diff --git a/Config.in b/Config.in
index daecd171e..f4ab5271f 100644
--- a/Config.in
+++ b/Config.in
@@ -126,6 +126,10 @@ menu "Global build settings"
 
 	comment "General build options"
 
+	config DISPLAY_SUPPORT
+		bool "Show packages that require graphics support (local or remote)"
+		default n
+
 	config BUILD_PATENTED
 		default y
 		bool "Compile with support for patented functionality"
diff --git a/include/package-defaults.mk b/include/package-defaults.mk
index 1d2918152..ef51710b9 100644
--- a/include/package-defaults.mk
+++ b/include/package-defaults.mk
@@ -23,6 +23,11 @@ define Package/Default
   else
     VERSION:=$(PKG_RELEASE)
   endif
+  ifneq ($(PKG_FLAGS),)
+    PKGFLAGS:=$(PKG_FLAGS)
+  else
+    PKGFLAGS:=
+  endif
   ifneq ($(ARCH_PACKAGES),)
     PKGARCH:=$(ARCH_PACKAGES)
   else
diff --git a/include/package-ipkg.mk b/include/package-ipkg.mk
index 2a274032a..184f53c61 100644
--- a/include/package-ipkg.mk
+++ b/include/package-ipkg.mk
@@ -49,6 +49,7 @@ ifeq ($(DUMP),)
     IPKG_$(1):=$(PACKAGE_DIR)/$(1)_$(VERSION)_$(PKGARCH).ipk
     IDIR_$(1):=$(PKG_BUILD_DIR)/ipkg-$(PKGARCH)/$(1)
     INFO_$(1):=$(IPKG_STATE_DIR)/info/$(1).list
+    KEEP_$(1):=$(strip $(call Package/$(1)/conffiles))
 
     ifeq ($(if $(VARIANT),$(BUILD_VARIANT)),$(VARIANT))
     ifdef Package/$(1)/install
@@ -98,6 +99,8 @@ ifeq ($(DUMP),)
 		echo "Provides: $(PROVIDES)"; \
 		echo "Source: $(SOURCE)"; \
 		echo "Section: $(SECTION)"; \
+		echo "Status: unknown $(if $(filter hold,$(PKG_FLAGS)),hold,ok) not-installed"; \
+		echo "Essential: $(if $(filter essential,$(PKG_FLAGS)),yes,no)"; \
 		echo "Priority: $(PRIORITY)"; \
 		echo "Maintainer: $(MAINTAINER)"; \
 		echo "Architecture: $(PKGARCH)"; \
@@ -114,12 +117,27 @@ ifeq ($(DUMP),)
 	$(RSTRIP) $$(IDIR_$(1))
 	SIZE=`cd $$(IDIR_$(1)); du -bs --exclude=./CONTROL . 2>/dev/null | cut -f1`; \
 	$(SED) "s|^\(Installed-Size:\).*|\1 $$$$SIZE|g" $$(IDIR_$(1))/CONTROL/control
+
+    ifneq ($$(KEEP_$(1)),)
+		@( \
+			keepfiles=""; \
+			for x in $$(KEEP_$(1)); do \
+				[ -f "$$(IDIR_$(1))/$$$$x" ] || keepfiles="$$$${keepfiles:+$$$$keepfiles }$$$$x"; \
+			done; \
+			[ -z "$keepfiles" ] || { \
+				mkdir -p $$(IDIR_$(1))/lib/upgrade/keep.d; \
+				for x in $$$$keepfiles; do echo $$$$x >> $$(IDIR_$(1))/lib/upgrade/keep.d/$(1); done; \
+			}; \
+		)
+    endif
+
 	$(IPKG_BUILD) $$(IDIR_$(1)) $(PACKAGE_DIR)
 	@[ -f $$(IPKG_$(1)) ] || false 
 
     $$(INFO_$(1)): $$(IPKG_$(1))
 	@[ -d $(TARGET_DIR)/tmp ] || mkdir -p $(TARGET_DIR)/tmp
 	$(OPKG) install $$(IPKG_$(1))
+	$(if $(filter-out essential,$(PKG_FLAGS)),for flag in $(filter-out essential,$(PKG_FLAGS)); do $(OPKG) flag $$$$flag $(1); done)
 
     $(1)-clean:
 	rm -f $(PACKAGE_DIR)/$(1)_*
diff --git a/include/package.mk b/include/package.mk
index f48c79057..e13cfe678 100644
--- a/include/package.mk
+++ b/include/package.mk
@@ -21,6 +21,8 @@ STAMP_CONFIGURED:=$(PKG_BUILD_DIR)/.configured$(if $(DUMP),,_$(call confvar,$(PK
 STAMP_BUILT:=$(PKG_BUILD_DIR)/.built
 STAMP_INSTALLED:=$(STAGING_DIR)/stamp/.$(PKG_NAME)_installed
 
+STAGING_FILES_LIST:=$(PKG_NAME)$(if $(BUILD_VARIANT),.$(BUILD_VARIANT),).list
+
 include $(INCLUDE_DIR)/download.mk
 include $(INCLUDE_DIR)/quilt.mk
 include $(INCLUDE_DIR)/package-defaults.mk
@@ -125,7 +127,7 @@ define Build/DefaultTargets
 		$(call $(hook),$(TMP_DIR)/stage-$(PKG_NAME),$(TMP_DIR)/stage-$(PKG_NAME)/host)$(sep)\
 	)
 	if [ -d $(TMP_DIR)/stage-$(PKG_NAME) ]; then \
-		(cd $(TMP_DIR)/stage-$(PKG_NAME); find ./ > $(STAGING_DIR)/packages/$(PKG_NAME).list); \
+		(cd $(TMP_DIR)/stage-$(PKG_NAME); find ./ > $(STAGING_DIR)/packages/$(STAGING_FILES_LIST)); \
 		$(CP) $(TMP_DIR)/stage-$(PKG_NAME)/* $(STAGING_DIR)/; \
 	fi
 	rm -rf $(TMP_DIR)/stage-$(PKG_NAME)
@@ -213,15 +215,15 @@ clean-staging: FORCE
 	rm -f $(STAMP_INSTALLED)
 	@-(\
 		cd "$(STAGING_DIR)"; \
-		if [ -f packages/$(PKG_NAME).list ]; then \
-			cat packages/$(PKG_NAME).list | xargs -r rm -f 2>/dev/null; \
+		if [ -f packages/$(STAGING_FILES_LIST) ]; then \
+			cat packages/$(STAGING_FILES_LIST) | xargs -r rm -f 2>/dev/null; \
 		fi; \
 	)
 
 clean: clean-staging FORCE
 	$(call Build/UninstallDev,$(STAGING_DIR),$(STAGING_DIR_HOST))
 	$(Build/Clean)
-	rm -f $(STAGING_DIR)/packages/$(PKG_NAME).list $(STAGING_DIR_HOST)/packages/$(PKG_NAME).list
+	rm -f $(STAGING_DIR)/packages/$(STAGING_FILES_LIST) $(STAGING_DIR_HOST)/packages/$(STAGING_FILES_LIST)
 	rm -rf $(PKG_BUILD_DIR)
 
 dist:
diff --git a/include/toplevel.mk b/include/toplevel.mk
index 83b73527d..ef6ab74ee 100644
--- a/include/toplevel.mk
+++ b/include/toplevel.mk
@@ -42,6 +42,8 @@ endif
 SCAN_COOKIE?=$(shell echo $$$$)
 export SCAN_COOKIE
 
+SUBMAKE:=umask 022; $(SUBMAKE)
+
 prepare-mk: FORCE ;
 
 prepare-tmpinfo: FORCE
diff --git a/package/6in4/Makefile b/package/6in4/Makefile
index 5722a4863..50f4178ab 100644
--- a/package/6in4/Makefile
+++ b/package/6in4/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=6in4
-PKG_VERSION:=6
+PKG_VERSION:=7
 PKG_RELEASE:=1
 
 include $(INCLUDE_DIR)/package.mk
diff --git a/package/6in4/files/6in4.hotplug b/package/6in4/files/6in4.hotplug
index 534682e99..9499296d9 100644
--- a/package/6in4/files/6in4.hotplug
+++ b/package/6in4/files/6in4.hotplug
@@ -17,11 +17,9 @@ if [ "$ACTION" = ifup ]; then
 		config_get wandev "$cfg" wan_device "$(find_6in4_wanif)"
 		[ "$wandev" = "$DEVICE" ] || return 0
 
-		local oldip
 		local wanip=$(find_6in4_wanip "$wandev")
-		config_get oldip "$cfg" ipaddr
 
-		[ -n "$wanip" ] && [ "$oldip" != "$wanip" ] && {
+		[ -n "$wanip" ] && {
 			local tunnelid
 			config_get tunnelid "$cfg" tunnelid
 
@@ -37,7 +35,22 @@ if [ "$ACTION" = ifup ]; then
 				}
 				uci_set_state network "$cfg" ipaddr "$wanip"
 
-				( wget -qO/dev/null "http://ipv4.tunnelbroker.net/ipv4_end.php?ipv4b=AUTO&user_id=$username&pass=$password&tunnel_id=$tunnelid" && ifup "$cfg" )&
+				(
+					local url="http://ipv4.tunnelbroker.net/ipv4_end.php?ipv4b=AUTO&user_id=$username&pass=$password&tunnel_id=$tunnelid"
+					local try=0
+					local max=3
+
+					while [ $((++try)) -le $max ]; do
+						wget -qO/dev/null "$url" 2>/dev/null && {
+							logger -t 6in4-update "Updated tunnel #$tunnelid endpoint to $wanip"
+							ifup "$cfg"
+							break
+						} || {
+							logger -t 6in4-update "Try $try/$max failed, retrying"
+							sleep 1
+						}
+					done
+				)&
 			}
 		}
 	}
diff --git a/package/Makefile b/package/Makefile
index 5468bdc71..786edd49f 100644
--- a/package/Makefile
+++ b/package/Makefile
@@ -17,7 +17,7 @@ else
   $(curdir)/builddirs-install:=. $(sort $(package-y))
 endif
 ifneq ($(IGNORE_ERRORS),)
-  $(curdir)/builddirs-ignore-compile:= $(if $(filter m y, $(IGNORE_ERRORS)),$(foreach m,$(IGNORE_ERRORS),$(package-$(m))),$(package-m))
+  $(curdir)/builddirs-ignore-compile:= $(if $(filter n m y, $(IGNORE_ERRORS)),$(foreach m,$(IGNORE_ERRORS),$(package-$(subst n,,$(m)))),$(package-m) $(package-))
 endif
 
 $(curdir)/install:=$(curdir)/install-cleanup
diff --git a/package/acx/files/lib/wifi/acx.sh b/package/acx/files/lib/wifi/acx.sh
index 2775a7b1f..9ee906dd8 100644
--- a/package/acx/files/lib/wifi/acx.sh
+++ b/package/acx/files/lib/wifi/acx.sh
@@ -185,7 +185,7 @@ detect_acx() {
 		cat <<EOF
 config wifi-device  $dev
 	option type     acx
-	option channel  5
+	option channel  11
 
 	# REMOVE THIS LINE TO ENABLE WIFI:
 	option disabled 1
diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index ade72195d..06496bae3 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=base-files
-PKG_RELEASE:=43.3
+PKG_RELEASE:=43.8
 
 PKG_FILE_DEPENDS:=$(PLATFORM_DIR)/ $(GENERIC_PLATFORM_DIR)/base-files/
 PKG_BUILD_DEPENDS:=opkg/host
@@ -50,9 +50,14 @@ define Package/base-files/conffiles
 /etc/inittab
 /etc/group
 /etc/passwd
+/etc/shadow
 /etc/profile
 /etc/shells
 /etc/sysctl.conf
+/etc/rc.local
+/etc/sysupgrade.conf
+/etc/config/
+/etc/dropbear/
 $(call $(TARGET)/conffiles)
 endef
 
@@ -159,6 +164,7 @@ ifneq ($(TARGET_avr32)$(TARGET_coldfire),)
   DEPENDS:=+libgcc
 endif
   URL:=$(LIBC_URL)
+  PKG_FLAGS:=hold essential
 endef
 
 
diff --git a/package/base-files/files/bin/login.sh b/package/base-files/files/bin/login.sh
index ff5d3660e..a64c84e1e 100755
--- a/package/base-files/files/bin/login.sh
+++ b/package/base-files/files/bin/login.sh
@@ -1,18 +1,16 @@
 #!/bin/sh
-# Copyright (C) 2006 OpenWrt.org
+# Copyright (C) 2006-2010 OpenWrt.org
 
-grep '^root:[^!]' /etc/passwd >&- 2>&-
-[ "$?" = "0" -a -z "$FAILSAFE" ]  &&  
-{
-    echo "Login failed."
-    exit 0
-} || {
+if grep -qs '^root:[^!]' /etc/passwd /etc/shadow && [ -z "$FAILSAFE" ]; then
+	echo "Login failed."
+	exit 0
+else
 cat << EOF
  === IMPORTANT ============================
   Use 'passwd' to set your login password
   this will disable telnet and enable SSH
  ------------------------------------------
 EOF
-}
+fi
 
 exec /bin/ash --login
diff --git a/package/base-files/files/etc/functions.sh b/package/base-files/files/etc/functions.sh
index fa0ba0427..134b520f0 100755
--- a/package/base-files/files/etc/functions.sh
+++ b/package/base-files/files/etc/functions.sh
@@ -274,4 +274,42 @@ uci_apply_defaults() {
 	uci commit
 }
 
+service_kill() {
+	local name="${1}"
+	local pid="${2:-$(pidof "$name")}"
+	local grace="${3:-5}"
+
+	[ -f "$pid" ] && pid="$(head -n1 "$pid" 2>/dev/null)"
+
+	for pid in $pid; do
+		[ -d "/proc/$pid" ] || continue
+		local try=0
+		kill -TERM $pid 2>/dev/null && \
+			while grep -qs "$name" "/proc/$pid/cmdline" && [ $((try++)) -lt $grace ]; do sleep 1; done
+		kill -KILL $pid 2>/dev/null && \
+			while grep -qs "$name" "/proc/$pid/cmdline"; do sleep 1; done
+	done
+}
+
+
+pi_include() {
+	if [ -f "/tmp/overlay/$1" ]; then
+		. "/tmp/overlay/$1"
+	elif [ -f "$1" ]; then
+		. "$1"
+	elif [ -d "/tmp/overlay/$1" ]; then
+		for src_script in /tmp/overlay/$1/*.sh; do
+			. "$src_script"
+		done
+	elif [ -d "$1" ]; then
+		for src_script in $1/*.sh; do
+			. "$src_script"
+		done
+	else
+		echo "WARNING: $1 not found"
+		return 1
+	fi
+	return 0
+}
+
 [ -z "$IPKG_INSTROOT" -a -f /lib/config/uci.sh ] && . /lib/config/uci.sh
diff --git a/package/base-files/files/etc/preinit b/package/base-files/files/etc/preinit
index 56c02e467..9e629ab81 100755
--- a/package/base-files/files/etc/preinit
+++ b/package/base-files/files/etc/preinit
@@ -5,12 +5,6 @@
 export PATH=/bin:/sbin:/usr/bin:/usr/sbin
 . /etc/diag.sh
 
-preinit_essential_hook=
-preinit_main_hook=
-failsafe_hook=
-initramfs_hook=
-preinit_mount_root_hook=
-
 pi_ifname=
 pi_ip=192.168.1.1
 pi_broadcast=192.168.1.255
@@ -28,8 +22,14 @@ pi_init_suppress_stderr="y"
 pi_init_path="/bin:/sbin:/usr/bin:/usr/sbin"
 pi_init_cmd="/sbin/init"
 
+. /etc/functions.sh
 . /lib/functions/boot.sh
 
+boot_hook_init preinit_essential
+boot_hook_init preinit_main
+boot_hook_init failsafe
+boot_hook_init initramfs
+boot_hook_init preinit_mount_root
 
 for pi_source_file in /lib/preinit/*; do
     . $pi_source_file
diff --git a/package/base-files/files/etc/sysupgrade.conf b/package/base-files/files/etc/sysupgrade.conf
new file mode 100644
index 000000000..e06fd5e33
--- /dev/null
+++ b/package/base-files/files/etc/sysupgrade.conf
@@ -0,0 +1,5 @@
+## This file contains files and directories that should
+## be preserved during an upgrade.
+
+# /etc/example.conf
+# /etc/openvpn/
diff --git a/package/base-files/files/lib/functions/boot.sh b/package/base-files/files/lib/functions/boot.sh
index f93eec99a..66423d9aa 100644
--- a/package/base-files/files/lib/functions/boot.sh
+++ b/package/base-files/files/lib/functions/boot.sh
@@ -6,19 +6,66 @@ mount() {
 	/bin/busybox mount "$@"
 }
 
+boot_hook_splice_start() {
+	export -n PI_HOOK_SPLICE=1
+}
+
+boot_hook_splice_finish() {
+	local hook
+	for hook in $PI_STACK_LIST; do
+		local v; eval "v=\${${hook}_splice:+\$${hook}_splice }$hook"
+		export -n "${hook}=${v% }"
+		export -n "${hook}_splice="
+	done
+	export -n PI_HOOK_SPLICE=
+}
+
+boot_hook_init() {
+	local hook="${1}_hook"
+	export -n "PI_STACK_LIST=${PI_STACK_LIST:+$PI_STACK_LIST }$hook"
+	export -n "$hook="
+}
+
 boot_hook_add() {
-    	local hook="${1}_hook"
-	local value="$2"
-	local sep=" "
-	
-	eval "$hook=\"\${$hook:+\${$hook}\${value:+\$sep}}\$value\""
+	local hook="${1}_hook${PI_HOOK_SPLICE:+_splice}"
+	local func="${2}"
+
+	[ -n "$func" ] && {
+		local v; eval "v=\$$hook"
+		export -n "$hook=${v:+$v }$func"
+	}
+}
+
+boot_hook_shift() {
+	local hook="${1}_hook"
+	local rvar="${2}"
+
+	local v; eval "v=\$$hook"
+	[ -n "$v" ] && {
+		local first="${v%% *}"
+
+		[ "$v" != "${v#* }" ] && \
+			export -n "$hook=${v#* }" || \
+			export -n "$hook="
+
+		export -n "$rvar=$first"
+		return 0
+	}
+
+	return 1
 }
 
 boot_run_hook() {
-    local boot_func
-    for boot_func in $(eval "echo \"\$${1}_hook\""); do
-	$boot_func "$1" "$2"
-    done
+	local hook="$1"
+	local func
+
+	while boot_hook_shift "$hook" func; do
+		local ran; eval "ran=\$PI_RAN_$func"
+		[ -n "$ran" ] || {
+			export -n "PI_RAN_$func=1"
+			$func "$1" "$2"
+		}
+	done
 }
 
 find_mtd_part() {
@@ -95,6 +142,7 @@ fopivot() { # <rw_root> <ro_root> <dupe?>
 
 ramoverlay() {
 	mkdir -p /tmp/root
-	mount -t tmpfs root /tmp/root
+	mount -t tmpfs -o mode=0755 root /tmp/root
 	fopivot /tmp/root /rom 1
 }
+
diff --git a/package/base-files/files/lib/network/config.sh b/package/base-files/files/lib/network/config.sh
index 8321b191b..bf7d15cc9 100755
--- a/package/base-files/files/lib/network/config.sh
+++ b/package/base-files/files/lib/network/config.sh
@@ -339,40 +339,34 @@ setup_interface() {
 			setup_interface_static "$iface" "$config"
 		;;
 		dhcp)
-			local lockfile="/var/lock/dhcp-$iface"
-			lock "$lockfile"
-
-			# prevent udhcpc from starting more than once
+			# kill running udhcpc instance
 			local pidfile="/var/run/dhcp-${iface}.pid"
-			local pid="$(cat "$pidfile" 2>/dev/null)"
-			if [ -d "/proc/$pid" ] && grep -qs udhcpc "/proc/${pid}/cmdline"; then
-				lock -u "$lockfile"
-			else
-				local ipaddr netmask hostname proto1 clientid broadcast
-				config_get ipaddr "$config" ipaddr
-				config_get netmask "$config" netmask
-				config_get hostname "$config" hostname
-				config_get proto1 "$config" proto
-				config_get clientid "$config" clientid
-				config_get_bool broadcast "$config" broadcast 0
+			service_kill udhcpc "$pidfile"
 
-				[ -z "$ipaddr" ] || \
-					$DEBUG ifconfig "$iface" "$ipaddr" ${netmask:+netmask "$netmask"}
+			local ipaddr netmask hostname proto1 clientid vendorid broadcast
+			config_get ipaddr "$config" ipaddr
+			config_get netmask "$config" netmask
+			config_get hostname "$config" hostname
+			config_get proto1 "$config" proto
+			config_get clientid "$config" clientid
+			config_get vendorid "$config" vendorid
+			config_get_bool broadcast "$config" broadcast 0
 
-				# don't stay running in background if dhcp is not the main proto on the interface (e.g. when using pptp)
-				local dhcpopts
-				[ ."$proto1" != ."$proto" ] && dhcpopts="-n -q"
-				[ "$broadcast" = 1 ] && broadcast="-O broadcast" || broadcast=
+			[ -z "$ipaddr" ] || \
+				$DEBUG ifconfig "$iface" "$ipaddr" ${netmask:+netmask "$netmask"}
 
-				$DEBUG eval udhcpc -t 0 -i "$iface" \
-					${ipaddr:+-r $ipaddr} \
-					${hostname:+-H $hostname} \
-					${clientid:+-c $clientid} \
-					-b -p "$pidfile" $broadcast \
-					${dhcpopts:- -O rootpath -R &}
+			# don't stay running in background if dhcp is not the main proto on the interface (e.g. when using pptp)
+			local dhcpopts
+			[ ."$proto1" != ."$proto" ] && dhcpopts="-n -q"
+			[ "$broadcast" = 1 ] && broadcast="-O broadcast" || broadcast=
 
-				lock -u "$lockfile"
-			fi
+			$DEBUG eval udhcpc -t 0 -i "$iface" \
+				${ipaddr:+-r $ipaddr} \
+				${hostname:+-H $hostname} \
+				${clientid:+-c $clientid} \
+				${vendorid:+-V $vendorid} \
+				-b -p "$pidfile" $broadcast \
+				${dhcpopts:- -O rootpath -R &}
 		;;
 		none)
 			setup_interface_none "$iface" "$config"
@@ -400,12 +394,7 @@ stop_interface_dhcp() {
 	remove_dns "$config"
 
 	local pidfile="/var/run/dhcp-${ifname}.pid"
-	local pid="$(cat "$pidfile" 2>/dev/null)"
-	[ -d "/proc/$pid" ] && {
-		grep -qs udhcpc "/proc/$pid/cmdline" && kill -TERM $pid && \
-			while grep -qs udhcpc "/proc/$pid/cmdline"; do sleep 1; done
-		rm -f "$pidfile"
-	}
+	service_kill udhcpc "$pidfile"
 
 	uci -P /var/state revert "network.$config"
 }
diff --git a/package/base-files/files/lib/preinit/20_device_fs_mount b/package/base-files/files/lib/preinit/20_device_fs_mount
index f82f9a6f4..fb0a4c0fa 100644
--- a/package/base-files/files/lib/preinit/20_device_fs_mount
+++ b/package/base-files/files/lib/preinit/20_device_fs_mount
@@ -7,7 +7,7 @@ do_mount_devfs() {
 }
 
 do_mount_hotplug() {
-    mount -t tmpfs tmpfs /dev -o size=512K
+    mount -t tmpfs tmpfs /dev -o mode=0755,size=512K
 }
 
 do_mount_udev() {
diff --git a/package/base-files/files/lib/preinit/41_merge_overlay_hooks b/package/base-files/files/lib/preinit/41_merge_overlay_hooks
new file mode 100644
index 000000000..4ca6877be
--- /dev/null
+++ b/package/base-files/files/lib/preinit/41_merge_overlay_hooks
@@ -0,0 +1,24 @@
+#!/bin/sh
+# Copyright (C) 2010 OpenWrt.org
+
+merge_overlay_hooks() {
+	jffs2_not_mounted || [ ! -d /tmp/overlay/lib/preinit ] || {
+		echo "- merge overlay components -"
+
+		mkdir -p /tmp/preinit-hook-merge
+		ln -sf /lib/preinit/* /tmp/overlay/lib/preinit/[0-9][0-9]_* /tmp/preinit-hook-merge/
+
+		boot_hook_splice_start
+
+		local pipart
+		for pipart in /tmp/preinit-hook-merge/*; do
+			. $pipart
+		done
+
+		boot_hook_splice_finish
+
+		rm -rf /tmp/preinit-hook-merge
+	}
+}
+
+boot_hook_add preinit_mount_root merge_overlay_hooks
diff --git a/package/base-files/files/lib/upgrade/keep.d/base-files-essential b/package/base-files/files/lib/upgrade/keep.d/base-files-essential
new file mode 100644
index 000000000..e35aae509
--- /dev/null
+++ b/package/base-files/files/lib/upgrade/keep.d/base-files-essential
@@ -0,0 +1,10 @@
+# Essential files that will be always kept
+/etc/banner
+/etc/hosts
+/etc/inittab
+/etc/group
+/etc/passwd
+/etc/profile
+/etc/shells
+/etc/sysctl.conf
+/etc/rc.local
diff --git a/package/base-files/files/sbin/sysupgrade b/package/base-files/files/sbin/sysupgrade
index 0cf51cfb7..cae59dc6b 100755
--- a/package/base-files/files/sbin/sysupgrade
+++ b/package/base-files/files/sbin/sysupgrade
@@ -51,8 +51,10 @@ EOF
 
 add_uci_conffiles() {
 	local file="$1"
-	find /etc/config /etc/passwd /etc/group /etc/dropbear \
-		/etc/firewall.user /etc/rc.local -type f > "$file"
+	( find $(sed -ne '/^[[:space:]]*$/d; /^#/d; p' \
+		/etc/sysupgrade.conf /lib/upgrade/keep.d/* 2>/dev/null) \
+		-type f 2>/dev/null;
+	  opkg list-changed-conffiles ) | sort -u > "$file"
 	return 0
 }
 
diff --git a/package/base-files/files/usr/share/udhcpc/default.script b/package/base-files/files/usr/share/udhcpc/default.script
index 39527778a..708f84783 100755
--- a/package/base-files/files/usr/share/udhcpc/default.script
+++ b/package/base-files/files/usr/share/udhcpc/default.script
@@ -21,9 +21,9 @@ setup_interface () {
 	local user_router
 
 	[ -n "$ifc" ] && {
-		config_get old_ip        "$ifc" ipaddr
-		config_get old_broadcast "$ifc" broadcast
-		config_get old_subnet    "$ifc" netmask
+		old_ip="$(uci_get_state network "$ifc" ipaddr)"
+		old_broadcast="$(uci_get_state network "$ifc" broadcast)"
+		old_subnet="$(uci_get_state network "$ifc" netmask)"
 	}
 
 	[ "$ip" != "$old_ip" ] \
@@ -41,8 +41,8 @@ setup_interface () {
 	# Default Route
 	[ -n "$ifc" ] && {
 		change_state network "$ifc" lease_gateway "$router"
-		config_get old_router "$ifc" gateway
-		user_router=$(uci_get "network.$ifc.gateway")
+		old_router="$(uci_get_state network "$ifc" gateway)"
+		user_router="$(uci_get network "$ifc" gateway)"
 		[ -n "$user_router" ] && router="$user_router"
 	}
 
diff --git a/package/block-extroot/Makefile b/package/block-extroot/Makefile
index 6957669fd..f1e093bcc 100644
--- a/package/block-extroot/Makefile
+++ b/package/block-extroot/Makefile
@@ -17,10 +17,9 @@ PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
 include $(INCLUDE_DIR)/package.mk
 
 define Package/block-extroot/Default
-  SECTION:=utils
-  CATEGORY:=Utilities
+  SECTION:=base
+  CATEGORY:=Base system
   TITLE:=root filesystem on secondary storage
-  SUBMENU:=disc
 endef
 
 define Package/block-extroot
diff --git a/package/block-extroot/files/50_determine_usb_root b/package/block-extroot/files/50_determine_usb_root
index 0de9be384..b899203e5 100644
--- a/package/block-extroot/files/50_determine_usb_root
+++ b/package/block-extroot/files/50_determine_usb_root
@@ -4,11 +4,10 @@
 # See /LICENSE for more information.
 
 
-. /etc/functions.sh
-. /lib/functions/extmount.sh
-. /lib/functions/mount.sh
-
 determine_external_root() {
+	pi_include /lib/functions/extmount.sh
+	pi_include /lib/functions/mount.sh
+
 	local OLD_UCI_CONFIG_DIR="$UCI_CONFIG_DIR"
 	set_jffs_mp
 	determine_root_device
diff --git a/package/block-extroot/files/extmount.sh b/package/block-extroot/files/extmount.sh
index dfd6eef07..f696324f7 100644
--- a/package/block-extroot/files/extmount.sh
+++ b/package/block-extroot/files/extmount.sh
@@ -13,12 +13,14 @@ set_jffs_mp() {
 }
 
 er_load_modules() {
-	[ -d $ER_ROOT/etc/modules.d ] && {
-	    cd $ER_ROOT/etc/modules.d && {
-	    	local modules="$(grep -l '# May be required for rootfs' *)"
-	    	cat $modules | sed 's/^\([^#]\)/insmod \1/' | sh 2>&- || : 
-	    }
+	mkdir -p /tmp/extroot_modules/modules.d
+	mkdir -p /tmp/extroot_modules/modules
+	ln -sf /etc/modules.d/* /tmp/overlay/etc/modules.d/* /tmp/extroot_modules/modules.d
+	ln -sf /lib/modules/*/* /tmp/overlay/lib/modules/*/* /tmp/extroot_modules/modules
+    	local modules="$(grep -l '# May be required for rootfs' /tmp/extroot_modules/modules.d/*)"
+	cd /tmp/extroot_modules/modules && {
+		cat $modules | sed -e 's/^\([^#].*\)/insmod \.\/\1.ko/'| sh 2>&- || :
 	}
+	rm -rf /tmp/extroot_modules
 }
 
-
diff --git a/package/block-mount/files/block.sh b/package/block-mount/files/block.sh
index b8a473a00..72d6c3ab3 100644
--- a/package/block-mount/files/block.sh
+++ b/package/block-mount/files/block.sh
@@ -118,15 +118,18 @@ config_create_swap_fstab_entry() {
 
 	[ -n "$device" ] || return 0
 
-	local fstabnew="$(mktemp -t '.fstab.XXXXXXXX')"
+	local fstabnew
 	
 	mkdir -p /var/lock
-	lock /var/lock/fstab.lck
-	cat /tmp/fstab | grep -E -v "^$device[[:blank:]]" >>"$fstabnew"
-	[ "$enabled" -eq 1 ] && echo "$device	none	swap	sw	0	0" >> "$fstabnew"
-	cat "$fstabnew" >/tmp/fstab
-	lock -u /var/lock/fstab.lck
-	rm -f $fstabnew
+	lock -w /var/lock/fstab.lck && {
+		lock /var/lock/fstab.lck
+		fstabnew="$(mktemp -t '.fstab.XXXXXXXX')"
+		cat /tmp/fstab | grep -E -v "^$device[[:blank:]]" >>"$fstabnew"
+		[ "$enabled" -eq 1 ] && echo "$device	none	swap	sw	0	0" >> "$fstabnew"
+		cat "$fstabnew" >/tmp/fstab
+		rm -f $fstabnew
+		lock -u /var/lock/fstab.lck
+	}
 }
 
 config_create_mount_fstab_entry() {
@@ -140,15 +143,18 @@ config_create_mount_fstab_entry() {
 	[ -n "$target" ] || return 0
 	[ -n "$device" ] || return 0
 
-	local fstabnew="$(mktemp -t '.fstab.XXXXXXXX')"
+	local fstabnew
 	
 	mkdir -p /var/lock
-	lock /var/lock/fstab.lck
-	cat /tmp/fstab | grep -E -v "^$device[[:blank:]]" | grep -v "$target" >>"$fstabnew"
-	echo "$device	$target	$fstype	$options	0	0" >>"$fstabnew"
-	cat "$fstabnew" >/tmp/fstab		
-	lock -u /var/lock/fstab.lck
-	rm -f $fstabnew
+	lock -w /var/lock/fstab.lck && {
+		lock /var/lock/fstab.lck
+		fstabnew="$(mktemp -t '.fstab.XXXXXXXX')"
+		cat /tmp/fstab | grep -E -v "^$device[[:blank:]]" | grep -v "$target" >>"$fstabnew"
+		echo "$device	$target	$fstype	$options	0	0" >>"$fstabnew"
+		cat "$fstabnew" >/tmp/fstab		
+		rm -f $fstabnew
+		lock -u /var/lock/fstab.lck
+	}
 }
 
 libmount_find_token() {
diff --git a/package/block-mount/files/fsck.sh b/package/block-mount/files/fsck.sh
index d80e71693..3011160a4 100644
--- a/package/block-mount/files/fsck.sh
+++ b/package/block-mount/files/fsck.sh
@@ -12,25 +12,23 @@ libmount_fsck() {
 	local found_fsck=0
 	
 
-	[ -n "$fsck_type" ] && [ "$fsck_type" != "swap" ] && {
-		grep -q "$device" /proc/swaps || grep -q "$device" /proc/mounts || {
-			[ -e "$device" ] && [ "$fsck_enabled" -eq 1 ] && {
-				for known_type in $libmount_known_fsck; do
-					if [ "$known_type" = "$fsck_fstype" ]; then
-						fsck_${known_type} "$device"
-						found_fsck=1
-						break
-					fi
-				done
-				if [ "$found_fsck" -ne 1 ]; then
-					logger -t 'fstab' "Unable to check/repair $device; no known fsck for filesystem type $fstype"
+	grep -q "$device" /proc/swaps || grep -q "$device" /proc/mounts || {
+		[ -e "$device" ] && [ "$fsck_enabled" -eq 1 ] && {
+			for known_type in $libmount_known_fsck; do
+				if [ "$known_type" = "$fsck_fstype" ]; then
+					fsck_${known_type} "$device"
+					found_fsck=1
+					break
 				fi
-			}
+			done
+			if [ "$found_fsck" -ne 1 ]; then
+				logger -t 'fstab' "Unable to check/repair $device; no known fsck for filesystem type $fstype"
+			fi
 		}
 	}
 }
 
 libmount_known_fsck=""
 
-include /lib/functions/fsck
+pi_include /lib/functions/fsck
 
diff --git a/package/block-mount/files/fstab.init b/package/block-mount/files/fstab.init
index bd2bf24cb..a3e0338f4 100644
--- a/package/block-mount/files/fstab.init
+++ b/package/block-mount/files/fstab.init
@@ -8,8 +8,6 @@
 
 START=20
 
-. /lib/functions/mount.sh
-
 do_mount() {
 	local cfg="$1"
 	config_mount_by_section "$cfg"
@@ -39,19 +37,29 @@ do_swapoff() {
 }
 
 start() {
+	. /lib/functions/mount.sh
+
 	config_load fstab
 	mkdir -p /var/lock
-	lock /var/lock/fstab.lck
-	echo '# WARNING: this is an auto generated file, please use uci to set defined filesystems' > /etc/fstab
-	lock -u /var/lock/fstab.lck
-	config_foreach do_mount mount
+	lock -w /var/lock/fstab.lck && {
+		lock /var/lock/fstab.lck
+		[ -e /tmp/fstab ] || { 
+			echo '# WARNING: this is an auto generated file, please use uci to set defined filesystems' > /tmp/fstab
+		}
+		lock -u /var/lock/fstab.lck
+	}
 	config_foreach do_swapon swap
+	config_foreach do_mount mount
+	config_foreach do_swapon swap  # do swap a second time so that swap on filesystems is enabled
 }
 
 stop() {
+	. /lib/functions/mount.sh
+
 	config_load fstab
 	config_foreach do_unmount mount
 	config_foreach do_swapoff swap
 	swapoff -a
 }
 
+
diff --git a/package/block-mount/files/mount.sh b/package/block-mount/files/mount.sh
index 1616ca7a1..583e1a5ca 100644
--- a/package/block-mount/files/mount.sh
+++ b/package/block-mount/files/mount.sh
@@ -5,8 +5,8 @@
 #
 
 
-. /lib/functions/block.sh
-. /lib/functions/fsck.sh
+pi_include /lib/functions/block.sh
+pi_include /lib/functions/fsck.sh
 
 config_mount_by_section() {
 	local cfg="$1"
@@ -28,14 +28,13 @@ config_mount_by_section() {
 		local is_rootfs="$9"
 		shift
 		local found_device=""
-		local fsck_type=""
 		
 		found_device="$(libmount_find_device_by_id "$uuid" "$label" "$device" "$cfgdevice")"
 		if [ -n "$found_device" ]; then
 			if [ -z "$find_rootfs" ] || [ "$find_rootfs" -eq 0 ] || [ "$is_rootfs" -eq 1 ]; then
 				[ "$enabled_fsck" -eq 1 ] && {
 					grep -q "$found_device" /proc/swaps || grep -q "$found_device" /proc/mounts || {
-						libmount_fsck "$found_device" "$fsck_type" "$enabled_fsck"
+						libmount_fsck "$found_device" "$fstype" "$enabled_fsck"
 					}
 				}								
 	
@@ -72,7 +71,6 @@ config_swapon_by_section() {
 		local label
 		
 		local found_device=""
-		local fsck_type=""
 		
 		found_device="$(libmount_find_device_by_id "$uuid" "$label" "$device" "$cfgdevice")"
 
diff --git a/package/broadcom-wl/files/lib/wifi/broadcom.sh b/package/broadcom-wl/files/lib/wifi/broadcom.sh
index bfb7ed25e..51dc0e311 100644
--- a/package/broadcom-wl/files/lib/wifi/broadcom.sh
+++ b/package/broadcom-wl/files/lib/wifi/broadcom.sh
@@ -354,7 +354,7 @@ detect_broadcom() {
 		cat <<EOF
 config wifi-device  wl${i}
 	option type     broadcom
-	option channel  5
+	option channel  11
 
 	# REMOVE THIS LINE TO ENABLE WIFI:
 	option disabled 1
diff --git a/package/busybox/Makefile b/package/busybox/Makefile
index e6934a6eb..2833542ca 100644
--- a/package/busybox/Makefile
+++ b/package/busybox/Makefile
@@ -10,6 +10,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=busybox
 PKG_VERSION:=1.15.3
 PKG_RELEASE:=2
+PKG_FLAGS:=essential
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=http://www.busybox.net/downloads \
diff --git a/package/busybox/files/telnet b/package/busybox/files/telnet
index 082aba7e9..b8823379b 100755
--- a/package/busybox/files/telnet
+++ b/package/busybox/files/telnet
@@ -1,16 +1,24 @@
 #!/bin/sh /etc/rc.common
-# Copyright (C) 2006 OpenWrt.org
+# Copyright (C) 2006-2010 OpenWrt.org
 START=50
 
+has_root_pwd() {
+	local pwd=$([ -f "$1" ] && cat "$1")
+	      pwd="${pwd#*root:}"
+	      pwd="${pwd%%:*}"
+
+	test -n "${pwd#!}"
+}
+
 start() {
-	if 	[ \! -f /etc/passwd ] || \
-		awk -F: '/^root:/ && ($2 != "") && ($2 !~ /\!/) {exit 1}' /etc/passwd 2>/dev/null || \
-		( [ \! -x /usr/sbin/dropbear ] && [ \! -x /usr/sbin/sshd ] )
-	then \
+	if ( ! has_root_pwd /etc/passwd && ! has_root_pwd /etc/shadow ) || \
+	   ( [ ! -x /usr/sbin/dropbear ] && [ ! -x /usr/sbin/sshd ] );
+	then
 		telnetd -l /bin/login.sh
 	fi
 }
 
 stop() {
-	killall telnetd
+	killall telnetd 2>/dev/null
 }
+
diff --git a/package/carl9170/Makefile b/package/carl9170/Makefile
deleted file mode 100644
index 34165cb48..000000000
--- a/package/carl9170/Makefile
+++ /dev/null
@@ -1,90 +0,0 @@
-#
-# Copyright (C) 2010 OpenWrt.org
-#
-# This is free software, licensed under the GNU General Public License v2.
-# See /LICENSE for more information.
-#
-
-include $(TOPDIR)/rules.mk
-include $(INCLUDE_DIR)/kernel.mk
-
-PKG_NAME:=carl9170
-PKG_VERSION:=1.0.5.3
-PKG_RELEASE:=1
-
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
-PKG_SOURCE_URL:=@KERNEL/linux/kernel/people/chr/carl9170/$(PKG_VERSION) \
-	@KERNEL/linux/kernel/people/chr/carl9170/old/$(PKG_VERSION)
-PKG_MD5SUM:=91d714d1e5c5c62da1191ac5afd8bcb0
-
-PKG_CONFIG_DEPENDS:= \
-	CONFIG_PACKAGE_CARL9170_DEBUGFS \
-
-include $(INCLUDE_DIR)/package.mk
-
-DRV_PATH:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/carl9170
-
-define KernelPackage/carl9170
-  SUBMENU:=Wireless Drivers
-  TITLE:=Driver for Atheros AR9170 USB sticks
-  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core
-  URL:=http://www.kernel.org/pub/linux/kernel/people/chr/carl9170
-  FILES:=$(DRV_PATH)/carl9170usb.$(LINUX_KMOD_SUFFIX)
-  AUTOLOAD:=$(call AutoLoad,60,carl9170usb)
-  MENU:=1
-endef
-
-define KernelPackage/carl9170/config
-	menu "Configuration"
-		depends PACKAGE_kmod-carl9170
-
-	config PACKAGE_CARL9170_DEBUGFS
-		bool "Enable Debugging (DebugFS) Support"
-		depends PACKAGE_MAC80211_DEBUGFS
-		help
-		  Say Y if you need access to carl9170usb's statistics for QoS queue 
-		  status, rate control, etc...
-
-	endmenu
-endef
-
-define KernelPackage/carl9170/description
- This package contains a driver for Atheros AR9170 USB sticks using the free firmware
-endef
-
-define Build/Prepare
-	rm -rf $(PKG_BUILD_DIR)
-	mkdir -p $(PKG_BUILD_DIR)
-	$(HOST_TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(PKG_SOURCE)
-	$(HOST_TAR) -C $(PKG_BUILD_DIR) -xf $(PKG_BUILD_DIR)/$(PKG_VERSION)/driver/carl9170-driver-$(PKG_VERSION).tar
-	ln -s $(STAGING_DIR)/usr/include/mac80211/ath/*.h $(PKG_BUILD_DIR)/drivers/net/wireless/ath/
-	$(Build/Patch)
-endef
-
-BUILDFLAGS = \
-	CONFIG_CARL9170_USB=m \
-	CONFIG_CARL9170_LEDS=$(if $(CONFIG_LEDS_TRIGGERS),y) \
-	CONFIG_CARL9170_DEBUGFS=$(if $(CONFIG_PACKAGE_CARL9170_DEBUGFS),y) \
-	CONFIG_MAC80211_DEBUGFS=$(if $(CONFIG_PACKAGE_MAC80211_DEBUGFS),y) \
-
-EXTRA_CFLAGS = \
-	$(if $(CONFIG_ATH_USER_REGD),-DATH_USER_REGD) \
-	$(if $(CONFIG_LEDS_TRIGGERS), -DCONFIG_MAC80211_LEDS -DCONFIG_LEDS_TRIGGERS -DCONFIG_CARL9170_LEDS) \
-	$(if $(CONFIG_PACKAGE_CARL9170_DEBUGFS),-DCONFIG_CARL9170_DEBUGFS) \
-	$(if $(CONFIG_PACKAGE_MAC80211_DEBUGFS),-DCONFIG_MAC80211_DEBUGFS) \
-
-define Build/Compile
-	$(MAKE) -C $(LINUX_DIR) \
-		SUBDIRS="$(DRV_PATH)" \
-		ARCH="$(LINUX_KARCH)" \
-		CROSS_COMPILE="$(KERNEL_CROSS)" \
-		CC="$(TARGET_CC) -I$(STAGING_DIR)/usr/include/mac80211 $(EXTRA_CFLAGS)" \
-		$(BUILDFLAGS)
-endef
-
-define KernelPackage/carl9170/install
-	$(INSTALL_DIR) $(1)/lib/firmware
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(PKG_VERSION)/firmware_build/carl9170-1.fw $(1)/lib/firmware/
-endef
-
-$(eval $(call KernelPackage,carl9170))
diff --git a/package/carl9170/patches/100-request_firmware_compat.patch b/package/carl9170/patches/100-request_firmware_compat.patch
deleted file mode 100644
index cc29239c8..000000000
--- a/package/carl9170/patches/100-request_firmware_compat.patch
+++ /dev/null
@@ -1,31 +0,0 @@
---- a/drivers/net/wireless/ath/carl9170/usb.c
-+++ b/drivers/net/wireless/ath/carl9170/usb.c
-@@ -1000,11 +1000,28 @@ err_failed:
- 	ar9170_usb_firmware_failed(aru);
- }
- 
-+
-+
- static int ar9170_usb_request_firmware(struct ar9170_usb *aru)
- {
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,33))
-+	const struct firmware *fw;
-+	int ret;
-+
-+	ret = request_firmware(&fw,
-+		ar9170_fws[aru->fw_load].files[aru->fw_files].name,
-+		&aru->udev->dev);
-+
-+	if (ret < 0)
-+		return ret;
-+
-+	ar9170_usb_firmware_step2(fw, aru);
-+	return 0;
-+#else
- 	return request_firmware_nowait(THIS_MODULE, 1,
- 		ar9170_fws[aru->fw_load].files[aru->fw_files].name,
- 		&aru->udev->dev, GFP_KERNEL, aru, ar9170_usb_firmware_step2);
-+#endif
- }
- 
- static void ar9170_usb_disconnect(struct usb_interface *intf)
diff --git a/package/carl9170/patches/110-ht_default.patch b/package/carl9170/patches/110-ht_default.patch
deleted file mode 100644
index 5e1c4bccf..000000000
--- a/package/carl9170/patches/110-ht_default.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/drivers/net/wireless/ath/carl9170/main.c
-+++ b/drivers/net/wireless/ath/carl9170/main.c
-@@ -51,7 +51,7 @@ static int modparam_nohwcrypt;
- module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
- MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
- 
--int modparam_ht;
-+int modparam_ht = 1;
- module_param_named(ht, modparam_ht, bool, S_IRUGO);
- MODULE_PARM_DESC(ht, "enable MPDU aggregation.");
- 
diff --git a/package/crda/Makefile b/package/crda/Makefile
index 402bee53b..48a24f036 100644
--- a/package/crda/Makefile
+++ b/package/crda/Makefile
@@ -28,7 +28,7 @@ define Package/crda
   SECTION:=net
   CATEGORY:=Network
   TITLE:=Central Regulatory Domain Agent (CRDA)
-  DEPENDS:=@LINUX_2_6 +hotplug2 +kmod-mac80211 +libnl-tiny
+  DEPENDS:=@LINUX_2_6 +hotplug2 +libnl-tiny
   URL:=http://wireless.kernel.org/en/developers/Regulatory/CRDA
 endef
 
diff --git a/package/dnsmasq/Makefile b/package/dnsmasq/Makefile
index 977e10970..695d26088 100644
--- a/package/dnsmasq/Makefile
+++ b/package/dnsmasq/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dnsmasq
 PKG_VERSION:=2.55
-PKG_RELEASE:=3
+PKG_RELEASE:=5
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq
diff --git a/package/dnsmasq/files/dhcp.conf b/package/dnsmasq/files/dhcp.conf
index c79458fb2..660b06ad4 100644
--- a/package/dnsmasq/files/dhcp.conf
+++ b/package/dnsmasq/files/dhcp.conf
@@ -4,7 +4,7 @@ config dnsmasq
 	option filterwin2k	0  # enable for dial on demand
 	option localise_queries	1
 	option rebind_protection 1  # disable if upstream must serve RFC1918 addresses
-	option rebind_localhost 0  # enable for RBL checking and similar services
+	option rebind_localhost 1  # enable for RBL checking and similar services
 	#list rebind_domain example.lan  # whitelist RFC1918 responses for domains
 	option local	'/lan/'
 	option domain	'lan'
@@ -18,6 +18,7 @@ config dnsmasq
 	#option nonwildcard	1
 	#list interface		br-lan
 	#list notinterface	lo
+	#list bogusnxdomain     '64.94.110.11'
 
 config dhcp lan
 	option interface	lan
diff --git a/package/dnsmasq/files/dnsmasq.init b/package/dnsmasq/files/dnsmasq.init
index 2325a3e4f..1e91eb2b5 100644
--- a/package/dnsmasq/files/dnsmasq.init
+++ b/package/dnsmasq/files/dnsmasq.init
@@ -42,17 +42,23 @@ append_server() {
 }
 
 append_interface() {
-	append args "-i $1"
+	local ifname=$(uci_get_state network "$1" ifname "$1")
+	append args "-i $ifname"
 }
 
 append_notinterface() {
-	append args "-I $1"
+	local ifname=$(uci_get_state network "$1" ifname "$1")
+	append args "-I $ifname"
 }
 
 append_addnhosts() {
 	append args "-H $1"
 }
 
+append_bogusnxdomain() {
+       append args "-B $1"
+}
+
 dnsmasq() {
 	local cfg="$1"
 	append_bool "$cfg" authoritative "-K"
@@ -72,6 +78,7 @@ dnsmasq() {
 	append_bool "$cfg" enable_tftp "--enable-tftp"
 	append_bool "$cfg" nonwildcard "-z"
 
+	append_parm "$cfg" cachesize "-c"
 	append_parm "$cfg" dnsforwardmax "-0"
 	append_parm "$cfg" port "-p"
 	append_parm "$cfg" ednspacket_max "-P"
@@ -83,6 +90,7 @@ dnsmasq() {
 	config_list_foreach "$cfg" "interface" append_interface
 	config_list_foreach "$cfg" "notinterface" append_notinterface
 	config_list_foreach "$cfg" "addnhosts" append_addnhosts
+	config_list_foreach "$cfg" "bogusnxdomain" append_bogusnxdomain
 	append_parm "$cfg" "leasefile" "-l"
 	append_parm "$cfg" "resolvfile" "-r"
 	append_parm "$cfg" "tftp_root" "--tftp-root"
@@ -94,7 +102,7 @@ dnsmasq() {
 	[ "$readethers" = "1" ] && [ -e "/etc/ethers" ] || touch /etc/ethers
 
 	config_get leasefile $cfg leasefile
-	[ -e "$leasefile" ] || touch "$leasefile"
+	[ -n "$leasefile" ] && [ -e "$leasefile" ] || touch "$leasefile"
 	config_get_bool cachelocal "$cfg" cachelocal 1
 
 	config_get hostsfile "$cfg" dhcphostsfile
diff --git a/package/firewall/Makefile b/package/firewall/Makefile
index c8f200432..dc61f7c75 100644
--- a/package/firewall/Makefile
+++ b/package/firewall/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=firewall
 
 PKG_VERSION:=1
-PKG_RELEASE:=16
+PKG_RELEASE:=20
 
 include $(INCLUDE_DIR)/package.mk
 
@@ -32,6 +32,7 @@ endef
 
 define Package/firewall/conffiles
 /etc/config/firewall
+/etc/firewall.user
 endef
 
 define Package/firewall/install
diff --git a/package/firewall/files/reflection.hotplug b/package/firewall/files/reflection.hotplug
index 76ef6e7a9..9eab709fe 100644
--- a/package/firewall/files/reflection.hotplug
+++ b/package/firewall/files/reflection.hotplug
@@ -15,6 +15,11 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
 		iptables -t nat -A postrouting_rule -j nat_reflection_out
 	}
 
+	iptables -t filter -F nat_reflection_fwd 2>/dev/null || {
+		iptables -t filter -N nat_reflection_fwd
+		iptables -t filter -A forwarding_rule -j nat_reflection_fwd
+	}
+
 	find_networks() {
 		find_networks_cb() {
 			local cfg="$1"
@@ -34,10 +39,14 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
 
 		config_foreach find_networks_cb zone "$1"
 	}
-	
+
 	setup_fwd() {
 		local cfg="$1"
 
+		local reflection
+		config_get_bool reflection "$cfg" reflection 1
+		[ "$reflection" == 1 ] || return
+
 		local src
 		config_get src "$cfg" src
 
@@ -56,10 +65,6 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
 				local proto
 				config_get proto "$cfg" proto
 
-				local reflection
-				config_get_bool reflection "$cfg" reflection 1
-				[ "$reflection" == 1 ] || return
-
 				local epmin epmax extport
 				config_get extport "$cfg" src_dport
 				[ -n "$extport" ] || return
@@ -82,6 +87,9 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
 
 				[ "$proto" = tcpudp ] && proto="tcp udp"
 
+				[ "${inthost#!}" = "$inthost" ] || return 0
+				[ "${exthost#!}" = "$exthost" ] || return 0
+
 				local p
 				for p in ${proto:-tcp udp}; do
 					case "$p" in
@@ -95,6 +103,11 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
 								-s $lanip/$lanmk -d $inthost \
 								-p $p --dport $ipmin${ipmax:+:$ipmax} \
 								-j SNAT --to-source $lanip
+
+							iptables -t filter -A nat_reflection_fwd \
+								-s $lanip/$lanmk -d $inthost \
+								-p $p --dport $ipmin${ipmax:+:$ipmax} \
+								-j ACCEPT
 						;;
 					esac
 				done
@@ -105,4 +118,3 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
 	config_load firewall
 	config_foreach setup_fwd redirect
 fi
-
diff --git a/package/firewall/files/uci_firewall.sh b/package/firewall/files/uci_firewall.sh
index 4a0e1f7e6..be6620d19 100755
--- a/package/firewall/files/uci_firewall.sh
+++ b/package/firewall/files/uci_firewall.sh
@@ -15,6 +15,7 @@ config_load firewall
 
 config fw_zones
 ZONE_LIST=$CONFIG_SECTION
+ZONE_NAMES=
 
 CUSTOM_CHAINS=1
 DEF_INPUT=DROP
@@ -23,6 +24,25 @@ DEF_FORWARD=DROP
 CONNTRACK_ZONES=
 NOTRACK_DISABLED=
 
+add_state() {
+	local var="$1"
+	local item="$2"
+
+	local val="$(uci_get_state firewall core $var)"
+	uci_set_state firewall core $var "${val:+$val }$item"
+}
+
+del_state() {
+	local var="$1"
+	local item="$2"
+
+	local val=" $(uci_get_state firewall core $var) "
+	val="${val// $item / }"
+	val="${val# }"
+	val="${val% }"
+	uci_set_state firewall core $var "$val"
+}
+
 find_item() {
 	local item="$1"; shift
 	for i in "$@"; do
@@ -44,6 +64,16 @@ get_portrange() {
 		export -n -- "$_var=${_min:-$_max}"
 }
 
+get_negation() {
+	local _var="$1"
+	local _flag="$2"
+	local _ipaddr="$3"
+
+	[ "${_ipaddr#!}" != "$_ipaddr" ] && \
+		export -n -- "$_var=! $_flag ${_ipaddr#!}" || \
+		export -n -- "$_var=${_ipaddr:+$_flag $_ipaddr}"
+}
+
 load_policy() {
 	config_get input $1 input
 	config_get output $1 output
@@ -88,13 +118,15 @@ create_zone() {
 	if [ "$masq" == "1" ]; then
 		local msrc mdst
 		for msrc in ${masq_src:-0.0.0.0/0}; do
-			[ "${msrc#!}" != "$msrc" ] && msrc="! -s ${msrc#!}" || msrc="-s $msrc"
+			get_negation msrc '-s' "$msrc"
 			for mdst in ${masq_dest:-0.0.0.0/0}; do
-				[ "${mdst#!}" != "$mdst" ] && mdst="! -d ${mdst#!}" || mdst="-d $mdst"
+				get_negation mdst '-d' "$mdst"
 				$IPTABLES -A zone_${name}_nat -t nat $msrc $mdst -j MASQUERADE
 			done
 		done
 	fi
+
+	append ZONE_NAMES "$name"
 }
 
 
@@ -132,6 +164,8 @@ addif() {
 	uci_set_state firewall core "${network}_ifname" "$ifname"
 	uci_set_state firewall core "${network}_zone" "$zone"
 
+	add_state "${zone}_networks" "$network"
+
 	ACTION=add ZONE="$zone" INTERFACE="$network" DEVICE="$ifname" /sbin/hotplug-call firewall
 }
 
@@ -158,6 +192,8 @@ delif() {
 	uci_revert_state firewall core "${network}_ifname"
 	uci_revert_state firewall core "${network}_zone"
 
+	del_state "${zone}_networks" "$network"
+
 	ACTION=remove ZONE="$zone" INTERFACE="$network" DEVICE="$ifname" /sbin/hotplug-call firewall
 }
 
@@ -327,27 +363,41 @@ fw_rule() {
 	config_get target $1 target
 	config_get ruleset $1 ruleset
 
+	[ "$target" != "NOTRACK" ] || [ -n "$src" ] || {
+		echo "NOTRACK rule needs src"
+		return
+	}
+
+	local srcaddr destaddr
+	get_negation srcaddr '-s' "$src_ip"
+	get_negation destaddr '-d' "$dest_ip"
+
 	local srcports destports
 	get_portrange srcports "$src_port" ":"
 	get_portrange destports "$dest_port" ":"
 
 	ZONE=input
-	TARGET=$target
-	[ -z "$target" ] && target=DROP
-	[ -n "$src" -a -z "$dest" ] && ZONE=zone_$src
-	[ -n "$src" -a -n "$dest" ] && ZONE=zone_${src}_forward
-	[ -n "$dest" ] && TARGET=zone_${dest}_$target
+	TABLE=filter
+	TARGET="${target:-DROP}"
 
-	eval 'RULE_COUNT=$((++RULE_COUNT_'$ZONE'))'
+	if [ "$TARGET" = "NOTRACK" ]; then
+		TABLE=raw
+		ZONE="zone_${src}_notrack"
+	else
+		[ -n "$src" ] && ZONE="zone_${src}${dest:+_forward}"
+		[ -n "$dest" ] && TARGET="zone_${dest}_${TARGET}"
+	fi
+
+	local pos
+	eval 'pos=$((++FW__RULE_COUNT_'$ZONE'))'
 
 	add_rule() {
-		$IPTABLES -I $ZONE $RULE_COUNT \
+		$IPTABLES -t $TABLE -I $ZONE $pos \
+			$srcaddr $destaddr \
 			${proto:+-p $proto} \
 			${icmp_type:+--icmp-type $icmp_type} \
-			${src_ip:+-s $src_ip} \
 			${srcports:+--sport $srcports} \
 			${src_mac:+-m mac --mac-source $src_mac} \
-			${dest_ip:+-d $dest_ip} \
 			${destports:+--dport $destports} \
 			-j $TARGET
 	}
@@ -413,7 +463,7 @@ fw_redirect() {
 		nataddr="$dest_ip"
 		get_portrange natports "$dest_port" "-"
 
-		srcdaddr="$src_dip"
+		get_negation srcdaddr '-d' "$src_dip"
 		get_portrange srcdports "$src_dport" ":"
 
 		find_item "$src" $CONNTRACK_ZONES || \
@@ -432,7 +482,7 @@ fw_redirect() {
 		nataddr="$src_dip"
 		get_portrange natports "$src_dport" "-"
 
-		srcdaddr="$dest_ip"
+		get_negation srcdaddr '-d' "$dest_ip"
 		get_portrange srcdports "$dest_port" ":"
 
 		find_item "$dest" $CONNTRACK_ZONES || \
@@ -443,26 +493,31 @@ fw_redirect() {
 		return
 	fi
 
+	local srcaddr destaddr
+	get_negation srcaddr '-s' "$src_ip"
+	get_negation destaddr '-d' "$dest_ip"
+
 	local srcports destports
 	get_portrange srcports "$src_port" ":"
 	get_portrange destports "${dest_port-$src_dport}" ":"
 
 	add_rule() {
-		$IPTABLES -I $natchain 1 -t nat \
+		local pos
+		eval 'pos=$((++FW__REDIR_COUNT_'$natchain'))'
+
+		$IPTABLES -I $natchain $pos -t nat \
+			$srcaddr $srcdaddr \
 			${proto:+-p $proto} \
-			${src_ip:+-s $src_ip} \
 			${srcports:+--sport $srcports} \
-			${srcdaddr:+-d $srcdaddr} \
 			${srcdports:+--dport $srcdports} \
 			${src_mac:+-m mac --mac-source $src_mac} \
 			-j ${target:-DNAT} $natopt $nataddr${natports:+:$natports}
 
 		[ -n "$dest_ip" ] && \
 		$IPTABLES -I ${fwdchain:-forward} 1 \
+			$srcaddr $destaddr \
 			${proto:+-p $proto} \
-			${src_ip:+-s $src_ip} \
 			${srcports:+--sport $srcports} \
-			${dest_ip:+-d $dest_ip} \
 			${destports:+--dport $destports} \
 			${src_mac:+-m mac --mac-source $src_mac} \
 			-j ACCEPT
@@ -605,9 +660,22 @@ fw_init() {
 	for interface in $INTERFACES; do
 		fw_event ifup "$interface"
 	done
+
+	uci_set_state firewall core zones "$ZONE_NAMES"
 }
 
 fw_stop() {
+	local z n i
+	config_get z core zones
+	for z in $z; do
+		config_get n core "${z}_networks"
+		for n in $n; do
+			config_get i core "${n}_ifname"
+			[ -n "$i" ] && env -i ACTION=remove ZONE="$z" INTERFACE="$n" DEVICE="$i" \
+				/sbin/hotplug-call firewall
+		done
+	done
+
 	fw_clear
 	$IPTABLES -P INPUT ACCEPT
 	$IPTABLES -P OUTPUT ACCEPT
diff --git a/package/hostapd/Config.in b/package/hostapd/Config.in
index 19893382a..a74cbae96 100644
--- a/package/hostapd/Config.in
+++ b/package/hostapd/Config.in
@@ -20,3 +20,8 @@ config WPA_SUPPLICANT_OPENSSL
 	select PACKAGE_libopenssl
 
 endchoice
+
+config WPA_RFKILL_SUPPORT
+	bool "Add rfkill support"
+	depends PACKAGE_wpa-supplicant || PACKAGE_wpa-supplicant-mini || PACKAGE_wpad || PACKAGE_wpad-mini
+	default n
diff --git a/package/hostapd/Makefile b/package/hostapd/Makefile
index 948e1339b..172e89b25 100644
--- a/package/hostapd/Makefile
+++ b/package/hostapd/Makefile
@@ -8,9 +8,9 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hostapd
-PKG_VERSION:=20100418
-PKG_RELEASE:=2
-PKG_REV:=0b86f67a2970403d1b1b6d34ce49f5485ef5dbb3
+PKG_VERSION:=20100705
+PKG_RELEASE:=1
+PKG_REV:=2f1ce78bf78cecd7021385b04a4f55f22e76ab97
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=git://w1.fi/srv/git/hostap.git
@@ -30,7 +30,8 @@ PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_kmod-madwifi \
 	CONFIG_PACKAGE_hostapd \
 	CONFIG_PACKAGE_hostapd-mini \
-	CONFIG_PACKAGE_kmod-hostap
+	CONFIG_PACKAGE_kmod-hostap \
+	CONFIG_WPA_RFKILL_SUPPORT
 
 LOCAL_TYPE=$(strip \
 		$(if $(findstring wpad,$(BUILD_VARIANT)),wpad, \
@@ -64,7 +65,8 @@ DRIVER_MAKEOPTS= \
 	CONFIG_DRIVER_MADWIFI=$(CONFIG_PACKAGE_kmod-madwifi) \
 	CONFIG_DRIVER_HOSTAP=$(CONFIG_PACKAGE_kmod-hostap) \
 	CONFIG_IEEE80211N=$(HOSTAPD_IEEE80211N) \
-	CONFIG_IEEE80211W=$(CONFIG_PACKAGE_kmod-ath9k)
+	CONFIG_IEEE80211W=$(CONFIG_PACKAGE_kmod-ath9k) \
+	$(if $(CONFIG_WPA_RFKILL_SUPPORT),NEED_RFKILL=y)
 
 ifneq ($(LOCAL_TYPE),hostapd)
   ifdef CONFIG_WPA_SUPPLICANT_OPENSSL
@@ -80,7 +82,7 @@ ifneq ($(LOCAL_TYPE),hostapd)
 	CONFIG_DRIVER_ROBOSWITCH=$(CONFIG_PACKAGE_kmod-switch)
 endif
 
-DRV_DEPENDS:=+PACKAGE_kmod-mac80211:libnl-tiny +PACKAGE_kmod-mac80211:crda @(!(TARGET_avr32||TARGET_etrax)||BROKEN)
+DRV_DEPENDS:=+PACKAGE_kmod-mac80211:libnl-tiny @(!(TARGET_avr32||TARGET_etrax)||BROKEN)
 
 define Package/hostapd/Default
   SECTION:=net
@@ -115,7 +117,7 @@ endef
 define Package/hostapd-utils
   $(call Package/hostapd/Default)
   TITLE+= (utils)
-  DEPENDS:=@PACKAGE_hostapd||PACKAGE_hostapd-mini
+  DEPENDS:=@PACKAGE_hostapd||PACKAGE_hostapd-mini||PACKAGE_wpad||PACKAGE_wpad-mini
 endef
 
 define Package/hostapd-utils/description
@@ -186,7 +188,7 @@ endef
 define Package/wpa-cli
   SECTION:=net
   CATEGORY:=Network
-  DEPENDS:=wpa-supplicant
+  DEPENDS:=@PACKAGE_wpa-supplicant||PACKAGE_wpad-mini||PACKAGE_wpad
   TITLE:=WPA Supplicant command line interface
   MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
 endef
@@ -237,7 +239,7 @@ endef
 define Build/Compile/wpad
 	echo ` \
 		$(call Build/RunMake,hostapd,-s MULTICALL=1 dump_cflags); \
-		$(call Build/RunMake,wpa_supplicant,-s dump_cflags) | \
+		$(call Build/RunMake,wpa_supplicant,-s MULTICALL=1 dump_cflags) | \
 		sed -e 's,-n ,,g' -e 's,$(TARGET_CFLAGS),,' \
 	` > $(PKG_BUILD_DIR)/.cflags
 	$(call Build/RunMake,hostapd, \
@@ -294,8 +296,9 @@ Package/hostapd-mini/install = $(Package/hostapd/install)
 
 ifneq ($(LOCAL_TYPE),supplicant)
   define Package/hostapd-utils/install
-	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/hotplug.d/button
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/hostapd/hostapd_cli $(1)/usr/sbin/
+	$(INSTALL_DATA) ./files/wps-hotplug.sh $(1)/etc/hotplug.d/button/50-wps
   endef
 endif
 
diff --git a/package/hostapd/files/hostapd-full.config b/package/hostapd/files/hostapd-full.config
index 07c924fe9..cf7993c34 100644
--- a/package/hostapd/files/hostapd-full.config
+++ b/package/hostapd/files/hostapd-full.config
@@ -156,3 +156,5 @@ CONFIG_TLS=internal
 CONFIG_INTERNAL_LIBTOMMATH=y
 CONFIG_INTERNAL_AES=y
 NEED_AES_DEC=y
+
+CONFIG_WPS=y
diff --git a/package/hostapd/files/hostapd.sh b/package/hostapd/files/hostapd.sh
index fdb047be6..db08e7bce 100644
--- a/package/hostapd/files/hostapd.sh
+++ b/package/hostapd/files/hostapd.sh
@@ -1,7 +1,7 @@
 hostapd_set_bss_options() {
 	local var="$1"
 	local vif="$2"
-	local enc wpa_group_rekey
+	local enc wpa_group_rekey wps_possible
 
 	config_get enc "$vif" encryption
 	config_get wpa_group_rekey "$vif" wpa_group_rekey
@@ -60,6 +60,7 @@ hostapd_set_bss_options() {
 			else
 				append "$var" "wpa_passphrase=$psk" "$N"
 			fi
+			wps_possible=1
 		;;
 		*wpa*)
 			# required fields? formats?
@@ -76,7 +77,6 @@ hostapd_set_bss_options() {
 			append "$var" "eapol_key_index_workaround=1" "$N"
 			append "$var" "radius_acct_interim_interval=300" "$N"
 			append "$var" "ieee8021x=1" "$N"
-			append "$var" "auth_algs=1" "$N"
 			append "$var" "wpa_key_mgmt=WPA-EAP" "$N"
 			append "$var" "wpa_group_rekey=300" "$N"
 			append "$var" "wpa_gmk_rekey=640" "$N"
@@ -100,6 +100,14 @@ hostapd_set_bss_options() {
 					append "$var" "wep_default_key=0" "$N"
 				;;
 			esac
+			case "$enc" in
+				*shared*)
+					auth_algs=2
+				;;
+				*mixed*)
+					auth_algs=3
+				;;
+			esac
 			wpa=0
 			crypto=
 		;;
@@ -108,6 +116,7 @@ hostapd_set_bss_options() {
 			crypto=
 		;;
 	esac
+	append "$var" "auth_algs=${auth_algs:-1}" "$N"
 	append "$var" "wpa=$wpa" "$N"
 	[ -n "$crypto" ] && append "$var" "wpa_pairwise=$crypto" "$N"
 	[ -n "$wpa_group_rekey" ] && append "$var" "wpa_group_rekey=$wpa_group_rekey" "$N"
@@ -115,10 +124,20 @@ hostapd_set_bss_options() {
 	config_get ssid "$vif" ssid
 	config_get bridge "$vif" bridge
 	config_get ieee80211d "$vif" ieee80211d
+	config_get iapp_interface "$vif" iapp_interface
+
+	config_get_bool wps_pbc "$vif" wps_pushbutton 0
+	[ -n "$wps_possible" -a "$wps_pbc" -gt 0 ] && {
+		append "$var" "eap_server=1" "$N"
+		append "$var" "wps_state=2" "$N"
+		append "$var" "ap_setup_locked=1" "$N"
+		append "$var" "config_methods=push_button" "$N"
+	}
 
 	append "$var" "ssid=$ssid" "$N"
 	[ -n "$bridge" ] && append "$var" "bridge=$bridge" "$N"
 	[ -n "$ieee80211d" ] && append "$var" "ieee80211d=$ieee80211d" "$N"
+	[ -n "$iapp_interface" ] && append "$var" $(uci_get_state network "$iapp_interface" ifname "$iapp_interface") "$N"
 
 	[ "$wpa" -ge "2" ] && config_get ieee80211w "$vif" ieee80211w
 	case "$ieee80211w" in
diff --git a/package/hostapd/files/wpa_supplicant-full.config b/package/hostapd/files/wpa_supplicant-full.config
index 8d6813a56..6e157f749 100644
--- a/package/hostapd/files/wpa_supplicant-full.config
+++ b/package/hostapd/files/wpa_supplicant-full.config
@@ -189,7 +189,7 @@ CONFIG_EAP_LEAP=y
 #CONFIG_EAP_TNC=y
 
 # Wi-Fi Protected Setup (WPS)
-#CONFIG_WPS=y
+CONFIG_WPS=y
 
 # EAP-IKEv2
 #CONFIG_EAP_IKEV2=y
diff --git a/package/hostapd/files/wpa_supplicant.sh b/package/hostapd/files/wpa_supplicant.sh
index 28d5d2056..515fa6c0d 100644
--- a/package/hostapd/files/wpa_supplicant.sh
+++ b/package/hostapd/files/wpa_supplicant.sh
@@ -2,6 +2,7 @@ wpa_supplicant_setup_vif() {
 	local vif="$1"
 	local driver="$2"
 	local key="$key"
+	local options="$3"
 
