hostapd: sync with trunk r36533

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

git-svn-id: svn://svn.openwrt.org/openwrt/branches/attitude_adjustment@36682 3c298f89-4303-0410-b956-a3cf2f4a3e73

40 files changed, 2706 insertions, 390 deletions

diff --git a/package/hostapd/Makefile b/package/hostapd/Makefile
index 2fbfb98e3c..485a8fad0c 100644
--- a/package/hostapd/Makefile
+++ b/package/hostapd/Makefile
@@ -8,16 +8,18 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hostapd
-PKG_VERSION:=20120910
+PKG_VERSION:=20130405
 PKG_RELEASE:=1
-PKG_REV:=762b99db7a76803d1ad274e87caa6fe870d47441
+PKG_REV:=f2f66ad7e805218468aa041985dccaf8719c296e
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=git://w1.fi/srv/git/hostap.git
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
 PKG_SOURCE_VERSION:=$(PKG_REV)
 PKG_SOURCE_PROTO:=git
-PKG_MIRROR_MD5SUM:=fa3227c146cb50732fe8511ce6d1d862
+PKG_MIRROR_MD5SUM:=5dff9bc3b8fbd9ef8a66273d5adee5a3
+
+PKG_MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
 
 PKG_BUILD_PARALLEL:=1
 
@@ -84,15 +86,14 @@ ifneq ($(LOCAL_TYPE),hostapd)
 	CONFIG_DRIVER_ROBOSWITCH=$(CONFIG_PACKAGE_kmod-switch)
 endif
 
-DRV_DEPENDS:=+PACKAGE_kmod-mac80211:libnl-tiny @(!(TARGET_avr32||TARGET_etrax)||BROKEN)
+DRV_DEPENDS:=+PACKAGE_kmod-mac80211:libnl-tiny @(!TARGET_avr32||BROKEN)
 
 define Package/hostapd/Default
   SECTION:=net
   CATEGORY:=Network
   TITLE:=IEEE 802.1x Authenticator
   URL:=http://hostap.epitest.fi/
-  DEPENDS:=$(DRV_DEPENDS)
-  MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
+  DEPENDS:=$(DRV_DEPENDS) +libubus
 endef
 
 define Package/hostapd
@@ -132,13 +133,12 @@ define Package/wpad/Default
   CATEGORY:=Network
   TITLE:=IEEE 802.1x Authenticator/Supplicant
   URL:=http://hostap.epitest.fi/
-  MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
 endef
 
 define Package/wpad
 $(call Package/wpad/Default)
   TITLE+= (full)
-  DEPENDS:=$(DRV_DEPENDS) +WPA_SUPPLICANT_OPENSSL:libopenssl
+  DEPENDS:=$(DRV_DEPENDS) +WPA_SUPPLICANT_OPENSSL:libopenssl +libubus
   VARIANT:=wpad-full
 endef
 
@@ -150,7 +150,7 @@ endef
 define Package/wpad-mini
 $(call Package/wpad/Default)
   TITLE+= (WPA-PSK only)
-  DEPENDS:=$(DRV_DEPENDS)
+  DEPENDS:=$(DRV_DEPENDS) +libubus
   VARIANT:=wpad-mini
 endef
 
@@ -165,7 +165,6 @@ define Package/wpa-supplicant
   URL:=http://hostap.epitest.fi/wpa_supplicant/
   DEPENDS:=$(DRV_DEPENDS) +WPA_SUPPLICANT_OPENSSL:libopenssl
   VARIANT:=supplicant-full
-  MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
 endef
 
 define Package/wpa-supplicant/Description
@@ -192,7 +191,6 @@ define Package/wpa-cli
   CATEGORY:=Network
   DEPENDS:=@PACKAGE_wpa-supplicant||PACKAGE_wpad-mini||PACKAGE_wpad
   TITLE:=WPA Supplicant command line interface
-  MAINTAINER:=Felix Fietkau <nbd@openwrt.org>
 endef
 
 define Package/wpa-cli/Description
@@ -220,13 +218,16 @@ TARGET_CPPFLAGS := \
 	-I$(STAGING_DIR)/usr/include/libnl-tiny \
 	-I$(PKG_BUILD_DIR)/src/crypto \
 	$(TARGET_CPPFLAGS) \
-	-I$(STAGING_DIR)/usr/include/madwifi \
+	-I$(CURDIR)/madwifi \
 	-DCONFIG_LIBNL20 \
 	-D_GNU_SOURCE \
 	$(if $(CONFIG_WPA_MSG_MIN_PRIORITY),-DCONFIG_MSG_MIN_PRIORITY=$(CONFIG_WPA_MSG_MIN_PRIORITY))
 
 TARGET_CFLAGS += -ffunction-sections -fdata-sections
 TARGET_LDFLAGS += -Wl,--gc-sections
+ifeq ($(findstring supplicant,$(BUILD_VARIANT)),)
+  TARGET_LDFLAGS += -lubox -lubus
+endif
 
 ifdef CONFIG_PACKAGE_kmod-mac80211
   TARGET_LDFLAGS += -lm -lnl-tiny
@@ -305,6 +306,11 @@ ifneq ($(LOCAL_TYPE),supplicant)
 	$(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/hotplug.d/button
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/hostapd/hostapd_cli $(1)/usr/sbin/
 	$(INSTALL_DATA) ./files/wps-hotplug.sh $(1)/etc/hotplug.d/button/50-wps
+	$(if $(CONFIG_PROCD_INIT),
+		$(INSTALL_DIR) $(1)/etc/rc.button/
+		$(INSTALL_BIN) ./files/wps-hotplug.sh $(1)/etc/rc.button/wps,
+		$(INSTALL_DATA) ./files/wps-hotplug.sh $(1)/etc/hotplug.d/button/50-wps
+	)
   endef
 endif
 
diff --git a/package/hostapd/files/hostapd-full.config b/package/hostapd/files/hostapd-full.config
index 3a0ce12fc4..d558736db7 100644
--- a/package/hostapd/files/hostapd-full.config
+++ b/package/hostapd/files/hostapd-full.config
@@ -129,7 +129,7 @@ CONFIG_PKCS12=y
 CONFIG_IPV6=y
 
 # IEEE Std 802.11r-2008 (Fast BSS Transition)
-#CONFIG_IEEE80211R=y
+CONFIG_IEEE80211R=y
 
 # Use the hostapd's IEEE 802.11 authentication (ACL), but without
 # the IEEE 802.11 Management capability (e.g., madwifi or FreeBSD/net80211)
diff --git a/package/hostapd/files/hostapd.sh b/package/hostapd/files/hostapd.sh
index d60c26f3c6..00c6a094cf 100644
--- a/package/hostapd/files/hostapd.sh
+++ b/package/hostapd/files/hostapd.sh
@@ -12,6 +12,7 @@ hostapd_set_bss_options() {
 	config_get_bool disassoc_low_ack "$vif" disassoc_low_ack 1
 	config_get max_num_sta "$vif" max_num_sta 0
 	config_get max_inactivity "$vif" max_inactivity 0
+	config_get_bool preamble "$vif" short_preamble 1
 
 	config_get device "$vif" device
 	config_get hwmode "$device" hwmode
@@ -29,6 +30,9 @@ hostapd_set_bss_options() {
 		append "$var" "ap_max_inactivity=$max_inactivity" "$N"
 	fi
 	append "$var" "disassoc_low_ack=$disassoc_low_ack" "$N"
+	if [ "$preamble" -gt 0 ]; then
+		append "$var" "preamble=$preamble" "$N"
+	fi
 
 	# Examples:
 	# psk-mixed/tkip 	=> WPA1+2 PSK, TKIP
@@ -210,6 +214,27 @@ hostapd_set_bss_options() {
 			;;
 		esac
 	fi
+
+	config_get macfilter "$vif" macfilter
+	macfile="/var/run/hostapd-$ifname.maclist"
+	[ -e "$macfile" ] && rm -f "$macfile"
+
+	case "$macfilter" in
+		allow)
+			append "$var" "macaddr_acl=1" "$N"
+			append "$var" "accept_mac_file=$macfile" "$N"
+			;;
+		deny)
+			append "$var" "macaddr_acl=0" "$N"
+			append "$var" "deny_mac_file=$macfile" "$N"
+			;;
+	esac
+	config_get maclist "$vif" maclist
+	[ -n "$maclist" ] && {
+		for mac in $maclist; do
+			echo "$mac" >> $macfile
+		done
+	}
 }
 
