madwifi: fix noderef and state machine issues in the currently unused ap-to-ap wds mode; refresh patches

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@13096 3c298f89-4303-0410-b956-a3cf2f4a3e73

65 files changed, 602 insertions, 465 deletions

diff --git a/package/madwifi/patches/102-multicall_binary.patch b/package/madwifi/patches/102-multicall_binary.patch
index d3533ec68a..887a462e9f 100644
--- a/package/madwifi/patches/102-multicall_binary.patch
+++ b/package/madwifi/patches/102-multicall_binary.patch
@@ -8,7 +8,7 @@
  
  #undef ARRAY_SIZE
  #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
-@@ -185,7 +186,7 @@
+@@ -185,7 +186,7 @@ sysctlbyname(const char *oid0, void *old
  #endif /* __linux__ */
  
  int
@@ -27,7 +27,7 @@
  
  #ifndef SIOCG80211STATS
  #define	SIOCG80211STATS	(SIOCDEVPRIVATE + 2)
-@@ -240,7 +241,7 @@
+@@ -240,7 +241,7 @@ print_sta_stats(FILE *fd, const u_int8_t
  }
  
  int
@@ -46,7 +46,7 @@
  
  static	int s = -1;
  static const char *progname;
-@@ -140,8 +141,9 @@
+@@ -140,8 +141,9 @@ usage(void)
  }
  
  #define	MAXCHAN	((int)(sizeof(struct ieee80211req_chanlist) * NBBY))
@@ -67,7 +67,7 @@
  
  static int
  setsysctrl(const char *dev, const char *control , u_long value)
-@@ -88,7 +89,7 @@
+@@ -88,7 +89,7 @@ static void usage(void)
  }
  
  int
@@ -86,7 +86,7 @@
  
  #undef ARRAY_SIZE
  #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
-@@ -194,7 +195,7 @@
+@@ -194,7 +195,7 @@ sysctlbyname(const char *oid0, void *old
  #endif /* __linux__ */
  
  int
@@ -105,7 +105,7 @@
  
  static int s = -1;
  static const char *progname;
-@@ -213,8 +214,7 @@
+@@ -213,8 +214,7 @@ usage(void)
  	exit(-1);
  }
  
@@ -125,7 +125,7 @@
  
  static const struct {
  	u_int		phyerr;
-@@ -228,7 +229,7 @@
+@@ -228,7 +229,7 @@ catchalarm(int signo)
  }
  
  int
@@ -190,7 +190,7 @@
 +#endif
 --- a/tools/Makefile
 +++ b/tools/Makefile
-@@ -46,56 +46,55 @@
+@@ -46,56 +46,55 @@ ifeq ($(HAL),)
  HAL=   $(TOP)/hal
  endif
  
@@ -284,7 +284,7 @@
  
  /*
   * These are taken from ieee80211_node.h
-@@ -100,7 +101,7 @@
+@@ -100,7 +101,7 @@ size_t strlcat(char *, const char *, siz
  static int verbose = 0;
  
  int
@@ -303,7 +303,7 @@
  
  #undef ARRAY_SIZE
  #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
-@@ -738,7 +739,8 @@
+@@ -738,7 +739,8 @@ static void usage(const char *n)
  		"unlawful radio transmissions!\n\n");
  }
  
diff --git a/package/madwifi/patches/104-autocreate_none.patch b/package/madwifi/patches/104-autocreate_none.patch
index 0979179641..b2181b68e2 100644
--- a/package/madwifi/patches/104-autocreate_none.patch
+++ b/package/madwifi/patches/104-autocreate_none.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -516,7 +516,7 @@
+@@ -516,7 +516,7 @@ ath_attach(u_int16_t devid, struct net_d
  	HAL_STATUS status;
  	int error = 0;
  	unsigned int i;
diff --git a/package/madwifi/patches/105-ratectl_attach.patch b/package/madwifi/patches/105-ratectl_attach.patch
index 79b08dfb82..1303acfb0d 100644
--- a/package/madwifi/patches/105-ratectl_attach.patch
+++ b/package/madwifi/patches/105-ratectl_attach.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_rate.c
 +++ b/net80211/ieee80211_rate.c
-@@ -100,8 +100,18 @@
+@@ -100,8 +100,18 @@ struct ath_ratectrl *ieee80211_rate_atta
  		ieee80211_load_module(buf);
  
  	if (!ratectls[id].attach) {
diff --git a/package/madwifi/patches/106-get_arch.patch b/package/madwifi/patches/106-get_arch.patch
index b5ef4f299e..4873271138 100644
--- a/package/madwifi/patches/106-get_arch.patch
+++ b/package/madwifi/patches/106-get_arch.patch
@@ -1,6 +1,6 @@
 --- a/scripts/get_arch.mk
 +++ b/scripts/get_arch.mk
-@@ -36,6 +36,13 @@
+@@ -36,6 +36,13 @@ ifeq (,$(ARCH-y))
  $(Cannot determine ARCH)
  endif
  
diff --git a/package/madwifi/patches/111-minstrel_crash.patch b/package/madwifi/patches/111-minstrel_crash.patch
index 43998c3ee0..975bc4e94a 100644
--- a/package/madwifi/patches/111-minstrel_crash.patch
+++ b/package/madwifi/patches/111-minstrel_crash.patch
@@ -1,6 +1,6 @@
 --- a/ath_rate/minstrel/minstrel.c
 +++ b/ath_rate/minstrel/minstrel.c
-@@ -393,6 +393,9 @@
+@@ -393,6 +393,9 @@ ath_rate_get_mrr(struct ath_softc *sc, s
  		struct minstrel_node *sn = ATH_NODE_MINSTREL(an);
  		int rc1, rc2, rc3;         /* Index into the rate table, so for example, it is  0..11 */
  
diff --git a/package/madwifi/patches/113-no_ibss_pwrsave.patch b/package/madwifi/patches/113-no_ibss_pwrsave.patch
index 0d6a11ef5e..af23ceb7a8 100644
--- a/package/madwifi/patches/113-no_ibss_pwrsave.patch
+++ b/package/madwifi/patches/113-no_ibss_pwrsave.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_scan.c
 +++ b/net80211/ieee80211_scan.c
-@@ -291,7 +291,8 @@
+@@ -291,7 +291,8 @@ scan_restart_pwrsav(unsigned long arg)
  	struct ieee80211com *ic = vap->iv_ic;
  	int delay;
  
diff --git a/package/madwifi/patches/122-replayfail_workaround.patch b/package/madwifi/patches/122-replayfail_workaround.patch
index 3ed352076a..c4eb28c947 100644
--- a/package/madwifi/patches/122-replayfail_workaround.patch
+++ b/package/madwifi/patches/122-replayfail_workaround.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_linux.c
 +++ b/net80211/ieee80211_linux.c
-@@ -331,6 +331,9 @@
+@@ -331,6 +331,9 @@ ieee80211_notify_replay_failure(struct i
  		k->wk_cipher->ic_name, k->wk_keyix,
  		(unsigned long long)rsc);
  
diff --git a/package/madwifi/patches/123-ccmp_checks.patch b/package/madwifi/patches/123-ccmp_checks.patch
index 95c7905dd6..71cede7987 100644
--- a/package/madwifi/patches/123-ccmp_checks.patch
+++ b/package/madwifi/patches/123-ccmp_checks.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_crypto_ccmp.c
 +++ b/net80211/ieee80211_crypto_ccmp.c
-@@ -475,6 +475,9 @@
+@@ -475,6 +475,9 @@ ccmp_encrypt(struct ieee80211_key *key, 
  	uint8_t *mic, *pos;
  	u_int space;
  
@@ -10,7 +10,7 @@
  	ctx->cc_vap->iv_stats.is_crypto_ccmp++;
  
  	skb = skb0;
-@@ -589,6 +592,9 @@
+@@ -589,6 +592,9 @@ ccmp_decrypt(struct ieee80211_key *key, 
  	uint8_t *pos, *mic;
  	u_int space;
  
diff --git a/package/madwifi/patches/124-linux24_compat.patch b/package/madwifi/patches/124-linux24_compat.patch
index ec862bbe1f..88601a4c71 100644
--- a/package/madwifi/patches/124-linux24_compat.patch
+++ b/package/madwifi/patches/124-linux24_compat.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_athvar.h
 +++ b/ath/if_athvar.h
-@@ -126,6 +126,11 @@
+@@ -126,6 +126,11 @@ typedef void irqreturn_t;
  #define ATH_GET_NETDEV_DEV(ndev)	((ndev)->class_dev.dev)
  #endif
  
@@ -30,7 +30,7 @@
  	const char *name;
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -4705,6 +4705,46 @@
+@@ -4705,6 +4705,46 @@ ath_beacon_setup(struct ath_softc *sc, s
  #undef USE_SHPREAMBLE
  }
  
diff --git a/package/madwifi/patches/126-rxerr_frames.patch b/package/madwifi/patches/126-rxerr_frames.patch
index ceab9eadc0..762a7bc815 100644
--- a/package/madwifi/patches/126-rxerr_frames.patch
+++ b/package/madwifi/patches/126-rxerr_frames.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -6474,8 +6474,9 @@
+@@ -6474,8 +6474,9 @@ ath_rx_tasklet(TQUEUE_ARG data)
  			/*
  			 * Reject error frames if we have no vaps that
  			 * are operating in monitor mode.
diff --git a/package/madwifi/patches/200-no_debug.patch b/package/madwifi/patches/200-no_debug.patch
index 542c6c808c..ed443893a6 100644
--- a/package/madwifi/patches/200-no_debug.patch
+++ b/package/madwifi/patches/200-no_debug.patch
@@ -8,7 +8,7 @@
  #include "if_ath_debug.h"
  #include "opt_ah.h"
  
-@@ -368,8 +367,10 @@
+@@ -368,8 +367,10 @@ static unsigned int ath_get_dfs_cac_time
  static void ath_set_dfs_cac_time(struct ieee80211com *, unsigned int seconds);
  
  static unsigned int ath_test_radar(struct ieee80211com *);
@@ -20,7 +20,7 @@
  static u_int32_t ath_get_clamped_maxtxpower(struct ath_softc *sc);
  static u_int32_t ath_set_clamped_maxtxpower(struct ath_softc *sc, 
  		u_int32_t new_clamped_maxtxpower);
-@@ -520,9 +521,11 @@
+@@ -520,9 +521,11 @@ ath_attach(u_int16_t devid, struct net_d
  	u_int8_t csz;
  
  	sc->devid = devid;
@@ -32,7 +32,7 @@
  
  	/* Allocate space for dynamically determined maximum VAP count */
  	sc->sc_bslot = 
-@@ -1038,8 +1041,9 @@
+@@ -1038,8 +1041,9 @@ ath_attach(u_int16_t devid, struct net_d
  	ic->ic_vap_delete = ath_vap_delete;
  
  	ic->ic_test_radar           = ath_test_radar;
@@ -43,7 +43,7 @@
  	ic->ic_set_dfs_testmode     = ath_set_dfs_testmode;
  	ic->ic_get_dfs_testmode     = ath_get_dfs_testmode;
  
-@@ -1297,12 +1301,14 @@
+@@ -1297,12 +1301,14 @@ ath_vap_create(struct ieee80211com *ic, 
  		/* If no default VAP debug flags are passed, allow a few to
  		 * transfer down from the driver to new VAPs so we can have load
  		 * time debugging for VAPs too. */
@@ -58,7 +58,7 @@
  	}
  	ic->ic_debug = (sc->sc_default_ieee80211_debug & IEEE80211_MSG_IC);
  
-@@ -10496,9 +10502,11 @@
+@@ -10496,9 +10502,11 @@ ATH_SYSCTL_DECL(ath_sysctl_halparam, ctl
  				/* XXX validate? */
  				sc->sc_ledpin = val;
  				break;
@@ -70,7 +70,7 @@
  				break;
  			case ATH_TXANTENNA:
  				/*
-@@ -10918,9 +10926,11 @@
+@@ -10918,9 +10926,11 @@ ath_dynamic_sysctl_register(struct ath_s
  	}
  
  	/* initialize values */
@@ -82,7 +82,7 @@
  	sc->sc_txantenna = 0;		/* default to auto-selection */
  	sc->sc_txintrperiod = ATH_TXQ_INTR_PERIOD;
  }
-@@ -11762,6 +11772,7 @@
+@@ -11762,6 +11772,7 @@ ath_test_radar(struct ieee80211com *ic)
  }
  
  /* This is called by a private ioctl (iwpriv) to dump the HAL obfuscation table */
@@ -90,7 +90,7 @@
  static unsigned int
  ath_dump_hal_map(struct ieee80211com *ic)
  {
-@@ -11770,7 +11781,7 @@
+@@ -11770,7 +11781,7 @@ ath_dump_hal_map(struct ieee80211com *ic
  	ath_hal_dump_map(sc->sc_ah);
  	return 0;
  }
@@ -150,7 +150,7 @@
  	ATH_DEBUG_RATE		= 0x00000010,	/* rate control */
 --- a/tools/do_multi.c
 +++ b/tools/do_multi.c
-@@ -10,16 +10,20 @@
+@@ -10,16 +10,20 @@ main(int argc, char *argv[])
  
      progname = basename(argv[0]);
  
@@ -173,7 +173,7 @@
      if(strcmp(progname, "athstats") == 0)
 --- a/tools/Makefile
 +++ b/tools/Makefile
-@@ -48,6 +48,8 @@
+@@ -48,6 +48,8 @@ endif
  
  all: compile
  
@@ -182,7 +182,7 @@
  ALLPROGS=	athstats 80211stats athkey athchans athctrl \
  	athdebug 80211debug wlanconfig ath_info
  
-@@ -55,7 +57,7 @@
+@@ -55,7 +57,7 @@ OBJS=	$(patsubst %,%.o,$(ALLPROGS))
  
  INCS=	-I. -I../ath -I$(HAL) -I$(TOP) -I$(ATH_HAL)
  CFLAGS=	-g -O2 -Wall
@@ -204,7 +204,7 @@
  #include <linux/wireless.h>
 --- a/Makefile.inc
 +++ b/Makefile.inc
-@@ -148,7 +148,8 @@
+@@ -148,7 +148,8 @@ ATH_RATE=	$(TOP)/ath_rate
  TOOLS=  $(TOP)/tools 
  
  WARNINGS = -Werror
@@ -236,7 +236,7 @@
  
 --- a/ath/if_ath_hal.h
 +++ b/ath/if_ath_hal.h
-@@ -1081,6 +1081,7 @@
+@@ -1081,6 +1081,7 @@ static inline HAL_BOOL ath_hal_disable(s
  
             tail -f /var/log/messages | sed -f hal_unmangle.sed 
   */
@@ -244,7 +244,7 @@
  static inline void ath_hal_dump_map(struct ath_hal *ah)
  {
  #ifdef CONFIG_KALLSYMS
-@@ -1345,7 +1346,7 @@
+@@ -1345,7 +1346,7 @@ static inline void ath_hal_dump_map(stru
  #endif				/* #ifndef CONFIG_KALLSYMS */
  
  }
@@ -255,7 +255,7 @@
  #endif				/* #ifndef _IF_ATH_HAL_H_ */
 --- a/net80211/ieee80211_var.h
 +++ b/net80211/ieee80211_var.h
-@@ -492,9 +492,10 @@
+@@ -492,9 +492,10 @@ struct ieee80211com {
  	/* inject a fake radar signal -- used while on a 802.11h DFS channels */
  	unsigned int (*ic_test_radar)(struct ieee80211com *);
  
@@ -269,7 +269,7 @@
  	unsigned int (*ic_get_dfs_cac_time)(struct ieee80211com *);
 --- a/net80211/ieee80211_wireless.c
 +++ b/net80211/ieee80211_wireless.c
-@@ -1548,6 +1548,7 @@
+@@ -1548,6 +1548,7 @@ ieee80211_get_txcont_power(struct net_de
  	return 0;
  }
  
@@ -277,7 +277,7 @@
  static int 
  ieee80211_ioctl_hal_map(struct net_device *dev, struct iw_request_info *info,
         void *w, char *extra)
-@@ -1558,7 +1559,7 @@
+@@ -1558,7 +1559,7 @@ ieee80211_ioctl_hal_map(struct net_devic
         params[0] = ic->ic_dump_hal_map(ic);
         return 0;
  }
@@ -286,7 +286,7 @@
  
  static int
  ieee80211_ioctl_radar(struct net_device *dev, struct iw_request_info *info,
-@@ -5258,8 +5259,10 @@
+@@ -5258,8 +5259,10 @@ static const struct iw_priv_args ieee802
  	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,   "getwmmparams" },
  	{ IEEE80211_IOCTL_RADAR,
  	  0, 0, "doth_radar" },
@@ -297,7 +297,7 @@
  	/*
  	 * These depends on sub-ioctl support which added in version 12.
  	 */
-@@ -5695,7 +5698,9 @@
+@@ -5695,7 +5698,9 @@ static const iw_handler ieee80211_priv_h
  	set_priv(IEEE80211_IOCTL_SETMLME, ieee80211_ioctl_setmlme),
  	set_priv(IEEE80211_IOCTL_SETKEY, ieee80211_ioctl_setkey),
  	set_priv(IEEE80211_IOCTL_DELKEY, ieee80211_ioctl_delkey),
@@ -309,7 +309,7 @@
  	set_priv(IEEE80211_IOCTL_WDSADDMAC, ieee80211_ioctl_wdsmac),
 --- a/ath/if_ath_debug.h
 +++ b/ath/if_ath_debug.h
-@@ -54,6 +54,10 @@
+@@ -54,6 +54,10 @@ enum {
  	ATH_DEBUG_GLOBAL	= (ATH_DEBUG_SKB|ATH_DEBUG_SKB_REF)
  };
  
@@ -320,7 +320,7 @@
  #ifdef AR_DEBUG
  
  /* DEBUG-ONLY DEFINITIONS */
-@@ -68,20 +72,9 @@
+@@ -68,20 +72,9 @@ enum {
  		ath_keyprint((_sc), __func__, _ix, _hk, _mac);		\
  } while (0)
  
@@ -341,7 +341,7 @@
  #define	WPRINTF(_sc, _fmt, ...) \
  		printk(KERN_WARNING "%s: %s: " _fmt, \
  			SC_DEV_NAME(_sc), __func__, ## __VA_ARGS__)
-@@ -89,5 +82,14 @@
+@@ -89,5 +82,14 @@ enum {
  #define	IPRINTF(_sc, _fmt, ...) \
  		printk(KERN_INFO "%s: %s: " _fmt, \
  			SC_DEV_NAME(_sc), __func__, ## __VA_ARGS__)
@@ -358,7 +358,7 @@
  #endif /* #ifndef _IF_ATH_DEBUG_H_ */
 --- a/net80211/ieee80211_node.c
 +++ b/net80211/ieee80211_node.c
-@@ -920,6 +920,9 @@
+@@ -920,6 +920,9 @@ node_cleanup(struct ieee80211_node *ni)
  	ni->ni_rxkeyoff = 0;
  }
  
@@ -368,7 +368,7 @@
  static void node_print_message(
  		u_int32_t flags,
  		int show_counter, 
-@@ -972,7 +975,7 @@
+@@ -972,7 +975,7 @@ static void node_print_message(
  			adjusted_refcount);
  	va_end(args);
  }
@@ -379,7 +379,7 @@
  #ifdef IEEE80211_DEBUG_REFCNT
 --- a/ath/if_ath_pci.c
 +++ b/ath/if_ath_pci.c
-@@ -134,8 +134,10 @@
+@@ -134,8 +134,10 @@ ath_pci_probe(struct pci_dev *pdev, cons
  	u16 vdevice;
  	int i;
  
@@ -391,7 +391,7 @@
  
  	/* XXX 32-bit addressing only */
  	if (pci_set_dma_mask(pdev, 0xffffffff)) {
-@@ -244,8 +246,10 @@
+@@ -244,8 +246,10 @@ ath_pci_probe(struct pci_dev *pdev, cons
  		sc->aps_sc.sc_ledpin = 1;
  	}
  
diff --git a/package/madwifi/patches/201-debug_fix.patch b/package/madwifi/patches/201-debug_fix.patch
index 57425f7537..bcfbba82c6 100644
--- a/package/madwifi/patches/201-debug_fix.patch
+++ b/package/madwifi/patches/201-debug_fix.patch
@@ -9,7 +9,7 @@
  #endif
  
  int	ath_hal_dma_beacon_response_time = 2;	/* in TUs */
-@@ -327,6 +327,8 @@
+@@ -327,6 +327,8 @@ EXPORT_SYMBOL(OS_MARK);
   * useful for debugging and figuring out, which hal function sets which 
   * registers */
  char *ath_hal_func = NULL;
diff --git a/package/madwifi/patches/202-debug_variables.patch b/package/madwifi/patches/202-debug_variables.patch
index 83556ee7df..041344ff0a 100644
--- a/package/madwifi/patches/202-debug_variables.patch
+++ b/package/madwifi/patches/202-debug_variables.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -453,8 +453,8 @@
+@@ -453,8 +453,8 @@ MODULE_PARM_DESC(autocreate, "Create ath
  MODULE_PARM_DESC(ratectl, "Rate control algorithm [amrr|minstrel|onoe|sample], "
  		"defaults to '" DEF_RATE_CTL "'");
  
@@ -10,7 +10,7 @@
  #if (LINUX_VERSION_CODE < KERNEL_VERSION(2,5,52))
  MODULE_PARM(ath_debug, "i");
  #else
-@@ -465,8 +465,8 @@
+@@ -465,8 +465,8 @@ static void ath_printrxbuf(const struct 
  static void ath_printtxbuf(const struct ath_buf *, int);
  #endif /* defined(AR_DEBUG) */
  
@@ -20,7 +20,7 @@
  #if (LINUX_VERSION_CODE < KERNEL_VERSION(2,5,52))
  MODULE_PARM(ieee80211_debug, "i");
  #else
-@@ -1565,7 +1565,9 @@
+@@ -1565,7 +1565,9 @@ ath_vap_delete(struct ieee80211vap *vap)
  void
  ath_suspend(struct net_device *dev)
  {
@@ -30,7 +30,7 @@
  
  	DPRINTF(sc, ATH_DEBUG_ANY, "flags=%x\n", dev->flags);
  	ath_stop(dev);
-@@ -1574,7 +1576,9 @@
+@@ -1574,7 +1576,9 @@ ath_suspend(struct net_device *dev)
  void
  ath_resume(struct net_device *dev)
  {
@@ -40,7 +40,7 @@
  
  	DPRINTF(sc, ATH_DEBUG_ANY, "flags=%x\n", dev->flags);
  	ath_init(dev);
-@@ -4019,7 +4023,9 @@
+@@ -4019,7 +4023,9 @@ static void
  ath_key_update_begin(struct ieee80211vap *vap)
  {
  	struct net_device *dev = vap->iv_ic->ic_dev;
@@ -50,7 +50,7 @@
  
  	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "Begin\n");
  	/*
-@@ -4040,7 +4046,9 @@
+@@ -4040,7 +4046,9 @@ static void
  ath_key_update_end(struct ieee80211vap *vap)
  {
  	struct net_device *dev = vap->iv_ic->ic_dev;
@@ -60,7 +60,7 @@
  
  	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "End\n");
  	netif_wake_queue(dev);
-@@ -6218,7 +6226,9 @@
+@@ -6218,7 +6226,9 @@ ath_recv_mgmt(struct ieee80211vap * vap,
  	struct sk_buff *skb, int subtype, int rssi, u_int64_t rtsf)
  {
  	struct ath_softc *sc = vap->iv_ic->ic_dev->priv;
@@ -70,7 +70,7 @@
  	struct ieee80211_node * ni = ni_or_null;
  	u_int64_t hw_tsf, beacon_tsf;
  	u_int32_t hw_tu, beacon_tu, intval;
-@@ -8382,7 +8392,9 @@
+@@ -8382,7 +8392,9 @@ ath_tx_timeout(struct net_device *dev)
  static void
  ath_tx_draintxq(struct ath_softc *sc, struct ath_txq *txq)
  {
@@ -80,7 +80,7 @@
  	struct ath_buf *bf;
  	/*
  	 * NB: this assumes output has been stopped and
-@@ -11002,6 +11014,7 @@
+@@ -11002,6 +11014,7 @@ ath_announce(struct net_device *dev)
  		strncat(m, b, MLEN);
  	}
  	strncat(m, "\n", MLEN);
@@ -88,7 +88,7 @@
  	if (1 /* bootverbose */) {
  		unsigned int i;
  		for (i = 0; i <= WME_AC_VO; i++) {
-@@ -11014,6 +11027,7 @@
+@@ -11014,6 +11027,7 @@ ath_announce(struct net_device *dev)
  			sc->sc_cabq->axq_qnum);
  		IPRINTF(sc, "Use hw queue %u for beacons\n", sc->sc_bhalq);
  	}
@@ -98,7 +98,7 @@
   