 	# wpa_supplicant should use wext for mac80211 cards
 	[ "$driver" = "mac80211" ] && driver='wext'
@@ -133,5 +134,5 @@ network={
 }
 EOF
 	[ -z "$proto" -a "$key_mgmt" != "NONE" ] || \
-		wpa_supplicant ${bridge:+ -b $bridge} -B -P "/var/run/wifi-${ifname}.pid" -D ${driver:-wext} -i "$ifname" -c /var/run/wpa_supplicant-$ifname.conf
+		wpa_supplicant ${bridge:+ -b $bridge} -B -P "/var/run/wifi-${ifname}.pid" -D ${driver:-wext} -i "$ifname" -c /var/run/wpa_supplicant-$ifname.conf $options
 }
diff --git a/package/hostapd/files/wps-hotplug.sh b/package/hostapd/files/wps-hotplug.sh
new file mode 100644
index 000000000..b5376cc55
--- /dev/null
+++ b/package/hostapd/files/wps-hotplug.sh
@@ -0,0 +1,6 @@
+if [ "$ACTION" = "pressed" -a "$BUTTON" = "wps" ]; then
+	for dir in /var/run/hostapd-*; do
+		[ -d "$dir" ] || continue
+		hostapd_cli -p "$dir" wps_pbc
+	done
+fi
diff --git a/package/hostapd/patches/110-countrycode.patch b/package/hostapd/patches/110-countrycode.patch
index 88dd1e92e..11cf06e84 100644
--- a/package/hostapd/patches/110-countrycode.patch
+++ b/package/hostapd/patches/110-countrycode.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -659,7 +659,6 @@ static int setup_interface(struct hostap
+@@ -660,7 +660,6 @@ static int setup_interface(struct hostap
  		country[3] = '\0';
  		if (hostapd_set_country(hapd, country) < 0) {
  			wpa_printf(MSG_ERROR, "Failed to set country code");
diff --git a/package/hostapd/patches/130-scan_wait.patch b/package/hostapd/patches/130-scan_wait.patch
index 5e8d1e72e..1f249533f 100644
--- a/package/hostapd/patches/130-scan_wait.patch
+++ b/package/hostapd/patches/130-scan_wait.patch
@@ -10,7 +10,7 @@
  /* hostapd.c */
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -754,6 +754,9 @@ int hostapd_setup_interface_complete(str
+@@ -755,6 +755,9 @@ int hostapd_setup_interface_complete(str
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
  
diff --git a/package/hostapd/patches/200-multicall.patch b/package/hostapd/patches/200-multicall.patch
index 006e26a94..a35b5c8d3 100644
--- a/package/hostapd/patches/200-multicall.patch
+++ b/package/hostapd/patches/200-multicall.patch
@@ -62,7 +62,7 @@
  
  ifndef CONFIG_OS
  ifdef CONFIG_NATIVE_WINDOWS
-@@ -579,6 +580,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
+@@ -581,6 +582,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
  CFLAGS += -DCONFIG_DYNAMIC_EAP_METHODS
  LIBS += -ldl -rdynamic
  endif
@@ -73,7 +73,7 @@
  endif
  
  ifdef CONFIG_AP
-@@ -631,6 +636,12 @@ CFLAGS += -DEAP_SERVER_WSC
+@@ -635,6 +640,12 @@ CFLAGS += -DEAP_SERVER_WSC
  OBJS += ../src/ap/wps_hostapd.o
  OBJS += ../src/eap_server/eap_server_wsc.o
  endif
@@ -86,7 +86,7 @@
  endif
  
  ifdef NEED_RSN_AUTHENTICATOR
-@@ -1262,6 +1273,12 @@ BCHECK=../src/drivers/build.wpa_supplica
+@@ -1270,6 +1281,12 @@ BCHECK=../src/drivers/build.wpa_supplica
  wpa_priv: $(BCHECK) $(OBJS_priv)
  	$(LDO) $(LDFLAGS) -o wpa_priv $(OBJS_priv) $(LIBS)
  
@@ -99,7 +99,7 @@
  wpa_supplicant: .config $(BCHECK) $(OBJS) $(EXTRA_progs)
  	$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
  
-@@ -1321,6 +1338,12 @@ endif
+@@ -1329,6 +1346,12 @@ endif
  	$(Q)$(CC) -c -o $@ $(CFLAGS) $<
  	@$(E) "  CC " $<
  
@@ -114,7 +114,7 @@
  wpa_cli.exe: wpa_cli
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -2449,8 +2449,8 @@ union wpa_event_data {
+@@ -2465,8 +2465,8 @@ union wpa_event_data {
   * Driver wrapper code should call this function whenever an event is received
   * from the driver.
   */
@@ -169,7 +169,7 @@
  	for (;;) {
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -1577,8 +1577,8 @@ static void ft_rx_action(struct wpa_supp
+@@ -1582,8 +1582,8 @@ static void ft_rx_action(struct wpa_supp
  #endif /* CONFIG_IEEE80211R */
  
  
@@ -182,7 +182,7 @@
  	u16 reason_code = 0;
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2223,6 +2223,9 @@ struct wpa_supplicant * wpa_supplicant_g
+@@ -2228,6 +2228,9 @@ struct wpa_supplicant * wpa_supplicant_g
  	return NULL;
  }
  
@@ -192,7 +192,7 @@
  
  /**
   * wpa_supplicant_init - Initialize %wpa_supplicant
-@@ -2241,6 +2244,7 @@ struct wpa_global * wpa_supplicant_init(
+@@ -2246,6 +2249,7 @@ struct wpa_global * wpa_supplicant_init(
  	if (params == NULL)
  		return NULL;
  
diff --git a/package/hostapd/patches/300-timestamp_check.patch b/package/hostapd/patches/300-timestamp_check.patch
index fef63e30a..70ac63597 100644
--- a/package/hostapd/patches/300-timestamp_check.patch
+++ b/package/hostapd/patches/300-timestamp_check.patch
@@ -1,6 +1,6 @@
 --- a/src/tls/x509v3.c
 +++ b/src/tls/x509v3.c
-@@ -1832,8 +1832,11 @@ int x509_certificate_chain_validate(stru
+@@ -1854,8 +1854,11 @@ int x509_certificate_chain_validate(stru
  		if (chain_trusted)
  			continue;
  
diff --git a/package/hostapd/patches/310-scan_ssid.patch b/package/hostapd/patches/310-scan_ssid.patch
index 60babf474..884459ce6 100644
--- a/package/hostapd/patches/310-scan_ssid.patch
+++ b/package/hostapd/patches/310-scan_ssid.patch
@@ -8,7 +8,7 @@
  	size_t max_ssids;
  	enum wpa_states prev_state;
  
-@@ -311,6 +312,16 @@ static void wpa_supplicant_scan(void *el
+@@ -316,6 +317,16 @@ static void wpa_supplicant_scan(void *el
  	    wpa_s->wpa_state == WPA_INACTIVE)
  		wpa_supplicant_set_state(wpa_s, WPA_SCANNING);
  
@@ -25,7 +25,7 @@
  	/* Find the starting point from which to continue scanning */
  	ssid = wpa_s->conf->ssid;
  	if (wpa_s->prev_scan_ssid != WILDCARD_SSID_SCAN) {
-@@ -374,6 +385,9 @@ static void wpa_supplicant_scan(void *el
+@@ -379,6 +390,9 @@ static void wpa_supplicant_scan(void *el
  		int_array_sort_unique(params.freqs);
  	}
  
diff --git a/package/hostapd/patches/320-rescan_immediately.patch b/package/hostapd/patches/320-rescan_immediately.patch
index 1a0eb58a7..19183040a 100644
--- a/package/hostapd/patches/320-rescan_immediately.patch
+++ b/package/hostapd/patches/320-rescan_immediately.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -958,7 +958,7 @@ static void wpa_supplicant_event_scan_re
+@@ -963,7 +963,7 @@ static void wpa_supplicant_event_scan_re
  			wpa_printf(MSG_DEBUG, "Setup a new network");
  			wpa_supplicant_associate(wpa_s, NULL, ssid);
  		} else {
diff --git a/package/hostapd/patches/330-madwifi_merge.patch b/package/hostapd/patches/330-madwifi_merge.patch
index f35eab386..cddffe4b9 100644
--- a/package/hostapd/patches/330-madwifi_merge.patch
+++ b/package/hostapd/patches/330-madwifi_merge.patch
@@ -336,7 +336,7 @@
 -	return 0;
 -}
 -
- static int
+-static int
 -set80211param(struct wpa_driver_madwifi_data *drv, int op, int arg,
 -	      int show_err)
 -{
@@ -355,7 +355,7 @@
 -	return 0;
 -}
 -
--static int
+ static int
 -wpa_driver_madwifi_set_wpa_ie(struct wpa_driver_madwifi_data *drv,
 +wpa_driver_madwifi_set_wpa_ie(struct madwifi_driver_data *drv,
  			      const u8 *wpa_ie, size_t wpa_ie_len)
@@ -627,7 +627,7 @@
  	return wpa_driver_wext_get_ssid(drv->wext, ssid);
  }
  
-@@ -1705,14 +1481,14 @@ static int wpa_driver_madwifi_get_ssid(v
+@@ -1705,14 +1481,16 @@ static int wpa_driver_madwifi_get_ssid(v
  static struct wpa_scan_results *
  wpa_driver_madwifi_get_scan_results(void *priv)
  {
@@ -641,10 +641,12 @@
  {
 -	struct wpa_driver_madwifi_data *drv = priv;
 +	struct madwifi_driver_data *drv = priv;
++	if (!drv->wext)
++		return 0;
  	return wpa_driver_wext_set_operstate(drv->wext, state);
  }
  
-@@ -1733,7 +1509,7 @@ static int wpa_driver_madwifi_set_probe_
+@@ -1733,7 +1511,7 @@ static int wpa_driver_madwifi_set_probe_
  
  	ret = set80211priv(priv, IEEE80211_IOCTL_SET_APPIEBUF, probe_req_ie,
  			   sizeof(struct ieee80211req_getset_appiebuf) +
@@ -653,7 +655,7 @@
  
  	os_free(probe_req_ie);
  
-@@ -1743,7 +1519,7 @@ static int wpa_driver_madwifi_set_probe_
+@@ -1743,7 +1521,7 @@ static int wpa_driver_madwifi_set_probe_
  
  static void * wpa_driver_madwifi_init(void *ctx, const char *ifname)
  {
@@ -662,7 +664,7 @@
  
  	drv = os_zalloc(sizeof(*drv));
  	if (drv == NULL)
-@@ -1754,17 +1530,17 @@ static void * wpa_driver_madwifi_init(vo
+@@ -1754,17 +1532,17 @@ static void * wpa_driver_madwifi_init(vo
  
  	drv->ctx = ctx;
  	os_strlcpy(drv->ifname, ifname, sizeof(drv->ifname));
@@ -684,7 +686,7 @@
  		wpa_printf(MSG_DEBUG, "%s: failed to enable WPA support",
  			   __FUNCTION__);
  		goto fail3;
-@@ -1773,7 +1549,7 @@ static void * wpa_driver_madwifi_init(vo
+@@ -1773,7 +1551,7 @@ static void * wpa_driver_madwifi_init(vo
  	return drv;
  
  fail3:
@@ -693,7 +695,7 @@
  fail2:
  	wpa_driver_wext_deinit(drv->wext);
  fail:
-@@ -1784,38 +1560,37 @@ fail:
+@@ -1784,38 +1562,37 @@ fail:
  
  static void wpa_driver_madwifi_deinit(void *priv)
  {
@@ -739,7 +741,7 @@
  #ifdef HOSTAPD
  	.hapd_init		= madwifi_init,
  	.hapd_deinit		= madwifi_deinit,
-@@ -1835,7 +1610,8 @@ const struct wpa_driver_ops wpa_driver_m
+@@ -1835,7 +1612,8 @@ const struct wpa_driver_ops wpa_driver_m
  	.sta_clear_stats        = madwifi_sta_clear_stats,
  	.commit			= madwifi_commit,
  	.set_ap_wps_ie		= madwifi_set_ap_wps_ie,
@@ -749,7 +751,7 @@
  	.get_bssid		= wpa_driver_madwifi_get_bssid,
  	.get_ssid		= wpa_driver_madwifi_get_ssid,
  	.init			= wpa_driver_madwifi_init,
-@@ -1847,5 +1623,5 @@ const struct wpa_driver_ops wpa_driver_m
+@@ -1847,5 +1625,5 @@ const struct wpa_driver_ops wpa_driver_m
  	.disassociate		= wpa_driver_madwifi_disassociate,
  	.associate		= wpa_driver_madwifi_associate,
  	.set_operstate		= wpa_driver_madwifi_set_operstate,
diff --git a/package/hostapd/patches/350-wds_fix.patch b/package/hostapd/patches/350-wds_fix.patch
index 7bcf410a9..3a3ee000a 100644
--- a/package/hostapd/patches/350-wds_fix.patch
+++ b/package/hostapd/patches/350-wds_fix.patch
@@ -1,6 +1,6 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -4576,9 +4576,11 @@ static int i802_set_wds_sta(void *priv, 
+@@ -4652,9 +4652,11 @@ static int i802_set_wds_sta(void *priv, 
  	wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
  		   " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
  	if (val) {
@@ -16,7 +16,7 @@
  	} else {
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
-@@ -1614,6 +1614,9 @@ static void handle_assoc_cb(struct hosta
+@@ -1627,6 +1627,9 @@ static void handle_assoc_cb(struct hosta
  			       "Could not add STA to kernel driver");
  	}
  
diff --git a/package/hostapd/patches/360-wds_bridge.patch b/package/hostapd/patches/360-wds_bridge.patch
index 48867922b..4cc60de06 100644
--- a/package/hostapd/patches/360-wds_bridge.patch
+++ b/package/hostapd/patches/360-wds_bridge.patch
@@ -21,7 +21,7 @@
  			/* clear to get error below if setting is invalid */
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -4566,7 +4566,8 @@ static int i802_set_sta_vlan(void *priv,
+@@ -4642,7 +4642,8 @@ static int i802_set_sta_vlan(void *priv,
  }
  
  
@@ -31,7 +31,7 @@
  {
  	struct i802_bss *bss = priv;
  	struct wpa_driver_nl80211_data *drv = bss->drv;
-@@ -4580,6 +4581,10 @@ static int i802_set_wds_sta(void *priv, 
+@@ -4656,6 +4657,10 @@ static int i802_set_wds_sta(void *priv, 
  			if (nl80211_create_iface(drv, name, NL80211_IFTYPE_AP_VLAN,
  					 NULL, 1) < 0)
  				return -1;
diff --git a/package/hostapd/patches/370-basic_rates.patch b/package/hostapd/patches/370-basic_rates.patch
index 98420c01f..6c3fafe83 100644
--- a/package/hostapd/patches/370-basic_rates.patch
+++ b/package/hostapd/patches/370-basic_rates.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -715,6 +715,16 @@ int hostapd_setup_interface_complete(str
+@@ -716,6 +716,16 @@ int hostapd_setup_interface_complete(str
  		}
  	}
  
diff --git a/package/hostapd/patches/380-ap_isolate.patch b/package/hostapd/patches/380-ap_isolate.patch
index 92ac6ded8..12fbdc86b 100644
--- a/package/hostapd/patches/380-ap_isolate.patch
+++ b/package/hostapd/patches/380-ap_isolate.patch
@@ -38,7 +38,7 @@
  	 * @freq: Frequency (in MHz) of the channel
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -4263,6 +4263,29 @@ static int i802_set_rate_sets(void *priv
+@@ -4339,6 +4339,29 @@ static int i802_set_rate_sets(void *priv
  	return -ENOBUFS;
  }
  
@@ -68,7 +68,7 @@
  #endif /* HOSTAPD */
  
  
-@@ -5372,6 +5395,7 @@ const struct wpa_driver_ops wpa_driver_n
+@@ -5448,6 +5471,7 @@ const struct wpa_driver_ops wpa_driver_n
  	.set_tx_queue_params = i802_set_tx_queue_params,
  	.set_sta_vlan = i802_set_sta_vlan,
  	.set_wds_sta = i802_set_wds_sta,
diff --git a/package/hostapd/patches/390-nl80211_fixes.patch b/package/hostapd/patches/390-nl80211_fixes.patch
index fdac284b6..20c603252 100644
--- a/package/hostapd/patches/390-nl80211_fixes.patch
+++ b/package/hostapd/patches/390-nl80211_fixes.patch
@@ -1,6 +1,6 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -1119,7 +1119,6 @@ nla_put_failure:
+@@ -1135,7 +1135,6 @@ nla_put_failure:
  }
  
  
@@ -8,7 +8,7 @@
  struct wiphy_info_data {
  	int max_scan_ssids;
  	int ap_supported;
-@@ -1231,7 +1230,6 @@ static int wpa_driver_nl80211_capa(struc
+@@ -1247,7 +1246,6 @@ static int wpa_driver_nl80211_capa(struc
  
  	return 0;
  }
@@ -16,7 +16,7 @@
  
  
  static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv,
-@@ -1371,6 +1369,7 @@ static void * wpa_driver_nl80211_init(vo
+@@ -1411,6 +1409,7 @@ static void * wpa_driver_nl80211_init(vo
  	drv->monitor_ifidx = -1;
  	drv->monitor_sock = -1;
  	drv->ioctl_sock = -1;
@@ -24,7 +24,7 @@
  
  	if (wpa_driver_nl80211_init_nl(drv, ctx)) {
  		os_free(drv);
-@@ -1468,24 +1467,23 @@ wpa_driver_nl80211_finish_drv_init(struc
+@@ -1530,32 +1529,32 @@ wpa_driver_nl80211_finish_drv_init(struc
  	drv->ifindex = if_nametoindex(bss->ifname);
  	drv->first_bss.ifindex = drv->ifindex;
  
@@ -33,23 +33,38 @@
 -		wpa_printf(MSG_DEBUG, "nl80211: Could not configure driver to "
 -			   "use managed mode");
 -	}
--
--	if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 1)) {
--		wpa_printf(MSG_ERROR, "Could not set interface '%s' UP",
--			   bss->ifname);
--		return -1;
--	}
 +	if (drv->nlmode == NL80211_IFTYPE_STATION) {
-+		if (wpa_driver_nl80211_set_mode(bss, IEEE80211_MODE_INFRA) < 0)
-+			wpa_printf(MSG_DEBUG, "nl80211: Could not configure "
-+				   "driver to use managed mode");
-+
-+		if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 1)) {
-+			wpa_printf(MSG_ERROR, "Could not set interface '%s' UP",
-+				   bss->ifname);
-+			return -1;
++		if (wpa_driver_nl80211_set_mode(bss, IEEE80211_MODE_INFRA) < 0) {
++			wpa_printf(MSG_DEBUG, "nl80211: Could not configure driver to "
++				   "use managed mode");
 +		}
  
+-	if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 1)) {
+-		if (rfkill_is_blocked(drv->rfkill)) {
+-			wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
+-				   "interface '%s' due to rfkill",
+-				   bss->ifname);
+-			drv->if_disabled = 1;
+-			send_rfkill_event = 1;
+-		} else {
+-			wpa_printf(MSG_ERROR, "nl80211: Could not set "
+-				   "interface '%s' UP", bss->ifname);
+-			return -1;
++		if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 1)) {
++			if (rfkill_is_blocked(drv->rfkill)) {
++				wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
++					   "interface '%s' due to rfkill",
++					   bss->ifname);
++				drv->if_disabled = 1;
++				send_rfkill_event = 1;
++			} else {
++				wpa_printf(MSG_ERROR, "nl80211: Could not set "
++					   "interface '%s' UP", bss->ifname);
++				return -1;
++			}
+ 		}
+-	}
+ 
 -	if (wpa_driver_nl80211_capa(drv))
 -		return -1;
 +		if (wpa_driver_nl80211_capa(drv))
@@ -64,7 +79,7 @@
  
  	if (nl80211_register_action_frames(drv) < 0) {
  		wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action "
-@@ -2143,13 +2141,9 @@ static int wpa_driver_nl80211_set_key(co
+@@ -2219,13 +2218,9 @@ static int wpa_driver_nl80211_set_key(co
  	 */
  	if (ret || !set_tx || alg == WPA_ALG_NONE)
  		return ret;
@@ -79,7 +94,7 @@
  
  	msg = nlmsg_alloc();
  	if (!msg)
-@@ -2990,7 +2984,8 @@ static void nl80211_remove_iface(struct 
+@@ -3066,7 +3061,8 @@ static void nl80211_remove_iface(struct 
  
  #ifdef HOSTAPD
  	/* stop listening for EAPOL on this interface */
@@ -89,7 +104,7 @@
  #endif /* HOSTAPD */
  
  	msg = nlmsg_alloc();
-@@ -3063,7 +3058,8 @@ static int nl80211_create_iface_once(str
+@@ -3139,7 +3135,8 @@ static int nl80211_create_iface_once(str
  
  #ifdef HOSTAPD
  	/* start listening for EAPOL on this interface */
@@ -99,7 +114,7 @@
  #endif /* HOSTAPD */
  
  	if (addr && iftype != NL80211_IFTYPE_MONITOR &&
-@@ -4766,6 +4762,7 @@ static void *i802_init(struct hostapd_da
+@@ -4842,6 +4839,7 @@ static void *i802_init(struct hostapd_da
  		return NULL;
  
  	drv = bss->drv;
diff --git a/package/hostapd/patches/400-nl80211_sta_auth.patch b/package/hostapd/patches/400-nl80211_sta_auth.patch
index 8c959062d..41c68c093 100644
--- a/package/hostapd/patches/400-nl80211_sta_auth.patch
+++ b/package/hostapd/patches/400-nl80211_sta_auth.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -543,10 +543,16 @@ void wpa_supplicant_set_state(struct wpa
+@@ -545,10 +545,16 @@ void wpa_supplicant_set_state(struct wpa
  		wpa_s->reassociated_connection = 1;
  		wpa_drv_set_operstate(wpa_s, 1);
  		wpa_s->after_wps = 0;
diff --git a/package/hostapd/patches/410-no_rfkill.patch b/package/hostapd/patches/410-no_rfkill.patch
new file mode 100644
index 000000000..f7e8bc057
--- /dev/null
+++ b/package/hostapd/patches/410-no_rfkill.patch
@@ -0,0 +1,263 @@
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -75,7 +75,9 @@ struct wpa_driver_nl80211_data {
+ 	int ifindex;
+ 	int if_removed;
+ 	int if_disabled;
++#ifdef CONFIG_RFKILL
+ 	struct rfkill_data *rfkill;
++#endif
+ 	struct wpa_driver_capa capa;
+ 	int has_capability;
+ 
+@@ -1361,7 +1363,7 @@ err1:
+ 	return -1;
+ }
+ 
+-
++#ifdef CONFIG_RFKILL
+ static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
+ {
+ 	wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
+@@ -1383,6 +1385,7 @@ static void wpa_driver_nl80211_rfkill_un
+ 	}
+ 	/* rtnetlink ifup handler will report interface as enabled */
+ }
++#endif /* CONFIG_RFKILL */
+ 
+ 
+ /**
+@@ -1396,7 +1399,9 @@ static void * wpa_driver_nl80211_init(vo
+ {
+ 	struct wpa_driver_nl80211_data *drv;
+ 	struct netlink_config *cfg;
++#ifdef CONFIG_RFKILL
+ 	struct rfkill_config *rcfg;
++#endif
+ 	struct i802_bss *bss;
+ 
+ 	drv = os_zalloc(sizeof(*drv));
+@@ -1434,6 +1439,7 @@ static void * wpa_driver_nl80211_init(vo
+ 		goto failed;
+ 	}
+ 
++#ifdef CONFIG_RFKILL
+ 	rcfg = os_zalloc(sizeof(*rcfg));
+ 	if (rcfg == NULL)
+ 		goto failed;
+@@ -1446,6 +1452,7 @@ static void * wpa_driver_nl80211_init(vo
+ 		wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
+ 		os_free(rcfg);
+ 	}
++#endif /* CONFIG_RFKILL */
+ 
+ 	if (wpa_driver_nl80211_finish_drv_init(drv))
+ 		goto failed;
+@@ -1453,7 +1460,9 @@ static void * wpa_driver_nl80211_init(vo
+ 	return bss;
+ 
+ failed:
++#ifdef CONFIG_RFKILL
+ 	rfkill_deinit(drv->rfkill);
++#endif
+ 	netlink_deinit(drv->netlink);
+ 	if (drv->ioctl_sock >= 0)
+ 		close(drv->ioctl_sock);
+@@ -1514,10 +1523,12 @@ static int nl80211_register_action_frame
+ }
+ 
+ 
++#ifdef CONFIG_RFKILL
+ static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx)
+ {
+ 	wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
+ }
++#endif /* CONFIG_RFKILL */
+ 
+ 
+ static int
+@@ -1536,13 +1547,16 @@ wpa_driver_nl80211_finish_drv_init(struc
+ 		}
+ 
+ 		if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 1)) {
++#ifdef CONFIG_RFKILL
+ 			if (rfkill_is_blocked(drv->rfkill)) {
+ 				wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
+ 					   "interface '%s' due to rfkill",
+ 					   bss->ifname);
+ 				drv->if_disabled = 1;
+ 				send_rfkill_event = 1;
+-			} else {
++			} else
++#endif
++			{
+ 				wpa_printf(MSG_ERROR, "nl80211: Could not set "
+ 					   "interface '%s' UP", bss->ifname);
+ 				return -1;
+@@ -1567,8 +1581,10 @@ wpa_driver_nl80211_finish_drv_init(struc
+ 	}
+ 
+ 	if (send_rfkill_event) {
++#ifdef CONFIG_RFKILL
+ 		eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill,
+ 				       drv, drv->ctx);
++#endif
+ 	}
+ 
+ 	return 0;
+@@ -1647,7 +1663,9 @@ static void wpa_driver_nl80211_deinit(vo
+ 
+ 	netlink_send_oper_ifla(drv->netlink, drv->ifindex, 0, IF_OPER_UP);
+ 	netlink_deinit(drv->netlink);
++#ifdef CONFIG_RFKILL
+ 	rfkill_deinit(drv->rfkill);
++#endif
+ 
+ 	eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
+ 
+--- a/src/drivers/driver_wext.c
++++ b/src/drivers/driver_wext.c
+@@ -700,7 +700,7 @@ static void wpa_driver_wext_event_rtm_de
+ 	}
+ }
+ 
+-
++#ifdef CONFIG_RFKILL
+ static void wpa_driver_wext_rfkill_blocked(void *ctx)
+ {
+ 	wpa_printf(MSG_DEBUG, "WEXT: RFKILL blocked");
+@@ -722,7 +722,7 @@ static void wpa_driver_wext_rfkill_unblo
+ 	}
+ 	/* rtnetlink ifup handler will report interface as enabled */
+ }
+-
++#endif /* CONFIG_RFKILL */
+ 
+ /**
+  * wpa_driver_wext_init - Initialize WE driver interface
+@@ -735,7 +735,9 @@ void * wpa_driver_wext_init(void *ctx, c
+ {
+ 	struct wpa_driver_wext_data *drv;
+ 	struct netlink_config *cfg;
++#ifdef CONFIG_RFKILL
+ 	struct rfkill_config *rcfg;
++#endif
+ 	char path[128];
+ 	struct stat buf;
+ 
+@@ -769,6 +771,7 @@ void * wpa_driver_wext_init(void *ctx, c
+ 		goto err2;
+ 	}
+ 
++#ifdef CONFIG_RFKILL
+ 	rcfg = os_zalloc(sizeof(*rcfg));
+ 	if (rcfg == NULL)
+ 		goto err3;
+@@ -781,6 +784,7 @@ void * wpa_driver_wext_init(void *ctx, c
+ 		wpa_printf(MSG_DEBUG, "WEXT: RFKILL status not available");
+ 		os_free(rcfg);
+ 	}
++#endif /* CONFIG_RFKILL */
+ 
+ 	drv->mlme_sock = -1;
+ 
+@@ -792,7 +796,9 @@ void * wpa_driver_wext_init(void *ctx, c
+ 	return drv;
+ 
+ err3:
++#ifdef CONFIG_RFKILL
+ 	rfkill_deinit(drv->rfkill);
++#endif
+ 	netlink_deinit(drv->netlink);
+ err2:
+ 	close(drv->ioctl_sock);
+@@ -802,10 +808,12 @@ err1:
+ }
+ 
+ 
++#ifdef CONFIG_RFKILL
+ static void wpa_driver_wext_send_rfkill(void *eloop_ctx, void *timeout_ctx)
+ {
+ 	wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
+ }
++#endif /* CONFIG_RFKILL */
+ 
+ 
+ static int wpa_driver_wext_finish_drv_init(struct wpa_driver_wext_data *drv)
+@@ -813,13 +821,16 @@ static int wpa_driver_wext_finish_drv_in
+ 	int send_rfkill_event = 0;
+ 
+ 	if (linux_set_iface_flags(drv->ioctl_sock, drv->ifname, 1) < 0) {
++#ifdef CONFIG_RFKILL
+ 		if (rfkill_is_blocked(drv->rfkill)) {
+ 			wpa_printf(MSG_DEBUG, "WEXT: Could not yet enable "
+ 				   "interface '%s' due to rfkill",
+ 				   drv->ifname);
+ 			drv->if_disabled = 1;
+ 			send_rfkill_event = 1;
+-		} else {
++		} else
++#endif
++		{
+ 			wpa_printf(MSG_ERROR, "WEXT: Could not set "
+ 				   "interface '%s' UP", drv->ifname);
+ 			return -1;
+@@ -867,8 +878,10 @@ static int wpa_driver_wext_finish_drv_in
+ 			       1, IF_OPER_DORMANT);
+ 
+ 	if (send_rfkill_event) {
++#ifdef CONFIG_RFKILL
+ 		eloop_register_timeout(0, 0, wpa_driver_wext_send_rfkill,
+ 				       drv, drv->ctx);
++#endif
+ 	}
+ 
+ 	return 0;
+@@ -898,7 +911,9 @@ void wpa_driver_wext_deinit(void *priv)
+ 
+ 	netlink_send_oper_ifla(drv->netlink, drv->ifindex, 0, IF_OPER_UP);
+ 	netlink_deinit(drv->netlink);
++#ifdef CONFIG_RFKILL
+ 	rfkill_deinit(drv->rfkill);
++#endif
+ 
+ 	if (drv->mlme_sock >= 0)
+ 		eloop_unregister_read_sock(drv->mlme_sock);
+--- a/src/drivers/drivers.mak
++++ b/src/drivers/drivers.mak
+@@ -31,7 +31,6 @@ NEED_SME=y
+ NEED_AP_MLME=y
+ NEED_NETLINK=y
+ NEED_LINUX_IOCTL=y
+-NEED_RFKILL=y
+ DRV_LIBS += -lnl
+ 
+ ifdef CONFIG_LIBNL20
+@@ -78,7 +77,6 @@ DRV_WPA_CFLAGS += -DCONFIG_DRIVER_WEXT
+ CONFIG_WIRELESS_EXTENSION=y
+ NEED_NETLINK=y
+ NEED_LINUX_IOCTL=y
+-NEED_RFKILL=y
+ endif
+ 
+ ifdef CONFIG_DRIVER_HERMES
+@@ -166,6 +164,7 @@ endif
+ 
+ ifdef NEED_RFKILL
+ DRV_OBJS += ../src/drivers/rfkill.o
++DRV_WPA_CFLAGS += -DCONFIG_RFKILL
+ endif
+ 
+ 
+--- a/src/drivers/driver_wext.h
++++ b/src/drivers/driver_wext.h
+@@ -27,7 +27,9 @@ struct wpa_driver_wext_data {
+ 	int ifindex2;
+ 	int if_removed;
+ 	int if_disabled;
++#ifdef CONFIG_RFKILL
+ 	struct rfkill_data *rfkill;
++#endif
+ 	u8 *assoc_req_ies;
+ 	size_t assoc_req_ies_len;
+ 	u8 *assoc_resp_ies;
diff --git a/package/hostapd/patches/430-supplicant_bridge_fix.patch b/package/hostapd/patches/430-supplicant_bridge_fix.patch
new file mode 100644
index 000000000..feddf6fed
--- /dev/null
+++ b/package/hostapd/patches/430-supplicant_bridge_fix.patch
@@ -0,0 +1,45 @@
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -410,6 +410,10 @@ static void wpa_driver_nl80211_event_rtm
+ 		return;
+ 	}
+ 
++	if (ifi->ifi_family == AF_BRIDGE &&
++	    drv->nlmode != NL80211_IFTYPE_AP)
++		return;
++
+ 	wpa_printf(MSG_DEBUG, "RTM_NEWLINK: operstate=%d ifi_flags=0x%x "
+ 		   "(%s%s%s%s)",
+ 		   drv->operstate, ifi->ifi_flags,
+@@ -481,6 +485,10 @@ static void wpa_driver_nl80211_event_rtm
+ 	attrlen = len;
+ 	attr = (struct rtattr *) buf;
+ 
++	if (ifi->ifi_family == AF_BRIDGE &&
++	    drv->nlmode != NL80211_IFTYPE_AP)
++		return;
++
+ 	rta_len = RTA_ALIGN(sizeof(struct rtattr));
+ 	while (RTA_OK(attr, attrlen)) {
+ 		if (attr->rta_type == IFLA_IFNAME) {
+@@ -1347,6 +1355,11 @@ static int wpa_driver_nl80211_init_nl(st
+ 	eloop_register_read_sock(nl_socket_get_fd(drv->nl_handle_event),
+ 				 wpa_driver_nl80211_event_receive, drv, ctx);
+ 
++#ifdef HOSTAPD
++	drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
++	drv->if_indices = drv->default_if_indices;
++#endif
++
+ 	return 0;
+ 
+ err4:
+@@ -4867,8 +4880,6 @@ static void *i802_init(struct hostapd_da
+ 		br_ifindex = 0;
+ 	}
+ 
+-	drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
+-	drv->if_indices = drv->default_if_indices;
+ 	for (i = 0; i < params->num_bridge; i++) {
+ 		if (params->bridge[i]) {
+ 			ifindex = if_nametoindex(params->bridge[i]);
diff --git a/package/hostapd/patches/440-mbss_reload_fix.patch b/package/hostapd/patches/440-mbss_reload_fix.patch
new file mode 100644
index 000000000..ed513b1f1
--- /dev/null
+++ b/package/hostapd/patches/440-mbss_reload_fix.patch
@@ -0,0 +1,89 @@
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -42,37 +42,8 @@ static int hostapd_setup_encryption(char
+ 
+ extern int wpa_debug_level;
+ 
+-
+-int hostapd_reload_config(struct hostapd_iface *iface)
++static int hostapd_reload_bss(struct hostapd_data *hapd)
+ {
+-	struct hostapd_data *hapd = iface->bss[0];
+-	struct hostapd_config *newconf, *oldconf;
+-	size_t j;
+-
+-	if (iface->config_read_cb == NULL)
+-		return -1;
+-	newconf = iface->config_read_cb(iface->config_fname);
+-	if (newconf == NULL)
+-		return -1;
+-
+-	/*
+-	 * Deauthenticate all stations since the new configuration may not
+-	 * allow them to use the BSS anymore.
+-	 */
+-	for (j = 0; j < iface->num_bss; j++)
+-		hostapd_flush_old_stations(iface->bss[j]);
+-
+-#ifndef CONFIG_NO_RADIUS
+-	/* TODO: update dynamic data based on changed configuration
+-	 * items (e.g., open/close sockets, etc.) */
+-	radius_client_flush(hapd->radius, 0);
+-#endif /* CONFIG_NO_RADIUS */
+-
+-	oldconf = hapd->iconf;
+-	hapd->iconf = newconf;
+-	hapd->conf = &newconf->bss[0];
+-	iface->conf = newconf;
+-
+ 	if (hostapd_setup_wpa_psk(hapd->conf)) {
+ 		wpa_printf(MSG_ERROR, "Failed to re-configure WPA PSK "
+ 			   "after reloading configuration");
+@@ -110,10 +81,46 @@ int hostapd_reload_config(struct hostapd
+ 		wpa_printf(MSG_ERROR, "Could not set SSID for kernel driver");
+ 		/* try to continue */
+ 	}
++	wpa_printf(MSG_DEBUG, "Reconfigured interface %s", hapd->conf->iface);
++}
++
++int hostapd_reload_config(struct hostapd_iface *iface)
++{
++	struct hostapd_data *hapd = iface->bss[0];
++	struct hostapd_config *newconf, *oldconf;
++	size_t j;
++
++	if (iface->config_read_cb == NULL)
++		return -1;
++	newconf = iface->config_read_cb(iface->config_fname);
++	if (newconf == NULL)
++		return -1;
++
++	/*
++	 * Deauthenticate all stations since the new configuration may not
++	 * allow them to use the BSS anymore.
++	 */
++	for (j = 0; j < iface->num_bss; j++)
++		hostapd_flush_old_stations(iface->bss[j]);
++
++#ifndef CONFIG_NO_RADIUS
++	/* TODO: update dynamic data based on changed configuration
++	 * items (e.g., open/close sockets, etc.) */
++	radius_client_flush(hapd->radius, 0);
++#endif /* CONFIG_NO_RADIUS */
++
++	oldconf = hapd->iconf;
++	iface->conf = newconf;
++
++	for (j = 0; j < iface->num_bss; j++) {
++		hapd = iface->bss[j];
++		hapd->iconf = newconf;
++		hapd->conf = &newconf->bss[j];
++		hostapd_reload_bss(hapd);
++	}
+ 
+ 	hostapd_config_free(oldconf);
+ 
+-	wpa_printf(MSG_DEBUG, "Reconfigured interface %s", hapd->conf->iface);
+ 
+ 	return 0;
+ }
diff --git a/package/hostapd/patches/450-reload_settings.patch b/package/hostapd/patches/450-reload_settings.patch
new file mode 100644
index 000000000..5f226124c
--- /dev/null
+++ b/package/hostapd/patches/450-reload_settings.patch
@@ -0,0 +1,13 @@
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -112,6 +112,10 @@ int hostapd_reload_config(struct hostapd
+ 	oldconf = hapd->iconf;
+ 	iface->conf = newconf;
+ 
++	iface->freq = hostapd_hw_get_freq(hapd, hapd->iconf->channel);
++	if (iface->current_mode)
++		hostapd_prepare_rates(hapd, iface->current_mode);
++
+ 	for (j = 0; j < iface->num_bss; j++) {
+ 		hapd = iface->bss[j];
+ 		hapd->iconf = newconf;
diff --git a/package/hostapd/patches/451-nl80211_del_beacon_bss.patch b/package/hostapd/patches/451-nl80211_del_beacon_bss.patch
new file mode 100644
index 000000000..b23acc6f0
--- /dev/null
+++ b/package/hostapd/patches/451-nl80211_del_beacon_bss.patch
@@ -0,0 +1,63 @@
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -1604,23 +1604,41 @@ wpa_driver_nl80211_finish_drv_init(struc
+ }
+ 
+ 
+-static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
++static int wpa_driver_nl80211_del_bss_beacon(struct i802_bss *bss)
+ {
++	struct wpa_driver_nl80211_data *drv = bss->drv;
+ 	struct nl_msg *msg;
+ 
++	bss->beacon_set = 0;
++
+ 	msg = nlmsg_alloc();
+ 	if (!msg)
+ 		return -ENOMEM;
+ 
+ 	genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
+ 		    0, NL80211_CMD_DEL_BEACON, 0);
+-	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
++	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
+ 
+ 	return send_and_recv_msgs(drv, msg, NULL, NULL);
+  nla_put_failure:
++	nlmsg_free(msg);
+ 	return -ENOBUFS;
+ }
+ 
++static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
++{
++	struct i802_bss *bss;
++
++	for (bss = &drv->first_bss; bss; bss = bss->next)
++		wpa_driver_nl80211_del_bss_beacon(bss);
++}
++
++static int wpa_driver_nl80211_stop_ap(void *priv)
++{
++	struct i802_bss *bss = priv;
++
++	wpa_driver_nl80211_del_beacon(bss->drv);
++}
+ 
+ /**
+  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
+@@ -5512,4 +5530,5 @@ const struct wpa_driver_ops wpa_driver_n
+ 	.send_ft_action = nl80211_send_ft_action,
+ 	.signal_monitor = nl80211_signal_monitor,
+ 	.send_frame = nl80211_send_frame,
++	.stop_ap = wpa_driver_nl80211_stop_ap,
+ };
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1774,6 +1774,8 @@ struct wpa_driver_ops {
+ 	 */
+ 	int (*send_frame)(void *priv, const u8 *data, size_t data_len,
+ 			  int encrypt);
++
++	int (*stop_ap)(void *priv);
+ };
+ 
+ 
diff --git a/package/hostapd/patches/452-ctrl_iface_reload.patch b/package/hostapd/patches/452-ctrl_iface_reload.patch
new file mode 100644
index 000000000..e07ab6d44
--- /dev/null
+++ b/package/hostapd/patches/452-ctrl_iface_reload.patch
@@ -0,0 +1,96 @@
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -35,6 +35,7 @@
+ #include "ap/wps_hostapd.h"
+ #include "ap/ctrl_iface_ap.h"
+ #include "ctrl_iface.h"
++#include "config_file.h"
+ 
+ 
+ struct wpa_ctrl_dst {
+@@ -45,6 +46,7 @@ struct wpa_ctrl_dst {
+ 	int errors;
+ };
+ 
++static char *reload_opts = NULL;
+ 
+ static void hostapd_ctrl_iface_send(struct hostapd_data *hapd, int level,
+ 				    const char *buf, size_t len);
+@@ -315,6 +317,66 @@ static int hostapd_ctrl_iface_wps_oob(st
+ #endif /* CONFIG_WPS_OOB */
+ #endif /* CONFIG_WPS */
+ 
++static int hostapd_ctrl_iface_set_down(struct hostapd_data *hapd)
++{
++	if (hapd->driver->stop_ap)
++		hapd->driver->stop_ap(hapd->drv_priv);
++	return 0;
++}
++
++static char *get_option(char *opt, char *str)
++{
++	int len = strlen(str);
++
++	if (!strncmp(opt, str, len))
++		return opt + len;
++	else
++		return NULL;
++}
++
++static struct hostapd_config *hostapd_ctrl_iface_config_read(const char *fname)
++{
++	struct hostapd_config *conf;
++	char *opt, *val;
++
++	conf = hostapd_config_read(fname);
++	if (!conf)
++		return NULL;
++
++	for (opt = strtok(reload_opts, " ");
++	     opt;
++		 opt = strtok(NULL, " ")) {
++
++		if ((val = get_option(opt, "channel=")))
++			conf->channel = atoi(val);
++		else if ((val = get_option(opt, "ht_capab=")))
++			conf->ht_capab = atoi(val);
++		else if ((val = get_option(opt, "ht_capab_mask=")))
++			conf->ht_capab &= atoi(val);
++		else if ((val = get_option(opt, "sec_chan=")))
++			conf->secondary_channel = atoi(val);
++		else if ((val = get_option(opt, "hwmode=")))
++			conf->hw_mode = atoi(val);
++		else if ((val = get_option(opt, "ieee80211n=")))
++			conf->ieee80211n = atoi(val);
++		else
++			break;
++	}
++
++	return conf;
++}
++
++static int hostapd_ctrl_iface_reload(struct hostapd_data *hapd, char *txt)
++{
++	struct hostapd_iface *iface = hapd->iface;
++
++	iface->config_read_cb = hostapd_ctrl_iface_config_read;
++	reload_opts = txt;
++
++	hostapd_reload_config(iface);
++
++	iface->config_read_cb = hostapd_config_read;
++}
+ 
+ static void hostapd_ctrl_iface_receive(int sock, void *eloop_ctx,
+ 				       void *sock_ctx)
+@@ -379,6 +441,10 @@ static void hostapd_ctrl_iface_receive(i
+ 				reply_len += res;
+ 		}
+ #endif /* CONFIG_NO_RADIUS */
++	} else if (os_strcmp(buf, "DOWN") == 0) {
++		hostapd_ctrl_iface_set_down(hapd);
++	} else if (os_strncmp(buf, "RELOAD ", 7) == 0) {
++		hostapd_ctrl_iface_reload(hapd, buf + 7);
+ 	} else if (os_strcmp(buf, "STA-FIRST") == 0) {
+ 		reply_len = hostapd_ctrl_iface_sta_first(hapd, reply,
+ 							 reply_size);
diff --git a/package/hostapd/patches/453-ap_sta_support.patch b/package/hostapd/patches/453-ap_sta_support.patch
new file mode 100644
index 000000000..930981dd3
--- /dev/null
+++ b/package/hostapd/patches/453-ap_sta_support.patch
@@ -0,0 +1,211 @@
+--- a/wpa_supplicant/wpa_supplicant_i.h
++++ b/wpa_supplicant/wpa_supplicant_i.h
+@@ -98,6 +98,8 @@ struct wpa_interface {
+ 	 * receiving of EAPOL frames from an additional interface.
+ 	 */
+ 	const char *bridge_ifname;
++
++	const char *hostapd_ctrl;
+ };
+ 
+ /**
+@@ -316,6 +318,8 @@ struct wpa_supplicant {
+ #endif /* CONFIG_CTRL_IFACE_DBUS_NEW */
+ 	char bridge_ifname[16];
+ 
++	struct wpa_ctrl *hostapd;
++
+ 	char *confname;
+ 	struct wpa_config *conf;
+ 	int countermeasures;
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -51,6 +51,11 @@ OBJS_p += ../src/utils/wpa_debug.o
+ OBJS_p += ../src/utils/wpabuf.o
+ OBJS_c = wpa_cli.o ../src/common/wpa_ctrl.o
+ 
++ifdef MULTICALL
++OBJS += ../src/common/wpa_ctrl.o
++CFLAGS += -DMULTICALL
++endif
++
+ -include .config
+ -include $(if $(MULTICALL),../hostapd/.config)
+ 
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -120,6 +120,55 @@ extern int wpa_debug_show_keys;
+ extern int wpa_debug_timestamp;
+ extern struct wpa_driver_ops *wpa_drivers[];
+ 
++#ifdef MULTICALL
++static int hostapd_stop(struct wpa_supplicant *wpa_s)
++{
++	const char *cmd = "DOWN";
++	char buf[256];
++	int len = sizeof(buf);
++
++	if (wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL) < 0) {
++		wpa_printf(MSG_ERROR, "\nFailed to stop hostapd AP interfaces\n");
++		return -1;
++	}
++	return 0;
++}
++
++static int hostapd_reload(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
++{
++	char *cmd = NULL;
++	char buf[256];
++	int len = sizeof(buf);
++	int channel, hw_mode;
++	int ret;
++
++	if (!bss)
++		return;
++
++	if (bss->freq < 4000) {
++		hw_mode = HOSTAPD_MODE_IEEE80211G;
++		channel = (bss->freq - 2407) / 5;
++	} else {
++		hw_mode = HOSTAPD_MODE_IEEE80211A;
++		channel = (bss->freq - 5000) / 5;
++	}
++
++	if (asprintf(&cmd, "RELOAD channel=%d sec_chan=0 hw_mode=%d ieee80211n=%d",
++		     channel, hw_mode, !!bss->ht_capab) < 0) {
++		return -1;
++	}
++
++	ret = wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL);
++	free(cmd);
++
++	if (ret < 0) {
++		wpa_printf(MSG_ERROR, "\nFailed to reload hostapd AP interfaces\n");
++		return -1;
++	}
++	return 0;
++}
++#endif
++
+ /* Configure default/group WEP keys for static WEP */
+ int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
+ {
+@@ -548,8 +597,16 @@ void wpa_supplicant_set_state(struct wpa
+ #ifndef IEEE8021X_EAPOL
+ 		wpa_drv_set_supp_port(wpa_s, 1);
+ #endif
++#ifdef MULTICALL
++		if (wpa_s->hostapd)
++			hostapd_reload(wpa_s, wpa_s->current_bss);
++#endif
+ 	} else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
+ 		   state == WPA_ASSOCIATED) {
++#ifdef MULTICALL
++		if (wpa_s->hostapd)
++			hostapd_stop(wpa_s);
++#endif
+ 		wpa_s->new_connection = 1;
+ 		wpa_drv_set_operstate(wpa_s, 0);
+ #ifndef IEEE8021X_EAPOL
+@@ -1957,6 +2014,21 @@ static int wpa_supplicant_init_iface(str
+ 		os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
+ 			   sizeof(wpa_s->bridge_ifname));
+ 	}
++#ifdef MULTICALL
++	if (iface->hostapd_ctrl) {
++		char *cmd = "DOWN";
++		char buf[256];
++		int len = sizeof(buf);
++
++		wpa_s->hostapd = wpa_ctrl_open(iface->hostapd_ctrl);
++		if (!wpa_s->hostapd) {
++			wpa_printf(MSG_ERROR, "\nFailed to connect to hostapd\n");
++			return -1;
++		}
++		if (hostapd_stop(wpa_s) < 0)
++			return -1;
++	}
++#endif
+ 
+ 	/* RSNA Supplicant Key Management - INITIALIZE */
+ 	eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
+--- a/wpa_supplicant/bss.c
++++ b/wpa_supplicant/bss.c
+@@ -17,6 +17,7 @@
+ #include "utils/common.h"
+ #include "utils/eloop.h"
+ #include "common/ieee802_11_defs.h"
++#include "common/ieee802_11_common.h"
+ #include "drivers/driver.h"
+ #include "wpa_supplicant_i.h"
+ #include "config.h"
+@@ -89,6 +90,8 @@ struct wpa_bss * wpa_bss_get(struct wpa_
+ 
+ static void wpa_bss_copy_res(struct wpa_bss *dst, struct wpa_scan_res *src)
+ {
++	struct ieee80211_ht_capabilities *capab;
++	struct ieee802_11_elems elems;
+ 	os_time_t usec;
+ 
+ 	dst->flags = src->flags;
+@@ -101,6 +104,12 @@ static void wpa_bss_copy_res(struct wpa_
+ 	dst->level = src->level;
+ 	dst->tsf = src->tsf;
+ 
++	memset(&elems, 0, sizeof(elems));
++	ieee802_11_parse_elems((u8 *) (src + 1), src->ie_len, &elems, 0);
++	capab = (struct ieee80211_ht_capabilities *) elems.ht_capabilities;
++	if (capab)
++		dst->ht_capab = le_to_host16(capab->ht_capabilities_info);
++
+ 	os_get_time(&dst->last_update);
+ 	dst->last_update.sec -= src->age / 1000;
+ 	usec = (src->age % 1000) * 1000;
+--- a/wpa_supplicant/bss.h
++++ b/wpa_supplicant/bss.h
+@@ -56,6 +56,7 @@ struct wpa_bss {
+ 	unsigned int flags;
+ 	u8 bssid[ETH_ALEN];
+ 	u8 ssid[32];
++	u16 ht_capab;
+ 	size_t ssid_len;
+ 	int freq;
+ 	u16 beacon_int;
+--- a/wpa_supplicant/main.c
++++ b/wpa_supplicant/main.c
+@@ -31,7 +31,7 @@ static void usage(void)
+ 	       "usage:\n"
+ 	       "  wpa_supplicant [-BddhKLqqstuvW] [-P<pid file>] "
+ 	       "[-g<global ctrl>] \\\n"
+-	       "        -i<ifname> -c<config file> [-C<ctrl>] [-D<driver>] "
++	       "        -i<ifname> -c<config file> [-C<ctrl>] [-D<driver>] [-H<hostapd path>]"
+ 	       "[-p<driver_param>] \\\n"
+ 	       "        [-b<br_ifname>] [-f<debug file>] \\\n"
+ 	       "        [-o<override driver>] [-O<override ctrl>] \\\n"
+@@ -67,6 +67,7 @@ static void usage(void)
+ #endif /* CONFIG_DEBUG_SYSLOG */
+ 	printf("  -t = include timestamp in debug messages\n"
+ 	       "  -h = show this help text\n"
++		   "  -H = connect to a hostapd instance to manage state changes\n"
+ 	       "  -L = show license (GPL and BSD)\n"
+ 	       "  -o = override driver parameter for new interfaces\n"
+ 	       "  -O = override ctrl_interface parameter for new interfaces\n"
+@@ -143,7 +144,7 @@ int main(int argc, char *argv[])
+ 	wpa_supplicant_fd_workaround();
+ 
+ 	for (;;) {
+-		c = getopt(argc, argv, "b:Bc:C:D:df:g:hi:KLNo:O:p:P:qstuvW");
++		c = getopt(argc, argv, "b:Bc:C:D:df:g:hH:i:KLNo:O:p:P:qstuvW");
+ 		if (c < 0)
+ 			break;
+ 		switch (c) {
+@@ -184,6 +185,9 @@ int main(int argc, char *argv[])
+ 			usage();
+ 			exitcode = 0;
+ 			goto out;
++		case 'H':
++			iface->hostapd_ctrl = optarg;
++			break;
+ 		case 'i':
+ 			iface->ifname = optarg;
+ 			break;
diff --git a/package/hostapd/patches/460-oper_state_fix.patch b/package/hostapd/patches/460-oper_state_fix.patch
new file mode 100644
index 000000000..5a685a23e
--- /dev/null
+++ b/package/hostapd/patches/460-oper_state_fix.patch
@@ -0,0 +1,25 @@
+From: Jouni Malinen <jouni.malinen@atheros.com>
+Date: Tue, 26 Oct 2010 13:30:28 +0000 (+0300)
+Subject: hostapd: Set operstate UP when initializing AP mode
+X-Git-Url: http://w1.fi/gitweb/gitweb.cgi?p=hostap.git;a=commitdiff_plain;h=e11f5a2cbc333113a3a1cc1aeea7f698c3936ca3
+
+hostapd: Set operstate UP when initializing AP mode
+
+This is needed to avoid problems with other applications setting and
+leaving the interface to IF_OPER_DORMANT state. In AP mode, the interface
+is ready immediately after the keys are set, so we better make sure the
+DORMANT state does not prevent normal operations after that.
+---
+
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -622,6 +622,9 @@ static int hostapd_setup_bss(struct host
+ 
+ 	ieee802_11_set_beacon(hapd);
+ 
++	if (hapd->driver && hapd->driver->set_operstate)
++		hapd->driver->set_operstate(hapd->drv_priv, 1);
++
+ 	return 0;
+ }
+ 
diff --git a/package/hotplug2/Makefile b/package/hotplug2/Makefile
index d02b435bd..898ec3073 100644
--- a/package/hotplug2/Makefile
+++ b/package/hotplug2/Makefile
@@ -15,7 +15,7 @@ PKG_RELEASE:=2
 PKG_SOURCE_PROTO:=svn
 PKG_SOURCE_VERSION:=$(PKG_REV)
 PKG_SOURCE_SUBDIR:=hotplug2-$(PKG_VERSION)
-PKG_SOURCE_URL:=http://svn.nomi.cz/svn/isteve/hotplug2 
+PKG_SOURCE_URL:=http://svn.nomi.cz/svn/isteve/hotplug2
 PKG_SOURCE:=$(PKG_SOURCE_SUBDIR).tar.gz
 #PKG_SOURCE_URL:=http://isteve.bofh.cz/~isteve/hotplug2
 #PKG_MD5SUM:=ea2c01d027b4002e4e6b0ff266f51a51
@@ -36,6 +36,10 @@ define Package/hotplug2/description
  This is an implementation of Hotplug2-1.0-beta
 endef
 
+define Package/hotplug2/conffiles
+/etc/hotplug2.rules
+endef
+
 MAKE_FLAGS += \
 	COPTS="$(TARGET_CFLAGS)" \
 	STATIC_WORKER="fork"
diff --git a/package/iproute2/Makefile b/package/iproute2/Makefile
index 9eec69e41..63f4dbc9d 100644
--- a/package/iproute2/Makefile
+++ b/package/iproute2/Makefile
@@ -30,6 +30,10 @@ $(call Package/iproute2/Default)
   TITLE:=Routing control utility
 endef
 
+define Package/ip/conffiles
+/etc/iproute2/rt_tables
+endef
+
 define Package/tc
 $(call Package/iproute2/Default)
   TITLE:=Traffic control utility
diff --git a/package/iptables/patches/011-iprange-linux-2.4-compat.patch b/package/iptables/patches/011-iprange-linux-2.4-compat.patch
new file mode 100644
index 000000000..b5a21fddd
--- /dev/null
+++ b/package/iptables/patches/011-iprange-linux-2.4-compat.patch
@@ -0,0 +1,24 @@
+--- a/extensions/libxt_iprange.c
++++ b/extensions/libxt_iprange.c
+@@ -96,7 +96,8 @@ static int iprange_parse(int c, char **a
+ 		if (invert)
+ 			info->flags |= IPRANGE_SRC_INV;
+ 		iprange_parse_range(optarg, range, NFPROTO_IPV4, "--src-range");
+-
++		info->src.min_ip = range[0].in.s_addr;
++		info->src.max_ip = range[1].in.s_addr;
+ 		break;
+ 
+ 	case '2':
+@@ -110,8 +111,9 @@ static int iprange_parse(int c, char **a
+ 		if (invert)
+ 			info->flags |= IPRANGE_DST_INV;
+ 
+-		iprange_parse_range(optarg, range, NFPROTO_IPV4, "--src-range");
+-
++		iprange_parse_range(optarg, range, NFPROTO_IPV4, "--dst-range");
++		info->dst.min_ip = range[0].in.s_addr;
++		info->dst.max_ip = range[1].in.s_addr;
+ 		break;
+ 
+ 	default:
diff --git a/package/iw/Makefile b/package/iw/Makefile
index 226e8ca59..d1d60c1c6 100644
--- a/package/iw/Makefile
+++ b/package/iw/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=iw
-PKG_VERSION:=0.9.19
+PKG_VERSION:=0.9.21
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=http://wireless.kernel.org/download/iw/
-PKG_MD5SUM:=3b88743f9c6ce8a7e2f5fd7d18fdea42
+PKG_MD5SUM:=726db5f1fd6bc316434414770513ef81
 PKG_BUILD_DEPENDS:=mac80211
 
 include $(INCLUDE_DIR)/package.mk
@@ -48,11 +48,9 @@ MAKE_FLAGS += \
 	LIBS="-lm -lnl-tiny" \
 	V=1
 
-ifneq ($(CONFIG_LINUX_2_6),)
-  define Package/iw/install
+define Package/iw/install
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/iw $(1)/usr/sbin/
-  endef
-endif
+endef
 
