diff --git a/package/iwcap/Makefile b/package/iwcap/Makefile
new file mode 100644
index 0000000000..b406bdfb4f
--- /dev/null
+++ b/package/iwcap/Makefile
@@ -0,0 +1,50 @@
+#
+# Copyright (C) 2012 Jo-Philipp Wich <jow@openwrt.org>
+#
+# This is free software, licensed under the Apache 2 license.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=iwcap
+PKG_RELEASE:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+
+define Package/iwcap
+  SECTION:=utils
+  CATEGORY:=Utilities
+  TITLE:=Simple radiotap capture utility
+  MAINTAINER:=Jo-Philipp Wich <jow@openwrt.org>
+endef
+
+define Package/iwcap/description
+  The iwcap utility receives radiotap packet data from wifi monitor interfaces
+  and outputs it to pcap format. It gathers recived packets in a fixed ring
+  buffer to dump them on demand which is useful for background monitoring.
+  Alternatively the utility can stream the data to stdout to act as remote
+  capture drone for Wireshark or similar programs.
+endef
+
+
+define Build/Prepare
+	$(INSTALL_DIR) $(PKG_BUILD_DIR)
+	$(CP) ./src/* $(PKG_BUILD_DIR)/
+endef
+
+define Build/Configure
+endef
+
+define Build/Compile
+	$(TARGET_CC) $(TARGET_CFLAGS) \
+		-o $(PKG_BUILD_DIR)/iwcap $(PKG_BUILD_DIR)/iwcap.c
+endef
+
+
+define Package/iwcap/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/iwcap $(1)/usr/sbin/iwcap
+endef
+
+$(eval $(call BuildPackage,iwcap))
diff --git a/package/iwcap/src/iwcap.c b/package/iwcap/src/iwcap.c
new file mode 100644
index 0000000000..a71dca2320
--- /dev/null
+++ b/package/iwcap/src/iwcap.c
@@ -0,0 +1,582 @@
+/*
+ * iwcap.c - A simply radiotap capture utility outputting pcap dumps
+ *
+ *    Copyright 2012 Jo-Philipp Wich <jow@openwrt.org>
+ *
+ *    Licensed under the Apache License, Version 2.0 (the "License");
+ *    you may not use this file except in compliance with the License.
+ *    You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *    Unless required by applicable law or agreed to in writing, software
+ *    distributed under the License is distributed on an "AS IS" BASIS,
+ *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *    See the License for the specific language governing permissions and
+ *    limitations under the License.
+ *
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <unistd.h>
+#include <string.h>
+#include <signal.h>
+#include <syslog.h>
+#include <errno.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <net/ethernet.h>
+#include <net/if.h>
+#include <netinet/in.h>
+#include <linux/if_packet.h>
+
+#define ARPHRD_IEEE80211_RADIOTAP	803
+
+#define DLT_IEEE802_11_RADIO		127
+#define LEN_IEEE802_11_HDR			32
+
+#define FRAMETYPE_MASK				0xFC
+#define FRAMETYPE_BEACON			0x80
+#define FRAMETYPE_DATA				0x08
+
+#if __BYTE_ORDER == __BIG_ENDIAN
+#define le16(x) __bswap_16(x)
+#else
+#define le16(x) (x)
+#endif
+
+uint8_t run_dump   = 0;
+uint8_t run_stop   = 0;
+uint8_t run_daemon = 0;
+
+uint32_t frames_captured = 0;
+uint32_t frames_filtered = 0;
+
+int capture_sock = -1;
+const char *ifname = NULL;
+
+
+struct ringbuf {
+	uint32_t len;            /* number of slots */
+	uint32_t fill;           /* last used slot */
+	uint32_t slen;           /* slot size */
+	void *buf;               /* ring memory */
+};
+
+struct ringbuf_entry {
+	uint32_t len;            /* used slot memory */
+	uint32_t olen;           /* original data size */
+	uint32_t sec;            /* epoch of slot creation */
+	uint32_t usec;			 /* epoch microseconds */
+};
+
+typedef struct pcap_hdr_s {
+	uint32_t magic_number;   /* magic number */
+	uint16_t version_major;  /* major version number */
+	uint16_t version_minor;  /* minor version number */
+	int32_t  thiszone;       /* GMT to local correction */
+	uint32_t sigfigs;        /* accuracy of timestamps */
+	uint32_t snaplen;        /* max length of captured packets, in octets */
+	uint32_t network;        /* data link type */
+} pcap_hdr_t;
+
+typedef struct pcaprec_hdr_s {
+	uint32_t ts_sec;         /* timestamp seconds */
+	uint32_t ts_usec;        /* timestamp microseconds */
+	uint32_t incl_len;       /* number of octets of packet saved in file */
+	uint32_t orig_len;       /* actual length of packet */
+} pcaprec_hdr_t;
+
+typedef struct ieee80211_radiotap_header {
+	u_int8_t  it_version;    /* set to 0 */
+	u_int8_t  it_pad;
+	u_int16_t it_len;        /* entire length */
+	u_int32_t it_present;    /* fields present */
+} __attribute__((__packed__)) radiotap_hdr_t;
+
+
+int check_type(void)
+{
+	struct ifreq ifr;
+
+	strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
+
+	if (ioctl(capture_sock, SIOCGIFHWADDR, &ifr) < 0)
+		return -1;
+
+	return (ifr.ifr_hwaddr.sa_family == ARPHRD_IEEE80211_RADIOTAP);
+}
+
+int set_promisc(int on)
+{
+	struct ifreq ifr;
+
+	strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
+
+	if (ioctl(capture_sock, SIOCGIFFLAGS, &ifr) < 0)
+		return -1;
+
+	if (on && !(ifr.ifr_flags & IFF_PROMISC))
+	{
+		ifr.ifr_flags |= IFF_PROMISC;
+
+		if (ioctl(capture_sock, SIOCSIFFLAGS, &ifr))
+			return -1;
+
+		return 1;
+	}
+	else if (!on && (ifr.ifr_flags & IFF_PROMISC))
+	{
+		ifr.ifr_flags &= ~IFF_PROMISC;
+
+		if (ioctl(capture_sock, SIOCSIFFLAGS, &ifr))
+			return -1;
+
+		return 1;
+	}
+
+	return 0;
+}
+
+
+void sig_dump(int sig)
+{
+	run_dump = 1;
+}
+
+void sig_teardown(int sig)
+{
+	run_stop = 1;
+}
+
+
+void write_pcap_header(FILE *o)
+{
+	pcap_hdr_t ghdr = {
+		.magic_number  = 0xa1b2c3d4,
+		.version_major = 2,
+		.version_minor = 4,
+		.thiszone      = 0,
+		.sigfigs       = 0,
+		.snaplen       = 0xFFFF,
+		.network       = DLT_IEEE802_11_RADIO
+	};
+
+	fwrite(&ghdr, 1, sizeof(ghdr), o);
+}
+
+void write_pcap_frame(FILE *o, uint32_t *sec, uint32_t *usec,
+					  uint16_t len, uint16_t olen)
+{
+	struct timeval tv;
+	pcaprec_hdr_t fhdr;
+
+	if (!sec || !usec)
+	{
+		gettimeofday(&tv, NULL);
+	}
+	else
+	{
+		tv.tv_sec  = *sec;
+		tv.tv_usec = *usec;
+	}
+
+	fhdr.ts_sec   = tv.tv_sec;
+	fhdr.ts_usec  = tv.tv_usec;
+	fhdr.incl_len = len;
+	fhdr.orig_len = olen;
+
+	fwrite(&fhdr, 1, sizeof(fhdr), o);
+}
+
+
+struct ringbuf * ringbuf_init(uint32_t num_item, uint16_t len_item)
+{
+	static struct ringbuf r;
+
+	if (len_item <= 0)
+		return NULL;
+
+	r.buf = malloc(num_item * (len_item + sizeof(struct ringbuf_entry)));
+
+	if (r.buf)
+	{
+		r.len = num_item;
+		r.fill = 0;
+		r.slen = (len_item + sizeof(struct ringbuf_entry));
+
+		memset(r.buf, 0, num_item * len_item);
+
+		return &r;
+	}
+
+	return NULL;
+}
+
+struct ringbuf_entry * ringbuf_add(struct ringbuf *r)
+{
+	struct timeval t;
+	struct ringbuf_entry *e;
+
+	gettimeofday(&t, NULL);
+
+	e = r->buf + (r->fill++ * r->slen);
+	r->fill %= r->len;
+
+	memset(e, 0, r->slen);
+
+	e->sec = t.tv_sec;
+	e->usec = t.tv_usec;
+
+	return e;
+}
+
+struct ringbuf_entry * ringbuf_get(struct ringbuf *r, int i)
+{
+	struct ringbuf_entry *e = r->buf + (((r->fill + i) % r->len) * r->slen);
+
+	if (e->len > 0)
+		return e;
+
+	return NULL;
+}
+
+void ringbuf_free(struct ringbuf *r)
+{
+	free(r->buf);
+	memset(r, 0, sizeof(*r));
+}
+
+
+void msg(const char *fmt, ...)
+{
+	va_list ap;
+	va_start(ap, fmt);
+
+	if (run_daemon)
+		vsyslog(LOG_INFO | LOG_USER, fmt, ap);
+	else
+		vfprintf(stderr, fmt, ap);
+
+	va_end(ap);
+}
+
+
+int main(int argc, char **argv)
+{
+	int i, n;
+	struct ringbuf *ring;
+	struct ringbuf_entry *e;
+	struct sockaddr_ll local = {
+		.sll_family   = AF_PACKET,
+		.sll_protocol = htons(ETH_P_ALL)
+	};
+
+	radiotap_hdr_t *rhdr;
+
+	uint8_t frametype;
+	uint8_t pktbuf[0xFFFF];
+	ssize_t pktlen;
+
+	FILE *o;
+
+	int opt;
+
+	uint8_t promisc        = 0;
+	uint8_t streaming      = 0;
+	uint8_t foreground     = 0;
+	uint8_t filter_data    = 0;
+	uint8_t filter_beacon  = 0;
+	uint8_t header_written = 0;
+
+	uint32_t ringsz   = 1024 * 1024; /* 1 Mbyte ring buffer */
+	uint16_t pktcap   = 256;		 /* truncate frames after 265KB */
+
+	const char *output = NULL;
+
+
+	while ((opt = getopt(argc, argv, "i:r:c:o:sfhBD")) != -1)
+	{
+		switch (opt)
+		{
+		case 'i':
+			ifname = optarg;
+			if (!(local.sll_ifindex = if_nametoindex(ifname)))
+			{
+				msg("Unknown interface '%s'\n", ifname);
+				return 2;
+			}
+			break;
+
+		case 'r':
+			ringsz = atoi(optarg);
+			if (ringsz < (3 * pktcap))
+			{
+				msg("Ring size of %d bytes is too short, "
+					"must be at least %d bytes\n", ringsz, 3 * pktcap);
+				return 3;
+			}
+			break;
+
+		case 'c':
+			pktcap = atoi(optarg);
+			if (pktcap <= (sizeof(radiotap_hdr_t) + LEN_IEEE802_11_HDR))
+			{
+				msg("Packet truncate after %d bytes is too short, "
+					"must be at least %d bytes\n",
+					pktcap, sizeof(radiotap_hdr_t) + LEN_IEEE802_11_HDR);
+				return 4;
+			}
+			break;
+
+		case 's':
+			streaming = 1;
+			break;
+
+		case 'o':
+			output = optarg;
+			break;
+
+		case 'B':
+			filter_beacon = 1;
+			break;
+
+		case 'D':
+			filter_data = 1;
+			break;
+
+		case 'f':
+			foreground = 1;
+			break;
+
+		case 'h':
+			msg(
+				"Usage:\n"
+				"  %s -i {iface} -s [-b] [-d]\n"
+				"  %s -i {iface} -o {file} [-r len] [-c len] [-B] [-D] [-f]\n"
+				"\n"
+				"  -i iface\n"
+				"    Specify interface to use, must be in monitor mode and\n"
+				"    produce IEEE 802.11 Radiotap headers.\n\n"
+				"  -s\n"
+				"    Stream to stdout instead of Dumping to file on USR1.\n\n"
+				"  -o file\n"
+				"    Write current ringbuffer contents to given output file\n"
+				"    on receipt of SIGUSR1.\n\n"
+				"  -r len\n"
+				"    Specify the amount of bytes to use for the ringbuffer.\n"
+				"    The default length is %d bytes.\n\n"
+				"  -c len\n"
+				"    Truncate captured packets after given amount of bytes.\n"
+				"    The default size limit is %d bytes.\n\n"
+				"  -B\n"
+				"    Don't store beacon frames in ring, default is keep.\n\n"
+				"  -D\n"
+				"    Don't store data frames in ring, default is keep.\n\n"
+				"  -f\n"
+				"    Do not daemonize but keep running in foreground.\n\n"
+				"  -h\n"
+				"    Display this help.\n\n",
+				argv[0], argv[0], ringsz, pktcap);
+
+			return 1;
+		}
+	}
+
+	if (!streaming && !output)
+	{
+		msg("No output file specified\n");
+		return 1;
+	}
+
+	if (streaming && output)
+	{
+		msg("The -s and -o options are exclusive\n");
+		return 1;
+	}
+
+	if (streaming && isatty(1))
+	{
+		msg("Refusing to stream into a terminal\n");
+		return 1;
+	}
+
+	if (!local.sll_ifindex)
+	{
+		msg("No interface specified\n");
+		return 2;
+	}
+
+	if (!check_type())
+	{
+		msg("Bad interface: not ARPHRD_IEEE80211_RADIOTAP\n");
+		return 2;
+	}
+
+	if ((capture_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL))) < 0)
+	{
+		msg("Unable to create raw socket: %s\n",
+				strerror(errno));
+		return 6;
+	}
+
+	if (bind(capture_sock, (struct sockaddr *)&local, sizeof(local)) == -1)
+	{
+		msg("Unable to bind to interface: %s\n",
+			strerror(errno));
+		return 7;
+	}
+
+	if (!streaming)
+	{
+		if (!foreground)
+		{
+			switch (fork())
+			{
+				case -1:
+					msg("Unable to fork: %s\n", strerror(errno));
+					return 8;
+
+				case 0:
+					umask(0077);
+					chdir("/");
+					freopen("/dev/null", "r", stdin);
+					freopen("/dev/null", "w", stdout);
+					freopen("/dev/null", "w", stderr);
+					run_daemon = 1;
+					break;
+
+				default:
+					msg("Daemon launched ...\n");
+					return 0;
+			}
+		}
+
+		msg("Monitoring interface %s ...\n", ifname);
+
+		if (!(ring = ringbuf_init(ringsz / pktcap, pktcap)))
+		{
+			msg("Unable to allocate ring buffer: %s\n",
+				strerror(errno));
+			return 5;
+		}
+
+		msg(" * Using %d bytes ringbuffer with %d slots\n", ringsz, ring->len);
+		msg(" * Truncating frames at %d bytes\n", pktcap);
+		msg(" * Dumping data to file %s\n", output);
+
+		signal(SIGUSR1, sig_dump);
+	}
+	else
+	{
+		msg("Monitoring interface %s ...\n", ifname);
+		msg(" * Streaming data to stdout\n");
+	}
+
+	msg(" * Beacon frames are %sfiltered\n", filter_beacon ? "" : "not ");
+	msg(" * Data frames are %sfiltered\n", filter_data ? "" : "not ");
+
+	signal(SIGINT, sig_teardown);
+	signal(SIGTERM, sig_teardown);
+
+	promisc = set_promisc(1);
+
+	/* capture loop */
+	while (1)
+	{
+		if (run_stop)
+		{
+			msg("Shutting down ...\n");
+
+			if (promisc)
+				set_promisc(0);
+
+			if (ring)
+				ringbuf_free(ring);
+
+			return 0;
+		}
+		else if (run_dump)
+		{
+			msg("Dumping ring to %s ...\n", output);
+
+			if (!(o = fopen(output, "w")))
+			{
+				msg("Unable to open %s: %s\n",
+					output, strerror(errno));
+			}
+			else
+			{
+				write_pcap_header(o);
+
+				/* sig_dump packet buffer */
+				for (i = 0, n = 0; i < ring->len; i++)
+				{
+					if (!(e = ringbuf_get(ring, i)))
+						continue;
+
+					write_pcap_frame(o, &(e->sec), &(e->usec), e->len, e->olen);
+					fwrite((void *)e + sizeof(*e), 1, e->len, o);
+					n++;
+				}
+
+				fclose(o);
+
+				msg(" * %d frames captured\n", frames_captured);
+				msg(" * %d frames filtered\n", frames_filtered);
+				msg(" * %d frames dumped\n", n);
+			}
+
+			run_dump = 0;
+		}
+
+		pktlen = recvfrom(capture_sock, pktbuf, sizeof(pktbuf), 0, NULL, 0);
+		frames_captured++;
+
+		/* check received frametype, if we should filter it, rewind the ring */
+		rhdr = (radiotap_hdr_t *)pktbuf;
+
+		if (pktlen <= sizeof(radiotap_hdr_t) || le16(rhdr->it_len) >= pktlen)
+		{
+			frames_filtered++;
+			continue;
+		}
+
+		frametype = *(uint8_t *)(pktbuf + le16(rhdr->it_len));
+
+		if ((filter_data   && (frametype & FRAMETYPE_MASK) == FRAMETYPE_DATA) ||
+		    (filter_beacon && (frametype & FRAMETYPE_MASK) == FRAMETYPE_BEACON))
+		{
+			frames_filtered++;
+			continue;
+		}
+
+		if (streaming)
+		{
+			if (!header_written)
+			{
+				write_pcap_header(stdout);
+				header_written = 1;
+			}
+
+			write_pcap_frame(stdout, NULL, NULL, pktlen, pktlen);
+			fwrite(pktbuf, 1, pktlen, stdout);
+			fflush(stdout);
+		}
+		else
+		{
+			e = ringbuf_add(ring);
+			e->olen = pktlen;
+			e->len = (pktlen > pktcap) ? pktcap : pktlen;
+
+			memcpy((void *)e + sizeof(*e), pktbuf, e->len);
+		}
+	}
+
+	return 0;
+}
diff --git a/package/mac80211/Makefile b/package/mac80211/Makefile
index a1edc717f1..0eb6fa803e 100644
--- a/package/mac80211/Makefile
+++ b/package/mac80211/Makefile
@@ -10,10 +10,10 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=mac80211
 
