diff --git a/package/madwifi/Makefile b/package/madwifi/Makefile
index 952da7e9fc..0815c52d3b 100644
--- a/package/madwifi/Makefile
+++ b/package/madwifi/Makefile
@@ -10,13 +10,13 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=madwifi
-PKG_VERSION:=r2834-20071106
+PKG_VERSION:=r2978-20071127
 PKG_BRANCH:=madwifi-ng
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_BRANCH)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=http://snapshots.madwifi.org/$(PKG_BRANCH)
-PKG_MD5SUM:=3de6b07146001b53bc45de5d3dd95bc2
+PKG_MD5SUM:=53d7e7c60caa4d613cf43763e33ce874
 
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(PKG_BRANCH)-$(PKG_VERSION)
 
diff --git a/package/madwifi/patches/112-keycache_PR_962.patch b/package/madwifi/patches/112-keycache_PR_962.patch
deleted file mode 100644
index 9d738b117f..0000000000
--- a/package/madwifi/patches/112-keycache_PR_962.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-Index: madwifi-ng-r2834-20071106/ath/if_ath.c
-===================================================================
---- madwifi-ng-r2834-20071106.orig/ath/if_ath.c	2007-11-07 14:02:00.957425434 +0100
-+++ madwifi-ng-r2834-20071106/ath/if_ath.c	2007-11-07 14:02:01.785472625 +0100
-@@ -5853,7 +5853,8 @@
- 		 * frame; it'll be dropped where it's not wanted.
- 		 */
- 		if (rs->rs_keyix != HAL_RXKEYIX_INVALID &&
--		    (ni = sc->sc_keyixmap[rs->rs_keyix]) != NULL) {
-+		    ((ni = sc->sc_keyixmap[rs->rs_keyix]) != NULL) &&
-+			ieee80211_check_rxnode(ni, (const struct ieee80211_frame_min *) skb->data)) {
- 			struct ath_node *an;
- 			/*
- 			 * Fast path: node is present in the key map;
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_node.c
-===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_node.c	2007-11-07 14:01:59.581347018 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_node.c	2007-11-07 14:02:01.789472851 +0100
-@@ -1290,8 +1290,6 @@
- 	IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
- 
- 	return ni;
--#undef IS_PSPOLL
--#undef IS_CTL
- }
- #ifdef IEEE80211_DEBUG_REFCNT
- EXPORT_SYMBOL(ieee80211_find_rxnode_debug);
-@@ -1299,6 +1297,20 @@
- EXPORT_SYMBOL(ieee80211_find_rxnode);
- #endif
- 
-+int
-+ieee80211_check_rxnode(struct ieee80211_node *ni,
-+	const struct ieee80211_frame_min *wh)
-+{
-+	if (IS_CTL(wh) && !IS_PSPOLL(wh) /*&& !IS_RTS(ah)*/)
-+		return IEEE80211_ADDR_EQ(ni->ni_macaddr, wh->i_addr1);
-+	else
-+		return IEEE80211_ADDR_EQ(ni->ni_macaddr, wh->i_addr2);
-+}
-+
-+EXPORT_SYMBOL(ieee80211_check_rxnode);
-+#undef IS_PSPOLL
-+#undef IS_CTL
-+
- /*
-  * Return a reference to the appropriate node for sending
-  * a data frame.  This handles node discovery in adhoc networks.
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_node.h
-===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_node.h	2007-11-07 14:01:59.589347473 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_node.h	2007-11-07 14:02:01.873477636 +0100
-@@ -328,6 +328,8 @@
- 	*pni = NULL;			/* guard against use */
- }
- 
-+int ieee80211_check_rxnode(struct ieee80211_node *ni,
-+	const struct ieee80211_frame_min *wh);
- int ieee80211_add_wds_addr(struct ieee80211_node_table *, struct ieee80211_node *,
- 	const u_int8_t *, u_int8_t);
- void ieee80211_remove_wds_addr(struct ieee80211_node_table *, const u_int8_t *);
diff --git a/package/madwifi/patches/121-ibss_hostap.patch b/package/madwifi/patches/121-ibss_hostap.patch
index bb0bbc044a..ba54521397 100644
--- a/package/madwifi/patches/121-ibss_hostap.patch
+++ b/package/madwifi/patches/121-ibss_hostap.patch
@@ -1,49 +1,46 @@
-Index: madwifi-ng-r2834-20071106/ath/if_ath.c
+Index: madwifi-ng-r2978-20071127/ath/if_ath.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/ath/if_ath.c	2007-11-07 14:02:02.637521177 +0100
-+++ madwifi-ng-r2834-20071106/ath/if_ath.c	2007-11-07 14:02:02.861533944 +0100
-@@ -409,7 +409,6 @@
-  * and use the next two bits as the index of the VAP.
+--- madwifi-ng-r2978-20071127.orig/ath/if_ath.c	2007-11-27 21:18:24.910671912 +0100
++++ madwifi-ng-r2978-20071127/ath/if_ath.c	2007-11-27 21:21:37.137626301 +0100
+@@ -515,7 +515,6 @@
   */
- #define ATH_SET_VAP_BSSID_MASK(bssid_mask)      ((bssid_mask)[0] &= ~(((ATH_BCBUF-1)<<2)|0x02))
+ #define ATH_SET_VAP_BSSID_MASK(bssid_mask)				\
+ 	((bssid_mask)[0] &= ~(((ATH_BCBUF-1) << 2) | 0x02))
 -#define ATH_GET_VAP_ID(bssid)                   ((bssid)[0] >> 2)
- #define ATH_SET_VAP_BSSID(bssid, id) \
- 		do { \
- 			if (id) \
-@@ -1059,9 +1058,12 @@
- 			ic_opmode = opmode;
- 		break;
+ #define ATH_SET_VAP_BSSID(bssid, id)					\
+ 		do {							\
+ 			if (id)						\
+@@ -1203,7 +1202,11 @@
  	case IEEE80211_M_IBSS:
--		if (sc->sc_nvaps != 0)		/* only one */
--			return NULL;
+ 		if ((sc->sc_nvaps != 0) && (ic->ic_opmode == IEEE80211_M_STA))
+ 			return NULL;
 -		ic_opmode = opmode;
-+		if (sc->sc_nvaps == 0)		/* only one */
++		else if (sc->sc_nvaps == 0)
 +			ic_opmode = opmode;
 +		else
 +			ic_opmode = IEEE80211_M_HOSTAP;
-+
 +		sc->sc_nibssvaps++;
  		break;
  	case IEEE80211_M_AHDEMO:
  	case IEEE80211_M_MONITOR:
-@@ -1091,7 +1093,7 @@
+@@ -1233,7 +1236,7 @@
  		return NULL;
  	}
  
 -	if (sc->sc_nvaps >= ATH_BCBUF) {
 +	if (sc->sc_nvaps + sc->sc_nibssvaps >= ATH_BCBUF) {
- 		printk(KERN_WARNING "too many virtual APs (already got %d)\n", sc->sc_nvaps);
+ 		printk(KERN_WARNING "too many virtual APs (already got %d)\n", 
+ 				sc->sc_nvaps);
  		return NULL;
- 	}
-@@ -1127,6 +1129,7 @@
- 	if (opmode == IEEE80211_M_MONITOR)
+@@ -1288,6 +1291,7 @@
+ 		/* Use RadioTAP interface type for monitor mode. */
  		dev->type = ARPHRD_IEEE80211_RADIOTAP;
  
 +	avp->av_bslot = -1;
- 	if ((flags & IEEE80211_CLONE_BSSID) &&
- 	    opmode != IEEE80211_M_WDS && sc->sc_hasbmask) {
+ 	if ((flags & IEEE80211_CLONE_BSSID) && sc->sc_hasbmask) {
  		struct ieee80211vap *v;
-@@ -1141,18 +1144,22 @@
+ 		unsigned int id_mask, id;
+@@ -1301,18 +1305,22 @@
  
