madwifi: wds updates

- refactor wds code
- add interface for separating individual wds stations from the master interface
- add some queueing fixes for packets passing through virtual interfaces


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@12003 3c298f89-4303-0410-b956-a3cf2f4a3e73

7 files changed, 1172 insertions, 6 deletions

diff --git a/package/madwifi/patches/370-wdsvap.patch b/package/madwifi/patches/370-wdsvap.patch
new file mode 100644
index 0000000000..ee0a2de5bb
--- /dev/null
+++ b/package/madwifi/patches/370-wdsvap.patch
@@ -0,0 +1,706 @@
+--- a/ath/if_ath.c
++++ b/ath/if_ath.c
+@@ -124,7 +124,7 @@
+ };
+ 
+ static struct ieee80211vap *ath_vap_create(struct ieee80211com *,
+-	const char *, int, int, struct net_device *);
++	const char *, int, int, struct net_device *, struct ieee80211vap *);
+ static void ath_vap_delete(struct ieee80211vap *);
+ static int ath_init(struct net_device *);
+ static int ath_set_ack_bitrate(struct ath_softc *, int);
+@@ -1123,8 +1123,6 @@
+ 			autocreatemode = IEEE80211_M_IBSS;
+ 		else if (!strcmp(autocreate, "ahdemo"))
+ 			autocreatemode = IEEE80211_M_AHDEMO;
+-		else if (!strcmp(autocreate, "wds"))
+-			autocreatemode = IEEE80211_M_WDS;
+ 		else if (!strcmp(autocreate, "monitor"))
+ 			autocreatemode = IEEE80211_M_MONITOR;
+ 		else {
+@@ -1137,7 +1135,7 @@
+ 	if (autocreatemode != -1) {
+ 		rtnl_lock();
+ 		vap = ieee80211_create_vap(ic, "ath%d", dev,
+-				autocreatemode, 0);
++				autocreatemode, 0, NULL);
+ 		rtnl_unlock();
+ 		if (vap == NULL)
+ 			EPRINTF(sc, "Autocreation of %s VAP failed.", autocreate);
+@@ -1230,14 +1228,14 @@
+ 
+ static struct ieee80211vap *
+ ath_vap_create(struct ieee80211com *ic, const char *name,
+-	int opmode, int flags, struct net_device *mdev)
++	int opmode, int flags, struct net_device *mdev, struct ieee80211vap *master)
+ {
+ 	struct ath_softc *sc = ic->ic_dev->priv;
+ 	struct ath_hal *ah = sc->sc_ah;
+ 	struct net_device *dev;
+ 	struct ath_vap *avp;
+ 	struct ieee80211vap *vap;
+-	int ic_opmode;
++	int ic_opmode = IEEE80211_M_STA;
+ 
+ 	if (ic->ic_dev->flags & IFF_RUNNING) {
+ 		/* needs to disable hardware too */
+@@ -1271,8 +1269,12 @@
+ 		} else
+ 			ic_opmode = opmode;
+ 		break;
+-	case IEEE80211_M_HOSTAP:
+ 	case IEEE80211_M_WDS:
++		if (!master)
++			return NULL;
++		ic_opmode = ic->ic_opmode;
++		break;
++	case IEEE80211_M_HOSTAP:
+ 		/* permit multiple APs and/or WDS links */
+ 		/* XXX sta+ap for repeater/bridge application */
+ 		if ((sc->sc_nvaps != 0) && (ic->ic_opmode == IEEE80211_M_STA))
+@@ -1304,7 +1306,7 @@
+ 	}
+ 
+ 	avp = dev->priv;
+-	ieee80211_vap_setup(ic, dev, name, opmode, flags);
++	ieee80211_vap_setup(ic, dev, name, opmode, flags, master);
+ 	/* override with driver methods */
+ 	vap = &avp->av_vap;
+ 	avp->av_newstate = vap->iv_newstate;
+@@ -4201,8 +4203,7 @@
+ 	if (ic->ic_opmode == IEEE80211_M_STA ||
+ 	    sc->sc_opmode == HAL_M_IBSS ||	/* NB: AHDEMO too */
+ 	    (sc->sc_nostabeacons) || sc->sc_scanning ||
+-		((ic->ic_opmode == IEEE80211_M_HOSTAP) &&
+-		 (ic->ic_protmode != IEEE80211_PROT_NONE)))
++		(ic->ic_opmode == IEEE80211_M_HOSTAP))
+ 		rfilt |= HAL_RX_FILTER_BEACON;
+ 	if (sc->sc_nmonvaps > 0)
+ 		rfilt |= (HAL_RX_FILTER_CONTROL | HAL_RX_FILTER_BEACON |
+@@ -9030,8 +9031,6 @@
+ 		 * set sc->beacons if we might need to restart
+                  * them after ath_reset. */
+ 		if (!sc->sc_beacons &&
+-				(TAILQ_FIRST(&ic->ic_vaps)->iv_opmode != 
+-				 IEEE80211_M_WDS) &&
+ 				!txcont_was_active &&
+ 				!sc->sc_dfs_cac) {
+ 			sc->sc_beacons = 1;
+--- a/net80211/ieee80211.c
++++ b/net80211/ieee80211.c
+@@ -396,7 +396,7 @@
+ 
+ int
+ ieee80211_vap_setup(struct ieee80211com *ic, struct net_device *dev,
+-	const char *name, int opmode, int flags)
++	const char *name, int opmode, int flags, struct ieee80211vap *master)
+ {
+ #define	IEEE80211_C_OPMODE \
+ 	(IEEE80211_C_IBSS | IEEE80211_C_HOSTAP | IEEE80211_C_AHDEMO | \
+@@ -510,9 +510,18 @@
+ 
+ 	vap->iv_monitor_crc_errors = 0;
+ 	vap->iv_monitor_phy_errors = 0;
++	TAILQ_INIT(&vap->iv_wdslinks);
+ 
+-	IEEE80211_ADDR_COPY(vap->iv_myaddr, ic->ic_myaddr);
+-	IEEE80211_ADDR_COPY(vap->iv_bssid, ic->ic_myaddr);
++	if (master && (vap->iv_opmode == IEEE80211_M_WDS)) {
++		vap->iv_master = master;
++		TAILQ_INSERT_TAIL(&master->iv_wdslinks, vap, iv_wdsnext);
++		/* use the same BSSID as the master interface */
++		IEEE80211_ADDR_COPY(vap->iv_myaddr, vap->iv_master->iv_myaddr);
++		IEEE80211_ADDR_COPY(vap->iv_bssid, vap->iv_master->iv_myaddr);
++	} else {
++		IEEE80211_ADDR_COPY(vap->iv_myaddr, ic->ic_myaddr);
++		IEEE80211_ADDR_COPY(vap->iv_bssid, ic->ic_myaddr);
++	}
+ 	/* NB: Defer setting dev_addr so driver can override */
+ 
+ 	ieee80211_crypto_vattach(vap);
+@@ -547,7 +556,8 @@
+ 	ifmedia_set(&vap->iv_media, imr.ifm_active);
+ 
+ 	IEEE80211_LOCK_IRQ(ic);
+-	TAILQ_INSERT_TAIL(&ic->ic_vaps, vap, iv_next);
++	if (vap->iv_opmode != IEEE80211_M_WDS)