 $(eval $(call BuildPackage,iw))
diff --git a/package/iw/patches/001-nl80211_sync.patch b/package/iw/patches/001-nl80211_sync.patch
new file mode 100644
index 000000000..b3482d70e
--- /dev/null
+++ b/package/iw/patches/001-nl80211_sync.patch
@@ -0,0 +1,183 @@
+--- a/nl80211.h
++++ b/nl80211.h
+@@ -295,7 +295,9 @@
+  *	auth and assoc steps. For this, you need to specify the SSID in a
+  *	%NL80211_ATTR_SSID attribute, and can optionally specify the association
+  *	IEs in %NL80211_ATTR_IE, %NL80211_ATTR_AUTH_TYPE, %NL80211_ATTR_MAC,
+- *	%NL80211_ATTR_WIPHY_FREQ and %NL80211_ATTR_CONTROL_PORT.
++ *	%NL80211_ATTR_WIPHY_FREQ, %NL80211_ATTR_CONTROL_PORT,
++ *	%NL80211_ATTR_CONTROL_PORT_ETHERTYPE and
++ *	%NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT.
+  *	It is also sent as an event, with the BSSID and response IEs when the
+  *	connection is established or failed to be established. This can be
+  *	determined by the STATUS_CODE attribute.
+@@ -313,8 +315,8 @@
+  *	channel for the specified amount of time. This can be used to do
+  *	off-channel operations like transmit a Public Action frame and wait for
+  *	a response while being associated to an AP on another channel.
+- *	%NL80211_ATTR_WIPHY or %NL80211_ATTR_IFINDEX is used to specify which
+- *	radio is used. %NL80211_ATTR_WIPHY_FREQ is used to specify the
++ *	%NL80211_ATTR_IFINDEX is used to specify which interface (and thus
++ *	radio) is used. %NL80211_ATTR_WIPHY_FREQ is used to specify the
+  *	frequency for the operation and %NL80211_ATTR_WIPHY_CHANNEL_TYPE may be
+  *	optionally used to specify additional channel parameters.
+  *	%NL80211_ATTR_DURATION is used to specify the duration in milliseconds
+@@ -385,6 +387,8 @@
+  *	of any other interfaces, and other interfaces will again take
+  *	precedence when they are used.
+  *
++ * @NL80211_CMD_SET_WDS_PEER: Set the MAC address of the peer on a WDS interface.
++ *
+  * @NL80211_CMD_MAX: highest used command number
+  * @__NL80211_CMD_AFTER_LAST: internal use
+  */
+@@ -487,6 +491,7 @@ enum nl80211_commands {
+ 	NL80211_CMD_NOTIFY_CQM,
+ 
+ 	NL80211_CMD_SET_CHANNEL,
++	NL80211_CMD_SET_WDS_PEER,
+ 
+ 	/* add new commands above here */
+ 
+@@ -686,6 +691,15 @@ enum nl80211_commands {
+  *	request, the driver will assume that the port is unauthorized until
+  *	authorized by user space. Otherwise, port is marked authorized by
+  *	default in station mode.
++ * @NL80211_ATTR_CONTROL_PORT_ETHERTYPE: A 16-bit value indicating the
++ *	ethertype that will be used for key negotiation. It can be
++ *	specified with the associate and connect commands. If it is not
++ *	specified, the value defaults to 0x888E (PAE, 802.1X). This
++ *	attribute is also used as a flag in the wiphy information to
++ *	indicate that protocols other than PAE are supported.
++ * @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT: When included along with
++ *	%NL80211_ATTR_CONTROL_PORT_ETHERTYPE, indicates that the custom
++ *	ethertype frames used for key negotiation must not be encrypted.
+  *
+  * @NL80211_ATTR_TESTDATA: Testmode data blob, passed through to the driver.
+  *	We recommend using nested, driver-specific attributes within this.
+@@ -787,6 +801,11 @@ enum nl80211_commands {
+  *      This is used in association with @NL80211_ATTR_WIPHY_TX_POWER_SETTING
+  *      for non-automatic settings.
+  *
++ * @NL80211_ATTR_SUPPORT_IBSS_RSN: The device supports IBSS RSN, which mostly
++ *	means support for per-station GTKs.
++ *
++ * @NL80211_ATTR_MCAST_RATE: Multicast tx rate (in 100 kbps) for IBSS
++ *
+  * @NL80211_ATTR_MAX: highest attribute number currently defined
+  * @__NL80211_ATTR_AFTER_LAST: internal use
+  */
+@@ -951,6 +970,13 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_RX_FRAME_TYPES,
+ 	NL80211_ATTR_FRAME_TYPE,
+ 
++	NL80211_ATTR_CONTROL_PORT_ETHERTYPE,
++	NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT,
++
++	NL80211_ATTR_SUPPORT_IBSS_RSN,
++
++	NL80211_ATTR_MCAST_RATE,
++
+ 	/* add attributes here, update the policy in nl80211.c */
+ 
+ 	__NL80211_ATTR_AFTER_LAST,
+@@ -1006,6 +1032,8 @@ enum nl80211_attrs {
+  * @NL80211_IFTYPE_WDS: wireless distribution interface
+  * @NL80211_IFTYPE_MONITOR: monitor interface receiving all frames
+  * @NL80211_IFTYPE_MESH_POINT: mesh point
++ * @NL80211_IFTYPE_P2P_CLIENT: P2P client
++ * @NL80211_IFTYPE_P2P_GO: P2P group owner
+  * @NL80211_IFTYPE_MAX: highest interface type number currently defined
+  * @NUM_NL80211_IFTYPES: number of defined interface types
+  *
+@@ -1022,6 +1050,8 @@ enum nl80211_iftype {
+ 	NL80211_IFTYPE_WDS,
+ 	NL80211_IFTYPE_MONITOR,
+ 	NL80211_IFTYPE_MESH_POINT,
++	NL80211_IFTYPE_P2P_CLIENT,
++	NL80211_IFTYPE_P2P_GO,
+ 
+ 	/* keep last */
+ 	NUM_NL80211_IFTYPES,
+@@ -1111,6 +1141,8 @@ enum nl80211_rate_info {
+  * @NL80211_STA_INFO_RX_PACKETS: total received packet (u32, from this station)
+  * @NL80211_STA_INFO_TX_PACKETS: total transmitted packets (u32, to this
+  *	station)
++ * @NL80211_STA_INFO_TX_RETRIES: total retries (u32, to this station)
++ * @NL80211_STA_INFO_TX_FAILED: total failed packets (u32, to this station)
+  */
+ enum nl80211_sta_info {
+ 	__NL80211_STA_INFO_INVALID,
+@@ -1124,6 +1156,8 @@ enum nl80211_sta_info {
+ 	NL80211_STA_INFO_TX_BITRATE,
+ 	NL80211_STA_INFO_RX_PACKETS,
+ 	NL80211_STA_INFO_TX_PACKETS,
++	NL80211_STA_INFO_TX_RETRIES,
++	NL80211_STA_INFO_TX_FAILED,
+ 
+ 	/* keep last */
+ 	__NL80211_STA_INFO_AFTER_LAST,
+@@ -1382,6 +1416,17 @@ enum nl80211_reg_rule_flags {
+  * @__NL80211_SURVEY_INFO_INVALID: attribute number 0 is reserved
+  * @NL80211_SURVEY_INFO_FREQUENCY: center frequency of channel
+  * @NL80211_SURVEY_INFO_NOISE: noise level of channel (u8, dBm)
++ * @NL80211_SURVEY_INFO_IN_USE: channel is currently being used
++ * @NL80211_SURVEY_INFO_CHANNEL_TIME: amount of time (in ms) that the radio
++ *	spent on this channel
++ * @NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY: amount of the time the primary
++ *	channel was sensed busy (either due to activity or energy detect)
++ * @NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY: amount of time the extension
++ *	channel was sensed busy
++ * @NL80211_SURVEY_INFO_CHANNEL_TIME_RX: amount of time the radio spent
++ *	receiving data
++ * @NL80211_SURVEY_INFO_CHANNEL_TIME_TX: amount of time the radio spent
++ *	transmitting data
+  * @NL80211_SURVEY_INFO_MAX: highest survey info attribute number
+  *	currently defined
+  * @__NL80211_SURVEY_INFO_AFTER_LAST: internal use
+@@ -1390,6 +1435,12 @@ enum nl80211_survey_info {
+ 	__NL80211_SURVEY_INFO_INVALID,
+ 	NL80211_SURVEY_INFO_FREQUENCY,
+ 	NL80211_SURVEY_INFO_NOISE,
++	NL80211_SURVEY_INFO_IN_USE,
++	NL80211_SURVEY_INFO_CHANNEL_TIME,
++	NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
++	NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
++	NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
++	NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
+ 
+ 	/* keep last */
+ 	__NL80211_SURVEY_INFO_AFTER_LAST,
+@@ -1636,11 +1687,14 @@ enum nl80211_auth_type {
+  * @NL80211_KEYTYPE_GROUP: Group (broadcast/multicast) key
+  * @NL80211_KEYTYPE_PAIRWISE: Pairwise (unicast/individual) key
+  * @NL80211_KEYTYPE_PEERKEY: PeerKey (DLS)
++ * @NUM_NL80211_KEYTYPES: number of defined key types
+  */
+ enum nl80211_key_type {
+ 	NL80211_KEYTYPE_GROUP,
+ 	NL80211_KEYTYPE_PAIRWISE,
+ 	NL80211_KEYTYPE_PEERKEY,
++
++	NUM_NL80211_KEYTYPES
+ };
+ 
+ /**
+@@ -1671,6 +1725,9 @@ enum nl80211_wpa_versions {
+  *	CCMP keys, each six bytes in little endian
+  * @NL80211_KEY_DEFAULT: flag indicating default key
+  * @NL80211_KEY_DEFAULT_MGMT: flag indicating default management key
++ * @NL80211_KEY_TYPE: the key type from enum nl80211_key_type, if not
++ *	specified the default depends on whether a MAC address was
++ *	given with the command using the key or not (u32)
+  * @__NL80211_KEY_AFTER_LAST: internal
+  * @NL80211_KEY_MAX: highest key attribute
+  */
+@@ -1682,6 +1739,7 @@ enum nl80211_key_attributes {
+ 	NL80211_KEY_SEQ,
+ 	NL80211_KEY_DEFAULT,
+ 	NL80211_KEY_DEFAULT_MGMT,
++	NL80211_KEY_TYPE,
+ 
+ 	/* keep last */
+ 	__NL80211_KEY_AFTER_LAST,
diff --git a/package/iw/patches/001-sync_nl80211_h.patch b/package/iw/patches/001-sync_nl80211_h.patch
deleted file mode 100644
index fecb35d25..000000000
--- a/package/iw/patches/001-sync_nl80211_h.patch
+++ /dev/null
@@ -1,167 +0,0 @@
---- a/nl80211.h
-+++ b/nl80211.h
-@@ -270,6 +270,35 @@
-  * @NL80211_CMD_SET_WIPHY_NETNS: Set a wiphy's netns. Note that all devices
-  *	associated with this wiphy must be down and will follow.
-  *
-+ * @NL80211_CMD_REMAIN_ON_CHANNEL: Request to remain awake on the specified
-+ *	channel for the specified amount of time. This can be used to do
-+ *	off-channel operations like transmit a Public Action frame and wait for
-+ *	a response while being associated to an AP on another channel.
-+ *	%NL80211_ATTR_WIPHY or %NL80211_ATTR_IFINDEX is used to specify which
-+ *	radio is used. %NL80211_ATTR_WIPHY_FREQ is used to specify the
-+ *	frequency for the operation and %NL80211_ATTR_WIPHY_CHANNEL_TYPE may be
-+ *	optionally used to specify additional channel parameters.
-+ *	%NL80211_ATTR_DURATION is used to specify the duration in milliseconds
-+ *	to remain on the channel. This command is also used as an event to
-+ *	notify when the requested duration starts (it may take a while for the
-+ *	driver to schedule this time due to other concurrent needs for the
-+ *	radio).
-+ *	When called, this operation returns a cookie (%NL80211_ATTR_COOKIE)
-+ *	that will be included with any events pertaining to this request;
-+ *	the cookie is also used to cancel the request.
-+ * @NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL: This command can be used to cancel a
-+ *	pending remain-on-channel duration if the desired operation has been
-+ *	completed prior to expiration of the originally requested duration.
-+ *	%NL80211_ATTR_WIPHY or %NL80211_ATTR_IFINDEX is used to specify the
-+ *	radio. The %NL80211_ATTR_COOKIE attribute must be given as well to
-+ *	uniquely identify the request.
-+ *	This command is also used as an event to notify when a requested
-+ *	remain-on-channel duration has expired.
-+ *
-+ * @NL80211_CMD_SET_TX_BITRATE_MASK: Set the mask of rates to be used in TX
-+ *	rate selection. %NL80211_ATTR_IFINDEX is used to specify the interface
-+ *	and @NL80211_ATTR_TX_RATES the set of allowed rates.
-+ *
-  * @NL80211_CMD_MAX: highest used command number
-  * @__NL80211_CMD_AFTER_LAST: internal use
-  */
-@@ -349,6 +378,15 @@ enum nl80211_commands {
- 	NL80211_CMD_GET_SURVEY,
- 	NL80211_CMD_NEW_SURVEY_RESULTS,
- 
-+	NL80211_CMD_SET_PMKSA,
-+	NL80211_CMD_DEL_PMKSA,
-+	NL80211_CMD_FLUSH_PMKSA,
-+
-+	NL80211_CMD_REMAIN_ON_CHANNEL,
-+	NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
-+
-+	NL80211_CMD_SET_TX_BITRATE_MASK,
-+
- 	/* add new commands above here */
- 
- 	/* used to define NL80211_CMD_MAX below */
-@@ -398,6 +436,8 @@ enum nl80211_commands {
-  * @NL80211_ATTR_WIPHY_RTS_THRESHOLD: RTS threshold (TX frames with length
-  *	larger than or equal to this use RTS/CTS handshake); allowed range:
-  *	0..65536, disable with (u32)-1; dot11RTSThreshold; u32
-+ * @NL80211_ATTR_WIPHY_COVERAGE_CLASS: Coverage Class as defined by IEEE 802.11
-+ *	section 7.3.2.9; dot11CoverageClass; u8
-  *
-  * @NL80211_ATTR_IFINDEX: network interface index of the device to operate on
-  * @NL80211_ATTR_IFNAME: network interface name
-@@ -598,6 +638,21 @@ enum nl80211_commands {
-  *      the survey response for %NL80211_CMD_GET_SURVEY, nested attribute
-  *      containing info as possible, see &enum survey_info.
-  *
-+ * @NL80211_ATTR_PMKID: PMK material for PMKSA caching.
-+ * @NL80211_ATTR_MAX_NUM_PMKIDS: maximum number of PMKIDs a firmware can
-+ *	cache, a wiphy attribute.
-+ *
-+ * @NL80211_ATTR_DURATION: Duration of an operation in milliseconds, u32.
-+ *
-+ * @NL80211_ATTR_COOKIE: Generic 64-bit cookie to identify objects.
-+ *
-+ * @NL80211_ATTR_TX_RATES: Nested set of attributes
-+ *	(enum nl80211_tx_rate_attributes) describing TX rates per band. The
-+ *	enum nl80211_band value is used as the index (nla_type() of the nested
-+ *	data. If a band is not included, it will be configured to allow all
-+ *	rates based on negotiated supported rates information. This attribute
-+ *	is used with %NL80211_CMD_SET_TX_BITRATE_MASK.
-+ *
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-  */
-@@ -732,6 +787,17 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_SURVEY_INFO,
- 
-+	NL80211_ATTR_PMKID,
-+	NL80211_ATTR_MAX_NUM_PMKIDS,
-+
-+	NL80211_ATTR_DURATION,
-+
-+	NL80211_ATTR_COOKIE,
-+
-+	NL80211_ATTR_WIPHY_COVERAGE_CLASS,
-+
-+	NL80211_ATTR_TX_RATES,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -1312,13 +1378,20 @@ enum nl80211_channel_type {
-  * @NL80211_BSS_BEACON_INTERVAL: beacon interval of the (I)BSS (u16)
-  * @NL80211_BSS_CAPABILITY: capability field (CPU order, u16)
-  * @NL80211_BSS_INFORMATION_ELEMENTS: binary attribute containing the
-- *	raw information elements from the probe response/beacon (bin)
-+ *	raw information elements from the probe response/beacon (bin);
-+ *	if the %NL80211_BSS_BEACON_IES attribute is present, the IEs here are
-+ *	from a Probe Response frame; otherwise they are from a Beacon frame.
-+ *	However, if the driver does not indicate the source of the IEs, these
-+ *	IEs may be from either frame subtype.
-  * @NL80211_BSS_SIGNAL_MBM: signal strength of probe response/beacon
-  *	in mBm (100 * dBm) (s32)
-  * @NL80211_BSS_SIGNAL_UNSPEC: signal strength of the probe response/beacon
-  *	in unspecified units, scaled to 0..100 (u8)
-  * @NL80211_BSS_STATUS: status, if this BSS is "used"
-  * @NL80211_BSS_SEEN_MS_AGO: age of this BSS entry in ms
-+ * @NL80211_BSS_BEACON_IES: binary attribute containing the raw information
-+ *	elements from a Beacon frame (bin); not present if no Beacon frame has
-+ *	yet been received
-  * @__NL80211_BSS_AFTER_LAST: internal
-  * @NL80211_BSS_MAX: highest BSS attribute
-  */
-@@ -1334,6 +1407,7 @@ enum nl80211_bss {
- 	NL80211_BSS_SIGNAL_UNSPEC,
- 	NL80211_BSS_STATUS,
- 	NL80211_BSS_SEEN_MS_AGO,
-+	NL80211_BSS_BEACON_IES,
- 
- 	/* keep last */
- 	__NL80211_BSS_AFTER_LAST,
-@@ -1431,4 +1505,33 @@ enum nl80211_key_attributes {
- 	NL80211_KEY_MAX = __NL80211_KEY_AFTER_LAST - 1
- };
- 
-+/**
-+ * enum nl80211_tx_rate_attributes - TX rate set attributes
-+ * @__NL80211_TXRATE_INVALID: invalid
-+ * @NL80211_TXRATE_LEGACY: Legacy (non-MCS) rates allowed for TX rate selection
-+ *	in an array of rates as defined in IEEE 802.11 7.3.2.2 (u8 values with
-+ *	1 = 500 kbps) but without the IE length restriction (at most
-+ *	%NL80211_MAX_SUPP_RATES in a single array).
-+ * @__NL80211_TXRATE_AFTER_LAST: internal
-+ * @NL80211_TXRATE_MAX: highest TX rate attribute
-+ */
-+enum nl80211_tx_rate_attributes {
-+	__NL80211_TXRATE_INVALID,
-+	NL80211_TXRATE_LEGACY,
-+
-+	/* keep last */
-+	__NL80211_TXRATE_AFTER_LAST,
-+	NL80211_TXRATE_MAX = __NL80211_TXRATE_AFTER_LAST - 1
-+};
-+
-+/**
-+ * enum nl80211_band - Frequency band
-+ * @NL80211_BAND_2GHZ - 2.4 GHz ISM band
-+ * @NL80211_BAND_5GHZ - around 5 GHz band (4.9 - 5.7 GHz)
-+ */
-+enum nl80211_band {
-+	NL80211_BAND_2GHZ,
-+	NL80211_BAND_5GHZ,
-+};
-+
- #endif /* __LINUX_NL80211_H */
diff --git a/package/iw/patches/100-coverage_class.patch b/package/iw/patches/100-coverage_class.patch
deleted file mode 100644
index 8e18e038d..000000000
--- a/package/iw/patches/100-coverage_class.patch
+++ /dev/null
@@ -1,81 +0,0 @@
---- a/info.c
-+++ b/info.c
-@@ -156,6 +156,14 @@ static int print_phy_handler(struct nl_m
- 			printf("\tRTS threshold: %d\n", rts);
- 	}
- 
-+	if (tb_msg[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
-+		unsigned char coverage;
-+
-+		coverage = nla_get_u8(tb_msg[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
-+		/* See handle_distance() for an explanation where the '450' comes from */
-+		printf("\tCoverage class: %d (up to %dm)\n", coverage, 450 * coverage);
-+	}
-+
- 	if (!tb_msg[NL80211_ATTR_SUPPORTED_IFTYPES])
- 		goto commands;
- 
---- a/phy.c
-+++ b/phy.c
-@@ -164,3 +164,61 @@ static int handle_netns(struct nl80211_s
- COMMAND(set, netns, "<pid>",
- 	NL80211_CMD_SET_WIPHY_NETNS, 0, CIB_PHY, handle_netns,
- 	"Put this wireless device into a different network namespace");
-+
-+static int handle_coverage(struct nl80211_state *state,
-+			struct nl_cb *cb,
-+			struct nl_msg *msg,
-+			int argc, char **argv)
-+{
-+	unsigned int coverage;
-+
-+	if (argc != 1)
-+		return 1;
-+
-+	coverage = strtoul(argv[0], NULL, 10);
-+	if (coverage > 255)
-+		return 1;
-+	
-+	NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS, coverage);
-+
-+	return 0;
-+ nla_put_failure:
-+	return -ENOBUFS;
-+}
-+COMMAND(set, coverage, "<coverage class>",
-+	NL80211_CMD_SET_WIPHY, 0, CIB_PHY, handle_coverage,
-+	"Set coverage class (1 for every 3 usec of air propagation time).\n"
-+	"Valid values: 0 - 255.");
-+
-+static int handle_distance(struct nl80211_state *state,
-+			struct nl_cb *cb,
-+			struct nl_msg *msg,
-+			int argc, char **argv)
-+{
-+	unsigned int distance, coverage;
-+
-+	if (argc != 1)
-+		return 1;
-+
-+	distance = strtoul(argv[0], NULL, 10);
-+	
-+	/*
-+	 * Divide double the distance by the speed of light in m/usec (300) to
-+	 * get round-trip time in microseconds and then divide the result by
-+	 * three to get coverage class as specified in IEEE 802.11-2007 table
-+	 * 7-27. Values are rounded upwards.
-+	 */
-+	coverage = (distance + 449) / 450;
-+	if (coverage > 255)
-+		return 1;
-+	
-+	NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS, coverage);
-+
-+	return 0;
-+ nla_put_failure:
-+	return -ENOBUFS;
-+}
-+COMMAND(set, distance, "<distance>",
-+	NL80211_CMD_SET_WIPHY, 0, CIB_PHY, handle_distance,
-+	"Set appropriate coverage class for given link distance in meters.\n"
-+	"Valid values: 0 - 114750");
diff --git a/package/iw/patches/100-survey_freq_in_use.patch b/package/iw/patches/100-survey_freq_in_use.patch
new file mode 100644
index 000000000..3933ae379
--- /dev/null
+++ b/package/iw/patches/100-survey_freq_in_use.patch
@@ -0,0 +1,14 @@
+--- a/survey.c
++++ b/survey.c
+@@ -44,8 +44,9 @@ static int print_survey_handler(struct n
+ 	}
+ 
+ 	if (sinfo[NL80211_SURVEY_INFO_FREQUENCY])
+-		printf("\tfrequency:\t%u MHz\n",
+-			nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]));
++		printf("\tfrequency:\t%u MHz%s\n",
++			nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]),
++			sinfo[NL80211_SURVEY_INFO_IN_USE] ? " [in use]" : "");
+ 	if (sinfo[NL80211_SURVEY_INFO_NOISE])
+ 		printf("\tnoise:\t\t%d dBm\n",
+ 			(int8_t)nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]));
diff --git a/package/iw/patches/110-freq.patch b/package/iw/patches/110-freq.patch
deleted file mode 100644
index f73d303bb..000000000
--- a/package/iw/patches/110-freq.patch
+++ /dev/null
@@ -1,30 +0,0 @@
---- a/interface.c
-+++ b/interface.c
-@@ -260,6 +260,27 @@ static int print_iface_handler(struct nl
- 		printf("%s\tifindex %d\n", indent, nla_get_u32(tb_msg[NL80211_ATTR_IFINDEX]));
- 	if (tb_msg[NL80211_ATTR_IFTYPE])
- 		printf("%s\ttype %s\n", indent, iftype_name(nla_get_u32(tb_msg[NL80211_ATTR_IFTYPE])));
-+	if (tb_msg[NL80211_ATTR_WIPHY_FREQ]) {
-+		const char *mode;
-+
-+		if (tb_msg[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
-+			switch(nla_get_u32(tb_msg[NL80211_ATTR_WIPHY_CHANNEL_TYPE])) {
-+			case NL80211_CHAN_HT20:
-+				mode = "HT20";
-+				break;
-+			case NL80211_CHAN_HT40PLUS:
-+				mode = "HT40+";
-+				break;
-+			case NL80211_CHAN_HT40MINUS:
-+				mode = "HT40-";
-+				break;
-+			default:
-+				mode = "";
-+			}
-+
-+		printf("%s\tfrequency %d MHz %s\n", indent, nla_get_u32(tb_msg[NL80211_ATTR_WIPHY_FREQ]), mode);
-+	}
-+
- 
- 	return NL_SKIP;
- }
diff --git a/package/iw/patches/110-survey_phy_stats.patch b/package/iw/patches/110-survey_phy_stats.patch
new file mode 100644
index 000000000..cdd5c2e48
--- /dev/null
+++ b/package/iw/patches/110-survey_phy_stats.patch
@@ -0,0 +1,32 @@
+--- a/survey.c
++++ b/survey.c
+@@ -44,12 +44,27 @@ static int print_survey_handler(struct n
+ 	}
+ 
+ 	if (sinfo[NL80211_SURVEY_INFO_FREQUENCY])
+-		printf("\tfrequency:\t%u MHz%s\n",
++		printf("\tfrequency:\t\t\t%u MHz%s\n",
+ 			nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]),
+ 			sinfo[NL80211_SURVEY_INFO_IN_USE] ? " [in use]" : "");
+ 	if (sinfo[NL80211_SURVEY_INFO_NOISE])
+-		printf("\tnoise:\t\t%d dBm\n",
++		printf("\tnoise:\t\t\t\t%d dBm\n",
+ 			(int8_t)nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]));
++	if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME])
++		printf("\tchannel active time:\t\t%lld ms\n",
++			(int64_t)nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]));
++	if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY])
++		printf("\tchannel busy time:\t\t%lld ms\n",
++			(int64_t)nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]));
++	if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY])
++		printf("\textension channel busy time:\t%lld ms\n",
++			(int64_t)nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY]));
++	if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX])
++		printf("\tchannel receive time:\t\t%lld ms\n",
++			(int64_t)nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]));
++	if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX])
++		printf("\tchannel transmit time:\t\t%lld ms\n",
++			(int64_t)nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]));
+ 	return NL_SKIP;
+ }
+ 
diff --git a/package/iw/patches/120-ibss_mcast_rate.patch b/package/iw/patches/120-ibss_mcast_rate.patch
new file mode 100644
index 000000000..acbd3e89a
--- /dev/null
+++ b/package/iw/patches/120-ibss_mcast_rate.patch
@@ -0,0 +1,32 @@
+--- a/ibss.c
++++ b/ibss.c
+@@ -83,6 +83,20 @@ static int join_ibss(struct nl80211_stat
+ 		argc--;
+ 	}
+ 
++	/* multicast rate */
++	if (argc > 1 && strcmp(argv[0], "mcast-rate") == 0) {
++		argv++;
++		argc--;
++
++		rate = strtod(argv[0], &end);
++		if (*end != '\0')
++			return 1;
++
++		NLA_PUT_U32(msg, NL80211_ATTR_MCAST_RATE, (int) rate * 10);
++		argv++;
++		argc--;
++	}
++
+ 	if (!argc)
+ 		return 0;
+ 
+@@ -109,7 +123,7 @@ COMMAND(ibss, leave, NULL,
+ 	"Leave the current IBSS cell.");
+ COMMAND(ibss, join,
+ 	"<SSID> <freq in MHz> [fixed-freq] [<fixed bssid>] "
+-	"[basic-rates <rate in Mbps,rate2,...>] [key d:0:abcde]",
++	"[basic-rates <rate in Mbps,rate2,...>] [mcast-rate <rate in Mbps>] [key d:0:abcde]",
+ 	NL80211_CMD_JOIN_IBSS, 0, CIB_NETDEV, join_ibss,
+ 	"Join the IBSS cell with the given SSID, if it doesn't exist create\n"
+ 	"it on the given frequency. When fixed frequency is requested, don't\n"
diff --git a/package/kernel/Makefile b/package/kernel/Makefile
index 75925df55..39e38f921 100644
--- a/package/kernel/Makefile
+++ b/package/kernel/Makefile
@@ -9,6 +9,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=kernel
+PKG_FLAGS:=hold
 
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/packages
 SCAN_DEPS=modules/*.mk
diff --git a/package/kernel/modules/netdevices.mk b/package/kernel/modules/netdevices.mk
index e2a00811c..586700f67 100644
--- a/package/kernel/modules/netdevices.mk
+++ b/package/kernel/modules/netdevices.mk
@@ -146,6 +146,22 @@ endef
 $(eval $(call KernelPackage,8139too))
 
 
+define KernelPackage/8139cp
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=RealTek RTL-8139C+ PCI Fast Ethernet Adapter kernel support
+  DEPENDS:=@TARGET_x86
+  KCONFIG:=CONFIG_8139CP
+  FILES:=$(LINUX_DIR)/drivers/net/8139cp.$(LINUX_KMOD_SUFFIX)
+  AUTOLOAD:=$(call AutoLoad,50,8139cp)
+endef
+
+define KernelPackage/8139cp/description
+ Kernel module for RealTek RTL-8139C+ PCI Fast Ethernet adapters.
+endef
+
+$(eval $(call KernelPackage,8139cp))
+
+
 define KernelPackage/r8169
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=RealTek RTL-8169 PCI Gigabit Ethernet Adapter kernel support
diff --git a/package/kernel/modules/video.mk b/package/kernel/modules/video.mk
index 1fcfcf184..ea28be061 100644
--- a/package/kernel/modules/video.mk
+++ b/package/kernel/modules/video.mk
@@ -85,7 +85,7 @@ $(eval $(call KernelPackage,video-konica))
 define KernelPackage/video-ov511
 $(call KernelPackage/video/Depends,@LINUX_2_6 @USB_SUPPORT +kmod-usb-core)
   TITLE:=OV511 USB webcam support
-  KCONFIG:=CONFIG_VIDEO_OV511
+  KCONFIG:=CONFIG_USB_OV511
   FILES:=$(LINUX_DIR)/drivers/media/video/ov511.$(LINUX_KMOD_SUFFIX)
   AUTOLOAD:=$(call AutoLoad,70,ov511)
 endef
diff --git a/package/lua/Makefile b/package/lua/Makefile
index 0a5e8f343..fdbbddc40 100644
--- a/package/lua/Makefile
+++ b/package/lua/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=lua
 PKG_VERSION:=5.1.4
-PKG_RELEASE:=6
+PKG_RELEASE:=7
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=http://www.lua.org/ftp/ \
diff --git a/package/lua/patches-host/011-lnum-use-double.patch b/package/lua/patches-host/011-lnum-use-double.patch
new file mode 100644
index 000000000..14c720bf1
--- /dev/null
+++ b/package/lua/patches-host/011-lnum-use-double.patch
@@ -0,0 +1,11 @@
+--- a/src/lnum_config.h
++++ b/src/lnum_config.h
+@@ -11,7 +11,7 @@
+ ** Default number modes
+ */
+ #if (!defined LNUM_DOUBLE) && (!defined LNUM_FLOAT) && (!defined LNUM_LDOUBLE)
+-# define LNUM_FLOAT
++# define LNUM_DOUBLE
+ #endif
+ #if (!defined LNUM_INT16) && (!defined LNUM_INT32) && (!defined LNUM_INT64)
+ # define LNUM_INT32
diff --git a/package/lua/patches/011-lnum-use-double.patch b/package/lua/patches/011-lnum-use-double.patch
new file mode 100644
index 000000000..14c720bf1
--- /dev/null
+++ b/package/lua/patches/011-lnum-use-double.patch
@@ -0,0 +1,11 @@
+--- a/src/lnum_config.h
++++ b/src/lnum_config.h
+@@ -11,7 +11,7 @@
+ ** Default number modes
+ */
+ #if (!defined LNUM_DOUBLE) && (!defined LNUM_FLOAT) && (!defined LNUM_LDOUBLE)
+-# define LNUM_FLOAT
++# define LNUM_DOUBLE
+ #endif
+ #if (!defined LNUM_INT16) && (!defined LNUM_INT32) && (!defined LNUM_INT64)
+ # define LNUM_INT32
diff --git a/package/mac80211/Makefile b/package/mac80211/Makefile
index e2451b395..84f03621c 100644
--- a/package/mac80211/Makefile
+++ b/package/mac80211/Makefile
@@ -10,23 +10,25 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=mac80211
 
-PKG_VERSION:=2010-07-29
+PKG_VERSION:=2010-10-19
 PKG_RELEASE:=1
 PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
 #	http://www.orbit-lab.org/kernel/compat-wireless-2.6/2010/11 \
 #	http://wireless.kernel.org/download/compat-wireless-2.6
-PKG_MD5SUM:=fcfb757939c4718efbf9c87ca59c6932
+PKG_MD5SUM:=3bad1752f0154baa57a4d94774bd2ccf
 
 PKG_SOURCE:=compat-wireless-$(PKG_VERSION).tar.bz2
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/compat-wireless-$(PKG_VERSION)
+PKG_BUILD_PARALLEL:=1
 
 PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_kmod-mac80211 \
 	CONFIG_PACKAGE_MAC80211_DEBUGFS \
-	CONFIG_PACKAGE_ATH9K_USE_MINSTREL \
 	CONFIG_PACKAGE_ATH_DEBUG \
 	CONFIG_ATH_USER_REGD \
 
+CARL9170_FW_VERSION:=1.8.8.2
+
 include $(INCLUDE_DIR)/package.mk
 
 WMENU:=Wireless Drivers
@@ -35,23 +37,23 @@ define KernelPackage/mac80211/Default
   SUBMENU:=$(WMENU)
   URL:=http://linuxwireless.org/
   MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
-  DEPENDS:=@!LINUX_2_4 @(!(TARGET_avr32||TARGET_ep93xx||TARGET_ps3||TARGET_pxcab)||BROKEN)
+  DEPENDS:=@(!(TARGET_avr32||TARGET_ep93xx||TARGET_ps3||TARGET_pxcab)||BROKEN)
 endef
 
 define KernelPackage/cfg80211
   $(call KernelPackage/mac80211/Default)
   TITLE:=cfg80211 - wireless configuration API
-  DEPENDS+= +wireless-tools +iw @!LINUX_2_6_25
+  DEPENDS+= +wireless-tools +iw @!LINUX_2_6_25 @!LINUX_2_4 +crda
 ifeq ($(strip $(call CompareKernelPatchVer,$(KERNEL_PATCHVER),ge,2.6.33)),1)
   FILES:= \
-	$(PKG_BUILD_DIR)/compat/compat.$(LINUX_KMOD_SUFFIX) \
-	$(PKG_BUILD_DIR)/net/wireless/cfg80211.$(LINUX_KMOD_SUFFIX)
+	$(PKG_BUILD_DIR)/compat/compat.ko \
+	$(PKG_BUILD_DIR)/net/wireless/cfg80211.ko
   AUTOLOAD:=$(call AutoLoad,20,compat cfg80211)
 else
   FILES:= \
-	$(PKG_BUILD_DIR)/compat/compat.$(LINUX_KMOD_SUFFIX) \
-	$(PKG_BUILD_DIR)/compat/compat_firmware_class.$(LINUX_KMOD_SUFFIX) \
-	$(PKG_BUILD_DIR)/net/wireless/cfg80211.$(LINUX_KMOD_SUFFIX)
+	$(PKG_BUILD_DIR)/compat/compat.ko \
+	$(PKG_BUILD_DIR)/compat/compat_firmware_class.ko \
+	$(PKG_BUILD_DIR)/net/wireless/cfg80211.ko
   AUTOLOAD:=$(call AutoLoad,20,compat compat_firmware_class cfg80211)
 endif
 endef
@@ -64,7 +66,7 @@ define KernelPackage/mac80211
   $(call KernelPackage/mac80211/Default)
   TITLE:=Linux 802.11 Wireless Networking Stack
   DEPENDS+= +kmod-crypto-core +kmod-crypto-arc4 +kmod-crypto-aes +kmod-cfg80211
-  FILES:= $(PKG_BUILD_DIR)/net/mac80211/mac80211.$(LINUX_KMOD_SUFFIX)
+  FILES:= $(PKG_BUILD_DIR)/net/mac80211/mac80211.ko
   AUTOLOAD:=$(call AutoLoad,21,mac80211)
   MENU:=1
 endef
@@ -92,6 +94,8 @@ endef
 # Prism54 drivers
 P54PCIFW:=2.13.12.0.arm
 P54USBFW:=2.13.24.0.lm87.arm
+P54SPIFW:=2.13.0.0.a.13.14.arm
+CARL9170_FW:=carl9170-1.fw
 
 define Download/p54usb
   FILE:=$(P54USBFW)
@@ -107,6 +111,20 @@ define Download/p54pci
 endef
 $(eval $(call Download,p54pci))
 
+define Download/p54spi
+  FILE:=$(P54SPIFW)
+  URL:=http://daemonizer.de/prism54/prism54-fw/stlc4560
+  MD5SUM:=42661f8ecbadd88012807493f596081d
+endef
+$(eval $(call Download,p54spi))
+
+define Download/carl9170
+  FILE:=$(CARL9170_FW)
+  URL:=http://www.kernel.org/pub/linux/kernel/people/chr/carl9170/fw/$(CARL9170_FW_VERSION)
+  MD5SUM:=114c43846ed1d2f89cc92bd0e2ec0589
+endef
+$(eval $(call Download,carl9170))
+
 define KernelPackage/p54/Default
   $(call KernelPackage/mac80211/Default)
   TITLE:=Prism54 Drivers
@@ -118,9 +136,9 @@ endef
 
 define KernelPackage/p54-common
   $(call KernelPackage/p54/Default)
-  DEPENDS+= @PCI_SUPPORT||@USB_SUPPORT +kmod-mac80211
+  DEPENDS+= @PCI_SUPPORT||@USB_SUPPORT||@TARGET_omap24xx +kmod-mac80211 +kmod-crc-ccitt
   TITLE+= (COMMON)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54common.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54common.ko
   AUTOLOAD:=$(call AutoLoad,30,p54common)
 endef
 
@@ -128,7 +146,7 @@ define KernelPackage/p54-pci
   $(call KernelPackage/p54/Default)
   TITLE+= (PCI)
   DEPENDS+= @PCI_SUPPORT +kmod-p54-common
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54pci.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54pci.ko
   AUTOLOAD:=$(call AutoLoad,31,p54pci)
 endef
 
@@ -136,10 +154,18 @@ define KernelPackage/p54-usb
   $(call KernelPackage/p54/Default)
   TITLE+= (USB)
   DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-p54-common
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54usb.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54usb.ko
   AUTOLOAD:=$(call AutoLoad,31,p54usb)
 endef
 
+define KernelPackage/p54-spi
+  $(call KernelPackage/p54/Default)
+  TITLE+= (SPI)
+  DEPENDS+= @TARGET_omap24xx +kmod-p54-common
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/p54/p54spi.ko
+  AUTOLOAD:=$(call AutoLoad,31,p54spi)
+endef
+
 # Ralink rt2x00 drivers
 RT61FW:=RT61_Firmware_V1.2.zip
 RT71FW:=RT71W_Firmware_V1.8.zip
@@ -197,7 +223,7 @@ define KernelPackage/rt2x00-lib
 $(call KernelPackage/rt2x00/Default)
   DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-mac80211 +kmod-crc-itu-t
   TITLE+= (LIB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00lib.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00lib.ko
   AUTOLOAD:=$(call AutoLoad,25,rt2x00lib)
   MENU:=1
 endef
@@ -226,7 +252,7 @@ define KernelPackage/rt2x00-pci
 $(call KernelPackage/rt2x00/Default)
   DEPENDS+= @(PCI_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-eeprom-93cx6
   TITLE+= (PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00pci.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00pci.ko
   AUTOLOAD:=$(call AutoLoad,26,rt2x00pci)
 endef
 
@@ -234,7 +260,7 @@ define KernelPackage/rt2x00-usb
 $(call KernelPackage/rt2x00/Default)
   DEPENDS+= @USB_SUPPORT +kmod-rt2x00-lib +kmod-usb-core
   TITLE+= (USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00usb.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00usb.ko
   AUTOLOAD:=$(call AutoLoad,26,rt2x00usb)
 endef
 
@@ -242,7 +268,7 @@ define KernelPackage/rt2x00-soc
 $(call KernelPackage/rt2x00/Default)
   DEPENDS+= @TARGET_ramips +kmod-rt2x00-lib
   TITLE+= (SoC)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00soc.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2x00soc.ko
   AUTOLOAD:=$(call AutoLoad,26,rt2x00soc)
 endef
 
@@ -250,7 +276,7 @@ define KernelPackage/rt2800-lib
 $(call KernelPackage/rt2x00/Default)
   DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +USB_SUPPORT:kmod-rt2x00-usb +TARGET_ramips:kmod-rt2x00-soc
   TITLE+= (rt2800 LIB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800lib.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800lib.ko
   AUTOLOAD:=$(call AutoLoad,27,rt2800lib)
 endef
 
@@ -258,7 +284,7 @@ define KernelPackage/rt2400-pci
 $(call KernelPackage/rt2x00/Default)
   DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci
   TITLE+= (RT2400 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2400pci.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2400pci.ko
   AUTOLOAD:=$(call AutoLoad,27,rt2400pci)
 endef
 
@@ -266,7 +292,7 @@ define KernelPackage/rt2500-pci
 $(call KernelPackage/rt2x00/Default)
   DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci
   TITLE+= (RT2500 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2500pci.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2500pci.ko
   AUTOLOAD:=$(call AutoLoad,27,rt2500pci)
 endef
 
@@ -274,7 +300,7 @@ define KernelPackage/rt2500-usb
 $(call KernelPackage/rt2x00/Default)
   DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb
   TITLE+= (RT2500 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2500usb.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2500usb.ko
   AUTOLOAD:=$(call AutoLoad,27,rt2500usb)
 endef
 
@@ -282,7 +308,7 @@ define KernelPackage/rt61-pci
 $(call KernelPackage/rt2x00/Default)
   DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci
   TITLE+= (RT2x61 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt61pci.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt61pci.ko
   AUTOLOAD:=$(call AutoLoad,27,rt61pci)
 endef
 
@@ -290,7 +316,7 @@ define KernelPackage/rt73-usb
   $(call KernelPackage/rt2x00/Default)
   DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb
   TITLE+= (RT73 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt73usb.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt73usb.ko
   AUTOLOAD:=$(call AutoLoad,27,rt73usb)
 endef
 
@@ -298,7 +324,7 @@ define KernelPackage/rt2800-pci
 $(call KernelPackage/rt2x00/Default)
   DEPENDS+= +kmod-rt2x00-pci +kmod-rt2800-lib +kmod-crc-ccitt +TARGET_ramips:kmod-rt2x00-soc
   TITLE+= (RT2860 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800pci.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800pci.ko
   AUTOLOAD:=$(call AutoLoad,28,rt2800pci)
 endef
 
@@ -306,7 +332,7 @@ define KernelPackage/rt2800-usb
 $(call KernelPackage/rt2x00/Default)
   DEPENDS+= +kmod-rt2x00-usb +kmod-rt2800-lib +kmod-crc-ccitt
   TITLE+= (RT2870 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800usb.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rt2x00/rt2800usb.ko
   AUTOLOAD:=$(call AutoLoad,28,rt2800usb)
 endef
 
@@ -321,7 +347,7 @@ define KernelPackage/rtl8180
   $(call KernelPackage/rtl818x/Default)
   DEPENDS+= @PCI_SUPPORT
   TITLE+= (RTL8180 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtl818x/rtl8180.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtl818x/rtl8180.ko
   AUTOLOAD:=$(call AutoLoad,27,rtl8180)
 endef
 
@@ -329,7 +355,7 @@ define KernelPackage/rtl8187
 $(call KernelPackage/rtl818x/Default)
   DEPENDS+= @USB_SUPPORT
   TITLE+= (RTL8187 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtl818x/rtl8187.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rtl818x/rtl8187.ko
   AUTOLOAD:=$(call AutoLoad,27,rtl8187)
 endef
 
@@ -346,7 +372,7 @@ define KernelPackage/zd1211rw
   $(call KernelPackage/mac80211/Default)
   TITLE:=Zydas ZD1211 support
   DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/zd1211rw/zd1211rw.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/zd1211rw/zd1211rw.ko
   AUTOLOAD:=$(call AutoLoad,60,zd1211rw)
 endef
 
@@ -378,7 +404,7 @@ define KernelPackage/ath
   $(call KernelPackage/mac80211/Default)
   TITLE:=Atheros common driver part
   DEPENDS+= @PCI_SUPPORT +kmod-mac80211
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath.ko
   AUTOLOAD:=$(call AutoLoad,26,ath)
   MENU:=1
 endef
@@ -392,7 +418,7 @@ define KernelPackage/ath5k
   TITLE:=Atheros 5xxx wireless cards support
   URL:=http://linuxwireless.org/en/users/Drivers/ath5k
   DEPENDS+= +kmod-ath
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath5k/ath5k.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath5k/ath5k.ko
   AUTOLOAD:=$(call AutoLoad,27,ath5k)
 endef
 
@@ -407,9 +433,9 @@ define KernelPackage/ath9k
   URL:=http://linuxwireless.org/en/users/Drivers/ath9k
   DEPENDS+= +kmod-ath
   FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_common.$(LINUX_KMOD_SUFFIX) \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_hw.$(LINUX_KMOD_SUFFIX) \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k.$(LINUX_KMOD_SUFFIX)
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_common.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_hw.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k.ko
   AUTOLOAD:=$(call AutoLoad,27,ath9k_hw ath9k_common ath9k)
   MENU:=1
 endef
@@ -419,17 +445,20 @@ This module adds support for wireless adapters based on
 Atheros IEEE 802.11n AR5008 and AR9001 family of chipsets.
 endef
 
-define KernelPackage/ath9k/config
-	menu "Configuration"
-		depends PACKAGE_kmod-ath9k
-
-	config PACKAGE_ATH9K_USE_MINSTREL
-		bool "use the new minstrel_ht rate control for ath9k"
-		default y
-
-	endmenu
+define KernelPackage/carl9170
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Driver for Atheros AR9170 USB sticks
+  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/carl9170/carl9170.ko
+  AUTOLOAD:=$(call AutoLoad,60,carl9170)
 endef
 
+define KernelPackage/carl9170/install
+	$(INSTALL_DIR) $(1)/lib/firmware
+	$(INSTALL_DATA) $(DL_DIR)/$(CARL9170_FW) $(1)/lib/firmware/
+endef
+
+
 USB8388FW_NAME:=usb8388
 USB8388FW_VERSION:=5.110.22.p23
 
@@ -464,8 +493,8 @@ define KernelPackage/libertas-usb
   DEPENDS+= @USB_SUPPORT +kmod-mac80211 +kmod-usb-core +kmod-lib80211
   TITLE:=Marvell 88W8015 Wireless Driver
   FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/libertas.$(LINUX_KMOD_SUFFIX) \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/usb8xxx.$(LINUX_KMOD_SUFFIX)
+	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/libertas.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/usb8xxx.ko
   AUTOLOAD:=$(call AutoLoad,27,libertas usb8xxx)
 endef
 
@@ -474,29 +503,16 @@ define KernelPackage/libertas-sd
   DEPENDS+= +kmod-mac80211 +kmod-lib80211
   TITLE:=Marvell 88W8686 Wireless Driver
   FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/libertas.$(LINUX_KMOD_SUFFIX) \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/libertas_sdio.$(LINUX_KMOD_SUFFIX)
+	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/libertas.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/libertas/libertas_sdio.ko
   AUTOLOAD:=$(call AutoLoad,27,libertas libertas_sdio)
 endef
 
-define KernelPackage/ar9170
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Atheros AR9170 802.11n USB support
-  URL:=http://wireless.kernel.org/en/users/Drivers/ar9170
-  DEPENDS+= @USB_SUPPORT @!LINUX_2_6_25 +kmod-ath +kmod-usb-core
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ar9170/ar9170usb.$(LINUX_KMOD_SUFFIX)
-  AUTOLOAD:=$(call AutoLoad,27,ar9170usb)
-endef
-
-define KernelPackage/ar9170/description
- This is a driver for the Atheros "otus" 802.11n USB devices.
-endef
-
 define KernelPackage/mac80211-hwsim
   $(call KernelPackage/mac80211/Default)
   TITLE:=mac80211 HW simulation device
   DEPENDS+= +kmod-mac80211
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mac80211_hwsim.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mac80211_hwsim.ko
   AUTOLOAD:=$(call AutoLoad,60,mac80211_hwsim)
 endef
 
@@ -504,7 +520,7 @@ define KernelPackage/net-libipw
   $(call KernelPackage/mac80211/Default)
   TITLE:=libipw for ipw2100 and ipw2200
   DEPENDS:=@PCI_SUPPORT +kmod-crypto-core +kmod-crypto-arc4 +kmod-crypto-aes +kmod-crypto-michael-mic +kmod-lib80211 +kmod-cfg80211
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ipw2x00/libipw.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ipw2x00/libipw.ko
   AUTOLOAD:=$(call AutoLoad,49,libipw)
 endef
 
@@ -526,7 +542,7 @@ define KernelPackage/net-ipw2100
   $(call KernelPackage/mac80211/Default)
   TITLE:=Intel IPW2100 driver
   DEPENDS:=@PCI_SUPPORT +kmod-net-libipw
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ipw2x00/ipw2100.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ipw2x00/ipw2100.ko
   AUTOLOAD:=$(call AutoLoad,50,ipw2100)
 endef
 
@@ -550,7 +566,7 @@ define KernelPackage/net-ipw2200
   $(call KernelPackage/mac80211/Default)
   TITLE:=Intel IPW2200 driver
   DEPENDS:=@PCI_SUPPORT +kmod-net-libipw
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ipw2x00/ipw2200.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ipw2x00/ipw2200.ko
   AUTOLOAD:=$(call AutoLoad,50,ipw2200)
 endef
 
@@ -566,7 +582,7 @@ define KernelPackage/mwl8k
   TITLE:=Driver for Marvell TOPDOG 802.11 Wireless cards
   URL:=http://wireless.kernel.org/en/users/Drivers/mwl8k
   DEPENDS+= @PCI_SUPPORT +kmod-mac80211
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mwl8k.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mwl8k.ko
   AUTOLOAD:=$(call AutoLoad,27,mwl8k)
 endef
 
@@ -661,7 +677,7 @@ endef
 define KernelPackage/b43
 $(call KernelPackage/b43-common)
   TITLE:=Broadcom 43xx wireless support
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/b43/b43.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/b43/b43.ko
   AUTOLOAD:=$(call AutoLoad,30,b43)
   MENU:=1
 endef
@@ -759,7 +775,7 @@ endef
 define KernelPackage/b43legacy
 $(call KernelPackage/b43-common)
   TITLE:=Broadcom 43xx-legacy wireless support
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/b43legacy/b43legacy.$(LINUX_KMOD_SUFFIX)
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/b43legacy/b43legacy.ko
   AUTOLOAD:=$(call AutoLoad,30,b43legacy)
   MENU:=1
 endef
@@ -804,12 +820,11 @@ BUILDFLAGS:= \
 	$(if $(CONFIG_PCI),-DCONFIG_B43_PCI_AUTOSELECT -DCONFIG_B43_PCICORE_AUTOSELECT) \
 	$(if $(CONFIG_LEDS_TRIGGERS), -DCONFIG_MAC80211_LEDS -DCONFIG_LEDS_TRIGGERS -DCONFIG_B43_LEDS -DCONFIG_B43LEGACY_LEDS -DCONFIG_AR9170_LEDS) \
 	-DCONFIG_B43_HWRNG -DCONFIG_B43LEGACY_HWRNG \
-	$(if $(CONFIG_PACKAGE_MAC80211_DEBUGFS),-DCONFIG_MAC80211_DEBUGFS -DCONFIG_ATH9K_DEBUGFS) \
+	$(if $(CONFIG_PACKAGE_MAC80211_DEBUGFS),-DCONFIG_MAC80211_DEBUGFS -DCONFIG_ATH9K_DEBUGFS -DCONFIG_CARL9170_DEBUGFS) \
 	$(if $(CONFIG_PACKAGE_ATH_DEBUG),-DCONFIG_ATH_DEBUG -DCONFIG_ATH9K_PKTLOG) \
 	-D__CONFIG_MAC80211_RC_DEFAULT=minstrel \
 	-DCONFIG_MAC80211_RC_MINSTREL_HT \
 	$(if $(CONFIG_ATH_USER_REGD),-DATH_USER_REGD=1) \
-	$(if $(CONFIG_PACKAGE_ATH9K_USE_MINSTREL),-DATH9K_USE_MINSTREL) \
 	$(if $(CONFIG_PACKAGE_RT2X00_LIB_DEBUGFS),-DCONFIG_RT2X00_LIB_DEBUGFS) \
 	$(if $(CONFIG_PACKAGE_RT2X00_DEBUG),-DCONFIG_RT2X00_DEBUG) \
 	$(if $(NEED_RT2X00_LIB_HT),-DCONFIG_RT2X00_LIB_HT) \
@@ -821,6 +836,7 @@ BUILDFLAGS:= \
 	$(if $(CONFIG_PACKAGE_kmod-rt2x00-soc),-DCONFIG_RT2X00_LIB_SOC) \
 	$(if $(CONFIG_PCI_SUPPORT),-DCONFIG_RT2800PCI_PCI) \
 	$(if $(CONFIG_TARGET_ramips),-DCONFIG_RT2800PCI_SOC) \
+	-DCONFIG_P54_SPI_DEFAULT_EEPROM
 
 MAKE_OPTS:= \
 	CROSS_COMPILE="$(KERNEL_CROSS)" \
@@ -845,12 +861,17 @@ MAKE_OPTS:= \
 	CONFIG_ATH9K_PKTLOG=$(if $(CONFIG_PACKAGE_ATH_DEBUG),y) \
 	CONFIG_ATH5K=$(if $(CONFIG_PACKAGE_kmod-ath5k),m) \
 	CONFIG_ATH9K=$(if $(CONFIG_PACKAGE_kmod-ath9k),m) \
+	CONFIG_ATH9K_HW=$(if $(CONFIG_PACKAGE_kmod-ath9k),m) \
+	CONFIG_ATH9K_COMMON=$(if $(CONFIG_PACKAGE_kmod-ath9k),m) \
 	CONFIG_ATH9K_DEBUGFS=$(if $(CONFIG_PACKAGE_MAC80211_DEBUGFS),y) \
+	CONFIG_CARL9170=$(if $(CONFIG_PACKAGE_kmod-carl9170),m) \
+	CONFIG_CARL9170_DEBUGFS=$(if $(CONFIG_PACKAGE_MAC80211_DEBUGFS),y) \
 	CONFIG_ZD1211RW=$(if $(CONFIG_PACKAGE_kmod-zd1211rw),m) \
 	CONFIG_P54_COMMON=$(if $(CONFIG_PACKAGE_kmod-p54-common),m) \
 	CONFIG_P54_PCI=$(if $(CONFIG_PACKAGE_kmod-p54-pci),m) \
 	CONFIG_P54_USB=$(if $(CONFIG_PACKAGE_kmod-p54-usb),m) \
-	CONFIG_P54_SPI= \
+	CONFIG_P54_SPI=$(if $(CONFIG_PACKAGE_kmod-p54-spi),m) \
+	CONFIG_P54_SPI_DEFAULT_EEPROM=y \
 	CONFIG_RT2X00=$(if $(CONFIG_PACKAGE_kmod-rt2x00-lib),m) \
 	CONFIG_RT2X00_LIB=$(if $(CONFIG_PACKAGE_kmod-rt2x00-lib),m) \
 	CONFIG_RT2X00_LIB_PCI=$(if $(CONFIG_PACKAGE_kmod-rt2x00-pci),m) \
@@ -890,6 +911,7 @@ MAKE_OPTS:= \
 	CONFIG_LIB80211_CRYPT_CCMP= \
 	CONFIG_LIB80211_CRYPT_TKIP= \
 	CONFIG_IWLWIFI= \
+	CONFIG_COMPAT_IWLWIFI= \
 	CONFIG_IWLAGN= \
 	CONFIG_MWL8K=$(if $(CONFIG_PACKAGE_kmod-mwl8k),m) \
 	CONFIG_ATMEL= \
@@ -935,7 +957,7 @@ endef
 ifneq ($(CONFIG_PACKAGE_kmod-cfg80211),)
  define Build/Compile/kmod
 	rm -rf $(PKG_BUILD_DIR)/modules
-	$(MAKE) -C "$(PKG_BUILD_DIR)" $(MAKE_OPTS) all
+	$(MAKE) $(PKG_JOBS) -C "$(PKG_BUILD_DIR)" $(MAKE_OPTS) all
  endef
 endif
 
@@ -980,6 +1002,11 @@ define KernelPackage/p54-usb/install
 	$(INSTALL_DATA) $(DL_DIR)/$(P54USBFW) $(1)/lib/firmware/isl3887usb
 endef
 
+define KernelPackage/p54-spi/install
+	$(INSTALL_DIR) $(1)/lib/firmware
+	$(INSTALL_DATA) $(DL_DIR)/$(P54SPIFW) $(1)/lib/firmware/3826.arm
+endef
+
 define KernelPackage/rt61-pci/install
 	$(INSTALL_DIR) $(1)/lib/firmware
 	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rt2?61*.bin $(1)/lib/firmware/
@@ -1076,6 +1103,7 @@ $(eval $(call KernelPackage,mac80211))
 $(eval $(call KernelPackage,p54-common))
 $(eval $(call KernelPackage,p54-pci))
 $(eval $(call KernelPackage,p54-usb))
+$(eval $(call KernelPackage,p54-spi))
 $(eval $(call KernelPackage,rt2x00-lib))
 $(eval $(call KernelPackage,rt2x00-pci))
 $(eval $(call KernelPackage,rt2x00-usb))
@@ -1094,7 +1122,7 @@ $(eval $(call KernelPackage,zd1211rw))
 $(eval $(call KernelPackage,mac80211-hwsim))
 $(eval $(call KernelPackage,ath9k))
 $(eval $(call KernelPackage,ath))
-$(eval $(call KernelPackage,ar9170))
+$(eval $(call KernelPackage,carl9170))
 $(eval $(call KernelPackage,b43))
 $(eval $(call KernelPackage,b43legacy))
 $(eval $(call KernelPackage,net-libipw))
diff --git a/package/mac80211/files/lib/wifi/mac80211.sh b/package/mac80211/files/lib/wifi/mac80211.sh
index 4390b657f..46c8c2af4 100644
--- a/package/mac80211/files/lib/wifi/mac80211.sh
+++ b/package/mac80211/files/lib/wifi/mac80211.sh
@@ -165,6 +165,14 @@ scan_mac80211() {
 	config_set "$device" vifs "${ap:+$ap }${adhoc:+$adhoc }${sta:+$sta }${monitor:+$monitor }${mesh:+$mesh}"
 }
 
+list_phy_interfaces() {
+	local phy="$1"
+	if [ -d "/sys/class/ieee80211/${phy}/device/net" ]; then
+		ls "/sys/class/ieee80211/${phy}/device/net" 2>/dev/null;
+	else
+		ls "/sys/class/ieee80211/${phy}/device" 2>/dev/null | grep net: | sed -e 's,net:,,g'
+	fi
+}
 
 disable_mac80211() (
 	local device="$1"
@@ -181,7 +189,7 @@ disable_mac80211() (
 	done
 
 	include /lib/network
-	for wdev in $(ls /sys/class/ieee80211/${phy}/device/net 2>/dev/null); do
+	for wdev in $(list_phy_interfaces "$phy"); do
 		[ -f "/var/run/$wdev.pid" ] && kill $(cat /var/run/$wdev.pid) >&/dev/null 2>&1
 		for pid in `pidof wpa_supplicant`; do
 			grep "$wdev" /proc/$pid/cmdline >/dev/null && \
@@ -214,6 +222,7 @@ enable_mac80211() {
 	local macidx=0
 	local apidx=0
 	fixed=""
+	local hostapd_ctrl=""
 
 	[ -n "$country" ] && iw reg set "$country"
 	[ "$channel" = "auto" -o "$channel" = "0" ] || {
@@ -336,6 +345,7 @@ enable_mac80211() {
 			config_get mode "$vif" mode
 			config_get ifname "$vif" ifname
 			[ "$mode" = "ap" ] || continue
+			hostapd_ctrl="${hostapd_ctrl:-/var/run/hostapd-$phy/$ifname}"
 			mac80211_start_vif "$vif" "$ifname"
 		done
 	}
@@ -352,11 +362,18 @@ enable_mac80211() {
 				adhoc)
 					config_get bssid "$vif" bssid
 					config_get ssid "$vif" ssid
-					iw dev "$ifname" ibss join "$ssid" $freq ${fixed:+fixed-freq} $bssid
+					config_get mcast_rate "$vif" mcast_rate
+					local mcval=""
+					[ -n "$mcast_rate" ] && {
+						mcval="$(($mcast_rate / 1000))"
+						mcsub="$(( ($mcast_rate / 100) % 10 ))"
+						[ "$mcsub" -gt 0 ] && mcval="$mcval.$mcsub"
+					}
+					iw dev "$ifname" ibss join "$ssid" $freq ${fixed:+fixed-freq} $bssid ${mcval:+mcast-rate $mcval}
 				;;
 				sta)
 					if eval "type wpa_supplicant_setup_vif" 2>/dev/null >/dev/null; then
-						wpa_supplicant_setup_vif "$vif" wext || {
+						wpa_supplicant_setup_vif "$vif" nl80211 "${hostapd_ctrl:+-H $hostapd_ctrl}" || {
 							echo "enable_mac80211($device): Failed to set up wpa_supplicant for interface $ifname" >&2
 							# make sure this wifi interface won't accidentally stay open without encryption
 							ifconfig "$ifname" down
@@ -396,7 +413,7 @@ detect_mac80211() {
 
 		mode_11n=""
 		mode_band="g"
-		channel="5"
+		channel="11"
 		ht_cap=0
 		for cap in $(iw phy "$dev" info | grep 'Capabilities:' | cut -d: -f2); do
 			ht_cap="$(($ht_cap | $cap))"
@@ -408,6 +425,7 @@ detect_mac80211() {
 
 			list="	list ht_capab"
 			[ "$(($ht_cap & 1))" -eq 1 ] && append ht_capab "$list	LDPC" "$N"
+			[ "$(($ht_cap & 16))" -eq 16 ] && append ht_capab "$list	GF" "$N"
 			[ "$(($ht_cap & 32))" -eq 32 ] && append ht_capab "$list	SHORT-GI-20" "$N"
 			[ "$(($ht_cap & 64))" -eq 64 ] && append ht_capab "$list	SHORT-GI-40" "$N"
 			[ "$(($ht_cap & 128))" -eq 128 ] && append ht_capab "$list	TX-STBC" "$N"
diff --git a/package/mac80211/patches/001-disable_b44.patch b/package/mac80211/patches/001-disable_b44.patch
index 31976bd64..d93857bf3 100644
--- a/package/mac80211/patches/001-disable_b44.patch
+++ b/package/mac80211/patches/001-disable_b44.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -268,8 +268,8 @@ endif
+@@ -300,8 +300,8 @@ endif #CONFIG_SSB
  
  CONFIG_P54_PCI=m
  
diff --git a/package/mac80211/patches/002-disable_rfkill.patch b/package/mac80211/patches/002-disable_rfkill.patch
index c5d1ccc50..f1d45ad8a 100644
--- a/package/mac80211/patches/002-disable_rfkill.patch
+++ b/package/mac80211/patches/002-disable_rfkill.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -72,7 +72,7 @@ endif # build check
+@@ -74,7 +74,7 @@ endif # build check
  endif # kernel Makefile check
  
  # These both are needed by compat-wireless || compat-bluetooth so enable them
@@ -9,7 +9,7 @@
  
  ifeq ($(CONFIG_MAC80211),y)
  $(error "ERROR: you have MAC80211 compiled into the kernel, CONFIG_MAC80211=y, as such you cannot replace its mac80211 driver. You need this set to CONFIG_MAC80211=m. If you are using Fedora upgrade your kernel as later version should this set as modular. For further information on Fedora see https://bugzilla.redhat.com/show_bug.cgi?id=470143. If you are using your own kernel recompile it and make mac80211 modular")
-@@ -495,8 +495,8 @@ endif
+@@ -585,8 +585,8 @@ endif #CONFIG_COMPAT_KERNEL_27
  # We need the backported rfkill module on kernel < 2.6.31.
  # In more recent kernel versions use the in kernel rfkill module.
  ifdef CONFIG_COMPAT_KERNEL_31
@@ -19,5 +19,5 @@
 +# CONFIG_RFKILL_BACKPORT=m
 +# CONFIG_RFKILL_BACKPORT_LEDS=y
 +# CONFIG_RFKILL_BACKPORT_INPUT=y
- endif
+ endif #CONFIG_COMPAT_KERNEL_31
  
diff --git a/package/mac80211/patches/003-disable_bt.patch b/package/mac80211/patches/003-disable_bt.patch
index e1e7443ab..50b9e98c0 100644
--- a/package/mac80211/patches/003-disable_bt.patch
+++ b/package/mac80211/patches/003-disable_bt.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -94,8 +94,8 @@ ifndef CONFIG_COMPAT_KERNEL_27
+@@ -96,8 +96,8 @@ ifndef CONFIG_COMPAT_KERNEL_27
  ifeq ($(CONFIG_BT),y)
  # we'll ignore compiling bluetooth
  else
@@ -9,5 +9,5 @@
 +# CONFIG_COMPAT_BLUETOOTH=y
 +# CONFIG_COMPAT_BLUETOOTH_MODULES=m
  endif
- endif # Kernel >= 2.6.26
+ endif #CONFIG_COMPAT_KERNEL_27
  
diff --git a/package/mac80211/patches/005-disable_ssb_build.patch b/package/mac80211/patches/005-disable_ssb_build.patch
index 7207d7b84..fd2907ffe 100644
--- a/package/mac80211/patches/005-disable_ssb_build.patch
+++ b/package/mac80211/patches/005-disable_ssb_build.patch
@@ -6,9 +6,9 @@
  obj-$(CONFIG_COMPAT_NETWORK_MODULES) += drivers/net/
 -obj-$(CONFIG_COMPAT_VAR_MODULES) +=  drivers/ssb/ drivers/misc/eeprom/
 +obj-$(CONFIG_COMPAT_VAR_MODULES) +=  drivers/misc/eeprom/
- endif
  
- obj-$(CONFIG_COMPAT_BLUETOOTH) += net/bluetooth/
+ ifeq ($(CONFIG_STAGING_EXCLUDE_BUILD),)
+ obj-$(CONFIG_COMPAT_STAGING) += drivers/staging/ath6kl/
 --- a/config.mk
 +++ b/config.mk
 @@ -9,7 +9,6 @@ ifeq ($(wildcard $(KLIB_BUILD)/.config),
@@ -19,11 +19,11 @@
  else
  include $(KLIB_BUILD)/.config
  endif
-@@ -251,21 +250,6 @@ CONFIG_IPW2200_QOS=y
- #
+@@ -283,21 +282,6 @@ CONFIG_IPW2200_QOS=y
  # % echo 1 > /sys/bus/pci/drivers/ipw2200/*/rtap_iface
+ endif #CONFIG_WIRELESS_EXT
  
--ifneq ($(CONFIG_SSB),)
+-ifdef CONFIG_SSB
 -# Sonics Silicon Backplane
 -CONFIG_SSB_SPROM=y
 -# CONFIG_SSB_DEBUG=y
@@ -31,21 +31,21 @@
 -CONFIG_SSB_BLOCKIO=y
 -CONFIG_SSB_PCIHOST=y
 -CONFIG_SSB_B43_PCI_BRIDGE=y
--ifneq ($(CONFIG_PCMCIA),)
+-ifdef CONFIG_PCMCIA
 -CONFIG_SSB_PCMCIAHOST=y
--endif
+-endif #CONFIG_PCMCIA
 -# CONFIG_SSB_DEBUG=y
 -CONFIG_SSB_DRIVER_PCICORE=y
--endif
+-endif #CONFIG_SSB
 -
  CONFIG_P54_PCI=m
  
  # CONFIG_B44=m
-@@ -429,7 +413,6 @@ endif # end of SPI driver list
+@@ -485,7 +469,6 @@ endif #CONFIG_SPI_MASTER end of SPI driv
  
- ifneq ($(CONFIG_MMC),)
+ ifdef CONFIG_MMC
  
 -CONFIG_SSB_SDIOHOST=y
  CONFIG_B43_SDIO=y
- CONFIG_WL1251_SDIO=m
  
+ ifdef CONFIG_CRC7
diff --git a/package/mac80211/patches/007-remove_misc_drivers.patch b/package/mac80211/patches/007-remove_misc_drivers.patch
index 1fb835333..39bef1868 100644
--- a/package/mac80211/patches/007-remove_misc_drivers.patch
+++ b/package/mac80211/patches/007-remove_misc_drivers.patch
@@ -1,6 +1,15 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -282,13 +282,13 @@ endif
+@@ -196,7 +196,7 @@ $(warning "WARNING: CONFIG_CFG80211_WEXT
+ endif #CONFIG_WIRELESS_EXT
+ 
+ ifneq ($(CONFIG_STAGING),)
+- CONFIG_COMPAT_STAGING=m
++# CONFIG_COMPAT_STAGING=m
+ endif
+ 
+ # mac80211 test driver
+@@ -314,13 +314,13 @@ endif #CONFIG_CRC_ITU_T
  CONFIG_MWL8K=m
  
  # Ethernet drivers go here
@@ -13,24 +22,35 @@
  ifdef CONFIG_COMPAT_KERNEL_27
 -CONFIG_ATL1C=n
 +# CONFIG_ATL1C=n
- else
+ else #CONFIG_COMPAT_KERNEL_27
 -CONFIG_ATL1C=m
 +# CONFIG_ATL1C=m
- endif
+ endif #CONFIG_COMPAT_KERNEL_27
  
- CONFIG_HERMES=m
-@@ -342,10 +342,10 @@ CONFIG_USB_NET_COMPAT_RNDIS_HOST=n
- CONFIG_USB_NET_COMPAT_RNDIS_WLAN=n
- CONFIG_USB_NET_COMPAT_CDCETHER=n
- else
+ ifdef CONFIG_WIRELESS_EXT
+@@ -371,17 +371,17 @@ CONFIG_ZD1211RW=m
+ # Note: this depends on CONFIG_USB_NET_RNDIS_HOST and CONFIG_USB_NET_CDCETHER
+ # it also requires new RNDIS_HOST and CDC_ETHER modules which we add
+ ifdef CONFIG_COMPAT_KERNEL_29
+-CONFIG_USB_COMPAT_USBNET=n
+-CONFIG_USB_NET_COMPAT_RNDIS_HOST=n
+-CONFIG_USB_NET_COMPAT_RNDIS_WLAN=n
+-CONFIG_USB_NET_COMPAT_CDCETHER=n
++# CONFIG_USB_COMPAT_USBNET=n
++# CONFIG_USB_NET_COMPAT_RNDIS_HOST=n
++# CONFIG_USB_NET_COMPAT_RNDIS_WLAN=n
++# CONFIG_USB_NET_COMPAT_CDCETHER=n
+ else #CONFIG_COMPAT_KERNEL_29
 -CONFIG_USB_COMPAT_USBNET=m
++# CONFIG_USB_COMPAT_USBNET=m
+ ifdef CONFIG_USB_NET_CDCETHER
 -CONFIG_USB_NET_COMPAT_RNDIS_HOST=m
 -CONFIG_USB_NET_COMPAT_RNDIS_WLAN=m
--CONFIG_USB_NET_COMPAT_CDCETHER=m
-+# CONFIG_USB_COMPAT_USBNET=m
 +# CONFIG_USB_NET_COMPAT_RNDIS_HOST=m
 +# CONFIG_USB_NET_COMPAT_RNDIS_WLAN=m
+ endif #CONFIG_USB_NET_CDCETHER
+-CONFIG_USB_NET_COMPAT_CDCETHER=m
 +# CONFIG_USB_NET_COMPAT_CDCETHER=m
- endif
+ endif #CONFIG_COMPAT_KERNEL_29
  
  
diff --git a/package/mac80211/patches/008-led_default.patch b/package/mac80211/patches/008-led_default.patch
new file mode 100644
index 000000000..5a2105bbd
--- /dev/null
+++ b/package/mac80211/patches/008-led_default.patch
@@ -0,0 +1,127 @@
+--- a/config.mk
++++ b/config.mk
+@@ -132,7 +132,7 @@ CONFIG_COMPAT_MAC80211_RC_DEFAULT=minstr
+ CONFIG_MAC80211_RC_PID=y
+ CONFIG_MAC80211_RC_MINSTREL=y
+ CONFIG_MAC80211_RC_MINSTREL_HT=y
+-CONFIG_MAC80211_LEDS=y
++# CONFIG_MAC80211_LEDS=y
+ 
+ # enable mesh networking too
+ CONFIG_MAC80211_MESH=y
+@@ -240,7 +240,7 @@ CONFIG_B43_PCI_AUTOSELECT=y
+ ifdef CONFIG_PCMCIA
+ CONFIG_B43_PCMCIA=y
+ endif #CONFIG_PCMCIA
+-CONFIG_B43_LEDS=y
++# CONFIG_B43_LEDS=y
+ CONFIG_B43_PHY_LP=y
+ CONFIG_B43_NPHY=y
+ # CONFIG_B43_FORCE_PIO=y
+@@ -249,7 +249,7 @@ CONFIG_B43_NPHY=y
+ CONFIG_B43LEGACY=m
+ CONFIG_B43LEGACY_HWRNG=y
+ CONFIG_B43LEGACY_PCI_AUTOSELECT=y
+-CONFIG_B43LEGACY_LEDS=y
++# CONFIG_B43LEGACY_LEDS=y
+ # CONFIG_B43LEGACY_DEBUG=y
+ CONFIG_B43LEGACY_DMA=y
+ CONFIG_B43LEGACY_PIO=y
+@@ -542,7 +542,7 @@ endif
+ 
+ # p54
+ CONFIG_P54_COMMON=m
+-CONFIG_P54_LEDS=y
++# CONFIG_P54_LEDS=y
+ 
+ # Atheros
+ CONFIG_ATH_COMMON=m
+--- a/drivers/net/wireless/ath/ath9k/gpio.c
++++ b/drivers/net/wireless/ath/ath9k/gpio.c
+@@ -54,6 +54,7 @@ static void ath_led_blink_work(struct wo
+ 		sc->sc_flags |= SC_OP_LED_ON;
+ }
+ 
++#ifdef CONFIG_LEDS_CLASS
+ static void ath_led_brightness(struct led_classdev *led_cdev,
+ 			       enum led_brightness brightness)
+ {
+@@ -90,10 +91,12 @@ static void ath_led_brightness(struct le
+ 		break;
+ 	}
+ }
++#endif
+ 
+ static int ath_register_led(struct ath_softc *sc, struct ath_led *led,
+ 			    char *trigger)
+ {
++#ifdef CONFIG_LEDS_CLASS
+ 	int ret;
+ 
+ 	led->sc = sc;
+@@ -108,14 +111,19 @@ static int ath_register_led(struct ath_s
+ 	else
+ 		led->registered = 1;
+ 	return ret;
++#else
++	return 0;
++#endif
+ }
+ 
+ static void ath_unregister_led(struct ath_led *led)
+ {
++#ifdef CONFIG_LEDS_CLASS
+ 	if (led->registered) {
+ 		led_classdev_unregister(&led->led_cdev);
+ 		led->registered = 0;
+ 	}
++#endif
+ }
+ 
+ void ath_deinit_leds(struct ath_softc *sc)
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+@@ -860,6 +860,7 @@ static void ath9k_led_brightness_work(st
+ 	}
+ }
+ 
++#ifdef CONFIG_LEDS_CLASS
+ static void ath9k_led_brightness(struct led_classdev *led_cdev,
+ 				 enum led_brightness brightness)
+ {
+@@ -871,6 +872,7 @@ static void ath9k_led_brightness(struct 
+ 		ieee80211_queue_delayed_work(priv->hw,
+ 					     &led->brightness_work, 0);
+ }
++#endif
+ 
+ static void ath9k_led_stop_brightness(struct ath9k_htc_priv *priv)
+ {
+@@ -883,6 +885,7 @@ static void ath9k_led_stop_brightness(st
+ static int ath9k_register_led(struct ath9k_htc_priv *priv, struct ath_led *led,
+ 			      char *trigger)
+ {
++#ifdef CONFIG_LEDS_CLASS
+ 	int ret;
+ 
+ 	led->priv = priv;
+@@ -900,14 +903,19 @@ static int ath9k_register_led(struct ath
+ 	INIT_DELAYED_WORK(&led->brightness_work, ath9k_led_brightness_work);
+ 
+ 	return ret;
++#else
++	return 0;
++#endif
+ }
+ 
+ static void ath9k_unregister_led(struct ath_led *led)
+ {
++#ifdef CONFIG_LEDS_CLASS
+ 	if (led->registered) {
+ 		led_classdev_unregister(&led->led_cdev);
+ 		led->registered = 0;
+ 	}
++#endif
+ }
+ 
+ void ath9k_deinit_leds(struct ath9k_htc_priv *priv)
diff --git a/package/mac80211/patches/009-remove_mac80211_module_dependence.patch b/package/mac80211/patches/009-remove_mac80211_module_dependence.patch
index d0998b120..6c421b022 100644
--- a/package/mac80211/patches/009-remove_mac80211_module_dependence.patch
+++ b/package/mac80211/patches/009-remove_mac80211_module_dependence.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -42,21 +42,6 @@ $(error "ERROR: Your 2.6.27 kernel has C
+@@ -42,23 +42,6 @@ $(error "ERROR: Your 2.6.27 kernel has C
  endif
  endif
  
@@ -13,9 +13,11 @@
 -#
 -# skb->requeue
 -#
--ifeq ($(shell test $(KERNEL_SUBLEVEL) -ge 27 && echo yes),yes)
+-# In kernel 2.6.32 both attributes were removed.
+-#
+-ifeq ($(shell test $(KERNEL_SUBLEVEL) -ge 27 -a $(KERNEL_SUBLEVEL) -le 31 && echo yes),yes)
 -ifeq ($(CONFIG_MAC80211),)
--$(error "ERROR: Your >=2.6.27 kernel has CONFIG_MAC80211 disabled, you should have it CONFIG_MAC80211=m if you want to use this thing.")
+-$(error "ERROR: Your >=2.6.27 and <= 2.6.31 kernel has CONFIG_MAC80211 disabled, you should have it CONFIG_MAC80211=m if you want to use this thing.")
 -endif
 -endif
 -
diff --git a/package/mac80211/patches/010-no_pcmcia.patch b/package/mac80211/patches/010-no_pcmcia.patch
index 0c8072a3e..f16dac6d5 100644
--- a/package/mac80211/patches/010-no_pcmcia.patch
+++ b/package/mac80211/patches/010-no_pcmcia.patch
@@ -9,12 +9,12 @@
  else
  include $(KLIB_BUILD)/.config
  endif
-@@ -192,7 +192,7 @@ CONFIG_B43=m
+@@ -221,7 +221,7 @@ CONFIG_B43=m
  CONFIG_B43_HWRNG=y
  CONFIG_B43_PCI_AUTOSELECT=y
- ifneq ($(CONFIG_PCMCIA),)
+ ifdef CONFIG_PCMCIA
 -CONFIG_B43_PCMCIA=y
 +# CONFIG_B43_PCMCIA=y
- endif
- CONFIG_B43_LEDS=y
+ endif #CONFIG_PCMCIA
+ # CONFIG_B43_LEDS=y
  CONFIG_B43_PHY_LP=y
diff --git a/package/mac80211/patches/011-no_sdio.patch b/package/mac80211/patches/011-no_sdio.patch
index 3f7fd5a2c..2e906f56b 100644
--- a/package/mac80211/patches/011-no_sdio.patch
+++ b/package/mac80211/patches/011-no_sdio.patch
@@ -1,11 +1,11 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -398,7 +398,7 @@ endif # end of SPI driver list
+@@ -452,7 +452,7 @@ endif #CONFIG_SPI_MASTER end of SPI driv
  
- ifneq ($(CONFIG_MMC),)
+ ifdef CONFIG_MMC
  
 -CONFIG_B43_SDIO=y
 +# CONFIG_B43_SDIO=y
- CONFIG_WL1251_SDIO=m
  
- ifndef CONFIG_COMPAT_KERNEL_32
+ ifdef CONFIG_CRC7
+ CONFIG_WL1251_SDIO=m
diff --git a/package/mac80211/patches/013-disable_b43_nphy.patch b/package/mac80211/patches/013-disable_b43_nphy.patch
index f71d3b288..743d12351 100644
--- a/package/mac80211/patches/013-disable_b43_nphy.patch
+++ b/package/mac80211/patches/013-disable_b43_nphy.patch
@@ -1,8 +1,8 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -196,7 +196,7 @@ ifneq ($(CONFIG_PCMCIA),)
- endif
- CONFIG_B43_LEDS=y
+@@ -225,7 +225,7 @@ ifdef CONFIG_PCMCIA
+ endif #CONFIG_PCMCIA
+ # CONFIG_B43_LEDS=y
  CONFIG_B43_PHY_LP=y
 -CONFIG_B43_NPHY=y
 +# CONFIG_B43_NPHY is not set
diff --git a/package/mac80211/patches/015-remove-rt2x00-options.patch b/package/mac80211/patches/015-remove-rt2x00-options.patch
index 694694870..535326118 100644
--- a/package/mac80211/patches/015-remove-rt2x00-options.patch
+++ b/package/mac80211/patches/015-remove-rt2x00-options.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -244,12 +244,12 @@ CONFIG_RTL8180=m
+@@ -274,12 +274,12 @@ CONFIG_RTL8180=m
  