 hostapd_set_log_options() {
diff --git a/package/hostapd/files/wpa_supplicant.sh b/package/hostapd/files/wpa_supplicant.sh
index cdca9b5539..0b5e1d391f 100644
--- a/package/hostapd/files/wpa_supplicant.sh
+++ b/package/hostapd/files/wpa_supplicant.sh
@@ -106,7 +106,7 @@ wpa_supplicant_setup_vif() {
 					config_get password "$vif" password
 					phase2="phase2=\"auth=${auth:-MSCHAPV2}\""
 					identity="identity=\"$identity\""
-					password="password=\"$password\""
+					password="${password:+password=\"$password\"}"
 				;;
 			esac
 			eap_type="eap=$(echo $eap_type | tr 'a-z' 'A-Z')"
@@ -186,6 +186,9 @@ network={
 	$wep_tx_keyidx
 }
 EOF
-	[ -z "$proto" -a "$key_mgmt" != "NONE" ] || \
+	if [ -n "$proto" -o "$key_mgmt" == "NONE" ]; then
 		wpa_supplicant ${bridge:+ -b $bridge} -B -P "/var/run/wifi-${ifname}.pid" -D ${driver:-wext} -i "$ifname" -c /var/run/wpa_supplicant-$ifname.conf $options
+	else
+		return 0
+	fi
 }
diff --git a/package/hostapd/files/wps-hotplug.sh b/package/hostapd/files/wps-hotplug.sh
index b5376cc55b..ffd3cf929b 100644
--- a/package/hostapd/files/wps-hotplug.sh
+++ b/package/hostapd/files/wps-hotplug.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+
 if [ "$ACTION" = "pressed" -a "$BUTTON" = "wps" ]; then
 	for dir in /var/run/hostapd-*; do
 		[ -d "$dir" ] || continue
diff --git a/package/hostapd/madwifi/include/compat.h b/package/hostapd/madwifi/include/compat.h
new file mode 100644
index 0000000000..09e63974fa
--- /dev/null
+++ b/package/hostapd/madwifi/include/compat.h
@@ -0,0 +1,209 @@
+/*-
+ * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
+ *    redistribution must be conditioned upon including a substantially
+ *    similar Disclaimer requirement for further binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: compat.h 3310 2008-01-30 20:23:49Z mentor $
+ */
+#ifndef _ATH_COMPAT_H_
+#define _ATH_COMPAT_H_
+
+/* Compatibility with older Linux kernels */
+#ifdef __KERNEL__
+#include <linux/types.h>
+#include <linux/time.h>
+#include <linux/netdevice.h>
+#endif
+
+#if !defined(__KERNEL__) || !defined (__bitwise)
+#define __le16 u_int16_t
+#define __le32 u_int32_t
+#define __le64 u_int64_t
+#define __be16 u_int16_t
+#define __be32 u_int32_t
+#define __be64 u_int64_t
+#define __force
+#endif
+
+#ifndef container_of
+#define container_of(ptr, type, member) ({				\
+	    const typeof( ((type *)0)->member ) *__mptr = (ptr);	\
+	    (type *)( (char *)__mptr - offsetof(type,member) );})
+#endif
+
+#ifndef list_for_each_entry_reverse
+#define list_for_each_entry_reverse(pos, head, member)			\
+	for (pos = list_entry((head)->prev, typeof(*pos), member);	\
+	     prefetch(pos->member.prev), &pos->member != (head); 	\
+	     pos = list_entry(pos->member.prev, typeof(*pos), member))
+#endif
+
+#ifndef NETDEV_TX_OK
+#define NETDEV_TX_OK    0
+#define NETDEV_TX_BUSY  1
+#endif
+
+/*
+ * BSD/Linux compatibility shims.  These are used mainly to
+ * minimize differences when importing necesary BSD code.
+ */
+#define	NBBY	8			/* number of bits/byte */
+
+/* roundup() appears in Linux 2.6.18 */
+#include <linux/kernel.h>
+#ifndef roundup
+#define	roundup(x, y)	((((x)+((y)-1))/(y))*(y))  /* to any y */
+#endif
+
+#define	howmany(x, y)	(((x)+((y)-1))/(y))
+
+/* Bit map related macros. */
+#define	setbit(a,i)	((a)[(i)/NBBY] |= 1<<((i)%NBBY))
+#define	clrbit(a,i)	((a)[(i)/NBBY] &= ~(1<<((i)%NBBY)))
+#define	isset(a,i)	((a)[(i)/NBBY] & (1<<((i)%NBBY)))
+#define	isclr(a,i)	(((a)[(i)/NBBY] & (1<<((i)%NBBY))) == 0)
+
+#ifndef __packed
+#define	__packed	__attribute__((__packed__))
+#endif
+
+#define	__offsetof(t,m)	offsetof(t,m)
+
+#ifndef ALIGNED_POINTER
+/*
+ * ALIGNED_POINTER is a boolean macro that checks whether an address
+ * is valid to fetch data elements of type t from on this architecture.
+ * This does not reflect the optimal alignment, just the possibility
+ * (within reasonable limits). 
+ *
+ */
+#define ALIGNED_POINTER(p,t)	1
+#endif
+
+#ifdef __KERNEL__
+#define	KASSERT(exp, msg) do {			\
+	if (unlikely(!(exp))) {			\
+		printk msg;			\
+		BUG();				\
+	}					\
+} while (0)
+#endif /* __KERNEL__ */
+
+/*
+ * NetBSD/FreeBSD defines for file version.
+ */
+#define	__FBSDID(_s)
+#define	__KERNEL_RCSID(_n,_s)
+
+/*
+ * Fixes for Linux API changes
+ */
+#ifdef __KERNEL__
+
+#include <linux/version.h>
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)
+#define AUTOCONF_INCLUDED 1
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,21)
+#define ATH_REGISTER_SYSCTL_TABLE(t) register_sysctl_table(t, 1)
+#else
+#define ATH_REGISTER_SYSCTL_TABLE(t) register_sysctl_table(t)
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,9)
+#define __user
+#define __kernel
+#define __iomem
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
+typedef int gfp_t;
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16)
+static inline int timeval_compare(struct timeval *lhs, struct timeval *rhs)
+{
+	if (lhs->tv_sec < rhs->tv_sec)
+		return -1;
+	if (lhs->tv_sec > rhs->tv_sec)
+		return 1;
+	return lhs->tv_usec - rhs->tv_usec;
+}
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,18)
+#define IRQF_SHARED SA_SHIRQ
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,4,27)
+#define netdev_priv(_netdev) ((_netdev)->priv)
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)
+#define skb_end_pointer(_skb) ((_skb)->end)
+#define skb_tail_pointer(_skb) ((_skb)->tail)
+#define skb_set_network_header(_skb, _offset) \
+	do { (_skb)->nh.raw = (_skb)->data + (_offset); } while(0)
+#define skb_reset_network_header(_skb) \
+	do { (_skb)->nh.raw = (_skb)->data; } while(0)
+#define skb_mac_header(_skb) ((_skb)->mac.raw)
+#define skb_reset_mac_header(_skb) \
+	do { (_skb)->mac.raw = (_skb)->data; } while(0)
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24)
+#define CTL_AUTO -2
+#define DEV_ATH 9
+#else
+#define CTL_AUTO CTL_UNNUMBERED
+#define DEV_ATH CTL_UNNUMBERED
+#endif
+
+/* __skb_append got a third parameter in 2.6.14 */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
+#define __skb_queue_after(_list, _old, _new)	__skb_append(_old, _new)
+#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,25)
+#define __skb_queue_after(_list, _old, _new)	__skb_append(_old, _new, _list)
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,33)
+#define CTLNAME(x)	.ctl_name	= x,
+#else
+#define CTLNAME(x)
+#endif
+
+#endif /* __KERNEL__ */
+
+#endif /* _ATH_COMPAT_H_ */
diff --git a/package/hostapd/madwifi/net80211/_ieee80211.h b/package/hostapd/madwifi/net80211/_ieee80211.h
new file mode 100644
index 0000000000..2d2a06f23d
--- /dev/null
+++ b/package/hostapd/madwifi/net80211/_ieee80211.h
@@ -0,0 +1,325 @@
+/*-
+ * Copyright (c) 2001 Atsushi Onoe
+ * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $Id: _ieee80211.h 3207 2008-01-18 21:25:05Z mtaylor $
+ */
+#ifndef _NET80211__IEEE80211_H_
+#define _NET80211__IEEE80211_H_
+
+enum ieee80211_phytype {
+	IEEE80211_T_DS,			/* direct sequence spread spectrum */
+	IEEE80211_T_FH,			/* frequency hopping */
+	IEEE80211_T_OFDM,		/* frequency division multiplexing */
+	IEEE80211_T_TURBO,		/* high rate OFDM, aka turbo mode */
+};
+#define	IEEE80211_T_CCK	IEEE80211_T_DS	/* more common nomenclature */
+
+/* XXX: not really a mode; there are really multiple PHYs */
+enum ieee80211_phymode {
+	IEEE80211_MODE_AUTO	= 0,	/* autoselect */
+	IEEE80211_MODE_11A	= 1,	/* 5GHz, OFDM */
+	IEEE80211_MODE_11B	= 2,	/* 2GHz, CCK */
+	IEEE80211_MODE_11G	= 3,	/* 2GHz, OFDM */
+	IEEE80211_MODE_FH	= 4,	/* 2GHz, GFSK */
+	IEEE80211_MODE_TURBO_A	= 5,	/* 5GHz, OFDM, 2x clock dynamic turbo */
+	IEEE80211_MODE_TURBO_G	= 6,	/* 2GHz, OFDM, 2x clock  dynamic turbo*/
+};
+#define	IEEE80211_MODE_MAX	(IEEE80211_MODE_TURBO_G+1)
+
+enum ieee80211_opmode {
+	IEEE80211_M_STA		= 1,	/* infrastructure station */
+	IEEE80211_M_IBSS 	= 0,	/* IBSS (adhoc) station */
+	IEEE80211_M_AHDEMO	= 3,	/* Old lucent compatible adhoc demo */
+	IEEE80211_M_HOSTAP	= 6,	/* Software Access Point */
+	IEEE80211_M_MONITOR	= 8,	/* Monitor mode */
+	IEEE80211_M_WDS		= 2	/* WDS link */
+};
+
+/*
+ * True if this mode will send beacon on a regular interval, like AP
+ * or IBSS
+ */
+#define IEEE80211_IS_MODE_BEACON(_opmode) \
+	((_opmode == IEEE80211_M_IBSS) || \
+	 (_opmode == IEEE80211_M_HOSTAP))
+
+/*
+ * True if this mode must behave like a DFS master, ie do Channel
+ * Check Availability and In Service Monitoring. We need to make sure
+ * that all modes cannot send data without being authorized. Such
+ * enforcement is not done in monitor mode however.
+ */
+
+#define IEEE80211_IS_MODE_DFS_MASTER(_opmode) \
+	((_opmode == IEEE80211_M_IBSS) || \
+	 (_opmode == IEEE80211_M_AHDEMO) || \
+	 (_opmode == IEEE80211_M_HOSTAP) || \
+	 (_opmode == IEEE80211_M_WDS))
+
+/*
+ * 802.11g protection mode.
+ */
+enum ieee80211_protmode {
+	IEEE80211_PROT_NONE	= 0,	/* no protection */
+	IEEE80211_PROT_CTSONLY	= 1,	/* CTS to self */
+	IEEE80211_PROT_RTSCTS	= 2,	/* RTS-CTS */
+};
+
+/*
+ * Authentication mode.
+ */
+enum ieee80211_authmode {
+	IEEE80211_AUTH_NONE	= 0,
+	IEEE80211_AUTH_OPEN	= 1,	/* open */
+	IEEE80211_AUTH_SHARED	= 2,	/* shared-key */
+	IEEE80211_AUTH_8021X	= 3,	/* 802.1x */
+	IEEE80211_AUTH_AUTO	= 4,	/* auto-select/accept */
+	/* NB: these are used only for ioctls */
+	IEEE80211_AUTH_WPA	= 5,	/* WPA/RSN w/ 802.1x/PSK */
+};
+
+/*
+ * Roaming mode is effectively who controls the operation
+ * of the 802.11 state machine when operating as a station.
+ * State transitions are controlled either by the driver
+ * (typically when management frames are processed by the
+ * hardware/firmware), the host (auto/normal operation of
+ * the 802.11 layer), or explicitly through ioctl requests
+ * when applications like wpa_supplicant want control.
+ */
+enum ieee80211_roamingmode {
+	IEEE80211_ROAMING_DEVICE= 0,	/* driver/hardware control */
+	IEEE80211_ROAMING_AUTO	= 1,	/* 802.11 layer control */
+	IEEE80211_ROAMING_MANUAL= 2,	/* application control */
+};
+
+/*
+ * Scanning mode controls station scanning work; this is
+ * used only when roaming mode permits the host to select
+ * the bss to join/channel to use.
+ */
+enum ieee80211_scanmode {
+	IEEE80211_SCAN_DEVICE	= 0,	/* driver/hardware control */
+	IEEE80211_SCAN_BEST	= 1,	/* 802.11 layer selects best */
+	IEEE80211_SCAN_FIRST	= 2,	/* take first suitable candidate */
+};
+
+enum ieee80211_scanflags {
+	IEEE80211_NOSCAN_DEFAULT = (1 << 0),
+	IEEE80211_NOSCAN_SET     = (1 << 1),
+};
+
+/*
+ * Channels are specified by frequency and attributes.
+ */
+struct ieee80211_channel {
+	u_int16_t ic_freq;	/* setting in MHz */
+	u_int16_t ic_flags;	/* see below */
+	u_int8_t ic_ieee;	/* IEEE channel number */
+	int8_t ic_maxregpower;	/* maximum regulatory tx power in dBm */
+	int8_t ic_maxpower;	/* maximum tx power in dBm */
+	int8_t ic_minpower;	/* minimum tx power in dBm */
+	u_int8_t ic_scanflags;
+	u_int8_t ic_idletime; /* phy idle time in % */
+};
+
+#define	IEEE80211_CHAN_MAX	255
+#define	IEEE80211_CHAN_BYTES	32	/* howmany(IEEE80211_CHAN_MAX, NBBY) */
+#define	IEEE80211_CHAN_ANY	0xffff	/* token for ``any channel'' */
+#define	IEEE80211_CHAN_ANYC 	((struct ieee80211_channel *) IEEE80211_CHAN_ANY)
+
+#define	IEEE80211_RADAR_CHANCHANGE_TBTT_COUNT	0
+#define IEEE80211_DEFAULT_CHANCHANGE_TBTT_COUNT	3
+
+#define	IEEE80211_RADAR_TEST_MUTE_CHAN	36	/* Move to channel 36 for mute test */
+
+/* bits 0-3 are for private use by drivers */
+/* channel attributes */
+#define	IEEE80211_CHAN_TURBO	0x0010	/* Turbo channel */
+#define	IEEE80211_CHAN_CCK	0x0020	/* CCK channel */
+#define	IEEE80211_CHAN_OFDM	0x0040	/* OFDM channel */
+#define	IEEE80211_CHAN_2GHZ	0x0080	/* 2 GHz spectrum channel. */
+#define	IEEE80211_CHAN_5GHZ	0x0100	/* 5 GHz spectrum channel */
+#define	IEEE80211_CHAN_PASSIVE	0x0200	/* Only passive scan allowed */
+#define	IEEE80211_CHAN_DYN	0x0400	/* Dynamic CCK-OFDM channel */
+#define	IEEE80211_CHAN_GFSK	0x0800	/* GFSK channel (FHSS PHY) */
+#define IEEE80211_CHAN_RADAR	0x1000	/* Radar found on channel */
+#define	IEEE80211_CHAN_STURBO	0x2000	/* 11a static turbo channel only */
+#define	IEEE80211_CHAN_HALF	0x4000	/* Half rate channel */
+#define	IEEE80211_CHAN_QUARTER	0x8000	/* Quarter rate channel */
+
+/*
+ * Useful combinations of channel characteristics.
+ */
+#define	IEEE80211_CHAN_FHSS \
+	(IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_GFSK)
+#define	IEEE80211_CHAN_A \
+	(IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
+#define	IEEE80211_CHAN_B \
+	(IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_CCK)
+#define	IEEE80211_CHAN_PUREG \
+	(IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_OFDM)
+#define	IEEE80211_CHAN_G \
+	(IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_DYN)
+#define IEEE80211_CHAN_108A \
+	(IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM | IEEE80211_CHAN_TURBO)
+#define	IEEE80211_CHAN_108G \
+	(IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_OFDM | IEEE80211_CHAN_TURBO)
+#define	IEEE80211_CHAN_ST \
+	(IEEE80211_CHAN_108A | IEEE80211_CHAN_STURBO)
+
+#define	IEEE80211_CHAN_ALL \
+	(IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_GFSK | \
+	 IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM | IEEE80211_CHAN_DYN)
+#define	IEEE80211_CHAN_ALLTURBO \
+	(IEEE80211_CHAN_ALL | IEEE80211_CHAN_TURBO | IEEE80211_CHAN_STURBO)
+
+#define	IEEE80211_IS_CHAN_FHSS(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_FHSS) == IEEE80211_CHAN_FHSS)
+#define	IEEE80211_IS_CHAN_A(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_A) == IEEE80211_CHAN_A)
+#define	IEEE80211_IS_CHAN_B(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_B) == IEEE80211_CHAN_B)
+#define	IEEE80211_IS_CHAN_PUREG(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_PUREG) == IEEE80211_CHAN_PUREG)
+#define	IEEE80211_IS_CHAN_G(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_G) == IEEE80211_CHAN_G)
+#define	IEEE80211_IS_CHAN_ANYG(_c) \
+	(IEEE80211_IS_CHAN_PUREG(_c) || IEEE80211_IS_CHAN_G(_c))
+#define	IEEE80211_IS_CHAN_ST(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_ST) == IEEE80211_CHAN_ST)
+#define	IEEE80211_IS_CHAN_108A(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_108A) == IEEE80211_CHAN_108A)
+#define	IEEE80211_IS_CHAN_108G(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_108G) == IEEE80211_CHAN_108G)
+
+#define	IEEE80211_IS_CHAN_2GHZ(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_2GHZ) != 0)
+#define	IEEE80211_IS_CHAN_5GHZ(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_5GHZ) != 0)
+#define	IEEE80211_IS_CHAN_OFDM(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_OFDM) != 0)
+#define	IEEE80211_IS_CHAN_CCK(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_CCK) != 0)
+#define	IEEE80211_IS_CHAN_GFSK(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_GFSK) != 0)
+#define	IEEE80211_IS_CHAN_TURBO(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_TURBO) != 0)
+#define	IEEE80211_IS_CHAN_STURBO(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_STURBO) != 0)
+#define	IEEE80211_IS_CHAN_DTURBO(_c) \
+	(((_c)->ic_flags & \
+	(IEEE80211_CHAN_TURBO | IEEE80211_CHAN_STURBO)) == IEEE80211_CHAN_TURBO)
+#define	IEEE80211_IS_CHAN_HALF(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_HALF) != 0)
+#define	IEEE80211_IS_CHAN_QUARTER(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_QUARTER) != 0)
+
+#define	IEEE80211_IS_CHAN_RADAR(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_RADAR) != 0)
+#define	IEEE80211_IS_CHAN_PASSIVE(_c) \
+	(((_c)->ic_flags & IEEE80211_CHAN_PASSIVE) != 0)
+#define	IEEE80211_ARE_CHANS_SAME_MODE(_a, _b) \
+	(((_a)->ic_flags & IEEE80211_CHAN_ALLTURBO) == ((_b)->ic_flags & IEEE80211_CHAN_ALLTURBO))
+
+/* ni_chan encoding for FH phy */
+#define	IEEE80211_FH_CHANMOD		80
+#define	IEEE80211_FH_CHAN(set,pat)	(((set) - 1) * IEEE80211_FH_CHANMOD + (pat))
+#define	IEEE80211_FH_CHANSET(chan)	((chan) / IEEE80211_FH_CHANMOD + 1)
+#define	IEEE80211_FH_CHANPAT(chan)	((chan) % IEEE80211_FH_CHANMOD)
+
+/*
+ * Spectrum Management (IEEE 802.11h-2003)
+ */
+
+/* algorithm for (re)association based on supported channels
+ * (the one mentioned in 11.6.1 as out of scope of .11h) */
+enum ieee80211_sc_algorithm {
+	IEEE80211_SC_NONE,
+	/*
+	 * Do not disallow anyone from associating. When needed, channel will
+	 * be switched to the most suitable channel, no matter client stations
+	 * support it or not.
+	 */
+
+	IEEE80211_SC_LOOSE,
+	/*
+	 * Do not disallow anyone from associating. When needed, channel will
+	 * be switched to a suitable channel, which will be chosen taking
+	 * ni->ni_suppchans and ic->ic_sc_sldg under consideration.
+	 */
+
+	IEEE80211_SC_TIGHT,
+	/*
+	 * Allow to associate if there are at least ic->ic_mincom channels
+	 * common to the associating station and all of the already associated
+	 * stations. If the number of new common channels is less than
+	 * required, consider disassociating some other STAs. Such a
+	 * disassociation will be performed if (and only if) the association we
+	 * are currently considering would be then possible and the count of
+	 * the resultant set of common channels (ic_chan_nodes[i] ==
+	 * ic_cn_total) would increase by some amount. Whether the number of
+	 * the new channels that could be gained is enough to sacrifice a
+	 * number of STAs is determined by the ic->ic_slcg parameter.
+	 */
+
+	IEEE80211_SC_STRICT
+	/*
+	 * Basically the same behavior as IEEE80211_SC_TIGHT, except that if a
+	 * station does not specify Supported Channels, then it is denied to
+	 * associate.
+	 */
+};
+
+/*
+ * 802.11 rate set.
+ */
+#define	IEEE80211_RATE_SIZE	8		/* 802.11 standard */
+#define	IEEE80211_RATE_MAXSIZE	15		/* max rates we'll handle */
+#define	IEEE80211_SANITISE_RATESIZE(_rsz) \
+	((_rsz > IEEE80211_RATE_MAXSIZE) ? IEEE80211_RATE_MAXSIZE : _rsz)
+
+struct ieee80211_rateset {
+	u_int8_t rs_nrates;
+	u_int8_t rs_rates[IEEE80211_RATE_MAXSIZE];
+};
+
+struct ieee80211_roam {
+	int8_t rssi11a;		/* rssi thresh for 11a bss */
+	int8_t rssi11b;		/* for 11g sta in 11b bss */
+	int8_t rssi11bOnly;	/* for 11b sta */
+	u_int8_t pad1;
+	u_int8_t rate11a;	/* rate thresh for 11a bss */
+	u_int8_t rate11b;	/* for 11g sta in 11b bss */
+	u_int8_t rate11bOnly;	/* for 11b sta */
+	u_int8_t pad2;
+};
+#endif /* _NET80211__IEEE80211_H_ */
diff --git a/package/hostapd/madwifi/net80211/ieee80211.h b/package/hostapd/madwifi/net80211/ieee80211.h
new file mode 100644
index 0000000000..a39d4b9263
--- /dev/null
+++ b/package/hostapd/madwifi/net80211/ieee80211.h
@@ -0,0 +1,997 @@
+/*-
+ * Copyright (c) 2001 Atsushi Onoe
+ * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $Id: ieee80211.h 3268 2008-01-26 20:48:11Z mtaylor $
+ */
+#ifndef _NET80211_IEEE80211_H_
+#define _NET80211_IEEE80211_H_
+
+/*
+ * 802.11 protocol definitions.
+ */
+
+#define	IEEE80211_ADDR_LEN		6		/* size of 802.11 address */
+/* is 802.11 address multicast/broadcast? */
+#define	IEEE80211_IS_MULTICAST(_a)	(*(_a) & 0x01)
+
+/* IEEE 802.11 PLCP header */
+struct ieee80211_plcp_hdr {
+	u_int16_t i_sfd;
+	u_int8_t i_signal;
+	u_int8_t i_service;
+	u_int16_t i_length;
+	u_int16_t i_crc;
+} __packed;
+
+#define IEEE80211_PLCP_SFD      0xF3A0
+#define IEEE80211_PLCP_SERVICE  0x00
+
+/*
+ * generic definitions for IEEE 802.11 frames
+ */
+struct ieee80211_frame {
+	u_int8_t i_fc[2];
+	__le16 i_dur;
+	u_int8_t i_addr1[IEEE80211_ADDR_LEN];
+	u_int8_t i_addr2[IEEE80211_ADDR_LEN];
+	u_int8_t i_addr3[IEEE80211_ADDR_LEN];
+	u_int8_t i_seq[2];
+	/* possibly followed by addr4[IEEE80211_ADDR_LEN]; */
+	/* see below */
+} __packed;
+
+struct ieee80211_qosframe {
+	u_int8_t i_fc[2];
+	__le16 i_dur;
+	u_int8_t i_addr1[IEEE80211_ADDR_LEN];
+	u_int8_t i_addr2[IEEE80211_ADDR_LEN];
+	u_int8_t i_addr3[IEEE80211_ADDR_LEN];
+	u_int8_t i_seq[2];
+	u_int8_t i_qos[2];
+	/* possibly followed by addr4[IEEE80211_ADDR_LEN]; */
+	/* see below */
+} __packed;
+
+struct ieee80211_qoscntl {
+	u_int8_t i_qos[2];
+};
+
+struct ieee80211_frame_addr4 {
+	u_int8_t i_fc[2];
+	__le16 i_dur;
+	u_int8_t i_addr1[IEEE80211_ADDR_LEN];
+	u_int8_t i_addr2[IEEE80211_ADDR_LEN];
+	u_int8_t i_addr3[IEEE80211_ADDR_LEN];
+	u_int8_t i_seq[2];
+	u_int8_t i_addr4[IEEE80211_ADDR_LEN];
+} __packed;
+
+
+struct ieee80211_qosframe_addr4 {
+	u_int8_t i_fc[2];
+	__le16 i_dur;
+	u_int8_t i_addr1[IEEE80211_ADDR_LEN];
+	u_int8_t i_addr2[IEEE80211_ADDR_LEN];
+	u_int8_t i_addr3[IEEE80211_ADDR_LEN];
+	u_int8_t i_seq[2];
+	u_int8_t i_addr4[IEEE80211_ADDR_LEN];
+	u_int8_t i_qos[2];
+} __packed;
+
+struct ieee80211_ctlframe_addr2 {
+	u_int8_t i_fc[2];
+	__le16 i_aidordur; /* AID or duration */
+	u_int8_t i_addr1[IEEE80211_ADDR_LEN];
+	u_int8_t i_addr2[IEEE80211_ADDR_LEN];
+} __packed;
+
+#define	IEEE80211_FC0_VERSION_MASK		0x03
+#define	IEEE80211_FC0_VERSION_SHIFT		0
+#define	IEEE80211_FC0_VERSION_0			0x00
+#define	IEEE80211_FC0_TYPE_MASK			0x0c
+#define	IEEE80211_FC0_TYPE_SHIFT		2
+#define	IEEE80211_FC0_TYPE_MGT			0x00
+#define	IEEE80211_FC0_TYPE_CTL			0x04
+#define	IEEE80211_FC0_TYPE_DATA			0x08
+
+#define	IEEE80211_FC0_SUBTYPE_MASK		0xf0
+#define	IEEE80211_FC0_SUBTYPE_SHIFT		4
+/* for TYPE_MGT */
+#define	IEEE80211_FC0_SUBTYPE_ASSOC_REQ		0x00
+#define	IEEE80211_FC0_SUBTYPE_ASSOC_RESP	0x10
+#define	IEEE80211_FC0_SUBTYPE_REASSOC_REQ	0x20
+#define	IEEE80211_FC0_SUBTYPE_REASSOC_RESP	0x30
+#define	IEEE80211_FC0_SUBTYPE_PROBE_REQ		0x40
+#define	IEEE80211_FC0_SUBTYPE_PROBE_RESP	0x50
+#define	IEEE80211_FC0_SUBTYPE_BEACON		0x80
+#define	IEEE80211_FC0_SUBTYPE_ATIM		0x90
+#define	IEEE80211_FC0_SUBTYPE_DISASSOC		0xa0
+#define	IEEE80211_FC0_SUBTYPE_AUTH		0xb0
+#define	IEEE80211_FC0_SUBTYPE_DEAUTH		0xc0
+#define IEEE80211_FC0_SUBTYPE_ACTION		0xd0
+/* for TYPE_CTL */
+#define	IEEE80211_FC0_SUBTYPE_PS_POLL		0xa0
+#define	IEEE80211_FC0_SUBTYPE_RTS		0xb0
+#define	IEEE80211_FC0_SUBTYPE_CTS		0xc0
+#define	IEEE80211_FC0_SUBTYPE_ACK		0xd0
+#define	IEEE80211_FC0_SUBTYPE_CF_END		0xe0
+#define	IEEE80211_FC0_SUBTYPE_CF_END_ACK	0xf0
+/* for TYPE_DATA (bit combination) */
+#define	IEEE80211_FC0_SUBTYPE_DATA		0x00
+#define	IEEE80211_FC0_SUBTYPE_CF_ACK		0x10
+#define	IEEE80211_FC0_SUBTYPE_CF_POLL		0x20
+#define	IEEE80211_FC0_SUBTYPE_CF_ACPL		0x30
+#define	IEEE80211_FC0_SUBTYPE_NODATA		0x40
+#define	IEEE80211_FC0_SUBTYPE_CFACK		0x50
+#define	IEEE80211_FC0_SUBTYPE_CFPOLL		0x60
+#define	IEEE80211_FC0_SUBTYPE_CF_ACK_CF_ACK	0x70
+#define	IEEE80211_FC0_SUBTYPE_QOS		0x80
+#define	IEEE80211_FC0_SUBTYPE_QOS_NULL		0xc0
+
+#define	IEEE80211_FC1_DIR_MASK			0x03
+#define	IEEE80211_FC1_DIR_NODS			0x00	/* STA->STA */
+#define	IEEE80211_FC1_DIR_TODS			0x01	/* STA->AP  */
+#define	IEEE80211_FC1_DIR_FROMDS		0x02	/* AP ->STA */
+#define	IEEE80211_FC1_DIR_DSTODS		0x03	/* AP ->AP  */
+
+#define	IEEE80211_FC1_MORE_FRAG			0x04
+#define	IEEE80211_FC1_RETRY			0x08
+#define	IEEE80211_FC1_PWR_MGT			0x10
+#define	IEEE80211_FC1_MORE_DATA			0x20
+#define	IEEE80211_FC1_PROT			0x40
+#define	IEEE80211_FC1_ORDER			0x80
+
+#define	IEEE80211_SEQ_FRAG_MASK			0x000f
+#define	IEEE80211_SEQ_FRAG_SHIFT		0
+#define	IEEE80211_SEQ_SEQ_MASK			0xfff0
+#define	IEEE80211_SEQ_SEQ_SHIFT			4
+
+#define	IEEE80211_NWID_LEN			32
+
+#define	IEEE80211_QOS_TXOP			0x00ff
+/* bit 8 is reserved */
+#define	IEEE80211_QOS_ACKPOLICY			0x60
+#define	IEEE80211_QOS_ACKPOLICY_S		5
+#define	IEEE80211_QOS_EOSP			0x10
+#define	IEEE80211_QOS_EOSP_S			4
+#define	IEEE80211_QOS_TID			0x0f
+
+#define IEEE80211_FRM_HAS_BODY(_wh)			\
+	(((_wh)->i_fc[0] & IEEE80211_FC0_TYPE_MASK) !=	\
+			IEEE80211_FC0_TYPE_CTL)
+
+/*
+ * Country/Region Codes from MS WINNLS.H
+ * Numbering from ISO 3166
+ * XXX belongs elsewhere
+ */
+enum CountryCode {
+	CTRY_ALBANIA              = 8,       /* Albania */
+	CTRY_ALGERIA              = 12,      /* Algeria */
+	CTRY_ARGENTINA            = 32,      /* Argentina */
+	CTRY_ARMENIA              = 51,      /* Armenia */
+	CTRY_AUSTRALIA            = 36,      /* Australia */
+	CTRY_AUSTRIA              = 40,      /* Austria */
+	CTRY_AZERBAIJAN           = 31,      /* Azerbaijan */
+	CTRY_BAHRAIN              = 48,      /* Bahrain */
+	CTRY_BELARUS              = 112,     /* Belarus */
+	CTRY_BELGIUM              = 56,      /* Belgium */
+	CTRY_BELIZE               = 84,      /* Belize */
+	CTRY_BOLIVIA              = 68,      /* Bolivia */
+	CTRY_BRAZIL               = 76,      /* Brazil */
+	CTRY_BRUNEI_DARUSSALAM    = 96,      /* Brunei Darussalam */
+	CTRY_BULGARIA             = 100,     /* Bulgaria */
+	CTRY_CANADA               = 124,     /* Canada */
+	CTRY_CHILE                = 152,     /* Chile */
+	CTRY_CHINA                = 156,     /* People's Republic of China */
+	CTRY_COLOMBIA             = 170,     /* Colombia */
+	CTRY_COSTA_RICA           = 188,     /* Costa Rica */
+	CTRY_CROATIA              = 191,     /* Croatia */
+	CTRY_CYPRUS               = 196,
+	CTRY_CZECH                = 203,     /* Czech Republic */
+	CTRY_DENMARK              = 208,     /* Denmark */
+	CTRY_DOMINICAN_REPUBLIC   = 214,     /* Dominican Republic */
+	CTRY_ECUADOR              = 218,     /* Ecuador */
+	CTRY_EGYPT                = 818,     /* Egypt */
+	CTRY_EL_SALVADOR          = 222,     /* El Salvador */
+	CTRY_ESTONIA              = 233,     /* Estonia */
+	CTRY_FAEROE_ISLANDS       = 234,     /* Faeroe Islands */
+	CTRY_FINLAND              = 246,     /* Finland */
+	CTRY_FRANCE               = 250,     /* France */
+	CTRY_FRANCE2              = 255,     /* France2 */
+	CTRY_GEORGIA              = 268,     /* Georgia */
+	CTRY_GERMANY              = 276,     /* Germany */
+	CTRY_GREECE               = 300,     /* Greece */
+	CTRY_GUATEMALA            = 320,     /* Guatemala */
+	CTRY_HONDURAS             = 340,     /* Honduras */
+	CTRY_HONG_KONG            = 344,     /* Hong Kong S.A.R., P.R.C. */
+	CTRY_HUNGARY              = 348,     /* Hungary */
+	CTRY_ICELAND              = 352,     /* Iceland */
+	CTRY_INDIA                = 356,     /* India */
+	CTRY_INDONESIA            = 360,     /* Indonesia */
+	CTRY_IRAN                 = 364,     /* Iran */
+	CTRY_IRAQ                 = 368,     /* Iraq */
+	CTRY_IRELAND              = 372,     /* Ireland */
+	CTRY_ISRAEL               = 376,     /* Israel */
+	CTRY_ITALY                = 380,     /* Italy */
+	CTRY_JAMAICA              = 388,     /* Jamaica */
+	CTRY_JAPAN                = 392,     /* Japan */
+	CTRY_JAPAN1               = 393,     /* Japan (JP1) */
+	CTRY_JAPAN2               = 394,     /* Japan (JP0) */
+	CTRY_JAPAN3               = 395,     /* Japan (JP1-1) */
+	CTRY_JAPAN4               = 396,     /* Japan (JE1) */
+	CTRY_JAPAN5               = 397,     /* Japan (JE2) */
+	CTRY_JAPAN6               = 399,	 /* Japan (JP6) */
+	CTRY_JAPAN7               = 900,	 /* Japan */
+	CTRY_JAPAN8               = 901,	 /* Japan */
+	CTRY_JAPAN9               = 902,	 /* Japan */
+	CTRY_JAPAN10	      = 903,	 /* Japan */
+	CTRY_JAPAN11	      = 904,	 /* Japan */
+	CTRY_JAPAN12	      = 905,	 /* Japan */
+	CTRY_JAPAN13	      = 906,	 /* Japan */
+	CTRY_JAPAN14	      = 907,	 /* Japan */
+	CTRY_JAPAN15	      = 908,	 /* Japan */
+	CTRY_JAPAN16	      = 909,	 /* Japan */
+	CTRY_JAPAN17	      = 910,	 /* Japan */
+	CTRY_JAPAN18	      = 911,	 /* Japan */
+	CTRY_JAPAN19	      = 912,	 /* Japan */
+	CTRY_JAPAN20	      = 913,	 /* Japan */
+	CTRY_JAPAN21	      = 914,	 /* Japan */
+	CTRY_JAPAN22	      = 915,	 /* Japan */
+	CTRY_JAPAN23	      = 916,	 /* Japan */
+	CTRY_JAPAN24	      = 917,	 /* Japan */
+	CTRY_JAPAN25	      = 918,	 /* Japan */
+	CTRY_JAPAN26	      = 919,	 /* Japan */
+	CTRY_JAPAN27	      = 920,	 /* Japan */
+	CTRY_JAPAN28	      = 921,	 /* Japan */
+	CTRY_JAPAN29	      = 922,	 /* Japan */
+	CTRY_JAPAN30	      = 923,	 /* Japan */
+	CTRY_JAPAN31	      = 924,	 /* Japan */
+	CTRY_JAPAN32	      = 925,	 /* Japan */
+	CTRY_JAPAN33	      = 926,	 /* Japan */
+	CTRY_JAPAN34	      = 927,	 /* Japan */
+	CTRY_JAPAN35	      = 928,	 /* Japan */
+	CTRY_JAPAN36	      = 929,	 /* Japan */
+	CTRY_JAPAN37	      = 930,	 /* Japan */
+	CTRY_JAPAN38	      = 931,	 /* Japan */
+	CTRY_JAPAN39	      = 932,	 /* Japan */
+	CTRY_JAPAN40	      = 933,	 /* Japan */
+	CTRY_JAPAN41	      = 934,	 /* Japan */
+	CTRY_JAPAN42	      = 935,	 /* Japan */
+	CTRY_JAPAN43	      = 936,	 /* Japan */
+	CTRY_JAPAN44	      = 937,	 /* Japan */
+	CTRY_JAPAN45	      = 938,	 /* Japan */
+	CTRY_JAPAN46	      = 939,	 /* Japan */
+	CTRY_JAPAN47	      = 940,	 /* Japan */
+	CTRY_JAPAN48	      = 941,	 /* Japan */
+	CTRY_JORDAN               = 400,     /* Jordan */
+	CTRY_KAZAKHSTAN           = 398,     /* Kazakhstan */
+	CTRY_KENYA                = 404,     /* Kenya */
+	CTRY_KOREA_NORTH          = 408,     /* North Korea */
+	CTRY_KOREA_ROC            = 410,     /* South Korea */
+	CTRY_KOREA_ROC2           = 411,     /* South Korea */
+	CTRY_KUWAIT               = 414,     /* Kuwait */
+	CTRY_LATVIA               = 428,     /* Latvia */
+	CTRY_LEBANON              = 422,     /* Lebanon */
+	CTRY_LIBYA                = 434,     /* Libya */
+	CTRY_LIECHTENSTEIN        = 438,     /* Liechtenstein */
+	CTRY_LITHUANIA            = 440,     /* Lithuania */
+	CTRY_LUXEMBOURG           = 442,     /* Luxembourg */
+	CTRY_MACAU                = 446,     /* Macau */
+	CTRY_MACEDONIA            = 807,     /* the Former Yugoslav Republic of Macedonia */
+	CTRY_MALAYSIA             = 458,     /* Malaysia */
+	CTRY_MEXICO               = 484,     /* Mexico */
+	CTRY_MONACO               = 492,     /* Principality of Monaco */
+	CTRY_MOROCCO              = 504,     /* Morocco */
+	CTRY_NETHERLANDS          = 528,     /* Netherlands */
+	CTRY_NEW_ZEALAND          = 554,     /* New Zealand */
+	CTRY_NICARAGUA            = 558,     /* Nicaragua */
+	CTRY_NORWAY               = 578,     /* Norway */
+	CTRY_OMAN                 = 512,     /* Oman */
+	CTRY_PAKISTAN             = 586,     /* Islamic Republic of Pakistan */
+	CTRY_PANAMA               = 591,     /* Panama */
+	CTRY_PARAGUAY             = 600,     /* Paraguay */
+	CTRY_PERU                 = 604,     /* Peru */
+	CTRY_PHILIPPINES          = 608,     /* Republic of the Philippines */
+	CTRY_POLAND               = 616,     /* Poland */
+	CTRY_PORTUGAL             = 620,     /* Portugal */
+	CTRY_PUERTO_RICO          = 630,     /* Puerto Rico */
+	CTRY_QATAR                = 634,     /* Qatar */
+	CTRY_ROMANIA              = 642,     /* Romania */
+	CTRY_RUSSIA               = 643,     /* Russia */
+	CTRY_SAUDI_ARABIA         = 682,     /* Saudi Arabia */
+	CTRY_SINGAPORE            = 702,     /* Singapore */
+	CTRY_SLOVAKIA             = 703,     /* Slovak Republic */
+	CTRY_SLOVENIA             = 705,     /* Slovenia */
+	CTRY_SOUTH_AFRICA         = 710,     /* South Africa */
+	CTRY_SPAIN                = 724,     /* Spain */
+	CTRY_SWEDEN               = 752,     /* Sweden */
+	CTRY_SWITZERLAND          = 756,     /* Switzerland */
+	CTRY_SYRIA                = 760,     /* Syria */
+	CTRY_TAIWAN               = 158,     /* Taiwan */
+	CTRY_THAILAND             = 764,     /* Thailand */
+	CTRY_TRINIDAD_Y_TOBAGO    = 780,     /* Trinidad y Tobago */
+	CTRY_TUNISIA              = 788,     /* Tunisia */
+	CTRY_TURKEY               = 792,     /* Turkey */
+	CTRY_UAE                  = 784,     /* U.A.E. */
+	CTRY_UKRAINE              = 804,     /* Ukraine */
+	CTRY_UNITED_KINGDOM       = 826,     /* United Kingdom */
+	CTRY_UNITED_STATES        = 840,     /* United States */
+	CTRY_UNITED_STATES_FCC49  = 842,     /* United States (Public Safety)*/
+	CTRY_URUGUAY              = 858,     /* Uruguay */
+	CTRY_UZBEKISTAN           = 860,     /* Uzbekistan */
+	CTRY_VENEZUELA            = 862,     /* Venezuela */
+	CTRY_VIET_NAM             = 704,     /* Viet Nam */
+	CTRY_YEMEN                = 887,     /* Yemen */