++		TAILQ_INSERT_TAIL(&ic->ic_vaps, vap, iv_next);
+ 	IEEE80211_UNLOCK_IRQ(ic);
+ 
+ 	IEEE80211_ADDR_COPY(dev->dev_addr, vap->iv_myaddr);
+@@ -579,10 +589,24 @@
+ {
+ 	struct ieee80211com *ic = vap->iv_ic;
+ 	struct net_device *dev = vap->iv_dev;
++	struct ieee80211vap *avp;
++
++	/* Drop all WDS links that belong to this vap */
++	while ((avp = TAILQ_FIRST(&vap->iv_wdslinks)) != NULL) {
++		ieee80211_stop(avp->iv_dev);
++		ic->ic_vap_delete(avp);
++	}
+ 
+ 	IEEE80211_CANCEL_TQUEUE(&vap->iv_stajoin1tq);
+ 	IEEE80211_LOCK_IRQ(ic);
+-	TAILQ_REMOVE(&ic->ic_vaps, vap, iv_next);
++	if (vap->iv_wdsnode)
++		ieee80211_unref_node(&vap->iv_wdsnode);
++	if ((vap->iv_opmode == IEEE80211_M_WDS) &&
++		(vap->iv_master != NULL))
++		TAILQ_REMOVE(&vap->iv_master->iv_wdslinks, vap, iv_wdsnext);
++	else
++		TAILQ_REMOVE(&ic->ic_vaps, vap, iv_next);
++
+ 	if (TAILQ_EMPTY(&ic->ic_vaps))		/* reset to supported mode */
+ 		ic->ic_opmode = IEEE80211_M_STA;
+ 	IEEE80211_UNLOCK_IRQ(ic);
+--- a/net80211/ieee80211_ioctl.h
++++ b/net80211/ieee80211_ioctl.h
+@@ -474,7 +474,7 @@
+ #define	IEEE80211_IOC_DTIM_PERIOD	52	/* DTIM period (beacons) */
+ #define	IEEE80211_IOC_BEACON_INTERVAL	53	/* beacon interval (ms) */
+ #define	IEEE80211_IOC_ADDMAC		54	/* add sta to MAC ACL table */
+-#define	IEEE80211_IOC_DELMAC		55	/* del sta from MAC ACL table */
++#define	IEEE80211_IOC_SETMAC		55	/* set interface wds mac addr */
+ #define	IEEE80211_IOC_FF		56	/* ATH fast frames (on, off) */
+ #define	IEEE80211_IOC_TURBOP		57	/* ATH turbo' (on, off) */
+ #define	IEEE80211_IOC_APPIEBUF		58	/* IE in the management frame */
+@@ -552,8 +552,8 @@
+ #define	IEEE80211_IOCTL_HALMAP		(SIOCIWFIRSTPRIV+21)
+ #define	IEEE80211_IOCTL_ADDMAC		(SIOCIWFIRSTPRIV+22)
+ #define	IEEE80211_IOCTL_DELMAC		(SIOCIWFIRSTPRIV+24)
+-#define	IEEE80211_IOCTL_WDSADDMAC	(SIOCIWFIRSTPRIV+26)
+-#define	IEEE80211_IOCTL_WDSDELMAC	(SIOCIWFIRSTPRIV+28)
++#define	IEEE80211_IOCTL_WDSADDMAC	(SIOCIWFIRSTPRIV+25)
++#define	IEEE80211_IOCTL_WDSSETMAC	(SIOCIWFIRSTPRIV+26)
+ #define	IEEE80211_IOCTL_KICKMAC		(SIOCIWFIRSTPRIV+30)
+ #define	IEEE80211_IOCTL_SETSCANLIST	(SIOCIWFIRSTPRIV+31)
+ 
+--- a/net80211/ieee80211_linux.h
++++ b/net80211/ieee80211_linux.h
+@@ -650,5 +650,5 @@
+ int ieee80211_ioctl_create_vap(struct ieee80211com *, struct ifreq *,
+ 	struct net_device *);
+ struct ieee80211vap *ieee80211_create_vap(struct ieee80211com *, char *,
+-	struct net_device *, int, int);
++	struct net_device *, int, int, struct ieee80211vap *);
+ #endif /* _NET80211_IEEE80211_LINUX_H_ */
+--- a/net80211/ieee80211_var.h
++++ b/net80211/ieee80211_var.h
+@@ -187,6 +187,12 @@
+ 	struct ieee80211_proc_entry *iv_proc_entries;
+ 	struct vlan_group *iv_vlgrp;			/* vlan group state */
+ 
++	/* list of wds links */
++	TAILQ_HEAD(, ieee80211vap) iv_wdslinks;
++	TAILQ_ENTRY(ieee80211vap) iv_wdsnext;
++	struct ieee80211vap *iv_master;
++	struct ieee80211_node *iv_wdsnode;
++
+ 	TAILQ_ENTRY(ieee80211vap) iv_next;		/* list of vap instances */
+ 	struct ieee80211com *iv_ic;			/* back ptr to common state */
+ 	u_int32_t iv_debug;				/* debug msg flags */
+@@ -447,7 +453,7 @@
+ 	atomic_t ic_node_counter;
+ 	/* Virtual AP create/delete */
+ 	struct ieee80211vap *(*ic_vap_create)(struct ieee80211com *,
+-		const char *, int, int, struct net_device *);
++		const char *, int, int, struct net_device *, struct ieee80211vap *);
+ 	void (*ic_vap_delete)(struct ieee80211vap *);
+ 
+ 	/* Send/recv 802.11 management frame */
+@@ -703,7 +709,7 @@
+ int ieee80211_ifattach(struct ieee80211com *);
+ void ieee80211_ifdetach(struct ieee80211com *);
+ int ieee80211_vap_setup(struct ieee80211com *, struct net_device *,
+-	const char *, int, int);
++	const char *, int, int, struct ieee80211vap *);
+ int ieee80211_vap_attach(struct ieee80211vap *, ifm_change_cb_t, ifm_stat_cb_t);
+ void ieee80211_vap_detach(struct ieee80211vap *);
+ void ieee80211_mark_dfs(struct ieee80211com *, struct ieee80211_channel *);
+--- a/net80211/ieee80211_wireless.c
++++ b/net80211/ieee80211_wireless.c
+@@ -2190,7 +2190,7 @@
+ 			ieee80211_scan_flush(ic);	/* NB: could optimize */
+ 
+ 			if (!(xrvap = ic->ic_vap_create(ic, name, IEEE80211_M_HOSTAP,
+-				IEEE80211_VAP_XR | IEEE80211_CLONE_BSSID, dev)))
++				IEEE80211_VAP_XR | IEEE80211_CLONE_BSSID, dev, NULL)))
+ 				return;
+ 
+ 			/* We use iv_xrvap to link to the parent VAP as well */
+@@ -3801,74 +3801,51 @@
+ 	return 0;
+ }
+ 
++#define WDSNAME ".wds%d"
+ static int
+-ieee80211_ioctl_wdsmac(struct net_device *dev, struct iw_request_info *info,
++ieee80211_ioctl_wdsaddmac(struct net_device *dev, struct iw_request_info *info,
+ 	void *w, char *extra)
+ {
+ 	struct ieee80211vap *vap = dev->priv;
+ 	struct sockaddr *sa = (struct sockaddr *)extra;
++	struct ieee80211com *ic = vap->iv_ic;
++	struct ieee80211vap *avp;
++	char *name;
+ 
+-	if (!IEEE80211_ADDR_NULL(vap->wds_mac)) {
+-		printk("%s: Failed to add WDS MAC: " MAC_FMT "\n", dev->name,
+-			MAC_ADDR(sa->sa_data));