-PKG_VERSION:=2012-02-06
-PKG_RELEASE:=4
+PKG_VERSION:=2012-02-27
+PKG_RELEASE:=1
 PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
-PKG_MD5SUM:=fae71c35ee3f3de6329f2db7aed6d265
+PKG_MD5SUM:=ccd51c46813c25090ce657c8b7c67615
 
 PKG_SOURCE:=compat-wireless-$(PKG_VERSION).tar.bz2
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/compat-wireless-$(PKG_VERSION)
@@ -1297,13 +1297,14 @@ define Build/Prepare
 	$(TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(PKG_LINUX_FIRMWARE_SOURCE)
 	rm -rf $(PKG_BUILD_DIR)/include/linux/ssb
 	rm -rf $(PKG_BUILD_DIR)/include/linux/bcma
+	rm -f $(PKG_BUILD_DIR)/include/linux/eeprom_93cx6.h
 	rm -f $(PKG_BUILD_DIR)/include/net/ieee80211.h
 endef
 
 ifneq ($(CONFIG_PACKAGE_kmod-cfg80211)$(CONFIG_PACKAGE_kmod-lib80211),)
  define Build/Compile/kmod
 	rm -rf $(PKG_BUILD_DIR)/modules
-	$(MAKE) $(PKG_JOBS) -C "$(PKG_BUILD_DIR)" $(MAKE_OPTS) all
+	$(MAKE) $(PKG_JOBS) -C "$(PKG_BUILD_DIR)" $(MAKE_OPTS) modules
  endef
 endif
 
diff --git a/package/mac80211/patches/000-disable_ethernet.patch b/package/mac80211/patches/000-disable_ethernet.patch
index be1f4bdb4d..a6d708ec5a 100644
--- a/package/mac80211/patches/000-disable_ethernet.patch
+++ b/package/mac80211/patches/000-disable_ethernet.patch
@@ -1,6 +1,6 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -32,9 +32,6 @@ obj-$(CONFIG_COMPAT_WIRELESS_MODULES) +=
+@@ -26,9 +26,6 @@ obj-$(CONFIG_COMPAT_WIRELESS_MODULES) +=
  
  obj-$(CONFIG_COMPAT_NET_USB_MODULES) += drivers/net/usb/
  
diff --git a/package/mac80211/patches/001-disable_b44.patch b/package/mac80211/patches/001-disable_b44.patch
index d6242587f0..8b5f3e60c7 100644
--- a/package/mac80211/patches/001-disable_b44.patch
+++ b/package/mac80211/patches/001-disable_b44.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -380,8 +380,8 @@ CONFIG_B43_BCMA_EXTRA=y
+@@ -368,8 +368,8 @@ CONFIG_B43_BCMA_EXTRA=y
  
  CONFIG_P54_PCI=m
  
diff --git a/package/mac80211/patches/002-disable_rfkill.patch b/package/mac80211/patches/002-disable_rfkill.patch
index 4380d93910..94249413ba 100644
--- a/package/mac80211/patches/002-disable_rfkill.patch
+++ b/package/mac80211/patches/002-disable_rfkill.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -95,7 +95,7 @@ endif # build check
+@@ -83,7 +83,7 @@ endif # build check
  endif # kernel Makefile check
  
  # These both are needed by compat-wireless || compat-bluetooth so enable them
@@ -9,7 +9,7 @@
  
  ifeq ($(CONFIG_MAC80211),y)
  $(error "ERROR: you have MAC80211 compiled into the kernel, CONFIG_MAC80211=y, as such you cannot replace its mac80211 driver. You need this set to CONFIG_MAC80211=m. If you are using Fedora upgrade your kernel as later version should this set as modular. For further information on Fedora see https://bugzilla.redhat.com/show_bug.cgi?id=470143. If you are using your own kernel recompile it and make mac80211 modular")
-@@ -684,10 +684,10 @@ endif #CONFIG_COMPAT_KERNEL_2_6_27
+@@ -674,10 +674,10 @@ endif #CONFIG_COMPAT_KERNEL_2_6_27
  # We need the backported rfkill module on kernel < 2.6.31.
  # In more recent kernel versions use the in kernel rfkill module.
  ifdef CONFIG_COMPAT_KERNEL_2_6_31
diff --git a/package/mac80211/patches/003-disable_bt.patch b/package/mac80211/patches/003-disable_bt.patch
index d93b0cd2c0..fc433d1c0f 100644
--- a/package/mac80211/patches/003-disable_bt.patch
+++ b/package/mac80211/patches/003-disable_bt.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -117,8 +117,8 @@ ifndef CONFIG_COMPAT_KERNEL_2_6_27
+@@ -105,8 +105,8 @@ ifndef CONFIG_COMPAT_KERNEL_2_6_27
  ifeq ($(CONFIG_BT),y)
  # we'll ignore compiling bluetooth
  else
diff --git a/package/mac80211/patches/005-disable_ssb_build.patch b/package/mac80211/patches/005-disable_ssb_build.patch
index a67168af64..9b39e76be1 100644
--- a/package/mac80211/patches/005-disable_ssb_build.patch
+++ b/package/mac80211/patches/005-disable_ssb_build.patch
@@ -1,6 +1,6 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -32,7 +32,6 @@ obj-$(CONFIG_COMPAT_WIRELESS_MODULES) +=
+@@ -26,7 +26,6 @@ obj-$(CONFIG_COMPAT_WIRELESS_MODULES) +=
  
  obj-$(CONFIG_COMPAT_NET_USB_MODULES) += drivers/net/usb/
  
@@ -18,7 +18,7 @@
  else
  include $(KLIB_BUILD)/.config
  endif
-@@ -356,7 +355,8 @@ CONFIG_IPW2200_QOS=y
+@@ -344,7 +343,8 @@ CONFIG_IPW2200_QOS=y
  # % echo 1 > /sys/bus/pci/drivers/ipw2200/*/rtap_iface
  endif #CONFIG_WIRELESS_EXT
  
@@ -28,7 +28,7 @@
  # Sonics Silicon Backplane
  CONFIG_SSB_SPROM=y
  
-@@ -369,7 +369,7 @@ endif #CONFIG_PCMCIA
+@@ -357,7 +357,7 @@ endif #CONFIG_PCMCIA
  # CONFIG_SSB_DEBUG=y
  CONFIG_SSB_DRIVER_PCICORE=y
  CONFIG_B43_SSB=y
@@ -37,7 +37,7 @@
  
  CONFIG_BCMA=m
  CONFIG_BCMA_BLOCKIO=y
-@@ -578,7 +578,6 @@ endif #CONFIG_SPI_MASTER end of SPI driv
+@@ -568,7 +568,6 @@ endif #CONFIG_SPI_MASTER end of SPI driv
  
  ifdef CONFIG_MMC
  
diff --git a/package/mac80211/patches/006-disable_bcma_build.patch b/package/mac80211/patches/006-disable_bcma_build.patch
index 9ac0f0e92b..f79cbcbe19 100644
--- a/package/mac80211/patches/006-disable_bcma_build.patch
+++ b/package/mac80211/patches/006-disable_bcma_build.patch
@@ -1,6 +1,6 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -32,7 +32,6 @@ obj-$(CONFIG_COMPAT_WIRELESS_MODULES) +=
+@@ -26,7 +26,6 @@ obj-$(CONFIG_COMPAT_WIRELESS_MODULES) +=
  
  obj-$(CONFIG_COMPAT_NET_USB_MODULES) += drivers/net/usb/
  
@@ -10,7 +10,7 @@
  ifeq ($(CONFIG_STAGING_EXCLUDE_BUILD),)
 --- a/config.mk
 +++ b/config.mk
-@@ -371,12 +371,12 @@ CONFIG_SSB_DRIVER_PCICORE=y
+@@ -359,12 +359,12 @@ CONFIG_SSB_DRIVER_PCICORE=y
  CONFIG_B43_SSB=y
  endif #__CONFIG_SSB
  
diff --git a/package/mac80211/patches/007-remove_misc_drivers.patch b/package/mac80211/patches/007-remove_misc_drivers.patch
index b8c785388b..750b95d2d2 100644
--- a/package/mac80211/patches/007-remove_misc_drivers.patch
+++ b/package/mac80211/patches/007-remove_misc_drivers.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -254,7 +254,7 @@ $(warning "WARNING: CONFIG_CFG80211_WEXT
+@@ -242,7 +242,7 @@ $(warning "WARNING: CONFIG_CFG80211_WEXT
  endif #CONFIG_WIRELESS_EXT
  
  ifdef CONFIG_STAGING
@@ -9,7 +9,7 @@
  endif #CONFIG_STAGING
  
  # mac80211 test driver
-@@ -408,13 +408,13 @@ endif #CONFIG_CRC_ITU_T
+@@ -396,15 +396,15 @@ endif #CONFIG_CRC_ITU_T
  CONFIG_MWL8K=m
  
  # Ethernet drivers go here
@@ -21,14 +21,18 @@
 +# CONFIG_ATL1E=m
  ifdef CONFIG_COMPAT_KERNEL_2_6_27
 -CONFIG_ATL1C=n
+-CONFIG_ALX=m
 +# CONFIG_ATL1C=n
++# CONFIG_ALX=m
  else #CONFIG_COMPAT_KERNEL_2_6_27
--CONFIG_ATL1C=m
-+# CONFIG_ATL1C=m
+-CONFIG_ATL1C=n
+-CONFIG_ALX=m
++# CONFIG_ATL1C=n
++# CONFIG_ALX=m
  endif #CONFIG_COMPAT_KERNEL_2_6_27
  
  ifdef CONFIG_WIRELESS_EXT
-@@ -475,21 +475,21 @@ endif #CONFIG_COMPAT_KERNEL_2_6_29
+@@ -465,21 +465,21 @@ endif #CONFIG_COMPAT_KERNEL_2_6_29
  # Note: this depends on CONFIG_USB_NET_RNDIS_HOST and CONFIG_USB_NET_CDCETHER
  # it also requires new RNDIS_HOST and CDC_ETHER modules which we add
  ifdef CONFIG_COMPAT_KERNEL_2_6_29
diff --git a/package/mac80211/patches/008-disable_mesh.patch b/package/mac80211/patches/008-disable_mesh.patch
index bdefe20df6..aaa27d00f8 100644
--- a/package/mac80211/patches/008-disable_mesh.patch
+++ b/package/mac80211/patches/008-disable_mesh.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -192,7 +192,7 @@ CONFIG_MAC80211_LEDS=y
+@@ -180,7 +180,7 @@ CONFIG_MAC80211_LEDS=y
  endif #CONFIG_LEDS_TRIGGERS
  