+	CTRY_ZIMBABWE             = 716      /* Zimbabwe */
+};
+
+/* 
+ * Generic information element
+ */
+struct ieee80211_ie {
+	u_int8_t id;
+	u_int8_t len;
+	u_int8_t info[0];
+} __packed;
+
+/* 
+ * Country information element.
+ */
+#define IEEE80211_COUNTRY_MAX_TRIPLETS (83)
+struct ieee80211_ie_country {
+	u_int8_t country_id;
+	u_int8_t country_len;
+	u_int8_t country_str[3];
+	u_int8_t country_triplet[IEEE80211_COUNTRY_MAX_TRIPLETS * 3];
+} __packed;
+
+/*
+ * Power Constraint information element.
+ */
+struct ieee80211_ie_pwrcnstr {
+	u_int8_t pc_id;			/* IEEE80211_ELEMID_PWRCNSTR */
+	u_int8_t pc_len;		/* == 2 */
+	u_int8_t pc_lpc;		/* Local Power Constraint [dB] */
+} __packed;
+
+/*
+ * Power Capability information element.
+ */
+struct ieee80211_ie_pwrcap {
+	u_int8_t pc_id;			/* IEEE80211_ELEMID_PWRCAP */
+	u_int8_t pc_len;		/* == 2 */
+	int8_t pc_mintxpow;		/* Minimum Transmit Power Capability [dBm] */
+	int8_t pc_maxtxpow;		/* Maximum Transmit Power Capability [dBm] */
+} __packed;
+
+/*
+ * Supported Channels information element.
+ */
+#define IEEE80211_SUPPCHAN_MAX_PAIRS (127)
+struct ieee80211_ie_sc {
+	u_int8_t sc_id;			/* IEEE80211_ELEMID_SUPPCHAN */
+	u_int8_t sc_len;		/* == 2 * number of sc_subband elements */
+	struct {
+		u_int8_t sc_first;	/* First Channel Number */
+		u_int8_t sc_number;	/* Number of Channels */
+	} __packed sc_subband[IEEE80211_SUPPCHAN_MAX_PAIRS];
+} __packed;
+
+/*
+ * Channel Switch Announcement information element.
+ */
+struct ieee80211_ie_csa {
+	u_int8_t csa_id;	/* IEEE80211_ELEMID_CHANSWITCHANN */
+	u_int8_t csa_len;	/* == 3 */
+	u_int8_t csa_mode;	/* Channel Switch Mode: 1 == stop transmission until CS */
+	u_int8_t csa_chan;	/* New Channel Number */
+	u_int8_t csa_count;	/* TBTTs until Channel Switch happens */
+} __packed;
+
+/* minimal Channel Switch Count in the initial announcement */
+#define IEEE80211_CSA_PROTECTION_PERIOD 3
+
+/* maximum allowed deviance of measurement of intervals between CSA in Beacons */
+#define IEEE80211_CSA_SANITY_THRESHOLD 100
+
+
+/* does frame have QoS sequence control data */
+#define	IEEE80211_QOS_HAS_SEQ(wh) \
+	(((wh)->i_fc[0] & \
+	  (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_QOS)) == \
+	  (IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS))
+
+#define WME_QOSINFO_COUNT	0x0f  /* Mask for Param Set Count field */
+/*
+ * WME/802.11e information element.
+ */
+struct ieee80211_ie_wme {
+	u_int8_t wme_id;		/* IEEE80211_ELEMID_VENDOR */
+	u_int8_t wme_len;	/* length in bytes */
+	u_int8_t wme_oui[3];	/* 0x00, 0x50, 0xf2 */
+	u_int8_t wme_type;	/* OUI type */
+	u_int8_t wme_subtype;	/* OUI subtype */
+	u_int8_t wme_version;	/* spec revision */
+	u_int8_t wme_info;	/* QoS info */
+} __packed;
+
+/*
+ * WME/802.11e Tspec Element
+ */
+struct ieee80211_wme_tspec {
+	u_int8_t ts_id;
+	u_int8_t ts_len;
+	u_int8_t ts_oui[3];
+	u_int8_t ts_oui_type;
+	u_int8_t ts_oui_subtype;
+	u_int8_t ts_version;
+	u_int8_t ts_tsinfo[3];
+	u_int8_t ts_nom_msdu[2];
+	u_int8_t ts_max_msdu[2];
+	u_int8_t ts_min_svc[4];
+	u_int8_t ts_max_svc[4];
+	u_int8_t ts_inactv_intv[4];
+	u_int8_t ts_susp_intv[4];
+	u_int8_t ts_start_svc[4];
+	u_int8_t ts_min_rate[4];
+	u_int8_t ts_mean_rate[4];
+	u_int8_t ts_max_burst[4];
+	u_int8_t ts_min_phy[4];
+	u_int8_t ts_peak_rate[4];
+	u_int8_t ts_delay[4];
+	u_int8_t ts_surplus[2];
+	u_int8_t ts_medium_time[2];
+} __packed;
+
+/*
+ * WME AC parameter field
+ */
+
+struct ieee80211_wme_acparams {
+	u_int8_t acp_aci_aifsn;
+	u_int8_t acp_logcwminmax;
+	u_int16_t acp_txop;
+} __packed;
+
+#define IEEE80211_WME_PARAM_LEN 24
+#define WME_NUM_AC		4	/* 4 AC categories */
+
+#define WME_PARAM_ACI		0x60	/* Mask for ACI field */
+#define WME_PARAM_ACI_S		5	/* Shift for ACI field */
+#define WME_PARAM_ACM		0x10	/* Mask for ACM bit */
+#define WME_PARAM_ACM_S		4	/* Shift for ACM bit */
+#define WME_PARAM_AIFSN		0x0f	/* Mask for aifsn field */
+#define WME_PARAM_AIFSN_S	0	/* Shift for aifsn field */
+#define WME_PARAM_LOGCWMIN	0x0f	/* Mask for CwMin field (in log) */
+#define WME_PARAM_LOGCWMIN_S	0	/* Shift for CwMin field */
+#define WME_PARAM_LOGCWMAX	0xf0	/* Mask for CwMax field (in log) */
+#define WME_PARAM_LOGCWMAX_S	4	/* Shift for CwMax field */
+
+#define WME_AC_TO_TID(_ac) (       \
+	((_ac) == WME_AC_VO) ? 6 : \
+	((_ac) == WME_AC_VI) ? 5 : \
+	((_ac) == WME_AC_BK) ? 1 : \
+	0)
+
+#define TID_TO_WME_AC(_tid) (      \
+	((_tid) < 1) ? WME_AC_BE : \
+	((_tid) < 3) ? WME_AC_BK : \
+	((_tid) < 6) ? WME_AC_VI : \
+	WME_AC_VO)
+
+/*
+ * WME Parameter Element
+ */
+
+struct ieee80211_wme_param {
+	u_int8_t param_id;
+	u_int8_t param_len;
+	u_int8_t param_oui[3];
+	u_int8_t param_oui_type;
+	u_int8_t param_oui_sybtype;
+	u_int8_t param_version;
+	u_int8_t param_qosInfo;
+	u_int8_t param_reserved;
+	struct ieee80211_wme_acparams	params_acParams[WME_NUM_AC];
+} __packed;
+
+/*
+ * WME U-APSD qos info field defines
+ */
+#define WME_CAPINFO_UAPSD_EN			0x00000080
+#define WME_CAPINFO_UAPSD_VO			0x00000001
+#define WME_CAPINFO_UAPSD_VI			0x00000002
+#define WME_CAPINFO_UAPSD_BK			0x00000004
+#define WME_CAPINFO_UAPSD_BE			0x00000008
+#define WME_CAPINFO_UAPSD_ACFLAGS_SHIFT		0
+#define WME_CAPINFO_UAPSD_ACFLAGS_MASK		0xF
+#define WME_CAPINFO_UAPSD_MAXSP_SHIFT		5
+#define WME_CAPINFO_UAPSD_MAXSP_MASK		0x3
+#define WME_CAPINFO_IE_OFFSET			8
+#define WME_UAPSD_MAXSP(_qosinfo)					\
+		(((_qosinfo) >> WME_CAPINFO_UAPSD_MAXSP_SHIFT) & 	\
+		 WME_CAPINFO_UAPSD_MAXSP_MASK)
+#define WME_UAPSD_AC_ENABLED(_ac, _qosinfo)				\
+		((1 << (3 - (_ac))) & (					\
+		 ((_qosinfo) >> WME_CAPINFO_UAPSD_ACFLAGS_SHIFT) &	\
+		 WME_CAPINFO_UAPSD_ACFLAGS_MASK))
+
+/*
+ * Atheros Advanced Capability information element.
+ */
+struct ieee80211_ie_athAdvCap {
+	u_int8_t athAdvCap_id;		/* IEEE80211_ELEMID_VENDOR */
+	u_int8_t athAdvCap_len;		/* length in bytes */
+	u_int8_t athAdvCap_oui[3];	/* 0x00, 0x03, 0x7f */
+	u_int8_t athAdvCap_type;	/* OUI type */
+	u_int8_t athAdvCap_subtype;	/* OUI subtype */
+	u_int8_t athAdvCap_version;	/* spec revision */
+	u_int8_t athAdvCap_capability;	/* Capability info */
+	u_int16_t athAdvCap_defKeyIndex;
+} __packed;
+
+/*
+ * Atheros XR information element.
+ */
+struct ieee80211_xr_param {
+	u_int8_t param_id;
+	u_int8_t param_len;
+	u_int8_t param_oui[3];
+	u_int8_t param_oui_type;
+	u_int8_t param_oui_sybtype;
+	u_int8_t param_version;
+	u_int8_t param_Info;
+	u_int8_t param_base_bssid[IEEE80211_ADDR_LEN];
+	u_int8_t param_xr_bssid[IEEE80211_ADDR_LEN];
+	u_int16_t param_xr_beacon_interval;
+	u_int8_t param_base_ath_capability;
+	u_int8_t param_xr_ath_capability;
+} __packed;
+
+/* Atheros capabilities */
+#define IEEE80211_ATHC_TURBOP	0x0001		/* Turbo Prime */
+#define IEEE80211_ATHC_COMP	0x0002		/* Compression */
+#define IEEE80211_ATHC_FF	0x0004		/* Fast Frames */
+#define IEEE80211_ATHC_XR	0x0008		/* Xtended Range support */
+#define IEEE80211_ATHC_AR	0x0010		/* Advanced Radar support */
+#define IEEE80211_ATHC_BURST	0x0020		/* Bursting - not negotiated */
+#define IEEE80211_ATHC_WME	0x0040		/* CWMin tuning */
+#define IEEE80211_ATHC_BOOST	0x0080		/* Boost */
+
+/*
+ * Management Notification Frame
+ */
+struct ieee80211_mnf {
+	u_int8_t mnf_category;
+	u_int8_t mnf_action;
+	u_int8_t mnf_dialog;
+	u_int8_t mnf_status;
+} __packed;
+#define	MNF_SETUP_REQ	0
+#define	MNF_SETUP_RESP	1
+#define	MNF_TEARDOWN	2
+
+/*
+ * Control frames.
+ */
+struct ieee80211_frame_min {
+	u_int8_t i_fc[2];
+	__le16 i_dur;
+	u_int8_t i_addr1[IEEE80211_ADDR_LEN];
+	u_int8_t i_addr2[IEEE80211_ADDR_LEN];
+	/* FCS */
+} __packed;
+
+struct ieee80211_frame_rts {
+	u_int8_t i_fc[2];
+	__le16 i_dur;
+	u_int8_t i_ra[IEEE80211_ADDR_LEN];
+	u_int8_t i_ta[IEEE80211_ADDR_LEN];
+	/* FCS */
+} __packed;
+
+struct ieee80211_frame_cts {
+	u_int8_t i_fc[2];
+	__le16 i_dur;
+	u_int8_t i_ra[IEEE80211_ADDR_LEN];
+	/* FCS */
+} __packed;
+
+struct ieee80211_frame_ack {
+	u_int8_t i_fc[2];
+	__le16 i_dur;
+	u_int8_t i_ra[IEEE80211_ADDR_LEN];
+	/* FCS */
+} __packed;
+
+struct ieee80211_frame_pspoll {
+	u_int8_t i_fc[2];
+	u_int8_t i_aid[2];
+	u_int8_t i_bssid[IEEE80211_ADDR_LEN];
+	u_int8_t i_ta[IEEE80211_ADDR_LEN];
+	/* FCS */
+} __packed;
+
+struct ieee80211_frame_cfend {		/* NB: also CF-End+CF-Ack */
+	u_int8_t i_fc[2];
+	__le16 i_dur;	/* should be zero */
+	u_int8_t i_ra[IEEE80211_ADDR_LEN];
+	u_int8_t i_bssid[IEEE80211_ADDR_LEN];
+	/* FCS */
+} __packed;
+
+/*
+ * BEACON management packets
+ *
+ *	octet timestamp[8]
+ *	octet beacon interval[2]
+ *	octet capability information[2]
+ *	information element
+ *		octet elemid
+ *		octet length
+ *		octet information[length]
+ */
+
+typedef u_int8_t *ieee80211_mgt_beacon_t;
+
+#define	IEEE80211_BEACON_INTERVAL(beacon) \
+	((beacon)[8] | ((beacon)[9] << 8))
+#define	IEEE80211_BEACON_CAPABILITY(beacon) \
+	((beacon)[10] | ((beacon)[11] << 8))
+
+#define	IEEE80211_CAPINFO_ESS			0x0001
+#define	IEEE80211_CAPINFO_IBSS			0x0002
+#define	IEEE80211_CAPINFO_CF_POLLABLE		0x0004
+#define	IEEE80211_CAPINFO_CF_POLLREQ		0x0008
+#define	IEEE80211_CAPINFO_PRIVACY		0x0010
+#define	IEEE80211_CAPINFO_SHORT_PREAMBLE	0x0020
+#define	IEEE80211_CAPINFO_PBCC			0x0040
+#define	IEEE80211_CAPINFO_CHNL_AGILITY		0x0080
+/* bits 8-9 are reserved (8 now for spectrum management) */
+#define IEEE80211_CAPINFO_SPECTRUM_MGMT		0x0100
+#define	IEEE80211_CAPINFO_SHORT_SLOTTIME	0x0400
+#define	IEEE80211_CAPINFO_RSN			0x0800
+/* bit 12 is reserved */
+#define	IEEE80211_CAPINFO_DSSSOFDM		0x2000
+/* bits 14-15 are reserved */
+
+/*
+ * 802.11i/WPA information element (maximally sized).
+ */
+struct ieee80211_ie_wpa {
+	u_int8_t wpa_id;			/* IEEE80211_ELEMID_VENDOR */
+	u_int8_t wpa_len;		/* length in bytes */
+	u_int8_t wpa_oui[3];		/* 0x00, 0x50, 0xf2 */
+	u_int8_t wpa_type;		/* OUI type */
+	u_int16_t wpa_version;		/* spec revision */
+	u_int32_t wpa_mcipher[1];	/* multicast/group key cipher */
+	u_int16_t wpa_uciphercnt;	/* # pairwise key ciphers */
+	u_int32_t wpa_uciphers[8];	/* ciphers */
+	u_int16_t wpa_authselcnt;	/* authentication selector cnt*/
+	u_int32_t wpa_authsels[8];	/* selectors */
+	u_int16_t wpa_caps;		/* 802.11i capabilities */
+	u_int16_t wpa_pmkidcnt;		/* 802.11i pmkid count */
+	u_int16_t wpa_pmkids[8];	/* 802.11i pmkids */
+} __packed;
+
+/*
+ * Management information element payloads.
+ */
+
+enum {
+	IEEE80211_ELEMID_SSID		= 0,
+	IEEE80211_ELEMID_RATES		= 1,
+	IEEE80211_ELEMID_FHPARMS	= 2,
+	IEEE80211_ELEMID_DSPARMS	= 3,
+	IEEE80211_ELEMID_CFPARMS	= 4,
+	IEEE80211_ELEMID_TIM		= 5,
+	IEEE80211_ELEMID_IBSSPARMS	= 6,
+	IEEE80211_ELEMID_COUNTRY	= 7,
+	IEEE80211_ELEMID_HOPPATRNPARMS  = 8,
+	IEEE80211_ELEMID_HOPPATRNTABLE  = 9,
+	IEEE80211_ELEMID_REQINFO	= 10,
+	IEEE80211_ELEMID_QBSSLOAD       = 11,
+	IEEE80211_ELEMID_EDCAPARAM      = 12,
+	IEEE80211_ELEMID_TSPEC		= 13,
+	IEEE80211_ELEMID_TRAFCLASS      = 14,
+	IEEE80211_ELEMID_SCHEDULE       = 15,
+	IEEE80211_ELEMID_CHALLENGE	= 16,
+	/* 17-31 reserved for challenge text extension */
+	IEEE80211_ELEMID_PWRCNSTR	= 32,
+	IEEE80211_ELEMID_PWRCAP		= 33,
+	IEEE80211_ELEMID_TPCREQ		= 34,
+	IEEE80211_ELEMID_TPCREP		= 35,
+	IEEE80211_ELEMID_SUPPCHAN	= 36,
+	IEEE80211_ELEMID_CHANSWITCHANN	= 37,
+	IEEE80211_ELEMID_MEASREQ	= 38,
+	IEEE80211_ELEMID_MEASREP	= 39,
+	IEEE80211_ELEMID_QUIET		= 40,
+	IEEE80211_ELEMID_IBSSDFS	= 41,
+	IEEE80211_ELEMID_ERP		= 42,
+	IEEE80211_ELEMID_TSDELAY	= 43,
+	IEEE80211_ELEMID_TCLASSPROC     = 44,
+	IEEE80211_ELEMID_QOS		= 46,
+	IEEE80211_ELEMID_RSN		= 48,
+	/* 49 reserved */
+	IEEE80211_ELEMID_XRATES		= 50,
+	/* 128-129 proprietary elements used by Agere chipsets */
+	IEEE80211_ELEMID_AGERE1		= 128,
+	IEEE80211_ELEMID_AGERE2		= 129,
+	IEEE80211_ELEMID_TPC		= 150,
+	IEEE80211_ELEMID_CCKM		= 156,
+	IEEE80211_ELEMID_VENDOR		= 221,	/* vendor private */
+};
+
+#define IEEE80211_CHANSWITCHANN_BYTES 	5
+#define BITCTL_BUFD_MCAST       	1
+#define BITCTL_BUFD_UCAST_AID_MASK 	((u_int8_t)~(BITCTL_BUFD_MCAST))
+#define BITCTL_BUFD_UCAST_AID_SHIFT 	1
+
+struct ieee80211_tim_ie {
+	u_int8_t	tim_ie;			/* IEEE80211_ELEMID_TIM */
+	u_int8_t	tim_len;
+	u_int8_t	tim_count;		/* DTIM count */
+	u_int8_t	tim_period;		/* DTIM period */
+	u_int8_t	tim_bitctl;		/* bitmap control */
+	u_int8_t	tim_bitmap[1];		/* variable-length bitmap */
+} __packed;
+
+struct ieee80211_country_ie {
+	u_int8_t	ie;			/* IEEE80211_ELEMID_COUNTRY */
+	u_int8_t	len;
+	u_int8_t	cc[3];			/* ISO CC+(I)ndoor/(O)utdoor */
+	struct {
+		u_int8_t schan;			/* starting channel */
+		u_int8_t nchan;			/* number channels */
+		u_int8_t maxtxpwr;		/* tx power cap */
+	} __packed band[4];			/* up to 4 sub bands */
+} __packed;
+
+#define IEEE80211_CHALLENGE_LEN		128
+
+#define IEEE80211_SUPPCHAN_LEN		26
+
+#define	IEEE80211_RATE_BASIC		0x80
+#define	IEEE80211_RATE_VAL		0x7f
+
+/* EPR information element flags */
+#define	IEEE80211_ERP_NON_ERP_PRESENT	0x01
+#define	IEEE80211_ERP_USE_PROTECTION	0x02
+#define	IEEE80211_ERP_LONG_PREAMBLE	0x04
+
+/* Atheros private advanced capabilities info */
+#define	ATHEROS_CAP_TURBO_PRIME		0x01
+#define	ATHEROS_CAP_COMPRESSION		0x02
+#define	ATHEROS_CAP_FAST_FRAME		0x04
+/* bits 3-6 reserved */
+#define	ATHEROS_CAP_BOOST		0x80
+
+#define	ATH_OUI			0x7f0300		/* Atheros OUI */
+#define	ATH_OUI_TYPE		0x01
+#define	ATH_OUI_SUBTYPE		0x01
+#define	ATH_OUI_VERSION		0x00
+#define	ATH_OUI_TYPE_XR		0x03
+#define	ATH_OUI_SUBTYPE_XR	0x01
+#define	ATH_OUI_VER_XR		0x00
+
+#define	WPA_OUI			0xf25000
+#define	WPA_OUI_TYPE		0x01
+#define	WPA_VERSION		1		/* current supported version */
+
+#define	WPA_CSE_NULL		0x00
+#define	WPA_CSE_WEP40		0x01
+#define	WPA_CSE_TKIP		0x02
+#define	WPA_CSE_CCMP		0x04
+#define	WPA_CSE_WEP104		0x05
+
+#define	WPA_ASE_NONE		0x00
+#define	WPA_ASE_8021X_UNSPEC	0x01
+#define	WPA_ASE_8021X_PSK	0x02
+
+#define	RSN_OUI			0xac0f00
+#define	RSN_VERSION		1		/* current supported version */
+
+#define	RSN_CSE_NULL		0x00
+#define	RSN_CSE_WEP40		0x01
+#define	RSN_CSE_TKIP		0x02
+#define	RSN_CSE_WRAP		0x03
+#define	RSN_CSE_CCMP		0x04
+#define	RSN_CSE_WEP104		0x05
+
+#define	RSN_ASE_NONE		0x00
+#define	RSN_ASE_8021X_UNSPEC	0x01
+#define	RSN_ASE_8021X_PSK	0x02
+
+#define	RSN_CAP_PREAUTH		0x01
+
+#define	WME_OUI			0xf25000
+#define	WME_OUI_TYPE		0x02
+#define	WME_INFO_OUI_SUBTYPE	0x00
+#define	WME_PARAM_OUI_SUBTYPE	0x01
+#define	WME_VERSION		1
+
+/* WME stream classes */
+#define	WME_AC_BE	0		/* best effort */
+#define	WME_AC_BK	1		/* background */
+#define	WME_AC_VI	2		/* video */
+#define	WME_AC_VO	3		/* voice */
+
+/*
+ * AUTH management packets
+ *
+ *	octet algo[2]
+ *	octet seq[2]
+ *	octet status[2]
+ *	octet chal.id
+ *	octet chal.length
+ *	octet chal.text[253]
+ */
+
+typedef u_int8_t *ieee80211_mgt_auth_t;
+
+#define	IEEE80211_AUTH_ALGORITHM(auth) \
+	((auth)[0] | ((auth)[1] << 8))
+#define	IEEE80211_AUTH_TRANSACTION(auth) \
+	((auth)[2] | ((auth)[3] << 8))
+#define	IEEE80211_AUTH_STATUS(auth) \
+	((auth)[4] | ((auth)[5] << 8))
+
+#define	IEEE80211_AUTH_ALG_OPEN		0x0000
+#define	IEEE80211_AUTH_ALG_SHARED	0x0001
+#define	IEEE80211_AUTH_ALG_LEAP		0x0080
+
+enum {
+	IEEE80211_AUTH_OPEN_REQUEST		= 1,
+	IEEE80211_AUTH_OPEN_RESPONSE		= 2,
+};
+
+enum {
+	IEEE80211_AUTH_SHARED_REQUEST		= 1,
+	IEEE80211_AUTH_SHARED_CHALLENGE		= 2,
+	IEEE80211_AUTH_SHARED_RESPONSE		= 3,
+	IEEE80211_AUTH_SHARED_PASS		= 4,
+};
+
+/*
+ * Reason codes
+ *
+ * Unlisted codes are reserved
+ */
+
+enum {
+	IEEE80211_REASON_UNSPECIFIED		= 1,
+	IEEE80211_REASON_AUTH_EXPIRE		= 2,
+	IEEE80211_REASON_AUTH_LEAVE		= 3,
+	IEEE80211_REASON_ASSOC_EXPIRE		= 4,
+	IEEE80211_REASON_ASSOC_TOOMANY		= 5,
+	IEEE80211_REASON_NOT_AUTHED		= 6,
+	IEEE80211_REASON_NOT_ASSOCED		= 7,
+	IEEE80211_REASON_ASSOC_LEAVE		= 8,
+	IEEE80211_REASON_ASSOC_NOT_AUTHED	= 9,
+
+	IEEE80211_REASON_PWRCAP_UNACCEPTABLE	= 10,
+	IEEE80211_REASON_SUPPCHAN_UNACCEPTABLE	= 11,
+	IEEE80211_REASON_RSN_REQUIRED		= 11,
+	IEEE80211_REASON_RSN_INCONSISTENT	= 12,
+	IEEE80211_REASON_IE_INVALID		= 13,
+	IEEE80211_REASON_MIC_FAILURE		= 14,
+
+	IEEE80211_STATUS_SUCCESS		= 0,
+	IEEE80211_STATUS_UNSPECIFIED		= 1,
+	IEEE80211_STATUS_CAPINFO		= 10,
+	IEEE80211_STATUS_NOT_ASSOCED		= 11,
+	IEEE80211_STATUS_OTHER			= 12,
+	IEEE80211_STATUS_ALG			= 13,
+	IEEE80211_STATUS_SEQUENCE		= 14,
+	IEEE80211_STATUS_CHALLENGE		= 15,
+	IEEE80211_STATUS_TIMEOUT		= 16,
+	IEEE80211_STATUS_TOOMANY		= 17,
+	IEEE80211_STATUS_BASIC_RATE		= 18,
+	IEEE80211_STATUS_SP_REQUIRED		= 19,
+	IEEE80211_STATUS_PBCC_REQUIRED		= 20,
+	IEEE80211_STATUS_CA_REQUIRED		= 21,
+	IEEE80211_STATUS_SM_REQUIRED		= 22,
+	IEEE80211_STATUS_PWRCAP_UNACCEPTABLE	= 23,
+	IEEE80211_STATUS_SUPPCHAN_UNACCEPTABLE	= 24,
+	IEEE80211_STATUS_TOO_MANY_STATIONS	= 22,
+	IEEE80211_STATUS_RATES			= 23,
+	IEEE80211_STATUS_SHORTSLOT_REQUIRED	= 25,
+	IEEE80211_STATUS_DSSSOFDM_REQUIRED	= 26,
+};
+
+#define	IEEE80211_WEP_KEYLEN		5	/* 40bit */
+#define	IEEE80211_WEP_IVLEN		3	/* 24bit */
+#define	IEEE80211_WEP_KIDLEN		1	/* 1 octet */
+#define	IEEE80211_WEP_CRCLEN		4	/* CRC-32 */
+#define	IEEE80211_WEP_NKID		4	/* number of key ids */
+
+/*
+ * 802.11i defines an extended IV for use with non-WEP ciphers.
+ * When the EXTIV bit is set in the key id byte an additional
+ * 4 bytes immediately follow the IV for TKIP.  For CCMP the
+ * EXTIV bit is likewise set but the 8 bytes represent the
+ * CCMP header rather than IV+extended-IV.
+ */
+#define	IEEE80211_WEP_EXTIV		0x20
+#define	IEEE80211_WEP_EXTIVLEN		4	/* extended IV length */
+#define	IEEE80211_WEP_MICLEN		8	/* trailing MIC */
+
+#define	IEEE80211_CRC_LEN		4
+
+/*
+ * Maximum acceptable MTU is:
+ *	IEEE80211_MAX_LEN - WEP overhead - CRC -
+ *		QoS overhead - RSN/WPA overhead
+ * Min is arbitrarily chosen > IEEE80211_MIN_LEN.  The default
+ * mtu is Ethernet-compatible; it's set by ether_ifattach.
+ */
+#define	IEEE80211_MTU_MAX		2290
+#define	IEEE80211_MTU_MIN		32
+
+#define	IEEE80211_MAX_LEN		(2300 + IEEE80211_CRC_LEN + \
+	(IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + IEEE80211_WEP_CRCLEN))
+#define	IEEE80211_ACK_LEN \
+	(sizeof(struct ieee80211_frame_ack) + IEEE80211_CRC_LEN)
+#define	IEEE80211_MIN_LEN \
+	(sizeof(struct ieee80211_frame_min) + IEEE80211_CRC_LEN)
+
+/*
+ * The 802.11 spec says at most 2007 stations may be
+ * associated at once.  For most APs this is way more
+ * than is feasible so we use a default of 128.  This
+ * number may be overridden by the driver and/or by
+ * user configuration.
+ */
+#define	IEEE80211_AID_MAX		2007
+#define	IEEE80211_AID_DEF		128
+
+#define	IEEE80211_AID(b)	((b) &~ 0xc000)
+
+/* 
+ * RTS frame length parameters.  The default is specified in
+ * the 802.11 spec.  The max may be wrong for jumbo frames.
+ */
+#define	IEEE80211_RTS_DEFAULT		512
+#define	IEEE80211_RTS_MIN		1
+#define	IEEE80211_RTS_MAX		2346
+
+/* 
+ * Regulatory extension identifier for country IE.
+ */
+#define IEEE80211_REG_EXT_ID		201
+
+/*
+ * IEEE 802.11 timer synchronization function (TSF) timestamp length
+ */
+#define IEEE80211_TSF_LEN		8
+
+#endif /* _NET80211_IEEE80211_H_ */
diff --git a/package/hostapd/madwifi/net80211/ieee80211_crypto.h b/package/hostapd/madwifi/net80211/ieee80211_crypto.h
new file mode 100644
index 0000000000..b34f359d0e
--- /dev/null
+++ b/package/hostapd/madwifi/net80211/ieee80211_crypto.h
@@ -0,0 +1,207 @@
+/*-
+ * Copyright (c) 2001 Atsushi Onoe
+ * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $Id: ieee80211_crypto.h 3068 2007-12-21 17:46:02Z mentor $
+ */
+#ifndef _NET80211_IEEE80211_CRYPTO_H_
+#define _NET80211_IEEE80211_CRYPTO_H_
+
+/*
+ * 802.11 protocol crypto-related definitions.
+ */
+#define	IEEE80211_KEYBUF_SIZE	16
+#define	IEEE80211_MICBUF_SIZE	(8 + 8)		/* space for both TX & RX keys */
+#define IEEE80211_TID_SIZE	17		/* total number of TIDs */
+
+/*
+ * Old WEP-style key.  Deprecated.
+ */
+struct ieee80211_wepkey {
+	u_int wk_len;				/* key length in bytes */
+	u_int8_t wk_key[IEEE80211_KEYBUF_SIZE];
+};
+
+struct ieee80211_cipher;
+
+/*
+ * Crypto key state.  There is sufficient room for all supported
+ * ciphers (see below).  The underlying ciphers are handled
+ * separately through loadable cipher modules that register with
+ * the generic crypto support.  A key has a reference to an instance
+ * of the cipher; any per-key state is hung off wk_private by the
+ * cipher when it is attached.  Ciphers are automatically called
+ * to detach and cleanup any such state when the key is deleted.
+ *
+ * The generic crypto support handles encap/decap of cipher-related
+ * frame contents for both hardware- and software-based implementations.
+ * A key requiring software crypto support is automatically flagged and
+ * the cipher is expected to honor this and do the necessary work.
+ * Ciphers such as TKIP may also support mixed hardware/software
+ * encrypt/decrypt and MIC processing.
+ */
+
+typedef u_int16_t ieee80211_keyix_t;
+
+/* XXX pack better? */
+/* XXX 48-bit rsc/tsc */
+struct ieee80211_key {
+	u_int8_t wk_keylen;		/* key length in bytes */
+	u_int8_t wk_flags;
+#define	IEEE80211_KEY_XMIT	0x01	/* key used for xmit */
+#define	IEEE80211_KEY_RECV	0x02	/* key used for recv */
+#define	IEEE80211_KEY_GROUP	0x04	/* key used for WPA group operation */
+#define	IEEE80211_KEY_SWCRYPT	0x10	/* host-based encrypt/decrypt */
+#define	IEEE80211_KEY_SWMIC	0x20	/* host-based enmic/demic */
+	ieee80211_keyix_t wk_keyix;	/* key index */
+	u_int8_t wk_key[IEEE80211_KEYBUF_SIZE+IEEE80211_MICBUF_SIZE];
+#define	wk_txmic	wk_key+IEEE80211_KEYBUF_SIZE+0	/* XXX can't () right */
+#define	wk_rxmic	wk_key+IEEE80211_KEYBUF_SIZE+8	/* XXX can't () right */
+	u_int64_t wk_keyrsc[IEEE80211_TID_SIZE];	/* key receive sequence counter */
+	u_int64_t wk_keytsc;		/* key transmit sequence counter */
+	const struct ieee80211_cipher *wk_cipher;
+	void *wk_private;		/* private cipher state */
+};
+#define	IEEE80211_KEY_COMMON 		/* common flags passed in by apps */\
+	(IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV | IEEE80211_KEY_GROUP)
+
+/*
+ * NB: these values are ordered carefully; there are lots of
+ * of implications in any reordering.  In particular beware
+ * that 4 is not used to avoid conflicting with IEEE80211_F_PRIVACY.
+ */
+#define	IEEE80211_CIPHER_WEP		0
+#define	IEEE80211_CIPHER_TKIP		1
+#define	IEEE80211_CIPHER_AES_OCB	2
+#define	IEEE80211_CIPHER_AES_CCM	3
+#define	IEEE80211_CIPHER_CKIP		5
+#define	IEEE80211_CIPHER_NONE		6	/* pseudo value */
+
+#define	IEEE80211_CIPHER_MAX		(IEEE80211_CIPHER_NONE + 1)
+
+#define	IEEE80211_KEYIX_NONE	((ieee80211_keyix_t)-1)
+
+#if defined(__KERNEL__) || defined(_KERNEL)
+
+struct ieee80211com;
+struct ieee80211vap;
+struct ieee80211_node;
+struct sk_buff;
+
+void ieee80211_crypto_attach(struct ieee80211com *);
+void ieee80211_crypto_detach(struct ieee80211com *);
+void ieee80211_crypto_vattach(struct ieee80211vap *);
+void ieee80211_crypto_vdetach(struct ieee80211vap *);
+int ieee80211_crypto_newkey(struct ieee80211vap *, int, int,
+	struct ieee80211_key *);
+int ieee80211_crypto_delkey(struct ieee80211vap *, struct ieee80211_key *,
+	struct ieee80211_node *);
+int ieee80211_crypto_setkey(struct ieee80211vap *, struct ieee80211_key *,
+	const u_int8_t macaddr[IEEE80211_ADDR_LEN], struct ieee80211_node *);
+void ieee80211_crypto_delglobalkeys(struct ieee80211vap *);
+
+/*
+ * Template for a supported cipher.  Ciphers register with the
+ * crypto code and are typically loaded as separate modules
+ * (the null cipher is always present).
+ * XXX may need refcnts
+ */
+struct ieee80211_cipher {
+	const char *ic_name;		/* printable name */
+	u_int ic_cipher;		/* IEEE80211_CIPHER_* */
+	u_int ic_header;		/* size of privacy header (bytes) */
+	u_int ic_trailer;		/* size of privacy trailer (bytes) */
+	u_int ic_miclen;		/* size of mic trailer (bytes) */
+	void *(*ic_attach)(struct ieee80211vap *, struct ieee80211_key *);
+	void (*ic_detach)(struct ieee80211_key *);
+	int (*ic_setkey)(struct ieee80211_key *);
+	int (*ic_encap)(struct ieee80211_key *, struct sk_buff *, u_int8_t);
+	int (*ic_decap)(struct ieee80211_key *, struct sk_buff *, int);
+	int (*ic_enmic)(struct ieee80211_key *, struct sk_buff *, int);
+	int (*ic_demic)(struct ieee80211_key *, struct sk_buff *, int, int);
+};
+extern const struct ieee80211_cipher ieee80211_cipher_none;
+
+void ieee80211_crypto_register(const struct ieee80211_cipher *);
+void ieee80211_crypto_unregister(const struct ieee80211_cipher *);
+int ieee80211_crypto_available(struct ieee80211vap*, u_int);
+
+struct ieee80211_key *ieee80211_crypto_encap(struct ieee80211_node *,
+	struct sk_buff *);
+struct ieee80211_key *ieee80211_crypto_decap(struct ieee80211_node *,
+	struct sk_buff *, int);
+
+/*
+ * Check and remove any MIC.
+ */
+static __inline int
+ieee80211_crypto_demic(struct ieee80211vap *vap, struct ieee80211_key *k,
+	struct sk_buff *skb, int hdrlen, int force)
+{
+	const struct ieee80211_cipher *cip = k->wk_cipher;
+	return (cip->ic_miclen > 0 ? cip->ic_demic(k, skb, hdrlen, force) : 1);
+}
+
+/*
+ * Add any MIC.
+ */
+static __inline int
+ieee80211_crypto_enmic(struct ieee80211vap *vap, struct ieee80211_key *k,
+	struct sk_buff *skb, int force)
+{
+	const struct ieee80211_cipher *cip = k->wk_cipher;
+	return (cip->ic_miclen > 0 ? cip->ic_enmic(k, skb, force) : 1);
+}
+
+/* 
+ * Reset key state to an unused state.  The crypto
+ * key allocation mechanism ensures other state (e.g.
+ * key data) is properly setup before a key is used.
+ */
+static __inline void
+ieee80211_crypto_resetkey(struct ieee80211vap *vap, struct ieee80211_key *k,
+	ieee80211_keyix_t ix)
+{
+	k->wk_cipher = &ieee80211_cipher_none;;
+	k->wk_private = k->wk_cipher->ic_attach(vap, k);
+	k->wk_keyix = ix;
+	k->wk_flags = IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV;
+}
+
+/*
+ * Crypto-related notification methods.
+ */
+void ieee80211_notify_replay_failure(struct ieee80211vap *,
+	const struct ieee80211_frame *, const struct ieee80211_key *,
+	u_int64_t rsc);
+void ieee80211_notify_michael_failure(struct ieee80211vap *,
+	const struct ieee80211_frame *, ieee80211_keyix_t keyix);
+#endif /* defined(__KERNEL__) || defined(_KERNEL) */
+#endif /* _NET80211_IEEE80211_CRYPTO_H_ */
diff --git a/package/hostapd/madwifi/net80211/ieee80211_ioctl.h b/package/hostapd/madwifi/net80211/ieee80211_ioctl.h
new file mode 100644
index 0000000000..204303b6ee
--- /dev/null
+++ b/package/hostapd/madwifi/net80211/ieee80211_ioctl.h
@@ -0,0 +1,715 @@
+/*-
+ * Copyright (c) 2001 Atsushi Onoe
+ * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $Id: ieee80211_ioctl.h 3314 2008-01-30 23:50:16Z mtaylor $
+ */
+#ifndef _NET80211_IEEE80211_IOCTL_H_
+#define _NET80211_IEEE80211_IOCTL_H_
+
+/*
+ * IEEE 802.11 ioctls.
+ */
+#include <net80211/_ieee80211.h>
+#include <net80211/ieee80211.h>
+#include <net80211/ieee80211_crypto.h>
+
+/*
+ * Per/node (station) statistics available when operating as an AP.
+ */
+struct ieee80211_nodestats {
+	u_int32_t ns_rx_data;		/* rx data frames */
+	u_int32_t ns_rx_mgmt;		/* rx management frames */
+	u_int32_t ns_rx_ctrl;		/* rx control frames */
+	u_int32_t ns_rx_ucast;		/* rx unicast frames */
+	u_int32_t ns_rx_mcast;		/* rx multi/broadcast frames */
+	u_int64_t ns_rx_bytes;		/* rx data count (bytes) */
+	u_int64_t ns_rx_beacons;		/* rx beacon frames */
+	u_int32_t ns_rx_proberesp;	/* rx probe response frames */
+
+	u_int32_t ns_rx_dup;		/* rx discard because it's a dup */
+	u_int32_t ns_rx_noprivacy;	/* rx w/ wep but privacy off */
+	u_int32_t ns_rx_wepfail;		/* rx wep processing failed */
+	u_int32_t ns_rx_demicfail;	/* rx demic failed */
+	u_int32_t ns_rx_decap;		/* rx decapsulation failed */
+	u_int32_t ns_rx_defrag;		/* rx defragmentation failed */
+	u_int32_t ns_rx_disassoc;	/* rx disassociation */
+	u_int32_t ns_rx_deauth;		/* rx deauthentication */
+	u_int32_t ns_rx_decryptcrc;	/* rx decrypt failed on crc */
+	u_int32_t ns_rx_unauth;		/* rx on unauthorized port */
+	u_int32_t ns_rx_unencrypted;	/* rx unecrypted w/ privacy */
+
+	u_int32_t ns_tx_data;		/* tx data frames */
+	u_int32_t ns_tx_mgmt;		/* tx management frames */
+	u_int32_t ns_tx_ucast;		/* tx unicast frames */
+	u_int32_t ns_tx_mcast;		/* tx multi/broadcast frames */
+	u_int64_t ns_tx_bytes;		/* tx data count (bytes) */
+	u_int32_t ns_tx_probereq;	/* tx probe request frames */
+	u_int32_t ns_tx_uapsd;		/* tx on uapsd queue */
+
+	u_int32_t ns_tx_novlantag;	/* tx discard due to no tag */
+	u_int32_t ns_tx_vlanmismatch;	/* tx discard due to of bad tag */
+
+	u_int32_t ns_tx_eosplost;	/* uapsd EOSP retried out */
+
+	u_int32_t ns_ps_discard;		/* ps discard due to of age */
+
+	u_int32_t ns_uapsd_triggers;	/* uapsd triggers */
+
+	/* MIB-related state */
+	u_int32_t ns_tx_assoc;		/* [re]associations */
+	u_int32_t ns_tx_assoc_fail;	/* [re]association failures */
+	u_int32_t ns_tx_auth;		/* [re]authentications */
+	u_int32_t ns_tx_auth_fail;	/* [re]authentication failures*/
+	u_int32_t ns_tx_deauth;		/* deauthentications */
+	u_int32_t ns_tx_deauth_code;	/* last deauth reason */
+	u_int32_t ns_tx_disassoc;	/* disassociations */
+	u_int32_t ns_tx_disassoc_code;	/* last disassociation reason */
+	u_int32_t ns_psq_drops;		/* power save queue drops */
+};
+
+/*
+ * Summary statistics.
+ */
+struct ieee80211_stats {
+	u_int32_t is_rx_badversion;	/* rx frame with bad version */
+	u_int32_t is_rx_tooshort;	/* rx frame too short */
+	u_int32_t is_rx_wrongbss;	/* rx from wrong bssid */
+	u_int32_t is_rx_dup;		/* rx discard due to it's a dup */
+	u_int32_t is_rx_wrongdir;	/* rx w/ wrong direction */
+	u_int32_t is_rx_mcastecho;	/* rx discard due to of mcast echo */
+	u_int32_t is_rx_mcastdisabled;	/* rx discard due to of mcast disabled */
+	u_int32_t is_rx_notassoc;	/* rx discard due to sta !assoc */
+	u_int32_t is_rx_noprivacy;	/* rx w/ wep but privacy off */
+	u_int32_t is_rx_unencrypted;	/* rx w/o wep and privacy on */
+	u_int32_t is_rx_wepfail;		/* rx wep processing failed */
+	u_int32_t is_rx_decap;		/* rx decapsulation failed */
+	u_int32_t is_rx_mgtdiscard;	/* rx discard mgt frames */
+	u_int32_t is_rx_ctl;		/* rx discard ctrl frames */
+	u_int32_t is_rx_beacon;		/* rx beacon frames */
+	u_int32_t is_rx_rstoobig;	/* rx rate set truncated */
+	u_int32_t is_rx_elem_missing;	/* rx required element missing*/
+	u_int32_t is_rx_elem_toobig;	/* rx element too big */
+	u_int32_t is_rx_elem_toosmall;	/* rx element too small */
+	u_int32_t is_rx_elem_unknown;	/* rx element unknown */
+	u_int32_t is_rx_badchan;		/* rx frame w/ invalid chan */
+	u_int32_t is_rx_chanmismatch;	/* rx frame chan mismatch */
+	u_int32_t is_rx_nodealloc;	/* rx frame dropped */
+	u_int32_t is_rx_ssidmismatch;	/* rx frame ssid mismatch  */
+	u_int32_t is_rx_auth_unsupported;/* rx w/ unsupported auth alg */
+	u_int32_t is_rx_auth_fail;	/* rx sta auth failure */
+	u_int32_t is_rx_auth_countermeasures;/* rx auth discard due to CM */
+	u_int32_t is_rx_assoc_bss;	/* rx assoc from wrong bssid */
+	u_int32_t is_rx_assoc_notauth;	/* rx assoc w/o auth */
+	u_int32_t is_rx_assoc_capmismatch;/* rx assoc w/ cap mismatch */
+	u_int32_t is_rx_assoc_norate;	/* rx assoc w/ no rate match */
+	u_int32_t is_rx_assoc_badwpaie;	/* rx assoc w/ bad WPA IE */
+	u_int32_t is_rx_assoc_badscie;	/* rx assoc w/ bad SC IE */
+	u_int32_t is_rx_deauth;		/* rx deauthentication */
+	u_int32_t is_rx_disassoc;	/* rx disassociation */
+	u_int32_t is_rx_badsubtype;	/* rx frame w/ unknown subtype*/
+	u_int32_t is_rx_nobuf;		/* rx failed for lack of buf */
+	u_int32_t is_rx_decryptcrc;	/* rx decrypt failed on crc */
+	u_int32_t is_rx_ahdemo_mgt;	/* rx discard ahdemo mgt frame*/
+	u_int32_t is_rx_bad_auth;	/* rx bad auth request */
+	u_int32_t is_rx_unauth;		/* rx on unauthorized port */
+	u_int32_t is_rx_badkeyid;	/* rx w/ incorrect keyid */
+	u_int32_t is_rx_ccmpreplay;	/* rx seq# violation (CCMP) */
