b43_nphy_cal_tx_iq_lo(struct 
  		}
  	}
  
@@ -3070,7 +3070,7 @@ This brings b43 up to wireless-testing/master master-2014-07-29-1
  
  	if (error == 0) {
  		if (nphy->mphase_cal_phase_id > 2) {
-@@ -4777,9 +5570,9 @@ static int b43_nphy_cal_tx_iq_lo(struct
+@@ -4777,9 +5570,9 @@ static int b43_nphy_cal_tx_iq_lo(struct 
  						nphy->txiqlocal_bestc);
  			nphy->txiqlocal_coeffsvalid = true;
  			nphy->txiqlocal_chanspec.center_freq =
diff --git a/package/kernel/mac80211/patches/910-01-add-support-for-mt7620.patch b/package/kernel/mac80211/patches/910-01-add-support-for-mt7620.patch
index c736b57..2bdf12f 100644
--- a/package/kernel/mac80211/patches/910-01-add-support-for-mt7620.patch
+++ b/package/kernel/mac80211/patches/910-01-add-support-for-mt7620.patch
@@ -1,5 +1,5 @@
---- a/drivers/net/wireless/rt2x00/rt2800.h	2014-06-30 01:05:26.000000000 +0300
-+++ b/drivers/net/wireless/rt2x00/rt2800.h	2014-06-30 01:23:42.000000000 +0300
+--- a/drivers/net/wireless/rt2x00/rt2800.h
++++ b/drivers/net/wireless/rt2x00/rt2800.h
 @@ -79,6 +79,7 @@
  #define RF5372				0x5372
  #define RF5390				0x5390
@@ -62,8 +62,8 @@
  /* TX_PWR_CFG_7 */
  #define TX_PWR_CFG_7			0x13d4
  #define TX_PWR_CFG_7_OFDM54_CH0		FIELD32(0x0000000f)
---- a/drivers/net/wireless/rt2x00/rt2800lib.c	2014-06-30 01:05:26.000000000 +0300
-+++ b/drivers/net/wireless/rt2x00/rt2800lib.c	2014-06-30 17:31:35.000000000 +0300
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
 @@ -61,6 +61,8 @@
  	rt2800_regbusy_read((__dev), BBP_CSR_CFG, BBP_CSR_CFG_BUSY, (__reg))
  #define WAIT_FOR_RFCSR(__dev, __reg) \
@@ -539,7 +539,7 @@
  	default:
  		rt2800_config_channel_rf2xxx(rt2x00dev, conf, rf, info);
  	}
-@@ -3631,7 +4010,7 @@ static void rt2800_config_channel(struct
+@@ -3636,7 +4015,7 @@ static void rt2800_config_channel(struct
  		else if (rt2x00_rt(rt2x00dev, RT3593) ||
  			 rt2x00_rt(rt2x00dev, RT3883))
  			rt2800_bbp_write(rt2x00dev, 82, 0x82);
@@ -548,7 +548,7 @@
  			rt2800_bbp_write(rt2x00dev, 82, 0xf2);
  
  		if (rt2x00_rt(rt2x00dev, RT3593) ||
-@@ -3653,7 +4032,7 @@ static void rt2800_config_channel(struct
+@@ -3658,7 +4037,7 @@ static void rt2800_config_channel(struct
  	if (rt2x00_rt(rt2x00dev, RT3572))
  		rt2800_rfcsr_write(rt2x00dev, 8, 0);
  
@@ -557,7 +557,7 @@
  
  	switch (rt2x00dev->default_ant.tx_chain_num) {
  	case 3:
-@@ -3702,6 +4081,7 @@ static void rt2800_config_channel(struct
+@@ -3707,6 +4086,7 @@ static void rt2800_config_channel(struct
  
  	rt2x00_set_field32(&tx_pin, TX_PIN_CFG_RFTR_EN, 1);
  	rt2x00_set_field32(&tx_pin, TX_PIN_CFG_TRSW_EN, 1);
@@ -565,7 +565,7 @@
  
  	rt2800_register_write(rt2x00dev, TX_PIN_CFG, tx_pin);
  
