diff --git a/package/madwifi/patches/370-wdsvap.patch b/package/madwifi/patches/370-wdsvap.patch
index 94d75f0411..d1f255d6c7 100644
--- a/package/madwifi/patches/370-wdsvap.patch
+++ b/package/madwifi/patches/370-wdsvap.patch
@@ -44,12 +44,13 @@
  
  	if (ic->ic_dev->flags & IFF_RUNNING) {
  		/* needs to disable hardware too */
-@@ -1271,8 +1269,11 @@ ath_vap_create(struct ieee80211com *ic, 
+@@ -1271,8 +1269,12 @@ ath_vap_create(struct ieee80211com *ic, 
  		} else
  			ic_opmode = opmode;
  		break;
 -	case IEEE80211_M_HOSTAP:
  	case IEEE80211_M_WDS:
++		ic_opmode = ic->ic_opmode;
 +		if (!master)
 +			return NULL;
 +		break;
@@ -57,7 +58,7 @@
  		/* permit multiple APs and/or WDS links */
  		/* XXX sta+ap for repeater/bridge application */
  		if ((sc->sc_nvaps != 0) && (ic->ic_opmode == IEEE80211_M_STA))
-@@ -1304,7 +1305,7 @@ ath_vap_create(struct ieee80211com *ic, 
+@@ -1304,7 +1306,7 @@ ath_vap_create(struct ieee80211com *ic, 
  	}
  
  	avp = dev->priv;
@@ -66,7 +67,7 @@
  	/* override with driver methods */
  	vap = &avp->av_vap;
  	avp->av_newstate = vap->iv_newstate;
-@@ -4209,8 +4210,7 @@ ath_calcrxfilter(struct ath_softc *sc)
+@@ -4209,8 +4211,7 @@ ath_calcrxfilter(struct ath_softc *sc)
  	if (ic->ic_opmode == IEEE80211_M_STA ||
  	    sc->sc_opmode == HAL_M_IBSS ||	/* NB: AHDEMO too */
  	    (sc->sc_nostabeacons) || sc->sc_scanning ||
@@ -76,7 +77,7 @@
  		rfilt |= HAL_RX_FILTER_BEACON;
  	if (sc->sc_nmonvaps > 0)
  		rfilt |= (HAL_RX_FILTER_CONTROL | HAL_RX_FILTER_BEACON |
-@@ -9030,8 +9030,6 @@ ath_calibrate(unsigned long arg)
+@@ -9030,8 +9031,6 @@ ath_calibrate(unsigned long arg)
  		 * set sc->beacons if we might need to restart
                   * them after ath_reset. */
  		if (!sc->sc_beacons &&
diff --git a/package/madwifi/patches/374-nbtt_fix.patch b/package/madwifi/patches/374-nbtt_fix.patch
index b3237aef99..5293c34e0d 100644
--- a/package/madwifi/patches/374-nbtt_fix.patch
+++ b/package/madwifi/patches/374-nbtt_fix.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -5483,6 +5483,9 @@ ath_beacon_config(struct ath_softc *sc, 
+@@ -5484,6 +5484,9 @@ ath_beacon_config(struct ath_softc *sc, 
  		ath_beacon_dturbo_config(vap, intval &
  				~(HAL_BEACON_RESET_TSF | HAL_BEACON_ENA));
  #endif
diff --git a/package/madwifi/patches/375-atim_tsf_update.patch b/package/madwifi/patches/375-atim_tsf_update.patch
index 64bd1c1973..35d8e1ab26 100644
--- a/package/madwifi/patches/375-atim_tsf_update.patch
+++ b/package/madwifi/patches/375-atim_tsf_update.patch
@@ -8,7 +8,7 @@
  static int ath_desc_alloc(struct ath_softc *);
  static void ath_desc_free(struct ath_softc *);
  static void ath_desc_swap(struct ath_desc *);
-@@ -2792,6 +2793,72 @@ ath_set_ack_bitrate(struct ath_softc *sc
+@@ -2793,6 +2794,72 @@ ath_set_ack_bitrate(struct ath_softc *sc
  	return 1;
  }
  