  CONFIG_ADM8211=m
  
@@ -8,19 +8,19 @@
 +# CONFIG_RT2X00_LIB_PCI=m
  CONFIG_RT2400PCI=m
  CONFIG_RT2500PCI=m
- ifneq ($(CONFIG_CRC_CCITT),)
+ ifdef CONFIG_CRC_CCITT
  CONFIG_RT2800PCI=m
 -CONFIG_RT2800PCI_PCI=y
 +# CONFIG_RT2800PCI_PCI=y
  # CONFIG_RT2800PCI_RT30XX=y
  # CONFIG_RT2800PCI_RT35XX=y
  # CONFIG_RT2800PCI_SOC=y
-@@ -355,7 +355,7 @@ CONFIG_RT2800USB_RT30XX=y
+@@ -402,7 +402,7 @@ CONFIG_RT2800USB_RT30XX=y
  CONFIG_RT2800USB_RT35XX=y
  CONFIG_RT2800USB_UNKNOWN=y
- endif
+ endif #CONFIG_CRC_CCITT
 -CONFIG_RT2X00_LIB_USB=m
 +# CONFIG_RT2X00_LIB_USB=m
  NEED_RT2X00=y
  # RT73USB requires firmware
- ifneq ($(CONFIG_CRC_ITU_T),)
+ ifdef CONFIG_CRC_ITU_T
diff --git a/package/mac80211/patches/016-remove_pid_algo.patch b/package/mac80211/patches/016-remove_pid_algo.patch
index 33b19cc67..99b19d81e 100644
--- a/package/mac80211/patches/016-remove_pid_algo.patch
+++ b/package/mac80211/patches/016-remove_pid_algo.patch
@@ -3,9 +3,9 @@
 @@ -112,7 +112,7 @@ CONFIG_MAC80211_RC_DEFAULT_MINSTREL=y
  # This is the one used by our compat-wireless net/mac80211/rate.c
  # in case you have and old kernel which is overriding this to pid.
- CONFIG_COMPAT_MAC80211_RC_DEFAULT=minstrel
+ CONFIG_COMPAT_MAC80211_RC_DEFAULT=minstrel_ht
 -CONFIG_MAC80211_RC_PID=y
 +# CONFIG_MAC80211_RC_PID=y
  CONFIG_MAC80211_RC_MINSTREL=y
  CONFIG_MAC80211_RC_MINSTREL_HT=y
- CONFIG_MAC80211_LEDS=y
+ # CONFIG_MAC80211_LEDS=y
diff --git a/package/mac80211/patches/017-remove_ath9k_rc.patch b/package/mac80211/patches/017-remove_ath9k_rc.patch
new file mode 100644
index 000000000..f9e8756d4
--- /dev/null
+++ b/package/mac80211/patches/017-remove_ath9k_rc.patch
@@ -0,0 +1,11 @@
+--- a/config.mk
++++ b/config.mk
+@@ -204,7 +204,7 @@ CONFIG_ATH9K_COMMON=m
+ # as default once we get minstrel properly tested and blessed by
+ # our systems engineering team. CCK rates also need to be used
+ # for long range considerations.
+-CONFIG_ATH9K_RATE_CONTROL=y
++# CONFIG_ATH9K_RATE_CONTROL=y
+ 
+ 
+ CONFIG_COMPAT_IWLWIFI=m
diff --git a/package/mac80211/patches/020-wext-fix.patch b/package/mac80211/patches/020-wext-fix.patch
deleted file mode 100644
index 9cbbb4377..000000000
--- a/package/mac80211/patches/020-wext-fix.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- a/scripts/gen-compat-autoconf.sh
-+++ b/scripts/gen-compat-autoconf.sh
-@@ -191,10 +191,8 @@ if [ -f $KLIB_BUILD/Makefile ]; then
- 		echo CONFIG_NETDEVICES_MULTIQUEUE >> $MULT_DEP_FILE
- 		define_config_multiple_deps CONFIG_MAC80211_QOS y $ALL_DEPS
- 		rm -f $MULT_DEP_FILE
--		# Kernels >= 2.6.32 can disable WEXT :D
--		if [ $SUBLEVEL -le 32 ]; then
--			define_config_dep CONFIG_CFG80211_WEXT 1 CONFIG_WIRELESS_EXT
--		fi
-+		# Up to kernel 2.6.35 we still need the following:
-+		define_config_dep CONFIG_CFG80211_WEXT 1 CONFIG_WIRELESS_EXT
- 	fi
- fi
- echo "#endif /* COMPAT_AUTOCONF_INCLUDED */"
diff --git a/package/mac80211/patches/030-backport_93c86_eeprom.patch b/package/mac80211/patches/030-backport_93c86_eeprom.patch
index d76f39ed9..ac568f7f2 100644
--- a/package/mac80211/patches/030-backport_93c86_eeprom.patch
+++ b/package/mac80211/patches/030-backport_93c86_eeprom.patch
@@ -1,8 +1,8 @@
 --- a/include/linux/compat-2.6.36.h
 +++ b/include/linux/compat-2.6.36.h
-@@ -8,6 +8,8 @@
- #define kparam_block_sysfs_write(a)
- #define kparam_unblock_sysfs_write(a)
+@@ -56,6 +56,8 @@ static inline int pcmcia_write_config_by
+ 	return pcmcia_access_configuration_register(p_dev, &reg);
+ }
  
 +#define PCI_EEPROM_WIDTH_93C86   8
 +
diff --git a/package/mac80211/patches/100-disable_pcmcia_compat.patch b/package/mac80211/patches/100-disable_pcmcia_compat.patch
index ebfe5ce65..affdc3864 100644
--- a/package/mac80211/patches/100-disable_pcmcia_compat.patch
+++ b/package/mac80211/patches/100-disable_pcmcia_compat.patch
@@ -1,6 +1,6 @@
 --- a/compat/compat-2.6.28.c
 +++ b/compat/compat-2.6.28.c
-@@ -87,7 +87,7 @@ EXPORT_SYMBOL_GPL(usb_poison_urb);
+@@ -89,7 +89,7 @@ EXPORT_SYMBOL_GPL(usb_poison_urb);
  #endif
  #endif /* CONFIG_USB */
  
diff --git a/package/mac80211/patches/110-disable_usb_compat.patch b/package/mac80211/patches/110-disable_usb_compat.patch
index c60705a53..5c9147c77 100644
--- a/package/mac80211/patches/110-disable_usb_compat.patch
+++ b/package/mac80211/patches/110-disable_usb_compat.patch
@@ -1,6 +1,6 @@
 --- a/compat/compat-2.6.28.c
 +++ b/compat/compat-2.6.28.c
-@@ -166,7 +166,7 @@ EXPORT_SYMBOL(pcmcia_loop_config);
+@@ -168,7 +168,7 @@ EXPORT_SYMBOL(pcmcia_loop_config);
  
  #endif /* CONFIG_PCMCIA */
  
@@ -11,7 +11,7 @@
  {
 --- a/compat/compat-2.6.29.c
 +++ b/compat/compat-2.6.29.c
-@@ -51,7 +51,7 @@ void netdev_attach_ops(struct net_device
+@@ -52,7 +52,7 @@ void netdev_attach_ops(struct net_device
  EXPORT_SYMBOL(netdev_attach_ops);
  
  #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23))
@@ -31,3 +31,14 @@
  #if 0
  extern void usb_poison_urb(struct urb *urb);
  #endif
+--- a/config.mk
++++ b/config.mk
+@@ -389,7 +389,7 @@ endif #CONFIG_COMPAT_KERNEL_29
+ # This activates a threading fix for usb urb.
+ # this is mainline commit: b3e670443b7fb8a2d29831b62b44a039c283e351
+ # This fix will be included in some stable releases.
+-CONFIG_COMPAT_USB_URB_THREAD_FIX=y
++# CONFIG_COMPAT_USB_URB_THREAD_FIX=y
+ 
+ CONFIG_ATH9K_HTC=m
+ # CONFIG_ATH9K_HTC_DEBUGFS=y
diff --git a/package/mac80211/patches/120-pm_qos_params.patch b/package/mac80211/patches/120-pm_qos_params.patch
deleted file mode 100644
index ca4b7bfe3..000000000
--- a/package/mac80211/patches/120-pm_qos_params.patch
+++ /dev/null
@@ -1,61 +0,0 @@
---- a/drivers/net/wireless/ipw2x00/ipw2100.c
-+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
-@@ -174,7 +174,9 @@ that only one external action is invoked
- #define DRV_DESCRIPTION	"Intel(R) PRO/Wireless 2100 Network Driver"
- #define DRV_COPYRIGHT	"Copyright(c) 2003-2006 Intel Corporation"
- 
-+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
- static struct pm_qos_request_list *ipw2100_pm_qos_req;
-+#endif
- 
- /* Debugging stuff */
- #ifdef CONFIG_IPW2100_DEBUG
-@@ -1741,7 +1743,11 @@ static int ipw2100_up(struct ipw2100_pri
- 	/* the ipw2100 hardware really doesn't want power management delays
- 	 * longer than 175usec
- 	 */
-+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
- 	pm_qos_update_request(ipw2100_pm_qos_req, 175);
-+#else
-+	pm_qos_update_requirement(PM_QOS_CPU_DMA_LATENCY, "ipw2100", 175);
-+#endif
- 
- 	/* If the interrupt is enabled, turn it off... */
- 	spin_lock_irqsave(&priv->low_lock, flags);
-@@ -1889,7 +1895,12 @@ static void ipw2100_down(struct ipw2100_
- 	ipw2100_disable_interrupts(priv);
- 	spin_unlock_irqrestore(&priv->low_lock, flags);
- 
-+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
- 	pm_qos_update_request(ipw2100_pm_qos_req, PM_QOS_DEFAULT_VALUE);
-+#else
-+	pm_qos_update_requirement(PM_QOS_CPU_DMA_LATENCY, "ipw2100",
-+			PM_QOS_DEFAULT_VALUE);
-+#endif
- 
- 	/* We have to signal any supplicant if we are disassociating */
- 	if (associated)
-@@ -6669,7 +6680,11 @@ static int __init ipw2100_init(void)
- 	if (ret)
- 		goto out;
- 
-+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
- 	ipw2100_pm_qos_req = pm_qos_add_request(PM_QOS_CPU_DMA_LATENCY,
-+#else
-+	pm_qos_add_requirement(PM_QOS_CPU_DMA_LATENCY, "ipw2100",
-+#endif
- 			PM_QOS_DEFAULT_VALUE);
- #ifdef CONFIG_IPW2100_DEBUG
- 	ipw2100_debug_level = debug;
-@@ -6692,7 +6707,11 @@ static void __exit ipw2100_exit(void)
- 			   &driver_attr_debug_level);
- #endif
- 	pci_unregister_driver(&ipw2100_pci_driver);
-+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
- 	pm_qos_remove_request(ipw2100_pm_qos_req);
-+#else
-+	pm_qos_remove_requirement(PM_QOS_CPU_DMA_LATENCY, "ipw2100");
-+#endif
- }
- 
- module_init(ipw2100_init);
diff --git a/package/mac80211/patches/130-printk_debug_revert.patch b/package/mac80211/patches/130-printk_debug_revert.patch
deleted file mode 100644
index 232902e8c..000000000
--- a/package/mac80211/patches/130-printk_debug_revert.patch
+++ /dev/null
@@ -1,69 +0,0 @@
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -2443,9 +2443,8 @@ void cfg80211_cqm_rssi_notify(struct net
- 	wiphy_printk(KERN_NOTICE, wiphy, format, ##args)
- #define wiphy_info(wiphy, format, args...)			\
- 	wiphy_printk(KERN_INFO, wiphy, format, ##args)
--
--int wiphy_debug(const struct wiphy *wiphy, const char *format, ...)
--	__attribute__ ((format (printf, 2, 3)));
-+#define wiphy_debug(wiphy, format, args...)			\
-+	wiphy_printk(KERN_DEBUG, wiphy, format, ##args)
- 
- #if defined(DEBUG)
- #define wiphy_dbg(wiphy, format, args...)			\
---- a/net/wireless/core.c
-+++ b/net/wireless/core.c
-@@ -921,52 +921,3 @@ static void __exit cfg80211_exit(void)
- 	destroy_workqueue(cfg80211_wq);
- }
- module_exit(cfg80211_exit);
--
--static int ___wiphy_printk(const char *level, const struct wiphy *wiphy,
--			   struct va_format *vaf)
--{
--	if (!wiphy)
--		return printk("%s(NULL wiphy *): %pV", level, vaf);
--
--	return printk("%s%s: %pV", level, wiphy_name(wiphy), vaf);
--}
--
--int __wiphy_printk(const char *level, const struct wiphy *wiphy,
--		   const char *fmt, ...)
--{
--	struct va_format vaf;
--	va_list args;
--	int r;
--
--	va_start(args, fmt);
--
--	vaf.fmt = fmt;
--	vaf.va = &args;
--
--	r = ___wiphy_printk(level, wiphy, &vaf);
--	va_end(args);
--
--	return r;
--}
--EXPORT_SYMBOL(__wiphy_printk);
--
--#define define_wiphy_printk_level(func, kern_level)		\
--int func(const struct wiphy *wiphy, const char *fmt, ...)	\
--{								\
--	struct va_format vaf;					\
--	va_list args;						\
--	int r;							\
--								\
--	va_start(args, fmt);					\
--								\
--	vaf.fmt = fmt;						\
--	vaf.va = &args;						\
--								\
--	r = ___wiphy_printk(kern_level, wiphy, &vaf);		\
--	va_end(args);						\
--								\
--	return r;						\
--}								\
--EXPORT_SYMBOL(func);
--
--define_wiphy_printk_level(wiphy_debug, KERN_DEBUG);
diff --git a/package/mac80211/patches/300-nl80211_dump_crash_fix.patch b/package/mac80211/patches/300-nl80211_dump_crash_fix.patch
new file mode 100644
index 000000000..3c6385f89
--- /dev/null
+++ b/package/mac80211/patches/300-nl80211_dump_crash_fix.patch
@@ -0,0 +1,13 @@
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -224,8 +224,8 @@ static int nl80211_prepare_netdev_dump(s
+ 	}
+ 
+ 	*rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
+-	if (IS_ERR(dev)) {
+-		err = PTR_ERR(dev);
++	if (IS_ERR(*rdev)) {
++		err = PTR_ERR(*rdev);
+ 		goto out_rtnl;
+ 	}
+ 
diff --git a/package/mac80211/patches/401-ath9k-dont-register-leds-on-ar9100.patch b/package/mac80211/patches/401-ath9k-dont-register-leds-on-ar9100.patch
index 166c133a6..330503d23 100644
--- a/package/mac80211/patches/401-ath9k-dont-register-leds-on-ar9100.patch
+++ b/package/mac80211/patches/401-ath9k-dont-register-leds-on-ar9100.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/gpio.c
 +++ b/drivers/net/wireless/ath/ath9k/gpio.c
-@@ -120,6 +120,9 @@ static void ath_unregister_led(struct at
+@@ -128,6 +128,9 @@ static void ath_unregister_led(struct at
  
  void ath_deinit_leds(struct ath_softc *sc)
  {
@@ -10,7 +10,7 @@
  	ath_unregister_led(&sc->assoc_led);
  	sc->sc_flags &= ~SC_OP_LED_ASSOCIATED;
  	ath_unregister_led(&sc->tx_led);
-@@ -133,6 +136,9 @@ void ath_init_leds(struct ath_softc *sc)
+@@ -141,6 +144,9 @@ void ath_init_leds(struct ath_softc *sc)
  	char *trigger;
  	int ret;
  
diff --git a/package/mac80211/patches/403-ath9k-fix-invalid-mac-address-handling.patch b/package/mac80211/patches/403-ath9k-fix-invalid-mac-address-handling.patch
index 23631dcac..1f3712a60 100644
--- a/package/mac80211/patches/403-ath9k-fix-invalid-mac-address-handling.patch
+++ b/package/mac80211/patches/403-ath9k-fix-invalid-mac-address-handling.patch
@@ -8,7 +8,7 @@
  #include <asm/unaligned.h>
  
  #include "hw.h"
-@@ -451,8 +452,16 @@ static int ath9k_hw_init_macaddr(struct 
+@@ -449,8 +450,16 @@ static int ath9k_hw_init_macaddr(struct 
  		common->macaddr[2 * i] = eeval >> 8;
  		common->macaddr[2 * i + 1] = eeval & 0xff;
  	}
diff --git a/package/mac80211/patches/404-ath_regd_optional.patch b/package/mac80211/patches/404-ath_regd_optional.patch
index 927aeb4b6..9bda94b03 100644
--- a/package/mac80211/patches/404-ath_regd_optional.patch
+++ b/package/mac80211/patches/404-ath_regd_optional.patch
@@ -1,68 +1,46 @@
 --- a/drivers/net/wireless/ath/regd.c
 +++ b/drivers/net/wireless/ath/regd.c
-@@ -18,6 +18,9 @@
- #include <net/cfg80211.h>
- #include <net/mac80211.h>
- #include "regd.h"
-+
-+#ifndef ATH_USER_REGD
-+
- #include "regd_common.h"
- 
- /*
-@@ -587,3 +590,5 @@ u32 ath_regd_get_band_ctl(struct ath_reg
- 	}
- }
- EXPORT_SYMBOL(ath_regd_get_band_ctl);
-+
-+#endif
---- a/drivers/net/wireless/ath/regd.h
-+++ b/drivers/net/wireless/ath/regd.h
-@@ -250,6 +250,41 @@ enum CountryCode {
- 	CTRY_BELGIUM2 = 5002
- };
+@@ -185,6 +185,10 @@ ath_reg_apply_beaconing_flags(struct wip
+ 	u32 bandwidth = 0;
+ 	int r;
  
 +#ifdef ATH_USER_REGD
-+
-+static inline bool
-+ath_is_world_regd(struct ath_regulatory *reg)
-+{
-+	return true;
-+}
-+
-+static inline int
-+ath_regd_init(struct ath_regulatory *reg, struct wiphy *wiphy,
-+	      int (*reg_notifier)(struct wiphy *wiphy,
-+	      struct regulatory_request *request))
-+{
-+	return 0;
-+}
-+
-+
-+static inline u32
-+ath_regd_get_band_ctl(struct ath_regulatory *reg,
-+		      enum ieee80211_band band)
-+{
-+	return SD_NO_CTL;
-+}
-+
-+static inline int
-+ath_reg_notifier_apply(struct wiphy *wiphy,
-+		       struct regulatory_request *request,
-+		       struct ath_regulatory *reg)
-+{
-+	return 0;
-+}
-+
-+
-+#else
-+
- bool ath_is_world_regd(struct ath_regulatory *reg);
- int ath_regd_init(struct ath_regulatory *reg, struct wiphy *wiphy,
- 		  int (*reg_notifier)(struct wiphy *wiphy,
-@@ -261,3 +296,5 @@ int ath_reg_notifier_apply(struct wiphy 
- 			   struct ath_regulatory *reg);
- 
- #endif
-+
++	return;
 +#endif
++
+ 	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+ 
+ 		if (!wiphy->bands[band])
+@@ -244,6 +248,10 @@ ath_reg_apply_active_scan_flags(struct w
+ 	u32 bandwidth = 0;
+ 	int r;
+ 
++#ifdef ATH_USER_REGD
++	return;
++#endif
++
+ 	sband = wiphy->bands[IEEE80211_BAND_2GHZ];
+ 
+ 	/*
+@@ -291,6 +299,10 @@ static void ath_reg_apply_radar_flags(st
+ 	struct ieee80211_channel *ch;
+ 	unsigned int i;
+ 
++#ifdef ATH_USER_REGD
++	return;
++#endif
++
+ 	if (!wiphy->bands[IEEE80211_BAND_5GHZ])
+ 		return;
+ 
+@@ -449,6 +461,10 @@ ath_regd_init_wiphy(struct ath_regulator
+ {
+ 	const struct ieee80211_regdomain *regd;
+ 
++#ifdef ATH_USER_REGD
++	return 0;
++#endif
++
+ 	wiphy->reg_notifier = reg_notifier;
+ 	wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY;
+ 
diff --git a/package/mac80211/patches/406-ath9k-set-AH_USE_EEPROM-only-if-no-platform-data-present.patch b/package/mac80211/patches/406-ath9k-set-AH_USE_EEPROM-only-if-no-platform-data-present.patch
index 77d1c7b6e..615bce561 100644
--- a/package/mac80211/patches/406-ath9k-set-AH_USE_EEPROM-only-if-no-platform-data-present.patch
+++ b/package/mac80211/patches/406-ath9k-set-AH_USE_EEPROM-only-if-no-platform-data-present.patch
@@ -10,7 +10,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -538,6 +538,7 @@ static int ath9k_init_softc(u16 devid, s
+@@ -559,6 +559,7 @@ static int ath9k_init_softc(u16 devid, s
  {
  	struct ath_hw *ah = NULL;
  	struct ath_common *common;
@@ -18,7 +18,7 @@
  	int ret = 0, i;
  	int csz = 0;
  
-@@ -549,6 +550,10 @@ static int ath9k_init_softc(u16 devid, s
+@@ -570,6 +571,10 @@ static int ath9k_init_softc(u16 devid, s
  	ah->hw_version.subsysid = subsysid;
  	sc->sc_ah = ah;
  
@@ -31,7 +31,7 @@
  	common->bus_ops = bus_ops;
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -422,10 +422,6 @@ static void ath9k_hw_init_defaults(struc
+@@ -420,10 +420,6 @@ static void ath9k_hw_init_defaults(struc
  	ah->hw_version.magic = AR5416_MAGIC;
  	ah->hw_version.subvendorid = 0;
  
diff --git a/package/mac80211/patches/407-ath9k-override-mac-address-from-platform-data.patch b/package/mac80211/patches/407-ath9k-override-mac-address-from-platform-data.patch
index 72f7751fc..315e7992c 100644
--- a/package/mac80211/patches/407-ath9k-override-mac-address-from-platform-data.patch
+++ b/package/mac80211/patches/407-ath9k-override-mac-address-from-platform-data.patch
@@ -11,7 +11,7 @@
  #include "hw.h"
  #include "hw-ops.h"
  #include "rc.h"
-@@ -436,18 +438,23 @@ static void ath9k_hw_init_defaults(struc
+@@ -434,18 +436,23 @@ static void ath9k_hw_init_defaults(struc
  static int ath9k_hw_init_macaddr(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
diff --git a/package/mac80211/patches/408-ath9k_tweak_rx_intr_mitigation.patch b/package/mac80211/patches/408-ath9k_tweak_rx_intr_mitigation.patch
index f987e8a54..b9bf3e70d 100644
--- a/package/mac80211/patches/408-ath9k_tweak_rx_intr_mitigation.patch
+++ b/package/mac80211/patches/408-ath9k_tweak_rx_intr_mitigation.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1418,7 +1418,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -1420,7 +1420,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  
  	if (ah->config.rx_intr_mitigation) {
  		REG_RMW_FIELD(ah, AR_RIMT, AR_RIMT_LAST, 500);
diff --git a/package/mac80211/patches/409-ath9k-add-wndr3700-antenna-initialization.patch b/package/mac80211/patches/409-ath9k-add-wndr3700-antenna-initialization.patch
index 6d275f81e..77db1729b 100644
--- a/package/mac80211/patches/409-ath9k-add-wndr3700-antenna-initialization.patch
+++ b/package/mac80211/patches/409-ath9k-add-wndr3700-antenna-initialization.patch
@@ -8,7 +8,7 @@
  #include "ath9k.h"
  
  static char *dev_info = "ath9k";
-@@ -553,6 +554,8 @@ static int ath9k_init_softc(u16 devid, s
+@@ -574,6 +575,8 @@ static int ath9k_init_softc(u16 devid, s
  	pdata = (struct ath9k_platform_data *) sc->dev->platform_data;
  	if (!pdata)
  		ah->ah_flags |= AH_USE_EEPROM;
@@ -17,7 +17,7 @@
  
  	common = ath9k_hw_common(ah);
  	common->ops = &ath9k_common_ops;
-@@ -675,6 +678,24 @@ void ath9k_set_hw_capab(struct ath_softc
+@@ -704,6 +707,24 @@ void ath9k_set_hw_capab(struct ath_softc
  	SET_IEEE80211_PERM_ADDR(hw, common->macaddr);
  }
  
@@ -42,7 +42,7 @@
  int ath9k_init_device(u16 devid, struct ath_softc *sc, u16 subsysid,
  		    const struct ath_bus_ops *bus_ops)
  {
-@@ -693,6 +714,9 @@ int ath9k_init_device(u16 devid, struct 
+@@ -723,6 +744,9 @@ int ath9k_init_device(u16 devid, struct 
  	common = ath9k_hw_common(ah);
  	ath9k_set_hw_capab(sc, hw);
  
@@ -54,7 +54,7 @@
  			      ath9k_reg_notifier);
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -596,6 +596,8 @@ struct ath_softc {
+@@ -635,6 +635,8 @@ struct ath_softc {
  
  	int beacon_interval;
  
diff --git a/package/mac80211/patches/410-ath9k-wndr3700-led-pin-fix.patch b/package/mac80211/patches/410-ath9k-wndr3700-led-pin-fix.patch
index d6d2634c1..03d017a6d 100644
--- a/package/mac80211/patches/410-ath9k-wndr3700-led-pin-fix.patch
+++ b/package/mac80211/patches/410-ath9k-wndr3700-led-pin-fix.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/gpio.c
 +++ b/drivers/net/wireless/ath/ath9k/gpio.c
-@@ -139,7 +139,9 @@ void ath_init_leds(struct ath_softc *sc)
+@@ -147,7 +147,9 @@ void ath_init_leds(struct ath_softc *sc)
  	if (AR_SREV_9100(sc->sc_ah))
  		return;
  
@@ -13,7 +13,7 @@
  		sc->sc_ah->led_pin = ATH_LED_PIN_DEF;
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -467,6 +467,7 @@ void ath9k_btcoex_timer_pause(struct ath
+@@ -455,6 +455,7 @@ void ath9k_btcoex_timer_pause(struct ath
  
  #define ATH_LED_PIN_DEF 		1
  #define ATH_LED_PIN_9287		8
diff --git a/package/mac80211/patches/450-add-ath5k-platform.patch b/package/mac80211/patches/450-add-ath5k-platform.patch
index 77717b993..b213e2a81 100644
--- a/package/mac80211/patches/450-add-ath5k-platform.patch
+++ b/package/mac80211/patches/450-add-ath5k-platform.patch
@@ -1,6 +1,5 @@
-diff -Nur a/include/linux/ath5k_platform.h b/include/linux/ath5k_platform.h
---- a/include/linux/ath5k_platform.h	1970-01-01 01:00:00.000000000 +0100
-+++ b/include/linux/ath5k_platform.h	2010-06-21 00:19:52.000000000 +0200
+--- /dev/null
++++ b/include/linux/ath5k_platform.h
 @@ -0,0 +1,30 @@
 +/*
 + * Copyright (c) 2008 Atheros Communications Inc.
@@ -32,4 +31,3 @@ diff -Nur a/include/linux/ath5k_platform.h b/include/linux/ath5k_platform.h
 +};
 +
 +#endif /* _LINUX_ATH5K_PLATFORM_H */
-
diff --git a/package/mac80211/patches/451-add-platform-eeprom-support-to-ath5k.patch b/package/mac80211/patches/451-add-platform-eeprom-support-to-ath5k.patch
index 717acd234..a03b59944 100644
--- a/package/mac80211/patches/451-add-platform-eeprom-support-to-ath5k.patch
+++ b/package/mac80211/patches/451-add-platform-eeprom-support-to-ath5k.patch
@@ -1,6 +1,6 @@
---- a/drivers/net/wireless/ath/ath5k/eeprom.c	2010-06-23 03:08:32.000000000 +0200
-+++ b/drivers/net/wireless/ath/ath5k/eeprom.c	2010-06-23 05:59:30.000000000 +0200
-@@ -22,6 +23,8 @@
+--- a/drivers/net/wireless/ath/ath5k/eeprom.c
++++ b/drivers/net/wireless/ath/ath5k/eeprom.c
+@@ -22,6 +22,8 @@
  \*************************************/
  
  #include <linux/slab.h>
@@ -9,7 +9,7 @@
  
  #include "ath5k.h"
  #include "reg.h"
-@@ -34,6 +37,18 @@
+@@ -34,6 +36,18 @@
  static int ath5k_hw_eeprom_read(struct ath5k_hw *ah, u32 offset, u16 *data)
  {
  	u32 status, timeout;
@@ -28,7 +28,7 @@
  
  	/*
  	 * Initialize EEPROM access
-@@ -1788,7 +1802,7 @@
+@@ -1788,7 +1802,7 @@ ath5k_eeprom_init(struct ath5k_hw *ah)
  }
  
  /*
@@ -37,7 +37,7 @@
   */
  int ath5k_eeprom_read_mac(struct ath5k_hw *ah, u8 *mac)
  {
-@@ -1796,6 +1810,16 @@
+@@ -1796,6 +1810,16 @@ int ath5k_eeprom_read_mac(struct ath5k_h
  	u32 total, offset;
  	u16 data;
  	int octet, ret;
@@ -54,4 +54,3 @@
  