+-		printk("%s: Device already has WDS mac address attached,"
+-			" remove first\n", dev->name);
+-		return -1;
+-	}
+-
+-	memcpy(vap->wds_mac, sa->sa_data, IEEE80211_ADDR_LEN);
+-
+-	printk("%s: Added WDS MAC: " MAC_FMT "\n", dev->name,
+-		MAC_ADDR(vap->wds_mac));
++	name = kmalloc(strlen(vap->iv_dev->name) + sizeof(WDSNAME) + 1, GFP_KERNEL);
++	if (!name)
++		return -ENOMEM;
+ 
+-	if (IS_UP(vap->iv_dev)) {
+-		/* Force us back to scan state to force us to go back through RUN
+-		 * state and create/pin the WDS peer node into memory. */
+-		return ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
+-	}
++	strcpy(name, vap->iv_dev->name);
++	strcat(name, WDSNAME);
++	avp = ieee80211_create_vap(ic, name, ic->ic_dev, IEEE80211_M_WDS, 0, vap);
++	kfree(name);
++	if (!avp)
++		return -ENOMEM;
+ 
++	memcpy(avp->wds_mac, sa->sa_data, IEEE80211_ADDR_LEN);
+ 	return 0;
+ }
++#undef WDSNAME
+ 
+ static int
+-ieee80211_ioctl_wdsdelmac(struct net_device *dev, struct iw_request_info *info,
++ieee80211_ioctl_wdssetmac(struct net_device *dev, struct iw_request_info *info,
+ 	void *w, char *extra)
+ {
+ 	struct ieee80211vap *vap = dev->priv;
+ 	struct sockaddr *sa = (struct sockaddr *)extra;
+-	struct ieee80211com *ic = vap->iv_ic;
+-	struct ieee80211_node *wds_ni;
+ 
+-	/* WDS Mac address filed already? */
+-	if (IEEE80211_ADDR_NULL(vap->wds_mac))
+-		return 0;
++	if (vap->iv_opmode != IEEE80211_M_WDS)
++		return -EINVAL;
+ 
+-	/* Compare suplied MAC address with WDS MAC of this interface 
+-	 * remove when mac address is known
+-	 */
+-	if (memcmp(vap->wds_mac, sa->sa_data, IEEE80211_ADDR_LEN) == 0) {
+-		if (IS_UP(vap->iv_dev)) {
+-			wds_ni = ieee80211_find_txnode(vap, vap->wds_mac);
+-			if (wds_ni != NULL) {
+-				/* Release reference created by find node */
+-				ieee80211_unref_node(&wds_ni);
+-				/* Release reference created by transition to RUN state,
+-				 * [pinning peer node into the table] */
+-				ieee80211_unref_node(&wds_ni);
+-			}
+-		}
+-		memset(vap->wds_mac, 0x00, IEEE80211_ADDR_LEN);
+-		if (IS_UP(vap->iv_dev)) {
+-			/* This leaves a dead WDS node, until started again */
+-			return ic->ic_reset(ic->ic_dev);
+-		}
+-		return 0;
++	memcpy(vap->wds_mac, sa->sa_data, IEEE80211_ADDR_LEN);
++	if (IS_UP(vap->iv_dev)) {
++		/* Force us back to scan state to force us to go back through RUN
++		 * state and create/pin the WDS peer node into memory. */
++		return ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
+ 	}
+ 
+-	printk("%s: WDS MAC address " MAC_FMT " is not known by this interface\n",
+-		dev->name, MAC_ADDR(sa->sa_data));
+-
+-	return -1;
++	return 0;
+ }
+ 
+ /*
+@@ -5391,8 +5368,8 @@
+ 	  IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0, "kickmac"},
+ 	{ IEEE80211_IOCTL_WDSADDMAC,
+ 	  IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0,"wds_add" },
+-	{ IEEE80211_IOCTL_WDSDELMAC,
+-	  IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0,"wds_del" },
++	{ IEEE80211_IOCTL_WDSSETMAC,
++	  IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0,"wds_set" },
+ 	{ IEEE80211_IOCTL_SETCHANLIST,
+ 	  IW_PRIV_TYPE_CHANLIST | IW_PRIV_SIZE_FIXED, 0,"setchanlist" },
+ 	{ IEEE80211_IOCTL_GETCHANLIST,
+@@ -5884,8 +5861,8 @@
+ #endif
+ 	set_priv(IEEE80211_IOCTL_ADDMAC, ieee80211_ioctl_addmac),
+ 	set_priv(IEEE80211_IOCTL_DELMAC, ieee80211_ioctl_delmac),
+-	set_priv(IEEE80211_IOCTL_WDSADDMAC, ieee80211_ioctl_wdsmac),
+-	set_priv(IEEE80211_IOCTL_WDSDELMAC, ieee80211_ioctl_wdsdelmac),
++	set_priv(IEEE80211_IOCTL_WDSADDMAC, ieee80211_ioctl_wdsaddmac),
++	set_priv(IEEE80211_IOCTL_WDSSETMAC, ieee80211_ioctl_wdssetmac),
+ 	set_priv(IEEE80211_IOCTL_KICKMAC, ieee80211_ioctl_kickmac),
+ 	set_priv(IEEE80211_IOCTL_SETSCANLIST, ieee80211_ioctl_setscanlist),
+ #ifdef ATH_REVERSE_ENGINEERING
+@@ -5956,7 +5933,7 @@
+ 
+ 	strncpy(name, cp.icp_name, sizeof(name));
+ 
+-	vap = ieee80211_create_vap(ic, name, mdev, cp.icp_opmode, cp.icp_flags);
++	vap = ieee80211_create_vap(ic, name, mdev, cp.icp_opmode, cp.icp_flags, NULL);
+ 	if (vap == NULL)
+ 		return -EIO;
+ 
+@@ -5973,9 +5950,9 @@
+  */
+ struct ieee80211vap*
+ ieee80211_create_vap(struct ieee80211com *ic, char *name,
+-	struct net_device *mdev, int opmode, int opflags)
++	struct net_device *mdev, int opmode, int opflags, struct ieee80211vap *master)
+ {
+-	return ic->ic_vap_create(ic, name, opmode, opflags, mdev);
++	return ic->ic_vap_create(ic, name, opmode, opflags, mdev, master);
+ }
+ EXPORT_SYMBOL(ieee80211_create_vap);
+ 
+--- a/net80211/ieee80211_input.c
++++ b/net80211/ieee80211_input.c
+@@ -201,6 +201,7 @@
+ 	struct ieee80211_node * ni = ni_or_null;
+ 	struct ieee80211com *ic = vap->iv_ic;
+ 	struct net_device *dev = vap->iv_dev;
++	struct ieee80211_node *ni_wds = NULL;
+ 	struct ieee80211_frame *wh;
+ 	struct ieee80211_key *key;
+ 	struct ether_header *eh;
+@@ -545,11 +546,29 @@
+ 			 * the node table for the packet source address (addr4).
+ 			 * If not, add one.
+ 			 */
+-			/* XXX: Useless node mgmt API; make better */
++
++			/* check for wds link first */
+ 			if (dir == IEEE80211_FC1_DIR_DSTODS) {
+-				struct ieee80211_node_table *nt;
++				struct ieee80211vap *avp;
++
++				TAILQ_FOREACH(avp, &vap->iv_wdslinks, iv_wdsnext) {
++					if (!memcmp(avp->wds_mac, wh->i_addr2, IEEE80211_ADDR_LEN)) {
++						IEEE80211_LOCK_IRQ(ni->ni_ic);
++						ni_wds = avp->iv_wdsnode;
++						IEEE80211_UNLOCK_IRQ(ni->ni_ic);
++						break;
++					}
++				}
++				if (ni_wds != NULL) {
++					ieee80211_unref_node(&ni);
++					ni = ieee80211_ref_node(ni_wds);
++				}
++			}
++
++			/* XXX: Useless node mgmt API; make better */
++			if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni_wds) {
++				struct ieee80211_node_table *nt = &ic->ic_sta;
+ 				struct ieee80211_frame_addr4 *wh4;
+-				struct ieee80211_node *ni_wds;
+ 
+ 				if (!(vap->iv_flags_ext & IEEE80211_FEXT_WDS)) {
+ 					IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
+@@ -557,7 +576,6 @@
+ 					goto err;
+ 				}
+ 				wh4 = (struct ieee80211_frame_addr4 *)skb->data;
+-				nt = &ic->ic_sta;
+ 				ni_wds = ieee80211_find_wds_node(nt, wh4->i_addr4);
+ 				/* Last call increments ref count if !NULL */
+ 				if ((ni_wds != NULL) && (ni_wds != ni)) {
+@@ -3084,8 +3102,7 @@
+ 		    (vap->iv_opmode == IEEE80211_M_STA && ni->ni_associd) ||
+ 		    (vap->iv_opmode == IEEE80211_M_IBSS) ||
+ 			((subtype == IEEE80211_FC0_SUBTYPE_BEACON) &&
+-			 (vap->iv_opmode == IEEE80211_M_HOSTAP) &&
+-			 (ic->ic_protmode != IEEE80211_PROT_NONE)))) {
++			 (vap->iv_opmode == IEEE80211_M_HOSTAP)))) {
+ 			vap->iv_stats.is_rx_mgtdiscard++;
+ 			return;
+ 		}
+@@ -3471,13 +3488,53 @@
+ 		 */
+ 		if (ic->ic_flags & IEEE80211_F_SCAN) {
+ 			ieee80211_add_scan(vap, &scan, wh, subtype, rssi, rtsf);
+-			return;
+ 		}
+-		if ((vap->iv_opmode == IEEE80211_M_IBSS) && 
+-				(scan.capinfo & IEEE80211_CAPINFO_IBSS)) {
++		/* NB: Behavior of WDS-Link and Ad-Hoc is very similar here:
++		 * When we receive a beacon that belongs to the AP that we're
++		 * connected to, use it to refresh the local node info.
++		 * If no node is found, go through the vap's wds link table
++		 * and try to find the sub-vap that is interested in this address
++		 */
++		if (((vap->iv_opmode == IEEE80211_M_IBSS) &&
++				(scan.capinfo & IEEE80211_CAPINFO_IBSS)) ||
++				(((vap->iv_opmode == IEEE80211_M_HOSTAP) ||
++				 (vap->iv_opmode == IEEE80211_M_WDS)) &&
++				(scan.capinfo & IEEE80211_CAPINFO_ESS))) {
++			struct ieee80211vap *avp = NULL;
++
++			IEEE80211_LOCK_IRQ(vap->iv_ic);
++			if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
++				int found = 0;
++
++				TAILQ_FOREACH(avp, &vap->iv_wdslinks, iv_wdsnext) {
++					if (!memcmp(avp->wds_mac, wh->i_addr2, IEEE80211_ADDR_LEN)) {
++						found = 1;
++						break;
++					}
++				}
++				if (found) {
++					if (!avp->iv_wdsnode)
++						break;
++					ni = ni_or_null = avp->iv_wdsnode;
++				} else {
++					avp = NULL;
++				}
++			}
++			IEEE80211_UNLOCK_IRQ(vap->iv_ic);
++
++
+ 			if (ni_or_null == NULL) {
+-				/* Create a new entry in the neighbor table. */
+-				ni = ieee80211_add_neighbor(vap, wh, &scan);
++				if (avp) {
++					IEEE80211_LOCK_IRQ(ic);
++					ni = ieee80211_add_neighbor(avp, wh, &scan);
++					/* force assoc */
++					ni->ni_associd |= 0xc000;
++					avp->iv_wdsnode = ieee80211_ref_node(ni);
++					IEEE80211_UNLOCK_IRQ(ic);
++				} else if (vap->iv_opmode == IEEE80211_M_IBSS) {
++					/* Create a new entry in the neighbor table. */
++					ni = ieee80211_add_neighbor(vap, wh, &scan);
++				}
+ 			} else {
+ 				/*
+ 				 * Copy data from beacon to neighbor table.
+@@ -3490,6 +3547,7 @@
+ 				IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
+ 				memcpy(ni->ni_tstamp.data, scan.tstamp,
+ 					sizeof(ni->ni_tstamp));
++				ni->ni_inact = ni->ni_inact_reload;
+ 				ni->ni_intval = 
+ 					IEEE80211_BINTVAL_SANITISE(scan.bintval);
+ 				ni->ni_capinfo = scan.capinfo;
+--- a/net80211/ieee80211_node.c
++++ b/net80211/ieee80211_node.c
+@@ -1553,22 +1553,24 @@
+ 	((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
+ 	struct ieee80211_node_table *nt;
+ 	struct ieee80211_node *ni;
++	u_int8_t *addr;
++
++	if (IS_CTL(wh) && !IS_PSPOLL(wh) /*&& !IS_RTS(ah)*/)
++		addr = wh->i_addr1;
++	else
++		addr = wh->i_addr2;
++
++	if (IEEE80211_IS_MULTICAST(addr))
++		return NULL;
+ 
+ 	/* XXX check ic_bss first in station mode */
+ 	/* XXX 4-address frames? */
+ 	nt = &ic->ic_sta;
+ 	IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
+-	if (IS_CTL(wh) && !IS_PSPOLL(wh) /*&& !IS_RTS(ah)*/)
+ #ifdef IEEE80211_DEBUG_REFCNT
+-		ni = ieee80211_find_node_locked_debug(nt, wh->i_addr1, func, line);
++	ni = ieee80211_find_node_locked_debug(nt, addr, func, line);
+ #else
+-		ni = ieee80211_find_node_locked(nt, wh->i_addr1);
+-#endif
+-	else
+-#ifdef IEEE80211_DEBUG_REFCNT
+-		ni = ieee80211_find_node_locked_debug(nt, wh->i_addr2, func, line);
+-#else
+-		ni = ieee80211_find_node_locked(nt, wh->i_addr2);
++	ni = ieee80211_find_node_locked(nt, addr);
+ #endif
+ 	IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
+ 
+@@ -1669,6 +1671,11 @@
+ {
+ 	struct ieee80211vap *vap = ni->ni_vap;
+ 
++	IEEE80211_LOCK_IRQ(ni->ni_ic);
++	if (vap && ni == vap->iv_wdsnode)
++		vap->iv_wdsnode = NULL;
++	IEEE80211_UNLOCK_IRQ(ni->ni_ic);
++
+ 	atomic_dec(&ni->ni_ic->ic_node_counter);
+ 	node_print_message(IEEE80211_MSG_NODE|IEEE80211_MSG_NODE_REF,
+ 			   1 /* show counter */, 
+@@ -1781,22 +1788,6 @@
+ 		    jiffies > ni->ni_rxfragstamp + HZ) {
+ 			ieee80211_dev_kfree_skb(&ni->ni_rxfrag);
+ 		}
+-		/*
+-		 * Special case ourself; we may be idle for extended periods
+-		 * of time and regardless reclaiming our state is wrong.
+-		 * Special case a WDS link: it may be dead or idle, but it is 
+-		 * never ok to reclaim it, as this will block transmissions
+-		 * and nobody will recreate the node when the WDS peer is
+-		 * available again. */
+-		if ((ni == ni->ni_vap->iv_bss) ||
+-		    (ni->ni_vap->iv_opmode == IEEE80211_M_WDS && 
+-		     !memcmp(ni->ni_macaddr, ni->ni_vap->wds_mac, ETH_ALEN)))
+-		{
+-			/* NB: don't permit it to go negative */
+-			if (ni->ni_inact > 0)
+-				ni->ni_inact--;
+-			continue;
+-		}
+ 		ni->ni_inact--;
+ 		if (ni->ni_associd != 0 || isadhoc) {
+ 			struct ieee80211vap *vap = ni->ni_vap;
+--- a/net80211/ieee80211_output.c
++++ b/net80211/ieee80211_output.c
+@@ -246,10 +246,16 @@
+ 	 * things like power save.