  		/* do a full search to mark all the allocated VAPs */
  		id_mask = 0;
@@ -70,7 +67,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  	STAILQ_INIT(&avp->av_mcastq.axq_q);
  	ATH_TXQ_LOCK_INIT(&avp->av_mcastq);
  	if (opmode == IEEE80211_M_HOSTAP || opmode == IEEE80211_M_IBSS) {
-@@ -1162,33 +1169,14 @@
+@@ -1322,33 +1330,14 @@
  		 */
  		avp->av_bcbuf = STAILQ_FIRST(&sc->sc_bbuf);
  		STAILQ_REMOVE_HEAD(&sc->sc_bbuf, bf_list);
@@ -106,7 +103,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  			/*
  			 * Multiple VAPs are to transmit beacons and we
  			 * have h/w support for TSF adjusting; enable use
-@@ -1298,7 +1286,9 @@
+@@ -1460,7 +1449,9 @@
  			sc->sc_stagbeacons = 0;
  	}
  
@@ -117,7 +114,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  		sc->sc_nstavaps--;
  		sc->sc_nostabeacons = 0;
  	} else if (vap->iv_opmode == IEEE80211_M_MONITOR)
-@@ -3517,7 +3507,7 @@
+@@ -3816,7 +3807,7 @@
  	    sc->sc_opmode == HAL_M_IBSS ||	/* NB: AHDEMO too */
  	    (sc->sc_nostabeacons) || sc->sc_scanning)
  		rfilt |= HAL_RX_FILTER_BEACON;
@@ -126,8 +123,8 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  		rfilt |= (HAL_RX_FILTER_CONTROL | HAL_RX_FILTER_BEACON |
  			  HAL_RX_FILTER_PROBEREQ | HAL_RX_FILTER_PROM);
  	return rfilt;
-@@ -5953,12 +5943,20 @@
- 			type = ieee80211_input(ni, skb, rs->rs_rssi, rs_tsf);
+@@ -6284,12 +6275,20 @@
+ 			type = ieee80211_input(ni, skb, rs->rs_rssi, bf->bf_tsf);
  			ieee80211_unref_node(&ni);
  		} else {
 +			const struct ieee80211_frame_min *wh = (const struct ieee80211_frame_min *) skb->data;
@@ -149,10 +146,10 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  			if (ni != NULL) {
  				struct ath_node *an = ATH_NODE(ni);
  				ieee80211_keyix_t keyix;
-Index: madwifi-ng-r2834-20071106/ath/if_athvar.h
+Index: madwifi-ng-r2978-20071127/ath/if_athvar.h
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/ath/if_athvar.h	2007-11-07 14:01:59.457339950 +0100
-+++ madwifi-ng-r2834-20071106/ath/if_athvar.h	2007-11-07 14:02:02.861533944 +0100
+--- madwifi-ng-r2978-20071127.orig/ath/if_athvar.h	2007-11-27 21:18:08.257722921 +0100
++++ madwifi-ng-r2978-20071127/ath/if_athvar.h	2007-11-27 21:18:30.026963473 +0100
 @@ -209,7 +209,7 @@
  #define	ATH_RXBUF	40		/* number of RX buffers */
  #define	ATH_TXBUF	200		/* number of TX buffers */
@@ -162,7 +159,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_athvar.h
  
  /* free buffer threshold to restart net dev */
  #define	ATH_TXBUF_FREE_THRESHOLD  (ATH_TXBUF / 20)
-@@ -610,6 +610,7 @@
+@@ -667,6 +667,7 @@
  	u_int16_t sc_nvaps;			/* # of active virtual APs */
  	u_int8_t sc_nstavaps;			/* # of active station VAPs */
  	u_int8_t sc_nmonvaps;			/* # of monitor VAPs */
@@ -170,10 +167,10 @@ Index: madwifi-ng-r2834-20071106/ath/if_athvar.h
  	u_int8_t sc_nbcnvaps;			/* # of vaps sending beacons */
  	u_int sc_fftxqmin;			/* aggregation threshold */
  	HAL_INT sc_imask;			/* interrupt mask copy */
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_beacon.c
+Index: madwifi-ng-r2978-20071127/net80211/ieee80211_beacon.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_beacon.c	2007-11-07 14:01:59.461340176 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_beacon.c	2007-11-07 14:02:02.869534399 +0100
+--- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_beacon.c	2007-11-27 21:18:08.265723374 +0100
++++ madwifi-ng-r2978-20071127/net80211/ieee80211_beacon.c	2007-11-27 21:18:30.034963929 +0100
 @@ -111,7 +111,7 @@
  	bo->bo_tim = frm;
  
@@ -183,11 +180,11 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_beacon.c
  		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
  		*frm++ = 2;
  		*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_input.c
+Index: madwifi-ng-r2978-20071127/net80211/ieee80211_input.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_input.c	2007-11-07 14:01:59.469340634 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_input.c	2007-11-07 14:02:02.873534629 +0100
-@@ -2990,7 +2990,13 @@
+--- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_input.c	2007-11-27 21:18:08.269723596 +0100
++++ madwifi-ng-r2978-20071127/net80211/ieee80211_input.c	2007-11-27 21:18:30.038964155 +0100
+@@ -3069,7 +3069,13 @@
  			return;
  		}
  		if (ni == vap->iv_bss) {
@@ -202,7 +199,7 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_input.c
  				/*
  				 * XXX Cannot tell if the sender is operating
  				 * in ibss mode.  But we need a new node to
-@@ -2999,12 +3005,13 @@
+@@ -3078,12 +3084,13 @@
  				 */
  				ni = ieee80211_fakeup_adhoc_node(vap,
  					wh->i_addr2);
@@ -217,34 +214,45 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_input.c
  		}
  
  		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_node.c
+Index: madwifi-ng-r2978-20071127/net80211/ieee80211_node.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_node.c	2007-11-07 14:02:01.789472851 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_node.c	2007-11-07 14:02:02.873534629 +0100
-@@ -1103,8 +1103,25 @@
+--- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_node.c	2007-11-27 21:18:08.281724279 +0100
++++ madwifi-ng-r2978-20071127/net80211/ieee80211_node.c	2007-11-27 21:24:30.083481925 +0100
+@@ -1326,13 +1326,26 @@
  	IEEE80211_NODE_TABLE_LOCK_ASSERT(nt);
  