  	ret = ath5k_hw_eeprom_read(ah, 0x20, &data);
  	if (ret)
-
diff --git a/package/mac80211/patches/500-ath9k_eeprom_debugfs.patch b/package/mac80211/patches/500-ath9k_eeprom_debugfs.patch
new file mode 100644
index 000000000..20ad8b264
--- /dev/null
+++ b/package/mac80211/patches/500-ath9k_eeprom_debugfs.patch
@@ -0,0 +1,67 @@
+--- a/drivers/net/wireless/ath/ath9k/debug.c
++++ b/drivers/net/wireless/ath/ath9k/debug.c
+@@ -861,6 +861,53 @@ static const struct file_operations fops
+ 	.owner = THIS_MODULE
+ };
+ 
++static ssize_t read_file_eeprom(struct file *file, char __user *user_buf,
++			     size_t count, loff_t *ppos)
++{
++	struct ath_softc *sc = file->private_data;
++	struct ath_hw *ah = sc->sc_ah;
++	struct ath_common *common = ath9k_hw_common(ah);
++	int bytes = 0;
++	int pos = *ppos;
++	int size = 4096;
++	u16 val;
++	int i;
++
++	if (AR_SREV_9300_20_OR_LATER(ah))
++		size = 16384;
++
++	if (*ppos < 0)
++		return -EINVAL;
++
++	if (count > size - *ppos)
++		count = size - *ppos;
++
++	for (i = *ppos / 2; count > 0; count -= bytes, *ppos += bytes, i++) {
++		void *from = &val;
++
++		if (!common->bus_ops->eeprom_read(common, i, &val))
++			val = 0xffff;
++
++		if (*ppos % 2) {
++			from++;
++			bytes = 1;
++		} else if (count == 1) {
++			bytes = 1;
++		} else {
++			bytes = 2;
++		}
++		copy_to_user(user_buf, from, bytes);
++		user_buf += bytes;
++	}
++	return *ppos - pos;
++}
++
++static const struct file_operations fops_eeprom = {
++	.read = read_file_eeprom,
++	.open = ath9k_debugfs_open,
++	.owner = THIS_MODULE
++};
++
+ int ath9k_init_debug(struct ath_hw *ah)
+ {
+ 	struct ath_common *common = ath9k_hw_common(ah);
+@@ -920,6 +967,10 @@ int ath9k_init_debug(struct ath_hw *ah)
+ 			sc->debug.debugfs_phy, &ah->config.cwm_ignore_extcca))
+ 		goto err;
+ 
++	if (!debugfs_create_file("eeprom", S_IRUSR,
++			sc->debug.debugfs_phy, sc, &fops_eeprom))
++		goto err;
++
+ 	sc->debug.regidx = 0;
+ 	return 0;
+ err:
diff --git a/package/mac80211/patches/500-ath9k_use_minstrel.patch b/package/mac80211/patches/500-ath9k_use_minstrel.patch
deleted file mode 100644
index 9cb129309..000000000
--- a/package/mac80211/patches/500-ath9k_use_minstrel.patch
+++ /dev/null
@@ -1,14 +0,0 @@
---- a/drivers/net/wireless/ath/ath9k/init.c
-+++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -659,7 +659,11 @@ void ath9k_set_hw_capab(struct ath_softc
- 	hw->sta_data_size = sizeof(struct ath_node);
- 	hw->vif_data_size = sizeof(struct ath_vif);
- 
-+#ifdef ATH9K_USE_MINSTREL
-+	hw->rate_control_algorithm = "minstrel_ht";
-+#else
- 	hw->rate_control_algorithm = "ath9k_rate_control";
-+#endif
- 
- 	if (test_bit(ATH9K_MODE_11G, sc->sc_ah->caps.wireless_modes))
- 		hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
diff --git a/package/mac80211/patches/510-ath9k_aggr_delim_fix.patch b/package/mac80211/patches/510-ath9k_aggr_delim_fix.patch
new file mode 100644
index 000000000..a34ff9264
--- /dev/null
+++ b/package/mac80211/patches/510-ath9k_aggr_delim_fix.patch
@@ -0,0 +1,13 @@
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -177,8 +177,8 @@ void ath_descdma_cleanup(struct ath_soft
+ 
+ /* returns delimiter padding required given the packet length */
+ #define ATH_AGGR_GET_NDELIM(_len)					\
+-	(((((_len) + ATH_AGGR_DELIM_SZ) < ATH_AGGR_MINPLEN) ?           \
+-	  (ATH_AGGR_MINPLEN - (_len) - ATH_AGGR_DELIM_SZ) : 0) >> 2)
++	(((_len) >= ATH_AGGR_MINPLEN) ? 0 :				\
++	 DIV_ROUND_UP(ATH_AGGR_MINPLEN - (_len), ATH_AGGR_DELIM_SZ))
+ 
+ #define BAW_WITHIN(_start, _bawsz, _seqno) \
+ 	((((_seqno) - (_start)) & 4095) < (_bawsz))
diff --git a/package/mac80211/patches/510-ath9k_handle_keymiss.patch b/package/mac80211/patches/510-ath9k_handle_keymiss.patch
deleted file mode 100644
index f4ff69b16..000000000
--- a/package/mac80211/patches/510-ath9k_handle_keymiss.patch
+++ /dev/null
@@ -1,23 +0,0 @@
---- a/drivers/net/wireless/ath/ath9k/mac.c
-+++ b/drivers/net/wireless/ath/ath9k/mac.c
-@@ -713,6 +713,8 @@ int ath9k_hw_rxprocdesc(struct ath_hw *a
- 			rs->rs_status |= ATH9K_RXERR_DECRYPT;
- 		else if (ads.ds_rxstatus8 & AR_MichaelErr)
- 			rs->rs_status |= ATH9K_RXERR_MIC;
-+		else if (ads.ds_rxstatus8 & AR_KeyMiss)
-+			rs->rs_status |= ATH9K_RXERR_DECRYPT;
- 	}
- 
- 	return 0;
---- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
-@@ -616,7 +616,8 @@ int ath9k_hw_process_rxdesc_edma(struct 
- 			rxs->rs_status |= ATH9K_RXERR_DECRYPT;
- 		} else if (rxsp->status11 & AR_MichaelErr) {
- 			rxs->rs_status |= ATH9K_RXERR_MIC;
--		}
-+		} else if (rxsp->status11 & AR_KeyMiss)
-+			rxs->rs_status |= ATH9K_RXERR_DECRYPT;
- 	}
- 
- 	return 0;
diff --git a/package/mac80211/patches/520-ath9k_ar9003_regulatory_power.patch b/package/mac80211/patches/520-ath9k_ar9003_regulatory_power.patch
new file mode 100644
index 000000000..6d0ecef86
--- /dev/null
+++ b/package/mac80211/patches/520-ath9k_ar9003_regulatory_power.patch
@@ -0,0 +1,18 @@
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -2133,6 +2133,7 @@ static void ath9k_hw_ar9300_set_txpower(
+ 					u8 twiceMaxRegulatoryPower,
+ 					u8 powerLimit)
+ {
++	struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
+ 	struct ath_common *common = ath9k_hw_common(ah);
+ 	u8 targetPowerValT2[ar9300RateSize];
+ 	unsigned int i = 0;
+@@ -2180,6 +2181,7 @@ static void ath9k_hw_ar9300_set_txpower(
+ 		i = ALL_TARGET_HT20_0_8_16; /* ht20 */
+ 
+ 	ah->txpower_limit = targetPowerValT2[i];
++	regulatory->max_power_level = ratesArray[i];
+ 
+ 	ar9003_hw_calibration_apply(ah, chan->channel);
+ }
diff --git a/package/mac80211/patches/520-pending_work.patch b/package/mac80211/patches/520-pending_work.patch
deleted file mode 100644
index bcbbaf66b..000000000
--- a/package/mac80211/patches/520-pending_work.patch
+++ /dev/null
@@ -1,993 +0,0 @@
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -103,11 +103,13 @@ int ieee80211_hw_config(struct ieee80211
- 	int ret = 0;
- 	int power;
- 	enum nl80211_channel_type channel_type;
-+	u32 offchannel_flag;
- 
- 	might_sleep();
- 
- 	scan_chan = local->scan_channel;
- 
-+	offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
- 	if (scan_chan) {
- 		chan = scan_chan;
- 		channel_type = NL80211_CHAN_NO_HT;
-@@ -121,8 +123,9 @@ int ieee80211_hw_config(struct ieee80211
- 		channel_type = local->_oper_channel_type;
- 		local->hw.conf.flags &= ~IEEE80211_CONF_OFFCHANNEL;
- 	}
-+	offchannel_flag ^= local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
- 
--	if (chan != local->hw.conf.channel ||
-+	if (offchannel_flag || chan != local->hw.conf.channel ||
- 	    channel_type != local->hw.conf.channel_type) {
- 		local->hw.conf.channel = chan;
- 		local->hw.conf.channel_type = channel_type;
---- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
-@@ -63,6 +63,7 @@ static bool ar9002_hw_per_calibration(st
- 				      u8 rxchainmask,
- 				      struct ath9k_cal_list *currCal)
- {
-+	struct ath9k_hw_cal_data *caldata = ah->caldata;
- 	bool iscaldone = false;
- 
- 	if (currCal->calState == CAL_RUNNING) {
-@@ -81,14 +82,14 @@ static bool ar9002_hw_per_calibration(st
- 				}
- 
- 				currCal->calData->calPostProc(ah, numChains);
--				ichan->CalValid |= currCal->calData->calType;
-+				caldata->CalValid |= currCal->calData->calType;
- 				currCal->calState = CAL_DONE;
- 				iscaldone = true;
- 			} else {
- 				ar9002_hw_setup_calibration(ah, currCal);
- 			}
- 		}
--	} else if (!(ichan->CalValid & currCal->calData->calType)) {
-+	} else if (!(caldata->CalValid & currCal->calData->calType)) {
- 		ath9k_hw_reset_calibration(ah, currCal);
- 	}
- 
-@@ -686,8 +687,13 @@ static bool ar9002_hw_calibrate(struct a
- {
- 	bool iscaldone = true;
- 	struct ath9k_cal_list *currCal = ah->cal_list_curr;
-+	bool nfcal, nfcal_pending = false;
- 
--	if (currCal &&
-+	nfcal = !!(REG_READ(ah, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF);
-+	if (ah->caldata)
-+		nfcal_pending = ah->caldata->nfcal_pending;
-+
-+	if (currCal && !nfcal &&
- 	    (currCal->calState == CAL_RUNNING ||
- 	     currCal->calState == CAL_WAITING)) {
- 		iscaldone = ar9002_hw_per_calibration(ah, chan,
-@@ -703,7 +709,7 @@ static bool ar9002_hw_calibrate(struct a
- 	}
- 
- 	/* Do NF cal only at longer intervals */
--	if (longcal) {
-+	if (longcal || nfcal_pending) {
- 		/* Do periodic PAOffset Cal */
- 		ar9002_hw_pa_cal(ah, false);
- 		ar9002_hw_olc_temp_compensation(ah);
-@@ -712,16 +718,18 @@ static bool ar9002_hw_calibrate(struct a
- 		 * Get the value from the previous NF cal and update
- 		 * history buffer.
- 		 */
--		ath9k_hw_getnf(ah, chan);
--
--		/*
--		 * Load the NF from history buffer of the current channel.
--		 * NF is slow time-variant, so it is OK to use a historical
--		 * value.
--		 */
--		ath9k_hw_loadnf(ah, ah->curchan);
-+		if (ath9k_hw_getnf(ah, chan)) {
-+			/*
-+			 * Load the NF from history buffer of the current
-+			 * channel.
-+			 * NF is slow time-variant, so it is OK to use a
-+			 * historical value.
-+			 */
-+			ath9k_hw_loadnf(ah, ah->curchan);
-+		}
- 
--		ath9k_hw_start_nfcal(ah);
-+		if (longcal)
-+			ath9k_hw_start_nfcal(ah, false);
- 	}
- 
- 	return iscaldone;
-@@ -869,8 +877,10 @@ static bool ar9002_hw_init_cal(struct at
- 	ar9002_hw_pa_cal(ah, true);
- 
- 	/* Do NF Calibration after DC offset and other calibrations */
--	REG_WRITE(ah, AR_PHY_AGC_CONTROL,
--		  REG_READ(ah, AR_PHY_AGC_CONTROL) | AR_PHY_AGC_CONTROL_NF);
-+	ath9k_hw_start_nfcal(ah, true);
-+
-+	if (ah->caldata)
-+		ah->caldata->nfcal_pending = true;
- 
- 	ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
- 
-@@ -901,7 +911,8 @@ static bool ar9002_hw_init_cal(struct at
- 			ath9k_hw_reset_calibration(ah, ah->cal_list_curr);
- 	}
- 
--	chan->CalValid = 0;
-+	if (ah->caldata)
-+		ah->caldata->CalValid = 0;
- 
- 	return true;
- }
---- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-@@ -68,6 +68,7 @@ static bool ar9003_hw_per_calibration(st
- 				      u8 rxchainmask,
- 				      struct ath9k_cal_list *currCal)
- {
-+	struct ath9k_hw_cal_data *caldata = ah->caldata;
- 	/* Cal is assumed not done until explicitly set below */
- 	bool iscaldone = false;
- 
-@@ -95,7 +96,7 @@ static bool ar9003_hw_per_calibration(st
- 				currCal->calData->calPostProc(ah, numChains);
- 
- 				/* Calibration has finished. */
--				ichan->CalValid |= currCal->calData->calType;
-+				caldata->CalValid |= currCal->calData->calType;
- 				currCal->calState = CAL_DONE;
- 				iscaldone = true;
- 			} else {
-@@ -106,7 +107,7 @@ static bool ar9003_hw_per_calibration(st
- 			ar9003_hw_setup_calibration(ah, currCal);
- 			}
- 		}
--	} else if (!(ichan->CalValid & currCal->calData->calType)) {
-+	} else if (!(caldata->CalValid & currCal->calData->calType)) {
- 		/* If current cal is marked invalid in channel, kick it off */
- 		ath9k_hw_reset_calibration(ah, currCal);
- 	}
-@@ -149,6 +150,12 @@ static bool ar9003_hw_calibrate(struct a
- 	/* Do NF cal only at longer intervals */
- 	if (longcal) {
- 		/*
-+		 * Get the value from the previous NF cal and update
-+		 * history buffer.
-+		 */
-+		ath9k_hw_getnf(ah, chan);
-+
-+		/*
- 		 * Load the NF from history buffer of the current channel.
- 		 * NF is slow time-variant, so it is OK to use a historical
- 		 * value.
-@@ -156,7 +163,7 @@ static bool ar9003_hw_calibrate(struct a
- 		ath9k_hw_loadnf(ah, ah->curchan);
- 
- 		/* start NF calibration, without updating BB NF register */
--		ath9k_hw_start_nfcal(ah);
-+		ath9k_hw_start_nfcal(ah, false);
- 	}
- 
- 	return iscaldone;
-@@ -762,6 +769,8 @@ static bool ar9003_hw_init_cal(struct at
- 	/* Revert chainmasks to their original values before NF cal */
- 	ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
- 
-+	ath9k_hw_start_nfcal(ah, true);
-+
- 	/* Initialize list pointers */
- 	ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
- 
-@@ -785,7 +794,8 @@ static bool ar9003_hw_init_cal(struct at
- 	if (ah->cal_list_curr)
- 		ath9k_hw_reset_calibration(ah, ah->cal_list_curr);
- 
--	chan->CalValid = 0;
-+	if (ah->caldata)
-+		ah->caldata->CalValid = 0;
- 
- 	return true;
- }
---- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-@@ -542,7 +542,11 @@ static void ar9003_hw_prog_ini(struct at
- 		u32 reg = INI_RA(iniArr, i, 0);
- 		u32 val = INI_RA(iniArr, i, column);
- 
--		REG_WRITE(ah, reg, val);
-+		if (reg >= 0x16000 && reg < 0x17000)
-+			ath9k_hw_analog_shift_regwrite(ah, reg, val);
-+		else
-+			REG_WRITE(ah, reg, val);
-+
- 		DO_DELAY(regWrites);
- 	}
- }
---- a/drivers/net/wireless/ath/ath9k/calib.c
-+++ b/drivers/net/wireless/ath/ath9k/calib.c
-@@ -22,23 +22,6 @@
- /* We can tune this as we go by monitoring really low values */
- #define ATH9K_NF_TOO_LOW	-60
- 
--/* AR5416 may return very high value (like -31 dBm), in those cases the nf
-- * is incorrect and we should use the static NF value. Later we can try to
-- * find out why they are reporting these values */
--
--static bool ath9k_hw_nf_in_range(struct ath_hw *ah, s16 nf)
--{
--	if (nf > ATH9K_NF_TOO_LOW) {
--		ath_print(ath9k_hw_common(ah), ATH_DBG_CALIBRATE,
--			  "noise floor value detected (%d) is "
--			  "lower than what we think is a "
--			  "reasonable value (%d)\n",
--			  nf, ATH9K_NF_TOO_LOW);
--		return false;
--	}
--	return true;
--}
--
- static int16_t ath9k_hw_get_nf_hist_mid(int16_t *nfCalBuffer)
- {
- 	int16_t nfval;
-@@ -121,6 +104,19 @@ void ath9k_hw_reset_calibration(struct a
- 	ah->cal_samples = 0;
- }
- 
-+static s16 ath9k_hw_get_default_nf(struct ath_hw *ah,
-+				   struct ath9k_channel *chan)
-+{
-+	struct ath_nf_limits *limit;
-+
-+	if (!chan || IS_CHAN_2GHZ(chan))
-+		limit = &ah->nf_2g;
-+	else
-+		limit = &ah->nf_5g;
-+
-+	return limit->nominal;
-+}
-+
- /* This is done for the currently configured channel */
- bool ath9k_hw_reset_calvalid(struct ath_hw *ah)
- {
-@@ -128,7 +124,7 @@ bool ath9k_hw_reset_calvalid(struct ath_
- 	struct ieee80211_conf *conf = &common->hw->conf;
- 	struct ath9k_cal_list *currCal = ah->cal_list_curr;
- 
--	if (!ah->curchan)
-+	if (!ah->caldata)
- 		return true;
- 
- 	if (!AR_SREV_9100(ah) && !AR_SREV_9160_10_OR_LATER(ah))
-@@ -151,37 +147,55 @@ bool ath9k_hw_reset_calvalid(struct ath_
- 		  "Resetting Cal %d state for channel %u\n",
- 		  currCal->calData->calType, conf->channel->center_freq);
- 
--	ah->curchan->CalValid &= ~currCal->calData->calType;
-+	ah->caldata->CalValid &= ~currCal->calData->calType;
- 	currCal->calState = CAL_WAITING;
- 
- 	return false;
- }
- EXPORT_SYMBOL(ath9k_hw_reset_calvalid);
- 
--void ath9k_hw_start_nfcal(struct ath_hw *ah)
-+void ath9k_hw_start_nfcal(struct ath_hw *ah, bool update)
- {
-+	if (ah->caldata)
-+		ah->caldata->nfcal_pending = true;
-+
- 	REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
- 		    AR_PHY_AGC_CONTROL_ENABLE_NF);
--	REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
-+
-+	if (update)
-+		REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
-+		    AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
-+	else
-+		REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
- 		    AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
-+
- 	REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
- }
- 
- void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
- {
--	struct ath9k_nfcal_hist *h;
-+	struct ath9k_nfcal_hist *h = NULL;
- 	unsigned i, j;
- 	int32_t val;
- 	u8 chainmask = (ah->rxchainmask << 3) | ah->rxchainmask;
- 	struct ath_common *common = ath9k_hw_common(ah);
-+	s16 default_nf = ath9k_hw_get_default_nf(ah, chan);
- 
--	h = ah->nfCalHist;
-+	if (ah->caldata)
-+		h = ah->caldata->nfCalHist;
- 
- 	for (i = 0; i < NUM_NF_READINGS; i++) {
- 		if (chainmask & (1 << i)) {
-+			s16 nfval;
-+
-+			if (h)
-+				nfval = h[i].privNF;
-+			else
-+				nfval = default_nf;
-+
- 			val = REG_READ(ah, ah->nf_regs[i]);
- 			val &= 0xFFFFFE00;
--			val |= (((u32) (h[i].privNF) << 1) & 0x1ff);
-+			val |= (((u32) nfval << 1) & 0x1ff);
- 			REG_WRITE(ah, ah->nf_regs[i], val);
- 		}
- 	}
-@@ -277,22 +291,25 @@ static void ath9k_hw_nf_sanitize(struct 
- 	}
- }
- 
--int16_t ath9k_hw_getnf(struct ath_hw *ah,
--		       struct ath9k_channel *chan)
-+bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan)
- {
- 	struct ath_common *common = ath9k_hw_common(ah);
- 	int16_t nf, nfThresh;
- 	int16_t nfarray[NUM_NF_READINGS] = { 0 };
- 	struct ath9k_nfcal_hist *h;
- 	struct ieee80211_channel *c = chan->chan;
-+	struct ath9k_hw_cal_data *caldata = ah->caldata;
-+
-+	if (!caldata)
-+		return false;
- 
- 	chan->channelFlags &= (~CHANNEL_CW_INT);
- 	if (REG_READ(ah, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF) {
- 		ath_print(common, ATH_DBG_CALIBRATE,
- 			  "NF did not complete in calibration window\n");
- 		nf = 0;
--		chan->rawNoiseFloor = nf;
--		return chan->rawNoiseFloor;
-+		caldata->rawNoiseFloor = nf;
-+		return false;
- 	} else {
- 		ath9k_hw_do_getnf(ah, nfarray);
- 		ath9k_hw_nf_sanitize(ah, nfarray);
-@@ -307,47 +324,40 @@ int16_t ath9k_hw_getnf(struct ath_hw *ah
- 		}
- 	}
- 
--	h = ah->nfCalHist;
--
-+	h = caldata->nfCalHist;
-+	caldata->nfcal_pending = false;
- 	ath9k_hw_update_nfcal_hist_buffer(h, nfarray);
--	chan->rawNoiseFloor = h[0].privNF;
--
--	return chan->rawNoiseFloor;
-+	caldata->rawNoiseFloor = h[0].privNF;
-+	return true;
- }
- 
--void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah)
-+void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah,
-+				  struct ath9k_channel *chan)
- {
--	struct ath_nf_limits *limit;
-+	struct ath9k_nfcal_hist *h;
-+	s16 default_nf;
- 	int i, j;
- 
--	if (!ah->curchan || IS_CHAN_2GHZ(ah->curchan))
--		limit = &ah->nf_2g;
--	else
--		limit = &ah->nf_5g;
-+	if (!ah->caldata)
-+		return;
- 
-+	h = ah->caldata->nfCalHist;
-+	default_nf = ath9k_hw_get_default_nf(ah, chan);
- 	for (i = 0; i < NUM_NF_READINGS; i++) {
--		ah->nfCalHist[i].currIndex = 0;
--		ah->nfCalHist[i].privNF = limit->nominal;
--		ah->nfCalHist[i].invalidNFcount =
--			AR_PHY_CCA_FILTERWINDOW_LENGTH;
-+		h[i].currIndex = 0;
-+		h[i].privNF = default_nf;
-+		h[i].invalidNFcount = AR_PHY_CCA_FILTERWINDOW_LENGTH;
- 		for (j = 0; j < ATH9K_NF_CAL_HIST_MAX; j++) {
--			ah->nfCalHist[i].nfCalBuffer[j] = limit->nominal;
-+			h[i].nfCalBuffer[j] = default_nf;
- 		}
- 	}
- }
- 
- s16 ath9k_hw_getchan_noise(struct ath_hw *ah, struct ath9k_channel *chan)
- {
--	s16 nf;
--
--	if (chan->rawNoiseFloor == 0)
--		nf = -96;
--	else
--		nf = chan->rawNoiseFloor;
--
--	if (!ath9k_hw_nf_in_range(ah, nf))
--		nf = ATH_DEFAULT_NOISE_FLOOR;
-+	if (!ah->caldata || !ah->caldata->rawNoiseFloor)
-+		return ath9k_hw_get_default_nf(ah, chan);
- 
--	return nf;
-+	return ah->caldata->rawNoiseFloor;
- }
- EXPORT_SYMBOL(ath9k_hw_getchan_noise);
---- a/drivers/net/wireless/ath/ath9k/calib.h
-+++ b/drivers/net/wireless/ath/ath9k/calib.h
-@@ -108,11 +108,11 @@ struct ath9k_pacal_info{
- };
- 
- bool ath9k_hw_reset_calvalid(struct ath_hw *ah);
--void ath9k_hw_start_nfcal(struct ath_hw *ah);
-+void ath9k_hw_start_nfcal(struct ath_hw *ah, bool update);
- void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan);
--int16_t ath9k_hw_getnf(struct ath_hw *ah,
--		       struct ath9k_channel *chan);
--void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah);
-+bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan);
-+void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah,
-+				  struct ath9k_channel *chan);
- s16 ath9k_hw_getchan_noise(struct ath_hw *ah, struct ath9k_channel *chan);
- void ath9k_hw_reset_calibration(struct ath_hw *ah,
- 				struct ath9k_cal_list *currCal);
---- a/drivers/net/wireless/ath/ath9k/hw.c
-+++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -622,7 +622,6 @@ static int __ath9k_hw_init(struct ath_hw
- 	else
- 		ah->tx_trig_level = (AR_FTRIG_512B >> AR_FTRIG_S);
- 
--	ath9k_init_nfcal_hist_buffer(ah);
- 	ah->bb_watchdog_timeout_ms = 25;
- 
- 	common->state = ATH_HW_INITIALIZED;
-@@ -1195,9 +1194,6 @@ static bool ath9k_hw_channel_change(stru
- 
- 	ath9k_hw_spur_mitigate_freq(ah, chan);
- 
--	if (!chan->oneTimeCalsDone)
--		chan->oneTimeCalsDone = true;
--
- 	return true;
- }
- 
-@@ -1230,7 +1226,7 @@ bool ath9k_hw_check_alive(struct ath_hw 
- EXPORT_SYMBOL(ath9k_hw_check_alive);
- 
- int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
--		    bool bChannelChange)
-+		   struct ath9k_hw_cal_data *caldata, bool bChannelChange)
- {
- 	struct ath_common *common = ath9k_hw_common(ah);
- 	u32 saveLedState;
-@@ -1255,9 +1251,19 @@ int ath9k_hw_reset(struct ath_hw *ah, st
- 	if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE))
- 		return -EIO;
- 
--	if (curchan && !ah->chip_fullsleep)
-+	if (curchan && !ah->chip_fullsleep && ah->caldata)
- 		ath9k_hw_getnf(ah, curchan);
- 
-+	ah->caldata = caldata;
-+	if (caldata &&
-+	    (chan->channel != caldata->channel ||
-+	     (chan->channelFlags & ~CHANNEL_CW_INT) !=
-+	     (caldata->channelFlags & ~CHANNEL_CW_INT))) {
-+		/* Operating channel changed, reset channel calibration data */
-+		memset(caldata, 0, sizeof(*caldata));
-+		ath9k_init_nfcal_hist_buffer(ah, chan);
-+	}
-+
- 	if (bChannelChange &&
- 	    (ah->chip_fullsleep != true) &&
- 	    (ah->curchan != NULL) &&
-@@ -1268,7 +1274,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
- 
- 		if (ath9k_hw_channel_change(ah, chan)) {
- 			ath9k_hw_loadnf(ah, ah->curchan);
--			ath9k_hw_start_nfcal(ah);
-+			ath9k_hw_start_nfcal(ah, true);
- 			return 0;
- 		}
- 	}
-@@ -1473,11 +1479,8 @@ int ath9k_hw_reset(struct ath_hw *ah, st
- 	if (ah->btcoex_hw.enabled)
- 		ath9k_hw_btcoex_enable(ah);
- 
--	if (AR_SREV_9300_20_OR_LATER(ah)) {
--		ath9k_hw_loadnf(ah, curchan);
--		ath9k_hw_start_nfcal(ah);
-+	if (AR_SREV_9300_20_OR_LATER(ah))
- 		ar9003_hw_bb_watchdog_config(ah);
--	}
- 
- 	return 0;
- }
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -155,6 +155,27 @@ void ath9k_ps_restore(struct ath_softc *
- 	spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
- }
- 
-+static void ath_start_ani(struct ath_common *common)
-+{
-+	struct ath_hw *ah = common->ah;
-+	unsigned long timestamp = jiffies_to_msecs(jiffies);
-+	struct ath_softc *sc = (struct ath_softc *) common->priv;
-+
-+	if (!(sc->sc_flags & SC_OP_ANI_RUN))
-+		return;
-+
-+	if (sc->sc_flags & SC_OP_OFFCHANNEL)
-+		return;
-+
-+	common->ani.longcal_timer = timestamp;
-+	common->ani.shortcal_timer = timestamp;
-+	common->ani.checkani_timer = timestamp;
-+
-+	mod_timer(&common->ani.timer,
-+		  jiffies +
-+			msecs_to_jiffies((u32)ah->config.ani_poll_interval));
-+}
-+
- /*
-  * Set/change channels.  If the channel is really being changed, it's done
-  * by reseting the chip.  To accomplish this we must first cleanup any pending
-@@ -163,16 +184,23 @@ void ath9k_ps_restore(struct ath_softc *
- int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
- 		    struct ath9k_channel *hchan)
- {
-+	struct ath_wiphy *aphy = hw->priv;
- 	struct ath_hw *ah = sc->sc_ah;
- 	struct ath_common *common = ath9k_hw_common(ah);
- 	struct ieee80211_conf *conf = &common->hw->conf;
- 	bool fastcc = true, stopped;
- 	struct ieee80211_channel *channel = hw->conf.channel;
-+	struct ath9k_hw_cal_data *caldata = NULL;
- 	int r;
- 
- 	if (sc->sc_flags & SC_OP_INVALID)
- 		return -EIO;
- 
-+	del_timer_sync(&common->ani.timer);
-+	cancel_work_sync(&sc->paprd_work);
-+	cancel_work_sync(&sc->hw_check_work);
-+	cancel_delayed_work_sync(&sc->tx_complete_work);
-+
- 	ath9k_ps_wakeup(sc);
- 
- 	/*
-@@ -192,9 +220,12 @@ int ath_set_channel(struct ath_softc *sc
- 	 * to flush data frames already in queue because of
- 	 * changing channel. */
- 
--	if (!stopped || (sc->sc_flags & SC_OP_FULL_RESET))
-+	if (!stopped || !(sc->sc_flags & SC_OP_OFFCHANNEL))
- 		fastcc = false;
- 
-+	if (!(sc->sc_flags & SC_OP_OFFCHANNEL))
-+		caldata = &aphy->caldata;
-+
- 	ath_print(common, ATH_DBG_CONFIG,
- 		  "(%u MHz) -> (%u MHz), conf_is_ht40: %d\n",
- 		  sc->sc_ah->curchan->channel,
-@@ -202,7 +233,7 @@ int ath_set_channel(struct ath_softc *sc
- 
- 	spin_lock_bh(&sc->sc_resetlock);
- 
--	r = ath9k_hw_reset(ah, hchan, fastcc);
-+	r = ath9k_hw_reset(ah, hchan, caldata, fastcc);
- 	if (r) {
- 		ath_print(common, ATH_DBG_FATAL,
- 			  "Unable to reset channel (%u MHz), "
-@@ -213,8 +244,6 @@ int ath_set_channel(struct ath_softc *sc
- 	}
- 	spin_unlock_bh(&sc->sc_resetlock);
- 
--	sc->sc_flags &= ~SC_OP_FULL_RESET;
--
- 	if (ath_startrecv(sc) != 0) {
- 		ath_print(common, ATH_DBG_FATAL,
- 			  "Unable to restart recv logic\n");
-@@ -226,6 +255,12 @@ int ath_set_channel(struct ath_softc *sc
- 	ath_update_txpow(sc);
- 	ath9k_hw_set_interrupts(ah, ah->imask);
- 
-+	if (!(sc->sc_flags & (SC_OP_OFFCHANNEL | SC_OP_SCANNING))) {
-+		ath_start_ani(common);
-+		ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
-+		ath_beacon_config(sc, NULL);
-+	}
-+
-  ps_restore:
- 	ath9k_ps_restore(sc);
- 	return r;
-@@ -234,17 +269,19 @@ int ath_set_channel(struct ath_softc *sc
- static void ath_paprd_activate(struct ath_softc *sc)
- {
- 	struct ath_hw *ah = sc->sc_ah;
-+	struct ath9k_hw_cal_data *caldata = ah->caldata;
- 	int chain;
- 
--	if (!ah->curchan->paprd_done)
-+	if (!caldata || !caldata->paprd_done)
- 		return;
- 
- 	ath9k_ps_wakeup(sc);
-+	ar9003_paprd_enable(ah, false);
- 	for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
- 		if (!(ah->caps.tx_chainmask & BIT(chain)))
- 			continue;
- 
--		ar9003_paprd_populate_single_table(ah, ah->curchan, chain);
-+		ar9003_paprd_populate_single_table(ah, caldata, chain);
- 	}
- 
- 	ar9003_paprd_enable(ah, true);
-@@ -262,6 +299,7 @@ void ath_paprd_calibrate(struct work_str
- 	int band = hw->conf.channel->band;
- 	struct ieee80211_supported_band *sband = &sc->sbands[band];
- 	struct ath_tx_control txctl;
-+	struct ath9k_hw_cal_data *caldata = ah->caldata;
- 	int qnum, ftype;
- 	int chain_ok = 0;
- 	int chain;
-@@ -269,6 +307,9 @@ void ath_paprd_calibrate(struct work_str
- 	int time_left;
- 	int i;
- 
-+	if (!caldata)
-+		return;
-+
- 	skb = alloc_skb(len, GFP_KERNEL);
- 	if (!skb)
- 		return;
-@@ -323,7 +364,7 @@ void ath_paprd_calibrate(struct work_str
- 		if (!ar9003_paprd_is_done(ah))
- 			break;
- 
--		if (ar9003_paprd_create_curve(ah, ah->curchan, chain) != 0)
-+		if (ar9003_paprd_create_curve(ah, caldata, chain) != 0)
- 			break;
- 
- 		chain_ok = 1;
-@@ -331,7 +372,7 @@ void ath_paprd_calibrate(struct work_str
- 	kfree_skb(skb);
- 
- 	if (chain_ok) {
--		ah->curchan->paprd_done = true;
-+		caldata->paprd_done = true;
- 		ath_paprd_activate(sc);
- 	}
- 
-@@ -440,33 +481,14 @@ set_timer:
- 		cal_interval = min(cal_interval, (u32)short_cal_interval);
- 
- 	mod_timer(&common->ani.timer, jiffies + msecs_to_jiffies(cal_interval));
--	if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_PAPRD) &&
--	    !(sc->sc_flags & SC_OP_SCANNING)) {
--		if (!sc->sc_ah->curchan->paprd_done)
-+	if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_PAPRD) && ah->caldata) {
-+		if (!ah->caldata->paprd_done)
- 			ieee80211_queue_work(sc->hw, &sc->paprd_work);
- 		else
- 			ath_paprd_activate(sc);
- 	}
- }
- 
--static void ath_start_ani(struct ath_common *common)
--{
--	struct ath_hw *ah = common->ah;
--	unsigned long timestamp = jiffies_to_msecs(jiffies);
--	struct ath_softc *sc = (struct ath_softc *) common->priv;
--
--	if (!(sc->sc_flags & SC_OP_ANI_RUN))
--		return;
--
--	common->ani.longcal_timer = timestamp;
--	common->ani.shortcal_timer = timestamp;
--	common->ani.checkani_timer = timestamp;
--
--	mod_timer(&common->ani.timer,
--		  jiffies +
--			msecs_to_jiffies((u32)ah->config.ani_poll_interval));
--}
--
- /*
-  * Update tx/rx chainmask. For legacy association,
-  * hard code chainmask to 1x1, for 11n association, use
-@@ -478,7 +500,7 @@ void ath_update_chainmask(struct ath_sof
- 	struct ath_hw *ah = sc->sc_ah;
- 	struct ath_common *common = ath9k_hw_common(ah);
- 
--	if ((sc->sc_flags & SC_OP_SCANNING) || is_ht ||
-+	if ((sc->sc_flags & SC_OP_OFFCHANNEL) || is_ht ||
- 	    (ah->btcoex_hw.scheme != ATH_BTCOEX_CFG_NONE)) {
- 		common->tx_chainmask = ah->caps.tx_chainmask;
- 		common->rx_chainmask = ah->caps.rx_chainmask;
-@@ -818,7 +840,7 @@ void ath_radio_enable(struct ath_softc *
- 		ah->curchan = ath_get_curchannel(sc, sc->hw);
- 
- 	spin_lock_bh(&sc->sc_resetlock);
--	r = ath9k_hw_reset(ah, ah->curchan, false);
-+	r = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
- 	if (r) {
- 		ath_print(common, ATH_DBG_FATAL,
- 			  "Unable to reset channel (%u MHz), "
-@@ -878,7 +900,7 @@ void ath_radio_disable(struct ath_softc 
- 		ah->curchan = ath_get_curchannel(sc, hw);
- 
- 	spin_lock_bh(&sc->sc_resetlock);
--	r = ath9k_hw_reset(ah, ah->curchan, false);
-+	r = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
- 	if (r) {
- 		ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
- 			  "Unable to reset channel (%u MHz), "
-@@ -911,7 +933,7 @@ int ath_reset(struct ath_softc *sc, bool
- 	ath_flushrecv(sc);
- 
- 	spin_lock_bh(&sc->sc_resetlock);
--	r = ath9k_hw_reset(ah, sc->sc_ah->curchan, false);
-+	r = ath9k_hw_reset(ah, sc->sc_ah->curchan, ah->caldata, false);
- 	if (r)
- 		ath_print(common, ATH_DBG_FATAL,
- 			  "Unable to reset hardware; reset status %d\n", r);
-@@ -1086,7 +1108,7 @@ static int ath9k_start(struct ieee80211_
- 	 * and then setup of the interrupt mask.
- 	 */
- 	spin_lock_bh(&sc->sc_resetlock);
--	r = ath9k_hw_reset(ah, init_channel, false);
-+	r = ath9k_hw_reset(ah, init_channel, ah->caldata, false);
- 	if (r) {
- 		ath_print(common, ATH_DBG_FATAL,
- 			  "Unable to reset hardware; reset status %d "
-@@ -1580,6 +1602,10 @@ static int ath9k_config(struct ieee80211
- 
- 		aphy->chan_idx = pos;
- 		aphy->chan_is_ht = conf_is_ht(conf);
-+		if (hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
-+			sc->sc_flags |= SC_OP_OFFCHANNEL;
-+		else
-+			sc->sc_flags &= ~SC_OP_OFFCHANNEL;
- 
- 		if (aphy->state == ATH_WIPHY_SCAN ||
- 		    aphy->state == ATH_WIPHY_ACTIVE)
-@@ -1991,7 +2017,6 @@ static void ath9k_sw_scan_start(struct i
- {
- 	struct ath_wiphy *aphy = hw->priv;
- 	struct ath_softc *sc = aphy->sc;
--	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
- 
- 	mutex_lock(&sc->mutex);
- 	if (ath9k_wiphy_scanning(sc)) {
-@@ -2009,10 +2034,6 @@ static void ath9k_sw_scan_start(struct i
- 	aphy->state = ATH_WIPHY_SCAN;
- 	ath9k_wiphy_pause_all_forced(sc, aphy);
- 	sc->sc_flags |= SC_OP_SCANNING;
--	del_timer_sync(&common->ani.timer);
--	cancel_work_sync(&sc->paprd_work);
--	cancel_work_sync(&sc->hw_check_work);
--	cancel_delayed_work_sync(&sc->tx_complete_work);
- 	mutex_unlock(&sc->mutex);
- }
- 
-@@ -2024,15 +2045,10 @@ static void ath9k_sw_scan_complete(struc
- {
- 	struct ath_wiphy *aphy = hw->priv;
- 	struct ath_softc *sc = aphy->sc;
--	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
- 
- 	mutex_lock(&sc->mutex);
- 	aphy->state = ATH_WIPHY_ACTIVE;
- 	sc->sc_flags &= ~SC_OP_SCANNING;
--	sc->sc_flags |= SC_OP_FULL_RESET;
--	ath_start_ani(common);
--	ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
--	ath_beacon_config(sc, NULL);
- 	mutex_unlock(&sc->mutex);
- }
- 
---- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
-@@ -577,10 +577,11 @@ static bool create_pa_curve(u32 *data_L,
- }
- 
- void ar9003_paprd_populate_single_table(struct ath_hw *ah,
--					struct ath9k_channel *chan, int chain)
-+					struct ath9k_hw_cal_data *caldata,
-+					int chain)
- {
--	u32 *paprd_table_val = chan->pa_table[chain];
--	u32 small_signal_gain = chan->small_signal_gain[chain];
-+	u32 *paprd_table_val = caldata->pa_table[chain];
-+	u32 small_signal_gain = caldata->small_signal_gain[chain];
- 	u32 training_power;
- 	u32 reg = 0;
- 	int i;
-@@ -654,17 +655,17 @@ int ar9003_paprd_setup_gain_table(struct
- }
- EXPORT_SYMBOL(ar9003_paprd_setup_gain_table);
- 
--int ar9003_paprd_create_curve(struct ath_hw *ah, struct ath9k_channel *chan,
--			      int chain)
-+int ar9003_paprd_create_curve(struct ath_hw *ah,
-+			      struct ath9k_hw_cal_data *caldata, int chain)
- {
--	u16 *small_signal_gain = &chan->small_signal_gain[chain];
--	u32 *pa_table = chan->pa_table[chain];
-+	u16 *small_signal_gain = &caldata->small_signal_gain[chain];
-+	u32 *pa_table = caldata->pa_table[chain];
- 	u32 *data_L, *data_U;
- 	int i, status = 0;
- 	u32 *buf;
- 	u32 reg;
- 
--	memset(chan->pa_table[chain], 0, sizeof(chan->pa_table[chain]));
-+	memset(caldata->pa_table[chain], 0, sizeof(caldata->pa_table[chain]));
- 
- 	buf = kmalloc(2 * 48 * sizeof(u32), GFP_ATOMIC);
- 	if (!buf)
---- a/drivers/net/wireless/ath/ath9k/ath9k.h
-+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -511,7 +511,7 @@ void ath_deinit_leds(struct ath_softc *s
- #define SC_OP_BEACONS                BIT(1)
- #define SC_OP_RXAGGR                 BIT(2)
- #define SC_OP_TXAGGR                 BIT(3)
--#define SC_OP_FULL_RESET             BIT(4)
-+#define SC_OP_OFFCHANNEL             BIT(4)
- #define SC_OP_PREAMBLE_SHORT         BIT(5)
- #define SC_OP_PROTECT_ENABLE         BIT(6)
- #define SC_OP_RXFLUSH                BIT(7)
-@@ -612,6 +612,7 @@ struct ath_softc {
- struct ath_wiphy {
- 	struct ath_softc *sc; /* shared for all virtual wiphys */
- 	struct ieee80211_hw *hw;
-+	struct ath9k_hw_cal_data caldata;
- 	enum ath_wiphy_state {
- 		ATH_WIPHY_INACTIVE,
- 		ATH_WIPHY_ACTIVE,
---- a/drivers/net/wireless/ath/ath9k/htc.h
-+++ b/drivers/net/wireless/ath/ath9k/htc.h
-@@ -353,6 +353,8 @@ struct ath9k_htc_priv {
- 	u16 seq_no;
- 	u32 bmiss_cnt;
- 
-+	struct ath9k_hw_cal_data caldata[38];
-+
- 	spinlock_t beacon_lock;
- 
- 	bool tx_queues_stop;
---- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
-+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
-@@ -125,6 +125,7 @@ static int ath9k_htc_set_channel(struct 
- 	struct ieee80211_conf *conf = &common->hw->conf;
- 	bool fastcc = true;
- 	struct ieee80211_channel *channel = hw->conf.channel;
-+	struct ath9k_hw_cal_data *caldata;
- 	enum htc_phymode mode;
- 	__be16 htc_mode;
- 	u8 cmd_rsp;
-@@ -149,7 +150,8 @@ static int ath9k_htc_set_channel(struct 
- 		  priv->ah->curchan->channel,
- 		  channel->center_freq, conf_is_ht(conf), conf_is_ht40(conf));
- 
--	ret = ath9k_hw_reset(ah, hchan, fastcc);
-+	caldata = &priv->caldata[channel->hw_value];
-+	ret = ath9k_hw_reset(ah, hchan, caldata, fastcc);
- 	if (ret) {
- 		ath_print(common, ATH_DBG_FATAL,
- 			  "Unable to reset channel (%u Mhz) "
-@@ -1028,7 +1030,7 @@ static void ath9k_htc_radio_enable(struc
- 		ah->curchan = ath9k_cmn_get_curchannel(hw, ah);
- 
- 	/* Reset the HW */
--	ret = ath9k_hw_reset(ah, ah->curchan, false);
-+	ret = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
- 	if (ret) {
- 		ath_print(common, ATH_DBG_FATAL,
- 			  "Unable to reset hardware; reset status %d "
-@@ -1091,7 +1093,7 @@ static void ath9k_htc_radio_disable(stru
- 		ah->curchan = ath9k_cmn_get_curchannel(hw, ah);
- 
- 	/* Reset the HW */
--	ret = ath9k_hw_reset(ah, ah->curchan, false);
-+	ret = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
- 	if (ret) {
- 		ath_print(common, ATH_DBG_FATAL,
- 			  "Unable to reset hardware; reset status %d "
-@@ -1179,7 +1181,7 @@ static int ath9k_htc_start(struct ieee80
- 	ath9k_hw_configpcipowersave(ah, 0, 0);
- 
- 	ath9k_hw_htc_resetinit(ah);
--	ret = ath9k_hw_reset(ah, init_channel, false);
-+	ret = ath9k_hw_reset(ah, init_channel, ah->caldata, false);
- 	if (ret) {
- 		ath_print(common, ATH_DBG_FATAL,
- 			  "Unable to reset hardware; reset status %d "
---- a/drivers/net/wireless/ath/ath9k/hw.h
-+++ b/drivers/net/wireless/ath/ath9k/hw.h
-@@ -346,19 +346,25 @@ enum ath9k_int {
- 	 CHANNEL_HT40PLUS |			\
- 	 CHANNEL_HT40MINUS)
- 
--struct ath9k_channel {
--	struct ieee80211_channel *chan;
-+struct ath9k_hw_cal_data {
- 	u16 channel;
- 	u32 channelFlags;
--	u32 chanmode;
- 	int32_t CalValid;
--	bool oneTimeCalsDone;
- 	int8_t iCoff;
- 	int8_t qCoff;
- 	int16_t rawNoiseFloor;
- 	bool paprd_done;
-+	bool nfcal_pending;
- 	u16 small_signal_gain[AR9300_MAX_CHAINS];
- 	u32 pa_table[AR9300_MAX_CHAINS][PAPRD_TABLE_SZ];
-+	struct ath9k_nfcal_hist nfCalHist[NUM_NF_READINGS];
-+};
-+
-+struct ath9k_channel {
-+	struct ieee80211_channel *chan;
-+	u16 channel;
-+	u32 channelFlags;
-+	u32 chanmode;
- };
- 
- #define IS_CHAN_G(_c) ((((_c)->channelFlags & (CHANNEL_G)) == CHANNEL_G) || \
-@@ -669,7 +675,7 @@ struct ath_hw {
- 	enum nl80211_iftype opmode;
- 	enum ath9k_power_mode power_mode;
- 
--	struct ath9k_nfcal_hist nfCalHist[NUM_NF_READINGS];
-+	struct ath9k_hw_cal_data *caldata;
- 	struct ath9k_pacal_info pacal_info;
- 	struct ar5416Stats stats;
- 	struct ath9k_tx_queue_info txq[ATH9K_NUM_TX_QUEUES];
-@@ -863,7 +869,7 @@ const char *ath9k_hw_probe(u16 vendorid,
- void ath9k_hw_deinit(struct ath_hw *ah);
- int ath9k_hw_init(struct ath_hw *ah);
- int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
--		   bool bChannelChange);
-+		   struct ath9k_hw_cal_data *caldata, bool bChannelChange);
- int ath9k_hw_fill_cap_info(struct ath_hw *ah);
- u32 ath9k_regd_get_ctl(struct ath_regulatory *reg, struct ath9k_channel *chan);
- 
-@@ -958,9 +964,10 @@ void ar9003_hw_bb_watchdog_read(struct a
- void ar9003_hw_bb_watchdog_dbg_info(struct ath_hw *ah);
- void ar9003_paprd_enable(struct ath_hw *ah, bool val);
- void ar9003_paprd_populate_single_table(struct ath_hw *ah,
--					struct ath9k_channel *chan, int chain);
--int ar9003_paprd_create_curve(struct ath_hw *ah, struct ath9k_channel *chan,
--			      int chain);
-+					struct ath9k_hw_cal_data *caldata,
-+					int chain);
-+int ar9003_paprd_create_curve(struct ath_hw *ah,
-+			      struct ath9k_hw_cal_data *caldata, int chain);
- int ar9003_paprd_setup_gain_table(struct ath_hw *ah, int chain);
- int ar9003_paprd_init_table(struct ath_hw *ah);
- bool ar9003_paprd_is_done(struct ath_hw *ah);
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -1181,7 +1181,7 @@ void ath_drain_all_txq(struct ath_softc 
- 			  "Failed to stop TX DMA. Resetting hardware!\n");
- 
- 		spin_lock_bh(&sc->sc_resetlock);
--		r = ath9k_hw_reset(ah, sc->sc_ah->curchan, false);
-+		r = ath9k_hw_reset(ah, sc->sc_ah->curchan, ah->caldata, false);
- 		if (r)
- 			ath_print(common, ATH_DBG_FATAL,
- 				  "Unable to reset hardware; reset status %d\n",
diff --git a/package/mac80211/patches/521-ath9k_hw_tx_power.patch b/package/mac80211/patches/521-ath9k_hw_tx_power.patch
new file mode 100644
index 000000000..4777cec26
--- /dev/null
+++ b/package/mac80211/patches/521-ath9k_hw_tx_power.patch
@@ -0,0 +1,327 @@
+--- a/drivers/net/wireless/ath/ath9k/eeprom.h
++++ b/drivers/net/wireless/ath/ath9k/eeprom.h
+@@ -680,7 +680,8 @@ struct eeprom_ops {
+ 	void (*set_addac)(struct ath_hw *hw, struct ath9k_channel *chan);
+ 	void (*set_txpower)(struct ath_hw *hw, struct ath9k_channel *chan,
+ 			   u16 cfgCtl, u8 twiceAntennaReduction,
+-			   u8 twiceMaxRegulatoryPower, u8 powerLimit);
++			   u8 twiceMaxRegulatoryPower, u8 powerLimit,
++			   bool test);
+ 	u16 (*get_spur_channel)(struct ath_hw *ah, u16 i, bool is2GHz);
+ };
+ 
+--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
++++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+@@ -726,7 +726,7 @@ static void ath9k_hw_4k_set_txpower(stru
+ 				    u16 cfgCtl,
+ 				    u8 twiceAntennaReduction,
+ 				    u8 twiceMaxRegulatoryPower,
+-				    u8 powerLimit)
++				    u8 powerLimit, bool test)
+ {
+ 	struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
+ 	struct ar5416_eeprom_4k *pEepData = &ah->eeprom.map4k;
+@@ -751,15 +751,20 @@ static void ath9k_hw_4k_set_txpower(stru
+ 
+ 	ath9k_hw_set_4k_power_cal_table(ah, chan, &txPowerIndexOffset);
+ 
++	regulatory->max_power_level = 0;
+ 	for (i = 0; i < ARRAY_SIZE(ratesArray); i++) {
+ 		ratesArray[i] =	(int16_t)(txPowerIndexOffset + ratesArray[i]);
+ 		if (ratesArray[i] > AR5416_MAX_RATE_POWER)
+ 			ratesArray[i] = AR5416_MAX_RATE_POWER;
++
++		if (ratesArray[i] > regulatory->max_power_level)
++			regulatory->max_power_level = ratesArray[i];
+ 	}
+ 
++	if (test)
++	    return;
+ 
+ 	/* Update regulatory */
+-
+ 	i = rate6mb;
+ 	if (IS_CHAN_HT40(chan))
+ 		i = rateHt40_0;
+--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
++++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+@@ -853,7 +853,7 @@ static void ath9k_hw_ar9287_set_txpower(
+ 					struct ath9k_channel *chan, u16 cfgCtl,
+ 					u8 twiceAntennaReduction,
+ 					u8 twiceMaxRegulatoryPower,
+-					u8 powerLimit)
++					u8 powerLimit, bool test)
+ {
+ 	struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
+ 	struct ar9287_eeprom *pEepData = &ah->eeprom.map9287;
+@@ -877,12 +877,26 @@ static void ath9k_hw_ar9287_set_txpower(
+ 
+ 	ath9k_hw_set_ar9287_power_cal_table(ah, chan, &txPowerIndexOffset);
+ 
++	regulatory->max_power_level = 0;
+ 	for (i = 0; i < ARRAY_SIZE(ratesArray); i++) {
+ 		ratesArray[i] = (int16_t)(txPowerIndexOffset + ratesArray[i]);
+ 		if (ratesArray[i] > AR9287_MAX_RATE_POWER)
+ 			ratesArray[i] = AR9287_MAX_RATE_POWER;
++
++		if (ratesArray[i] > regulatory->max_power_level)
++			regulatory->max_power_level = ratesArray[i];
+ 	}
+ 
++	if (test)
++		return;
++
++	if (IS_CHAN_2GHZ(chan))
++		i = rate1l;
++	else
++		i = rate6mb;
++
++	regulatory->max_power_level = ratesArray[i];
++
+ 	if (AR_SREV_9280_20_OR_LATER(ah)) {
+ 		for (i = 0; i < Ar5416RateSize; i++)
+ 			ratesArray[i] -= AR9287_PWR_TABLE_OFFSET_DB * 2;
+@@ -971,17 +985,6 @@ static void ath9k_hw_ar9287_set_txpower(
+ 			  | ATH9K_POW_SM(ratesArray[rateDupOfdm], 8)
+ 			  | ATH9K_POW_SM(ratesArray[rateDupCck], 0));
+ 	}
+-
+-	if (IS_CHAN_2GHZ(chan))
+-		i = rate1l;
+-	else
+-		i = rate6mb;
+-
+-	if (AR_SREV_9280_20_OR_LATER(ah))
+-		regulatory->max_power_level =
+-			ratesArray[i] + AR9287_PWR_TABLE_OFFSET_DB * 2;
+-	else
+-		regulatory->max_power_level = ratesArray[i];
+ }
+ 
+ static void ath9k_hw_ar9287_set_addac(struct ath_hw *ah,
+--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
++++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
+@@ -1258,7 +1258,7 @@ static void ath9k_hw_def_set_txpower(str
+ 				    u16 cfgCtl,
+ 				    u8 twiceAntennaReduction,
+ 				    u8 twiceMaxRegulatoryPower,
+-				    u8 powerLimit)
++				    u8 powerLimit, bool test)
+ {
+ #define RT_AR_DELTA(x) (ratesArray[x] - cck_ofdm_delta)
+ 	struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
+@@ -1285,12 +1285,44 @@ static void ath9k_hw_def_set_txpower(str
+ 
+ 	ath9k_hw_set_def_power_cal_table(ah, chan, &txPowerIndexOffset);
+ 
++	regulatory->max_power_level = 0;
+ 	for (i = 0; i < ARRAY_SIZE(ratesArray); i++) {
+ 		ratesArray[i] =	(int16_t)(txPowerIndexOffset + ratesArray[i]);
+ 		if (ratesArray[i] > AR5416_MAX_RATE_POWER)
+ 			ratesArray[i] = AR5416_MAX_RATE_POWER;
++		if (ratesArray[i] > regulatory->max_power_level)
++			regulatory->max_power_level = ratesArray[i];
+ 	}
+ 
++	if (!test) {
++		i = rate6mb;
++
++		if (IS_CHAN_HT40(chan))
++			i = rateHt40_0;
++		else if (IS_CHAN_HT20(chan))
++			i = rateHt20_0;
++
++		regulatory->max_power_level = ratesArray[i];
++	}
++
++	switch(ar5416_get_ntxchains(ah->txchainmask)) {
++	case 1:
++		break;
++	case 2:
++		regulatory->max_power_level += INCREASE_MAXPOW_BY_TWO_CHAIN;
++		break;
++	case 3:
++		regulatory->max_power_level += INCREASE_MAXPOW_BY_THREE_CHAIN;
++		break;
++	default:
++		ath_print(ath9k_hw_common(ah), ATH_DBG_EEPROM,
++			  "Invalid chainmask configuration\n");
++		break;
++	}
++
++	if (test)
++		return;
++
+ 	if (AR_SREV_9280_20_OR_LATER(ah)) {
+ 		for (i = 0; i < Ar5416RateSize; i++) {
+ 			int8_t pwr_table_offset;
+@@ -1387,34 +1419,6 @@ static void ath9k_hw_def_set_txpower(str
+ 	REG_WRITE(ah, AR_PHY_POWER_TX_SUB,
+ 		  ATH9K_POW_SM(pModal->pwrDecreaseFor3Chain, 6)
+ 		  | ATH9K_POW_SM(pModal->pwrDecreaseFor2Chain, 0));
+-
+-	i = rate6mb;
+-
+-	if (IS_CHAN_HT40(chan))
+-		i = rateHt40_0;
+-	else if (IS_CHAN_HT20(chan))
+-		i = rateHt20_0;
+-
+-	if (AR_SREV_9280_20_OR_LATER(ah))
+-		regulatory->max_power_level =
+-			ratesArray[i] + AR5416_PWR_TABLE_OFFSET_DB * 2;
+-	else
+-		regulatory->max_power_level = ratesArray[i];
+-
+-	switch(ar5416_get_ntxchains(ah->txchainmask)) {
+-	case 1:
+-		break;
+-	case 2:
+-		regulatory->max_power_level += INCREASE_MAXPOW_BY_TWO_CHAIN;
+-		break;
+-	case 3:
+-		regulatory->max_power_level += INCREASE_MAXPOW_BY_THREE_CHAIN;
+-		break;
+-	default:
+-		ath_print(ath9k_hw_common(ah), ATH_DBG_EEPROM,
+-			  "Invalid chainmask configuration\n");
+-		break;
+-	}
+ }
+ 
+ static u8 ath9k_hw_def_get_num_ant_config(struct ath_hw *ah,
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -2131,7 +2131,7 @@ static void ath9k_hw_ar9300_set_txpower(
+ 					struct ath9k_channel *chan, u16 cfgCtl,
+ 					u8 twiceAntennaReduction,
+ 					u8 twiceMaxRegulatoryPower,
+-					u8 powerLimit)
++					u8 powerLimit, bool test)
+ {
+ 	struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
+ 	struct ath_common *common = ath9k_hw_common(ah);
+@@ -2145,7 +2145,16 @@ static void ath9k_hw_ar9300_set_txpower(
+ 					   twiceMaxRegulatoryPower,
+ 					   powerLimit);
+ 
+-	while (i < ar9300RateSize) {
++	regulatory->max_power_level = 0;
++	for (i = 0; i < ar9300RateSize; i++) {
++		if (targetPowerValT2[i] > regulatory->max_power_level)
++			regulatory->max_power_level = targetPowerValT2[i];
++	}
++
++	if (test)
++		return;
++
++	for (i = 0; i < ar9300RateSize; i++) {
+ 		ath_print(common, ATH_DBG_EEPROM,
+ 			  "TPC[%02d] 0x%08x ", i, targetPowerValT2[i]);
+ 		i++;
+@@ -2160,9 +2169,6 @@ static void ath9k_hw_ar9300_set_txpower(
+ 		i++;
+ 	}
+ 
+-	/* Write target power array to registers */
+-	ar9003_hw_tx_power_regwrite(ah, targetPowerValT2);
+-
+ 	/*
+ 	 * This is the TX power we send back to driver core,
+ 	 * and it can use to pass to userspace to display our
+@@ -2181,8 +2187,10 @@ static void ath9k_hw_ar9300_set_txpower(
+ 		i = ALL_TARGET_HT20_0_8_16; /* ht20 */
+ 
+ 	ah->txpower_limit = targetPowerValT2[i];
+-	regulatory->max_power_level = ratesArray[i];
++	regulatory->max_power_level = targetPowerValT2[i];
+ 
++	/* Write target power array to registers */
++	ar9003_hw_tx_power_regwrite(ah, targetPowerValT2);
+ 	ar9003_hw_calibration_apply(ah, chan->channel);
+ }
+ 
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1178,7 +1178,7 @@ static bool ath9k_hw_channel_change(stru
+ 			     channel->max_antenna_gain * 2,
+ 			     channel->max_power * 2,
+ 			     min((u32) MAX_RATE_POWER,
+-			     (u32) regulatory->power_limit));
++			     (u32) regulatory->power_limit), false);
+ 
+ 	ath9k_hw_rfbus_done(ah);
+ 
+@@ -2177,7 +2177,7 @@ bool ath9k_hw_disable(struct ath_hw *ah)
+ }
+ EXPORT_SYMBOL(ath9k_hw_disable);
+ 
+-void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit)
++void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit, bool test)
+ {
+ 	struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
+ 	struct ath9k_channel *chan = ah->curchan;
+@@ -2190,7 +2190,7 @@ void ath9k_hw_set_txpowerlimit(struct at
+ 				 channel->max_antenna_gain * 2,
+ 				 channel->max_power * 2,
+ 				 min((u32) MAX_RATE_POWER,
+-				 (u32) regulatory->power_limit));
++				 (u32) regulatory->power_limit), test);
+ }
+ EXPORT_SYMBOL(ath9k_hw_set_txpowerlimit);
+ 
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -860,7 +860,7 @@ u32 ath9k_hw_getrxfilter(struct ath_hw *
+ void ath9k_hw_setrxfilter(struct ath_hw *ah, u32 bits);
+ bool ath9k_hw_phy_disable(struct ath_hw *ah);
+ bool ath9k_hw_disable(struct ath_hw *ah);
+-void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit);
++void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit, bool test);
+ void ath9k_hw_setopmode(struct ath_hw *ah);
+ void ath9k_hw_setmcastfilter(struct ath_hw *ah, u32 filter0, u32 filter1);
+ void ath9k_hw_setbssidmask(struct ath_hw *ah);
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -24,7 +24,7 @@ static void ath_update_txpow(struct ath_
+ 	struct ath_hw *ah = sc->sc_ah;
+ 
+ 	if (sc->curtxpow != sc->config.txpowlimit) {
+-		ath9k_hw_set_txpowerlimit(ah, sc->config.txpowlimit);
++		ath9k_hw_set_txpowerlimit(ah, sc->config.txpowlimit, false);
+ 		/* read back in case value is clamped */
+ 		sc->curtxpow = ath9k_hw_regulatory(ah)->power_limit;
+ 	}
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -614,7 +614,7 @@ static int ar9003_hw_process_ini(struct 
+ 				 channel->max_antenna_gain * 2,
+ 				 channel->max_power * 2,
+ 				 min((u32) MAX_RATE_POWER,
+-				 (u32) regulatory->power_limit));
++				 (u32) regulatory->power_limit), false);
+ 
+ 	return 0;
+ }
+--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+@@ -875,7 +875,7 @@ static int ar5008_hw_process_ini(struct 
+ 				 channel->max_antenna_gain * 2,
+ 				 channel->max_power * 2,
+ 				 min((u32) MAX_RATE_POWER,
+-				 (u32) regulatory->power_limit));
++				 (u32) regulatory->power_limit), false);
+ 
+ 	/* Write analog registers */
+ 	if (!ath9k_hw_set_rf_regs(ah, chan, freqIndex)) {
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+@@ -29,7 +29,7 @@ static void ath_update_txpow(struct ath9
+ 	struct ath_hw *ah = priv->ah;
+ 
+ 	if (priv->curtxpow != priv->txpowlimit) {
+-		ath9k_hw_set_txpowerlimit(ah, priv->txpowlimit);
++		ath9k_hw_set_txpowerlimit(ah, priv->txpowlimit, false);
+ 		/* read back in case value is clamped */
+ 		priv->curtxpow = ath9k_hw_regulatory(ah)->power_limit;
+ 	}
diff --git a/package/mac80211/patches/522-ath9k_tx_power_init.patch b/package/mac80211/patches/522-ath9k_tx_power_init.patch
new file mode 100644
index 000000000..b8138af25
--- /dev/null
+++ b/package/mac80211/patches/522-ath9k_tx_power_init.patch
@@ -0,0 +1,115 @@
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -650,6 +650,37 @@ err_hw:
+ 	return ret;
+ }
+ 
++static void ath9k_init_band_txpower(struct ath_softc *sc, int band)
++{
++	struct ieee80211_supported_band *sband;
++	struct ieee80211_channel *chan;
++	struct ath_hw *ah = sc->sc_ah;
++	struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
++	int i;
++
++	sband = &sc->sbands[band];
++	for (i = 0; i < sband->n_channels; i++) {
++		chan = &sband->channels[i];
++		ah->curchan = &ah->channels[chan->hw_value];
++		ath9k_cmn_update_ichannel(ah->curchan, chan, NL80211_CHAN_HT20);
++		ath9k_hw_set_txpowerlimit(ah, MAX_RATE_POWER, true);
++		chan->max_power = reg->max_power_level / 2;
++	}
++}
++
++static void ath9k_init_txpower_limits(struct ath_softc *sc)
++{
++	struct ath_hw *ah = sc->sc_ah;
++	struct ath9k_channel *curchan = ah->curchan;
++
++	if (ah->caps.hw_caps & ATH9K_HW_CAP_2GHZ)
++		ath9k_init_band_txpower(sc, IEEE80211_BAND_2GHZ);
++	if (ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
++		ath9k_init_band_txpower(sc, IEEE80211_BAND_5GHZ);
++
++	ah->curchan = curchan;
++}
++
+ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+ {
+ 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+@@ -765,6 +796,8 @@ int ath9k_init_device(u16 devid, struct 
+ 	if (error != 0)
+ 		goto error_rx;
+ 
++	ath9k_init_txpower_limits(sc);
++
+ 	/* Register with mac80211 */
+ 	error = ieee80211_register_hw(hw);
+ 	if (error)
+--- a/drivers/net/wireless/ath/ath9k/common.c
++++ b/drivers/net/wireless/ath/ath9k/common.c
+@@ -107,12 +107,10 @@ static u32 ath9k_get_extchanmode(struct 
+ /*
+  * Update internal channel flags.
+  */
+-void ath9k_cmn_update_ichannel(struct ieee80211_hw *hw,
+-			       struct ath9k_channel *ichan)
++void ath9k_cmn_update_ichannel(struct ath9k_channel *ichan,
++			       struct ieee80211_channel *chan,
++			       enum nl80211_channel_type channel_type)
+ {
+-	struct ieee80211_channel *chan = hw->conf.channel;
+-	struct ieee80211_conf *conf = &hw->conf;
+-
+ 	ichan->channel = chan->center_freq;
+ 	ichan->chan = chan;
+ 
+@@ -124,9 +122,8 @@ void ath9k_cmn_update_ichannel(struct ie
+ 		ichan->channelFlags = CHANNEL_5GHZ | CHANNEL_OFDM;
+ 	}
+ 
+-	if (conf_is_ht(conf))
+-		ichan->chanmode = ath9k_get_extchanmode(chan,
+-							conf->channel_type);
++	if (channel_type != NL80211_CHAN_NO_HT)
++		ichan->chanmode = ath9k_get_extchanmode(chan, channel_type);
+ }
+ EXPORT_SYMBOL(ath9k_cmn_update_ichannel);
+ 
+@@ -142,7 +139,7 @@ struct ath9k_channel *ath9k_cmn_get_curc
+ 
+ 	chan_idx = curchan->hw_value;
+ 	channel = &ah->channels[chan_idx];
+-	ath9k_cmn_update_ichannel(hw, channel);
++	ath9k_cmn_update_ichannel(channel, curchan, hw->conf.channel_type);
+ 
+ 	return channel;
+ }
+--- a/drivers/net/wireless/ath/ath9k/common.h
++++ b/drivers/net/wireless/ath/ath9k/common.h
+@@ -62,8 +62,9 @@ enum ath_stomp_type {
+ 
+ int ath9k_cmn_padpos(__le16 frame_control);
+ int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb);
+-void ath9k_cmn_update_ichannel(struct ieee80211_hw *hw,
+-			       struct ath9k_channel *ichan);
++void ath9k_cmn_update_ichannel(struct ath9k_channel *ichan,
++			       struct ieee80211_channel *chan,
++			       enum nl80211_channel_type channel_type);
+ struct ath9k_channel *ath9k_cmn_get_curchannel(struct ieee80211_hw *hw,
+ 					       struct ath_hw *ah);
+ int ath9k_cmn_count_streams(unsigned int chainmask, int max);
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+@@ -1405,7 +1405,9 @@ static int ath9k_htc_config(struct ieee8
+ 		ath_print(common, ATH_DBG_CONFIG, "Set channel: %d MHz\n",
+ 			  curchan->center_freq);
+ 
+-		ath9k_cmn_update_ichannel(hw, &priv->ah->channels[pos]);
++		ath9k_cmn_update_ichannel(&priv->ah->channels[pos],
++					  hw->conf.channel,
++					  hw->conf.channel_type);
+ 
+ 		if (ath9k_htc_set_channel(priv, hw, &priv->ah->channels[pos]) < 0) {
+ 			ath_print(common, ATH_DBG_FATAL,
diff --git a/package/mac80211/patches/530-ath9k_aggr_state_fix.patch b/package/mac80211/patches/530-ath9k_aggr_state_fix.patch
deleted file mode 100644
index d3a784948..000000000
--- a/package/mac80211/patches/530-ath9k_aggr_state_fix.patch
+++ /dev/null
@@ -1,72 +0,0 @@
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -120,26 +120,14 @@ static void ath_tx_queue_tid(struct ath_
- 	list_add_tail(&ac->list, &txq->axq_acq);
- }
- 
--static void ath_tx_pause_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
--{
--	struct ath_txq *txq = &sc->tx.txq[tid->ac->qnum];
--
--	spin_lock_bh(&txq->axq_lock);
--	tid->paused++;
--	spin_unlock_bh(&txq->axq_lock);
--}
--
- static void ath_tx_resume_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
- {
- 	struct ath_txq *txq = &sc->tx.txq[tid->ac->qnum];
- 
--	BUG_ON(tid->paused <= 0);
--	spin_lock_bh(&txq->axq_lock);
--
--	tid->paused--;
-+	WARN_ON(!tid->paused);
- 
--	if (tid->paused > 0)
--		goto unlock;
-+	spin_lock_bh(&txq->axq_lock);
-+	tid->paused = false;
- 
- 	if (list_empty(&tid->buf_q))
- 		goto unlock;
-@@ -157,15 +145,10 @@ static void ath_tx_flush_tid(struct ath_
- 	struct list_head bf_head;
- 	INIT_LIST_HEAD(&bf_head);
- 
--	BUG_ON(tid->paused <= 0);
--	spin_lock_bh(&txq->axq_lock);
-+	WARN_ON(!tid->paused);
- 
--	tid->paused--;
--
--	if (tid->paused > 0) {
--		spin_unlock_bh(&txq->axq_lock);
--		return;
--	}
-+	spin_lock_bh(&txq->axq_lock);
-+	tid->paused = false;
- 
- 	while (!list_empty(&tid->buf_q)) {
- 		bf = list_first_entry(&tid->buf_q, struct ath_buf, list);
-@@ -811,7 +794,7 @@ void ath_tx_aggr_start(struct ath_softc 
- 	an = (struct ath_node *)sta->drv_priv;
- 	txtid = ATH_AN_2_TID(an, tid);
- 	txtid->state |= AGGR_ADDBA_PROGRESS;
--	ath_tx_pause_tid(sc, txtid);
-+	txtid->paused = true;
- 	*ssn = txtid->seq_start;
- }
- 
-@@ -835,10 +818,9 @@ void ath_tx_aggr_stop(struct ath_softc *
- 		return;
- 	}
- 
--	ath_tx_pause_tid(sc, txtid);
--
- 	/* drop all software retried frames and mark this TID */
- 	spin_lock_bh(&txq->axq_lock);
-+	txtid->paused = true;
- 	while (!list_empty(&txtid->buf_q)) {
- 		bf = list_first_entry(&txtid->buf_q, struct ath_buf, list);
- 		if (!bf_isretried(bf)) {
diff --git a/package/mac80211/patches/530-ath9k_locking_fix.patch b/package/mac80211/patches/530-ath9k_locking_fix.patch
new file mode 100644
index 000000000..29303323a
--- /dev/null
+++ b/package/mac80211/patches/530-ath9k_locking_fix.patch
@@ -0,0 +1,363 @@
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -309,7 +309,6 @@ struct ath_rx {
+ 	u8 rxotherant;
+ 	u32 *rxlink;
+ 	unsigned int rxfilter;
+-	spinlock_t rxflushlock;
+ 	spinlock_t rxbuflock;
+ 	struct list_head rxbuf;
+ 	struct ath_descdma rxdma;
+@@ -600,9 +599,9 @@ struct ath_softc {
+ 	struct ath_hw *sc_ah;
+ 	void __iomem *mem;
+ 	int irq;
+-	spinlock_t sc_resetlock;
+ 	spinlock_t sc_serial_rw;
+ 	spinlock_t sc_pm_lock;
++	spinlock_t sc_pcu_lock;
+ 	struct mutex mutex;
+ 	struct work_struct paprd_work;
+ 	struct work_struct hw_check_work;
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -228,6 +228,8 @@ int ath_set_channel(struct ath_softc *sc
+ 
+ 	ath9k_ps_wakeup(sc);
+ 
++	spin_lock_bh(&sc->sc_pcu_lock);
++
+ 	/*
+ 	 * This is only performed if the channel settings have
+ 	 * actually changed.
+@@ -239,6 +241,7 @@ int ath_set_channel(struct ath_softc *sc
+ 	 */
+ 	ath9k_hw_disable_interrupts(ah);
+ 	ath_drain_all_txq(sc, false);
++
+ 	stopped = ath_stoprecv(sc);
+ 
+ 	/* XXX: do not flush receive queue here. We don't want
+@@ -257,18 +260,14 @@ int ath_set_channel(struct ath_softc *sc
+ 		  channel->center_freq, conf_is_ht40(conf),
+ 		  fastcc);
+ 
+-	spin_lock_bh(&sc->sc_resetlock);
+-
+ 	r = ath9k_hw_reset(ah, hchan, caldata, fastcc);
+ 	if (r) {
+ 		ath_print(common, ATH_DBG_FATAL,
+ 			  "Unable to reset channel (%u MHz), "
+ 			  "reset status %d\n",
+ 			  channel->center_freq, r);
+-		spin_unlock_bh(&sc->sc_resetlock);
+ 		goto ps_restore;
+ 	}
+-	spin_unlock_bh(&sc->sc_resetlock);
+ 
+ 	if (ath_startrecv(sc) != 0) {
+ 		ath_print(common, ATH_DBG_FATAL,
+@@ -287,6 +286,8 @@ int ath_set_channel(struct ath_softc *sc
+ 	}
+ 
+  ps_restore:
++	spin_unlock_bh(&sc->sc_pcu_lock);
++
+ 	ath9k_ps_restore(sc);
+ 	return r;
+ }
+@@ -600,6 +601,8 @@ void ath9k_tasklet(unsigned long data)
+ 		return;
+ 	}
+ 
++	spin_lock_bh(&sc->sc_pcu_lock);
++
+ 	if (!ath9k_hw_check_alive(ah))
+ 		ieee80211_queue_work(sc->hw, &sc->hw_check_work);
+ 
+@@ -610,15 +613,12 @@ void ath9k_tasklet(unsigned long data)
+ 		rxmask = (ATH9K_INT_RX | ATH9K_INT_RXEOL | ATH9K_INT_RXORN);
+ 
+ 	if (status & rxmask) {
+-		spin_lock_bh(&sc->rx.rxflushlock);
+-
+ 		/* Check for high priority Rx first */
+ 		if ((ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) &&
+ 		    (status & ATH9K_INT_RXHP))
+ 			ath_rx_tasklet(sc, 0, true);
+ 
+ 		ath_rx_tasklet(sc, 0, false);
+-		spin_unlock_bh(&sc->rx.rxflushlock);
+ 	}
+ 
+ 	if (status & ATH9K_INT_TX) {
+@@ -644,6 +644,8 @@ void ath9k_tasklet(unsigned long data)
+ 
+ 	/* re-enable hardware interrupt */
+ 	ath9k_hw_enable_interrupts(ah);
++
++	spin_unlock_bh(&sc->sc_pcu_lock);
+ 	ath9k_ps_restore(sc);
+ }
+ 
+@@ -871,12 +873,13 @@ void ath_radio_enable(struct ath_softc *
+ 	int r;
+ 
+ 	ath9k_ps_wakeup(sc);
++	spin_lock_bh(&sc->sc_pcu_lock);
++
+ 	ath9k_hw_configpcipowersave(ah, 0, 0);
+ 
+ 	if (!ah->curchan)
+ 		ah->curchan = ath_get_curchannel(sc, sc->hw);
+ 
+-	spin_lock_bh(&sc->sc_resetlock);
+ 	r = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
+ 	if (r) {
+ 		ath_print(common, ATH_DBG_FATAL,
+@@ -884,15 +887,14 @@ void ath_radio_enable(struct ath_softc *
+ 			  "reset status %d\n",
+ 			  channel->center_freq, r);
+ 	}
+-	spin_unlock_bh(&sc->sc_resetlock);
+ 
+ 	ath_update_txpow(sc);
+ 	if (ath_startrecv(sc) != 0) {
+ 		ath_print(common, ATH_DBG_FATAL,
+ 			  "Unable to restart recv logic\n");
++		spin_unlock_bh(&sc->sc_pcu_lock);
+ 		return;
+ 	}
+-
+ 	if (sc->sc_flags & SC_OP_BEACONS)
+ 		ath_beacon_config(sc, NULL);	/* restart beacons */
+ 
+@@ -905,6 +907,8 @@ void ath_radio_enable(struct ath_softc *
+ 	ath9k_hw_set_gpio(ah, ah->led_pin, 0);
+ 
+ 	ieee80211_wake_queues(hw);
++	spin_unlock_bh(&sc->sc_pcu_lock);
++
+ 	ath9k_ps_restore(sc);
+ }
+ 
+@@ -915,6 +919,8 @@ void ath_radio_disable(struct ath_softc 
+ 	int r;
+ 
+ 	ath9k_ps_wakeup(sc);
++	spin_lock_bh(&sc->sc_pcu_lock);
++
+ 	ieee80211_stop_queues(hw);
+ 
+ 	/*
+@@ -930,13 +936,13 @@ void ath_radio_disable(struct ath_softc 
+ 	ath9k_hw_disable_interrupts(ah);
+ 
+ 	ath_drain_all_txq(sc, false);	/* clear pending tx frames */
++
+ 	ath_stoprecv(sc);		/* turn off frame recv */
+ 	ath_flushrecv(sc);		/* flush recv queue */
+ 
+ 	if (!ah->curchan)
+ 		ah->curchan = ath_get_curchannel(sc, hw);
+ 
+-	spin_lock_bh(&sc->sc_resetlock);
+ 	r = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
+ 	if (r) {
+ 		ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
+@@ -944,11 +950,14 @@ void ath_radio_disable(struct ath_softc 
+ 			  "reset status %d\n",
+ 			  channel->center_freq, r);
+ 	}
+-	spin_unlock_bh(&sc->sc_resetlock);
+ 
+ 	ath9k_hw_phy_disable(ah);
++
+ 	ath9k_hw_configpcipowersave(ah, 1, 1);
++
++	spin_unlock_bh(&sc->sc_pcu_lock);
+ 	ath9k_ps_restore(sc);
++
+ 	ath9k_setpower(sc, ATH9K_PM_FULL_SLEEP);
+ }
+ 
+@@ -962,19 +971,20 @@ int ath_reset(struct ath_softc *sc, bool
+ 	/* Stop ANI */
+ 	del_timer_sync(&common->ani.timer);
+ 
++	spin_lock_bh(&sc->sc_pcu_lock);
++
+ 	ieee80211_stop_queues(hw);
+ 
+ 	ath9k_hw_disable_interrupts(ah);
+ 	ath_drain_all_txq(sc, retry_tx);
++
+ 	ath_stoprecv(sc);
+ 	ath_flushrecv(sc);
+ 
+-	spin_lock_bh(&sc->sc_resetlock);
+ 	r = ath9k_hw_reset(ah, sc->sc_ah->curchan, ah->caldata, false);
+ 	if (r)
+ 		ath_print(common, ATH_DBG_FATAL,
+ 			  "Unable to reset hardware; reset status %d\n", r);
+-	spin_unlock_bh(&sc->sc_resetlock);
+ 
+ 	if (ath_startrecv(sc) != 0)
+ 		ath_print(common, ATH_DBG_FATAL,
+@@ -1004,6 +1014,7 @@ int ath_reset(struct ath_softc *sc, bool
+ 	}
+ 
+ 	ieee80211_wake_queues(hw);
++	spin_unlock_bh(&sc->sc_pcu_lock);
+ 
+ 	/* Start ANI */
+ 	ath_start_ani(common);
+@@ -1142,17 +1153,16 @@ static int ath9k_start(struct ieee80211_
+ 	 * be followed by initialization of the appropriate bits
+ 	 * and then setup of the interrupt mask.
+ 	 */
+-	spin_lock_bh(&sc->sc_resetlock);
++	spin_lock_bh(&sc->sc_pcu_lock);
+ 	r = ath9k_hw_reset(ah, init_channel, ah->caldata, false);
+ 	if (r) {
+ 		ath_print(common, ATH_DBG_FATAL,
+ 			  "Unable to reset hardware; reset status %d "
+ 			  "(freq %u MHz)\n", r,
+ 			  curchan->center_freq);
+-		spin_unlock_bh(&sc->sc_resetlock);
++		spin_unlock_bh(&sc->sc_pcu_lock);
+ 		goto mutex_unlock;
+ 	}
+-	spin_unlock_bh(&sc->sc_resetlock);
+ 
+ 	/*
+ 	 * This is needed only to setup initial state
+@@ -1171,8 +1181,10 @@ static int ath9k_start(struct ieee80211_
+ 		ath_print(common, ATH_DBG_FATAL,
+ 			  "Unable to start recv logic\n");
+ 		r = -EIO;
++		spin_unlock_bh(&sc->sc_pcu_lock);
+ 		goto mutex_unlock;
+ 	}
++	spin_unlock_bh(&sc->sc_pcu_lock);
+ 
+ 	/* Setup our intr mask. */
+ 	ah->imask = ATH9K_INT_TX | ATH9K_INT_RXEOL |
+@@ -1367,6 +1379,8 @@ static void ath9k_stop(struct ieee80211_
+ 			ath9k_btcoex_timer_pause(sc);
+ 	}
+ 
++	spin_lock_bh(&sc->sc_pcu_lock);
++
+ 	/* make sure h/w will not generate any interrupt
+ 	 * before setting the invalid flag. */
+ 	ath9k_hw_disable_interrupts(ah);
+@@ -1381,6 +1395,9 @@ static void ath9k_stop(struct ieee80211_
+ 	/* disable HAL and put h/w to sleep */
+ 	ath9k_hw_disable(ah);
+ 	ath9k_hw_configpcipowersave(ah, 1, 1);
++
++	spin_unlock_bh(&sc->sc_pcu_lock);
++
+ 	ath9k_ps_restore(sc);
+ 
+ 	/* Finally, put the chip in FULL SLEEP mode */
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -297,19 +297,17 @@ static void ath_edma_start_recv(struct a
+ 	ath_rx_addbuffer_edma(sc, ATH9K_RX_QUEUE_LP,
+ 			      sc->rx.rx_edma[ATH9K_RX_QUEUE_LP].rx_fifo_hwsize);
+ 
+-	spin_unlock_bh(&sc->rx.rxbuflock);
+-
+ 	ath_opmode_init(sc);
+ 
+ 	ath9k_hw_startpcureceive(sc->sc_ah, (sc->sc_flags & SC_OP_OFFCHANNEL));
++
++	spin_unlock_bh(&sc->rx.rxbuflock);
+ }
+ 
+ static void ath_edma_stop_recv(struct ath_softc *sc)
+ {
+-	spin_lock_bh(&sc->rx.rxbuflock);
+ 	ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_HP);
+ 	ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_LP);
+-	spin_unlock_bh(&sc->rx.rxbuflock);
+ }
+ 
+ int ath_rx_init(struct ath_softc *sc, int nbufs)
+@@ -319,7 +317,7 @@ int ath_rx_init(struct ath_softc *sc, in
+ 	struct ath_buf *bf;
+ 	int error = 0;
+ 
+-	spin_lock_init(&sc->rx.rxflushlock);
++	spin_lock_init(&sc->sc_pcu_lock);
+ 	sc->sc_flags &= ~SC_OP_RXFLUSH;
+ 	spin_lock_init(&sc->rx.rxbuflock);
+ 
+@@ -506,9 +504,9 @@ int ath_startrecv(struct ath_softc *sc)
+ 	ath9k_hw_rxena(ah);
+ 
+ start_recv:
+-	spin_unlock_bh(&sc->rx.rxbuflock);
+ 	ath_opmode_init(sc);
+ 	ath9k_hw_startpcureceive(ah, (sc->sc_flags & SC_OP_OFFCHANNEL));
++	spin_unlock_bh(&sc->rx.rxbuflock);
+ 
+ 	return 0;
+ }
+@@ -518,6 +516,7 @@ bool ath_stoprecv(struct ath_softc *sc)
+ 	struct ath_hw *ah = sc->sc_ah;
+ 	bool stopped;
+ 
++	spin_lock_bh(&sc->rx.rxbuflock);
+ 	ath9k_hw_stoppcurecv(ah);
+ 	ath9k_hw_setrxfilter(ah, 0);
+ 	stopped = ath9k_hw_stopdmarecv(ah);
+@@ -526,19 +525,18 @@ bool ath_stoprecv(struct ath_softc *sc)
+ 		ath_edma_stop_recv(sc);
+ 	else
+ 		sc->rx.rxlink = NULL;
++	spin_unlock_bh(&sc->rx.rxbuflock);
+ 
+ 	return stopped;
+ }
+ 
+ void ath_flushrecv(struct ath_softc *sc)
+ {
+-	spin_lock_bh(&sc->rx.rxflushlock);
+ 	sc->sc_flags |= SC_OP_RXFLUSH;
+ 	if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+ 		ath_rx_tasklet(sc, 1, true);
+ 	ath_rx_tasklet(sc, 1, false);
+ 	sc->sc_flags &= ~SC_OP_RXFLUSH;
+-	spin_unlock_bh(&sc->rx.rxflushlock);
+ }
+ 
+ static bool ath_beacon_dtim_pending_cab(struct sk_buff *skb)
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -588,7 +588,6 @@ static int ath9k_init_softc(u16 devid, s
+ 	spin_lock_init(&common->cc_lock);
+ 
+ 	spin_lock_init(&sc->wiphy_lock);
+-	spin_lock_init(&sc->sc_resetlock);
+ 	spin_lock_init(&sc->sc_serial_rw);
+ 	spin_lock_init(&sc->sc_pm_lock);
+ 	mutex_init(&sc->mutex);
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -1142,13 +1142,11 @@ void ath_drain_all_txq(struct ath_softc 
+ 		ath_print(common, ATH_DBG_FATAL,
+ 			  "Failed to stop TX DMA. Resetting hardware!\n");
+ 
+-		spin_lock_bh(&sc->sc_resetlock);
+ 		r = ath9k_hw_reset(ah, sc->sc_ah->curchan, ah->caldata, false);
+ 		if (r)
+ 			ath_print(common, ATH_DBG_FATAL,
+ 				  "Unable to reset hardware; reset status %d\n",
+ 				  r);
+-		spin_unlock_bh(&sc->sc_resetlock);
+ 	}
+ 
+ 	for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
diff --git a/package/mac80211/patches/540-ath9k_bstuck_debug.patch b/package/mac80211/patches/540-ath9k_bstuck_debug.patch
deleted file mode 100644
index b2d44c5bb..000000000
--- a/package/mac80211/patches/540-ath9k_bstuck_debug.patch
+++ /dev/null
@@ -1,43 +0,0 @@
---- a/drivers/net/wireless/ath/debug.h
-+++ b/drivers/net/wireless/ath/debug.h
-@@ -36,6 +36,7 @@
-  * @ATH_DBG_PS: power save processing
-  * @ATH_DBG_HWTIMER: hardware timer handling
-  * @ATH_DBG_BTCOEX: bluetooth coexistance
-+ * @ATH_DBG_BSTUCK: stuck beacons
-  * @ATH_DBG_ANY: enable all debugging
-  *
-  * The debug level is used to control the amount and type of debugging output
-@@ -60,6 +61,7 @@ enum ATH_DEBUG {
- 	ATH_DBG_HWTIMER		= 0x00001000,
- 	ATH_DBG_BTCOEX		= 0x00002000,
- 	ATH_DBG_WMI		= 0x00004000,
-+	ATH_DBG_BSTUCK		= 0x00008000,
- 	ATH_DBG_ANY		= 0xffffffff
- };
- 
---- a/drivers/net/wireless/ath/ath9k/beacon.c
-+++ b/drivers/net/wireless/ath/ath9k/beacon.c
-@@ -359,11 +359,11 @@ void ath_beacon_tasklet(unsigned long da
- 		sc->beacon.bmisscnt++;
- 
- 		if (sc->beacon.bmisscnt < BSTUCK_THRESH) {
--			ath_print(common, ATH_DBG_BEACON,
-+			ath_print(common, ATH_DBG_BSTUCK,
- 				  "missed %u consecutive beacons\n",
- 				  sc->beacon.bmisscnt);
- 		} else if (sc->beacon.bmisscnt >= BSTUCK_THRESH) {
--			ath_print(common, ATH_DBG_BEACON,
-+			ath_print(common, ATH_DBG_BSTUCK,
- 				  "beacon is officially stuck\n");
- 			sc->sc_flags |= SC_OP_TSF_RESET;
- 			ath_reset(sc, false);
-@@ -373,7 +373,7 @@ void ath_beacon_tasklet(unsigned long da
- 	}
- 
- 	if (sc->beacon.bmisscnt != 0) {
--		ath_print(common, ATH_DBG_BEACON,
-+		ath_print(common, ATH_DBG_BSTUCK,
- 			  "resume beacon xmit after %u misses\n",
- 			  sc->beacon.bmisscnt);
- 		sc->beacon.bmisscnt = 0;
diff --git a/package/mac80211/patches/540-ath9k_fix_survey_crash.patch b/package/mac80211/patches/540-ath9k_fix_survey_crash.patch
new file mode 100644
index 000000000..b627f8f4a
--- /dev/null
+++ b/package/mac80211/patches/540-ath9k_fix_survey_crash.patch
@@ -0,0 +1,12 @@
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -183,6 +183,9 @@ static void ath_update_survey_stats(stru
+ 	struct ath_cycle_counters *cc = &common->cc_survey;
+ 	unsigned int div = common->clockrate * 1000;
+ 
++	if (!ah->curchan)
++		return;
++
+ 	if (ah->power_mode == ATH9K_PM_AWAKE)
+ 		ath_hw_cycle_counters_update(common);
+ 
diff --git a/package/mac80211/patches/541-ath9k_nf_validate.patch b/package/mac80211/patches/541-ath9k_nf_validate.patch
deleted file mode 100644
index 7e3cb350f..000000000
--- a/package/mac80211/patches/541-ath9k_nf_validate.patch
+++ /dev/null
@@ -1,101 +0,0 @@
---- a/drivers/net/wireless/ath/ath9k/calib.c
-+++ b/drivers/net/wireless/ath/ath9k/calib.c
-@@ -19,8 +19,7 @@
- 
- /* Common calibration code */
- 
--/* We can tune this as we go by monitoring really low values */
--#define ATH9K_NF_TOO_LOW	-60
-+#define ATH9K_NF_TOO_HIGH	-60
- 
- static int16_t ath9k_hw_get_nf_hist_mid(int16_t *nfCalBuffer)
- {
-@@ -45,11 +44,35 @@ static int16_t ath9k_hw_get_nf_hist_mid(
- 	return nfval;
- }
- 
--static void ath9k_hw_update_nfcal_hist_buffer(struct ath9k_nfcal_hist *h,
-+static struct ath_nf_limits *ath9k_hw_get_nf_limits(struct ath_hw *ah,
-+						    struct ath9k_channel *chan)
-+{
-+	struct ath_nf_limits *limit;
-+
-+	if (!chan || IS_CHAN_2GHZ(chan))
-+		limit = &ah->nf_2g;
-+	else
-+		limit = &ah->nf_5g;
-+
-+	return limit;
-+}
-+
-+static s16 ath9k_hw_get_default_nf(struct ath_hw *ah,
-+				   struct ath9k_channel *chan)
-+{
-+	return ath9k_hw_get_nf_limits(ah, chan)->nominal;
-+}
-+
-+
-+static void ath9k_hw_update_nfcal_hist_buffer(struct ath_hw *ah,
-+					      struct ath9k_nfcal_hist *h,
- 					      int16_t *nfarray)
- {
-+	struct ath_nf_limits *limit;
- 	int i;
- 
-+	limit = ath9k_hw_get_nf_limits(ah, ah->curchan);
-+
- 	for (i = 0; i < NUM_NF_READINGS; i++) {
- 		h[i].nfCalBuffer[h[i].currIndex] = nfarray[i];
- 
-@@ -63,6 +86,9 @@ static void ath9k_hw_update_nfcal_hist_b
- 			h[i].privNF =
- 				ath9k_hw_get_nf_hist_mid(h[i].nfCalBuffer);
- 		}
-+
-+		if (h[i].privNF > limit->max)
-+			h[i].privNF = limit->max;
- 	}
- }
- 
-@@ -104,19 +130,6 @@ void ath9k_hw_reset_calibration(struct a
- 	ah->cal_samples = 0;
- }
- 
--static s16 ath9k_hw_get_default_nf(struct ath_hw *ah,
--				   struct ath9k_channel *chan)
--{
--	struct ath_nf_limits *limit;
--
--	if (!chan || IS_CHAN_2GHZ(chan))
--		limit = &ah->nf_2g;
--	else
--		limit = &ah->nf_5g;
--
--	return limit->nominal;
--}
--
- /* This is done for the currently configured channel */
- bool ath9k_hw_reset_calvalid(struct ath_hw *ah)
- {
-@@ -277,10 +290,10 @@ static void ath9k_hw_nf_sanitize(struct 
- 			  "NF calibrated [%s] [chain %d] is %d\n",
- 			  (i >= 3 ? "ext" : "ctl"), i % 3, nf[i]);
- 
--		if (nf[i] > limit->max) {
-+		if (nf[i] > ATH9K_NF_TOO_HIGH) {
- 			ath_print(common, ATH_DBG_CALIBRATE,
- 				  "NF[%d] (%d) > MAX (%d), correcting to MAX",
--				  i, nf[i], limit->max);
-+				  i, nf[i], ATH9K_NF_TOO_HIGH);
- 			nf[i] = limit->max;
- 		} else if (nf[i] < limit->min) {
- 			ath_print(common, ATH_DBG_CALIBRATE,
-@@ -326,7 +339,7 @@ bool ath9k_hw_getnf(struct ath_hw *ah, s
- 
- 	h = caldata->nfCalHist;
- 	caldata->nfcal_pending = false;
--	ath9k_hw_update_nfcal_hist_buffer(h, nfarray);
-+	ath9k_hw_update_nfcal_hist_buffer(ah, h, nfarray);
- 	caldata->rawNoiseFloor = h[0].privNF;
- 	return true;
- }
diff --git a/package/mac80211/patches/542-ath9k_bstuck_nf_calibrate.patch b/package/mac80211/patches/542-ath9k_bstuck_nf_calibrate.patch
deleted file mode 100644
index 4ac4ab210..000000000
--- a/package/mac80211/patches/542-ath9k_bstuck_nf_calibrate.patch
+++ /dev/null
@@ -1,129 +0,0 @@
---- a/drivers/net/wireless/ath/ath9k/beacon.c
-+++ b/drivers/net/wireless/ath/ath9k/beacon.c
-@@ -362,6 +362,7 @@ void ath_beacon_tasklet(unsigned long da
- 			ath_print(common, ATH_DBG_BSTUCK,
- 				  "missed %u consecutive beacons\n",
- 				  sc->beacon.bmisscnt);
-+			ath9k_hw_bstuck_nfcal(ah);
- 		} else if (sc->beacon.bmisscnt >= BSTUCK_THRESH) {
- 			ath_print(common, ATH_DBG_BSTUCK,
- 				  "beacon is officially stuck\n");
---- a/drivers/net/wireless/ath/ath9k/calib.c
-+++ b/drivers/net/wireless/ath/ath9k/calib.c
-@@ -65,12 +65,16 @@ static s16 ath9k_hw_get_default_nf(struc
- 
- 
- static void ath9k_hw_update_nfcal_hist_buffer(struct ath_hw *ah,
--					      struct ath9k_nfcal_hist *h,
-+					      struct ath9k_hw_cal_data *cal,
- 					      int16_t *nfarray)
- {
-+	struct ath_common *common = ath9k_hw_common(ah);
- 	struct ath_nf_limits *limit;
-+	struct ath9k_nfcal_hist *h;
-+	bool high_nf_mid = false;
- 	int i;
- 
-+	h = cal->nfCalHist;
- 	limit = ath9k_hw_get_nf_limits(ah, ah->curchan);
- 
- 	for (i = 0; i < NUM_NF_READINGS; i++) {
-@@ -87,9 +91,38 @@ static void ath9k_hw_update_nfcal_hist_b
- 				ath9k_hw_get_nf_hist_mid(h[i].nfCalBuffer);
- 		}
- 
--		if (h[i].privNF > limit->max)
--			h[i].privNF = limit->max;
-+		if (!h[i].privNF)
-+			continue;
-+
-+		if (h[i].privNF > limit->max) {
-+			high_nf_mid = true;
-+
-+			ath_print(common, ATH_DBG_CALIBRATE,
-+				  "NFmid[%d] (%d) > MAX (%d), %s\n",
-+				  i, h[i].privNF, limit->max,
-+				  (cal->nfcal_interference ?
-+				   "not corrected (due to interference)" :
-+				   "correcting to MAX"));
-+
-+			/*
-+			 * Normally we limit the average noise floor by the
-+			 * hardware specific maximum here. However if we have
-+			 * encountered stuck beacons because of interference,
-+			 * we bypass this limit here in order to better deal
-+			 * with our environment.
-+			 */
-+			if (!cal->nfcal_interference)
-+				h[i].privNF = limit->max;
-+		}
- 	}
-+
-+	/*
-+	 * If the noise floor seems normal for all chains, assume that
-+	 * there is no significant interference in the environment anymore.
-+	 * Re-enable the enforcement of the NF maximum again.
-+	 */
-+	if (!high_nf_mid)
-+		cal->nfcal_interference = false;
- }
- 
- static bool ath9k_hw_get_nf_thresh(struct ath_hw *ah,
-@@ -339,7 +372,7 @@ bool ath9k_hw_getnf(struct ath_hw *ah, s
- 
- 	h = caldata->nfCalHist;
- 	caldata->nfcal_pending = false;
--	ath9k_hw_update_nfcal_hist_buffer(ah, h, nfarray);
-+	ath9k_hw_update_nfcal_hist_buffer(ah, caldata, nfarray);
- 	caldata->rawNoiseFloor = h[0].privNF;
- 	return true;
- }
-@@ -374,3 +407,28 @@ s16 ath9k_hw_getchan_noise(struct ath_hw
- 	return ah->caldata->rawNoiseFloor;
- }
- EXPORT_SYMBOL(ath9k_hw_getchan_noise);
-+
-+void ath9k_hw_bstuck_nfcal(struct ath_hw *ah)
-+{
-+	struct ath9k_hw_cal_data *caldata = ah->caldata;
-+
-+	if (unlikely(!caldata))
-+		return;
-+
-+	/*
-+	 * If beacons are stuck, the most likely cause is interference.
-+	 * Triggering a noise floor calibration at this point helps the
-+	 * hardware adapt to a noisy environment much faster.
-+	 * To ensure that we recover from stuck beacons quickly, let
-+	 * the baseband update the internal NF value itself, similar to
-+	 * what is being done after a full reset.
-+	 */
-+	if (!caldata->nfcal_pending)
-+		ath9k_hw_start_nfcal(ah, true);
-+	else if (!(REG_READ(ah, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF))
-+		ath9k_hw_getnf(ah, ah->curchan);
-+
-+	caldata->nfcal_interference = true;
-+}
-+EXPORT_SYMBOL(ath9k_hw_bstuck_nfcal);
-+
---- a/drivers/net/wireless/ath/ath9k/calib.h
-+++ b/drivers/net/wireless/ath/ath9k/calib.h
-@@ -113,6 +113,7 @@ void ath9k_hw_loadnf(struct ath_hw *ah, 
- bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan);
- void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah,
- 				  struct ath9k_channel *chan);
-+void ath9k_hw_bstuck_nfcal(struct ath_hw *ah);
- s16 ath9k_hw_getchan_noise(struct ath_hw *ah, struct ath9k_channel *chan);
- void ath9k_hw_reset_calibration(struct ath_hw *ah,
- 				struct ath9k_cal_list *currCal);
---- a/drivers/net/wireless/ath/ath9k/hw.h
-+++ b/drivers/net/wireless/ath/ath9k/hw.h
-@@ -355,6 +355,7 @@ struct ath9k_hw_cal_data {
- 	int16_t rawNoiseFloor;
- 	bool paprd_done;
- 	bool nfcal_pending;
-+	bool nfcal_interference;
- 	u16 small_signal_gain[AR9300_MAX_CHAINS];
- 	u32 pa_table[AR9300_MAX_CHAINS][PAPRD_TABLE_SZ];
- 	struct ath9k_nfcal_hist nfCalHist[NUM_NF_READINGS];
diff --git a/package/mac80211/patches/543-ath9k_interference_nf_cal.patch b/package/mac80211/patches/543-ath9k_interference_nf_cal.patch
deleted file mode 100644
index 74bee3e14..000000000
--- a/package/mac80211/patches/543-ath9k_interference_nf_cal.patch
+++ /dev/null
@@ -1,35 +0,0 @@
---- a/drivers/net/wireless/ath/ath9k/ath9k.h
-+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -423,6 +423,7 @@ int ath_beaconq_config(struct ath_softc 
- #define ATH_AP_SHORT_CALINTERVAL  100     /* 100 ms */
- #define ATH_ANI_POLLINTERVAL_OLD  100     /* 100 ms */
- #define ATH_ANI_POLLINTERVAL_NEW  1000    /* 1000 ms */
-+#define ATH_LONG_CALINTERVAL_INT  1000    /* 1000 ms */
- #define ATH_LONG_CALINTERVAL      30000   /* 30 seconds */
- #define ATH_RESTART_CALINTERVAL   1200000 /* 20 minutes */
- 
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -396,7 +396,12 @@ void ath_ani_calibrate(unsigned long dat
- 	bool shortcal = false;
- 	bool aniflag = false;
- 	unsigned int timestamp = jiffies_to_msecs(jiffies);
--	u32 cal_interval, short_cal_interval;
-+	u32 cal_interval, short_cal_interval, long_cal_interval;
-+
-+	if (ah->caldata && ah->caldata->nfcal_interference)
-+		long_cal_interval = ATH_LONG_CALINTERVAL_INT;
-+	else
-+		long_cal_interval = ATH_LONG_CALINTERVAL;
- 
- 	short_cal_interval = (ah->opmode == NL80211_IFTYPE_AP) ?
- 		ATH_AP_SHORT_CALINTERVAL : ATH_STA_SHORT_CALINTERVAL;
-@@ -408,7 +413,7 @@ void ath_ani_calibrate(unsigned long dat
- 	ath9k_ps_wakeup(sc);
- 
- 	/* Long calibration runs independently of short calibration. */
--	if ((timestamp - common->ani.longcal_timer) >= ATH_LONG_CALINTERVAL) {
-+	if ((timestamp - common->ani.longcal_timer) >= long_cal_interval) {
- 		longcal = true;
- 		ath_print(common, ATH_DBG_ANI, "longcal @%lu\n", jiffies);
- 		common->ani.longcal_timer = timestamp;
diff --git a/package/mac80211/patches/550-ath9k_tsf_fix.patch b/package/mac80211/patches/550-ath9k_tsf_fix.patch
deleted file mode 100644
index 8a99ed7a2..000000000
--- a/package/mac80211/patches/550-ath9k_tsf_fix.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-ath9k_rx_skb_preprocess nulls rxs and the mactime is never set again -
-mactime is always 0. This causes problems in IBSS mode.
-
-ieee80211_rx_bss_info uses mactime to decide if an IBSS merge is needed.
-Without this patch the merge is triggered by each beacon received.
-
-This can be recognized by the "beacon TSF higher than local TSF - IBSS
-merge with BSSID" log message accompanying each beacon.
-
-This problem was not completely fixed in commit
-a6d2055b02dde1067075795274672720baadd3ca and is not a stable kernel fix.
-It is solely intended for wireless-testing.
-
-Signed-off-by: Jan Friedrich <jft@dev2day.de>
----
- drivers/net/wireless/ath/ath9k/recv.c |   10 +++++-----
- 1 files changed, 5 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/ath/ath9k/recv.c
-+++ b/drivers/net/wireless/ath/ath9k/recv.c
-@@ -1140,6 +1140,11 @@ int ath_rx_tasklet(struct ath_softc *sc,
- 		if (flush)
- 			goto requeue;
- 
-+		retval = ath9k_rx_skb_preprocess(common, hw, hdr, &rs,
-+						 rxs, &decrypt_error);
-+		if (retval)
-+			goto requeue;
-+
- 		rxs->mactime = (tsf & ~0xffffffffULL) | rs.rs_tstamp;
- 		if (rs.rs_tstamp > tsf_lower &&
- 		    unlikely(rs.rs_tstamp - tsf_lower > 0x10000000))
-@@ -1149,11 +1154,6 @@ int ath_rx_tasklet(struct ath_softc *sc,
- 		    unlikely(tsf_lower - rs.rs_tstamp > 0x10000000))
- 			rxs->mactime += 0x100000000ULL;
- 
--		retval = ath9k_rx_skb_preprocess(common, hw, hdr, &rs,
--						 rxs, &decrypt_error);
--		if (retval)
--			goto requeue;
--
- 		/* Ensure we always have an skb to requeue once we are done
- 		 * processing the current buffer's skb */
- 		requeue_skb = ath_rxbuf_alloc(common, common->rx_bufsize, GFP_ATOMIC);
diff --git a/package/mac80211/patches/550-ath9k_xretry_fix.patch b/package/mac80211/patches/550-ath9k_xretry_fix.patch
new file mode 100644
index 000000000..122be5b2a
--- /dev/null
+++ b/package/mac80211/patches/550-ath9k_xretry_fix.patch
@@ -0,0 +1,25 @@
+--- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
++++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
+@@ -237,13 +237,15 @@ static int ar9002_hw_proc_txdesc(struct 
+ 	status = ACCESS_ONCE(ads->ds_txstatus1);
+ 	if (status & AR_FrmXmitOK)
+ 		ts->ts_status |= ATH9K_TX_ACKED;
+-	if (status & AR_ExcessiveRetries)
+-		ts->ts_status |= ATH9K_TXERR_XRETRY;
+-	if (status & AR_Filtered)
+-		ts->ts_status |= ATH9K_TXERR_FILT;
+-	if (status & AR_FIFOUnderrun) {
+-		ts->ts_status |= ATH9K_TXERR_FIFO;
+-		ath9k_hw_updatetxtriglevel(ah, true);
++	else {
++		if (status & AR_ExcessiveRetries)
++			ts->ts_status |= ATH9K_TXERR_XRETRY;
++		if (status & AR_Filtered)
++			ts->ts_status |= ATH9K_TXERR_FILT;
++		if (status & AR_FIFOUnderrun) {
++			ts->ts_status |= ATH9K_TXERR_FIFO;
++			ath9k_hw_updatetxtriglevel(ah, true);
++		}
+ 	}
+ 	if (status & AR_TxTimerExpired)
+ 		ts->ts_status |= ATH9K_TXERR_TIMER_EXPIRED;
diff --git a/package/mac80211/patches/560-ath9k_aggr_sampling_fix.patch b/package/mac80211/patches/560-ath9k_aggr_sampling_fix.patch
new file mode 100644
index 000000000..66a341901
--- /dev/null
+++ b/package/mac80211/patches/560-ath9k_aggr_sampling_fix.patch
@@ -0,0 +1,22 @@
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -673,6 +673,7 @@ static enum ATH_AGGR_STATUS ath_tx_form_
+ 	u16 aggr_limit = 0, al = 0, bpad = 0,
+ 		al_delta, h_baw = tid->baw_size / 2;
+ 	enum ATH_AGGR_STATUS status = ATH_AGGR_DONE;
++	struct ieee80211_tx_info *tx_info;
+ 
+ 	bf_first = list_first_entry(&tid->buf_q, struct ath_buf, list);
+ 
+@@ -699,6 +700,11 @@ static enum ATH_AGGR_STATUS ath_tx_form_
+ 			break;
+ 		}
+ 
++		tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
++		if (nframes && ((tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) ||
++			!(tx_info->control.rates[0].flags & IEEE80211_TX_RC_MCS)))
++			break;
++
+ 		/* do not exceed subframe limit */
+ 		if (nframes >= min((int)h_baw, ATH_AMPDU_SUBFRAME_DEFAULT)) {
+ 			status = ATH_AGGR_LIMITED;
diff --git a/package/mac80211/patches/560-ath9k_baw_fix.patch b/package/mac80211/patches/560-ath9k_baw_fix.patch
deleted file mode 100644
index 50e4b99e4..000000000
--- a/package/mac80211/patches/560-ath9k_baw_fix.patch
+++ /dev/null
@@ -1,36 +0,0 @@
---- a/drivers/net/wireless/ath/ath9k/ath9k.h
-+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -254,7 +254,7 @@ struct ath_atx_tid {
- 	struct list_head buf_q;
- 	struct ath_node *an;
- 	struct ath_atx_ac *ac;
--	struct ath_buf *tx_buf[ATH_TID_MAX_BUFS];
-+	unsigned long tx_buf[BITS_TO_LONGS(ATH_TID_MAX_BUFS)];
- 	u16 seq_start;
- 	u16 seq_next;
- 	u16 baw_size;
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -168,9 +168,9 @@ static void ath_tx_update_baw(struct ath
- 	index  = ATH_BA_INDEX(tid->seq_start, seqno);
- 	cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
- 
--	tid->tx_buf[cindex] = NULL;
-+	__clear_bit(cindex, tid->tx_buf);
- 
--	while (tid->baw_head != tid->baw_tail && !tid->tx_buf[tid->baw_head]) {
-+	while (tid->baw_head != tid->baw_tail && !test_bit(tid->baw_head, tid->tx_buf)) {
- 		INCR(tid->seq_start, IEEE80211_SEQ_MAX);
- 		INCR(tid->baw_head, ATH_TID_MAX_BUFS);
- 	}
-@@ -186,9 +186,7 @@ static void ath_tx_addto_baw(struct ath_
- 
- 	index  = ATH_BA_INDEX(tid->seq_start, bf->bf_seqno);
- 	cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
--
--	BUG_ON(tid->tx_buf[cindex] != NULL);
--	tid->tx_buf[cindex] = bf;
-+	__set_bit(cindex, tid->tx_buf);
- 
- 	if (index >= ((tid->baw_tail - tid->baw_head) &
- 		(ATH_TID_MAX_BUFS - 1))) {
diff --git a/package/mac80211/patches/561-minstrel_sample_retransmit.patch b/package/mac80211/patches/561-minstrel_sample_retransmit.patch
new file mode 100644
index 000000000..2ae03d878
--- /dev/null
+++ b/package/mac80211/patches/561-minstrel_sample_retransmit.patch
@@ -0,0 +1,13 @@
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -506,7 +506,9 @@ minstrel_ht_set_rate(struct minstrel_pri
+ 	if (!mr->retry_updated)
+ 		minstrel_calc_retransmit(mp, mi, index);
+ 
+-	if (mr->probability < MINSTREL_FRAC(20, 100))
++	if (sample)
++		rate->count = 1;
++	else if (mr->probability < MINSTREL_FRAC(20, 100))
+ 		rate->count = 2;
+ 	else if (rtscts)
+ 		rate->count = mr->retry_count_rtscts;
diff --git a/package/mac80211/patches/562-minstrel_sample_performance.patch b/package/mac80211/patches/562-minstrel_sample_performance.patch
new file mode 100644
index 000000000..424a74160
--- /dev/null
+++ b/package/mac80211/patches/562-minstrel_sample_performance.patch
@@ -0,0 +1,52 @@
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -407,8 +407,8 @@ minstrel_ht_tx_status(void *priv, struct
+ 	mi->ampdu_len += info->status.ampdu_len;
+ 
+ 	if (!mi->sample_wait && !mi->sample_tries && mi->sample_count > 0) {
+-		mi->sample_wait = 4 + 2 * MINSTREL_TRUNC(mi->avg_ampdu_len);
+-		mi->sample_tries = 3;
++		mi->sample_wait = 16 + 2 * MINSTREL_TRUNC(mi->avg_ampdu_len);
++		mi->sample_tries = 2;
+ 		mi->sample_count--;
+ 	}
+ 
+@@ -564,7 +564,7 @@ minstrel_get_sample_rate(struct minstrel
+ 	 */
+ 	if (minstrel_get_duration(sample_idx) >
+ 	    minstrel_get_duration(mi->max_tp_rate)) {
+-		if (mr->sample_skipped < 10)
++		if (mr->sample_skipped < 20)
+ 			goto next;
+ 
+ 		if (mi->sample_slow++ > 2)
+@@ -588,6 +588,7 @@ minstrel_ht_get_rate(void *priv, struct 
+ 	struct minstrel_ht_sta *mi = &msp->ht;
+ 	struct minstrel_priv *mp = priv;
+ 	int sample_idx;
++	bool sample = false;
+ 
+ 	if (rate_control_send_low(sta, priv_sta, txrc))
+ 		return;
+@@ -598,10 +599,11 @@ minstrel_ht_get_rate(void *priv, struct 
+ 	info->flags |= mi->tx_flags;
+ 	sample_idx = minstrel_get_sample_rate(mp, mi);
+ 	if (sample_idx >= 0) {
++		sample = true;
+ 		minstrel_ht_set_rate(mp, mi, &ar[0], sample_idx,
+ 			txrc, true, false);
+ 		minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_tp_rate,
+-			txrc, false, true);
++			txrc, false, false);
+ 		info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+ 	} else {
+ 		minstrel_ht_set_rate(mp, mi, &ar[0], mi->max_tp_rate,
+@@ -609,7 +611,7 @@ minstrel_ht_get_rate(void *priv, struct 
+ 		minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_tp_rate2,
+ 			txrc, false, true);
+ 	}
+-	minstrel_ht_set_rate(mp, mi, &ar[2], mi->max_prob_rate, txrc, false, true);
++	minstrel_ht_set_rate(mp, mi, &ar[2], mi->max_prob_rate, txrc, false, !sample);
+ 
+ 	ar[3].count = 0;
+ 	ar[3].idx = -1;
diff --git a/package/mac80211/patches/570-ath9k_mic_failure_fix.patch b/package/mac80211/patches/570-ath9k_mic_failure_fix.patch
deleted file mode 100644
index fbd188d6f..000000000
--- a/package/mac80211/patches/570-ath9k_mic_failure_fix.patch
+++ /dev/null
@@ -1,85 +0,0 @@
---- a/drivers/net/wireless/ath/ath.h
-+++ b/drivers/net/wireless/ath/ath.h
-@@ -119,6 +119,7 @@ struct ath_common {
- 
- 	u32 keymax;
- 	DECLARE_BITMAP(keymap, ATH_KEYMAX);
-+	DECLARE_BITMAP(tkip_keymap, ATH_KEYMAX);
- 	u8 splitmic;
- 
- 	struct ath_regulatory regulatory;
---- a/drivers/net/wireless/ath/ath9k/common.c
-+++ b/drivers/net/wireless/ath/ath9k/common.c
-@@ -366,9 +366,13 @@ int ath9k_cmn_key_config(struct ath_comm
- 	set_bit(idx, common->keymap);
- 	if (key->alg == ALG_TKIP) {
- 		set_bit(idx + 64, common->keymap);
-+		set_bit(idx, common->tkip_keymap);
-+		set_bit(idx + 64, common->tkip_keymap);
- 		if (common->splitmic) {
- 			set_bit(idx + 32, common->keymap);
- 			set_bit(idx + 64 + 32, common->keymap);
-+			set_bit(idx + 32, common->tkip_keymap);
-+			set_bit(idx + 64 + 32, common->tkip_keymap);
- 		}
- 	}
- 
-@@ -393,10 +397,17 @@ void ath9k_cmn_key_delete(struct ath_com
- 		return;
- 
- 	clear_bit(key->hw_key_idx + 64, common->keymap);
-+
-+	clear_bit(key->hw_key_idx, common->tkip_keymap);
-+	clear_bit(key->hw_key_idx + 64, common->tkip_keymap);
-+
- 	if (common->splitmic) {
- 		ath9k_hw_keyreset(ah, key->hw_key_idx + 32);
- 		clear_bit(key->hw_key_idx + 32, common->keymap);
- 		clear_bit(key->hw_key_idx + 64 + 32, common->keymap);
-+
-+		clear_bit(key->hw_key_idx + 32, common->tkip_keymap);
-+		clear_bit(key->hw_key_idx + 64 + 32, common->tkip_keymap);
- 	}
- }
- EXPORT_SYMBOL(ath9k_cmn_key_delete);
---- a/drivers/net/wireless/ath/ath9k/recv.c
-+++ b/drivers/net/wireless/ath/ath9k/recv.c
-@@ -870,15 +870,18 @@ static bool ath9k_rx_accept(struct ath_c
- 		if (rx_stats->rs_status & ATH9K_RXERR_DECRYPT) {
- 			*decrypt_error = true;
- 		} else if (rx_stats->rs_status & ATH9K_RXERR_MIC) {
--			if (ieee80211_is_ctl(fc))
--				/*
--				 * Sometimes, we get invalid
--				 * MIC failures on valid control frames.
--				 * Remove these mic errors.
--				 */
--				rx_stats->rs_status &= ~ATH9K_RXERR_MIC;
--			else
-+			/*
-+			 * The MIC error bit is only valid if the frame
-+			 * is not a control frame or fragment, and it was
-+			 * decrypted using a valid TKIP key.
-+			 */
-+			if (!ieee80211_is_ctl(fc) &&
-+			    !ieee80211_has_morefrags(fc) &&
-+			    !(le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG) &&
-+			    test_bit(rx_stats->rs_keyix, common->tkip_keymap))
- 				rxs->flag |= RX_FLAG_MMIC_ERROR;
-+			else
-+				rx_stats->rs_status &= ~ATH9K_RXERR_MIC;
- 		}
- 		/*
- 		 * Reject error frames with the exception of
---- a/drivers/net/wireless/ath/ath9k/mac.c
-+++ b/drivers/net/wireless/ath/ath9k/mac.c
-@@ -711,7 +711,8 @@ int ath9k_hw_rxprocdesc(struct ath_hw *a
- 			rs->rs_phyerr = phyerr;
- 		} else if (ads.ds_rxstatus8 & AR_DecryptCRCErr)
- 			rs->rs_status |= ATH9K_RXERR_DECRYPT;
--		else if (ads.ds_rxstatus8 & AR_MichaelErr)
-+		else if ((ads.ds_rxstatus8 & AR_MichaelErr) &&
-+		         rs->rs_keyix != ATH9K_RXKEYIX_INVALID)
- 			rs->rs_status |= ATH9K_RXERR_MIC;
- 		else if (ads.ds_rxstatus8 & AR_KeyMiss)
- 			rs->rs_status |= ATH9K_RXERR_DECRYPT;
diff --git a/package/mac80211/patches/570-ath9k_reset_aggr_fix.patch b/package/mac80211/patches/570-ath9k_reset_aggr_fix.patch
new file mode 100644
index 000000000..81866d6e8
--- /dev/null
+++ b/package/mac80211/patches/570-ath9k_reset_aggr_fix.patch
@@ -0,0 +1,42 @@
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -581,7 +581,7 @@ void ath_hw_check(struct work_struct *wo
+ 
+ 		msleep(1);
+ 	}
+-	ath_reset(sc, false);
++	ath_reset(sc, true);
+ 
+ out:
+ 	ath9k_ps_restore(sc);
+@@ -599,7 +599,7 @@ void ath9k_tasklet(unsigned long data)
+ 	ath9k_ps_wakeup(sc);
+ 
+ 	if (status & ATH9K_INT_FATAL) {
+-		ath_reset(sc, false);
++		ath_reset(sc, true);
+ 		ath9k_ps_restore(sc);
+ 		return;
+ 	}
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2161,7 +2161,7 @@ static void ath_tx_complete_poll_work(st
+ 		ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_RESET,
+ 			  "tx hung, resetting the chip\n");
+ 		ath9k_ps_wakeup(sc);
+-		ath_reset(sc, false);
++		ath_reset(sc, true);
+ 		ath9k_ps_restore(sc);
+ 	}
+ 
+--- a/drivers/net/wireless/ath/ath9k/beacon.c
++++ b/drivers/net/wireless/ath/ath9k/beacon.c
+@@ -370,7 +370,7 @@ void ath_beacon_tasklet(unsigned long da
+ 			ath_print(common, ATH_DBG_BSTUCK,
+ 				  "beacon is officially stuck\n");
+ 			sc->sc_flags |= SC_OP_TSF_RESET;
+-			ath_reset(sc, false);
++			ath_reset(sc, true);
+ 		}
+ 
+ 		return;
diff --git a/package/mac80211/patches/571-ath9k_ar9300_aggr_flush.patch b/package/mac80211/patches/571-ath9k_ar9300_aggr_flush.patch
new file mode 100644
index 000000000..3d4cfe88a
--- /dev/null
+++ b/package/mac80211/patches/571-ath9k_ar9300_aggr_flush.patch
@@ -0,0 +1,34 @@
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -1089,15 +1089,6 @@ void ath_draintxq(struct ath_softc *sc, 
+ 	txq->axq_tx_inprogress = false;
+ 	spin_unlock_bh(&txq->axq_lock);
+ 
+-	/* flush any pending frames if aggregation is enabled */
+-	if (sc->sc_flags & SC_OP_TXAGGR) {
+-		if (!retry_tx) {
+-			spin_lock_bh(&txq->axq_lock);
+-			ath_txq_drain_pending_buffers(sc, txq);
+-			spin_unlock_bh(&txq->axq_lock);
+-		}
+-	}
+-
+ 	if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+ 		spin_lock_bh(&txq->axq_lock);
+ 		while (!list_empty(&txq->txq_fifo_pending)) {
+@@ -1118,6 +1109,15 @@ void ath_draintxq(struct ath_softc *sc, 
+ 		}
+ 		spin_unlock_bh(&txq->axq_lock);
+ 	}
++
++	/* flush any pending frames if aggregation is enabled */
++	if (sc->sc_flags & SC_OP_TXAGGR) {
++		if (!retry_tx) {
++			spin_lock_bh(&txq->axq_lock);
++			ath_txq_drain_pending_buffers(sc, txq);
++			spin_unlock_bh(&txq->axq_lock);
++		}
++	}
+ }
+ 
+ void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
diff --git a/package/mac80211/patches/572-ath9k_xmit_queue_cleanup.patch b/package/mac80211/patches/572-ath9k_xmit_queue_cleanup.patch
new file mode 100644
index 000000000..3e99c080a
--- /dev/null
+++ b/package/mac80211/patches/572-ath9k_xmit_queue_cleanup.patch
@@ -0,0 +1,714 @@
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -195,7 +195,6 @@ enum ATH_AGGR_STATUS {
+ 
+ #define ATH_TXFIFO_DEPTH 8
+ struct ath_txq {
+-	int axq_class;
+ 	u32 axq_qnum;
+ 	u32 *axq_link;
+ 	struct list_head axq_q;
+@@ -208,11 +207,12 @@ struct ath_txq {
+ 	struct list_head txq_fifo_pending;
+ 	u8 txq_headidx;
+ 	u8 txq_tailidx;
++	int pending_frames;
+ };
+ 
+ struct ath_atx_ac {
++	struct ath_txq *txq;
+ 	int sched;
+-	int qnum;
+ 	struct list_head list;
+ 	struct list_head tid_q;
+ };
+@@ -290,12 +290,11 @@ struct ath_tx_control {
+ struct ath_tx {
+ 	u16 seq_no;
+ 	u32 txqsetup;
+-	int hwq_map[WME_NUM_AC];
+ 	spinlock_t txbuflock;
+ 	struct list_head txbuf;
+ 	struct ath_txq txq[ATH9K_NUM_TX_QUEUES];
+ 	struct ath_descdma txdma;
+-	int pending_frames[WME_NUM_AC];
++	struct ath_txq *txq_map[WME_NUM_AC];
+ };
+ 
+ struct ath_rx_edma {
+@@ -325,7 +324,6 @@ void ath_rx_cleanup(struct ath_softc *sc
+ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp);
+ struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype);
+ void ath_tx_cleanupq(struct ath_softc *sc, struct ath_txq *txq);
+-int ath_tx_setup(struct ath_softc *sc, int haltype);
+ void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx);
+ void ath_draintxq(struct ath_softc *sc,
+ 		     struct ath_txq *txq, bool retry_tx);
+@@ -665,7 +663,6 @@ struct ath_wiphy {
+ 
+ void ath9k_tasklet(unsigned long data);
+ int ath_reset(struct ath_softc *sc, bool retry_tx);
+-int ath_get_mac80211_qnum(u32 queue, struct ath_softc *sc);
+ int ath_cabq_update(struct ath_softc *);
+ 
+ static inline void ath_read_cachesize(struct ath_common *common, int *csz)
+--- a/drivers/net/wireless/ath/ath9k/beacon.c
++++ b/drivers/net/wireless/ath/ath9k/beacon.c
+@@ -28,7 +28,7 @@ int ath_beaconq_config(struct ath_softc 
+ 	struct ath_hw *ah = sc->sc_ah;
+ 	struct ath_common *common = ath9k_hw_common(ah);
+ 	struct ath9k_tx_queue_info qi, qi_be;
+-	int qnum;
++	struct ath_txq *txq;
+ 
+ 	ath9k_hw_get_txq_props(ah, sc->beacon.beaconq, &qi);
+ 	if (sc->sc_ah->opmode == NL80211_IFTYPE_AP) {
+@@ -38,8 +38,8 @@ int ath_beaconq_config(struct ath_softc 
+ 		qi.tqi_cwmax = 0;
+ 	} else {
+ 		/* Adhoc mode; important thing is to use 2x cwmin. */
+-		qnum = sc->tx.hwq_map[WME_AC_BE];
+-		ath9k_hw_get_txq_props(ah, qnum, &qi_be);
++		txq = sc->tx.txq_map[WME_AC_BE];
++		ath9k_hw_get_txq_props(ah, txq->axq_qnum, &qi_be);
+ 		qi.tqi_aifs = qi_be.tqi_aifs;
+ 		qi.tqi_cwmin = 4*qi_be.tqi_cwmin;
+ 		qi.tqi_cwmax = qi_be.tqi_cwmax;
+--- a/drivers/net/wireless/ath/ath9k/common.h
++++ b/drivers/net/wireless/ath/ath9k/common.h
+@@ -31,10 +31,11 @@
+ #define WME_MAX_BA              WME_BA_BMP_SIZE
+ #define ATH_TID_MAX_BUFS        (2 * WME_MAX_BA)
+ 
+-#define WME_AC_BE   0
+-#define WME_AC_BK   1
+-#define WME_AC_VI   2
+-#define WME_AC_VO   3
++/* These must match mac80211 skb queue mapping numbers */
++#define WME_AC_VO   0
++#define WME_AC_VI   1
++#define WME_AC_BE   2
++#define WME_AC_BK   3
+ #define WME_NUM_AC  4
+ 
+ #define ATH_RSSI_DUMMY_MARKER   0x127
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -331,7 +331,7 @@ void ath_paprd_calibrate(struct work_str
+ 	struct ath_tx_control txctl;
+ 	struct ath9k_hw_cal_data *caldata = ah->caldata;
+ 	struct ath_common *common = ath9k_hw_common(ah);
+-	int qnum, ftype;
++	int ftype;
+ 	int chain_ok = 0;
+ 	int chain;
+ 	int len = 1800;
+@@ -358,8 +358,7 @@ void ath_paprd_calibrate(struct work_str
+ 	memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
+ 
+ 	memset(&txctl, 0, sizeof(txctl));
+-	qnum = sc->tx.hwq_map[WME_AC_BE];
+-	txctl.txq = &sc->tx.txq[qnum];
++	txctl.txq = sc->tx.txq_map[WME_AC_BE];
+ 
+ 	ath9k_ps_wakeup(sc);
+ 	ar9003_paprd_init_table(ah);
+@@ -1025,56 +1024,6 @@ int ath_reset(struct ath_softc *sc, bool
+ 	return r;
+ }
+ 
+-static int ath_get_hal_qnum(u16 queue, struct ath_softc *sc)
+-{
+-	int qnum;
+-
+-	switch (queue) {
+-	case 0:
+-		qnum = sc->tx.hwq_map[WME_AC_VO];
+-		break;
+-	case 1:
+-		qnum = sc->tx.hwq_map[WME_AC_VI];
+-		break;
+-	case 2:
+-		qnum = sc->tx.hwq_map[WME_AC_BE];
+-		break;
+-	case 3:
+-		qnum = sc->tx.hwq_map[WME_AC_BK];
+-		break;
+-	default:
+-		qnum = sc->tx.hwq_map[WME_AC_BE];
+-		break;
+-	}
+-
+-	return qnum;
+-}
+-
+-int ath_get_mac80211_qnum(u32 queue, struct ath_softc *sc)
+-{
+-	int qnum;
+-
+-	switch (queue) {
+-	case WME_AC_VO:
+-		qnum = 0;
+-		break;
+-	case WME_AC_VI:
+-		qnum = 1;
+-		break;
+-	case WME_AC_BE:
+-		qnum = 2;
+-		break;
+-	case WME_AC_BK:
+-		qnum = 3;
+-		break;
+-	default:
+-		qnum = -1;
+-		break;
+-	}
+-
+-	return qnum;
+-}
+-
+ /* XXX: Remove me once we don't depend on ath9k_channel for all
+  * this redundant data */
+ void ath9k_update_ichannel(struct ath_softc *sc, struct ieee80211_hw *hw,
+@@ -1244,7 +1193,6 @@ static int ath9k_tx(struct ieee80211_hw 
+ 	struct ath_tx_control txctl;
+ 	int padpos, padsize;
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+-	int qnum;
+ 
+ 	if (aphy->state != ATH_WIPHY_ACTIVE && aphy->state != ATH_WIPHY_SCAN) {
+ 		ath_print(common, ATH_DBG_XMIT,
+@@ -1317,8 +1265,7 @@ static int ath9k_tx(struct ieee80211_hw 
+ 		memmove(skb->data, skb->data + padsize, padpos);
+ 	}
+ 
+-	qnum = ath_get_hal_qnum(skb_get_queue_mapping(skb), sc);
+-	txctl.txq = &sc->tx.txq[qnum];
++	txctl.txq = sc->tx.txq_map[skb_get_queue_mapping(skb)];
+ 
+ 	ath_print(common, ATH_DBG_XMIT, "transmitting packet, skb: %p\n", skb);
+ 
+@@ -1802,12 +1749,15 @@ static int ath9k_conf_tx(struct ieee8021
+ 	struct ath_wiphy *aphy = hw->priv;
+ 	struct ath_softc *sc = aphy->sc;
+ 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
++	struct ath_txq *txq;
+ 	struct ath9k_tx_queue_info qi;
+-	int ret = 0, qnum;
++	int ret = 0;
+ 
+ 	if (queue >= WME_NUM_AC)
+ 		return 0;
+ 
++	txq = sc->tx.txq_map[queue];
++
+ 	mutex_lock(&sc->mutex);
+ 
+ 	memset(&qi, 0, sizeof(struct ath9k_tx_queue_info));
+@@ -1816,20 +1766,19 @@ static int ath9k_conf_tx(struct ieee8021
+ 	qi.tqi_cwmin = params->cw_min;
+ 	qi.tqi_cwmax = params->cw_max;
+ 	qi.tqi_burstTime = params->txop;
+-	qnum = ath_get_hal_qnum(queue, sc);
+ 
+ 	ath_print(common, ATH_DBG_CONFIG,
+ 		  "Configure tx [queue/halq] [%d/%d],  "
+ 		  "aifs: %d, cw_min: %d, cw_max: %d, txop: %d\n",
+-		  queue, qnum, params->aifs, params->cw_min,
++		  queue, txq->axq_qnum, params->aifs, params->cw_min,
+ 		  params->cw_max, params->txop);
+ 
+-	ret = ath_txq_update(sc, qnum, &qi);
++	ret = ath_txq_update(sc, txq->axq_qnum, &qi);
+ 	if (ret)
+ 		ath_print(common, ATH_DBG_FATAL, "TXQ Update failed\n");
+ 
+ 	if (sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC)
+-		if ((qnum == sc->tx.hwq_map[WME_AC_BE]) && !ret)
++		if (queue == WME_AC_BE && !ret)
+ 			ath_beaconq_config(sc);
+ 
+ 	mutex_unlock(&sc->mutex);
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -124,7 +124,7 @@ static void ath_tx_queue_tid(struct ath_
+ 
+ static void ath_tx_resume_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
+ {
+-	struct ath_txq *txq = &sc->tx.txq[tid->ac->qnum];
++	struct ath_txq *txq = tid->ac->txq;
+ 
+ 	WARN_ON(!tid->paused);
+ 
+@@ -142,7 +142,7 @@ unlock:
+ 
+ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
+ {
+-	struct ath_txq *txq = &sc->tx.txq[tid->ac->qnum];
++	struct ath_txq *txq = tid->ac->txq;
+ 	struct ath_buf *bf;
+ 	struct list_head bf_head;
+ 	struct ath_tx_status ts;
+@@ -817,7 +817,7 @@ void ath_tx_aggr_stop(struct ath_softc *
+ {
+ 	struct ath_node *an = (struct ath_node *)sta->drv_priv;
+ 	struct ath_atx_tid *txtid = ATH_AN_2_TID(an, tid);
+-	struct ath_txq *txq = &sc->tx.txq[txtid->ac->qnum];
++	struct ath_txq *txq = txtid->ac->txq;
+ 
+ 	if (txtid->state & AGGR_CLEANUP)
+ 		return;
+@@ -888,10 +888,16 @@ struct ath_txq *ath_txq_setup(struct ath
+ 	struct ath_hw *ah = sc->sc_ah;
+ 	struct ath_common *common = ath9k_hw_common(ah);
+ 	struct ath9k_tx_queue_info qi;
++	static const int subtype_txq_to_hwq[] = {
++		[WME_AC_BE] = ATH_TXQ_AC_BE,
++		[WME_AC_BK] = ATH_TXQ_AC_BK,
++		[WME_AC_VI] = ATH_TXQ_AC_VI,
++		[WME_AC_VO] = ATH_TXQ_AC_VO,
++	};
+ 	int qnum, i;
+ 
+ 	memset(&qi, 0, sizeof(qi));
+-	qi.tqi_subtype = subtype;
++	qi.tqi_subtype = subtype_txq_to_hwq[subtype];
+ 	qi.tqi_aifs = ATH9K_TXQ_USEDEFAULT;
+ 	qi.tqi_cwmin = ATH9K_TXQ_USEDEFAULT;
+ 	qi.tqi_cwmax = ATH9K_TXQ_USEDEFAULT;
+@@ -940,7 +946,6 @@ struct ath_txq *ath_txq_setup(struct ath
+ 	if (!ATH_TXQ_SETUP(sc, qnum)) {
+ 		struct ath_txq *txq = &sc->tx.txq[qnum];
+ 
+-		txq->axq_class = subtype;
+ 		txq->axq_qnum = qnum;
+ 		txq->axq_link = NULL;
+ 		INIT_LIST_HEAD(&txq->axq_q);
+@@ -1210,24 +1215,6 @@ void ath_txq_schedule(struct ath_softc *
+ 	}
+ }
+ 
+-int ath_tx_setup(struct ath_softc *sc, int haltype)
+-{
+-	struct ath_txq *txq;
+-
+-	if (haltype >= ARRAY_SIZE(sc->tx.hwq_map)) {
+-		ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
+-			  "HAL AC %u out of range, max %zu!\n",
+-			 haltype, ARRAY_SIZE(sc->tx.hwq_map));
+-		return 0;
+-	}
+-	txq = ath_txq_setup(sc, ATH9K_TX_QUEUE_DATA, haltype);
+-	if (txq != NULL) {
+-		sc->tx.hwq_map[haltype] = txq->axq_qnum;
+-		return 1;
+-	} else
+-		return 0;
+-}
+-
+ /***********/
+ /* TX, DMA */
+ /***********/
+@@ -1708,6 +1695,7 @@ static void ath_tx_start_dma(struct ath_
+ 			goto tx_done;
+ 		}
+ 
++		WARN_ON(tid->ac->txq != txctl->txq);
+ 		if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
+ 			/*
+ 			 * Try aggregation if it's a unicast data frame
+@@ -1747,6 +1735,7 @@ int ath_tx_start(struct ieee80211_hw *hw
+ 		return -1;
+ 	}
+ 
++	q = skb_get_queue_mapping(skb);
+ 	r = ath_tx_setup_buffer(hw, bf, skb, txctl);
+ 	if (unlikely(r)) {
+ 		ath_print(common, ATH_DBG_FATAL, "TX mem alloc failure\n");
+@@ -1756,8 +1745,9 @@ int ath_tx_start(struct ieee80211_hw *hw
+ 		 * we will at least have to run TX completionon one buffer
+ 		 * on the queue */
+ 		spin_lock_bh(&txq->axq_lock);
+-		if (!txq->stopped && txq->axq_depth > 1) {
+-			ath_mac80211_stop_queue(sc, skb_get_queue_mapping(skb));
++		if (txq == sc->tx.txq_map[q] && !txq->stopped &&
++		    txq->axq_depth > 1) {
++			ath_mac80211_stop_queue(sc, q);
+ 			txq->stopped = 1;
+ 		}
+ 		spin_unlock_bh(&txq->axq_lock);
+@@ -1767,13 +1757,10 @@ int ath_tx_start(struct ieee80211_hw *hw
+ 		return r;
+ 	}
+ 
+-	q = skb_get_queue_mapping(skb);
+-	if (q >= 4)
+-		q = 0;
+-
+ 	spin_lock_bh(&txq->axq_lock);
+-	if (++sc->tx.pending_frames[q] > ATH_MAX_QDEPTH && !txq->stopped) {
+-		ath_mac80211_stop_queue(sc, skb_get_queue_mapping(skb));
++	if (txq == sc->tx.txq_map[q] &&
++	    ++txq->pending_frames > ATH_MAX_QDEPTH && !txq->stopped) {
++		ath_mac80211_stop_queue(sc, q);
+ 		txq->stopped = 1;
+ 	}
+ 	spin_unlock_bh(&txq->axq_lock);
+@@ -1841,7 +1828,8 @@ exit:
+ /*****************/
+ 
+ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
+-			    struct ath_wiphy *aphy, int tx_flags)
++			    struct ath_wiphy *aphy, int tx_flags,
++			    struct ath_txq *txq)
+ {
+ 	struct ieee80211_hw *hw = sc->hw;
+ 	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+@@ -1888,11 +1876,12 @@ static void ath_tx_complete(struct ath_s
+ 		ath9k_tx_status(hw, skb);
+ 	else {
+ 		q = skb_get_queue_mapping(skb);
+-		if (q >= 4)
+-			q = 0;
+-
+-		if (--sc->tx.pending_frames[q] < 0)
+-			sc->tx.pending_frames[q] = 0;
++		if (txq == sc->tx.txq_map[q]) {
++			spin_lock_bh(&txq->axq_lock);
++			if (WARN_ON(--txq->pending_frames < 0))
++				txq->pending_frames = 0;
++			spin_unlock_bh(&txq->axq_lock);
++		}
+ 
+ 		ieee80211_tx_status(hw, skb);
+ 	}
+@@ -1927,8 +1916,8 @@ static void ath_tx_complete_buf(struct a
+ 		else
+ 			complete(&sc->paprd_complete);
+ 	} else {
+-		ath_debug_stat_tx(sc, txq, bf, ts);
+-		ath_tx_complete(sc, skb, bf->aphy, tx_flags);
++		ath_debug_stat_tx(sc, bf, ts);
++		ath_tx_complete(sc, skb, bf->aphy, tx_flags, txq);
+ 	}
+ 	/* At this point, skb (bf->bf_mpdu) is consumed...make sure we don't
+ 	 * accidentally reference it later.
+@@ -2018,16 +2007,13 @@ static void ath_tx_rc_status(struct ath_
+ 	tx_info->status.rates[tx_rateindex].count = ts->ts_longretry + 1;
+ }
+ 
+-static void ath_wake_mac80211_queue(struct ath_softc *sc, struct ath_txq *txq)
++static void ath_wake_mac80211_queue(struct ath_softc *sc, int qnum)
+ {
+-	int qnum;
+-
+-	qnum = ath_get_mac80211_qnum(txq->axq_class, sc);
+-	if (qnum == -1)
+-		return;
++	struct ath_txq *txq;
+ 
++	txq = sc->tx.txq_map[qnum];
+ 	spin_lock_bh(&txq->axq_lock);
+-	if (txq->stopped && sc->tx.pending_frames[qnum] < ATH_MAX_QDEPTH) {
++	if (txq->stopped && txq->pending_frames < ATH_MAX_QDEPTH) {
+ 		if (ath_mac80211_start_queue(sc, qnum))
+ 			txq->stopped = 0;
+ 	}
+@@ -2044,6 +2030,7 @@ static void ath_tx_processq(struct ath_s
+ 	struct ath_tx_status ts;
+ 	int txok;
+ 	int status;
++	int qnum;
+ 
+ 	ath_print(common, ATH_DBG_QUEUE, "tx queue %d (%x), link %p\n",
+ 		  txq->axq_qnum, ath9k_hw_gettxbuf(sc->sc_ah, txq->axq_qnum),
+@@ -2119,12 +2106,15 @@ static void ath_tx_processq(struct ath_s
+ 			ath_tx_rc_status(bf, &ts, txok ? 0 : 1, txok, true);
+ 		}
+ 
++		qnum = skb_get_queue_mapping(bf->bf_mpdu);
++
+ 		if (bf_isampdu(bf))
+ 			ath_tx_complete_aggr(sc, txq, bf, &bf_head, &ts, txok);
+ 		else
+ 			ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, txok, 0);
+ 
+-		ath_wake_mac80211_queue(sc, txq);
++		if (txq == sc->tx.txq_map[qnum])
++			ath_wake_mac80211_queue(sc, qnum);
+ 
+ 		spin_lock_bh(&txq->axq_lock);
+ 		if (sc->sc_flags & SC_OP_TXAGGR)
+@@ -2194,6 +2184,7 @@ void ath_tx_edma_tasklet(struct ath_soft
+ 	struct list_head bf_head;
+ 	int status;
+ 	int txok;
++	int qnum;
+ 
+ 	for (;;) {
+ 		status = ath9k_hw_txprocdesc(ah, NULL, (void *)&txs);
+@@ -2237,13 +2228,16 @@ void ath_tx_edma_tasklet(struct ath_soft
+ 			ath_tx_rc_status(bf, &txs, txok ? 0 : 1, txok, true);
+ 		}
+ 
++		qnum = skb_get_queue_mapping(bf->bf_mpdu);
++
+ 		if (bf_isampdu(bf))
+ 			ath_tx_complete_aggr(sc, txq, bf, &bf_head, &txs, txok);
+ 		else
+ 			ath_tx_complete_buf(sc, bf, txq, &bf_head,
+ 					    &txs, txok, 0);
+ 
+-		ath_wake_mac80211_queue(sc, txq);
++		if (txq == sc->tx.txq_map[qnum])
++			ath_wake_mac80211_queue(sc, qnum);
+ 
+ 		spin_lock_bh(&txq->axq_lock);
+ 		if (!list_empty(&txq->txq_fifo_pending)) {
+@@ -2375,7 +2369,7 @@ void ath_tx_node_init(struct ath_softc *
+ 	for (acno = 0, ac = &an->ac[acno];
+ 	     acno < WME_NUM_AC; acno++, ac++) {
+ 		ac->sched    = false;
+-		ac->qnum = sc->tx.hwq_map[acno];
++		ac->txq = sc->tx.txq_map[acno];
+ 		INIT_LIST_HEAD(&ac->tid_q);
+ 	}
+ }
+@@ -2385,17 +2379,13 @@ void ath_tx_node_cleanup(struct ath_soft
+ 	struct ath_atx_ac *ac;
+ 	struct ath_atx_tid *tid;
+ 	struct ath_txq *txq;
+-	int i, tidno;
++	int tidno;
+ 
+ 	for (tidno = 0, tid = &an->tid[tidno];
+ 	     tidno < WME_NUM_TID; tidno++, tid++) {
+-		i = tid->ac->qnum;
+-
+-		if (!ATH_TXQ_SETUP(sc, i))
+-			continue;
+ 
+-		txq = &sc->tx.txq[i];
+ 		ac = tid->ac;
++		txq = ac->txq;
+ 
+ 		spin_lock_bh(&txq->axq_lock);
+ 
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -157,6 +157,13 @@
+ #define PAPRD_GAIN_TABLE_ENTRIES    32
+ #define PAPRD_TABLE_SZ              24
+ 
++enum ath_hw_txq_subtype {
++	ATH_TXQ_AC_BE = 0,
++	ATH_TXQ_AC_BK = 1,
++	ATH_TXQ_AC_VI = 2,
++	ATH_TXQ_AC_VO = 3,
++};
++
+ enum ath_ini_subsys {
+ 	ATH_INI_PRE = 0,
+ 	ATH_INI_CORE,
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+@@ -20,8 +20,15 @@
+ /* TX */
+ /******/
+ 
++static const int subtype_txq_to_hwq[] = {
++	[WME_AC_BE] = ATH_TXQ_AC_BE,
++	[WME_AC_BK] = ATH_TXQ_AC_BK,
++	[WME_AC_VI] = ATH_TXQ_AC_VI,
++	[WME_AC_VO] = ATH_TXQ_AC_VO,
++};
++
+ #define ATH9K_HTC_INIT_TXQ(subtype) do {			\
+-		qi.tqi_subtype = subtype;			\
++		qi.tqi_subtype = subtype_txq_to_hwq[subtype];	\
+ 		qi.tqi_aifs = ATH9K_TXQ_USEDEFAULT;		\
+ 		qi.tqi_cwmin = ATH9K_TXQ_USEDEFAULT;		\
+ 		qi.tqi_cwmax = ATH9K_TXQ_USEDEFAULT;		\
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -396,7 +396,8 @@ static void ath9k_init_crypto(struct ath
+ 
+ static int ath9k_init_btcoex(struct ath_softc *sc)
+ {
+-	int r, qnum;
++	struct ath_txq *txq;
++	int r;
+ 
+ 	switch (sc->sc_ah->btcoex_hw.scheme) {
+ 	case ATH_BTCOEX_CFG_NONE:
+@@ -409,8 +410,8 @@ static int ath9k_init_btcoex(struct ath_
+ 		r = ath_init_btcoex_timer(sc);
+ 		if (r)
+ 			return -1;
+-		qnum = sc->tx.hwq_map[WME_AC_BE];
+-		ath9k_hw_init_btcoex_hw(sc->sc_ah, qnum);
++		txq = sc->tx.txq_map[WME_AC_BE];
++		ath9k_hw_init_btcoex_hw(sc->sc_ah, txq->axq_qnum);
+ 		sc->btcoex.bt_stomp_type = ATH_BTCOEX_STOMP_LOW;
+ 		break;
+ 	default:
+@@ -423,59 +424,18 @@ static int ath9k_init_btcoex(struct ath_
+ 
+ static int ath9k_init_queues(struct ath_softc *sc)
+ {
+-	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+ 	int i = 0;
+ 
+-	for (i = 0; i < ARRAY_SIZE(sc->tx.hwq_map); i++)
+-		sc->tx.hwq_map[i] = -1;
+-
+ 	sc->beacon.beaconq = ath9k_hw_beaconq_setup(sc->sc_ah);
+-	if (sc->beacon.beaconq == -1) {
+-		ath_print(common, ATH_DBG_FATAL,
+-			  "Unable to setup a beacon xmit queue\n");
+-		goto err;
+-	}
+-
+ 	sc->beacon.cabq = ath_txq_setup(sc, ATH9K_TX_QUEUE_CAB, 0);
+-	if (sc->beacon.cabq == NULL) {
+-		ath_print(common, ATH_DBG_FATAL,
+-			  "Unable to setup CAB xmit queue\n");
+-		goto err;
+-	}
+ 
+ 	sc->config.cabqReadytime = ATH_CABQ_READY_TIME;
+ 	ath_cabq_update(sc);
+ 
+-	if (!ath_tx_setup(sc, WME_AC_BK)) {
+-		ath_print(common, ATH_DBG_FATAL,
+-			  "Unable to setup xmit queue for BK traffic\n");
+-		goto err;
+-	}
+-
+-	if (!ath_tx_setup(sc, WME_AC_BE)) {
+-		ath_print(common, ATH_DBG_FATAL,
+-			  "Unable to setup xmit queue for BE traffic\n");
+-		goto err;
+-	}
+-	if (!ath_tx_setup(sc, WME_AC_VI)) {
+-		ath_print(common, ATH_DBG_FATAL,
+-			  "Unable to setup xmit queue for VI traffic\n");
+-		goto err;
+-	}
+-	if (!ath_tx_setup(sc, WME_AC_VO)) {
+-		ath_print(common, ATH_DBG_FATAL,
+-			  "Unable to setup xmit queue for VO traffic\n");
+-		goto err;
+-	}
++	for (i = 0; i < WME_NUM_AC; i++)
++		sc->tx.txq_map[i] = ath_txq_setup(sc, ATH9K_TX_QUEUE_DATA, i);
+ 
+ 	return 0;
+-
+-err:
+-	for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
+-		if (ATH_TXQ_SETUP(sc, i))
+-			ath_tx_cleanupq(sc, &sc->tx.txq[i]);
+-
+-	return -EIO;
+ }
+ 
+ static int ath9k_init_channels_rates(struct ath_softc *sc)
+--- a/drivers/net/wireless/ath/ath9k/virtual.c
++++ b/drivers/net/wireless/ath/ath9k/virtual.c
+@@ -187,7 +187,7 @@ static int ath9k_send_nullfunc(struct at
+ 	info->control.rates[1].idx = -1;
+ 
+ 	memset(&txctl, 0, sizeof(struct ath_tx_control));
+-	txctl.txq = &sc->tx.txq[sc->tx.hwq_map[WME_AC_VO]];
++	txctl.txq = sc->tx.txq_map[WME_AC_VO];
+ 	txctl.frame_type = ps ? ATH9K_IFT_PAUSE : ATH9K_IFT_UNPAUSE;
+ 
+ 	if (ath_tx_start(aphy->hw, skb, &txctl) != 0)
+--- a/drivers/net/wireless/ath/ath9k/debug.c
++++ b/drivers/net/wireless/ath/ath9k/debug.c
+@@ -579,10 +579,10 @@ static const struct file_operations fops
+ 	do {								\
+ 		len += snprintf(buf + len, size - len,			\
+ 				"%s%13u%11u%10u%10u\n", str,		\
+-		sc->debug.stats.txstats[sc->tx.hwq_map[WME_AC_BE]].elem, \
+-		sc->debug.stats.txstats[sc->tx.hwq_map[WME_AC_BK]].elem, \
+-		sc->debug.stats.txstats[sc->tx.hwq_map[WME_AC_VI]].elem, \
+-		sc->debug.stats.txstats[sc->tx.hwq_map[WME_AC_VO]].elem); \
++		sc->debug.stats.txstats[WME_AC_BE].elem, \
++		sc->debug.stats.txstats[WME_AC_BK].elem, \
++		sc->debug.stats.txstats[WME_AC_VI].elem, \
++		sc->debug.stats.txstats[WME_AC_VO].elem); \
+ } while(0)
+ 
+ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
+@@ -624,33 +624,35 @@ static ssize_t read_file_xmit(struct fil
+ 	return retval;
+ }
+ 
+-void ath_debug_stat_tx(struct ath_softc *sc, struct ath_txq *txq,
+-		       struct ath_buf *bf, struct ath_tx_status *ts)
++void ath_debug_stat_tx(struct ath_softc *sc, struct ath_buf *bf,
++		       struct ath_tx_status *ts)
+ {
+-	TX_STAT_INC(txq->axq_qnum, tx_pkts_all);
+-	sc->debug.stats.txstats[txq->axq_qnum].tx_bytes_all += bf->bf_mpdu->len;
++	int qnum = skb_get_queue_mapping(bf->bf_mpdu);
++
++	TX_STAT_INC(qnum, tx_pkts_all);
++	sc->debug.stats.txstats[qnum].tx_bytes_all += bf->bf_mpdu->len;
+ 
+ 	if (bf_isampdu(bf)) {
+ 		if (bf_isxretried(bf))
+-			TX_STAT_INC(txq->axq_qnum, a_xretries);
++			TX_STAT_INC(qnum, a_xretries);
+ 		else
+-			TX_STAT_INC(txq->axq_qnum, a_completed);
++			TX_STAT_INC(qnum, a_completed);
+ 	} else {
+-		TX_STAT_INC(txq->axq_qnum, completed);
++		TX_STAT_INC(qnum, completed);
+ 	}
+ 
+ 	if (ts->ts_status & ATH9K_TXERR_FIFO)
+-		TX_STAT_INC(txq->axq_qnum, fifo_underrun);
++		TX_STAT_INC(qnum, fifo_underrun);
+ 	if (ts->ts_status & ATH9K_TXERR_XTXOP)
+-		TX_STAT_INC(txq->axq_qnum, xtxop);
++		TX_STAT_INC(qnum, xtxop);
+ 	if (ts->ts_status & ATH9K_TXERR_TIMER_EXPIRED)
+-		TX_STAT_INC(txq->axq_qnum, timer_exp);
++		TX_STAT_INC(qnum, timer_exp);
+ 	if (ts->ts_flags & ATH9K_TX_DESC_CFG_ERR)
+-		TX_STAT_INC(txq->axq_qnum, desc_cfg_err);
++		TX_STAT_INC(qnum, desc_cfg_err);
+ 	if (ts->ts_flags & ATH9K_TX_DATA_UNDERRUN)
+-		TX_STAT_INC(txq->axq_qnum, data_underrun);
++		TX_STAT_INC(qnum, data_underrun);
+ 	if (ts->ts_flags & ATH9K_TX_DELIM_UNDERRUN)
+-		TX_STAT_INC(txq->axq_qnum, delim_underrun);
++		TX_STAT_INC(qnum, delim_underrun);
+ }
+ 
+ static const struct file_operations fops_xmit = {
+--- a/drivers/net/wireless/ath/ath9k/debug.h
++++ b/drivers/net/wireless/ath/ath9k/debug.h
+@@ -169,8 +169,8 @@ void ath9k_exit_debug(struct ath_hw *ah)
+ int ath9k_debug_create_root(void);
+ void ath9k_debug_remove_root(void);
+ void ath_debug_stat_interrupt(struct ath_softc *sc, enum ath9k_int status);
+-void ath_debug_stat_tx(struct ath_softc *sc, struct ath_txq *txq,
+-		       struct ath_buf *bf, struct ath_tx_status *ts);
++void ath_debug_stat_tx(struct ath_softc *sc, struct ath_buf *bf,
++		       struct ath_tx_status *ts);
+ void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs);
+ 
+ #else
+@@ -199,7 +199,6 @@ static inline void ath_debug_stat_interr
+ }
+ 
+ static inline void ath_debug_stat_tx(struct ath_softc *sc,
+-				     struct ath_txq *txq,
+ 				     struct ath_buf *bf,
+ 				     struct ath_tx_status *ts)
+ {
diff --git a/package/mac80211/patches/580-ath9k_aggr_start_fix.patch b/package/mac80211/patches/580-ath9k_aggr_start_fix.patch
deleted file mode 100644
index 1dcac53e4..000000000
--- a/package/mac80211/patches/580-ath9k_aggr_start_fix.patch
+++ /dev/null
@@ -1,12 +0,0 @@
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -124,7 +124,8 @@ static void ath_tx_resume_tid(struct ath
- {
- 	struct ath_txq *txq = &sc->tx.txq[tid->ac->qnum];
- 
--	WARN_ON(!tid->paused);
-+	if (!tid->paused)
-+		return;
- 
- 	spin_lock_bh(&txq->axq_lock);
- 	tid->paused = false;
diff --git a/package/mac80211/patches/580-cfg80211_ibss_mcast_rate.patch b/package/mac80211/patches/580-cfg80211_ibss_mcast_rate.patch
new file mode 100644
index 000000000..7ec4ce49d
--- /dev/null
+++ b/package/mac80211/patches/580-cfg80211_ibss_mcast_rate.patch
@@ -0,0 +1,58 @@
+--- a/include/linux/nl80211.h
++++ b/include/linux/nl80211.h
+@@ -804,6 +804,8 @@ enum nl80211_commands {
+  * @NL80211_ATTR_SUPPORT_IBSS_RSN: The device supports IBSS RSN, which mostly
+  *	means support for per-station GTKs.
+  *
++ * @NL80211_ATTR_MCAST_RATE: Multicast tx rate (in 100 kbps) for IBSS
++ *
+  * @NL80211_ATTR_MAX: highest attribute number currently defined
+  * @__NL80211_ATTR_AFTER_LAST: internal use
+  */
+@@ -973,6 +975,8 @@ enum nl80211_attrs {
+ 
+ 	NL80211_ATTR_SUPPORT_IBSS_RSN,
+ 
++	NL80211_ATTR_MCAST_RATE,
++
+ 	/* add attributes here, update the policy in nl80211.c */
+ 
+ 	__NL80211_ATTR_AFTER_LAST,
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -924,6 +924,7 @@ struct cfg80211_disassoc_request {
+  * @privacy: this is a protected network, keys will be configured
+  *	after joining
+  * @basic_rates: bitmap of basic rates to use when creating the IBSS
++ * @mcast_rate: multicast tx rate (in 100 kbps)
+  */
+ struct cfg80211_ibss_params {
+ 	u8 *ssid;
+@@ -935,6 +936,7 @@ struct cfg80211_ibss_params {
+ 	u32 basic_rates;
+ 	bool channel_fixed;
+ 	bool privacy;
++	int mcast_rate;
+ };
+ 
+ /**
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -167,6 +167,7 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
+ 	[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
+ 	[NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
++	[NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
+ };
+ 
+ /* policy for the key attributes */
+@@ -3652,6 +3653,9 @@ static int nl80211_join_ibss(struct sk_b
+ 				return -EINVAL;
+ 		}
+ 	}
++	if (info->attrs[NL80211_ATTR_MCAST_RATE])
++		ibss.mcast_rate =
++			nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
+ 
+ 	if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
+ 		connkeys = nl80211_parse_connkeys(rdev,
diff --git a/package/mac80211/patches/581-mac80211_ibss_mcast_rate.patch b/package/mac80211/patches/581-mac80211_ibss_mcast_rate.patch
new file mode 100644
index 000000000..07ba6f096
--- /dev/null
+++ b/package/mac80211/patches/581-mac80211_ibss_mcast_rate.patch
@@ -0,0 +1,106 @@
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -914,6 +914,7 @@ int ieee80211_ibss_join(struct ieee80211
+ 
+ 	sdata->u.ibss.privacy = params->privacy;
+ 	sdata->u.ibss.basic_rates = params->basic_rates;
++	sdata->vif.bss_conf.mcast_rate = params->mcast_rate;
+ 
+ 	sdata->vif.bss_conf.beacon_int = params->beacon_interval;
+ 
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -244,6 +244,7 @@ struct ieee80211_bss_conf {
+ 	u16 assoc_capability;
+ 	u64 timestamp;
+ 	u32 basic_rates;
++	u32 mcast_rate;
+ 	u16 ht_operation_mode;
+ 	s32 cqm_rssi_thold;
+ 	u32 cqm_rssi_hyst;
+@@ -2644,7 +2645,7 @@ enum rate_control_changed {
+  * @rate_idx_mask: user-requested rate mask (not MCS for now)
+  * @skb: the skb that will be transmitted, the control information in it needs
+  *	to be filled in
+- * @ap: whether this frame is sent out in AP mode
++ * @bss: whether this frame is sent out in AP or IBSS mode
+  */
+ struct ieee80211_tx_rate_control {
+ 	struct ieee80211_hw *hw;
+@@ -2655,7 +2656,7 @@ struct ieee80211_tx_rate_control {
+ 	bool rts, short_preamble;
+ 	u8 max_rate_idx;
+ 	u32 rate_idx_mask;
+-	bool ap;
++	bool bss;
+ };
+ 
+ struct rate_control_ops {
+--- a/net/mac80211/rate.c
++++ b/net/mac80211/rate.c
+@@ -210,10 +210,20 @@ static bool rc_no_data_or_no_ack(struct 
+ 	return ((info->flags & IEEE80211_TX_CTL_NO_ACK) || !ieee80211_is_data(fc));
+ }
+ 
+-static void rc_send_low_broadcast(s8 *idx, u32 basic_rates, u8 max_rate_idx)
++static void rc_send_low_broadcast(s8 *idx, u32 basic_rates, u32 mcast_rate,
++				  struct ieee80211_supported_band *sband)
+ {
+ 	u8 i;
+ 
++	if (mcast_rate) {
++		for (i = 0; i < sband->n_bitrates; i++) {
++			if (sband->bitrates[i].bitrate == mcast_rate) {
++				*idx = i;
++				return;
++			}
++		}
++	}
++
+ 	if (basic_rates == 0)
+ 		return; /* assume basic rates unknown and accept rate */
+ 	if (*idx < 0)
+@@ -221,7 +231,7 @@ static void rc_send_low_broadcast(s8 *id
+ 	if (basic_rates & (1 << *idx))
+ 		return; /* selected rate is a basic rate */
+ 
+-	for (i = *idx + 1; i <= max_rate_idx; i++) {
++	for (i = *idx + 1; i <= sband->n_bitrates; i++) {
+ 		if (basic_rates & (1 << i)) {
+ 			*idx = i;
+ 			return;
+@@ -242,10 +252,11 @@ bool rate_control_send_low(struct ieee80
+ 		info->control.rates[0].count =
+ 			(info->flags & IEEE80211_TX_CTL_NO_ACK) ?
+ 			1 : txrc->hw->max_rate_tries;
+-		if (!sta && txrc->ap)
++		if (!sta && txrc->bss)
+ 			rc_send_low_broadcast(&info->control.rates[0].idx,
+ 					      txrc->bss_conf->basic_rates,
+-					      txrc->sband->n_bitrates);
++					      txrc->bss_conf->mcast_rate,
++					      txrc->sband);
+ 		return true;
+ 	}
+ 	return false;
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -622,7 +622,8 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
+ 		txrc.max_rate_idx = -1;
+ 	else
+ 		txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
+-	txrc.ap = tx->sdata->vif.type == NL80211_IFTYPE_AP;
++	txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
++			   tx->sdata->vif.type == NL80211_IFTYPE_ADHOC);
+ 
+ 	/* set up RTS protection if desired */
+ 	if (len > tx->local->hw.wiphy->rts_threshold) {
+@@ -2312,7 +2313,7 @@ struct sk_buff *ieee80211_beacon_get_tim
+ 		txrc.max_rate_idx = -1;
+ 	else
+ 		txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
+-	txrc.ap = true;
++	txrc.bss = true;
+ 	rate_control_get_rate(sdata, NULL, &txrc);
+ 
+ 	info->control.vif = vif;
diff --git a/package/mac80211/patches/590-ath9k_fix_cycle_counter_ps.patch b/package/mac80211/patches/590-ath9k_fix_cycle_counter_ps.patch
new file mode 100644
index 000000000..4ee5f7359
--- /dev/null
+++ b/package/mac80211/patches/590-ath9k_fix_cycle_counter_ps.patch
@@ -0,0 +1,33 @@
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -94,11 +94,13 @@ void ath9k_ps_wakeup(struct ath_softc *s
+ {
+ 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+ 	unsigned long flags;
++	enum ath9k_power_mode power_mode;
+ 
+ 	spin_lock_irqsave(&sc->sc_pm_lock, flags);
+ 	if (++sc->ps_usecount != 1)
+ 		goto unlock;
+ 
++	power_mode = sc->sc_ah->power_mode;
+ 	ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_AWAKE);
+ 
+ 	/*
+@@ -106,10 +108,12 @@ void ath9k_ps_wakeup(struct ath_softc *s
+ 	 * useful data. Better clear them now so that they don't mess up
+ 	 * survey data results.
+ 	 */
+-	spin_lock(&common->cc_lock);
+-	ath_hw_cycle_counters_update(common);
+-	memset(&common->cc_survey, 0, sizeof(common->cc_survey));
+-	spin_unlock(&common->cc_lock);
++	if (power_mode != ATH9K_PM_AWAKE) {
++		spin_lock(&common->cc_lock);
++		ath_hw_cycle_counters_update(common);
++		memset(&common->cc_survey, 0, sizeof(common->cc_survey));
++		spin_unlock(&common->cc_lock);
++	}
+ 
+  unlock:
+ 	spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
diff --git a/package/mac80211/patches/591-ath9k_swba_intr_fix.patch b/package/mac80211/patches/591-ath9k_swba_intr_fix.patch
new file mode 100644
index 000000000..5bea9f90a
--- /dev/null
+++ b/package/mac80211/patches/591-ath9k_swba_intr_fix.patch
@@ -0,0 +1,20 @@
+--- a/drivers/net/wireless/ath/ath9k/beacon.c
++++ b/drivers/net/wireless/ath/ath9k/beacon.c
+@@ -506,7 +506,7 @@ static void ath_beacon_config_ap(struct 
+ 	ath9k_hw_disable_interrupts(ah);
+ 	ath9k_beacon_init(sc, nexttbtt, intval);
+ 	sc->beacon.bmisscnt = 0;
+-	ath9k_hw_enable_interrupts(ah);
++	ath9k_hw_set_interrupts(ah, ah->imask);
+ 
+ 	/* Clear the reset TSF flag, so that subsequent beacon updation
+ 	   will not reset the HW TSF. */
+@@ -689,7 +689,7 @@ static void ath_beacon_config_adhoc(stru
+ 	ath9k_hw_disable_interrupts(ah);
+ 	ath9k_beacon_init(sc, nexttbtt, intval);
+ 	sc->beacon.bmisscnt = 0;
+-	ath9k_hw_enable_interrupts(ah);
++	ath9k_hw_set_interrupts(ah, ah->imask);
+ }
+ 
+ void ath_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif)
diff --git a/package/mac80211/patches/600-rt2x00-disable-pci-code-if-CONFIG_PCI-not-defined.patch b/package/mac80211/patches/600-rt2x00-disable-pci-code-if-CONFIG_PCI-not-defined.patch
index 3364b8bcc..28009bce0 100644
--- a/package/mac80211/patches/600-rt2x00-disable-pci-code-if-CONFIG_PCI-not-defined.patch
+++ b/package/mac80211/patches/600-rt2x00-disable-pci-code-if-CONFIG_PCI-not-defined.patch
@@ -8,7 +8,7 @@
  /*
   * PCI driver handlers.
   */
-@@ -382,6 +383,7 @@ int rt2x00pci_resume(struct pci_dev *pci
+@@ -381,6 +382,7 @@ int rt2x00pci_resume(struct pci_dev *pci
  }
  EXPORT_SYMBOL_GPL(rt2x00pci_resume);
  #endif /* CONFIG_PM */
diff --git a/package/mac80211/patches/601-rt2x00-fix-hang-on-ifdown.patch b/package/mac80211/patches/601-rt2x00-fix-hang-on-ifdown.patch
new file mode 100644
index 000000000..3bee27105
--- /dev/null
+++ b/package/mac80211/patches/601-rt2x00-fix-hang-on-ifdown.patch
@@ -0,0 +1,29 @@
+From 27ed5ec6924c17b76d65b697a162bafee7bd8e4e Mon Sep 17 00:00:00 2001
+From: Helmut Schaa <helmut.schaa@googlemail.com>
+Date: Mon, 21 Jun 2010 10:03:05 +0200
+Subject: [PATCH] rt2x00: fix rt2800pci hang on ifdown
+
+rt2800pci hangs the system on rt305x SoC devices on ifdown. Work around
+this issue by disabling TX DMA prior to resetting the TX queue indices.
+
+This patch is not suitable for upstream inclusion but is just meant as
+a workaround until a proper solution is implemented.
+
+Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
+---
+ drivers/net/wireless/rt2x00/rt2800pci.c |    4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2800pci.c
++++ b/drivers/net/wireless/rt2x00/rt2800pci.c
+@@ -593,6 +593,10 @@ static void rt2800pci_kill_tx_queue(stru
+ 		return;
+ 	}
+ 
++	rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
++	rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
++	rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
++
+ 	rt2800_register_read(rt2x00dev, WPDMA_RST_IDX, &reg);
+ 	rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX0, (queue->qid == QID_AC_BE));
+ 	rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX1, (queue->qid == QID_AC_BK));
diff --git a/package/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch b/package/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
index b90539e5e..c0e918e8f 100644
--- a/package/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
+++ b/package/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/mwl8k.c
 +++ b/drivers/net/wireless/mwl8k.c
-@@ -3884,6 +3884,7 @@ MODULE_FIRMWARE("mwl8k/helper_8366.fw");
+@@ -3897,6 +3897,7 @@ MODULE_FIRMWARE("mwl8k/helper_8366.fw");
  MODULE_FIRMWARE("mwl8k/fmimage_8366.fw");
  