 --- a/ath/if_ath_radar.c
 +++ b/ath/if_ath_radar.c
-@@ -156,7 +156,9 @@
+@@ -156,7 +156,9 @@ static struct radar_pattern_specificatio
  #endif
  };
  
@@ -108,7 +108,7 @@
  
  /* Returns true if radar detection is enabled. */
  int ath_radar_is_enabled(struct ath_softc *sc)
-@@ -229,7 +231,9 @@
+@@ -229,7 +231,9 @@ int ath_radar_update(struct ath_softc *s
  {
  
  	struct ath_hal *ah = sc->sc_ah;
@@ -118,7 +118,7 @@
  	struct ieee80211com *ic = &sc->sc_ic;
  	int required = 0;
  
-@@ -366,6 +370,7 @@
+@@ -366,6 +370,7 @@ static struct ath_rp *pulse_prev(struct 
  #define MR_FAIL_MIN_PERIOD	4
  #define MR_FAIL_MAX_PERIOD	5
  
@@ -126,7 +126,7 @@
  static const char* get_match_result_desc(u_int32_t code) {
  	switch (code) {
  	case MR_MATCH:
-@@ -384,6 +389,7 @@
+@@ -384,6 +389,7 @@ static const char* get_match_result_desc
  		return "unknown";
  	}
  }
@@ -134,7 +134,7 @@
  
  static int32_t match_radar(
  	u_int32_t matched, 
-@@ -775,7 +781,10 @@
+@@ -775,7 +781,10 @@ static HAL_BOOL rp_analyse_short_pulse(
  	struct ath_softc *sc, struct ath_rp *last_pulse, 
  	u_int32_t *index, u_int32_t *pri, u_int32_t *matching_pulses, 
  	u_int32_t *missed_pulses, u_int32_t *noise_pulses)
@@ -146,7 +146,7 @@
  	int i;
  	int best_index = -1;
  	unsigned int best_matched = 0;
-@@ -1217,6 +1226,7 @@
+@@ -1217,6 +1226,7 @@ static HAL_BOOL rp_analyse_short_pulse(
  	return (-1 != best_index) ? AH_TRUE : AH_FALSE;
  }
  
@@ -154,7 +154,7 @@
  static u_int32_t interval_to_frequency(u_int32_t interval)
  {
  	/* Calculate BRI from PRI */
-@@ -1224,6 +1234,7 @@
+@@ -1224,6 +1234,7 @@ static u_int32_t interval_to_frequency(u
  	/* Round to nearest multiple of 50 */
  	return frequency + ((frequency % 50) >= 25 ? 50 : 0) - (frequency % 50);
  }
@@ -162,7 +162,7 @@
  
  #ifdef ATH_RADAR_LONG_PULSE
  static const char* get_longpulse_desc(int lp) {
-@@ -1580,7 +1591,9 @@
+@@ -1580,7 +1591,9 @@ void ath_rp_done(struct ath_softc *sc)
  void ath_rp_record(struct ath_softc *sc, u_int64_t tsf, u_int8_t rssi, 
  			    u_int8_t width, HAL_BOOL is_simulated)
  {
@@ -174,7 +174,7 @@
  	DPRINTF(sc, ATH_DEBUG_DOTHPULSES, "%s: ath_rp_record: "
 --- a/ath_rate/minstrel/minstrel.c
 +++ b/ath_rate/minstrel/minstrel.c
-@@ -931,7 +931,9 @@
+@@ -931,7 +931,9 @@ ath_proc_read_nodes(struct ieee80211vap 
  			    (struct ieee80211_node_table *) &vap->iv_ic->ic_sta;
  		unsigned int x = 0;
  		unsigned int this_tp, this_prob, this_eprob;
@@ -186,7 +186,7 @@
  		TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
 --- a/net80211/ieee80211_scan_ap.c
 +++ b/net80211/ieee80211_scan_ap.c
-@@ -731,6 +731,7 @@
+@@ -731,6 +731,7 @@ pick_channel(struct ieee80211_scan_state
  
  	sort(chans, ss_last, sizeof(*chans), pc_cmp, pc_swap);
  
@@ -194,7 +194,7 @@
  	for (i = 0; i < ss_last; i++) {
  		int chan = ieee80211_chan2ieee(ic, chans[i].chan);
  
-@@ -742,6 +743,7 @@
+@@ -742,6 +743,7 @@ pick_channel(struct ieee80211_scan_state
  				!!IEEE80211_ARE_CHANS_SAME_MODE(chans[i].chan, 
  					ic->ic_bsschan));
  	}
diff --git a/package/madwifi/patches/300-napi_polling.patch b/package/madwifi/patches/300-napi_polling.patch
index a3a7c834a4..bc62d7b4a6 100644
--- a/package/madwifi/patches/300-napi_polling.patch
+++ b/package/madwifi/patches/300-napi_polling.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -184,7 +184,11 @@
+@@ -184,7 +184,11 @@ static void ath_recv_mgmt(struct ieee802
  	struct sk_buff *, int, int, u_int64_t);
  static void ath_setdefantenna(struct ath_softc *, u_int);
  static struct ath_txq *ath_txq_setup(struct ath_softc *, int, int);
@@ -13,7 +13,7 @@
  static int ath_hardstart(struct sk_buff *, struct net_device *);
  static int ath_mgtstart(struct ieee80211com *, struct sk_buff *);
  #ifdef ATH_SUPERG_COMP
-@@ -376,6 +380,9 @@
+@@ -376,6 +380,9 @@ static u_int32_t ath_set_clamped_maxtxpo
  		u_int32_t new_clamped_maxtxpower);
  static u_int32_t ath_get_real_maxtxpower(struct ath_softc *sc);
  
@@ -23,7 +23,7 @@
  /* calibrate every 30 secs in steady state but check every second at first. */
  static int ath_calinterval = ATH_SHORT_CALINTERVAL;
  static int ath_countrycode = CTRY_DEFAULT;	/* country code */
-@@ -547,7 +554,6 @@
+@@ -547,7 +554,6 @@ ath_attach(u_int16_t devid, struct net_d
  
  	atomic_set(&sc->sc_txbuf_counter, 0);
  
@@ -31,7 +31,7 @@
  	ATH_INIT_TQUEUE(&sc->sc_txtq,	  ath_tx_tasklet,	dev);
  	ATH_INIT_TQUEUE(&sc->sc_bmisstq,  ath_bmiss_tasklet,	dev);
  	ATH_INIT_TQUEUE(&sc->sc_bstucktq, ath_bstuck_tasklet,	dev);
-@@ -821,6 +827,12 @@
+@@ -821,6 +827,12 @@ ath_attach(u_int16_t devid, struct net_d
  	dev->set_mac_address = ath_set_mac_address;
  	dev->change_mtu = ath_change_mtu;
  	dev->tx_queue_len = ATH_TXBUF - ATH_TXBUF_MGT_RESERVED;
@@ -44,7 +44,7 @@
  #ifdef USE_HEADERLEN_RESV
  	dev->hard_header_len += sizeof(struct ieee80211_qosframe) +
  				sizeof(struct llc) +
-@@ -2220,6 +2232,7 @@
+@@ -2220,6 +2232,7 @@ ath_intr(int irq, void *dev_id, struct p
  		(status & HAL_INT_GLOBAL)	? " HAL_INT_GLOBAL"	: ""
  		);
  
@@ -52,7 +52,7 @@
  	status &= sc->sc_imask;			/* discard unasked for bits */
  	/* As soon as we know we have a real interrupt we intend to service, 
  	 * we will check to see if we need an initial hardware TSF reading. 
-@@ -2277,7 +2290,21 @@
+@@ -2277,7 +2290,21 @@ ath_intr(int irq, void *dev_id, struct p
  		}
  		if (status & (HAL_INT_RX | HAL_INT_RXPHY)) {
  			ath_uapsd_processtriggers(sc, hw_tsf);
@@ -75,7 +75,7 @@
  		}
  		if (status & HAL_INT_TX) {
  #ifdef ATH_SUPERG_DYNTURBO
-@@ -2303,6 +2330,11 @@
+@@ -2303,6 +2330,11 @@ ath_intr(int irq, void *dev_id, struct p
  				}
  			}
  #endif
@@ -87,7 +87,7 @@
  			ATH_SCHEDULE_TQUEUE(&sc->sc_txtq, &needmark);
  		}
  		if (status & HAL_INT_BMISS) {
-@@ -2515,6 +2547,7 @@
+@@ -2515,6 +2547,7 @@ ath_init(struct net_device *dev)
  	if (sc->sc_tx99 != NULL)
  		sc->sc_tx99->start(sc->sc_tx99);
  #endif
@@ -95,7 +95,7 @@
  
  done:
  	ATH_UNLOCK(sc);
-@@ -2555,6 +2588,9 @@
+@@ -2555,6 +2588,9 @@ ath_stop_locked(struct net_device *dev)
  		if (sc->sc_tx99 != NULL)
  			sc->sc_tx99->stop(sc->sc_tx99);
  #endif
@@ -105,7 +105,7 @@
  		netif_stop_queue(dev);	/* XXX re-enabled by ath_newstate */
  		dev->flags &= ~IFF_RUNNING;	/* NB: avoid recursion */
  		ieee80211_stop_running(ic);	/* stop all VAPs */
-@@ -4013,12 +4049,47 @@
+@@ -4013,12 +4049,47 @@ ath_key_set(struct ieee80211vap *vap, co
  	return ath_keyset(sc, k, mac, vap->iv_bss);
  }
  
@@ -153,7 +153,7 @@
  static void
  ath_key_update_begin(struct ieee80211vap *vap)
  {
-@@ -4032,14 +4103,9 @@
+@@ -4032,14 +4103,9 @@ ath_key_update_begin(struct ieee80211vap
  	 * When called from the rx tasklet we cannot use
  	 * tasklet_disable because it will block waiting
  	 * for us to complete execution.
@@ -170,7 +170,7 @@
  }
  
  static void
-@@ -4051,9 +4117,9 @@
+@@ -4051,9 +4117,9 @@ ath_key_update_end(struct ieee80211vap *
  #endif
  
  	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "End\n");
@@ -183,7 +183,7 @@
  }
  
  /*
-@@ -6360,15 +6426,25 @@
+@@ -6360,15 +6426,25 @@ ath_setdefantenna(struct ath_softc *sc, 
  	sc->sc_rxotherant = 0;
  }
  
@@ -213,7 +213,7 @@
  	struct ieee80211com *ic = &sc->sc_ic;
  	struct ath_hal *ah = sc ? sc->sc_ah : NULL;
  	struct ath_desc *ds;
-@@ -6378,8 +6454,10 @@
+@@ -6378,8 +6454,10 @@ ath_rx_tasklet(TQUEUE_ARG data)
  	unsigned int len;
  	int type;
  	u_int phyerr;
@@ -224,7 +224,7 @@
  	do {
  		bf = STAILQ_FIRST(&sc->sc_rxbuf);
  		if (bf == NULL) {		/* XXX ??? can this happen */
-@@ -6403,6 +6481,15 @@
+@@ -6403,6 +6481,15 @@ ath_rx_tasklet(TQUEUE_ARG data)
  			/* NB: never process the self-linked entry at the end */
  			break;
  		}
@@ -240,7 +240,7 @@
  		skb = bf->bf_skb;
  		if (skb == NULL) {
  			EPRINTF(sc, "Dropping; buffer contains NULL skbuff.\n");
-@@ -6450,6 +6537,7 @@
+@@ -6450,6 +6537,7 @@ ath_rx_tasklet(TQUEUE_ARG data)
  				sc->sc_stats.ast_rx_phyerr++;
  				phyerr = rs->rs_phyerr & 0x1f;
  				sc->sc_stats.ast_rx_phy[phyerr]++;
@@ -248,7 +248,7 @@
  			}
  			if (rs->rs_status & HAL_RXERR_DECRYPT) {
  				/*
-@@ -6645,9 +6733,39 @@
+@@ -6645,9 +6733,39 @@ rx_next:
  		STAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
  		ATH_RXBUF_UNLOCK_IRQ(sc);
  	} while (ath_rxbuf_init(sc, bf) == 0);
@@ -288,7 +288,7 @@
  #undef PA2DESC
  }
  
-@@ -8298,12 +8416,24 @@
+@@ -8298,12 +8416,24 @@ ath_tx_tasklet_q0(TQUEUE_ARG data)
  {
  	struct net_device *dev = (struct net_device *)data;
  	struct ath_softc *sc = dev->priv;
@@ -313,7 +313,7 @@
  	netif_wake_queue(dev);
  
  	if (sc->sc_softled)
-@@ -8319,7 +8449,9 @@
+@@ -8319,7 +8449,9 @@ ath_tx_tasklet_q0123(TQUEUE_ARG data)
  {
  	struct net_device *dev = (struct net_device *)data;
  	struct ath_softc *sc = dev->priv;
@@ -323,7 +323,7 @@
  	/*
  	 * Process each active queue.
  	 */
-@@ -8340,6 +8472,16 @@
+@@ -8340,6 +8472,16 @@ ath_tx_tasklet_q0123(TQUEUE_ARG data)
  	if (sc->sc_uapsdq && txqactive(sc->sc_ah, sc->sc_uapsdq->axq_qnum))
  		ath_tx_processq(sc, sc->sc_uapsdq);
  
@@ -340,7 +340,7 @@
  	netif_wake_queue(dev);
  
  	if (sc->sc_softled)
-@@ -8355,13 +8497,25 @@
+@@ -8355,13 +8497,25 @@ ath_tx_tasklet(TQUEUE_ARG data)
  	struct net_device *dev = (struct net_device *)data;
  	struct ath_softc *sc = dev->priv;
  	unsigned int i;
@@ -366,7 +366,7 @@
  	netif_wake_queue(dev);
  
  	if (sc->sc_softled)
-@@ -10296,9 +10450,9 @@
+@@ -10296,9 +10450,9 @@ ath_change_mtu(struct net_device *dev, i
  	dev->mtu = mtu;
  	if ((dev->flags & IFF_RUNNING) && !sc->sc_invalid) {
  		/* NB: the rx buffers may need to be reallocated */
@@ -391,7 +391,7 @@
  /*
   * Deduce if tasklets are available.  If not then
   * fall back to using the immediate work queue.
-@@ -616,6 +620,9 @@
+@@ -616,6 +620,9 @@ struct ath_rp {
  struct ath_softc {
  	struct ieee80211com sc_ic;		/* NB: must be first */
  	struct net_device *sc_dev;
@@ -401,7 +401,7 @@
  	void __iomem *sc_iobase;		/* address of the device */
  	struct semaphore sc_lock;		/* dev-level lock */
  	struct net_device_stats	sc_devstats;	/* device statistics */
-@@ -730,7 +737,6 @@
+@@ -730,7 +737,6 @@ struct ath_softc {
  	struct ath_buf *sc_rxbufcur;		/* current rx buffer */
  	u_int32_t *sc_rxlink;			/* link ptr in last RX desc */
  	spinlock_t sc_rxbuflock;
@@ -409,7 +409,7 @@
  	struct ATH_TQ_STRUCT sc_rxorntq;	/* rxorn intr tasklet */
  	u_int8_t sc_defant;			/* current default antenna */
  	u_int8_t sc_rxotherant;			/* RXs on non-default antenna */
-@@ -745,6 +751,7 @@
+@@ -745,6 +751,7 @@ struct ath_softc {
  	u_int sc_txintrperiod;			/* tx interrupt batching */
  	struct ath_txq sc_txq[HAL_NUM_TX_QUEUES];
  	struct ath_txq *sc_ac2q[WME_NUM_AC];	/* WME AC -> h/w qnum */
@@ -417,7 +417,7 @@
  	struct ATH_TQ_STRUCT sc_txtq;		/* tx intr tasklet */
  	u_int8_t sc_grppoll_str[GRPPOLL_RATE_STR_LEN];
  	struct ath_descdma sc_bdma;		/* beacon descriptors */
-@@ -858,6 +865,8 @@
+@@ -858,6 +865,8 @@ typedef void (*ath_callback) (struct ath
  #define	ATH_TXBUF_LOCK_CHECK(_sc)
  #endif
  
@@ -428,7 +428,7 @@
  #define	ATH_RXBUF_LOCK_DESTROY(_sc)
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -1198,7 +1198,7 @@
+@@ -1198,7 +1198,7 @@ ieee80211_deliver_data(struct ieee80211_
  			/* attach vlan tag */
  			struct ieee80211_node *ni_tmp = SKB_CB(skb)->ni;
  			if (vlan_hwaccel_receive_skb(skb, vap->iv_vlgrp, ni->ni_vlan) == NET_RX_DROP) {
@@ -437,7 +437,7 @@
  				 * device was too busy */
  				if (ni_tmp != NULL) {
  					/* node reference was leaked */
-@@ -1209,8 +1209,8 @@
+@@ -1209,8 +1209,8 @@ ieee80211_deliver_data(struct ieee80211_
  			skb = NULL; /* SKB is no longer ours */
  		} else {
  			struct ieee80211_node *ni_tmp = SKB_CB(skb)->ni;
@@ -448,7 +448,7 @@
  				 * device was too busy */
  				if (ni_tmp != NULL) {
  					/* node reference was leaked */
-@@ -2322,8 +2322,8 @@
+@@ -2322,8 +2322,8 @@ forward_mgmt_to_app(struct ieee80211vap 
  		skb1->protocol = __constant_htons(0x0019);  /* ETH_P_80211_RAW */
  
  		ni_tmp = SKB_CB(skb1)->ni;
@@ -461,7 +461,7 @@
  				/* node reference was leaked */
 --- a/net80211/ieee80211_monitor.c
 +++ b/net80211/ieee80211_monitor.c
-@@ -584,8 +584,8 @@
+@@ -584,8 +584,8 @@ ieee80211_input_monitor(struct ieee80211
  			skb1->protocol = 
  				__constant_htons(0x0019); /* ETH_P_80211_RAW */
  
@@ -483,7 +483,7 @@
  #undef pskb_copy
  #undef skb_clone
  #undef skb_copy
-@@ -638,8 +638,8 @@
+@@ -638,8 +638,8 @@ int  vlan_hwaccel_receive_skb_debug(stru
  		grp, vlan_tag);
  }
  
@@ -494,7 +494,7 @@
  }
  
  struct sk_buff * alloc_skb_debug(unsigned int length, gfp_t gfp_mask,
-@@ -760,7 +760,7 @@
+@@ -760,7 +760,7 @@ struct sk_buff * skb_copy_expand_debug(c
  }
  
  EXPORT_SYMBOL(vlan_hwaccel_receive_skb_debug);
@@ -505,7 +505,7 @@
  EXPORT_SYMBOL(skb_clone_debug);
 --- a/net80211/ieee80211_skb.h
 +++ b/net80211/ieee80211_skb.h
-@@ -116,7 +116,7 @@
+@@ -116,7 +116,7 @@ int ieee80211_skb_references(void);
  int  vlan_hwaccel_receive_skb_debug(struct sk_buff *skb, 
  				    struct vlan_group *grp, unsigned short vlan_tag, 
  				    const char* func, int line);
@@ -514,7 +514,7 @@
  struct sk_buff * alloc_skb_debug(unsigned int length, gfp_t gfp_mask,
  				 const char *func, int line);
  struct sk_buff * dev_alloc_skb_debug(unsigned int length,
-@@ -151,7 +151,7 @@
+@@ -151,7 +151,7 @@ struct sk_buff * skb_copy_expand_debug(c
  #undef dev_queue_xmit
  #undef kfree_skb
  #undef kfree_skb_fast
@@ -523,7 +523,7 @@
  #undef pskb_copy
  #undef skb_clone
  #undef skb_copy
-@@ -168,8 +168,8 @@
+@@ -168,8 +168,8 @@ struct sk_buff * skb_copy_expand_debug(c
  	skb_copy_expand_debug(_skb, _newheadroom, _newtailroom, _gfp_mask, __func__, __LINE__)
  #define vlan_hwaccel_receive_skb(_skb, _grp, _tag) \
  	vlan_hwaccel_receive_skb_debug(_skb, _grp, _tag, __func__, __LINE__)
diff --git a/package/madwifi/patches/305-pureg_fix.patch b/package/madwifi/patches/305-pureg_fix.patch
index 8950547d83..231ab081a4 100644
--- a/package/madwifi/patches/305-pureg_fix.patch
+++ b/package/madwifi/patches/305-pureg_fix.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -4158,7 +4158,9 @@
+@@ -4158,7 +4158,9 @@ ath_calcrxfilter(struct ath_softc *sc)
  		rfilt |= HAL_RX_FILTER_PROM;
  	if (ic->ic_opmode == IEEE80211_M_STA ||
  	    sc->sc_opmode == HAL_M_IBSS ||	/* NB: AHDEMO too */
@@ -13,7 +13,7 @@
  		rfilt |= (HAL_RX_FILTER_CONTROL | HAL_RX_FILTER_BEACON |
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -346,11 +346,12 @@
+@@ -346,11 +346,12 @@ ieee80211_input(struct ieee80211vap * va
  				bssid = wh->i_addr3;
  			}
  			/*
@@ -29,7 +29,7 @@
  				/*
  				 * allow MGT frames to vap->iv_xrvap.
  				 * this will allow roaming between  XR and normal vaps
-@@ -366,18 +367,14 @@
+@@ -366,18 +367,14 @@ ieee80211_input(struct ieee80211vap * va
  					vap->iv_stats.is_rx_wrongbss++;
  					goto out;
  				}
@@ -49,7 +49,7 @@
  			break;
  		case IEEE80211_M_WDS:
  			if (skb->len < sizeof(struct ieee80211_frame_addr4)) {
-@@ -3066,7 +3063,7 @@
+@@ -3066,7 +3063,7 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  	u_int8_t *frm, *efrm;
  	u_int8_t *ssid, *rates, *xrates, *suppchan, *wpa, *rsn, *wme, *ath;
  	u_int8_t rate;
@@ -58,7 +58,7 @@
  	u_int8_t qosinfo;
  
  	if (ni_or_null == NULL)
-@@ -3096,11 +3093,15 @@
+@@ -3096,11 +3093,15 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  		 *    o station mode when associated (to collect state
  		 *      updates such as 802.11g slot time), or
  		 *    o adhoc mode (to discover neighbors)
@@ -75,7 +75,7 @@
  			vap->iv_stats.is_rx_mgtdiscard++;
  			return;
  		}
-@@ -3184,6 +3185,7 @@
+@@ -3184,6 +3185,7 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  					break;
  				}
  				scan.erp = frm[2];
@@ -83,7 +83,7 @@
  				break;
  			case IEEE80211_ELEMID_RSN:
  				scan.rsn = frm;
-@@ -3421,6 +3423,20 @@
+@@ -3421,6 +3423,20 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  				ieee80211_bg_scan(vap);
  			return;
  		}
@@ -106,7 +106,7 @@
  		 */
 --- a/net80211/ieee80211_node.c
 +++ b/net80211/ieee80211_node.c
-@@ -383,10 +383,16 @@
+@@ -383,10 +383,16 @@ ieee80211_create_ibss(struct ieee80211va
  	/* Update country ie information */
  	ieee80211_build_countryie(ic);
  
@@ -127,7 +127,7 @@
  }
 --- a/net80211/ieee80211_proto.c
 +++ b/net80211/ieee80211_proto.c
-@@ -595,6 +595,28 @@
+@@ -595,6 +595,28 @@ static const struct ieee80211_rateset ba
  	{ 4, { 2, 4, 11, 22 } },	/* IEEE80211_MODE_TURBO_G (mixed b/g) */
  };
  