@@ -81,7 +81,7 @@
  /*
   * Reset the hardware w/o losing operational state.  This is
   * basically a more efficient way of doing ath_stop, ath_init,
-@@ -5291,6 +5358,7 @@ ath_beacon_config(struct ath_softc *sc, 
+@@ -5292,6 +5359,7 @@ ath_beacon_config(struct ath_softc *sc, 
  	u_int64_t tsf, hw_tsf;
  	u_int32_t tsftu, hw_tsftu;
  	u_int32_t intval, nexttbtt = 0;
@@ -89,7 +89,7 @@
  	int reset_tsf = 0;
  
  	if (vap == NULL)
-@@ -5298,6 +5366,9 @@ ath_beacon_config(struct ath_softc *sc, 
+@@ -5299,6 +5367,9 @@ ath_beacon_config(struct ath_softc *sc, 
  
  	ni = vap->iv_bss;
  
@@ -99,7 +99,7 @@
  	hw_tsf = ath_hal_gettsf64(ah);
  	tsf = le64_to_cpu(ni->ni_tstamp.tsf);
  	hw_tsftu = hw_tsf >> 10;
-@@ -5487,15 +5558,27 @@ ath_beacon_config(struct ath_softc *sc, 
+@@ -5488,15 +5559,27 @@ ath_beacon_config(struct ath_softc *sc, 
  				<= ath_hal_sw_beacon_response_time)
  			nexttbtt += intval;
  		sc->sc_nexttbtt = nexttbtt;
@@ -127,7 +127,7 @@
  	/* We print all debug messages here, in order to preserve the
  	 * time critical aspect of this function */
  	DPRINTF(sc, ATH_DEBUG_BEACON,
-@@ -6398,6 +6481,11 @@ ath_recv_mgmt(struct ieee80211vap * vap,
+@@ -6399,6 +6482,11 @@ ath_recv_mgmt(struct ieee80211vap * vap,
  			DPRINTF(sc, ATH_DEBUG_BEACON, 
  				"Updated beacon timers\n");
  		}
diff --git a/package/madwifi/patches/381-ibss_modes.patch b/package/madwifi/patches/381-ibss_modes.patch
index ec04276dff..f904ed9721 100644
--- a/package/madwifi/patches/381-ibss_modes.patch
+++ b/package/madwifi/patches/381-ibss_modes.patch
@@ -12,7 +12,7 @@
  		break;
  	case IEEE80211_M_AHDEMO:
  	case IEEE80211_M_MONITOR:
-@@ -1454,7 +1457,7 @@ ath_vap_create(struct ieee80211com *ic, 
+@@ -1455,7 +1458,7 @@ ath_vap_create(struct ieee80211com *ic, 
  	 * frames.  Other modes carry over directly to the HAL.
  	 */
  	if (ic->ic_opmode == IEEE80211_M_AHDEMO)
diff --git a/package/madwifi/patches/383-ibss_hostap.patch b/package/madwifi/patches/383-ibss_hostap.patch
index 445f537373..7ededce80c 100644
--- a/package/madwifi/patches/383-ibss_hostap.patch
+++ b/package/madwifi/patches/383-ibss_hostap.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -1451,6 +1451,23 @@ ath_vap_create(struct ieee80211com *ic, 
+@@ -1452,6 +1452,23 @@ ath_vap_create(struct ieee80211com *ic, 
  		sc->sc_nstavaps++;
  	else if (opmode == IEEE80211_M_MONITOR)
  		sc->sc_nmonvaps++;
@@ -24,7 +24,7 @@
  	/*
  	 * Adhoc demo mode is a pseudo mode; to the HAL it's
  	 * just IBSS mode and the driver doesn't use management
-@@ -4278,7 +4295,8 @@ ath_calcrxfilter(struct ath_softc *sc)
+@@ -4279,7 +4296,8 @@ ath_calcrxfilter(struct ath_softc *sc)
  	if (ic->ic_opmode != IEEE80211_M_HOSTAP && (dev->flags & IFF_PROMISC))
  		rfilt |= HAL_RX_FILTER_PROM;
  	if (ic->ic_opmode == IEEE80211_M_STA ||
@@ -34,7 +34,7 @@
  	    (sc->sc_nostabeacons) || sc->sc_scanning ||
  		(ic->ic_opmode == IEEE80211_M_HOSTAP))
  		rfilt |= HAL_RX_FILTER_BEACON;
-@@ -6432,6 +6450,33 @@ ath_capture(struct net_device *dev, cons
+@@ -6433,6 +6451,33 @@ ath_capture(struct net_device *dev, cons
  }
  