  static DEFINE_PCI_DEVICE_TABLE(mwl8k_pci_id_table) = {
diff --git a/package/mac80211/patches/800-b43-gpio-mask-module-option.patch b/package/mac80211/patches/800-b43-gpio-mask-module-option.patch
new file mode 100644
index 000000000..bef3b58c3
--- /dev/null
+++ b/package/mac80211/patches/800-b43-gpio-mask-module-option.patch
@@ -0,0 +1,50 @@
+--- a/drivers/net/wireless/b43/b43.h
++++ b/drivers/net/wireless/b43/b43.h
+@@ -705,6 +705,7 @@ struct b43_wldev {
+ 	bool qos_enabled;		/* TRUE, if QoS is used. */
+ 	bool hwcrypto_enabled;		/* TRUE, if HW crypto acceleration is enabled. */
+ 	bool use_pio;			/* TRUE if next init should use PIO */
++	int gpiomask;			/* GPIO LED mask as a module parameter */
+ 
+ 	/* PHY/Radio device. */
+ 	struct b43_phy phy;
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -75,6 +75,11 @@ MODULE_FIRMWARE("b43/ucode15.fw");
+ MODULE_FIRMWARE("b43/ucode5.fw");
+ MODULE_FIRMWARE("b43/ucode9.fw");
+ 
++static int modparam_gpiomask = 0x000F;
++module_param_named(gpiomask, modparam_gpiomask, int, 0444);
++MODULE_PARM_DESC(gpiomask,
++         "GPIO mask for LED control (default 0x000F)");
++
+ static int modparam_bad_frames_preempt;
+ module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
+ MODULE_PARM_DESC(bad_frames_preempt,
+@@ -2534,10 +2539,10 @@ static int b43_gpio_init(struct b43_wlde
+ 		    & ~B43_MACCTL_GPOUTSMSK);
+ 
+ 	b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
+-		    | 0x000F);
++		    | modparam_gpiomask);
+ 
+ 	mask = 0x0000001F;
+-	set = 0x0000000F;
++	set = modparam_gpiomask;
+ 	if (dev->dev->bus->chip_id == 0x4301) {
+ 		mask |= 0x0060;
+ 		set |= 0x0060;
+@@ -5094,10 +5099,10 @@ static void b43_print_driverinfo(void)
+ 	feat_sdio = "S";
+ #endif
+ 	printk(KERN_INFO "Broadcom 43xx driver loaded "
+-	       "[ Features: %s%s%s%s%s, Firmware-ID: "
++	       "[ Features: %s%s%s%s%s, GPIO LED Mask: 0x%04x, Firmware-ID: "
+ 	       B43_SUPPORTED_FIRMWARE_ID " ]\n",
+ 	       feat_pci, feat_pcmcia, feat_nphy,
+-	       feat_leds, feat_sdio);
++	       feat_leds, feat_sdio, modparam_gpiomask);
+ }
+ 
+ static int __init b43_init(void)
diff --git a/package/mac80211/patches/810-b43_no_pio.patch b/package/mac80211/patches/810-b43_no_pio.patch
new file mode 100644
index 000000000..4a382e70e
--- /dev/null
+++ b/package/mac80211/patches/810-b43_no_pio.patch
@@ -0,0 +1,70 @@
+--- a/drivers/net/wireless/b43/Makefile
++++ b/drivers/net/wireless/b43/Makefile
+@@ -14,7 +14,7 @@ b43-y				+= xmit.o
+ b43-y				+= lo.o
+ b43-y				+= wa.o
+ b43-y				+= dma.o
+-b43-y				+= pio.o
++# b43-y				+= pio.o
+ b43-y				+= rfkill.o
+ b43-$(CONFIG_B43_LEDS)		+= leds.o
+ b43-$(CONFIG_B43_PCMCIA)	+= pcmcia.o
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -1810,9 +1810,11 @@ static void b43_do_interrupt_thread(stru
+ 			       dma_reason[4], dma_reason[5]);
+ 			b43err(dev->wl, "This device does not support DMA "
+ 			       "on your system. It will now be switched to PIO.\n");
++#if 0
+ 			/* Fall back to PIO transfers if we get fatal DMA errors! */
+ 			dev->use_pio = 1;
+ 			b43_controller_restart(dev, "DMA error");
++#endif
+ 			return;
+ 		}
+ 		if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
+--- a/drivers/net/wireless/b43/pio.h
++++ b/drivers/net/wireless/b43/pio.h
+@@ -151,15 +151,34 @@ static inline void b43_piorx_write32(str
+ }
+ 
+ 
+-int b43_pio_init(struct b43_wldev *dev);
+-void b43_pio_free(struct b43_wldev *dev);
++static inline int b43_pio_init(struct b43_wldev *dev)
++{
++	return 0;
++}
++
++static inline void b43_pio_free(struct b43_wldev *dev)
++{
++}
++
++static inline int b43_pio_tx(struct b43_wldev *dev, struct sk_buff *skb)
++{
++	return 0;
++}
+ 
+-int b43_pio_tx(struct b43_wldev *dev, struct sk_buff *skb);
+-void b43_pio_handle_txstatus(struct b43_wldev *dev,
+-			     const struct b43_txstatus *status);
+-void b43_pio_rx(struct b43_pio_rxqueue *q);
++static inline void b43_pio_handle_txstatus(struct b43_wldev *dev,
++					   const struct b43_txstatus *status)
++{
++}
++
++static inline void b43_pio_rx(struct b43_pio_rxqueue *q)
++{
++}
+ 
+-void b43_pio_tx_suspend(struct b43_wldev *dev);
+-void b43_pio_tx_resume(struct b43_wldev *dev);
++static inline void b43_pio_tx_suspend(struct b43_wldev *dev)
++{
++}
++static inline void b43_pio_tx_resume(struct b43_wldev *dev)
++{
++}
+ 
+ #endif /* B43_PIO_H_ */
diff --git a/package/mac80211/patches/900-bash-location.patch b/package/mac80211/patches/900-bash-location.patch
new file mode 100644
index 000000000..42b7d56f2
--- /dev/null
+++ b/package/mac80211/patches/900-bash-location.patch
@@ -0,0 +1,189 @@
+--- a/scripts/admin-clean.sh
++++ b/scripts/admin-clean.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ if [ -d net ] ; then
+ 	make clean
+ fi
+--- a/scripts/admin-refresh.sh
++++ b/scripts/admin-refresh.sh
+@@ -1,3 +1,3 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ ./scripts/admin-clean.sh $@
+ ./scripts/admin-update.sh $@
+--- a/scripts/admin-update.sh
++++ b/scripts/admin-update.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ # 
+ # Copyright 2007, 2008, 2010	Luis R. Rodriguez <mcgrof@winlab.rutgers.edu>
+ #
+--- a/scripts/athenable
++++ b/scripts/athenable
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ #
+ # Copyright 2007	Luis R. Rodriguez <mcgrof@winlab.rutgers.edu>
+ #
+--- a/scripts/athload
++++ b/scripts/athload
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ # Copyright 2007	Luis R. Rodriguez <mcgrof@winlab.rutgers.edu>
+ #
+ # Loads ath5k or madwifi
+--- a/scripts/b43enable
++++ b/scripts/b43enable
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ #
+ # Copyright 2007	Luis R. Rodriguez <mcgrof@winlab.rutgers.edu>
+ #
+--- a/scripts/b43load
++++ b/scripts/b43load
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ # Copyright 2007	Luis R. Rodriguez <mcgrof@winlab.rutgers.edu>
+ #
+ # Loads new broadcom drivers (b43 and b43legacy) or the old ones (bcm43xx)
+--- a/scripts/btload.sh
++++ b/scripts/btload.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ MODULES="bluetooth btusb l2cap sco hidp rfcomm bnep"
+ for i in $MODULES; do
+ 	echo Loading $i...
+--- a/scripts/btunload.sh
++++ b/scripts/btunload.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ MODULES="hidp rfcomm bnep l2cap sco btusb bluetooth"
+ echo Stoping bluetooth service..
+ /etc/init.d/bluetooth stop
+--- a/scripts/check_config.sh
++++ b/scripts/check_config.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ # This script checks the compat-wireless configuration file and if changes were made
+ # regenerates the compat_autoconf header.
+ 
+--- a/scripts/check_depmod
++++ b/scripts/check_depmod
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ # Copyright 2009	Luis R. Rodriguez <mcgrof@gmail.com>
+ # 
+ # Ensures your distribution likes to prefer updates/ over the kernel/
+--- a/scripts/compress_modules
++++ b/scripts/compress_modules
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ # To be used by distributions using compressed modules
+ 
+ COMPRESSION_FOUND="n"
+--- a/scripts/driver-select
++++ b/scripts/driver-select
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ # Copyright 2009        Luis R. Rodriguez <mcgrof@gmail.com>
+ #
+ # This script allows you to select your compat-wireless driver and
+--- a/scripts/gen-compat-autoconf.sh
++++ b/scripts/gen-compat-autoconf.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ # 
+ # Copyright 2007	Luis R. Rodriguez <mcgrof@winlab.rutgers.edu>
+ #
+--- a/scripts/gen-stable-release.sh
++++ b/scripts/gen-stable-release.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ # Copyright 2009  Luis R. Rodriguez <mcgrof@gmail.com>
+ #
+ # You can use this to make stable compat-wireless releases
+--- a/scripts/iwl-enable
++++ b/scripts/iwl-enable
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ #
+ # Copyright 2007	Luis R. Rodriguez <lrodriguez@atheros.com>
+ #
+--- a/scripts/iwl-load
++++ b/scripts/iwl-load
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ # Copyright 2008	Luis R. Rodriguez <lrodriguez@atheros.com>
+ #
+ # Loads new Intel iwl (iwlagn) or the old ones (iwl4965)
+--- a/scripts/load.sh
++++ b/scripts/load.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ MODULES="ipw2100 ipw2200 libertas_cs usb8xxx"
+ MODULES="$MODULES p54pci p54usb"
+ MODULES="$MODULES adm8211 zd1211rw"
+--- a/scripts/modlib.sh
++++ b/scripts/modlib.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ #
+ # Copyright 2007	Luis R. Rodriguez <mcgrof@winlab.rutgers.edu>
+ #
+--- a/scripts/skip-colors
++++ b/scripts/skip-colors
+@@ -1,2 +1,2 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ perl -pe 's|(\e)\[(\d+)(;*)(\d*)(\w)||g'
+--- a/scripts/unload.sh
++++ b/scripts/unload.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ 
+ # The old stack drivers and the mac80211 rc80211_simple modules 
+ # which is no longer on recent kernels (its internal)
+--- a/scripts/update-initramfs
++++ b/scripts/update-initramfs
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ # Copyright 2009        Luis R. Rodriguez <mcgrof@gmail.com>
+ #
+ # Since we provide ssb, the Ethernet module b44 some people may
+--- a/scripts/wlload.sh
++++ b/scripts/wlload.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ MODULES="ipw2100 ipw2200 libertas_cs usb8xxx"
+ MODULES="$MODULES p54pci p54usb"
+ MODULES="$MODULES adm8211 zd1211rw"
+--- a/scripts/wlunload.sh
++++ b/scripts/wlunload.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ 
+ # The old stack drivers and the mac80211 rc80211_simple modules
+ # which is no longer on recent kernels (its internal)
diff --git a/package/madwifi/files/lib/wifi/madwifi.sh b/package/madwifi/files/lib/wifi/madwifi.sh
index 2b2e699d0..9e0e70b38 100755
--- a/package/madwifi/files/lib/wifi/madwifi.sh
+++ b/package/madwifi/files/lib/wifi/madwifi.sh
@@ -215,7 +215,11 @@ enable_atheros() {
 		}
 
 		case "$enc" in
-			WEP|wep)
+			wep*)
+				case "$enc" in
+					*shared*) iwpriv "$ifname" authmode 2;;
+					*)        iwpriv "$ifname" authmode 1;;
+				esac
 				for idx in 1 2 3 4; do
 					config_get key "$vif" "key${idx}"
 					iwconfig "$ifname" enc "[$idx]" "${key:-off}"
diff --git a/package/madwifi/patches/464-remove_11n_devids.patch b/package/madwifi/patches/464-remove_11n_devids.patch
new file mode 100644
index 000000000..cf80f06bf
--- /dev/null
+++ b/package/madwifi/patches/464-remove_11n_devids.patch
@@ -0,0 +1,20 @@
+--- a/ath/if_ath_pci.c
++++ b/ath/if_ath_pci.c
+@@ -111,8 +111,6 @@ static struct pci_device_id ath_pci_id_t
+ 	{ 0x168c, 0x001b, PCI_ANY_ID, PCI_ANY_ID },
+ 	{ 0x168c, 0x001c, PCI_ANY_ID, PCI_ANY_ID }, /* PCI Express 5424 */
+ 	{ 0x168c, 0x001d, PCI_ANY_ID, PCI_ANY_ID }, /* PCI Express ???  */
+-	{ 0x168c, 0x0023, PCI_ANY_ID, PCI_ANY_ID },
+-	{ 0x168c, 0x0024, PCI_ANY_ID, PCI_ANY_ID },
+ 	{ 0x168c, 0x9013, PCI_ANY_ID, PCI_ANY_ID }, /* sonicwall */
+ 	{ 0x168c, 0xff1a, PCI_ANY_ID, PCI_ANY_ID },
+ 	{ 0 }
+@@ -146,8 +144,6 @@ static const struct ath_hw_detect cards[
+ 	{ ubnt, "SR4C",    0x168c, 0x0013, 0x7777, 0x1004, 6 },
+ 	{ ubnt, "SR5",     0x168c, 0x0013, 0x168c, 0x2042, 7 },
+ 	{ ubnt, "SR9",     0x168c, 0x0013, 0x7777, 0x2009, 12 },
+-	{ ubnt, "SR71A",   0x168c, 0x0027, 0x168c, 0x2082, 10 },
+-	{ ubnt, "SR71",    0x168c, 0x0027, 0x0777, 0x4082, 10 },
+ };
+ 
+ static int
diff --git a/package/mmc_over_gpio/Makefile b/package/mmc_over_gpio/Makefile
index 5a3ab1d60..9c14a69f5 100644
--- a/package/mmc_over_gpio/Makefile
+++ b/package/mmc_over_gpio/Makefile
@@ -51,6 +51,10 @@ define KernelPackage/mmc-over-gpio/description
  Support for driving an MMC/SD card over GPIO pins via SPI.
 endef
 
+define KernelPackage/mmc-over-gpio/conffiles
+/etc/config/mmc_over_gpio
+endef
+
 define Build/Prepare
 	mkdir -p $(PKG_BUILD_DIR)
 endef
diff --git a/package/mountd/Makefile b/package/mountd/Makefile
index bfee3585e..c59137637 100644
--- a/package/mountd/Makefile
+++ b/package/mountd/Makefile
@@ -25,6 +25,10 @@ define Package/mountd/description
   openwrt automount daemon
 endef
 
+define Package/mountd/conffiles
+/etc/config/mountd
+endef
+
 define Build/Compile
 	$(TARGET_CONFIGURE_OPTS) \
 		CFLAGS="$(TARGET_CFLAGS) -I$(STAGING_DIR)/usr/include -I$(PKG_BUILD_DIR)" \
@@ -40,4 +44,3 @@ define Package/mountd/install
 endef
 
 $(eval $(call BuildPackage,mountd))
-
diff --git a/package/opkg/Makefile b/package/opkg/Makefile
index 5afd9935b..2870abdc0 100644
--- a/package/opkg/Makefile
+++ b/package/opkg/Makefile
@@ -8,9 +8,9 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=opkg
-PKG_REV:=513
+PKG_REV:=576
 PKG_VERSION:=$(PKG_REV)
-PKG_RELEASE:=3
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=svn
 PKG_SOURCE_VERSION:=$(PKG_REV)
@@ -26,6 +26,7 @@ define Package/opkg
   SECTION:=base
   CATEGORY:=Base system
   TITLE:=opkg package management system
+  MAINTAINER:=Jo-Philipp Wich <xm@subsignal.org>
   URL:=http://wiki.openmoko.org/wiki/Opkg
 endef
 
diff --git a/package/opkg/patches/000-upstream-fix_configure_order.patch b/package/opkg/patches/000-upstream-fix_configure_order.patch
deleted file mode 100644
index dcd1b547c..000000000
--- a/package/opkg/patches/000-upstream-fix_configure_order.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-http://code.google.com/p/opkg/source/detail?r=521
-
---- a/libopkg/opkg_cmd.c
-+++ b/libopkg/opkg_cmd.c
-@@ -390,8 +390,8 @@ opkg_configure_packages(char *pkg_name)
- 	     goto error;
-      }
-     
--     for(i = 0; i < all->len; i++) {
--	  pkg = all->pkgs[i];
-+     for(i = 0; i < ordered->len; i++) {
-+	  pkg = ordered->pkgs[i];
- 
- 	  if (pkg_name && fnmatch(pkg_name, pkg->name, 0)) 
- 	       continue;
diff --git a/package/opkg/patches/003-fs_overlay_support.patch b/package/opkg/patches/003-fs_overlay_support.patch
index 4fed4d12e..63933bd97 100644
--- a/package/opkg/patches/003-fs_overlay_support.patch
+++ b/package/opkg/patches/003-fs_overlay_support.patch
@@ -6,7 +6,7 @@ Signed-off-by: Nicolas Thill <nico@openwrt.org>
 