  # enable mesh networking too
diff --git a/package/mac80211/patches/009-remove_mac80211_module_dependence.patch b/package/mac80211/patches/009-remove_mac80211_module_dependence.patch
index 2e3753e13c..4fe13d45c6 100644
--- a/package/mac80211/patches/009-remove_mac80211_module_dependence.patch
+++ b/package/mac80211/patches/009-remove_mac80211_module_dependence.patch
@@ -1,26 +1,11 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -58,23 +58,6 @@ $(error "ERROR: Your 2.6.27 kernel has C
+@@ -58,7 +58,7 @@ endif
+ ifeq ($(KERNEL_VERSION),2)
+ ifeq ($(shell test $(KERNEL_VERSION) -eq 2 -a $(KERNEL_26SUBLEVEL) -ge 27 -a $(KERNEL_26SUBLEVEL) -le 31 && echo yes),yes)
+ ifeq ($(CONFIG_MAC80211),)
+-$(error "ERROR: Your >=2.6.27 and <= 2.6.31 kernel has CONFIG_MAC80211 disabled, you should have it CONFIG_MAC80211=m if you want to use this thing.")
++# $(error "ERROR: Your >=2.6.27 and <= 2.6.31 kernel has CONFIG_MAC80211 disabled, you should have it CONFIG_MAC80211=m if you want to use this thing.")
+ endif
  endif
  endif
- 
--# This is because with CONFIG_MAC80211 include/linux/skbuff.h will
--# enable on 2.6.27 a new attribute:
--#
--# skb->do_not_encrypt
--#
--# and on 2.6.28 another new attribute:
--#
--# skb->requeue
--#
--# In kernel 2.6.32 both attributes were removed.
--#
--ifeq ($(shell test $(KERNEL_VERSION) -eq 2 -a $(KERNEL_SUBLEVEL) -ge 27 -a $(KERNEL_SUBLEVEL) -le 31 && echo yes),yes)
--ifeq ($(CONFIG_MAC80211),)
--$(error "ERROR: Your >=2.6.27 and <= 2.6.31 kernel has CONFIG_MAC80211 disabled, you should have it CONFIG_MAC80211=m if you want to use this thing.")
--endif
--endif
--
- ifneq ($(KERNELRELEASE),) # This prevents a warning
- 
- # We will warn when you don't have MQ support or NET_SCHED enabled.
diff --git a/package/mac80211/patches/010-no_pcmcia.patch b/package/mac80211/patches/010-no_pcmcia.patch
index ce833cff6d..3a1f912f14 100644
--- a/package/mac80211/patches/010-no_pcmcia.patch
+++ b/package/mac80211/patches/010-no_pcmcia.patch
@@ -9,7 +9,7 @@
  else
  include $(KLIB_BUILD)/.config
  endif
-@@ -289,7 +289,7 @@ CONFIG_B43=m
+@@ -294,7 +294,7 @@ CONFIG_B43=m
  CONFIG_B43_HWRNG=y
  CONFIG_B43_PCI_AUTOSELECT=y
  ifdef CONFIG_PCMCIA
diff --git a/package/mac80211/patches/011-no_sdio.patch b/package/mac80211/patches/011-no_sdio.patch
index b1ee2cba2c..b724d98aeb 100644
--- a/package/mac80211/patches/011-no_sdio.patch
+++ b/package/mac80211/patches/011-no_sdio.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -561,7 +561,7 @@ endif #CONFIG_SPI_MASTER end of SPI driv
+@@ -568,7 +568,7 @@ endif #CONFIG_SPI_MASTER end of SPI driv
  
  ifdef CONFIG_MMC
  
diff --git a/package/mac80211/patches/013-disable_b43_nphy.patch b/package/mac80211/patches/013-disable_b43_nphy.patch
index 0ff2992907..4340dcc1e3 100644
--- a/package/mac80211/patches/013-disable_b43_nphy.patch
+++ b/package/mac80211/patches/013-disable_b43_nphy.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -295,8 +295,8 @@ ifdef CONFIG_MAC80211_LEDS
+@@ -300,8 +300,8 @@ ifdef CONFIG_MAC80211_LEDS
  CONFIG_B43_LEDS=y
  endif #CONFIG_MAC80211_LEDS
  CONFIG_B43_PHY_LP=y
diff --git a/package/mac80211/patches/015-remove-rt2x00-options.patch b/package/mac80211/patches/015-remove-rt2x00-options.patch
index ecad73168e..259fe7fed6 100644
--- a/package/mac80211/patches/015-remove-rt2x00-options.patch
+++ b/package/mac80211/patches/015-remove-rt2x00-options.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -370,7 +370,7 @@ CONFIG_RTL8180=m
+@@ -375,7 +375,7 @@ CONFIG_RTL8180=m
  
  CONFIG_ADM8211=m
  
@@ -9,7 +9,7 @@
  CONFIG_RT2400PCI=m
  CONFIG_RT2500PCI=m
  ifdef CONFIG_CRC_CCITT
-@@ -510,7 +510,7 @@ CONFIG_RT2800USB_RT35XX=y
+@@ -517,7 +517,7 @@ CONFIG_RT2800USB_RT35XX=y
  CONFIG_RT2800USB_RT53XX=y
  CONFIG_RT2800USB_UNKNOWN=y
  endif #CONFIG_CRC_CCITT
diff --git a/package/mac80211/patches/016-remove_pid_algo.patch b/package/mac80211/patches/016-remove_pid_algo.patch
index 2035d60f09..d356651a90 100644
--- a/package/mac80211/patches/016-remove_pid_algo.patch
+++ b/package/mac80211/patches/016-remove_pid_algo.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -167,7 +167,7 @@ CONFIG_MAC80211_RC_DEFAULT_MINSTREL=y
+@@ -172,7 +172,7 @@ CONFIG_MAC80211_RC_DEFAULT_MINSTREL=y
  # This is the one used by our compat-wireless net/mac80211/rate.c
  # in case you have and old kernel which is overriding this to pid.
  CONFIG_COMPAT_MAC80211_RC_DEFAULT=minstrel_ht
diff --git a/package/mac80211/patches/017-remove_ath9k_rc.patch b/package/mac80211/patches/017-remove_ath9k_rc.patch
index 7fef47f889..fd818adf1a 100644
--- a/package/mac80211/patches/017-remove_ath9k_rc.patch
+++ b/package/mac80211/patches/017-remove_ath9k_rc.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -261,7 +261,7 @@ CONFIG_ATH9K_COMMON=m
+@@ -266,7 +266,7 @@ CONFIG_ATH9K_COMMON=m
  # as default once we get minstrel properly tested and blessed by
  # our systems engineering team. CCK rates also need to be used
  # for long range considerations.
diff --git a/package/mac80211/patches/019-remove_ath5k_pci_option.patch b/package/mac80211/patches/019-remove_ath5k_pci_option.patch
index a11d625715..40a5cfc2d2 100644
--- a/package/mac80211/patches/019-remove_ath5k_pci_option.patch
+++ b/package/mac80211/patches/019-remove_ath5k_pci_option.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -268,7 +268,7 @@ CONFIG_ATH9K_BTCOEX_SUPPORT=y
+@@ -273,7 +273,7 @@ CONFIG_ATH9K_BTCOEX_SUPPORT=y
  # PCI Drivers
  ifdef CONFIG_PCI
  
diff --git a/package/mac80211/patches/060-fix_compat_security.patch b/package/mac80211/patches/060-fix_compat_security.patch
deleted file mode 100644
index dca0e90931..0000000000
--- a/package/mac80211/patches/060-fix_compat_security.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/include/linux/compat-3.1.h
-+++ b/include/linux/compat-3.1.h
-@@ -7,6 +7,8 @@
- 
- #include <linux/security.h>
- 
-+#include <linux/security.h>
-+
- #define genl_dump_check_consistent(cb, user_hdr, family)
- 
- #define IFF_TX_SKB_SHARING	0x10000	/* The interface supports sharing
diff --git a/package/mac80211/patches/100-disable_pcmcia_compat.patch b/package/mac80211/patches/100-disable_pcmcia_compat.patch
index fb5ae7d628..39478ee8c0 100644
--- a/package/mac80211/patches/100-disable_pcmcia_compat.patch
+++ b/package/mac80211/patches/100-disable_pcmcia_compat.patch
@@ -31,7 +31,7 @@
  	struct pcmcia_device *p_dev;
 --- a/include/linux/compat-2.6.28.h
 +++ b/include/linux/compat-2.6.28.h
-@@ -27,7 +27,7 @@
+@@ -44,7 +44,7 @@ typedef u32 phys_addr_t;
  })
  #endif /* From include/asm-generic/bug.h */
  
diff --git a/package/mac80211/patches/110-disable_usb_compat.patch b/package/mac80211/patches/110-disable_usb_compat.patch
index 9700fb320e..c605801485 100644
--- a/package/mac80211/patches/110-disable_usb_compat.patch
+++ b/package/mac80211/patches/110-disable_usb_compat.patch
@@ -22,7 +22,7 @@
   * @anchor: anchor the requests are bound to
 --- a/include/linux/compat-2.6.28.h
 +++ b/include/linux/compat-2.6.28.h
-@@ -52,7 +52,7 @@ int pcmcia_loop_config(struct pcmcia_dev
+@@ -69,7 +69,7 @@ int pcmcia_loop_config(struct pcmcia_dev
  /* USB anchors were added as of 2.6.23 */
  #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23))
  