  /*
@@ -68,7 +68,7 @@
   * Intercept management frames to collect beacon RSSI data and to do
   * ibss merges. This function is called for all management frames,
   * including those belonging to other BSS.
-@@ -6484,10 +6529,19 @@ ath_recv_mgmt(struct ieee80211vap * vap,
+@@ -6485,10 +6530,19 @@ ath_recv_mgmt(struct ieee80211vap * vap,
  			DPRINTF(sc, ATH_DEBUG_BEACON, 
  				"Updated beacon timers\n");
  		}
@@ -92,7 +92,7 @@
  		}
  		/* NB: Fall Through */
  	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
-@@ -6560,6 +6614,10 @@ ath_recv_mgmt(struct ieee80211vap * vap,
+@@ -6561,6 +6615,10 @@ ath_recv_mgmt(struct ieee80211vap * vap,
  #endif
  			if (do_merge)
  				ieee80211_ibss_merge(ni);
diff --git a/package/madwifi/patches/384-hwdetect.patch b/package/madwifi/patches/384-hwdetect.patch
index aeaf8f6698..61926ccbef 100644
--- a/package/madwifi/patches/384-hwdetect.patch
+++ b/package/madwifi/patches/384-hwdetect.patch
@@ -33,7 +33,7 @@
  	/* Allocate space for dynamically determined maximum VAP count */
  	sc->sc_bslot = 
  		kmalloc(ath_maxvaps * sizeof(struct ieee80211vap*), GFP_KERNEL);
-@@ -1507,6 +1519,28 @@ ath_vap_create(struct ieee80211com *ic, 
+@@ -1508,6 +1520,28 @@ ath_vap_create(struct ieee80211com *ic, 
  	return vap;
  }
  
@@ -62,7 +62,7 @@
  static void
  ath_vap_delete(struct ieee80211vap *vap)
  {
-@@ -10818,6 +10852,12 @@ ath_ioctl(struct net_device *dev, struct
+@@ -10819,6 +10853,12 @@ ath_ioctl(struct net_device *dev, struct
   * is to add module parameters.
   */
  
@@ -75,7 +75,7 @@
  /*
   * Dynamic (i.e. per-device) sysctls.  These are automatically
   * mirrored in /proc/sys.
-@@ -10897,6 +10937,38 @@ ath_sysctl_get_intmit(struct ath_softc *
+@@ -10898,6 +10938,38 @@ ath_sysctl_get_intmit(struct ath_softc *
  }
  
  static int
@@ -114,7 +114,7 @@
  ATH_SYSCTL_DECL(ath_sysctl_halparam, ctl, write, filp, buffer, lenp, ppos)
  {
  	struct ath_softc *sc = ctl->extra1;
-@@ -11176,6 +11248,24 @@ static int maxint = 0x7fffffff;		/* 32-b
+@@ -11177,6 +11249,24 @@ static int maxint = 0x7fffffff;		/* 32-b
  
  static const ctl_table ath_sysctl_template[] = {
  	{ .ctl_name	= CTL_AUTO,
diff --git a/package/madwifi/patches/385-antenna_fix.patch b/package/madwifi/patches/385-antenna_fix.patch
index de4e9fe6bd..3205502fc3 100644
--- a/package/madwifi/patches/385-antenna_fix.patch
+++ b/package/madwifi/patches/385-antenna_fix.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -6665,6 +6665,7 @@ ath_setdefantenna(struct ath_softc *sc, 
+@@ -6666,6 +6666,7 @@ ath_setdefantenna(struct ath_softc *sc, 
  	struct ath_hal *ah = sc->sc_ah;
  
  	/* XXX block beacon interrupts */
diff --git a/package/madwifi/patches/389-autochannel.patch b/package/madwifi/patches/389-autochannel.patch
index 0e4cad873d..b8ca3841c7 100644
--- a/package/madwifi/patches/389-autochannel.patch
+++ b/package/madwifi/patches/389-autochannel.patch
@@ -8,7 +8,7 @@
  