@@ -158,7 +158,7 @@
   * specified mode.  For 11b compatibility we mark only 11b
 --- a/net80211/ieee80211_var.h
 +++ b/net80211/ieee80211_var.h
-@@ -708,6 +708,7 @@
+@@ -708,6 +708,7 @@ int ieee80211_media_setup(struct ieee802
  void ieee80211_build_sc_ie(struct ieee80211com *);
  void ieee80211_dfs_action(struct ieee80211com *);
  void ieee80211_expire_channel_excl_restrictions(struct ieee80211com *);
diff --git a/package/madwifi/patches/309-micfail_detect.patch b/package/madwifi/patches/309-micfail_detect.patch
index 80c1e731e7..19bea79bea 100644
--- a/package/madwifi/patches/309-micfail_detect.patch
+++ b/package/madwifi/patches/309-micfail_detect.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -6457,6 +6457,7 @@
+@@ -6457,6 +6457,7 @@ ath_rx_poll(struct net_device *dev, int 
  	int type;
  	u_int phyerr;
  	u_int processed = 0, early_stop = 0;
@@ -8,7 +8,7 @@
  
  	DPRINTF(sc, ATH_DEBUG_RX_PROC, "invoked\n");
  process_rx_again:
-@@ -6558,24 +6559,8 @@
+@@ -6558,24 +6559,8 @@ process_rx_again:
  			}
  			if (rs->rs_status & HAL_RXERR_MIC) {
  				sc->sc_stats.ast_rx_badmic++;
@@ -35,7 +35,7 @@
  			}
  			/*
  			 * Reject error frames if we have no vaps that
-@@ -6614,8 +6599,9 @@
+@@ -6614,8 +6599,9 @@ rx_accept:
  		/*
  		 * Finished monitor mode handling, now reject
  		 * error frames before passing to other vaps
@@ -46,7 +46,7 @@
  			ieee80211_dev_kfree_skb(&skb);
  			goto rx_next;
  		}
-@@ -6623,6 +6609,26 @@
+@@ -6623,6 +6609,26 @@ rx_accept:
  		/* remove the CRC */
  		skb_trim(skb, skb->len - IEEE80211_CRC_LEN);
  
@@ -73,7 +73,7 @@
  		/*
  		 * From this point on we assume the frame is at least
  		 * as large as ieee80211_frame_min; verify that.
-@@ -6635,6 +6641,7 @@
+@@ -6635,6 +6641,7 @@ rx_accept:
  			goto rx_next;
  		}
  
@@ -83,7 +83,7 @@
  		 */
 --- a/net80211/ieee80211_crypto_ccmp.c
 +++ b/net80211/ieee80211_crypto_ccmp.c
-@@ -73,7 +73,7 @@
+@@ -73,7 +73,7 @@ static int ccmp_setkey(struct ieee80211_
  static int ccmp_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  static int ccmp_decap(struct ieee80211_key *, struct sk_buff *, int);
  static int ccmp_enmic(struct ieee80211_key *, struct sk_buff *, int);
@@ -92,7 +92,7 @@
  
  static const struct ieee80211_cipher ccmp = {
  	.ic_name	= "AES-CCM",
-@@ -308,7 +308,7 @@
+@@ -308,7 +308,7 @@ ccmp_decap(struct ieee80211_key *k, stru
   * Verify and strip MIC from the frame.
   */
  static int
@@ -103,7 +103,7 @@
  }
 --- a/net80211/ieee80211_crypto.h
 +++ b/net80211/ieee80211_crypto.h
-@@ -145,7 +145,7 @@
+@@ -145,7 +145,7 @@ struct ieee80211_cipher {
  	int (*ic_encap)(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  	int (*ic_decap)(struct ieee80211_key *, struct sk_buff *, int);
  	int (*ic_enmic)(struct ieee80211_key *, struct sk_buff *, int);
@@ -112,7 +112,7 @@
  };
  extern const struct ieee80211_cipher ieee80211_cipher_none;
  
-@@ -163,10 +163,10 @@
+@@ -163,10 +163,10 @@ struct ieee80211_key *ieee80211_crypto_d
   */
  static __inline int
  ieee80211_crypto_demic(struct ieee80211vap *vap, struct ieee80211_key *k,
@@ -127,7 +127,7 @@
  /*
 --- a/net80211/ieee80211_crypto_none.c
 +++ b/net80211/ieee80211_crypto_none.c
-@@ -52,7 +52,7 @@
+@@ -52,7 +52,7 @@ static int none_setkey(struct ieee80211_
  static int none_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  static int none_decap(struct ieee80211_key *, struct sk_buff *, int);
  static int none_enmic(struct ieee80211_key *, struct sk_buff *, int);
@@ -136,7 +136,7 @@
  
  const struct ieee80211_cipher ieee80211_cipher_none = {
  	.ic_name	= "NONE",
-@@ -137,7 +137,7 @@
+@@ -137,7 +137,7 @@ none_enmic(struct ieee80211_key *k, stru
  }
  
  static int
@@ -147,7 +147,7 @@
  
 --- a/net80211/ieee80211_crypto_tkip.c
 +++ b/net80211/ieee80211_crypto_tkip.c
-@@ -57,7 +57,7 @@
+@@ -57,7 +57,7 @@ static int tkip_setkey(struct ieee80211_
  static int tkip_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  static int tkip_enmic(struct ieee80211_key *, struct sk_buff *, int);
  static int tkip_decap(struct ieee80211_key *, struct sk_buff *, int);
@@ -156,7 +156,7 @@
  
  static const struct ieee80211_cipher tkip  = {
  	.ic_name	= "TKIP",
-@@ -339,7 +339,7 @@
+@@ -339,7 +339,7 @@ tkip_decap(struct ieee80211_key *k, stru
   * Verify and strip MIC from the frame.
   */
  static int
@@ -165,7 +165,7 @@
  {
  	struct tkip_ctx *ctx = k->wk_private;
  	struct sk_buff *skb;
-@@ -355,7 +355,7 @@
+@@ -355,7 +355,7 @@ tkip_demic(struct ieee80211_key *k, stru
  	}
  	wh = (struct ieee80211_frame *) skb0->data;
  	/* NB: skb left pointing at last in chain */
@@ -176,7 +176,7 @@
  		u8 mic0[IEEE80211_WEP_MICLEN];
 --- a/net80211/ieee80211_crypto_wep.c
 +++ b/net80211/ieee80211_crypto_wep.c
-@@ -54,7 +54,7 @@
+@@ -54,7 +54,7 @@ static int wep_setkey(struct ieee80211_k
  static int wep_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  static int wep_decap(struct ieee80211_key *, struct sk_buff *, int);
  static int wep_enmic(struct ieee80211_key *, struct sk_buff *, int);
@@ -185,7 +185,7 @@
  
  static const struct ieee80211_cipher wep = {
  	.ic_name	= "WEP",
-@@ -244,7 +244,7 @@
+@@ -244,7 +244,7 @@ wep_decap(struct ieee80211_key *k, struc
   * Verify and strip MIC from the frame.
   */
  static int
@@ -196,7 +196,7 @@
  }
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -669,7 +669,7 @@
+@@ -669,7 +669,7 @@ ieee80211_input(struct ieee80211vap * va
  		 * Next strip any MSDU crypto bits.
  		 */
  		if (key != NULL &&
@@ -205,7 +205,7 @@
  			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  				ni->ni_macaddr, "data", "%s", "demic error");
  			IEEE80211_NODE_STAT(ni, rx_demicfail);
-@@ -4293,6 +4293,47 @@
+@@ -4293,6 +4293,47 @@ ath_eth_type_trans(struct sk_buff *skb, 
  }
  #endif
  
@@ -255,7 +255,7 @@
   * Debugging support.
 --- a/net80211/ieee80211_proto.h
 +++ b/net80211/ieee80211_proto.h
-@@ -90,6 +90,7 @@
+@@ -90,6 +90,7 @@ int ieee80211_iserp_rateset(struct ieee8
  void ieee80211_set11gbasicrates(struct ieee80211_rateset *, enum ieee80211_phymode);
  enum ieee80211_phymode ieee80211_get11gbasicrates(struct ieee80211_rateset *);
  void ieee80211_send_pspoll(struct ieee80211_node *);
@@ -265,7 +265,7 @@
   * Return the size of the 802.11 header for a management or data frame.
 --- a/net80211/ieee80211_linux.c
 +++ b/net80211/ieee80211_linux.c
-@@ -337,8 +337,8 @@
+@@ -337,8 +337,8 @@ ieee80211_notify_replay_failure(struct i
  	/* TODO: needed parameters: count, keyid, key type, src address, TSC */
  	snprintf(buf, sizeof(buf), "%s(keyid=%d %scast addr=" MAC_FMT ")", tag,
  		k->wk_keyix,
@@ -278,7 +278,7 @@
  	wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 --- a/net80211/ieee80211_output.c
 +++ b/net80211/ieee80211_output.c
-@@ -1074,13 +1074,16 @@
+@@ -1074,13 +1074,16 @@ ieee80211_encap(struct ieee80211_node *n
  			cip = (struct ieee80211_cipher *) key->wk_cipher;
  			ciphdrsize = cip->ic_header;
  			tailsize += (cip->ic_trailer + cip->ic_miclen);
@@ -300,7 +300,7 @@
  		 * Allocate sk_buff for each subsequent fragment; First fragment
 --- a/net80211/ieee80211_node.c
 +++ b/net80211/ieee80211_node.c
-@@ -2264,11 +2264,13 @@
+@@ -2264,11 +2264,13 @@ ieee80211_node_leave(struct ieee80211_no
  	/* From this point onwards we can no longer find the node,
  	 * so no more references are generated
  	 */
diff --git a/package/madwifi/patches/310-noise_get.patch b/package/madwifi/patches/310-noise_get.patch
index 63e8a4fecd..d8821583b3 100644
--- a/package/madwifi/patches/310-noise_get.patch
+++ b/package/madwifi/patches/310-noise_get.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -1699,8 +1699,6 @@
+@@ -1699,8 +1699,6 @@ ath_uapsd_processtriggers(struct ath_sof
  	 * get to reality.  This value is used in monitor mode and by tools like
  	 * Wireshark and Kismet.
  	 */
@@ -9,7 +9,7 @@
  	ATH_RXBUF_LOCK_IRQ(sc);
  	if (sc->sc_rxbufcur == NULL)
  		sc->sc_rxbufcur = STAILQ_FIRST(&sc->sc_rxbuf);
-@@ -8975,6 +8973,7 @@
+@@ -8975,6 +8973,7 @@ ath_calibrate(unsigned long arg)
  			sc->sc_curchan.channel);
  		sc->sc_stats.ast_per_calfail++;
  	}
@@ -17,7 +17,7 @@
  
  	ath_hal_process_noisefloor(ah);
  	if (isIQdone == AH_TRUE) {
-@@ -9043,6 +9042,7 @@
+@@ -9043,6 +9042,7 @@ ath_set_channel(struct ieee80211com *ic)
  	struct ath_softc *sc = dev->priv;
  
  	(void) ath_chan_set(sc, ic->ic_curchan);
@@ -25,7 +25,7 @@
  	/*
  	 * If we are returning to our bss channel then mark state
  	 * so the next recv'd beacon's TSF will be used to sync the
-@@ -9311,6 +9311,7 @@
+@@ -9311,6 +9311,7 @@ ath_newstate(struct ieee80211vap *vap, e
  		}
  
  		ath_hal_process_noisefloor(ah);
@@ -35,7 +35,7 @@
  		 */
 --- a/net80211/ieee80211_wireless.c
 +++ b/net80211/ieee80211_wireless.c
-@@ -4358,6 +4358,7 @@
+@@ -4358,6 +4358,7 @@ get_sta_info(void *arg, struct ieee80211
  	si->isi_state = ni->ni_flags;
  	si->isi_authmode = ni->ni_authmode;
  	si->isi_rssi = ic->ic_node_getrssi(ni);
@@ -45,7 +45,7 @@
  	si->isi_erp = ni->ni_erp;
 --- a/net80211/ieee80211_ioctl.h
 +++ b/net80211/ieee80211_ioctl.h
-@@ -311,6 +311,7 @@
+@@ -311,6 +311,7 @@ struct ieee80211req_sta_info {
  	u_int16_t isi_state;		/* state flags */
  	u_int8_t isi_authmode;		/* authentication algorithm */
  	u_int8_t isi_rssi;
diff --git a/package/madwifi/patches/311-bssid_alloc.patch b/package/madwifi/patches/311-bssid_alloc.patch
index 9d895d2b7f..8059b99e02 100644
--- a/package/madwifi/patches/311-bssid_alloc.patch
+++ b/package/madwifi/patches/311-bssid_alloc.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -1354,7 +1354,7 @@
+@@ -1354,7 +1354,7 @@ ath_vap_create(struct ieee80211com *ic, 
  		TAILQ_FOREACH(v, &ic->ic_vaps, iv_next)
  			id_mask |= (1 << ATH_GET_VAP_ID(v->iv_myaddr));
  
diff --git a/package/madwifi/patches/312-erpupdate.patch b/package/madwifi/patches/312-erpupdate.patch
index b4befba5cb..34fae68dbd 100644
--- a/package/madwifi/patches/312-erpupdate.patch
+++ b/package/madwifi/patches/312-erpupdate.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_beacon.c
 +++ b/net80211/ieee80211_beacon.c
-@@ -542,10 +542,10 @@
+@@ -542,10 +542,10 @@ ieee80211_beacon_update(struct ieee80211
  			vap->iv_flags &= ~IEEE80211_F_XRUPDATE;
  		}
  #endif
@@ -15,7 +15,7 @@
  	/* if it is a mode change beacon for dynamic turbo case */
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -3431,9 +3431,12 @@
+@@ -3431,9 +3431,12 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  			/* Assume no ERP IE == 11b AP */
  			if ((!has_erp || (has_erp && (scan.erp & IEEE80211_ERP_NON_ERP_PRESENT))) &&
  				!(ic->ic_flags & IEEE80211_F_USEPROT)) {
@@ -31,7 +31,7 @@
  
 --- a/net80211/ieee80211_node.c
 +++ b/net80211/ieee80211_node.c
-@@ -2025,8 +2025,12 @@
+@@ -2025,8 +2025,12 @@ ieee80211_node_join_11g(struct ieee80211
  		}
  
  		/* Update ERP element if this is first non ERP station */
@@ -46,7 +46,7 @@
  	} else
  		ni->ni_flags |= IEEE80211_NODE_ERP;
  }
-@@ -2229,6 +2233,8 @@
+@@ -2229,6 +2233,8 @@ ieee80211_node_leave_11g(struct ieee8021
  		IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
  			"non-ERP station leaves, count now %d", ic->ic_nonerpsta);
  		if (ic->ic_nonerpsta == 0) {
@@ -55,7 +55,7 @@
  			IEEE80211_DPRINTF(vap, IEEE80211_MSG_ASSOC,
  				"%s: disable use of protection\n", __func__);
  			ic->ic_flags &= ~IEEE80211_F_USEPROT;
-@@ -2240,7 +2246,9 @@
+@@ -2240,7 +2246,9 @@ ieee80211_node_leave_11g(struct ieee8021
  				ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
  				ic->ic_flags &= ~IEEE80211_F_USEBARKER;
  			}
diff --git a/package/madwifi/patches/317-bmask.patch b/package/madwifi/patches/317-bmask.patch
index 4402761cd8..3355dc7221 100644
--- a/package/madwifi/patches/317-bmask.patch
+++ b/package/madwifi/patches/317-bmask.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -8689,6 +8689,10 @@
+@@ -8689,6 +8689,10 @@ ath_startrecv(struct ath_softc *sc)
  
  	sc->sc_rxbufcur = NULL;
  
diff --git a/package/madwifi/patches/323-dfs_optional.patch b/package/madwifi/patches/323-dfs_optional.patch
index d1f3b6258e..2336d7484e 100644
--- a/package/madwifi/patches/323-dfs_optional.patch
+++ b/package/madwifi/patches/323-dfs_optional.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -1778,17 +1778,14 @@
+@@ -1778,17 +1778,14 @@ ath_uapsd_processtriggers(struct ath_sof
  			 * may have occurred in the intervening timeframe. */
  			bf->bf_channoise = ic->ic_channoise;
  
@@ -27,7 +27,7 @@
  			bus_dma_sync_single(sc->sc_bdev, bf->bf_skbaddr,
 --- a/ath/if_ath_radar.c
 +++ b/ath/if_ath_radar.c
-@@ -265,7 +265,7 @@
+@@ -265,7 +265,7 @@ int ath_radar_update(struct ath_softc *s
  		unsigned int new_rxfilt = old_rxfilt;
  
  		ath_hal_intrset(ah, old_ier & ~HAL_INT_GLOBAL);
diff --git a/package/madwifi/patches/324-alignment.patch b/package/madwifi/patches/324-alignment.patch
index 338373ec12..c01135f3e4 100644
--- a/package/madwifi/patches/324-alignment.patch
+++ b/package/madwifi/patches/324-alignment.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -1275,14 +1275,8 @@
+@@ -1275,14 +1275,8 @@ ieee80211_decap(struct ieee80211vap *vap
  		eh->ether_type = ether_type;
  
  	if (!ALIGNED_POINTER(skb->data + sizeof(*eh), u_int32_t)) {
diff --git a/package/madwifi/patches/325-channel_spam.patch b/package/madwifi/patches/325-channel_spam.patch
index ee06fe95c2..a4b9463a29 100644
--- a/package/madwifi/patches/325-channel_spam.patch
+++ b/package/madwifi/patches/325-channel_spam.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -9792,7 +9792,9 @@
+@@ -9792,7 +9792,9 @@ ath_getchannels(struct net_device *dev, 
  	/*
  	 * Convert HAL channels to ieee80211 ones.
  	 */
@@ -10,7 +10,7 @@
  	for (i = 0; i < nchan; i++) {
  		HAL_CHANNEL *c = &chans[i];
  		struct ieee80211_channel *ichan = &ic->ic_channels[i];
-@@ -9819,6 +9821,7 @@
+@@ -9819,6 +9821,7 @@ ath_getchannels(struct net_device *dev, 
  		ic->ic_chan_non_occupy[i].tv_sec  = 0;
  		ic->ic_chan_non_occupy[i].tv_usec = 0;
  
@@ -18,7 +18,7 @@
  		IPRINTF(sc, "Channel %3d (%4d MHz) Max Tx Power %d dBm%s "
  				"[%d hw %d reg] Flags%s%s%s%s%s%s%s%s%s%s%s%s%"
  				"s%s%s%s%s%s%s%s%s%s%s%s\n",
-@@ -9907,6 +9910,7 @@
+@@ -9907,6 +9910,7 @@ ath_getchannels(struct net_device *dev, 
  				(c->privFlags & 0x0080 ? 
  				 " PF & (1 << 7)" : "")
  				);
diff --git a/package/madwifi/patches/327-queue.patch b/package/madwifi/patches/327-queue.patch
index 71e5911e30..228aae3496 100644
--- a/package/madwifi/patches/327-queue.patch
+++ b/package/madwifi/patches/327-queue.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -8438,8 +8438,6 @@
+@@ -8438,8 +8438,6 @@ process_tx_again:
  	ath_hal_intrset(sc->sc_ah, sc->sc_imask);
  	local_irq_restore(flags);
  
@@ -9,7 +9,7 @@
  	if (sc->sc_softled)
  		ath_led_event(sc, ATH_LED_TX);
  }
-@@ -8486,8 +8484,6 @@
+@@ -8486,8 +8484,6 @@ process_tx_again:
  	ath_hal_intrset(sc->sc_ah, sc->sc_imask);
  	local_irq_restore(flags);
  
@@ -18,7 +18,7 @@
  	if (sc->sc_softled)
  		ath_led_event(sc, ATH_LED_TX);
  }
-@@ -8520,8 +8516,6 @@
+@@ -8520,8 +8516,6 @@ process_tx_again:
  	ath_hal_intrset(sc->sc_ah, sc->sc_imask);
  	local_irq_restore(flags);
  
@@ -29,7 +29,7 @@
  }
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -1132,7 +1132,7 @@
+@@ -1132,7 +1132,7 @@ ieee80211_deliver_data(struct ieee80211_
  	    (vap->iv_flags & IEEE80211_F_NOBRIDGE) == 0) {
  		struct sk_buff *skb1 = NULL;
  
diff --git a/package/madwifi/patches/330-beaconcal.patch b/package/madwifi/patches/330-beaconcal.patch
index 3504bc4e95..8556e0bb1d 100644
--- a/package/madwifi/patches/330-beaconcal.patch
+++ b/package/madwifi/patches/330-beaconcal.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -397,6 +397,7 @@
+@@ -397,6 +397,7 @@ static int countrycode = -1;
  static int maxvaps = -1;
  static int outdoor = -1;
  static int xchanmode = -1;
@@ -8,7 +8,7 @@
  
  static const char *hal_status_desc[] = {
  	"No error",
-@@ -422,6 +423,7 @@
+@@ -422,6 +423,7 @@ static struct notifier_block ath_event_b
  };
  
  #if (LINUX_VERSION_CODE < KERNEL_VERSION(2,5,52))
@@ -16,7 +16,7 @@
  MODULE_PARM(countrycode, "i");
  MODULE_PARM(maxvaps, "i");
  MODULE_PARM(outdoor, "i");
-@@ -434,6 +436,7 @@
+@@ -434,6 +436,7 @@ MODULE_PARM(autocreate, "s");
  MODULE_PARM(ratectl, "s");
  #else
  #include <linux/moduleparam.h>
@@ -24,7 +24,7 @@
  module_param(countrycode, int, 0600);
  module_param(maxvaps, int, 0600);
  module_param(outdoor, int, 0600);
-@@ -2600,7 +2603,8 @@
+@@ -2600,7 +2603,8 @@ ath_stop_locked(struct net_device *dev)
  		}
  		if (!sc->sc_invalid) {
  			del_timer_sync(&sc->sc_dfs_cac_timer);
@@ -34,7 +34,7 @@
  		}
  		ath_draintxq(sc);
  		if (!sc->sc_invalid) {
-@@ -2617,6 +2621,20 @@
+@@ -2617,6 +2621,20 @@ ath_stop_locked(struct net_device *dev)
  	return 0;
  }
  
@@ -55,7 +55,7 @@
  /*
   * Stop the device, grabbing the top-level lock to protect
   * against concurrent entry through ath_init (which can happen
-@@ -2742,6 +2760,12 @@
+@@ -2742,6 +2760,12 @@ ath_reset(struct net_device *dev)
  	HAL_STATUS status;
  
  	/*
@@ -68,7 +68,7 @@
  	 * Convert to a HAL channel description with the flags
  	 * constrained to reflect the current operating mode.
  	 */
-@@ -5154,6 +5178,8 @@
+@@ -5154,6 +5178,8 @@ ath_beacon_send(struct ath_softc *sc, in
  			"Invoking ath_hal_txstart with sc_bhalq: %d\n",
  			sc->sc_bhalq);
  		ath_hal_txstart(ah, sc->sc_bhalq);
@@ -77,7 +77,7 @@
  
  		sc->sc_stats.ast_be_xmit++;		/* XXX per-VAP? */
  	}
-@@ -5403,6 +5429,7 @@
+@@ -5403,6 +5429,7 @@ ath_beacon_config(struct ath_softc *sc, 
  		ath_hal_beacontimers(ah, &bs);
  		sc->sc_imask |= HAL_INT_BMISS;
  		ath_hal_intrset(ah, sc->sc_imask);
@@ -85,7 +85,7 @@
  	} else {
  		ath_hal_intrset(ah, 0);
  		if (reset_tsf)
-@@ -5414,8 +5441,11 @@
+@@ -5414,8 +5441,11 @@ ath_beacon_config(struct ath_softc *sc, 
  			 */
  			intval |= HAL_BEACON_ENA;
  			sc->sc_imask |= HAL_INT_SWBA;
@@ -98,7 +98,7 @@
  #ifdef ATH_SUPERG_DYNTURBO
  		ath_beacon_dturbo_config(vap, intval &
  				~(HAL_BEACON_RESET_TSF | HAL_BEACON_ENA));
-@@ -8879,6 +8909,9 @@
+@@ -8879,6 +8909,9 @@ ath_chan_set(struct ath_softc *sc, struc
  			/* Enter DFS wait period */
  			mod_timer(&sc->sc_dfs_cac_timer,
  				jiffies + (sc->sc_dfs_cac_period * HZ));
@@ -108,7 +108,7 @@
  		}
  		/*
  		 * re configure beacons when it is a turbo mode switch.
-@@ -8988,8 +9021,11 @@
+@@ -8988,8 +9021,11 @@ ath_calibrate(unsigned long arg)
  		sc->sc_curchan.channel, sc->sc_curchan.channelFlags,
  		isIQdone ? "done" : "not done");
  
