From b3378a4f120657d96db891ce19ed6533f99d1f94 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@openwrt.org>
Date: Mon, 28 Jan 2008 18:34:06 +0000
Subject: [PATCH] update madwifi to latest trunk, include a few more
 fixes/improvements

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@10294 3c298f89-4303-0410-b956-a3cf2f4a3e73
---
 package/madwifi/Makefile                      |   8 +-
 .../madwifi/patches/300-napi_polling.patch    | 110 ++++++++--------
 package/madwifi/patches/305-pureg_fix.patch   |  44 +++----
 .../madwifi/patches/309-micfail_detect.patch  |  86 ++++++-------
 package/madwifi/patches/310-noise_get.patch   |  31 ++---
 package/madwifi/patches/312-erpupdate.patch   |  35 +++---
 .../patches/314-ap_bridge_multicast.patch     |  12 +-
 package/madwifi/patches/316-skb_checks.patch  |  16 +--
 .../madwifi/patches/319-no_queue_stop.patch   | 118 ------------------
 package/madwifi/patches/320-no_kzalloc.patch  |  16 +--
 ...d_code.patch => 321-nuke_weird_code.patch} |   8 +-
 .../madwifi/patches/322-dev_info_fixes.patch  |  36 ++++++
 .../madwifi/patches/323-dfs_optional.patch    |  42 +++++++
 package/madwifi/patches/324-alignment.patch   |  24 ++++
 .../madwifi/patches/325-channel_spam.patch    |  30 +++++
 package/madwifi/patches/326-soc_dma.patch     |  82 ++++++++++++
 16 files changed, 398 insertions(+), 300 deletions(-)
 delete mode 100644 package/madwifi/patches/319-no_queue_stop.patch
 rename package/madwifi/patches/{320-nuke_weird_code.patch => 321-nuke_weird_code.patch} (66%)
 create mode 100644 package/madwifi/patches/322-dev_info_fixes.patch
 create mode 100644 package/madwifi/patches/323-dfs_optional.patch
 create mode 100644 package/madwifi/patches/324-alignment.patch
 create mode 100644 package/madwifi/patches/325-channel_spam.patch
 create mode 100644 package/madwifi/patches/326-soc_dma.patch

diff --git a/package/madwifi/Makefile b/package/madwifi/Makefile
index ad7f5c9ba3..1cf9246372 100644
--- a/package/madwifi/Makefile
+++ b/package/madwifi/Makefile
@@ -10,18 +10,18 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=madwifi
-PKG_REV:=3252
+PKG_REV:=3280
 PKG_VERSION:=r$(PKG_REV)
-PKG_BRANCH:=madwifi-dfs
+# PKG_BRANCH:=madwifi-dfs
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=svn
 PKG_SOURCE_VERSION:=$(PKG_REV)
-PKG_SOURCE_SUBDIR:=$(if $(PKG_BRANCH),$(PKG_BRANCH),madwifi)-$(PKG_VERSION)
+PKG_SOURCE_SUBDIR:=$(if $(PKG_BRANCH),$(PKG_BRANCH),madwifi-trunk)-$(PKG_VERSION)
 PKG_SOURCE_URL:=http://svn.madwifi.org/madwifi/$(if $(PKG_BRANCH),branches/$(PKG_BRANCH),trunk)
 PKG_SOURCE:=$(PKG_SOURCE_SUBDIR).tar.gz
 
-PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(PKG_BRANCH)-$(PKG_VERSION)
+PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(if $(PKG_BRANCH),$(PKG_BRANCH),madwifi-trunk)-$(PKG_VERSION)
 
 include $(INCLUDE_DIR)/package.mk
 
diff --git a/package/madwifi/patches/300-napi_polling.patch b/package/madwifi/patches/300-napi_polling.patch
index f1799b4219..4feb3338ac 100644
--- a/package/madwifi/patches/300-napi_polling.patch
+++ b/package/madwifi/patches/300-napi_polling.patch
@@ -1,8 +1,8 @@
-Index: madwifi-dfs-r3246/ath/if_ath.c
+Index: madwifi-trunk-r3280/ath/if_ath.c
 ===================================================================
---- madwifi-dfs-r3246.orig/ath/if_ath.c	2008-01-25 16:28:31.352327279 +0100
-+++ madwifi-dfs-r3246/ath/if_ath.c	2008-01-25 16:30:04.921659489 +0100
-@@ -188,7 +188,7 @@
+--- madwifi-trunk-r3280.orig/ath/if_ath.c	2008-01-28 17:29:22.989895792 +0100
++++ madwifi-trunk-r3280/ath/if_ath.c	2008-01-28 17:46:59.249785581 +0100
+@@ -184,7 +184,7 @@
  	struct sk_buff *, int, int, u_int64_t);
  static void ath_setdefantenna(struct ath_softc *, u_int);
  static struct ath_txq *ath_txq_setup(struct ath_softc *, int, int);
@@ -11,7 +11,7 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  static int ath_hardstart(struct sk_buff *, struct net_device *);
  static int ath_mgtstart(struct ieee80211com *, struct sk_buff *);
  #ifdef ATH_SUPERG_COMP
-@@ -545,7 +545,6 @@
+@@ -542,7 +542,6 @@
  	ATH_TXBUF_LOCK_INIT(sc);
  	ATH_RXBUF_LOCK_INIT(sc);
  
@@ -19,7 +19,7 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  	ATH_INIT_TQUEUE(&sc->sc_txtq,	  ath_tx_tasklet,	dev);
  	ATH_INIT_TQUEUE(&sc->sc_bmisstq,  ath_bmiss_tasklet,	dev);
  	ATH_INIT_TQUEUE(&sc->sc_bstucktq, ath_bstuck_tasklet,	dev);
-@@ -822,6 +821,8 @@
+@@ -816,6 +815,8 @@
  	dev->set_mac_address = ath_set_mac_address;
  	dev->change_mtu = ath_change_mtu;
  	dev->tx_queue_len = ATH_TXBUF - ATH_TXBUF_MGT_RESERVED;
@@ -28,18 +28,18 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  #ifdef USE_HEADERLEN_RESV
  	dev->hard_header_len += sizeof(struct ieee80211_qosframe) +
  				sizeof(struct llc) +
-@@ -2233,6 +2234,7 @@
+@@ -2206,6 +2207,7 @@
  		(status & HAL_INT_GLOBAL)	? " HAL_INT_GLOBAL"	: ""
  		);
  
 +	sc->sc_isr = status;
  	status &= sc->sc_imask;			/* discard unasked for bits */
- 	if (status & HAL_INT_FATAL) {
- 		sc->sc_stats.ast_hardware++;
-@@ -2284,7 +2286,14 @@
+ 	/* As soon as we know we have a real interrupt we intend to service, 
+ 	 * we will check to see if we need an initial hardware TSF reading. 
+@@ -2263,7 +2265,14 @@
  		}
  		if (status & (HAL_INT_RX | HAL_INT_RXPHY)) {
- 			ath_uapsd_processtriggers(sc);
+ 			ath_uapsd_processtriggers(sc, hw_tsf);
 -			ATH_SCHEDULE_TQUEUE(&sc->sc_rxtq, &needmark);
 +			sc->sc_isr &= ~HAL_INT_RX;
 +			if (netif_rx_schedule_prep(dev)) {
@@ -52,7 +52,7 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  		}
  		if (status & HAL_INT_TX) {
  #ifdef ATH_SUPERG_DYNTURBO
-@@ -2310,6 +2319,11 @@
+@@ -2289,6 +2298,11 @@
  				}
  			}
  #endif
@@ -64,7 +64,7 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  			ATH_SCHEDULE_TQUEUE(&sc->sc_txtq, &needmark);
  		}
  		if (status & HAL_INT_BMISS) {
-@@ -4017,10 +4031,10 @@
+@@ -4011,10 +4025,10 @@
  	 *
  	 * XXX Using in_softirq is not right since we might
  	 * be called from other soft irq contexts than
@@ -77,16 +77,16 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  	netif_stop_queue(dev);
  }
  
-@@ -4033,7 +4047,7 @@
- 	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s:\n", __func__);
- 	netif_start_queue(dev);
+@@ -4027,7 +4041,7 @@
+ 	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "End\n");
+ 	netif_wake_queue(dev);
  	if (!in_softirq())		/* NB: see above */
 -		tasklet_enable(&sc->sc_rxtq);
 +		netif_poll_enable(dev);
  }
  
  /*
-@@ -6358,13 +6372,12 @@
+@@ -6329,13 +6343,12 @@
  	sc->sc_rxotherant = 0;
  }
  
@@ -102,19 +102,19 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  	struct ath_buf *bf;
  	struct ath_softc *sc = dev->priv;
  	struct ieee80211com *ic = &sc->sc_ic;
-@@ -6376,8 +6389,11 @@
+@@ -6347,8 +6360,11 @@
  	unsigned int len;
  	int type;
  	u_int phyerr;
 +	u_int processed = 0, early_stop = 0;
 +	u_int rx_limit = dev->quota;
  
- 	DPRINTF(sc, ATH_DEBUG_RX_PROC, "%s\n", __func__);
+ 	DPRINTF(sc, ATH_DEBUG_RX_PROC, "invoked\n");
 +process_rx_again:
  	do {
  		bf = STAILQ_FIRST(&sc->sc_rxbuf);
  		if (bf == NULL) {		/* XXX ??? can this happen */
-@@ -6401,6 +6417,13 @@
+@@ -6372,6 +6388,13 @@
  			/* NB: never process the self-linked entry at the end */
  			break;
  		}
@@ -127,8 +127,8 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
 +
  		skb = bf->bf_skb;
  		if (skb == NULL) {
- 			printk("%s: no skbuff (%s)\n", DEV_NAME(dev), __func__);
-@@ -6448,6 +6471,7 @@
+ 			EPRINTF(sc, "Dropping; buffer contains NULL skbuff.\n");
+@@ -6419,6 +6442,7 @@
  				sc->sc_stats.ast_rx_phyerr++;
  				phyerr = rs->rs_phyerr & 0x1f;
  				sc->sc_stats.ast_rx_phy[phyerr]++;
@@ -136,20 +136,22 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  			}
  			if (rs->rs_status & HAL_RXERR_DECRYPT) {
  				/*
-@@ -6658,9 +6682,33 @@
+@@ -6614,9 +6638,35 @@
  		STAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
  		ATH_RXBUF_UNLOCK_IRQ(sc);
  	} while (ath_rxbuf_init(sc, bf) == 0);
 +	if (!early_stop) {
++		unsigned long flags;
 +		/* Check if more data is received while we were
 +		 * processing the descriptor chain.
 +		 */
 +#ifndef ATH_PRECISE_TSF
-+		ATH_DISABLE_INTR();
++		local_irq_save(flags);
 +		if (sc->sc_isr & HAL_INT_RX) {
++			u_int64_t hw_tsf = ath_hal_gettsf64(ah);
 +			sc->sc_isr &= ~HAL_INT_RX;
-+			ATH_ENABLE_INTR();
-+			ath_uapsd_processtriggers(sc);
++			local_irq_restore(flags);
++			ath_uapsd_processtriggers(sc, hw_tsf);
 +			goto process_rx_again;
 +		}
 +#endif
@@ -158,7 +160,7 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
 +#ifndef ATH_PRECISE_TSF
 +		sc->sc_imask |= HAL_INT_RX;
 +		ath_hal_intrset(ah, sc->sc_imask);
-+		ATH_ENABLE_INTR();
++		local_irq_restore(flags);
 +#endif
 +	}
 +
@@ -170,7 +172,7 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  #undef PA2DESC
  }
  
-@@ -8308,11 +8356,22 @@
+@@ -8268,11 +8318,22 @@
  	struct net_device *dev = (struct net_device *)data;
  	struct ath_softc *sc = dev->priv;
  
@@ -193,7 +195,7 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  	netif_wake_queue(dev);
  
  	if (sc->sc_softled)
-@@ -8329,6 +8388,7 @@
+@@ -8289,6 +8350,7 @@
  	struct net_device *dev = (struct net_device *)data;
  	struct ath_softc *sc = dev->priv;
  
@@ -201,7 +203,7 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  	/*
  	 * Process each active queue.
  	 */
-@@ -8349,6 +8409,16 @@
+@@ -8309,6 +8371,16 @@
  	if (sc->sc_uapsdq && txqactive(sc->sc_ah, sc->sc_uapsdq->axq_qnum))
  		ath_tx_processq(sc, sc->sc_uapsdq);
  
@@ -218,7 +220,7 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  	netif_wake_queue(dev);
  
  	if (sc->sc_softled)
-@@ -8367,10 +8437,21 @@
+@@ -8327,10 +8399,21 @@
  
  	/* Process each active queue. This includes sc_cabq, sc_xrtq and
  	 * sc_uapsdq */
@@ -240,7 +242,7 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  	netif_wake_queue(dev);
  
  	if (sc->sc_softled)
-@@ -8445,6 +8526,7 @@
+@@ -8405,6 +8488,7 @@
  ath_draintxq(struct ath_softc *sc)
  {
  	struct ath_hal *ah = sc->sc_ah;
@@ -248,7 +250,7 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  	unsigned int i;
  
  	/* XXX return value */
-@@ -10310,9 +10392,9 @@
+@@ -10261,9 +10345,9 @@
  	dev->mtu = mtu;
  	if ((dev->flags & IFF_RUNNING) && !sc->sc_invalid) {
  		/* NB: the rx buffers may need to be reallocated */
@@ -260,10 +262,10 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  	}
  	ATH_UNLOCK(sc);
  
-Index: madwifi-dfs-r3246/ath/if_athvar.h
+Index: madwifi-trunk-r3280/ath/if_athvar.h
 ===================================================================
---- madwifi-dfs-r3246.orig/ath/if_athvar.h	2008-01-25 16:28:31.304324541 +0100
-+++ madwifi-dfs-r3246/ath/if_athvar.h	2008-01-25 16:28:36.740634339 +0100
+--- madwifi-trunk-r3280.orig/ath/if_athvar.h	2008-01-28 17:29:22.997896245 +0100
++++ madwifi-trunk-r3280/ath/if_athvar.h	2008-01-28 17:45:06.903383316 +0100
 @@ -50,6 +50,10 @@
  #include <asm/io.h>
  #include <linux/list.h>
@@ -300,11 +302,11 @@ Index: madwifi-dfs-r3246/ath/if_athvar.h
  
  #define	ATH_RXBUF_LOCK_INIT(_sc)	spin_lock_init(&(_sc)->sc_rxbuflock)
  #define	ATH_RXBUF_LOCK_DESTROY(_sc)
-Index: madwifi-dfs-r3246/net80211/ieee80211_input.c
+Index: madwifi-trunk-r3280/net80211/ieee80211_input.c
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_input.c	2008-01-25 16:27:28.000000000 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_input.c	2008-01-25 16:32:53.171247487 +0100
-@@ -1196,7 +1196,7 @@
+--- madwifi-trunk-r3280.orig/net80211/ieee80211_input.c	2008-01-28 17:29:23.005896702 +0100
++++ madwifi-trunk-r3280/net80211/ieee80211_input.c	2008-01-28 17:46:28.108010900 +0100
+@@ -1197,7 +1197,7 @@
  			/* attach vlan tag */
  			struct ieee80211_node *ni_tmp = SKB_CB(skb)->ni;
  			if (vlan_hwaccel_receive_skb(skb, vap->iv_vlgrp, ni->ni_vlan) == NET_RX_DROP) {
@@ -313,7 +315,7 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_input.c
  				 * device was too busy */
  				if (ni_tmp != NULL) {
  					/* node reference was leaked */
-@@ -1207,8 +1207,8 @@
+@@ -1208,8 +1208,8 @@
  			skb = NULL; /* SKB is no longer ours */
  		} else {
  			struct ieee80211_node *ni_tmp = SKB_CB(skb)->ni;
@@ -324,7 +326,7 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_input.c
  				 * device was too busy */
  				if (ni_tmp != NULL) {
  					/* node reference was leaked */
-@@ -2313,8 +2313,8 @@
+@@ -2314,8 +2314,8 @@
  		skb1->protocol = __constant_htons(0x0019);  /* ETH_P_80211_RAW */
  
  		ni_tmp = SKB_CB(skb1)->ni;
@@ -335,11 +337,11 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_input.c
  			 * device was too busy */
  			if (ni_tmp != NULL) {
  				/* node reference was leaked */
-Index: madwifi-dfs-r3246/net80211/ieee80211_monitor.c
+Index: madwifi-trunk-r3280/net80211/ieee80211_monitor.c
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_monitor.c	2008-01-25 16:27:28.000000000 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_monitor.c	2008-01-25 16:32:05.436527235 +0100
-@@ -586,8 +586,8 @@
+--- madwifi-trunk-r3280.orig/net80211/ieee80211_monitor.c	2008-01-28 17:29:23.013897159 +0100
++++ madwifi-trunk-r3280/net80211/ieee80211_monitor.c	2008-01-28 17:29:26.430091834 +0100
+@@ -584,8 +584,8 @@
  			skb1->protocol = 
  				__constant_htons(0x0019); /* ETH_P_80211_RAW */
  
@@ -350,10 +352,10 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_monitor.c
  				 * device was too busy, reclaim the ref. in 
  				 * the skb. */
  				if (SKB_CB(skb1)->ni != NULL)
-Index: madwifi-dfs-r3246/net80211/ieee80211_skb.c
+Index: madwifi-trunk-r3280/net80211/ieee80211_skb.c
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_skb.c	2008-01-25 16:31:47.167486151 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_skb.c	2008-01-25 16:31:55.695972162 +0100
+--- madwifi-trunk-r3280.orig/net80211/ieee80211_skb.c	2008-01-28 17:29:23.017897384 +0100
++++ madwifi-trunk-r3280/net80211/ieee80211_skb.c	2008-01-28 17:29:26.446092748 +0100
 @@ -73,7 +73,7 @@
  #undef dev_queue_xmit
  #undef kfree_skb
@@ -363,7 +365,7 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_skb.c
  #undef pskb_copy
  #undef skb_clone
  #undef skb_copy
-@@ -627,8 +627,8 @@
+@@ -638,8 +638,8 @@
  		grp, vlan_tag);
  }
  
@@ -374,7 +376,7 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_skb.c
  }
  
  struct sk_buff * alloc_skb_debug(unsigned int length, gfp_t gfp_mask,
-@@ -749,7 +749,7 @@
+@@ -760,7 +760,7 @@
  }
  
  EXPORT_SYMBOL(vlan_hwaccel_receive_skb_debug);
@@ -383,10 +385,10 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_skb.c
  EXPORT_SYMBOL(alloc_skb_debug);
  EXPORT_SYMBOL(dev_alloc_skb_debug);
  EXPORT_SYMBOL(skb_clone_debug);
-Index: madwifi-dfs-r3246/net80211/ieee80211_skb.h
+Index: madwifi-trunk-r3280/net80211/ieee80211_skb.h
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_skb.h	2008-01-25 16:31:20.845986170 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_skb.h	2008-01-25 16:31:36.982905763 +0100
+--- madwifi-trunk-r3280.orig/net80211/ieee80211_skb.h	2008-01-28 17:29:23.029898072 +0100
++++ madwifi-trunk-r3280/net80211/ieee80211_skb.h	2008-01-28 17:29:26.458093432 +0100
 @@ -116,7 +116,7 @@
  int  vlan_hwaccel_receive_skb_debug(struct sk_buff *skb, 
  				    struct vlan_group *grp, unsigned short vlan_tag, 
diff --git a/package/madwifi/patches/305-pureg_fix.patch b/package/madwifi/patches/305-pureg_fix.patch
index 05c54d052b..ff179b54a0 100644
--- a/package/madwifi/patches/305-pureg_fix.patch
+++ b/package/madwifi/patches/305-pureg_fix.patch
@@ -1,8 +1,8 @@
-Index: madwifi-dfs-r3246/ath/if_ath.c
+Index: madwifi-trunk-r3280/ath/if_ath.c
 ===================================================================
---- madwifi-dfs-r3246.orig/ath/if_ath.c	2008-01-25 16:30:04.921659489 +0100
-+++ madwifi-dfs-r3246/ath/if_ath.c	2008-01-25 16:33:11.528293596 +0100
-@@ -4086,7 +4086,9 @@
+--- madwifi-trunk-r3280.orig/ath/if_ath.c	2008-01-28 17:29:41.614957171 +0100
++++ madwifi-trunk-r3280/ath/if_ath.c	2008-01-28 17:29:54.895713998 +0100
+@@ -4080,7 +4080,9 @@
  		rfilt |= HAL_RX_FILTER_PROM;
  	if (ic->ic_opmode == IEEE80211_M_STA ||
  	    sc->sc_opmode == HAL_M_IBSS ||	/* NB: AHDEMO too */
@@ -13,10 +13,10 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  		rfilt |= HAL_RX_FILTER_BEACON;
  	if (sc->sc_nmonvaps > 0)
  		rfilt |= (HAL_RX_FILTER_CONTROL | HAL_RX_FILTER_BEACON |
-Index: madwifi-dfs-r3246/net80211/ieee80211_input.c
+Index: madwifi-trunk-r3280/net80211/ieee80211_input.c
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_input.c	2008-01-25 16:32:53.171247487 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_input.c	2008-01-25 16:35:46.341115878 +0100
+--- madwifi-trunk-r3280.orig/net80211/ieee80211_input.c	2008-01-28 17:29:26.378088873 +0100
++++ madwifi-trunk-r3280/net80211/ieee80211_input.c	2008-01-28 17:29:54.999719926 +0100
 @@ -346,11 +346,12 @@
  				bssid = wh->i_addr3;
  			}
@@ -53,7 +53,7 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_input.c
  			break;
  		case IEEE80211_M_WDS:
  			if (skb->len < sizeof(struct ieee80211_frame_addr4)) {
-@@ -3023,7 +3020,7 @@
+@@ -3058,7 +3055,7 @@
  	u_int8_t *frm, *efrm;
  	u_int8_t *ssid, *rates, *xrates, *suppchan, *wpa, *rsn, *wme, *ath;
  	u_int8_t rate;
@@ -62,7 +62,7 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_input.c
  	u_int8_t qosinfo;
  
  	if (ni_or_null == NULL)
-@@ -3053,11 +3050,15 @@
+@@ -3088,11 +3085,15 @@
  		 *    o station mode when associated (to collect state
  		 *      updates such as 802.11g slot time), or
  		 *    o adhoc mode (to discover neighbors)
@@ -79,7 +79,7 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_input.c
  			vap->iv_stats.is_rx_mgtdiscard++;
  			return;
  		}
-@@ -3140,6 +3141,7 @@
+@@ -3176,6 +3177,7 @@
  					break;
  				}
  				scan.erp = frm[2];
@@ -87,7 +87,7 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_input.c
  				break;
  			case IEEE80211_ELEMID_RSN:
  				scan.rsn = frm;
-@@ -3357,6 +3359,20 @@
+@@ -3413,6 +3415,20 @@
  				ieee80211_bg_scan(vap);
  			return;
  		}
@@ -108,10 +108,10 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_input.c
  		/*
  		 * If scanning, just pass information to the scan module.
  		 */
-Index: madwifi-dfs-r3246/net80211/ieee80211_node.c
+Index: madwifi-trunk-r3280/net80211/ieee80211_node.c
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_node.c	2008-01-25 16:27:28.000000000 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_node.c	2008-01-25 16:33:11.540294282 +0100
+--- madwifi-trunk-r3280.orig/net80211/ieee80211_node.c	2008-01-28 17:27:08.000000000 +0100
++++ madwifi-trunk-r3280/net80211/ieee80211_node.c	2008-01-28 17:29:55.199731324 +0100
 @@ -383,10 +383,16 @@
  	/* Update country ie information */
  	ieee80211_build_countryie(ic);
@@ -131,10 +131,10 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_node.c
  
  	(void) ieee80211_sta_join1(PASS_NODE(ni));
  }
-Index: madwifi-dfs-r3246/net80211/ieee80211_proto.c
+Index: madwifi-trunk-r3280/net80211/ieee80211_proto.c
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_proto.c	2008-01-25 16:27:28.000000000 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_proto.c	2008-01-25 16:33:11.544294507 +0100
+--- madwifi-trunk-r3280.orig/net80211/ieee80211_proto.c	2008-01-28 17:27:08.000000000 +0100
++++ madwifi-trunk-r3280/net80211/ieee80211_proto.c	2008-01-28 17:29:55.299737023 +0100
 @@ -595,6 +595,28 @@
  	{ 4, { 2, 4, 11, 22 } },	/* IEEE80211_MODE_TURBO_G (mixed b/g) */
  };
@@ -164,14 +164,14 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_proto.c
  /*
   * Mark the basic rates for the 11g rate table based on the
   * specified mode.  For 11b compatibility we mark only 11b
-Index: madwifi-dfs-r3246/net80211/ieee80211_var.h
+Index: madwifi-trunk-r3280/net80211/ieee80211_var.h
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_var.h	2008-01-25 16:27:28.000000000 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_var.h	2008-01-25 16:33:11.548294736 +0100
-@@ -688,6 +688,7 @@
+--- madwifi-trunk-r3280.orig/net80211/ieee80211_var.h	2008-01-28 17:27:08.000000000 +0100
++++ madwifi-trunk-r3280/net80211/ieee80211_var.h	2008-01-28 17:30:20.585177966 +0100
+@@ -694,6 +694,7 @@
  void ieee80211_build_sc_ie(struct ieee80211com *);
  void ieee80211_dfs_action(struct ieee80211com *);
- void ieee80211_expire_channel_non_occupancy_restrictions(struct ieee80211com *);
+ void ieee80211_expire_channel_excl_restrictions(struct ieee80211com *);
 +void ieee80211_setpuregbasicrates(struct ieee80211_rateset *rs);
  
  /*
diff --git a/package/madwifi/patches/309-micfail_detect.patch b/package/madwifi/patches/309-micfail_detect.patch
index c1b6224425..1b4cf3b261 100644
--- a/package/madwifi/patches/309-micfail_detect.patch
+++ b/package/madwifi/patches/309-micfail_detect.patch
@@ -1,16 +1,16 @@
-Index: madwifi-dfs-r3246/ath/if_ath.c
+Index: madwifi-dfs-r3280/ath/if_ath.c
 ===================================================================
---- madwifi-dfs-r3246.orig/ath/if_ath.c	2008-01-25 16:33:11.528293596 +0100
-+++ madwifi-dfs-r3246/ath/if_ath.c	2008-01-25 16:36:40.024175098 +0100
-@@ -6393,6 +6393,7 @@
+--- madwifi-dfs-r3280.orig/ath/if_ath.c	2008-01-28 17:14:55.182157045 +0100
++++ madwifi-dfs-r3280/ath/if_ath.c	2008-01-28 17:15:04.876271620 +0100
+@@ -6379,6 +6379,7 @@
  	u_int phyerr;
  	u_int processed = 0, early_stop = 0;
  	u_int rx_limit = dev->quota;
 +	u_int mic_fail = 0;
  
- 	DPRINTF(sc, ATH_DEBUG_RX_PROC, "%s\n", __func__);
+ 	DPRINTF(sc, ATH_DEBUG_RX_PROC, "invoked\n");
  process_rx_again:
-@@ -6492,24 +6493,8 @@
+@@ -6478,24 +6479,8 @@
  			}
  			if (rs->rs_status & HAL_RXERR_MIC) {
  				sc->sc_stats.ast_rx_badmic++;
@@ -37,7 +37,7 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  			}
  			/*
  			 * Reject error frames if we have no vaps that
-@@ -6562,8 +6547,9 @@
+@@ -6534,8 +6519,9 @@
  		/*
  		 * Finished monitor mode handling, now reject
  		 * error frames before passing to other vaps
@@ -48,7 +48,7 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  			ieee80211_dev_kfree_skb(&skb);
  			goto rx_next;
  		}
-@@ -6571,6 +6557,26 @@
+@@ -6543,6 +6529,26 @@
  		/* remove the CRC */
  		skb_trim(skb, skb->len - IEEE80211_CRC_LEN);
  
@@ -75,7 +75,7 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  		/*
  		 * From this point on we assume the frame is at least
  		 * as large as ieee80211_frame_min; verify that.
-@@ -6583,6 +6589,7 @@
+@@ -6555,6 +6561,7 @@
  			goto rx_next;
  		}
  
@@ -83,10 +83,10 @@ Index: madwifi-dfs-r3246/ath/if_ath.c
  		/*
  		 * Normal receive.
  		 */
-Index: madwifi-dfs-r3246/net80211/ieee80211_crypto_ccmp.c
+Index: madwifi-dfs-r3280/net80211/ieee80211_crypto_ccmp.c
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_crypto_ccmp.c	2008-01-25 16:28:31.292323859 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_crypto_ccmp.c	2008-01-25 16:36:01.926004007 +0100
+--- madwifi-dfs-r3280.orig/net80211/ieee80211_crypto_ccmp.c	2008-01-28 17:14:16.203935804 +0100
++++ madwifi-dfs-r3280/net80211/ieee80211_crypto_ccmp.c	2008-01-28 17:15:04.916253895 +0100
 @@ -73,7 +73,7 @@
  static int ccmp_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  static int ccmp_decap(struct ieee80211_key *, struct sk_buff *, int);
@@ -105,10 +105,10 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_crypto_ccmp.c
  {
  	return 1;
  }
-Index: madwifi-dfs-r3246/net80211/ieee80211_crypto.h
+Index: madwifi-dfs-r3280/net80211/ieee80211_crypto.h
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_crypto.h	2008-01-25 16:27:28.000000000 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_crypto.h	2008-01-25 16:36:01.926004007 +0100
+--- madwifi-dfs-r3280.orig/net80211/ieee80211_crypto.h	2008-01-28 17:13:49.000000000 +0100
++++ madwifi-dfs-r3280/net80211/ieee80211_crypto.h	2008-01-28 17:15:05.116165297 +0100
 @@ -145,7 +145,7 @@
  	int (*ic_encap)(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  	int (*ic_decap)(struct ieee80211_key *, struct sk_buff *, int);
@@ -131,10 +131,10 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_crypto.h
  }
  
  /*
-Index: madwifi-dfs-r3246/net80211/ieee80211_crypto_none.c
+Index: madwifi-dfs-r3280/net80211/ieee80211_crypto_none.c
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_crypto_none.c	2008-01-25 16:27:28.000000000 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_crypto_none.c	2008-01-25 16:36:01.926004007 +0100
+--- madwifi-dfs-r3280.orig/net80211/ieee80211_crypto_none.c	2008-01-28 17:13:49.000000000 +0100
++++ madwifi-dfs-r3280/net80211/ieee80211_crypto_none.c	2008-01-28 17:15:05.316076693 +0100
 @@ -52,7 +52,7 @@
  static int none_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  static int none_decap(struct ieee80211_key *, struct sk_buff *, int);
@@ -153,10 +153,10 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_crypto_none.c
  {
  	struct ieee80211vap *vap = k->wk_private;
  
-Index: madwifi-dfs-r3246/net80211/ieee80211_crypto_tkip.c
+Index: madwifi-dfs-r3280/net80211/ieee80211_crypto_tkip.c
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_crypto_tkip.c	2008-01-25 16:27:28.000000000 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_crypto_tkip.c	2008-01-25 16:36:01.930004236 +0100
+--- madwifi-dfs-r3280.orig/net80211/ieee80211_crypto_tkip.c	2008-01-28 17:13:49.000000000 +0100
++++ madwifi-dfs-r3280/net80211/ieee80211_crypto_tkip.c	2008-01-28 17:15:05.519986320 +0100
 @@ -57,7 +57,7 @@
  static int tkip_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  static int tkip_enmic(struct ieee80211_key *, struct sk_buff *, int);
@@ -184,10 +184,10 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_crypto_tkip.c
  		struct ieee80211vap *vap = ctx->tc_vap;
  		u8 mic[IEEE80211_WEP_MICLEN];
  		u8 mic0[IEEE80211_WEP_MICLEN];
-Index: madwifi-dfs-r3246/net80211/ieee80211_crypto_wep.c
+Index: madwifi-dfs-r3280/net80211/ieee80211_crypto_wep.c
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_crypto_wep.c	2008-01-25 16:27:28.000000000 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_crypto_wep.c	2008-01-25 16:36:01.930004236 +0100
+--- madwifi-dfs-r3280.orig/net80211/ieee80211_crypto_wep.c	2008-01-28 17:13:49.000000000 +0100
++++ madwifi-dfs-r3280/net80211/ieee80211_crypto_wep.c	2008-01-28 17:15:05.731892402 +0100
 @@ -54,7 +54,7 @@
  static int wep_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  static int wep_decap(struct ieee80211_key *, struct sk_buff *, int);
@@ -206,10 +206,10 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_crypto_wep.c
  {
  	return 1;
  }
-Index: madwifi-dfs-r3246/net80211/ieee80211_input.c
+Index: madwifi-dfs-r3280/net80211/ieee80211_input.c
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_input.c	2008-01-25 16:35:46.341115878 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_input.c	2008-01-25 16:36:01.934004465 +0100
+--- madwifi-dfs-r3280.orig/net80211/ieee80211_input.c	2008-01-28 17:14:55.186157275 +0100
++++ madwifi-dfs-r3280/net80211/ieee80211_input.c	2008-01-28 17:15:05.831848102 +0100
 @@ -669,7 +669,7 @@
  		 * Next strip any MSDU crypto bits.
  		 */
@@ -219,7 +219,7 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_input.c
  			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  				ni->ni_macaddr, "data", "%s", "demic error");
  			IEEE80211_NODE_STAT(ni, rx_demicfail);
-@@ -4221,6 +4221,47 @@
+@@ -4222,6 +4222,47 @@
  }
  #endif
  
@@ -267,10 +267,10 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_input.c
  #ifdef IEEE80211_DEBUG
  /*
   * Debugging support.
-Index: madwifi-dfs-r3246/net80211/ieee80211_proto.h
+Index: madwifi-dfs-r3280/net80211/ieee80211_proto.h
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_proto.h	2008-01-25 16:27:28.000000000 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_proto.h	2008-01-25 16:36:01.934004465 +0100
+--- madwifi-dfs-r3280.orig/net80211/ieee80211_proto.h	2008-01-28 17:13:49.000000000 +0100
++++ madwifi-dfs-r3280/net80211/ieee80211_proto.h	2008-01-28 17:15:05.935802033 +0100
 @@ -90,6 +90,7 @@
  void ieee80211_set11gbasicrates(struct ieee80211_rateset *, enum ieee80211_phymode);
  enum ieee80211_phymode ieee80211_get11gbasicrates(struct ieee80211_rateset *);
@@ -279,25 +279,25 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_proto.h
  
  /*
   * Return the size of the 802.11 header for a management or data frame.
-Index: madwifi-dfs-r3246/net80211/ieee80211_linux.c
+Index: madwifi-dfs-r3280/net80211/ieee80211_linux.c
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_linux.c	2008-01-25 16:28:31.280323176 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_linux.c	2008-01-25 16:36:01.934004465 +0100
+--- madwifi-dfs-r3280.orig/net80211/ieee80211_linux.c	2008-01-28 17:14:16.091929418 +0100
++++ madwifi-dfs-r3280/net80211/ieee80211_linux.c	2008-01-28 17:18:40.397276522 +0100
 @@ -337,8 +337,8 @@
  	/* TODO: needed parameters: count, keyid, key type, src address, TSC */
- 	snprintf(buf, sizeof(buf), "%s(keyid=%d %scast addr=%s)", tag,
+ 	snprintf(buf, sizeof(buf), "%s(keyid=%d %scast addr=" MAC_FMT ")", tag,
  		k->wk_keyix,
 -		IEEE80211_IS_MULTICAST(wh->i_addr1) ?  "broad" : "uni",
--		ether_sprintf(wh->i_addr1));
+-		MAC_ADDR(wh->i_addr1));
 +		IEEE80211_IS_MULTICAST(wh->i_addr2) ?  "broad" : "uni",
-+		ether_sprintf(wh->i_addr2));
++		MAC_ADDR(wh->i_addr2));
  	memset(&wrqu, 0, sizeof(wrqu));
  	wrqu.data.length = strlen(buf);
  	wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
-Index: madwifi-dfs-r3246/net80211/ieee80211_output.c
+Index: madwifi-dfs-r3280/net80211/ieee80211_output.c
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_output.c	2008-01-25 16:27:28.000000000 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_output.c	2008-01-25 16:36:01.938004695 +0100
+--- madwifi-dfs-r3280.orig/net80211/ieee80211_output.c	2008-01-28 17:13:49.000000000 +0100
++++ madwifi-dfs-r3280/net80211/ieee80211_output.c	2008-01-28 17:15:06.247663812 +0100
 @@ -1083,13 +1083,16 @@
  			cip = (struct ieee80211_cipher *) key->wk_cipher;
  			ciphdrsize = cip->ic_header;
@@ -318,10 +318,10 @@ Index: madwifi-dfs-r3246/net80211/ieee80211_output.c
  
  		/*
  		 * Allocate sk_buff for each subsequent fragment; First fragment
-Index: madwifi-dfs-r3246/net80211/ieee80211_node.c
+Index: madwifi-dfs-r3280/net80211/ieee80211_node.c
 ===================================================================
---- madwifi-dfs-r3246.orig/net80211/ieee80211_node.c	2008-01-25 16:33:11.540294282 +0100
-+++ madwifi-dfs-r3246/net80211/ieee80211_node.c	2008-01-25 16:36:01.938004695 +0100
+--- madwifi-dfs-r3280.orig/net80211/ieee80211_node.c	2008-01-28 17:14:55.410170040 +0100
++++ madwifi-dfs-r3280/net80211/ieee80211_node.c	2008-01-28 17:15:06.351617734 +0100
 @@ -2259,11 +2259,13 @@
  	/* From this point onwards we can no longer find the node,
  	 * so no more references are generated
diff --git a/package/madwifi/patches/310-noise_get.patch b/package/madwifi/patches/310-noise_get.patch
index dec7217210..bbfd82dbb6 100644
--- a/package/madwifi/patches/310-noise_get.patch
+++ b/package/madwifi/patches/310-noise_get.patch
@@ -1,24 +1,25 @@
-Index: madwifi-dfs-r3053/ath/if_ath.c
+Index: madwifi-trunk-r3280/ath/if_ath.c
 ===================================================================
---- madwifi-dfs-r3053.orig/ath/if_ath.c	2007-12-13 05:25:14.210435274 +0100
-+++ madwifi-dfs-r3053/ath/if_ath.c	2007-12-13 05:25:14.558455106 +0100
-@@ -1648,7 +1648,6 @@
- 	/* XXXAPSD: build in check against max triggers we could see
- 	 *          based on ic->ic_uapsdmaxtriggers. */
- 	hw_tsf = ath_hal_gettsf64(ah);
+--- madwifi-trunk-r3280.orig/ath/if_ath.c	2008-01-28 17:30:33.325904012 +0100
++++ madwifi-trunk-r3280/ath/if_ath.c	2008-01-28 17:31:21.850243393 +0100
+@@ -1674,8 +1674,6 @@
+ 	 * get to reality.  This value is used in monitor mode and by tools like
+ 	 * Wireshark and Kismet.
+ 	 */
 -	ic->ic_channoise = ath_hal_get_channel_noise(ah, &(sc->sc_curchan));
- 
+-
  	ATH_RXBUF_LOCK_IRQ(sc);
  	if (sc->sc_rxbufcur == NULL)
-@@ -8815,6 +8814,7 @@
- 		if (ath_calinterval == ATH_LONG_CALINTERVAL)
- 			ath_calinterval = ATH_SHORT_CALINTERVAL;
+ 		sc->sc_rxbufcur = STAILQ_FIRST(&sc->sc_rxbuf);
+@@ -8868,6 +8866,7 @@
+ 			sc->sc_curchan.channel);
+ 		sc->sc_stats.ast_per_calfail++;
  	}
 +	ic->ic_channoise = ath_hal_get_channel_noise(ah, &(sc->sc_curchan));
  
- 	DPRINTF(sc, ATH_DEBUG_CALIBRATE, "%s: channel %u/%x -- IQ %s.\n",
- 		__func__, sc->sc_curchan.channel, sc->sc_curchan.channelFlags,
-@@ -8869,6 +8869,7 @@
+ 	ath_hal_process_noisefloor(ah);
+ 	if (isIQdone == AH_TRUE) {
+@@ -8936,6 +8935,7 @@
  	struct ath_softc *sc = dev->priv;
  
  	(void) ath_chan_set(sc, ic->ic_curchan);
@@ -26,7 +27,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  	/*
  	 * If we are returning to our bss channel then mark state
  	 * so the next recv'd beacon's TSF will be used to sync the
-@@ -9095,6 +9096,7 @@
+@@ -9204,6 +9204,7 @@
  		}
  
  		ath_hal_process_noisefloor(ah);
diff --git a/package/madwifi/patches/312-erpupdate.patch b/package/madwifi/patches/312-erpupdate.patch
index 8b8b3c7c29..162e2c36e3 100644
--- a/package/madwifi/patches/312-erpupdate.patch
+++ b/package/madwifi/patches/312-erpupdate.patch
@@ -1,24 +1,25 @@
-Index: madwifi-dfs-r3053/net80211/ieee80211_beacon.c
+Index: madwifi-trunk-r3280/net80211/ieee80211_beacon.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_beacon.c	2008-01-10 10:51:31.406580318 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_beacon.c	2008-01-10 10:56:54.040966203 +0100
-@@ -538,9 +538,9 @@
+--- madwifi-trunk-r3280.orig/net80211/ieee80211_beacon.c	2008-01-28 17:27:08.000000000 +0100
++++ madwifi-trunk-r3280/net80211/ieee80211_beacon.c	2008-01-28 17:32:30.587778482 +0100
+@@ -542,10 +542,10 @@
  			vap->iv_flags &= ~IEEE80211_F_XRUPDATE;
  		}
  #endif
--		if ((ic->ic_flags_ext & IEEE80211_FEXT_ERPUPDATE) && (bo->bo_erp != NULL)) {
-+		if ((vap->iv_flags_ext & IEEE80211_FEXT_ERPUPDATE) && (bo->bo_erp != NULL)) {
- 			(void) ieee80211_add_erp(bo->bo_erp, ic);
+-		if ((ic->ic_flags_ext & IEEE80211_FEXT_ERPUPDATE) && 
++		if ((vap->iv_flags_ext & IEEE80211_FEXT_ERPUPDATE) &&
+ 				(bo->bo_erp != NULL)) {
+ 			(void)ieee80211_add_erp(bo->bo_erp, ic);
 -			ic->ic_flags_ext &= ~IEEE80211_FEXT_ERPUPDATE;
 +			vap->iv_flags_ext &= ~IEEE80211_FEXT_ERPUPDATE;
  		}
  	}
  	/* if it is a mode change beacon for dynamic turbo case */
-Index: madwifi-dfs-r3053/net80211/ieee80211_input.c
+Index: madwifi-trunk-r3280/net80211/ieee80211_input.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_input.c	2008-01-10 10:51:31.558588981 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_input.c	2008-01-10 10:55:51.565405916 +0100
-@@ -3315,9 +3315,12 @@
+--- madwifi-trunk-r3280.orig/net80211/ieee80211_input.c	2008-01-28 17:30:33.905937066 +0100
++++ madwifi-trunk-r3280/net80211/ieee80211_input.c	2008-01-28 17:31:42.836941957 +0100
+@@ -3423,9 +3423,12 @@
  			/* Assume no ERP IE == 11b AP */
  			if ((!has_erp || (has_erp && (scan.erp & IEEE80211_ERP_NON_ERP_PRESENT))) &&
  				!(ic->ic_flags & IEEE80211_F_USEPROT)) {
@@ -32,11 +33,11 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_input.c
  			}
  		}
  
-Index: madwifi-dfs-r3053/net80211/ieee80211_node.c
+Index: madwifi-trunk-r3280/net80211/ieee80211_node.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_node.c	2008-01-10 10:51:31.622592626 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_node.c	2008-01-10 10:54:58.398376106 +0100
-@@ -1998,8 +1998,12 @@
+--- madwifi-trunk-r3280.orig/net80211/ieee80211_node.c	2008-01-28 17:30:34.525972400 +0100
++++ madwifi-trunk-r3280/net80211/ieee80211_node.c	2008-01-28 17:31:42.844938410 +0100
+@@ -2021,8 +2021,12 @@
  		}
  
  		/* Update ERP element if this is first non ERP station */
@@ -51,7 +52,7 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_node.c
  	} else
  		ni->ni_flags |= IEEE80211_NODE_ERP;
  }
-@@ -2202,6 +2206,8 @@
+@@ -2225,6 +2229,8 @@
  		IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
  			"non-ERP station leaves, count now %d", ic->ic_nonerpsta);
  		if (ic->ic_nonerpsta == 0) {
@@ -60,7 +61,7 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_node.c
  			IEEE80211_DPRINTF(vap, IEEE80211_MSG_ASSOC,
  				"%s: disable use of protection\n", __func__);
  			ic->ic_flags &= ~IEEE80211_F_USEPROT;
-@@ -2213,7 +2219,9 @@
+@@ -2236,7 +2242,9 @@
  				ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
  				ic->ic_flags &= ~IEEE80211_F_USEBARKER;
  			}
diff --git a/package/madwifi/patches/314-ap_bridge_multicast.patch b/package/madwifi/patches/314-ap_bridge_multicast.patch
index a57901bca3..3e2fc92944 100644
--- a/package/madwifi/patches/314-ap_bridge_multicast.patch
+++ b/package/madwifi/patches/314-ap_bridge_multicast.patch
@@ -1,14 +1,12 @@
-Index: madwifi-dfs-r3252/net80211/ieee80211_input.c
+Index: madwifi-trunk-r3280/net80211/ieee80211_input.c
 ===================================================================
---- madwifi-dfs-r3252.orig/net80211/ieee80211_input.c	2008-01-26 00:03:20.203760157 +0100
-+++ madwifi-dfs-r3252/net80211/ieee80211_input.c	2008-01-26 00:08:08.773799701 +0100
-@@ -1133,8 +1133,8 @@
- 
+--- madwifi-trunk-r3280.orig/net80211/ieee80211_input.c	2008-01-28 17:36:32.052771162 +0100
++++ madwifi-trunk-r3280/net80211/ieee80211_input.c	2008-01-28 17:36:55.186089457 +0100
+@@ -1135,7 +1135,7 @@
  		if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
+ 			/* Create a SKB for the BSS to send out. */
  			skb1 = skb_copy(skb, GFP_ATOMIC);
--			/* We duplicate the reference after skb_copy */
 -			ieee80211_skb_copy_noderef(skb, skb1);
-+			/* Use the BSS node for retransmitting this multicast frame */
 +			SKB_CB(skb1)->ni = ieee80211_ref_node(vap->iv_bss);
  		}
  		else {
diff --git a/package/madwifi/patches/316-skb_checks.patch b/package/madwifi/patches/316-skb_checks.patch
index de6d551e51..8457bc3dc0 100644
--- a/package/madwifi/patches/316-skb_checks.patch
+++ b/package/madwifi/patches/316-skb_checks.patch
@@ -1,7 +1,7 @@
-Index: madwifi-dfs-r3252/net80211/ieee80211_input.c
+Index: madwifi-trunk-r3280/net80211/ieee80211_input.c
 ===================================================================
---- madwifi-dfs-r3252.orig/net80211/ieee80211_input.c	2008-01-26 05:14:46.815962139 +0100
-+++ madwifi-dfs-r3252/net80211/ieee80211_input.c	2008-01-26 05:18:37.005079863 +0100
+--- madwifi-trunk-r3280.orig/net80211/ieee80211_input.c	2008-01-28 17:36:55.186089457 +0100
++++ madwifi-trunk-r3280/net80211/ieee80211_input.c	2008-01-28 17:38:42.816222949 +0100
 @@ -740,8 +740,10 @@
  
  			skb1 = skb_copy(skb, GFP_ATOMIC);
@@ -15,7 +15,7 @@ Index: madwifi-dfs-r3252/net80211/ieee80211_input.c
  
  			/* we now have 802.3 MAC hdr followed by 802.2 LLC/SNAP; convert to EthernetII.
  			 * Note that the frame is at least IEEE80211_MIN_LEN, due to the driver code. */
-@@ -1055,9 +1057,11 @@
+@@ -1056,9 +1058,11 @@
  				 * assemble fragments
  				 */
  				ni->ni_rxfrag = skb_copy(skb, GFP_ATOMIC);
@@ -30,7 +30,7 @@ Index: madwifi-dfs-r3252/net80211/ieee80211_input.c
  			}
  			/*
  			 * Check that we have enough space to hold
-@@ -1071,7 +1075,7 @@
+@@ -1072,7 +1076,7 @@
  					(skb_end_pointer(skb) - skb->head),
  					GFP_ATOMIC);
  				/* We duplicate the reference after skb_copy */
@@ -39,17 +39,17 @@ Index: madwifi-dfs-r3252/net80211/ieee80211_input.c
  					ieee80211_skb_copy_noderef(skb, ni->ni_rxfrag);
  				ieee80211_dev_kfree_skb(&skb);
  			}
-@@ -1134,7 +1138,8 @@
+@@ -1135,7 +1139,8 @@
  		if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
+ 			/* Create a SKB for the BSS to send out. */
  			skb1 = skb_copy(skb, GFP_ATOMIC);
- 			/* Use the BSS node for retransmitting this multicast frame */
 -			SKB_CB(skb1)->ni = ieee80211_ref_node(vap->iv_bss);
 +			if (skb1)
 +				SKB_CB(skb1)->ni = ieee80211_ref_node(vap->iv_bss);
  		}
  		else {
  			/*
-@@ -1277,6 +1282,9 @@
+@@ -1278,6 +1283,9 @@
  
  		/* XXX: does this always work? */
  		tskb = skb_copy(skb, GFP_ATOMIC);
diff --git a/package/madwifi/patches/319-no_queue_stop.patch b/package/madwifi/patches/319-no_queue_stop.patch
deleted file mode 100644
index a8df8e3c05..0000000000
--- a/package/madwifi/patches/319-no_queue_stop.patch
+++ /dev/null
@@ -1,118 +0,0 @@
-Index: madwifi-dfs-r3252/ath/if_ath.c
-===================================================================
---- madwifi-dfs-r3252.orig/ath/if_ath.c	2008-01-26 06:36:36.889082972 +0100
-+++ madwifi-dfs-r3252/ath/if_ath.c	2008-01-26 06:41:35.670109540 +0100
-@@ -3082,46 +3082,44 @@
- {
- 	struct ath_buf* bf = NULL;
- 	ATH_TXBUF_LOCK_ASSERT(sc);
-+
- 	/* Reserve at least ATH_TXBUF_MGT_RESERVED buffers for management frames */
--	if (ath_get_buffers_available() <= ATH_TXBUF_MGT_RESERVED) {
-+	if (!for_management && (ath_get_buffers_available() <= ATH_TXBUF_MGT_RESERVED)) {
- 		/* Stop the queue, we are full */
- 		DPRINTF(sc, ATH_DEBUG_XMIT, "%s: stopping queuing of additional "
- 					    "frames.  Insufficient free "
- 					    "buffers.\n", __func__);
- 		sc->sc_stats.ast_tx_qstop++;
--		netif_stop_queue(sc->sc_dev);
--		sc->sc_devstopped = 1;
- 		ATH_SCHEDULE_TQUEUE(&sc->sc_txtq, NULL);
-+		return NULL;
- 	}
- 
- 	/* Only let us go further if management frame, or there are enough */
--	if (for_management || (ath_get_buffers_available() > ATH_TXBUF_MGT_RESERVED)) {
--		bf = STAILQ_FIRST(&sc->sc_txbuf);
--		if (bf) {
--			STAILQ_REMOVE_HEAD(&sc->sc_txbuf, bf_list);
--			/* This should be redundant, unless someone illegally 
--			 * accessed the buffer after returning it. */
-+	bf = STAILQ_FIRST(&sc->sc_txbuf);
-+	if (bf) {
-+		STAILQ_REMOVE_HEAD(&sc->sc_txbuf, bf_list);
-+		/* This should be redundant, unless someone illegally 
-+		 * accessed the buffer after returning it. */
- #ifdef IEEE80211_DEBUG_REFCNT
--			cleanup_ath_buf_debug(sc, bf, BUS_DMA_TODEVICE, func, line);
-+		cleanup_ath_buf_debug(sc, bf, BUS_DMA_TODEVICE, func, line);
- #else
--			cleanup_ath_buf(sc, bf, BUS_DMA_TODEVICE);
-+		cleanup_ath_buf(sc, bf, BUS_DMA_TODEVICE);
- #endif
--			atomic_inc(&ath_buf_counter);
-+		atomic_inc(&ath_buf_counter);
- #ifdef IEEE80211_DEBUG_REFCNT
--			DPRINTF(sc, ATH_DEBUG_TXBUF, 
--				"[TXBUF=%03d/%03d] %s:%d -> %s:%d took txbuf %p.\n", 
--				ath_get_buffer_count(), ATH_TXBUF,
--				func, line, __func__, __LINE__,
--				bf);
-+		DPRINTF(sc, ATH_DEBUG_TXBUF, 
-+			"[TXBUF=%03d/%03d] %s:%d -> %s:%d took txbuf %p.\n", 
-+			ath_get_buffer_count(), ATH_TXBUF,
-+			func, line, __func__, __LINE__,
-+			bf);
- #endif
--		}
--		else {
--			DPRINTF(sc, ATH_DEBUG_ANY, 
--				"%s: discard %s, no xmit buffers available.\n", 
--				__func__,
--				for_management ? "management frame" : "frame");
--			sc->sc_stats.ast_tx_nobuf++;
--		}
-+	}
-+	else {
-+		DPRINTF(sc, ATH_DEBUG_ANY, 
-+			"%s: discard %s, no xmit buffers available.\n", 
-+			__func__,
-+			for_management ? "management frame" : "frame");
-+		sc->sc_stats.ast_tx_nobuf++;
- 	}
- 
- 	return bf;
-@@ -3503,9 +3501,6 @@
- 	/* Pass control of the skb to the caller (i.e., resources are their 
- 	 * problem). */
- 	if (requeue) {
--		/* queue is full, let the kernel backlog the skb */
--		netif_stop_queue(dev);
--		sc->sc_devstopped = 1;
- 		/* Stop tracking again we are giving it back*/
- 		ieee80211_skb_untrack(skb);
- 		return NETDEV_TX_BUSY;
-@@ -12871,21 +12866,6 @@
- 		ath_get_buffer_count(), ATH_TXBUF,
- 		func, line, __func__, __LINE__, bfaddr);
- #endif /* #ifdef IEEE80211_DEBUG_REFCNT */
--	if (sc->sc_devstopped) {
--		++sc->sc_reapcount;
--		if (sc->sc_reapcount > ATH_TXBUF_FREE_THRESHOLD) {
--			if (!ath_radio_silence_required_for_dfs(sc)) {
--				netif_start_queue(sc->sc_dev);
--				DPRINTF(sc, ATH_DEBUG_ANY,
--				    "%s: restarting queue.\n",
--				    __func__);
--			}
--			sc->sc_reapcount = 0;
--			sc->sc_devstopped = 0;
--		}
--		else if (!ath_radio_silence_required_for_dfs(sc))
--			ATH_SCHEDULE_TQUEUE(&sc->sc_txtq, NULL);
--	}
- 
- 	*bf = NULL;
- }
-Index: madwifi-dfs-r3252/ath/if_athvar.h
-===================================================================
---- madwifi-dfs-r3252.orig/ath/if_athvar.h	2008-01-26 06:41:42.206482027 +0100
-+++ madwifi-dfs-r3252/ath/if_athvar.h	2008-01-26 06:41:46.646735062 +0100
-@@ -667,7 +667,6 @@
- 	unsigned int	sc_xrgrppoll:1;		/* xr group polls are active */
- 	unsigned int	sc_syncbeacon:1;	/* sync/resync beacon timers */
- 	unsigned int	sc_hasclrkey:1;		/* CLR key supported */
--	unsigned int	sc_devstopped:1;	/* stopped due to of no tx bufs */
- 	unsigned int	sc_stagbeacons:1;	/* use staggered beacons */
- 	unsigned int	sc_dfswait:1;		/* waiting on channel for radar detect */
- 	unsigned int	sc_ackrate:1;		/* send acks at high bitrate */
diff --git a/package/madwifi/patches/320-no_kzalloc.patch b/package/madwifi/patches/320-no_kzalloc.patch
index 47fff71fb6..4c9f9868f7 100644
--- a/package/madwifi/patches/320-no_kzalloc.patch
+++ b/package/madwifi/patches/320-no_kzalloc.patch
@@ -1,8 +1,8 @@
-Index: madwifi-dfs-r3252/ath/if_ath.c
+Index: madwifi-dfs-r3280/ath/if_ath.c
 ===================================================================
---- madwifi-dfs-r3252.orig/ath/if_ath.c	2008-01-26 11:12:45.731030258 +0100
-+++ madwifi-dfs-r3252/ath/if_ath.c	2008-01-26 11:14:38.985484262 +0100
-@@ -529,7 +529,8 @@
+--- madwifi-dfs-r3280.orig/ath/if_ath.c	2008-01-28 17:18:52.497966105 +0100
++++ madwifi-dfs-r3280/ath/if_ath.c	2008-01-28 17:19:06.982791546 +0100
+@@ -526,7 +526,8 @@
  
  	/* Allocate space for dynamically determined maximum VAP count */
  	sc->sc_bslot = 
@@ -12,11 +12,11 @@ Index: madwifi-dfs-r3252/ath/if_ath.c
  
  	/*
  	 * Cache line size is used to size and align various
-Index: madwifi-dfs-r3252/ath/if_ath_radar.c
+Index: madwifi-dfs-r3280/ath/if_ath_radar.c
 ===================================================================
---- madwifi-dfs-r3252.orig/ath/if_ath_radar.c	2008-01-26 11:14:48.638034327 +0100
-+++ madwifi-dfs-r3252/ath/if_ath_radar.c	2008-01-26 11:15:36.740775546 +0100
-@@ -1556,9 +1556,11 @@
+--- madwifi-dfs-r3280.orig/ath/if_ath_radar.c	2008-01-28 17:14:16.411947654 +0100
++++ madwifi-dfs-r3280/ath/if_ath_radar.c	2008-01-28 17:19:07.290809101 +0100
+@@ -1539,9 +1539,11 @@
  
  	ath_rp_clear(sc);
  
diff --git a/package/madwifi/patches/320-nuke_weird_code.patch b/package/madwifi/patches/321-nuke_weird_code.patch
similarity index 66%
rename from package/madwifi/patches/320-nuke_weird_code.patch
rename to package/madwifi/patches/321-nuke_weird_code.patch
index 4d78e395e1..2469b4ddf8 100644
--- a/package/madwifi/patches/320-nuke_weird_code.patch
+++ b/package/madwifi/patches/321-nuke_weird_code.patch
@@ -1,8 +1,8 @@
-Index: madwifi-dfs-r3252/ath/if_ath.c
+Index: madwifi-dfs-r3280/ath/if_ath.c
 ===================================================================
---- madwifi-dfs-r3252.orig/ath/if_ath.c	2008-01-26 14:30:48.458906072 +0100
-+++ madwifi-dfs-r3252/ath/if_ath.c	2008-01-26 14:30:57.135400518 +0100
-@@ -3288,10 +3288,6 @@
+--- madwifi-dfs-r3280.orig/ath/if_ath.c	2008-01-28 17:19:06.982791546 +0100
++++ madwifi-dfs-r3280/ath/if_ath.c	2008-01-28 17:19:28.448014778 +0100
+@@ -3269,10 +3269,6 @@
  		/* If the clone works, bump the reference count for our copy. */
  		SKB_CB(skb)->ni = ieee80211_ref_node(SKB_CB(skb_orig)->ni);
  		ieee80211_dev_kfree_skb(&skb_orig);
diff --git a/package/madwifi/patches/322-dev_info_fixes.patch b/package/madwifi/patches/322-dev_info_fixes.patch
new file mode 100644
index 0000000000..9877362135
--- /dev/null
+++ b/package/madwifi/patches/322-dev_info_fixes.patch
@@ -0,0 +1,36 @@
+Index: madwifi-trunk-r3280/ath/if_ath_ahb.c
+===================================================================
+--- madwifi-trunk-r3280.orig/ath/if_ath_ahb.c	2008-01-28 17:51:21.800747500 +0100
++++ madwifi-trunk-r3280/ath/if_ath_ahb.c	2008-01-28 17:51:23.700855785 +0100
+@@ -31,6 +31,15 @@
+ #include "ah_devid.h"
+ #include "if_ath_ahb.h"
+ #include "ah_soc.h"
++/*
++ * Module glue.
++ */
++#include "release.h"
++static char *version = RELEASE_VERSION;
++static char *dev_info = "ath_ahb";
++
++#include <linux/ethtool.h>
++
+ 
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
+ #error "Kernel versions older than 2.6.19 are not supported!"
+@@ -303,15 +312,6 @@
+ 	.remove = ahb_wmac_remove
+ };
+ 
+-/*
+- * Module glue.
+- */
+-#include "release.h"
+-static char *version = RELEASE_VERSION;
+-static char *dev_info = "ath_ahb";
+-
+-#include <linux/ethtool.h>
+-
+ int
+ ath_ioctl_ethtool(struct ath_softc *sc, int cmd, void __user *addr)
+ {
diff --git a/package/madwifi/patches/323-dfs_optional.patch b/package/madwifi/patches/323-dfs_optional.patch
new file mode 100644
index 0000000000..4e3f0f6f8a
--- /dev/null
+++ b/package/madwifi/patches/323-dfs_optional.patch
@@ -0,0 +1,42 @@
+Index: madwifi-trunk-r3280/ath/if_ath.c
+===================================================================
+--- madwifi-trunk-r3280.orig/ath/if_ath.c	2008-01-28 18:17:03.786862678 +0100
++++ madwifi-trunk-r3280/ath/if_ath.c	2008-01-28 18:21:43.162783406 +0100
+@@ -1754,17 +1754,14 @@
+ 			 * may have occurred in the intervening timeframe. */
+ 			bf->bf_channoise = ic->ic_channoise;
+ 
+-			if (rs->rs_status) {
+-				if ((HAL_RXERR_PHY == rs->rs_status) &&
+-				    (HAL_PHYERR_RADAR ==
+-				     (rs->rs_phyerr & 0x1f)) &&
+-				    (0 == (bf->bf_status &
+-					   ATH_BUFSTATUS_RADAR_DONE))) {
+-					check_for_radar = 1;
+-				}
+-				/* Skip past the error now */
++			if ((HAL_RXERR_PHY == rs->rs_status) &&
++			    (HAL_PHYERR_RADAR == (rs->rs_phyerr & 0x1f)) &&
++			    (0 == (bf->bf_status & ATH_BUFSTATUS_RADAR_DONE)) &&
++			    (ic->ic_flags & IEEE80211_F_DOTH))
++				check_for_radar = 1;
++
++			if (rs->rs_status) /* Skip past the error now */
+ 				continue;
+-			}
+ 
+ 			/* Prepare wireless header for examination */
+ 			bus_dma_sync_single(sc->sc_bdev, bf->bf_skbaddr,
+Index: madwifi-trunk-r3280/ath/if_ath_radar.c
+===================================================================
+--- madwifi-trunk-r3280.orig/ath/if_ath_radar.c	2008-01-28 18:20:47.859631857 +0100
++++ madwifi-trunk-r3280/ath/if_ath_radar.c	2008-01-28 18:20:50.915806019 +0100
+@@ -265,7 +265,7 @@
+ 		unsigned int new_rxfilt = old_rxfilt;
+ 
+ 		ath_hal_intrset(ah, old_ier & ~HAL_INT_GLOBAL);
+-		if (required) {
++		if ((required) && (ic->ic_flags & IEEE80211_F_DOTH)) {
+ 			new_radar |= AR5K_PHY_RADAR_ENABLE;
+ 			new_filter |= AR5K_AR5212_PHY_ERR_FIL_RADAR;
+ 			new_rxfilt |= (HAL_RX_FILTER_PHYERR | 
diff --git a/package/madwifi/patches/324-alignment.patch b/package/madwifi/patches/324-alignment.patch
new file mode 100644
index 0000000000..108f0c6137
--- /dev/null
+++ b/package/madwifi/patches/324-alignment.patch
@@ -0,0 +1,24 @@
+Index: madwifi-trunk-r3280/net80211/ieee80211_input.c
+===================================================================
+--- madwifi-trunk-r3280.orig/net80211/ieee80211_input.c	2008-01-28 18:38:05.794780412 +0100
++++ madwifi-trunk-r3280/net80211/ieee80211_input.c	2008-01-28 18:38:21.835694529 +0100
+@@ -1279,17 +1279,8 @@
+ 		eh->ether_type = ether_type;
+ 
+ 	if (!ALIGNED_POINTER(skb->data + sizeof(*eh), u_int32_t)) {
+-		struct sk_buff *tskb;
+-
+-		/* XXX: does this always work? */
+-		tskb = skb_copy(skb, GFP_ATOMIC);
+-		if (!tskb)
+-			return skb;
+-
+-		/* We duplicate the reference after skb_copy */
+-		ieee80211_skb_copy_noderef(skb, tskb);
+-		ieee80211_dev_kfree_skb(&skb);
+-		skb = tskb;
++		memmove(skb->data - 2, skb->data, skb->len);
++		skb->data -= 2;
+ 	}
+ 	return skb;
+ }
diff --git a/package/madwifi/patches/325-channel_spam.patch b/package/madwifi/patches/325-channel_spam.patch
new file mode 100644
index 0000000000..b4b30040a5
--- /dev/null
+++ b/package/madwifi/patches/325-channel_spam.patch
@@ -0,0 +1,30 @@
+Index: madwifi-trunk-r3280/ath/if_ath.c
+===================================================================
+--- madwifi-trunk-r3280.orig/ath/if_ath.c	2008-01-28 19:00:13.666420256 +0100
++++ madwifi-trunk-r3280/ath/if_ath.c	2008-01-28 19:01:05.093350913 +0100
+@@ -9701,7 +9701,9 @@
+ 	/*
+ 	 * Convert HAL channels to ieee80211 ones.
+ 	 */
++#ifdef AR_DEBUG
+ 	IPRINTF(sc, "HAL returned %d channels.\n", nchan);
++#endif
+ 	for (i = 0; i < nchan; i++) {
+ 		HAL_CHANNEL *c = &chans[i];
+ 		struct ieee80211_channel *ichan = &ic->ic_channels[i];
+@@ -9728,6 +9730,7 @@
+ 		ic->ic_chan_non_occupy[i].tv_sec  = 0;
+ 		ic->ic_chan_non_occupy[i].tv_usec = 0;
+ 
++#ifdef AR_DEBUG
+ 		IPRINTF(sc, "Channel %3d (%4d MHz) Max Tx Power %d dBm%s "
+ 				"[%d hw %d reg] Flags%s%s%s%s%s%s%s%s%s%s%s%s%"
+ 				"s%s%s%s%s%s%s%s%s%s%s%s\n",
+@@ -9816,6 +9819,7 @@
+ 				(c->privFlags & 0x0080 ? 
+ 				 " PF & (1 << 7)" : "")
+ 				);
++#endif
+ 	}
+ 	ic->ic_nchans = nchan;
+ 	kfree(chans);
diff --git a/package/madwifi/patches/326-soc_dma.patch b/package/madwifi/patches/326-soc_dma.patch
new file mode 100644
index 0000000000..8ac6187a34
--- /dev/null
+++ b/package/madwifi/patches/326-soc_dma.patch
@@ -0,0 +1,82 @@
+Index: madwifi-trunk-r3280/ath/if_ath_ahb.c
+===================================================================
+--- madwifi-trunk-r3280.orig/ath/if_ath_ahb.c	2008-01-28 19:12:37.022826852 +0100
++++ madwifi-trunk-r3280/ath/if_ath_ahb.c	2008-01-28 19:31:09.184472483 +0100
+@@ -69,27 +69,13 @@
+ void *
+ bus_alloc_consistent(void *hwdev, size_t size, dma_addr_t *dma_handle)
+ {
+-	void *ret;
+-
+-	ret = (void *) __get_free_pages(GFP_ATOMIC, get_order(size));
+-
+-	if (ret != NULL) {
+-		memset(ret, 0, size);
+-		*dma_handle = __pa(ret);
+-		dma_cache_wback_inv((unsigned long) ret, size);
+-		ret = UNCAC_ADDR(ret);
+-	}
+-
+-	return ret;
++	return dma_alloc_coherent(hwdev, size, dma_handle, GFP_ATOMIC);
+ }
+ 
+ void
+ bus_free_consistent(void *hwdev, size_t size, void *vaddr, dma_addr_t dma_handle)
+ {
+-	unsigned long addr = (unsigned long) vaddr;
+-
+-	addr = CAC_ADDR(addr);
+-	free_pages(addr, get_order(size));
++	dma_free_coherent(hwdev, size, vaddr, dma_handle);
+ }
+ 
+ static int
+Index: madwifi-trunk-r3280/ath/if_ath_ahb.h
+===================================================================
+--- madwifi-trunk-r3280.orig/ath/if_ath_ahb.h	2008-01-28 19:20:06.016413537 +0100
++++ madwifi-trunk-r3280/ath/if_ath_ahb.h	2008-01-28 19:30:40.978865135 +0100
+@@ -89,8 +89,8 @@
+ #define AR531X_RADIO1_MASK	0x000c
+ #define AR531X_RADIO1_S		2
+ 
+-#define BUS_DMA_FROMDEVICE	0
+-#define BUS_DMA_TODEVICE	1
++#define BUS_DMA_FROMDEVICE	DMA_FROM_DEVICE
++#define BUS_DMA_TODEVICE	DMA_TO_DEVICE
+ 
+ #define AR531X_APBBASE		0xbc000000
+ #define AR531X_RESETTMR		(AR531X_APBBASE  + 0x3000)
+@@ -115,29 +115,19 @@
+ static __inline void bus_dma_sync_single(void *hwdev, dma_addr_t dma_handle,
+ 	size_t size, int direction)
+ {
+-	unsigned long addr;
+-
+-	addr = (unsigned long) __va(dma_handle);
+-	dma_cache_wback_inv(addr, size);
++	dma_sync_single(hwdev, dma_handle, size, direction);
+ }
+ 
+ static __inline dma_addr_t bus_map_single(void *hwdev, void *ptr,
+ 	size_t size, int direction)
+ {
+-	dma_cache_wback_inv((unsigned long) ptr, size);
+-
+-	return __pa(ptr);
++	return dma_map_single(hwdev, ptr, size, direction);
+ }
+ 
+ static __inline void bus_unmap_single(void *hwdev, dma_addr_t dma_addr,
+ 	size_t size, int direction)
+ {
+-	if (direction != BUS_DMA_TODEVICE) {
+-		unsigned long addr;
+-
+-		addr = (unsigned long)__va(dma_addr);
+-		dma_cache_wback_inv(addr, size);
+-	}
++	dma_unmap_single(hwdev, dma_addr, size, direction);
+ }
+ void *bus_alloc_consistent(void *, size_t, dma_addr_t *);
+ void bus_free_consistent(void *, size_t, void *, dma_addr_t);