+	u_int32_t is_rx_ccmpformat;	/* rx format bad (CCMP) */
+	u_int32_t is_rx_ccmpmic;		/* rx MIC check failed (CCMP) */
+	u_int32_t is_rx_tkipreplay;	/* rx seq# violation (TKIP) */
+	u_int32_t is_rx_tkipformat;	/* rx format bad (TKIP) */
+	u_int32_t is_rx_tkipmic;		/* rx MIC check failed (TKIP) */
+	u_int32_t is_rx_tkipicv;		/* rx ICV check failed (TKIP) */
+	u_int32_t is_rx_badcipher;	/* rx failed due to of key type */
+	u_int32_t is_rx_nocipherctx;	/* rx failed due to key !setup */
+	u_int32_t is_rx_acl;		/* rx discard due to of acl policy */
+	u_int32_t is_rx_ffcnt;		/* rx fast frames */
+	u_int32_t is_rx_badathtnl;   	/* driver key alloc failed */
+	u_int32_t is_tx_nobuf;		/* tx failed for lack of buf */
+	u_int32_t is_tx_nonode;		/* tx failed for no node */
+	u_int32_t is_tx_unknownmgt;	/* tx of unknown mgt frame */
+	u_int32_t is_tx_badcipher;	/* tx failed due to of key type */
+	u_int32_t is_tx_nodefkey;	/* tx failed due to no defkey */
+	u_int32_t is_tx_noheadroom;	/* tx failed due to no space */
+	u_int32_t is_tx_ffokcnt;		/* tx fast frames sent success */
+	u_int32_t is_tx_fferrcnt;	/* tx fast frames sent success */
+	u_int32_t is_scan_active;	/* active scans started */
+	u_int32_t is_scan_passive;	/* passive scans started */
+	u_int32_t is_node_timeout;	/* nodes timed out inactivity */
+	u_int32_t is_node_fdisassoc;	/* forced node disassociation */
+	u_int32_t is_crypto_nomem;	/* no memory for crypto ctx */
+	u_int32_t is_crypto_tkip;	/* tkip crypto done in s/w */
+	u_int32_t is_crypto_tkipenmic;	/* tkip en-MIC done in s/w */
+	u_int32_t is_crypto_tkipdemic;	/* tkip de-MIC done in s/w */
+	u_int32_t is_crypto_tkipcm;	/* tkip counter measures */
+	u_int32_t is_crypto_ccmp;	/* ccmp crypto done in s/w */
+	u_int32_t is_crypto_wep;		/* wep crypto done in s/w */
+	u_int32_t is_crypto_setkey_cipher;/* cipher rejected key */
+	u_int32_t is_crypto_setkey_nokey;/* no key index for setkey */
+	u_int32_t is_crypto_delkey;	/* driver key delete failed */
+	u_int32_t is_crypto_badcipher;	/* unknown cipher */
+	u_int32_t is_crypto_nocipher;	/* cipher not available */
+	u_int32_t is_crypto_attachfail;	/* cipher attach failed */
+	u_int32_t is_crypto_swfallback;	/* cipher fallback to s/w */
+	u_int32_t is_crypto_keyfail;	/* driver key alloc failed */
+	u_int32_t is_crypto_enmicfail;	/* en-MIC failed */
+	u_int32_t is_ibss_capmismatch;	/* merge failed-cap mismatch */
+	u_int32_t is_ibss_norate;	/* merge failed-rate mismatch */
+	u_int32_t is_ps_unassoc;		/* ps-poll for unassoc. sta */
+	u_int32_t is_ps_badaid;		/* ps-poll w/ incorrect aid */
+	u_int32_t is_ps_qempty;		/* ps-poll w/ nothing to send */
+};
+
+/*
+ * Max size of optional information elements.  We artificially
+ * constrain this; it's limited only by the max frame size (and
+ * the max parameter size of the wireless extensions).
+ */
+#define	IEEE80211_MAX_OPT_IE	256
+
+/*
+ * WPA/RSN get/set key request.  Specify the key/cipher
+ * type and whether the key is to be used for sending and/or
+ * receiving.  The key index should be set only when working
+ * with global keys (use IEEE80211_KEYIX_NONE for ``no index'').
+ * Otherwise a unicast/pairwise key is specified by the bssid
+ * (on a station) or mac address (on an ap).  They key length
+ * must include any MIC key data; otherwise it should be no
+ more than IEEE80211_KEYBUF_SIZE.
+ */
+struct ieee80211req_key {
+	u_int8_t ik_type;		/* key/cipher type */
+	u_int8_t ik_pad;
+	ieee80211_keyix_t ik_keyix;	/* key index */
+	u_int8_t ik_keylen;		/* key length in bytes */
+	u_int8_t ik_flags;
+/* NB: IEEE80211_KEY_XMIT and IEEE80211_KEY_RECV defined elsewhere */
+#define	IEEE80211_KEY_DEFAULT	0x80	/* default xmit key */
+	u_int8_t ik_macaddr[IEEE80211_ADDR_LEN];
+	u_int64_t ik_keyrsc;		/* key receive sequence counter */
+	u_int64_t ik_keytsc;		/* key transmit sequence counter */
+	u_int8_t ik_keydata[IEEE80211_KEYBUF_SIZE+IEEE80211_MICBUF_SIZE];
+};
+
+/*
+ * Delete a key either by index or address.  Set the index
+ * to IEEE80211_KEYIX_NONE when deleting a unicast key.
+ */
+struct ieee80211req_del_key {
+	/* NB: This is different to ieee80211_keyix_t, but this is OK as 
+	 * values are unique over the low order bits. */
+	u_int8_t idk_keyix;	/* key index */
+	u_int8_t idk_macaddr[IEEE80211_ADDR_LEN];
+};
+
+/*
+ * MLME state manipulation request.  IEEE80211_MLME_ASSOC
+ * only makes sense when operating as a station.  The other
+ * requests can be used when operating as a station or an
+ * ap (to effect a station).
+ */
+struct ieee80211req_mlme {
+	u_int8_t im_op;			/* operation to perform */
+#define	IEEE80211_MLME_ASSOC		1	/* associate station */
+#define	IEEE80211_MLME_DISASSOC		2	/* disassociate station */
+#define	IEEE80211_MLME_DEAUTH		3	/* deauthenticate station */
+#define	IEEE80211_MLME_AUTHORIZE	4	/* authorize station */
+#define	IEEE80211_MLME_UNAUTHORIZE	5	/* unauthorize station */
+#define IEEE80211_MLME_CLEAR_STATS	6	/* clear station statistic */
+	u_int8_t im_ssid_len;		/* length of optional ssid */
+	u_int16_t im_reason;		/* 802.11 reason code */
+	u_int8_t im_macaddr[IEEE80211_ADDR_LEN];
+	u_int8_t im_ssid[IEEE80211_NWID_LEN];
+};
+
+/* 
+ * MAC ACL operations.
+ */
+enum {
+	IEEE80211_MACCMD_POLICY_OPEN	= 0,	/* set policy: no ACLs */
+	IEEE80211_MACCMD_POLICY_ALLOW	= 1,	/* set policy: allow traffic */
+	IEEE80211_MACCMD_POLICY_DENY	= 2,	/* set policy: deny traffic */
+	IEEE80211_MACCMD_FLUSH		= 3,	/* flush ACL database */
+	IEEE80211_MACCMD_DETACH		= 4,	/* detach ACL policy */
+};
+
+/*
+ * Set the active channel list.  Note this list is
+ * intersected with the available channel list in
+ * calculating the set of channels actually used in
+ * scanning.
+ */
+struct ieee80211req_chanlist {
+	u_int8_t ic_channels[IEEE80211_CHAN_BYTES];
+};
+
+/*
+ * Get the active channel list info.
+ */
+struct ieee80211req_chaninfo {
+	u_int ic_nchans;
+	struct ieee80211_channel ic_chans[IEEE80211_CHAN_MAX];
+};
+
+/*
+ * Retrieve the WPA/RSN information element for an associated station.
+ */
+struct ieee80211req_wpaie {
+	u_int8_t	wpa_macaddr[IEEE80211_ADDR_LEN];
+	u_int8_t	wpa_ie[IEEE80211_MAX_OPT_IE];
+	u_int8_t	rsn_ie[IEEE80211_MAX_OPT_IE];
+};
+
+/*
+ * Retrieve per-node statistics.
+ */
+struct ieee80211req_sta_stats {
+	union {
+		/* NB: explicitly force 64-bit alignment */
+		u_int8_t macaddr[IEEE80211_ADDR_LEN];
+		u_int64_t pad;
+	} is_u;
+	struct ieee80211_nodestats is_stats;
+};
+
+/*
+ * Station information block; the mac address is used
+ * to retrieve other data like stats, unicast key, etc.
+ */
+struct ieee80211req_sta_info {
+	u_int16_t isi_len;		/* length (mult of 4) */
+	u_int16_t isi_freq;		/* MHz */
+	u_int16_t isi_flags;		/* channel flags */
+	u_int16_t isi_state;		/* state flags */
+	u_int8_t isi_authmode;		/* authentication algorithm */
+	u_int8_t isi_rssi;
+	int8_t isi_noise;
+	u_int16_t isi_capinfo;		/* capabilities */
+	u_int8_t isi_athflags;		/* Atheros capabilities */
+	u_int8_t isi_erp;		/* ERP element */
+	u_int8_t isi_macaddr[IEEE80211_ADDR_LEN];
+	u_int8_t isi_nrates;		/* negotiated rates */
+	u_int8_t isi_rates[IEEE80211_RATE_MAXSIZE];
+	u_int8_t isi_txrate;		/* index to isi_rates[] */
+	u_int16_t isi_ie_len;		/* IE length */
+	u_int16_t isi_associd;		/* assoc response */
+	u_int16_t isi_txpower;		/* current tx power */
+	u_int16_t isi_vlan;		/* vlan tag */
+	u_int16_t isi_txseqs[17];	/* seq to be transmitted */
+	u_int16_t isi_rxseqs[17];	/* seq previous for qos frames*/
+	u_int16_t isi_inact;		/* inactivity timer */
+	u_int8_t isi_uapsd;		/* UAPSD queues */
+	u_int8_t isi_opmode;		/* sta operating mode */
+
+	/* XXX frag state? */
+	/* variable length IE data */
+};
+
+enum {
+	IEEE80211_STA_OPMODE_NORMAL,
+	IEEE80211_STA_OPMODE_XR
+};
+
+/*
+ * Retrieve per-station information; to retrieve all
+ * specify a mac address of ff:ff:ff:ff:ff:ff.
+ */
+struct ieee80211req_sta_req {
+	union {
+		/* NB: explicitly force 64-bit alignment */
+		u_int8_t macaddr[IEEE80211_ADDR_LEN];
+		u_int64_t pad;
+	} is_u;
+	struct ieee80211req_sta_info info[1];	/* variable length */
+};
+
+/*
+ * Get/set per-station tx power cap.
+ */
+struct ieee80211req_sta_txpow {
+	u_int8_t	it_macaddr[IEEE80211_ADDR_LEN];
+	u_int8_t	it_txpow;
+};
+
+/*
+ * WME parameters are set and return using i_val and i_len.
+ * i_val holds the value itself.  i_len specifies the AC
+ * and, as appropriate, then high bit specifies whether the
+ * operation is to be applied to the BSS or ourself.
+ */
+#define	IEEE80211_WMEPARAM_SELF	0x0000		/* parameter applies to self */
+#define	IEEE80211_WMEPARAM_BSS	0x8000		/* parameter applies to BSS */
+#define	IEEE80211_WMEPARAM_VAL	0x7fff		/* parameter value */
+
+/*
+ * Scan result data returned for IEEE80211_IOC_SCAN_RESULTS.
+ */
+struct ieee80211req_scan_result {
+	u_int16_t isr_len;		/* length (mult of 4) */
+	u_int16_t isr_freq;		/* MHz */
+	u_int16_t isr_flags;		/* channel flags */
+	u_int8_t isr_noise;
+	u_int8_t isr_rssi;
+	u_int8_t isr_intval;		/* beacon interval */
+	u_int16_t isr_capinfo;		/* capabilities */
+	u_int8_t isr_erp;		/* ERP element */
+	u_int8_t isr_bssid[IEEE80211_ADDR_LEN];
+	u_int8_t isr_nrates;
+	u_int8_t isr_rates[IEEE80211_RATE_MAXSIZE];
+	u_int8_t isr_ssid_len;		/* SSID length */
+	u_int8_t isr_ie_len;		/* IE length */
+	u_int8_t isr_pad[5];
+	/* variable length SSID followed by IE data */
+};
+
+#ifdef __FreeBSD__
+/*
+ * FreeBSD-style ioctls.
+ */
+/* the first member must be matched with struct ifreq */
+struct ieee80211req {
+	char i_name[IFNAMSIZ];	/* if_name, e.g. "wi0" */
+	u_int16_t i_type;	/* req type */
+	int16_t 	i_val;		/* Index or simple value */
+	int16_t 	i_len;		/* Index or simple value */
+	void *i_data;		/* Extra data */
+};
+#define	SIOCS80211		 _IOW('i', 234, struct ieee80211req)
+#define	SIOCG80211		_IOWR('i', 235, struct ieee80211req)
+#define	SIOCG80211STATS		_IOWR('i', 236, struct ifreq)
+#define	SIOC80211IFCREATE	_IOWR('i', 237, struct ifreq)
+#define	SIOC80211IFDESTROY	 _IOW('i', 238, struct ifreq)
+
+#define IEEE80211_IOC_SSID		1
+#define IEEE80211_IOC_NUMSSIDS		2
+#define IEEE80211_IOC_WEP		3
+#define 	IEEE80211_WEP_NOSUP		-1
+#define 	IEEE80211_WEP_OFF		0
+#define 	IEEE80211_WEP_ON		1
+#define 	IEEE80211_WEP_MIXED		2
+#define IEEE80211_IOC_WEPKEY		4
+#define IEEE80211_IOC_NUMWEPKEYS	5
+#define IEEE80211_IOC_WEPTXKEY		6
+#define IEEE80211_IOC_AUTHMODE		7
+#define IEEE80211_IOC_STATIONNAME	8
+#define IEEE80211_IOC_CHANNEL		9
+#define IEEE80211_IOC_POWERSAVE		10
+#define 	IEEE80211_POWERSAVE_NOSUP	-1
+#define 	IEEE80211_POWERSAVE_OFF		0
+#define 	IEEE80211_POWERSAVE_CAM		1
+#define 	IEEE80211_POWERSAVE_PSP		2
+#define 	IEEE80211_POWERSAVE_PSP_CAM	3
+#define 	IEEE80211_POWERSAVE_ON		IEEE80211_POWERSAVE_CAM
+#define IEEE80211_IOC_POWERSAVESLEEP	11
+#define	IEEE80211_IOC_RTSTHRESHOLD	12
+#define IEEE80211_IOC_PROTMODE		13
+#define 	IEEE80211_PROTMODE_OFF		0
+#define 	IEEE80211_PROTMODE_CTS		1
+#define 	IEEE80211_PROTMODE_RTSCTS	2
+#define	IEEE80211_IOC_TXPOWER		14	/* global tx power limit */
+#define	IEEE80211_IOC_BSSID		15
+#define	IEEE80211_IOC_ROAMING		16	/* roaming mode */
+#define	IEEE80211_IOC_PRIVACY		17	/* privacy invoked */
+#define	IEEE80211_IOC_DROPUNENCRYPTED	18	/* discard unencrypted frames */
+#define	IEEE80211_IOC_WPAKEY		19
+#define	IEEE80211_IOC_DELKEY		20
+#define	IEEE80211_IOC_MLME		21
+#define	IEEE80211_IOC_OPTIE		22	/* optional info. element */
+#define	IEEE80211_IOC_SCAN_REQ		23
+#define	IEEE80211_IOC_SCAN_RESULTS	24
+#define	IEEE80211_IOC_COUNTERMEASURES	25	/* WPA/TKIP countermeasures */
+#define	IEEE80211_IOC_WPA		26	/* WPA mode (0,1,2) */
+#define	IEEE80211_IOC_CHANLIST		27	/* channel list */
+#define	IEEE80211_IOC_WME		28	/* WME mode (on, off) */
+#define	IEEE80211_IOC_HIDESSID		29	/* hide SSID mode (on, off) */
+#define IEEE80211_IOC_APBRIDGE		30	/* AP inter-sta bridging */
+#define	IEEE80211_IOC_MCASTCIPHER	31	/* multicast/default cipher */
+#define	IEEE80211_IOC_MCASTKEYLEN	32	/* multicast key length */
+#define	IEEE80211_IOC_UCASTCIPHERS	33	/* unicast cipher suites */
+#define	IEEE80211_IOC_UCASTCIPHER	34	/* unicast cipher */
+#define	IEEE80211_IOC_UCASTKEYLEN	35	/* unicast key length */
+#define	IEEE80211_IOC_DRIVER_CAPS	36	/* driver capabilities */
+#define	IEEE80211_IOC_KEYMGTALGS	37	/* key management algorithms */
+#define	IEEE80211_IOC_RSNCAPS		38	/* RSN capabilities */
+#define	IEEE80211_IOC_WPAIE		39	/* WPA information element */
+#define	IEEE80211_IOC_STA_STATS		40	/* per-station statistics */
+#define	IEEE80211_IOC_MACCMD		41	/* MAC ACL operation */
+#define	IEEE80211_IOC_TXPOWMAX		43	/* max tx power for channel */
+#define	IEEE80211_IOC_STA_TXPOW		44	/* per-station tx power limit */
+#define	IEEE80211_IOC_STA_INFO		45	/* station/neighbor info */
+#define	IEEE80211_IOC_WME_CWMIN		46	/* WME: ECWmin */
+#define	IEEE80211_IOC_WME_CWMAX		47	/* WME: ECWmax */
+#define	IEEE80211_IOC_WME_AIFS		48	/* WME: AIFSN */
+#define	IEEE80211_IOC_WME_TXOPLIMIT	49	/* WME: txops limit */
+#define	IEEE80211_IOC_WME_ACM		50	/* WME: ACM (bss only) */
+#define	IEEE80211_IOC_WME_ACKPOLICY	51	/* WME: ACK policy (!bss only)*/
+#define	IEEE80211_IOC_DTIM_PERIOD	52	/* DTIM period (beacons) */
+#define	IEEE80211_IOC_BEACON_INTERVAL	53	/* beacon interval (ms) */
+#define	IEEE80211_IOC_ADDMAC		54	/* add sta to MAC ACL table */
+#define	IEEE80211_IOC_SETMAC		55	/* set interface wds mac addr */
+#define	IEEE80211_IOC_FF		56	/* ATH fast frames (on, off) */
+#define	IEEE80211_IOC_TURBOP		57	/* ATH turbo' (on, off) */
+#define	IEEE80211_IOC_APPIEBUF		58	/* IE in the management frame */
+#define	IEEE80211_IOC_FILTERFRAME	59	/* management frame filter */
+
+/*
+ * Scan result data returned for IEEE80211_IOC_SCAN_RESULTS.
+ */
+struct ieee80211req_scan_result {
+	u_int16_t isr_len;		/* length (mult of 4) */
+	u_int16_t isr_freq;		/* MHz */
+	u_int16_t isr_flags;		/* channel flags */
+	u_int8_t isr_noise;
+	u_int8_t isr_rssi;
+	u_int8_t isr_intval;		/* beacon interval */
+	u_int16_t isr_capinfo;		/* capabilities */
+	u_int8_t isr_erp;		/* ERP element */
+	u_int8_t isr_bssid[IEEE80211_ADDR_LEN];
+	u_int8_t isr_nrates;
+	u_int8_t isr_rates[IEEE80211_RATE_MAXSIZE];
+	u_int8_t isr_ssid_len;		/* SSID length */
+	u_int8_t isr_ie_len;		/* IE length */
+	u_int8_t isr_pad[5];
+	/* variable length SSID followed by IE data */
+};
+
+#endif /* __FreeBSD__ */
+
+#ifdef __linux__
+/*
+ * Wireless Extensions API, private ioctl interfaces.
+ *
+ * NB: Even-numbered ioctl numbers have set semantics and are privileged!
+ *     (regardless of the incorrect comment in wireless.h!)
+ */
+#ifdef __KERNEL__
+#include <linux/if.h>
+#endif
+/* The maximum size of a iwpriv structure is IW_PRIV_SIZE_MASK, which was 
+ * exceeded for some time by chaninfo ioctl.  These macros change the size 
+ * encoding for anything larger than IW_PRIV_SIZE_MASK from bytes to 4-byte
+ * multiples so that the padded size fits under IW_PRIV_SIZE_MASK. */
+#define IW_PRIV_BLOB_LENGTH_ENCODING(_SIZE) \
+	(((_SIZE) == ((_SIZE) & IW_PRIV_SIZE_MASK)) ? \
+		(_SIZE) : \
+		(((_SIZE) / sizeof(uint32_t)) + \
+			(((_SIZE) == (((_SIZE) / sizeof(uint32_t)) * sizeof(int))) ? \
+				0 : 1)))
+#define IW_PRIV_BLOB_TYPE_ENCODING(_SIZE) \
+	(((_SIZE) == ((_SIZE) & IW_PRIV_SIZE_MASK)) ? \
+		(IW_PRIV_TYPE_BYTE | (_SIZE)) : \
+		(IW_PRIV_TYPE_INT  | IW_PRIV_BLOB_LENGTH_ENCODING((_SIZE))))
+
+#define	IEEE80211_IOCTL_SETPARAM	(SIOCIWFIRSTPRIV+0)
+#define	IEEE80211_IOCTL_GETPARAM	(SIOCIWFIRSTPRIV+1)
+#define	IEEE80211_IOCTL_SETMODE		(SIOCIWFIRSTPRIV+2)
+#define	IEEE80211_IOCTL_GETMODE		(SIOCIWFIRSTPRIV+3)
+#define	IEEE80211_IOCTL_SETWMMPARAMS	(SIOCIWFIRSTPRIV+4)
+#define	IEEE80211_IOCTL_GETWMMPARAMS	(SIOCIWFIRSTPRIV+5)
+#define	IEEE80211_IOCTL_SETCHANLIST	(SIOCIWFIRSTPRIV+6)
+#define	IEEE80211_IOCTL_GETCHANLIST	(SIOCIWFIRSTPRIV+7)
+#define	IEEE80211_IOCTL_CHANSWITCH	(SIOCIWFIRSTPRIV+8)
+#define	IEEE80211_IOCTL_GET_APPIEBUF	(SIOCIWFIRSTPRIV+9)
+#define	IEEE80211_IOCTL_SET_APPIEBUF	(SIOCIWFIRSTPRIV+10)
+#define	IEEE80211_IOCTL_READREG		(SIOCIWFIRSTPRIV+11)
+#define	IEEE80211_IOCTL_FILTERFRAME	(SIOCIWFIRSTPRIV+12)
+#define	IEEE80211_IOCTL_GETCHANINFO	(SIOCIWFIRSTPRIV+13)
+#define	IEEE80211_IOCTL_SETOPTIE	(SIOCIWFIRSTPRIV+14)
+#define	IEEE80211_IOCTL_GETOPTIE	(SIOCIWFIRSTPRIV+15)
+#define	IEEE80211_IOCTL_SETMLME		(SIOCIWFIRSTPRIV+16)
+#define	IEEE80211_IOCTL_RADAR		(SIOCIWFIRSTPRIV+17)
+#define	IEEE80211_IOCTL_SETKEY		(SIOCIWFIRSTPRIV+18)
+#define	IEEE80211_IOCTL_WRITEREG	(SIOCIWFIRSTPRIV+19)
+#define	IEEE80211_IOCTL_DELKEY		(SIOCIWFIRSTPRIV+20)
+#define	IEEE80211_IOCTL_HALMAP		(SIOCIWFIRSTPRIV+21)
+#define	IEEE80211_IOCTL_ADDMAC		(SIOCIWFIRSTPRIV+22)
+#define	IEEE80211_IOCTL_DELMAC		(SIOCIWFIRSTPRIV+24)
+#define	IEEE80211_IOCTL_WDSADDMAC	(SIOCIWFIRSTPRIV+25)
+#define	IEEE80211_IOCTL_WDSSETMAC	(SIOCIWFIRSTPRIV+26)
+#define	IEEE80211_IOCTL_KICKMAC		(SIOCIWFIRSTPRIV+30)
+#define	IEEE80211_IOCTL_SETSCANLIST	(SIOCIWFIRSTPRIV+31)
+
+enum {
+	IEEE80211_WMMPARAMS_CWMIN       = 1,
+	IEEE80211_WMMPARAMS_CWMAX       = 2,
+	IEEE80211_WMMPARAMS_AIFS       	= 3,
+	IEEE80211_WMMPARAMS_TXOPLIMIT	= 4,
+	IEEE80211_WMMPARAMS_ACM		= 5,
+	IEEE80211_WMMPARAMS_NOACKPOLICY	= 6,
+};
+enum {
+	IEEE80211_PARAM_TURBO			= 1,	/* turbo mode */
+	IEEE80211_PARAM_MODE			= 2,	/* phy mode (11a, 11b, etc.) */
+	IEEE80211_PARAM_AUTHMODE		= 3,	/* authentication mode */
+	IEEE80211_PARAM_PROTMODE		= 4,	/* 802.11g protection */
+	IEEE80211_PARAM_MCASTCIPHER		= 5,	/* multicast/default cipher */
+	IEEE80211_PARAM_MCASTKEYLEN		= 6,	/* multicast key length */
+	IEEE80211_PARAM_UCASTCIPHERS		= 7,	/* unicast cipher suites */
+	IEEE80211_PARAM_UCASTCIPHER		= 8,	/* unicast cipher */
+	IEEE80211_PARAM_UCASTKEYLEN		= 9,	/* unicast key length */
+	IEEE80211_PARAM_WPA			= 10,	/* WPA mode (0,1,2) */
+	IEEE80211_PARAM_ROAMING			= 12,	/* roaming mode */
+	IEEE80211_PARAM_PRIVACY			= 13,	/* privacy invoked */
+	IEEE80211_PARAM_COUNTERMEASURES		= 14,	/* WPA/TKIP countermeasures */
+	IEEE80211_PARAM_DROPUNENCRYPTED		= 15,	/* discard unencrypted frames */
+	IEEE80211_PARAM_DRIVER_CAPS		= 16,	/* driver capabilities */
+	IEEE80211_PARAM_MACCMD			= 17,	/* MAC ACL operation */
+	IEEE80211_PARAM_WMM			= 18,	/* WMM mode (on, off) */
+	IEEE80211_PARAM_HIDESSID		= 19,	/* hide SSID mode (on, off) */
+	IEEE80211_PARAM_APBRIDGE    		= 20,   /* AP inter-sta bridging */
+	IEEE80211_PARAM_KEYMGTALGS		= 21,	/* key management algorithms */
+	IEEE80211_PARAM_RSNCAPS			= 22,	/* RSN capabilities */
+	IEEE80211_PARAM_INACT			= 23,	/* station inactivity timeout */
+	IEEE80211_PARAM_INACT_AUTH		= 24,	/* station auth inact timeout */
+	IEEE80211_PARAM_INACT_INIT		= 25,	/* station init inact timeout */
+	IEEE80211_PARAM_ABOLT			= 26,	/* Atheros Adv. Capabilities */
+	IEEE80211_PARAM_INACT_TICK		= 27,	/* station inactivity timer tick (seconds) */
+	IEEE80211_PARAM_DTIM_PERIOD		= 28,	/* DTIM period (beacons) */
+	IEEE80211_PARAM_BEACON_INTERVAL		= 29,	/* beacon interval (ms) */
+	IEEE80211_PARAM_DOTH			= 30,	/* 11.h is on/off */
+	IEEE80211_PARAM_PWRTARGET		= 31,	/* Current Channel Pwr Constraint */
+	IEEE80211_PARAM_GENREASSOC		= 32,	/* Generate a reassociation request */
+	IEEE80211_PARAM_COMPRESSION		= 33,	/* compression */
+	IEEE80211_PARAM_FF			= 34,	/* fast frames support  */
+	IEEE80211_PARAM_XR			= 35,	/* XR support */
+	IEEE80211_PARAM_BURST			= 36,	/* burst mode */
+	IEEE80211_PARAM_PUREG			= 37,	/* pure 11g (no 11b stations) */
+	IEEE80211_PARAM_AR			= 38,	/* AR support */
+	IEEE80211_PARAM_WDS			= 39,	/* Enable 4 address processing */
+	IEEE80211_PARAM_BGSCAN			= 40,	/* bg scanning (on, off) */
+	IEEE80211_PARAM_BGSCAN_IDLE		= 41,	/* bg scan idle threshold */
+	IEEE80211_PARAM_BGSCAN_INTERVAL		= 42,	/* bg scan interval */
+	IEEE80211_PARAM_MCAST_RATE		= 43,	/* Multicast Tx Rate */
+	IEEE80211_PARAM_COVERAGE_CLASS		= 44,	/* coverage class */
+	IEEE80211_PARAM_COUNTRY_IE		= 45,	/* enable country IE */
+	IEEE80211_PARAM_SCANVALID		= 46,	/* scan cache valid threshold */
+	IEEE80211_PARAM_ROAM_RSSI_11A		= 47,	/* rssi threshold in 11a */
+	IEEE80211_PARAM_ROAM_RSSI_11B		= 48,	/* rssi threshold in 11b */
+	IEEE80211_PARAM_ROAM_RSSI_11G		= 49,	/* rssi threshold in 11g */
+	IEEE80211_PARAM_ROAM_RATE_11A		= 50,	/* tx rate threshold in 11a */
+	IEEE80211_PARAM_ROAM_RATE_11B		= 51,	/* tx rate threshold in 11b */
+	IEEE80211_PARAM_ROAM_RATE_11G		= 52,	/* tx rate threshold in 11g */
+	IEEE80211_PARAM_UAPSDINFO		= 53,	/* value for qos info field */
+	IEEE80211_PARAM_SLEEP			= 54,	/* force sleep/wake */
+	IEEE80211_PARAM_QOSNULL			= 55,	/* force sleep/wake */
+	IEEE80211_PARAM_PSPOLL			= 56,	/* force ps-poll generation (sta only) */
+	IEEE80211_PARAM_EOSPDROP		= 57,	/* force uapsd EOSP drop (ap only) */
+	IEEE80211_PARAM_MARKDFS			= 58,	/* mark a dfs interference channel when found */
+	IEEE80211_PARAM_REGCLASS		= 59,	/* enable regclass ids in country IE */
+	IEEE80211_PARAM_DROPUNENC_EAPOL		= 60,	/* drop unencrypted eapol frames */
+	IEEE80211_PARAM_SHPREAMBLE		= 61,	/* Short Preamble */
+	IEEE80211_PARAM_DUMPREGS		= 62,	/* Pretty printed dump of Atheros hardware registers */
+	IEEE80211_PARAM_DOTH_ALGORITHM		= 63,	/* spectrum management algorithm */
+	IEEE80211_PARAM_DOTH_MINCOM   		= 64,	/* minimum number of common channels */
+	IEEE80211_PARAM_DOTH_SLCG		= 65,	/* permil of Stations Lost per Channel Gained */
+	IEEE80211_PARAM_DOTH_SLDG		= 66,	/* permil of Stations Lost per rssi Db Gained */
+	IEEE80211_PARAM_TXCONT			= 67,	/* continuous transmit mode (boolean) */
+	IEEE80211_PARAM_TXCONT_RATE		= 68,	/* continuous transmit mode data rate (in mbit/sec) - will use closest match from current rate table */
+	IEEE80211_PARAM_TXCONT_POWER		= 69,	/* power level in units of 0.5dBm */
+	IEEE80211_PARAM_DFS_TESTMODE		= 70,	/* do not perform DFS actions (i.e. markng DFS and channel change on interference), just report them via debug. */
+	IEEE80211_PARAM_DFS_CACTIME		= 71,	/* how long do we wait for chan availability
+							   scans ?
+							   FCC requires 60s, so that is the default. */
+	IEEE80211_PARAM_DFS_EXCLPERIOD		= 72,	/* DFS no-occupancy limit - how long do we stay
+							   off a channel once radar is detected?
+							   FCC requires 30m, so that is the default. */
+	IEEE80211_PARAM_BEACON_MISS_THRESH	= 73,	/* Beacon miss threshold (in beacons) */
+	IEEE80211_PARAM_BEACON_MISS_THRESH_MS	= 74,	/* Beacon miss threshold (in ms) */
+	IEEE80211_PARAM_MAXRATE			= 75,	/* Maximum rate (by table index) */
+	IEEE80211_PARAM_MINRATE			= 76,	/* Minimum rate (by table index) */
+	IEEE80211_PARAM_PROTMODE_RSSI		= 77,	/* RSSI Threshold for enabling protection mode */
+	IEEE80211_PARAM_PROTMODE_TIMEOUT	= 78,	/* Timeout for expiring protection mode */
+	IEEE80211_PARAM_BGSCAN_THRESH		= 79,	/* bg scan rssi threshold */
+	IEEE80211_PARAM_RSSI_DIS_THR	= 80,	/* rssi threshold for disconnection */
+	IEEE80211_PARAM_RSSI_DIS_COUNT	= 81,	/* counter for rssi threshold */
+	IEEE80211_PARAM_WDS_SEP			= 82,	/* move wds stations into separate interfaces */
+	IEEE80211_PARAM_MAXASSOC		= 83,	/* maximum associated stations */
+	IEEE80211_PARAM_PROBEREQ		= 84,	/* enable handling of probe requests */
+	IEEE80211_PARAM_BEACON_TXP		= 85,	/* set beacon tx power */
+};
+
+#define	SIOCG80211STATS			(SIOCDEVPRIVATE+2)
+/* NB: require in+out parameters so cannot use wireless extensions, yech */
+#define	IEEE80211_IOCTL_GETKEY		(SIOCDEVPRIVATE+3)
+#define	IEEE80211_IOCTL_GETWPAIE	(SIOCDEVPRIVATE+4)
+#define	IEEE80211_IOCTL_STA_STATS	(SIOCDEVPRIVATE+5)
+#define	IEEE80211_IOCTL_STA_INFO	(SIOCDEVPRIVATE+6)
+#define	SIOC80211IFCREATE		(SIOCDEVPRIVATE+7)
+#define	SIOC80211IFDESTROY	 	(SIOCDEVPRIVATE+8)
+#define	IEEE80211_IOCTL_SCAN_RESULTS	(SIOCDEVPRIVATE+9)
+
+struct ieee80211_clone_params {
+	char icp_name[IFNAMSIZ];		/* device name */
+	u_int16_t icp_opmode;			/* operating mode */
+	u_int16_t icp_flags;			/* see below */
+#define	IEEE80211_CLONE_BSSID	0x0001		/* allocate unique mac/bssid */
+#define	IEEE80211_NO_STABEACONS	0x0002		/* Do not setup the station beacon timers */
+};
+
+/* APPIEBUF related definitions */
+
+/* Management frame type to which application IE is added */
+enum {
+	IEEE80211_APPIE_FRAME_BEACON		= 0,
+	IEEE80211_APPIE_FRAME_PROBE_REQ		= 1,
+	IEEE80211_APPIE_FRAME_PROBE_RESP	= 2,
+	IEEE80211_APPIE_FRAME_ASSOC_REQ		= 3,
+	IEEE80211_APPIE_FRAME_ASSOC_RESP	= 4,
+	IEEE80211_APPIE_NUM_OF_FRAME		= 5
+};
+
+struct ieee80211req_getset_appiebuf {
+	u_int32_t	app_frmtype;		/* management frame type for which buffer is added */
+	u_int32_t	app_buflen;		/* application-supplied buffer length */
+	u_int8_t	app_buf[0];		/* application-supplied IE(s) */
+};
+
+/* Flags ORed by application to set filter for receiving management frames */
+enum {
+	IEEE80211_FILTER_TYPE_BEACON		= 1<<0,
+	IEEE80211_FILTER_TYPE_PROBE_REQ		= 1<<1,
+	IEEE80211_FILTER_TYPE_PROBE_RESP	= 1<<2,
+	IEEE80211_FILTER_TYPE_ASSOC_REQ		= 1<<3,
+	IEEE80211_FILTER_TYPE_ASSOC_RESP	= 1<<4,
+	IEEE80211_FILTER_TYPE_AUTH		= 1<<5,
+	IEEE80211_FILTER_TYPE_DEAUTH		= 1<<6,
+	IEEE80211_FILTER_TYPE_DISASSOC		= 1<<7,
+	IEEE80211_FILTER_TYPE_ALL		= 0xFF	/* used to check the valid filter bits */
+};
+
+struct ieee80211req_set_filter {
+	u_int32_t app_filterype;		/* management frame filter type */
+};
+
+
+#endif /* __linux__ */
+
+#endif /* _NET80211_IEEE80211_IOCTL_H_ */
diff --git a/package/hostapd/patches/001-CVE-2012-4445.patch b/package/hostapd/patches/001-CVE-2012-4445.patch
deleted file mode 100644
index 1b8bdd00c5..0000000000
--- a/package/hostapd/patches/001-CVE-2012-4445.patch
+++ /dev/null
@@ -1,17 +0,0 @@
---- a/src/eap_server/eap_server_tls_common.c
-+++ b/src/eap_server/eap_server_tls_common.c
-@@ -228,6 +228,14 @@ static int eap_server_tls_process_fragme
- 			return -1;
- 		}
- 
-+		if (len > message_length) {
-+			wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in "
-+				   "first fragment of frame (TLS Message "
-+				   "Length %d bytes)",
-+				   (int) len, (int) message_length);
-+			return -1;
-+		}
-+
- 		data->tls_in = wpabuf_alloc(message_length);
- 		if (data->tls_in == NULL) {
- 			wpa_printf(MSG_DEBUG, "SSL: No memory for message");
diff --git a/package/hostapd/patches/100-pending_work.patch b/package/hostapd/patches/100-pending_work.patch
deleted file mode 100644
index 73949dd386..0000000000
--- a/package/hostapd/patches/100-pending_work.patch
+++ /dev/null
@@ -1,165 +0,0 @@
---- a/src/ap/ieee802_11.c
-+++ b/src/ap/ieee802_11.c
-@@ -1506,13 +1506,6 @@ static void handle_assoc_cb(struct hosta
- 	int new_assoc = 1;
- 	struct ieee80211_ht_capabilities ht_cap;
- 
--	if (!ok) {
--		hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
--			       HOSTAPD_LEVEL_DEBUG,
--			       "did not acknowledge association response");
--		return;
--	}
--
- 	if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_resp) :
- 				      sizeof(mgmt->u.assoc_resp))) {
- 		printf("handle_assoc_cb(reassoc=%d) - too short payload "
-@@ -1520,11 +1513,6 @@ static void handle_assoc_cb(struct hosta
- 		return;
- 	}
- 
--	if (reassoc)
--		status = le_to_host16(mgmt->u.reassoc_resp.status_code);
--	else
--		status = le_to_host16(mgmt->u.assoc_resp.status_code);
--
- 	sta = ap_get_sta(hapd, mgmt->da);
- 	if (!sta) {
- 		printf("handle_assoc_cb: STA " MACSTR " not found\n",
-@@ -1532,6 +1520,19 @@ static void handle_assoc_cb(struct hosta
- 		return;
- 	}
- 
-+	if (!ok) {
-+		hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
-+			       HOSTAPD_LEVEL_DEBUG,
-+			       "did not acknowledge association response");
-+		sta->flags &= ~WLAN_STA_ASSOC_REQ_OK;
-+		return;
-+	}
-+
-+	if (reassoc)
-+		status = le_to_host16(mgmt->u.reassoc_resp.status_code);
-+	else
-+		status = le_to_host16(mgmt->u.assoc_resp.status_code);
-+
- 	if (status != WLAN_STATUS_SUCCESS)
- 		goto fail;
- 
-@@ -1830,6 +1831,9 @@ void ieee802_11_rx_from_unknown(struct h
- 
- 	sta = ap_get_sta(hapd, src);
- 	if (sta && (sta->flags & WLAN_STA_ASSOC)) {
-+		if (!hapd->conf->wds_sta)
-+			return;
-+
- 		if (wds && !(sta->flags & WLAN_STA_WDS)) {
- 			wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for "
- 				   "STA " MACSTR " (aid %u)",
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -2661,10 +2661,10 @@ static int wpa_driver_nl80211_capa(struc
- 	drv->data_tx_status = info.data_tx_status;
- 
- 	/*
--	 * If poll command is supported mac80211 is new enough to
--	 * have everything we need to not need monitor interfaces.
-+	 * If poll command and tx status are supported, mac80211 is new enough
-+	 * to have everything we need to not need monitor interfaces.
- 	 */
--	drv->use_monitor = !info.poll_command_supported;
-+	drv->use_monitor = !info.poll_command_supported || !info.data_tx_status;
- 
- 	if (drv->device_ap_sme && drv->use_monitor) {
- 		/*
-@@ -6392,8 +6392,8 @@ static int wpa_driver_nl80211_hapd_send_
- 	pos = (u8 *) (hdr + 1);
- 
- 	if (qos) {
--		/* add an empty QoS header if needed */
--		pos[0] = 0;
-+		/* Set highest priority in QoS header */
-+		pos[0] = 7;
- 		pos[1] = 0;
- 		pos += 2;
- 	}
-@@ -7698,6 +7698,10 @@ static int i802_set_wds_sta(void *priv, 
- 		}
- 		return i802_set_sta_vlan(priv, addr, name, 0);
- 	} else {
-+		if (bridge_ifname)
-+			linux_br_del_if(drv->global->ioctl_sock, bridge_ifname,
-+					name);
-+
- 		i802_set_sta_vlan(priv, addr, bss->ifname, 0);
- 		return wpa_driver_nl80211_if_remove(priv, WPA_IF_AP_VLAN,
- 						    name);
-@@ -8065,7 +8069,12 @@ static int wpa_driver_nl80211_if_remove(
- 	if (ifindex <= 0)
- 		return -1;
- 
-+	nl80211_remove_iface(drv, ifindex);
-+
- #ifdef HOSTAPD
-+	if (type != WPA_IF_AP_BSS)
-+		return 0;
-+
- 	if (bss->added_if_into_bridge) {
- 		if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
- 				    bss->ifname) < 0)
-@@ -8079,13 +8088,6 @@ static int wpa_driver_nl80211_if_remove(
- 				   "bridge %s: %s",
- 				   bss->brname, strerror(errno));
- 	}
--#endif /* HOSTAPD */
--
--	nl80211_remove_iface(drv, ifindex);
--
--#ifdef HOSTAPD
--	if (type != WPA_IF_AP_BSS)
--		return 0;
- 
- 	if (bss != &drv->first_bss) {
- 		struct i802_bss *tbss;
---- a/src/ap/drv_callbacks.c
-+++ b/src/ap/drv_callbacks.c
-@@ -672,12 +672,15 @@ static void hostapd_event_eapol_rx(struc
- 				   const u8 *data, size_t data_len)
- {
- 	struct hostapd_iface *iface = hapd->iface;
-+	struct sta_info *sta;
- 	size_t j;
- 
- 	for (j = 0; j < iface->num_bss; j++) {
--		if (ap_get_sta(iface->bss[j], src)) {
--			hapd = iface->bss[j];
--			break;
-+		if ((sta = ap_get_sta(iface->bss[j], src))) {
-+			if (sta->flags & WLAN_STA_ASSOC) {
-+				hapd = iface->bss[j];
-+				break;
-+			}
- 		}
- 	}
- 
---- a/src/eap_peer/eap.c
-+++ b/src/eap_peer/eap.c
-@@ -348,6 +348,7 @@ SM_STATE(EAP, METHOD)
- {
- 	struct wpabuf *eapReqData;
- 	struct eap_method_ret ret;
-+	int min_len = 1;
- 
- 	SM_ENTRY(EAP, METHOD);
- 	if (sm->m == NULL) {
-@@ -356,7 +357,9 @@ SM_STATE(EAP, METHOD)
- 	}
- 
- 	eapReqData = eapol_get_eapReqData(sm);
--	if (!eap_hdr_len_valid(eapReqData, 1))
-+	if (sm->m->vendor == EAP_VENDOR_IETF && sm->m->method == EAP_TYPE_LEAP)
-+		min_len = 0; /* LEAP uses EAP-Success without payload */
-+	if (!eap_hdr_len_valid(eapReqData, min_len))
- 		return;
- 
- 	/*
diff --git a/package/hostapd/patches/300-nl80211_multicall_fixes.patch b/package/hostapd/patches/300-nl80211_multicall_fixes.patch
index 1d2519a937..be68ed1d44 100644
--- a/package/hostapd/patches/300-nl80211_multicall_fixes.patch
+++ b/package/hostapd/patches/300-nl80211_multicall_fixes.patch
@@ -1,6 +1,6 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -2988,6 +2988,7 @@ static void * wpa_driver_nl80211_init(vo
+@@ -3290,6 +3290,7 @@ static void * wpa_driver_nl80211_init(vo
  	drv->monitor_sock = -1;
  	drv->eapol_tx_sock = -1;
  	drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
@@ -8,7 +8,7 @@
  
