diff --git a/package/iw/Makefile b/package/iw/Makefile
index f758631a7571d905db6913325c9a7759008ccfe0..f47d76b1733306f9d53c9d1447c8466d10ee429a 100644
--- a/package/iw/Makefile
+++ b/package/iw/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=iw
-PKG_VERSION:=3.3
+PKG_VERSION:=3.6
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=http://wireless.kernel.org/download/iw/
-PKG_MD5SUM:=146ad14cdeb39fb88b21efdbb28787d1
+PKG_MD5SUM:=1c18bfbbc8773629e5e8ac733a39540c
 
 include $(INCLUDE_DIR)/package.mk
 
diff --git a/package/iw/patches/001-nl80211_h_sync.patch b/package/iw/patches/001-nl80211_h_sync.patch
index cccc144756b0dc388e45921743caf899c1820125..8e776643b7bfa439dadd9d1377bc8263e3f24759 100644
--- a/package/iw/patches/001-nl80211_h_sync.patch
+++ b/package/iw/patches/001-nl80211_h_sync.patch
@@ -1,284 +1,96 @@
 --- a/nl80211.h
 +++ b/nl80211.h
-@@ -156,21 +156,23 @@
-  * @NL80211_CMD_DEL_KEY: delete a key identified by %NL80211_ATTR_KEY_IDX
-  *	or %NL80211_ATTR_MAC.
+@@ -565,6 +565,14 @@
+  *	%NL80211_ATTR_IFINDEX is now on %NL80211_ATTR_WIPHY_FREQ with
+  *	%NL80211_ATTR_WIPHY_CHANNEL_TYPE.
   *
-- * @NL80211_CMD_GET_BEACON: retrieve beacon information (returned in a
-- *	%NL80222_CMD_NEW_BEACON message)
-- * @NL80211_CMD_SET_BEACON: set the beacon on an access point interface
-- *	using the %NL80211_ATTR_BEACON_INTERVAL, %NL80211_ATTR_DTIM_PERIOD,
-- *	%NL80211_ATTR_BEACON_HEAD and %NL80211_ATTR_BEACON_TAIL attributes.
-- *	Following attributes are provided for drivers that generate full Beacon
-- *	and Probe Response frames internally: %NL80211_ATTR_SSID,
-+ * @NL80211_CMD_GET_BEACON: (not used)
-+ * @NL80211_CMD_SET_BEACON: change the beacon on an access point interface
-+ *	using the %NL80211_ATTR_BEACON_HEAD and %NL80211_ATTR_BEACON_TAIL
-+ *	attributes. For drivers that generate the beacon and probe responses
-+ *	internally, the following attributes must be provided: %NL80211_ATTR_IE,
-+ *	%NL80211_ATTR_IE_PROBE_RESP and %NL80211_ATTR_IE_ASSOC_RESP.
-+ * @NL80211_CMD_START_AP: Start AP operation on an AP interface, parameters
-+ *	are like for %NL80211_CMD_SET_BEACON, and additionally parameters that
-+ *	do not change are used, these include %NL80211_ATTR_BEACON_INTERVAL,
-+ *	%NL80211_ATTR_DTIM_PERIOD, %NL80211_ATTR_SSID,
-  *	%NL80211_ATTR_HIDDEN_SSID, %NL80211_ATTR_CIPHERS_PAIRWISE,
-  *	%NL80211_ATTR_CIPHER_GROUP, %NL80211_ATTR_WPA_VERSIONS,
-  *	%NL80211_ATTR_AKM_SUITES, %NL80211_ATTR_PRIVACY,
-- *	%NL80211_ATTR_AUTH_TYPE, %NL80211_ATTR_IE, %NL80211_ATTR_IE_PROBE_RESP,
-- *	%NL80211_ATTR_IE_ASSOC_RESP.
-- * @NL80211_CMD_NEW_BEACON: add a new beacon to an access point interface,
-- *	parameters are like for %NL80211_CMD_SET_BEACON.
-- * @NL80211_CMD_DEL_BEACON: remove the beacon, stop sending it
-+ *	%NL80211_ATTR_AUTH_TYPE and %NL80211_ATTR_INACTIVITY_TIMEOUT.
-+ * @NL80211_CMD_NEW_BEACON: old alias for %NL80211_CMD_START_AP
-+ * @NL80211_CMD_STOP_AP: Stop AP operation on the given interface
-+ * @NL80211_CMD_DEL_BEACON: old alias for %NL80211_CMD_STOP_AP
-  *
-  * @NL80211_CMD_GET_STATION: Get station attributes for station identified by
-  *	%NL80211_ATTR_MAC on the interface identified by %NL80211_ATTR_IFINDEX.
-@@ -367,6 +369,11 @@
-  *	%NL80211_ATTR_WIPHY_FREQ, %NL80211_ATTR_CONTROL_PORT,
-  *	%NL80211_ATTR_CONTROL_PORT_ETHERTYPE and
-  *	%NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT.
-+ *	Background scan period can optionally be
-+ *	specified in %NL80211_ATTR_BG_SCAN_PERIOD,
-+ *	if not specified default background scan configuration
-+ *	in driver is used and if period value is 0, bg scan will be disabled.
-+ *	This attribute is ignored if driver does not support roam scan.
-  *	It is also sent as an event, with the BSSID and response IEs when the
-  *	connection is established or failed to be established. This can be
-  *	determined by the STATUS_CODE attribute.
-@@ -541,6 +548,11 @@
-  * @NL80211_CMD_SET_NOACK_MAP: sets a bitmap for the individual TIDs whether
-  *      No Acknowledgement Policy should be applied.
-  *
-+ * @NL80211_CMD_CH_SWITCH_NOTIFY: An AP or GO may decide to switch channels
-+ *	independently of the userspace SME, send this event indicating
-+ *	%NL80211_ATTR_IFINDEX is now on %NL80211_ATTR_WIPHY_FREQ with
-+ *	%NL80211_ATTR_WIPHY_CHANNEL_TYPE.
++ * @NL80211_CMD_START_P2P_DEVICE: Start the given P2P Device, identified by
++ *	its %NL80211_ATTR_WDEV identifier. It must have been created with
++ *	%NL80211_CMD_NEW_INTERFACE previously. After it has been started, the
++ *	P2P Device can be used for P2P operations, e.g. remain-on-channel and
++ *	public action frame TX.
++ * @NL80211_CMD_STOP_P2P_DEVICE: Stop the given P2P Device, identified by
++ *	its %NL80211_ATTR_WDEV identifier.
 + *
   * @NL80211_CMD_MAX: highest used command number
   * @__NL80211_CMD_AFTER_LAST: internal use
   */
-@@ -565,8 +577,10 @@ enum nl80211_commands {
- 
- 	NL80211_CMD_GET_BEACON,
- 	NL80211_CMD_SET_BEACON,
--	NL80211_CMD_NEW_BEACON,
--	NL80211_CMD_DEL_BEACON,
-+	NL80211_CMD_START_AP,
-+	NL80211_CMD_NEW_BEACON = NL80211_CMD_START_AP,
-+	NL80211_CMD_STOP_AP,
-+	NL80211_CMD_DEL_BEACON = NL80211_CMD_STOP_AP,
+@@ -708,6 +716,9 @@ enum nl80211_commands {
  