@@ -122,7 +122,7 @@
  }
  
  static void
-@@ -9096,7 +9132,8 @@
+@@ -9096,7 +9132,8 @@ ath_newstate(struct ieee80211vap *vap, e
  		ieee80211_state_name[vap->iv_state],
  		ieee80211_state_name[nstate]);
  
@@ -132,7 +132,7 @@
  
  	ath_hal_setledstate(ah, leds[nstate]);	/* set LED */
  	netif_stop_queue(dev);			/* before we do anything else */
-@@ -9321,7 +9358,8 @@
+@@ -9321,7 +9358,8 @@ ath_newstate(struct ieee80211vap *vap, e
  				"VAP -> DFSWAIT_PENDING \n");
  			/* start calibration timer with a really small value 
  			 * 1/10 sec */
@@ -142,7 +142,7 @@
  			/* wake the receiver */
  			netif_wake_queue(dev);
  			/* don't do the other usual stuff... */
-@@ -9364,7 +9402,7 @@
+@@ -9364,7 +9402,7 @@ done:
  	error = avp->av_newstate(vap, nstate, arg);
  
  	/* Finally, start any timers. */
@@ -153,7 +153,7 @@
  	}
 --- a/ath/if_athvar.h
 +++ b/ath/if_athvar.h
-@@ -778,6 +778,8 @@
+@@ -778,6 +778,8 @@ struct ath_softc {
  	struct ieee80211vap **sc_bslot;		/* beacon xmit slots */
  	int sc_bnext;				/* next slot for beacon xmit */
  
diff --git a/package/madwifi/patches/331-memory_alloc.patch b/package/madwifi/patches/331-memory_alloc.patch
index 49a42e9ba3..6b01d79c0d 100644
--- a/package/madwifi/patches/331-memory_alloc.patch
+++ b/package/madwifi/patches/331-memory_alloc.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -3320,17 +3320,18 @@
+@@ -3320,17 +3320,18 @@ ath_hardstart(struct sk_buff *skb, struc
  	 * without affecting any other bridge ports. */
  	if (skb_cloned(skb)) {
  		/* Remember the original SKB so we can free up our references */
@@ -25,7 +25,7 @@
  	eh = (struct ether_header *)skb->data;
  
  #ifdef ATH_SUPERG_FF
-@@ -3601,6 +3602,8 @@
+@@ -3601,6 +3602,8 @@ ath_mgtstart(struct ieee80211com *ic, st
  	sc->sc_stats.ast_tx_mgmt++;
  	return 0;
  bad:
diff --git a/package/madwifi/patches/332-reset_beacons.patch b/package/madwifi/patches/332-reset_beacons.patch
index 81b10b59a9..283f7f4f29 100644
--- a/package/madwifi/patches/332-reset_beacons.patch
+++ b/package/madwifi/patches/332-reset_beacons.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -8920,7 +8920,7 @@
+@@ -8920,7 +8920,7 @@ ath_chan_set(struct ath_softc *sc, struc
  		 * re configure beacons when it is a turbo mode switch.
  		 * HW seems to turn off beacons during turbo mode switch.
  		 */
diff --git a/package/madwifi/patches/333-apscan_mode.patch b/package/madwifi/patches/333-apscan_mode.patch
index d8497a6d85..877eea6cef 100644
--- a/package/madwifi/patches/333-apscan_mode.patch
+++ b/package/madwifi/patches/333-apscan_mode.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_scan_ap.c
 +++ b/net80211/ieee80211_scan_ap.c
-@@ -783,12 +783,6 @@
+@@ -783,12 +783,6 @@ pick_channel(struct ieee80211_scan_state
  				/* break the loop as the subsequent chans won't be 
  				 * better */
  				break;
diff --git a/package/madwifi/patches/334-input.patch b/package/madwifi/patches/334-input.patch
index e96e6724a5..1e1b2760f3 100644
--- a/package/madwifi/patches/334-input.patch
+++ b/package/madwifi/patches/334-input.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -950,6 +950,9 @@
+@@ -950,6 +950,9 @@ ieee80211_input_all(struct ieee80211com 
  	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
  		struct sk_buff *skb1;
  
diff --git a/package/madwifi/patches/340-maxrate.patch b/package/madwifi/patches/340-maxrate.patch
index ecefd82a7f..50374a75c2 100644
--- a/package/madwifi/patches/340-maxrate.patch
+++ b/package/madwifi/patches/340-maxrate.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -1307,6 +1307,7 @@
+@@ -1307,6 +1307,7 @@ ath_vap_create(struct ieee80211com *ic, 
  	vap->iv_key_set = ath_key_set;
  	vap->iv_key_update_begin = ath_key_update_begin;
  	vap->iv_key_update_end = ath_key_update_end;
@@ -10,7 +10,7 @@
  		 * use those (only). */
 --- a/ath_rate/minstrel/minstrel.c
 +++ b/ath_rate/minstrel/minstrel.c
-@@ -622,8 +622,12 @@
+@@ -622,8 +622,12 @@ ath_rate_ctl_reset(struct ath_softc *sc,
  			return;
  		}
  		sn->static_rate_ndx = -1;
@@ -26,7 +26,7 @@
  			sn->rs_thisprob 	[x] = 0;
 --- a/ath_rate/sample/sample.c
 +++ b/ath_rate/sample/sample.c
-@@ -835,7 +835,12 @@
+@@ -835,7 +835,12 @@ ath_rate_ctl_reset(struct ath_softc *sc,
  	}
  	sn->static_rate_ndx = -1;
  
@@ -42,7 +42,7 @@
  		sn->rates[x].rix = sc->sc_rixmap[sn->rates[x].rate];
 --- a/net80211/ieee80211_ioctl.h
 +++ b/net80211/ieee80211_ioctl.h
-@@ -641,6 +641,7 @@
+@@ -641,6 +641,7 @@ enum {
  							   FCC requires 30m, so that is the default. */
  	IEEE80211_PARAM_BEACON_MISS_THRESH	= 73,	/* Beacon miss threshold (in beacons) */
  	IEEE80211_PARAM_BEACON_MISS_THRESH_MS	= 74,	/* Beacon miss threshold (in ms) */
@@ -52,7 +52,7 @@
  #define	SIOCG80211STATS			(SIOCDEVPRIVATE+2)
 --- a/net80211/ieee80211_var.h
 +++ b/net80211/ieee80211_var.h
-@@ -281,6 +281,7 @@
+@@ -281,6 +281,7 @@ struct ieee80211vap {
  	struct ieee80211_spy iv_spy;         		/* IWSPY support */
  	struct ieee80211_app_ie app_ie[IEEE80211_APPIE_NUM_OF_FRAME]; /* app-specified IEs by frame type */
  	u_int32_t app_filter;				/* filters which management frames are forwarded to app */
@@ -62,7 +62,7 @@
  /* Debug functions need the defintion of struct ieee80211vap because iv_debug 
 --- a/net80211/ieee80211_wireless.c
 +++ b/net80211/ieee80211_wireless.c
-@@ -2839,6 +2839,12 @@
+@@ -2839,6 +2839,12 @@ ieee80211_ioctl_setparam(struct net_devi
  		else
  			ic->ic_flags_ext &= ~IEEE80211_FEXT_MARKDFS;
  		break;
@@ -75,7 +75,7 @@
  #ifdef ATH_REVERSE_ENGINEERING
  	case IEEE80211_PARAM_DUMPREGS:
  		ieee80211_dump_registers(dev, info, w, extra);
-@@ -3174,6 +3180,9 @@
+@@ -3174,6 +3180,9 @@ ieee80211_ioctl_getparam(struct net_devi
  		else
  			param[0] = 0;
  		break;
@@ -85,7 +85,7 @@
  	default:
  		return -EOPNOTSUPP;
  	}
-@@ -5610,6 +5619,10 @@
+@@ -5610,6 +5619,10 @@ static const struct iw_priv_args ieee802
  	  0, IW_PRIV_TYPE_APPIEBUF, "getiebuf" },
  	{ IEEE80211_IOCTL_FILTERFRAME,
  	  IW_PRIV_TYPE_FILTER , 0, "setfilter" },
diff --git a/package/madwifi/patches/341-minrate.patch b/package/madwifi/patches/341-minrate.patch
index 1e75ddecf8..6f448afa60 100644
--- a/package/madwifi/patches/341-minrate.patch
+++ b/package/madwifi/patches/341-minrate.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -1308,6 +1308,7 @@
+@@ -1308,6 +1308,7 @@ ath_vap_create(struct ieee80211com *ic, 
  	vap->iv_key_update_begin = ath_key_update_begin;
  	vap->iv_key_update_end = ath_key_update_end;
  	vap->iv_maxrateindex = 0;
@@ -10,7 +10,7 @@
  		 * use those (only). */
 --- a/ath_rate/minstrel/minstrel.c
 +++ b/ath_rate/minstrel/minstrel.c
-@@ -638,9 +638,15 @@
+@@ -638,9 +638,15 @@ ath_rate_ctl_reset(struct ath_softc *sc,
  			sn->rs_succ_hist	[x] = 0;
  			sn->rs_att_hist 	[x] = 0;
  			sn->rs_this_tp 		[x] = 0;
@@ -27,7 +27,7 @@
  			if (sn->rates[x].rix == 0xff) {
  				DPRINTF(sc, "%s: %s ignore bogus rix at %d\n",
  					dev_info, __func__, x);
-@@ -649,7 +655,7 @@
+@@ -649,7 +655,7 @@ ath_rate_ctl_reset(struct ath_softc *sc,
  			sn->rates[x].rateCode = rt->info[sn->rates[x].rix].rateCode;
  			sn->rates[x].shortPreambleRateCode =
  				rt->info[sn->rates[x].rix].rateCode |
@@ -38,7 +38,7 @@
  		ath_fill_sample_table(sn);
 --- a/ath_rate/sample/sample.c
 +++ b/ath_rate/sample/sample.c
-@@ -842,8 +842,15 @@
+@@ -842,8 +842,15 @@ ath_rate_ctl_reset(struct ath_softc *sc,
  		sn->num_rates = vap->iv_maxrateindex;
  
  	for (x = 0; x < ni->ni_rates.rs_nrates; x++) {
@@ -58,7 +58,7 @@
  				dev_info, __func__, x);
 --- a/net80211/ieee80211_ioctl.h
 +++ b/net80211/ieee80211_ioctl.h
-@@ -642,6 +642,7 @@
+@@ -642,6 +642,7 @@ enum {
  	IEEE80211_PARAM_BEACON_MISS_THRESH	= 73,	/* Beacon miss threshold (in beacons) */
  	IEEE80211_PARAM_BEACON_MISS_THRESH_MS	= 74,	/* Beacon miss threshold (in ms) */
  	IEEE80211_PARAM_MAXRATE			= 75,	/* Maximum rate (by table index) */
@@ -68,7 +68,7 @@
  #define	SIOCG80211STATS			(SIOCDEVPRIVATE+2)
 --- a/net80211/ieee80211_var.h
 +++ b/net80211/ieee80211_var.h
-@@ -282,6 +282,7 @@
+@@ -282,6 +282,7 @@ struct ieee80211vap {
  	struct ieee80211_app_ie app_ie[IEEE80211_APPIE_NUM_OF_FRAME]; /* app-specified IEs by frame type */
  	u_int32_t app_filter;				/* filters which management frames are forwarded to app */
  	int iv_maxrateindex;
@@ -78,7 +78,7 @@
  /* Debug functions need the defintion of struct ieee80211vap because iv_debug 
 --- a/net80211/ieee80211_wireless.c
 +++ b/net80211/ieee80211_wireless.c
-@@ -2845,6 +2845,12 @@
+@@ -2845,6 +2845,12 @@ ieee80211_ioctl_setparam(struct net_devi
  		else
  			vap->iv_maxrateindex = 0;
  		break;
@@ -91,7 +91,7 @@
  #ifdef ATH_REVERSE_ENGINEERING
  	case IEEE80211_PARAM_DUMPREGS:
  		ieee80211_dump_registers(dev, info, w, extra);
-@@ -3183,6 +3189,9 @@
+@@ -3183,6 +3189,9 @@ ieee80211_ioctl_getparam(struct net_devi
  	case IEEE80211_PARAM_MAXRATE:
  		param[0] = vap->iv_maxrateindex;
  		break;
@@ -101,7 +101,7 @@
  	default:
  		return -EOPNOTSUPP;
  	}
-@@ -5623,6 +5632,10 @@
+@@ -5623,6 +5632,10 @@ static const struct iw_priv_args ieee802
  	 IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "maxrate"},
  	{IEEE80211_PARAM_MAXRATE,
  	 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_maxrate"},
diff --git a/package/madwifi/patches/342-performance.patch b/package/madwifi/patches/342-performance.patch
index 1fa1b856b6..8015643dcd 100644
--- a/package/madwifi/patches/342-performance.patch
+++ b/package/madwifi/patches/342-performance.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -3239,7 +3239,6 @@
+@@ -3239,7 +3239,6 @@ ath_hardstart(struct sk_buff *skb, struc
  	struct ath_softc *sc = dev->priv;
  	struct ieee80211_node *ni = NULL;
  	struct ath_buf *bf = NULL;
@@ -8,7 +8,7 @@
  	ath_bufhead bf_head;
  	struct ath_buf *tbf, *tempbf;
  	struct sk_buff *tskb;
-@@ -3251,6 +3250,7 @@
+@@ -3251,6 +3250,7 @@ ath_hardstart(struct sk_buff *skb, struc
  	*/
  	int requeue = 0;
  #ifdef ATH_SUPERG_FF
@@ -16,7 +16,7 @@
  	unsigned int pktlen;
  	struct ieee80211com *ic = &sc->sc_ic;
  	struct ath_node *an;
-@@ -3316,27 +3316,9 @@
+@@ -3316,27 +3316,9 @@ ath_hardstart(struct sk_buff *skb, struc
  		requeue = 1;
  		goto hardstart_fail;
  	}
@@ -46,7 +46,7 @@
  	ATH_TXQ_LOCK_IRQ(txq);
 --- a/net80211/ieee80211_output.c
 +++ b/net80211/ieee80211_output.c
-@@ -283,7 +283,7 @@
+@@ -283,7 +283,7 @@ ieee80211_hardstart(struct sk_buff *skb,
  	 * normal vap. */
  	if (vap->iv_xrvap && (ni == vap->iv_bss) &&
  	    vap->iv_xrvap->iv_sta_assoc) {
@@ -55,7 +55,7 @@
  		if (skb1) {
  			memset(SKB_CB(skb1), 0, sizeof(struct ieee80211_cb));
  #ifdef IEEE80211_DEBUG_REFCNT
-@@ -566,7 +566,7 @@
+@@ -566,7 +566,7 @@ ieee80211_skbhdr_adjust(struct ieee80211
  	struct ieee80211_key *key, struct sk_buff *skb, int ismulticast)
  {
  	/* XXX pre-calculate per node? */
@@ -64,7 +64,7 @@
  	int need_tailroom = 0;
  #ifdef ATH_SUPERG_FF
  	int isff = ATH_FF_MAGIC_PRESENT(skb);
-@@ -608,109 +608,56 @@
+@@ -608,109 +608,56 @@ ieee80211_skbhdr_adjust(struct ieee80211
  				need_tailroom += cip->ic_miclen;
  	}
  
@@ -214,7 +214,7 @@
  #define	KEY_UNDEFINED(k)	((k).wk_cipher == &ieee80211_cipher_none)
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -204,7 +204,6 @@
+@@ -204,7 +204,6 @@ ieee80211_input(struct ieee80211vap * va
  	struct ieee80211_frame *wh;
  	struct ieee80211_key *key;
  	struct ether_header *eh;
@@ -222,7 +222,7 @@
  #ifdef ATH_SUPERG_FF
  	struct llc *llc;
  #endif
-@@ -244,20 +243,6 @@
+@@ -244,20 +243,6 @@ ieee80211_input(struct ieee80211vap * va
  		vap->iv_stats.is_rx_tooshort++;
  		goto out;
  	}
@@ -243,7 +243,7 @@
  
  	/*
  	 * Bit of a cheat here, we use a pointer for a 3-address
-@@ -738,7 +723,7 @@
+@@ -738,7 +723,7 @@ ieee80211_input(struct ieee80211vap * va
  			/* ether_type must be length as FF frames are always LLC/SNAP encap'd */ 
  			frame_len = ntohs(eh_tmp->ether_type); 
  
@@ -252,7 +252,7 @@
  			if (skb1 == NULL)
  				goto err;
  			ieee80211_skb_copy_noderef(skb, skb1);
-@@ -1137,7 +1122,7 @@
+@@ -1137,7 +1122,7 @@ ieee80211_deliver_data(struct ieee80211_
  
  		if (ETHER_IS_MULTICAST(eh->ether_dhost) && !netif_queue_stopped(dev)) {
  			/* Create a SKB for the BSS to send out. */
diff --git a/package/madwifi/patches/343-txqueue_races.patch b/package/madwifi/patches/343-txqueue_races.patch
index a49f5376c2..4ae287e49d 100644
--- a/package/madwifi/patches/343-txqueue_races.patch
+++ b/package/madwifi/patches/343-txqueue_races.patch
@@ -2,7 +2,7 @@ Merged from madwifi trunk r3551, r3552
 
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -8251,6 +8251,17 @@
+@@ -8251,6 +8251,17 @@ ath_tx_processq(struct ath_softc *sc, st
  			goto bf_fail;
  		}
  
@@ -22,7 +22,7 @@ Merged from madwifi trunk r3551, r3552
  
 --- a/ath/if_athvar.h
 +++ b/ath/if_athvar.h
-@@ -586,7 +586,8 @@
+@@ -586,7 +586,8 @@ struct ath_vap {
  } while (0)
  #define ATH_TXQ_REMOVE_HEAD(_tq, _field) do { \
  	STAILQ_REMOVE_HEAD(&(_tq)->axq_q, _field); \
diff --git a/package/madwifi/patches/344-minstrel_failcnt.patch b/package/madwifi/patches/344-minstrel_failcnt.patch
index b17440be3a..ea92dc4d60 100644
--- a/package/madwifi/patches/344-minstrel_failcnt.patch
+++ b/package/madwifi/patches/344-minstrel_failcnt.patch
@@ -1,6 +1,6 @@
 --- a/ath_rate/minstrel/minstrel.c
 +++ b/ath_rate/minstrel/minstrel.c
-@@ -475,7 +475,7 @@
+@@ -475,7 +475,7 @@ ath_rate_tx_complete(struct ath_softc *s
  		/* 'tries' is the total number of times we have endeavoured to
  		 * send this packet, and is a sum of the #attempts at each
  		 * level in the multi-rate retry chain */
diff --git a/package/madwifi/patches/345-minstrel_sampling.patch b/package/madwifi/patches/345-minstrel_sampling.patch
index aa242d5974..cf278a496f 100644
--- a/package/madwifi/patches/345-minstrel_sampling.patch
+++ b/package/madwifi/patches/345-minstrel_sampling.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -8101,6 +8101,7 @@
+@@ -8101,6 +8101,7 @@ ath_tx_start(struct net_device *dev, str
  		ath_hal_setupxtxdesc(sc->sc_ah, ds, mrr.rate1, mrr.retries1,
  				     mrr.rate2, mrr.retries2,
  				     mrr.rate3, mrr.retries3);
@@ -10,7 +10,7 @@
  #ifndef ATH_SUPERG_FF
 --- a/ath/if_athvar.h
 +++ b/ath/if_athvar.h
-@@ -446,6 +446,7 @@
+@@ -446,6 +446,7 @@ struct ath_buf {
  	u_int16_t bf_flags;				/* tx descriptor flags */
  	u_int64_t bf_tsf;
  	int16_t bf_channoise;
@@ -20,7 +20,7 @@
  	 *      multiple segments.
 --- a/ath_rate/minstrel/minstrel.c
 +++ b/ath_rate/minstrel/minstrel.c
-@@ -333,15 +333,19 @@
+@@ -333,15 +333,19 @@ ath_rate_findrate(struct ath_softc *sc, 
  		if (sn->static_rate_ndx >= 0) {
  			    ndx = sn->static_rate_ndx;
  		} else {
@@ -41,7 +41,7 @@
  				}
  
  				/* Don't look for slowest rate (i.e. slowest
-@@ -398,11 +402,14 @@
+@@ -398,11 +402,14 @@ ath_rate_get_mrr(struct ath_softc *sc, s
  		if (sn->num_rates <= 0)
  			return;
  
@@ -58,7 +58,7 @@
  				rc1 = sn->max_tp_rate;
  		} else {
  			rc1 = sn->max_tp_rate2;
-@@ -525,6 +532,9 @@
+@@ -525,6 +532,9 @@ ath_rate_tx_complete(struct ath_softc *s
  		if (tries <= tries1)
  			return;
  
@@ -70,7 +70,7 @@
  		tries = tries - tries1;
 --- a/net80211/ieee80211_rate.h
 +++ b/net80211/ieee80211_rate.h
-@@ -87,6 +87,7 @@
+@@ -87,6 +87,7 @@ struct ieee80211_mrr {
  	int retries2;
  	int rate3;
  	int retries3;
diff --git a/package/madwifi/patches/346-protmode_trig.patch b/package/madwifi/patches/346-protmode_trig.patch
index 0abae5181c..1364c559b2 100644
--- a/package/madwifi/patches/346-protmode_trig.patch
+++ b/package/madwifi/patches/346-protmode_trig.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211.c
 +++ b/net80211/ieee80211.c
-@@ -333,7 +333,9 @@
+@@ -333,7 +333,9 @@ ieee80211_ifattach(struct ieee80211com *
  			IEEE80211_MS_TO_TU(IEEE80211_BMISSTHRESH_DEFAULT_MS), 
  			ic->ic_lintval), ic->ic_lintval);
  	}
@@ -13,7 +13,7 @@
  	TAILQ_INIT(&ic->ic_vaps);
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -3411,14 +3411,18 @@
+@@ -3411,14 +3411,18 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  			IEEE80211_IS_CHAN_ANYG(ic->ic_curchan)) {
  
  			/* Assume no ERP IE == 11b AP */
@@ -39,7 +39,7 @@
  
 --- a/net80211/ieee80211_ioctl.h
 +++ b/net80211/ieee80211_ioctl.h
-@@ -643,6 +643,8 @@
+@@ -643,6 +643,8 @@ enum {
  	IEEE80211_PARAM_BEACON_MISS_THRESH_MS	= 74,	/* Beacon miss threshold (in ms) */
  	IEEE80211_PARAM_MAXRATE			= 75,	/* Maximum rate (by table index) */
  	IEEE80211_PARAM_MINRATE			= 76,	/* Maximum rate (by table index) */
@@ -60,7 +60,7 @@
  #define IEEE80211_PWRCONSTRAINT_VAL(ic) \
  	(((ic)->ic_bsschan->ic_maxregpower > (ic)->ic_curchanmaxpwr) ? \
  	    (ic)->ic_bsschan->ic_maxregpower - (ic)->ic_curchanmaxpwr : 0)
-@@ -324,6 +327,9 @@
+@@ -324,6 +327,9 @@ struct ieee80211com {
  	u_int16_t ic_newtxpowlimit; 		/* tx power limit to change to (in 0.5 dBm) */
  	u_int16_t ic_uapsdmaxtriggers; 		/* max triggers that could arrive */
  	u_int8_t ic_coverageclass; 		/* coverage class */
@@ -72,7 +72,7 @@
  	 *
 --- a/net80211/ieee80211_wireless.c
 +++ b/net80211/ieee80211_wireless.c
-@@ -2312,6 +2312,12 @@
+@@ -2312,6 +2312,12 @@ ieee80211_ioctl_setparam(struct net_devi
  		    IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan))
  			retv = ENETRESET;
  		break;
@@ -85,7 +85,7 @@
  	case IEEE80211_PARAM_MCASTCIPHER:
  		if ((vap->iv_caps & cipher2cap(value)) == 0 &&
  		    !ieee80211_crypto_available(vap, value))
-@@ -2955,6 +2961,12 @@
+@@ -2955,6 +2961,12 @@ ieee80211_ioctl_getparam(struct net_devi
  	case IEEE80211_PARAM_PROTMODE:
  		param[0] = ic->ic_protmode;
  		break;
@@ -98,7 +98,7 @@
  	case IEEE80211_PARAM_MCASTCIPHER:
  		param[0] = rsn->rsn_mcastcipher;
  		break;
-@@ -5346,6 +5358,14 @@
+@@ -5346,6 +5358,14 @@ static const struct iw_priv_args ieee802
  	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "protmode" },
  	{ IEEE80211_PARAM_PROTMODE,
  	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_protmode" },
@@ -115,7 +115,7 @@
  	{ IEEE80211_PARAM_MCASTCIPHER,
 --- a/net80211/ieee80211_node.c
 +++ b/net80211/ieee80211_node.c
-@@ -1877,6 +1877,17 @@
+@@ -1877,6 +1877,17 @@ ieee80211_node_timeout(unsigned long arg
  
  	ieee80211_scan_timeout(ic);
  	ieee80211_timeout_stations(&ic->ic_sta);
diff --git a/package/madwifi/patches/347-tuning.patch b/package/madwifi/patches/347-tuning.patch
index efa3f6e14b..ca005e7d76 100644
--- a/package/madwifi/patches/347-tuning.patch
+++ b/package/madwifi/patches/347-tuning.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -10274,11 +10274,11 @@
+@@ -10274,11 +10274,11 @@ ath_setcurmode(struct ath_softc *sc, enu
  	sc->sc_currates = rt;
  	sc->sc_curmode = mode;
  	/*
@@ -17,7 +17,7 @@
  }
 --- a/ath/if_athvar.h
 +++ b/ath/if_athvar.h
-@@ -272,6 +272,10 @@
+@@ -272,6 +272,10 @@ static inline struct net_device *_alloc_
  #define AES_ICV_FIELD_SIZE      8       /* AES ICV field size */
  #define EXT_IV_FIELD_SIZE       4       /* ext IV field size */
  