-@@ -4710,6 +5090,14 @@ void rt2800_vco_calibration(struct rt2x0
+@@ -4715,6 +5095,14 @@ void rt2800_vco_calibration(struct rt2x0
  		rt2x00_set_field8(&rfcsr, RFCSR3_VCOCAL_EN, 1);
  		rt2800_rfcsr_write(rt2x00dev, 3, rfcsr);
  		break;
@@ -580,7 +580,7 @@
  	default:
  		return;
  	}
-@@ -5110,9 +5498,42 @@ static int rt2800_init_registers(struct
+@@ -5115,9 +5503,42 @@ static int rt2800_init_registers(struct 
  	} else if (rt2x00_rt(rt2x00dev, RT5390) ||
  		   rt2x00_rt(rt2x00dev, RT5392) ||
  		   rt2x00_rt(rt2x00dev, RT5592)) {
@@ -626,7 +626,7 @@
  	} else if (rt2x00_rt(rt2x00dev, RT5350)) {
  		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
  	} else {
-@@ -6144,6 +6565,225 @@ static void rt2800_init_bbp_5592(struct
+@@ -6149,6 +6570,225 @@ static void rt2800_init_bbp_5592(struct 
  		rt2800_bbp_write(rt2x00dev, 103, 0xc0);
  }
  
@@ -852,7 +852,7 @@
  static void rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
  {
  	unsigned int i;
-@@ -6186,7 +6826,10 @@ static void rt2800_init_bbp(struct rt2x0
+@@ -6191,7 +6831,10 @@ static void rt2800_init_bbp(struct rt2x0
  		return;
  	case RT5390:
  	case RT5392:
@@ -864,7 +864,7 @@
  		break;
  	case RT5592:
  		rt2800_init_bbp_5592(rt2x00dev);
-@@ -7400,6 +8043,295 @@ static void rt2800_init_rfcsr_5592(struc
+@@ -7405,6 +8048,295 @@ static void rt2800_init_rfcsr_5592(struc
  	rt2800_led_open_drain_enable(rt2x00dev);
  }
  