  	if (wpa_driver_nl80211_init_nl(drv)) {
  		os_free(drv);
-@@ -3302,17 +3303,12 @@ static void wpa_driver_nl80211_send_rfki
+@@ -3607,17 +3608,12 @@ static void wpa_driver_nl80211_send_rfki
  	wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
  }
  
@@ -28,7 +28,7 @@
  	/*
  	 * Make sure the interface starts up in station mode unless this is a
  	 * dynamically added interface (e.g., P2P) that was already configured
-@@ -3331,7 +3327,7 @@ wpa_driver_nl80211_finish_drv_init(struc
+@@ -3636,7 +3632,7 @@ wpa_driver_nl80211_finish_drv_init(struc
  				   "interface '%s' due to rfkill",
  				   bss->ifname);
  			drv->if_disabled = 1;
@@ -37,7 +37,7 @@
  		} else {
  			wpa_printf(MSG_ERROR, "nl80211: Could not set "
  				   "interface '%s' UP", bss->ifname);
-@@ -3341,7 +3337,19 @@ wpa_driver_nl80211_finish_drv_init(struc
+@@ -3646,7 +3642,19 @@ wpa_driver_nl80211_finish_drv_init(struc
  
  	netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
  			       1, IF_OPER_DORMANT);
diff --git a/package/hostapd/patches/310-multicall_bridge_fix.patch b/package/hostapd/patches/310-multicall_bridge_fix.patch
index 59bfe5177a..a80c041d4a 100644
--- a/package/hostapd/patches/310-multicall_bridge_fix.patch
+++ b/package/hostapd/patches/310-multicall_bridge_fix.patch
@@ -1,6 +1,6 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -893,6 +893,10 @@ static void wpa_driver_nl80211_event_rtm
+@@ -899,6 +899,10 @@ static void wpa_driver_nl80211_event_rtm
  		return;
  	}
  