@@ -30,7 +30,7 @@
  #define XR_DEFAULT_GRPPOLL_RATE_STR 	"0.25 1 1 3 3 6 6 20"
 --- a/ath_rate/minstrel/minstrel.c
 +++ b/ath_rate/minstrel/minstrel.c
-@@ -197,7 +197,7 @@
+@@ -197,7 +197,7 @@ calc_usecs_unicast_packet(struct ath_sof
  		unsigned int x = 0, tt = 0;
  		unsigned int cix = rt->info[rix].controlRate;
  		int rts = 0, cts = 0;
@@ -39,7 +39,7 @@
  
  		KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
  
-@@ -281,7 +281,7 @@
+@@ -281,7 +281,7 @@ calc_usecs_unicast_packet(struct ath_sof
  		tt += (long_retries + 1) * ath_hal_computetxtime(sc->sc_ah, rt, length,
  							rix, AH_TRUE);
  		for (x = 0; x <= short_retries + long_retries; x++) {
@@ -50,7 +50,7 @@
  		return tt;
 --- a/ath_rate/minstrel/minstrel.h
 +++ b/ath_rate/minstrel/minstrel.h
-@@ -180,14 +180,6 @@
+@@ -180,14 +180,6 @@ struct minstrel_node {
  #define MAX(a,b)        ((a) > (b) ? (a) : (b))
  #endif
  
@@ -67,7 +67,7 @@
   * a 5212 h/w descriptor. These Don't belong here; the
 --- a/ath_rate/sample/sample.c
 +++ b/ath_rate/sample/sample.c
-@@ -170,7 +170,7 @@
+@@ -170,7 +170,7 @@ calc_usecs_unicast_packet(struct ath_sof
  	struct ieee80211com *ic = &sc->sc_ic;
  	unsigned int tt = 0;
  	unsigned int x;
@@ -76,7 +76,7 @@
  	unsigned int cix = rt->info[rix].controlRate;
  	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
  
-@@ -254,7 +254,7 @@
+@@ -254,7 +254,7 @@ calc_usecs_unicast_packet(struct ath_sof
  	tt += (long_retries+1)*ath_hal_computetxtime(sc->sc_ah, rt, length,
  						rix, AH_TRUE);
  	for (x = 0; x <= short_retries + long_retries; x++) {
@@ -87,7 +87,7 @@
  	return tt;
 --- a/ath_rate/sample/sample.h
 +++ b/ath_rate/sample/sample.h
-@@ -106,9 +106,6 @@
+@@ -106,9 +106,6 @@ struct sample_node {
  #define MAX(a,b)        ((a) > (b) ? (a) : (b))
  #endif
  
diff --git a/package/madwifi/patches/348-ackcts.patch b/package/madwifi/patches/348-ackcts.patch
index 5dd23fefb5..957e8ad55f 100644
--- a/package/madwifi/patches/348-ackcts.patch
+++ b/package/madwifi/patches/348-ackcts.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -2723,6 +2723,9 @@
+@@ -2723,6 +2723,9 @@ ar_device(int devid)
  static int
  ath_set_ack_bitrate(struct ath_softc *sc, int high)
  {
@@ -10,7 +10,7 @@
  	if (ar_device(sc->devid) == 5212 || ar_device(sc->devid) == 5213) {
  		/* set ack to be sent at low bit-rate */
  		/* registers taken from the OpenBSD 5212 HAL */
-@@ -10789,8 +10792,13 @@
+@@ -10789,8 +10792,13 @@ ATH_SYSCTL_DECL(ath_sysctl_halparam, ctl
  				break;
  #endif
  			case ATH_ACKRATE:
@@ -28,7 +28,7 @@
  				ath_rp_record(sc,
 --- a/ath/if_athvar.h
 +++ b/ath/if_athvar.h
-@@ -681,6 +681,7 @@
+@@ -681,6 +681,7 @@ struct ath_softc {
  	unsigned int	sc_devstopped:1;	/* stopped due to of no tx bufs */
  	unsigned int	sc_stagbeacons:1;	/* use staggered beacons */
  	unsigned int	sc_dfswait:1;		/* waiting on channel for radar detect */
diff --git a/package/madwifi/patches/349-reset.patch b/package/madwifi/patches/349-reset.patch
index 8b74e021d0..599948de0b 100644
--- a/package/madwifi/patches/349-reset.patch
+++ b/package/madwifi/patches/349-reset.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -8862,8 +8862,7 @@
+@@ -8862,8 +8862,7 @@ ath_chan_set(struct ath_softc *sc, struc
  		 * needed to do the reset with chanchange = AH_FALSE in order
  		 * to receive traffic when peforming high velocity channel
  		 * changes. */
diff --git a/package/madwifi/patches/350-wisoc_softled.patch b/package/madwifi/patches/350-wisoc_softled.patch
index ca5ffdce4b..dae9f218df 100644
--- a/package/madwifi/patches/350-wisoc_softled.patch
+++ b/package/madwifi/patches/350-wisoc_softled.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath_ahb.c
 +++ b/ath/if_ath_ahb.c
-@@ -245,6 +245,8 @@
+@@ -245,6 +245,8 @@ init_ath_wmac(u_int16_t devid, u_int16_t
  	num_activesc++;
  	/* Ready to process interrupts */
  
diff --git a/package/madwifi/patches/351-scanlist.patch b/package/madwifi/patches/351-scanlist.patch
index 3765264968..67e757468b 100644
--- a/package/madwifi/patches/351-scanlist.patch
+++ b/package/madwifi/patches/351-scanlist.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_scan_sta.c
 +++ b/net80211/ieee80211_scan_sta.c
-@@ -317,147 +317,6 @@
+@@ -317,147 +317,6 @@ found:
  #undef ISPROBE
  }
  
@@ -148,7 +148,7 @@
  /*
   * Start a station-mode scan by populating the channel list.
   */
-@@ -466,81 +325,14 @@
+@@ -466,81 +325,14 @@ sta_start(struct ieee80211_scan_state *s
  {
  	struct ieee80211com *ic = vap->iv_ic;
  	struct sta_table *st = ss->ss_priv;
@@ -232,7 +232,7 @@
  	/* XXX tunables */
  	/* 
  	 * The scanner will stay on station for ss_maxdwell ms (using a 
-@@ -749,17 +541,7 @@
+@@ -749,17 +541,7 @@ match_bss(struct ieee80211vap *vap,
  	fail = 0;
  	if (isclr(ic->ic_chan_active, ieee80211_chan2ieee(ic, se->se_chan)))
  		fail |= 0x01;
@@ -251,7 +251,7 @@
  	if (vap->iv_opmode == IEEE80211_M_IBSS) {
  		if ((se->se_capinfo & IEEE80211_CAPINFO_IBSS) == 0)
  			fail |= 0x02;
-@@ -1168,78 +950,6 @@
+@@ -1168,78 +950,6 @@ static const struct ieee80211_scanner st
  	.scan_default		= ieee80211_sta_join,
  };
  
@@ -330,7 +330,7 @@
  
  /*
   * Select a channel to start an adhoc network on.
-@@ -1405,7 +1115,7 @@
+@@ -1405,7 +1115,7 @@ static const struct ieee80211_scanner ad
  	.scan_name		= "default",
  	.scan_attach		= sta_attach,
  	.scan_detach		= sta_detach,
@@ -341,7 +341,7 @@
  	.scan_end		= adhoc_pick_bss,
 --- a/net80211/ieee80211.c
 +++ b/net80211/ieee80211.c
-@@ -278,6 +278,11 @@
+@@ -278,6 +278,11 @@ ieee80211_ifattach(struct ieee80211com *
  			("channel with bogus ieee number %u", c->ic_ieee));
  		setbit(ic->ic_chan_avail, c->ic_ieee);
  
@@ -355,7 +355,7 @@
  			ic->ic_modecaps |= 1 << IEEE80211_MODE_11A;
 --- a/net80211/_ieee80211.h
 +++ b/net80211/_ieee80211.h
-@@ -132,6 +132,11 @@
+@@ -132,6 +132,11 @@ enum ieee80211_scanmode {
  	IEEE80211_SCAN_FIRST	= 2,	/* take first suitable candidate */
  };
  
@@ -367,7 +367,7 @@
  /*
   * Channels are specified by frequency and attributes.
   */
-@@ -142,6 +147,7 @@
+@@ -142,6 +147,7 @@ struct ieee80211_channel {
  	int8_t ic_maxregpower;	/* maximum regulatory tx power in dBm */
  	int8_t ic_maxpower;	/* maximum tx power in dBm */
  	int8_t ic_minpower;	/* minimum tx power in dBm */
@@ -377,7 +377,7 @@
  #define	IEEE80211_CHAN_MAX	255
 --- a/net80211/ieee80211_ioctl.h
 +++ b/net80211/ieee80211_ioctl.h
-@@ -555,6 +555,7 @@
+@@ -555,6 +555,7 @@ struct ieee80211req_scan_result {
  #define	IEEE80211_IOCTL_WDSADDMAC	(SIOCIWFIRSTPRIV+26)
  #define	IEEE80211_IOCTL_WDSDELMAC	(SIOCIWFIRSTPRIV+28)
  #define	IEEE80211_IOCTL_KICKMAC		(SIOCIWFIRSTPRIV+30)
@@ -387,7 +387,7 @@
  	IEEE80211_WMMPARAMS_CWMIN       = 1,
 --- a/net80211/ieee80211_scan_ap.c
 +++ b/net80211/ieee80211_scan_ap.c
-@@ -129,131 +129,7 @@
+@@ -129,131 +129,7 @@ struct ap_state {
  
  static int ap_flush(struct ieee80211_scan_state *);
  static void action_tasklet(IEEE80211_TQUEUE_ARG);
@@ -519,7 +519,7 @@
  
  /*
   * Attach prior to any scanning work.
-@@ -327,29 +203,6 @@
+@@ -327,29 +203,6 @@ saveie(u_int8_t **iep, const u_int8_t *i
  		ieee80211_saveie(iep, ie);
  }
  
@@ -549,7 +549,7 @@
  /*
   * Start an ap scan by populating the channel list.
   */
-@@ -358,8 +211,6 @@
+@@ -358,8 +211,6 @@ ap_start(struct ieee80211_scan_state *ss
  {
  	struct ap_state *as 	    = ss->ss_priv;
  	struct ieee80211com *ic     = NULL;
@@ -558,7 +558,7 @@
  	int i;
  	unsigned int mode = 0;
  
-@@ -368,80 +219,8 @@
+@@ -368,80 +219,8 @@ ap_start(struct ieee80211_scan_state *ss
  	/* Determine mode flags to match, or leave zero for auto mode */
  	as->as_vap_desired_mode = vap->iv_des_mode;
  	as->as_required_mode    = 0;
@@ -640,7 +640,7 @@
  	ss->ss_next = 0;
  	/* XXX tunables */
  	ss->ss_mindwell = msecs_to_jiffies(200);	/* 200ms */
-@@ -761,13 +540,6 @@
+@@ -761,13 +540,6 @@ pick_channel(struct ieee80211_scan_state
  		if (IEEE80211_IS_CHAN_RADAR(c->chan))
  			continue;
  
@@ -656,7 +656,7 @@
  				as->as_required_mode)
 --- a/net80211/ieee80211_scan.c
 +++ b/net80211/ieee80211_scan.c
-@@ -958,6 +958,80 @@
+@@ -958,6 +958,80 @@ ieee80211_scan_flush(struct ieee80211com
  	}
  }
  
@@ -739,7 +739,7 @@
   * signal is detected.  AP mode only.  Return 1 on success, 0 on
 --- a/net80211/ieee80211_scan.h
 +++ b/net80211/ieee80211_scan.h
-@@ -219,4 +219,7 @@
+@@ -219,4 +219,7 @@ void ieee80211_scanner_register(enum iee
  void ieee80211_scanner_unregister(enum ieee80211_opmode,
  	const struct ieee80211_scanner *);
  void ieee80211_scanner_unregister_all(const struct ieee80211_scanner *);
@@ -749,7 +749,7 @@
  #endif /* _NET80211_IEEE80211_SCAN_H_ */
 --- a/net80211/ieee80211_wireless.c
 +++ b/net80211/ieee80211_wireless.c
-@@ -3873,6 +3873,106 @@
+@@ -3873,6 +3873,106 @@ ieee80211_ioctl_kickmac(struct net_devic
  	return ieee80211_ioctl_setmlme(dev, info, w, (char *)&mlme);
  }
  
@@ -856,7 +856,7 @@
  static int
  ieee80211_ioctl_addmac(struct net_device *dev, struct iw_request_info *info,
  	void *w, char *extra)
-@@ -5656,6 +5756,8 @@
+@@ -5656,6 +5756,8 @@ static const struct iw_priv_args ieee802
  	 IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "minrate"},
  	{IEEE80211_PARAM_MINRATE,
  	 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_minrate"},
@@ -865,7 +865,7 @@
  
  #ifdef ATH_REVERSE_ENGINEERING
  	/*
-@@ -5753,6 +5855,7 @@
+@@ -5753,6 +5855,7 @@ static const iw_handler ieee80211_priv_h
  	set_priv(IEEE80211_IOCTL_WDSADDMAC, ieee80211_ioctl_wdsmac),
  	set_priv(IEEE80211_IOCTL_WDSDELMAC, ieee80211_ioctl_wdsdelmac),
  	set_priv(IEEE80211_IOCTL_KICKMAC, ieee80211_ioctl_kickmac),
diff --git a/package/madwifi/patches/352-ani_fix.patch b/package/madwifi/patches/352-ani_fix.patch
index 981005fc9b..af00f5e850 100644
--- a/package/madwifi/patches/352-ani_fix.patch
+++ b/package/madwifi/patches/352-ani_fix.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -1014,9 +1014,7 @@
+@@ -1014,9 +1014,7 @@ ath_attach(u_int16_t devid, struct net_d
  	 */
  	sc->sc_hasveol = ath_hal_hasveol(ah);
  
@@ -11,7 +11,7 @@
  	sc->sc_hasintmit = ath_hal_hasintmit(ah);
  
  	/* get mac address from hardware */
-@@ -1144,6 +1142,11 @@
+@@ -1144,6 +1142,11 @@ ath_attach(u_int16_t devid, struct net_d
  	sc->sc_rp_lasttsf	= 0;
  	sc->sc_last_tsf		= 0;
  
@@ -23,7 +23,7 @@
  	return 0;
  bad3:
  	ieee80211_ifdetach(ic);
-@@ -2428,6 +2431,43 @@
+@@ -2428,6 +2431,43 @@ ath_chan2flags(struct ieee80211_channel 
  	return flags;
  }
  
@@ -67,7 +67,7 @@
  /*
   * Context: process context
   */
-@@ -2493,8 +2533,7 @@
+@@ -2493,8 +2533,7 @@ ath_init(struct net_device *dev)
  	if (sc->sc_softled)
  		ath_hal_gpioCfgOutput(ah, sc->sc_ledpin);
  
@@ -77,7 +77,7 @@
  
  	/*
  	 * This is needed only to setup initial state
-@@ -2530,7 +2569,7 @@
+@@ -2530,7 +2569,7 @@ ath_init(struct net_device *dev)
  	 * Enable MIB interrupts when there are hardware phy counters.
  	 * Note we only do this (at the moment) for station mode.
  	 */
@@ -86,7 +86,7 @@
  		sc->sc_imask |= HAL_INT_MIB;
  	ath_hal_intrset(ah, sc->sc_imask);
  
-@@ -2787,9 +2826,7 @@
+@@ -2787,9 +2826,7 @@ ath_reset(struct net_device *dev)
  		EPRINTF(sc, "Unable to reset hardware: '%s' (HAL status %u)\n",
  			ath_get_hal_status_desc(status), status);
  
@@ -97,7 +97,7 @@
  	ath_update_txpow(sc);		/* update tx power state */
  	ath_radar_update(sc);
  	ath_setdefantenna(sc, sc->sc_defant);
-@@ -4174,6 +4211,8 @@
+@@ -4174,6 +4211,8 @@ ath_calcrxfilter(struct ath_softc *sc)
  	if (sc->sc_nmonvaps > 0)
  		rfilt |= (HAL_RX_FILTER_CONTROL | HAL_RX_FILTER_BEACON |
  			  HAL_RX_FILTER_PROBEREQ | HAL_RX_FILTER_PROM);
@@ -106,7 +106,7 @@
  	if (sc->sc_curchan.privFlags & CHANNEL_DFS)
  		rfilt |= (HAL_RX_FILTER_PHYERR | HAL_RX_FILTER_PHYRADAR);
  	return rfilt;
-@@ -6524,9 +6563,6 @@
+@@ -6524,9 +6563,6 @@ process_rx_again:
  			rs->rs_rssi = 0;
  
  		len = rs->rs_datalen;
@@ -116,7 +116,7 @@
  
  		if (rs->rs_more) {
  			/*
-@@ -8874,9 +8910,7 @@
+@@ -8874,9 +8910,7 @@ ath_chan_set(struct ath_softc *sc, struc
  		if (sc->sc_softled)
  			ath_hal_gpioCfgOutput(ah, sc->sc_ledpin);
  
@@ -127,7 +127,7 @@
  		sc->sc_curchan = hchan;
  		ath_update_txpow(sc);		/* update tx power state */
  		ath_radar_update(sc);
-@@ -10653,9 +10687,54 @@
+@@ -10653,9 +10687,54 @@ enum {
  	ATH_RP_IGNORED 		= 24,
  	ATH_RADAR_IGNORED       = 25,
  	ATH_MAXVAPS  		= 26,
@@ -182,7 +182,7 @@
  ATH_SYSCTL_DECL(ath_sysctl_halparam, ctl, write, filp, buffer, lenp, ppos)
  {
  	struct ath_softc *sc = ctl->extra1;
-@@ -10841,6 +10920,11 @@
+@@ -10841,6 +10920,11 @@ ATH_SYSCTL_DECL(ath_sysctl_halparam, ctl
  			case ATH_RADAR_IGNORED:
  				sc->sc_radar_ignored = val;
  				break;
@@ -194,7 +194,7 @@
  			default:
  				ret = -EINVAL;
  				break;
-@@ -10907,6 +10991,11 @@
+@@ -10907,6 +10991,11 @@ ATH_SYSCTL_DECL(ath_sysctl_halparam, ctl
  		case ATH_RADAR_IGNORED:
  			val = sc->sc_radar_ignored;
  			break;
@@ -206,7 +206,7 @@
  		default:
  			ret = -EINVAL;
  			break;
-@@ -11084,6 +11173,24 @@
+@@ -11084,6 +11173,24 @@ static const ctl_table ath_sysctl_templa
  	  .proc_handler = ath_sysctl_halparam,
  	  .extra2	= (void *)ATH_RADAR_IGNORED,
  	},
@@ -233,7 +233,7 @@
  
 --- a/ath/if_athvar.h
 +++ b/ath/if_athvar.h
-@@ -693,6 +693,10 @@
+@@ -693,6 +693,10 @@ struct ath_softc {
  	unsigned int sc_txcont_power; /* Continuous transmit power in 0.5dBm units */
  	unsigned int sc_txcont_rate;  /* Continuous transmit rate in Mbps */
  
@@ -246,7 +246,7 @@
  	const HAL_RATE_TABLE *sc_currates;	/* current rate table */
 --- a/ath/if_ath_hal.h
 +++ b/ath/if_ath_hal.h
-@@ -67,14 +67,14 @@
+@@ -67,14 +67,14 @@ static inline HAL_POWER_MODE ath_hal_get
  
  static inline HAL_BOOL ath_hal_getdiagstate(struct ath_hal *ah, int request,
  					    const void *args, u_int32_t argsize,
diff --git a/package/madwifi/patches/353-devid.patch b/package/madwifi/patches/353-devid.patch
index 281e348f83..bcc214b8fd 100644
--- a/package/madwifi/patches/353-devid.patch
+++ b/package/madwifi/patches/353-devid.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath_pci.c
 +++ b/ath/if_ath_pci.c
-@@ -114,11 +114,13 @@
+@@ -114,11 +114,13 @@ static struct pci_device_id ath_pci_id_t
  	{ 0x168c, 0x0023, PCI_ANY_ID, PCI_ANY_ID },
  	{ 0x168c, 0x0024, PCI_ANY_ID, PCI_ANY_ID },
  	{ 0x168c, 0x9013, PCI_ANY_ID, PCI_ANY_ID }, /* sonicwall */
diff --git a/package/madwifi/patches/354-ifxmips_eeprom.patch b/package/madwifi/patches/354-ifxmips_eeprom.patch
index e96bf86547..635857ac24 100644
--- a/package/madwifi/patches/354-ifxmips_eeprom.patch
+++ b/package/madwifi/patches/354-ifxmips_eeprom.patch
@@ -1,6 +1,6 @@
 --- a/ath_hal/ah_os.c
 +++ b/ath_hal/ah_os.c
-@@ -343,6 +343,46 @@
+@@ -343,6 +343,46 @@ EXPORT_SYMBOL(ath_hal_func);
   * NB: see the comments in ah_osdep.h about byte-swapping register
   *     reads and writes to understand what's going on below.
   */
@@ -47,7 +47,7 @@
  void __ahdecl
  ath_hal_reg_write(struct ath_hal *ah, u_int reg, u_int32_t val)
  {
-@@ -351,20 +391,33 @@
+@@ -351,20 +391,33 @@ ath_hal_reg_write(struct ath_hal *ah, u_
  		ath_hal_printf(ah, "%s: WRITE 0x%x <= 0x%x\n", 
  				(ath_hal_func ?: "unknown"), reg, val);
  #endif
@@ -85,7 +85,7 @@
  				(ath_hal_func ?: "unknown"), reg, val);
  #endif
  	return val;
-@@ -581,7 +634,9 @@
+@@ -581,7 +634,9 @@ init_ath_hal(void)
  {
  	const char *sep;
  	int i;
diff --git a/package/madwifi/patches/355-eap_auth_disassoc.patch b/package/madwifi/patches/355-eap_auth_disassoc.patch
index a3d8de4f55..23cde7bcda 100644
--- a/package/madwifi/patches/355-eap_auth_disassoc.patch
+++ b/package/madwifi/patches/355-eap_auth_disassoc.patch
@@ -5,7 +5,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -8332,6 +8332,14 @@
+@@ -8332,6 +8332,14 @@ ath_tx_processq(struct ath_softc *sc, st
  #endif
  				if (ts->ts_status & HAL_TXERR_XRETRY) {
  					sc->sc_stats.ast_tx_xretries++;
@@ -22,7 +22,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  						DPRINTF(sc, ATH_DEBUG_UAPSD,
 --- a/net80211/ieee80211_linux.c
 +++ b/net80211/ieee80211_linux.c
-@@ -156,6 +156,7 @@
+@@ -156,6 +156,7 @@ ieee80211_getmgtframe(u_int8_t **frm, u_
  		if (off != 0)
  			skb_reserve(skb, align - off);
  
@@ -32,7 +32,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		SKB_CB(skb)->next = NULL;
 --- a/net80211/ieee80211_linux.h
 +++ b/net80211/ieee80211_linux.h
-@@ -393,6 +393,7 @@
+@@ -393,6 +393,7 @@ typedef spinlock_t acl_lock_t;
  	void		(*next_destructor)(struct sk_buff *skb);
  #endif
  	struct sk_buff *next;			/* fast frame sk_buf chain */
@@ -42,7 +42,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  
 --- a/net80211/ieee80211_output.c
 +++ b/net80211/ieee80211_output.c
-@@ -778,6 +778,8 @@
+@@ -778,6 +778,8 @@ ieee80211_encap(struct ieee80211_node *n
  	else
  		hdrsize = sizeof(struct ieee80211_frame);
  
@@ -51,7 +51,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	switch (vap->iv_opmode) {
  	case IEEE80211_M_IBSS:
  	case IEEE80211_M_AHDEMO:
-@@ -1622,6 +1624,7 @@
+@@ -1622,6 +1624,7 @@ ieee80211_add_xr_param(u_int8_t *frm, st
  	ie->param_len = frm - &ie->param_oui[0];
  	return frm;
  }
@@ -59,7 +59,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  #endif
  /*
   * Send a probe request frame with the specified ssid
-@@ -1886,6 +1889,7 @@
+@@ -1886,6 +1889,7 @@ ieee80211_send_mgmt(struct ieee80211_nod
  				sizeof(u_int16_t)+IEEE80211_CHALLENGE_LEN : 0));
  		if (skb == NULL)
  			senderr(ENOMEM, is_tx_nobuf);
@@ -67,7 +67,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  
  		((__le16 *)frm)[0] =
  			(is_shared_key) ? htole16(IEEE80211_AUTH_ALG_SHARED)
-@@ -1960,6 +1964,7 @@
+@@ -1960,6 +1964,7 @@ ieee80211_send_mgmt(struct ieee80211_nod
  			vap->app_ie[IEEE80211_APPIE_FRAME_ASSOC_REQ].length);
  		if (skb == NULL)
  			senderr(ENOMEM, is_tx_nobuf);
diff --git a/package/madwifi/patches/356-hidden_ssid.patch b/package/madwifi/patches/356-hidden_ssid.patch
index f8b895caca..b87569e762 100644
--- a/package/madwifi/patches/356-hidden_ssid.patch
+++ b/package/madwifi/patches/356-hidden_ssid.patch
@@ -5,7 +5,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 
 --- a/net80211/ieee80211_scan_sta.c
 +++ b/net80211/ieee80211_scan_sta.c
-@@ -209,6 +209,19 @@
+@@ -209,6 +209,19 @@ saveie(u_int8_t **iep, const u_int8_t *i
  		ieee80211_saveie(iep, ie);
  }
  
@@ -25,7 +25,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  /*
   * Process a beacon or probe response frame; create an
   * entry in the scan cache or update any previous entry.
-@@ -233,8 +246,8 @@
+@@ -233,8 +246,8 @@ sta_add(struct ieee80211_scan_state *ss,
  	SCAN_STA_LOCK_IRQ(st);
  	LIST_FOREACH(se, &st->st_hash[hash], se_hash)
  		if (IEEE80211_ADDR_EQ(se->base.se_macaddr, macaddr) &&
@@ -36,7 +36,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  			goto found;
  
  	MALLOC(se, struct sta_entry *, sizeof(struct sta_entry),
-@@ -252,8 +265,8 @@
+@@ -252,8 +265,8 @@ found:
  	ise = &se->base;
  
  	/* XXX ap beaconing multiple ssid w/ same bssid */
diff --git a/package/madwifi/patches/357-bgscan_thresh.patch b/package/madwifi/patches/357-bgscan_thresh.patch
index 9255768f67..c9d60ea856 100644
--- a/package/madwifi/patches/357-bgscan_thresh.patch
+++ b/package/madwifi/patches/357-bgscan_thresh.patch
@@ -6,7 +6,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 
 --- a/net80211/ieee80211_ioctl.h
 +++ b/net80211/ieee80211_ioctl.h
-@@ -646,6 +646,7 @@
+@@ -646,6 +646,7 @@ enum {
  	IEEE80211_PARAM_MINRATE			= 76,	/* Maximum rate (by table index) */
  	IEEE80211_PARAM_PROTMODE_RSSI		= 77,	/* RSSI Threshold for enabling protection mode */
  	IEEE80211_PARAM_PROTMODE_TIMEOUT	= 78,	/* Timeout for expiring protection mode */
@@ -25,7 +25,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  #define IEEE80211_COVERAGE_CLASS_MAX	31	/* max coverage class */
  #define IEEE80211_REGCLASSIDS_MAX	10	/* max regclass id list */
  
-@@ -219,6 +221,10 @@
+@@ -219,6 +221,10 @@ struct ieee80211vap {
  	u_int8_t iv_nickname[IEEE80211_NWID_LEN];
  	u_int iv_bgscanidle;				/* bg scan idle threshold */
  	u_int iv_bgscanintvl;				/* bg scan min interval */
@@ -36,7 +36,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	u_int iv_scanvalid;				/* scan cache valid threshold */
  	struct ieee80211_roam iv_roam;			/* sta-mode roaming state */
  
-@@ -608,6 +614,7 @@
+@@ -608,6 +614,7 @@ MALLOC_DECLARE(M_80211_VAP);
  #define IEEE80211_FEXT_SWBMISS		0x00000400	/* CONF: use software beacon timer */
  #define IEEE80211_FEXT_DROPUNENC_EAPOL	0x00000800	/* CONF: drop unencrypted eapol frames */
  #define IEEE80211_FEXT_APPIE_UPDATE	0x00001000	/* STATE: beacon APP IE updated */
@@ -46,7 +46,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  #define IEEE80211_COM_UAPSD_DISABLE(_ic)	((_ic)->ic_flags_ext &= ~IEEE80211_FEXT_UAPSD)
 --- a/net80211/ieee80211_wireless.c
 +++ b/net80211/ieee80211_wireless.c
-@@ -2744,6 +2744,9 @@
+@@ -2744,6 +2744,9 @@ ieee80211_ioctl_setparam(struct net_devi
  		else
  			retv = EINVAL;
  		break;
@@ -56,7 +56,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	case IEEE80211_PARAM_MCAST_RATE:
  		/* units are in KILObits per second */
  		if (value >= 256 && value <= 54000)
-@@ -3144,6 +3147,9 @@
+@@ -3144,6 +3147,9 @@ ieee80211_ioctl_getparam(struct net_devi
  	case IEEE80211_PARAM_BGSCAN_INTERVAL:
  		param[0] = vap->iv_bgscanintvl / HZ;	/* seconds */
  		break;
@@ -66,7 +66,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	case IEEE80211_PARAM_MCAST_RATE:
  		param[0] = vap->iv_mcast_rate;	/* seconds */
  		break;
-@@ -5666,6 +5672,10 @@
+@@ -5666,6 +5672,10 @@ static const struct iw_priv_args ieee802
  	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "bgscanintvl" },
  	{ IEEE80211_PARAM_BGSCAN_INTERVAL,
  	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_bgscanintvl" },
@@ -79,7 +79,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	{ IEEE80211_PARAM_MCAST_RATE,
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -3013,8 +3013,10 @@
+@@ -3013,8 +3013,10 @@ contbgscan(struct ieee80211vap *vap)
  {
  	struct ieee80211com *ic = vap->iv_ic;
  
@@ -91,7 +91,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  }
  
  static __inline int
-@@ -3258,6 +3260,25 @@
+@@ -3258,6 +3260,25 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  			/* record tsf of last beacon */
  			memcpy(ni->ni_tstamp.data, scan.tstamp,
  				sizeof(ni->ni_tstamp));
@@ -119,7 +119,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  						"beacon interval divergence: "
 --- a/net80211/ieee80211_scan.c
 +++ b/net80211/ieee80211_scan.c
-@@ -616,6 +616,7 @@
+@@ -616,6 +616,7 @@ ieee80211_cancel_scan(struct ieee80211va
  
  		/* clear bg scan NOPICK and mark cancel request */
  		ss->ss_flags &= ~IEEE80211_SCAN_NOPICK;
@@ -127,7 +127,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		SCAN_PRIVATE(ss)->ss_iflags |= ISCAN_CANCEL;
  		ss->ss_ops->scan_cancel(ss, vap);
  		/* force it to fire asap */
-@@ -782,7 +783,7 @@
+@@ -782,7 +783,7 @@ again:
  				ieee80211_sta_pwrsave(vap, 0);
  				if (ss->ss_next >= ss->ss_last) {
  					ieee80211_notify_scan_done(vap);
@@ -138,7 +138,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  			SCAN_PRIVATE(ss)->ss_iflags &= ~ISCAN_CANCEL;
 --- a/net80211/ieee80211_proto.c
 +++ b/net80211/ieee80211_proto.c
-@@ -1450,6 +1450,7 @@
+@@ -1450,6 +1450,7 @@ __ieee80211_newstate(struct ieee80211vap
  		}
  		break;
  	case IEEE80211_S_AUTH:
@@ -148,7 +148,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		KASSERT(vap->iv_opmode == IEEE80211_M_STA || 
 --- a/net80211/ieee80211_output.c
 +++ b/net80211/ieee80211_output.c
-@@ -238,7 +238,8 @@
+@@ -238,7 +238,8 @@ ieee80211_hardstart(struct sk_buff *skb,
  	}
  	
  	/* Cancel any running BG scan */
diff --git a/package/madwifi/patches/358-ignore_broken_bssid.patch b/package/madwifi/patches/358-ignore_broken_bssid.patch
index 0bae461f6b..b549272202 100644
--- a/package/madwifi/patches/358-ignore_broken_bssid.patch
+++ b/package/madwifi/patches/358-ignore_broken_bssid.patch
@@ -5,7 +5,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 
 --- a/net80211/ieee80211_scan_sta.c
 +++ b/net80211/ieee80211_scan_sta.c
-@@ -242,6 +242,10 @@
+@@ -242,6 +242,10 @@ sta_add(struct ieee80211_scan_state *ss,
  	struct ieee80211_scan_entry *ise;
  	int hash;
  
diff --git a/package/madwifi/patches/359-disable_reassoc.patch b/package/madwifi/patches/359-disable_reassoc.patch
index 723424f1bb..8d25dc2a8e 100644
--- a/package/madwifi/patches/359-disable_reassoc.patch
+++ b/package/madwifi/patches/359-disable_reassoc.patch
@@ -5,7 +5,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 
 --- a/net80211/ieee80211_node.c
 +++ b/net80211/ieee80211_node.c
-@@ -599,10 +599,9 @@
+@@ -599,10 +599,9 @@ ieee80211_ibss_merge(struct ieee80211_no
  EXPORT_SYMBOL(ieee80211_ibss_merge);
  
  static __inline int
@@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  }
  
  /*
-@@ -634,8 +633,8 @@
+@@ -634,8 +633,8 @@ ieee80211_sta_join1(struct ieee80211_nod
  	 * Check if old+new node have the same ssid in which
  	 * case we can reassociate when operating in sta mode.
  	 */
diff --git a/package/madwifi/patches/360-sta_nodes.patch b/package/madwifi/patches/360-sta_nodes.patch
index f1151ac40a..2060001232 100644
--- a/package/madwifi/patches/360-sta_nodes.patch
+++ b/package/madwifi/patches/360-sta_nodes.patch
@@ -5,7 +5,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 
 --- a/net80211/ieee80211_proto.c
 +++ b/net80211/ieee80211_proto.c
-@@ -1348,7 +1348,7 @@
+@@ -1348,7 +1348,7 @@ __ieee80211_newstate(struct ieee80211vap
  				IEEE80211_SEND_MGMT(ni,
  					IEEE80211_FC0_SUBTYPE_DISASSOC,
  					IEEE80211_REASON_ASSOC_LEAVE);
@@ -14,7 +14,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  				break;
  			case IEEE80211_M_HOSTAP:
  				ieee80211_iterate_nodes(&ic->ic_sta,
-@@ -1358,12 +1358,14 @@
+@@ -1358,12 +1358,14 @@ __ieee80211_newstate(struct ieee80211vap
  				break;
  			}
  			goto reset;
@@ -29,7 +29,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  				break;
  			case IEEE80211_M_HOSTAP:
  				ieee80211_iterate_nodes(&ic->ic_sta,
-@@ -1376,7 +1378,6 @@
+@@ -1376,7 +1378,6 @@ __ieee80211_newstate(struct ieee80211vap
  		case IEEE80211_S_SCAN:
  			ieee80211_cancel_scan(vap);
  			goto reset;
@@ -37,7 +37,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		reset:
  			ieee80211_reset_bss(vap);
  			break;
-@@ -1429,10 +1430,12 @@
+@@ -1429,10 +1430,12 @@ __ieee80211_newstate(struct ieee80211vap
  					IEEE80211_SCAN_FOREVER,
  					vap->iv_des_nssid, vap->iv_des_ssid,
  					NULL);
@@ -51,7 +51,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  				vap->iv_flags &= ~IEEE80211_F_SIBSS;	/* XXX */
  				if (ic->ic_roaming == IEEE80211_ROAMING_AUTO)
  					ieee80211_check_scan(vap,
-@@ -1511,7 +1514,7 @@
+@@ -1511,7 +1514,7 @@ __ieee80211_newstate(struct ieee80211vap
  				IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
  			break;
  		case IEEE80211_S_RUN:
@@ -60,7 +60,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  			if (ic->ic_roaming == IEEE80211_ROAMING_AUTO) {
  				/* NB: caller specifies ASSOC/REASSOC by arg */
  				IEEE80211_SEND_MGMT(ni, arg ?
-@@ -1779,6 +1782,7 @@
+@@ -1779,6 +1782,7 @@ ieee80211_newstate(struct ieee80211vap *
  			  ieee80211_state_name[nstate], 
  			  ieee80211_state_name[dstate]);
  
@@ -70,7 +70,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	case IEEE80211_S_ASSOC:
 --- a/net80211/ieee80211_linux.c
 +++ b/net80211/ieee80211_linux.c
-@@ -233,33 +233,59 @@
+@@ -233,33 +233,59 @@ ieee80211_vlan_vdetach(struct ieee80211v
  }
  
  void
@@ -149,7 +149,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  }
  
  void
-@@ -269,18 +295,14 @@
+@@ -269,18 +295,14 @@ ieee80211_notify_node_leave(struct ieee8
  	struct net_device *dev = vap->iv_dev;
  	union iwreq_data wreq;
  
@@ -178,7 +178,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  void
 --- a/net80211/ieee80211_node.c
 +++ b/net80211/ieee80211_node.c
-@@ -2332,6 +2332,7 @@
+@@ -2332,6 +2332,7 @@ ieee80211_node_leave(struct ieee80211_no
  		count_suppchans(ic, ni, -1);
  	IEEE80211_UNLOCK_IRQ(ic);
  
@@ -186,7 +186,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	/*
  	 * Cleanup station state.  In particular clear various
  	 * state that might otherwise be reused if the node
-@@ -2339,7 +2340,7 @@
+@@ -2339,7 +2340,7 @@ ieee80211_node_leave(struct ieee80211_no
  	 * (and memory is reclaimed).
  	 */
  	ieee80211_sta_leave(ni);
@@ -208,7 +208,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  /* simple hash is enough for variation of macaddr */
 --- a/net80211/ieee80211_output.c
 +++ b/net80211/ieee80211_output.c
-@@ -2141,7 +2141,7 @@
+@@ -2141,7 +2141,7 @@ ieee80211_send_mgmt(struct ieee80211_nod
  
  	ieee80211_mgmt_output(ieee80211_ref_node(ni), skb, type);
  	if (timer)
@@ -219,7 +219,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	return ret;
 --- a/net80211/ieee80211_wireless.c
 +++ b/net80211/ieee80211_wireless.c
-@@ -514,8 +514,9 @@
+@@ -514,8 +514,9 @@ ieee80211_ioctl_siwap(struct net_device 
  			vap->iv_flags |= IEEE80211_F_DESBSSID;
  
  		IEEE80211_ADDR_COPY(vap->iv_des_bssid, &ap_addr->sa_data);
@@ -232,7 +232,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  }
 --- a/net80211/ieee80211_linux.h
 +++ b/net80211/ieee80211_linux.h
-@@ -643,6 +643,7 @@
+@@ -643,6 +643,7 @@ void ieee80211_vlan_vdetach(struct ieee8
  #define	free_netdev(dev)	kfree(dev)
  #endif
  
diff --git a/package/madwifi/patches/361-bmiss_handling.patch b/package/madwifi/patches/361-bmiss_handling.patch
index 8de323ed9f..b33cc3f73e 100644
--- a/package/madwifi/patches/361-bmiss_handling.patch
+++ b/package/madwifi/patches/361-bmiss_handling.patch
@@ -7,7 +7,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -3400,12 +3400,17 @@
+@@ -3400,12 +3400,17 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  			}
  
  			/* WDS/Repeater: re-schedule software beacon timer for 
@@ -31,7 +31,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  			 * Otherwise, check if it's the right time to do
 --- a/net80211/ieee80211_proto.c
 +++ b/net80211/ieee80211_proto.c
-@@ -1209,6 +1209,8 @@
+@@ -1209,6 +1209,8 @@ ieee80211_beacon_miss(struct ieee80211co
  	}
  	/* XXX locking */
  	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
@@ -40,7 +40,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		IEEE80211_DPRINTF(vap,
  			IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
  			"%s\n", "beacon miss");
-@@ -1221,6 +1223,29 @@
+@@ -1221,6 +1223,29 @@ ieee80211_beacon_miss(struct ieee80211co
  		if (vap->iv_opmode != IEEE80211_M_STA ||
  		    vap->iv_state != IEEE80211_S_RUN)
  			continue;
@@ -70,7 +70,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		if (ic->ic_roaming == IEEE80211_ROAMING_AUTO) {
  #ifdef ATH_SUPERG_DYNTURBO
  			/* 
-@@ -1621,14 +1646,14 @@
+@@ -1621,14 +1646,14 @@ __ieee80211_newstate(struct ieee80211vap
  		}
  
  		/* WDS/Repeater: Start software beacon timer for STA */
@@ -92,7 +92,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  
 --- a/net80211/ieee80211_var.h
 +++ b/net80211/ieee80211_var.h
-@@ -283,6 +283,7 @@
+@@ -283,6 +283,7 @@ struct ieee80211vap {
  
  	struct timer_list iv_swbmiss;			/* software beacon miss timer */
  	u_int16_t iv_swbmiss_period; 			/* software beacon miss timer period */
diff --git a/package/madwifi/patches/362-rssithr.patch b/package/madwifi/patches/362-rssithr.patch
index 376204a805..7e178e13ad 100644
--- a/package/madwifi/patches/362-rssithr.patch
+++ b/package/madwifi/patches/362-rssithr.patch
@@ -5,7 +5,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 
 --- a/net80211/ieee80211_ioctl.h
 +++ b/net80211/ieee80211_ioctl.h
-@@ -647,6 +647,8 @@
+@@ -647,6 +647,8 @@ enum {
  	IEEE80211_PARAM_PROTMODE_RSSI		= 77,	/* RSSI Threshold for enabling protection mode */
  	IEEE80211_PARAM_PROTMODE_TIMEOUT	= 78,	/* Timeout for expiring protection mode */
  	IEEE80211_PARAM_BGSCAN_THRESH		= 79,	/* bg scan rssi threshold */
@@ -16,7 +16,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  #define	SIOCG80211STATS			(SIOCDEVPRIVATE+2)
 --- a/net80211/ieee80211_wireless.c
 +++ b/net80211/ieee80211_wireless.c
-@@ -2799,6 +2799,12 @@
+@@ -2799,6 +2799,12 @@ ieee80211_ioctl_setparam(struct net_devi
  	case IEEE80211_PARAM_ROAM_RATE_11G:
  		vap->iv_roam.rate11b = value;
  		break;
@@ -29,7 +29,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	case IEEE80211_PARAM_UAPSDINFO:
  		if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
  			if (ic->ic_caps & IEEE80211_C_UAPSD) {
-@@ -3184,6 +3190,12 @@
+@@ -3184,6 +3190,12 @@ ieee80211_ioctl_getparam(struct net_devi
  	case IEEE80211_PARAM_ROAM_RATE_11G:
  		param[0] = vap->iv_roam.rate11b;
  		break;
@@ -42,7 +42,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	case IEEE80211_PARAM_UAPSDINFO:
  		if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
  			if (IEEE80211_VAP_UAPSD_ENABLED(vap))
-@@ -5733,6 +5745,14 @@
+@@ -5733,6 +5745,14 @@ static const struct iw_priv_args ieee802
  	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "rate11g" },
  	{ IEEE80211_PARAM_ROAM_RATE_11G,
  	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_rate11g" },
@@ -59,7 +59,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	{ IEEE80211_PARAM_UAPSDINFO,
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -3261,6 +3261,19 @@
+@@ -3261,6 +3261,19 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  			memcpy(ni->ni_tstamp.data, scan.tstamp,
  				sizeof(ni->ni_tstamp));
  
@@ -81,7 +81,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  			if (!(ic->ic_flags & IEEE80211_F_SCAN) && (rssi < vap->iv_bgscanthr) &&
 --- a/net80211/ieee80211_var.h
 +++ b/net80211/ieee80211_var.h
-@@ -223,6 +223,9 @@
+@@ -223,6 +223,9 @@ struct ieee80211vap {
  	u_int iv_bgscanintvl;				/* bg scan min interval */
  	u_int iv_bgscanthr;					/* bg scan rssi threshold */
  	u_int iv_bgscantrintvl;				/* bg scan trigger interval */
diff --git a/package/madwifi/patches/363-fix_turbo.patch b/package/madwifi/patches/363-fix_turbo.patch
index 54fcd76a60..880f2d6144 100644
--- a/package/madwifi/patches/363-fix_turbo.patch
+++ b/package/madwifi/patches/363-fix_turbo.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -4925,7 +4925,7 @@
+@@ -4925,7 +4925,7 @@ ath_beacon_generate(struct ath_softc *sc
  	 * capability info and arrange for a mode change
  	 * if needed.
  	 */
diff --git a/package/madwifi/patches/364-memory_alloc.patch b/package/madwifi/patches/364-memory_alloc.patch
index d0d76a1792..53fbc77091 100644
--- a/package/madwifi/patches/364-memory_alloc.patch
+++ b/package/madwifi/patches/364-memory_alloc.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -539,8 +539,8 @@
+@@ -539,8 +539,8 @@ ath_attach(u_int16_t devid, struct net_d
  
  	/* Allocate space for dynamically determined maximum VAP count */
  	sc->sc_bslot = 
diff --git a/package/madwifi/patches/365-turbo_channelsearch.patch b/package/madwifi/patches/365-turbo_channelsearch.patch
index 31caa1bfe7..df4306b212 100644
--- a/package/madwifi/patches/365-turbo_channelsearch.patch
+++ b/package/madwifi/patches/365-turbo_channelsearch.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211.c
 +++ b/net80211/ieee80211.c
-@@ -684,6 +684,7 @@
+@@ -684,6 +684,7 @@ ieee80211_find_channel(struct ieee80211c
  	int i;
  
  	/* Brute force search */
diff --git a/package/madwifi/patches/366-bstuck_thresh.patch b/package/madwifi/patches/366-bstuck_thresh.patch
index 6aa70d39b8..f5a94c6b61 100644
--- a/package/madwifi/patches/366-bstuck_thresh.patch
+++ b/package/madwifi/patches/366-bstuck_thresh.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -389,6 +389,7 @@
+@@ -389,6 +389,7 @@ static int ath_countrycode = CTRY_DEFAUL
  static int ath_outdoor = AH_FALSE;		/* enable outdoor use */
  static int ath_xchanmode = AH_TRUE;		/* enable extended channels */
  static int ath_maxvaps = ATH_MAXVAPS_DEFAULT;   /* set default maximum vaps */
@@ -8,7 +8,7 @@
  static char *autocreate = NULL;
  static char *ratectl = DEF_RATE_CTL;
  static int rfkill = 0;
-@@ -432,6 +433,7 @@
+@@ -432,6 +433,7 @@ MODULE_PARM(rfkill, "i");
  #ifdef ATH_CAP_TPC
  MODULE_PARM(tpc, "i");
  #endif
@@ -16,7 +16,7 @@
  MODULE_PARM(autocreate, "s");
  MODULE_PARM(ratectl, "s");
  #else
-@@ -445,6 +447,7 @@
+@@ -445,6 +447,7 @@ module_param(rfkill, int, 0600);
  #ifdef ATH_CAP_TPC
  module_param(tpc, int, 0600);
  #endif
@@ -24,7 +24,7 @@
  module_param(autocreate, charp, 0600);
  module_param(ratectl, charp, 0600);
  #endif
-@@ -457,6 +460,7 @@
+@@ -457,6 +460,7 @@ MODULE_PARM_DESC(rfkill, "Enable/disable
  MODULE_PARM_DESC(tpc, "Enable/disable per-packet transmit power control (TPC) "
  		"capability");
  #endif
@@ -32,7 +32,7 @@
  MODULE_PARM_DESC(autocreate, "Create ath device in "
  		"[sta|ap|wds|adhoc|ahdemo|monitor] mode. defaults to sta, use "
  		"'none' to disable");
-@@ -5072,7 +5076,7 @@
+@@ -5072,7 +5076,7 @@ ath_beacon_send(struct ath_softc *sc, in
  		DPRINTF(sc, ATH_DEBUG_BEACON_PROC,
  			"Missed %u consecutive beacons (n_beacon=%u)\n",
  			sc->sc_bmisscount, n_beacon);
@@ -41,7 +41,7 @@
  			ATH_SCHEDULE_TQUEUE(&sc->sc_bstucktq, needmark);
  		return;
  	}
-@@ -5228,7 +5232,7 @@
+@@ -5228,7 +5232,7 @@ ath_bstuck_tasklet(TQUEUE_ARG data)
  	 *     check will be true, in which case return
  	 *     without resetting the driver.
  	 */
diff --git a/package/madwifi/patches/367-roaming.patch b/package/madwifi/patches/367-roaming.patch
index a8af67107d..5950f9fd4e 100644
--- a/package/madwifi/patches/367-roaming.patch
+++ b/package/madwifi/patches/367-roaming.patch
@@ -2,7 +2,7 @@ Patch adapted from ubnt madwifi patchset
 
 --- a/net80211/ieee80211_node.c
 +++ b/net80211/ieee80211_node.c
-@@ -659,7 +659,7 @@
+@@ -659,7 +659,7 @@ ieee80211_sta_join1(struct ieee80211_nod
  		 */
  		if (canreassoc) {
  			vap->iv_nsparams.newstate = IEEE80211_S_ASSOC;
@@ -13,7 +13,7 @@ Patch adapted from ubnt madwifi patchset
  			vap->iv_nsparams.newstate = IEEE80211_S_AUTH;
 --- a/net80211/ieee80211_scan_sta.c
 +++ b/net80211/ieee80211_scan_sta.c
-@@ -748,14 +748,17 @@
+@@ -748,14 +748,17 @@ notfound:
   * a reference to an entry w/o holding the lock on the table.
   */
  static struct sta_entry *
@@ -33,7 +33,7 @@ Patch adapted from ubnt madwifi patchset
  			break;
  	SCAN_STA_UNLOCK_IRQ(st);
  
-@@ -772,7 +775,7 @@
+@@ -772,7 +775,7 @@ sta_roam_check(struct ieee80211_scan_sta
  	u_int8_t roamRate, curRate;
  	int8_t roamRssi, curRssi;
  
@@ -42,7 +42,7 @@ Patch adapted from ubnt madwifi patchset
  	if (se == NULL) {
  		/* XXX something is wrong */
  		return;
-@@ -866,8 +869,8 @@
+@@ -866,8 +869,8 @@ sta_age(struct ieee80211_scan_state *ss)
  	 */
  	KASSERT(vap->iv_opmode == IEEE80211_M_STA,
  		("wrong mode %u", vap->iv_opmode));
@@ -53,7 +53,7 @@ Patch adapted from ubnt madwifi patchset
  	    vap->iv_state >= IEEE80211_S_RUN)
  		/* XXX vap is implicit */
  		sta_roam_check(ss, vap);
-@@ -922,7 +925,11 @@
+@@ -922,7 +925,11 @@ sta_assoc_fail(struct ieee80211_scan_sta
  	struct sta_table *st = ss->ss_priv;
  	struct sta_entry *se;
  
@@ -66,7 +66,7 @@ Patch adapted from ubnt madwifi patchset
  	if (se != NULL) {
  		se->se_fails++;
  		se->se_lastfail = jiffies;
-@@ -939,7 +946,7 @@
+@@ -939,7 +946,7 @@ sta_assoc_success(struct ieee80211_scan_
  	struct sta_table *st = ss->ss_priv;
  	struct sta_entry *se;
  
diff --git a/package/madwifi/patches/368-sta_ie_preserve.patch b/package/madwifi/patches/368-sta_ie_preserve.patch
index 7094a43258..4beef62228 100644
--- a/package/madwifi/patches/368-sta_ie_preserve.patch
+++ b/package/madwifi/patches/368-sta_ie_preserve.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_scan_sta.c
 +++ b/net80211/ieee80211_scan_sta.c
-@@ -201,8 +201,10 @@
+@@ -201,8 +201,10 @@ sta_flush_table(struct sta_table *st)
  }
  
  static void
@@ -12,7 +12,7 @@
  	if (ie == NULL)
  		*iep = NULL;
  	else
-@@ -304,10 +306,10 @@
+@@ -304,10 +306,10 @@ found:
  		    (const struct ieee80211_tim_ie *) sp->tim;
  		ise->se_dtimperiod = tim->tim_period;
  	}
@@ -29,7 +29,7 @@
  	if (se->se_fails && (jiffies - se->se_lastfail) > STA_FAILS_AGE*HZ) {
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -3106,6 +3106,7 @@
+@@ -3106,6 +3106,7 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  		 */
  		IEEE80211_VERIFY_LENGTH(efrm - frm, 12);
  		memset(&scan, 0, sizeof(scan));
@@ -39,7 +39,7 @@
  		scan.bintval = le16toh(*(__le16 *)frm);
 --- a/net80211/ieee80211_scan.h
 +++ b/net80211/ieee80211_scan.h
-@@ -133,6 +133,7 @@
+@@ -133,6 +133,7 @@ struct ieee80211_scanparams {
  	u_int8_t erp;
  	u_int16_t bintval;
  	u_int8_t timoff;
diff --git a/package/madwifi/patches/369-mlme_assoc.patch b/package/madwifi/patches/369-mlme_assoc.patch
index 84e9ed9b39..43aac668c3 100644
--- a/package/madwifi/patches/369-mlme_assoc.patch
+++ b/package/madwifi/patches/369-mlme_assoc.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_wireless.c
 +++ b/net80211/ieee80211_wireless.c
-@@ -3723,6 +3723,7 @@
+@@ -3723,6 +3723,7 @@ ieee80211_ioctl_setmlme(struct net_devic
  		if (vap->iv_opmode == IEEE80211_M_STA) {
  			struct scanlookup lookup;
  
diff --git a/package/madwifi/patches/370-wdsvap.patch b/package/madwifi/patches/370-wdsvap.patch
index 3d266e2b52..f09739bfc1 100644
--- a/package/madwifi/patches/370-wdsvap.patch
+++ b/package/madwifi/patches/370-wdsvap.patch
@@ -128,7 +128,7 @@
  	IEEE80211_UNLOCK_IRQ(ic);
  
  	IEEE80211_ADDR_COPY(dev->dev_addr, vap->iv_myaddr);
-@@ -579,10 +589,24 @@ ieee80211_vap_detach(struct ieee80211vap
+@@ -579,10 +589,25 @@ ieee80211_vap_detach(struct ieee80211vap
  {
  	struct ieee80211com *ic = vap->iv_ic;
  	struct net_device *dev = vap->iv_dev;
@@ -136,7 +136,8 @@
 +
 +	/* Drop all WDS links that belong to this vap */
 +	while ((avp = TAILQ_FIRST(&vap->iv_wdslinks)) != NULL) {
-+		ieee80211_stop(avp->iv_dev);
++		if (avp->iv_state != IEEE80211_S_INIT)
++			ieee80211_stop(avp->iv_dev);
 +		ic->ic_vap_delete(avp);
 +	}
  
@@ -229,7 +230,7 @@
  				return;
  
  			/* We use iv_xrvap to link to the parent VAP as well */
-@@ -3801,74 +3801,51 @@ ieee80211_ioctl_setmlme(struct net_devic
+@@ -3801,74 +3801,54 @@ ieee80211_ioctl_setmlme(struct net_devic
  	return 0;
  }
  
@@ -254,7 +255,9 @@
 -	}
 -
 -	memcpy(vap->wds_mac, sa->sa_data, IEEE80211_ADDR_LEN);
--
++	if (vap->iv_opmode != IEEE80211_M_HOSTAP)
++		return -EINVAL;
+ 
 -	printk("%s: Added WDS MAC: " MAC_FMT "\n", dev->name,
 -		MAC_ADDR(vap->wds_mac));
 +	name = kmalloc(strlen(vap->iv_dev->name) + sizeof(WDSNAME) + 1, GFP_KERNEL);
@@ -329,7 +332,7 @@
  }
  
  /*
-@@ -5391,8 +5368,8 @@ static const struct iw_priv_args ieee802
+@@ -5391,8 +5371,8 @@ static const struct iw_priv_args ieee802
  	  IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0, "kickmac"},
  	{ IEEE80211_IOCTL_WDSADDMAC,
  	  IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0,"wds_add" },
@@ -340,7 +343,7 @@
  	{ IEEE80211_IOCTL_SETCHANLIST,
  	  IW_PRIV_TYPE_CHANLIST | IW_PRIV_SIZE_FIXED, 0,"setchanlist" },
  	{ IEEE80211_IOCTL_GETCHANLIST,
-@@ -5884,8 +5861,8 @@ static const iw_handler ieee80211_priv_h
+@@ -5884,8 +5864,8 @@ static const iw_handler ieee80211_priv_h
  #endif
  	set_priv(IEEE80211_IOCTL_ADDMAC, ieee80211_ioctl_addmac),
  	set_priv(IEEE80211_IOCTL_DELMAC, ieee80211_ioctl_delmac),
@@ -351,7 +354,7 @@
  	set_priv(IEEE80211_IOCTL_KICKMAC, ieee80211_ioctl_kickmac),
  	set_priv(IEEE80211_IOCTL_SETSCANLIST, ieee80211_ioctl_setscanlist),
  #ifdef ATH_REVERSE_ENGINEERING
-@@ -5956,7 +5933,7 @@ ieee80211_ioctl_create_vap(struct ieee80
+@@ -5956,7 +5936,7 @@ ieee80211_ioctl_create_vap(struct ieee80
  
  	strncpy(name, cp.icp_name, sizeof(name));
  
@@ -360,7 +363,7 @@
  	if (vap == NULL)
  		return -EIO;
  
-@@ -5973,9 +5950,9 @@ EXPORT_SYMBOL(ieee80211_ioctl_create_vap
+@@ -5973,9 +5953,9 @@ EXPORT_SYMBOL(ieee80211_ioctl_create_vap
   */
  struct ieee80211vap*
  ieee80211_create_vap(struct ieee80211com *ic, char *name,
@@ -374,49 +377,62 @@
  
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -201,6 +201,7 @@ ieee80211_input(struct ieee80211vap * va
+@@ -199,8 +199,9 @@ ieee80211_input(struct ieee80211vap * va
+ {
+ #define	HAS_SEQ(type)	((type & 0x4) == 0)
  	struct ieee80211_node * ni = ni_or_null;
- 	struct ieee80211com *ic = vap->iv_ic;
- 	struct net_device *dev = vap->iv_dev;
+-	struct ieee80211com *ic = vap->iv_ic;
+-	struct net_device *dev = vap->iv_dev;
++	struct ieee80211com *ic;
++	struct net_device *dev;
 +	struct ieee80211_node *ni_wds = NULL;
  	struct ieee80211_frame *wh;
  	struct ieee80211_key *key;
  	struct ether_header *eh;
-@@ -545,11 +546,30 @@ ieee80211_input(struct ieee80211vap * va
+@@ -212,6 +213,19 @@ ieee80211_input(struct ieee80211vap * va
+ 	u_int8_t *bssid;
+ 	u_int16_t rxseq;
+ 
++	type = -1;			/* undefined */
++
++	if (!vap)
++		goto out;
++
++	ic = vap->iv_ic;
++	if (!ic)
++		goto out;
++
++	dev = vap->iv_dev;
++	if (!dev)
++		goto out;
++
+ 	/* initialize ni as in the previous API */
+ 	if (ni_or_null == NULL) {
+                /* This function does not 'own' vap->iv_bss, so we cannot
+@@ -227,7 +241,6 @@ ieee80211_input(struct ieee80211vap * va
+ 
+ 	/* XXX adjust device in sk_buff? */
+ 
+-	type = -1;			/* undefined */
+ 	/*
+ 	 * In monitor mode, send everything directly to bpf.
+ 	 * Also do not process frames w/o i_addr2 any further.
+@@ -545,11 +558,11 @@ ieee80211_input(struct ieee80211vap * va
  			 * the node table for the packet source address (addr4).
  			 * If not, add one.
  			 */
--			/* XXX: Useless node mgmt API; make better */
 +
-+			/* check for wds link first */
- 			if (dir == IEEE80211_FC1_DIR_DSTODS) {
+ 			/* XXX: Useless node mgmt API; make better */
+-			if (dir == IEEE80211_FC1_DIR_DSTODS) {
 -				struct ieee80211_node_table *nt;
-+				struct ieee80211vap *avp;
-+
-+				TAILQ_FOREACH(avp, &vap->iv_wdslinks, iv_wdsnext) {
-+					if (!memcmp(avp->wds_mac, wh->i_addr2, IEEE80211_ADDR_LEN)) {
-+						IEEE80211_LOCK_IRQ(ni->ni_ic);
-+						ni_wds = avp->iv_wdsnode;
-+						IEEE80211_UNLOCK_IRQ(ni->ni_ic);
-+						break;
-+					}
-+				}
-+				if (ni_wds != NULL) {
-+					if (ni_or_null == NULL)
-+						ieee80211_unref_node(&ni);
-+					ni = ieee80211_ref_node(ni_wds);
-+				}
-+			}
-+
-+			/* XXX: Useless node mgmt API; make better */
-+			if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni_wds) {
++			if ((dir == IEEE80211_FC1_DIR_DSTODS) && !vap->iv_wdsnode && !ni_wds) {
 +				struct ieee80211_node_table *nt = &ic->ic_sta;
  				struct ieee80211_frame_addr4 *wh4;
 -				struct ieee80211_node *ni_wds;
  
  				if (!(vap->iv_flags_ext & IEEE80211_FEXT_WDS)) {
  					IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
-@@ -557,7 +577,6 @@ ieee80211_input(struct ieee80211vap * va
+@@ -557,7 +570,6 @@ ieee80211_input(struct ieee80211vap * va
  					goto err;
  				}
  				wh4 = (struct ieee80211_frame_addr4 *)skb->data;
@@ -424,7 +440,7 @@
  				ni_wds = ieee80211_find_wds_node(nt, wh4->i_addr4);
  				/* Last call increments ref count if !NULL */
  				if ((ni_wds != NULL) && (ni_wds != ni)) {
-@@ -3084,8 +3103,7 @@ ieee80211_recv_mgmt(struct ieee80211vap 
+@@ -3084,8 +3096,7 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  		    (vap->iv_opmode == IEEE80211_M_STA && ni->ni_associd) ||
  		    (vap->iv_opmode == IEEE80211_M_IBSS) ||
  			((subtype == IEEE80211_FC0_SUBTYPE_BEACON) &&
@@ -434,7 +450,7 @@
  			vap->iv_stats.is_rx_mgtdiscard++;
  			return;
  		}
-@@ -3471,13 +3489,53 @@ ieee80211_recv_mgmt(struct ieee80211vap 
+@@ -3471,13 +3482,54 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  		 */
  		if (ic->ic_flags & IEEE80211_F_SCAN) {
  			ieee80211_add_scan(vap, &scan, wh, subtype, rssi, rtsf);
@@ -461,17 +477,18 @@
 +
 +				TAILQ_FOREACH(avp, &vap->iv_wdslinks, iv_wdsnext) {
 +					if (!memcmp(avp->wds_mac, wh->i_addr2, IEEE80211_ADDR_LEN)) {
++						if (avp->iv_state != IEEE80211_S_RUN)
++							continue;
 +						found = 1;
 +						break;
 +					}
 +				}
-+				if (found) {
-+					if (!avp->iv_wdsnode)
-+						break;
-+					ni = ni_or_null = avp->iv_wdsnode;
-+				} else {
-+					avp = NULL;
-+				}
++				if (!found)
++					break;
++
++				ni = ni_or_null = avp->iv_wdsnode;
++			} else if (vap->iv_opmode == IEEE80211_M_WDS) {
++				ni = ni_or_null = vap->iv_wdsnode;
 +			}
 +			IEEE80211_UNLOCK_IRQ(vap->iv_ic);
 +
@@ -493,7 +510,7 @@
  			} else {
  				/*
  				 * Copy data from beacon to neighbor table.
-@@ -3490,6 +3548,7 @@ ieee80211_recv_mgmt(struct ieee80211vap 
+@@ -3490,6 +3542,7 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  				IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
  				memcpy(ni->ni_tstamp.data, scan.tstamp,
  					sizeof(ni->ni_tstamp));
@@ -503,10 +520,31 @@
  				ni->ni_capinfo = scan.capinfo;
 --- a/net80211/ieee80211_node.c
 +++ b/net80211/ieee80211_node.c
-@@ -1553,22 +1553,24 @@ ieee80211_find_rxnode(struct ieee80211co
+@@ -831,12 +831,18 @@ node_table_leave_locked(struct ieee80211
+ 		LIST_REMOVE(ni, ni_hash);
+ 	}
+ 	ni->ni_table = NULL;
++	if (ni->ni_vap->iv_wdsnode == ni) {
++#ifdef IEEE80211_DEBUG_REFCNT
++		ieee80211_unref_node_debug(&ni->ni_vap->iv_wdsnode, func, line);
++#else
++		ieee80211_unref_node(&ni->ni_vap->iv_wdsnode);
++#endif
++	}
+ #ifdef IEEE80211_DEBUG_REFCNT
+ 	ieee80211_unref_node_debug(&ni, func, line);
+ #else
+ 	ieee80211_unref_node(&ni);
+ #endif
+-	
+ }
+ 
+ /* This is overridden by ath_node_alloc in ath/if_ath.c, and so
+@@ -1553,22 +1559,39 @@ ieee80211_find_rxnode(struct ieee80211co
  	((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
  	struct ieee80211_node_table *nt;
  	struct ieee80211_node *ni;
++	struct ieee80211vap *vap, *avp;
 +	const u_int8_t *addr;
 +
 +	if (IS_CTL(wh) && !IS_PSPOLL(wh) /*&& !IS_RTS(ah)*/)
@@ -522,22 +560,56 @@
  	nt = &ic->ic_sta;
  	IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
 -	if (IS_CTL(wh) && !IS_PSPOLL(wh) /*&& !IS_RTS(ah)*/)
- #ifdef IEEE80211_DEBUG_REFCNT
+-#ifdef IEEE80211_DEBUG_REFCNT
 -		ni = ieee80211_find_node_locked_debug(nt, wh->i_addr1, func, line);
-+	ni = ieee80211_find_node_locked_debug(nt, addr, func, line);
- #else
+-#else
 -		ni = ieee80211_find_node_locked(nt, wh->i_addr1);
 -#endif
 -	else
--#ifdef IEEE80211_DEBUG_REFCNT
++	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS) {
++		TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
++			TAILQ_FOREACH(avp, &vap->iv_wdslinks, iv_wdsnext) {
++				if (!IEEE80211_ADDR_EQ(addr, avp->wds_mac))
++					continue;
++
++				if (avp->iv_wdsnode)
++					return ieee80211_ref_node(avp->iv_wdsnode);
++				else
++					return NULL;
++			}
++		}
++	}
++
+ #ifdef IEEE80211_DEBUG_REFCNT
 -		ni = ieee80211_find_node_locked_debug(nt, wh->i_addr2, func, line);
--#else
++	ni = ieee80211_find_node_locked_debug(nt, addr, func, line);
+ #else
 -		ni = ieee80211_find_node_locked(nt, wh->i_addr2);
 +	ni = ieee80211_find_node_locked(nt, addr);
  #endif
  	IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
  
-@@ -1669,6 +1671,11 @@ ieee80211_free_node(struct ieee80211_nod
+@@ -1596,9 +1619,19 @@ ieee80211_find_txnode_debug(struct ieee8
+ ieee80211_find_txnode(struct ieee80211vap *vap, const u_int8_t *mac)
+ #endif
+ {
++	struct ieee80211com *ic = vap->iv_ic;
+ 	struct ieee80211_node_table *nt;
+ 	struct ieee80211_node *ni = NULL;
+ 
++	IEEE80211_LOCK_IRQ(ic);
++	if (vap->iv_opmode == IEEE80211_M_WDS) {
++		if (vap->iv_wdsnode)
++			return ieee80211_ref_node(vap->iv_wdsnode);
++		else
++			return NULL;
++	}
++	IEEE80211_UNLOCK_IRQ(ic);
++
+ 	/*
+ 	 * The destination address should be in the node table
+ 	 * unless we are operating in station mode or this is a
+@@ -1669,6 +1702,11 @@ ieee80211_free_node(struct ieee80211_nod
  {
  	struct ieee80211vap *vap = ni->ni_vap;
  