@@ -33,7 +33,7 @@
  #endif
 --- a/config.mk
 +++ b/config.mk
-@@ -496,7 +496,7 @@ endif #CONFIG_COMPAT_KERNEL_2_6_29
+@@ -503,7 +503,7 @@ endif #CONFIG_COMPAT_KERNEL_2_6_29
  # This activates a threading fix for usb urb.
  # this is mainline commit: b3e670443b7fb8a2d29831b62b44a039c283e351
  # This fix will be included in some stable releases.
diff --git a/package/mac80211/patches/130-fix_sublevel_check.patch b/package/mac80211/patches/130-fix_sublevel_check.patch
deleted file mode 100644
index 9dfa90af32..0000000000
--- a/package/mac80211/patches/130-fix_sublevel_check.patch
+++ /dev/null
@@ -1,22 +0,0 @@
---- a/config.mk
-+++ b/config.mk
-@@ -20,16 +20,16 @@ COMPAT_LATEST_VERSION = 3
- KERNEL_VERSION := $(shell $(MAKE) -C $(KLIB_BUILD) kernelversion | sed -n 's/^\([0-9]\)\..*/\1/p')
- 
- ifneq ($(KERNEL_VERSION),2)
--KERNEL_SUBLEVEL := $(shell $(MAKE) -C $(KLIB_BUILD) kernelversion | sed -n 's/^3\.\([0-9]\+\).*/\1/p')
-+COMPAT_KERNEL_SUBLEVEL := $(shell $(MAKE) -C $(KLIB_BUILD) kernelversion | sed -n 's/^3\.\([0-9]\+\).*/\1/p')
- else
- COMPAT_26LATEST_VERSION = 39
- KERNEL_26SUBLEVEL := $(shell $(MAKE) -C $(KLIB_BUILD) kernelversion | sed -n 's/^2\.6\.\([0-9]\+\).*/\1/p')
- COMPAT_26VERSIONS := $(shell I=$(COMPAT_26LATEST_VERSION); while [ "$$I" -gt $(KERNEL_26SUBLEVEL) ]; do echo $$I; I=$$(($$I - 1)); done)
- $(foreach ver,$(COMPAT_26VERSIONS),$(eval CONFIG_COMPAT_KERNEL_2_6_$(ver)=y))
--KERNEL_SUBLEVEL := -1
-+COMPAT_KERNEL_SUBLEVEL := -1
- endif
- 
--COMPAT_VERSIONS := $(shell I=$(COMPAT_LATEST_VERSION); while [ "$$I" -gt $(KERNEL_SUBLEVEL) ]; do echo $$I; I=$$(($$I - 1)); done)
-+COMPAT_VERSIONS := $(shell I=$(COMPAT_LATEST_VERSION); while [ "$$I" -gt $(COMPAT_KERNEL_SUBLEVEL) ]; do echo $$I; I=$$(($$I - 1)); done)
- $(foreach ver,$(COMPAT_VERSIONS),$(eval CONFIG_COMPAT_KERNEL_3_$(ver)=y))
- 
- RHEL_MAJOR := $(shell grep ^RHEL_MAJOR $(KLIB_BUILD)/Makefile | sed -n 's/.*= *\(.*\)/\1/p')
diff --git a/package/mac80211/patches/140-mesh_pathtbl_backport.patch b/package/mac80211/patches/130-mesh_pathtbl_backport.patch
similarity index 100%
rename from package/mac80211/patches/140-mesh_pathtbl_backport.patch
rename to package/mac80211/patches/130-mesh_pathtbl_backport.patch
diff --git a/package/mac80211/patches/300-pending_work.patch b/package/mac80211/patches/300-pending_work.patch
index 93773d7eba..25ebbb68c8 100644
--- a/package/mac80211/patches/300-pending_work.patch
+++ b/package/mac80211/patches/300-pending_work.patch
@@ -1,3 +1,163 @@
+--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+@@ -510,7 +510,11 @@ int ath9k_hw_process_rxdesc_edma(struct 
+ 		 */
+ 		if (rxsp->status11 & AR_CRCErr)
+ 			rxs->rs_status |= ATH9K_RXERR_CRC;
+-		else if (rxsp->status11 & AR_PHYErr) {
++		else if (rxsp->status11 & AR_DecryptCRCErr)
++			rxs->rs_status |= ATH9K_RXERR_DECRYPT;
++		else if (rxsp->status11 & AR_MichaelErr)
++			rxs->rs_status |= ATH9K_RXERR_MIC;
++		if (rxsp->status11 & AR_PHYErr) {
+ 			phyerr = MS(rxsp->status11, AR_PHYErrCode);
+ 			/*
+ 			 * If we reach a point here where AR_PostDelimCRCErr is
+@@ -532,11 +536,7 @@ int ath9k_hw_process_rxdesc_edma(struct 
+ 				rxs->rs_status |= ATH9K_RXERR_PHY;
+ 				rxs->rs_phyerr = phyerr;
+ 			}
+-
+-		} else if (rxsp->status11 & AR_DecryptCRCErr)
+-			rxs->rs_status |= ATH9K_RXERR_DECRYPT;
+-		else if (rxsp->status11 & AR_MichaelErr)
+-			rxs->rs_status |= ATH9K_RXERR_MIC;
++		};
+ 	}
+ 
+ 	if (rxsp->status11 & AR_KeyMiss)
+--- a/drivers/net/wireless/ath/carl9170/tx.c
++++ b/drivers/net/wireless/ath/carl9170/tx.c
+@@ -1236,6 +1236,7 @@ static bool carl9170_tx_ps_drop(struct a
+ {
+ 	struct ieee80211_sta *sta;
+ 	struct carl9170_sta_info *sta_info;
++	struct ieee80211_tx_info *tx_info;
+ 
+ 	rcu_read_lock();
+ 	sta = __carl9170_get_tx_sta(ar, skb);
+@@ -1243,12 +1244,13 @@ static bool carl9170_tx_ps_drop(struct a
+ 		goto out_rcu;
+ 
+ 	sta_info = (void *) sta->drv_priv;
+-	if (unlikely(sta_info->sleeping)) {
+-		struct ieee80211_tx_info *tx_info;
++	tx_info = IEEE80211_SKB_CB(skb);
+ 
++	if (unlikely(sta_info->sleeping) &&
++	    !(tx_info->flags & (IEEE80211_TX_CTL_NO_PS_BUFFER |
++				IEEE80211_TX_CTL_CLEAR_PS_FILT))) {
+ 		rcu_read_unlock();
+ 
+-		tx_info = IEEE80211_SKB_CB(skb);
+ 		if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
+ 			atomic_dec(&ar->tx_ampdu_upload);
+ 
+--- a/drivers/net/wireless/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/iwlegacy/4965-mac.c
+@@ -1694,7 +1694,7 @@ il4965_tx_skb(struct il_priv *il, struct
+ 		sta_priv = (void *)sta->drv_priv;
+ 
+ 	if (sta_priv && sta_priv->asleep &&
+-	    (info->flags & IEEE80211_TX_CTL_POLL_RESPONSE)) {
++	    (info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER)) {
+ 		/*
+ 		 * This sends an asynchronous command to the device,
+ 		 * but we can rely on it being processed before the
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+@@ -322,7 +322,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv,
+ 		sta_priv = (void *)info->control.sta->drv_priv;
+ 
+ 	if (sta_priv && sta_priv->asleep &&
+-	    (info->flags & IEEE80211_TX_CTL_POLL_RESPONSE)) {
++	    (info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER)) {
+ 		/*
+ 		 * This sends an asynchronous command to the device,
+ 		 * but we can rely on it being processed before the
+@@ -331,6 +331,10 @@ int iwlagn_tx_skb(struct iwl_priv *priv,
+ 		 * counter.
+ 		 * For now set the counter to just 1 since we do not
+ 		 * support uAPSD yet.
++		 *
++		 * FIXME: If we get two non-bufferable frames one
++		 * after the other, we might only send out one of
++		 * them because this is racy.
+ 		 */
+ 		iwl_sta_modify_sleep_tx_count(priv, sta_id, 1);
+ 	}
+--- a/drivers/net/wireless/p54/txrx.c
++++ b/drivers/net/wireless/p54/txrx.c
+@@ -690,7 +690,7 @@ static void p54_tx_80211_header(struct p
+ 	if (!(info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ))
+ 		*flags |= P54_HDR_FLAG_DATA_OUT_SEQNR;
+ 
+-	if (info->flags & IEEE80211_TX_CTL_POLL_RESPONSE)
++	if (info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER)
+ 		*flags |= P54_HDR_FLAG_DATA_OUT_NOCANCEL;
+ 
+ 	if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -341,9 +341,9 @@ struct ieee80211_bss_conf {
+  *	used to indicate that a frame was already retried due to PS
+  * @IEEE80211_TX_INTFL_DONT_ENCRYPT: completely internal to mac80211,
+  *	used to indicate frame should not be encrypted
+- * @IEEE80211_TX_CTL_POLL_RESPONSE: This frame is a response to a poll
+- *	frame (PS-Poll or uAPSD) and should be sent although the station
+- *	is in powersave mode.
++ * @IEEE80211_TX_CTL_NO_PS_BUFFER: This frame is a response to a poll
++ *	frame (PS-Poll or uAPSD) or a non-bufferable MMPDU and must
++ *	be sent although the station is in powersave mode.
+  * @IEEE80211_TX_CTL_MORE_FRAMES: More frames will be passed to the
+  *	transmit function after the current frame, this can be used
+  *	by drivers to kick the DMA queue only if unset or when the
+@@ -399,7 +399,7 @@ enum mac80211_tx_control_flags {
+ 	IEEE80211_TX_INTFL_NEED_TXPROCESSING	= BIT(14),
+ 	IEEE80211_TX_INTFL_RETRIED		= BIT(15),
+ 	IEEE80211_TX_INTFL_DONT_ENCRYPT		= BIT(16),
+-	IEEE80211_TX_CTL_POLL_RESPONSE		= BIT(17),
++	IEEE80211_TX_CTL_NO_PS_BUFFER		= BIT(17),
+ 	IEEE80211_TX_CTL_MORE_FRAMES		= BIT(18),
+ 	IEEE80211_TX_INTFL_RETRANSMISSION	= BIT(19),
+ 	/* hole at 20, use later */
+@@ -425,7 +425,7 @@ enum mac80211_tx_control_flags {
+ 	IEEE80211_TX_CTL_SEND_AFTER_DTIM | IEEE80211_TX_CTL_AMPDU |	      \
+ 	IEEE80211_TX_STAT_TX_FILTERED |	IEEE80211_TX_STAT_ACK |		      \
+ 	IEEE80211_TX_STAT_AMPDU | IEEE80211_TX_STAT_AMPDU_NO_BACK |	      \
+-	IEEE80211_TX_CTL_RATE_CTRL_PROBE | IEEE80211_TX_CTL_POLL_RESPONSE |   \
++	IEEE80211_TX_CTL_RATE_CTRL_PROBE | IEEE80211_TX_CTL_NO_PS_BUFFER |    \
+ 	IEEE80211_TX_CTL_MORE_FRAMES | IEEE80211_TX_CTL_LDPC |		      \
+ 	IEEE80211_TX_CTL_STBC | IEEE80211_TX_STATUS_EOSP)
+ 
+@@ -1634,7 +1634,7 @@ void ieee80211_free_txskb(struct ieee802
+  * the station sends a PS-Poll or a uAPSD trigger frame, mac80211
+  * will inform the driver of this with the @allow_buffered_frames
+  * callback; this callback is optional. mac80211 will then transmit
+- * the frames as usual and set the %IEEE80211_TX_CTL_POLL_RESPONSE
++ * the frames as usual and set the %IEEE80211_TX_CTL_NO_PS_BUFFER
+  * on each frame. The last frame in the service period (or the only
+  * response to a PS-Poll) also has %IEEE80211_TX_STATUS_EOSP set to
+  * indicate that it ends the service period; as this frame must have
+@@ -1642,6 +1642,9 @@ void ieee80211_free_txskb(struct ieee802
+  * When TX status is reported for this frame, the service period is
+  * marked has having ended and a new one can be started by the peer.
+  *
++ * Additionally, non-bufferable MMPDUs can also be transmitted by
++ * mac80211 with the %IEEE80211_TX_CTL_NO_PS_BUFFER set in them.
++ *
+  * Another race condition can happen on some devices like iwlwifi
+  * when there are frames queued for the station and it wakes up
+  * or polls; the frames that are already queued could end up being
+@@ -2140,7 +2143,7 @@ enum ieee80211_frame_release_type {
+  * @allow_buffered_frames: Prepare device to allow the given number of frames
+  *	to go out to the given station. The frames will be sent by mac80211
+  *	via the usual TX path after this call. The TX information for frames
+- *	released will also have the %IEEE80211_TX_CTL_POLL_RESPONSE flag set
++ *	released will also have the %IEEE80211_TX_CTL_NO_PS_BUFFER flag set
+  *	and the last one will also have %IEEE80211_TX_STATUS_EOSP set. In case
+  *	frames from multiple TIDs are released and the driver might reorder
+  *	them between the TIDs, it must set the %IEEE80211_TX_STATUS_EOSP flag
 --- a/net/mac80211/agg-rx.c
 +++ b/net/mac80211/agg-rx.c
 @@ -187,6 +187,8 @@ static void ieee80211_send_addba_resp(st
@@ -94,7 +254,7 @@
   err_stop:
  	if (!local->open_count)
  		drv_stop(local);
-@@ -720,6 +696,70 @@ static void ieee80211_if_setup(struct ne
+@@ -722,6 +698,70 @@ static void ieee80211_if_setup(struct ne
  	dev->destructor = free_netdev;
  }
  
@@ -165,7 +325,7 @@
  static void ieee80211_iface_work(struct work_struct *work)
  {
  	struct ieee80211_sub_if_data *sdata =
-@@ -824,6 +864,9 @@ static void ieee80211_iface_work(struct 
+@@ -826,6 +866,9 @@ static void ieee80211_iface_work(struct 
  				break;
  			ieee80211_mesh_rx_queued_mgmt(sdata, skb);
  			break;
@@ -177,7 +337,7 @@
  			break;
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -2281,6 +2281,7 @@ ieee80211_rx_h_action(struct ieee80211_r
+@@ -2282,6 +2282,7 @@ ieee80211_rx_h_action(struct ieee80211_r
  		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
  		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
  		    sdata->vif.type != NL80211_IFTYPE_AP &&
@@ -185,7 +345,7 @@
  		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
  			break;
  
-@@ -2491,14 +2492,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
+@@ -2492,14 +2493,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
  
  	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
  	    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
@@ -203,7 +363,7 @@
  		break;
  	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
  	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
-@@ -2852,10 +2854,16 @@ static int prepare_for_handlers(struct i
+@@ -2853,10 +2855,16 @@ static int prepare_for_handlers(struct i
  		}
  		break;
  	case NL80211_IFTYPE_WDS:
@@ -224,17 +384,24 @@
  		/* should never get here */
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -1379,8 +1379,10 @@ int sta_info_move_state(struct sta_info 
- 		return -EINVAL;
- 	}
+@@ -1050,7 +1050,7 @@ static void ieee80211_send_null_response
+ 	 * exchange. Also set EOSP to indicate this packet
+ 	 * ends the poll/service period.
+ 	 */
+-	info->flags |= IEEE80211_TX_CTL_POLL_RESPONSE |
++	info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
+ 		       IEEE80211_TX_STATUS_EOSP |
+ 		       IEEE80211_TX_CTL_REQ_TX_STATUS;
  
-+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
- 	printk(KERN_DEBUG "%s: moving STA %pM to state %d\n",
- 		sta->sdata->name, sta->sta.addr, new_state);
-+#endif
+@@ -1177,7 +1177,7 @@ ieee80211_sta_ps_deliver_response(struct
+ 			 * STA may still remain is PS mode after this frame
+ 			 * exchange.
+ 			 */
+-			info->flags |= IEEE80211_TX_CTL_POLL_RESPONSE;
++			info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
  
- 	/*
- 	 * notify the driver before the actual changes so it can
+ 			/*
+ 			 * Use MoreData flag to indicate whether there are
 --- a/net/mac80211/sta_info.h
 +++ b/net/mac80211/sta_info.h
 @@ -31,7 +31,6 @@
@@ -253,120 +420,35 @@
  	WLAN_STA_CLEAR_PS_FILT,
  	WLAN_STA_MFP,
  	WLAN_STA_BLOCK_BA,
---- a/net/mac80211/rate.h
-+++ b/net/mac80211/rate.h
-@@ -37,7 +37,7 @@ static inline void rate_control_tx_statu
- 	struct ieee80211_sta *ista = &sta->sta;
- 	void *priv_sta = sta->rate_ctrl_priv;
- 
--	if (!ref)
-+	if (!ref || !test_sta_flag(sta, WLAN_STA_RATE_CONTROL))
- 		return;
- 
- 	ref->ops->tx_status(ref->priv, sband, ista, priv_sta, skb);
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -915,6 +915,8 @@ int ieee80211_register_hw(struct ieee802
- 		wiphy_debug(local->hw.wiphy, "Failed to initialize wep: %d\n",
- 			    result);
- 
-+	ieee80211_led_init(local);
-+
- 	rtnl_lock();
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -448,18 +448,23 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
+ 	struct ieee80211_local *local = tx->local;
  
- 	result = ieee80211_init_rate_ctrl_alg(local,
-@@ -936,8 +938,6 @@ int ieee80211_register_hw(struct ieee802
+-	if (unlikely(!sta ||
+-		     ieee80211_is_probe_resp(hdr->frame_control) ||
+-		     ieee80211_is_auth(hdr->frame_control) ||
+-		     ieee80211_is_assoc_resp(hdr->frame_control) ||
+-		     ieee80211_is_reassoc_resp(hdr->frame_control)))
++	if (unlikely(!sta))
+ 		return TX_CONTINUE;
  
- 	rtnl_unlock();
+ 	if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||
+ 		      test_sta_flag(sta, WLAN_STA_PS_DRIVER)) &&
+-		     !(info->flags & IEEE80211_TX_CTL_POLL_RESPONSE))) {
++		     !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
+ 		int ac = skb_get_queue_mapping(tx->skb);
  