@@ -1160,7 +1160,7 @@
  static void rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
  {
  	if (rt2800_is_305x_soc(rt2x00dev)) {
-@@ -7435,7 +8367,10 @@ static void rt2800_init_rfcsr(struct rt2
+@@ -7440,7 +8372,10 @@ static void rt2800_init_rfcsr(struct rt2
  		rt2800_init_rfcsr_5350(rt2x00dev);
  		break;
  	case RT5390:
@@ -1172,7 +1172,7 @@
  		break;
  	case RT5392:
  		rt2800_init_rfcsr_5392(rt2x00dev);
-@@ -7866,6 +8801,7 @@ static int rt2800_init_eeprom(struct rt2
+@@ -7871,6 +8806,7 @@ static int rt2800_init_eeprom(struct rt2
  	case RF5390:
  	case RF5392:
  	case RF5592:
@@ -1180,7 +1180,7 @@
  		break;
  	default:
  		rt2x00_err(rt2x00dev, "Invalid RF chipset 0x%04x detected\n",
-@@ -8431,6 +9367,7 @@ static int rt2800_probe_hw_mode(struct r
+@@ -8436,6 +9372,7 @@ static int rt2800_probe_hw_mode(struct r
  	case RF5372:
  	case RF5390:
  	case RF5392:
@@ -1188,7 +1188,7 @@
  		spec->num_channels = 14;
  		if (spec->clk_is_20mhz)
  			spec->channels = rf_vals_xtal20mhz_3x;
-@@ -8570,6 +9507,7 @@ static int rt2800_probe_hw_mode(struct r
+@@ -8575,6 +9512,7 @@ static int rt2800_probe_hw_mode(struct r
  	case RF5372:
  	case RF5390:
  	case RF5392:
diff --git a/package/kernel/mac80211/patches/925-rt2x00-backport_rf5362.patch b/package/kernel/mac80211/patches/925-rt2x00-backport_rf5362.patch
new file mode 100755
index 0000000..9bb5656
--- /dev/null
+++ b/package/kernel/mac80211/patches/925-rt2x00-backport_rf5362.patch
@@ -0,0 +1,77 @@
+--- a/drivers/net/wireless/rt2x00/rt2800.h
++++ b/drivers/net/wireless/rt2x00/rt2800.h
+@@ -53,6 +53,7 @@
+  * RF5592 2.4G/5G 2T2R
+  * RF3070 2.4G 1T1R
+  * RF5360 2.4G 1T1R
++ * RF5362 2.4G 1T1R
+  * RF5370 2.4G 1T1R
+  * RF5390 2.4G 1T1R
+  */
+@@ -75,6 +76,7 @@
+ #define RF3853				0x3853
+ #define RF5350				0x5350
+ #define RF5360				0x5360
++#define RF5362				0x5362
+ #define RF5370				0x5370
+ #define RF5372				0x5372
+ #define RF5390				0x5390
+@@ -2207,7 +2209,7 @@ struct mac_iveiv_entry {
+ /* Bits [7-4] for RF3320 (RT3370/RT3390), on other chipsets reserved */
+ #define RFCSR3_PA1_BIAS_CCK		FIELD8(0x70)
+ #define RFCSR3_PA2_CASCODE_BIAS_CCKK	FIELD8(0x80)
+-/* Bits for RF3290/RF5360/RF5370/RF5372/RF5390/RF5392 */
++/* Bits for RF3290/RF5360/RF5362/RF5370/RF5372/RF5390/RF5392 */
+ #define RFCSR3_VCOCAL_EN		FIELD8(0x80)
+ /* Bits for RF3050 */
+ #define RFCSR3_BIT1			FIELD8(0x02)
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -3902,6 +3902,7 @@ static void rt2800_config_channel(struct
+ 	case RF3070:
+ 	case RF5350:
+ 	case RF5360:
++	case RF5362:
+ 	case RF5370:
+ 	case RF5372:
+ 	case RF5390:
+@@ -3923,6 +3924,7 @@ static void rt2800_config_channel(struct
+ 	    rt2x00_rf(rt2x00dev, RF3322) ||
+ 	    rt2x00_rf(rt2x00dev, RF5350) ||
+ 	    rt2x00_rf(rt2x00dev, RF5360) ||
++	    rt2x00_rf(rt2x00dev, RF5362) ||
+ 	    rt2x00_rf(rt2x00dev, RF5370) ||
+ 	    rt2x00_rf(rt2x00dev, RF5372) ||
+ 	    rt2x00_rf(rt2x00dev, RF5390) ||
+@@ -5087,6 +5089,7 @@ void rt2800_vco_calibration(struct rt2x0
+ 	case RF3853:
+ 	case RF5350:
+ 	case RF5360:
++	case RF5362:
+ 	case RF5370:
+ 	case RF5372:
+ 	case RF5390:
+@@ -8801,6 +8804,7 @@ static int rt2800_init_eeprom(struct rt2
+ 	case RF3853:
+ 	case RF5350:
+ 	case RF5360:
++	case RF5362:
+ 	case RF5370:
+ 	case RF5372:
+ 	case RF5390:
+@@ -9368,6 +9372,7 @@ static int rt2800_probe_hw_mode(struct r
+ 	case RF3322:
+ 	case RF5350:
+ 	case RF5360:
++	case RF5362:
+ 	case RF5370:
+ 	case RF5372:
+ 	case RF5390:
+@@ -9508,6 +9513,7 @@ static int rt2800_probe_hw_mode(struct r
+ 	case RF3853:
+ 	case RF5350:
+ 	case RF5360:
++	case RF5362:
+ 	case RF5370:
+ 	case RF5372:
+ 	case RF5390: