madwifi: switch to latest madwifi-hal-0.9.30.13 snapshot as reference merge in refcount branch as well and clean up openwrt patches (a few fixes got merged upstream)

SVN-Revision: 7300
2007-05-21 06:25:34 +00:00 · 2007-05-21 06:25:34 +00:00 · d169d2d02a
parent 10b572b451
commit d169d2d02a
15 changed files with 2391 additions and 399 deletions
--- a/package/madwifi/Makefile
+++ b/package/madwifi/Makefile
@ -10,13 +10,14 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk

 PKG_NAME:=madwifi
-PKG_VERSION:=r2313-20070505
+PKG_VERSION:=r2351-20070519
+PKG_BRANCH:=madwifi-hal-0.9.30.13
 PKG_RELEASE:=1

-PKG_SOURCE:=madwifi-ng-refcount-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=http://snapshots.madwifi.org/madwifi-ng-refcount
-PKG_MD5SUM:=01ee9dfb1f174be6e009f9697f7267b8
-PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/madwifi-ng-refcount-r2313-20070505
+PKG_SOURCE:=$(PKG_BRANCH)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=http://snapshots.madwifi.org/$(PKG_BRANCH)
+PKG_MD5SUM:=215b6c66eb1a3c4bcd947f358ade823f
+PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(PKG_BRANCH)-$(PKG_VERSION)

 include $(INCLUDE_DIR)/package.mk

--- a/package/madwifi/patches/010-refcount_merge.patch
+++ b/package/madwifi/patches/010-refcount_merge.patch
--- a/package/madwifi/patches/101-fix_typo.patch
+++ b/package/madwifi/patches/101-fix_typo.patch
@ -1,12 +0,0 @@
-diff -urN madwifi-ng-refcount-r2313-20070505.old/ath_hal/ah_os.h madwifi-ng-refcount-r2313-20070505.dev/ath_hal/ah_os.h
--- madwifi-ng-refcount-r2313-20070505.old/ath_hal/ah_os.h	2007-05-04 02:10:06.000000000 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/ath_hal/ah_os.h	2007-05-13 18:17:55.040201656 +0200
-@@ -149,7 +149,7 @@
- 	(0x4000 <= (_reg) && (_reg) < 0x5000) ?			\
- 	 writel((_val), (_ah)->ah_sh + (_reg)) :		\
- 	 ({__raw_writel((_val), (_ah)->ah_sh + (_reg)); 	\
-	   mb(); });
-+	   mb(); }); \
- } while (0)
- #define _OS_REG_READ(_ah, _reg)					\
- 	((0x4000 <= (_reg) && (_reg) < 0x5000) ?		\
--- a/package/madwifi/patches/106-minstrel_crash.patch
+++ b/package/madwifi/patches/106-minstrel_crash.patch
@ -1,13 +0,0 @@
-diff -urN madwifi-ng-refcount-r2313-20070505.old/ath_rate/minstrel/minstrel.c madwifi-ng-refcount-r2313-20070505.dev/ath_rate/minstrel/minstrel.c
--- madwifi-ng-refcount-r2313-20070505.old/ath_rate/minstrel/minstrel.c	2007-04-25 22:29:55.000000000 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/ath_rate/minstrel/minstrel.c	2007-05-13 18:17:55.533126720 +0200
-@@ -543,6 +543,9 @@
-         unsigned int i, column_index;
-         int newIndex;
-         u_int8_t random_bytes[12];
-+		
-+		if (num_sample_rates < 0)
-+			return;
- 
-         for(column_index = 0; column_index < MINSTREL_COLUMNS; column_index++) {
-                 for (i = 0; i <= IEEE80211_RATE_MAXSIZE; i++)
--- a/package/madwifi/patches/111-wds_fix_PR_914.patch
+++ b/package/madwifi/patches/111-wds_fix_PR_914.patch
@ -1,31 +0,0 @@
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_node.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c	2007-05-04 23:09:29.000000000 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_node.c	2007-05-13 18:17:55.697101792 +0200
-@@ -981,11 +981,11 @@
- ieee80211_del_wds_node(struct ieee80211_node_table *nt, struct ieee80211_node *ni)
- {
- 	int hash;
-	struct ieee80211_wds_addr *wds;
-+	struct ieee80211_wds_addr *wds, *next;
- 
- 	IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
- 	for (hash = 0; hash < IEEE80211_NODE_HASHSIZE; hash++) {
-		LIST_FOREACH(wds, &nt->nt_wds_hash[hash], wds_hash) {
-+		LIST_FOREACH_SAFE(wds, &nt->nt_wds_hash[hash], wds_hash, next) {
- 			if (wds->wds_ni == ni) {
- 				LIST_REMOVE(wds, wds_hash);
- 				ieee80211_unref_node(&wds->wds_ni);
-@@ -1002,11 +1002,11 @@
- {
- 	struct ieee80211_node_table *nt = (struct ieee80211_node_table *)data;
- 	int hash;
-	struct ieee80211_wds_addr *wds;
-+	struct ieee80211_wds_addr *wds, *next;
- 
- 	IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
- 	for (hash = 0; hash < IEEE80211_NODE_HASHSIZE; hash++) {
-		LIST_FOREACH(wds, &nt->nt_wds_hash[hash], wds_hash) {
-+		LIST_FOREACH_SAFE(wds, &nt->nt_wds_hash[hash], wds_hash, next) {
- 			if (wds->wds_agingcount != WDS_AGING_STATIC) {
- 				if (!wds->wds_agingcount) {
- 					LIST_REMOVE(wds, wds_hash);
--- a/package/madwifi/patches/112-keycache_PR_962.patch
+++ b/package/madwifi/patches/112-keycache_PR_962.patch
@ -1,20 +1,20 @@
-diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcount-r2313-20070505.dev/ath/if_ath.c
--- madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c	2007-05-13 18:17:55.691102704 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/ath/if_ath.c	2007-05-13 18:17:55.783088720 +0200
-@@ -5704,7 +5704,8 @@
+diff -ur madwifi.old/ath/if_ath.c madwifi.dev/ath/if_ath.c
+--- madwifi.old/ath/if_ath.c	2007-05-21 07:33:42.392925296 +0200
+++ madwifi.dev/ath/if_ath.c	2007-05-21 07:35:51.933232176 +0200
+@@ -5660,7 +5660,8 @@
 		 * frame; it'll be dropped where it's not wanted.
 		 */
- 		if (ds->ds_rxstat.rs_keyix != HAL_RXKEYIX_INVALID &&
-		    (ni = sc->sc_keyixmap[ds->ds_rxstat.rs_keyix]) != NULL) {
-+		    (ni = sc->sc_keyixmap[ds->ds_rxstat.rs_keyix]) != NULL &&
+ 		if (rs->rs_keyix != HAL_RXKEYIX_INVALID &&
+-		    (ni = sc->sc_keyixmap[rs->rs_keyix]) != NULL) {
+		    ((ni = sc->sc_keyixmap[rs->rs_keyix]) != NULL) &&
 +			ieee80211_check_rxnode(ni, (const struct ieee80211_frame_min *) skb->data)) {
 			struct ath_node *an;
 			/*
 			 * Fast path: node is present in the key map;
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_node.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c	2007-05-13 18:17:55.773090240 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_node.c	2007-05-13 18:17:55.784088568 +0200
-@@ -1268,8 +1268,6 @@
+diff -ur madwifi.old/net80211/ieee80211_node.c madwifi.dev/net80211/ieee80211_node.c
+--- madwifi.old/net80211/ieee80211_node.c	2007-05-21 07:33:42.371928488 +0200
+++ madwifi.dev/net80211/ieee80211_node.c	2007-05-21 07:34:13.689167544 +0200
+@@ -1272,8 +1272,6 @@
 	IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
 
 	return ni;
@ -23,7 +23,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c madwi
 }
 #ifdef IEEE80211_DEBUG_REFCNT
 EXPORT_SYMBOL(ieee80211_find_rxnode_debug);
-@@ -1277,6 +1275,20 @@
+@@ -1281,6 +1279,20 @@
 EXPORT_SYMBOL(ieee80211_find_rxnode);
 #endif
 
@ -44,10 +44,10 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c madwi
 /*
  * Return a reference to the appropriate node for sending
  * a data frame.  This handles node discovery in adhoc networks.
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.h madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_node.h
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.h	2007-04-04 04:39:58.000000000 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_node.h	2007-05-13 18:17:55.784088568 +0200
-@@ -318,6 +318,8 @@
+diff -ur madwifi.old/net80211/ieee80211_node.h madwifi.dev/net80211/ieee80211_node.h
+--- madwifi.old/net80211/ieee80211_node.h	2007-05-21 07:33:42.372928336 +0200
+++ madwifi.dev/net80211/ieee80211_node.h	2007-05-21 07:34:13.689167544 +0200
+@@ -317,6 +317,8 @@
 	*pni = NULL;			/* guard against use */
 }
 
--- a/package/madwifi/patches/114-fix_ff_corruption.patch
+++ b/package/madwifi/patches/114-fix_ff_corruption.patch
@ -1,21 +0,0 @@
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_output.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_output.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_output.c	2007-04-25 22:29:55.000000000 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_output.c	2007-05-13 18:17:55.947063792 +0200
-@@ -942,7 +942,7 @@
- 		llc->llc_snap.org_code[0] = 0;
- 		llc->llc_snap.org_code[1] = 0;
- 		llc->llc_snap.org_code[2] = 0;
-		llc->llc_snap.ether_type = eh.ether_type;
-+		llc->llc_snap.ether_type = eh2.ether_type;
- 
- 		eh_inter = (struct ether_header *) skb_push(skb2, sizeof(struct ether_header));
- 		if (eh_inter == NULL) {
-@@ -952,7 +952,7 @@
- 			return NULL;
- 		}
- 
-		memcpy(eh_inter, &eh2, sizeof(struct ether_header) - sizeof eh.ether_type);
-+		memcpy(eh_inter, &eh2, sizeof(struct ether_header) - sizeof eh2.ether_type);
- 		eh_inter->ether_type = htons(payload);
- 
- 		/* variable length pad */
--- a/package/madwifi/patches/115-PR_1270_fix.patch
+++ b/package/madwifi/patches/115-PR_1270_fix.patch
@ -1,104 +0,0 @@
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_input.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_input.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_input.c	2007-05-04 02:10:06.000000000 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_input.c	2007-05-13 18:17:56.027051632 +0200
-@@ -2854,7 +2854,7 @@
- 				IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
- 				memcpy(ni->ni_tstamp.data, scan.tstamp,
- 					sizeof(ni->ni_tstamp));
-				ni->ni_intval = scan.bintval;
-+				ni->ni_intval = IEEE80211_BINTVAL_SANITISE(scan.bintval);
- 				ni->ni_capinfo = scan.capinfo;
- 				ni->ni_chan = ic->ic_curchan;
- 				ni->ni_fhdwell = scan.fhdwell;
-@@ -3279,7 +3279,7 @@
- 		ni->ni_rssi = rssi;
- 		ni->ni_rstamp = rstamp;
- 		ni->ni_last_rx = jiffies;
-		ni->ni_intval = bintval;
-+		ni->ni_intval = IEEE80211_BINTVAL_SANITISE(bintval);
- 		ni->ni_capinfo = capinfo;
- 		ni->ni_chan = ic->ic_curchan;
- 		ni->ni_fhdwell = vap->iv_bss->ni_fhdwell;
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_node.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c	2007-05-13 18:17:55.862076712 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_node.c	2007-05-13 18:17:56.028051480 +0200
-@@ -658,7 +658,7 @@
- 	memcpy(ni->ni_essid, se->se_ssid + 2, ni->ni_esslen);
- 	ni->ni_rstamp = se->se_rstamp;
- 	ni->ni_tstamp.tsf = se->se_tstamp.tsf;
-	ni->ni_intval = se->se_intval;
-+	ni->ni_intval = IEEE80211_BINTVAL_SANITISE(se->se_intval);
- 	ni->ni_capinfo = se->se_capinfo;
- 	ni->ni_chan = se->se_chan;
- 	ni->ni_timoff = se->se_timoff;
-@@ -1191,7 +1191,7 @@
- 		memcpy(ni->ni_essid, sp->ssid + 2, sp->ssid[1]);
- 		IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
- 		memcpy(ni->ni_tstamp.data, sp->tstamp, sizeof(ni->ni_tstamp));
-		ni->ni_intval = sp->bintval;
-+		ni->ni_intval = IEEE80211_BINTVAL_SANITISE(sp->bintval);
- 		ni->ni_capinfo = sp->capinfo;
- 		ni->ni_chan = ic->ic_curchan;
- 		ni->ni_fhdwell = sp->fhdwell;
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_scan.h madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_scan.h
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_scan.h	2007-04-04 04:39:58.000000000 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_scan.h	2007-05-13 18:17:56.029051328 +0200
-@@ -131,7 +131,7 @@
- 	u_int8_t bchan;
- 	u_int8_t fhindex;
- 	u_int8_t erp;
-	u_int8_t bintval;
-+	u_int16_t bintval;
- 	u_int8_t timoff;
- 	u_int8_t *tim;
- 	u_int8_t *tstamp;
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_var.h madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_var.h
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_var.h	2007-04-25 22:29:55.000000000 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_var.h	2007-05-13 18:17:56.029051328 +0200
-@@ -61,6 +61,12 @@
- #define	IEEE80211_BINTVAL_MAX	500		/* max beacon interval (TU's) */
- #define	IEEE80211_BINTVAL_MIN	25		/* min beacon interval (TU's) */
- #define	IEEE80211_BINTVAL_DEFAULT 100		/* default beacon interval (TU's) */
-+#define IEEE80211_BINTVAL_VALID(_bi) \
-+	((IEEE80211_BINTVAL_MIN <= (_bi)) && \
-+	 ((_bi) <= IEEE80211_BINTVAL_MAX))
-+#define IEEE80211_BINTVAL_SANITISE(_bi) \
-+	(IEEE80211_BINTVAL_VALID(_bi) ? \
-+	 (_bi) : IEEE80211_BINTVAL_DEFAULT)
- 
- #define	IEEE80211_BGSCAN_INTVAL_MIN	15	/* min bg scan intvl (secs) */
- #define	IEEE80211_BGSCAN_INTVAL_DEFAULT	(5*60)	/* default bg scan intvl */
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_wireless.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_wireless.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_wireless.c	2007-05-04 02:10:06.000000000 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_wireless.c	2007-05-13 18:17:56.031051024 +0200
-@@ -1271,12 +1271,16 @@
- 		case IW_POWER_UNICAST_R:
- 		case IW_POWER_ALL_R:
- 		case IW_POWER_ON:
-			ic->ic_flags |= IEEE80211_F_PMGTON;
-			
-+			if (wrq->flags & IW_POWER_PERIOD) {
-+				if (IEEE80211_BINTVAL_VALID(wrq->value))
-+					ic->ic_lintval = IEEE80211_MS_TO_TU(wrq->value);
-+				else
-+					return -EINVAL;
-+			}
- 			if (wrq->flags & IW_POWER_TIMEOUT)
- 				ic->ic_holdover = IEEE80211_MS_TO_TU(wrq->value);
-			if (wrq->flags & IW_POWER_PERIOD)
-				ic->ic_lintval = IEEE80211_MS_TO_TU(wrq->value);
-+			
-+			ic->ic_flags |= IEEE80211_F_PMGTON;
- 			break;
- 		default:
- 			return -EINVAL;
-@@ -2364,8 +2368,7 @@
- 		if (vap->iv_opmode != IEEE80211_M_HOSTAP &&
- 		    vap->iv_opmode != IEEE80211_M_IBSS)
- 			return -EINVAL;
-		if (IEEE80211_BINTVAL_MIN <= value &&
-		    value <= IEEE80211_BINTVAL_MAX) {
-+		if (IEEE80211_BINTVAL_VALID(value)) {
- 			ic->ic_lintval = value;		/* XXX multi-bss */
- 			retv = ENETRESET;		/* requires restart */
- 		} else
--- a/package/madwifi/patches/116-adhoc_beacon_PR_1033.patch
+++ b/package/madwifi/patches/116-adhoc_beacon_PR_1033.patch
@ -1,7 +1,7 @@
-diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcount-r2313-20070505.dev/ath/if_ath.c
--- madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c	2007-05-13 18:17:55.862076712 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/ath/if_ath.c	2007-05-13 18:17:56.119037648 +0200
-@@ -4411,16 +4411,31 @@
+diff -ur madwifi.old/ath/if_ath.c madwifi.dev/ath/if_ath.c
+--- madwifi.old/ath/if_ath.c	2007-05-21 07:33:42.392925296 +0200
+++ madwifi.dev/ath/if_ath.c	2007-05-21 07:39:50.536958896 +0200
+@@ -4359,16 +4359,31 @@
 	struct ieee80211com *ic = &sc->sc_ic;
 	struct ath_hal *ah = sc->sc_ah;
 	struct ieee80211_node *ni;
@ -37,7 +37,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	/* XXX conditionalize multi-bss support? */
 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
 		/*
-@@ -4434,20 +4449,61 @@
+@@ -4382,20 +4397,61 @@
 		if (sc->sc_stagbeacons)
 			intval /= ATH_BCBUF;	/* for staggered beacons */
 		if ((sc->sc_nostabeacons) &&
@ -108,7 +108,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 		int dtimperiod, dtimcount;
 		int cfpperiod, cfpcount;
 
-@@ -4463,13 +4519,13 @@
+@@ -4411,13 +4467,13 @@
 			dtimcount = 0;		/* XXX? */
 		cfpperiod = 1;			/* NB: no PCF support yet */
 		cfpcount = 0;
@ -125,7 +125,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 		do {
 			nexttbtt += intval;
 			if (--dtimcount < 0) {
-@@ -4477,7 +4533,7 @@
+@@ -4425,7 +4481,7 @@
 				if (--cfpcount < 0)
 					cfpcount = cfpperiod - 1;
 			}
@ -134,16 +134,16 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 #undef FUDGE
 		memset(&bs, 0, sizeof(bs));
 		bs.bs_intval = intval;
-@@ -4529,7 +4585,7 @@
+@@ -4477,7 +4533,7 @@
 		DPRINTF(sc, ATH_DEBUG_BEACON, 
 			"%s: tsf %llu tsf:tu %u intval %u nexttbtt %u dtim %u nextdtim %u bmiss %u sleep %u cfp:period %u maxdur %u next %u timoffset %u\n",
 			__func__,
-			(long long) tsf, tsftu,
-+			(long long) hw_tsf, hw_tsftu,
+-			(unsigned long long) tsf, tsftu,
+			(unsigned long long) hw_tsf, hw_tsftu,
 			bs.bs_intval,
 			bs.bs_nexttbtt,
 			bs.bs_dtimperiod,
-@@ -4548,7 +4604,7 @@
+@@ -4496,7 +4552,7 @@
 		ath_hal_intrset(ah, sc->sc_imask);
 	} else {
 		ath_hal_intrset(ah, 0);
@ -152,7 +152,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 			intval |= HAL_BEACON_RESET_TSF;
 		if (ic->ic_opmode == IEEE80211_M_IBSS) {
 			/*
-@@ -4585,8 +4641,40 @@
+@@ -4533,8 +4589,40 @@
 		if (ic->ic_opmode == IEEE80211_M_IBSS && sc->sc_hasveol)
 			ath_beacon_start_adhoc(sc, vap);
 	}
--- a/package/madwifi/patches/117-node_rates.patch
+++ b/package/madwifi/patches/117-node_rates.patch
@ -1,11 +0,0 @@
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_node.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c	2007-05-13 18:17:56.107039472 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_node.c	2007-05-13 18:17:56.202025032 +0200
-@@ -919,6 +919,7 @@
- 
- 		ni->ni_vap = vap;
- 		ni->ni_ic = ic;
-+		ni->ni_rates = ic->ic_sup_rates[ieee80211_chan2mode(ic->ic_curchan)];
- 	} else {
- 		/* XXX msg */
- 		vap->iv_stats.is_rx_nodealloc++;
--- a/package/madwifi/patches/118-txstop_workaround.patch
+++ b/package/madwifi/patches/118-txstop_workaround.patch
@ -1,7 +1,7 @@
 diff -ur madwifi.old/ath/if_ath.c madwifi.dev/ath/if_ath.c
--- madwifi.old/ath/if_ath.c	2007-05-21 05:40:18.320301560 +0200
-+++ madwifi.dev/ath/if_ath.c	2007-05-21 05:49:40.132893064 +0200
-@@ -2264,6 +2264,17 @@
+--- madwifi.old/ath/if_ath.c	2007-05-21 07:45:03.185429104 +0200
+++ madwifi.dev/ath/if_ath.c	2007-05-21 07:45:55.867420224 +0200
+@@ -2206,6 +2206,17 @@
 		txq->axq_link = &lastds->ds_link;
 		ath_hal_txstart(ah, txq->axq_qnum);
 		sc->sc_dev->trans_start = jiffies;
@ -19,18 +19,18 @@ diff -ur madwifi.old/ath/if_ath.c madwifi.dev/ath/if_ath.c
 	}
 	ATH_TXQ_UNLOCK(txq);
 
-@@ -7299,6 +7310,7 @@
+@@ -7246,6 +7257,7 @@
+ 			__func__, ds);
 #else
 		ds = bf->bf_desc;		/* NB: last descriptor */
- #endif
 +		sc->sc_tx_start = 0;
- 		status = ath_hal_txprocdesc(ah, ds);
- #ifdef AR_DEBUG
- 		if (sc->sc_debug & ATH_DEBUG_XMIT_DESC)
+ #endif
+ 		ts = &bf->bf_dsstatus.ds_txstat;
+ 		status = ath_hal_txprocdesc(ah, ds, ts);
 diff -ur madwifi.old/ath/if_athvar.h madwifi.dev/ath/if_athvar.h
--- madwifi.old/ath/if_athvar.h	2007-05-04 23:09:29.000000000 +0200
-+++ madwifi.dev/ath/if_athvar.h	2007-05-21 05:40:32.958076280 +0200
-@@ -689,6 +689,14 @@
+--- madwifi.old/ath/if_athvar.h	2007-05-18 13:19:16.000000000 +0200
+++ madwifi.dev/ath/if_athvar.h	2007-05-21 07:45:37.720179024 +0200
+@@ -684,6 +684,14 @@
 #endif
 	u_int sc_slottimeconf;			/* manual override for slottime */
 	int16_t sc_channoise; 			/* Measured noise of current channel (dBm) */
--- a/package/madwifi/patches/200-no_debug.patch
+++ b/package/madwifi/patches/200-no_debug.patch
@ -34,11 +34,11 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath_rate/amrr/amrr.c madwifi-ng
 diff -urN madwifi-ng-refcount-r2313-20070505.old/ath_rate/minstrel/minstrel.c madwifi-ng-refcount-r2313-20070505.dev/ath_rate/minstrel/minstrel.c
 --- madwifi-ng-refcount-r2313-20070505.old/ath_rate/minstrel/minstrel.c	2007-05-13 18:17:55.605115776 +0200
 +++ madwifi-ng-refcount-r2313-20070505.dev/ath_rate/minstrel/minstrel.c	2007-05-13 18:17:56.458985968 +0200
-@@ -117,7 +117,7 @@
+@@ -116,7 +116,7 @@
+ 
 #include "minstrel.h"
 
- /* XXX: Use standard debug functions */
-#define	MINSTREL_DEBUG 10
+-#define	MINSTREL_DEBUG 
 +#undef	MINSTREL_DEBUG 
 #ifdef MINSTREL_DEBUG
 enum {
@ -104,16 +104,14 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_proto.h madw
 diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_var.h madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_var.h
 --- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_var.h	2007-05-13 18:17:56.107039472 +0200
 +++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_var.h	2007-05-13 18:17:56.461985512 +0200
-@@ -35,8 +35,8 @@
- #ifndef _NET80211_IEEE80211_VAR_H_
- #define _NET80211_IEEE80211_VAR_H_
- 
+@@ -37,7 +37,7 @@
+ /*
+  * Definitions for IEEE 802.11 drivers.
+  */
 -#define	IEEE80211_DEBUG
-#define	IEEE80211_DEBUG_REFCNT			/* Node reference count debugging */
 +#undef	IEEE80211_DEBUG
-+#undef	IEEE80211_DEBUG_REFCNT			/* Node reference count debugging */
+ #undef	IEEE80211_DEBUG_REFCNT			/* node refcnt stuff */
 
- /* Definitions for IEEE 802.11 drivers. */
 #include <net80211/ieee80211_linux.h>
 diff -urN madwifi-ng-refcount-r2313-20070505.old/tools/do_multi.c madwifi-ng-refcount-r2313-20070505.dev/tools/do_multi.c
 --- madwifi-ng-refcount-r2313-20070505.old/tools/do_multi.c	2007-05-13 18:17:55.192178552 +0200
--- a/package/madwifi/patches/300-napi_polling.patch
+++ b/package/madwifi/patches/300-napi_polling.patch
@ -1,7 +1,7 @@
-diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcount-r2313-20070505.dev/ath/if_ath.c
--- madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c	2007-05-13 18:17:56.576968032 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/ath/if_ath.c	2007-05-13 18:17:56.594965296 +0200
-@@ -170,7 +170,7 @@
+diff -ur madwifi.old/ath/if_ath.c madwifi.dev/ath/if_ath.c
+--- madwifi.old/ath/if_ath.c	2007-05-21 07:49:54.571131744 +0200
+++ madwifi.dev/ath/if_ath.c	2007-05-21 07:51:40.208072488 +0200
+@@ -167,7 +167,7 @@
 	int, u_int32_t);
 static void ath_setdefantenna(struct ath_softc *, u_int);
 static struct ath_txq *ath_txq_setup(struct ath_softc *, int, int);
@ -10,7 +10,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 static int ath_hardstart(struct sk_buff *, struct net_device *);
 static int ath_mgtstart(struct ieee80211com *, struct sk_buff *);
 #ifdef ATH_SUPERG_COMP
-@@ -420,7 +420,6 @@
+@@ -417,7 +417,6 @@
 	ATH_TXBUF_LOCK_INIT(sc);
 	ATH_RXBUF_LOCK_INIT(sc);
 
@ -18,7 +18,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	ATH_INIT_TQUEUE(&sc->sc_txtq,	  ath_tx_tasklet,	dev);
 	ATH_INIT_TQUEUE(&sc->sc_bmisstq,  ath_bmiss_tasklet,	dev);
 	ATH_INIT_TQUEUE(&sc->sc_bstucktq, ath_bstuck_tasklet,	dev);
-@@ -674,6 +673,8 @@
+@@ -665,6 +664,8 @@
 	dev->set_mac_address = ath_set_mac_address;
  	dev->change_mtu = ath_change_mtu;
 	dev->tx_queue_len = ATH_TXBUF - 1;		/* 1 for mgmt frame */
@ -27,7 +27,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 #ifdef USE_HEADERLEN_RESV
 	dev->hard_header_len += sizeof(struct ieee80211_qosframe) +
 				sizeof(struct llc) +
-@@ -1645,6 +1646,7 @@
+@@ -1635,6 +1636,7 @@
 	 */
 	ath_hal_getisr(ah, &status);		/* NB: clears ISR too */
 	DPRINTF(sc, ATH_DEBUG_INTR, "%s: status 0x%x\n", __func__, status);
@ -35,7 +35,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	status &= sc->sc_imask;			/* discard unasked for bits */
 	if (status & HAL_INT_FATAL) {
 		sc->sc_stats.ast_hardware++;
-@@ -1684,7 +1686,12 @@
+@@ -1674,7 +1676,12 @@
 			 * might take too long to fire */
 			ath_hal_process_noisefloor(ah);
 			sc->sc_channoise = ath_hal_get_channel_noise(ah, &(sc->sc_curchan));
@ -49,7 +49,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 		}
 		if (status & HAL_INT_TX) {
 #ifdef ATH_SUPERG_DYNTURBO
-@@ -1710,6 +1717,11 @@
+@@ -1700,6 +1707,11 @@
 				}
 			} 
 #endif
@ -59,9 +59,9 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 +			sc->sc_imask &= ~HAL_INT_TX;
 +
 			ATH_SCHEDULE_TQUEUE(&sc->sc_txtq, &needmark);
- 			sc->sc_tx_start = 0;
 		}
-@@ -2221,12 +2233,13 @@
+ 		if (status & HAL_INT_BMISS) {
+@@ -2162,12 +2174,13 @@
 	 * Insert the frame on the outbound list and
 	 * pass it on to the hardware.
 	 */
@ -76,7 +76,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 		ath_hal_intrset(ah, sc->sc_imask & ~HAL_INT_SWBA);
 		ATH_TXQ_INSERT_TAIL(txq, bf, bf_list);
 		DPRINTF(sc, ATH_DEBUG_TX_PROC, "%s: txq depth = %d\n", __func__, txq->axq_depth);
-@@ -2242,6 +2255,7 @@
+@@ -2183,6 +2196,7 @@
 				ito64(bf->bf_daddr), bf->bf_desc);
 		}
 		txq->axq_link = &lastds->ds_link;
@ -84,8 +84,8 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 		ath_hal_intrset(ah, sc->sc_imask);
 	} else {
 		ATH_TXQ_INSERT_TAIL(txq, bf, bf_list);
-@@ -2275,7 +2289,7 @@
- 			sc->sc_tx_start = jiffies;
+@@ -2218,7 +2232,7 @@
+ 			}
 		}
 	}
 -	ATH_TXQ_UNLOCK(txq);
@ -93,7 +93,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 
 	sc->sc_devstats.tx_packets++;
 	sc->sc_devstats.tx_bytes += framelen;
-@@ -2426,8 +2440,14 @@
+@@ -2369,8 +2383,14 @@
 	unsigned int pktlen;
 	int framecnt;
 
@ -109,7 +109,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 
 		bf_ff = TAILQ_LAST(&txq->axq_stageq, axq_headtype);
 		if ((!bf_ff) || ath_ff_flushdonetest(txq, bf_ff)) {
-@@ -2441,7 +2461,7 @@
+@@ -2384,7 +2404,7 @@
 		ATH_NODE(ni)->an_tx_ffbuf[bf_ff->bf_skb->priority] = NULL;
 		TAILQ_REMOVE(&txq->axq_stageq, bf_ff, bf_stagelist);
 
@ -118,7 +118,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 
 		/* encap and xmit */
 		bf_ff->bf_skb = ieee80211_encap(ni, bf_ff->bf_skb, &framecnt);
-@@ -2462,15 +2482,16 @@
+@@ -2405,15 +2425,16 @@
 		}
 		bf_ff->bf_node = NULL;
 
@ -138,7 +138,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	bf = STAILQ_FIRST(&sc->sc_txbuf);				\
 	if (bf != NULL) {						\
 		STAILQ_REMOVE_HEAD(&sc->sc_txbuf, bf_list);		\
-@@ -2485,10 +2506,21 @@
+@@ -2428,11 +2449,23 @@
 		sc->sc_devstopped = 1;					\
 		ATH_SCHEDULE_TQUEUE(&sc->sc_txtq, NULL); 		\
 	}								\
@ -159,17 +159,11 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 			"%s: discard, no xmit buf\n", __func__);	\
 +	    ATH_TXQ_UNLOCK_BH(txq);					\
 		sc->sc_stats.ast_tx_nobuf++;				\
- 		goto hardstart_fail;					\
- 	}
-@@ -2490,6 +2490,7 @@
- 		DPRINTF(sc,ATH_DEBUG_XMIT,				\
- 			"%s: discard, no xmit buf\n", __func__);	\
- 		sc->sc_stats.ast_tx_nobuf++;				\
 +		goto hardstart_fail;					\
 	}
 
 /*
-@@ -2552,6 +2584,7 @@
+@@ -2494,6 +2527,7 @@
 	if (M_FLAG_GET(skb, M_UAPSD)) {
 		/* bypass FF handling */
 		ATH_HARDSTART_GET_TX_BUF_WITH_LOCK;
@ -177,7 +171,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 		if (bf == NULL)
 			goto hardstart_fail;
 		goto ff_bypass;
-@@ -2573,7 +2606,7 @@
+@@ -2515,7 +2549,7 @@
 	/* NB: use this lock to protect an->an_ff_txbuf in athff_can_aggregate()
 	 *     call too.
 	 */
@ -186,7 +180,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	if (athff_can_aggregate(sc, eh, an, skb, vap->iv_fragthreshold, &ff_flush)) {
 
 		if (an->an_tx_ffbuf[skb->priority]) { /* i.e., frame on the staging queue */
-@@ -2583,7 +2616,7 @@
+@@ -2525,7 +2559,7 @@
 			TAILQ_REMOVE(&txq->axq_stageq, bf, bf_stagelist);
 			an->an_tx_ffbuf[skb->priority] = NULL;
 
@ -195,7 +189,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 
 			/*
 			 * chain skbs and add FF magic
-@@ -2610,6 +2643,7 @@
+@@ -2552,6 +2586,7 @@
 			 *     to give the buffer back.
 			 */
 			ATH_HARDSTART_GET_TX_BUF_WITH_LOCK;
@ -203,7 +197,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 			if (bf == NULL) {
 				ATH_TXQ_UNLOCK(txq);
 				goto hardstart_fail;
-@@ -2624,7 +2658,7 @@
+@@ -2566,7 +2601,7 @@
 
 			TAILQ_INSERT_HEAD(&txq->axq_stageq, bf, bf_stagelist);
 
@ -212,7 +206,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 
 			return 0;
 		}
-@@ -2635,7 +2669,7 @@
+@@ -2577,7 +2612,7 @@
 			TAILQ_REMOVE(&txq->axq_stageq, bf_ff, bf_stagelist);
 			an->an_tx_ffbuf[skb->priority] = NULL;
 
@ -221,7 +215,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 
 			/* encap and xmit */
 			bf_ff->bf_skb = ieee80211_encap(ni, bf_ff->bf_skb, &framecnt);
-@@ -2665,9 +2699,9 @@
+@@ -2607,9 +2642,9 @@
 			}
 			bf_ff->bf_node = NULL;
 
@ -233,7 +227,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 			goto ff_flushdone;
 		}
 		/*
-@@ -2676,14 +2677,13 @@
+@@ -2619,14 +2654,13 @@
 		else if (an->an_tx_ffbuf[skb->priority]) {
 			DPRINTF(sc, ATH_DEBUG_XMIT | ATH_DEBUG_FF,
 				"%s: Out-Of-Order fast-frame\n", __func__);
@ -251,7 +245,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	}
 
 ff_bypass:
-@@ -2691,6 +2725,7 @@
+@@ -2634,6 +2668,7 @@
 #else /* ATH_SUPERG_FF */
 
 	ATH_HARDSTART_GET_TX_BUF_WITH_LOCK;
@ -259,7 +253,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 
 #endif /* ATH_SUPERG_FF */
 
-@@ -2712,7 +2747,7 @@
+@@ -2655,7 +2690,7 @@
 		 *  Allocate 1 ath_buf for each frame given 1 was 
 		 *  already alloc'd
 		 */
@ -268,7 +262,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 		for (bfcnt = 1; bfcnt < framecnt; ++bfcnt) {
 			if ((tbf = STAILQ_FIRST(&sc->sc_txbuf)) != NULL) {
 				STAILQ_REMOVE_HEAD(&sc->sc_txbuf, bf_list);
-@@ -2733,11 +2768,11 @@
+@@ -2676,11 +2711,11 @@
 					STAILQ_INSERT_TAIL(&sc->sc_txbuf, tbf, bf_list);
 				}
 			}
@ -282,7 +276,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 
 		while ((bf = STAILQ_FIRST(&bf_head)) != NULL && skb != NULL) {
 			unsigned int nextfraglen = 0;
-@@ -2773,7 +2808,7 @@
+@@ -2716,7 +2751,7 @@
 
 hardstart_fail:
 	if (!STAILQ_EMPTY(&bf_head)) {
@ -291,7 +285,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 		STAILQ_FOREACH_SAFE(tbf, &bf_head, bf_list, tempbf) {
 			tbf->bf_skb = NULL;
 			tbf->bf_node = NULL;
-@@ -2783,7 +2818,7 @@
+@@ -2726,7 +2761,7 @@
 
 			STAILQ_INSERT_TAIL(&sc->sc_txbuf, tbf, bf_list);
 		}
@ -300,7 +294,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	}
 
 	/* free sk_buffs */
-@@ -2826,7 +2861,7 @@
+@@ -2769,7 +2804,7 @@
 	/*
 	 * Grab a TX buffer and associated resources.
 	 */
@ -309,7 +303,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	bf = STAILQ_FIRST(&sc->sc_txbuf);
 	if (bf != NULL)
 		STAILQ_REMOVE_HEAD(&sc->sc_txbuf, bf_list);
-@@ -2837,7 +2872,7 @@
+@@ -2780,7 +2815,7 @@
 		sc->sc_devstopped=1;
 		ATH_SCHEDULE_TQUEUE(&sc->sc_txtq, NULL);
 	}
@ -318,7 +312,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	if (bf == NULL) {
 		printk("ath_mgtstart: discard, no xmit buf\n");
 		sc->sc_stats.ast_tx_nobufmgt++;
-@@ -2866,9 +2901,9 @@
+@@ -2809,9 +2844,9 @@
 		bf->bf_skb = NULL;
 		bf->bf_node = NULL;
 
@ -330,7 +324,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	}
 	dev_kfree_skb_any(skb);
 	skb = NULL;
-@@ -3336,10 +3371,10 @@
+@@ -3279,10 +3314,10 @@
 	 *
 	 * XXX Using in_softirq is not right since we might
 	 * be called from other soft irq contexts than
@ -343,7 +337,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	netif_stop_queue(dev);
 }
 
-@@ -3352,7 +3387,7 @@
+@@ -3295,7 +3330,7 @@
 	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s:\n", __func__);
 	netif_start_queue(dev);
 	if (!in_softirq())		/* NB: see above */
@ -352,7 +346,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 }
 
 /*
-@@ -4912,9 +4947,9 @@
+@@ -4861,9 +4896,9 @@
 		bf->bf_node = NULL;
 		bf->bf_desc->ds_link = 0;
 		
@ -364,7 +358,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 
 		an->an_uapsd_overflowqdepth--;
 	}
-@@ -5585,13 +5620,12 @@
+@@ -5542,13 +5577,12 @@
 	sc->sc_rxotherant = 0;
 }
 
@ -380,7 +374,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	struct ath_buf *bf;
 	struct ath_softc *sc = dev->priv;
 	struct ieee80211com *ic = &sc->sc_ic;
-@@ -5602,11 +5636,15 @@
+@@ -5560,11 +5594,15 @@
 	unsigned int len;
 	int type;
 	u_int phyerr;
@ -396,7 +390,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	do {
 		bf = STAILQ_FIRST(&sc->sc_rxbuf);
 		if (bf == NULL) {		/* XXX ??? can this happen */
-@@ -5630,6 +5668,13 @@
+@@ -5588,6 +5626,13 @@
 			/* NB: never process the self-linked entry at the end */
 			break;
 		}
@ -410,15 +404,15 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 		skb = bf->bf_skb;
 		if (skb == NULL) {		/* XXX ??? can this happen */
 			printk("%s: no skbuff (%s)\n", dev->name, __func__);
-@@ -5668,6 +5668,7 @@
+@@ -5626,6 +5671,7 @@
 				sc->sc_stats.ast_rx_phyerr++;
- 				phyerr = ds->ds_rxstat.rs_phyerr & 0x1f;
+ 				phyerr = rs->rs_phyerr & 0x1f;
 				sc->sc_stats.ast_rx_phy[phyerr]++;
 +				goto rx_next;
 			}
- 			if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT) {
+ 			if (rs->rs_status & HAL_RXERR_DECRYPT) {
 				/*
-@@ -5878,6 +5923,25 @@
+@@ -5829,9 +5875,29 @@
 		STAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
 		ATH_RXBUF_UNLOCK_IRQ(sc);
 	} while (ath_rxbuf_init(sc, bf) == 0);
@ -444,15 +438,11 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	
 	/* rx signal state monitoring */
 	ath_hal_rxmonitor(ah, &sc->sc_halstats, &sc->sc_curchan);
-@@ -5885,6 +5949,7 @@
- 		sc->sc_rtasksched = 1;
- 		schedule_work(&sc->sc_radartask);
- 	}
 +	return early_stop;
 #undef PA2DESC
 }
 
-@@ -6160,22 +6225,22 @@
+@@ -6107,22 +6173,22 @@
 				}
 			}
 
@ -479,7 +469,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 
 			bf->bf_skbaddr = bus_map_single(sc->sc_bdev,
 				skb->data, skb->len, BUS_DMA_TODEVICE);
-@@ -6641,9 +6706,9 @@
+@@ -6588,9 +6654,9 @@
 		dev_kfree_skb(lastbuf->bf_skb);
 		lastbuf->bf_skb = NULL;
 		ieee80211_unref_node(&lastbuf->bf_node);
@ -491,7 +481,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 		
 		/*
 		 *  move oldest from overflow to delivery
-@@ -7462,9 +7527,6 @@
+@@ -7411,9 +7477,6 @@
 			if (sc->sc_reapcount > ATH_TXBUF_FREE_THRESHOLD) {
 				if (!sc->sc_dfswait)
 					netif_start_queue(sc->sc_dev);
@ -501,7 +491,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 				sc->sc_reapcount = 0;
 				sc->sc_devstopped = 0;
 			} else
-@@ -7499,11 +7561,22 @@
+@@ -7448,11 +7511,22 @@
 	struct net_device *dev = (struct net_device *)data;
 	struct ath_softc *sc = dev->priv;
 
@ -524,7 +514,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	netif_wake_queue(dev);
 
 	if (sc->sc_softled)
-@@ -7520,6 +7593,7 @@
+@@ -7469,6 +7543,7 @@
 	struct net_device *dev = (struct net_device *)data;
 	struct ath_softc *sc = dev->priv;
 
@ -532,7 +522,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	/*
 	 * Process each active queue.
 	 */
-@@ -7540,6 +7614,16 @@
+@@ -7489,6 +7564,16 @@
 	if (sc->sc_uapsdq && txqactive(sc->sc_ah, sc->sc_uapsdq->axq_qnum))
 		ath_tx_processq(sc, sc->sc_uapsdq);
 
@ -549,7 +539,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	netif_wake_queue(dev);
 
 	if (sc->sc_softled)
-@@ -7557,6 +7641,7 @@
+@@ -7506,6 +7591,7 @@
 	unsigned int i;
 
 	/* Process each active queue. */
@ -557,7 +547,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	for (i = 0; i < HAL_NUM_TX_QUEUES; i++)
 		if (ATH_TXQ_SETUP(sc, i) && txqactive(sc->sc_ah, i))
 			ath_tx_processq(sc, &sc->sc_txq[i]);
-@@ -7565,6 +7650,16 @@
+@@ -7514,6 +7600,16 @@
 		ath_tx_processq(sc, sc->sc_xrtxq);
 #endif
 
@ -574,7 +564,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	netif_wake_queue(dev);
 
 	if (sc->sc_softled)
-@@ -7662,6 +7663,7 @@
+@@ -7612,6 +7708,7 @@
 ath_draintxq(struct ath_softc *sc)
 {
 	struct ath_hal *ah = sc->sc_ah;
@ -582,7 +572,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	unsigned int i;
 
 	/* XXX return value */
-@@ -9221,9 +9316,9 @@
+@@ -9144,9 +9241,9 @@
 	dev->mtu = mtu;
 	if ((dev->flags & IFF_RUNNING) && !sc->sc_invalid) {
 		/* NB: the rx buffers may need to be reallocated */
@ -594,10 +584,10 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 	}
 	ATH_UNLOCK(sc);
 
-diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_athvar.h madwifi-ng-refcount-r2313-20070505.dev/ath/if_athvar.h
--- madwifi-ng-refcount-r2313-20070505.old/ath/if_athvar.h	2007-05-13 18:17:56.363000560 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/ath/if_athvar.h	2007-05-13 18:17:56.595965144 +0200
-@@ -47,6 +47,10 @@
+diff -ur madwifi.old/ath/if_athvar.h madwifi.dev/ath/if_athvar.h
+--- madwifi.old/ath/if_athvar.h	2007-05-21 07:49:54.563132960 +0200
+++ madwifi.dev/ath/if_athvar.h	2007-05-21 07:50:22.814838048 +0200
+@@ -48,6 +48,10 @@
 #include "if_athioctl.h"
 #include "net80211/ieee80211.h"		/* XXX for WME_NUM_AC */
 
@ -608,7 +598,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_athvar.h madwifi-ng-refc
 /*
  * Deduce if tasklets are available.  If not then
  * fall back to using the immediate work queue.
-@@ -477,8 +481,12 @@
+@@ -478,8 +482,12 @@
 #define	ATH_TXQ_LOCK_DESTROY(_tq)	
 #define	ATH_TXQ_LOCK(_tq)		spin_lock(&(_tq)->axq_lock)
 #define	ATH_TXQ_UNLOCK(_tq)		spin_unlock(&(_tq)->axq_lock)
@ -623,7 +613,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_athvar.h madwifi-ng-refc
 #define ATH_TXQ_LOCK_IRQ(_tq)		do {	\
 	unsigned long __axq_lockflags;		\
 	spin_lock_irqsave(&(_tq)->axq_lock, __axq_lockflags);
-@@ -627,7 +635,6 @@
+@@ -623,7 +631,6 @@
 	struct ath_buf *sc_rxbufcur;		/* current rx buffer */
 	u_int32_t *sc_rxlink;			/* link ptr in last RX desc */
 	spinlock_t sc_rxbuflock; 
@ -631,7 +621,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_athvar.h madwifi-ng-refc
 	struct ATH_TQ_STRUCT sc_rxorntq;	/* rxorn intr tasklet */
 	u_int8_t sc_defant;			/* current default antenna */
 	u_int8_t sc_rxotherant;			/* rx's on non-default antenna*/
-@@ -640,6 +647,7 @@
+@@ -636,6 +643,7 @@
 	u_int sc_txintrperiod;			/* tx interrupt batching */
 	struct ath_txq sc_txq[HAL_NUM_TX_QUEUES];
 	struct ath_txq *sc_ac2q[WME_NUM_AC];	/* WME AC -> h/w qnum */ 
@ -639,7 +629,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_athvar.h madwifi-ng-refc
 	struct ATH_TQ_STRUCT sc_txtq;		/* tx intr tasklet */
 	u_int8_t sc_grppoll_str[GRPPOLL_RATE_STR_LEN];  
 	struct ath_descdma sc_bdma;		/* beacon descriptors */
-@@ -706,8 +714,12 @@
+@@ -701,8 +709,12 @@
 #define	ATH_TXBUF_LOCK_DESTROY(_sc)
 #define	ATH_TXBUF_LOCK(_sc)		spin_lock(&(_sc)->sc_txbuflock)
 #define	ATH_TXBUF_UNLOCK(_sc)		spin_unlock(&(_sc)->sc_txbuflock)
@ -654,7 +644,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_athvar.h madwifi-ng-refc
 #define	ATH_TXBUF_LOCK_IRQ(_sc)		do {	\
 	unsigned long __txbuflockflags;		\
 	spin_lock_irqsave(&(_sc)->sc_txbuflock, __txbuflockflags);
-@@ -725,8 +737,12 @@
+@@ -720,8 +732,12 @@
 #define	ATH_RXBUF_LOCK_DESTROY(_sc)
 #define	ATH_RXBUF_LOCK(_sc)		spin_lock(&(_sc)->sc_rxbuflock)
 #define	ATH_RXBUF_UNLOCK(_sc)		spin_unlock(&(_sc)->sc_rxbuflock)
@ -669,7 +659,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_athvar.h madwifi-ng-refc
 #define	ATH_RXBUF_LOCK_IRQ(_sc)		do {	\
 	unsigned long __rxbuflockflags;		\
 	spin_lock_irqsave(&(_sc)->sc_rxbuflock, __rxbuflockflags);
-@@ -736,6 +752,8 @@
+@@ -731,6 +747,8 @@
 #define	ATH_RXBUF_UNLOCK_IRQ_EARLY(_sc)		\
 	spin_unlock_irqrestore(&(_sc)->sc_rxbuflock, __rxbuflockflags);
 
@ -678,9 +668,9 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_athvar.h madwifi-ng-refc
 
