fix a rare wds related noderef issue

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@13095 3c298f89-4303-0410-b956-a3cf2f4a3e73

18 files changed, 191 insertions, 190 deletions

diff --git a/package/madwifi/patches/370-wdsvap.patch b/package/madwifi/patches/370-wdsvap.patch
index 0e4b3a85d3..3d266e2b52 100644
--- a/package/madwifi/patches/370-wdsvap.patch
+++ b/package/madwifi/patches/370-wdsvap.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -124,7 +124,7 @@
+@@ -124,7 +124,7 @@ enum {
  };
  
  static struct ieee80211vap *ath_vap_create(struct ieee80211com *,
@@ -9,7 +9,7 @@
  static void ath_vap_delete(struct ieee80211vap *);
  static int ath_init(struct net_device *);
  static int ath_set_ack_bitrate(struct ath_softc *, int);
-@@ -1123,8 +1123,6 @@
+@@ -1123,8 +1123,6 @@ ath_attach(u_int16_t devid, struct net_d
  			autocreatemode = IEEE80211_M_IBSS;
  		else if (!strcmp(autocreate, "ahdemo"))
  			autocreatemode = IEEE80211_M_AHDEMO;
@@ -18,7 +18,7 @@
  		else if (!strcmp(autocreate, "monitor"))
  			autocreatemode = IEEE80211_M_MONITOR;
  		else {
-@@ -1137,7 +1135,7 @@
+@@ -1137,7 +1135,7 @@ ath_attach(u_int16_t devid, struct net_d
  	if (autocreatemode != -1) {
  		rtnl_lock();
  		vap = ieee80211_create_vap(ic, "ath%d", dev,
@@ -27,7 +27,7 @@
  		rtnl_unlock();
  		if (vap == NULL)
  			EPRINTF(sc, "Autocreation of %s VAP failed.", autocreate);
-@@ -1230,14 +1228,14 @@
+@@ -1230,14 +1228,14 @@ ath_detach(struct net_device *dev)
  
  static struct ieee80211vap *
  ath_vap_create(struct ieee80211com *ic, const char *name,
@@ -44,7 +44,7 @@
  
  	if (ic->ic_dev->flags & IFF_RUNNING) {
  		/* needs to disable hardware too */
-@@ -1271,8 +1269,12 @@
+@@ -1271,8 +1269,12 @@ ath_vap_create(struct ieee80211com *ic, 
  		} else
  			ic_opmode = opmode;
  		break;
@@ -58,7 +58,7 @@
  		/* permit multiple APs and/or WDS links */
  		/* XXX sta+ap for repeater/bridge application */
  		if ((sc->sc_nvaps != 0) && (ic->ic_opmode == IEEE80211_M_STA))
-@@ -1304,7 +1306,7 @@
+@@ -1304,7 +1306,7 @@ ath_vap_create(struct ieee80211com *ic, 
  	}
  
  	avp = dev->priv;
@@ -67,7 +67,7 @@
  	/* override with driver methods */
  	vap = &avp->av_vap;
  	avp->av_newstate = vap->iv_newstate;
-@@ -4209,8 +4211,7 @@
+@@ -4209,8 +4211,7 @@ ath_calcrxfilter(struct ath_softc *sc)
  	if (ic->ic_opmode == IEEE80211_M_STA ||
  	    sc->sc_opmode == HAL_M_IBSS ||	/* NB: AHDEMO too */
  	    (sc->sc_nostabeacons) || sc->sc_scanning ||
@@ -77,7 +77,7 @@
  		rfilt |= HAL_RX_FILTER_BEACON;
  	if (sc->sc_nmonvaps > 0)
  		rfilt |= (HAL_RX_FILTER_CONTROL | HAL_RX_FILTER_BEACON |
-@@ -9030,8 +9031,6 @@
+@@ -9030,8 +9031,6 @@ ath_calibrate(unsigned long arg)
  		 * set sc->beacons if we might need to restart
                   * them after ath_reset. */
  		if (!sc->sc_beacons &&
@@ -88,7 +88,7 @@
  			sc->sc_beacons = 1;
 --- a/net80211/ieee80211.c
 +++ b/net80211/ieee80211.c
-@@ -396,7 +396,7 @@
+@@ -396,7 +396,7 @@ EXPORT_SYMBOL(ieee80211_ifdetach);
  
  int
  ieee80211_vap_setup(struct ieee80211com *ic, struct net_device *dev,
@@ -97,7 +97,7 @@
  {
  #define	IEEE80211_C_OPMODE \
  	(IEEE80211_C_IBSS | IEEE80211_C_HOSTAP | IEEE80211_C_AHDEMO | \
-@@ -510,9 +510,18 @@
+@@ -510,9 +510,18 @@ ieee80211_vap_setup(struct ieee80211com 
  
  	vap->iv_monitor_crc_errors = 0;
  	vap->iv_monitor_phy_errors = 0;
@@ -118,7 +118,7 @@
  	/* NB: Defer setting dev_addr so driver can override */
  
  	ieee80211_crypto_vattach(vap);
-@@ -547,7 +556,8 @@
+@@ -547,7 +556,8 @@ ieee80211_vap_attach(struct ieee80211vap
  	ifmedia_set(&vap->iv_media, imr.ifm_active);
  
  	IEEE80211_LOCK_IRQ(ic);
@@ -128,7 +128,7 @@
  	IEEE80211_UNLOCK_IRQ(ic);
  
  	IEEE80211_ADDR_COPY(dev->dev_addr, vap->iv_myaddr);
-@@ -579,10 +589,24 @@
+@@ -579,10 +589,24 @@ ieee80211_vap_detach(struct ieee80211vap
  {
  	struct ieee80211com *ic = vap->iv_ic;
  	struct net_device *dev = vap->iv_dev;
@@ -156,7 +156,7 @@
  	IEEE80211_UNLOCK_IRQ(ic);
 --- a/net80211/ieee80211_ioctl.h
 +++ b/net80211/ieee80211_ioctl.h
-@@ -474,7 +474,7 @@
+@@ -474,7 +474,7 @@ struct ieee80211req {
  #define	IEEE80211_IOC_DTIM_PERIOD	52	/* DTIM period (beacons) */
  #define	IEEE80211_IOC_BEACON_INTERVAL	53	/* beacon interval (ms) */
  #define	IEEE80211_IOC_ADDMAC		54	/* add sta to MAC ACL table */
@@ -165,7 +165,7 @@
  #define	IEEE80211_IOC_FF		56	/* ATH fast frames (on, off) */
  #define	IEEE80211_IOC_TURBOP		57	/* ATH turbo' (on, off) */
  #define	IEEE80211_IOC_APPIEBUF		58	/* IE in the management frame */
-@@ -552,8 +552,8 @@
+@@ -552,8 +552,8 @@ struct ieee80211req_scan_result {
  #define	IEEE80211_IOCTL_HALMAP		(SIOCIWFIRSTPRIV+21)
  #define	IEEE80211_IOCTL_ADDMAC		(SIOCIWFIRSTPRIV+22)
  #define	IEEE80211_IOCTL_DELMAC		(SIOCIWFIRSTPRIV+24)
@@ -178,7 +178,7 @@
  
 --- a/net80211/ieee80211_linux.h
 +++ b/net80211/ieee80211_linux.h
-@@ -650,5 +650,5 @@
+@@ -650,5 +650,5 @@ struct ifreq;
  int ieee80211_ioctl_create_vap(struct ieee80211com *, struct ifreq *,
  	struct net_device *);
  struct ieee80211vap *ieee80211_create_vap(struct ieee80211com *, char *,
@@ -187,7 +187,7 @@
  #endif /* _NET80211_IEEE80211_LINUX_H_ */
 --- a/net80211/ieee80211_var.h
 +++ b/net80211/ieee80211_var.h
-@@ -187,6 +187,12 @@
+@@ -187,6 +187,12 @@ struct ieee80211vap {
  	struct ieee80211_proc_entry *iv_proc_entries;
  	struct vlan_group *iv_vlgrp;			/* vlan group state */
  
@@ -200,7 +200,7 @@
  	TAILQ_ENTRY(ieee80211vap) iv_next;		/* list of vap instances */
  	struct ieee80211com *iv_ic;			/* back ptr to common state */
  	u_int32_t iv_debug;				/* debug msg flags */
-@@ -447,7 +453,7 @@
+@@ -447,7 +453,7 @@ struct ieee80211com {
  	atomic_t ic_node_counter;
  	/* Virtual AP create/delete */
  	struct ieee80211vap *(*ic_vap_create)(struct ieee80211com *,
@@ -209,7 +209,7 @@
  	void (*ic_vap_delete)(struct ieee80211vap *);
  
  	/* Send/recv 802.11 management frame */
-@@ -703,7 +709,7 @@
+@@ -703,7 +709,7 @@ MALLOC_DECLARE(M_80211_VAP);
  int ieee80211_ifattach(struct ieee80211com *);
  void ieee80211_ifdetach(struct ieee80211com *);
  int ieee80211_vap_setup(struct ieee80211com *, struct net_device *,
@@ -220,7 +220,7 @@
  void ieee80211_mark_dfs(struct ieee80211com *, struct ieee80211_channel *);
 --- a/net80211/ieee80211_wireless.c
 +++ b/net80211/ieee80211_wireless.c
-@@ -2190,7 +2190,7 @@
+@@ -2190,7 +2190,7 @@ ieee80211_setupxr(struct ieee80211vap *v
  			ieee80211_scan_flush(ic);	/* NB: could optimize */
  
  			if (!(xrvap = ic->ic_vap_create(ic, name, IEEE80211_M_HOSTAP,
@@ -229,7 +229,7 @@
  				return;
  
  			/* We use iv_xrvap to link to the parent VAP as well */
-@@ -3801,74 +3801,51 @@
+@@ -3801,74 +3801,51 @@ ieee80211_ioctl_setmlme(struct net_devic
  	return 0;
  }
  