  	hash = IEEE80211_NODE_HASH(macaddr);
 +
 +	/* look for non-ibss nodes first */
-+	LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
+ 	LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
+-		if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr)) {
 +		if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr) && ni->ni_vap->iv_opmode != IEEE80211_M_IBSS) {
-+			ieee80211_ref_node(ni);	/* mark referenced */
-+#ifdef IEEE80211_DEBUG_REFCNT
-+			IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
-+				"%s (%s:%u) %p<%s> refcnt %d\n", __func__,
-+				func, line,
-+				ni, ether_sprintf(ni->ni_macaddr),
-+				ieee80211_node_refcnt(ni));
+ #ifdef IEEE80211_DEBUG_REFCNT
+ 			ieee80211_ref_node_debug(ni, func, line);
+ #else
+ 			ieee80211_ref_node(ni);
+-#endif 
 +#endif
 +			return ni;
 +		}
 +	}
 +
-+	/* now look for ibss nodes */
- 	LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
--		if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr)) {
++	LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
 +		if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr) && ni->ni_vap->iv_opmode == IEEE80211_M_IBSS) {
- 			ieee80211_ref_node(ni);	/* mark referenced */
- #ifdef IEEE80211_DEBUG_REFCNT
- 			IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
++#ifdef IEEE80211_DEBUG_REFCNT
++			ieee80211_ref_node_debug(ni, func, line);
++#else
++			ieee80211_ref_node(ni);
++#endif
+ 			return ni;
+ 		}
+ 	}
+@@ -1345,7 +1358,7 @@
+ 			return ieee80211_ref_node_debug(wds->wds_ni, func, line);
+ #else
+ 			return ieee80211_ref_node(wds->wds_ni);
+-#endif 
++#endif
+ 		}
+ 	}
+ 	return NULL;
diff --git a/package/madwifi/patches/127-beacon_node.patch b/package/madwifi/patches/127-beacon_node.patch
deleted file mode 100644
index 71b85850aa..0000000000
--- a/package/madwifi/patches/127-beacon_node.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Index: madwifi-ng-r2834-20071106/ath/if_ath.c
-===================================================================
---- madwifi-ng-r2834-20071106.orig/ath/if_ath.c	2007-11-07 14:02:03.853590479 +0100
-+++ madwifi-ng-r2834-20071106/ath/if_ath.c	2007-11-07 14:02:04.077603246 +0100
-@@ -4162,6 +4162,8 @@
- 	}
- 	bf = avp->av_bcbuf;
- 	ni = bf->bf_node;
-+	if (!ni)
-+		return NULL;
- 
- #ifdef ATH_SUPERG_DYNTURBO
- 	/* 
diff --git a/package/madwifi/patches/128-revert_ioaccess.patch b/package/madwifi/patches/128-revert_ioaccess.patch
deleted file mode 100644
index 987515bfaf..0000000000
--- a/package/madwifi/patches/128-revert_ioaccess.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-Index: madwifi-ng-r2834-20071106/ath_hal/ah_os.h
-===================================================================
---- madwifi-ng-r2834-20071106.orig/ath_hal/ah_os.h	2007-11-07 14:01:59.257328552 +0100
-+++ madwifi-ng-r2834-20071106/ath_hal/ah_os.h	2007-11-07 14:02:04.329617605 +0100
-@@ -172,44 +172,25 @@
-  * never byte-swapped by PCI chipsets or bridges, but always 
-  * written directly (i.e. the format defined by the manufacturer).
-  */
--#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,12)
--# if (AH_BYTE_ORDER == AH_BIG_ENDIAN)
-+#if (AH_BYTE_ORDER == AH_BIG_ENDIAN)
- #define _OS_REG_WRITE(_ah, _reg, _val) do {			\
- 	(0x4000 <= (_reg) && (_reg) < 0x5000) ?			\
--	 iowrite32((_val), (_ah)->ah_sh + (_reg)) :		\
--	 iowrite32be((_val), (_ah)->ah_sh + (_reg));		\
--	} while (0)
--#define _OS_REG_READ(_ah, _reg)					\
--	((0x4000 <= (_reg) && (_reg) < 0x5000) ?		\
--	 ioread32((_ah)->ah_sh + (_reg)) :			\
--	 ioread32be((_ah)->ah_sh + (_reg)));
--# else /* AH_LITTLE_ENDIAN */
--#define _OS_REG_WRITE(_ah, _reg, _val) do {			\
--	iowrite32(_val, (_ah)->ah_sh + (_reg));			\
--	} while (0)
--#define _OS_REG_READ(_ah, _reg)					\
--	ioread32((_ah)->ah_sh + (_reg))
--	
--# endif /* AH_BYTE_ORDER */
--#else
--# if (AH_BYTE_ORDER == AH_BIG_ENDIAN)
--#define _OS_REG_WRITE(_ah, _reg, _val) do {			\
--	 writel((0x4000 <= (_reg) && (_reg) < 0x5000) ? 	\
--	 	(_val) : cpu_to_le32(_val), 			\
--		(_ah)->ah_sh + (_reg));				\
--	} while (0)
-+	 writel((_val), (_ah)->ah_sh + (_reg)) :		\
-+	 ({__raw_writel((_val), (_ah)->ah_sh + (_reg)); 	\
-+	   mb(); });						\
-+} while (0)
- #define _OS_REG_READ(_ah, _reg)					\
- 	((0x4000 <= (_reg) && (_reg) < 0x5000) ?		\
- 	 readl((_ah)->ah_sh + (_reg)) :				\
--	 cpu_to_le32(readl((_ah)->ah_sh + (_reg))))
--# else /* AH_LITTLE_ENDIAN */
-+	 ({unsigned long __v = __raw_readl((_ah)->ah_sh + 	\
-+	  (_reg)); mb(); __v; }))
-+#else /* AH_LITTLE_ENDIAN */
- #define _OS_REG_WRITE(_ah, _reg, _val) do {			\
- 	writel(_val, (_ah)->ah_sh + (_reg));			\
--	} while (0)
-+} while (0)
- #define _OS_REG_READ(_ah, _reg)					\
- 	readl((_ah)->ah_sh + (_reg))
--# endif /* AH_BYTE_ORDER */
--#endif /* KERNEL_VERSON(2,6,12) */
-+#endif /* AH_BYTE_ORDER */
- 
- /* 
- The functions in this section are not intended to be invoked by MadWifi driver
diff --git a/package/madwifi/patches/200-no_debug.patch b/package/madwifi/patches/200-no_debug.patch
index 21e9ba07c8..3497b78cf4 100644
--- a/package/madwifi/patches/200-no_debug.patch
+++ b/package/madwifi/patches/200-no_debug.patch
@@ -1,20 +1,71 @@
-Index: madwifi-ng-r2834-20071106/ath/if_ath.c
+Index: madwifi-ng-r2978-20071127/ath/if_ath.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/ath/if_ath.c	2007-11-07 14:02:04.077603246 +0100
-+++ madwifi-ng-r2834-20071106/ath/if_ath.c	2007-11-07 14:02:04.537629461 +0100
-@@ -75,7 +75,7 @@
- #include <net80211/if_llc.h>
- #endif
+--- madwifi-ng-r2978-20071127.orig/ath/if_ath.c	2007-11-27 21:43:39.632991016 +0100
++++ madwifi-ng-r2978-20071127/ath/if_ath.c	2007-11-27 22:09:32.889506059 +0100
+@@ -67,7 +67,7 @@
+ #include "if_media.h"
+ #include "if_llc.h"
  