 /* Protects the device from concurrent accesses */
 #define	ATH_LOCK_INIT(_sc)		init_MUTEX(&(_sc)->sc_lock)
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_beacon.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_beacon.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_beacon.c	2007-01-30 05:01:29.000000000 +0100
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_beacon.c	2007-05-13 18:17:56.596964992 +0200
+diff -ur madwifi.old/net80211/ieee80211_beacon.c madwifi.dev/net80211/ieee80211_beacon.c
+--- madwifi.old/net80211/ieee80211_beacon.c	2007-01-31 11:41:05.000000000 +0100
+++ madwifi.dev/net80211/ieee80211_beacon.c	2007-05-21 07:50:22.815837896 +0200
@@ -286,7 +286,7 @@
 	int len_changed = 0;
 	u_int16_t capinfo;
@ -699,10 +689,10 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_beacon.c mad
 
 	return len_changed;
 }
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_input.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_input.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_input.c	2007-05-13 18:17:56.106039624 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_input.c	2007-05-13 18:17:56.597964840 +0200
-@@ -1148,8 +1148,9 @@
+diff -ur madwifi.old/net80211/ieee80211_input.c madwifi.dev/net80211/ieee80211_input.c
+--- madwifi.old/net80211/ieee80211_input.c	2007-05-21 07:49:54.527138432 +0200
+++ madwifi.dev/net80211/ieee80211_input.c	2007-05-21 07:50:22.816837744 +0200
+@@ -1155,8 +1155,9 @@
 		if (ni->ni_vlan != 0 && vap->iv_vlgrp != NULL) {
 			/* attach vlan tag */
 			vlan_hwaccel_receive_skb(skb, vap->iv_vlgrp, ni->ni_vlan);
@ -714,7 +704,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_input.c madw
 		dev->last_rx = jiffies;
 	}
 }
-@@ -3623,9 +3624,9 @@
+@@ -3657,9 +3658,9 @@
 	}
 
 	/* Okay, take the first queued packet and put it out... */
@ -726,9 +716,9 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_input.c madw
 	if (skb == NULL) {
 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_POWER, wh->i_addr2,
 			"%s", "recv ps-poll, but queue empty");
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_linux.h madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_linux.h
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_linux.h	2007-05-04 02:10:06.000000000 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_linux.h	2007-05-13 18:17:56.598964688 +0200
+diff -ur madwifi.old/net80211/ieee80211_linux.h madwifi.dev/net80211/ieee80211_linux.h
+--- madwifi.old/net80211/ieee80211_linux.h	2007-05-21 07:49:54.528138280 +0200
+++ madwifi.dev/net80211/ieee80211_linux.h	2007-05-21 07:50:22.817837592 +0200
@@ -31,6 +31,10 @@
 
 #include <linux/wireless.h>
@ -829,10 +819,10 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_linux.h madw
 
 #if (defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)) && defined(spin_is_locked)
 #define	ACL_LOCK_ASSERT(_as) \
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_node.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c	2007-05-13 18:17:56.273014240 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_node.c	2007-05-13 18:17:56.599964536 +0200
-@@ -1567,7 +1567,7 @@
+diff -ur madwifi.old/net80211/ieee80211_node.c madwifi.dev/net80211/ieee80211_node.c
+--- madwifi.old/net80211/ieee80211_node.c	2007-05-21 07:49:54.555134176 +0200
+++ madwifi.dev/net80211/ieee80211_node.c	2007-05-21 07:50:22.818837440 +0200
+@@ -1570,7 +1570,7 @@
 	struct ieee80211_node *ni;
 	u_int gen;
 
@ -841,7 +831,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c madwi
 	gen = ++nt->nt_scangen;
 	
 restart:
-@@ -1587,7 +1587,7 @@
+@@ -1590,7 +1590,7 @@
 	}
 	IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
 
@ -850,9 +840,9 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c madwi
 }
 EXPORT_SYMBOL(ieee80211_iterate_dev_nodes);
 
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_power.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_power.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_power.c	2007-04-25 22:29:55.000000000 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_power.c	2007-05-13 18:17:56.599964536 +0200
+diff -ur madwifi.old/net80211/ieee80211_power.c madwifi.dev/net80211/ieee80211_power.c
+--- madwifi.old/net80211/ieee80211_power.c	2007-05-21 07:49:54.532137672 +0200
+++ madwifi.dev/net80211/ieee80211_power.c	2007-05-21 07:50:22.818837440 +0200
@@ -147,7 +147,7 @@
 #endif
 		struct sk_buff *skb;
@ -901,7 +891,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_power.c madw
 		if (skb == NULL)
 			break;
 		/* 
-@@ -363,9 +363,9 @@
+@@ -361,9 +361,9 @@
 			for (;;) {
 				struct sk_buff *skb;
 
@ -913,9 +903,9 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_power.c madw
 				if (skb == NULL)
 					break;
 				ieee80211_parent_queue_xmit(skb);
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_proto.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_proto.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_proto.c	2007-05-13 18:17:56.578967728 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_proto.c	2007-05-13 18:17:56.600964384 +0200
+diff -ur madwifi.old/net80211/ieee80211_proto.c madwifi.dev/net80211/ieee80211_proto.c
+--- madwifi.old/net80211/ieee80211_proto.c	2007-05-21 07:49:54.574131288 +0200
+++ madwifi.dev/net80211/ieee80211_proto.c	2007-05-21 07:50:22.819837288 +0200
@@ -635,9 +635,9 @@
 {
 	struct ieee80211com *ic = vap->iv_ic;
@ -940,9 +930,9 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_proto.c madw
 	}
 }
 
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_scan_sta.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_scan_sta.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_scan_sta.c	2007-02-01 21:49:37.000000000 +0100
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_scan_sta.c	2007-05-13 18:17:56.601964232 +0200
+diff -ur madwifi.old/net80211/ieee80211_scan_sta.c madwifi.dev/net80211/ieee80211_scan_sta.c
+--- madwifi.old/net80211/ieee80211_scan_sta.c	2006-09-20 10:45:13.000000000 +0200
+++ madwifi.dev/net80211/ieee80211_scan_sta.c	2007-05-21 07:50:22.819837288 +0200
@@ -163,9 +163,11 @@
 {
 	struct sta_table *st = ss->ss_priv;
--- a/package/madwifi/patches/308-mlme_fix.patch
+++ b/package/madwifi/patches/308-mlme_fix.patch
@ -1,12 +0,0 @@
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_wireless.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_wireless.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_wireless.c	2007-05-13 18:17:56.109039168 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_wireless.c	2007-05-13 18:17:56.795934744 +0200
-@@ -3359,7 +3359,7 @@
- 				if (ieee80211_sta_join(vap, lookup.se))
- 					while (!vap->iv_nsdone)
- 						IEEE80211_RESCHEDULE();
-				if (vap->iv_nsparams.result)
-+				if (!vap->iv_nsparams.result)
- 					return 0;
- 			}
- 		}
--- a/package/madwifi/patches/309-micfail_detect.patch
+++ b/package/madwifi/patches/309-micfail_detect.patch
@ -1,7 +1,7 @@
-diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcount-r2313-20070505.dev/ath/if_ath.c
--- madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c	2007-05-13 18:17:56.785936264 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/ath/if_ath.c	2007-05-13 18:17:56.878922128 +0200
-@@ -5640,6 +5640,7 @@
+diff -ur madwifi.old/ath/if_ath.c madwifi.dev/ath/if_ath.c
+--- madwifi.old/ath/if_ath.c	2007-05-21 07:53:37.247279824 +0200
+++ madwifi.dev/ath/if_ath.c	2007-05-21 07:55:23.290158856 +0200
+@@ -5598,6 +5598,7 @@
 	u_int phyerr;
 	int processed = 0, early_stop = 0;
 	int rx_limit = dev->quota;
@ -9,16 +9,16 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 
 	/* Let the 802.11 layer know about the new noise floor */
 	ic->ic_channoise = sc->sc_channoise;
-@@ -5734,32 +5735,16 @@
+@@ -5692,31 +5693,16 @@
 			}
- 			if (ds->ds_rxstat.rs_status & HAL_RXERR_MIC) {
+ 			if (rs->rs_status & HAL_RXERR_MIC) {
 				sc->sc_stats.ast_rx_badmic++;
 -				/*
 -				 * Do minimal work required to hand off
 -				 * the 802.11 header for notification.
 -				 */
 -				/* XXX frag's and QoS frames */
-				len = ds->ds_rxstat.rs_datalen;
+-				len = rs->rs_datalen;
 -				if (len >= sizeof (struct ieee80211_frame)) {
 -					bus_dma_sync_single(sc->sc_bdev,
 -					    bf->bf_skbaddr, len,
@ -28,8 +28,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 -					ieee80211_notify_michael_failure(ic,
 -					    (struct ieee80211_frame *) skb->data,
 -					    sc->sc_splitmic ?
-					        ds->ds_rxstat.rs_keyix - 32 :
-					        ds->ds_rxstat.rs_keyix
+-					        rs->rs_keyix - 32 : rs->rs_keyix
 -					);
 -#endif
 -				}
@ -40,15 +39,15 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 			 * are operating in monitor mode.
 			 */
 -			if(sc->sc_nmonvaps == 0) goto rx_next;
-+			if ((ds->ds_rxstat.rs_status & ~HAL_RXERR_MIC) &&
-+				((ds->ds_rxstat.rs_status &~ HAL_RXERR_DECRYPT) ||
+			if ((rs->rs_status & ~HAL_RXERR_MIC) &&
+				((rs->rs_status &~ HAL_RXERR_DECRYPT) ||
 +			     (sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR)))
 +					goto rx_next;
 		}
 rx_accept:
 		/*
-@@ -5843,6 +5828,20 @@
- 				   ds->ds_rxstat.rs_rssi);
+@@ -5800,6 +5786,20 @@
+ 				   rs->rs_rssi);
 		}
 