@@ -329,7 +329,7 @@
  }
  
  /*
-@@ -5391,8 +5368,8 @@
+@@ -5391,8 +5368,8 @@ static const struct iw_priv_args ieee802
  	  IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0, "kickmac"},
  	{ IEEE80211_IOCTL_WDSADDMAC,
  	  IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0,"wds_add" },
@@ -340,7 +340,7 @@
  	{ IEEE80211_IOCTL_SETCHANLIST,
  	  IW_PRIV_TYPE_CHANLIST | IW_PRIV_SIZE_FIXED, 0,"setchanlist" },
  	{ IEEE80211_IOCTL_GETCHANLIST,
-@@ -5884,8 +5861,8 @@
+@@ -5884,8 +5861,8 @@ static const iw_handler ieee80211_priv_h
  #endif
  	set_priv(IEEE80211_IOCTL_ADDMAC, ieee80211_ioctl_addmac),
  	set_priv(IEEE80211_IOCTL_DELMAC, ieee80211_ioctl_delmac),
@@ -351,7 +351,7 @@
  	set_priv(IEEE80211_IOCTL_KICKMAC, ieee80211_ioctl_kickmac),
  	set_priv(IEEE80211_IOCTL_SETSCANLIST, ieee80211_ioctl_setscanlist),
  #ifdef ATH_REVERSE_ENGINEERING
-@@ -5956,7 +5933,7 @@
+@@ -5956,7 +5933,7 @@ ieee80211_ioctl_create_vap(struct ieee80
  
  	strncpy(name, cp.icp_name, sizeof(name));
  
@@ -360,7 +360,7 @@
  	if (vap == NULL)
  		return -EIO;
  
-@@ -5973,9 +5950,9 @@
+@@ -5973,9 +5950,9 @@ EXPORT_SYMBOL(ieee80211_ioctl_create_vap
   */
  struct ieee80211vap*
  ieee80211_create_vap(struct ieee80211com *ic, char *name,
@@ -374,7 +374,7 @@
  
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -201,6 +201,7 @@
+@@ -201,6 +201,7 @@ ieee80211_input(struct ieee80211vap * va
  	struct ieee80211_node * ni = ni_or_null;
  	struct ieee80211com *ic = vap->iv_ic;
  	struct net_device *dev = vap->iv_dev;
@@ -382,7 +382,7 @@
  	struct ieee80211_frame *wh;
  	struct ieee80211_key *key;
  	struct ether_header *eh;
-@@ -545,11 +546,29 @@
+@@ -545,11 +546,30 @@ ieee80211_input(struct ieee80211vap * va
  			 * the node table for the packet source address (addr4).
  			 * If not, add one.
  			 */
@@ -402,7 +402,8 @@
 +					}
 +				}
 +				if (ni_wds != NULL) {
-+					ieee80211_unref_node(&ni);
++					if (ni_or_null == NULL)
++						ieee80211_unref_node(&ni);
 +					ni = ieee80211_ref_node(ni_wds);
 +				}
 +			}
@@ -415,7 +416,7 @@
  
  				if (!(vap->iv_flags_ext & IEEE80211_FEXT_WDS)) {
  					IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
-@@ -557,7 +576,6 @@
+@@ -557,7 +577,6 @@ ieee80211_input(struct ieee80211vap * va
  					goto err;
  				}
  				wh4 = (struct ieee80211_frame_addr4 *)skb->data;
@@ -423,7 +424,7 @@
  				ni_wds = ieee80211_find_wds_node(nt, wh4->i_addr4);
  				/* Last call increments ref count if !NULL */
  				if ((ni_wds != NULL) && (ni_wds != ni)) {
-@@ -3084,8 +3102,7 @@
+@@ -3084,8 +3103,7 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  		    (vap->iv_opmode == IEEE80211_M_STA && ni->ni_associd) ||
  		    (vap->iv_opmode == IEEE80211_M_IBSS) ||
  			((subtype == IEEE80211_FC0_SUBTYPE_BEACON) &&
@@ -433,7 +434,7 @@
  			vap->iv_stats.is_rx_mgtdiscard++;
  			return;
  		}
-@@ -3471,13 +3488,53 @@
+@@ -3471,13 +3489,53 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  		 */
  		if (ic->ic_flags & IEEE80211_F_SCAN) {
  			ieee80211_add_scan(vap, &scan, wh, subtype, rssi, rtsf);
@@ -492,7 +493,7 @@
  			} else {
  				/*
  				 * Copy data from beacon to neighbor table.
-@@ -3490,6 +3547,7 @@
+@@ -3490,6 +3548,7 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  				IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
  				memcpy(ni->ni_tstamp.data, scan.tstamp,
  					sizeof(ni->ni_tstamp));
@@ -502,7 +503,7 @@
  				ni->ni_capinfo = scan.capinfo;
 --- a/net80211/ieee80211_node.c
 +++ b/net80211/ieee80211_node.c
-@@ -1553,22 +1553,24 @@
+@@ -1553,22 +1553,24 @@ ieee80211_find_rxnode(struct ieee80211co
  	((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
  	struct ieee80211_node_table *nt;
  	struct ieee80211_node *ni;
@@ -536,7 +537,7 @@
  #endif
  	IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
  
-@@ -1669,6 +1671,11 @@
+@@ -1669,6 +1671,11 @@ ieee80211_free_node(struct ieee80211_nod
  {
  	struct ieee80211vap *vap = ni->ni_vap;
  
@@ -548,7 +549,7 @@
  	atomic_dec(&ni->ni_ic->ic_node_counter);
  	node_print_message(IEEE80211_MSG_NODE|IEEE80211_MSG_NODE_REF,
  			   1 /* show counter */, 
-@@ -1781,22 +1788,6 @@
+@@ -1781,22 +1788,6 @@ restart:
  		    jiffies > ni->ni_rxfragstamp + HZ) {
  			ieee80211_dev_kfree_skb(&ni->ni_rxfrag);
  		}
@@ -573,7 +574,7 @@
  			struct ieee80211vap *vap = ni->ni_vap;
 --- a/net80211/ieee80211_output.c
 +++ b/net80211/ieee80211_output.c
-@@ -246,10 +246,16 @@
+@@ -246,10 +246,16 @@ ieee80211_hardstart(struct sk_buff *skb,
  	 * things like power save.
  	 */
  	eh = (struct ether_header *)skb->data;
@@ -593,7 +594,7 @@
  	if (ni == NULL) {
  		/* NB: ieee80211_find_txnode does stat+msg */
  		goto bad;
-@@ -788,7 +794,7 @@
+@@ -788,7 +794,7 @@ ieee80211_encap(struct ieee80211_node *n
  		break;
  	case IEEE80211_M_WDS:
  		use4addr = 1;
@@ -602,7 +603,7 @@
  		break;
  	case IEEE80211_M_HOSTAP:
  		if (!IEEE80211_IS_MULTICAST(eh.ether_dhost) &&
-@@ -973,7 +979,7 @@
+@@ -973,7 +979,7 @@ ieee80211_encap(struct ieee80211_node *n
  			break;
  		case IEEE80211_M_WDS:
  			wh->i_fc[1] = IEEE80211_FC1_DIR_DSTODS;
@@ -613,7 +614,7 @@
  			IEEE80211_ADDR_COPY(WH4(wh)->i_addr4, eh.ether_shost);
 --- a/tools/athkey.c
 +++ b/tools/athkey.c
-@@ -118,7 +118,7 @@
+@@ -118,7 +118,7 @@ set80211priv(const char *dev, int op, vo
  				IOCTL_ERR(IEEE80211_IOCTL_ADDMAC),
  				IOCTL_ERR(IEEE80211_IOCTL_DELMAC),
  				IOCTL_ERR(IEEE80211_IOCTL_WDSADDMAC),
@@ -624,7 +625,7 @@
  			};
 --- a/tools/athchans.c
 +++ b/tools/athchans.c
-@@ -118,7 +118,7 @@
+@@ -118,7 +118,7 @@ set80211priv(const char *dev, int op, vo
  				IOCTL_ERR(IEEE80211_IOCTL_ADDMAC),
  				IOCTL_ERR(IEEE80211_IOCTL_DELMAC),
  				IOCTL_ERR(IEEE80211_IOCTL_WDSADDMAC),
@@ -635,7 +636,7 @@
  			};
 --- a/tools/wlanconfig.c
 +++ b/tools/wlanconfig.c
-@@ -968,7 +968,7 @@
+@@ -968,7 +968,7 @@ do80211priv(struct iwreq *iwr, const cha
  			IOCTL_ERR(IEEE80211_IOCTL_ADDMAC),
  			IOCTL_ERR(IEEE80211_IOCTL_DELMAC),
  			IOCTL_ERR(IEEE80211_IOCTL_WDSADDMAC),
@@ -646,7 +647,7 @@
  		};
 --- a/net80211/ieee80211_proto.c
 +++ b/net80211/ieee80211_proto.c
-@@ -1557,57 +1557,12 @@
+@@ -1557,57 +1557,12 @@ __ieee80211_newstate(struct ieee80211vap
  		switch (ostate) {
  		case IEEE80211_S_INIT:
  			if (vap->iv_opmode == IEEE80211_M_MONITOR ||
diff --git a/package/madwifi/patches/371-wds_sta_separation.patch b/package/madwifi/patches/371-wds_sta_separation.patch
index a37ebd4938..b40eafa08d 100644
--- a/package/madwifi/patches/371-wds_sta_separation.patch
+++ b/package/madwifi/patches/371-wds_sta_separation.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -202,6 +202,7 @@
+@@ -202,6 +202,7 @@ ieee80211_input(struct ieee80211vap * va
  	struct ieee80211com *ic = vap->iv_ic;
  	struct net_device *dev = vap->iv_dev;
  	struct ieee80211_node *ni_wds = NULL;
@@ -8,7 +8,7 @@
  	struct ieee80211_frame *wh;
  	struct ieee80211_key *key;
  	struct ether_header *eh;
-@@ -435,7 +436,7 @@
+@@ -435,7 +436,7 @@ ieee80211_input(struct ieee80211vap * va
  
  	switch (type) {
  	case IEEE80211_FC0_TYPE_DATA:
@@ -17,7 +17,7 @@
  		if (skb->len < hdrspace) {
  			IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  				wh, "data", "too short: len %u, expecting %u",
-@@ -445,16 +446,24 @@
+@@ -445,16 +446,24 @@ ieee80211_input(struct ieee80211vap * va
  		}
  		switch (vap->iv_opmode) {
  		case IEEE80211_M_STA:
@@ -46,7 +46,7 @@
  				/* Discard multicast if IFF_MULTICAST not set */
  				if ((0 != memcmp(wh->i_addr3, dev->broadcast, ETH_ALEN)) && 
  					(0 == (dev->flags & IFF_MULTICAST))) {
-@@ -482,24 +491,10 @@
+@@ -482,24 +491,10 @@ ieee80211_input(struct ieee80211vap * va
  					vap->iv_stats.is_rx_mcastecho++;
  					goto out;
  				}
@@ -75,7 +75,7 @@
  			}
  			break;
  		case IEEE80211_M_IBSS:
-@@ -541,6 +536,11 @@
+@@ -541,6 +536,11 @@ ieee80211_input(struct ieee80211vap * va
  				vap->iv_stats.is_rx_notassoc++;
  				goto err;
  			}
@@ -87,7 +87,7 @@
  			/*
  			 * If we're a 4 address packet, make sure we have an entry in
  			 * the node table for the packet source address (addr4).
-@@ -548,9 +548,16 @@
+@@ -548,9 +548,16 @@ ieee80211_input(struct ieee80211vap * va
  			 */
  
  			/* check for wds link first */
@@ -105,7 +105,7 @@
  				TAILQ_FOREACH(avp, &vap->iv_wdslinks, iv_wdsnext) {
  					if (!memcmp(avp->wds_mac, wh->i_addr2, IEEE80211_ADDR_LEN)) {
  						IEEE80211_LOCK_IRQ(ni->ni_ic);
-@@ -566,7 +573,7 @@
+@@ -567,7 +574,7 @@ ieee80211_input(struct ieee80211vap * va
  			}
  
  			/* XXX: Useless node mgmt API; make better */
@@ -114,7 +114,7 @@
  				struct ieee80211_node_table *nt = &ic->ic_sta;
  				struct ieee80211_frame_addr4 *wh4;
  
-@@ -626,6 +633,11 @@
+@@ -627,6 +634,11 @@ ieee80211_input(struct ieee80211vap * va
  			goto out;
  		}
  
@@ -126,7 +126,7 @@
  		/*
  		 * Handle privacy requirements.  Note that we
  		 * must not be preempted from here until after
-@@ -698,8 +710,12 @@
+@@ -699,8 +711,12 @@ ieee80211_input(struct ieee80211vap * va
  		if (! accept_data_frame(vap, ni, key, skb, eh))
  			goto out;
  
@@ -141,7 +141,7 @@
  		IEEE80211_NODE_STAT(ni, rx_data);
  		IEEE80211_NODE_STAT_ADD(ni, rx_bytes, skb->len);
  		ic->ic_lastdata = jiffies;
-@@ -1132,6 +1148,13 @@
+@@ -1133,6 +1149,13 @@ ieee80211_deliver_data(struct ieee80211_
  		dev = vap->iv_xrvap->iv_dev;
  #endif
  
@@ -155,7 +155,7 @@
  	/* perform as a bridge within the vap */
  	/* XXX intra-vap bridging only */
  	if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
-@@ -1157,7 +1180,16 @@
+@@ -1158,7 +1181,16 @@ ieee80211_deliver_data(struct ieee80211_
  			if (ni1 != NULL) {
  				if (ni1->ni_vap == vap &&
  				    ieee80211_node_is_authorized(ni1) &&
@@ -174,7 +174,7 @@
  				}
 --- a/net80211/ieee80211_ioctl.h
 +++ b/net80211/ieee80211_ioctl.h
-@@ -649,6 +649,7 @@
+@@ -649,6 +649,7 @@ enum {
  	IEEE80211_PARAM_BGSCAN_THRESH		= 79,	/* bg scan rssi threshold */
  	IEEE80211_PARAM_RSSI_DIS_THR	= 80,	/* rssi threshold for disconnection */
  	IEEE80211_PARAM_RSSI_DIS_COUNT	= 81,	/* counter for rssi threshold */
@@ -184,7 +184,7 @@
  #define	SIOCG80211STATS			(SIOCDEVPRIVATE+2)
 --- a/net80211/ieee80211_node.h
 +++ b/net80211/ieee80211_node.h
-@@ -92,11 +92,13 @@
+@@ -92,11 +92,13 @@ struct ath_softc;
   * the ieee80211com structure.
   */
  struct ieee80211_node {
@@ -199,7 +199,7 @@
  	atomic_t ni_refcnt;
  	u_int ni_scangen;			/* gen# for timeout scan */
  	u_int8_t ni_authmode;			/* authentication algorithm */
-@@ -430,5 +432,6 @@
+@@ -430,5 +432,6 @@ void ieee80211_node_join(struct ieee8021
  void ieee80211_node_leave(struct ieee80211_node *);
  u_int8_t ieee80211_getrssi(struct ieee80211com *);
  int32_t ieee80211_get_node_count(struct ieee80211com *);
@@ -208,7 +208,7 @@
  
 --- a/net80211/ieee80211_var.h
 +++ b/net80211/ieee80211_var.h
-@@ -322,6 +322,7 @@
+@@ -322,6 +322,7 @@ struct ieee80211com {
  	u_int8_t ic_myaddr[IEEE80211_ADDR_LEN];
  	struct timer_list ic_inact;		/* mgmt/inactivity timer */
  
@@ -216,7 +216,7 @@
  	u_int32_t ic_flags;			/* state flags */
  	u_int32_t ic_flags_ext;			/* extension of state flags */
  	u_int32_t ic_caps;			/* capabilities */
-@@ -625,6 +626,7 @@
+@@ -625,6 +626,7 @@ MALLOC_DECLARE(M_80211_VAP);
  #define IEEE80211_FEXT_DROPUNENC_EAPOL	0x00000800	/* CONF: drop unencrypted eapol frames */
  #define IEEE80211_FEXT_APPIE_UPDATE	0x00001000	/* STATE: beacon APP IE updated */
  #define IEEE80211_FEXT_BGSCAN_THR	0x00002000	/* bgscan due to low rssi */
@@ -226,7 +226,7 @@
  #define IEEE80211_COM_UAPSD_DISABLE(_ic)	((_ic)->ic_flags_ext &= ~IEEE80211_FEXT_UAPSD)
 --- a/net80211/ieee80211_wireless.c
 +++ b/net80211/ieee80211_wireless.c
-@@ -2867,6 +2867,14 @@
+@@ -2867,6 +2867,14 @@ ieee80211_ioctl_setparam(struct net_devi
  		else
  			vap->iv_minrateindex = 0;
  		break;
@@ -241,7 +241,7 @@
  #ifdef ATH_REVERSE_ENGINEERING
  	case IEEE80211_PARAM_DUMPREGS:
  		ieee80211_dump_registers(dev, info, w, extra);
-@@ -3223,6 +3231,9 @@
+@@ -3223,6 +3231,9 @@ ieee80211_ioctl_getparam(struct net_devi
  	case IEEE80211_PARAM_MINRATE:
  		param[0] = vap->iv_minrateindex;
  		break;
@@ -251,7 +251,7 @@
  	default:
  		return -EOPNOTSUPP;
  	}
-@@ -4447,6 +4458,8 @@
+@@ -4447,6 +4458,8 @@ get_sta_space(void *arg, struct ieee8021
  	struct ieee80211vap *vap = ni->ni_vap;
  	size_t ielen;
  
@@ -260,7 +260,7 @@
  	if (vap != req->vap && vap != req->vap->iv_xrvap)	/* only entries for this vap */
  		return;
  	if ((vap->iv_opmode == IEEE80211_M_HOSTAP ||
-@@ -4466,6 +4479,8 @@
+@@ -4466,6 +4479,8 @@ get_sta_info(void *arg, struct ieee80211
  	size_t ielen, len;
  	u_int8_t *cp;
  
@@ -269,7 +269,7 @@
  	if (vap != req->vap && vap != req->vap->iv_xrvap)	/* only entries for this vap (or) xrvap */
  		return;
  	if ((vap->iv_opmode == IEEE80211_M_HOSTAP ||
-@@ -5767,6 +5782,10 @@
+@@ -5767,6 +5782,10 @@ static const struct iw_priv_args ieee802
  	 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_minrate"},
  	{ IEEE80211_IOCTL_SETSCANLIST,
  	 IW_PRIV_TYPE_CHAR | 255, 0, "setscanlist"},
@@ -280,7 +280,7 @@
  
  #ifdef ATH_REVERSE_ENGINEERING
  	/*
-@@ -5890,6 +5909,8 @@
+@@ -5890,6 +5909,8 @@ static int
  ieee80211_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
  {
  	struct ieee80211vap *vap = dev->priv;
@@ -289,7 +289,7 @@
  
  	switch (cmd) {
  	case SIOCG80211STATS:
-@@ -5898,8 +5919,20 @@
+@@ -5898,8 +5919,20 @@ ieee80211_ioctl(struct net_device *dev, 
  	case SIOC80211IFDESTROY:
  		if (!capable(CAP_NET_ADMIN))
  			return -EPERM;
@@ -321,7 +321,7 @@
  
  #include "if_media.h"
  
-@@ -236,7 +237,11 @@
+@@ -236,7 +237,11 @@ void
  ieee80211_node_vdetach(struct ieee80211vap *vap)
  {
  	struct ieee80211com *ic = vap->iv_ic;
@@ -333,7 +333,7 @@
  	ieee80211_node_table_reset(&ic->ic_sta, vap);
  	if (vap->iv_bss != NULL) {
  		ieee80211_unref_node(&vap->iv_bss);
-@@ -1134,6 +1139,57 @@
+@@ -1134,6 +1139,57 @@ ieee80211_alloc_node(struct ieee80211vap
  	return ni;
  }
  
@@ -391,7 +391,7 @@
  /* Add wds address to the node table */
  int
  #ifdef IEEE80211_DEBUG_REFCNT
-@@ -2254,6 +2310,36 @@
+@@ -2254,6 +2310,36 @@ ieee80211_node_leave_11g(struct ieee8021
  	}
  }
  
@@ -428,7 +428,7 @@
  /*
   * Handle bookkeeping for a station/neighbor leaving
   * the bss when operating in ap or adhoc modes.
-@@ -2270,6 +2356,12 @@
+@@ -2270,6 +2356,12 @@ ieee80211_node_leave(struct ieee80211_no
  			ni, "station with aid %d leaves (refcnt %u)",
  			IEEE80211_NODE_AID(ni), atomic_read(&ni->ni_refcnt));
  
@@ -443,7 +443,7 @@
  	 */
 --- a/net80211/ieee80211_linux.h
 +++ b/net80211/ieee80211_linux.h
-@@ -81,6 +81,12 @@
+@@ -81,6 +81,12 @@ set_quality(struct iw_quality *iq, u_int
  #endif
  }
  
@@ -456,7 +456,7 @@
  /*
   * Task deferral
   *
-@@ -113,6 +119,29 @@
+@@ -113,6 +119,29 @@ typedef void *IEEE80211_TQUEUE_ARG;
  
  #define	IEEE80211_RESCHEDULE	schedule
  
@@ -488,7 +488,7 @@
   * because spinlocks do not exist in this configuration. Instead IRQs 
 --- a/net80211/ieee80211_proto.c
 +++ b/net80211/ieee80211_proto.c
-@@ -1081,6 +1081,8 @@
+@@ -1081,6 +1081,8 @@ ieee80211_init(struct net_device *dev, i
  int
  ieee80211_open(struct net_device *dev)
  {
@@ -497,7 +497,7 @@
  	return ieee80211_init(dev, 0);
  }
  
-@@ -1116,11 +1118,33 @@
+@@ -1116,11 +1118,33 @@ ieee80211_stop(struct net_device *dev)
  	struct ieee80211vap *vap = dev->priv;
  	struct ieee80211com *ic = vap->iv_ic;
  	struct net_device *parent = ic->ic_dev;
@@ -531,7 +531,7 @@
  	ieee80211_new_state(vap, IEEE80211_S_INIT, -1);
  	if (dev->flags & IFF_RUNNING) {
  		dev->flags &= ~IFF_RUNNING;		/* mark us stopped */
-@@ -1630,6 +1654,7 @@
+@@ -1630,6 +1654,7 @@ __ieee80211_newstate(struct ieee80211vap
  		 */
  		if (ni->ni_authmode != IEEE80211_AUTH_8021X)
  			ieee80211_node_authorize(ni);
@@ -539,7 +539,7 @@
  #ifdef ATH_SUPERG_XR
  		/*
  		 * fire a timer to bring up XR vap if configured.
-@@ -1885,8 +1910,15 @@
+@@ -1885,8 +1910,15 @@ ieee80211_newstate(struct ieee80211vap *
  		if (ostate == IEEE80211_S_SCAN || 
  		    ostate == IEEE80211_S_AUTH ||
  		    ostate == IEEE80211_S_ASSOC) {
@@ -557,7 +557,7 @@
  			if (dstate == IEEE80211_S_RUN) {
 --- a/net80211/ieee80211.c
 +++ b/net80211/ieee80211.c
-@@ -373,10 +373,25 @@
+@@ -373,10 +373,25 @@ void
  ieee80211_ifdetach(struct ieee80211com *ic)
  {
  	struct ieee80211vap *vap;
@@ -584,7 +584,7 @@
  	rtnl_unlock();
  
  	del_timer(&ic->ic_dfs_excl_timer);
-@@ -599,8 +614,10 @@
+@@ -599,8 +614,10 @@ ieee80211_vap_detach(struct ieee80211vap
  
  	IEEE80211_CANCEL_TQUEUE(&vap->iv_stajoin1tq);
  	IEEE80211_LOCK_IRQ(ic);
@@ -598,7 +598,7 @@
  		TAILQ_REMOVE(&vap->iv_master->iv_wdslinks, vap, iv_wdsnext);
 --- a/ath/if_athvar.h
 +++ b/ath/if_athvar.h
-@@ -79,28 +79,6 @@
+@@ -79,28 +79,6 @@ typedef void *TQUEUE_ARG;
  #define	tasklet_enable(t)	do { (void) t; local_bh_enable(); } while (0)
  #endif /* !DECLARE_TASKLET */
  
@@ -629,7 +629,7 @@
   */
 --- a/net80211/ieee80211_output.c
 +++ b/net80211/ieee80211_output.c
-@@ -261,6 +261,10 @@
+@@ -261,6 +261,10 @@ ieee80211_hardstart(struct sk_buff *skb,
  		goto bad;
  	}
  
@@ -640,7 +640,7 @@
  	/* calculate priority so drivers can find the TX queue */
  	if (ieee80211_classify(ni, skb)) {
  		IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT, ni,
-@@ -340,20 +344,33 @@
+@@ -340,20 +344,33 @@ void ieee80211_parent_queue_xmit(struct 
   * constructing a frame as it sets i_fc[1]; other bits can
   * then be or'd in.
   */
@@ -677,7 +677,7 @@
  		case IEEE80211_M_STA:
  			wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
  			IEEE80211_ADDR_COPY(wh->i_addr1, bssid);
-@@ -395,6 +412,8 @@
+@@ -395,6 +412,8 @@ ieee80211_send_setup(struct ieee80211vap
  	*(__le16 *)&wh->i_seq[0] =
  	    htole16(ni->ni_txseqs[0] << IEEE80211_SEQ_SEQ_SHIFT);
  	ni->ni_txseqs[0]++;
@@ -686,7 +686,7 @@
  #undef WH4
  }
  
-@@ -416,9 +435,7 @@
+@@ -416,9 +435,7 @@ ieee80211_mgmt_output(struct ieee80211_n
  
  	SKB_CB(skb)->ni = ni;
  
@@ -697,7 +697,7 @@
  		IEEE80211_FC0_TYPE_MGT | type,
  		vap->iv_myaddr, ni->ni_macaddr, vap->iv_bssid);
  	/* XXX power management */
-@@ -464,6 +481,9 @@
+@@ -464,6 +481,9 @@ ieee80211_send_nulldata(struct ieee80211
  	struct ieee80211_frame *wh;
  	u_int8_t *frm;
  
@@ -707,7 +707,7 @@
  	skb = ieee80211_getmgtframe(&frm, 0);
  	if (skb == NULL) {
  		/* XXX debug msg */
-@@ -472,9 +492,7 @@
+@@ -472,9 +492,7 @@ ieee80211_send_nulldata(struct ieee80211
  		return -ENOMEM;
  	}
  
@@ -718,7 +718,7 @@
  		IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_NODATA,
  		vap->iv_myaddr, ni->ni_macaddr, vap->iv_bssid);
  	/* NB: power management bit is never sent by an AP */
-@@ -512,6 +530,7 @@
+@@ -512,6 +530,7 @@ ieee80211_send_qosnulldata(struct ieee80
  	struct sk_buff *skb;
  	struct ieee80211_qosframe *qwh;
  	u_int8_t *frm;
@@ -726,7 +726,7 @@
  	int tid;
  
  	skb = ieee80211_getmgtframe(&frm, 2);
-@@ -523,11 +542,12 @@
+@@ -523,11 +542,12 @@ ieee80211_send_qosnulldata(struct ieee80
  	SKB_CB(skb)->ni = ieee80211_ref_node(ni);
  
  	skb->priority = ac;
@@ -742,7 +742,7 @@
  		IEEE80211_FC0_TYPE_DATA,
  		vap->iv_myaddr, /* SA */
  		ni->ni_macaddr, /* DA */
-@@ -541,10 +561,10 @@
+@@ -541,10 +561,10 @@ ieee80211_send_qosnulldata(struct ieee80
  
  	/* map from access class/queue to 11e header priority value */
  	tid = WME_AC_TO_TID(ac);
@@ -755,7 +755,7 @@
  
  	IEEE80211_NODE_STAT(ni, tx_data);
  
-@@ -786,6 +806,8 @@
+@@ -786,6 +806,8 @@ ieee80211_encap(struct ieee80211_node *n
  		hdrsize = sizeof(struct ieee80211_frame);
  
  	SKB_CB(skb)->auth_pkt = (eh.ether_type == __constant_htons(ETHERTYPE_PAE));
@@ -764,7 +764,7 @@
  
  	switch (vap->iv_opmode) {
  	case IEEE80211_M_IBSS:
-@@ -805,20 +827,9 @@
+@@ -805,20 +827,9 @@ ieee80211_encap(struct ieee80211_node *n
  			ismulticast = IEEE80211_IS_MULTICAST(eh.ether_dhost);
  		break;
  	case IEEE80211_M_STA:
@@ -787,7 +787,7 @@
  		} else
  			ismulticast = IEEE80211_IS_MULTICAST(vap->iv_bssid);
  		break;
-@@ -1689,9 +1700,7 @@
+@@ -1689,9 +1700,7 @@ ieee80211_send_probereq(struct ieee80211
  
  	SKB_CB(skb)->ni = ieee80211_ref_node(ni);
  
@@ -800,7 +800,7 @@
  	/* XXX power management? */
 --- a/net80211/ieee80211_linux.c
 +++ b/net80211/ieee80211_linux.c
-@@ -145,7 +145,7 @@
+@@ -145,7 +145,7 @@ ieee80211_getmgtframe(u_int8_t **frm, u_
  	struct sk_buff *skb;
  	u_int len;
  
@@ -809,7 +809,7 @@
  #ifdef IEEE80211_DEBUG_REFCNT
  	skb = ieee80211_dev_alloc_skb_debug(len + align - 1, func, line);
  #else
-@@ -161,7 +161,7 @@
+@@ -161,7 +161,7 @@ ieee80211_getmgtframe(u_int8_t **frm, u_
  		SKB_CB(skb)->flags = 0;
  		SKB_CB(skb)->next = NULL;
  
diff --git a/package/madwifi/patches/372-queue_vif.patch b/package/madwifi/patches/372-queue_vif.patch
index 83576c8e6c..8f8137b06b 100644
--- a/package/madwifi/patches/372-queue_vif.patch
+++ b/package/madwifi/patches/372-queue_vif.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -1199,6 +1199,7 @@
+@@ -1200,6 +1200,7 @@ ieee80211_deliver_data(struct ieee80211_
  		}
  		if (skb1 != NULL) {
  			struct ieee80211_node *ni_tmp;
@@ -8,7 +8,7 @@
  			skb1->dev = dev;
  			skb_reset_mac_header(skb1);
  			skb_set_network_header(skb1, sizeof(struct ether_header));
-@@ -1206,7 +1207,12 @@
+@@ -1207,7 +1208,12 @@ ieee80211_deliver_data(struct ieee80211_
  			skb1->protocol = __constant_htons(ETH_P_802_2);
  			/* XXX insert vlan tag before queue it? */
  			ni_tmp = SKB_CB(skb1)->ni; /* remember node so we can free it */
@@ -24,7 +24,7 @@
  				vap->iv_devstats.tx_dropped++;
 --- a/net80211/ieee80211_output.c
 +++ b/net80211/ieee80211_output.c
-@@ -333,9 +333,10 @@
+@@ -333,9 +333,10 @@ void ieee80211_parent_queue_xmit(struct 
  	/* Dispatch the packet to the parent device */
  	skb->dev = vap->iv_ic->ic_dev;
  
diff --git a/package/madwifi/patches/374-nbtt_fix.patch b/package/madwifi/patches/374-nbtt_fix.patch
index d8959435de..5293c34e0d 100644
--- a/package/madwifi/patches/374-nbtt_fix.patch
+++ b/package/madwifi/patches/374-nbtt_fix.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -5484,6 +5484,9 @@
+@@ -5484,6 +5484,9 @@ ath_beacon_config(struct ath_softc *sc, 
  		ath_beacon_dturbo_config(vap, intval &
  				~(HAL_BEACON_RESET_TSF | HAL_BEACON_ENA));
  #endif
@@ -12,7 +12,7 @@
  		if (intval & HAL_BEACON_RESET_TSF) {
 --- a/ath_hal/ah_os.c
 +++ b/ath_hal/ah_os.c
-@@ -71,6 +71,7 @@
+@@ -71,6 +71,7 @@ static	int ath_hal_debug = 99;
  int	ath_hal_dma_beacon_response_time = 2;	/* in TUs */
  int	ath_hal_sw_beacon_response_time = 10;	/* in TUs */
  int	ath_hal_additional_swba_backoff = 0;	/* in TUs */
diff --git a/package/madwifi/patches/375-atim_tsf_update.patch b/package/madwifi/patches/375-atim_tsf_update.patch
index 534986bbb0..35d8e1ab26 100644
--- a/package/madwifi/patches/375-atim_tsf_update.patch
+++ b/package/madwifi/patches/375-atim_tsf_update.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -161,6 +161,7 @@
+@@ -161,6 +161,7 @@ static void ath_beacon_send(struct ath_s
  static void ath_beacon_return(struct ath_softc *, struct ath_buf *);
  static void ath_beacon_free(struct ath_softc *);
  static void ath_beacon_config(struct ath_softc *, struct ieee80211vap *);
@@ -8,7 +8,7 @@
  static int ath_desc_alloc(struct ath_softc *);
  static void ath_desc_free(struct ath_softc *);
  static void ath_desc_swap(struct ath_desc *);
-@@ -2793,6 +2794,72 @@
+@@ -2793,6 +2794,72 @@ ath_set_ack_bitrate(struct ath_softc *sc
  	return 1;
  }
  
@@ -81,7 +81,7 @@
  /*
   * Reset the hardware w/o losing operational state.  This is
   * basically a more efficient way of doing ath_stop, ath_init,
-@@ -5292,6 +5359,7 @@
+@@ -5292,6 +5359,7 @@ ath_beacon_config(struct ath_softc *sc, 
  	u_int64_t tsf, hw_tsf;
  	u_int32_t tsftu, hw_tsftu;
  	u_int32_t intval, nexttbtt = 0;
@@ -89,7 +89,7 @@
  	int reset_tsf = 0;
  
  	if (vap == NULL)
-@@ -5299,6 +5367,9 @@
+@@ -5299,6 +5367,9 @@ ath_beacon_config(struct ath_softc *sc, 
  
  	ni = vap->iv_bss;
  
@@ -99,7 +99,7 @@
  	hw_tsf = ath_hal_gettsf64(ah);
  	tsf = le64_to_cpu(ni->ni_tstamp.tsf);
  	hw_tsftu = hw_tsf >> 10;
-@@ -5488,15 +5559,27 @@
+@@ -5488,15 +5559,27 @@ ath_beacon_config(struct ath_softc *sc, 
  				<= ath_hal_sw_beacon_response_time)
  			nexttbtt += intval;
  		sc->sc_nexttbtt = nexttbtt;
@@ -127,7 +127,7 @@
  	/* We print all debug messages here, in order to preserve the
  	 * time critical aspect of this function */
  	DPRINTF(sc, ATH_DEBUG_BEACON,
-@@ -6399,6 +6482,11 @@
+@@ -6399,6 +6482,11 @@ ath_recv_mgmt(struct ieee80211vap * vap,
  			DPRINTF(sc, ATH_DEBUG_BEACON, 
  				"Updated beacon timers\n");
  		}
diff --git a/package/madwifi/patches/377-disable_vlan_code.patch b/package/madwifi/patches/377-disable_vlan_code.patch
index 720b8dc53a..a46cc47113 100644
--- a/package/madwifi/patches/377-disable_vlan_code.patch
+++ b/package/madwifi/patches/377-disable_vlan_code.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_linux.h
 +++ b/net80211/ieee80211_linux.h
-@@ -649,22 +649,7 @@
+@@ -649,22 +649,7 @@ int ieee80211_proc_vcreate(struct ieee80
  	       char *);
  void ieee80211_proc_cleanup(struct ieee80211vap *);
  
diff --git a/package/madwifi/patches/378-adhoc_crash_fix.patch b/package/madwifi/patches/378-adhoc_crash_fix.patch
index e28bb014bd..26997f724e 100644
--- a/package/madwifi/patches/378-adhoc_crash_fix.patch
+++ b/package/madwifi/patches/378-adhoc_crash_fix.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -3530,6 +3530,11 @@
+@@ -3531,6 +3531,11 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  		if (ic->ic_flags & IEEE80211_F_SCAN) {
  			ieee80211_add_scan(vap, &scan, wh, subtype, rssi, rtsf);
  		}
diff --git a/package/madwifi/patches/379-invalid_rate_fix.patch b/package/madwifi/patches/379-invalid_rate_fix.patch
index 305d26d600..3ee2ed2c46 100644
--- a/package/madwifi/patches/379-invalid_rate_fix.patch
+++ b/package/madwifi/patches/379-invalid_rate_fix.patch
@@ -29,7 +29,7 @@
  #define ONE_SECOND (1000 * 1000)  /* 1 second, or 1000 milliseconds; eternity, in other words */
  
  #include "release.h"
-@@ -471,11 +457,11 @@
+@@ -471,11 +457,11 @@ ath_rate_tx_complete(struct ath_softc *s
  		final_rate = sc->sc_hwmap[ts->ts_rate & ~HAL_TXSTAT_ALTRATE].ieeerate;
  		final_ndx = rate_to_ndx(sn, final_rate);
  		if (final_ndx >= sn->num_rates) {
@@ -43,7 +43,7 @@
  			final_ndx = 0;
  		}
  
-@@ -485,7 +471,7 @@
+@@ -485,7 +471,7 @@ ath_rate_tx_complete(struct ath_softc *s
  		tries = ts->ts_longretry + 1;
  
  		if (sn->num_rates <= 0) {
@@ -52,7 +52,7 @@
  				MAC_ADDR(an->an_node.ni_macaddr), __func__);
  			return;
  		}
-@@ -551,7 +537,7 @@
+@@ -551,7 +537,7 @@ ath_rate_tx_complete(struct ath_softc *s
  static void
  ath_rate_newassoc(struct ath_softc *sc, struct ath_node *an, int isnew)
  {
@@ -61,7 +61,7 @@
  			MAC_ADDR(an->an_node.ni_macaddr), __func__);
  		if (isnew)
  			ath_rate_ctl_reset(sc, &an->an_node);
-@@ -601,7 +587,7 @@
+@@ -601,7 +587,7 @@ ath_fill_sample_table(struct minstrel_no
  			    p = rates + sprintf(rates, "rates :: %d ", column_index);
  			    for (i = 0; i < num_sample_rates; i++)
  			            p += sprintf(p, "%2u ", sn->rs_sampleTable[i][column_index]);
@@ -70,7 +70,7 @@
  		};
  #endif
  }
-@@ -628,7 +614,7 @@
+@@ -628,7 +614,7 @@ ath_rate_ctl_reset(struct ath_softc *sc,
  		sn->is_sampling = 0;
  
  		if (rt == NULL) {
@@ -79,7 +79,7 @@
  			return;
  		}
  		sn->static_rate_ndx = -1;
-@@ -658,7 +644,7 @@
+@@ -658,7 +644,7 @@ ath_rate_ctl_reset(struct ath_softc *sc,
  			sn->rates[x].rix = sc->sc_rixmap[sn->rates[x].rate];
  			}
  			if (sn->rates[x].rix == 0xff) {
@@ -88,7 +88,7 @@
  					dev_info, __func__, x);
  				continue;
  			}
-@@ -673,7 +659,7 @@
+@@ -673,7 +659,7 @@ ath_rate_ctl_reset(struct ath_softc *sc,
  		ni->ni_txrate = 0;
  
  		if (sn->num_rates <= 0) {
@@ -97,7 +97,7 @@
  				dev_info, __func__, MAC_ADDR(ni->ni_macaddr),
  				vap->iv_fixed_rate);
  			/* There are no rates yet; we're done */
-@@ -689,23 +675,23 @@
+@@ -689,23 +675,23 @@ ath_rate_ctl_reset(struct ath_softc *sc,
  			 * the node.  We know the rate is there because the
  			 * rate set is checked when the station associates. */
  			/* NB: the rate set is assumed sorted */
@@ -130,7 +130,7 @@
  					dev_info, __func__, x);
  				continue;
  			}
-@@ -735,9 +721,9 @@
+@@ -735,9 +721,9 @@ ath_rate_ctl_reset(struct ath_softc *sc,
  		}
  
  #if 0
@@ -142,7 +142,7 @@
  #endif
  
  		/* Set the initial rate */
-@@ -781,10 +767,10 @@
+@@ -781,10 +767,10 @@ ath_timer_function(unsigned long data)
  		unsigned int interval = ath_timer_interval;
  
  		if (dev == NULL)
@@ -155,7 +155,7 @@
  
  		ic = &sc->sc_ic;
  
-@@ -808,7 +794,7 @@
+@@ -808,7 +794,7 @@ ath_timer_function(unsigned long data)
  
  		timer  = &(ssc->timer);
  		if (timer == NULL)
@@ -164,7 +164,7 @@
  
  		timer->expires = jiffies + ((HZ * interval) / 1000);
  		add_timer(timer);
-@@ -904,7 +890,7 @@
+@@ -904,7 +890,7 @@ static struct ath_ratectrl *
  ath_rate_attach(struct ath_softc *sc)
  {
  		struct minstrel_softc *osc;
@@ -173,7 +173,7 @@
  
  		_MOD_INC_USE(THIS_MODULE, return NULL);
  		osc = kmalloc(sizeof(struct minstrel_softc), GFP_ATOMIC);
-@@ -963,7 +949,7 @@
+@@ -963,7 +949,7 @@ ath_proc_read_nodes(struct ieee80211vap 
  					p += sprintf(p, "out of room for node " MAC_FMT "\n\n", MAC_ADDR(ni->ni_macaddr));
  					break;
  				}
@@ -210,7 +210,7 @@
  static int ath_rateinterval = 1000;		/* rate ctl interval (ms)  */
  static int ath_rate_max_success_threshold = 10;
  static int ath_rate_min_success_threshold = 1;
-@@ -197,7 +186,7 @@
+@@ -197,7 +186,7 @@ ath_rate_update(struct ath_softc *sc, st
  
  	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
  
@@ -219,7 +219,7 @@
  		__func__, MAC_ADDR(ni->ni_macaddr),
  		ni->ni_rates.rs_nrates > 0 ?
  			(ni->ni_rates.rs_rates[rate] & IEEE80211_RATE_VAL) / 2 : 0);
-@@ -297,9 +286,9 @@
+@@ -297,9 +286,9 @@ ath_rate_ctl_start(struct ath_softc *sc,
  		 * rate set is checked when the station associates.
  		 */
  		srate = ni->ni_rates.rs_nrates - 1;
@@ -232,7 +232,7 @@
  	}
  	ath_rate_update(sc, ni, srate);
  #undef RATE
-@@ -377,7 +366,7 @@
+@@ -377,7 +366,7 @@ ath_rate_ctl(void *arg, struct ieee80211
  
  	old_rate = ni->ni_txrate;
  
@@ -241,7 +241,7 @@
  		 amn->amn_tx_try0_cnt,
  		 amn->amn_tx_try1_cnt,
  		 amn->amn_tx_try2_cnt,
-@@ -390,7 +379,7 @@
+@@ -390,7 +379,7 @@ ath_rate_ctl(void *arg, struct ieee80211
    			amn->amn_recovery = 1;
    			amn->amn_success = 0;
    			ni->ni_txrate++;
@@ -250,7 +250,7 @@
    		} else
  			amn->amn_recovery = 0;
    	} else if (is_failure(amn)) {
-@@ -401,12 +390,12 @@
+@@ -401,12 +390,12 @@ ath_rate_ctl(void *arg, struct ieee80211
    				amn->amn_success_threshold *= 2;
    				amn->amn_success_threshold = min(amn->amn_success_threshold,
  								  (u_int)ath_rate_max_success_threshold);
@@ -296,7 +296,7 @@
  /*
   * Default parameters for the rate control algorithm.  These are
   * all tunable with sysctls.  The rate controller runs periodically
-@@ -186,7 +172,7 @@
+@@ -186,7 +172,7 @@ ath_rate_update(struct ath_softc *sc, st
  
  	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
  
@@ -305,7 +305,7 @@
  		__func__, MAC_ADDR(ni->ni_macaddr),
  		ni->ni_rates.rs_nrates > 0 ?
  			(ni->ni_rates.rs_rates[rate] & IEEE80211_RATE_VAL) / 2 : 0);
-@@ -283,9 +269,9 @@
+@@ -283,9 +269,9 @@ ath_rate_ctl_start(struct ath_softc *sc,
  		 */
  		/* NB: the rate set is assumed sorted */
  		srate = ni->ni_rates.rs_nrates - 1;
@@ -318,7 +318,7 @@
  	}
  	ath_rate_update(sc, ni, srate);
  #undef RATE
-@@ -364,7 +350,7 @@
+@@ -364,7 +350,7 @@ ath_rate_ctl(void *arg, struct ieee80211
  	    on->on_tx_retr < (on->on_tx_ok * ath_rate_raise) / 100)
  		dir = 1;
  
@@ -327,7 +327,7 @@
  		MAC_ADDR(ni->ni_macaddr),
  		on->on_tx_ok, on->on_tx_err, on->on_tx_retr,
  		on->on_tx_upper, dir);
-@@ -395,7 +381,7 @@
+@@ -395,7 +381,7 @@ ath_rate_ctl(void *arg, struct ieee80211
  	}
  
  	if (nrate != ni->ni_txrate) {
@@ -370,7 +370,7 @@
  /*
   * This file is an implementation of the SampleRate algorithm
   * in "Bit-rate Selection in Wireless Networks"
-@@ -740,7 +723,7 @@
+@@ -740,7 +723,7 @@ ath_rate_tx_complete(struct ath_softc *s
  		ndx[3] = rate_to_ndx(sn, rate[3]);
  
  #if 0
@@ -379,7 +379,7 @@
  			dev_info, MAC_ADDR(an->an_node.ni_macaddr),
  			bin_to_size(size_to_bin(frame_size)),
  			finalTSIdx,
-@@ -886,15 +869,16 @@
+@@ -886,15 +869,16 @@ ath_rate_ctl_reset(struct ath_softc *sc,
  			if ((ni->ni_rates.rs_rates[x] & IEEE80211_RATE_VAL) == vap->iv_fixed_rate)
  				srate = x;
  
diff --git a/package/madwifi/patches/380-noderef_hack.patch b/package/madwifi/patches/380-noderef_hack.patch
index 4e224903ce..e9397724e7 100644
--- a/package/madwifi/patches/380-noderef_hack.patch
+++ b/package/madwifi/patches/380-noderef_hack.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_node.c
 +++ b/net80211/ieee80211_node.c
-@@ -427,8 +427,8 @@
+@@ -427,8 +427,8 @@ ieee80211_reset_bss(struct ieee80211vap 
  			  __func__, ni, MAC_ADDR(vap->iv_myaddr));
  	KASSERT(ni != NULL, ("unable to setup inital BSS node"));
  
diff --git a/package/madwifi/patches/381-ibss_modes.patch b/package/madwifi/patches/381-ibss_modes.patch
index 1ce295eea3..f904ed9721 100644
--- a/package/madwifi/patches/381-ibss_modes.patch
+++ b/package/madwifi/patches/381-ibss_modes.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -1260,7 +1260,10 @@
+@@ -1260,7 +1260,10 @@ ath_vap_create(struct ieee80211com *ic, 
  	case IEEE80211_M_IBSS:
  		if ((sc->sc_nvaps != 0) && (ic->ic_opmode == IEEE80211_M_STA))
  			return NULL;
@@ -12,7 +12,7 @@
  		break;
  	case IEEE80211_M_AHDEMO:
  	case IEEE80211_M_MONITOR:
-@@ -1455,7 +1458,7 @@
+@@ -1455,7 +1458,7 @@ ath_vap_create(struct ieee80211com *ic, 
  	 * frames.  Other modes carry over directly to the HAL.
  	 */
  	if (ic->ic_opmode == IEEE80211_M_AHDEMO)
diff --git a/package/madwifi/patches/383-ibss_hostap.patch b/package/madwifi/patches/383-ibss_hostap.patch
index b65c4afe89..7ededce80c 100644
--- a/package/madwifi/patches/383-ibss_hostap.patch
+++ b/package/madwifi/patches/383-ibss_hostap.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -1452,6 +1452,23 @@
+@@ -1452,6 +1452,23 @@ ath_vap_create(struct ieee80211com *ic, 
  		sc->sc_nstavaps++;
  	else if (opmode == IEEE80211_M_MONITOR)
  		sc->sc_nmonvaps++;
@@ -24,7 +24,7 @@
  	/*
  	 * Adhoc demo mode is a pseudo mode; to the HAL it's
  	 * just IBSS mode and the driver doesn't use management
-@@ -4279,7 +4296,8 @@
+@@ -4279,7 +4296,8 @@ ath_calcrxfilter(struct ath_softc *sc)
  	if (ic->ic_opmode != IEEE80211_M_HOSTAP && (dev->flags & IFF_PROMISC))
  		rfilt |= HAL_RX_FILTER_PROM;
  	if (ic->ic_opmode == IEEE80211_M_STA ||
@@ -34,7 +34,7 @@
  	    (sc->sc_nostabeacons) || sc->sc_scanning ||
  		(ic->ic_opmode == IEEE80211_M_HOSTAP))
  		rfilt |= HAL_RX_FILTER_BEACON;
-@@ -6433,6 +6451,33 @@
+@@ -6433,6 +6451,33 @@ ath_capture(struct net_device *dev, cons
  }
  
  /*
@@ -68,7 +68,7 @@
   * Intercept management frames to collect beacon RSSI data and to do
   * ibss merges. This function is called for all management frames,
   * including those belonging to other BSS.
-@@ -6485,10 +6530,19 @@
+@@ -6485,10 +6530,19 @@ ath_recv_mgmt(struct ieee80211vap * vap,
  			DPRINTF(sc, ATH_DEBUG_BEACON, 
  				"Updated beacon timers\n");
  		}
@@ -92,7 +92,7 @@
  		}
  		/* NB: Fall Through */
  	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
-@@ -6561,6 +6615,10 @@
+@@ -6561,6 +6615,10 @@ ath_recv_mgmt(struct ieee80211vap * vap,
  #endif
  			if (do_merge)
  				ieee80211_ibss_merge(ni);
diff --git a/package/madwifi/patches/400-changeset_r3402.patch b/package/madwifi/patches/400-changeset_r3402.patch
index af7e6d5733..f43a6d90d2 100644
--- a/package/madwifi/patches/400-changeset_r3402.patch
+++ b/package/madwifi/patches/400-changeset_r3402.patch
@@ -1,6 +1,6 @@
 --- a/ath_hal/ah_os.h
 +++ b/ath_hal/ah_os.h
-@@ -194,10 +194,6 @@
+@@ -194,10 +194,6 @@ extern u_int32_t __ahdecl ath_hal_getupt
   */
  #if (AH_BYTE_ORDER == AH_BIG_ENDIAN)
  #define is_reg_le(__reg) ((0x4000 <= (__reg) && (__reg) < 0x5000))
@@ -11,7 +11,7 @@
  #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,12)
  #define _OS_REG_WRITE(_ah, _reg, _val) do {			\
  	 is_reg_le(_reg) ?					\
-@@ -219,6 +215,21 @@
+@@ -219,6 +215,21 @@ extern u_int32_t __ahdecl ath_hal_getupt
  	 readl((_ah)->ah_sh + (_reg)) :				\
  	 cpu_to_le32(readl((_ah)->ah_sh + (_reg))))
  #endif				/* KERNEL_VERSION(2,6,12) */
diff --git a/package/madwifi/patches/401-changeset_r3602.patch b/package/madwifi/patches/401-changeset_r3602.patch
index 2693d7a368..0b31d6e57c 100644
--- a/package/madwifi/patches/401-changeset_r3602.patch
+++ b/package/madwifi/patches/401-changeset_r3602.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_linux.h
 +++ b/net80211/ieee80211_linux.h
-@@ -341,6 +341,8 @@
+@@ -341,6 +341,8 @@ typedef spinlock_t acl_lock_t;
  /* __skb_append got a third parameter in 2.6.14 */
  #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
  #define __skb_append(a,b,c)	__skb_append(a, b)
diff --git a/package/madwifi/patches/403-changeset_r3605.patch b/package/madwifi/patches/403-changeset_r3605.patch
index 48981ec13b..2cf28d7378 100644
--- a/package/madwifi/patches/403-changeset_r3605.patch
+++ b/package/madwifi/patches/403-changeset_r3605.patch
@@ -1,6 +1,6 @@
 --- a/include/compat.h
 +++ b/include/compat.h
-@@ -182,6 +182,13 @@
+@@ -182,6 +182,13 @@ static inline int timeval_compare(struct
  #define DEV_ATH CTL_UNNUMBERED
  #endif
  
@@ -16,7 +16,7 @@
  #endif /* _ATH_COMPAT_H_ */
 --- a/net80211/ieee80211_linux.h
 +++ b/net80211/ieee80211_linux.h
-@@ -338,13 +338,6 @@
+@@ -338,13 +338,6 @@ typedef spinlock_t acl_lock_t;
  #define	ACL_LOCK_CHECK(_as)
  #endif
  
@@ -30,7 +30,7 @@
  /*
   * Per-node power-save queue definitions.  Beware of control
   * flow with IEEE80211_NODE_SAVEQ_LOCK/IEEE80211_NODE_SAVEQ_UNLOCK.
-@@ -388,16 +381,16 @@
+@@ -388,16 +381,16 @@ typedef spinlock_t acl_lock_t;
  	_skb = __skb_dequeue(&(_ni)->ni_savedq);		\
  	(_qlen) = skb_queue_len(&(_ni)->ni_savedq);		\
  } while (0)
@@ -59,7 +59,7 @@
  /*
 --- a/net80211/ieee80211_power.c
 +++ b/net80211/ieee80211_power.c
-@@ -243,7 +243,7 @@
+@@ -243,7 +243,7 @@ ieee80211_pwrsave(struct sk_buff *skb)
  	tail = skb_peek_tail(&ni->ni_savedq);
  	if (tail != NULL) {
  		age -= M_AGE_GET(tail);
diff --git a/package/madwifi/patches/404-linux24_fix.patch b/package/madwifi/patches/404-linux24_fix.patch
index ecc80f1b92..4ea20b3cb7 100644
--- a/package/madwifi/patches/404-linux24_fix.patch
+++ b/package/madwifi/patches/404-linux24_fix.patch
@@ -1,6 +1,6 @@
 --- a/ath_hal/Makefile
 +++ b/ath_hal/Makefile
-@@ -78,10 +78,11 @@
+@@ -78,10 +78,11 @@ endif
  quiet_cmd_uudecode = UUDECODE $@
        cmd_uudecode = $(obj)/uudecode -o $@ $<
  
diff --git a/package/madwifi/patches/405-retransmit_check.patch b/package/madwifi/patches/405-retransmit_check.patch
index 66db06175d..0f97871940 100644
--- a/package/madwifi/patches/405-retransmit_check.patch
+++ b/package/madwifi/patches/405-retransmit_check.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211.h
 +++ b/net80211/ieee80211.h
-@@ -174,8 +174,6 @@
+@@ -174,8 +174,6 @@ struct ieee80211_ctlframe_addr2 {
  #define	IEEE80211_SEQ_SEQ_MASK			0xfff0
  #define	IEEE80211_SEQ_SEQ_SHIFT			4
  
@@ -11,7 +11,7 @@
  #define	IEEE80211_QOS_TXOP			0x00ff
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -417,7 +417,7 @@
+@@ -417,7 +417,7 @@ ieee80211_input(struct ieee80211vap * va
  				tid = 0;
  			rxseq = le16toh(*(__le16 *)wh->i_seq);
  			if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
diff --git a/package/madwifi/patches/407-new_athinfo.patch b/package/madwifi/patches/407-new_athinfo.patch
index 1577949750..6c512ad9e8 100644
--- a/package/madwifi/patches/407-new_athinfo.patch
+++ b/package/madwifi/patches/407-new_athinfo.patch
@@ -81,7 +81,7 @@
  
  #include <stdio.h>
  #include <stdlib.h>
-@@ -130,109 +60,103 @@
+@@ -130,109 +60,103 @@ fprintf(stderr, "#ERR %s: " fmt "\n", __
   */
  #define AR5K_GPIODI	0x401c
  
@@ -263,7 +263,7 @@
  #define AR5K_RESET_CTL_MAC	0x00000004	/* MAC reset (PCU+Baseband?) -5210 only */
  #define AR5K_RESET_CTL_PHY	0x00000008	/* PHY reset -5210 only */
  #define AR5K_RESET_CTL_PCI	0x00000010	/* PCI Core reset (interrupts etc) */
-@@ -253,7 +177,7 @@
+@@ -253,7 +177,7 @@ static const struct ath5k_srev_name ath5
  #define AR5K_SLEEP_CTL_SLE_UNITS	0x00000008	/* not on 5210 */
  
  #define AR5K_PCICFG			0x4010	/* Register Address */
@@ -272,7 +272,7 @@
  #define AR5K_PCICFG_CLKRUNEN		0x00000004	/* CLKRUN enable [5211+] */
  #define AR5K_PCICFG_EESIZE		0x00000018	/* Mask for EEPROM size [5211+] */
  #define AR5K_PCICFG_EESIZE_S		3
-@@ -264,26 +188,118 @@
+@@ -264,26 +188,118 @@ static const struct ath5k_srev_name ath5
  
  #define AR5K_PCICFG_SPWR_DN		0x00010000	/* Mask for power status (5210) */
  
@@ -395,7 +395,7 @@
  #define AR5K_EEPROM_CMD_READ	0x00000001	/* EEPROM read */
  #define AR5K_EEPROM_CMD_WRITE	0x00000002	/* EEPROM write */
  #define AR5K_EEPROM_CMD_RESET	0x00000004	/* EEPROM reset */
-@@ -291,43 +307,163 @@
+@@ -291,43 +307,163 @@ static const struct ath5k_srev_name ath5
  /*
   * EEPROM status register
   */
@@ -587,7 +587,7 @@
  
  /*
   * Read data by masking
-@@ -350,7 +486,6 @@
+@@ -350,7 +486,6 @@ static const struct ath5k_srev_name ath5
  	(*((volatile u_int32_t *)(mem + (_reg))) = (_val))
  #endif
  
@@ -595,7 +595,7 @@
  #define AR5K_REG_ENABLE_BITS(_reg, _flags)	\
  	AR5K_REG_WRITE(_reg, AR5K_REG_READ(_reg) | (_flags))
  
-@@ -359,7 +494,12 @@
+@@ -359,7 +494,12 @@ static const struct ath5k_srev_name ath5
  
  #define AR5K_TUNE_REGISTER_TIMEOUT		20000
  
@@ -609,7 +609,7 @@
  struct eeprom_entry {
  	const char *name;
  	int addr;
-@@ -375,8 +515,6 @@
+@@ -375,8 +515,6 @@ static const struct eeprom_entry eeprom_
  	{"regdomain", AR5K_EEPROM_REG_DOMAIN},
  };
  
@@ -618,7 +618,7 @@
  static int force_write = 0;
  static int verbose = 0;
  
-@@ -398,8 +536,8 @@
+@@ -398,8 +536,8 @@ static u_int32_t ath5k_hw_bitswap(u_int3
  /*
   * Get the PHY Chip revision
   */
@@ -629,7 +629,7 @@
  {
  	int i;
  	u_int32_t srev;
-@@ -427,7 +565,7 @@
+@@ -427,7 +565,7 @@ ath5k_hw_radio_revision(u_int16_t mac_ve
  	for (i = 0; i < 8; i++)
  		AR5K_REG_WRITE(AR5K_PHY(0x20), 0x00010000);
  
@@ -638,7 +638,7 @@
  		srev = AR5K_REG_READ(AR5K_PHY(256) >> 28) & 0xf;
  
  		ret = (u_int16_t)ath5k_hw_bitswap(srev, 4) + 1;
-@@ -447,9 +585,8 @@
+@@ -447,9 +585,8 @@ ath5k_hw_radio_revision(u_int16_t mac_ve
  /*
   * Write to EEPROM
   */
@@ -650,7 +650,7 @@
  {
  	u_int32_t status, timeout;
  
-@@ -457,7 +594,7 @@
+@@ -457,7 +594,7 @@ ath5k_hw_eeprom_write(void *mem, u_int32
  	 * Initialize EEPROM access
  	 */
  
@@ -659,7 +659,7 @@
  
  		AR5K_REG_ENABLE_BITS(AR5K_PCICFG, AR5K_PCICFG_EEAE);
  
-@@ -466,7 +603,7 @@
+@@ -466,7 +603,7 @@ ath5k_hw_eeprom_write(void *mem, u_int32
  
  	} else {
  		/* not 5210 */
@@ -668,7 +668,7 @@
  		AR5K_REG_WRITE(AR5K_EEPROM_CMD, AR5K_EEPROM_CMD_RESET);
  		usleep(5);
  
-@@ -484,7 +621,7 @@
+@@ -484,7 +621,7 @@ ath5k_hw_eeprom_write(void *mem, u_int32
  		status = AR5K_REG_READ(AR5K_EEPROM_STATUS);
  		if (status & AR5K_EEPROM_STAT_WRDONE) {
  			if (status & AR5K_EEPROM_STAT_WRERR) {
@@ -677,7 +677,7 @@
  				    offset);
  				return 1;
  			}
-@@ -499,16 +636,15 @@
+@@ -499,16 +636,15 @@ ath5k_hw_eeprom_write(void *mem, u_int32
  /*
   * Read from EEPROM
   */
@@ -697,7 +697,7 @@
  		AR5K_REG_ENABLE_BITS(AR5K_PCICFG, AR5K_PCICFG_EEAE);
  		(void)AR5K_REG_READ(AR5K_EEPROM_BASE + (4 * offset));
  	} else {
-@@ -531,50 +667,701 @@
+@@ -531,50 +667,701 @@ ath5k_hw_eeprom_read(void *mem, u_int32_
  	return 1;
  }
  
@@ -1419,7 +1419,7 @@
  {
  #define MAX_NR_WRITES 16
  	struct {
-@@ -635,7 +1422,7 @@
+@@ -635,7 +1422,7 @@ do_write_pairs(int anr, int argc, char *
  		}
  		anr++;
  		i++;
@@ -1428,7 +1428,7 @@
  
  	if (!(wr_ops_len = i)) {
  		err("no (addr,val) pairs given");
-@@ -702,20 +1489,22 @@
+@@ -702,20 +1489,22 @@ do_write_pairs(int anr, int argc, char *
  	}
  
  	return errors ? 11 : 0;
@@ -1455,7 +1455,7 @@
  		"<base_address>  device base address (see lspci output)\n\n");
  
  	fprintf(stderr,
-@@ -725,8 +1514,8 @@
+@@ -725,8 +1514,8 @@ static void usage(const char *n)
  		"  %s -w <base_address> regdomain N\n\n"
  		"- set a PCI id field to value N:\n"
  		"  %s -w <base_address> <field> N\n"
@@ -1466,7 +1466,7 @@
  		fprintf(stderr, " %s", eeprom_addr[i].name);
  	fprintf(stderr, "\n\n");
  	fprintf(stderr,
-@@ -739,19 +1528,457 @@
+@@ -739,19 +1528,457 @@ static void usage(const char *n)
  		"unlawful radio transmissions!\n\n");
  }
  
@@ -1930,7 +1930,7 @@
  
  	struct {
  		int valid;
-@@ -759,7 +1986,7 @@
+@@ -759,7 +1986,7 @@ CMD(athinfo)(int argc, char *argv[])
  	} gpio_set[AR5K_NUM_GPIO];
  	int nr_gpio_set = 0;
  