@@ -549,7 +621,7 @@
  	atomic_dec(&ni->ni_ic->ic_node_counter);
  	node_print_message(IEEE80211_MSG_NODE|IEEE80211_MSG_NODE_REF,
  			   1 /* show counter */, 
-@@ -1781,22 +1788,6 @@ restart:
+@@ -1781,22 +1819,6 @@ restart:
  		    jiffies > ni->ni_rxfragstamp + HZ) {
  			ieee80211_dev_kfree_skb(&ni->ni_rxfrag);
  		}
@@ -574,27 +646,19 @@
  			struct ieee80211vap *vap = ni->ni_vap;
 --- a/net80211/ieee80211_output.c
 +++ b/net80211/ieee80211_output.c
-@@ -246,10 +246,16 @@ ieee80211_hardstart(struct sk_buff *skb,
+@@ -246,10 +246,7 @@ ieee80211_hardstart(struct sk_buff *skb,
  	 * things like power save.
  	 */
  	eh = (struct ether_header *)skb->data;
 -	if (vap->iv_opmode == IEEE80211_M_WDS)
 -		ni = ieee80211_find_txnode(vap, vap->wds_mac);
 -	else
-+	if (vap->iv_opmode == IEEE80211_M_WDS) {
-+		IEEE80211_LOCK_IRQ(ic);
-+		ni = vap->iv_wdsnode;
-+		IEEE80211_UNLOCK_IRQ(ic);
-+		if (!ni)
-+			goto bad;
-+		ni = ieee80211_ref_node(vap->iv_wdsnode);
-+	} else {
- 		ni = ieee80211_find_txnode(vap, eh->ether_dhost);
-+	}
+-		ni = ieee80211_find_txnode(vap, eh->ether_dhost);
++	ni = ieee80211_find_txnode(vap, eh->ether_dhost);
  	if (ni == NULL) {
  		/* NB: ieee80211_find_txnode does stat+msg */
  		goto bad;
-@@ -788,7 +794,7 @@ ieee80211_encap(struct ieee80211_node *n
+@@ -788,7 +785,7 @@ ieee80211_encap(struct ieee80211_node *n
  		break;
  	case IEEE80211_M_WDS:
  		use4addr = 1;
@@ -603,7 +667,7 @@
  		break;
  	case IEEE80211_M_HOSTAP:
  		if (!IEEE80211_IS_MULTICAST(eh.ether_dhost) &&
-@@ -973,7 +979,7 @@ ieee80211_encap(struct ieee80211_node *n
+@@ -973,7 +970,7 @@ ieee80211_encap(struct ieee80211_node *n
  			break;
  		case IEEE80211_M_WDS:
  			wh->i_fc[1] = IEEE80211_FC1_DIR_DSTODS;
@@ -647,7 +711,74 @@
  		};
 --- a/net80211/ieee80211_proto.c
 +++ b/net80211/ieee80211_proto.c
-@@ -1557,57 +1557,12 @@ __ieee80211_newstate(struct ieee80211vap
+@@ -1090,7 +1090,7 @@ ieee80211_open(struct net_device *dev)
+ void
+ ieee80211_start_running(struct ieee80211com *ic)
+ {
+-	struct ieee80211vap *vap;
++	struct ieee80211vap *vap, *avp;
+ 	struct net_device *dev;
+ 
+ 	/* XXX locking */
+@@ -1099,6 +1099,13 @@ ieee80211_start_running(struct ieee80211
+ 		/* NB: avoid recursion */
+ 		if ((dev->flags & IFF_UP) && !(dev->flags & IFF_RUNNING))
+ 			ieee80211_open(dev);
++
++		TAILQ_FOREACH(avp, &vap->iv_wdslinks, iv_wdsnext) {
++			dev = avp->iv_dev;
++			/* NB: avoid recursion */
++			if ((dev->flags & IFF_UP) && !(dev->flags & IFF_RUNNING))
++				ieee80211_open(dev);
++		}
+ 	}
+ }
+ EXPORT_SYMBOL(ieee80211_start_running);
+@@ -1116,11 +1123,21 @@ ieee80211_stop(struct net_device *dev)
+ 	struct ieee80211vap *vap = dev->priv;
+ 	struct ieee80211com *ic = vap->iv_ic;
+ 	struct net_device *parent = ic->ic_dev;
++	struct ieee80211vap *avp;
+ 
+ 	IEEE80211_DPRINTF(vap,
+ 		IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
+ 		"%s\n", "stop running");
+ 
++	if (vap->iv_wdsnode)
++		ieee80211_unref_node(&vap->iv_wdsnode);
++
++	/* stop wds interfaces */
++	TAILQ_FOREACH(avp, &vap->iv_wdslinks, iv_next) {
++		if (avp->iv_state != IEEE80211_S_INIT)
++			ieee80211_stop(avp->iv_dev);
++	}
++
+ 	ieee80211_new_state(vap, IEEE80211_S_INIT, -1);
+ 	if (dev->flags & IFF_RUNNING) {
+ 		dev->flags &= ~IFF_RUNNING;		/* mark us stopped */
+@@ -1148,7 +1165,7 @@ EXPORT_SYMBOL(ieee80211_stop);
+ void
+ ieee80211_stop_running(struct ieee80211com *ic)
+ {
+-	struct ieee80211vap *vap;
++	struct ieee80211vap *vap, *avp;
+ 	struct net_device *dev;
+ 
+ 	/* XXX locking */
+@@ -1156,6 +1173,12 @@ ieee80211_stop_running(struct ieee80211c
+ 		dev = vap->iv_dev;
+ 		if (dev->flags & IFF_RUNNING)	/* NB: avoid recursion */
+ 			ieee80211_stop(dev);
++
++		TAILQ_FOREACH(avp, &vap->iv_wdslinks, iv_wdsnext) {
++			dev = avp->iv_dev;
++			if (dev->flags & IFF_RUNNING)	/* NB: avoid recursion */
++				ieee80211_stop(dev);
++		}
+ 	}
+ }
+ EXPORT_SYMBOL(ieee80211_stop_running);
+@@ -1557,57 +1580,12 @@ __ieee80211_newstate(struct ieee80211vap
  		switch (ostate) {
  		case IEEE80211_S_INIT:
  			if (vap->iv_opmode == IEEE80211_M_MONITOR ||
@@ -705,3 +836,14 @@
  				break;
  			}
  			/* fall thru... */
+@@ -1808,6 +1786,10 @@ ieee80211_newstate(struct ieee80211vap *
+ 			  ieee80211_state_name[dstate]);
+ 
+ 	ieee80211_update_link_status(vap, nstate, ostate);
++
++	if ((nstate != IEEE80211_S_RUN) && vap->iv_wdsnode)
++		ieee80211_unref_node(&vap->iv_wdsnode);
++
+ 	switch (nstate) {
+ 	case IEEE80211_S_AUTH:
+ 	case IEEE80211_S_ASSOC:
diff --git a/package/madwifi/patches/371-wds_sta_separation.patch b/package/madwifi/patches/371-wds_sta_separation.patch
index b40eafa08d..7da1881d2a 100644
--- a/package/madwifi/patches/371-wds_sta_separation.patch
+++ b/package/madwifi/patches/371-wds_sta_separation.patch
@@ -1,14 +1,14 @@
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
 @@ -202,6 +202,7 @@ ieee80211_input(struct ieee80211vap * va
- 	struct ieee80211com *ic = vap->iv_ic;
- 	struct net_device *dev = vap->iv_dev;
+ 	struct ieee80211com *ic;
+ 	struct net_device *dev;
  	struct ieee80211_node *ni_wds = NULL;
 +	struct net_device_stats *stats;
  	struct ieee80211_frame *wh;
  	struct ieee80211_key *key;
  	struct ether_header *eh;
-@@ -435,7 +436,7 @@ ieee80211_input(struct ieee80211vap * va
+@@ -447,7 +448,7 @@ ieee80211_input(struct ieee80211vap * va
  
  	switch (type) {
  	case IEEE80211_FC0_TYPE_DATA:
@@ -17,7 +17,7 @@
  		if (skb->len < hdrspace) {
  			IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  				wh, "data", "too short: len %u, expecting %u",
-@@ -445,16 +446,24 @@ ieee80211_input(struct ieee80211vap * va
+@@ -457,16 +458,24 @@ ieee80211_input(struct ieee80211vap * va
  		}
  		switch (vap->iv_opmode) {
  		case IEEE80211_M_STA:
@@ -46,7 +46,7 @@
  				/* Discard multicast if IFF_MULTICAST not set */
  				if ((0 != memcmp(wh->i_addr3, dev->broadcast, ETH_ALEN)) && 
  					(0 == (dev->flags & IFF_MULTICAST))) {
-@@ -482,24 +491,10 @@ ieee80211_input(struct ieee80211vap * va
+@@ -494,24 +503,10 @@ ieee80211_input(struct ieee80211vap * va
  					vap->iv_stats.is_rx_mcastecho++;
  					goto out;
  				}
@@ -75,7 +75,7 @@
  			}
  			break;
  		case IEEE80211_M_IBSS:
-@@ -541,6 +536,11 @@ ieee80211_input(struct ieee80211vap * va
+@@ -553,14 +548,30 @@ ieee80211_input(struct ieee80211vap * va
  				vap->iv_stats.is_rx_notassoc++;
  				goto err;
  			}
@@ -87,14 +87,10 @@
  			/*
  			 * If we're a 4 address packet, make sure we have an entry in
  			 * the node table for the packet source address (addr4).
-@@ -548,9 +548,16 @@ ieee80211_input(struct ieee80211vap * va
+ 			 * If not, add one.
  			 */
- 
- 			/* check for wds link first */
--			if (dir == IEEE80211_FC1_DIR_DSTODS) {
++			/* check for wds link first */
 +			if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni->ni_subif) {
- 				struct ieee80211vap *avp;
- 
 +				if (vap->iv_flags_ext & IEEE80211_FEXT_WDSSEP) {
 +					ieee80211_wds_addif(ni);
 +					/* we must drop frames here until the interface has
@@ -102,19 +98,16 @@
 +					 * confused */
 +					goto err;
 +				}
- 				TAILQ_FOREACH(avp, &vap->iv_wdslinks, iv_wdsnext) {
- 					if (!memcmp(avp->wds_mac, wh->i_addr2, IEEE80211_ADDR_LEN)) {
- 						IEEE80211_LOCK_IRQ(ni->ni_ic);
-@@ -567,7 +574,7 @@ ieee80211_input(struct ieee80211vap * va
- 			}
++			}
  
  			/* XXX: Useless node mgmt API; make better */
--			if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni_wds) {
-+			if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni_wds && !ni->ni_subif) {
+-			if ((dir == IEEE80211_FC1_DIR_DSTODS) && !vap->iv_wdsnode && !ni_wds) {
++			if ((dir == IEEE80211_FC1_DIR_DSTODS) && !vap->iv_wdsnode &&
++					!ni_wds && !ni->ni_subif) {
  				struct ieee80211_node_table *nt = &ic->ic_sta;
  				struct ieee80211_frame_addr4 *wh4;
  
-@@ -627,6 +634,11 @@ ieee80211_input(struct ieee80211vap * va
+@@ -620,6 +631,11 @@ ieee80211_input(struct ieee80211vap * va
  			goto out;
  		}
  
@@ -126,7 +119,7 @@
  		/*
  		 * Handle privacy requirements.  Note that we
  		 * must not be preempted from here until after
-@@ -699,8 +711,12 @@ ieee80211_input(struct ieee80211vap * va
+@@ -692,8 +708,12 @@ ieee80211_input(struct ieee80211vap * va
  		if (! accept_data_frame(vap, ni, key, skb, eh))
  			goto out;
  
@@ -141,7 +134,7 @@
  		IEEE80211_NODE_STAT(ni, rx_data);
  		IEEE80211_NODE_STAT_ADD(ni, rx_bytes, skb->len);
  		ic->ic_lastdata = jiffies;
-@@ -1133,6 +1149,13 @@ ieee80211_deliver_data(struct ieee80211_
+@@ -1126,6 +1146,13 @@ ieee80211_deliver_data(struct ieee80211_
  		dev = vap->iv_xrvap->iv_dev;
  #endif
  
@@ -155,7 +148,7 @@
  	/* perform as a bridge within the vap */
  	/* XXX intra-vap bridging only */
  	if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
-@@ -1158,7 +1181,16 @@ ieee80211_deliver_data(struct ieee80211_
+@@ -1151,7 +1178,16 @@ ieee80211_deliver_data(struct ieee80211_
  			if (ni1 != NULL) {
  				if (ni1->ni_vap == vap &&
  				    ieee80211_node_is_authorized(ni1) &&
@@ -251,7 +244,7 @@
  	default:
  		return -EOPNOTSUPP;
  	}
-@@ -4447,6 +4458,8 @@ get_sta_space(void *arg, struct ieee8021
+@@ -4450,6 +4461,8 @@ get_sta_space(void *arg, struct ieee8021
  	struct ieee80211vap *vap = ni->ni_vap;
  	size_t ielen;
  
@@ -260,7 +253,7 @@
  	if (vap != req->vap && vap != req->vap->iv_xrvap)	/* only entries for this vap */
  		return;
  	if ((vap->iv_opmode == IEEE80211_M_HOSTAP ||
-@@ -4466,6 +4479,8 @@ get_sta_info(void *arg, struct ieee80211
+@@ -4469,6 +4482,8 @@ get_sta_info(void *arg, struct ieee80211
  	size_t ielen, len;
  	u_int8_t *cp;
  
@@ -269,7 +262,7 @@
  	if (vap != req->vap && vap != req->vap->iv_xrvap)	/* only entries for this vap (or) xrvap */
  		return;
  	if ((vap->iv_opmode == IEEE80211_M_HOSTAP ||
-@@ -5767,6 +5782,10 @@ static const struct iw_priv_args ieee802
+@@ -5770,6 +5785,10 @@ static const struct iw_priv_args ieee802
  	 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_minrate"},
  	{ IEEE80211_IOCTL_SETSCANLIST,
  	 IW_PRIV_TYPE_CHAR | 255, 0, "setscanlist"},
@@ -280,7 +273,7 @@
  
  #ifdef ATH_REVERSE_ENGINEERING
  	/*
-@@ -5890,6 +5909,8 @@ static int
+@@ -5893,6 +5912,8 @@ static int
  ieee80211_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
  {
  	struct ieee80211vap *vap = dev->priv;
@@ -289,7 +282,7 @@
  
  	switch (cmd) {
  	case SIOCG80211STATS:
-@@ -5898,8 +5919,20 @@ ieee80211_ioctl(struct net_device *dev, 
+@@ -5901,8 +5922,20 @@ ieee80211_ioctl(struct net_device *dev, 
  	case SIOC80211IFDESTROY:
  		if (!capable(CAP_NET_ADMIN))
  			return -EPERM;
@@ -333,7 +326,7 @@
  	ieee80211_node_table_reset(&ic->ic_sta, vap);
  	if (vap->iv_bss != NULL) {
  		ieee80211_unref_node(&vap->iv_bss);
-@@ -1134,6 +1139,57 @@ ieee80211_alloc_node(struct ieee80211vap
+@@ -1140,6 +1145,57 @@ ieee80211_alloc_node(struct ieee80211vap
  	return ni;
  }
  
@@ -391,7 +384,7 @@
  /* Add wds address to the node table */
  int
  #ifdef IEEE80211_DEBUG_REFCNT
-@@ -2254,6 +2310,36 @@ ieee80211_node_leave_11g(struct ieee8021
+@@ -2285,6 +2341,36 @@ ieee80211_node_leave_11g(struct ieee8021
  	}
  }
  
@@ -428,7 +421,7 @@
  /*
   * Handle bookkeeping for a station/neighbor leaving
   * the bss when operating in ap or adhoc modes.
-@@ -2270,6 +2356,12 @@ ieee80211_node_leave(struct ieee80211_no
+@@ -2301,6 +2387,12 @@ ieee80211_node_leave(struct ieee80211_no
  			ni, "station with aid %d leaves (refcnt %u)",
  			IEEE80211_NODE_AID(ni), atomic_read(&ni->ni_refcnt));
  
@@ -497,15 +490,17 @@
  	return ieee80211_init(dev, 0);
  }
  
-@@ -1116,11 +1118,33 @@ ieee80211_stop(struct net_device *dev)
+@@ -1123,6 +1125,7 @@ ieee80211_stop(struct net_device *dev)
  	struct ieee80211vap *vap = dev->priv;
  	struct ieee80211com *ic = vap->iv_ic;
  	struct net_device *parent = ic->ic_dev;
 +	struct ieee80211_node *tni, *ni;
+ 	struct ieee80211vap *avp;
  
  	IEEE80211_DPRINTF(vap,
- 		IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
- 		"%s\n", "stop running");
+@@ -1138,6 +1141,27 @@ ieee80211_stop(struct net_device *dev)
+ 			ieee80211_stop(avp->iv_dev);
+ 	}
  
 +	/* get rid of all wds nodes while we're still locked */
 +	do {
@@ -531,7 +526,7 @@
  	ieee80211_new_state(vap, IEEE80211_S_INIT, -1);
  	if (dev->flags & IFF_RUNNING) {
  		dev->flags &= ~IFF_RUNNING;		/* mark us stopped */
-@@ -1630,6 +1654,7 @@ __ieee80211_newstate(struct ieee80211vap
+@@ -1653,6 +1677,7 @@ __ieee80211_newstate(struct ieee80211vap
  		 */
  		if (ni->ni_authmode != IEEE80211_AUTH_8021X)
  			ieee80211_node_authorize(ni);
@@ -539,7 +534,7 @@
  #ifdef ATH_SUPERG_XR
  		/*
  		 * fire a timer to bring up XR vap if configured.
-@@ -1885,8 +1910,15 @@ ieee80211_newstate(struct ieee80211vap *
+@@ -1912,8 +1937,15 @@ ieee80211_newstate(struct ieee80211vap *
  		if (ostate == IEEE80211_S_SCAN || 
  		    ostate == IEEE80211_S_AUTH ||
  		    ostate == IEEE80211_S_ASSOC) {
@@ -584,7 +579,7 @@
  	rtnl_unlock();
  
  	del_timer(&ic->ic_dfs_excl_timer);
-@@ -599,8 +614,10 @@ ieee80211_vap_detach(struct ieee80211vap
+@@ -600,8 +615,10 @@ ieee80211_vap_detach(struct ieee80211vap
  
  	IEEE80211_CANCEL_TQUEUE(&vap->iv_stajoin1tq);
  	IEEE80211_LOCK_IRQ(ic);
@@ -629,7 +624,7 @@
   */
 --- a/net80211/ieee80211_output.c
 +++ b/net80211/ieee80211_output.c
-@@ -261,6 +261,10 @@ ieee80211_hardstart(struct sk_buff *skb,
+@@ -252,6 +252,10 @@ ieee80211_hardstart(struct sk_buff *skb,
  		goto bad;
  	}
  
@@ -640,7 +635,7 @@
  	/* calculate priority so drivers can find the TX queue */
  	if (ieee80211_classify(ni, skb)) {
  		IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT, ni,
-@@ -340,20 +344,33 @@ void ieee80211_parent_queue_xmit(struct 
+@@ -331,20 +335,33 @@ void ieee80211_parent_queue_xmit(struct 
   * constructing a frame as it sets i_fc[1]; other bits can
   * then be or'd in.
   */
@@ -677,7 +672,7 @@
  		case IEEE80211_M_STA:
  			wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
  			IEEE80211_ADDR_COPY(wh->i_addr1, bssid);
-@@ -395,6 +412,8 @@ ieee80211_send_setup(struct ieee80211vap
+@@ -386,6 +403,8 @@ ieee80211_send_setup(struct ieee80211vap
  	*(__le16 *)&wh->i_seq[0] =
  	    htole16(ni->ni_txseqs[0] << IEEE80211_SEQ_SEQ_SHIFT);
  	ni->ni_txseqs[0]++;
@@ -686,7 +681,7 @@
  #undef WH4
  }
  
-@@ -416,9 +435,7 @@ ieee80211_mgmt_output(struct ieee80211_n
+@@ -407,9 +426,7 @@ ieee80211_mgmt_output(struct ieee80211_n
  
  	SKB_CB(skb)->ni = ni;
  
@@ -697,7 +692,7 @@
  		IEEE80211_FC0_TYPE_MGT | type,
  		vap->iv_myaddr, ni->ni_macaddr, vap->iv_bssid);
  	/* XXX power management */
-@@ -464,6 +481,9 @@ ieee80211_send_nulldata(struct ieee80211
+@@ -455,6 +472,9 @@ ieee80211_send_nulldata(struct ieee80211
  	struct ieee80211_frame *wh;
  	u_int8_t *frm;
  
@@ -707,7 +702,7 @@
  	skb = ieee80211_getmgtframe(&frm, 0);
  	if (skb == NULL) {
  		/* XXX debug msg */
-@@ -472,9 +492,7 @@ ieee80211_send_nulldata(struct ieee80211
+@@ -463,9 +483,7 @@ ieee80211_send_nulldata(struct ieee80211
  		return -ENOMEM;
  	}
  
@@ -718,7 +713,7 @@
  		IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_NODATA,
  		vap->iv_myaddr, ni->ni_macaddr, vap->iv_bssid);
  	/* NB: power management bit is never sent by an AP */
-@@ -512,6 +530,7 @@ ieee80211_send_qosnulldata(struct ieee80
+@@ -503,6 +521,7 @@ ieee80211_send_qosnulldata(struct ieee80
  	struct sk_buff *skb;
  	struct ieee80211_qosframe *qwh;
  	u_int8_t *frm;
@@ -726,7 +721,7 @@
  	int tid;
  
  	skb = ieee80211_getmgtframe(&frm, 2);
-@@ -523,11 +542,12 @@ ieee80211_send_qosnulldata(struct ieee80
+@@ -514,11 +533,12 @@ ieee80211_send_qosnulldata(struct ieee80
  	SKB_CB(skb)->ni = ieee80211_ref_node(ni);
  
  	skb->priority = ac;
@@ -742,7 +737,7 @@
  		IEEE80211_FC0_TYPE_DATA,
  		vap->iv_myaddr, /* SA */
  		ni->ni_macaddr, /* DA */
-@@ -541,10 +561,10 @@ ieee80211_send_qosnulldata(struct ieee80
+@@ -532,10 +552,10 @@ ieee80211_send_qosnulldata(struct ieee80
  
  	/* map from access class/queue to 11e header priority value */
  	tid = WME_AC_TO_TID(ac);
@@ -755,7 +750,7 @@
  
  	IEEE80211_NODE_STAT(ni, tx_data);
  
-@@ -786,6 +806,8 @@ ieee80211_encap(struct ieee80211_node *n
+@@ -777,6 +797,8 @@ ieee80211_encap(struct ieee80211_node *n
  		hdrsize = sizeof(struct ieee80211_frame);
  
  	SKB_CB(skb)->auth_pkt = (eh.ether_type == __constant_htons(ETHERTYPE_PAE));
@@ -764,7 +759,7 @@
  
  	switch (vap->iv_opmode) {
  	case IEEE80211_M_IBSS:
-@@ -805,20 +827,9 @@ ieee80211_encap(struct ieee80211_node *n
+@@ -796,20 +818,9 @@ ieee80211_encap(struct ieee80211_node *n
  			ismulticast = IEEE80211_IS_MULTICAST(eh.ether_dhost);
  		break;
  	case IEEE80211_M_STA:
@@ -787,7 +782,7 @@
  		} else
  			ismulticast = IEEE80211_IS_MULTICAST(vap->iv_bssid);
  		break;
-@@ -1689,9 +1700,7 @@ ieee80211_send_probereq(struct ieee80211
+@@ -1680,9 +1691,7 @@ ieee80211_send_probereq(struct ieee80211
  
  	SKB_CB(skb)->ni = ieee80211_ref_node(ni);
  
diff --git a/package/madwifi/patches/372-queue_vif.patch b/package/madwifi/patches/372-queue_vif.patch
index 8f8137b06b..1c31fff7f9 100644
--- a/package/madwifi/patches/372-queue_vif.patch
+++ b/package/madwifi/patches/372-queue_vif.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -1200,6 +1200,7 @@ ieee80211_deliver_data(struct ieee80211_
+@@ -1197,6 +1197,7 @@ ieee80211_deliver_data(struct ieee80211_
  		}
  		if (skb1 != NULL) {
  			struct ieee80211_node *ni_tmp;
@@ -8,7 +8,7 @@
  			skb1->dev = dev;
  			skb_reset_mac_header(skb1);
  			skb_set_network_header(skb1, sizeof(struct ether_header));
-@@ -1207,7 +1208,12 @@ ieee80211_deliver_data(struct ieee80211_
+@@ -1204,7 +1205,12 @@ ieee80211_deliver_data(struct ieee80211_
  			skb1->protocol = __constant_htons(ETH_P_802_2);
  			/* XXX insert vlan tag before queue it? */
  			ni_tmp = SKB_CB(skb1)->ni; /* remember node so we can free it */
@@ -24,7 +24,7 @@
  				vap->iv_devstats.tx_dropped++;
 --- a/net80211/ieee80211_output.c
 +++ b/net80211/ieee80211_output.c
-@@ -333,9 +333,10 @@ void ieee80211_parent_queue_xmit(struct 
+@@ -324,9 +324,10 @@ void ieee80211_parent_queue_xmit(struct 
  	/* Dispatch the packet to the parent device */
  	skb->dev = vap->iv_ic->ic_dev;
  
diff --git a/package/madwifi/patches/373-sanity_check.patch b/package/madwifi/patches/373-sanity_check.patch
index 9c18a74148..06c6acf08e 100644
--- a/package/madwifi/patches/373-sanity_check.patch
+++ b/package/madwifi/patches/373-sanity_check.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -238,6 +238,9 @@
+@@ -250,6 +250,9 @@ ieee80211_input(struct ieee80211vap * va
  	if (vap->iv_opmode == IEEE80211_M_MONITOR)
  		goto out;
  
diff --git a/package/madwifi/patches/378-adhoc_crash_fix.patch b/package/madwifi/patches/378-adhoc_crash_fix.patch
index 26997f724e..85183e6a71 100644
--- a/package/madwifi/patches/378-adhoc_crash_fix.patch
+++ b/package/madwifi/patches/378-adhoc_crash_fix.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -3531,6 +3531,11 @@ ieee80211_recv_mgmt(struct ieee80211vap 
+@@ -3528,6 +3528,11 @@ ieee80211_recv_mgmt(struct ieee80211vap 
  		if (ic->ic_flags & IEEE80211_F_SCAN) {
  			ieee80211_add_scan(vap, &scan, wh, subtype, rssi, rtsf);
  		}
diff --git a/package/madwifi/patches/405-retransmit_check.patch b/package/madwifi/patches/405-retransmit_check.patch
index 0f97871940..b03232ad5e 100644
--- a/package/madwifi/patches/405-retransmit_check.patch
+++ b/package/madwifi/patches/405-retransmit_check.patch
@@ -11,7 +11,7 @@
  #define	IEEE80211_QOS_TXOP			0x00ff
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -417,7 +417,7 @@ ieee80211_input(struct ieee80211vap * va
+@@ -429,7 +429,7 @@ ieee80211_input(struct ieee80211vap * va
  				tid = 0;
  			rxseq = le16toh(*(__le16 *)wh->i_seq);
  			if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) &&