diff --git a/target/linux/ar7/patches-2.6.24/160-cpmac-rx-ring-use-eoq.diff b/target/linux/ar7/patches-2.6.24/160-cpmac-rx-ring-use-eoq.diff
new file mode 100644
index 0000000000..47f7e6c989
--- /dev/null
+++ b/target/linux/ar7/patches-2.6.24/160-cpmac-rx-ring-use-eoq.diff
@@ -0,0 +1,178 @@
+--- linux-2.6.24.3/drivers/net/cpmac.c.orig	2008-03-10 23:59:56.000000000 +0000
++++ linux-2.6.24.3/drivers/net/cpmac.c	2008-03-11 00:13:04.000000000 +0000
+@@ -187,6 +187,7 @@
+ #define CPMAC_EOQ			0x1000
+ 	struct sk_buff *skb;
+ 	struct cpmac_desc *next;
++	struct cpmac_desc *prev;
+ 	dma_addr_t mapping;
+ 	dma_addr_t data_mapping;
+ };
+@@ -242,6 +243,16 @@
+ 	printk("\n");
+ }
+ 
++static void cpmac_dump_all_desc(struct net_device *dev)
++{
++        struct cpmac_priv *priv = netdev_priv(dev);
++        struct cpmac_desc *dump = priv->rx_head;
++        do {
++                cpmac_dump_desc(dev, dump);
++                dump = dump->next;
++        } while (dump != priv->rx_head);
++}
++
+ static void cpmac_dump_skb(struct net_device *dev, struct sk_buff *skb)
+ {
+ 	int i;
+@@ -413,21 +424,40 @@
+ static int cpmac_poll(struct napi_struct *napi, int budget)
+ {
+ 	struct sk_buff *skb;
+-	struct cpmac_desc *desc;
+-	int received = 0;
++	struct cpmac_desc *desc, *restart;
+ 	struct cpmac_priv *priv = container_of(napi, struct cpmac_priv, napi);
++	int received = 0, processed = 0;
+ 
+ 	spin_lock(&priv->rx_lock);
+ 	if (unlikely(!priv->rx_head)) {
+ 		if (netif_msg_rx_err(priv) && net_ratelimit())
+ 			printk(KERN_WARNING "%s: rx: polling, but no queue\n",
+ 			       priv->dev->name);
++		spin_unlock(&priv->rx_lock);
+ 		netif_rx_complete(priv->dev, napi);
+ 		return 0;
+ 	}
+ 
+ 	desc = priv->rx_head;
++	restart = NULL;
+ 	while (((desc->dataflags & CPMAC_OWN) == 0) && (received < budget)) {
++		processed++;
++		
++		if ((desc->dataflags & CPMAC_EOQ) != 0) {
++			/* The last update to eoq->hw_next didn't happen soon enough, and the
++			* receiver stopped here. Remember this descriptor so we can restart
++			* the receiver after freeing some space.
++			*/
++			if (unlikely(restart)) {
++				if (netif_msg_rx_err(priv))
++					printk(KERN_ERR "%s: poll found a duplicate EOQ: %p and %p\n",
++						priv->dev->name, restart, desc);
++				goto fatal_error;
++			}
++			
++			restart = desc->next;
++		}
++
+ 		skb = cpmac_rx_one(priv, desc);
+ 		if (likely(skb)) {
+ 			netif_receive_skb(skb);
+@@ -436,19 +466,81 @@
+ 		desc = desc->next;
+ 	}
+ 
++	if (desc != priv->rx_head) {
++		/* We freed some buffers, but not the whole ring, add what we did free to the rx list */ 
++		desc->prev->hw_next = (u32)0;
++		priv->rx_head->prev->hw_next = priv->rx_head->mapping;
++	}
++
++	/* Optimization: If we did not actually process an EOQ (perhaps because of 
++	* quota limits), check to see if the tail of the queue has EOQ set. We
++	* should immediately restart in that case so that the receiver can restart
++	* and run in parallel with more packet processing. This lets us handle slightly
++	* larger bursts before running out of ring space (assuming dev->weight < ring_size)
++	*/
++	if (!restart &&
++	     (priv->rx_head->prev->dataflags & (CPMAC_OWN|CPMAC_EOQ)) == CPMAC_EOQ &&
++	     (priv->rx_head->dataflags & CPMAC_OWN) != 0) {
++		/* reset EOQ so the poll loop (above) doesn't try to restart this when it
++		* eventually gets to this descriptor.