- 	NL80211_CMD_GET_STATION,
- 	NL80211_CMD_SET_STATION,
-@@ -680,6 +694,8 @@ enum nl80211_commands {
+ 	NL80211_CMD_CH_SWITCH_NOTIFY,
  
- 	NL80211_CMD_SET_NOACK_MAP,
- 
-+	NL80211_CMD_CH_SWITCH_NOTIFY,
++	NL80211_CMD_START_P2P_DEVICE,
++	NL80211_CMD_STOP_P2P_DEVICE,
 +
  	/* add new commands above here */
  
  	/* used to define NL80211_CMD_MAX below */
-@@ -1193,6 +1209,19 @@ enum nl80211_commands {
-  * @NL80211_ATTR_NOACK_MAP: This u16 bitmap contains the No Ack Policy of
-  *      up to 16 TIDs.
-  *
-+ * @NL80211_ATTR_INACTIVITY_TIMEOUT: timeout value in seconds, this can be
-+ *	used by the drivers which has MLME in firmware and does not have support
-+ *	to report per station tx/rx activity to free up the staion entry from
-+ *	the list. This needs to be used when the driver advertises the
-+ *	capability to timeout the stations.
-+ *
-+ * @NL80211_ATTR_RX_SIGNAL_DBM: signal strength in dBm (as a 32-bit int);
-+ *	this attribute is (depending on the driver capabilities) added to
-+ *	received frames indicated with %NL80211_CMD_FRAME.
-+ *
-+ * @NL80211_ATTR_BG_SCAN_PERIOD: Background scan period in seconds
-+ *      or 0 to disable background scan.
-+ *
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-  */
-@@ -1438,6 +1467,12 @@ enum nl80211_attrs {
+@@ -1506,6 +1517,8 @@ enum nl80211_attrs {
  
- 	NL80211_ATTR_NOACK_MAP,
+ 	NL80211_ATTR_USER_REG_HINT_TYPE,
  
-+	NL80211_ATTR_INACTIVITY_TIMEOUT,
-+
-+	NL80211_ATTR_RX_SIGNAL_DBM,
-+
-+	NL80211_ATTR_BG_SCAN_PERIOD,
++	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
 +
  	/* add attributes here, update the policy in nl80211.c */
  
  	__NL80211_ATTR_AFTER_LAST,
-@@ -1475,6 +1510,7 @@ enum nl80211_attrs {
- #define NL80211_ATTR_FEATURE_FLAGS NL80211_ATTR_FEATURE_FLAGS
+@@ -1575,6 +1588,10 @@ enum nl80211_attrs {
+  * @NL80211_IFTYPE_MESH_POINT: mesh point
+  * @NL80211_IFTYPE_P2P_CLIENT: P2P client
+  * @NL80211_IFTYPE_P2P_GO: P2P group owner
++ * @NL80211_IFTYPE_P2P_DEVICE: P2P device interface type, this is not a netdev
++ *	and therefore can't be created in the normal ways, use the
++ *	%NL80211_CMD_START_P2P_DEVICE and %NL80211_CMD_STOP_P2P_DEVICE
++ *	commands to create and destroy one
+  * @NL80211_IFTYPE_MAX: highest interface type number currently defined
+  * @NUM_NL80211_IFTYPES: number of defined interface types
+  *
+@@ -1593,6 +1610,7 @@ enum nl80211_iftype {
+ 	NL80211_IFTYPE_MESH_POINT,
+ 	NL80211_IFTYPE_P2P_CLIENT,
+ 	NL80211_IFTYPE_P2P_GO,
++	NL80211_IFTYPE_P2P_DEVICE,
  
- #define NL80211_MAX_SUPP_RATES			32
-+#define NL80211_MAX_SUPP_HT_RATES		77
- #define NL80211_MAX_SUPP_REG_RULES		32
- #define NL80211_TKIP_DATA_OFFSET_ENCR_KEY	0
- #define NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY	16
-@@ -1536,7 +1572,11 @@ enum nl80211_iftype {
-  * @NL80211_STA_FLAG_WME: station is WME/QoS capable
-  * @NL80211_STA_FLAG_MFP: station uses management frame protection
-  * @NL80211_STA_FLAG_AUTHENTICATED: station is authenticated
-- * @NL80211_STA_FLAG_TDLS_PEER: station is a TDLS peer
-+ * @NL80211_STA_FLAG_TDLS_PEER: station is a TDLS peer -- this flag should
-+ *	only be used in managed mode (even in the flags mask). Note that the
-+ *	flag can't be changed, it is only valid while adding a station, and
-+ *	attempts to change it will silently be ignored (rather than rejected
-+ *	as errors.)
-  * @NL80211_STA_FLAG_MAX: highest station flag number currently defined
-  * @__NL80211_STA_FLAG_AFTER_LAST: internal use
-  */
-@@ -1651,6 +1691,10 @@ enum nl80211_sta_bss_param {
-  *     containing info as possible, see &enum nl80211_sta_bss_param
-  * @NL80211_STA_INFO_CONNECTED_TIME: time since the station is last connected
+ 	/* keep last */
+ 	NUM_NL80211_IFTYPES,
+@@ -1744,6 +1762,8 @@ enum nl80211_sta_bss_param {
   * @NL80211_STA_INFO_STA_FLAGS: Contains a struct nl80211_sta_flag_update.
-+ * @NL80211_STA_INFO_BEACON_LOSS: count of times beacon loss was detected (u32)
-+ * @NL80211_STA_INFO_T_OFFSET: timing offset with respect to this STA (s64)
+  * @NL80211_STA_INFO_BEACON_LOSS: count of times beacon loss was detected (u32)
+  * @NL80211_STA_INFO_T_OFFSET: timing offset with respect to this STA (s64)
 + * @NL80211_STA_INFO_CHAIN_SIGNAL: per-chain signal strength of last PPDU
 + * @NL80211_STA_INFO_CHAIN_SIGNAL_AVG: per-chain signal strength average
   * @__NL80211_STA_INFO_AFTER_LAST: internal
   * @NL80211_STA_INFO_MAX: highest possible station info attribute
   */
-@@ -1673,6 +1717,10 @@ enum nl80211_sta_info {
- 	NL80211_STA_INFO_BSS_PARAM,
- 	NL80211_STA_INFO_CONNECTED_TIME,
+@@ -1768,6 +1788,8 @@ enum nl80211_sta_info {
  	NL80211_STA_INFO_STA_FLAGS,
-+	NL80211_STA_INFO_BEACON_LOSS,
-+	NL80211_STA_INFO_T_OFFSET,
+ 	NL80211_STA_INFO_BEACON_LOSS,
+ 	NL80211_STA_INFO_T_OFFSET,
 +	NL80211_STA_INFO_CHAIN_SIGNAL,
 +	NL80211_STA_INFO_CHAIN_SIGNAL_AVG,
  
  	/* keep last */
  	__NL80211_STA_INFO_AFTER_LAST,
-@@ -2098,8 +2146,18 @@ enum nl80211_mntr_flags {
-  * TUs) during which a mesh STA can send only one Action frame containing a
-  * PERR element.
-  *
-+ * @NL80211_MESHCONF_FORWARDING: set Mesh STA as forwarding or non-forwarding
-+ * or forwarding entity (default is TRUE - forwarding entity)
-+ *
-+ * @NL80211_MESHCONF_RSSI_THRESHOLD: RSSI threshold in dBm. This specifies the
-+ * threshold for average signal strength of candidate station to establish
-+ * a peer link.
-+ *
-  * @NL80211_MESHCONF_ATTR_MAX: highest possible mesh configuration attribute
-  *
-+ * @NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR: maximum number of neighbors
-+ * to synchronize to for 11s default synchronization method (see 11C.12.2.2)
-+ *
-  * @__NL80211_MESHCONF_ATTR_AFTER_LAST: internal use
-  */
- enum nl80211_meshconf_params {
-@@ -2122,6 +2180,9 @@ enum nl80211_meshconf_params {
- 	NL80211_MESHCONF_HWMP_RANN_INTERVAL,
- 	NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
- 	NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
-+	NL80211_MESHCONF_FORWARDING,
-+	NL80211_MESHCONF_RSSI_THRESHOLD,
-+	NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
- 
- 	/* keep last */
- 	__NL80211_MESHCONF_ATTR_AFTER_LAST,
-@@ -2161,6 +2222,11 @@ enum nl80211_meshconf_params {
-  * complete (unsecured) mesh peering without the need of a userspace daemon.
-  *
-  * @NL80211_MESH_SETUP_ATTR_MAX: highest possible mesh setup attribute number
-+ *
-+ * @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC: Enable this option to use a
-+ * vendor specific synchronization method or disable it to use the default
-+ * neighbor offset synchronization
-+ *
-  * @__NL80211_MESH_SETUP_ATTR_AFTER_LAST: Internal use
-  */
- enum nl80211_mesh_setup_params {
-@@ -2170,6 +2236,7 @@ enum nl80211_mesh_setup_params {
- 	NL80211_MESH_SETUP_IE,
- 	NL80211_MESH_SETUP_USERSPACE_AUTH,
- 	NL80211_MESH_SETUP_USERSPACE_AMPE,
-+	NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC,
- 
- 	/* keep last */
- 	__NL80211_MESH_SETUP_ATTR_AFTER_LAST,
-@@ -2179,7 +2246,7 @@ enum nl80211_mesh_setup_params {
- /**
-  * enum nl80211_txq_attr - TX queue parameter attributes
-  * @__NL80211_TXQ_ATTR_INVALID: Attribute number 0 is reserved
-- * @NL80211_TXQ_ATTR_QUEUE: TX queue identifier (NL80211_TXQ_Q_*)
-+ * @NL80211_TXQ_ATTR_AC: AC identifier (NL80211_AC_*)
-  * @NL80211_TXQ_ATTR_TXOP: Maximum burst time in units of 32 usecs, 0 meaning
-  *	disabled
-  * @NL80211_TXQ_ATTR_CWMIN: Minimum contention window [a value of the form
-@@ -2192,7 +2259,7 @@ enum nl80211_mesh_setup_params {
-  */
- enum nl80211_txq_attr {
- 	__NL80211_TXQ_ATTR_INVALID,
--	NL80211_TXQ_ATTR_QUEUE,
-+	NL80211_TXQ_ATTR_AC,
- 	NL80211_TXQ_ATTR_TXOP,
- 	NL80211_TXQ_ATTR_CWMIN,
- 	NL80211_TXQ_ATTR_CWMAX,
-@@ -2203,13 +2270,21 @@ enum nl80211_txq_attr {
- 	NL80211_TXQ_ATTR_MAX = __NL80211_TXQ_ATTR_AFTER_LAST - 1
- };
- 
--enum nl80211_txq_q {
--	NL80211_TXQ_Q_VO,
--	NL80211_TXQ_Q_VI,
--	NL80211_TXQ_Q_BE,
--	NL80211_TXQ_Q_BK
-+enum nl80211_ac {
-+	NL80211_AC_VO,
-+	NL80211_AC_VI,
-+	NL80211_AC_BE,
-+	NL80211_AC_BK,
-+	NL80211_NUM_ACS
- };
- 
-+/* backward compat */
-+#define NL80211_TXQ_ATTR_QUEUE	NL80211_TXQ_ATTR_AC
-+#define NL80211_TXQ_Q_VO	NL80211_AC_VO
-+#define NL80211_TXQ_Q_VI	NL80211_AC_VI
-+#define NL80211_TXQ_Q_BE	NL80211_AC_BE
-+#define NL80211_TXQ_Q_BK	NL80211_AC_BK
-+
- enum nl80211_channel_type {
- 	NL80211_CHAN_NO_HT,
- 	NL80211_CHAN_HT20,
-@@ -2395,12 +2470,15 @@ enum nl80211_key_attributes {
-  *	in an array of rates as defined in IEEE 802.11 7.3.2.2 (u8 values with
-  *	1 = 500 kbps) but without the IE length restriction (at most
-  *	%NL80211_MAX_SUPP_RATES in a single array).
-+ * @NL80211_TXRATE_MCS: HT (MCS) rates allowed for TX rate selection
-+ *	in an array of MCS numbers.
-  * @__NL80211_TXRATE_AFTER_LAST: internal
-  * @NL80211_TXRATE_MAX: highest TX rate attribute
-  */
- enum nl80211_tx_rate_attributes {
- 	__NL80211_TXRATE_INVALID,
- 	NL80211_TXRATE_LEGACY,
-+	NL80211_TXRATE_MCS,
- 
- 	/* keep last */
- 	__NL80211_TXRATE_AFTER_LAST,
-@@ -2786,10 +2864,13 @@ enum nl80211_ap_sme_features {
-  *	TX status to the socket error queue when requested with the
-  *	socket option.
-  * @NL80211_FEATURE_HT_IBSS: This driver supports IBSS with HT datarates.
-+ * @NL80211_FEATURE_INACTIVITY_TIMER: This driver takes care of freeing up
-+ *	the connected inactive stations in AP mode.
+@@ -2994,12 +3016,18 @@ enum nl80211_ap_sme_features {
+  * @NL80211_FEATURE_CELL_BASE_REG_HINTS: This driver has been tested
+  *	to work properly to suppport receiving regulatory hints from
+  *	cellular base stations.
++ * @NL80211_FEATURE_P2P_DEVICE_NEEDS_CHANNEL: If this is set, an active
++ *	P2P Device (%NL80211_IFTYPE_P2P_DEVICE) requires its own channel
++ *	in the interface combinations, even when it's only used for scan
++ *	and remain-on-channel. This could be due to, for example, the
++ *	remain-on-channel implementation requiring a channel context.
   */
  enum nl80211_feature_flags {
- 	NL80211_FEATURE_SK_TX_STATUS	= 1 << 0,
- 	NL80211_FEATURE_HT_IBSS		= 1 << 1,
-+	NL80211_FEATURE_INACTIVITY_TIMER = 1 << 2,
+-	NL80211_FEATURE_SK_TX_STATUS	= 1 << 0,
+-	NL80211_FEATURE_HT_IBSS		= 1 << 1,
+-	NL80211_FEATURE_INACTIVITY_TIMER = 1 << 2,
+-	NL80211_FEATURE_CELL_BASE_REG_HINTS = 1 << 3,
++	NL80211_FEATURE_SK_TX_STATUS			= 1 << 0,
++	NL80211_FEATURE_HT_IBSS				= 1 << 1,
++	NL80211_FEATURE_INACTIVITY_TIMER		= 1 << 2,
++	NL80211_FEATURE_CELL_BASE_REG_HINTS		= 1 << 3,
++	NL80211_FEATURE_P2P_DEVICE_NEEDS_CHANNEL	= 1 << 4,
  };
  
  /**
diff --git a/package/iw/patches/100-rx_rate.patch b/package/iw/patches/100-rx_rate.patch
index 780a7d4396d54493b8b9fee3ca3f9de16b1dae90..642b9f35702b063389c47e14b7d7c2e87425d934 100644
--- a/package/iw/patches/100-rx_rate.patch
+++ b/package/iw/patches/100-rx_rate.patch
@@ -1,6 +1,6 @@
 --- a/station.c
 +++ b/station.c
-@@ -29,13 +29,43 @@ enum plink_actions {
+@@ -29,13 +29,47 @@ enum plink_actions {
  	PLINK_ACTION_BLOCK,
  };
  
@@ -10,6 +10,7 @@
 +
 +	static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
 +		[NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 },
++		[NL80211_RATE_INFO_BITRATE32] = { .type = NLA_U32 },
 +		[NL80211_RATE_INFO_MCS] = { .type = NLA_U8 },
 +		[NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG },
 +		[NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG },
@@ -21,11 +22,14 @@
 +	if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX, nla, rate_policy)) {
 +		fprintf(stderr, "failed to parse nested rate attributes!\n");
 +	} else {
++		int rate = 0;
 +		printf("\n\t%s:\t", name);
-+		if (rinfo[NL80211_RATE_INFO_BITRATE]) {
-+			int rate = nla_get_u16(rinfo[NL80211_RATE_INFO_BITRATE]);
++		if (rinfo[NL80211_RATE_INFO_BITRATE32])
++			rate = nla_get_u32(rinfo[NL80211_RATE_INFO_BITRATE32]);
++		else if (rinfo[NL80211_RATE_INFO_BITRATE])
++			rate = nla_get_u16(rinfo[NL80211_RATE_INFO_BITRATE]);
++		if (rate > 0)
 +			printf("%d.%d MBit/s", rate / 10, rate % 10);
-+		}
 +
 +		if (rinfo[NL80211_RATE_INFO_MCS])
 +			printf(" MCS %d", nla_get_u8(rinfo[NL80211_RATE_INFO_MCS]));
@@ -45,20 +49,21 @@
  	char mac_addr[20], state_name[10], dev[20];
  	struct nl80211_sta_flag_update *sta_flags;
  	static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
-@@ -46,6 +76,7 @@ static int print_sta_handler(struct nl_m
- 		[NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
+@@ -47,6 +81,7 @@ static int print_sta_handler(struct nl_m
  		[NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 },
+ 		[NL80211_STA_INFO_T_OFFSET] = { .type = NLA_U64 },
  		[NL80211_STA_INFO_TX_BITRATE] = { .type = NLA_NESTED },
 +		[NL80211_STA_INFO_RX_BITRATE] = { .type = NLA_NESTED },
  		[NL80211_STA_INFO_LLID] = { .type = NLA_U16 },
  		[NL80211_STA_INFO_PLID] = { .type = NLA_U16 },
  		[NL80211_STA_INFO_PLINK_STATE] = { .type = NLA_U8 },
-@@ -55,13 +86,6 @@ static int print_sta_handler(struct nl_m
+@@ -56,14 +91,6 @@ static int print_sta_handler(struct nl_m
  			{ .minlen = sizeof(struct nl80211_sta_flag_update) },
  	};
  
 -	static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
 -		[NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 },
+-		[NL80211_RATE_INFO_BITRATE32] = { .type = NLA_U32 },
 -		[NL80211_RATE_INFO_MCS] = { .type = NLA_U8 },
 -		[NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG },
 -		[NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG },
@@ -67,20 +72,23 @@
  	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
  		  genlmsg_attrlen(gnlh, 0), NULL);
  
-@@ -114,25 +138,8 @@ static int print_sta_handler(struct nl_m
- 		printf("\n\tsignal avg:\t%d dBm",
- 			(int8_t)nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL_AVG]));
+@@ -119,28 +146,8 @@ static int print_sta_handler(struct nl_m
+ 		printf("\n\tToffset:\t%lld us",
+ 			(unsigned long long)nla_get_u64(sinfo[NL80211_STA_INFO_T_OFFSET]));
  
 -	if (sinfo[NL80211_STA_INFO_TX_BITRATE]) {
 -		if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX,
 -				     sinfo[NL80211_STA_INFO_TX_BITRATE], rate_policy)) {
 -			fprintf(stderr, "failed to parse nested rate attributes!\n");
 -		} else {
+-			int rate = 0;
 -			printf("\n\ttx bitrate:\t");
--			if (rinfo[NL80211_RATE_INFO_BITRATE]) {
--				int rate = nla_get_u16(rinfo[NL80211_RATE_INFO_BITRATE]);
+-			if (rinfo[NL80211_RATE_INFO_BITRATE32])
+-				rate = nla_get_u32(rinfo[NL80211_RATE_INFO_BITRATE32]);
+-			else if (rinfo[NL80211_RATE_INFO_BITRATE])
+-				rate = nla_get_u16(rinfo[NL80211_RATE_INFO_BITRATE]);
+-			if (rate > 0)
 -				printf("%d.%d MBit/s", rate / 10, rate % 10);
--			}
 -
 -			if (rinfo[NL80211_RATE_INFO_MCS])
 -				printf(" MCS %d", nla_get_u8(rinfo[NL80211_RATE_INFO_MCS]));
diff --git a/package/iw/patches/110-per_chain_signal_strength.patch b/package/iw/patches/110-per_chain_signal_strength.patch
index 0bc5607921cbd9d3ae87203e00c161d18ff84923..813a7d9165136e35c586be935c6ed4f7bff02e16 100644
--- a/package/iw/patches/110-per_chain_signal_strength.patch
+++ b/package/iw/patches/110-per_chain_signal_strength.patch
@@ -1,6 +1,6 @@
 --- a/station.c
 +++ b/station.c
-@@ -61,6 +61,33 @@ static void print_sta_bitrate(struct nla
+@@ -65,6 +65,33 @@ static void print_sta_bitrate(struct nla
  	}
  }
  
@@ -34,7 +34,7 @@
  static int print_sta_handler(struct nl_msg *msg, void *arg)
  {
  	struct nlattr *tb[NL80211_ATTR_MAX + 1];
-@@ -84,7 +111,10 @@ static int print_sta_handler(struct nl_m
+@@ -89,7 +116,10 @@ static int print_sta_handler(struct nl_m
  		[NL80211_STA_INFO_TX_FAILED] = { .type = NLA_U32 },
  		[NL80211_STA_INFO_STA_FLAGS] =
  			{ .minlen = sizeof(struct nl80211_sta_flag_update) },
@@ -45,7 +45,7 @@
  
  	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
  		  genlmsg_attrlen(gnlh, 0), NULL);
-@@ -131,12 +161,18 @@ static int print_sta_handler(struct nl_m
+@@ -136,12 +166,19 @@ static int print_sta_handler(struct nl_m
  	if (sinfo[NL80211_STA_INFO_TX_FAILED])
  		printf("\n\ttx failed:\t%u",
  			nla_get_u32(sinfo[NL80211_STA_INFO_TX_FAILED]));
@@ -65,6 +65,7 @@
 +		printf("\n\tsignal avg:\t%d %sdBm",
 +			(int8_t)nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL_AVG]),
 +			chain);
- 
- 	print_sta_bitrate(sinfo[NL80211_STA_INFO_TX_BITRATE], "tx bitrate");
- 	print_sta_bitrate(sinfo[NL80211_STA_INFO_RX_BITRATE], "rx bitrate");
++
+ 	if (sinfo[NL80211_STA_INFO_T_OFFSET])
+ 		printf("\n\tToffset:\t%lld us",
+ 			(unsigned long long)nla_get_u64(sinfo[NL80211_STA_INFO_T_OFFSET]));
diff --git a/package/iw/patches/120-tdls_peer_indentation.patch b/package/iw/patches/120-tdls_peer_indentation.patch
index 937b9dd3debf6b5ae9f272361876242db72b97d0..68368734e1b8f5df31cf8ddbf29f1111c73f333c 100644
--- a/package/iw/patches/120-tdls_peer_indentation.patch
+++ b/package/iw/patches/120-tdls_peer_indentation.patch
@@ -1,6 +1,6 @@
 --- a/station.c
 +++ b/station.c
-@@ -258,7 +258,7 @@ static int print_sta_handler(struct nl_m
+@@ -267,7 +267,7 @@ static int print_sta_handler(struct nl_m
  		}
  
  		if (sta_flags->mask & BIT(NL80211_STA_FLAG_TDLS_PEER)) {
diff --git a/package/iw/patches/130-antenna_gain.patch b/package/iw/patches/130-antenna_gain.patch
new file mode 100644
index 0000000000000000000000000000000000000000..f3ca691e50c33f79e5b4a70b9d7ab484a52592f1
--- /dev/null
+++ b/package/iw/patches/130-antenna_gain.patch
@@ -0,0 +1,34 @@
+--- a/phy.c
++++ b/phy.c
+@@ -359,3 +359,31 @@ COMMAND(set, antenna, "<bitmap> | all | 
+ 	NL80211_CMD_SET_WIPHY, 0, CIB_PHY, handle_antenna,
+ 	"Set a bitmap of allowed antennas to use for TX and RX.\n"
+ 	"The driver may reject antenna configurations it cannot support.");
++
++static int handle_antenna_gain(struct nl80211_state *state,
++			       struct nl_cb *cb,
++			       struct nl_msg *msg,
++			       int argc, char **argv,
++			       enum id_input id)
++{
++	char *endptr;
++	int dbm;
++
++	/* get the required args */
++	if (argc != 1)
++		return 1;
++
++	dbm = strtol(argv[0], &endptr, 10);
++	if (*endptr)
++		return 2;
++
++	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_GAIN, dbm);
++
++	return 0;
++
++ nla_put_failure:
++	return -ENOBUFS;
++}
++COMMAND(set, antenna_gain, "<antenna gain in dBm>",
++	NL80211_CMD_SET_WIPHY, 0, CIB_PHY, handle_antenna_gain,
++	"Specify antenna gain.");