--- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -4157,7 +4157,9 @@
+@@ -4160,7 +4160,9 @@
                rfilt |= HAL_RX_FILTER_PROM;
        if (ic->ic_opmode == IEEE80211_M_STA ||
            sc->sc_opmode == HAL_M_IBSS ||      /* NB: AHDEMO too */
 
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -6456,6 +6456,7 @@
+@@ -6459,6 +6459,7 @@
        int type;
        u_int phyerr;
        u_int processed = 0, early_stop = 0;
  
        DPRINTF(sc, ATH_DEBUG_RX_PROC, "invoked\n");
  process_rx_again:
-@@ -6557,24 +6558,8 @@
+@@ -6560,24 +6561,8 @@
                        }
                        if (rs->rs_status & HAL_RXERR_MIC) {
                                sc->sc_stats.ast_rx_badmic++;
                        }
                        /*
                         * Reject error frames if we have no vaps that
-@@ -6613,8 +6598,9 @@
+@@ -6616,8 +6601,9 @@
                /*
                 * Finished monitor mode handling, now reject
                 * error frames before passing to other vaps
                        ieee80211_dev_kfree_skb(&skb);
                        goto rx_next;
                }
-@@ -6622,6 +6608,26 @@
+@@ -6625,6 +6611,26 @@
                /* remove the CRC */
                skb_trim(skb, skb->len - IEEE80211_CRC_LEN);
  
                /*
                 * From this point on we assume the frame is at least
                 * as large as ieee80211_frame_min; verify that.
-@@ -6634,6 +6640,7 @@
+@@ -6637,6 +6643,7 @@
                        goto rx_next;
                }
  
 
        ATH_RXBUF_LOCK_IRQ(sc);
        if (sc->sc_rxbufcur == NULL)
                sc->sc_rxbufcur = STAILQ_FIRST(&sc->sc_rxbuf);
-@@ -8978,6 +8976,7 @@
+@@ -8981,6 +8979,7 @@
                        sc->sc_curchan.channel);
                sc->sc_stats.ast_per_calfail++;
        }
  
        ath_hal_process_noisefloor(ah);
        if (isIQdone == AH_TRUE) {
-@@ -9046,6 +9045,7 @@
+@@ -9049,6 +9048,7 @@
        struct ath_softc *sc = dev->priv;
  
        (void) ath_chan_set(sc, ic->ic_curchan);
        /*
         * If we are returning to our bss channel then mark state
         * so the next recv'd beacon's TSF will be used to sync the
-@@ -9314,6 +9314,7 @@
+@@ -9317,6 +9317,7 @@
                }
  
                ath_hal_process_noisefloor(ah);
 
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -8692,6 +8692,10 @@
+@@ -8695,6 +8695,10 @@
  
        sc->sc_rxbufcur = NULL;
  
 
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -9795,7 +9795,9 @@
+@@ -9798,7 +9798,9 @@
        /*
         * Convert HAL channels to ieee80211 ones.
         */
        for (i = 0; i < nchan; i++) {
                HAL_CHANNEL *c = &chans[i];
                struct ieee80211_channel *ichan = &ic->ic_channels[i];
-@@ -9822,6 +9824,7 @@
+@@ -9825,6 +9827,7 @@
                ic->ic_chan_non_occupy[i].tv_sec  = 0;
                ic->ic_chan_non_occupy[i].tv_usec = 0;
  
                IPRINTF(sc, "Channel %3d (%4d MHz) Max Tx Power %d dBm%s "
                                "[%d hw %d reg] Flags%s%s%s%s%s%s%s%s%s%s%s%s%"
                                "s%s%s%s%s%s%s%s%s%s%s%s\n",
-@@ -9910,6 +9913,7 @@
+@@ -9913,6 +9916,7 @@
                                (c->privFlags & 0x0080 ? 
                                 " PF & (1 << 7)" : "")
                                );
 