@@ -1939,7 +1939,7 @@
  		gpio_set[i].valid = 0;
  
  	if (argc < 2) {
-@@ -769,6 +1996,15 @@
+@@ -769,6 +1996,15 @@ CMD(athinfo)(int argc, char *argv[])
  
  	while (anr < argc && argv[anr][0] == '-') {
  		switch (argv[anr][1]) {
@@ -1955,7 +1955,7 @@
  		case 'w':
  			do_write = 1;
  			break;
-@@ -777,7 +2013,7 @@
+@@ -777,7 +2013,7 @@ CMD(athinfo)(int argc, char *argv[])
  			if (strlen(argv[anr]) != 3 || argv[anr][1] != ':' ||
  			    argv[anr][0] < '0' || argv[anr][0] > '5' ||
  			    (argv[anr][2] != '0' && argv[anr][2] != '1')) {
@@ -1964,7 +1964,7 @@
  				return 2;
  			}
  			gpio_set[argv[anr][0] - '0'].valid = 1;
-@@ -797,6 +2033,25 @@
+@@ -797,6 +2033,25 @@ CMD(athinfo)(int argc, char *argv[])
  			do_dump = 1;
  			break;
  
@@ -1990,7 +1990,7 @@
  		case 'h':
  			usage(argv[0]);
  			return 0;
-@@ -805,10 +2060,10 @@
+@@ -805,10 +2060,10 @@ CMD(athinfo)(int argc, char *argv[])
  		default:
  			err("unknown option %s", argv[anr]);
  			return 2;
@@ -2003,7 +2003,7 @@
  
  	if (anr >= argc) {
  		err("missing device address");
-@@ -816,7 +2071,7 @@
+@@ -816,7 +2071,7 @@ CMD(athinfo)(int argc, char *argv[])
  		return 3;
  	}
  
@@ -2012,7 +2012,7 @@
  
  	fd = open("/dev/mem", O_RDWR);
  	if (fd < 0) {
-@@ -828,7 +2083,7 @@
+@@ -828,7 +2083,7 @@ CMD(athinfo)(int argc, char *argv[])
  		   MAP_SHARED | MAP_FILE, fd, dev_addr);
  
  	if (mem == MAP_FAILED) {
@@ -2021,7 +2021,7 @@
  		       "%s\n", dev_addr, AR5K_PCI_MEM_SIZE, strerror(errno));
  		return -3;
  	}
-@@ -856,10 +2111,31 @@
+@@ -856,10 +2111,31 @@ CMD(athinfo)(int argc, char *argv[])
  	AR5K_REG_DISABLE_BITS(AR5K_PCICFG, AR5K_PCICFG_SPWR_DN);
  	usleep(500);
  
@@ -2055,7 +2055,7 @@
  	error = ath5k_hw_eeprom_read(mem, AR5K_EEPROM_MAGIC, &ee_magic,
  				     mac_version);
  
-@@ -872,157 +2148,114 @@
+@@ -872,157 +2148,114 @@ CMD(athinfo)(int argc, char *argv[])
  		printf("Warning: Invalid EEPROM Magic number!\n");
  	}
  
@@ -2285,7 +2285,7 @@
  	       AR5K_REG_READ(AR5K_GPIOCR), AR5K_REG_READ(AR5K_GPIODO),
  	       AR5K_REG_READ(AR5K_GPIODI));
  
-@@ -1030,18 +2263,18 @@
+@@ -1030,18 +2263,18 @@ CMD(athinfo)(int argc, char *argv[])
  		u_int16_t data;
  		FILE *dumpfile = fopen("ath-eeprom-dump.bin", "w");
  
@@ -2309,7 +2309,7 @@
  			fwrite(&data, 2, 1, dumpfile);
  		}
  		printf("\n==============================================\n");
-@@ -1054,18 +2287,18 @@
+@@ -1054,18 +2287,18 @@ CMD(athinfo)(int argc, char *argv[])
  		u_int32_t old_cr = rcr, old_do = rdo;
  		int rc;
  
@@ -2332,7 +2332,7 @@
  			if (gpio_set[i].valid) {
  				rcr |= AR5K_GPIOCR_OUT(i);	/* we use mode 3 */
  				rcr &= ~AR5K_GPIOCR_INT_SEL(i);
-@@ -1111,5 +2344,17 @@
+@@ -1111,5 +2344,17 @@ CMD(athinfo)(int argc, char *argv[])
  
  		return rc;
  	}
diff --git a/package/madwifi/patches/409-wext_compat.patch b/package/madwifi/patches/409-wext_compat.patch
index 4d5ebae253..449709232c 100644
--- a/package/madwifi/patches/409-wext_compat.patch
+++ b/package/madwifi/patches/409-wext_compat.patch
@@ -14,7 +14,7 @@
  static void
  pre_announced_chanswitch(struct net_device *dev, u_int32_t channel, u_int32_t tbtt);
  
-@@ -1800,7 +1807,7 @@
+@@ -1800,7 +1807,7 @@ giwscan_cb(void *arg, const struct ieee8
  		IEEE80211_ADDR_COPY(iwe.u.ap_addr.sa_data, se->se_macaddr);
  	else
  		IEEE80211_ADDR_COPY(iwe.u.ap_addr.sa_data, se->se_bssid);
@@ -23,7 +23,7 @@
  
  	/* We ran out of space in the buffer. */
  	if (last_ev == current_ev)
-@@ -1811,7 +1818,7 @@
+@@ -1811,7 +1818,7 @@ giwscan_cb(void *arg, const struct ieee8
  	iwe.cmd = SIOCGIWESSID;
  	iwe.u.data.flags = 1;
  	iwe.u.data.length = se->se_ssid[1];
@@ -32,7 +32,7 @@
  		end_buf, &iwe, (char *) se->se_ssid+2);
  
  	/* We ran out of space in the buffer. */
-@@ -1824,7 +1831,7 @@
+@@ -1824,7 +1831,7 @@ giwscan_cb(void *arg, const struct ieee8
  		iwe.cmd = SIOCGIWMODE;
  		iwe.u.mode = se->se_capinfo & IEEE80211_CAPINFO_ESS ?
  			IW_MODE_MASTER : IW_MODE_ADHOC;
@@ -41,7 +41,7 @@
  			end_buf, &iwe, IW_EV_UINT_LEN);
  
  		/* We ran out of space in the buffer. */
-@@ -1837,7 +1844,7 @@
+@@ -1837,7 +1844,7 @@ giwscan_cb(void *arg, const struct ieee8
  	iwe.cmd = SIOCGIWFREQ;
  	iwe.u.freq.m = se->se_chan->ic_freq * 100000;
  	iwe.u.freq.e = 1;
@@ -50,7 +50,7 @@
  		end_buf, &iwe, IW_EV_FREQ_LEN);
  
  	/* We ran out of space in the buffer. */
-@@ -1848,7 +1855,7 @@
+@@ -1848,7 +1855,7 @@ giwscan_cb(void *arg, const struct ieee8
  	last_ev = current_ev;
  	iwe.cmd = IWEVQUAL;
  	set_quality(&iwe.u.qual, se->se_rssi, ATH_DEFAULT_NOISE);
@@ -59,7 +59,7 @@
  		end_buf, &iwe, IW_EV_QUAL_LEN);
  
  	/* We ran out of space in the buffer */
-@@ -1863,7 +1870,7 @@
+@@ -1863,7 +1870,7 @@ giwscan_cb(void *arg, const struct ieee8
  	else
  		iwe.u.data.flags = IW_ENCODE_DISABLED;
  	iwe.u.data.length = 0;
@@ -68,7 +68,7 @@
  
  	/* We ran out of space in the buffer. */
  	if (last_ev == current_ev)
-@@ -1878,7 +1885,7 @@
+@@ -1878,7 +1885,7 @@ giwscan_cb(void *arg, const struct ieee8
  		int r = se->se_rates[2 + j] & IEEE80211_RATE_VAL;
  		if (r != 0) {
  			iwe.u.bitrate.value = r * (1000000 / 2);
@@ -77,7 +77,7 @@
  				current_val, end_buf, &iwe,
  				IW_EV_PARAM_LEN);
  		}
-@@ -1887,7 +1894,7 @@
+@@ -1887,7 +1894,7 @@ giwscan_cb(void *arg, const struct ieee8
  		int r = se->se_xrates[2+j] & IEEE80211_RATE_VAL;
  		if (r != 0) {
  			iwe.u.bitrate.value = r * (1000000 / 2);
@@ -86,7 +86,7 @@
  				current_val, end_buf, &iwe,
  				IW_EV_PARAM_LEN);
  		}
-@@ -1906,7 +1913,7 @@
+@@ -1906,7 +1913,7 @@ giwscan_cb(void *arg, const struct ieee8
  	iwe.cmd = IWEVCUSTOM;
  	snprintf(buf, sizeof(buf), "bcn_int=%d", se->se_intval);
  	iwe.u.data.length = strlen(buf);
@@ -95,7 +95,7 @@
  
  	/* We ran out of space in the buffer. */
  	if (last_ev == current_ev)
-@@ -1930,7 +1937,7 @@
+@@ -1930,7 +1937,7 @@ giwscan_cb(void *arg, const struct ieee8
  				rsn_leader, sizeof(rsn_leader) - 1);
  #endif
  		if (iwe.u.data.length != 0) {
@@ -104,7 +104,7 @@
  				&iwe, buf);
  
  			/* We ran out of space in the buffer */
-@@ -1956,7 +1963,7 @@
+@@ -1956,7 +1963,7 @@ giwscan_cb(void *arg, const struct ieee8
  			wpa_leader, sizeof(wpa_leader) - 1);
  #endif
  		if (iwe.u.data.length != 0) {
@@ -113,7 +113,7 @@
  				&iwe, buf);
  
  			/* We ran out of space in the buffer. */
-@@ -1975,7 +1982,7 @@
+@@ -1975,7 +1982,7 @@ giwscan_cb(void *arg, const struct ieee8
  			se->se_wme_ie, se->se_wme_ie[1] + 2,
  			wme_leader, sizeof(wme_leader) - 1);
  		if (iwe.u.data.length != 0) {
@@ -122,7 +122,7 @@
  				&iwe, buf);
  
  			/* We ran out of space in the buffer. */
-@@ -1993,7 +2000,7 @@
+@@ -1993,7 +2000,7 @@ giwscan_cb(void *arg, const struct ieee8
  			se->se_ath_ie, se->se_ath_ie[1] + 2,
  			ath_leader, sizeof(ath_leader) - 1);
  		if (iwe.u.data.length != 0) {