 --- a/libopkg/opkg_conf.c
 +++ b/libopkg/opkg_conf.c
-@@ -62,6 +62,7 @@ opkg_option_t options[] = {
+@@ -63,6 +63,7 @@ opkg_option_t options[] = {
  	  { "download_only", OPKG_OPT_TYPE_BOOL, &_conf.download_only },
  	  { "nodeps", OPKG_OPT_TYPE_BOOL, &_conf.nodeps },
  	  { "offline_root", OPKG_OPT_TYPE_STRING, &_conf.offline_root },
@@ -16,9 +16,9 @@ Signed-off-by: Nicolas Thill <nico@openwrt.org>
  	  { "query-all", OPKG_OPT_TYPE_BOOL, &_conf.query_all },
 --- a/libopkg/opkg_conf.h
 +++ b/libopkg/opkg_conf.h
-@@ -76,6 +76,7 @@ struct opkg_conf
+@@ -78,6 +78,7 @@ struct opkg_conf
       int check_signature;
-      int nodeps; /* do not follow dependences */
+      int nodeps; /* do not follow dependencies */
       char *offline_root;
 +     char *overlay_root;
       int query_all;
@@ -34,7 +34,7 @@ Signed-off-by: Nicolas Thill <nico@openwrt.org>
  
  #include "pkg.h"
  #include "pkg_hash.h"
-@@ -189,13 +190,24 @@ static int
+@@ -192,13 +193,24 @@ static int
  verify_pkg_installable(pkg_t *pkg)
  {
  	unsigned long kbs_available, pkg_size_kbs;
diff --git a/package/opkg/patches/009-remove-upgrade-all.patch b/package/opkg/patches/009-remove-upgrade-all.patch
deleted file mode 100644
index be76ef53c..000000000
--- a/package/opkg/patches/009-remove-upgrade-all.patch
+++ /dev/null
@@ -1,40 +0,0 @@
---- a/libopkg/opkg_cmd.c
-+++ b/libopkg/opkg_cmd.c
-@@ -498,17 +498,6 @@ opkg_upgrade_cmd(int argc, char **argv)
- 		    opkg_install_by_name(arg);
-                }
- 	  }
--     } else {
--	  pkg_vec_t *installed = pkg_vec_alloc();
--
--	  pkg_info_preinstall_check();
--
--	  pkg_hash_fetch_all_installed(installed);
--	  for (i = 0; i < installed->len; i++) {
--	       pkg = installed->pkgs[i];
--	       opkg_upgrade_pkg(pkg);
--	  }
--	  pkg_vec_free(installed);
-      }
- 
-      opkg_configure_packages(NULL);
-@@ -1166,7 +1155,7 @@ opkg_print_architecture_cmd(int argc, ch
-    array for easier maintenance */
- static opkg_cmd_t cmds[] = {
-      {"update", 0, (opkg_cmd_fun_t)opkg_update_cmd, PFM_DESCRIPTION|PFM_SOURCE},
--     {"upgrade", 0, (opkg_cmd_fun_t)opkg_upgrade_cmd, PFM_DESCRIPTION|PFM_SOURCE},
-+     {"upgrade", 1, (opkg_cmd_fun_t)opkg_upgrade_cmd, PFM_DESCRIPTION|PFM_SOURCE},
-      {"list", 0, (opkg_cmd_fun_t)opkg_list_cmd, PFM_SOURCE},
-      {"list_installed", 0, (opkg_cmd_fun_t)opkg_list_installed_cmd, PFM_SOURCE},
-      {"list-installed", 0, (opkg_cmd_fun_t)opkg_list_installed_cmd, PFM_SOURCE},
---- a/src/opkg-cl.c
-+++ b/src/opkg-cl.c
-@@ -187,7 +187,7 @@ usage()
- 
- 	printf("\nPackage Manipulation:\n");
- 	printf("\tupdate			Update list of available packages\n");
--	printf("\tupgrade			Upgrade installed packages\n");
-+	printf("\tupgrade <pkgs>		Upgrade package(s)\n");
- 	printf("\tinstall <pkgs>		Install package(s)\n");
- 	printf("\tconfigure <pkgs>	Configure unpacked package(s)\n");
- 	printf("\tremove <pkgs|regexp>	Remove package(s)\n");
diff --git a/package/opkg/patches/010-remove-flag.patch b/package/opkg/patches/010-remove-flag.patch
deleted file mode 100644
index c242bea31..000000000
--- a/package/opkg/patches/010-remove-flag.patch
+++ /dev/null
@@ -1,60 +0,0 @@
---- a/libopkg/opkg_cmd.c
-+++ b/libopkg/opkg_cmd.c
-@@ -738,49 +738,6 @@ opkg_remove_cmd(int argc, char **argv)
- }
- 
- static int
--opkg_flag_cmd(int argc, char **argv)
--{
--     int i;
--     pkg_t *pkg;
--     const char *flags = argv[0];
--    
--     signal(SIGINT, sigint_handler);
--
--     for (i=1; i < argc; i++) {
--	  if (conf->restrict_to_default_dest) {
--	       pkg = pkg_hash_fetch_installed_by_name_dest(argv[i],
--							   conf->default_dest);
--	  } else {
--	       pkg = pkg_hash_fetch_installed_by_name(argv[i]);
--	  }
--
--	  if (pkg == NULL) {
--	       opkg_msg(ERROR, "Package %s is not installed.\n", argv[i]);
--	       continue;
--	  }
--          if (( strcmp(flags,"hold")==0)||( strcmp(flags,"noprune")==0)||
--              ( strcmp(flags,"user")==0)||( strcmp(flags,"ok")==0)) {
--	      pkg->state_flag = pkg_state_flag_from_str(flags);
--          }
--
--	  /* 
--	   * Useful if a package is installed in an offline_root, and
--	   * should be configured by opkg-cl configure at a later date.
--	   */
--          if (( strcmp(flags,"installed")==0)||( strcmp(flags,"unpacked")==0)){
--	      pkg->state_status = pkg_state_status_from_str(flags);
--          }
--
--	  opkg_state_changed++;
--	  opkg_msg(NOTICE, "Setting flags for package %s to %s.\n",
--		       pkg->name, flags);
--     }
--
--     write_status_files_if_changed();
--     return 0;
--}
--
--static int
- opkg_files_cmd(int argc, char **argv)
- {
-      pkg_t *pkg;
-@@ -1162,7 +1119,6 @@ static opkg_cmd_t cmds[] = {
-      {"list_upgradable", 0, (opkg_cmd_fun_t)opkg_list_upgradable_cmd, PFM_SOURCE},
-      {"list-upgradable", 0, (opkg_cmd_fun_t)opkg_list_upgradable_cmd, PFM_SOURCE},
-      {"info", 0, (opkg_cmd_fun_t)opkg_info_cmd, 0},
--     {"flag", 1, (opkg_cmd_fun_t)opkg_flag_cmd, PFM_DESCRIPTION|PFM_SOURCE},
-      {"status", 0, (opkg_cmd_fun_t)opkg_status_cmd, PFM_DESCRIPTION|PFM_SOURCE},
-      {"install", 1, (opkg_cmd_fun_t)opkg_install_cmd, PFM_DESCRIPTION|PFM_SOURCE},
-      {"remove", 1, (opkg_cmd_fun_t)opkg_remove_cmd, PFM_DESCRIPTION|PFM_SOURCE},
diff --git a/package/opkg/patches/011-old-config-location.patch b/package/opkg/patches/011-old-config-location.patch
index 4094713f3..85c6d68ff 100644
--- a/package/opkg/patches/011-old-config-location.patch
+++ b/package/opkg/patches/011-old-config-location.patch
@@ -1,11 +1,9 @@
 --- a/src/opkg-cl.c
 +++ b/src/opkg-cl.c
-@@ -172,7 +172,10 @@ args_parse(int argc, char *argv[])
- 			printf("Confusion: getopt_long returned %d\n", c);
+@@ -200,6 +200,9 @@ args_parse(int argc, char *argv[])
  		}
  	}
--    
-+
+ 
 +	if(!conf->conf_file && !conf->offline_root)
 +		conf->conf_file = xstrdup("/etc/opkg.conf");
 +
diff --git a/package/opkg/patches/012-strip-trailing-conffiles-whitespace.patch b/package/opkg/patches/012-strip-trailing-conffiles-whitespace.patch
index cd7d47d05..a47ae77ce 100644
--- a/package/opkg/patches/012-strip-trailing-conffiles-whitespace.patch
+++ b/package/opkg/patches/012-strip-trailing-conffiles-whitespace.patch
@@ -1,6 +1,6 @@
 --- a/libopkg/opkg_install.c
 +++ b/libopkg/opkg_install.c
-@@ -271,6 +271,7 @@ unpack_pkg_control_files(pkg_t *pkg)
+@@ -274,6 +274,7 @@ unpack_pkg_control_files(pkg_t *pkg)
       while (1) {
  	  char *cf_name;
  	  char *cf_name_in_dest;
@@ -8,7 +8,7 @@
  
  	  cf_name = file_read_line_alloc(conffiles_file);
  	  if (cf_name == NULL) {
-@@ -279,6 +280,12 @@ unpack_pkg_control_files(pkg_t *pkg)
+@@ -282,6 +283,12 @@ unpack_pkg_control_files(pkg_t *pkg)
  	  if (cf_name[0] == '\0') {
  	       continue;
  	  }
diff --git a/package/opkg/patches/014-force-postinstall.patch b/package/opkg/patches/014-force-postinstall.patch
deleted file mode 100644
index 8634561f4..000000000
--- a/package/opkg/patches/014-force-postinstall.patch
+++ /dev/null
@@ -1,68 +0,0 @@
---- a/libopkg/opkg_conf.c
-+++ b/libopkg/opkg_conf.c
-@@ -54,6 +54,7 @@ opkg_option_t options[] = {
- 	  { "force_reinstall", OPKG_OPT_TYPE_BOOL, &_conf.force_reinstall },
- 	  { "force_space", OPKG_OPT_TYPE_BOOL, &_conf.force_space },
-           { "check_signature", OPKG_OPT_TYPE_BOOL, &_conf.check_signature }, 
-+	  { "force_postinstall", OPKG_OPT_TYPE_BOOL, &_conf.force_postinstall },
- 	  { "ftp_proxy", OPKG_OPT_TYPE_STRING, &_conf.ftp_proxy },
- 	  { "http_proxy", OPKG_OPT_TYPE_STRING, &_conf.http_proxy },
- 	  { "no_proxy", OPKG_OPT_TYPE_STRING, &_conf.no_proxy },
---- a/libopkg/opkg_conf.h
-+++ b/libopkg/opkg_conf.h
-@@ -73,6 +73,7 @@ struct opkg_conf
-      int force_space;
-      int force_removal_of_dependent_packages;
-      int force_removal_of_essential_packages;
-+     int force_postinstall;
-      int check_signature;
-      int nodeps; /* do not follow dependencies */
-      char *offline_root;
---- a/libopkg/pkg.c
-+++ b/libopkg/pkg.c
-@@ -1249,7 +1249,7 @@ pkg_run_script(pkg_t *pkg, const char *s
- 
-      /* XXX: FEATURE: When conf->offline_root is set, we should run the
- 	maintainer script within a chroot environment. */
--     if (conf->offline_root) {
-+     if (conf->offline_root && !conf->force_postinstall) {
-           opkg_msg(INFO, "Offline root mode: not running %s.%s.\n",
- 			  pkg->name, script);
- 	  return 0;
---- a/src/opkg-cl.c
-+++ b/src/opkg-cl.c
-@@ -39,6 +39,7 @@ enum {
- 	ARGS_OPT_FORCE_REMOVAL_OF_DEPENDENT_PACKAGES,
- 	ARGS_OPT_FORCE_REMOVAL_OF_ESSENTIAL_PACKAGES,
- 	ARGS_OPT_FORCE_SPACE,
-+	ARGS_OPT_FORCE_POSTINSTALL,
- 	ARGS_OPT_NOACTION,
- 	ARGS_OPT_DOWNLOAD_ONLY,
- 	ARGS_OPT_NODEPS,
-@@ -74,6 +75,8 @@ static struct option long_options[] = {
- 		ARGS_OPT_FORCE_REMOVAL_OF_ESSENTIAL_PACKAGES},
- 	{"force_removal_of_essential_packages", 0, 0,
- 		ARGS_OPT_FORCE_REMOVAL_OF_ESSENTIAL_PACKAGES},
-+	{"force-postinstall", 0, 0, ARGS_OPT_FORCE_POSTINSTALL},
-+	{"force_postinstall", 0, 0, ARGS_OPT_FORCE_POSTINSTALL},
- 	{"noaction", 0, 0, ARGS_OPT_NOACTION},
- 	{"download-only", 0, 0, ARGS_OPT_DOWNLOAD_ONLY},
- 	{"nodeps", 0, 0, ARGS_OPT_NODEPS},
-@@ -153,6 +156,9 @@ args_parse(int argc, char *argv[])
- 		case ARGS_OPT_FORCE_SPACE:
- 			conf->force_space = 1;
- 			break;
-+		case ARGS_OPT_FORCE_POSTINSTALL:
-+			conf->force_postinstall = 1;
-+			break;
- 		case ARGS_OPT_NODEPS:
- 			conf->nodeps = 1;
- 			break;
-@@ -242,6 +248,7 @@ usage()
- 	printf("\t--force-overwrite	Overwrite files from other package(s)\n");
- 	printf("\t--force-downgrade	Allow opkg to downgrade packages\n");
- 	printf("\t--force-space		Disable free space checks\n");
-+	printf("\t--force-postinstall	Run postinstall scripts even in offline mode\n");
- 	printf("\t--noaction		No action -- test only\n");
- 	printf("\t--download-only	No action -- download only\n");
- 	printf("\t--nodeps		Do not follow dependencies\n");
diff --git a/package/opkg/patches/015-add-arch-dest.patch b/package/opkg/patches/015-add-arch-dest.patch
deleted file mode 100644
index 4730672d0..000000000
--- a/package/opkg/patches/015-add-arch-dest.patch
+++ /dev/null
@@ -1,238 +0,0 @@
---- a/libopkg/opkg.c
-+++ b/libopkg/opkg.c
-@@ -120,6 +120,9 @@ opkg_new()
- 	if (opkg_conf_init())
- 		goto err0;
- 
-+	if (opkg_conf_load())
-+		goto err0;
-+
- 	if (pkg_hash_load_feeds())
- 		goto err1;
- 
---- a/libopkg/opkg_conf.c
-+++ b/libopkg/opkg_conf.c
-@@ -91,15 +91,15 @@ opkg_option_t options[] = {
- };
- 
- static int
--resolve_pkg_dest_list(nv_pair_list_t *nv_pair_list)
-+resolve_pkg_dest_list(void)
- {
-      nv_pair_list_elt_t *iter;
-      nv_pair_t *nv_pair;
-      pkg_dest_t *dest;
-      char *root_dir;
- 
--     for (iter = nv_pair_list_first(nv_pair_list); iter;
--		     iter = nv_pair_list_next(nv_pair_list, iter)) {
-+     for (iter = nv_pair_list_first(&conf->tmp_dest_list); iter;
-+		     iter = nv_pair_list_next(&conf->tmp_dest_list, iter)) {
- 	  nv_pair = (nv_pair_t *)iter->data;
- 
- 	  if (conf->offline_root) {
-@@ -185,8 +185,7 @@ opkg_conf_set_option(const char *name, c
- 
- static int
- opkg_conf_parse_file(const char *filename,
--				pkg_src_list_t *pkg_src_list,
--				nv_pair_list_t *tmp_dest_nv_pair_list)
-+				pkg_src_list_t *pkg_src_list)
- {
-      int line_num = 0;
-      int err = 0;
-@@ -269,7 +268,7 @@ opkg_conf_parse_file(const char *filenam
- 				regmatch[11].rm_eo - regmatch[11].rm_so);
- 	  }
- 
--	  /* We use the tmp_dest_nv_pair_list below instead of
-+	  /* We use the tmp_dest_list below instead of
- 	     conf->pkg_dest_list because we might encounter an
- 	     offline_root option later and that would invalidate the
- 	     directories we would have computed in
-@@ -292,7 +291,7 @@ opkg_conf_parse_file(const char *filenam
- 				   "Skipping.\n", name, value);
- 	       }
- 	  } else if (strcmp(type, "dest") == 0) {
--	       nv_pair_list_append(tmp_dest_nv_pair_list, name, value);
-+	       nv_pair_list_append(&conf->tmp_dest_list, name, value);
- 	  } else if (strcmp(type, "lists_dir") == 0) {
- 	       conf->lists_dir = xstrdup(value);
- 	  } else if (strcmp(type, "arch") == 0) {
-@@ -411,9 +410,19 @@ glob_errfunc(const char *epath, int eerr
- int
- opkg_conf_init(void)
- {
-+	pkg_src_list_init(&conf->pkg_src_list);
-+	pkg_dest_list_init(&conf->pkg_dest_list);
-+	pkg_dest_list_init(&conf->tmp_dest_list);
-+	nv_pair_list_init(&conf->arch_list);
-+
-+	return 0;
-+}
-+
-+int
-+opkg_conf_load(void)
-+{
- 	int i, glob_ret;
- 	char *tmp, *tmp_dir_base, **tmp_val;
--	nv_pair_list_t tmp_dest_nv_pair_list;
- 	glob_t globbuf;
- 	char *etc_opkg_conf_pattern;
- 
-@@ -423,11 +432,6 @@ opkg_conf_init(void)
- 	conf->check_x509_path = 1;
- #endif
- 
--	pkg_src_list_init(&conf->pkg_src_list);
--	pkg_dest_list_init(&conf->pkg_dest_list);
--	nv_pair_list_init(&conf->arch_list);
--	nv_pair_list_init(&tmp_dest_nv_pair_list);
--
- 	if (!conf->offline_root)
- 		conf->offline_root = xstrdup(getenv("OFFLINE_ROOT"));
- 
-@@ -438,7 +442,7 @@ opkg_conf_init(void)
- 			goto err0;
- 		}
- 		if (opkg_conf_parse_file(conf->conf_file,
--				&conf->pkg_src_list, &tmp_dest_nv_pair_list))
-+				&conf->pkg_src_list))
- 			goto err1;
- 	}
- 
-@@ -467,7 +471,7 @@ opkg_conf_init(void)
- 					!strcmp(conf->conf_file, globbuf.gl_pathv[i]))
- 				continue;
- 		if ( opkg_conf_parse_file(globbuf.gl_pathv[i], 
--			&conf->pkg_src_list, &tmp_dest_nv_pair_list)<0) {
-+			&conf->pkg_src_list)<0) {
- 			globfree(&globbuf);
- 			goto err1;
- 		}
-@@ -528,16 +532,16 @@ opkg_conf_init(void)
- 	}
- 
- 	/* Even if there is no conf file, we'll need at least one dest. */
--	if (nv_pair_list_empty(&tmp_dest_nv_pair_list)) {
--	nv_pair_list_append(&tmp_dest_nv_pair_list,
-+	if (nv_pair_list_empty(&conf->tmp_dest_list)) {
-+	nv_pair_list_append(&conf->tmp_dest_list,
- 			OPKG_CONF_DEFAULT_DEST_NAME,
- 			OPKG_CONF_DEFAULT_DEST_ROOT_DIR);
- 	}
- 
--	if (resolve_pkg_dest_list(&tmp_dest_nv_pair_list))
-+	if (resolve_pkg_dest_list())
- 		goto err5;
- 
--	nv_pair_list_deinit(&tmp_dest_nv_pair_list);
-+	nv_pair_list_deinit(&conf->tmp_dest_list);
- 
- 	return 0;
- 
-@@ -577,7 +581,7 @@ err1:
- 		}
- 	}
- err0:
--	nv_pair_list_deinit(&tmp_dest_nv_pair_list);
-+	nv_pair_list_deinit(&conf->tmp_dest_list);
- 	if (conf->dest_str)
- 		free(conf->dest_str);
- 	if (conf->conf_file)
---- a/libopkg/opkg_conf.h
-+++ b/libopkg/opkg_conf.h
-@@ -46,6 +46,7 @@ struct opkg_conf
- {
-      pkg_src_list_t pkg_src_list;
-      pkg_dest_list_t pkg_dest_list;
-+     pkg_dest_list_t tmp_dest_list;
-      nv_pair_list_t arch_list;
- 
-      int restrict_to_default_dest;
-@@ -133,6 +134,7 @@ struct opkg_option {
- };
- 
- int opkg_conf_init(void);
-+int opkg_conf_load(void);
- void opkg_conf_deinit(void);
- 
- int opkg_conf_write_status_files(void);
---- a/src/opkg-cl.c
-+++ b/src/opkg-cl.c
-@@ -40,6 +40,8 @@ enum {
- 	ARGS_OPT_FORCE_REMOVAL_OF_ESSENTIAL_PACKAGES,
- 	ARGS_OPT_FORCE_SPACE,
- 	ARGS_OPT_FORCE_POSTINSTALL,
-+	ARGS_OPT_ADD_ARCH,
-+	ARGS_OPT_ADD_DEST,
- 	ARGS_OPT_NOACTION,
- 	ARGS_OPT_DOWNLOAD_ONLY,
- 	ARGS_OPT_NODEPS,
-@@ -82,6 +84,8 @@ static struct option long_options[] = {
- 	{"nodeps", 0, 0, ARGS_OPT_NODEPS},
- 	{"offline", 1, 0, 'o'},
- 	{"offline-root", 1, 0, 'o'},
-+	{"add-arch", 1, 0, ARGS_OPT_ADD_ARCH},
-+	{"add-dest", 1, 0, ARGS_OPT_ADD_DEST},
- 	{"test", 0, 0, ARGS_OPT_NOACTION},
- 	{"tmp-dir", 1, 0, 't'},
- 	{"tmp_dir", 1, 0, 't'},
-@@ -96,6 +100,7 @@ args_parse(int argc, char *argv[])
- 	int c;
- 	int option_index = 0;
- 	int parse_err = 0;
-+	char *tuple, *prio;
- 
- 	while (1) {
- 		c = getopt_long_only(argc, argv, "Ad:f:no:p:t:vV:",
-@@ -162,6 +167,21 @@ args_parse(int argc, char *argv[])
- 		case ARGS_OPT_NODEPS:
- 			conf->nodeps = 1;
- 			break;
-+		case ARGS_OPT_ADD_ARCH:
-+		case ARGS_OPT_ADD_DEST:
-+			tuple = xstrdup(optarg);
-+			if ((prio = strchr(tuple, ':')) != NULL) {
-+				*prio++ = 0;
-+				if ((strlen(tuple) > 0) && (strlen(prio) > 0)) {
-+					nv_pair_list_append(
-+						(c == ARGS_OPT_ADD_ARCH)
-+							? &conf->arch_list : &conf->tmp_dest_list,
-+						tuple, prio
-+					);
-+				}
-+			}
-+			free(tuple);
-+			break;
- 		case ARGS_OPT_NOACTION:
- 			conf->noaction = 1;
- 			break;
-@@ -240,6 +260,8 @@ usage()
- 	printf("				directory name in a pinch).\n");
- 	printf("\t-o <dir>		Use <dir> as the root directory for\n");
- 	printf("\t--offline-root <dir>	offline installation of packages.\n");
-+	printf("\t--add-arch <arch>:<prio>	Register architecture with given priority\n");
-+	printf("\t--add-dest <name>:<path>	Register destination with given path\n");
- 
- 	printf("\nForce Options:\n");
- 	printf("\t--force-depends		Install/remove despite failed dependencies\n");
-@@ -280,6 +302,9 @@ main(int argc, char *argv[])
- 	int nocheckfordirorfile = 0;
-         int noreadfeedsfile = 0;
- 
-+	if (opkg_conf_init())
-+		goto err0;
-+
- 	conf->verbosity = NOTICE;
- 
- 	opts = args_parse(argc, argv);
-@@ -317,7 +342,7 @@ main(int argc, char *argv[])
- 
- 	conf->pfm = cmd->pfm;
- 
--	if (opkg_conf_init())
-+	if (opkg_conf_load())
- 		goto err0;
- 
- 	if (!nocheckfordirorfile) {
diff --git a/package/ppp/Makefile b/package/ppp/Makefile
index 8670dca13..a906a1144 100644
--- a/package/ppp/Makefile
+++ b/package/ppp/Makefile
@@ -10,7 +10,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=ppp
 PKG_VERSION:=2.4.4
-PKG_RELEASE:=10
+PKG_RELEASE:=11
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=ftp://ftp.samba.org/pub/ppp/
@@ -39,6 +39,16 @@ define Package/ppp/description
 This package contains the PPP (Point-to-Point Protocol) daemon.
 endef
 
+define Package/ppp/conffiles
+/etc/ppp/chap-secrets
+/etc/ppp/filter
+/etc/ppp/ip-down
+/etc/ppp/ip-up
+/etc/ppp/ipv6-down
+/etc/ppp/ipv6-up
+/etc/ppp/options
+endef
+
 define Package/ppp-mod-pppoa
 $(call Package/ppp/Default)
   DEPENDS:=ppp +linux-atm +kmod-pppoa
@@ -70,6 +80,11 @@ This package contains a RADIUS (Remote Authentication Dial-In User Service)
 plugin for ppp.
 endef
 
+define Package/ppp-mod-radius/conffiles
+/etc/ppp/radius.conf
+/etc/ppp/radius/
+endef
+
 define Package/chat
 $(call Package/ppp/Default)
   DEPENDS:=ppp
@@ -142,7 +157,7 @@ define Package/ppp/install
 	$(INSTALL_DATA) ./files/etc/ppp/options $(1)/etc/ppp/
 	ln -sf /tmp/resolv.conf.ppp $(1)/etc/ppp/resolv.conf
 endef
-	
+
 define Package/ppp-mod-pppoa/install
 	$(INSTALL_DIR) $(1)/usr/lib/pppd/$(PKG_VERSION)
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/lib/pppd/$(PKG_VERSION)/pppoatm.so \
diff --git a/package/ppp/files/ppp.sh b/package/ppp/files/ppp.sh
index 46a66c969..996d54228 100644
--- a/package/ppp/files/ppp.sh
+++ b/package/ppp/files/ppp.sh
@@ -5,15 +5,7 @@ stop_interface_ppp() {
 	config_get proto "$cfg" proto
 
 	local link="$proto-$cfg"
-	[ -f "/var/run/ppp-${link}.pid" ] && {
-		local pid="$(head -n1 /var/run/ppp-${link}.pid 2>/dev/null)"
-		local try=0
-		grep -qs pppd "/proc/$pid/cmdline" && kill -TERM $pid && \
-			while grep -qs pppd "/proc/$pid/cmdline" && [ $((try++)) -lt 5 ]; do sleep 1; done
-		grep -qs pppd "/proc/$pid/cmdline" && kill -KILL $pid && \
-			while grep -qs pppd "/proc/$pid/cmdline"; do sleep 1; done
-		rm -f "/var/run/ppp-${link}.pid"
-	}
+	service_kill pppd "/var/run/ppp-${link}.pid"
 
 	remove_dns "$cfg"
 
diff --git a/package/pptp/Makefile b/package/pptp/Makefile
index a55309bf5..9b67c90df 100644
--- a/package/pptp/Makefile
+++ b/package/pptp/Makefile
@@ -1,4 +1,4 @@
-# 
+#
 # Copyright (C) 2006-2008 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
@@ -25,10 +25,14 @@ define Package/pptp
   DEPENDS:=+ppp +kmod-gre
 endef
 
-define Package/pptp/daemon
+define Package/pptp/description
  This package contains a PPTP (Point-to-Point Tunneling Protocol) client.
 endef
 
+define Package/pptp/conffiles
+/etc/ppp/options.pptp
+endef
+
 define Package/pptp/install
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/pptp $(1)/usr/sbin/
diff --git a/package/qos-scripts/Makefile b/package/qos-scripts/Makefile
index 253e65dc4..7a374697e 100644
--- a/package/qos-scripts/Makefile
+++ b/package/qos-scripts/Makefile
@@ -1,5 +1,5 @@
 # 
-# Copyright (C) 2006-2008 OpenWrt.org
+# Copyright (C) 2006-2010 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=qos-scripts
 PKG_VERSION:=1.2.1
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
 
@@ -29,6 +29,10 @@ define Package/qos-scripts/description
  entries.
 endef
 
+define Package/qos-scripts/conffiles
+/etc/config/qos
+endef
+
 define Build/Prepare
 endef
 
diff --git a/package/qos-scripts/files/usr/lib/qos/generate.sh b/package/qos-scripts/files/usr/lib/qos/generate.sh
index 02c3933d1..6b5db3d7d 100755
--- a/package/qos-scripts/files/usr/lib/qos/generate.sh
+++ b/package/qos-scripts/files/usr/lib/qos/generate.sh
@@ -380,7 +380,6 @@ start_cg() {
 	local iptrules
 	local pktrules
 	local sizerules
-	local download
 	enum_classes "$cg"
 	add_rules iptrules "$ctrules" "iptables -t mangle -A ${cg}_ct"
 	config_get classes "$cg" classes
@@ -397,12 +396,14 @@ start_cg() {
 		config_get classgroup "$iface" classgroup
 		config_get device "$iface" device
 		config_get imqdev "$iface" imqdev
-		config_get dl "$iface" download
+		config_get upload "$iface" upload
+		config_get download "$iface" download
 		config_get halfduplex "$iface" halfduplex
+		download="${download:-${halfduplex:+$upload}}"
 		add_insmod ipt_IMQ
 		append up "iptables -t mangle -A OUTPUT -o $device -j ${cg}" "$N"
 		append up "iptables -t mangle -A FORWARD -o $device -j ${cg}" "$N"
-		[ -z "$dl" ] || {
+		[ -z "$download" ] || {
 			append down "iptables -t mangle -A POSTROUTING -o $device -j ${cg}" "$N"
 			[ -z "$halfduplex" ] || {
 				append down "iptables -t mangle -A POSTROUTING -o $device -j IMQ --todev $imqdev" "$N"
diff --git a/package/udev/Makefile b/package/udev/Makefile
index 26bfe8bba..3f90208ff 100644
--- a/package/udev/Makefile
+++ b/package/udev/Makefile
@@ -34,6 +34,10 @@ define Package/udev/description
 	provides the ability to have persistent device names.
 endef
 
+define Package/udev/conffiles
+/etc/udev/udev.conf
+endef
+
 define Package/udev/config
 	source "$(SOURCE)/Config.in"
 endef
diff --git a/package/uhttpd/Makefile b/package/uhttpd/Makefile
index e37fa90ec..9e0069f67 100644
--- a/package/uhttpd/Makefile
+++ b/package/uhttpd/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=uhttpd
-PKG_RELEASE:=18
+PKG_RELEASE:=19
 
 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
 PKG_BUILD_DEPENDS := libcyassl liblua
@@ -67,6 +67,8 @@ endef
 
 define Package/uhttpd/conffiles
 /etc/config/uhttpd
+/etc/uhttpd.crt
+/etc/uhttpd.key
 endef
 
 define Package/uhttpd/install
diff --git a/package/uhttpd/src/uhttpd-utils.c b/package/uhttpd/src/uhttpd-utils.c
index 3821eb54c..55c108f27 100644
--- a/package/uhttpd/src/uhttpd-utils.c
+++ b/package/uhttpd/src/uhttpd-utils.c
@@ -474,6 +474,7 @@ struct path_info * uh_path_lookup(struct client *cl, const char *url)
 	char *docroot = cl->server->conf->docroot;
 	char *pathptr = NULL;
 
+	int slash = 0;
 	int no_sym = cl->server->conf->no_symlinks;
 	int i = 0;
 	struct stat s;
@@ -516,7 +517,7 @@ struct path_info * uh_path_lookup(struct client *cl, const char *url)
 	}
 
 	/* create canon path */
-	for( i = strlen(buffer); i >= 0; i-- )
+	for( i = strlen(buffer), slash = (buffer[max(0, i-1)] == '/'); i >= 0; i-- )
 	{
 		if( (buffer[i] == 0) || (buffer[i] == '/') )
 		{
@@ -567,7 +568,23 @@ struct path_info * uh_path_lookup(struct client *cl, const char *url)
 			memcpy(buffer, path_phys, sizeof(buffer));
 			pathptr = &buffer[strlen(buffer)];
 
-			if( cl->server->conf->index_file )
+			/* if requested url resolves to a directory and a trailing slash
+			   is missing in the request url, redirect the client to the same
+			   url with trailing slash appended */
+			if( !slash )
+			{
+				uh_http_sendf(cl, NULL,
+					"HTTP/1.1 302 Found\r\n"
+					"Location: %s%s%s\r\n"
+					"Connection: close\r\n\r\n",
+						&path_phys[strlen(docroot)],
+						p.query ? "?" : "",
+						p.query ? p.query : ""
+				);
+
+				p.redirected = 1;
+			}
+			else if( cl->server->conf->index_file )
 			{
 				strncat(buffer, cl->server->conf->index_file, sizeof(buffer));
 
diff --git a/package/uhttpd/src/uhttpd-utils.h b/package/uhttpd/src/uhttpd-utils.h
index 3514ce1ca..68191a3a6 100644
--- a/package/uhttpd/src/uhttpd-utils.h
+++ b/package/uhttpd/src/uhttpd-utils.h
@@ -49,6 +49,7 @@ struct path_info {
 	char *name;
 	char *info;
 	char *query;
+	int redirected;
 	struct stat stat;
 };
 
diff --git a/package/uhttpd/src/uhttpd.c b/package/uhttpd/src/uhttpd.c
index a818e1c45..491452b63 100644
--- a/package/uhttpd/src/uhttpd.c
+++ b/package/uhttpd/src/uhttpd.c
@@ -566,7 +566,7 @@ static void uh_mainloop(struct config *conf, fd_set serv_fds, int max_fd)
 						if( (pin = uh_path_lookup(cl, req->url)) != NULL )
 						{
 							/* auth ok? */
-							if( uh_auth_check(cl, req, pin) )
+							if( !pin->redirected && uh_auth_check(cl, req, pin) )
 								uh_dispatch_request(cl, req, pin);
 						}
 
@@ -1089,4 +1089,3 @@ int main (int argc, char **argv)
 
 	return 0;
 }
-
diff --git a/package/wprobe/Makefile b/package/wprobe/Makefile
index ab34f50d6..aafe731dc 100644
--- a/package/wprobe/Makefile
+++ b/package/wprobe/Makefile
@@ -1,4 +1,4 @@
-# 
+#
 # Copyright (C) 2008-2010 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
@@ -67,6 +67,10 @@ define Package/wprobe-export/description
   wireless driver measurement data via the IPFIX protocol
 endef
 
+define Package/wprobe-export/conffiles
+/etc/config/wprobe
+endef
+
 define Build/Prepare
 	mkdir -p $(PKG_BUILD_DIR)
 	$(CP) src/* $(PKG_BUILD_DIR)/
diff --git a/scripts/dl_cleanup.py b/scripts/dl_cleanup.py
index 48f587de5..fc01c52bc 100755
--- a/scripts/dl_cleanup.py
+++ b/scripts/dl_cleanup.py
@@ -15,7 +15,7 @@ import getopt
 opt_dryrun = False
 
 
-def parseVer_1234(match):
+def parseVer_1234(match, filepath):
 	progname = match.group(1)
 	progversion = (int(match.group(2)) << 64) |\
 		      (int(match.group(3)) << 48) |\
@@ -23,7 +23,7 @@ def parseVer_1234(match):
 		      (int(match.group(5)) << 16)
 	return (progname, progversion)
 
-def parseVer_123(match):
+def parseVer_123(match, filepath):
 	progname = match.group(1)
 	try:
 		patchlevel = match.group(5)
@@ -39,7 +39,7 @@ def parseVer_123(match):
 		      patchlevel
 	return (progname, progversion)
 
-def parseVer_12(match):
+def parseVer_12(match, filepath):
 	progname = match.group(1)
 	try:
 		patchlevel = match.group(4)
@@ -54,18 +54,24 @@ def parseVer_12(match):
 		      patchlevel
 	return (progname, progversion)
 
-def parseVer_r(match):
+def parseVer_r(match, filepath):
 	progname = match.group(1)
 	progversion = (int(match.group(2)) << 64)
 	return (progname, progversion)
 
-def parseVer_ymd(match):
+def parseVer_ymd(match, filepath):
 	progname = match.group(1)
 	progversion = (int(match.group(2)) << 64) |\
 		      (int(match.group(3)) << 48) |\
 		      (int(match.group(4)) << 32)
 	return (progname, progversion)
 
+def parseVer_GIT(match, filepath):
+	progname = match.group(1)
+	st = os.stat(filepath)
+	progversion = int(st.st_mtime) << 64
+	return (progname, progversion)
+
 extensions = (
 	".tar.gz",
 	".tar.bz2",
@@ -77,6 +83,7 @@ extensions = (
 )
 
 versionRegex = (
+	(re.compile(r"(.+)[-_]([0-9a-fA-F]{40,40})"), parseVer_GIT),		# xxx-GIT_SHASUM
 	(re.compile(r"(.+)[-_](\d+)\.(\d+)\.(\d+)\.(\d+)"), parseVer_1234),	# xxx-1.2.3.4
 	(re.compile(r"(.+)[-_](\d\d\d\d)-?(\d\d)-?(\d\d)"), parseVer_ymd),	# xxx-YYYY-MM-DD
 	(re.compile(r"(.+)[-_](\d+)\.(\d+)\.(\d+)(\w?)"), parseVer_123),	# xxx-1.2.3a
@@ -102,10 +109,12 @@ class Entry:
 		self.directory = directory
 		self.filename = filename
 		self.progname = ""
+		self.fileext = ""
 
 		for ext in extensions:
 			if filename.endswith(ext):
 				filename = filename[0:0-len(ext)]
+				self.fileext = ext
 				break
 		else:
 			print self.filename, "has an unknown file-extension"
@@ -113,7 +122,8 @@ class Entry:
 		for (regex, parseVersion) in versionRegex:
 			match = regex.match(filename)
 			if match:
-				(self.progname, self.version) = parseVersion(match)
+				(self.progname, self.version) = parseVersion(
+					match, directory + "/" + filename + self.fileext)
 				break
 		else:
 			print self.filename, "has an unknown version pattern"
diff --git a/scripts/feeds b/scripts/feeds
index 3932a2d6d..43c5c6dc4 100755
--- a/scripts/feeds
+++ b/scripts/feeds
@@ -26,6 +26,10 @@ $valid_mk or die "Unsupported version of make found: $mk\n";
 my @feeds;
 my %build_packages;
 my %installed;
+my %feed_cache;
+
+my $feed_package = {};
+my $feed_src = {};
 
 sub parse_config() {
 	my $line = 0;
@@ -148,16 +152,22 @@ sub update_feed_via($$$$) {
 
 sub get_feed($) {
 	my $feed = shift;
-	my $file = "./feeds/$feed.index";
 
-	clear_packages();
+	if (!defined($feed_cache{$feed})) {
+		my $file = "./feeds/$feed.index";
 
-	-f $file or do {
-		print "Ignoring feed '$feed' - index missing\n";
-		return;
-	};
-	parse_package_metadata($file) or return;
-	return { %package };
+		clear_packages();
+		-f $file or do {
+			print "Ignoring feed '$feed' - index missing\n";
+			return;
+		};
+		parse_package_metadata($file) or return;
+		$feed_cache{$feed} = [ { %package }, { %srcpackage } ];
+	}
+
+	$feed_package = $feed_cache{$feed}->[0];
+	$feed_src = $feed_cache{$feed}->[1];
+	return $feed_cache{$feed}->[0];
 }
 
 sub get_installed() {
@@ -174,8 +184,8 @@ sub search_feed {
 
 	return unless @substr > 0;
 	get_feed($feed);
-	foreach my $name (sort { lc($a) cmp lc($b) } keys %package) {
-		my $pkg = $package{$name};
+	foreach my $name (sort { lc($a) cmp lc($b) } keys %$feed_package) {
+		my $pkg = $feed_package->{$name};
 		my $substr;
 		my $pkgmatch = 1;
 
@@ -211,8 +221,8 @@ sub list_feed {
 	my $feed = shift;
 
 	get_feed($feed);
-	foreach my $name (sort { lc($a) cmp lc($b) } keys %package) {
-		my $pkg = $package{$name};
+	foreach my $name (sort { lc($a) cmp lc($b) } keys %$feed_package) {
+		my $pkg = $feed_package->{$name};
 		next if $pkg->{vdepends};
 		if($pkg->{name}) {
 			printf "\%-32s\t\%s\n", $pkg->{name}, $pkg->{title};
@@ -293,10 +303,13 @@ sub install_package {
 	$feed or do {
 		$installed{$name} and return 0;
 		# TODO: check if it's already installed within ./package directory
-		$srcpackage{$name} or -d "./package/$name" or warn "WARNING: No feed for package '$name' found, maybe it's already part of the standard packages?\n";
+		$feed_src->{$name} or -d "./package/$name" or warn "WARNING: No feed for package '$name' found, maybe it's already part of the standard packages?\n";
 		return 0;
 	};
 
+	# switch to the metadata for the selected feed
+	get_feed($feed->[1]);
+
 	my $pkg = $feed{$feed->[1]}->{$name} or return 1;
 	$pkg->{name} or do {
 		$installed{$name} and return 0;
@@ -327,8 +340,8 @@ sub install_package {
 		return 1;
 	};
 
-	# install all dependencies
-	foreach my $vpkg (@{$srcpackage{$src}}, $pkg) {
+	# install all dependencies referenced from the source package
+	foreach my $vpkg (@{$feed_src->{$src}}) {
 		foreach my $dep (@{$vpkg->{depends}}, @{$vpkg->{builddepends}}, @{$vpkg->{"builddepends/host"}}) {
 			next if $dep =~ /@/;
 			$dep =~ s/^\+//;
@@ -384,11 +397,12 @@ sub install {
 			if (!defined($opts{p}) or $opts{p} eq $f->[1]) {
 				printf "Installing all packages from feed %s.\n", $f->[1];
 				get_feed($f->[1]);
-				foreach my $name (sort { lc($a) cmp lc($b) } keys %package) {
-					my $p = $package{$name};
+				foreach my $name (sort { lc($a) cmp lc($b) } keys %$feed_package) {
+					my $p = $feed_package->{$name};
 					next if $p->{vdepends};
 					if( $p->{name} ) {
 						install_package($feed, $p->{name}) == 0 or $ret = 1;
+						get_feed($f->[1]);
 					}
 				}
 			}
diff --git a/scripts/metadata.pl b/scripts/metadata.pl
index ef8f8daea..37cc256e5 100755
--- a/scripts/metadata.pl
+++ b/scripts/metadata.pl
@@ -638,6 +638,9 @@ sub gen_package_mk() {
 			$pkg->{buildonly} and $config = "";
 			print "package-$config += $pkg->{subdir}$pkg->{src}\n";
 			if ($pkg->{variant}) {
+				if (!defined($done{$pkg->{src}})) {
+					print "\$(curdir)/$pkg->{subdir}$pkg->{src}/default-variant := $pkg->{variant}\n";
+				}
 				print "\$(curdir)/$pkg->{subdir}$pkg->{src}/variants += \$(if $config,$pkg->{variant})\n"
 			}
 			$pkg->{prereq} and print "prereq-$config += $pkg->{subdir}$pkg->{src}\n";
@@ -772,6 +775,7 @@ sub gen_package_mk() {
 		next unless $cmds;
 		print <<EOF
 
+ifndef DUMP_TARGET_DB
 \$(TARGET_DIR)/etc/uci-defaults/$preconfig: FORCE
 	( \\
 $cmds \\
@@ -780,6 +784,8 @@ $cmds \\
 ifneq (\$(IMAGEOPT)\$(CONFIG_IMAGEOPT),)
   package/preconfig: \$(TARGET_DIR)/etc/uci-defaults/$preconfig
 endif
+endif
+
 EOF
 	}
 }
diff --git a/scripts/patch-kernel.sh b/scripts/patch-kernel.sh
index 5455a0cf8..8bdaa48af 100755
--- a/scripts/patch-kernel.sh
+++ b/scripts/patch-kernel.sh
@@ -37,7 +37,7 @@ for i in ${patchdir}/${patchpattern} ; do
     [ -d "${i}" ] && echo "Ignoring subdirectory ${i}" && continue	
     echo ""
     echo "Applying ${i} using ${type}: " 
-    ${uncomp} ${i} | patch -p1 -E -d ${targetdir} 
+    ${uncomp} ${i} | patch -f -p1 -E -d ${targetdir} 
     if [ $? != 0 ] ; then
         echo "Patch failed!  Please fix $i!"
 	exit 1
diff --git a/target/Config.in b/target/Config.in
index 48fd82732..3e161f598 100644
--- a/target/Config.in
+++ b/target/Config.in
@@ -14,9 +14,6 @@ config HAS_FPU
 config AUDIO_SUPPORT
 	bool
 
-config DISPLAY_SUPPORT
-	bool
-
 config GPIO_SUPPORT
 	bool
 
diff --git a/target/imagebuilder/Makefile b/target/imagebuilder/Makefile
index 1e3519fba..30083999e 100644
--- a/target/imagebuilder/Makefile
+++ b/target/imagebuilder/Makefile
@@ -17,12 +17,13 @@ PKG_CPU:=$(shell uname -m | sed "s/ //g")
 IB_NAME:=OpenWrt-ImageBuilder-$(BOARD)-for-$(PKG_OS)-$(PKG_CPU)
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(IB_NAME)
 IB_KDIR:=$(patsubst $(TOPDIR)/%,$(PKG_BUILD_DIR)/%,$(KERNEL_BUILD_DIR))
+IB_LDIR:=$(patsubst $(TOPDIR)/%,$(PKG_BUILD_DIR)/%,$(LINUX_DIR))
 
 all: compile
 
 $(BIN_DIR)/$(IB_NAME).tar.bz2: clean
 	rm -rf $(PKG_BUILD_DIR)
-	mkdir -p $(IB_KDIR) $(PKG_BUILD_DIR)/staging_dir/host \
+	mkdir -p $(IB_KDIR) $(IB_LDIR) $(PKG_BUILD_DIR)/staging_dir/host \
 		$(PKG_BUILD_DIR)/target $(PKG_BUILD_DIR)/scripts
 	-cp $(TOPDIR)/.config $(PKG_BUILD_DIR)/.config
 	$(CP) \
@@ -41,6 +42,7 @@ $(BIN_DIR)/$(IB_NAME).tar.bz2: clean
 		$(PKG_BUILD_DIR)/target/linux/*/files{,-*} \
 		$(PKG_BUILD_DIR)/target/linux/*/patches{,-*}
 	-cp $(KERNEL_BUILD_DIR)/* $(IB_KDIR)/ # don't copy subdirectories here
+	-cp $(LINUX_DIR)/.config $(IB_LDIR)/
 	echo REVISION:="$(REVISION)" > $(PKG_BUILD_DIR)/include/version.mk
 	find $(PKG_BUILD_DIR) -name CVS -o -name .git -o -name .svn \
 	  | $(XARGS) rm -rf
diff --git a/target/imagebuilder/files/Makefile b/target/imagebuilder/files/Makefile
index 469c4a2dd..1fa074b35 100644
--- a/target/imagebuilder/files/Makefile
+++ b/target/imagebuilder/files/Makefile
@@ -42,6 +42,7 @@ Building images:
 	make image PROFILE="<profilename>" # override the default target profile
 	make image PACKAGES="<pkg1> [<pkg2> [<pkg3> ...]]" # include extra packages
 	make image FILES="<path>" # include extra files from <path>
+	make image BIN_DIR="<path>" # alternative output directory for the images
 
 endef
 $(eval $(call shexport,Helptext))
@@ -157,7 +158,8 @@ image:
 	$(MAKE) _call_image \
 		$(if $(PROFILE),USER_PROFILE="$(PROFILE)") \
 		$(if $(FILES),USER_FILES="$(FILES)") \
-		$(if $(PACKAGES),USER_PACKAGES="$(PACKAGES)"))
+		$(if $(PACKAGES),USER_PACKAGES="$(PACKAGES)") \
+		$(if $(BIN_DIR),BIN_DIR="$(BIN_DIR)"))
 
 .SILENT: help info image
 
diff --git a/target/linux/adm5120/Makefile b/target/linux/adm5120/Makefile
index 0eee0b494..0c319a949 100644
--- a/target/linux/adm5120/Makefile
+++ b/target/linux/adm5120/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 BOARD:=adm5120
 BOARDNAME:=Infineon/ADMtek ADM5120
-LINUX_VERSION:=2.6.32.16
+LINUX_VERSION:=2.6.32.25
 SUBTARGETS:=router_le router_be
 INITRAMFS_EXTRA_FILES:=
 
diff --git a/target/linux/ar7/Makefile b/target/linux/ar7/Makefile
index ff9ebe0ba..40d162112 100644
--- a/target/linux/ar7/Makefile
+++ b/target/linux/ar7/Makefile
@@ -11,7 +11,7 @@ BOARD:=ar7
 BOARDNAME:=TI AR7
 FEATURES:=squashfs jffs2 atm
 
-LINUX_VERSION:=2.6.32.16
+LINUX_VERSION:=2.6.32.25
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/ar7/patches-2.6.32/130-clocks_devices_init.patch b/target/linux/ar7/patches-2.6.32/130-clocks_devices_init.patch
new file mode 100644
index 000000000..45f2e453e
--- /dev/null
+++ b/target/linux/ar7/patches-2.6.32/130-clocks_devices_init.patch
@@ -0,0 +1,8 @@
+--- a/arch/mips/ar7/platform.c
++++ b/arch/mips/ar7/platform.c
+@@ -606,4 +606,4 @@ static int __init ar7_register_devices(v
+ 
+ 	return res;
+ }
+-arch_initcall(ar7_register_devices);
++device_initcall(ar7_register_devices);
diff --git a/target/linux/ar7/patches-2.6.32/140-uart_port_ar7.patch b/target/linux/ar7/patches-2.6.32/140-uart_port_ar7.patch
new file mode 100644
index 000000000..3353c21fb
--- /dev/null
+++ b/target/linux/ar7/patches-2.6.32/140-uart_port_ar7.patch
@@ -0,0 +1,28 @@
+    AR7: use correct UART port type
+
+    PORT_AR7 has the correct TRIG flag (UART_FCR_R_TRIG_00) as well as UART_CAP_AFE
+    being set. This fixes kernel console on TNETD7300 revision 0x02 and has no side
+    effects on other revisions of the chip.
+
+    Signed-off-by: Florian Fainelli <florian@openwrt.org>
+
+--- a/arch/mips/ar7/platform.c
++++ b/arch/mips/ar7/platform.c
+@@ -509,7 +509,7 @@ static int __init ar7_register_devices(v
+ 
+ 	memset(uart_port, 0, sizeof(struct uart_port) * 2);
+ 
+-	uart_port[0].type = PORT_16550A;
++	uart_port[0].type = PORT_AR7;
+ 	uart_port[0].line = 0;
+ 	uart_port[0].irq = AR7_IRQ_UART0;
+ 	uart_port[0].uartclk = ar7_bus_freq() / 2;
+@@ -524,7 +524,7 @@ static int __init ar7_register_devices(v
+ 
+ 	/* Only TNETD73xx have a second serial port */
+ 	if (ar7_has_second_uart()) {
+-		uart_port[1].type = PORT_16550A;
++		uart_port[1].type = PORT_AR7;
+ 		uart_port[1].line = 1;
+ 		uart_port[1].irq = AR7_IRQ_UART1;
+ 		uart_port[1].uartclk = ar7_bus_freq() / 2;
diff --git a/target/linux/ar7/patches-2.6.32/160-vlynq_try_remote_first.patch b/target/linux/ar7/patches-2.6.32/160-vlynq_try_remote_first.patch
new file mode 100644
index 000000000..437bc89d9
--- /dev/null
+++ b/target/linux/ar7/patches-2.6.32/160-vlynq_try_remote_first.patch
@@ -0,0 +1,20 @@
+--- a/drivers/vlynq/vlynq.c
++++ b/drivers/vlynq/vlynq.c
+@@ -514,9 +514,14 @@ static int __vlynq_enable_device(struct
+ 				!__vlynq_try_external(dev))
+ 				return 0;
+ 		} else {
+-			if (!__vlynq_try_external(dev) ||
+-				!__vlynq_try_local(dev)    ||
+-				!__vlynq_try_remote(dev))
++            /* XXX: I don't really know what difference it makes, if the order
++             * of the following calls is changed, but at least in this order
++             * my fritzbox doesn't hang at startup as in
++             * https://dev.openwrt.org/ticket/7324
++             */
++			if (!__vlynq_try_remote(dev) ||
++				!__vlynq_try_local(dev)  ||
++				!__vlynq_try_external(dev))
+ 				return 0;
+ 		}
+ 		break;
diff --git a/target/linux/ar7/patches-2.6.32/170-clocks_init_earlier.patch b/target/linux/ar7/patches-2.6.32/170-clocks_init_earlier.patch
new file mode 100644
index 000000000..a0b384aae
--- /dev/null
+++ b/target/linux/ar7/patches-2.6.32/170-clocks_init_earlier.patch
@@ -0,0 +1,53 @@
+--- a/arch/mips/ar7/clock.c
++++ b/arch/mips/ar7/clock.c
+@@ -232,12 +232,12 @@ static void tnetd7300_set_clock(u32 shif
+ 	calculate(base_clock, frequency, &prediv, &postdiv, &mul);
+ 
+ 	writel(((prediv - 1) << PREDIV_SHIFT) | (postdiv - 1), &clock->ctrl);
+-	msleep(1);
++	mdelay(1);
+ 	writel(4, &clock->pll);
+ 	while (readl(&clock->pll) & PLL_STATUS)
+ 		;
+ 	writel(((mul - 1) << MUL_SHIFT) | (0xff << 3) | 0x0e, &clock->pll);
+-	msleep(75);
++	mdelay(75);
+ }
+ 
+ static void __init tnetd7300_init_clocks(void)
+@@ -407,7 +407,7 @@ static void __init tnetd7200_init_clocks
+ 	iounmap(bootcr);
+ }
+ 
+-int __init ar7_init_clocks(void)
++void __init ar7_init_clocks(void)
+ {
+ 	switch (ar7_chip_id()) {
+ 	case AR7_CHIP_7100:
+@@ -421,7 +421,4 @@ int __init ar7_init_clocks(void)
+ 	default:
+ 		break;
+ 	}
+-
+-	return 0;
+ }
+-arch_initcall(ar7_init_clocks);
+--- a/arch/mips/ar7/time.c
++++ b/arch/mips/ar7/time.c
+@@ -26,5 +26,7 @@
+ 
+ void __init plat_time_init(void)
+ {
++	ar7_init_clocks();
++
+ 	mips_hpt_frequency = ar7_cpu_freq() / 2;
+ }
+--- a/arch/mips/include/asm/mach-ar7/ar7.h
++++ b/arch/mips/include/asm/mach-ar7/ar7.h
+@@ -178,4 +178,6 @@ static inline void ar7_device_off(u32 bi
+ 	msleep(20);
+ }
+ 
++extern void __init ar7_init_clocks(void);
++
+ #endif /* __AR7_H__ */
diff --git a/target/linux/ar71xx/Makefile b/target/linux/ar71xx/Makefile
index 109b36e9c..7b8fea66b 100644
--- a/target/linux/ar71xx/Makefile
+++ b/target/linux/ar71xx/Makefile
@@ -12,7 +12,7 @@ BOARDNAME:=Atheros AR71xx/AR7240/AR913x
 FEATURES:=squashfs jffs2 targz
 CFLAGS:=-Os -pipe -mips32r2 -mtune=mips32r2 -funit-at-a-time
 
-LINUX_VERSION:=2.6.32.16
+LINUX_VERSION:=2.6.32.25
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/ar71xx/base-files/etc/defconfig/dir-600-a1/network b/target/linux/ar71xx/base-files/etc/defconfig/dir-600-a1/network
index 2108d3ae8..de201bf5e 100644
--- a/target/linux/ar71xx/base-files/etc/defconfig/dir-600-a1/network
+++ b/target/linux/ar71xx/base-files/etc/defconfig/dir-600-a1/network
@@ -4,12 +4,8 @@ config interface loopback
 	option ipaddr	127.0.0.1
 	option netmask	255.0.0.0
 
-config interface eth
-	option ifname	eth0
-	option proto	none
-
 config interface lan
-	option ifname	'lan1 lan2 lan3 lan4'
+	option ifname	eth0
 	option type	bridge
 	option proto	static
 	option ipaddr	192.168.1.1
@@ -18,3 +14,11 @@ config interface lan
 config interface wan
 	option ifname	eth1
 	option proto	dhcp
+
+config switch eth0
+	option enable_vlan	1
+
+config switch_vlan
+	option device	eth0
+	option vlan	1
+	option ports	"0 1 2 3 4"
diff --git a/target/linux/ar71xx/base-files/etc/defconfig/rb-750/network b/target/linux/ar71xx/base-files/etc/defconfig/rb-750/network
index 113d9f3ee..de201bf5e 100644
--- a/target/linux/ar71xx/base-files/etc/defconfig/rb-750/network
+++ b/target/linux/ar71xx/base-files/etc/defconfig/rb-750/network
@@ -4,12 +4,8 @@ config interface loopback
 	option ipaddr	127.0.0.1
 	option netmask	255.0.0.0
 
-config interface eth
-	option ifname	eth0
-	option proto	none
-
 config interface lan
-	option ifname	'port2 port3 port4 port5'
+	option ifname	eth0
 	option type	bridge
 	option proto	static
 	option ipaddr	192.168.1.1
@@ -18,3 +14,11 @@ config interface lan
 config interface wan
 	option ifname	eth1
 	option proto	dhcp
+
+config switch eth0
+	option enable_vlan	1
+
+config switch_vlan
+	option device	eth0
+	option vlan	1
+	option ports	"0 1 2 3 4"
diff --git a/target/linux/ar71xx/base-files/etc/diag.sh b/target/linux/ar71xx/base-files/etc/diag.sh
index 0ded6f4bc..c5ef44c6e 100755
--- a/target/linux/ar71xx/base-files/etc/diag.sh
+++ b/target/linux/ar71xx/base-files/etc/diag.sh
@@ -39,7 +39,7 @@ get_status_led() {
 	aw-nr580)
 		status_led="aw-nr580:green:ready"
 		;;
-	bullet-m | rocket-m | nano-m)
+	bullet-m | rocket-m | nano-m | nanostation-m)
 		status_led="ubnt:green:link4"
 		;;
 	dir-600-a1)
diff --git a/target/linux/ar71xx/config-2.6.32 b/target/linux/ar71xx/config-2.6.32
index 417d71822..ea6b470b0 100644
--- a/target/linux/ar71xx/config-2.6.32
+++ b/target/linux/ar71xx/config-2.6.32
@@ -6,7 +6,6 @@ CONFIG_AG71XX_AR8216_SUPPORT=y
 # CONFIG_AG71XX_DEBUG_FS is not set
 # CONFIG_ALCHEMY_GPIO_INDIRECT is not set
 # CONFIG_AR7 is not set
-CONFIG_AR71XX_DEV_AP91_ETH=y
 CONFIG_AR71XX_DEV_AP91_PCI=y
 CONFIG_AR71XX_DEV_AP94_PCI=y
 CONFIG_AR71XX_DEV_AR913X_WMAC=y
diff --git a/target/linux/ar71xx/files/arch/mips/ar71xx/Kconfig b/target/linux/ar71xx/files/arch/mips/ar71xx/Kconfig
index c471e3f64..0b290f804 100644
--- a/target/linux/ar71xx/files/arch/mips/ar71xx/Kconfig
+++ b/target/linux/ar71xx/files/arch/mips/ar71xx/Kconfig
@@ -21,7 +21,6 @@ config AR71XX_MACH_AP83
 
 config AR71XX_MACH_DIR_600_A1
 	bool "D-Link DIR-600 rev. A1 support"
-	select AR71XX_DEV_AP91_ETH
 	select AR71XX_DEV_AP91_PCI if PCI
 	select AR71XX_DEV_M25P80
 	select AR71XX_DEV_GPIO_BUTTONS
@@ -123,7 +122,6 @@ config AR71XX_MACH_RB4XX
 
 config AR71XX_MACH_RB750
 	bool "MikroTik RouterBOARD 750 support"
-	select AR71XX_DEV_AP91_ETH
 	default n
 
 config AR71XX_MACH_WNDR3700
@@ -222,10 +220,6 @@ config AR71XX_DEV_M25P80
 config AR71XX_DEV_AP91_PCI
 	def_bool n
 
-config AR71XX_DEV_AP91_ETH
-	select AR71XX_DEV_DSA
-	def_bool n
-
 config AR71XX_DEV_AP94_PCI
 	def_bool n
 
diff --git a/target/linux/ar71xx/files/arch/mips/ar71xx/Makefile b/target/linux/ar71xx/files/arch/mips/ar71xx/Makefile
index e24df571f..690dd9769 100644
--- a/target/linux/ar71xx/files/arch/mips/ar71xx/Makefile
+++ b/target/linux/ar71xx/files/arch/mips/ar71xx/Makefile
@@ -13,7 +13,6 @@ obj-y	:= prom.o irq.o setup.o devices.o gpio.o ar71xx.o
 obj-$(CONFIG_EARLY_PRINTK)		+= early_printk.o
 obj-$(CONFIG_PCI)			+= pci.o
 
-obj-$(CONFIG_AR71XX_DEV_AP91_ETH)	+= dev-ap91-eth.o
 obj-$(CONFIG_AR71XX_DEV_AP91_PCI)	+= dev-ap91-pci.o
 obj-$(CONFIG_AR71XX_DEV_AP94_PCI)	+= dev-ap94-pci.o
 obj-$(CONFIG_AR71XX_DEV_AR913X_WMAC)	+= dev-ar913x-wmac.o
diff --git a/target/linux/ar71xx/files/arch/mips/ar71xx/dev-ap91-eth.c b/target/linux/ar71xx/files/arch/mips/ar71xx/dev-ap91-eth.c
deleted file mode 100644
index c48af45cf..000000000
--- a/target/linux/ar71xx/files/arch/mips/ar71xx/dev-ap91-eth.c
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- *  Atheros AP91 reference board ethernet initialization
- *
- *  Copyright (C) 2010 Gabor Juhos <juhosg@openwrt.org>
- *
- *  This program is free software; you can redistribute it and/or modify it
- *  under the terms of the GNU General Public License version 2 as published
- *  by the Free Software Foundation.
- */
-
-#include "devices.h"
-#include "dev-dsa.h"
-#include "dev-ap91-eth.h"
-
-static struct dsa_chip_data ap91_dsa_chip = {
-	.port_names[0]  = "cpu",
-	.port_names[1]  = "lan1",
-	.port_names[2]  = "lan2",
-	.port_names[3]  = "lan3",
-	.port_names[4]  = "lan4",
-};
-
-static struct dsa_platform_data ap91_dsa_data = {
-	.nr_chips	= 1,
-	.chip		= &ap91_dsa_chip,
-};
-
-static void ap91_eth_set_port_name(unsigned port, const char *name)
-{
-	if (port < 1 || port > 5)
-		return;
-
-	if (name)
-		ap91_dsa_chip.port_names[port] = (char *) name;
-}
-
-void __init ap91_eth_init(u8 *mac_addr, const char *port_names[])
-{
-	if (mac_addr)
-		ar71xx_set_mac_base(mac_addr);
-
-	if (port_names) {
-		int i;
-
-		for (i = 0; i < AP91_ETH_NUM_PORT_NAMES; i++)
-			ap91_eth_set_port_name(i + 1, port_names[i]);
-	}
-
-	/* WAN port */
-	ar71xx_eth0_data.phy_if_mode = PHY_INTERFACE_MODE_RMII;
-	ar71xx_eth0_data.speed = SPEED_100;
-	ar71xx_eth0_data.duplex = DUPLEX_FULL;
-	ar71xx_eth0_data.fifo_cfg1 = 0x0fff0000;
-	ar71xx_eth0_data.fifo_cfg2 = 0x00001fff;
-	ar71xx_eth0_data.fifo_cfg3 = 0x008001ff;
-
-	/* LAN ports */
-	ar71xx_eth1_data.phy_if_mode = PHY_INTERFACE_MODE_RMII;
-	ar71xx_eth1_data.speed = SPEED_1000;
-	ar71xx_eth1_data.duplex = DUPLEX_FULL;
-	ar71xx_eth1_data.fifo_cfg1 = 0x0fff0000;
-	ar71xx_eth1_data.fifo_cfg2 = 0x00001fff;
-	ar71xx_eth1_data.fifo_cfg3 = 0x008001ff;
-
-	ar71xx_add_device_mdio(0x0);
-	ar71xx_add_device_eth(1);
-	ar71xx_add_device_eth(0);
-
-	ar71xx_add_device_dsa(1, &ap91_dsa_data);
-}
diff --git a/target/linux/ar71xx/files/arch/mips/ar71xx/dev-ap91-eth.h b/target/linux/ar71xx/files/arch/mips/ar71xx/dev-ap91-eth.h
deleted file mode 100644
index d9cd2141a..000000000
--- a/target/linux/ar71xx/files/arch/mips/ar71xx/dev-ap91-eth.h
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- *  Atheros AP91 reference board ethernet initialization
- *
- *  Copyright (C) 2010 Gabor Juhos <juhosg@openwrt.org>
- *
- *  This program is free software; you can redistribute it and/or modify it
- *  under the terms of the GNU General Public License version 2 as published
- *  by the Free Software Foundation.
- */
-
-#ifndef _AR71XX_DEV_AP91_ETH_H
-#define _AR71XX_DEV_AP91_ETH_H
-
-#define AP91_ETH_NUM_PORT_NAMES	4
-
-#if defined(CONFIG_AR71XX_DEV_AP91_ETH)
-void ap91_eth_init(u8 *mac_addr, const char *port_names[]) __init;
-#else
-static inline void ap91_eth_init(u8 *mac_addr) { }
-#endif
-
-#endif /* _AR71XX_DEV_AP91_ETH_H */
-
diff --git a/target/linux/ar71xx/files/arch/mips/ar71xx/mach-dir-600-a1.c b/target/linux/ar71xx/files/arch/mips/ar71xx/mach-dir-600-a1.c
index 7222405a0..fad417aeb 100644
--- a/target/linux/ar71xx/files/arch/mips/ar71xx/mach-dir-600-a1.c
+++ b/target/linux/ar71xx/files/arch/mips/ar71xx/mach-dir-600-a1.c
@@ -16,7 +16,6 @@
 #include "machtype.h"
 #include "devices.h"
 #include "dev-m25p80.h"
-#include "dev-ap91-eth.h"
 #include "dev-ap91-pci.h"
 #include "dev-gpio-buttons.h"
 #include "dev-leds-gpio.h"
@@ -130,7 +129,23 @@ static void __init dir_600_a1_setup(void)
 					ARRAY_SIZE(dir_600_a1_gpio_buttons),
 					dir_600_a1_gpio_buttons);
 
-	ap91_eth_init(mac, NULL);
+	ar71xx_eth1_data.has_ar7240_switch = 1;
+	ar71xx_set_mac_base(mac);
+
+	/* WAN port */
+	ar71xx_eth0_data.phy_if_mode = PHY_INTERFACE_MODE_RMII;
+	ar71xx_eth0_data.speed = SPEED_100;
+	ar71xx_eth0_data.duplex = DUPLEX_FULL;
+
+	/* LAN ports */
+	ar71xx_eth1_data.phy_if_mode = PHY_INTERFACE_MODE_RMII;
+	ar71xx_eth1_data.speed = SPEED_1000;
+	ar71xx_eth1_data.duplex = DUPLEX_FULL;
+
+	ar71xx_add_device_mdio(0x0);
+	ar71xx_add_device_eth(1);
+	ar71xx_add_device_eth(0);
+
 	ap91_pci_init(ee, mac);
 }
 
diff --git a/target/linux/ar71xx/files/arch/mips/ar71xx/mach-rb750.c b/target/linux/ar71xx/files/arch/mips/ar71xx/mach-rb750.c
index 3972f57ac..41a184e35 100644
--- a/target/linux/ar71xx/files/arch/mips/ar71xx/mach-rb750.c
+++ b/target/linux/ar71xx/files/arch/mips/ar71xx/mach-rb750.c
@@ -12,8 +12,8 @@
 #include <asm/mach-ar71xx/ar71xx.h>
 #include <asm/mach-ar71xx/mach-rb750.h>
 
+#include "devices.h"
 #include "machtype.h"
-#include "dev-ap91-eth.h"
 
 static struct rb750_led_data rb750_leds[] = {
 	{
@@ -55,13 +55,6 @@ static struct platform_device rb750_leds_device = {
 	}
 };
 
-static const char *rb750_port_names[AP91_ETH_NUM_PORT_NAMES] __initdata = {
-	"port5",
-	"port4",
-	"port3",
-	"port2",
-};
-
 static struct platform_device rb750_nand_device = {
 	.name	= "rb750-nand",
 	.id	= -1,
@@ -124,7 +117,21 @@ static void __init rb750_setup(void)
 				     AR724X_GPIO_FUNC_ETH_SWITCH_LED3_EN |
 				     AR724X_GPIO_FUNC_ETH_SWITCH_LED4_EN);
 