 -#define	AR_DEBUG
 +#undef	AR_DEBUG
  
- #include "net80211/if_athproto.h"
- #include "if_athvar.h"
-Index: madwifi-ng-r2834-20071106/ath_rate/amrr/amrr.c
+ #include <net80211/ieee80211_var.h>
+ #include <net80211/ieee80211_radiotap.h>
+@@ -535,9 +535,11 @@
+ 	u_int8_t csz;
+ 
+ 	sc->devid = devid;
++#ifdef AR_DEBUG
+ 	ath_debug_global = (ath_debug & ATH_DEBUG_GLOBAL);
+ 	sc->sc_debug 	 = (ath_debug & ~ATH_DEBUG_GLOBAL);
+ 	DPRINTF(sc, ATH_DEBUG_ANY, "%s: devid 0x%x\n", __func__, devid);
++#endif
+ 
+ 	/*
+ 	 * Cache line size is used to size and align various
+@@ -1268,12 +1270,14 @@
+ 		/* If no default VAP debug flags are passed, allow a few to
+ 		 * transfer down from the driver to new VAPs so we can have load
+ 		 * time debugging for VAPs too. */
++#ifdef AR_DEBUG
+ 		vap->iv_debug = 0 |
+ 			((sc->sc_debug & ATH_DEBUG_RATE) ? IEEE80211_MSG_XRATE  : 0) | 
+ 			((sc->sc_debug & ATH_DEBUG_XMIT) ? IEEE80211_MSG_OUTPUT : 0) | 
+ 			((sc->sc_debug & ATH_DEBUG_RECV) ? IEEE80211_MSG_INPUT  : 0) |
+ 			0
+ 			;
++#endif
+ 	}
+ 	ic->ic_debug = (sc->sc_default_ieee80211_debug & IEEE80211_MSG_IC);
+ 
+@@ -9872,9 +9876,11 @@
+ 				/* XXX validate? */
+ 				sc->sc_ledpin = val;
+ 				break;
++#ifdef AR_DEBUG
+ 			case ATH_DEBUG:
+ 				sc->sc_debug 	 = (val & ~ATH_DEBUG_GLOBAL);
+ 				ath_debug_global = (val &  ATH_DEBUG_GLOBAL);
++#endif
+ 				break;
+ 			case ATH_TXANTENNA:
+ 				/*
+@@ -10183,9 +10189,11 @@
+ 	}
+ 
+ 	/* initialize values */
++#ifdef AR_DEBUG
+ 	ath_debug_global = (ath_debug & ATH_DEBUG_GLOBAL);
+ 	sc->sc_debug 	 = (ath_debug & ~ATH_DEBUG_GLOBAL);
+ 	sc->sc_default_ieee80211_debug = ieee80211_debug;
++#endif
+ 	sc->sc_txantenna = 0;		/* default to auto-selection */
+ 	sc->sc_txintrperiod = ATH_TXQ_INTR_PERIOD;
+ }
+Index: madwifi-ng-r2978-20071127/ath_rate/amrr/amrr.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/ath_rate/amrr/amrr.c	2007-11-07 14:01:59.177323993 +0100
-+++ madwifi-ng-r2834-20071106/ath_rate/amrr/amrr.c	2007-11-07 14:02:04.545629914 +0100
+--- madwifi-ng-r2978-20071127.orig/ath_rate/amrr/amrr.c	2007-10-31 06:39:41.000000000 +0100
++++ madwifi-ng-r2978-20071127/ath_rate/amrr/amrr.c	2007-11-27 21:47:06.136758995 +0100
 @@ -70,7 +70,7 @@
  
  #include "amrr.h"
@@ -24,10 +75,10 @@ Index: madwifi-ng-r2834-20071106/ath_rate/amrr/amrr.c
  #ifdef AMRR_DEBUG
  #define	DPRINTF(sc, _fmt, ...) do {					\
  	if (sc->sc_debug & 0x10)					\
-Index: madwifi-ng-r2834-20071106/ath_rate/minstrel/minstrel.c
+Index: madwifi-ng-r2978-20071127/ath_rate/minstrel/minstrel.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/ath_rate/minstrel/minstrel.c	2007-11-07 14:02:01.169437517 +0100
-+++ madwifi-ng-r2834-20071106/ath_rate/minstrel/minstrel.c	2007-11-07 14:02:04.549630142 +0100
+--- madwifi-ng-r2978-20071127.orig/ath_rate/minstrel/minstrel.c	2007-11-27 21:18:24.882670317 +0100
++++ madwifi-ng-r2978-20071127/ath_rate/minstrel/minstrel.c	2007-11-27 21:47:06.140759225 +0100
 @@ -117,7 +117,7 @@
  
  #include "minstrel.h"
@@ -37,10 +88,10 @@ Index: madwifi-ng-r2834-20071106/ath_rate/minstrel/minstrel.c
  #ifdef MINSTREL_DEBUG
  enum {
  		ATH_DEBUG_RATE		= 0x00000010	/* rate control */
-Index: madwifi-ng-r2834-20071106/ath_rate/onoe/onoe.c
+Index: madwifi-ng-r2978-20071127/ath_rate/onoe/onoe.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/ath_rate/onoe/onoe.c	2007-11-07 14:01:59.193324906 +0100
-+++ madwifi-ng-r2834-20071106/ath_rate/onoe/onoe.c	2007-11-07 14:02:04.553630371 +0100
+--- madwifi-ng-r2978-20071127.orig/ath_rate/onoe/onoe.c	2007-10-31 06:39:41.000000000 +0100
++++ madwifi-ng-r2978-20071127/ath_rate/onoe/onoe.c	2007-11-27 21:47:06.144759451 +0100
 @@ -66,7 +66,7 @@
  
  #include "onoe.h"
@@ -50,10 +101,10 @@ Index: madwifi-ng-r2834-20071106/ath_rate/onoe/onoe.c
  #ifdef ONOE_DEBUG
  enum {
  	ATH_DEBUG_RATE	= 0x00000010,	/* rate control */
-Index: madwifi-ng-r2834-20071106/ath_rate/sample/sample.c
+Index: madwifi-ng-r2978-20071127/ath_rate/sample/sample.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/ath_rate/sample/sample.c	2007-11-07 14:01:59.201325359 +0100
-+++ madwifi-ng-r2834-20071106/ath_rate/sample/sample.c	2007-11-07 14:02:04.557630601 +0100
+--- madwifi-ng-r2978-20071127.orig/ath_rate/sample/sample.c	2007-11-21 09:23:20.000000000 +0100
++++ madwifi-ng-r2978-20071127/ath_rate/sample/sample.c	2007-11-27 21:47:06.148759680 +0100
 @@ -68,7 +68,7 @@
  
  #include "sample.h"
@@ -62,26 +113,11 @@ Index: madwifi-ng-r2834-20071106/ath_rate/sample/sample.c
 +#undef	SAMPLE_DEBUG
  #ifdef SAMPLE_DEBUG
  enum {
- 	ATH_DEBUG_NODE		= 0x00080000,	/* node management */
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_var.h
+ 	ATH_DEBUG_RATE		= 0x00000010,	/* rate control */
+Index: madwifi-ng-r2978-20071127/tools/do_multi.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_var.h	2007-11-07 14:01:59.209325817 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_var.h	2007-11-07 14:02:04.561630827 +0100
-@@ -35,8 +35,8 @@
- #ifndef _NET80211_IEEE80211_VAR_H_
- #define _NET80211_IEEE80211_VAR_H_
- 
--#define	IEEE80211_DEBUG
--#define	IEEE80211_DEBUG_REFCNT			/* Node reference count debugging */
-+#undef	IEEE80211_DEBUG
-+#undef	IEEE80211_DEBUG_REFCNT			/* Node reference count debugging */
- 
- /* Definitions for IEEE 802.11 drivers. */
- #include <net80211/ieee80211_linux.h>
-Index: madwifi-ng-r2834-20071106/tools/do_multi.c
-===================================================================
---- madwifi-ng-r2834-20071106.orig/tools/do_multi.c	2007-11-07 14:02:00.197382122 +0100
-+++ madwifi-ng-r2834-20071106/tools/do_multi.c	2007-11-07 14:02:04.565631053 +0100
+--- madwifi-ng-r2978-20071127.orig/tools/do_multi.c	2007-11-27 21:18:24.826667124 +0100
++++ madwifi-ng-r2978-20071127/tools/do_multi.c	2007-11-27 21:47:06.152759909 +0100
 @@ -9,16 +9,20 @@
  
      progname = basename(argv[0]);
@@ -103,10 +139,10 @@ Index: madwifi-ng-r2834-20071106/tools/do_multi.c
      if(strcmp(progname, "athkey") == 0)
  	ret =  athkey_init(argc, argv);
      if(strcmp(progname, "athstats") == 0)
-Index: madwifi-ng-r2834-20071106/tools/Makefile
+Index: madwifi-ng-r2978-20071127/tools/Makefile
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/tools/Makefile	2007-11-07 14:02:00.197382122 +0100
-+++ madwifi-ng-r2834-20071106/tools/Makefile	2007-11-07 14:02:04.565631053 +0100
+--- madwifi-ng-r2978-20071127.orig/tools/Makefile	2007-11-27 21:18:24.826667124 +0100
++++ madwifi-ng-r2978-20071127/tools/Makefile	2007-11-27 21:47:06.152759909 +0100
 @@ -48,7 +48,7 @@
  
  
@@ -125,3 +161,18 @@ Index: madwifi-ng-r2834-20071106/tools/Makefile
  	ln -s -f madwifi_multi $$i; \
  	done
  