+ 	 */
+ 	eh = (struct ether_header *)skb->data;
+-	if (vap->iv_opmode == IEEE80211_M_WDS)
+-		ni = ieee80211_find_txnode(vap, vap->wds_mac);
+-	else
++	if (vap->iv_opmode == IEEE80211_M_WDS) {
++		IEEE80211_LOCK_IRQ(ic);
++		ni = vap->iv_wdsnode;
++		IEEE80211_UNLOCK_IRQ(ic);
++		if (!ni)
++			goto bad;
++		ni = ieee80211_ref_node(vap->iv_wdsnode);
++	} else {
+ 		ni = ieee80211_find_txnode(vap, eh->ether_dhost);
++	}
+ 	if (ni == NULL) {
+ 		/* NB: ieee80211_find_txnode does stat+msg */
+ 		goto bad;
+@@ -788,7 +794,7 @@
+ 		break;
+ 	case IEEE80211_M_WDS:
+ 		use4addr = 1;
+-		ismulticast = IEEE80211_IS_MULTICAST(ni->ni_macaddr);
++		ismulticast = 0;
+ 		break;
+ 	case IEEE80211_M_HOSTAP:
+ 		if (!IEEE80211_IS_MULTICAST(eh.ether_dhost) &&
+@@ -973,7 +979,7 @@
+ 			break;
+ 		case IEEE80211_M_WDS:
+ 			wh->i_fc[1] = IEEE80211_FC1_DIR_DSTODS;
+-			IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr);
++			IEEE80211_ADDR_COPY(wh->i_addr1, vap->wds_mac);
+ 			IEEE80211_ADDR_COPY(wh->i_addr2, vap->iv_myaddr);
+ 			IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_dhost);
+ 			IEEE80211_ADDR_COPY(WH4(wh)->i_addr4, eh.ether_shost);
+--- a/tools/athkey.c
++++ b/tools/athkey.c
+@@ -118,7 +118,7 @@
+ 				IOCTL_ERR(IEEE80211_IOCTL_ADDMAC),
+ 				IOCTL_ERR(IEEE80211_IOCTL_DELMAC),
+ 				IOCTL_ERR(IEEE80211_IOCTL_WDSADDMAC),
+-				IOCTL_ERR(IEEE80211_IOCTL_WDSDELMAC),
++				IOCTL_ERR(IEEE80211_IOCTL_WDSSETMAC),
+ 				IOCTL_ERR(IEEE80211_IOCTL_READREG),
+ 				IOCTL_ERR(IEEE80211_IOCTL_WRITEREG),
+ 			};
+--- a/tools/athchans.c
++++ b/tools/athchans.c
+@@ -118,7 +118,7 @@
+ 				IOCTL_ERR(IEEE80211_IOCTL_ADDMAC),
+ 				IOCTL_ERR(IEEE80211_IOCTL_DELMAC),
+ 				IOCTL_ERR(IEEE80211_IOCTL_WDSADDMAC),
+-				IOCTL_ERR(IEEE80211_IOCTL_WDSDELMAC),
++				IOCTL_ERR(IEEE80211_IOCTL_WDSSETMAC),
+ 				IOCTL_ERR(IEEE80211_IOCTL_READREG),
+ 				IOCTL_ERR(IEEE80211_IOCTL_WRITEREG),
+ 			};
+--- a/tools/wlanconfig.c
++++ b/tools/wlanconfig.c
+@@ -968,7 +968,7 @@
+ 			IOCTL_ERR(IEEE80211_IOCTL_ADDMAC),
+ 			IOCTL_ERR(IEEE80211_IOCTL_DELMAC),
+ 			IOCTL_ERR(IEEE80211_IOCTL_WDSADDMAC),
+-			IOCTL_ERR(IEEE80211_IOCTL_WDSDELMAC),
++			IOCTL_ERR(IEEE80211_IOCTL_WDSSETMAC),
+ 			IOCTL_ERR(IEEE80211_IOCTL_READREG),
+ 			IOCTL_ERR(IEEE80211_IOCTL_WRITEREG),
+ 		};
+--- a/net80211/ieee80211_proto.c
++++ b/net80211/ieee80211_proto.c
+@@ -1557,57 +1557,12 @@
+ 		switch (ostate) {
+ 		case IEEE80211_S_INIT:
+ 			if (vap->iv_opmode == IEEE80211_M_MONITOR ||
+-			    vap->iv_opmode == IEEE80211_M_WDS ||
+ 			    vap->iv_opmode == IEEE80211_M_HOSTAP) {
+ 				/*
+ 				 * Already have a channel; bypass the
+ 				 * scan and startup immediately.
+ 				 */
+ 				ieee80211_create_ibss(vap, ic->ic_curchan);
+-
+-				/* In WDS mode, allocate and initialize peer node. */
+-				if (vap->iv_opmode == IEEE80211_M_WDS) {
+-					/* XXX: This is horribly non-atomic. */
+-					struct ieee80211_node *wds_ni =
+-						ieee80211_find_node(&ic->ic_sta,
+-								vap->wds_mac);
+-
+-					if (wds_ni == NULL) {
+-						wds_ni = ieee80211_alloc_node_table(
+-								vap,
+-								vap->wds_mac);
+-						if (wds_ni != NULL) {
+-							ieee80211_add_wds_addr(
+-									&ic->ic_sta,
+-									wds_ni,
+-									vap->wds_mac,
+-									1);
+-							ieee80211_ref_node(wds_ni); /* pin in memory */
+-						}
+-						else
+-							IEEE80211_DPRINTF(
+-									vap,
+-									IEEE80211_MSG_NODE,
+-									"%s: Unable to "
+-									"allocate node for "
+-									"WDS: " MAC_FMT "\n",
+-									__func__,
+-									MAC_ADDR(
+-										vap->wds_mac)
+-									);
+-					}
+-
+-					if (wds_ni != NULL) {
+-						ieee80211_node_authorize(wds_ni);
+-						wds_ni->ni_chan =
+-							vap->iv_bss->ni_chan;
+-						wds_ni->ni_capinfo =
+-							ni->ni_capinfo;
+-						wds_ni->ni_associd = 1;
+-						wds_ni->ni_ath_flags =
+-							vap->iv_ath_cap;
+-					}
+-				}
+ 				break;
+ 			}
+ 			/* fall thru... */
diff --git a/package/madwifi/patches/371-wds_sta_separation.patch b/package/madwifi/patches/371-wds_sta_separation.patch
new file mode 100644
index 0000000000..c16145b0a9
--- /dev/null
+++ b/package/madwifi/patches/371-wds_sta_separation.patch
@@ -0,0 +1,421 @@
+--- a/net80211/ieee80211_input.c
++++ b/net80211/ieee80211_input.c
+@@ -202,6 +202,7 @@
+ 	struct ieee80211com *ic = vap->iv_ic;
+ 	struct net_device *dev = vap->iv_dev;
+ 	struct ieee80211_node *ni_wds = NULL;
++	struct net_device_stats *stats;
+ 	struct ieee80211_frame *wh;
+ 	struct ieee80211_key *key;
+ 	struct ether_header *eh;
+@@ -562,11 +563,14 @@
+ 				if (ni_wds != NULL) {
+ 					ieee80211_unref_node(&ni);
+ 					ni = ieee80211_ref_node(ni_wds);
++				} else if (!ni->ni_subif &&
++						(vap->iv_flags_ext & IEEE80211_FEXT_WDSSEP)) {
++					ieee80211_wds_addif(ni);
+ 				}
+ 			}
+ 
+ 			/* XXX: Useless node mgmt API; make better */
+-			if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni_wds) {
++			if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni_wds && !ni->ni_subif) {
+ 				struct ieee80211_node_table *nt = &ic->ic_sta;
+ 				struct ieee80211_frame_addr4 *wh4;
+ 
+@@ -698,8 +702,12 @@
+ 		if (! accept_data_frame(vap, ni, key, skb, eh))
+ 			goto out;
+ 
+-		vap->iv_devstats.rx_packets++;
+-		vap->iv_devstats.rx_bytes += skb->len;