  /* calibrate every 30 secs in steady state but check every second at first. */
  static int ath_calinterval = ATH_SHORT_CALINTERVAL;
-@@ -2579,6 +2580,7 @@ ath_init(struct net_device *dev)
+@@ -2580,6 +2581,7 @@ ath_init(struct net_device *dev)
  	 * be followed by initialization of the appropriate bits
  	 * and then setup of the interrupt mask.
  	 */
@@ -16,7 +16,7 @@
  	sc->sc_curchan.channel = ic->ic_curchan->ic_freq;
  	sc->sc_curchan.channelFlags = ath_chan2flags(ic->ic_curchan);
  	if (!ath_hal_reset(ah, sc->sc_opmode, &sc->sc_curchan, AH_FALSE, &status)) {
-@@ -2913,6 +2915,40 @@ ath_hw_check_atim(struct ath_softc *sc, 
+@@ -2914,6 +2916,40 @@ ath_hw_check_atim(struct ath_softc *sc, 
  }
  
  
@@ -57,7 +57,7 @@
  /*
   * Reset the hardware w/o losing operational state.  This is
   * basically a more efficient way of doing ath_stop, ath_init,
-@@ -2939,6 +2975,7 @@ ath_reset(struct net_device *dev)
+@@ -2940,6 +2976,7 @@ ath_reset(struct net_device *dev)
  	 * Convert to a HAL channel description with the flags
  	 * constrained to reflect the current operating mode.
  	 */
@@ -65,7 +65,7 @@
  	c = ic->ic_curchan;
  	sc->sc_curchan.channel = c->ic_freq;
  	sc->sc_curchan.channelFlags = ath_chan2flags(c);
-@@ -9019,6 +9056,7 @@ ath_chan_set(struct ath_softc *sc, struc
+@@ -9020,6 +9057,7 @@ ath_chan_set(struct ath_softc *sc, struc
  	u_int8_t channel_change_required = 0;
  	struct timeval tv;
  
diff --git a/package/madwifi/patches/391-vap_auth.patch b/package/madwifi/patches/391-vap_auth.patch
index acee271c33..b317be0482 100644
--- a/package/madwifi/patches/391-vap_auth.patch
+++ b/package/madwifi/patches/391-vap_auth.patch
@@ -1,6 +1,6 @@
 --- a/net80211/ieee80211_input.c
 +++ b/net80211/ieee80211_input.c
-@@ -1374,7 +1386,7 @@ ieee80211_auth_open(struct ieee80211_nod
+@@ -1374,7 +1374,7 @@ ieee80211_auth_open(struct ieee80211_nod
  		vap->iv_stats.is_rx_bad_auth++;	/* XXX maybe a unique error? */
  		if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
  			if (ni == vap->iv_bss) {
@@ -9,7 +9,7 @@
  				if (ni == NULL)
  					return;
  				tmpnode = 1;
-@@ -1762,6 +1774,8 @@ ieee80211_ssid_mismatch(struct ieee80211
+@@ -1762,6 +1762,8 @@ ieee80211_ssid_mismatch(struct ieee80211
  }
  
  #define	IEEE80211_VERIFY_SSID(_ni, _ssid) do {				\
@@ -18,7 +18,7 @@
  	if ((_ssid)[1] != 0 &&						\
  	    ((_ssid)[1] != (_ni)->ni_esslen ||				\
  	    memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) {	\
-@@ -1776,6 +1790,8 @@ ieee80211_ssid_mismatch(struct ieee80211
+@@ -1776,6 +1778,8 @@ ieee80211_ssid_mismatch(struct ieee80211
  } while (0)
  #else /* !IEEE80211_DEBUG */
  #define	IEEE80211_VERIFY_SSID(_ni, _ssid) do {				\
diff --git a/package/madwifi/patches/393-mbss_vap_auth.patch b/package/madwifi/patches/393-mbss_vap_auth.patch
index 802f795d3b..ad817a0836 100644
--- a/package/madwifi/patches/393-mbss_vap_auth.patch
+++ b/package/madwifi/patches/393-mbss_vap_auth.patch
@@ -315,7 +315,7 @@
  