+Index: madwifi-ng-r2978-20071127/net80211/ieee80211_linux.h
+===================================================================
+--- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_linux.h	2007-11-27 21:47:46.371051817 +0100
++++ madwifi-ng-r2978-20071127/net80211/ieee80211_linux.h	2007-11-27 21:47:56.199611915 +0100
+@@ -29,8 +29,8 @@
+ #ifndef _NET80211_IEEE80211_LINUX_H_
+ #define _NET80211_IEEE80211_LINUX_H_
+ 
+-#define	IEEE80211_DEBUG
+-#define	IEEE80211_DEBUG_REFCNT			/* Node reference count debugging */
++#undef	IEEE80211_DEBUG
++#undef	IEEE80211_DEBUG_REFCNT			/* Node reference count debugging */
+ /* #define ATH_DEBUG_SPINLOCKS */		/* announce before spinlocking */
+ 
+ #include <linux/wireless.h>
diff --git a/package/madwifi/patches/300-napi_polling.patch b/package/madwifi/patches/300-napi_polling.patch
index 8300225b8b..d5d8ef8817 100644
--- a/package/madwifi/patches/300-napi_polling.patch
+++ b/package/madwifi/patches/300-napi_polling.patch
@@ -1,8 +1,8 @@
-Index: madwifi-ng-r2834-20071106/ath/if_ath.c
+Index: madwifi-ng-r2978-20071127/ath/if_ath.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/ath/if_ath.c	2007-11-26 12:29:04.313083193 +0100
-+++ madwifi-ng-r2834-20071106/ath/if_ath.c	2007-11-26 12:29:04.341084793 +0100
-@@ -170,7 +170,7 @@
+--- madwifi-ng-r2978-20071127.orig/ath/if_ath.c	2007-11-27 21:47:06.136758995 +0100
++++ madwifi-ng-r2978-20071127/ath/if_ath.c	2007-11-27 21:49:11.439899616 +0100
+@@ -183,7 +183,7 @@
  	int, u_int64_t);
  static void ath_setdefantenna(struct ath_softc *, u_int);
  static struct ath_txq *ath_txq_setup(struct ath_softc *, int, int);
@@ -11,7 +11,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  static int ath_hardstart(struct sk_buff *, struct net_device *);
  static int ath_mgtstart(struct ieee80211com *, struct sk_buff *);
  #ifdef ATH_SUPERG_COMP
-@@ -445,7 +445,6 @@
+@@ -552,7 +552,6 @@
  	ATH_TXBUF_LOCK_INIT(sc);
  	ATH_RXBUF_LOCK_INIT(sc);
  
@@ -19,16 +19,16 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  	ATH_INIT_TQUEUE(&sc->sc_txtq,	  ath_tx_tasklet,	dev);
  	ATH_INIT_TQUEUE(&sc->sc_bmisstq,  ath_bmiss_tasklet,	dev);
  	ATH_INIT_TQUEUE(&sc->sc_bstucktq, ath_bstuck_tasklet,	dev);
-@@ -696,6 +695,8 @@
+@@ -807,6 +806,8 @@
  	dev->set_mac_address = ath_set_mac_address;
-  	dev->change_mtu = ath_change_mtu;
+ 	dev->change_mtu = ath_change_mtu;
  	dev->tx_queue_len = ATH_TXBUF - 1;		/* 1 for mgmt frame */
 +	dev->poll = ath_rx_poll;
 +	dev->weight = 64;
  #ifdef USE_HEADERLEN_RESV
  	dev->hard_header_len += sizeof(struct ieee80211_qosframe) +
  				sizeof(struct llc) +
-@@ -1794,6 +1795,7 @@
+@@ -2014,6 +2015,7 @@
  		(status & HAL_INT_RXPHY)   ? " HAL_INT_RXPHY"   : "",
  		(status & HAL_INT_SWBA)    ? " HAL_INT_SWBA"    : "");
  
@@ -36,7 +36,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  	status &= sc->sc_imask;			/* discard unasked for bits */
  	if (status & HAL_INT_FATAL) {
  		sc->sc_stats.ast_hardware++;
-@@ -1831,7 +1833,14 @@
+@@ -2051,7 +2053,14 @@
  		}
  		if (status & (HAL_INT_RX | HAL_INT_RXPHY)) {
  			ath_uapsd_processtriggers(sc);
@@ -52,7 +52,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  		}
  		if (status & HAL_INT_TX) {
  #ifdef ATH_SUPERG_DYNTURBO
-@@ -1857,6 +1866,11 @@
+@@ -2077,6 +2086,11 @@
  				}
  			}
  #endif
@@ -64,7 +64,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  			ATH_SCHEDULE_TQUEUE(&sc->sc_txtq, &needmark);
  		}
  		if (status & HAL_INT_BMISS) {
-@@ -3450,10 +3464,10 @@
+@@ -3750,10 +3764,10 @@
  	 *
  	 * XXX Using in_softirq is not right since we might
  	 * be called from other soft irq contexts than
@@ -77,7 +77,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  	netif_stop_queue(dev);
  }
  
-@@ -3466,7 +3480,7 @@
+@@ -3766,7 +3780,7 @@
  	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s:\n", __func__);
  	netif_start_queue(dev);
  	if (!in_softirq())		/* NB: see above */
@@ -86,7 +86,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  }
  
  /*
-@@ -5707,13 +5721,12 @@
+@@ -6050,13 +6064,12 @@
  	sc->sc_rxotherant = 0;
  }
  
@@ -102,11 +102,10 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  	struct ath_buf *bf;
  	struct ath_softc *sc = dev->priv;
  	struct ieee80211com *ic = &sc->sc_ic;
-@@ -5726,9 +5739,11 @@
+@@ -6068,8 +6081,11 @@
+ 	unsigned int len;
  	int type;
  	u_int phyerr;
- 	u_int64_t rs_tsf;
--
 +	u_int processed = 0, early_stop = 0;
 +	u_int rx_limit = dev->quota;
  
@@ -115,7 +114,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  	do {
  		bf = STAILQ_FIRST(&sc->sc_rxbuf);
  		if (bf == NULL) {		/* XXX ??? can this happen */
-@@ -5752,6 +5767,13 @@
+@@ -6093,6 +6109,13 @@
  			/* NB: never process the self-linked entry at the end */
  			break;
  		}
@@ -127,9 +126,9 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
 +		}
 +
  		skb = bf->bf_skb;
- 		if (skb == NULL) {		/* XXX ??? can this happen */
+ 		if (skb == NULL) {
  			printk("%s: no skbuff (%s)\n", DEV_NAME(dev), __func__);
-@@ -5796,6 +5818,7 @@
+@@ -6137,6 +6160,7 @@
  				sc->sc_stats.ast_rx_phyerr++;
  				phyerr = rs->rs_phyerr & 0x1f;
  				sc->sc_stats.ast_rx_phy[phyerr]++;
@@ -137,7 +136,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  			}
  			if (rs->rs_status & HAL_RXERR_DECRYPT) {
  				/*
-@@ -6011,9 +6034,33 @@
+@@ -6342,9 +6366,33 @@
  		STAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
  		ATH_RXBUF_UNLOCK_IRQ(sc);
  	} while (ath_rxbuf_init(sc, bf) == 0);
@@ -171,7 +170,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  #undef PA2DESC
  }
  
-@@ -7635,11 +7682,22 @@
+@@ -7964,11 +8012,22 @@
  	struct net_device *dev = (struct net_device *)data;
  	struct ath_softc *sc = dev->priv;
  
@@ -194,7 +193,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  	netif_wake_queue(dev);
  
  	if (sc->sc_softled)
-@@ -7656,6 +7714,7 @@
+@@ -7985,6 +8044,7 @@
  	struct net_device *dev = (struct net_device *)data;
  	struct ath_softc *sc = dev->priv;
  