@@ -11,7 +11,7 @@
  	wpa_printf(MSG_DEBUG, "RTM_NEWLINK: operstate=%d ifi_flags=0x%x "
  		   "(%s%s%s%s)",
  		   drv->operstate, ifi->ifi_flags,
-@@ -1000,6 +1004,10 @@ static void wpa_driver_nl80211_event_rtm
+@@ -1006,6 +1010,10 @@ static void wpa_driver_nl80211_event_rtm
  	attrlen = len;
  	attr = (struct rtattr *) buf;
  
@@ -22,7 +22,7 @@
  	rta_len = RTA_ALIGN(sizeof(struct rtattr));
  	while (RTA_OK(attr, attrlen)) {
  		if (attr->rta_type == IFLA_IFNAME) {
-@@ -2990,6 +2998,11 @@ static void * wpa_driver_nl80211_init(vo
+@@ -3292,6 +3300,11 @@ static void * wpa_driver_nl80211_init(vo
  	drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
  	drv->nlmode = NL80211_IFTYPE_STATION;
  
@@ -34,7 +34,7 @@
  	if (wpa_driver_nl80211_init_nl(drv)) {
  		os_free(drv);
  		return NULL;
-@@ -7819,8 +7832,6 @@ static void *i802_init(struct hostapd_da
+@@ -8296,8 +8309,6 @@ static void *i802_init(struct hostapd_da
  		br_ifindex = 0;
  	}
  
diff --git a/package/hostapd/patches/330-fix_reassoc_after_ack_failure.patch b/package/hostapd/patches/330-fix_reassoc_after_ack_failure.patch
deleted file mode 100644
index 05dde2a5ac..0000000000
--- a/package/hostapd/patches/330-fix_reassoc_after_ack_failure.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/src/ap/sta_info.c
-+++ b/src/ap/sta_info.c
-@@ -567,7 +567,7 @@ void ap_sta_disassociate(struct hostapd_
- {
- 	wpa_printf(MSG_DEBUG, "%s: disassociate STA " MACSTR,
- 		   hapd->conf->iface, MAC2STR(sta->addr));
--	sta->flags &= ~WLAN_STA_ASSOC;
-+	sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK);
- 	ap_sta_set_authorized(hapd, sta, 0);
- 	sta->timeout_next = STA_DEAUTH;
- 	wpa_printf(MSG_DEBUG, "%s: reschedule ap_handle_timer timeout "
diff --git a/package/hostapd/patches/400-noscan.patch b/package/hostapd/patches/400-noscan.patch
index 69d026b3da..18a218cb26 100644
--- a/package/hostapd/patches/400-noscan.patch
+++ b/package/hostapd/patches/400-noscan.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -2485,6 +2485,8 @@ static int hostapd_config_fill(struct ho
+@@ -2464,6 +2464,8 @@ static int hostapd_config_fill(struct ho
  			}
  #endif /* CONFIG_IEEE80211W */
  #ifdef CONFIG_IEEE80211N
@@ -11,7 +11,7 @@
  		} else if (os_strcmp(buf, "ht_capab") == 0) {
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -497,6 +497,7 @@ struct hostapd_config {
+@@ -511,6 +511,7 @@ struct hostapd_config {
  
  	int ht_op_mode_fixed;
  	u16 ht_capab;
@@ -21,7 +21,7 @@
  	int require_ht;
 --- a/src/ap/hw_features.c
 +++ b/src/ap/hw_features.c
-@@ -493,7 +493,7 @@ static int ieee80211n_check_40mhz(struct
+@@ -494,7 +494,7 @@ static int ieee80211n_check_40mhz(struct
  {
  	struct wpa_driver_scan_params params;
  
diff --git a/package/hostapd/patches/410-multicall.patch b/package/hostapd/patches/410-multicall.patch
index a774603b40..723f5f6448 100644
--- a/package/hostapd/patches/410-multicall.patch
+++ b/package/hostapd/patches/410-multicall.patch
@@ -8,7 +8,7 @@
  
  ifndef CONFIG_OS
  ifdef CONFIG_NATIVE_WINDOWS
-@@ -188,10 +189,14 @@ ifdef CONFIG_IEEE80211AC
+@@ -192,10 +193,14 @@ ifdef CONFIG_IEEE80211AC
  CFLAGS += -DCONFIG_IEEE80211AC
  endif
  
@@ -26,7 +26,7 @@
  LIBS += $(DRV_AP_LIBS)
  
  ifdef CONFIG_L2_PACKET
-@@ -867,6 +872,12 @@ install: all
+@@ -860,6 +865,12 @@ install: all
  
  BCHECK=../src/drivers/build.hostapd
  
@@ -39,7 +39,7 @@
  hostapd: $(BCHECK) $(OBJS)
  	$(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
  	@$(E) "  LD " $@
-@@ -905,6 +916,12 @@ HOBJS += ../src/crypto/aes-internal.o
+@@ -898,6 +909,12 @@ HOBJS += ../src/crypto/aes-internal.o
  HOBJS += ../src/crypto/aes-internal-enc.o
  endif
  
@@ -62,7 +62,7 @@
  
  BINALL=wpa_supplicant wpa_cli
  
-@@ -705,6 +706,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
+@@ -708,6 +709,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
  CFLAGS += -DCONFIG_DYNAMIC_EAP_METHODS
  LIBS += -ldl -rdynamic
  endif
@@ -73,7 +73,7 @@
  endif
  
  ifdef CONFIG_AP
-@@ -713,9 +718,11 @@ NEED_EAP_COMMON=y
+@@ -716,9 +721,11 @@ NEED_EAP_COMMON=y
  NEED_RSN_AUTHENTICATOR=y
  CFLAGS += -DCONFIG_AP
  OBJS += ap.o
@@ -85,7 +85,7 @@
  OBJS += ../src/ap/hostapd.o
  OBJS += ../src/ap/wpa_auth_glue.o
  OBJS += ../src/ap/utils.o
-@@ -770,10 +777,18 @@ endif
+@@ -773,10 +780,18 @@ endif
  ifdef CONFIG_HS20
  OBJS += ../src/ap/hs20.o
  endif
@@ -104,7 +104,7 @@
  NEED_AES_WRAP=y
  OBJS += ../src/ap/wpa_auth.o
  OBJS += ../src/ap/wpa_auth_ie.o
-@@ -1515,6 +1530,12 @@ wpa_priv: $(BCHECK) $(OBJS_priv)
+@@ -1525,6 +1540,12 @@ wpa_priv: $(BCHECK) $(OBJS_priv)
  
  $(OBJS_c) $(OBJS_t) $(OBJS_t2) $(OBJS) $(BCHECK) $(EXTRA_progs): .config
  
@@ -117,7 +117,7 @@
  wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs)
  	$(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
  	@$(E) "  LD " $@
-@@ -1585,6 +1606,12 @@ eap_ikev2.so: ../src/eap_peer/eap_ikev2.
+@@ -1595,6 +1616,12 @@ eap_ikev2.so: ../src/eap_peer/eap_ikev2.
  %@.service: %.service.arg.in
  	sed -e 's|\@BINDIR\@|$(BINDIR)|g' $< >$@
  
@@ -132,7 +132,7 @@
  wpa_cli.exe: wpa_cli
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -3686,8 +3686,8 @@ union wpa_event_data {
+@@ -3750,8 +3750,8 @@ union wpa_event_data {
   * Driver wrapper code should call this function whenever an event is received
   * from the driver.
   */
@@ -145,7 +145,7 @@
  /*
 --- a/src/ap/drv_callbacks.c
 +++ b/src/ap/drv_callbacks.c
-@@ -688,8 +688,8 @@ static void hostapd_event_eapol_rx(struc
+@@ -714,8 +714,8 @@ static void hostapd_event_eapol_rx(struc
  }
  
  
@@ -179,7 +179,7 @@
  	for (;;) {
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -2258,8 +2258,8 @@ static void wnm_action_rx(struct wpa_sup
+@@ -2354,8 +2354,8 @@ static void wpa_supplicant_event_unprot_
  }
  
  
@@ -192,7 +192,7 @@
  	u16 reason_code = 0;
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2921,6 +2921,9 @@ static void wpa_supplicant_deinit_iface(
+@@ -3050,6 +3050,9 @@ static void wpa_supplicant_deinit_iface(
  	}
  }
  
@@ -202,7 +202,7 @@
  
  /**
   * wpa_supplicant_add_iface - Add a new network interface
-@@ -3113,6 +3116,7 @@ struct wpa_global * wpa_supplicant_init(
+@@ -3244,6 +3247,7 @@ struct wpa_global * wpa_supplicant_init(
  	wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
  #endif /* CONFIG_NO_WPA_MSG */
  
@@ -212,7 +212,7 @@
  		wpa_debug_open_syslog();
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -530,6 +530,9 @@ static int hostapd_get_global_ctrl_iface
+@@ -554,6 +554,9 @@ static int hostapd_get_ctrl_iface_group(
  	return 0;
  }
  
@@ -222,13 +222,13 @@
  
  int main(int argc, char *argv[])
  {
-@@ -555,6 +558,7 @@ int main(int argc, char *argv[])
+@@ -579,6 +582,7 @@ int main(int argc, char *argv[])
  	interfaces.global_iface_name = NULL;
  	interfaces.global_ctrl_sock = -1;
  
 +	wpa_supplicant_event = hostapd_wpa_event;
  	for (;;) {
- 		c = getopt(argc, argv, "Bde:f:hKP:tvg:");
+ 		c = getopt(argc, argv, "Bde:f:hKP:tvg:G:");
  		if (c < 0)
 --- a/src/drivers/drivers.c
 +++ b/src/drivers/drivers.c
diff --git a/package/hostapd/patches/430-rescan_immediately.patch b/package/hostapd/patches/430-rescan_immediately.patch
index 51d41f8001..9d5fd324c4 100644
--- a/package/hostapd/patches/430-rescan_immediately.patch
+++ b/package/hostapd/patches/430-rescan_immediately.patch
@@ -1,9 +1,9 @@
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2388,7 +2388,7 @@ static struct wpa_supplicant * wpa_suppl
+@@ -2443,7 +2443,7 @@ static struct wpa_supplicant * wpa_suppl
  	if (wpa_s == NULL)
  		return NULL;
- 	wpa_s->scan_req = 1;
+ 	wpa_s->scan_req = INITIAL_SCAN_REQ;
 -	wpa_s->scan_interval = 5;
 +	wpa_s->scan_interval = 1;
  	wpa_s->new_connection = 1;
diff --git a/package/hostapd/patches/440-optional_rfkill.patch b/package/hostapd/patches/440-optional_rfkill.patch
index be18458b24..8a006df913 100644
--- a/package/hostapd/patches/440-optional_rfkill.patch
+++ b/package/hostapd/patches/440-optional_rfkill.patch
@@ -8,9 +8,9 @@
  	struct rfkill_data *rfkill;
 +#endif
  	struct wpa_driver_capa capa;
- 	int has_capability;
- 
-@@ -2828,7 +2830,7 @@ static int wpa_driver_nl80211_init_nl(st
+ 	u8 *extended_capa, *extended_capa_mask;
+ 	unsigned int extended_capa_len;
+@@ -3128,7 +3130,7 @@ static int wpa_driver_nl80211_init_nl(st
  	return 0;
  }
  