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -8441,8 +8441,6 @@
+@@ -8444,8 +8444,6 @@
        ath_hal_intrset(sc->sc_ah, sc->sc_imask);
        local_irq_restore(flags);
  
        if (sc->sc_softled)
                ath_led_event(sc, ATH_LED_TX);
  }
-@@ -8489,8 +8487,6 @@
+@@ -8492,8 +8490,6 @@
        ath_hal_intrset(sc->sc_ah, sc->sc_imask);
        local_irq_restore(flags);
  
        if (sc->sc_softled)
                ath_led_event(sc, ATH_LED_TX);
  }
-@@ -8523,8 +8519,6 @@
+@@ -8526,8 +8522,6 @@
        ath_hal_intrset(sc->sc_ah, sc->sc_imask);
        local_irq_restore(flags);
  
 
         * Convert to a HAL channel description with the flags
         * constrained to reflect the current operating mode.
         */
-@@ -5153,6 +5177,8 @@
+@@ -5156,6 +5180,8 @@
                        "Invoking ath_hal_txstart with sc_bhalq: %d\n",
                        sc->sc_bhalq);
                ath_hal_txstart(ah, sc->sc_bhalq);
  
                sc->sc_stats.ast_be_xmit++;             /* XXX per-VAP? */
        }
-@@ -5402,6 +5428,7 @@
+@@ -5405,6 +5431,7 @@
                ath_hal_beacontimers(ah, &bs);
                sc->sc_imask |= HAL_INT_BMISS;
                ath_hal_intrset(ah, sc->sc_imask);
        } else {
                ath_hal_intrset(ah, 0);
                if (reset_tsf)
-@@ -5413,8 +5440,11 @@
+@@ -5416,8 +5443,11 @@
                         */
                        intval |= HAL_BEACON_ENA;
                        sc->sc_imask |= HAL_INT_SWBA;
  #ifdef ATH_SUPERG_DYNTURBO
                ath_beacon_dturbo_config(vap, intval &
                                ~(HAL_BEACON_RESET_TSF | HAL_BEACON_ENA));
-@@ -8882,6 +8912,9 @@
+@@ -8885,6 +8915,9 @@
                        /* Enter DFS wait period */
                        mod_timer(&sc->sc_dfs_cac_timer,
                                jiffies + (sc->sc_dfs_cac_period * HZ));
                }
                /*
                 * re configure beacons when it is a turbo mode switch.
-@@ -8991,8 +9024,11 @@
+@@ -8994,8 +9027,11 @@
                sc->sc_curchan.channel, sc->sc_curchan.channelFlags,
                isIQdone ? "done" : "not done");
  
  }
  
  static void
-@@ -9099,7 +9135,8 @@
+@@ -9102,7 +9138,8 @@
                ieee80211_state_name[vap->iv_state],
                ieee80211_state_name[nstate]);
  
  
        ath_hal_setledstate(ah, leds[nstate]);  /* set LED */
        netif_stop_queue(dev);                  /* before we do anything else */
-@@ -9324,7 +9361,8 @@
+@@ -9327,7 +9364,8 @@
                                "VAP -> DFSWAIT_PENDING \n");
                        /* start calibration timer with a really small value 
                         * 1/10 sec */
                        /* wake the receiver */
                        netif_wake_queue(dev);
                        /* don't do the other usual stuff... */
-@@ -9367,7 +9405,7 @@
+@@ -9370,7 +9408,7 @@
        error = avp->av_newstate(vap, nstate, arg);
  
        /* Finally, start any timers. */
 
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -8923,7 +8923,7 @@
+@@ -8926,7 +8926,7 @@
                 * re configure beacons when it is a turbo mode switch.
                 * HW seems to turn off beacons during turbo mode switch.
                 */
 
 
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -8254,6 +8254,17 @@
+@@ -8257,6 +8257,17 @@
                        goto bf_fail;
                }
  
 
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -8104,6 +8104,7 @@
+@@ -8107,6 +8107,7 @@
                ath_hal_setupxtxdesc(sc->sc_ah, ds, mrr.rate1, mrr.retries1,
                                     mrr.rate2, mrr.retries2,
                                     mrr.rate3, mrr.retries3);
 
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -10277,11 +10277,11 @@
+@@ -10280,11 +10280,11 @@
        sc->sc_currates = rt;
        sc->sc_curmode = mode;
        /*
 
        if (ar_device(sc->devid) == 5212 || ar_device(sc->devid) == 5213) {
                /* set ack to be sent at low bit-rate */
                /* registers taken from the OpenBSD 5212 HAL */
-@@ -10792,8 +10795,13 @@
+@@ -10795,8 +10798,13 @@
                                break;
  #endif
                        case ATH_ACKRATE:
 
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -8865,8 +8865,7 @@
+@@ -8868,8 +8868,7 @@
                 * needed to do the reset with chanchange = AH_FALSE in order
                 * to receive traffic when peforming high velocity channel
                 * changes. */
 
        ath_update_txpow(sc);           /* update tx power state */
        ath_radar_update(sc);
        ath_setdefantenna(sc, sc->sc_defant);
-@@ -4173,6 +4200,8 @@
+@@ -4176,6 +4203,8 @@
        if (sc->sc_nmonvaps > 0)
                rfilt |= (HAL_RX_FILTER_CONTROL | HAL_RX_FILTER_BEACON |
                          HAL_RX_FILTER_PROBEREQ | HAL_RX_FILTER_PROM);
        if (sc->sc_curchan.privFlags & CHANNEL_DFS)
                rfilt |= (HAL_RX_FILTER_PHYERR | HAL_RX_FILTER_PHYRADAR);
        return rfilt;
-@@ -6523,9 +6552,6 @@
+@@ -6526,9 +6555,6 @@
                        rs->rs_rssi = 0;
  
                len = rs->rs_datalen;
  
                if (rs->rs_more) {
                        /*
-@@ -8877,9 +8903,7 @@
+@@ -8880,9 +8906,7 @@
                if (sc->sc_softled)
                        ath_hal_gpioCfgOutput(ah, sc->sc_ledpin);
  
                sc->sc_curchan = hchan;
                ath_update_txpow(sc);           /* update tx power state */
                ath_radar_update(sc);
-@@ -10656,9 +10680,54 @@
+@@ -10659,9 +10683,54 @@
        ATH_RP_IGNORED          = 24,
        ATH_RADAR_IGNORED       = 25,
        ATH_MAXVAPS             = 26,
  ATH_SYSCTL_DECL(ath_sysctl_halparam, ctl, write, filp, buffer, lenp, ppos)
  {
        struct ath_softc *sc = ctl->extra1;
-@@ -10844,6 +10913,11 @@
+@@ -10847,6 +10916,11 @@
                        case ATH_RADAR_IGNORED:
                                sc->sc_radar_ignored = val;
                                break;
                        default:
                                ret = -EINVAL;
                                break;
-@@ -10910,6 +10984,11 @@
+@@ -10913,6 +10987,11 @@
                case ATH_RADAR_IGNORED:
                        val = sc->sc_radar_ignored;
                        break;
                default:
                        ret = -EINVAL;
                        break;
-@@ -11087,6 +11166,24 @@
+@@ -11090,6 +11169,24 @@
          .proc_handler = ath_sysctl_halparam,
          .extra2       = (void *)ATH_RADAR_IGNORED,
        },
 
 
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -8325,6 +8325,18 @@
+@@ -8328,6 +8328,18 @@
  #endif
                                if (ts->ts_status & HAL_TXERR_XRETRY) {
                                        sc->sc_stats.ast_tx_xretries++;
 
 
 Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 
-Index: madwifi-trunk-r3314/net80211/ieee80211_scan_sta.c
-===================================================================
---- madwifi-trunk-r3314.orig/net80211/ieee80211_scan_sta.c     2008-07-23 11:39:10.000000000 +0200
-+++ madwifi-trunk-r3314/net80211/ieee80211_scan_sta.c  2008-07-24 18:24:23.000000000 +0200
+--- a/net80211/ieee80211_scan_sta.c
++++ b/net80211/ieee80211_scan_sta.c
 @@ -209,6 +209,19 @@
                ieee80211_saveie(iep, ie);
  }
 
  /* simple hash is enough for variation of macaddr */
 --- a/net80211/ieee80211_output.c
 +++ b/net80211/ieee80211_output.c
-@@ -2140,7 +2140,7 @@
+@@ -2141,7 +2141,7 @@
  
        ieee80211_mgmt_output(ieee80211_ref_node(ni), skb, type);
        if (timer)
 
 
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -3398,12 +3398,17 @@
+@@ -3400,12 +3400,17 @@
                        }
  
                        /* WDS/Repeater: re-schedule software beacon timer for 
                if (ic->ic_roaming == IEEE80211_ROAMING_AUTO) {
  #ifdef ATH_SUPERG_DYNTURBO
                        /* 
-@@ -1617,14 +1642,14 @@
+@@ -1621,14 +1646,14 @@
                }
  
                /* WDS/Repeater: Start software beacon timer for STA */
  
 --- a/net80211/ieee80211_var.h
 +++ b/net80211/ieee80211_var.h
-@@ -282,6 +282,7 @@
+@@ -283,6 +283,7 @@
  
        struct timer_list iv_swbmiss;                   /* software beacon miss timer */
        u_int16_t iv_swbmiss_period;                    /* software beacon miss timer period */
 
  #define       SIOCG80211STATS                 (SIOCDEVPRIVATE+2)
 --- a/net80211/ieee80211_wireless.c
 +++ b/net80211/ieee80211_wireless.c
-@@ -2798,6 +2798,12 @@
+@@ -2799,6 +2799,12 @@
        case IEEE80211_PARAM_ROAM_RATE_11G:
                vap->iv_roam.rate11b = value;
                break;
        case IEEE80211_PARAM_UAPSDINFO:
                if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
                        if (ic->ic_caps & IEEE80211_C_UAPSD) {
-@@ -3183,6 +3189,12 @@
+@@ -3184,6 +3190,12 @@
        case IEEE80211_PARAM_ROAM_RATE_11G:
                param[0] = vap->iv_roam.rate11b;
                break;
        case IEEE80211_PARAM_UAPSDINFO:
                if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
                        if (IEEE80211_VAP_UAPSD_ENABLED(vap))
-@@ -5732,6 +5744,14 @@
+@@ -5733,6 +5745,14 @@
          IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "rate11g" },
        { IEEE80211_PARAM_ROAM_RATE_11G,
          0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_rate11g" },
 
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -4914,7 +4914,7 @@
+@@ -4917,7 +4917,7 @@
         * capability info and arrange for a mode change
         * if needed.
         */
 
  MODULE_PARM_DESC(autocreate, "Create ath device in "
                "[sta|ap|wds|adhoc|ahdemo|monitor] mode. defaults to sta, use "
                "'none' to disable");
-@@ -5061,7 +5065,7 @@
+@@ -5064,7 +5068,7 @@
                DPRINTF(sc, ATH_DEBUG_BEACON_PROC,
                        "Missed %u consecutive beacons (n_beacon=%u)\n",
                        sc->sc_bmisscount, n_beacon);
                        ATH_SCHEDULE_TQUEUE(&sc->sc_bstucktq, needmark);
                return;
        }
-@@ -5217,7 +5221,7 @@
+@@ -5220,7 +5224,7 @@
         *     check will be true, in which case return
         *     without resetting the driver.
         */
 
 --- a/net80211/ieee80211_wireless.c
 +++ b/net80211/ieee80211_wireless.c
-@@ -3726,6 +3726,7 @@
+@@ -3723,6 +3723,7 @@
                if (vap->iv_opmode == IEEE80211_M_STA) {
                        struct scanlookup lookup;
  
 
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -6321,7 +6321,7 @@
+@@ -6324,7 +6324,7 @@
  
        /* Never copy the SKB, as it is ours on the RX side, and this is the 
         * last process on the TX side and we only modify our own headers. */
        if (tskb == NULL) {
                DPRINTF(sc, ATH_DEBUG_ANY,
                        "Dropping; ath_skb_removepad failed!\n");
-@@ -6329,6 +6329,8 @@
+@@ -6332,6 +6332,8 @@
        }
        
        ieee80211_input_monitor(ic, tskb, bf, tx, tsf, sc);