@@ -202,7 +201,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  	/*
  	 * Process each active queue.
  	 */
-@@ -7676,6 +7735,16 @@
+@@ -8005,6 +8065,16 @@
  	if (sc->sc_uapsdq && txqactive(sc->sc_ah, sc->sc_uapsdq->axq_qnum))
  		ath_tx_processq(sc, sc->sc_uapsdq);
  
@@ -219,7 +218,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  	netif_wake_queue(dev);
  
  	if (sc->sc_softled)
-@@ -7693,6 +7762,7 @@
+@@ -8022,6 +8092,7 @@
  	unsigned int i;
  
  	/* Process each active queue. */
@@ -227,7 +226,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  	for (i = 0; i < HAL_NUM_TX_QUEUES; i++)
  		if (ATH_TXQ_SETUP(sc, i) && txqactive(sc->sc_ah, i))
  			ath_tx_processq(sc, &sc->sc_txq[i]);
-@@ -7701,6 +7771,16 @@
+@@ -8030,6 +8101,16 @@
  		ath_tx_processq(sc, sc->sc_xrtxq);
  #endif
  
@@ -244,7 +243,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  	netif_wake_queue(dev);
  
  	if (sc->sc_softled)
-@@ -7799,6 +7879,7 @@
+@@ -8101,6 +8182,7 @@
  ath_draintxq(struct ath_softc *sc)
  {
  	struct ath_hal *ah = sc->sc_ah;
@@ -252,7 +251,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  	unsigned int i;
  
  	/* XXX return value */
-@@ -9343,9 +9424,9 @@
+@@ -9675,9 +9757,9 @@
  	dev->mtu = mtu;
  	if ((dev->flags & IFF_RUNNING) && !sc->sc_invalid) {
  		/* NB: the rx buffers may need to be reallocated */
@@ -264,10 +263,10 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  	}
  	ATH_UNLOCK(sc);
  
-Index: madwifi-ng-r2834-20071106/ath/if_athvar.h
+Index: madwifi-ng-r2978-20071127/ath/if_athvar.h
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/ath/if_athvar.h	2007-11-26 12:29:04.233078645 +0100
-+++ madwifi-ng-r2834-20071106/ath/if_athvar.h	2007-11-26 12:29:04.341084793 +0100
+--- madwifi-ng-r2978-20071127.orig/ath/if_athvar.h	2007-11-27 21:43:39.616990105 +0100
++++ madwifi-ng-r2978-20071127/ath/if_athvar.h	2007-11-27 21:48:18.536884841 +0100
 @@ -50,6 +50,10 @@
  #include <asm/io.h>
  #include <linux/list.h>
@@ -279,7 +278,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_athvar.h
  /*
   * Deduce if tasklets are available.  If not then
   * fall back to using the immediate work queue.
-@@ -642,7 +646,6 @@
+@@ -699,7 +703,6 @@
  	struct ath_buf *sc_rxbufcur;		/* current rx buffer */
  	u_int32_t *sc_rxlink;			/* link ptr in last RX desc */
  	spinlock_t sc_rxbuflock;
@@ -287,7 +286,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_athvar.h
  	struct ATH_TQ_STRUCT sc_rxorntq;	/* rxorn intr tasklet */
  	u_int8_t sc_defant;			/* current default antenna */
  	u_int8_t sc_rxotherant;			/* RXs on non-default antenna */
-@@ -655,6 +658,7 @@
+@@ -712,6 +715,7 @@
  	u_int sc_txintrperiod;			/* tx interrupt batching */
  	struct ath_txq sc_txq[HAL_NUM_TX_QUEUES];
  	struct ath_txq *sc_ac2q[WME_NUM_AC];	/* WME AC -> h/w qnum */
@@ -295,50 +294,60 @@ Index: madwifi-ng-r2834-20071106/ath/if_athvar.h
  	struct ATH_TQ_STRUCT sc_txtq;		/* tx intr tasklet */
  	u_int8_t sc_grppoll_str[GRPPOLL_RATE_STR_LEN];
  	struct ath_descdma sc_bdma;		/* beacon descriptors */
-@@ -727,6 +731,8 @@
- #define	ATH_TXBUF_LOCK_ASSERT(_sc) \
- 	KASSERT(spin_is_locked(&(_sc)->sc_txbuflock), ("txbuf not locked!"))
+@@ -800,6 +804,8 @@
+ #define	ATH_TXBUF_LOCK_CHECK(_sc)
+ #endif
  
 +#define ATH_DISABLE_INTR		local_irq_disable
 +#define ATH_ENABLE_INTR 		local_irq_enable
  
  #define	ATH_RXBUF_LOCK_INIT(_sc)	spin_lock_init(&(_sc)->sc_rxbuflock)
  #define	ATH_RXBUF_LOCK_DESTROY(_sc)
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_input.c
+Index: madwifi-ng-r2978-20071127/net80211/ieee80211_input.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_input.c	2007-11-26 12:29:04.197076583 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_input.c	2007-11-26 12:29:54.727956181 +0100
-@@ -1128,8 +1128,9 @@
- 		if (ni->ni_vlan != 0 && vap->iv_vlgrp != NULL) {
+--- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_input.c	2007-11-27 21:18:30.038964155 +0100
++++ madwifi-ng-r2978-20071127/net80211/ieee80211_input.c	2007-11-27 21:50:39.616924535 +0100
+@@ -1173,7 +1173,7 @@
  			/* attach vlan tag */
- 			vlan_hwaccel_receive_skb(skb, vap->iv_vlgrp, ni->ni_vlan);
--		} else
--			netif_rx(skb);
-+		} else {
-+			netif_receive_skb(skb);
-+		}
- 		dev->last_rx = jiffies;
- 	}
- }
-@@ -2235,7 +2236,7 @@
- 		skb1->pkt_type = PACKET_OTHERHOST;
+ 			struct ieee80211_node *ni_tmp = SKB_CB(skb)->ni;
+ 			if (vlan_hwaccel_receive_skb(skb, vap->iv_vlgrp, ni->ni_vlan) == NET_RX_DROP) {
+-				/* If netif_rx dropped the packet because 
++				/* If netif_receive_skb dropped the packet because 
+ 				 * device was too busy */
+ 				if (ni_tmp != NULL) {
+ 					/* node reference was leaked */
+@@ -1184,8 +1184,8 @@
+ 			skb = NULL; /* SKB is no longer ours */
+ 		} else {
+ 			struct ieee80211_node *ni_tmp = SKB_CB(skb)->ni;
+-			if (netif_rx(skb) == NET_RX_DROP) {
+-				/* If netif_rx dropped the packet because 
++			if (netif_receive_skb(skb) == NET_RX_DROP) {
++				/* If netif_receive_skb dropped the packet because 
+ 				 * device was too busy */
+ 				if (ni_tmp != NULL) {
+ 					/* node reference was leaked */
+@@ -2294,8 +2294,8 @@
  		skb1->protocol = __constant_htons(0x0019);  /* ETH_P_80211_RAW */
  
--		netif_rx(skb1);
-+		netif_receive_skb(skb1);
- 	}
- }
- 
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_monitor.c
+ 		ni_tmp = SKB_CB(skb1)->ni;
+-		if (netif_rx(skb1) == NET_RX_DROP) {
+-			/* If netif_rx dropped the packet because 
++		if (netif_receive_skb(skb1) == NET_RX_DROP) {
++			/* If netif_receive_skb dropped the packet because 
+ 			 * device was too busy */
+ 			if (ni_tmp != NULL) {
+ 				/* node reference was leaked */
+Index: madwifi-ng-r2978-20071127/net80211/ieee80211_monitor.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_monitor.c	2007-11-26 12:29:24.998261983 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_monitor.c	2007-11-26 12:29:32.962715851 +0100
-@@ -567,7 +567,7 @@
- 			skb1->pkt_type = pkttype;
+--- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_monitor.c	2007-11-22 03:08:35.000000000 +0100
++++ madwifi-ng-r2978-20071127/net80211/ieee80211_monitor.c	2007-11-27 21:49:58.518582476 +0100
+@@ -568,7 +568,7 @@
  			skb1->protocol = __constant_htons(0x0019); /* ETH_P_80211_RAW */
  