--	ieee80211_led_init(local);
--
- 	local->network_latency_notifier.notifier_call =
- 		ieee80211_max_network_latency;
- 	result = pm_qos_add_notifier(PM_QOS_NETWORK_LATENCY,
---- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-@@ -489,8 +489,6 @@ static int ar5008_hw_rf_alloc_ext_banks(
- 	ATH_ALLOC_BANK(ah->analogBank6Data, ah->iniBank6.ia_rows);
- 	ATH_ALLOC_BANK(ah->analogBank6TPCData, ah->iniBank6TPC.ia_rows);
- 	ATH_ALLOC_BANK(ah->analogBank7Data, ah->iniBank7.ia_rows);
--	ATH_ALLOC_BANK(ah->addac5416_21,
--		       ah->iniAddac.ia_rows * ah->iniAddac.ia_columns);
- 	ATH_ALLOC_BANK(ah->bank6Temp, ah->iniBank6.ia_rows);
- 
- 	return 0;
-@@ -519,7 +517,6 @@ static void ar5008_hw_rf_free_ext_banks(
- 	ATH_FREE_BANK(ah->analogBank6Data);
- 	ATH_FREE_BANK(ah->analogBank6TPCData);
- 	ATH_FREE_BANK(ah->analogBank7Data);
--	ATH_FREE_BANK(ah->addac5416_21);
- 	ATH_FREE_BANK(ah->bank6Temp);
- 
- #undef ATH_FREE_BANK
-@@ -805,27 +802,7 @@ static int ar5008_hw_process_ini(struct 
- 	if (ah->eep_ops->set_addac)
- 		ah->eep_ops->set_addac(ah, chan);
- 
--	if (AR_SREV_5416_22_OR_LATER(ah)) {
--		REG_WRITE_ARRAY(&ah->iniAddac, 1, regWrites);
--	} else {
--		struct ar5416IniArray temp;
--		u32 addacSize =
--			sizeof(u32) * ah->iniAddac.ia_rows *
--			ah->iniAddac.ia_columns;
--
--		/* For AR5416 2.0/2.1 */
--		memcpy(ah->addac5416_21,
--		       ah->iniAddac.ia_array, addacSize);
--
--		/* override CLKDRV value at [row, column] = [31, 1] */
--		(ah->addac5416_21)[31 * ah->iniAddac.ia_columns + 1] = 0;
--
--		temp.ia_array = ah->addac5416_21;
--		temp.ia_columns = ah->iniAddac.ia_columns;
--		temp.ia_rows = ah->iniAddac.ia_rows;
--		REG_WRITE_ARRAY(&temp, 1, regWrites);
--	}
--
-+	REG_WRITE_ARRAY(&ah->iniAddac, 1, regWrites);
- 	REG_WRITE(ah, AR_PHY_ADC_SERIAL_CTL, AR_PHY_SEL_INTERNAL_ADDAC);
- 
- 	ENABLE_REGWRITE_BUFFER(ah);
---- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
-@@ -180,6 +180,25 @@ static void ar9002_hw_init_mode_regs(str
- 		INIT_INI_ARRAY(&ah->iniAddac, ar5416Addac,
- 			       ARRAY_SIZE(ar5416Addac), 2);
- 	}
-+
-+	/* iniAddac needs to be modified for these chips */
-+	if (AR_SREV_9160(ah) || !AR_SREV_5416_22_OR_LATER(ah)) {
-+		struct ar5416IniArray *addac = &ah->iniAddac;
-+		u32 size = sizeof(u32) * addac->ia_rows * addac->ia_columns;
-+		u32 *data;
-+
-+		data = kmalloc(size, GFP_KERNEL);
-+		if (!data)
-+			return;
-+
-+		memcpy(data, addac->ia_array, size);
-+		addac->ia_array = data;
-+
-+		if (!AR_SREV_5416_22_OR_LATER(ah)) {
-+			/* override CLKDRV value */
-+			INI_RA(addac, 31,1) = 0;
++		/* only deauth, disassoc and action are bufferable MMPDUs */
++		if (ieee80211_is_mgmt(hdr->frame_control) &&
++		    !ieee80211_is_deauth(hdr->frame_control) &&
++		    !ieee80211_is_disassoc(hdr->frame_control) &&
++		    !ieee80211_is_action(hdr->frame_control)) {
++			info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
++			return TX_CONTINUE;
 +		}
-+	}
- }
- 
- /* Support for Japan ch.14 (2484) spread */
---- a/drivers/net/wireless/ath/ath9k/hw.h
-+++ b/drivers/net/wireless/ath/ath9k/hw.h
-@@ -940,7 +940,6 @@ struct ath_hw {
- 	u32 *analogBank6Data;
- 	u32 *analogBank6TPCData;
- 	u32 *analogBank7Data;
--	u32 *addac5416_21;
- 	u32 *bank6Temp;
- 
- 	u8 txpower_limit;
++
+ #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
+ 		printk(KERN_DEBUG "STA %pM aid %d: PS buffer for AC %d\n",
+ 		       sta->sta.addr, sta->sta.aid, ac);
diff --git a/package/mac80211/patches/403-ath9k-fix-invalid-mac-address-handling.patch b/package/mac80211/patches/403-ath9k-fix-invalid-mac-address-handling.patch
index 65853b970a..a9232f2145 100644
--- a/package/mac80211/patches/403-ath9k-fix-invalid-mac-address-handling.patch
+++ b/package/mac80211/patches/403-ath9k-fix-invalid-mac-address-handling.patch
@@ -8,7 +8,7 @@
  #include <asm/unaligned.h>
  
  #include "hw.h"
-@@ -465,8 +466,16 @@ static int ath9k_hw_init_macaddr(struct 
+@@ -466,8 +467,16 @@ static int ath9k_hw_init_macaddr(struct 
  		common->macaddr[2 * i] = eeval >> 8;
  		common->macaddr[2 * i + 1] = eeval & 0xff;
  	}
diff --git a/package/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch b/package/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
index 242c40e05a..6a39995703 100644
--- a/package/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
+++ b/package/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/main.c
 +++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -1454,15 +1454,6 @@ static int ath9k_add_interface(struct ie
+@@ -1430,15 +1430,6 @@ static int ath9k_add_interface(struct ie
  		}
  	}
  
@@ -16,7 +16,7 @@
  	ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
  
  	sc->nvifs++;
-@@ -1487,15 +1478,6 @@ static int ath9k_change_interface(struct
+@@ -1463,15 +1454,6 @@ static int ath9k_change_interface(struct
  	mutex_lock(&sc->mutex);
  	ath9k_ps_wakeup(sc);
  
diff --git a/package/mac80211/patches/500-ath9k_eeprom_debugfs.patch b/package/mac80211/patches/500-ath9k_eeprom_debugfs.patch
index 354598ea45..3bdcb2aac5 100644
--- a/package/mac80211/patches/500-ath9k_eeprom_debugfs.patch
+++ b/package/mac80211/patches/500-ath9k_eeprom_debugfs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1616,6 +1616,53 @@ static const struct file_operations fops
+@@ -1552,6 +1552,53 @@ static const struct file_operations fops
  };
  
  
@@ -54,13 +54,12 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1677,6 +1724,9 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1613,5 +1660,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  	debugfs_create_u32("gpio_val", S_IRUSR | S_IWUSR,
  			   sc->debug.debugfs_phy, &sc->sc_ah->gpio_val);
  
 +	debugfs_create_file("eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
 +			    &fops_eeprom);
 +
- 	sc->debug.regidx = 0;
- 	memset(&sc->debug.bb_mac_samp, 0, sizeof(sc->debug.bb_mac_samp));
- 	sc->debug.sampidx = 0;
+ 	return 0;
+ }
diff --git a/package/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch b/package/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
index 82f5866425..092ab5714a 100644
--- a/package/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
+++ b/package/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1794,8 +1794,8 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -1745,8 +1745,8 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  	REG_WRITE(ah, AR_OBS, 8);
  
  	if (ah->config.rx_intr_mitigation) {
diff --git a/package/mac80211/patches/511-ath9k_increase_bcbuf.patch b/package/mac80211/patches/511-ath9k_increase_bcbuf.patch
index 6d54d7a30a..9adf07a40d 100644
--- a/package/mac80211/patches/511-ath9k_increase_bcbuf.patch
+++ b/package/mac80211/patches/511-ath9k_increase_bcbuf.patch
@@ -11,7 +11,7 @@
  #define IEEE80211_MS_TO_TU(x)           (((x) * 1000) / 1024)
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -388,8 +388,8 @@ static void ath9k_hw_init_config(struct 
+@@ -389,8 +389,8 @@ static void ath9k_hw_init_config(struct 
  {
  	int i;
  
diff --git a/package/mac80211/patches/513-ath9k_channelbw_debugfs.patch b/package/mac80211/patches/513-ath9k_channelbw_debugfs.patch
index fe225cd5a8..527ef3b529 100644
--- a/package/mac80211/patches/513-ath9k_channelbw_debugfs.patch
+++ b/package/mac80211/patches/513-ath9k_channelbw_debugfs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -595,6 +595,7 @@ struct ath_softc {
+@@ -625,6 +625,7 @@ struct ath_softc {
  	struct ieee80211_hw *hw;
  	struct device *dev;
  
@@ -8,7 +8,7 @@
  	int chan_idx;
  	int chan_is_ht;
  	struct survey_info *cur_survey;
-@@ -659,6 +660,7 @@ struct ath_softc {
+@@ -692,6 +693,7 @@ struct ath_softc {
  	u8 ant_tx, ant_rx;
  };
  
@@ -18,7 +18,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1663,6 +1663,50 @@ static const struct file_operations fops
+@@ -1599,6 +1599,50 @@ static const struct file_operations fops
  	.owner = THIS_MODULE
  };
  
@@ -69,19 +69,18 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1727,6 +1771,9 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1663,5 +1707,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  	debugfs_create_file("eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
  			    &fops_eeprom);
  
 +	debugfs_create_file("chanbw", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
 +			    sc, &fops_chanbw);
 +
- 	sc->debug.regidx = 0;
- 	memset(&sc->debug.bb_mac_samp, 0, sizeof(sc->debug.bb_mac_samp));
- 	sc->debug.sampidx = 0;
+ 	return 0;
+ }
 --- a/drivers/net/wireless/ath/ath9k/main.c
 +++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -1559,7 +1559,7 @@ static void ath9k_disable_ps(struct ath_
+@@ -1535,7 +1535,7 @@ static void ath9k_disable_ps(struct ath_
  
  }
  
@@ -90,7 +89,7 @@
  {
  	struct ath_softc *sc = hw->priv;
  	struct ath_hw *ah = sc->sc_ah;
-@@ -1609,9 +1609,11 @@ static int ath9k_config(struct ieee80211
+@@ -1579,9 +1579,11 @@ static int ath9k_config(struct ieee80211
  
  	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
  		struct ieee80211_channel *curchan = hw->conf.channel;
@@ -102,7 +101,7 @@
  
  		if (ah->curchan)
  			old_pos = ah->curchan - &ah->channels[0];
-@@ -1659,7 +1661,23 @@ static int ath9k_config(struct ieee80211
+@@ -1629,7 +1631,23 @@ static int ath9k_config(struct ieee80211
  			memset(&sc->survey[pos], 0, sizeof(struct survey_info));
  		}
  
@@ -129,7 +128,7 @@
  			return -EINVAL;
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1608,6 +1608,10 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -1570,6 +1570,10 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  	    caldata->rtt_hist.num_readings)
  		allow_fbs = true;
  
diff --git a/package/mac80211/patches/521-mac80211_reduce_txqueuelen.patch b/package/mac80211/patches/521-mac80211_reduce_txqueuelen.patch
index 4e4dcb8d4e..bf3f89b5a2 100644
--- a/package/mac80211/patches/521-mac80211_reduce_txqueuelen.patch
+++ b/package/mac80211/patches/521-mac80211_reduce_txqueuelen.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -686,6 +686,7 @@ static const struct net_device_ops ieee8
+@@ -688,6 +688,7 @@ static const struct net_device_ops ieee8
  static void ieee80211_if_setup(struct net_device *dev)
  {
  	ether_setup(dev);
diff --git a/package/mac80211/patches/530-mac80211_cur_txpower.patch b/package/mac80211/patches/530-mac80211_cur_txpower.patch
index f34267421d..c7f901bfa2 100644
--- a/package/mac80211/patches/530-mac80211_cur_txpower.patch
+++ b/package/mac80211/patches/530-mac80211_cur_txpower.patch
@@ -11,7 +11,7 @@
  	u16 listen_interval;
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1739,7 +1739,7 @@ static int ieee80211_get_tx_power(struct
+@@ -1711,7 +1711,7 @@ static int ieee80211_get_tx_power(struct
  {
  	struct ieee80211_local *local = wiphy_priv(wiphy);
  
diff --git a/package/mac80211/patches/531-ath9k_cur_txpower.patch b/package/mac80211/patches/531-ath9k_cur_txpower.patch
index 8fdd436cd9..46f2004ae4 100644
--- a/package/mac80211/patches/531-ath9k_cur_txpower.patch
+++ b/package/mac80211/patches/531-ath9k_cur_txpower.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/main.c
 +++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -1683,6 +1683,8 @@ int ath9k_config(struct ieee80211_hw *hw
+@@ -1653,6 +1653,8 @@ int ath9k_config(struct ieee80211_hw *hw
  			return -EINVAL;
  		}
  
@@ -9,7 +9,7 @@
  		/*
  		 * The most recent snapshot of channel->noisefloor for the old
  		 * channel is only available after the hardware reset. Copy it to
-@@ -1697,6 +1699,7 @@ int ath9k_config(struct ieee80211_hw *hw
+@@ -1667,6 +1669,7 @@ int ath9k_config(struct ieee80211_hw *hw
  		sc->config.txpowlimit = 2 * conf->power_level;
  		ath9k_cmn_update_txpow(ah, sc->curtxpow,
  				       sc->config.txpowlimit, &sc->curtxpow);
diff --git a/package/mac80211/patches/540-ath9k_limit_qlen.patch b/package/mac80211/patches/540-ath9k_limit_qlen.patch
index 737591f5a6..bf1811bae8 100644
--- a/package/mac80211/patches/540-ath9k_limit_qlen.patch
+++ b/package/mac80211/patches/540-ath9k_limit_qlen.patch
@@ -20,8 +20,8 @@
  	spinlock_t txbuflock;
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1732,6 +1732,10 @@ int ath9k_init_debug(struct ath_hw *ah)
- 			    sc, &fops_wiphy);
+@@ -1666,6 +1666,10 @@ int ath9k_init_debug(struct ath_hw *ah)
+ 			    &fops_interrupt);
  	debugfs_create_file("xmit", S_IRUSR, sc->debug.debugfs_phy, sc,
  			    &fops_xmit);
 +	debugfs_create_u32("qlen_single", S_IRUSR | S_IWUSR,
@@ -57,7 +57,7 @@
  	while (bf) {
  		u16 seqno = bf->bf_state.seqno;
  
-@@ -885,6 +895,7 @@ static enum ATH_AGGR_STATUS ath_tx_form_
+@@ -884,6 +894,7 @@ static enum ATH_AGGR_STATUS ath_tx_form_
  			ath_tx_addto_baw(sc, tid, seqno);
  		bf->bf_state.ndelim = ndelim;
  
@@ -65,7 +65,7 @@
  		__skb_unlink(skb, &tid->buf_q);
  		list_add_tail(&bf->list, bf_q);
  		if (bf_prev)
-@@ -1740,6 +1751,8 @@ static void ath_tx_send_ampdu(struct ath
+@@ -1739,6 +1750,8 @@ static void ath_tx_send_ampdu(struct ath
  	/* Add sub-frame to BAW */
  	ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
  
@@ -74,7 +74,7 @@
  	/* Queue to h/w without aggregation */
  	TX_STAT_INC(txctl->txq->axq_qnum, a_queued_hw);
  	bf->bf_lastbf = bf;
-@@ -1864,22 +1877,11 @@ error:
+@@ -1863,22 +1876,11 @@ error:
  