++		if (ni->ni_subif && ((eh)->ether_type != __constant_htons(ETHERTYPE_PAE)))
++			stats = &ni->ni_subif->iv_devstats;
++		else
++			stats = &vap->iv_devstats;
++		stats->rx_packets++;
++		stats->rx_bytes += skb->len;
+ 		IEEE80211_NODE_STAT(ni, rx_data);
+ 		IEEE80211_NODE_STAT_ADD(ni, rx_bytes, skb->len);
+ 		ic->ic_lastdata = jiffies;
+@@ -1132,6 +1140,11 @@
+ 		dev = vap->iv_xrvap->iv_dev;
+ #endif
+ 
++	/* if the node has a wds subif, move data frames there,
++	 * but keep EAP traffic on the master */
++	if (ni->ni_subif && ((eh)->ether_type != __constant_htons(ETHERTYPE_PAE)))
++		dev = ni->ni_subif->iv_dev;
++
+ 	/* perform as a bridge within the vap */
+ 	/* XXX intra-vap bridging only */
+ 	if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
+@@ -1157,6 +1170,7 @@
+ 			if (ni1 != NULL) {
+ 				if (ni1->ni_vap == vap &&
+ 				    ieee80211_node_is_authorized(ni1) &&
++					!ni->ni_subif &&
+ 				    ni1 != vap->iv_bss) {
+ 					skb1 = skb;
+ 					skb = NULL;
+--- a/net80211/ieee80211_ioctl.h
++++ b/net80211/ieee80211_ioctl.h
+@@ -649,6 +649,7 @@
+ 	IEEE80211_PARAM_BGSCAN_THRESH		= 79,	/* bg scan rssi threshold */
+ 	IEEE80211_PARAM_RSSI_DIS_THR	= 80,	/* rssi threshold for disconnection */
+ 	IEEE80211_PARAM_RSSI_DIS_COUNT	= 81,	/* counter for rssi threshold */
++	IEEE80211_PARAM_WDS_SEP			= 82,	/* move wds stations into separate interfaces */
+ };
+ 
+ #define	SIOCG80211STATS			(SIOCDEVPRIVATE+2)
+--- a/net80211/ieee80211_node.h
++++ b/net80211/ieee80211_node.h
+@@ -92,11 +92,12 @@
+  * the ieee80211com structure.
+  */
+ struct ieee80211_node {
+-	struct ieee80211vap *ni_vap;
++	struct ieee80211vap *ni_vap, *ni_subif;
+ 	struct ieee80211com *ni_ic;
+ 	struct ieee80211_node_table *ni_table;
+ 	TAILQ_ENTRY(ieee80211_node) ni_list;
+ 	LIST_ENTRY(ieee80211_node) ni_hash;
++	struct work_struct ni_destroy;	/* task for destroying a subif */
+ 	atomic_t ni_refcnt;
+ 	u_int ni_scangen;			/* gen# for timeout scan */
+ 	u_int8_t ni_authmode;			/* authentication algorithm */
+@@ -430,5 +431,6 @@
+ void ieee80211_node_leave(struct ieee80211_node *);
+ u_int8_t ieee80211_getrssi(struct ieee80211com *);
+ int32_t ieee80211_get_node_count(struct ieee80211com *);
++void ieee80211_wds_addif(struct ieee80211_node *ni);
+ #endif /* _NET80211_IEEE80211_NODE_H_ */
+ 
+--- a/net80211/ieee80211_var.h
++++ b/net80211/ieee80211_var.h
+@@ -322,6 +322,7 @@
+ 	u_int8_t ic_myaddr[IEEE80211_ADDR_LEN];
+ 	struct timer_list ic_inact;		/* mgmt/inactivity timer */
+ 
++	unsigned int ic_subifs;
+ 	u_int32_t ic_flags;			/* state flags */
+ 	u_int32_t ic_flags_ext;			/* extension of state flags */
+ 	u_int32_t ic_caps;			/* capabilities */
+@@ -625,6 +626,7 @@
+ #define IEEE80211_FEXT_DROPUNENC_EAPOL	0x00000800	/* CONF: drop unencrypted eapol frames */
+ #define IEEE80211_FEXT_APPIE_UPDATE	0x00001000	/* STATE: beacon APP IE updated */
+ #define IEEE80211_FEXT_BGSCAN_THR	0x00002000	/* bgscan due to low rssi */
++#define IEEE80211_FEXT_WDSSEP		0x00004000	/* move wds clients into separate interfaces */
+ 
+ #define IEEE80211_COM_UAPSD_ENABLE(_ic)		((_ic)->ic_flags_ext |= IEEE80211_FEXT_UAPSD)
+ #define IEEE80211_COM_UAPSD_DISABLE(_ic)	((_ic)->ic_flags_ext &= ~IEEE80211_FEXT_UAPSD)
+--- a/net80211/ieee80211_wireless.c
++++ b/net80211/ieee80211_wireless.c
+@@ -2867,6 +2867,14 @@
+ 		else
+ 			vap->iv_minrateindex = 0;
+ 		break;
++	case IEEE80211_PARAM_WDS_SEP:
++		if (vap->iv_opmode != IEEE80211_M_HOSTAP)
++			retv = -EINVAL;
++		else if (value)
++			vap->iv_flags_ext |= IEEE80211_FEXT_WDSSEP;
++		else
++			vap->iv_flags_ext &= ~IEEE80211_FEXT_WDSSEP;
++		break;
+ #ifdef ATH_REVERSE_ENGINEERING
+ 	case IEEE80211_PARAM_DUMPREGS:
+ 		ieee80211_dump_registers(dev, info, w, extra);
+@@ -3223,6 +3231,9 @@
+ 	case IEEE80211_PARAM_MINRATE:
+ 		param[0] = vap->iv_minrateindex;
+ 		break;
++	case IEEE80211_PARAM_WDS_SEP:
++		param[0] = !!(vap->iv_flags_ext & IEEE80211_FEXT_WDSSEP);
++		break;
+ 	default:
+ 		return -EOPNOTSUPP;
+ 	}
+@@ -5767,6 +5778,10 @@
+ 	 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_minrate"},
+ 	{ IEEE80211_IOCTL_SETSCANLIST,
+ 	 IW_PRIV_TYPE_CHAR | 255, 0, "setscanlist"},
++	{ IEEE80211_PARAM_WDS_SEP,
++	 IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "wdssep"},
++	{ IEEE80211_PARAM_WDS_SEP,
++	 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_wdssep"},
+ 
+ #ifdef ATH_REVERSE_ENGINEERING
+ 	/*
+--- a/net80211/ieee80211_node.c
++++ b/net80211/ieee80211_node.c
+@@ -47,6 +47,7 @@
+ #include <linux/netdevice.h>
+ #include <linux/etherdevice.h>
+ #include <linux/random.h>
++#include <linux/rtnetlink.h>
+ 
+ #include "if_media.h"
+ 
+@@ -236,7 +237,11 @@
+ ieee80211_node_vdetach(struct ieee80211vap *vap)
+ {
+ 	struct ieee80211com *ic = vap->iv_ic;
++	struct ieee80211_node *ni;
+ 
++	ni = vap->iv_wdsnode;
++	if (ni)
++		ni->ni_subif = NULL;
+ 	ieee80211_node_table_reset(&ic->ic_sta, vap);
+ 	if (vap->iv_bss != NULL) {
+ 		ieee80211_unref_node(&vap->iv_bss);
+@@ -1134,6 +1139,40 @@
+ 	return ni;
+ }
+ 
++#define WDSIFNAME ".sta%d"
++void ieee80211_wds_addif(struct ieee80211_node *ni)
++{
++	struct ieee80211vap *vap = ni->ni_vap;
++	struct ieee80211com *ic = vap->iv_ic;
++	struct ieee80211vap *avp;
++	char *name;
++
++	/* check if the node is split out already */
++	if (ni->ni_subif)
++		return;
++
++	name = kmalloc(strlen(vap->iv_dev->name) + sizeof(WDSIFNAME) + 1, GFP_KERNEL);
++	if (!name)
++		return;
++
++	strcpy(name, vap->iv_dev->name);
++	strcat(name, WDSIFNAME);
++	rtnl_lock();
++	avp = ieee80211_create_vap(ic, name, ic->ic_dev, IEEE80211_M_WDS, 0, vap);
++	kfree(name);
++	if (!avp)
++		goto done;
++
++	memcpy(avp->wds_mac, ni->ni_bssid, IEEE80211_ADDR_LEN);
++	avp->iv_wdsnode = ieee80211_ref_node(ni);
++	ni->ni_subif = avp;
++	ic->ic_subifs++;
++
++done:
++	rtnl_unlock();
++}
++#undef WDSIFNAME
++
+ /* Add wds address to the node table */
+ int
+ #ifdef IEEE80211_DEBUG_REFCNT
+@@ -2254,6 +2293,28 @@
+ 	}
+ }
+ 
++static void
++ieee80211_subif_destroy(struct work_struct *work)
++{
++	struct ieee80211_node *ni = container_of(work, struct ieee80211_node, ni_destroy);
++	struct ieee80211vap *vap = ni->ni_subif;
++	struct ieee80211com *ic;
++
++	if (!vap)
++		goto done;
++
++	rtnl_lock();
++	ic = vap->iv_ic;
++	ni->ni_subif = NULL;
++	ieee80211_stop(vap->iv_dev);
++	ic->ic_vap_delete(vap);
++	ic->ic_subifs--;
++	rtnl_unlock();
++
++done:
++	ieee80211_unref_node(&ni);
++}
++
+ /*
+  * Handle bookkeeping for a station/neighbor leaving
+  * the bss when operating in ap or adhoc modes.
+@@ -2270,6 +2331,12 @@
+ 			ni, "station with aid %d leaves (refcnt %u)",
+ 			IEEE80211_NODE_AID(ni), atomic_read(&ni->ni_refcnt));
+ 
++	if (ni->ni_subif) {
++		ieee80211_ref_node(ni);
++		IEEE80211_INIT_WORK(&ni->ni_destroy, ieee80211_subif_destroy);
++		schedule_work(&ni->ni_destroy);
++	}
++
+ 	/* From this point onwards we can no longer find the node,
+ 	 * so no more references are generated
+ 	 */
+--- a/net80211/ieee80211_linux.h
++++ b/net80211/ieee80211_linux.h
+@@ -81,6 +81,12 @@
+ #endif
+ }
+ 
++#ifndef container_of
++#define container_of(ptr, type, member) ({          \
++    const typeof( ((type *)0)->member ) *__mptr = (ptr);    \
++	    (type *)( (char *)__mptr - offsetof(type,member) );})
++#endif
++
+ /*
+  * Task deferral
+  *
+@@ -113,6 +119,29 @@
+ 
+ #define	IEEE80211_RESCHEDULE	schedule
+ 
++#include <linux/sched.h>
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,41)
++#include <linux/tqueue.h>
++#define work_struct			tq_struct
++#define schedule_work(t)		schedule_task((t))
++#define flush_scheduled_work()		flush_scheduled_tasks()
++#define IEEE80211_INIT_WORK(t, f) do { 			\
++	memset((t), 0, sizeof(struct tq_struct)); \
++	(t)->routine = (void (*)(void*)) (f); 	\
++	(t)->data=(void *) (t);			\
++} while (0)
++#else
++#include <linux/workqueue.h>
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
++#define IEEE80211_INIT_WORK(_t, _f)	INIT_WORK((_t), (void (*)(void *))(_f), (_t));
++#else
++#define IEEE80211_INIT_WORK(_t, _f)	INIT_WORK((_t), (_f));
++#endif
++
++#endif /* KERNEL_VERSION < 2.5.41 */
++
++
+ /* Locking */
+ /* NB: beware, spin_is_locked() is not usefully defined for !(DEBUG || SMP)
+  * because spinlocks do not exist in this configuration. Instead IRQs 
+@@ -167,6 +196,18 @@
+ 	IEEE80211_VAPS_LOCK_ASSERT(_ic);		\
+ 	spin_unlock_bh(&(_ic)->ic_vapslock);		\
+ } while (0)
++#define	IEEE80211_VAPS_LOCK_IRQ(_ic) do {					\
++	unsigned long __vlockflags;					\
++	IEEE80211_VAPS_LOCK_CHECK(_ic);					\
++	spin_lock_irqsave(&(_ic)->ic_vapslock, __vlockflags);
++#define	IEEE80211_VAPS_UNLOCK_IRQ(_ic)					\
++	IEEE80211_VAPS_LOCK_ASSERT(_ic);					\
++	spin_unlock_irqrestore(&(_ic)->ic_vapslock, __vlockflags);	\
++} while (0)
++#define	IEEE80211_VAPS_UNLOCK_IRQ_EARLY(_ic)					\
++	IEEE80211_VAPS_LOCK_ASSERT(_ic);					\
++	spin_unlock_irqrestore(&(_ic)->ic_vapslock, __vlockflags);
++
+ 
+ #if (defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)) && defined(spin_is_locked)
+ #define IEEE80211_VAPS_LOCK_ASSERT(_ic) \
+--- a/net80211/ieee80211_proto.c
++++ b/net80211/ieee80211_proto.c
+@@ -1081,6 +1081,8 @@
+ int
+ ieee80211_open(struct net_device *dev)
+ {
++	struct ieee80211vap *vap = dev->priv;
++
+ 	return ieee80211_init(dev, 0);
+ }
+ 
+@@ -1116,11 +1118,33 @@
+ 	struct ieee80211vap *vap = dev->priv;
+ 	struct ieee80211com *ic = vap->iv_ic;
+ 	struct net_device *parent = ic->ic_dev;
++	struct ieee80211_node *tni, *ni;
+ 
+ 	IEEE80211_DPRINTF(vap,
+ 		IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
+ 		"%s\n", "stop running");
+ 
++	/* get rid of all wds nodes while we're still locked */
++	do {
++		ni = NULL;
++
++		IEEE80211_NODE_TABLE_LOCK_IRQ(&ic->ic_sta);
++		TAILQ_FOREACH(tni, &ic->ic_sta.nt_node, ni_list) {
++			if (tni->ni_vap != vap)
++				continue;
++			if (!tni->ni_subif)
++				continue;
++			ni = tni;
++			break;
++		}
++		IEEE80211_NODE_TABLE_UNLOCK_IRQ(&ic->ic_sta);
++
++		if (!ni)
++			break;
++
++		ieee80211_node_leave(ni);
++	} while (1);
++
+ 	ieee80211_new_state(vap, IEEE80211_S_INIT, -1);
+ 	if (dev->flags & IFF_RUNNING) {
+ 		dev->flags &= ~IFF_RUNNING;		/* mark us stopped */
+@@ -1342,9 +1366,9 @@
+ 	struct ieee80211com *ic = vap->iv_ic;
+ 	int rc;
+ 
+-	IEEE80211_VAPS_LOCK_BH(ic);
++	IEEE80211_VAPS_LOCK_IRQ(ic);
+ 	rc = vap->iv_newstate(vap, nstate, arg);
+-	IEEE80211_VAPS_UNLOCK_BH(ic);
++	IEEE80211_VAPS_UNLOCK_IRQ(ic);
+ 	return rc;
+ }
+ 
+--- a/net80211/ieee80211.c
++++ b/net80211/ieee80211.c
+@@ -599,8 +599,10 @@
+ 
+ 	IEEE80211_CANCEL_TQUEUE(&vap->iv_stajoin1tq);
+ 	IEEE80211_LOCK_IRQ(ic);