--			netif_rx(skb1);
-+			netif_receive_skb(skb1);
- 
- 			vap->iv_devstats.rx_packets++;
- 			vap->iv_devstats.rx_bytes += skb1->len;
+ 			ni_tmp = SKB_CB(skb1)->ni;
+-			if (netif_rx(skb1) == NET_RX_DROP) {
++			if (netif_receive_skb(skb1) == NET_RX_DROP) {
+ 				/* If netif_rx dropped the packet because 
+ 				 * device was too busy */
+ 				if (ni_tmp != NULL) {
diff --git a/package/madwifi/patches/309-micfail_detect.patch b/package/madwifi/patches/309-micfail_detect.patch
index 753fc14b31..5eac135385 100644
--- a/package/madwifi/patches/309-micfail_detect.patch
+++ b/package/madwifi/patches/309-micfail_detect.patch
@@ -1,16 +1,16 @@
-Index: madwifi-ng-r2834-20071106/ath/if_ath.c
+Index: madwifi-ng-r2978-20071127/ath/if_ath.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/ath/if_ath.c	2007-11-07 14:02:05.345675505 +0100
-+++ madwifi-ng-r2834-20071106/ath/if_ath.c	2007-11-07 14:02:05.625691466 +0100
-@@ -5743,6 +5743,7 @@
- 	u_int64_t rs_tsf;
+--- madwifi-ng-r2978-20071127.orig/ath/if_ath.c	2007-11-27 21:50:53.125694356 +0100
++++ madwifi-ng-r2978-20071127/ath/if_ath.c	2007-11-27 21:59:09.565984878 +0100
+@@ -6085,6 +6085,7 @@
+ 	u_int phyerr;
  	u_int processed = 0, early_stop = 0;
  	u_int rx_limit = dev->quota;
 +	u_int mic_fail = 0;
  
  	DPRINTF(sc, ATH_DEBUG_RX_PROC, "%s\n", __func__);
  process_rx_again:
-@@ -5839,24 +5840,8 @@
+@@ -6181,24 +6182,8 @@
  			}
  			if (rs->rs_status & HAL_RXERR_MIC) {
  				sc->sc_stats.ast_rx_badmic++;
@@ -36,8 +36,8 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
 +				goto rx_accept;
  			}
  			/*
- 			 * Reject error frames if we have no vaps that 
-@@ -5920,8 +5905,9 @@
+ 			 * Reject error frames if we have no vaps that
+@@ -6257,8 +6242,9 @@
  		/*
  		 * Finished monitor mode handling, now reject
  		 * error frames before passing to other vaps
@@ -45,10 +45,10 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  		 */
 -		if (rs->rs_status != 0) {
 +		if (rs->rs_status & ~(HAL_RXERR_MIC | HAL_RXERR_DECRYPT)) {
- 			dev_kfree_skb(skb);
- 			skb = NULL;
+ 			ieee80211_dev_kfree_skb(&skb);
  			goto rx_next;
-@@ -5930,6 +5916,26 @@
+ 		}
+@@ -6266,6 +6252,26 @@
  		/* remove the CRC */
  		skb_trim(skb, skb->len - IEEE80211_CRC_LEN);
  
@@ -75,7 +75,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  		/*
  		 * From this point on we assume the frame is at least
  		 * as large as ieee80211_frame_min; verify that.
-@@ -5952,6 +5958,7 @@
+@@ -6287,6 +6293,7 @@
  				   sc->sc_hwmap[rs->rs_rate].ieeerate,
  				   rs->rs_rssi);
  
@@ -83,10 +83,10 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  		/*
  		 * Locate the node for sender, track state, and then
  		 * pass the (referenced) node up to the 802.11 layer
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_ccmp.c
+Index: madwifi-ng-r2978-20071127/net80211/ieee80211_crypto_ccmp.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_crypto_ccmp.c	2007-11-07 14:02:03.345561529 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_ccmp.c	2007-11-07 14:02:05.625691466 +0100
+--- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_crypto_ccmp.c	2007-11-27 21:43:39.604989422 +0100
++++ madwifi-ng-r2978-20071127/net80211/ieee80211_crypto_ccmp.c	2007-11-27 21:58:39.516272443 +0100
 @@ -73,7 +73,7 @@
  static int ccmp_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  static int ccmp_decap(struct ieee80211_key *, struct sk_buff *, int);
@@ -105,10 +105,10 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_ccmp.c
  {
  	return 1;
  }
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_crypto.h
+Index: madwifi-ng-r2978-20071127/net80211/ieee80211_crypto.h
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_crypto.h	2007-11-07 14:01:58.929309860 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_crypto.h	2007-11-07 14:02:05.633691920 +0100
+--- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_crypto.h	2007-10-29 23:33:03.000000000 +0100
++++ madwifi-ng-r2978-20071127/net80211/ieee80211_crypto.h	2007-11-27 21:58:39.524272897 +0100
 @@ -145,7 +145,7 @@
  	int (*ic_encap)(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  	int (*ic_decap)(struct ieee80211_key *, struct sk_buff *, int);
@@ -131,10 +131,10 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_crypto.h
  }
  
  /*
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_none.c
+Index: madwifi-ng-r2978-20071127/net80211/ieee80211_crypto_none.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_crypto_none.c	2007-11-07 14:01:58.937310316 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_none.c	2007-11-07 14:02:05.633691920 +0100
+--- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_crypto_none.c	2006-09-20 10:45:13.000000000 +0200
++++ madwifi-ng-r2978-20071127/net80211/ieee80211_crypto_none.c	2007-11-27 21:58:39.528273126 +0100
 @@ -52,7 +52,7 @@
  static int none_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  static int none_decap(struct ieee80211_key *, struct sk_buff *, int);
@@ -153,10 +153,10 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_none.c
  {
  	struct ieee80211vap *vap = k->wk_private;
  
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_tkip.c
+Index: madwifi-ng-r2978-20071127/net80211/ieee80211_crypto_tkip.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_crypto_tkip.c	2007-11-07 14:01:58.945310770 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_tkip.c	2007-11-07 14:02:05.633691920 +0100
+--- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_crypto_tkip.c	2007-10-28 21:40:04.000000000 +0100
++++ madwifi-ng-r2978-20071127/net80211/ieee80211_crypto_tkip.c	2007-11-27 21:58:39.532273356 +0100
 @@ -57,7 +57,7 @@
  static int tkip_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  static int tkip_enmic(struct ieee80211_key *, struct sk_buff *, int);
@@ -184,10 +184,10 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_tkip.c
  		struct ieee80211vap *vap = ctx->tc_vap;
  		u8 mic[IEEE80211_WEP_MICLEN];
  		u8 mic0[IEEE80211_WEP_MICLEN];
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_wep.c
+Index: madwifi-ng-r2978-20071127/net80211/ieee80211_crypto_wep.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_crypto_wep.c	2007-11-07 14:01:58.953311229 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_wep.c	2007-11-07 14:02:05.633691920 +0100
+--- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_crypto_wep.c	2007-05-29 23:55:25.000000000 +0200
++++ madwifi-ng-r2978-20071127/net80211/ieee80211_crypto_wep.c	2007-11-27 21:58:39.536273583 +0100
 @@ -54,7 +54,7 @@
  static int wep_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  static int wep_decap(struct ieee80211_key *, struct sk_buff *, int);
@@ -206,11 +206,11 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_wep.c
  {
  	return 1;
  }
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_input.c
+Index: madwifi-ng-r2978-20071127/net80211/ieee80211_input.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_input.c	2007-11-07 14:02:05.349675734 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_input.c	2007-11-07 14:02:05.637692150 +0100
-@@ -632,7 +632,7 @@
+--- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_input.c	2007-11-27 21:50:53.133694814 +0100
++++ madwifi-ng-r2978-20071127/net80211/ieee80211_input.c	2007-11-27 21:58:39.536273583 +0100
+@@ -640,7 +640,7 @@
  		 * Next strip any MSDU crypto bits.
  		 */
  		if (key != NULL &&
@@ -219,7 +219,7 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_input.c
  			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  				ni->ni_macaddr, "data", "%s", "demic error");
  			IEEE80211_NODE_STAT(ni, rx_demicfail);
-@@ -3781,6 +3781,47 @@
+@@ -3812,6 +3812,47 @@
  }
  #endif
  