  /* FIXME: tx power */
  static void ath_tx_start_dma(struct ath_softc *sc, struct sk_buff *skb,
@@ -99,7 +99,7 @@
  
  	if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && tid) {
  		/*
-@@ -1911,6 +1913,7 @@ int ath_tx_start(struct ieee80211_hw *hw
+@@ -1910,6 +1912,7 @@ int ath_tx_start(struct ieee80211_hw *hw
  	struct ieee80211_vif *vif = info->control.vif;
  	struct ath_softc *sc = hw->priv;
  	struct ath_txq *txq = txctl->txq;
@@ -107,7 +107,7 @@
  	int padpos, padsize;
  	int frmlen = skb->len + FCS_LEN;
  	int q;
-@@ -1953,6 +1956,24 @@ int ath_tx_start(struct ieee80211_hw *hw
+@@ -1952,6 +1955,24 @@ int ath_tx_start(struct ieee80211_hw *hw
  
  	setup_frame_info(hw, skb, frmlen);
  
@@ -132,7 +132,7 @@
  	/*
  	 * At this point, the vif, hw_key and sta pointers in the tx control
  	 * info are no longer valid (overwritten by the ath_frame_info data.
-@@ -1967,7 +1988,7 @@ int ath_tx_start(struct ieee80211_hw *hw
+@@ -1966,7 +1987,7 @@ int ath_tx_start(struct ieee80211_hw *hw
  		txq->stopped = true;
  	}
  
diff --git a/package/mac80211/patches/541-ath9k_ar9280_cold_reset.patch b/package/mac80211/patches/541-ath9k_ar9280_cold_reset.patch
index 70889d69d6..d6146e50a0 100644
--- a/package/mac80211/patches/541-ath9k_ar9280_cold_reset.patch
+++ b/package/mac80211/patches/541-ath9k_ar9280_cold_reset.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1394,10 +1394,16 @@ static bool ath9k_hw_set_reset_reg(struc
+@@ -1395,10 +1395,16 @@ static bool ath9k_hw_set_reset_reg(struc
  static bool ath9k_hw_chip_reset(struct ath_hw *ah,
  				struct ath9k_channel *chan)
  {
diff --git a/package/mac80211/patches/542-ath9k_fix_half_quarter_rx_latency.patch b/package/mac80211/patches/542-ath9k_fix_half_quarter_rx_latency.patch
index 8b1e0436d8..45246ea468 100644
--- a/package/mac80211/patches/542-ath9k_fix_half_quarter_rx_latency.patch
+++ b/package/mac80211/patches/542-ath9k_fix_half_quarter_rx_latency.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1005,16 +1005,26 @@ void ath9k_hw_init_global_settings(struc
+@@ -1006,16 +1006,26 @@ void ath9k_hw_init_global_settings(struc
  
  	if (IS_CHAN_HALF_RATE(chan)) {
  		eifs = 175;
diff --git a/package/mac80211/patches/543-ath9k_fix_half_quarter_sifs.patch b/package/mac80211/patches/543-ath9k_fix_half_quarter_sifs.patch
index 3f2b360f20..6bde7659f2 100644
--- a/package/mac80211/patches/543-ath9k_fix_half_quarter_sifs.patch
+++ b/package/mac80211/patches/543-ath9k_fix_half_quarter_sifs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1006,31 +1006,35 @@ void ath9k_hw_init_global_settings(struc
+@@ -1007,31 +1007,35 @@ void ath9k_hw_init_global_settings(struc
  	if (IS_CHAN_HALF_RATE(chan)) {
  		eifs = 175;
  
diff --git a/package/mac80211/patches/550-ath9k_debug_remove_packet_rssi.patch b/package/mac80211/patches/550-ath9k_debug_remove_packet_rssi.patch
index 087757db42..01d64ba2e4 100644
--- a/package/mac80211/patches/550-ath9k_debug_remove_packet_rssi.patch
+++ b/package/mac80211/patches/550-ath9k_debug_remove_packet_rssi.patch
@@ -1,42 +1,35 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -969,34 +969,6 @@ static ssize_t read_file_recv(struct fil
- 			"%18s : %10u\n", "DECRYPT BUSY ERR",
- 			sc->debug.stats.rxstats.decrypt_busy_err);
+@@ -942,27 +942,6 @@ static ssize_t read_file_recv(struct fil
+ 	PHY_ERR("HT-RATE ERR", ATH9K_PHYERR_HT_RATE_ILLEGAL);
  
--	len += snprintf(buf + len, size - len,
--			"%18s : %10d\n", "RSSI-CTL0",
+ 	len += snprintf(buf + len, size - len,
+-			"%22s : %10d\n", "RSSI-CTL0",
 -			sc->debug.stats.rxstats.rs_rssi_ctl0);
--
 -	len += snprintf(buf + len, size - len,
--			"%18s : %10d\n", "RSSI-CTL1",
+-			"%22s : %10d\n", "RSSI-CTL1",
 -			sc->debug.stats.rxstats.rs_rssi_ctl1);
--
 -	len += snprintf(buf + len, size - len,
--			"%18s : %10d\n", "RSSI-CTL2",
+-			"%22s : %10d\n", "RSSI-CTL2",
 -			sc->debug.stats.rxstats.rs_rssi_ctl2);
--
 -	len += snprintf(buf + len, size - len,
--			"%18s : %10d\n", "RSSI-EXT0",
+-			"%22s : %10d\n", "RSSI-EXT0",
 -			sc->debug.stats.rxstats.rs_rssi_ext0);
--
 -	len += snprintf(buf + len, size - len,
--			"%18s : %10d\n", "RSSI-EXT1",
+-			"%22s : %10d\n", "RSSI-EXT1",
 -			sc->debug.stats.rxstats.rs_rssi_ext1);
--
 -	len += snprintf(buf + len, size - len,
--			"%18s : %10d\n", "RSSI-EXT2",
+-			"%22s : %10d\n", "RSSI-EXT2",
 -			sc->debug.stats.rxstats.rs_rssi_ext2);
--
 -	len += snprintf(buf + len, size - len,
--			"%18s : %10d\n", "Rx Antenna",
+-			"%22s : %10d\n", "Rx Antenna",
 -			sc->debug.stats.rxstats.rs_antenna);
--
- 	PHY_ERR("UNDERRUN", ATH9K_PHYERR_UNDERRUN);
- 	PHY_ERR("TIMING", ATH9K_PHYERR_TIMING);
- 	PHY_ERR("PARITY", ATH9K_PHYERR_PARITY);
-@@ -1073,16 +1045,6 @@ void ath_debug_stat_rx(struct ath_softc 
- 		RX_PHY_ERR_INC(phyerr);
+-	len += snprintf(buf + len, size - len,
+ 			"%22s : %10u\n", "RX-Pkts-All",
+ 			sc->debug.stats.rxstats.rx_pkts_all);
+ 	len += snprintf(buf + len, size - len,
+@@ -1009,16 +988,6 @@ void ath_debug_stat_rx(struct ath_softc 
+ 			RX_PHY_ERR_INC(rs->rs_phyerr);
  	}
  
 -	sc->debug.stats.rxstats.rs_rssi_ctl0 = rs->rs_rssi_ctl0;
diff --git a/package/mac80211/patches/551-ath9k_per_chain_signal_strength.patch b/package/mac80211/patches/551-ath9k_per_chain_signal_strength.patch
index fd607dd385..778a1d0b42 100644
--- a/package/mac80211/patches/551-ath9k_per_chain_signal_strength.patch
+++ b/package/mac80211/patches/551-ath9k_per_chain_signal_strength.patch
@@ -37,7 +37,7 @@
  
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -1269,6 +1269,7 @@ ieee80211_rx_h_sta_process(struct ieee80
+@@ -1270,6 +1270,7 @@ ieee80211_rx_h_sta_process(struct ieee80
  	struct sk_buff *skb = rx->skb;
  	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
@@ -45,7 +45,7 @@
  
  	if (!sta)
  		return RX_CONTINUE;
-@@ -1311,6 +1312,19 @@ ieee80211_rx_h_sta_process(struct ieee80
+@@ -1312,6 +1313,19 @@ ieee80211_rx_h_sta_process(struct ieee80
  	sta->last_signal = status->signal;
  	ewma_add(&sta->avg_signal, -status->signal);
  
@@ -78,7 +78,7 @@
  		kfree(sta);
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -508,6 +508,8 @@ struct station_parameters {
+@@ -518,6 +518,8 @@ struct station_parameters {
   * @STATION_INFO_ASSOC_REQ_IES: @assoc_req_ies filled
   * @STATION_INFO_STA_FLAGS: @sta_flags filled
   * @STATION_INFO_BEACON_LOSS_COUNT: @beacon_loss_count filled
@@ -87,7 +87,7 @@
   */
  enum station_info_flags {
  	STATION_INFO_INACTIVE_TIME	= 1<<0,
-@@ -529,7 +531,9 @@ enum station_info_flags {
+@@ -539,7 +541,9 @@ enum station_info_flags {
  	STATION_INFO_CONNECTED_TIME	= 1<<16,
  	STATION_INFO_ASSOC_REQ_IES	= 1<<17,
  	STATION_INFO_STA_FLAGS		= 1<<18,
@@ -98,7 +98,7 @@
  };
  
  /**
-@@ -609,6 +613,9 @@ struct sta_bss_parameters {
+@@ -619,6 +623,9 @@ struct sta_bss_parameters {
   * @plink_state: mesh peer link state
   * @signal: signal strength of last received packet in dBm
   * @signal_avg: signal strength average in dBm
@@ -108,7 +108,7 @@
   * @txrate: current unicast bitrate from this station
   * @rxrate: current unicast bitrate to this station
   * @rx_packets: packets received from this station
-@@ -640,6 +647,11 @@ struct station_info {
+@@ -650,6 +657,11 @@ struct station_info {
  	u8 plink_state;
  	s8 signal;
  	s8 signal_avg;
@@ -189,7 +189,7 @@
  	/* Record packet only when both main_rssi and  alt_rssi is positive */
 --- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
 +++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
-@@ -483,12 +483,12 @@ int ath9k_hw_process_rxdesc_edma(struct 
+@@ -463,12 +463,12 @@ int ath9k_hw_process_rxdesc_edma(struct 
  
  	/* XXX: Keycache */
  	rxs->rs_rssi = MS(rxsp->status5, AR_RxRSSICombined);
@@ -250,7 +250,7 @@
  	if (ads.ds_rxstatus8 & AR_RxKeyIdxValid)
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1047,12 +1047,12 @@ void ath_debug_stat_rx(struct ath_softc 
+@@ -990,12 +990,12 @@ void ath_debug_stat_rx(struct ath_softc 
  
  	spin_lock(&sc->debug.samp_lock);
  	RX_SAMP_DBG(jiffies) = jiffies;
@@ -271,7 +271,7 @@
  	RX_SAMP_DBG(rate) = rs->rs_rate;
 --- a/include/linux/nl80211.h
 +++ b/include/linux/nl80211.h
-@@ -1657,6 +1657,8 @@ enum nl80211_sta_bss_param {
+@@ -1661,6 +1661,8 @@ enum nl80211_sta_bss_param {
   * @NL80211_STA_INFO_CONNECTED_TIME: time since the station is last connected
   * @NL80211_STA_INFO_STA_FLAGS: Contains a struct nl80211_sta_flag_update.
   * @NL80211_STA_INFO_BEACON_LOSS: count of times beacon loss was detected (u32)
@@ -280,7 +280,7 @@
   * @__NL80211_STA_INFO_AFTER_LAST: internal
   * @NL80211_STA_INFO_MAX: highest possible station info attribute
   */
-@@ -1680,6 +1682,8 @@ enum nl80211_sta_info {
+@@ -1684,6 +1686,8 @@ enum nl80211_sta_info {
  	NL80211_STA_INFO_CONNECTED_TIME,
  	NL80211_STA_INFO_STA_FLAGS,
  	NL80211_STA_INFO_BEACON_LOSS,
@@ -291,7 +291,7 @@
  	__NL80211_STA_INFO_AFTER_LAST,
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -2347,6 +2347,33 @@ nla_put_failure:
+@@ -2376,6 +2376,33 @@ nla_put_failure:
  	return false;
  }
  
@@ -325,7 +325,7 @@
  static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
  				int flags, struct net_device *dev,
  				const u8 *mac_addr, struct station_info *sinfo)
-@@ -2393,6 +2420,18 @@ static int nl80211_send_station(struct s
+@@ -2422,6 +2449,18 @@ static int nl80211_send_station(struct s
  	if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
  		NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
  			   sinfo->signal_avg);
diff --git a/package/mac80211/patches/560-ath9k_extra_leds.patch b/package/mac80211/patches/560-ath9k_extra_leds.patch
index adf2a0e887..ed749ed13c 100644
--- a/package/mac80211/patches/560-ath9k_extra_leds.patch
+++ b/package/mac80211/patches/560-ath9k_extra_leds.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -475,6 +475,9 @@ void ath9k_btcoex_timer_pause(struct ath
+@@ -505,6 +505,9 @@ static inline u16 ath9k_btcoex_aggr_limi
  #ifdef CONFIG_MAC80211_LEDS
  void ath_init_leds(struct ath_softc *sc);
  void ath_deinit_leds(struct ath_softc *sc);
@@ -10,7 +10,7 @@
  #else
  static inline void ath_init_leds(struct ath_softc *sc)
  {
-@@ -595,6 +598,13 @@ struct ath9k_vif_iter_data {
+@@ -625,6 +628,13 @@ struct ath9k_vif_iter_data {
  	int nothers;   /* number of vifs not specified above. */
  };
  
@@ -24,7 +24,7 @@
  struct ath_softc {
  	struct ieee80211_hw *hw;
  	struct device *dev;
-@@ -638,9 +648,8 @@ struct ath_softc {
+@@ -668,9 +678,8 @@ struct ath_softc {
  	struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
  
  #ifdef CONFIG_MAC80211_LEDS
@@ -171,7 +171,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -817,7 +817,7 @@ int ath9k_init_device(u16 devid, struct 
+@@ -757,7 +757,7 @@ int ath9k_init_device(u16 devid, struct 
  
  #ifdef CONFIG_MAC80211_LEDS
  	/* must be initialized before ieee80211_register_hw */
@@ -182,7 +182,7 @@
  #endif
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1304,6 +1304,61 @@ static const struct file_operations fops
+@@ -1247,6 +1247,61 @@ static const struct file_operations fops
  	.llseek = default_llseek,
  };
  