@@ -19,7 +19,7 @@
  static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
  {
  	wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
-@@ -2851,6 +2853,7 @@ static void wpa_driver_nl80211_rfkill_un
+@@ -3151,6 +3153,7 @@ static void wpa_driver_nl80211_rfkill_un
  	}
  	/* rtnetlink ifup handler will report interface as enabled */
  }
@@ -27,7 +27,7 @@
  
  
  static void nl80211_get_phy_name(struct wpa_driver_nl80211_data *drv)
-@@ -2979,7 +2982,9 @@ static void * wpa_driver_nl80211_init(vo
+@@ -3279,7 +3282,9 @@ static void * wpa_driver_nl80211_init(vo
  				      void *global_priv)
  {
  	struct wpa_driver_nl80211_data *drv;
@@ -37,7 +37,7 @@
  	struct i802_bss *bss;
  
  	if (global_priv == NULL)
-@@ -3013,6 +3018,7 @@ static void * wpa_driver_nl80211_init(vo
+@@ -3315,6 +3320,7 @@ static void * wpa_driver_nl80211_init(vo
  
  	nl80211_get_phy_name(drv);
  
@@ -45,7 +45,7 @@
  	rcfg = os_zalloc(sizeof(*rcfg));
  	if (rcfg == NULL)
  		goto failed;
-@@ -3025,6 +3031,7 @@ static void * wpa_driver_nl80211_init(vo
+@@ -3327,6 +3333,7 @@ static void * wpa_driver_nl80211_init(vo
  		wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
  		os_free(rcfg);
  	}
@@ -53,7 +53,7 @@
  
  	if (wpa_driver_nl80211_finish_drv_init(drv))
  		goto failed;
-@@ -3311,10 +3318,12 @@ static void nl80211_mgmt_unsubscribe(str
+@@ -3616,10 +3623,12 @@ static void nl80211_mgmt_unsubscribe(str
  }
  
  
@@ -66,7 +66,7 @@
  
  static int
  wpa_driver_nl80211_finish_drv_init_sta(struct wpa_driver_nl80211_data *drv,
-@@ -3335,13 +3344,16 @@ wpa_driver_nl80211_finish_drv_init_sta(s
+@@ -3640,13 +3649,16 @@ wpa_driver_nl80211_finish_drv_init_sta(s
  	}
  
  	if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1)) {
@@ -84,7 +84,7 @@
  			wpa_printf(MSG_ERROR, "nl80211: Could not set "
  				   "interface '%s' UP", bss->ifname);
  			return -1;
-@@ -3372,8 +3384,10 @@ wpa_driver_nl80211_finish_drv_init(struc
+@@ -3677,8 +3689,10 @@ wpa_driver_nl80211_finish_drv_init(struc
  		return -1;
  
  	if (send_rfkill_event) {
@@ -95,7 +95,7 @@
  	}
  
  	return 0;
-@@ -3460,7 +3474,9 @@ static void wpa_driver_nl80211_deinit(vo
+@@ -3764,7 +3778,9 @@ static void wpa_driver_nl80211_deinit(st
  
  	netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, 0,
  			       IF_OPER_UP);
@@ -223,7 +223,7 @@
  
  ifdef CONFIG_LIBNL32
    DRV_LIBS += -lnl-3
-@@ -101,7 +100,6 @@ DRV_WPA_CFLAGS += -DCONFIG_DRIVER_WEXT
+@@ -109,7 +108,6 @@ DRV_WPA_CFLAGS += -DCONFIG_DRIVER_WEXT
  CONFIG_WIRELESS_EXTENSION=y
  NEED_NETLINK=y
  NEED_LINUX_IOCTL=y
@@ -231,7 +231,7 @@
  endif
  
  ifdef CONFIG_DRIVER_NDIS
-@@ -127,7 +125,6 @@ endif
+@@ -135,7 +133,6 @@ endif
  ifdef CONFIG_WIRELESS_EXTENSION
  DRV_WPA_CFLAGS += -DCONFIG_WIRELESS_EXTENSION
  DRV_WPA_OBJS += ../src/drivers/driver_wext.o
@@ -239,7 +239,7 @@
  endif
  
  ifdef NEED_NETLINK
-@@ -140,6 +137,7 @@ endif
+@@ -148,6 +145,7 @@ endif
  
  ifdef NEED_RFKILL
  DRV_OBJS += ../src/drivers/rfkill.o
diff --git a/package/hostapd/patches/450-reload_freq_change.patch b/package/hostapd/patches/450-reload_freq_change.patch
index f11593fcd5..ffa757e9ca 100644
--- a/package/hostapd/patches/450-reload_freq_change.patch
+++ b/package/hostapd/patches/450-reload_freq_change.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -140,6 +140,20 @@ int hostapd_reload_config(struct hostapd
+@@ -156,6 +156,24 @@ int hostapd_reload_config(struct hostapd
  	oldconf = hapd->iconf;
  	iface->conf = newconf;
  
@@ -10,7 +10,11 @@
 +	if (hostapd_set_freq(hapd, newconf->hw_mode, iface->freq,
 +			     newconf->channel,
 +			     newconf->ieee80211n,
-+			     newconf->secondary_channel)) {
++			     newconf->ieee80211ac,
++			     newconf->secondary_channel,
++			     newconf->vht_oper_chwidth,
++			     newconf->vht_oper_centr_freq_seg0_idx,
++			     newconf->vht_oper_centr_freq_seg1_idx)) {
 +		wpa_printf(MSG_ERROR, "Could not set channel for "
 +			   "kernel driver");
 +	}
diff --git a/package/hostapd/patches/451-nl80211_del_beacon_bss.patch b/package/hostapd/patches/451-nl80211_del_beacon_bss.patch
index 801b78b124..fdff9e7923 100644
--- a/package/hostapd/patches/451-nl80211_del_beacon_bss.patch
+++ b/package/hostapd/patches/451-nl80211_del_beacon_bss.patch
@@ -1,6 +1,6 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -3394,16 +3394,18 @@ wpa_driver_nl80211_finish_drv_init(struc
+@@ -3699,16 +3699,18 @@ wpa_driver_nl80211_finish_drv_init(struc
  }
  
  
@@ -21,7 +21,7 @@
  
  	return send_and_recv_msgs(drv, msg, NULL, NULL);
   nla_put_failure:
-@@ -3411,6 +3413,21 @@ static int wpa_driver_nl80211_del_beacon
+@@ -3716,6 +3718,21 @@ static int wpa_driver_nl80211_del_beacon
  	return -ENOBUFS;
  }
  
@@ -43,15 +43,15 @@
  
  /**
   * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
-@@ -9238,4 +9255,5 @@ const struct wpa_driver_ops wpa_driver_n
- 	.send_tdls_mgmt = nl80211_send_tdls_mgmt,
+@@ -9855,4 +9872,5 @@ const struct wpa_driver_ops wpa_driver_n
  	.tdls_oper = nl80211_tdls_oper,
  #endif /* CONFIG_TDLS */
+ 	.update_ft_ies = wpa_driver_nl80211_update_ft_ies,
 +	.stop_ap = wpa_driver_nl80211_stop_ap,
  };
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -2053,6 +2053,9 @@ struct wpa_driver_ops {
+@@ -2095,6 +2095,9 @@ struct wpa_driver_ops {
  	 */
  	int (*probe_req_report)(void *priv, int report);
  
diff --git a/package/hostapd/patches/452-ctrl_iface_reload.patch b/package/hostapd/patches/452-ctrl_iface_reload.patch
index 81dcfedde5..85e871f457 100644
--- a/package/hostapd/patches/452-ctrl_iface_reload.patch
+++ b/package/hostapd/patches/452-ctrl_iface_reload.patch
@@ -85,7 +85,7 @@
  
  #ifdef CONFIG_IEEE80211W
  #ifdef NEED_AP_MLME
-@@ -864,6 +928,10 @@ static void hostapd_ctrl_iface_receive(i
+@@ -902,6 +966,10 @@ static void hostapd_ctrl_iface_receive(i
  				reply_len += res;
  		}
  #endif /* CONFIG_NO_RADIUS */
diff --git a/package/hostapd/patches/453-ap_sta_support.patch b/package/hostapd/patches/453-ap_sta_support.patch
index 4b6c0f1646..a3dff04b5f 100644
--- a/package/hostapd/patches/453-ap_sta_support.patch
+++ b/package/hostapd/patches/453-ap_sta_support.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/wpa_supplicant_i.h
 +++ b/wpa_supplicant/wpa_supplicant_i.h
-@@ -95,6 +95,8 @@ struct wpa_interface {
+@@ -96,6 +96,8 @@ struct wpa_interface {
  	 * receiving of EAPOL frames from an additional interface.
  	 */
  	const char *bridge_ifname;
@@ -9,7 +9,7 @@
  };
  
  /**
-@@ -294,6 +296,8 @@ struct wpa_supplicant {
+@@ -306,6 +308,8 @@ struct wpa_supplicant {
  #endif /* CONFIG_CTRL_IFACE_DBUS_NEW */
  	char bridge_ifname[16];
  
@@ -100,7 +100,7 @@
  /* Configure default/group WEP keys for static WEP */
  int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
  {
-@@ -672,8 +721,16 @@ void wpa_supplicant_set_state(struct wpa
+@@ -667,8 +716,16 @@ void wpa_supplicant_set_state(struct wpa
  #endif /* CONFIG_P2P */
  
  		sme_sched_obss_scan(wpa_s, 1);
@@ -117,7 +117,7 @@
  		wpa_s->new_connection = 1;
  		wpa_drv_set_operstate(wpa_s, 0);
  #ifndef IEEE8021X_EAPOL
-@@ -2727,6 +2784,21 @@ static int wpa_supplicant_init_iface(str
+@@ -2853,6 +2910,21 @@ static int wpa_supplicant_init_iface(str
  		os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
  			   sizeof(wpa_s->bridge_ifname));
  	}
@@ -149,16 +149,17 @@
  #include "drivers/driver.h"
  #include "wpa_supplicant_i.h"
  #include "config.h"
-@@ -139,6 +140,8 @@ struct wpa_bss * wpa_bss_get(struct wpa_
- 
- static void wpa_bss_copy_res(struct wpa_bss *dst, struct wpa_scan_res *src)
+@@ -245,6 +246,9 @@ static void calculate_update_time(const 
+ static void wpa_bss_copy_res(struct wpa_bss *dst, struct wpa_scan_res *src,
+ 			     struct os_time *fetch_time)
  {
 +	struct ieee80211_ht_capabilities *capab;
 +	struct ieee802_11_elems elems;
- 	os_time_t usec;
- 
++
  	dst->flags = src->flags;
-@@ -151,6 +154,12 @@ static void wpa_bss_copy_res(struct wpa_
+ 	os_memcpy(dst->bssid, src->bssid, ETH_ALEN);
+ 	dst->freq = src->freq;
+@@ -255,6 +259,12 @@ static void wpa_bss_copy_res(struct wpa_
  	dst->level = src->level;
  	dst->tsf = src->tsf;
  
@@ -168,19 +169,9 @@
 +	if (capab)
 +		dst->ht_capab = le_to_host16(capab->ht_capabilities_info);
 +
- 	os_get_time(&dst->last_update);
- 	dst->last_update.sec -= src->age / 1000;
- 	usec = (src->age % 1000) * 1000;
---- a/wpa_supplicant/bss.h
-+++ b/wpa_supplicant/bss.h
-@@ -72,6 +72,7 @@ struct wpa_bss {
- 	u8 bssid[ETH_ALEN];
- 	u8 hessid[ETH_ALEN];
- 	u8 ssid[32];
-+	u16 ht_capab;
- 	size_t ssid_len;
- 	int freq;
- 	u16 beacon_int;
+ 	calculate_update_time(fetch_time, src->age, &dst->last_update);
+ }
+ 
 --- a/wpa_supplicant/main.c
 +++ b/wpa_supplicant/main.c
 @@ -25,7 +25,7 @@ static void usage(void)
@@ -219,3 +210,14 @@
  		case 'i':
  			iface->ifname = optarg;
  			break;
+--- a/wpa_supplicant/bss.h
++++ b/wpa_supplicant/bss.h
+@@ -69,6 +69,8 @@ struct wpa_bss {
+ 	u8 ssid[32];
+ 	/** Length of SSID */
+ 	size_t ssid_len;
++	/** HT caapbilities */
++	u16 ht_capab;
+ 	/** Frequency of the channel in MHz (e.g., 2412 = channel 1) */
+ 	int freq;
+ 	/** Beacon interval in TUs (host byte order) */
diff --git a/package/hostapd/patches/460-disable_ctrl_iface_mib.patch b/package/hostapd/patches/460-disable_ctrl_iface_mib.patch
index 2f03179a0a..a51ade8295 100644
--- a/package/hostapd/patches/460-disable_ctrl_iface_mib.patch
+++ b/package/hostapd/patches/460-disable_ctrl_iface_mib.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/Makefile
 +++ b/hostapd/Makefile
-@@ -135,6 +135,9 @@ endif
+@@ -136,6 +136,9 @@ endif
  ifdef CONFIG_NO_CTRL_IFACE
  CFLAGS += -DCONFIG_NO_CTRL_IFACE
  else
@@ -12,7 +12,7 @@
  endif
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -899,6 +899,7 @@ static void hostapd_ctrl_iface_receive(i
+@@ -937,6 +937,7 @@ static void hostapd_ctrl_iface_receive(i
  	} else if (os_strncmp(buf, "RELOG", 5) == 0) {
  		if (wpa_debug_reopen_file() < 0)
  			reply_len = -1;
@@ -20,7 +20,7 @@
  	} else if (os_strcmp(buf, "MIB") == 0) {
  		reply_len = ieee802_11_get_mib(hapd, reply, reply_size);
  		if (reply_len >= 0) {
-@@ -928,10 +929,12 @@ static void hostapd_ctrl_iface_receive(i
+@@ -966,10 +967,12 @@ static void hostapd_ctrl_iface_receive(i
  				reply_len += res;
  		}
  #endif /* CONFIG_NO_RADIUS */
@@ -33,7 +33,7 @@
  	} else if (os_strcmp(buf, "STA-FIRST") == 0) {
  		reply_len = hostapd_ctrl_iface_sta_first(hapd, reply,
  							 reply_size);
-@@ -941,6 +944,7 @@ static void hostapd_ctrl_iface_receive(i
+@@ -979,6 +982,7 @@ static void hostapd_ctrl_iface_receive(i
  	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
  		reply_len = hostapd_ctrl_iface_sta_next(hapd, buf + 9, reply,
  							reply_size);
@@ -43,8 +43,8 @@
  			reply_len = -1;
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -751,6 +751,9 @@ ifdef CONFIG_IEEE80211N
- OBJS += ../src/ap/ieee802_11_ht.o
+@@ -758,6 +758,9 @@ ifdef CONFIG_WNM
+ OBJS += ../src/ap/wnm_ap.o
  endif
  ifdef CONFIG_CTRL_IFACE
 +ifdef CONFIG_CTRL_IFACE_MIB
@@ -55,7 +55,7 @@
  
 --- a/wpa_supplicant/ctrl_iface.c
 +++ b/wpa_supplicant/ctrl_iface.c
-@@ -4382,6 +4382,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -5051,6 +5051,7 @@ char * wpa_supplicant_ctrl_iface_process
  			reply_len = -1;
  	} else if (os_strncmp(buf, "NOTE ", 5) == 0) {
  		wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
@@ -63,7 +63,7 @@
  	} else if (os_strcmp(buf, "MIB") == 0) {
  		reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
  		if (reply_len >= 0) {
-@@ -4393,6 +4394,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -5062,6 +5063,7 @@ char * wpa_supplicant_ctrl_iface_process
  			else
  				reply_len += res;
  		}
@@ -71,7 +71,7 @@
  	} else if (os_strncmp(buf, "STATUS", 6) == 0) {
  		reply_len = wpa_supplicant_ctrl_iface_status(
  			wpa_s, buf + 6, reply, reply_size);
-@@ -4792,6 +4794,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -5465,6 +5467,7 @@ char * wpa_supplicant_ctrl_iface_process
  		reply_len = wpa_supplicant_ctrl_iface_bss(
  			wpa_s, buf + 4, reply, reply_size);
  #ifdef CONFIG_AP
@@ -79,7 +79,7 @@
  	} else if (os_strcmp(buf, "STA-FIRST") == 0) {
  		reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
  	} else if (os_strncmp(buf, "STA ", 4) == 0) {
-@@ -4800,6 +4803,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -5473,6 +5476,7 @@ char * wpa_supplicant_ctrl_iface_process
  	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
  		reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
  						   reply_size);
@@ -95,9 +95,9 @@
  
 +#ifdef CONFIG_CTRL_IFACE_MIB
  
- static int hostapd_ctrl_iface_sta_mib(struct hostapd_data *hapd,
- 				      struct sta_info *sta,
-@@ -103,6 +104,7 @@ int hostapd_ctrl_iface_sta_next(struct h
+ static int hostapd_get_sta_conn_time(struct sta_info *sta,
+ 				     char *buf, size_t buflen)
+@@ -129,6 +130,7 @@ int hostapd_ctrl_iface_sta_next(struct h
  	return hostapd_ctrl_iface_sta_mib(hapd, sta->next, buf, buflen);
  }
  
@@ -105,14 +105,14 @@
  
  #ifdef CONFIG_P2P_MANAGER
  static int p2p_manager_disconnect(struct hostapd_data *hapd, u16 stype,
-@@ -269,3 +271,4 @@ int hostapd_ctrl_iface_disassociate(stru
+@@ -303,3 +305,4 @@ int hostapd_ctrl_iface_disassociate(stru
  
  	return 0;
  }
 +
 --- a/src/ap/ieee802_1x.c
 +++ b/src/ap/ieee802_1x.c
-@@ -2034,6 +2034,7 @@ static const char * bool_txt(Boolean boo
+@@ -2048,6 +2048,7 @@ static const char * bool_txt(Boolean boo
  	return bool ? "TRUE" : "FALSE";
  }
  
@@ -120,7 +120,7 @@
  
  int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
  {
-@@ -2186,6 +2187,7 @@ int ieee802_1x_get_mib_sta(struct hostap
+@@ -2200,6 +2201,7 @@ int ieee802_1x_get_mib_sta(struct hostap
  	return len;
  }
  
@@ -130,7 +130,7 @@
  				struct sta_info *sta, int success)
 --- a/src/ap/wpa_auth.c
 +++ b/src/ap/wpa_auth.c
-@@ -2729,6 +2729,7 @@ static const char * wpa_bool_txt(int boo
+@@ -2687,6 +2687,7 @@ static const char * wpa_bool_txt(int boo
  	return bool ? "TRUE" : "FALSE";
  }
  
@@ -138,7 +138,7 @@
  
  #define RSN_SUITE "%02x-%02x-%02x-%d"
  #define RSN_SUITE_ARG(s) \
-@@ -2873,7 +2874,7 @@ int wpa_get_mib_sta(struct wpa_state_mac
+@@ -2831,7 +2832,7 @@ int wpa_get_mib_sta(struct wpa_state_mac
  
  	return len;
  }
@@ -149,7 +149,7 @@
  {
 --- a/src/rsn_supp/wpa.c
 +++ b/src/rsn_supp/wpa.c
-@@ -1844,6 +1844,8 @@ static u32 wpa_key_mgmt_suite(struct wpa
+@@ -1848,6 +1848,8 @@ static u32 wpa_key_mgmt_suite(struct wpa
  }
  
  
@@ -158,7 +158,7 @@
  #define RSN_SUITE "%02x-%02x-%02x-%d"
  #define RSN_SUITE_ARG(s) \
  ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
-@@ -1927,6 +1929,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch
+@@ -1931,6 +1933,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch
  
  	return (int) len;
  }
diff --git a/package/hostapd/patches/470-wpa_ie_cap_workaround.patch b/package/hostapd/patches/470-wpa_ie_cap_workaround.patch
index 00a32229d4..974ec3ded5 100644
--- a/package/hostapd/patches/470-wpa_ie_cap_workaround.patch
+++ b/package/hostapd/patches/470-wpa_ie_cap_workaround.patch
@@ -1,6 +1,6 @@
 --- a/src/common/wpa_common.c
 +++ b/src/common/wpa_common.c
-@@ -959,6 +959,31 @@ const char * wpa_key_mgmt_txt(int key_mg
+@@ -965,6 +965,31 @@ const char * wpa_key_mgmt_txt(int key_mg
  }
  
  
@@ -32,7 +32,7 @@
  int wpa_compare_rsn_ie(int ft_initial_assoc,
  		       const u8 *ie1, size_t ie1len,
  		       const u8 *ie2, size_t ie2len)
-@@ -966,8 +991,19 @@ int wpa_compare_rsn_ie(int ft_initial_as
+@@ -972,8 +997,19 @@ int wpa_compare_rsn_ie(int ft_initial_as
  	if (ie1 == NULL || ie2 == NULL)
  		return -1;
  
diff --git a/package/hostapd/patches/480-terminate_on_setup_failure.patch b/package/hostapd/patches/480-terminate_on_setup_failure.patch
index 6168a5cfc3..3f8a7783ba 100644
--- a/package/hostapd/patches/480-terminate_on_setup_failure.patch
+++ b/package/hostapd/patches/480-terminate_on_setup_failure.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -886,11 +886,8 @@ int hostapd_setup_interface_complete(str
+@@ -911,11 +911,8 @@ int hostapd_setup_interface_complete(str
  	size_t j;
  	u8 *prev_addr;
  
@@ -14,8 +14,8 @@
  
  	wpa_printf(MSG_DEBUG, "Completing interface initialization");
  	if (hapd->iconf->channel) {
-@@ -906,7 +903,7 @@ int hostapd_setup_interface_complete(str
- 				     hapd->iconf->secondary_channel)) {
+@@ -935,7 +932,7 @@ int hostapd_setup_interface_complete(str
+ 				     hapd->iconf->vht_oper_centr_freq_seg1_idx)) {
  			wpa_printf(MSG_ERROR, "Could not set channel for "
  				   "kernel driver");
 -			return -1;
@@ -23,7 +23,7 @@
  		}
  	}
  
-@@ -917,7 +914,7 @@ int hostapd_setup_interface_complete(str
+@@ -946,7 +943,7 @@ int hostapd_setup_interface_complete(str
  			hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
  				       HOSTAPD_LEVEL_WARNING,
  				       "Failed to prepare rates table.");
@@ -32,7 +32,7 @@
  		}
  	}
  
-@@ -925,14 +922,14 @@ int hostapd_setup_interface_complete(str
+@@ -954,14 +951,14 @@ int hostapd_setup_interface_complete(str
  	    hostapd_set_rts(hapd, hapd->iconf->rts_threshold)) {
  		wpa_printf(MSG_ERROR, "Could not set RTS threshold for "
  			   "kernel driver");
@@ -49,7 +49,7 @@
  	}
  
  	prev_addr = hapd->own_addr;
-@@ -942,7 +939,7 @@ int hostapd_setup_interface_complete(str
+@@ -971,7 +968,7 @@ int hostapd_setup_interface_complete(str
  		if (j)
  			os_memcpy(hapd->own_addr, prev_addr, ETH_ALEN);
  		if (hostapd_setup_bss(hapd, j == 0))
@@ -58,7 +58,7 @@
  		if (hostapd_mac_comp_empty(hapd->conf->bssid) == 0)
  			prev_addr = hapd->own_addr;
  	}
-@@ -954,7 +951,7 @@ int hostapd_setup_interface_complete(str
+@@ -983,7 +980,7 @@ int hostapd_setup_interface_complete(str
  	if (hostapd_driver_commit(hapd) < 0) {
  		wpa_printf(MSG_ERROR, "%s: Failed to commit driver "
  			   "configuration", __func__);
@@ -67,7 +67,7 @@
  	}
  
  	/*
-@@ -975,6 +972,11 @@ int hostapd_setup_interface_complete(str
+@@ -1004,6 +1001,11 @@ int hostapd_setup_interface_complete(str
  		   iface->bss[0]->conf->iface);
  
  	return 0;
diff --git a/package/hostapd/patches/500-random_pool_add_kernel.patch b/package/hostapd/patches/500-random_pool_add_kernel.patch
index e54e881d8e..ccecb2240a 100644
--- a/package/hostapd/patches/500-random_pool_add_kernel.patch
+++ b/package/hostapd/patches/500-random_pool_add_kernel.patch
@@ -1,6 +1,14 @@
 --- a/src/crypto/random.c
 +++ b/src/crypto/random.c
-@@ -33,6 +33,8 @@
+@@ -25,6 +25,7 @@
+ #include "utils/includes.h"
+ #ifdef __linux__
+ #include <fcntl.h>
++#include <sys/stat.h>
+ #endif /* __linux__ */
+ 
+ #include "utils/common.h"
+@@ -33,6 +34,8 @@
  #include "sha1.h"
  #include "random.h"
  
@@ -9,7 +17,7 @@
  #define POOL_WORDS 32
  #define POOL_WORDS_MASK (POOL_WORDS - 1)
  #define POOL_TAP1 26
-@@ -43,6 +45,8 @@
+@@ -43,6 +46,8 @@
  #define EXTRACT_LEN 16
  #define MIN_READY_MARK 2
  
@@ -18,7 +26,7 @@
  static u32 pool[POOL_WORDS];
  static unsigned int input_rotate = 0;
  static unsigned int pool_pos = 0;
-@@ -123,7 +127,7 @@ static void random_extract(u8 *out)
+@@ -123,7 +128,7 @@ static void random_extract(u8 *out)
  }
  
  
@@ -27,7 +35,7 @@
  {
  	struct os_time t;
  	static unsigned int count = 0;
-@@ -213,16 +217,22 @@ int random_get_bytes(void *buf, size_t l
+@@ -213,16 +218,22 @@ int random_get_bytes(void *buf, size_t l
  int random_pool_ready(void)
  {
  #ifdef __linux__
@@ -51,7 +59,7 @@
  