@@ -267,10 +267,10 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_input.c
  #ifdef IEEE80211_DEBUG
  /*
   * Debugging support.
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_proto.h
+Index: madwifi-ng-r2978-20071127/net80211/ieee80211_proto.h
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_proto.h	2007-11-07 14:01:58.965311910 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_proto.h	2007-11-07 14:02:05.637692150 +0100
+--- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_proto.h	2007-06-18 19:14:03.000000000 +0200
++++ madwifi-ng-r2978-20071127/net80211/ieee80211_proto.h	2007-11-27 21:58:39.540273808 +0100
 @@ -91,6 +91,7 @@
  void ieee80211_set11gbasicrates(struct ieee80211_rateset *, enum ieee80211_phymode);
  enum ieee80211_phymode ieee80211_get11gbasicrates(struct ieee80211_rateset *);
@@ -279,11 +279,11 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_proto.h
  
  /*
   * Return the size of the 802.11 header for a management or data frame.
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_linux.c
+Index: madwifi-ng-r2978-20071127/net80211/ieee80211_linux.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_linux.c	2007-11-07 14:02:03.137549672 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_linux.c	2007-11-07 14:02:05.641692376 +0100
-@@ -339,8 +339,8 @@
+--- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_linux.c	2007-11-27 21:43:39.592988736 +0100
++++ madwifi-ng-r2978-20071127/net80211/ieee80211_linux.c	2007-11-27 21:58:39.540273808 +0100
+@@ -337,8 +337,8 @@
  	/* TODO: needed parameters: count, keyid, key type, src address, TSC */
  	snprintf(buf, sizeof(buf), "%s(keyid=%d %scast addr=%s)", tag,
  		k->wk_keyix,
@@ -294,11 +294,11 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_linux.c
  	memset(&wrqu, 0, sizeof(wrqu));
  	wrqu.data.length = strlen(buf);
  	wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_output.c
+Index: madwifi-ng-r2978-20071127/net80211/ieee80211_output.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_output.c	2007-11-07 14:01:58.981312821 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_output.c	2007-11-07 14:02:05.641692376 +0100
-@@ -1079,13 +1079,16 @@
+--- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_output.c	2007-11-22 03:08:35.000000000 +0100
++++ madwifi-ng-r2978-20071127/net80211/ieee80211_output.c	2007-11-27 21:58:39.540273808 +0100
+@@ -1093,13 +1093,16 @@
  			cip = (struct ieee80211_cipher *) key->wk_cipher;
  			ciphdrsize = cip->ic_header;
  			tailsize += (cip->ic_trailer + cip->ic_miclen);
@@ -318,24 +318,24 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_output.c
  
  		/*
  		 * Allocate sk_buff for each subsequent fragment; First fragment
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_node.c
+Index: madwifi-ng-r2978-20071127/net80211/ieee80211_node.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_node.c	2007-11-07 14:02:05.357676193 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_node.c	2007-11-07 14:02:05.645692605 +0100
-@@ -1899,11 +1899,13 @@
+--- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_node.c	2007-11-27 21:50:53.141695270 +0100
++++ madwifi-ng-r2978-20071127/net80211/ieee80211_node.c	2007-11-27 21:59:52.592436814 +0100
+@@ -2165,11 +2165,13 @@
  	/* From this point onwards we can no longer find the node,
  	 * so no more references are generated
  	 */
 -	ieee80211_remove_wds_addr(nt, ni->ni_macaddr);
 -	ieee80211_del_wds_node(nt, ni);
 -	IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
--	_node_table_leave(nt, ni);
+-	node_table_leave_locked(nt, ni);
 -	IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
 +	if (nt) {
 +		ieee80211_remove_wds_addr(nt, ni->ni_macaddr);
 +		ieee80211_del_wds_node(nt, ni);
 +		IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
-+		_node_table_leave(nt, ni);
++		node_table_leave_locked(nt, ni);
 +		IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
 +	}
  
diff --git a/package/madwifi/patches/310-noise_get.patch b/package/madwifi/patches/310-noise_get.patch
index 927d56f4b2..c0da43cd0d 100644
--- a/package/madwifi/patches/310-noise_get.patch
+++ b/package/madwifi/patches/310-noise_get.patch
@@ -1,8 +1,8 @@
-Index: madwifi-ng-r2834-20071106/ath/if_ath.c
+Index: madwifi-ng-r2978-20071127/ath/if_ath.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/ath/if_ath.c	2007-11-07 14:02:05.625691466 +0100
-+++ madwifi-ng-r2834-20071106/ath/if_ath.c	2007-11-07 14:02:06.001712892 +0100
-@@ -1417,7 +1417,6 @@
+--- madwifi-ng-r2978-20071127.orig/ath/if_ath.c	2007-11-27 21:59:09.565984878 +0100
++++ madwifi-ng-r2978-20071127/ath/if_ath.c	2007-11-27 22:01:09.964846018 +0100
+@@ -1597,7 +1597,6 @@
  	 * Wireshark and Kismet.
  	 */
  	hw_tsf = ath_hal_gettsf64(ah);
@@ -10,23 +10,15 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  
  	ATH_RXBUF_LOCK_IRQ(sc);
  	if (sc->sc_rxbufcur == NULL)
-@@ -8182,6 +8181,7 @@
- 	struct net_device *dev = (struct net_device *) arg;
- 	struct ath_softc *sc = dev->priv;
- 	struct ath_hal *ah = sc->sc_ah;
-+	struct ieee80211com *ic = &sc->sc_ic;
- 	/* u_int32_t nchans; */
- 	HAL_BOOL isIQdone = AH_FALSE;
- 
-@@ -8210,6 +8210,7 @@
- 		ath_calinterval = ATH_LONG_CALINTERVAL;
- 	else
- 		ath_calinterval = ATH_SHORT_CALINTERVAL;
+@@ -8536,6 +8535,7 @@
+ 		if (ath_calinterval == ATH_LONG_CALINTERVAL)
+ 			ath_calinterval = ATH_SHORT_CALINTERVAL;
+ 	}
 +	ic->ic_channoise = ath_hal_get_channel_noise(ah, &(sc->sc_curchan));
  
- 	sc->sc_cal_ch.expires = jiffies + (ath_calinterval * HZ);
- 	add_timer(&sc->sc_cal_ch);
-@@ -8260,6 +8261,7 @@
+ 	DPRINTF(sc, ATH_DEBUG_CALIBRATE, "%s: channel %u/%x -- IQ %s.\n",
+ 		__func__, sc->sc_curchan.channel, sc->sc_curchan.channelFlags,
+@@ -8590,6 +8590,7 @@
  	struct ath_softc *sc = dev->priv;
  
  	(void) ath_chan_set(sc, ic->ic_curchan);
@@ -34,7 +26,7 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  	/*
  	 * If we are returning to our bss channel then mark state
  	 * so the next recv'd beacon's TSF will be used to sync the
-@@ -8474,6 +8476,7 @@
+@@ -8812,6 +8813,7 @@
  		}
  
  		ath_hal_process_noisefloor(ah);