@@ -244,7 +244,7 @@
  void ath9k_debug_samp_bb_mac(struct ath_softc *sc)
  {
  #define ATH_SAMP_DBG(c) (sc->debug.bb_mac_samp[sc->debug.sampidx].c)
-@@ -1728,6 +1783,11 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1671,6 +1726,11 @@ int ath9k_init_debug(struct ath_hw *ah)
  	debugfs_create_file("samples", S_IRUSR, sc->debug.debugfs_phy, sc,
  			    &fops_samps);
  
diff --git a/package/mac80211/patches/571-ath9k_beacon_fix.patch b/package/mac80211/patches/571-ath9k_beacon_fix.patch
new file mode 100644
index 0000000000..96b80600fa
--- /dev/null
+++ b/package/mac80211/patches/571-ath9k_beacon_fix.patch
@@ -0,0 +1,113 @@
+--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+@@ -326,7 +326,6 @@ static bool ar9003_hw_get_isr(struct ath
+ static int ar9003_hw_proc_txdesc(struct ath_hw *ah, void *ds,
+ 				 struct ath_tx_status *ts)
+ {
+-	struct ar9003_txc *txc = (struct ar9003_txc *) ds;
+ 	struct ar9003_txs *ads;
+ 	u32 status;
+ 
+@@ -336,11 +335,7 @@ static int ar9003_hw_proc_txdesc(struct 
+ 	if ((status & AR_TxDone) == 0)
+ 		return -EINPROGRESS;
+ 
+-	ts->qid = MS(ads->ds_info, AR_TxQcuNum);
+-	if (!txc || (MS(txc->info, AR_TxQcuNum) == ts->qid))
+-		ah->ts_tail = (ah->ts_tail + 1) % ah->ts_size;
+-	else
+-		return -ENOENT;
++	ah->ts_tail = (ah->ts_tail + 1) % ah->ts_size;
+ 
+ 	if ((MS(ads->ds_info, AR_DescId) != ATHEROS_VENDOR_ID) ||
+ 	    (MS(ads->ds_info, AR_TxRxDesc) != 1)) {
+@@ -354,6 +349,7 @@ static int ar9003_hw_proc_txdesc(struct 
+ 	ts->ts_seqnum = MS(status, AR_SeqNum);
+ 	ts->tid = MS(status, AR_TxTid);
+ 
++	ts->qid = MS(ads->ds_info, AR_TxQcuNum);
+ 	ts->desc_id = MS(ads->status1, AR_TxDescId);
+ 	ts->ts_tstamp = ads->status4;
+ 	ts->ts_status = 0;
+--- a/drivers/net/wireless/ath/ath9k/beacon.c
++++ b/drivers/net/wireless/ath/ath9k/beacon.c
+@@ -91,7 +91,7 @@ static void ath_beacon_setup(struct ath_
+ 	info.txpower = MAX_RATE_POWER;
+ 	info.keyix = ATH9K_TXKEYIX_INVALID;
+ 	info.keytype = ATH9K_KEY_TYPE_CLEAR;
+-	info.flags = ATH9K_TXDESC_NOACK;
++	info.flags = ATH9K_TXDESC_NOACK | ATH9K_TXDESC_INTREQ;
+ 
+ 	info.buf_addr[0] = bf->bf_buf_addr;
+ 	info.buf_len[0] = roundup(skb->len, 4);
+@@ -355,7 +355,6 @@ void ath_beacon_tasklet(unsigned long da
+ 	struct ath_common *common = ath9k_hw_common(ah);
+ 	struct ath_buf *bf = NULL;
+ 	struct ieee80211_vif *vif;
+-	struct ath_tx_status ts;
+ 	bool edma = !!(ah->caps.hw_caps & ATH9K_HW_CAP_EDMA);
+ 	int slot;
+ 	u32 bfaddr, bc = 0;
+@@ -462,11 +461,6 @@ void ath_beacon_tasklet(unsigned long da
+ 			ath9k_hw_txstart(ah, sc->beacon.beaconq);
+ 
+ 		sc->beacon.ast_be_xmit += bc;     /* XXX per-vif? */
+-		if (edma) {
+-			spin_lock_bh(&sc->sc_pcu_lock);
+-			ath9k_hw_txprocdesc(ah, bf->bf_desc, (void *)&ts);
+-			spin_unlock_bh(&sc->sc_pcu_lock);
+-		}
+ 	}
+ }
+ 
+--- a/drivers/net/wireless/ath/ath9k/mac.c
++++ b/drivers/net/wireless/ath/ath9k/mac.c
+@@ -745,7 +745,11 @@ int ath9k_hw_beaconq_setup(struct ath_hw
+ 	qi.tqi_aifs = 1;
+ 	qi.tqi_cwmin = 0;
+ 	qi.tqi_cwmax = 0;
+-	/* NB: don't enable any interrupts */
++
++	if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
++		qi.tqi_qflags = TXQ_FLAG_TXOKINT_ENABLE |
++				TXQ_FLAG_TXERRINT_ENABLE;
++
+ 	return ath9k_hw_setuptxqueue(ah, ATH9K_TX_QUEUE_BEACON, &qi);
+ }
+ EXPORT_SYMBOL(ath9k_hw_beaconq_setup);
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -2303,6 +2303,7 @@ static int ath9k_tx_last_beacon(struct i
+ 	struct ath_vif *avp;
+ 	struct ath_buf *bf;
+ 	struct ath_tx_status ts;
++	bool edma = !!(ah->caps.hw_caps & ATH9K_HW_CAP_EDMA);
+ 	int status;
+ 
+ 	vif = sc->beacon.bslot[0];
+@@ -2313,7 +2314,7 @@ static int ath9k_tx_last_beacon(struct i
+ 	if (!avp->is_bslot_active)
+ 		return 0;
+ 
+-	if (!sc->beacon.tx_processed) {
++	if (!sc->beacon.tx_processed && !edma) {
+ 		tasklet_disable(&sc->bcon_tasklet);
+ 
+ 		bf = avp->av_bcbuf;
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2317,9 +2317,12 @@ void ath_tx_edma_tasklet(struct ath_soft
+ 			break;
+ 		}
+ 
+-		/* Skip beacon completions */
+-		if (ts.qid == sc->beacon.beaconq)
++		/* Process beacon completions separately */
++		if (ts.qid == sc->beacon.beaconq) {
++			sc->beacon.tx_processed = true;
++			sc->beacon.tx_last = !(ts.ts_status & ATH9K_TXERR_MASK);
+ 			continue;
++		}
+ 
+ 		txq = &sc->tx.txq[ts.qid];
+ 
diff --git a/package/mac80211/patches/580-mac80211_ignore_bad_signal_values.patch b/package/mac80211/patches/580-mac80211_ignore_bad_signal_values.patch
index b6d88b0bac..cfc151629f 100644
--- a/package/mac80211/patches/580-mac80211_ignore_bad_signal_values.patch
+++ b/package/mac80211/patches/580-mac80211_ignore_bad_signal_values.patch
@@ -19,7 +19,7 @@
  /**
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -176,7 +176,8 @@ ieee80211_add_rx_radiotap_header(struct 
+@@ -177,7 +177,8 @@ ieee80211_add_rx_radiotap_header(struct 
  	pos += 2;
  
  	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
@@ -29,7 +29,7 @@
  		*pos = status->signal;
  		rthdr->it_present |=
  			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
-@@ -1309,8 +1310,10 @@ ieee80211_rx_h_sta_process(struct ieee80
+@@ -1310,8 +1311,10 @@ ieee80211_rx_h_sta_process(struct ieee80
  
  	sta->rx_fragments++;
  	sta->rx_bytes += rx->skb->len;
diff --git a/package/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch b/package/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
index d15b07da5c..31e33b7818 100644
--- a/package/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
+++ b/package/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
@@ -101,7 +101,7 @@
 +}
 --- a/drivers/net/wireless/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
-@@ -554,6 +554,7 @@ struct rt2x00lib_ops {
+@@ -560,6 +560,7 @@ struct rt2x00lib_ops {
  			       const u8 *data, const size_t len);
  	int (*load_firmware) (struct rt2x00_dev *rt2x00dev,
  			      const u8 *data, const size_t len);
@@ -109,7 +109,7 @@
  
  	/*
  	 * Device initialization/deinitialization handlers.
-@@ -705,6 +706,7 @@ enum rt2x00_capability_flags {
+@@ -713,6 +714,7 @@ enum rt2x00_capability_flags {
  	REQUIRE_SW_SEQNO,
  	REQUIRE_HT_TX_DESC,
  	REQUIRE_PS_AUTOWAKE,
@@ -117,7 +117,7 @@
  
  	/*
  	 * Capabilities
-@@ -961,6 +963,11 @@ struct rt2x00_dev {
+@@ -968,6 +970,11 @@ struct rt2x00_dev {
  	const struct firmware *fw;
  
  	/*
@@ -131,7 +131,7 @@
  	DECLARE_KFIFO_PTR(txstatus_fifo, u32);
 --- a/drivers/net/wireless/rt2x00/rt2x00lib.h
 +++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
-@@ -309,6 +309,22 @@ static inline void rt2x00lib_free_firmwa
+@@ -322,6 +322,22 @@ static inline void rt2x00lib_free_firmwa
  #endif /* CONFIG_RT2X00_LIB_FIRMWARE */
  
  /*
@@ -229,7 +229,7 @@
   * Initialization functions.
   */
  static bool rt2800pci_get_entry_state(struct queue_entry *entry)
-@@ -1040,6 +1044,7 @@ static const struct rt2x00lib_ops rt2800
+@@ -1052,6 +1056,7 @@ static const struct rt2x00lib_ops rt2800
  	.get_firmware_name	= rt2800pci_get_firmware_name,
  	.check_firmware		= rt2800_check_firmware,
  	.load_firmware		= rt2800_load_firmware,
@@ -239,7 +239,7 @@
  	.get_entry_state	= rt2800pci_get_entry_state,
 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
-@@ -1145,6 +1145,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+@@ -1161,6 +1161,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
  		    BIT(NL80211_IFTYPE_MESH_POINT) |
  		    BIT(NL80211_IFTYPE_WDS);
  
@@ -250,10 +250,10 @@
  	/*
  	 * Initialize work.
  	 */
-@@ -1261,6 +1265,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
- 	 * Free queue structures.
+@@ -1284,6 +1288,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
  	 */
- 	rt2x00queue_free(rt2x00dev);
+ 	if (rt2x00dev->drv_data)
+ 		kfree(rt2x00dev->drv_data);
 +
 +	/*
 +	 * Free EEPROM image.
diff --git a/package/mac80211/patches/604-rt2x00-add-CONFIG_RT2X00_LIB_EEPROM-option.patch b/package/mac80211/patches/604-rt2x00-add-CONFIG_RT2X00_LIB_EEPROM-option.patch
index 7d4e4fe803..5a373a7a7d 100644
--- a/package/mac80211/patches/604-rt2x00-add-CONFIG_RT2X00_LIB_EEPROM-option.patch
+++ b/package/mac80211/patches/604-rt2x00-add-CONFIG_RT2X00_LIB_EEPROM-option.patch
@@ -1,6 +1,6 @@
 --- a/config.mk
 +++ b/config.mk
-@@ -611,6 +611,7 @@ CONFIG_RT2X00=y
+@@ -618,6 +618,7 @@ CONFIG_RT2X00=y
  CONFIG_RT2X00_LIB=m
  CONFIG_RT2800_LIB=m
  CONFIG_RT2X00_LIB_FIRMWARE=y
diff --git a/package/mac80211/patches/605-rt2x00-pci-eeprom.patch b/package/mac80211/patches/605-rt2x00-pci-eeprom.patch
index 51af67eb77..088d474092 100644
--- a/package/mac80211/patches/605-rt2x00-pci-eeprom.patch
+++ b/package/mac80211/patches/605-rt2x00-pci-eeprom.patch
@@ -9,7 +9,7 @@
  {
  	memcpy(rt2x00dev->eeprom, rt2x00dev->eeprom_file->data, EEPROM_SIZE);
  }
-@@ -926,8 +926,9 @@ static int rt2800pci_validate_eeprom(str
+@@ -938,8 +938,9 @@ static int rt2800pci_validate_eeprom(str
  	/*
  	 * Read EEPROM into buffer
  	 */
diff --git a/package/mac80211/patches/608-rt2x00-allow_disabling_bands_through_platform_data.patch b/package/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
similarity index 92%
rename from package/mac80211/patches/608-rt2x00-allow_disabling_bands_through_platform_data.patch
rename to package/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
index df8f44509e..9056076bd4 100644
--- a/package/mac80211/patches/608-rt2x00-allow_disabling_bands_through_platform_data.patch
+++ b/package/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
@@ -12,7 +12,7 @@
  #endif /* _RT2X00_PLATFORM_H */
 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
-@@ -825,6 +825,22 @@ static int rt2x00lib_probe_hw_modes(stru
+@@ -829,6 +829,22 @@ static int rt2x00lib_probe_hw_modes(stru
  	unsigned int num_rates;
  	unsigned int i;
  
@@ -37,7 +37,7 @@
  		num_rates += 4;
 --- a/drivers/net/wireless/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
-@@ -420,6 +420,7 @@ struct hw_mode_spec {
+@@ -425,6 +425,7 @@ struct hw_mode_spec {
  	unsigned int supported_bands;
  #define SUPPORT_BAND_2GHZ	0x00000001
  #define SUPPORT_BAND_5GHZ	0x00000002
diff --git a/package/mac80211/patches/607-rt2x00-dont-try-to-destroy-unallocated-workqueue.patch b/package/mac80211/patches/607-rt2x00-dont-try-to-destroy-unallocated-workqueue.patch
deleted file mode 100644
index f9d3ca1ad1..0000000000
--- a/package/mac80211/patches/607-rt2x00-dont-try-to-destroy-unallocated-workqueue.patch
+++ /dev/null
@@ -1,12 +0,0 @@
---- a/drivers/net/wireless/rt2x00/rt2x00dev.c
-+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
-@@ -1224,7 +1224,8 @@ void rt2x00lib_remove_dev(struct rt2x00_
- 		cancel_work_sync(&rt2x00dev->rxdone_work);
- 		cancel_work_sync(&rt2x00dev->txdone_work);
- 	}
--	destroy_workqueue(rt2x00dev->workqueue);
-+	if (rt2x00dev->workqueue)
-+		destroy_workqueue(rt2x00dev->workqueue);
- 
- 	/*
- 	 * Free the tx status fifo.
diff --git a/package/mac80211/patches/820-b43-add-antenna-control.patch b/package/mac80211/patches/820-b43-add-antenna-control.patch
index c1f7a6f137..7b08ded566 100644
--- a/package/mac80211/patches/820-b43-add-antenna-control.patch
+++ b/package/mac80211/patches/820-b43-add-antenna-control.patch
@@ -9,7 +9,7 @@
  	antenna = b43_antenna_to_phyctl(antenna);
  	ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
  	/* We can't send beacons with short preamble. Would get PHY errors. */
-@@ -3031,8 +3031,8 @@ static int b43_chip_init(struct b43_wlde
+@@ -3033,8 +3033,8 @@ static int b43_chip_init(struct b43_wlde
  