  	/*
  	 * Try to fetch some more data from the kernel high quality
-@@ -257,6 +267,7 @@ int random_pool_ready(void)
+@@ -257,6 +268,7 @@ int random_pool_ready(void)
  	if (dummy_key_avail == sizeof(dummy_key)) {
  		if (own_pool_ready < MIN_READY_MARK)
  			own_pool_ready = MIN_READY_MARK;
@@ -59,7 +67,7 @@
  		random_write_entropy();
  		return 1;
  	}
-@@ -269,6 +280,7 @@ int random_pool_ready(void)
+@@ -269,6 +281,7 @@ int random_pool_ready(void)
  	    total_collected + 10 * own_pool_ready > MIN_COLLECT_ENTROPY) {
  		wpa_printf(MSG_INFO, "random: Allow operation to proceed "
  			   "based on internal entropy");
@@ -67,7 +75,7 @@
  		return 1;
  	}
  
-@@ -284,10 +296,16 @@ int random_pool_ready(void)
+@@ -284,10 +297,16 @@ int random_pool_ready(void)
  
  void random_mark_pool_ready(void)
  {
@@ -84,7 +92,7 @@
  }
  
  
-@@ -444,3 +462,22 @@ void random_deinit(void)
+@@ -444,3 +463,22 @@ void random_deinit(void)
  	os_free(random_entropy_file);
  	random_entropy_file = NULL;
  }
@@ -109,7 +117,7 @@
 +}
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -1217,9 +1217,8 @@ endif
+@@ -1226,9 +1226,8 @@ endif
  
  ifdef CONFIG_NO_RANDOM_POOL
  CFLAGS += -DCONFIG_NO_RANDOM_POOL
@@ -122,7 +130,7 @@
  ifeq ($(CONFIG_CTRL_IFACE), y)
 --- a/wpa_supplicant/Android.mk
 +++ b/wpa_supplicant/Android.mk
-@@ -1161,9 +1161,8 @@ endif
+@@ -1191,9 +1191,8 @@ endif
  
  ifdef CONFIG_NO_RANDOM_POOL
  L_CFLAGS += -DCONFIG_NO_RANDOM_POOL
@@ -135,12 +143,13 @@
  ifeq ($(CONFIG_CTRL_IFACE), y)
 --- a/hostapd/Android.mk
 +++ b/hostapd/Android.mk
-@@ -748,11 +748,11 @@ endif
+@@ -775,12 +775,12 @@ endif
  ifdef CONFIG_NO_RANDOM_POOL
  L_CFLAGS += -DCONFIG_NO_RANDOM_POOL
  else
 -OBJS += src/crypto/random.c
 -HOBJS += src/crypto/random.c
+ HOBJS += src/utils/eloop.c
  HOBJS += $(SHA1OBJS)
  HOBJS += src/crypto/md5.c
  endif
@@ -151,7 +160,7 @@
  L_CFLAGS += -DRADIUS_SERVER
 --- a/hostapd/Makefile
 +++ b/hostapd/Makefile
-@@ -755,12 +755,12 @@ endif
+@@ -748,12 +748,12 @@ endif
  ifdef CONFIG_NO_RANDOM_POOL
  CFLAGS += -DCONFIG_NO_RANDOM_POOL
  else
diff --git a/package/hostapd/patches/510-bring_down_interface.patch b/package/hostapd/patches/510-bring_down_interface.patch
index 7481eb152a..e92c122b82 100644
--- a/package/hostapd/patches/510-bring_down_interface.patch
+++ b/package/hostapd/patches/510-bring_down_interface.patch
@@ -1,6 +1,6 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -7144,8 +7144,6 @@ static int wpa_driver_nl80211_set_mode(s
+@@ -7616,8 +7616,6 @@ static int wpa_driver_nl80211_set_mode(s
  			ret = nl80211_set_mode(drv, drv->ifindex, nlmode);
  			if (ret == -EACCES)
  				break;
@@ -9,7 +9,7 @@
  			if (res && !ret)
  				ret = -1;
  			else if (ret != -EBUSY)
-@@ -7161,6 +7159,7 @@ static int wpa_driver_nl80211_set_mode(s
+@@ -7633,6 +7631,7 @@ static int wpa_driver_nl80211_set_mode(s
  			   "interface is down");
  		drv->nlmode = nlmode;
  		drv->ignore_if_down_event = 1;
diff --git a/package/hostapd/patches/520-fix_wps_pin_crash.patch b/package/hostapd/patches/520-fix_wps_pin_crash.patch
index 29d154cef3..80d562c8c2 100644
--- a/package/hostapd/patches/520-fix_wps_pin_crash.patch
+++ b/package/hostapd/patches/520-fix_wps_pin_crash.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -450,6 +450,9 @@ static int hostapd_ctrl_iface_wps_ap_pin
+@@ -479,6 +479,9 @@ static int hostapd_ctrl_iface_wps_ap_pin
  	char *pos;
  	const char *pin_txt;
  
diff --git a/package/hostapd/patches/530-wps_single_auth_enc_type.patch b/package/hostapd/patches/530-wps_single_auth_enc_type.patch
index f05ea35cf9..6f4a6557d5 100644
--- a/package/hostapd/patches/530-wps_single_auth_enc_type.patch
+++ b/package/hostapd/patches/530-wps_single_auth_enc_type.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/wps_hostapd.c
 +++ b/src/ap/wps_hostapd.c
-@@ -873,11 +873,9 @@ int hostapd_init_wps(struct hostapd_data
+@@ -989,11 +989,9 @@ int hostapd_init_wps(struct hostapd_data
  
  		if (conf->rsn_pairwise & WPA_CIPHER_CCMP)
  			wps->encr_types |= WPS_ENCR_AES;
@@ -14,7 +14,7 @@
  		if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK)
  			wps->auth_types |= WPS_AUTH_WPAPSK;
  		if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X)
-@@ -885,7 +883,7 @@ int hostapd_init_wps(struct hostapd_data
+@@ -1001,7 +999,7 @@ int hostapd_init_wps(struct hostapd_data
  
  		if (conf->wpa_pairwise & WPA_CIPHER_CCMP)
  			wps->encr_types |= WPS_ENCR_AES;
diff --git a/package/hostapd/patches/540-dynamic_20_40_mhz.patch b/package/hostapd/patches/540-dynamic_20_40_mhz.patch
index d58358c083..a7b39dbe89 100644
--- a/package/hostapd/patches/540-dynamic_20_40_mhz.patch
+++ b/package/hostapd/patches/540-dynamic_20_40_mhz.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -2495,6 +2495,10 @@ static int hostapd_config_fill(struct ho
+@@ -2474,6 +2474,10 @@ static int hostapd_config_fill(struct ho
  					   "ht_capab", line);
  				errors++;
  			}
@@ -13,7 +13,7 @@
  #endif /* CONFIG_IEEE80211N */
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -501,6 +501,7 @@ struct hostapd_config {
+@@ -515,6 +515,7 @@ struct hostapd_config {
  	int ieee80211n;
  	int secondary_channel;
  	int require_ht;
@@ -31,7 +31,7 @@
  #include "ieee802_11_auth.h"
  #include "vlan_init.h"
  #include "wpa_auth.h"
-@@ -323,6 +324,7 @@ static void hostapd_cleanup_iface_pre(st
+@@ -348,6 +349,7 @@ static void hostapd_cleanup_iface_pre(st
  
  static void hostapd_cleanup_iface_partial(struct hostapd_iface *iface)
  {
@@ -41,7 +41,7 @@
  	os_free(iface->current_rates);
 --- a/src/ap/hostapd.h
 +++ b/src/ap/hostapd.h
-@@ -251,6 +251,9 @@ struct hostapd_iface {
+@@ -269,6 +269,9 @@ struct hostapd_iface {
  	/* Overlapping BSS information */
  	int olbc_ht;
  
@@ -53,7 +53,7 @@
  };
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
-@@ -1220,6 +1220,9 @@ static void handle_beacon(struct hostapd
+@@ -1484,6 +1484,9 @@ static void handle_beacon(struct hostapd
  					     sizeof(mgmt->u.beacon)), &elems,
  				      0);
  
@@ -65,7 +65,7 @@
  
 --- a/src/ap/ieee802_11.h
 +++ b/src/ap/ieee802_11.h
-@@ -78,4 +78,17 @@ int hostapd_update_time_adv(struct hosta
+@@ -81,4 +81,17 @@ int hostapd_update_time_adv(struct hosta
  void hostapd_client_poll_ok(struct hostapd_data *hapd, const u8 *addr);
  u8 * hostapd_eid_bss_max_idle_period(struct hostapd_data *hapd, u8 *eid);
  
@@ -119,7 +119,7 @@
  
  	pos += sizeof(*oper);
  
-@@ -271,3 +276,80 @@ void hostapd_get_ht_capab(struct hostapd
+@@ -270,3 +275,84 @@ void hostapd_get_ht_capab(struct hostapd
  
  	neg_ht_cap->ht_capabilities_info = host_to_le16(cap);
  }
@@ -168,9 +168,13 @@
 +			secondary_channel = hapd->iconf->secondary_channel;
 +
 +		if (hostapd_set_freq(hapd, hapd->iconf->hw_mode, iface->freq,
-+					 hapd->iconf->channel,
-+					 hapd->iconf->ieee80211n,
-+					 secondary_channel)) {
++				     hapd->iconf->channel,
++				     hapd->iconf->ieee80211n,
++				     hapd->iconf->ieee80211ac,
++				     secondary_channel,
++				     hapd->iconf->vht_oper_chwidth,
++				     hapd->iconf->vht_oper_centr_freq_seg0_idx,
++				     hapd->iconf->vht_oper_centr_freq_seg1_idx)) {
 +			wpa_printf(MSG_ERROR, "Could not set channel for "
 +				   "kernel driver");
 +		}
diff --git a/package/hostapd/patches/560-indicate-features.patch b/package/hostapd/patches/560-indicate-features.patch
index d01e18b862..9073bd43a0 100644
--- a/package/hostapd/patches/560-indicate-features.patch
+++ b/package/hostapd/patches/560-indicate-features.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -13,6 +13,7 @@
+@@ -14,6 +14,7 @@
  
  #include "utils/common.h"
  #include "utils/eloop.h"
@@ -8,16 +8,16 @@
  #include "crypto/random.h"
  #include "crypto/tls.h"
  #include "common/version.h"
-@@ -560,7 +561,7 @@ int main(int argc, char *argv[])
+@@ -584,7 +585,7 @@ int main(int argc, char *argv[])
  
  	wpa_supplicant_event = hostapd_wpa_event;
  	for (;;) {
--		c = getopt(argc, argv, "Bde:f:hKP:tvg:");
-+		c = getopt(argc, argv, "Bde:f:hKP:tg:v::");
+-		c = getopt(argc, argv, "Bde:f:hKP:tvg:G:");
++		c = getopt(argc, argv, "Bde:f:hKP:tg:G:v::");
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -592,6 +593,8 @@ int main(int argc, char *argv[])
+@@ -616,6 +617,8 @@ int main(int argc, char *argv[])
  			wpa_debug_timestamp++;
  			break;
  		case 'v':
diff --git a/package/hostapd/patches/580-fix_bss_addr.patch b/package/hostapd/patches/580-fix_bss_addr.patch
deleted file mode 100644
index 3a76668c14..0000000000
--- a/package/hostapd/patches/580-fix_bss_addr.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -7738,7 +7738,7 @@ static int i802_set_wds_sta(void *priv, 
- 		if (!if_nametoindex(name)) {
- 			if (nl80211_create_iface(drv, name,
- 						 NL80211_IFTYPE_AP_VLAN,
--						 NULL, 1) < 0)
-+						 bss->addr, 1) < 0)
- 				return -1;
- 			if (bridge_ifname &&
- 			    linux_br_add_if(drv->global->ioctl_sock,
diff --git a/package/hostapd/patches/590-hostapd_cli_ifdef.patch b/package/hostapd/patches/590-hostapd_cli_ifdef.patch
index 705cef13d5..cbf1e485cd 100644
--- a/package/hostapd/patches/590-hostapd_cli_ifdef.patch
+++ b/package/hostapd/patches/590-hostapd_cli_ifdef.patch
@@ -8,7 +8,7 @@
  "   wps_pin <uuid> <pin> [timeout] [addr]  add WPS Enrollee PIN\n"
  "   wps_check_pin <PIN>  verify PIN checksum\n"
  "   wps_pbc              indicate button pushed to initiate PBC\n"
-@@ -82,7 +81,6 @@ static const char *commands_help =
+@@ -79,7 +78,6 @@ static const char *commands_help =
  #endif /* CONFIG_WPS_NFC */
  "   wps_ap_pin <cmd> [params..]  enable/disable AP PIN\n"
  "   wps_config <SSID> <auth> <encr> <key>  configure AP\n"
@@ -16,7 +16,7 @@
  "   get_config           show current configuration\n"
  "   help                 show this usage help\n"
  "   interface [ifname]   show interfaces/select interface\n"
-@@ -343,7 +341,6 @@ static int hostapd_cli_cmd_sa_query(stru
+@@ -340,7 +338,6 @@ static int hostapd_cli_cmd_sa_query(stru
  #endif /* CONFIG_IEEE80211W */
  
  
@@ -24,15 +24,15 @@
  static int hostapd_cli_cmd_wps_pin(struct wpa_ctrl *ctrl, int argc,
  				   char *argv[])
  {
-@@ -573,7 +570,6 @@ static int hostapd_cli_cmd_wps_config(st
+@@ -559,7 +556,6 @@ static int hostapd_cli_cmd_wps_config(st
  			 ssid_hex, argv[1]);
  	return wpa_ctrl_command(ctrl, buf);
  }
 -#endif /* CONFIG_WPS */
  
  
- static int hostapd_cli_cmd_ess_disassoc(struct wpa_ctrl *ctrl, int argc,
-@@ -799,7 +795,6 @@ static struct hostapd_cli_cmd hostapd_cl
+ static int hostapd_cli_cmd_disassoc_imminent(struct wpa_ctrl *ctrl, int argc,
+@@ -805,7 +801,6 @@ static struct hostapd_cli_cmd hostapd_cl
  #ifdef CONFIG_IEEE80211W
  	{ "sa_query", hostapd_cli_cmd_sa_query },
  #endif /* CONFIG_IEEE80211W */
@@ -40,11 +40,11 @@
  	{ "wps_pin", hostapd_cli_cmd_wps_pin },
  	{ "wps_check_pin", hostapd_cli_cmd_wps_check_pin },
  	{ "wps_pbc", hostapd_cli_cmd_wps_pbc },
-@@ -814,7 +809,6 @@ static struct hostapd_cli_cmd hostapd_cl
+@@ -818,7 +813,6 @@ static struct hostapd_cli_cmd hostapd_cl
  #endif /* CONFIG_WPS_NFC */
  	{ "wps_ap_pin", hostapd_cli_cmd_wps_ap_pin },
  	{ "wps_config", hostapd_cli_cmd_wps_config },
 -#endif /* CONFIG_WPS */
+ 	{ "disassoc_imminent", hostapd_cli_cmd_disassoc_imminent },
  	{ "ess_disassoc", hostapd_cli_cmd_ess_disassoc },
  	{ "get_config", hostapd_cli_cmd_get_config },
- 	{ "help", hostapd_cli_cmd_help },
diff --git a/package/hostapd/patches/601-wpa_supplicant-add-new-config-params-to-be-used-with.patch b/package/hostapd/patches/601-wpa_supplicant-add-new-config-params-to-be-used-with.patch
index ac0d247d76..3345e557f3 100644
--- a/package/hostapd/patches/601-wpa_supplicant-add-new-config-params-to-be-used-with.patch
+++ b/package/hostapd/patches/601-wpa_supplicant-add-new-config-params-to-be-used-with.patch
@@ -22,7 +22,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  #include "common/defs.h"
  
  #define HOSTAPD_CHAN_DISABLED 0x00000001
-@@ -351,6 +352,11 @@ struct wpa_driver_associate_params {
+@@ -363,6 +364,11 @@ struct wpa_driver_associate_params {
  	 */
  	int freq;
  
@@ -44,7 +44,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  #include "config.h"
  
  
-@@ -1463,6 +1464,97 @@ static char * wpa_config_write_p2p_clien
+@@ -1376,6 +1377,97 @@ static char * wpa_config_write_p2p_clien
  
  #endif /* CONFIG_P2P */
  
@@ -142,12 +142,11 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  /* Helper macros for network block parser */
  
  #ifdef OFFSET
-@@ -1638,6 +1730,10 @@ static const struct parse_data ssid_fiel
- #endif /* CONFIG_HT_OVERRIDES */
+@@ -1574,6 +1666,9 @@ static const struct parse_data ssid_fiel
  	{ INT(ap_max_inactivity) },
  	{ INT(dtim_period) },
+ 	{ INT(beacon_int) },
 +	{ INT_RANGE(fixed_freq, 0, 1) },
-+	{ INT_RANGE(beacon_interval, 0, 1000) },
 +	{ FUNC(rates) },
 +	{ FUNC(mcast_rate) },
  };
@@ -163,13 +162,12 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  
  #define MAX_SSID_LEN 32
  
-@@ -529,6 +530,11 @@ struct wpa_ssid {
- 	 * disabled_until - Network block disabled until this time if non-zero
+@@ -600,6 +601,10 @@ struct wpa_ssid {
+ 	 * dereferences since it may not be updated in all cases.
  	 */
- 	struct os_time disabled_until;
+ 	void *parent_cred;
 +
 +	int fixed_freq;
-+	int beacon_interval;
 +	unsigned char rates[NL80211_MAX_SUPP_RATES];
 +	double mcast_rate;
  };
@@ -177,7 +175,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  #endif /* CONFIG_SSID_H */
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -1561,15 +1561,24 @@ void wpa_supplicant_associate(struct wpa
+@@ -1597,15 +1597,24 @@ void wpa_supplicant_associate(struct wpa
  		params.ssid_len = ssid->ssid_len;
  	}
  
@@ -194,7 +192,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
 +			/* Initial channel for IBSS */
 +			params.freq = ssid->frequency;
 +		params.fixed_freq = ssid->fixed_freq;
-+		params.beacon_interval = ssid->beacon_interval;
++		params.beacon_interval = ssid->beacon_int;
 +		i = 0;
 +		while (i < NL80211_MAX_SUPP_RATES) {
 +			params.rates[i] = ssid->rates[i];
diff --git a/package/hostapd/patches/602-driver_nl80211-use-new-parameters-during-ibss-join.patch b/package/hostapd/patches/602-driver_nl80211-use-new-parameters-during-ibss-join.patch
index c426a0bb2d..5a6eb5e447 100644
--- a/package/hostapd/patches/602-driver_nl80211-use-new-parameters-during-ibss-join.patch
+++ b/package/hostapd/patches/602-driver_nl80211-use-new-parameters-during-ibss-join.patch
@@ -10,7 +10,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
 
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -6587,7 +6587,7 @@ static int wpa_driver_nl80211_ibss(struc
+@@ -7040,7 +7040,7 @@ static int wpa_driver_nl80211_ibss(struc
  				   struct wpa_driver_associate_params *params)
  {
  	struct nl_msg *msg;
@@ -19,7 +19,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  	int count = 0;
  
  	wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
-@@ -6620,6 +6620,37 @@ retry:
+@@ -7073,6 +7073,37 @@ retry:
  	wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
  	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
  
diff --git a/package/hostapd/patches/604-wpa_s-support-htmode-param.patch b/package/hostapd/patches/604-wpa_s-support-htmode-param.patch
index 44931f2f3b..267bde8f12 100644
--- a/package/hostapd/patches/604-wpa_s-support-htmode-param.patch
+++ b/package/hostapd/patches/604-wpa_s-support-htmode-param.patch
@@ -16,7 +16,7 @@ Signed-off-by: Antonio Quartulli <ordex@autistici.org>
 
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -356,6 +356,8 @@ struct wpa_driver_associate_params {
+@@ -368,6 +368,8 @@ struct wpa_driver_associate_params {
  	int fixed_freq;
  	unsigned char rates[NL80211_MAX_SUPP_RATES];
  	int mcast_rate;
@@ -27,7 +27,7 @@ Signed-off-by: Antonio Quartulli <ordex@autistici.org>
  	 * bg_scan_period - Background scan period in seconds, 0 to disable
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -6651,6 +6651,22 @@ retry:
+@@ -7104,6 +7104,22 @@ retry:
  		NLA_PUT_U32(msg, NL80211_ATTR_MCAST_RATE, params->mcast_rate);
  	}
  
@@ -52,7 +52,7 @@ Signed-off-by: Antonio Quartulli <ordex@autistici.org>
  		goto nla_put_failure;
 --- a/wpa_supplicant/config.c
 +++ b/wpa_supplicant/config.c
-@@ -1495,6 +1495,71 @@ static char * wpa_config_write_mcast_rat
+@@ -1408,6 +1408,71 @@ static char * wpa_config_write_mcast_rat
  }
  #endif /* NO_CONFIG_WRITE */
  
@@ -124,8 +124,8 @@ Signed-off-by: Antonio Quartulli <ordex@autistici.org>
  static int wpa_config_parse_rates(const struct parse_data *data,
  				  struct wpa_ssid *ssid, int line,
  				  const char *value)
-@@ -1734,6 +1799,7 @@ static const struct parse_data ssid_fiel
- 	{ INT_RANGE(beacon_interval, 0, 1000) },
+@@ -1669,6 +1734,7 @@ static const struct parse_data ssid_fiel
+ 	{ INT_RANGE(fixed_freq, 0, 1) },
  	{ FUNC(rates) },
  	{ FUNC(mcast_rate) },
 +	{ FUNC(htmode) },
@@ -134,8 +134,8 @@ Signed-off-by: Antonio Quartulli <ordex@autistici.org>
  #undef OFFSET
 --- a/wpa_supplicant/config_ssid.h
 +++ b/wpa_supplicant/config_ssid.h
-@@ -535,6 +535,8 @@ struct wpa_ssid {
- 	int beacon_interval;
+@@ -605,6 +605,8 @@ struct wpa_ssid {
+ 	int fixed_freq;
  	unsigned char rates[NL80211_MAX_SUPP_RATES];
  	double mcast_rate;
 +	int ht_set;
@@ -145,7 +145,7 @@ Signed-off-by: Antonio Quartulli <ordex@autistici.org>
  #endif /* CONFIG_SSID_H */
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -1577,6 +1577,8 @@ void wpa_supplicant_associate(struct wpa
+@@ -1613,6 +1613,8 @@ void wpa_supplicant_associate(struct wpa
  			i++;
  		}
  		params.mcast_rate = ssid->mcast_rate;
diff --git a/package/hostapd/patches/610-max_num_sta_probe.patch b/package/hostapd/patches/610-max_num_sta_probe.patch
index e22348c896..141eb5b6e3 100644
--- a/package/hostapd/patches/610-max_num_sta_probe.patch
+++ b/package/hostapd/patches/610-max_num_sta_probe.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
-@@ -413,6 +413,10 @@ void handle_probe_req(struct hostapd_dat
+@@ -455,6 +455,10 @@ void handle_probe_req(struct hostapd_dat
  		return;
  	}
  
diff --git a/package/hostapd/patches/620-scan_wait.patch b/package/hostapd/patches/620-scan_wait.patch
index d9c7f30104..ac2d445a43 100644
--- a/package/hostapd/patches/620-scan_wait.patch
+++ b/package/hostapd/patches/620-scan_wait.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -32,6 +32,8 @@
+@@ -33,6 +33,8 @@
  extern int wpa_debug_level;
  extern int wpa_debug_show_keys;
  extern int wpa_debug_timestamp;
@@ -9,7 +9,7 @@
  
  extern struct wpa_driver_ops *wpa_drivers[];
  
-@@ -146,6 +148,14 @@ static void hostapd_logger_cb(void *ctx,
+@@ -147,6 +149,14 @@ static void hostapd_logger_cb(void *ctx,
  }
  #endif /* CONFIG_NO_HOSTAPD_LOGGER */
  
@@ -24,7 +24,7 @@
  
  /**
   * hostapd_init - Allocate and initialize per-interface data
-@@ -189,6 +199,7 @@ static struct hostapd_iface * hostapd_in
+@@ -190,6 +200,7 @@ static struct hostapd_iface * hostapd_in
  		if (hapd == NULL)
  			goto fail;
  		hapd->msg_ctx = hapd;
@@ -32,7 +32,7 @@
  	}
  
  	return hapd_iface;
-@@ -425,8 +436,6 @@ static void hostapd_global_deinit(const 
+@@ -429,8 +440,6 @@ static void hostapd_global_deinit(const 
  #endif /* CONFIG_NATIVE_WINDOWS */
  
  	eap_server_unregister_methods();
@@ -41,7 +41,7 @@
  }
  
  
-@@ -452,11 +461,6 @@ static int hostapd_global_run(struct hap
+@@ -456,11 +465,6 @@ static int hostapd_global_run(struct hap
  	}
  #endif /* EAP_SERVER_TNC */
  
@@ -53,7 +53,7 @@
  	eloop_run();
  
  	return 0;
-@@ -540,8 +544,7 @@ int main(int argc, char *argv[])
+@@ -564,8 +568,7 @@ int main(int argc, char *argv[])
  	struct hapd_interfaces interfaces;
  	int ret = 1;
  	size_t i;
diff --git a/package/hostapd/patches/630-bool_fix.patch b/package/hostapd/patches/630-bool_fix.patch
new file mode 100644
index 0000000000..510b000027
--- /dev/null
+++ b/package/hostapd/patches/630-bool_fix.patch
@@ -0,0 +1,14 @@
+--- a/src/ap/ieee802_1x.c
++++ b/src/ap/ieee802_1x.c
+@@ -2043,9 +2043,9 @@ void ieee802_1x_notify_pre_auth(struct e
+ }
+ 
+ 
+-static const char * bool_txt(Boolean bool)
++static const char * bool_txt(Boolean bool_val)
+ {
+-	return bool ? "TRUE" : "FALSE";
++	return bool_val ? "TRUE" : "FALSE";
+ }
+ 
+ #ifdef CONFIG_CTRL_IFACE_MIB