+-	if (vap->iv_wdsnode)
++	if (vap->iv_wdsnode) {
++		vap->iv_wdsnode->ni_subif = NULL;
+ 		ieee80211_unref_node(&vap->iv_wdsnode);
++	}
+ 	if ((vap->iv_opmode == IEEE80211_M_WDS) &&
+ 		(vap->iv_master != NULL))
+ 		TAILQ_REMOVE(&vap->iv_master->iv_wdslinks, vap, iv_wdsnext);
+--- a/ath/if_athvar.h
++++ b/ath/if_athvar.h
+@@ -79,28 +79,6 @@
+ #define	tasklet_enable(t)	do { (void) t; local_bh_enable(); } while (0)
+ #endif /* !DECLARE_TASKLET */
+ 
+-#include <linux/sched.h>
+-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,41)
+-#include <linux/tqueue.h>
+-#define work_struct			tq_struct
+-#define schedule_work(t)		schedule_task((t))
+-#define flush_scheduled_work()		flush_scheduled_tasks()
+-#define ATH_INIT_WORK(t, f) do { 			\
+-	memset((t), 0, sizeof(struct tq_struct)); \
+-	(t)->routine = (void (*)(void*)) (f); 	\
+-	(t)->data=(void *) (t);			\
+-} while (0)
+-#else
+-#include <linux/workqueue.h>
+-
+-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
+-#define ATH_INIT_WORK(_t, _f)	INIT_WORK((_t), (void (*)(void *))(_f), (_t));
+-#else
+-#define ATH_INIT_WORK(_t, _f)	INIT_WORK((_t), (_f));
+-#endif
+-
+-#endif /* KERNEL_VERSION < 2.5.41 */
+-
+ /*
+  * Guess how the interrupt handler should work.
+  */
diff --git a/package/madwifi/patches/372-queue_vif.patch b/package/madwifi/patches/372-queue_vif.patch
new file mode 100644
index 0000000000..2467986049
--- /dev/null
+++ b/package/madwifi/patches/372-queue_vif.patch
@@ -0,0 +1,39 @@
+--- a/net80211/ieee80211_input.c
++++ b/net80211/ieee80211_input.c
+@@ -1181,6 +1181,7 @@
+ 		}
+ 		if (skb1 != NULL) {
+ 			struct ieee80211_node *ni_tmp;
++			int ret;
+ 			skb1->dev = dev;
+ 			skb_reset_mac_header(skb1);
+ 			skb_set_network_header(skb1, sizeof(struct ether_header));
+@@ -1188,7 +1189,12 @@
+ 			skb1->protocol = __constant_htons(ETH_P_802_2);
+ 			/* XXX insert vlan tag before queue it? */
+ 			ni_tmp = SKB_CB(skb1)->ni; /* remember node so we can free it */
+-			if (dev_queue_xmit(skb1) == NET_XMIT_DROP) {
++			ret = dev->hard_start_xmit(skb1, dev);
++
++			if (ret == NETDEV_TX_BUSY)
++				ieee80211_dev_kfree_skb(&skb1);
++
++			if (ret != NETDEV_TX_OK) {
+ 				/* If queue dropped the packet because device was
+ 				 * too busy */
+ 				vap->iv_devstats.tx_dropped++;
+--- a/net80211/ieee80211_output.c
++++ b/net80211/ieee80211_output.c
+@@ -329,9 +329,10 @@
+ 	/* Dispatch the packet to the parent device */
+ 	skb->dev = vap->iv_ic->ic_dev;
+ 
+-	if (dev_queue_xmit(skb) == NET_XMIT_DROP)
++	if (netif_queue_stopped(skb->dev))
++		ieee80211_dev_kfree_skb(&skb);
++	else if (dev_queue_xmit(skb) == NET_XMIT_DROP)
+ 		vap->iv_devstats.tx_dropped++;
+-
+ }
+ 
+ /*
diff --git a/package/madwifi/patches/401-changeset_r3602.patch b/package/madwifi/patches/401-changeset_r3602.patch
index 8e423ca3aa..64780da120 100644
--- a/package/madwifi/patches/401-changeset_r3602.patch
+++ b/package/madwifi/patches/401-changeset_r3602.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_linux.h
 +++ b/net80211/ieee80211_linux.h
-@@ -312,6 +312,8 @@
+@@ -353,6 +353,8 @@
  /* __skb_append got a third parameter in 2.6.14 */
  #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
  #define __skb_append(a,b,c)	__skb_append(a, b)
diff --git a/package/madwifi/patches/403-changeset_r3605.patch b/package/madwifi/patches/403-changeset_r3605.patch
index 579c2c72cb..18e377d642 100644
--- a/package/madwifi/patches/403-changeset_r3605.patch
+++ b/package/madwifi/patches/403-changeset_r3605.patch
@@ -16,7 +16,7 @@
  #endif /* _ATH_COMPAT_H_ */
 --- a/net80211/ieee80211_linux.h
 +++ b/net80211/ieee80211_linux.h
-@@ -309,13 +309,6 @@
+@@ -350,13 +350,6 @@
  #define	ACL_LOCK_CHECK(_as)
  #endif
  
@@ -30,7 +30,7 @@
  /*
   * Per-node power-save queue definitions.  Beware of control
   * flow with IEEE80211_NODE_SAVEQ_LOCK/IEEE80211_NODE_SAVEQ_UNLOCK.
-@@ -359,16 +352,16 @@
+@@ -400,16 +393,16 @@
  	_skb = __skb_dequeue(&(_ni)->ni_savedq);		\
  	(_qlen) = skb_queue_len(&(_ni)->ni_savedq);		\
  } while (0)
diff --git a/package/madwifi/patches/405-retransmit_check.patch b/package/madwifi/patches/405-retransmit_check.patch
index cb9de7f116..633901433a 100644
--- a/package/madwifi/patches/405-retransmit_check.patch
+++ b/package/madwifi/patches/405-retransmit_check.patch
@@ -11,7 +11,7 @@
  #define	IEEE80211_QOS_TXOP			0x00ff
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -412,7 +412,7 @@
+@@ -414,7 +414,7 @@
  				tid = 0;
  			rxseq = le16toh(*(__le16 *)wh->i_seq);
  			if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
diff --git a/package/madwifi/patches/406-monitor_r3711.patch b/package/madwifi/patches/406-monitor_r3711.patch
index 1bafa2d123..d44a556fa7 100644
--- a/package/madwifi/patches/406-monitor_r3711.patch
+++ b/package/madwifi/patches/406-monitor_r3711.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -6324,7 +6324,7 @@
+@@ -6325,7 +6325,7 @@
  
  	/* Never copy the SKB, as it is ours on the RX side, and this is the 
  	 * last process on the TX side and we only modify our own headers. */
@@ -9,7 +9,7 @@
  	if (tskb == NULL) {
  		DPRINTF(sc, ATH_DEBUG_ANY,
  			"Dropping; ath_skb_removepad failed!\n");
-@@ -6332,6 +6332,8 @@
+@@ -6333,6 +6333,8 @@
  	}
  	
  	ieee80211_input_monitor(ic, tskb, bf, tx, tsf, sc);