  	/* Select the antennae */
  	if (phy->ops->set_rx_antenna)
@@ -20,7 +20,7 @@
  
  	if (phy->type == B43_PHYTYPE_B) {
  		value16 = b43_read16(dev, 0x005E);
-@@ -3775,7 +3775,6 @@ static int b43_op_config(struct ieee8021
+@@ -3777,7 +3777,6 @@ static int b43_op_config(struct ieee8021
  	struct b43_wldev *dev;
  	struct b43_phy *phy;
  	struct ieee80211_conf *conf = &hw->conf;
@@ -28,7 +28,7 @@
  	int err = 0;
  	bool reload_bss = false;
  
-@@ -3829,11 +3828,9 @@ static int b43_op_config(struct ieee8021
+@@ -3831,11 +3830,9 @@ static int b43_op_config(struct ieee8021
  	}
  
  	/* Antennas for RX and management frame TX. */
@@ -42,7 +42,7 @@
  
  	if (wl->radio_enabled != phy->radio_on) {
  		if (wl->radio_enabled) {
-@@ -4905,6 +4902,47 @@ static int b43_op_get_survey(struct ieee
+@@ -4907,6 +4904,47 @@ static int b43_op_get_survey(struct ieee
  	return 0;
  }
  
@@ -90,7 +90,7 @@
  static const struct ieee80211_ops b43_hw_ops = {
  	.tx			= b43_op_tx,
  	.conf_tx		= b43_op_conf_tx,
-@@ -4926,6 +4964,8 @@ static const struct ieee80211_ops b43_hw
+@@ -4928,6 +4966,8 @@ static const struct ieee80211_ops b43_hw
  	.sw_scan_complete	= b43_op_sw_scan_complete_notifier,
  	.get_survey		= b43_op_get_survey,
  	.rfkill_poll		= b43_rfkill_poll,
@@ -99,7 +99,7 @@
  };
  
  /* Hard-reset the chip. Do not call this directly.
-@@ -5172,6 +5212,8 @@ static int b43_one_core_attach(struct b4
+@@ -5174,6 +5214,8 @@ static int b43_one_core_attach(struct b4
  	if (!wldev)
  		goto out;
  
@@ -108,7 +108,7 @@
  	wldev->use_pio = b43_modparam_pio;
  	wldev->dev = dev;
  	wldev->wl = wl;
-@@ -5260,6 +5302,9 @@ static struct b43_wl *b43_wireless_init(
+@@ -5262,6 +5304,9 @@ static struct b43_wl *b43_wireless_init(
  		BIT(NL80211_IFTYPE_WDS) |
  		BIT(NL80211_IFTYPE_ADHOC);
  
diff --git a/package/mac80211/patches/900-bash-location.patch b/package/mac80211/patches/900-bash-location.patch
deleted file mode 100644
index e8cab3337e..0000000000
--- a/package/mac80211/patches/900-bash-location.patch
+++ /dev/null
@@ -1,61 +0,0 @@
---- a/scripts/admin-clean.sh
-+++ b/scripts/admin-clean.sh
-@@ -1,4 +1,4 @@
--#!/bin/bash
-+#!/usr/bin/env bash
- if [ -d net ] ; then
- 	make clean
- fi
---- a/scripts/admin-refresh.sh
-+++ b/scripts/admin-refresh.sh
-@@ -1,3 +1,3 @@
--#!/bin/bash
-+#!/usr/bin/env bash
- ./scripts/admin-clean.sh $@
- ./scripts/admin-update.sh $@
---- a/scripts/admin-update.sh
-+++ b/scripts/admin-update.sh
-@@ -1,4 +1,4 @@
--#!/bin/bash
-+#!/usr/bin/env bash
- # 
- # Copyright 2007, 2008, 2010	Luis R. Rodriguez <mcgrof@winlab.rutgers.edu>
- #
---- a/scripts/check_config.sh
-+++ b/scripts/check_config.sh
-@@ -1,4 +1,4 @@
--#!/bin/bash
-+#!/usr/bin/env bash
- # This script checks the compat-wireless configuration file and if changes were made
- # regenerates the compat_autoconf header.
- 
---- a/scripts/driver-select
-+++ b/scripts/driver-select
-@@ -1,4 +1,4 @@
--#!/bin/bash
-+#!/usr/bin/env bash
- # Copyright 2009        Luis R. Rodriguez <mcgrof@gmail.com>
- #
- # This script allows you to select your compat-wireless driver and
---- a/scripts/gen-compat-autoconf.sh
-+++ b/scripts/gen-compat-autoconf.sh
-@@ -1,4 +1,4 @@
--#!/bin/bash
-+#!/usr/bin/env bash
- # 
- # Copyright 2007	Luis R. Rodriguez <mcgrof@winlab.rutgers.edu>
- #
---- a/scripts/gen-stable-release.sh
-+++ b/scripts/gen-stable-release.sh
-@@ -1,4 +1,4 @@
--#!/bin/bash
-+#!/usr/bin/env bash
- # Copyright 2009  Luis R. Rodriguez <mcgrof@gmail.com>
- #
- # You can use this to make stable compat-wireless releases
---- a/scripts/skip-colors
-+++ b/scripts/skip-colors
-@@ -1,2 +1,2 @@
--#!/bin/bash
-+#!/usr/bin/env bash
- perl -pe 's|(\e)\[(\d+)(;*)(\d*)(\w)||g'
diff --git a/package/netifd/Makefile b/package/netifd/Makefile
index 878f62ec2e..832ba97900 100644
--- a/package/netifd/Makefile
+++ b/package/netifd/Makefile
@@ -1,13 +1,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=netifd
-PKG_VERSION:=2012-02-03
+PKG_VERSION:=2012-02-28
 PKG_RELEASE=$(PKG_SOURCE_VERSION)
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=git://nbd.name/luci2/netifd.git
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=c0bb8addecae578d7766b94bd6681be82b621675
+PKG_SOURCE_VERSION:=93ddba72304f8267f8ca63dce2235a154227cd99
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
 # PKG_MIRROR_MD5SUM:=
 # CMAKE_INSTALL:=1
diff --git a/package/netifd/files/etc/hotplug.d/iface/10-sysctl b/package/netifd/files/etc/hotplug.d/iface/10-sysctl
new file mode 100644
index 0000000000..33ac5c329c
--- /dev/null
+++ b/package/netifd/files/etc/hotplug.d/iface/10-sysctl
@@ -0,0 +1,36 @@
+# Skip fake devices (e.g. relayd)
+grep -qs "^ *$DEVICE:" /proc/net/dev || exit 0
+
+case "$ACTION" in
+	ifup)
+		include /lib/network
+		scan_interfaces
+
+		# Setup sysctls
+		local proto accept_ra send_rs
+		
+		config_get proto "$INTERFACE" proto
+		if [ "$proto" = dhcp ]; then
+			accept_ra=1
+			send_rs=0
+		else
+			accept_ra=0
+			send_rs=1
+		fi
+
+		config_get_bool accept_ra "$INTERFACE" accept_ra $accept_ra
+		[ $accept_ra -eq 0 ] || {
+			logger -t ifup "Allowing Router Advertisements on $INTERFACE ($DEVICE)"
+			accept_ra=2
+		}
+		do_sysctl "net.ipv6.conf.$DEVICE.accept_ra" $accept_ra
+
+		config_get_bool send_rs "$INTERFACE" send_rs $send_rs
+		[ $send_rs -eq 0 ] || {
+			logger -t ifup "Enabling Router Solicitations on $INTERFACE ($DEVICE)"
+			send_rs=2
+		}
+		do_sysctl "net.ipv6.conf.$DEVICE.forwarding" $send_rs
+	;;
+esac
+
diff --git a/package/netifd/files/lib/network/config.sh b/package/netifd/files/lib/network/config.sh
index ab3efe8c00..129cb66622 100755
--- a/package/netifd/files/lib/network/config.sh
+++ b/package/netifd/files/lib/network/config.sh
@@ -57,3 +57,8 @@ setup_interface() {
 	ubus call network.interface."$config" add_device "{ \"name\": \"$iface\" }"
 }
 
+do_sysctl() {
+	[ -n "$2" ] && \
+		sysctl -n -e -w "$1=$2" >/dev/null || \
+		sysctl -n -e "$1"
+}
diff --git a/package/netifd/files/usr/share/udhcpc/default.script b/package/netifd/files/usr/share/udhcpc/default.script
new file mode 100755
index 0000000000..ac765a6363
--- /dev/null
+++ b/package/netifd/files/usr/share/udhcpc/default.script
@@ -0,0 +1,57 @@
+#!/bin/sh
+[ -z "$1" ] && echo "Error: should be run by udhcpc" && exit 1
+
+set_classless_routes() {
+	local max=128
+	local type
+	while [ -n "$1" -a -n "$2" -a $max -gt 0 ]; do
+		[ ${1##*/} -eq 32 ] && type=host || type=net
+		echo "udhcpc: adding route for $type $1 via $2"
+		route add -$type "$1" gw "$2" dev "$interface"
+		max=$(($max-1))
+		shift 2
+	done
+}
+
+setup_interface() {
+	echo "udhcpc: ifconfig $interface $ip netmask ${subnet:-255.255.255.0} broadcast ${broadcast:-+}"
+	ifconfig $interface $ip netmask ${subnet:-255.255.255.0} broadcast ${broadcast:-+}
+
+	[ -n "$router" ] && [ "$router" != "0.0.0.0" ] && [ "$router" != "255.255.255.255" ] && {
+		echo "udhcpc: setting default routers: $router"
+
+		local valid_gw=""
+		for i in $router ; do
+			route add default gw $i dev $interface
+			valid_gw="${valid_gw:+$valid_gw|}$i"
+		done
+		
+		eval $(route -n | awk '
+			/^0.0.0.0\W{9}('$valid_gw')\W/ {next}
+			/^0.0.0.0/ {print "route del -net "$1" gw "$2";"}
+		')
+	}
+
+	# CIDR STATIC ROUTES (rfc3442)
+	[ -n "$staticroutes" ] && set_classless_routes $staticroutes
+	[ -n "$msstaticroutes" ] && set_classless_routes $msstaticroutes
+}
+
+
+applied=
+case "$1" in
+	deconfig)
+		ifconfig "$interface" 0.0.0.0
+	;;
+	renew)
+		setup_interface update
+	;;
+	bound)
+		setup_interface ifup
+	;;
+esac
+
+# user rules
+[ -f /etc/udhcpc.user ] && . /etc/udhcpc.user
+
+exit 0
diff --git a/target/linux/brcm47xx/Makefile b/target/linux/brcm47xx/Makefile
index 0212ee6806..e39f6ad012 100644
--- a/target/linux/brcm47xx/Makefile
+++ b/target/linux/brcm47xx/Makefile
@@ -11,7 +11,7 @@ BOARD:=brcm47xx
 BOARDNAME:=Broadcom BCM947xx/953xx
 FEATURES:=squashfs usb pcmcia
 
-LINUX_VERSION:=3.0.18
+LINUX_VERSION:=3.2.5
 
 include $(INCLUDE_DIR)/target.mk
 DEFAULT_PACKAGES += wpad-mini kmod-switch kmod-diag nvram
diff --git a/target/linux/generic/config-3.0 b/target/linux/generic/config-3.0
index 92e5a7f1a0..5bfc3e7937 100644
--- a/target/linux/generic/config-3.0
+++ b/target/linux/generic/config-3.0
@@ -1221,6 +1221,7 @@ CONFIG_LBDAF=y
 # CONFIG_LEDS_BD2802 is not set
 CONFIG_LEDS_CLASS=y
 # CONFIG_LEDS_DAC124S085 is not set
+CONFIG_LEDS_GPIO_PLATFORM=y
 # CONFIG_LEDS_INTEL_SS4200 is not set
 # CONFIG_LEDS_LM3530 is not set
 # CONFIG_LEDS_LP3944 is not set
diff --git a/target/linux/generic/config-3.1 b/target/linux/generic/config-3.1
index 6bee18828f..9b339e7c33 100644
--- a/target/linux/generic/config-3.1
+++ b/target/linux/generic/config-3.1
@@ -1234,6 +1234,7 @@ CONFIG_LBDAF=y
 # CONFIG_LEDS_BD2802 is not set
 CONFIG_LEDS_CLASS=y
 # CONFIG_LEDS_DAC124S085 is not set
+CONFIG_LEDS_GPIO_PLATFORM=y
 # CONFIG_LEDS_INTEL_SS4200 is not set
 # CONFIG_LEDS_LM3530 is not set
 # CONFIG_LEDS_LP3944 is not set
diff --git a/target/linux/generic/config-3.2 b/target/linux/generic/config-3.2
index cce2a675d5..379b167450 100644
--- a/target/linux/generic/config-3.2
+++ b/target/linux/generic/config-3.2
@@ -1254,6 +1254,7 @@ CONFIG_LBDAF=y
 # CONFIG_LEDS_BD2802 is not set
 CONFIG_LEDS_CLASS=y
 # CONFIG_LEDS_DAC124S085 is not set
+CONFIG_LEDS_GPIO_PLATFORM=y
 # CONFIG_LEDS_INTEL_SS4200 is not set
 # CONFIG_LEDS_LM3530 is not set
 # CONFIG_LEDS_LP3944 is not set
diff --git a/target/linux/generic/config-3.3 b/target/linux/generic/config-3.3
index 7c9eddf3d8..f53668dc45 100644
--- a/target/linux/generic/config-3.3
+++ b/target/linux/generic/config-3.3
@@ -1265,6 +1265,7 @@ CONFIG_LBDAF=y
 # CONFIG_LEDS_BD2802 is not set
 CONFIG_LEDS_CLASS=y
 # CONFIG_LEDS_DAC124S085 is not set
+CONFIG_LEDS_GPIO_PLATFORM=y
 # CONFIG_LEDS_INTEL_SS4200 is not set
 # CONFIG_LEDS_LM3530 is not set
 # CONFIG_LEDS_LP3944 is not set
diff --git a/tools/Makefile b/tools/Makefile
index 14cddf8b54..71e92bb1e9 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -106,6 +106,7 @@ $(eval $(call PrepareCommand,find,gfind find))
 $(eval $(call PrepareCommand,md5sum,md5sum $(SCRIPT_DIR)/md5sum))
 $(eval $(call PrepareCommand,cp,gcp cp))
 $(eval $(call PrepareCommand,stat,gstat stat))
+$(eval $(call PrepareCommand,seq,gseq seq))
 
 $(curdir)/cmddeps = $(patsubst %,$(STAGING_DIR_HOST)/bin/%,find md5sum cp stat)
 $(curdir)//prepare = $(STAGING_DIR)/.prepared $(STAGING_DIR_HOST)/.prepared $($(curdir)/cmddeps)