 +		/* MIC failure. Drop the packet in any case */
@ -68,9 +67,9 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
 		/*
 		 * Locate the node for sender, track state, and then
 		 * pass the (referenced) node up to the 802.11 layer
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_crypto_ccmp.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_crypto_ccmp.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_crypto_ccmp.c	2007-04-13 07:53:25.000000000 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_crypto_ccmp.c	2007-05-13 18:17:56.879921976 +0200
+diff -ur madwifi.old/net80211/ieee80211_crypto_ccmp.c madwifi.dev/net80211/ieee80211_crypto_ccmp.c
+--- madwifi.old/net80211/ieee80211_crypto_ccmp.c	2007-05-18 13:19:16.000000000 +0200
+++ madwifi.dev/net80211/ieee80211_crypto_ccmp.c	2007-05-21 07:54:24.892036720 +0200
@@ -78,7 +78,7 @@
 static int ccmp_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
 static int ccmp_decap(struct ieee80211_key *, struct sk_buff *, int);
@ -89,9 +88,9 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_crypto_ccmp.
 {
 	return 1;
 }
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_crypto.h madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_crypto.h
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_crypto.h	2007-04-25 22:29:55.000000000 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_crypto.h	2007-05-13 18:17:56.880921824 +0200
+diff -ur madwifi.old/net80211/ieee80211_crypto.h madwifi.dev/net80211/ieee80211_crypto.h
+--- madwifi.old/net80211/ieee80211_crypto.h	2007-05-04 15:45:58.000000000 +0200
+++ madwifi.dev/net80211/ieee80211_crypto.h	2007-05-21 07:54:24.893036568 +0200
@@ -145,7 +145,7 @@
 	int (*ic_encap)(struct ieee80211_key *, struct sk_buff *, u_int8_t);
 	int (*ic_decap)(struct ieee80211_key *, struct sk_buff *, int);
@ -114,9 +113,9 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_crypto.h mad
 }
 
 /*
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_crypto_none.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_crypto_none.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_crypto_none.c	2006-09-20 10:45:13.000000000 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_crypto_none.c	2007-05-13 18:17:56.880921824 +0200
+diff -ur madwifi.old/net80211/ieee80211_crypto_none.c madwifi.dev/net80211/ieee80211_crypto_none.c
+--- madwifi.old/net80211/ieee80211_crypto_none.c	2006-09-20 10:45:13.000000000 +0200
+++ madwifi.dev/net80211/ieee80211_crypto_none.c	2007-05-21 07:54:24.893036568 +0200
@@ -52,7 +52,7 @@
 static int none_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
 static int none_decap(struct ieee80211_key *, struct sk_buff *, int);
@ -135,9 +134,9 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_crypto_none.
 {
 	struct ieee80211vap *vap = k->wk_private;
 
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_crypto_tkip.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_crypto_tkip.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_crypto_tkip.c	2007-01-30 04:51:52.000000000 +0100
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_crypto_tkip.c	2007-05-13 18:17:56.880921824 +0200
+diff -ur madwifi.old/net80211/ieee80211_crypto_tkip.c madwifi.dev/net80211/ieee80211_crypto_tkip.c
+--- madwifi.old/net80211/ieee80211_crypto_tkip.c	2007-05-18 13:19:16.000000000 +0200
+++ madwifi.dev/net80211/ieee80211_crypto_tkip.c	2007-05-21 07:54:24.893036568 +0200
@@ -57,7 +57,7 @@
 static int tkip_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
 static int tkip_enmic(struct ieee80211_key *, struct sk_buff *, int);
@ -165,9 +164,9 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_crypto_tkip.
 		struct ieee80211vap *vap = ctx->tc_vap;
 		u8 mic[IEEE80211_WEP_MICLEN];
 		u8 mic0[IEEE80211_WEP_MICLEN];
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_crypto_wep.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_crypto_wep.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_crypto_wep.c	2006-09-20 10:45:13.000000000 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_crypto_wep.c	2007-05-13 18:17:56.881921672 +0200
+diff -ur madwifi.old/net80211/ieee80211_crypto_wep.c madwifi.dev/net80211/ieee80211_crypto_wep.c
+--- madwifi.old/net80211/ieee80211_crypto_wep.c	2006-09-20 10:45:13.000000000 +0200
+++ madwifi.dev/net80211/ieee80211_crypto_wep.c	2007-05-21 07:54:24.894036416 +0200
@@ -54,7 +54,7 @@
 static int wep_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
 static int wep_decap(struct ieee80211_key *, struct sk_buff *, int);
@ -186,9 +185,9 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_crypto_wep.c
 {
 	return 1;
 }
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_input.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_input.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_input.c	2007-05-13 18:17:56.786936112 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_input.c	2007-05-13 18:17:56.883921368 +0200
+diff -ur madwifi.old/net80211/ieee80211_input.c madwifi.dev/net80211/ieee80211_input.c
+--- madwifi.old/net80211/ieee80211_input.c	2007-05-21 07:53:37.249279520 +0200
+++ madwifi.dev/net80211/ieee80211_input.c	2007-05-21 07:54:24.895036264 +0200
@@ -654,7 +654,7 @@
 		 * Next strip any MSDU crypto bits.
 		 */
@ -198,7 +197,7 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_input.c madw
 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 				ni->ni_macaddr, "data", "%s", "demic error");
 			IEEE80211_NODE_STAT(ni, rx_demicfail);
-@@ -3734,6 +3734,47 @@
+@@ -3778,6 +3778,47 @@
 }
 #endif
 
@ -246,10 +245,10 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_input.c madw
 #ifdef IEEE80211_DEBUG
 /*
  * Debugging support.
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_linux.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_linux.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_linux.c	2007-04-25 22:29:55.000000000 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_linux.c	2007-05-13 18:17:56.883921368 +0200
-@@ -309,8 +309,8 @@
+diff -ur madwifi.old/net80211/ieee80211_linux.c madwifi.dev/net80211/ieee80211_linux.c
+--- madwifi.old/net80211/ieee80211_linux.c	2007-05-21 07:49:54.528138280 +0200
+++ madwifi.dev/net80211/ieee80211_linux.c	2007-05-21 07:54:24.896036112 +0200
+@@ -311,8 +311,8 @@
 
 	/* TODO: needed parameters: count, keyid, key type, src address, TSC */
 	snprintf(buf, sizeof(buf), "%s(keyid=%d %scast addr=%s)", tag,
@ -260,9 +259,9 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_linux.c madw
 	memset(&wrqu, 0, sizeof(wrqu));
 	wrqu.data.length = strlen(buf);
 	wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
-diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_proto.h madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_proto.h
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_proto.h	2007-05-13 18:17:56.579967576 +0200
-+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_proto.h	2007-05-13 18:17:56.884921216 +0200
+diff -ur madwifi.old/net80211/ieee80211_proto.h madwifi.dev/net80211/ieee80211_proto.h
+--- madwifi.old/net80211/ieee80211_proto.h	2007-05-21 07:49:54.574131288 +0200
+++ madwifi.dev/net80211/ieee80211_proto.h	2007-05-21 07:54:24.896036112 +0200
@@ -91,6 +91,7 @@
 void ieee80211_set11gbasicrates(struct ieee80211_rateset *, enum ieee80211_phymode);
 enum ieee80211_phymode ieee80211_get11gbasicrates(struct ieee80211_rateset *);