++		*/
++		priv->rx_head->prev->dataflags &= ~CPMAC_EOQ;
++		restart = priv->rx_head;
++	}
++
++	if (restart) {
++		priv->dev->stats.rx_errors++;
++		priv->dev->stats.rx_fifo_errors++;
++		if (netif_msg_rx_err(priv) && net_ratelimit())
++			printk(KERN_WARNING "%s: rx dma ring overrun\n", priv->dev->name);
++
++		if (unlikely((restart->dataflags & CPMAC_OWN) == 0)) {
++			if (netif_msg_drv(priv))
++				printk(KERN_ERR "%s: cpmac_poll is trying to restart rx from a descriptor that's not free: %p\n",
++					priv->dev->name, restart);
++				goto fatal_error;
++		}
++
++		cpmac_write(priv->regs, CPMAC_RX_PTR(0), restart->mapping);
++	}
++
+ 	priv->rx_head = desc;
+ 	spin_unlock(&priv->rx_lock);
+ 	if (unlikely(netif_msg_rx_status(priv)))
+ 		printk(KERN_DEBUG "%s: poll processed %d packets\n",
+ 		       priv->dev->name, received);
+-	if (desc->dataflags & CPMAC_OWN) {
++	if (processed == 0) {
++		/* we ran out of packets to read, revert to interrupt-driven mode */ 
+ 		netif_rx_complete(priv->dev, napi);
+-		cpmac_write(priv->regs, CPMAC_RX_PTR(0), (u32)desc->mapping);
+ 		cpmac_write(priv->regs, CPMAC_RX_INT_ENABLE, 1);
+ 		return 0;
+ 	}
+ 
+ 	return 1;
++
++fatal_error:
++	/* Something went horribly wrong. Reset hardware to try to recover rather than wedging. */ 
++	
++	if (netif_msg_drv(priv)) {
++		printk(KERN_ERR "%s: cpmac_poll is confused. Resetting hardware\n", priv->dev->name);
++		cpmac_dump_all_desc(priv->dev);
++		printk(KERN_DEBUG "%s: RX_PTR(0)=0x%08x RX_ACK(0)=0x%08x\n",
++			priv->dev->name,
++			cpmac_read(priv->regs, CPMAC_RX_PTR(0)),
++			cpmac_read(priv->regs, CPMAC_RX_ACK(0)));
++	}
++
++	spin_unlock(&priv->rx_lock);
++	netif_rx_complete(priv->dev, napi);
++	netif_stop_queue(priv->dev);
++	napi_disable(&priv->napi);
++	
++	atomic_inc(&priv->reset_pending);
++	cpmac_hw_stop(priv->dev);
++	if (!schedule_work(&priv->reset_work))
++		atomic_dec(&priv->reset_pending);
++	return 0;
++ 
+ }
+ 
+ static int cpmac_start_xmit(struct sk_buff *skb, struct net_device *dev)
+@@ -625,8 +717,10 @@
+ 			desc->dataflags = CPMAC_OWN;
+ 			dev->stats.rx_dropped++;
+ 		}
++		desc->hw_next = desc->next->mapping;
+ 		desc = desc->next;
+ 	}
++	priv->rx_head->prev->hw_next = 0;
+ }
+ 
+ static void cpmac_clear_tx(struct net_device *dev)
+@@ -927,9 +1021,12 @@
+ 		desc->buflen = CPMAC_SKB_SIZE;
+ 		desc->dataflags = CPMAC_OWN;
+ 		desc->next = &priv->rx_head[(i + 1) % priv->ring_size];
++		desc->next->prev = desc;
+ 		desc->hw_next = (u32)desc->next->mapping;
+ 	}
+ 
++	priv->rx_head->prev->hw_next = (u32)0;
++
+ 	if ((res = request_irq(dev->irq, cpmac_irq, IRQF_SHARED,
+ 			       dev->name, dev))) {
+ 		if (netif_msg_drv(priv))