-	ap91_eth_init(NULL, rb750_port_names);
+	/* WAN port */
+	ar71xx_eth0_data.phy_if_mode = PHY_INTERFACE_MODE_RMII;
+	ar71xx_eth0_data.speed = SPEED_100;
+	ar71xx_eth0_data.duplex = DUPLEX_FULL;
+
+	/* LAN ports */
+	ar71xx_eth1_data.phy_if_mode = PHY_INTERFACE_MODE_RMII;
+	ar71xx_eth1_data.speed = SPEED_1000;
+	ar71xx_eth1_data.duplex = DUPLEX_FULL;
+	ar71xx_eth1_data.has_ar7240_switch = 1;
+
+	ar71xx_add_device_mdio(0x0);
+	ar71xx_add_device_eth(1);
+	ar71xx_add_device_eth(0);
+
 	platform_device_register(&rb750_leds_device);
 	platform_device_register(&rb750_nand_device);
 }
diff --git a/target/linux/ar71xx/files/arch/mips/ar71xx/mach-tl-wr741nd.c b/target/linux/ar71xx/files/arch/mips/ar71xx/mach-tl-wr741nd.c
index 5014ece04..cd5032589 100644
--- a/target/linux/ar71xx/files/arch/mips/ar71xx/mach-tl-wr741nd.c
+++ b/target/linux/ar71xx/files/arch/mips/ar71xx/mach-tl-wr741nd.c
@@ -16,7 +16,6 @@
 #include "machtype.h"
 #include "devices.h"
 #include "dev-m25p80.h"
-#include "dev-ap91-eth.h"
 #include "dev-ap91-pci.h"
 #include "dev-gpio-buttons.h"
 #include "dev-leds-gpio.h"
diff --git a/target/linux/ar71xx/patches-2.6.32/003-ar71xx_usb_host.patch b/target/linux/ar71xx/patches-2.6.32/003-ar71xx_usb_host.patch
index 0a428c78f..19cea296a 100644
--- a/target/linux/ar71xx/patches-2.6.32/003-ar71xx_usb_host.patch
+++ b/target/linux/ar71xx/patches-2.6.32/003-ar71xx_usb_host.patch
@@ -30,7 +30,7 @@
  	depends on USB_OHCI_HCD && (STB03xxx || PPC_MPC52xx)
 --- a/drivers/usb/host/ehci-hcd.c
 +++ b/drivers/usb/host/ehci-hcd.c
-@@ -1141,6 +1141,11 @@ MODULE_LICENSE ("GPL");
+@@ -1142,6 +1142,11 @@ MODULE_LICENSE ("GPL");
  #define	PLATFORM_DRIVER		ehci_atmel_driver
  #endif
  
diff --git a/target/linux/ar71xx/patches-2.6.32/102-mtd_m25p80_add_myloader_parser.patch b/target/linux/ar71xx/patches-2.6.32/102-mtd_m25p80_add_myloader_parser.patch
index 320c76a0c..6783f6b2b 100644
--- a/target/linux/ar71xx/patches-2.6.32/102-mtd_m25p80_add_myloader_parser.patch
+++ b/target/linux/ar71xx/patches-2.6.32/102-mtd_m25p80_add_myloader_parser.patch
@@ -1,6 +1,6 @@
 --- a/drivers/mtd/devices/m25p80.c
 +++ b/drivers/mtd/devices/m25p80.c
-@@ -867,6 +867,16 @@ static int __devinit m25p_probe(struct s
+@@ -868,6 +868,16 @@ static int __devinit m25p_probe(struct s
  					part_probes, &parts, 0);
  		}
  
diff --git a/target/linux/ar71xx/patches-2.6.32/104-mtd_m25p80_add_redboot_parser.patch b/target/linux/ar71xx/patches-2.6.32/104-mtd_m25p80_add_redboot_parser.patch
index dbcdde088..94e1389f5 100644
--- a/target/linux/ar71xx/patches-2.6.32/104-mtd_m25p80_add_redboot_parser.patch
+++ b/target/linux/ar71xx/patches-2.6.32/104-mtd_m25p80_add_redboot_parser.patch
@@ -1,6 +1,6 @@
 --- a/drivers/mtd/devices/m25p80.c
 +++ b/drivers/mtd/devices/m25p80.c
-@@ -877,6 +877,15 @@ static int __devinit m25p_probe(struct s
+@@ -878,6 +878,15 @@ static int __devinit m25p_probe(struct s
  		}
  #endif
  
diff --git a/target/linux/ar71xx/patches-2.6.32/108-mtd_fix_cfi_cmdset_0002_status_check.patch b/target/linux/ar71xx/patches-2.6.32/108-mtd_fix_cfi_cmdset_0002_status_check.patch
index d4272ab1b..d524297a4 100644
--- a/target/linux/ar71xx/patches-2.6.32/108-mtd_fix_cfi_cmdset_0002_status_check.patch
+++ b/target/linux/ar71xx/patches-2.6.32/108-mtd_fix_cfi_cmdset_0002_status_check.patch
@@ -1,6 +1,6 @@
 --- a/drivers/mtd/chips/cfi_cmdset_0002.c
 +++ b/drivers/mtd/chips/cfi_cmdset_0002.c
-@@ -1141,8 +1141,8 @@ static int __xipram do_write_oneword(str
+@@ -1169,8 +1169,8 @@ static int __xipram do_write_oneword(str
  			break;
  		}
  
@@ -11,7 +11,7 @@
  
  		/* Latency issues. Drop the lock, wait a while and retry */
  		UDELAY(map, chip, adr, 1);
-@@ -1158,6 +1158,8 @@ static int __xipram do_write_oneword(str
+@@ -1186,6 +1186,8 @@ static int __xipram do_write_oneword(str
  
  		ret = -EIO;
  	}
@@ -20,7 +20,7 @@
  	xip_enable(map, chip, adr);
   op_done:
  	chip->state = FL_READY;
-@@ -1504,7 +1506,6 @@ static int cfi_amdstd_write_buffers(stru
+@@ -1532,7 +1534,6 @@ static int cfi_amdstd_write_buffers(stru
  	return 0;
  }
  
@@ -28,7 +28,7 @@
  /*
   * Handle devices with one erase region, that only implement
   * the chip erase command.
-@@ -1568,8 +1569,8 @@ static int __xipram do_erase_chip(struct
+@@ -1596,8 +1597,8 @@ static int __xipram do_erase_chip(struct
  			chip->erase_suspended = 0;
  		}
  
@@ -39,7 +39,7 @@
  
  		if (time_after(jiffies, timeo)) {
  			printk(KERN_WARNING "MTD %s(): software timeout\n",
-@@ -1589,6 +1590,7 @@ static int __xipram do_erase_chip(struct
+@@ -1617,6 +1618,7 @@ static int __xipram do_erase_chip(struct
  		ret = -EIO;
  	}
  
@@ -47,7 +47,7 @@
  	chip->state = FL_READY;
  	xip_enable(map, chip, adr);
  	put_chip(map, chip, adr);
-@@ -1656,9 +1658,9 @@ static int __xipram do_erase_oneblock(st
+@@ -1684,9 +1686,9 @@ static int __xipram do_erase_oneblock(st
  			chip->erase_suspended = 0;
  		}
  
@@ -59,7 +59,7 @@
  		}
  
  		if (time_after(jiffies, timeo)) {
-@@ -1680,6 +1682,7 @@ static int __xipram do_erase_oneblock(st
+@@ -1708,6 +1710,7 @@ static int __xipram do_erase_oneblock(st
  		ret = -EIO;
  	}
  
diff --git a/target/linux/ar71xx/patches-2.6.32/109-mtd-wrt160nl-trx-parser.patch b/target/linux/ar71xx/patches-2.6.32/109-mtd-wrt160nl-trx-parser.patch
index 7af88432a..79162fa55 100644
--- a/target/linux/ar71xx/patches-2.6.32/109-mtd-wrt160nl-trx-parser.patch
+++ b/target/linux/ar71xx/patches-2.6.32/109-mtd-wrt160nl-trx-parser.patch
@@ -1,6 +1,6 @@
 --- a/drivers/mtd/devices/m25p80.c
 +++ b/drivers/mtd/devices/m25p80.c
-@@ -886,6 +886,16 @@ static int __devinit m25p_probe(struct s
+@@ -887,6 +887,16 @@ static int __devinit m25p_probe(struct s
  					part_probes, &parts, 0);
  		}
  #endif
diff --git a/target/linux/ar71xx/patches-2.6.32/110-usb-ehci-add-war-for-synopsys-hc-bug.patch b/target/linux/ar71xx/patches-2.6.32/110-usb-ehci-add-war-for-synopsys-hc-bug.patch
index 18994d083..9b1bd401a 100644
--- a/target/linux/ar71xx/patches-2.6.32/110-usb-ehci-add-war-for-synopsys-hc-bug.patch
+++ b/target/linux/ar71xx/patches-2.6.32/110-usb-ehci-add-war-for-synopsys-hc-bug.patch
@@ -12,7 +12,7 @@
  /* makes sure the async qh will become idle */
 --- a/drivers/usb/host/ehci.h
 +++ b/drivers/usb/host/ehci.h
-@@ -129,6 +129,7 @@ struct ehci_hcd {			/* one per controlle
+@@ -130,6 +130,7 @@ struct ehci_hcd {			/* one per controlle
  	unsigned		has_amcc_usb23:1;
  	unsigned		need_io_watchdog:1;
  	unsigned		broken_periodic:1;
diff --git a/target/linux/ar71xx/patches-2.6.32/111-mtd-cfi_cmdset_0002-force-word-write.patch b/target/linux/ar71xx/patches-2.6.32/111-mtd-cfi_cmdset_0002-force-word-write.patch
index 4be025d87..98f4a643b 100644
--- a/target/linux/ar71xx/patches-2.6.32/111-mtd-cfi_cmdset_0002-force-word-write.patch
+++ b/target/linux/ar71xx/patches-2.6.32/111-mtd-cfi_cmdset_0002-force-word-write.patch
@@ -9,7 +9,7 @@
  
  #define MAX_WORD_RETRIES 3
  
-@@ -55,7 +55,9 @@
+@@ -54,7 +54,9 @@
  
  static int cfi_amdstd_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
  static int cfi_amdstd_write_words(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
@@ -19,7 +19,7 @@
  static int cfi_amdstd_erase_chip(struct mtd_info *, struct erase_info *);
  static int cfi_amdstd_erase_varsize(struct mtd_info *, struct erase_info *);
  static void cfi_amdstd_sync (struct mtd_info *);
-@@ -190,6 +192,7 @@ static void fixup_amd_bootblock(struct m
+@@ -189,6 +191,7 @@ static void fixup_amd_bootblock(struct m
  }
  #endif
  
@@ -27,7 +27,7 @@
  static void fixup_use_write_buffers(struct mtd_info *mtd, void *param)
  {
  	struct map_info *map = mtd->priv;
-@@ -199,6 +202,7 @@ static void fixup_use_write_buffers(stru
+@@ -198,6 +201,7 @@ static void fixup_use_write_buffers(stru
  		mtd->write = cfi_amdstd_write_buffers;
  	}
  }
@@ -35,7 +35,7 @@
  
  /* Atmel chips don't use the same PRI format as AMD chips */
  static void fixup_convert_atmel_pri(struct mtd_info *mtd, void *param)
-@@ -1315,6 +1319,7 @@ static int cfi_amdstd_write_words(struct
+@@ -1343,6 +1347,7 @@ static int cfi_amdstd_write_words(struct
  /*
   * FIXME: interleaved mode not tested, and probably not supported!
   */
@@ -43,7 +43,7 @@
  static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
  				    unsigned long adr, const u_char *buf,
  				    int len)
-@@ -1426,7 +1431,6 @@ static int __xipram do_write_buffer(stru
+@@ -1454,7 +1459,6 @@ static int __xipram do_write_buffer(stru
  	return ret;
  }
  
@@ -51,7 +51,7 @@
  static int cfi_amdstd_write_buffers(struct mtd_info *mtd, loff_t to, size_t len,
  				    size_t *retlen, const u_char *buf)
  {
-@@ -1505,6 +1509,7 @@ static int cfi_amdstd_write_buffers(stru
+@@ -1533,6 +1537,7 @@ static int cfi_amdstd_write_buffers(stru
  
  	return 0;
  }
diff --git a/target/linux/au1000/Makefile b/target/linux/au1000/Makefile
index f7cec30ca..ced52cec9 100644
--- a/target/linux/au1000/Makefile
+++ b/target/linux/au1000/Makefile
@@ -12,7 +12,7 @@ BOARDNAME:=RMI/AMD AU1x00
 FEATURES:=jffs2 usb pci
 SUBTARGETS=au1500 au1550
 
-LINUX_VERSION:=2.6.32.16
+LINUX_VERSION:=2.6.32.25
 
 include $(INCLUDE_DIR)/target.mk
 DEFAULT_PACKAGES += wpad-mini yamonenv
diff --git a/target/linux/avr32/Makefile b/target/linux/avr32/Makefile
index 1a8cd5535..4aca262ba 100644
--- a/target/linux/avr32/Makefile
+++ b/target/linux/avr32/Makefile
@@ -10,7 +10,7 @@ ARCH:=avr32
 BOARD:=avr32
 BOARDNAME:=Atmel AVR32
 FEATURES:=squashfs
-LINUX_VERSION:=2.6.32.16
+LINUX_VERSION:=2.6.32.25
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/brcm47xx/Makefile b/target/linux/brcm47xx/Makefile
index 222f0758c..7d396d91a 100644
--- a/target/linux/brcm47xx/Makefile
+++ b/target/linux/brcm47xx/Makefile
@@ -11,7 +11,7 @@ BOARD:=brcm47xx
 BOARDNAME:=Broadcom BCM947xx/953xx
 FEATURES:=squashfs usb pcmcia
 
-LINUX_VERSION:=2.6.32.16
+LINUX_VERSION:=2.6.32.25
 
 include $(INCLUDE_DIR)/target.mk
 DEFAULT_PACKAGES += wpad-mini kmod-switch kmod-diag nvram
diff --git a/target/linux/brcm47xx/patches-2.6.32/150-cpu_fixes.patch b/target/linux/brcm47xx/patches-2.6.32/150-cpu_fixes.patch
index e6ac4c8e8..2f5e3a9fc 100644
--- a/target/linux/brcm47xx/patches-2.6.32/150-cpu_fixes.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/150-cpu_fixes.patch
@@ -345,7 +345,7 @@
  }
 --- a/arch/mips/mm/tlbex.c
 +++ b/arch/mips/mm/tlbex.c
-@@ -733,6 +733,9 @@ static void __cpuinit build_r4000_tlb_re
+@@ -738,6 +738,9 @@ static void __cpuinit build_r4000_tlb_re
  		/* No need for uasm_i_nop */
  	}
  
@@ -355,7 +355,7 @@
  #ifdef CONFIG_64BIT
  	build_get_pmde64(&p, &l, &r, K0, K1); /* get pmd in K1 */
  #else
-@@ -1185,6 +1188,9 @@ build_r4000_tlbchange_handler_head(u32 *
+@@ -1190,6 +1193,9 @@ build_r4000_tlbchange_handler_head(u32 *
  				   struct uasm_reloc **r, unsigned int pte,
  				   unsigned int ptr)
  {
diff --git a/target/linux/brcm47xx/patches-2.6.32/220-bcm5354.patch b/target/linux/brcm47xx/patches-2.6.32/220-bcm5354.patch
index 1d75e171d..ba849ddad 100644
--- a/target/linux/brcm47xx/patches-2.6.32/220-bcm5354.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/220-bcm5354.patch
@@ -1,6 +1,6 @@
 --- a/drivers/ssb/driver_chipcommon.c
 +++ b/drivers/ssb/driver_chipcommon.c
-@@ -260,6 +260,8 @@ void ssb_chipco_resume(struct ssb_chipco
+@@ -261,6 +261,8 @@ void ssb_chipco_resume(struct ssb_chipco
  void ssb_chipco_get_clockcpu(struct ssb_chipcommon *cc,
                               u32 *plltype, u32 *n, u32 *m)
  {
@@ -9,7 +9,7 @@
  	*n = chipco_read32(cc, SSB_CHIPCO_CLOCK_N);
  	*plltype = (cc->capabilities & SSB_CHIPCO_CAP_PLLT);
  	switch (*plltype) {
-@@ -283,6 +285,8 @@ void ssb_chipco_get_clockcpu(struct ssb_
+@@ -284,6 +286,8 @@ void ssb_chipco_get_clockcpu(struct ssb_
  void ssb_chipco_get_clockcontrol(struct ssb_chipcommon *cc,
  				 u32 *plltype, u32 *n, u32 *m)
  {
@@ -31,7 +31,7 @@
  	}
 --- a/drivers/ssb/main.c
 +++ b/drivers/ssb/main.c
-@@ -1073,6 +1073,8 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
+@@ -1075,6 +1075,8 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
  
  	if (bus->chip_id == 0x5365) {
  		rate = 100000000;
diff --git a/target/linux/brcm47xx/patches-2.6.32/270-ehci-ssb.patch b/target/linux/brcm47xx/patches-2.6.32/270-ehci-ssb.patch
index d6237f09a..f0cbad29e 100644
--- a/target/linux/brcm47xx/patches-2.6.32/270-ehci-ssb.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/270-ehci-ssb.patch
@@ -29,7 +29,7 @@
  	depends on USB
 --- a/drivers/usb/host/ehci-hcd.c
 +++ b/drivers/usb/host/ehci-hcd.c
-@@ -1141,8 +1141,16 @@ MODULE_LICENSE ("GPL");
+@@ -1142,8 +1142,16 @@ MODULE_LICENSE ("GPL");
  #define	PLATFORM_DRIVER		ehci_atmel_driver
  #endif
  
diff --git a/target/linux/brcm47xx/patches-2.6.32/275-usb2-bcm5354-init.patch b/target/linux/brcm47xx/patches-2.6.32/275-usb2-bcm5354-init.patch
index 3d8327ebf..6f193bc09 100644
--- a/target/linux/brcm47xx/patches-2.6.32/275-usb2-bcm5354-init.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/275-usb2-bcm5354-init.patch
@@ -41,19 +41,18 @@ Signed-off-by: Steve Brown <sbrown@cortland.com>
 -			ssb_write32(dev, 0x400, tmp);
 -			tmp = ssb_read32(dev, 0x400);
 -			printk("USB20H fcr: 0x%0x\n", tmp);
--
++		/* Work around for 5354 failures */
++		if ((dev->id.revision == 2) && (dev->bus->chip_id == 0x5354)) {
++			/* Change syn01 reg */
++			tmp = 0x00fe00fe;
++			ssb_write32(dev, 0x894, tmp);
+ 
 -			/* Change Shim control reg */
 -			tmp = ssb_read32(dev, 0x304);
 -			tmp &= ~0x100;
 -			ssb_write32(dev, 0x304, tmp);
 -			tmp = ssb_read32(dev, 0x304);
 -			printk("USB20H shim: 0x%0x\n", tmp);
-+		/* Work around for 5354 failures */
-+		if ((dev->id.revision == 2) && (dev->bus->chip_id == 0x5354)) {
-+			/* Change syn01 reg */
-+			tmp = 0x00fe00fe;
-+			ssb_write32(dev, 0x894, tmp);
-+
 +			/* Change syn03 reg */
 +			tmp = ssb_read32(dev, 0x89c);
 +			tmp |= 0x1;
diff --git a/target/linux/brcm47xx/patches-2.6.32/280-activate_ssb_support_in_usb.patch b/target/linux/brcm47xx/patches-2.6.32/280-activate_ssb_support_in_usb.patch
index f22415856..1a50c1a9d 100644
--- a/target/linux/brcm47xx/patches-2.6.32/280-activate_ssb_support_in_usb.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/280-activate_ssb_support_in_usb.patch
@@ -5,7 +5,7 @@ This prevents the options from being delete with make kernel_oldconfig.
 
 --- a/drivers/ssb/Kconfig
 +++ b/drivers/ssb/Kconfig
-@@ -140,6 +140,8 @@ config SSB_DRIVER_MIPS
+@@ -141,6 +141,8 @@ config SSB_DRIVER_MIPS
  config SSB_EMBEDDED
  	bool
  	depends on SSB_DRIVER_MIPS
diff --git a/target/linux/brcm47xx/patches-2.6.32/610-pci_ide_fix.patch b/target/linux/brcm47xx/patches-2.6.32/610-pci_ide_fix.patch
index 26ba3b755..f254b203b 100644
--- a/target/linux/brcm47xx/patches-2.6.32/610-pci_ide_fix.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/610-pci_ide_fix.patch
@@ -1,6 +1,6 @@
 --- a/include/linux/ide.h
 +++ b/include/linux/ide.h
-@@ -195,7 +195,11 @@
+@@ -195,7 +195,11 @@ static inline void ide_std_init_ports(st
  	hw->io_ports.ctl_addr = ctl_addr;
  }
  
diff --git a/target/linux/brcm47xx/patches-2.6.32/700-ssb-gigabit-ethernet-driver.patch b/target/linux/brcm47xx/patches-2.6.32/700-ssb-gigabit-ethernet-driver.patch
index dce689f19..9f473d9cb 100644
--- a/target/linux/brcm47xx/patches-2.6.32/700-ssb-gigabit-ethernet-driver.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/700-ssb-gigabit-ethernet-driver.patch
@@ -8,7 +8,7 @@
  
  #include <net/checksum.h>
  #include <net/ip.h>
-@@ -457,8 +458,9 @@ static void _tw32_flush(struct tg3 *tp, 
+@@ -457,8 +458,9 @@ static void _tw32_flush(struct tg3 *tp,
  static inline void tw32_mailbox_flush(struct tg3 *tp, u32 off, u32 val)
  {
  	tp->write32_mbox(tp, off, val);
@@ -52,7 +52,7 @@
  {
  	u32 frame_val;
  	unsigned int loops;
-@@ -866,6 +873,11 @@ static int tg3_writephy(struct tg3 *tp, 
+@@ -866,6 +873,11 @@ static int tg3_writephy(struct tg3 *tp,
  	return ret;
  }
  
@@ -129,7 +129,7 @@
  	tw32(GRC_MODE, tp->grc_mode);
  
  	if (tp->pci_chip_rev_id == CHIPREV_ID_5705_A0) {
-@@ -6704,9 +6742,12 @@ static int tg3_halt_cpu(struct tg3 *tp, 
+@@ -6704,9 +6742,12 @@ static int tg3_halt_cpu(struct tg3 *tp,
  		return -ENODEV;
  	}
  
@@ -157,7 +157,7 @@
  	fw_data = (void *)tp->fw->data;
  
  	/* Firmware blob starts with version numbers, followed by
-@@ -6828,6 +6874,11 @@ static int tg3_load_tso_firmware(struct 
+@@ -6828,6 +6874,11 @@ static int tg3_load_tso_firmware(struct
  	unsigned long cpu_base, cpu_scratch_base, cpu_scratch_size;
  	int err, i;
  
@@ -181,7 +181,7 @@
  	if (!(tp->tg3_flags & TG3_FLAG_TAGGED_STATUS)) {
  		/* All of this garbage is because when using non-tagged
  		 * IRQ status the mailbox/status_block protocol the chip
-@@ -9800,6 +9856,11 @@ static int tg3_test_nvram(struct tg3 *tp
+@@ -9801,6 +9857,11 @@ static int tg3_test_nvram(struct tg3 *tp
  	if (tp->tg3_flags3 & TG3_FLG3_NO_NVRAM)
  		return 0;
  
@@ -193,7 +193,7 @@
  	if (tg3_nvram_read(tp, 0, &magic) != 0)
  		return -EIO;
  
-@@ -10594,7 +10655,7 @@ static int tg3_ioctl(struct net_device *
+@@ -10595,7 +10656,7 @@ static int tg3_ioctl(struct net_device *
  			return -EAGAIN;
  
  		spin_lock_bh(&tp->lock);
@@ -202,7 +202,7 @@
  		spin_unlock_bh(&tp->lock);
  
  		data->val_out = mii_regval;
-@@ -10610,7 +10671,7 @@ static int tg3_ioctl(struct net_device *
+@@ -10611,7 +10672,7 @@ static int tg3_ioctl(struct net_device *
  			return -EAGAIN;
  
  		spin_lock_bh(&tp->lock);
@@ -211,7 +211,7 @@
  		spin_unlock_bh(&tp->lock);
  
  		return err;
-@@ -11255,6 +11316,12 @@ static void __devinit tg3_get_5717_nvram
+@@ -11256,6 +11317,12 @@ static void __devinit tg3_get_5717_nvram
  /* Chips other than 5700/5701 use the NVRAM for fetching info. */
  static void __devinit tg3_nvram_init(struct tg3 *tp)
  {
@@ -224,7 +224,7 @@
  	tw32_f(GRC_EEPROM_ADDR,
  	     (EEPROM_ADDR_FSM_RESET |
  	      (EEPROM_DEFAULT_CLOCK_PERIOD <<
-@@ -11515,6 +11582,9 @@ static int tg3_nvram_write_block(struct 
+@@ -11516,6 +11583,9 @@ static int tg3_nvram_write_block(struct
  {
  	int ret;
  
@@ -234,7 +234,7 @@
  	if (tp->tg3_flags & TG3_FLAG_EEPROM_WRITE_PROT) {
  		tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl &
  		       ~GRC_LCLCTRL_GPIO_OUTPUT1);
-@@ -12800,6 +12870,11 @@ static int __devinit tg3_get_invariants(
+@@ -12801,6 +12871,11 @@ static int __devinit tg3_get_invariants(
  	      GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)))
  		tp->tg3_flags |= TG3_FLAG_SRAM_USE_CONFIG;
  
@@ -246,7 +246,7 @@
  	/* Get eeprom hw config before calling tg3_set_power_state().
  	 * In particular, the TG3_FLG2_IS_NIC flag must be
  	 * determined before calling tg3_set_power_state() so that
-@@ -13189,6 +13264,10 @@ static int __devinit tg3_get_device_addr
+@@ -13190,6 +13265,10 @@ static int __devinit tg3_get_device_addr
  	}
  
  	if (!is_valid_ether_addr(&dev->dev_addr[0])) {
@@ -257,7 +257,7 @@
  #ifdef CONFIG_SPARC
  		if (!tg3_get_default_macaddr_sparc(tp))
  			return 0;
-@@ -13681,6 +13760,7 @@ static char * __devinit tg3_phy_string(s
+@@ -13682,6 +13761,7 @@ static char * __devinit tg3_phy_string(s
  	case PHY_ID_BCM5704:	return "5704";
  	case PHY_ID_BCM5705:	return "5705";
  	case PHY_ID_BCM5750:	return "5750";
@@ -265,7 +265,7 @@
  	case PHY_ID_BCM5752:	return "5752";
  	case PHY_ID_BCM5714:	return "5714";
  	case PHY_ID_BCM5780:	return "5780";
-@@ -13892,6 +13972,13 @@ static int __devinit tg3_init_one(struct
+@@ -13893,6 +13973,13 @@ static int __devinit tg3_init_one(struct
  		tp->msg_enable = tg3_debug;
  	else
  		tp->msg_enable = TG3_DEF_MSG_ENABLE;
diff --git a/target/linux/brcm47xx/patches-2.6.32/813-use_netdev_alloc_skb.patch b/target/linux/brcm47xx/patches-2.6.32/813-use_netdev_alloc_skb.patch
index 2cfa824cc..a2afd5f9f 100644
--- a/target/linux/brcm47xx/patches-2.6.32/813-use_netdev_alloc_skb.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/813-use_netdev_alloc_skb.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/b44.c
 +++ b/drivers/net/b44.c
-@@ -850,7 +850,7 @@ static int b44_rx(struct b44 *bp, int bu
+@@ -817,7 +817,7 @@ static int b44_rx(struct b44 *bp, int bu
  			struct sk_buff *copy_skb;
  
  			b44_recycle_rx(bp, cons, bp->rx_prod);
diff --git a/target/linux/brcm47xx/patches-2.6.32/920-cache-wround.patch b/target/linux/brcm47xx/patches-2.6.32/920-cache-wround.patch
index 688d3e138..1720c731e 100644
--- a/target/linux/brcm47xx/patches-2.6.32/920-cache-wround.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/920-cache-wround.patch
@@ -41,7 +41,7 @@
  	UASM_i_LA_mostly(p, ptr, pgdc);
  #endif
  	uasm_i_mfc0(p, tmp, C0_BADVADDR); /* get faulting address */
-@@ -733,12 +736,12 @@ static void __cpuinit build_r4000_tlb_re
+@@ -738,12 +741,12 @@ static void __cpuinit build_r4000_tlb_re
  		/* No need for uasm_i_nop */
  	}
  
@@ -57,7 +57,7 @@
  	build_get_pgde32(&p, K0, K1); /* get pgd in K1 */
  #endif
  
-@@ -750,6 +753,9 @@ static void __cpuinit build_r4000_tlb_re
+@@ -755,6 +758,9 @@ static void __cpuinit build_r4000_tlb_re
  	build_update_entries(&p, K0, K1);
  	build_tlb_write_entry(&p, &l, &r, tlb_random);
  	uasm_l_leave(&l, p);
@@ -67,7 +67,7 @@
  	uasm_i_eret(&p); /* return from trap */
  
  #ifdef CONFIG_HUGETLB_PAGE
-@@ -1188,12 +1194,12 @@ build_r4000_tlbchange_handler_head(u32 *
+@@ -1193,12 +1199,12 @@ build_r4000_tlbchange_handler_head(u32 *
  				   struct uasm_reloc **r, unsigned int pte,
  				   unsigned int ptr)
  {
@@ -83,7 +83,7 @@
  	build_get_pgde32(p, pte, ptr); /* get pgd in ptr */
  #endif
  
-@@ -1230,6 +1236,9 @@ build_r4000_tlbchange_handler_tail(u32 *
+@@ -1235,6 +1241,9 @@ build_r4000_tlbchange_handler_tail(u32 *
  	build_update_entries(p, tmp, ptr);
  	build_tlb_write_entry(p, l, r, tlb_indexed);
  	uasm_l_leave(l, *p);
diff --git a/target/linux/brcm63xx/Makefile b/target/linux/brcm63xx/Makefile
index 94ee4c5fc..fbbd577ca 100644
--- a/target/linux/brcm63xx/Makefile
+++ b/target/linux/brcm63xx/Makefile
@@ -10,7 +10,7 @@ ARCH:=mips
 BOARD:=brcm63xx
 BOARDNAME:=Broadcom BCM63xx
 FEATURES:=squashfs jffs2 usb atm pci pcmcia
-LINUX_VERSION:=2.6.32.16
+LINUX_VERSION:=2.6.32.25
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/cobalt/Makefile b/target/linux/cobalt/Makefile
index 53655e307..0e7a84500 100644
--- a/target/linux/cobalt/Makefile
+++ b/target/linux/cobalt/Makefile
@@ -12,7 +12,7 @@ BOARDNAME:=Cobalt Microservers
 FEATURES:=targz pci ext2
 CFLAGS:=-O2 -pipe -mtune=r5000 -funit-at-a-time
 
-LINUX_VERSION:=2.6.32.16
+LINUX_VERSION:=2.6.32.25
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/generic-2.6/files/drivers/net/phy/ar8216.c b/target/linux/generic-2.6/files/drivers/net/phy/ar8216.c
index 98bfc7eb3..93c961c3c 100644
--- a/target/linux/generic-2.6/files/drivers/net/phy/ar8216.c
+++ b/target/linux/generic-2.6/files/drivers/net/phy/ar8216.c
@@ -329,8 +329,8 @@ static struct switch_attr ar8216_port[] = {
 static struct switch_attr ar8216_vlan[] = {
 	{
 		.type = SWITCH_TYPE_INT,
-		.name = "pvid",
-		.description = "VLAN ID",
+		.name = "vid",
+		.description = "VLAN ID (0-4094)",
 		.set = ar8216_set_vid,
 		.get = ar8216_get_vid,
 		.max = 4094,
diff --git a/target/linux/generic-2.6/files/drivers/net/phy/ip17xx.c b/target/linux/generic-2.6/files/drivers/net/phy/ip17xx.c
index 49b3ece2b..67a4328c7 100644
--- a/target/linux/generic-2.6/files/drivers/net/phy/ip17xx.c
+++ b/target/linux/generic-2.6/files/drivers/net/phy/ip17xx.c
@@ -1210,8 +1210,8 @@ static const struct switch_attr ip17xx_vlan[] = {
 	[IP17XX_VLAN_TAG] = {
 		.id = IP17XX_VLAN_TAG,
 		.type = SWITCH_TYPE_INT,
-		.description = "VLAN tag (0-4095) [IP175D only]",
-		.name = "tag",
+		.description = "VLAN ID (0-4095) [IP175D only]",
+		.name = "vid",
 		.get = ip17xx_get_tag,
 		.set = ip17xx_set_tag,
 	}
diff --git a/target/linux/generic-2.6/files/drivers/net/phy/mvswitch.c b/target/linux/generic-2.6/files/drivers/net/phy/mvswitch.c
index c2f324572..f3a9c74e3 100644
--- a/target/linux/generic-2.6/files/drivers/net/phy/mvswitch.c
+++ b/target/linux/generic-2.6/files/drivers/net/phy/mvswitch.c
@@ -247,7 +247,7 @@ mvswitch_config_init(struct phy_device *pdev)
 	pdev->supported = ADVERTISED_100baseT_Full;
 	pdev->advertising = ADVERTISED_100baseT_Full;
 	dev->phy_ptr = priv;
-	dev->irq = PHY_POLL;
+	pdev->irq = PHY_POLL;
 #ifdef HEADER_MODE
 	dev->flags |= IFF_PROMISC;
 #endif
diff --git a/target/linux/generic-2.6/files/drivers/net/phy/rtl8306.c b/target/linux/generic-2.6/files/drivers/net/phy/rtl8306.c
index 87c661a77..4fa910a6f 100644
--- a/target/linux/generic-2.6/files/drivers/net/phy/rtl8306.c
+++ b/target/linux/generic-2.6/files/drivers/net/phy/rtl8306.c
@@ -829,7 +829,7 @@ static struct switch_attr rtl_vlan[] = {
 	{
 		RTL_VLAN_REGATTR(VID),
 		.name = "vid",
-		.description = "VLAN ID",
+		.description = "VLAN ID (1-4095)",
 		.max = 4095,
 	},
 };
diff --git a/target/linux/generic-2.6/files/drivers/net/phy/rtl8366rb.c b/target/linux/generic-2.6/files/drivers/net/phy/rtl8366rb.c
index ec196f941..9615eebea 100644
--- a/target/linux/generic-2.6/files/drivers/net/phy/rtl8366rb.c
+++ b/target/linux/generic-2.6/files/drivers/net/phy/rtl8366rb.c
@@ -25,6 +25,7 @@
 #define RTL8366RB_PHY_NO_MAX	4
 #define RTL8366RB_PHY_PAGE_MAX	7
 #define RTL8366RB_PHY_ADDR_MAX	31
+#define RTL8366RB_PHY_WAN	4
 
 /* Switch Global Configuration register */
 #define RTL8366RB_SGCR				0x0000
@@ -1063,6 +1064,10 @@ static int rtl8366rb_phy_config_init(struct phy_device *phydev)
 
 static int rtl8366rb_phy_config_aneg(struct phy_device *phydev)
 {
+	/* phy 4 might be connected to a second mac, allow aneg config */
+	if (phydev->addr == RTL8366RB_PHY_WAN)
+		return genphy_config_aneg(phydev);
+
 	return 0;
 }
 
diff --git a/target/linux/generic-2.6/files/drivers/net/phy/rtl8366s.c b/target/linux/generic-2.6/files/drivers/net/phy/rtl8366s.c
index 66dc2db0d..d45e4d76c 100644
--- a/target/linux/generic-2.6/files/drivers/net/phy/rtl8366s.c
+++ b/target/linux/generic-2.6/files/drivers/net/phy/rtl8366s.c
@@ -25,6 +25,7 @@
 #define RTL8366S_PHY_NO_MAX	4
 #define RTL8366S_PHY_PAGE_MAX	7
 #define RTL8366S_PHY_ADDR_MAX	31
+#define RTL8366S_PHY_WAN	4
 
 /* Switch Global Configuration register */
 #define RTL8366S_SGCR				0x0000
@@ -1090,6 +1091,10 @@ static int rtl8366s_phy_config_init(struct phy_device *phydev)
 
 static int rtl8366s_phy_config_aneg(struct phy_device *phydev)
 {
+	/* phy 4 might be connected to a second mac, allow aneg config */
+	if (phydev->addr == RTL8366S_PHY_WAN)
+		return genphy_config_aneg(phydev);
+
 	return 0;
 }
 
diff --git a/target/linux/generic-2.6/patches-2.6.30/014-cfi_fix_amd_extended_table_check.patch b/target/linux/generic-2.6/patches-2.6.30/014-cfi_fix_amd_extended_table_check.patch
index 1216a3bd3..3c7d303b7 100644
--- a/target/linux/generic-2.6/patches-2.6.30/014-cfi_fix_amd_extended_table_check.patch
+++ b/target/linux/generic-2.6/patches-2.6.30/014-cfi_fix_amd_extended_table_check.patch
@@ -1,6 +1,6 @@
 --- a/drivers/mtd/chips/cfi_cmdset_0002.c
 +++ b/drivers/mtd/chips/cfi_cmdset_0002.c
-@@ -336,6 +336,8 @@ static struct cfi_fixup fixup_table[] =
+@@ -336,6 +336,8 @@ static struct cfi_fixup fixup_table[] = 
  static void cfi_fixup_major_minor(struct cfi_private *cfi,
  				  struct cfi_pri_amdstd *extp)
  {
@@ -9,7 +9,7 @@
  	if (cfi->mfr == CFI_MFR_SAMSUNG && cfi->id == 0x257e &&
  	    extp->MajorVersion == '0')
  		extp->MajorVersion = '1';
-@@ -366,6 +368,9 @@ struct mtd_info *cfi_cmdset_0002(struct
+@@ -366,6 +368,9 @@ struct mtd_info *cfi_cmdset_0002(struct 
  	mtd->name    = map->name;
  	mtd->writesize = 1;
  
@@ -19,7 +19,7 @@
  	if (cfi->cfi_mode==CFI_MODE_CFI){
  		unsigned char bootloc;
  		/*
-@@ -384,16 +389,24 @@ struct mtd_info *cfi_cmdset_0002(struct
+@@ -384,16 +389,24 @@ struct mtd_info *cfi_cmdset_0002(struct 
  
  		cfi_fixup_major_minor(cfi, extp);
  
diff --git a/target/linux/generic-2.6/patches-2.6.30/930-kmsg_dump_backport.patch b/target/linux/generic-2.6/patches-2.6.30/930-kmsg_dump_backport.patch
index 762b44111..cdcf094d0 100644
--- a/target/linux/generic-2.6/patches-2.6.30/930-kmsg_dump_backport.patch
+++ b/target/linux/generic-2.6/patches-2.6.30/930-kmsg_dump_backport.patch
@@ -55,7 +55,7 @@
  #include <linux/kallsyms.h>
  #include <linux/notifier.h>
  #include <linux/module.h>
-@@ -74,6 +75,7 @@
+@@ -74,6 +75,7 @@ NORET_TYPE void panic(const char * fmt, 
  	dump_stack();
  #endif
  
@@ -63,7 +63,7 @@
  	/*
  	 * If we have crashed and we have a crash kernel loaded let it handle
  	 * everything else.
-@@ -337,6 +339,7 @@
+@@ -337,6 +339,7 @@ void oops_exit(void)
  {
  	do_oops_enter_exit();
  	print_oops_end_marker();
@@ -81,7 +81,7 @@
  
  #include <asm/uaccess.h>
  
-@@ -1322,3 +1323,121 @@
+@@ -1322,3 +1323,121 @@ bool printk_timed_ratelimit(unsigned lon
  }
  EXPORT_SYMBOL(printk_timed_ratelimit);
  #endif
diff --git a/target/linux/generic-2.6/patches-2.6.30/931-crashlog.patch b/target/linux/generic-2.6/patches-2.6.30/931-crashlog.patch
index d4424190c..4c7ba2390 100644
--- a/target/linux/generic-2.6/patches-2.6.30/931-crashlog.patch
+++ b/target/linux/generic-2.6/patches-2.6.30/931-crashlog.patch
@@ -1,6 +1,6 @@
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -723,6 +723,9 @@
+@@ -723,6 +723,9 @@ config NET_NS
  	  Allow user space to create what appear to be multiple instances
  	  of the network stack.
  
@@ -12,7 +12,7 @@
  	depends on BROKEN || !FRV
 --- a/kernel/Makefile
 +++ b/kernel/Makefile
-@@ -95,6 +95,7 @@
+@@ -95,6 +95,7 @@ obj-$(CONFIG_FUNCTION_TRACER) += trace/
  obj-$(CONFIG_TRACING) += trace/
  obj-$(CONFIG_SMP) += sched_cpupri.o
  obj-$(CONFIG_SLOW_WORK) += slow-work.o
@@ -30,7 +30,7 @@
  
  #include <asm/bug.h>
  #include <asm/io.h>
-@@ -151,6 +152,7 @@
+@@ -151,6 +152,7 @@ static unsigned long __init free_all_boo
  	if (!bdata->node_bootmem_map)
  		return 0;
  
diff --git a/target/linux/generic-2.6/patches-2.6.32/007-squashfs_make_lzma_available.patch b/target/linux/generic-2.6/patches-2.6.32/007-squashfs_make_lzma_available.patch
index ca43a98bc..740247162 100644
--- a/target/linux/generic-2.6/patches-2.6.32/007-squashfs_make_lzma_available.patch
+++ b/target/linux/generic-2.6/patches-2.6.32/007-squashfs_make_lzma_available.patch
@@ -65,7 +65,7 @@ Signed-off-by: Phillip Lougher <phillip@lougher.demon.co.uk>
 +#endif
 --- a/include/linux/decompress/mm.h
 +++ b/include/linux/decompress/mm.h
-@@ -53,8 +53,6 @@ static void free(void *where)
+@@ -63,8 +63,6 @@ static void free(void *where)
  
  #define set_error_fn(x)
  
@@ -74,7 +74,7 @@ Signed-off-by: Phillip Lougher <phillip@lougher.demon.co.uk>
  #else /* STATIC */
  
  /* Code active when compiled standalone for use when loading ramdisk: */
-@@ -77,7 +75,6 @@ static void free(void *where)
+@@ -87,7 +85,6 @@ static void free(void *where)
  static void(*error)(char *m);
  #define set_error_fn(x) error = x;
  
diff --git a/target/linux/generic-2.6/patches-2.6.32/014-cfi_fix_amd_extended_table_check.patch b/target/linux/generic-2.6/patches-2.6.32/014-cfi_fix_amd_extended_table_check.patch
index 2618fafeb..7010d367b 100644
--- a/target/linux/generic-2.6/patches-2.6.32/014-cfi_fix_amd_extended_table_check.patch
+++ b/target/linux/generic-2.6/patches-2.6.32/014-cfi_fix_amd_extended_table_check.patch
@@ -1,6 +1,6 @@
 --- a/drivers/mtd/chips/cfi_cmdset_0002.c
 +++ b/drivers/mtd/chips/cfi_cmdset_0002.c
-@@ -325,6 +325,8 @@ static struct cfi_fixup fixup_table[] =
+@@ -325,6 +325,8 @@ static struct cfi_fixup fixup_table[] = 
  static void cfi_fixup_major_minor(struct cfi_private *cfi,
  				  struct cfi_pri_amdstd *extp)
  {
@@ -9,7 +9,7 @@
  	if (cfi->mfr == CFI_MFR_SAMSUNG && cfi->id == 0x257e &&
  	    extp->MajorVersion == '0')
  		extp->MajorVersion = '1';
-@@ -355,6 +357,9 @@ struct mtd_info *cfi_cmdset_0002(struct
+@@ -355,6 +357,9 @@ struct mtd_info *cfi_cmdset_0002(struct 
  	mtd->name    = map->name;
  	mtd->writesize = 1;
  
@@ -19,7 +19,7 @@
  	if (cfi->cfi_mode==CFI_MODE_CFI){
  		unsigned char bootloc;
  		/*
-@@ -373,16 +378,24 @@ struct mtd_info *cfi_cmdset_0002(struct
+@@ -373,16 +378,24 @@ struct mtd_info *cfi_cmdset_0002(struct 
  
  		cfi_fixup_major_minor(cfi, extp);
  
diff --git a/target/linux/generic-2.6/patches-2.6.32/025-mips_disable_fpu.patch b/target/linux/generic-2.6/patches-2.6.32/025-mips_disable_fpu.patch
index e1e9f7369..a3511d742 100644
--- a/target/linux/generic-2.6/patches-2.6.32/025-mips_disable_fpu.patch
+++ b/target/linux/generic-2.6/patches-2.6.32/025-mips_disable_fpu.patch
@@ -71,7 +71,7 @@ Signed-off-by: Florian Fainelli <florian@openwrt.org>
  /* Control registers */
  
  #define FPCREG_RID	0	/* $0  = revision id */
-@@ -1274,6 +1276,13 @@ int fpu_emulator_cop1Handler(struct pt_r
+@@ -1281,6 +1283,13 @@ int fpu_emulator_cop1Handler(struct pt_r
  
  	return sig;
  }
diff --git a/target/linux/generic-2.6/patches-2.6.32/030-pci_disable_common_quirks.patch b/target/linux/generic-2.6/patches-2.6.32/030-pci_disable_common_quirks.patch
index 4050cf14c..7572e6f5d 100644
--- a/target/linux/generic-2.6/patches-2.6.32/030-pci_disable_common_quirks.patch
+++ b/target/linux/generic-2.6/patches-2.6.32/030-pci_disable_common_quirks.patch
@@ -23,7 +23,7 @@
  /* The Mellanox Tavor device gives false positive parity errors
   * Mark this device with a broken_parity_status, to allow
   * PCI scanning code to "skip" this now blacklisted device.
-@@ -1884,7 +1885,9 @@ static void __devinit fixup_rev1_53c810(
+@@ -1907,7 +1908,9 @@ static void __devinit fixup_rev1_53c810(
  	}
  }
  DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NCR, PCI_DEVICE_ID_NCR_53C810, fixup_rev1_53c810);
@@ -33,8 +33,8 @@
  /* Enable 1k I/O space granularity on the Intel P64H2 */
  static void __devinit quirk_p64h2_1k_io(struct pci_dev *dev)
  {
-@@ -2515,6 +2518,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150d, quirk_i82576_sriov);
+@@ -2546,6 +2549,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1518, quirk_i82576_sriov);
  
  #endif	/* CONFIG_PCI_IOV */
 +#endif /* !CONFIG_PCI_DISABLE_COMMON_QUIRKS */
diff --git a/target/linux/generic-2.6/patches-2.6.32/090-mtd-m25p80-add-en25f32-chip-support.patch b/target/linux/generic-2.6/patches-2.6.32/090-mtd-m25p80-add-en25f32-chip-support.patch
new file mode 100644
index 000000000..969790e87
--- /dev/null
+++ b/target/linux/generic-2.6/patches-2.6.32/090-mtd-m25p80-add-en25f32-chip-support.patch
@@ -0,0 +1,12 @@
+--- a/drivers/mtd/devices/m25p80.c
++++ b/drivers/mtd/devices/m25p80.c
+@@ -626,7 +626,8 @@ static struct flash_info __devinitdata m
+ 	{ "mx25l12805d", 0xc22018, 0, 64 * 1024, 256, },
+ 	{ "mx25l12855e", 0xc22618, 0, 64 * 1024, 256, },
+ 
+-	/* EON -- en25pxx */
++	/* EON -- en25xxx */
++	{ "en25f32", 0x1c3116, 0, 64 * 1024,  64, SECT_4K },
+ 	{ "en25p32", 0x1c2016, 0, 64 * 1024,  64, },
+ 	{ "en25p64", 0x1c2017, 0, 64 * 1024, 128, },
+ 
diff --git a/target/linux/generic-2.6/patches-2.6.32/150-netfilter_imq.patch b/target/linux/generic-2.6/patches-2.6.32/150-netfilter_imq.patch
index 9540ce0dd..8a6cf3e82 100644
--- a/target/linux/generic-2.6/patches-2.6.32/150-netfilter_imq.patch
+++ b/target/linux/generic-2.6/patches-2.6.32/150-netfilter_imq.patch
@@ -958,7 +958,7 @@
  			dev_queue_xmit_nit(skb, dev);
  
  		if (netif_needs_gso(dev, skb)) {
-@@ -1789,8 +1796,7 @@ u16 skb_tx_hash(const struct net_device 
+@@ -1789,8 +1796,7 @@ u16 skb_tx_hash(const struct net_device
  }
  EXPORT_SYMBOL(skb_tx_hash);
  
@@ -1109,7 +1109,7 @@
  	new->csum		= old->csum;
  	new->local_df		= old->local_df;
  	new->pkt_type		= old->pkt_type;
-@@ -2776,6 +2879,13 @@ void __init skb_init(void)
+@@ -2781,6 +2884,13 @@ void __init skb_init(void)
  						0,
  						SLAB_HWCACHE_ALIGN|SLAB_PANIC,
  						NULL);
@@ -1183,7 +1183,7 @@
  /* return EBUSY when somebody else is registered, return EEXIST if the
   * same handler is registered, return 0 in case of success. */
  int nf_register_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh)
-@@ -80,7 +100,7 @@ void nf_unregister_queue_handlers(const 
+@@ -80,7 +100,7 @@ void nf_unregister_queue_handlers(const
  }
  EXPORT_SYMBOL_GPL(nf_unregister_queue_handlers);
  
diff --git a/target/linux/generic-2.6/patches-2.6.32/260-crypto_optional_tests.patch b/target/linux/generic-2.6/patches-2.6.32/260-crypto_optional_tests.patch
index 0808c778e..b689fa63e 100644
--- a/target/linux/generic-2.6/patches-2.6.32/260-crypto_optional_tests.patch
+++ b/target/linux/generic-2.6/patches-2.6.32/260-crypto_optional_tests.patch
@@ -22,7 +22,7 @@
  struct tcrypt_result {
  	struct completion completion;
  	int err;
-@@ -2350,8 +2352,11 @@ static int alg_find_test(const char *alg
+@@ -2434,8 +2436,11 @@ static int alg_find_test(const char *alg
  	return -1;
  }
  
@@ -34,7 +34,7 @@
  	int i;
  	int j;
  	int rc;
-@@ -2406,5 +2411,8 @@ notest:
+@@ -2490,5 +2495,8 @@ notest:
  	return 0;
  non_fips_alg:
  	return -EINVAL;
diff --git a/target/linux/generic-2.6/patches-2.6.32/690-phy_rtl8306.patch b/target/linux/generic-2.6/patches-2.6.32/690-phy_rtl8306.patch
index a8c1cb59f..36ce9dfce 100644
--- a/target/linux/generic-2.6/patches-2.6.32/690-phy_rtl8306.patch
+++ b/target/linux/generic-2.6/patches-2.6.32/690-phy_rtl8306.patch
@@ -14,7 +14,7 @@
 --- a/drivers/net/phy/Makefile
 +++ b/drivers/net/phy/Makefile
 @@ -19,6 +19,7 @@ obj-$(CONFIG_MVSWITCH_PHY)	+= mvswitch.o
- obj-$(CONFIG_IP17XX)	+= ip17xx.o
+ obj-$(CONFIG_IP17XX_PHY)	+= ip17xx.o
  obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
  obj-$(CONFIG_AR8216_PHY)	+= ar8216.o
 +obj-$(CONFIG_RTL8306_PHY)	+= rtl8306.o
diff --git a/target/linux/generic-2.6/patches-2.6.32/840-unable_to_open_console.patch b/target/linux/generic-2.6/patches-2.6.32/840-unable_to_open_console.patch
index c9a277468..8d9039676 100644
--- a/target/linux/generic-2.6/patches-2.6.32/840-unable_to_open_console.patch
+++ b/target/linux/generic-2.6/patches-2.6.32/840-unable_to_open_console.patch
@@ -1,6 +1,6 @@
 --- a/init/main.c
 +++ b/init/main.c
-@@ -812,7 +812,7 @@ static noinline int init_post(void)
+@@ -807,7 +807,7 @@ static noinline int init_post(void)
  	numa_default_policy();
  
  	if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
diff --git a/target/linux/generic-2.6/patches-2.6.32/975-ssb_update.patch b/target/linux/generic-2.6/patches-2.6.32/975-ssb_update.patch
index f48c58052..def960926 100644
--- a/target/linux/generic-2.6/patches-2.6.32/975-ssb_update.patch
+++ b/target/linux/generic-2.6/patches-2.6.32/975-ssb_update.patch
@@ -1,15 +1,6 @@
 --- a/drivers/ssb/driver_chipcommon.c
 +++ b/drivers/ssb/driver_chipcommon.c
-@@ -233,6 +233,8 @@ void ssb_chipcommon_init(struct ssb_chip
- {
- 	if (!cc->dev)
- 		return; /* We don't have a ChipCommon */
-+	if (cc->dev->id.revision >= 11)
-+		cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT);
- 	ssb_pmu_init(cc);
- 	chipco_powercontrol_init(cc);
- 	ssb_chipco_set_clockmode(cc, SSB_CLKMODE_FAST);
-@@ -370,6 +372,7 @@ u32 ssb_chipco_gpio_control(struct ssb_c
+@@ -373,6 +373,7 @@ u32 ssb_chipco_gpio_control(struct ssb_c
  {
  	return chipco_write32_masked(cc, SSB_CHIPCO_GPIOCTL, mask, value);
  }
@@ -345,44 +336,11 @@
  }
  
  /* Get the word-offset for a SSB_SPROM_XXX define. */
--#define SPOFF(offset)	(((offset) - SSB_SPROM_BASE) / sizeof(u16))
+-#define SPOFF(offset)	(((offset) - SSB_SPROM_BASE1) / sizeof(u16))
 +#define SPOFF(offset)	((offset) / sizeof(u16))
  /* Helper to extract some _offset, which is one of the SSB_SPROM_XXX defines. */
  #define SPEX16(_outvar, _offset, _mask, _shift)	\
  	out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift))
-@@ -253,7 +254,7 @@ static int sprom_do_read(struct ssb_bus 
- 	int i;
- 
- 	for (i = 0; i < bus->sprom_size; i++)
--		sprom[i] = ioread16(bus->mmio + SSB_SPROM_BASE + (i * 2));
-+		sprom[i] = ioread16(bus->mmio + bus->sprom_offset + (i * 2));
- 
- 	return 0;
- }
-@@ -284,7 +285,7 @@ static int sprom_do_write(struct ssb_bus
- 			ssb_printk("75%%");
- 		else if (i % 2)
- 			ssb_printk(".");
--		writew(sprom[i], bus->mmio + SSB_SPROM_BASE + (i * 2));
-+		writew(sprom[i], bus->mmio + bus->sprom_offset + (i * 2));
- 		mmiowb();
- 		msleep(20);
- 	}
-@@ -620,6 +621,14 @@ static int ssb_pci_sprom_get(struct ssb_
- 	int err = -ENOMEM;
- 	u16 *buf;
- 
-+	if (!ssb_is_sprom_available(bus)) {
-+		ssb_printk(KERN_ERR PFX "No SPROM available!\n");
-+		return -ENODEV;
-+	}
-+
-+	bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ?
-+		SSB_SPROM_BASE1 : SSB_SPROM_BASE31;
-+
- 	buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
- 	if (!buf)
- 		goto out;
 --- a/drivers/ssb/pcihost_wrapper.c
 +++ b/drivers/ssb/pcihost_wrapper.c
 @@ -12,6 +12,7 @@
@@ -404,7 +362,10 @@
 +static int ssb_pcmcia_get_mac(struct pcmcia_device *p_dev,
 +			tuple_t *tuple,
 +			void *priv)
-+{
+ {
+-	tuple_t tuple;
+-	int res;
+-	unsigned char buf[32];
 +	struct ssb_sprom *sprom = priv;
 +
 +	if (tuple->TupleData[0] != CISTPL_FUNCE_LAN_NODE_ID)
@@ -420,10 +381,7 @@
 +static int ssb_pcmcia_do_get_invariants(struct pcmcia_device *p_dev,
 +					tuple_t *tuple,
 +					void *priv)
- {
--	tuple_t tuple;
--	int res;
--	unsigned char buf[32];
++{
 +	struct ssb_init_invariants *iv = priv;
  	struct ssb_sprom *sprom = &iv->sprom;
  	struct ssb_boardinfo *bi = &iv->boardinfo;
@@ -700,24 +658,6 @@
  	if (err)
  		ssb_printk(KERN_ERR PFX "SPROM write: Could not thaw all devices\n");
  out_unlock:
-@@ -179,3 +176,17 @@ const struct ssb_sprom *ssb_get_fallback
- {
- 	return fallback_sprom;
- }
-+
-+/* http://bcm-v4.sipsolutions.net/802.11/IsSpromAvailable */
-+bool ssb_is_sprom_available(struct ssb_bus *bus)
-+{
-+	/* status register only exists on chipcomon rev >= 11 and we need check
-+	   for >= 31 only */
-+	/* this routine differs from specs as we do not access SPROM directly
-+	   on PCMCIA */
-+	if (bus->bustype == SSB_BUSTYPE_PCI &&
-+	    bus->chipco.dev->id.revision >= 31)
-+		return bus->chipco.capabilities & SSB_CHIPCO_CAP_SPROM;
-+
-+	return true;
-+}
 --- a/drivers/ssb/ssb_private.h
 +++ b/drivers/ssb/ssb_private.h
 @@ -176,19 +176,27 @@ extern const struct ssb_sprom *ssb_get_f
@@ -796,79 +736,13 @@
  
  	/* See enum ssb_quirks */
  	unsigned int quirks;
-@@ -301,6 +305,7 @@ struct ssb_bus {
- 	/* ID information about the Chip. */
- 	u16 chip_id;
- 	u16 chip_rev;
-+	u16 sprom_offset;
- 	u16 sprom_size;		/* number of words in sprom */
- 	u8 chip_package;
- 
-@@ -390,6 +395,9 @@ extern int ssb_bus_sdiobus_register(stru
- 
- extern void ssb_bus_unregister(struct ssb_bus *bus);
- 
-+/* Does the device have an SPROM? */
-+extern bool ssb_is_sprom_available(struct ssb_bus *bus);
-+
- /* Set a fallback SPROM.
-  * See kdoc at the function definition for complete documentation. */
- extern int ssb_arch_set_fallback_sprom(const struct ssb_sprom *sprom);
---- a/include/linux/ssb/ssb_driver_chipcommon.h
-+++ b/include/linux/ssb/ssb_driver_chipcommon.h
-@@ -53,6 +53,7 @@
- #define  SSB_CHIPCO_CAP_64BIT		0x08000000	/* 64-bit Backplane */
- #define  SSB_CHIPCO_CAP_PMU		0x10000000	/* PMU available (rev >= 20) */
- #define  SSB_CHIPCO_CAP_ECI		0x20000000	/* ECI available (rev >= 20) */
-+#define  SSB_CHIPCO_CAP_SPROM		0x40000000	/* SPROM present */
- #define SSB_CHIPCO_CORECTL		0x0008
- #define  SSB_CHIPCO_CORECTL_UARTCLK0	0x00000001	/* Drive UART with internal clock */
- #define	 SSB_CHIPCO_CORECTL_SE		0x00000002	/* sync clk out enable (corerev >= 3) */
-@@ -385,6 +386,7 @@
- 
- 
- /** Chip specific Chip-Status register contents. */
-+#define SSB_CHIPCO_CHST_4322_SPROM_EXISTS	0x00000040 /* SPROM present */
- #define SSB_CHIPCO_CHST_4325_SPROM_OTP_SEL	0x00000003
- #define SSB_CHIPCO_CHST_4325_DEFCIS_SEL		0 /* OTP is powered up, use def. CIS, no SPROM */
- #define SSB_CHIPCO_CHST_4325_SPROM_SEL		1 /* OTP is powered up, SPROM is present */
-@@ -398,6 +400,18 @@
- #define SSB_CHIPCO_CHST_4325_RCAL_VALUE_SHIFT	4
- #define SSB_CHIPCO_CHST_4325_PMUTOP_2B 		0x00000200 /* 1 for 2b, 0 for to 2a */
- 
-+/** Macros to determine SPROM presence based on Chip-Status register. */
-+#define SSB_CHIPCO_CHST_4312_SPROM_PRESENT(status) \
-+	((status & SSB_CHIPCO_CHST_4325_SPROM_OTP_SEL) != \
-+		SSB_CHIPCO_CHST_4325_OTP_SEL)
-+#define SSB_CHIPCO_CHST_4322_SPROM_PRESENT(status) \
-+	(status & SSB_CHIPCO_CHST_4322_SPROM_EXISTS)
-+#define SSB_CHIPCO_CHST_4325_SPROM_PRESENT(status) \
-+	(((status & SSB_CHIPCO_CHST_4325_SPROM_OTP_SEL) != \
-+		SSB_CHIPCO_CHST_4325_DEFCIS_SEL) && \
-+	 ((status & SSB_CHIPCO_CHST_4325_SPROM_OTP_SEL) != \
-+		SSB_CHIPCO_CHST_4325_OTP_SEL))
-+
- 
- 
- /** Clockcontrol masks and values **/
-@@ -564,6 +578,7 @@ struct ssb_chipcommon_pmu {
- struct ssb_chipcommon {
- 	struct ssb_device *dev;
- 	u32 capabilities;
-+	u32 status;
- 	/* Fast Powerup Delay constant */
- 	u16 fast_pwrup_delay;
- 	struct ssb_chipcommon_pmu pmu;
 --- a/include/linux/ssb/ssb_regs.h
 +++ b/include/linux/ssb/ssb_regs.h
-@@ -170,26 +170,27 @@
- #define SSB_SPROMSIZE_WORDS_R4		220
- #define SSB_SPROMSIZE_BYTES_R123	(SSB_SPROMSIZE_WORDS_R123 * sizeof(u16))
+@@ -172,25 +172,25 @@
  #define SSB_SPROMSIZE_BYTES_R4		(SSB_SPROMSIZE_WORDS_R4 * sizeof(u16))
--#define SSB_SPROM_BASE			0x1000
+ #define SSB_SPROM_BASE1			0x1000
+ #define SSB_SPROM_BASE31		0x0800
 -#define SSB_SPROM_REVISION		0x107E
-+#define SSB_SPROM_BASE1			0x1000
-+#define SSB_SPROM_BASE31		0x0800
 +#define SSB_SPROM_REVISION		0x007E
  #define  SSB_SPROM_REVISION_REV		0x00FF	/* SPROM Revision number */
  #define  SSB_SPROM_REVISION_CRC		0xFF00	/* SPROM CRC8 value */
@@ -899,7 +773,7 @@
  #define  SSB_SPROM1_BINF_BREV		0x00FF	/* Board Revision */
  #define  SSB_SPROM1_BINF_CCODE		0x0F00	/* Country Code */
  #define  SSB_SPROM1_BINF_CCODE_SHIFT	8
-@@ -197,63 +198,63 @@
+@@ -198,63 +198,63 @@
  #define  SSB_SPROM1_BINF_ANTBG_SHIFT	12
  #define  SSB_SPROM1_BINF_ANTA		0xC000	/* Available A-PHY antennas */
  #define  SSB_SPROM1_BINF_ANTA_SHIFT	14
@@ -991,7 +865,7 @@
  #define  SSB_SPROM3_CCKPO_1M		0x000F	/* 1M Rate PO */
  #define  SSB_SPROM3_CCKPO_2M		0x00F0	/* 2M Rate PO */
  #define  SSB_SPROM3_CCKPO_2M_SHIFT	4
-@@ -264,100 +265,100 @@
+@@ -265,100 +265,100 @@
  #define  SSB_SPROM3_OFDMGPO		0x107A	/* G-PHY OFDM Power Offset (4 bytes, BigEndian) */
  
  /* SPROM Revision 4 */
@@ -1149,7 +1023,7 @@
  #define  SSB_SPROM8_RSSISMF2G		0x000F
  #define  SSB_SPROM8_RSSISMC2G		0x00F0
  #define  SSB_SPROM8_RSSISMC2G_SHIFT	4
-@@ -365,7 +366,7 @@
+@@ -366,7 +366,7 @@
  #define  SSB_SPROM8_RSSISAV2G_SHIFT	8
  #define  SSB_SPROM8_BXA2G		0x1800
  #define  SSB_SPROM8_BXA2G_SHIFT		11
@@ -1158,7 +1032,7 @@
  #define  SSB_SPROM8_RSSISMF5G		0x000F
  #define  SSB_SPROM8_RSSISMC5G		0x00F0
  #define  SSB_SPROM8_RSSISMC5G_SHIFT	4
-@@ -373,47 +374,47 @@
+@@ -374,47 +374,47 @@
  #define  SSB_SPROM8_RSSISAV5G_SHIFT	8
  #define  SSB_SPROM8_BXA5G		0x1800
  #define  SSB_SPROM8_BXA5G_SHIFT		11
diff --git a/target/linux/generic-2.6/patches-2.6.32/980-vm_exports.patch b/target/linux/generic-2.6/patches-2.6.32/980-vm_exports.patch
index 616bb2d54..5d55fa964 100644
--- a/target/linux/generic-2.6/patches-2.6.32/980-vm_exports.patch
+++ b/target/linux/generic-2.6/patches-2.6.32/980-vm_exports.patch
@@ -68,7 +68,7 @@
   * macro override instead of weak attribute alias, to workaround
 --- a/kernel/sched.c
 +++ b/kernel/sched.c
-@@ -6105,6 +6105,7 @@ int can_nice(const struct task_struct *p
+@@ -6224,6 +6224,7 @@ int can_nice(const struct task_struct *p
  	return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
  		capable(CAP_SYS_NICE));
  }
@@ -86,7 +86,7 @@
  
  /**
   * zap_vma_ptes - remove ptes mapping the vma
-@@ -2486,6 +2487,7 @@ int vmtruncate_range(struct inode *inode
+@@ -2496,6 +2497,7 @@ int vmtruncate_range(struct inode *inode
  
  	return 0;
  }
@@ -114,7 +114,7 @@
  				void *caller)
 --- a/include/linux/mm.h
 +++ b/include/linux/mm.h
-@@ -713,6 +713,7 @@ extern void show_free_areas(void);
+@@ -717,6 +717,7 @@ extern void show_free_areas(void);
  
  int shmem_lock(struct file *file, int lock, struct user_struct *user);
  struct file *shmem_file_setup(const char *name, loff_t size, unsigned long flags);
@@ -124,7 +124,7 @@
  #ifndef CONFIG_MMU
 --- a/kernel/signal.c
 +++ b/kernel/signal.c
-@@ -1070,6 +1070,7 @@ struct sighand_struct *lock_task_sighand
+@@ -1072,6 +1072,7 @@ struct sighand_struct *lock_task_sighand
  
  	return sighand;
  }
diff --git a/target/linux/generic-2.6/patches-2.6.32/999-use_preinit_as_init.patch b/target/linux/generic-2.6/patches-2.6.32/999-use_preinit_as_init.patch
index 0a52a87e8..c1f8ef075 100644
--- a/target/linux/generic-2.6/patches-2.6.32/999-use_preinit_as_init.patch
+++ b/target/linux/generic-2.6/patches-2.6.32/999-use_preinit_as_init.patch
@@ -1,6 +1,6 @@
 --- a/init/main.c
 +++ b/init/main.c
-@@ -836,10 +836,7 @@ static noinline int init_post(void)
+@@ -831,10 +831,7 @@ static noinline int init_post(void)
  		printk(KERN_WARNING "Failed to execute %s.  Attempting "
  					"defaults...\n", execute_command);
  	}
diff --git a/target/linux/ixp4xx/Makefile b/target/linux/ixp4xx/Makefile
index f65dc91d3..cf4173b6f 100644
--- a/target/linux/ixp4xx/Makefile
+++ b/target/linux/ixp4xx/Makefile
@@ -12,7 +12,7 @@ BOARDNAME:=Intel IXP4xx
 FEATURES:=squashfs
 SUBTARGETS=generic harddisk
 
-LINUX_VERSION:=2.6.32.16
+LINUX_VERSION:=2.6.32.25
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/orion/Makefile b/target/linux/orion/Makefile
index 84845d3be..63a23ee4d 100644
--- a/target/linux/orion/Makefile
+++ b/target/linux/orion/Makefile
@@ -13,7 +13,7 @@ FEATURES:=squashfs
 SUBTARGETS=generic harddisk
 CFLAGS=-Os -pipe -march=armv5t -mtune=xscale -funit-at-a-time
 
-LINUX_VERSION:=2.6.32.16
+LINUX_VERSION:=2.6.32.25
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/ppc40x/Makefile b/target/linux/ppc40x/Makefile
index 29d7f0d9b..2d0af9439 100644
--- a/target/linux/ppc40x/Makefile
+++ b/target/linux/ppc40x/Makefile
@@ -12,7 +12,7 @@ BOARDNAME:=AMCC/IBM PPC40x
 FEATURES:=squashfs
 CFLAGS:=-Os -pipe -funit-at-a-time -mcpu=405
 
-LINUX_VERSION:=2.6.32.16
+LINUX_VERSION:=2.6.32.25
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/ppc44x/Makefile b/target/linux/ppc44x/Makefile
index bd8157a19..599a1d198 100644
--- a/target/linux/ppc44x/Makefile
+++ b/target/linux/ppc44x/Makefile
@@ -12,7 +12,7 @@ BOARDNAME:=AMCC/IBM PPC44x
 FEATURES:=squashfs
 CFLAGS:=-Os -pipe -funit-at-a-time -mcpu=440
 
-LINUX_VERSION:=2.6.32.16
+LINUX_VERSION:=2.6.32.25
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/rb532/Makefile b/target/linux/rb532/Makefile
index f400b77bd..3a2afbe45 100644
--- a/target/linux/rb532/Makefile
+++ b/target/linux/rb532/Makefile
@@ -11,7 +11,7 @@ BOARD:=rb532
 BOARDNAME:=Mikrotik RouterBoard 532
 FEATURES:=jffs2 pci targz
 
-LINUX_VERSION:=2.6.32.16
+LINUX_VERSION:=2.6.32.25
 
 include $(INCLUDE_DIR)/target.mk
 DEFAULT_PACKAGES += wpad-mini kmod-madwifi kmod-input-rb532
diff --git a/target/linux/x86/Makefile b/target/linux/x86/Makefile
index 9a7ea84a2..7da783d79 100644
--- a/target/linux/x86/Makefile
+++ b/target/linux/x86/Makefile
@@ -12,7 +12,7 @@ BOARDNAME:=x86
 FEATURES:=squashfs jffs2 ext2 vdi vmdk pcmcia targz
 SUBTARGETS=generic olpc xen_domu ep80579
 
-LINUX_VERSION:=2.6.32.16
+LINUX_VERSION:=2.6.32.25
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/xburst/Makefile b/target/linux/xburst/Makefile
index 32e85cf33..3341b2798 100644
--- a/target/linux/xburst/Makefile
+++ b/target/linux/xburst/Makefile
@@ -12,7 +12,7 @@ BOARDNAME:=Ingenic XBurst
 FEATURES:=jffs2 targz ubifs audio
 SUBTARGETS:=qi_lb60 n516 n526
 
-LINUX_VERSION:=2.6.32.16
+LINUX_VERSION:=2.6.32.25
 
 DEVICE_TYPE=other
 
diff --git a/tools/Makefile b/tools/Makefile
index a44095b4e..83a50bcda 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -37,7 +37,7 @@ endif
 $(curdir)/pkg-config/compile := $(curdir)/sed/install
 $(curdir)/squashfs/compile := $(curdir)/lzma-old/install
 $(curdir)/squashfs4/compile := $(curdir)/lzma/install
-$(curdir)/quilt/compile := $(curdir)/sed/install
+$(curdir)/quilt/compile := $(curdir)/sed/install $(curdir)/autoconf/install
 $(curdir)/dtc/compile := $(curdir)/bison/install
 $(curdir)/autoconf/compile := $(curdir)/m4/install
 $(curdir)/automake/compile := $(curdir)/m4/install $(curdir)/autoconf/install
diff --git a/tools/ipkg-utils/patches/170-resolve_conffiles.patch b/tools/ipkg-utils/patches/170-resolve_conffiles.patch
new file mode 100644
index 000000000..31faf30a0
--- /dev/null
+++ b/tools/ipkg-utils/patches/170-resolve_conffiles.patch
@@ -0,0 +1,23 @@
+--- a/ipkg-build
++++ b/ipkg-build
+@@ -160,12 +160,15 @@ You probably want to chown these to a sy
+ 	done
+ 
+ 	if [ -f $CONTROL/conffiles ]; then
+-		for cf in `cat $CONTROL/conffiles`; do
+-			if [ ! -f ./$cf ]; then
+-				echo "*** Error: $CONTROL/conffiles mentions conffile $cf which does not exist" >&2
+-				PKG_ERROR=1
+-			fi
++		rm -f $CONTROL/conffiles.resolved
++
++		for cf in `$FIND $(sed -e "s!^/!$pkg_dir/!" $CONTROL/conffiles) -type f`; do
++			echo "${cf#$pkg_dir}" >> $CONTROL/conffiles.resolved
+ 		done
++
++		rm $CONTROL/conffiles
++		mv $CONTROL/conffiles.resolved $CONTROL/conffiles
++		chmod 0644 $CONTROL/conffiles
+ 	fi
+ 
+ 	cd $owd