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -6577,9 +6577,8 @@ ath_recv_mgmt(struct ieee80211vap * vap,
+@@ -6578,9 +6578,8 @@ ath_recv_mgmt(struct ieee80211vap * vap,
  
  	sc->sc_recv_mgmt(vap, ni_or_null, skb, subtype, rssi, rtsf);
  
@@ -326,7 +326,7 @@
  	         (const struct ieee80211_frame_min *)skb->data);
  	if (ni == NULL) {
  		DPRINTF(sc, ATH_DEBUG_BEACON, "Dropping; node unknown.\n");
-@@ -6734,7 +6733,9 @@ ath_rx_poll(struct net_device *dev, int 
+@@ -6735,7 +6734,9 @@ ath_rx_poll(struct net_device *dev, int 
  	struct ath_desc *ds;
  	struct ath_rx_status *rs;
  	struct sk_buff *skb = NULL;
@@ -336,7 +336,7 @@
  	unsigned int len;
  	int type;
  	u_int phyerr;
-@@ -6889,12 +6890,15 @@ rx_accept:
+@@ -6890,12 +6891,15 @@ rx_accept:
  		skb_trim(skb, skb->len - IEEE80211_CRC_LEN);
  
  		if (mic_fail) {
@@ -354,7 +354,7 @@
  
  			if (ni && ni->ni_table) {
  				ieee80211_check_mic(ni, skb);
-@@ -6956,11 +6960,24 @@ drop_micfail:
+@@ -6957,11 +6961,24 @@ drop_micfail:
  		 * for its use.  If the sender is unknown spam the
  		 * frame; it'll be dropped where it's not wanted.
  		 */
@@ -381,7 +381,7 @@
  			ATH_RSSI_LPF(ATH_NODE(ni)->an_avgrssi, rs->rs_rssi);
  			type = ieee80211_input(ni->ni_vap, ni, skb, rs->rs_rssi, bf->bf_tsf);
  			ieee80211_unref_node(&ni);
-@@ -6969,24 +6986,35 @@ drop_micfail:
+@@ -6970,24 +6987,35 @@ drop_micfail:
  			 * No key index or no entry, do a lookup and
  			 * add the node to the mapping table if possible.
  			 */
diff --git a/package/madwifi/patches/395-ath_ff_unmap.patch b/package/madwifi/patches/395-ath_ff_unmap.patch
index 595c43d5b1..6eaad70714 100644
--- a/package/madwifi/patches/395-ath_ff_unmap.patch
+++ b/package/madwifi/patches/395-ath_ff_unmap.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -13508,7 +13508,7 @@ cleanup_ath_buf(struct ath_softc *sc, st
+@@ -13509,7 +13509,7 @@ cleanup_ath_buf(struct ath_softc *sc, st
  				bus_unmap_single(
  					sc->sc_bdev,
  					bf->bf_skbaddrff[i], 
diff --git a/package/madwifi/patches/406-monitor_r3711.patch b/package/madwifi/patches/406-monitor_r3711.patch
index 64f19e0b8c..d6d4a5b133 100644
--- a/package/madwifi/patches/406-monitor_r3711.patch
+++ b/package/madwifi/patches/406-monitor_r3711.patch
@@ -1,6 +1,6 @@
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -6510,7 +6510,7 @@ ath_capture(struct net_device *dev, cons
+@@ -6511,7 +6511,7 @@ ath_capture(struct net_device *dev, cons
  
  	/* Never copy the SKB, as it is ours on the RX side, and this is the 
  	 * last process on the TX side and we only modify our own headers. */
@@ -9,7 +9,7 @@
  	if (tskb == NULL) {
  		DPRINTF(sc, ATH_DEBUG_ANY,
  			"Dropping; ath_skb_removepad failed!\n");
-@@ -6518,6 +6518,8 @@ ath_capture(struct net_device *dev, cons
+@@ -6519,6 +6519,8 @@ ath_capture(struct net_device *dev, cons
  	}
  	
  	ieee80211_input_monitor(ic, tskb, bf, tx, tsf, sc);
diff --git a/package/madwifi/patches/408-changeset_r3337.patch b/package/madwifi/patches/408-changeset_r3337.patch
index 00f0955fa4..e1724725f5 100644
--- a/package/madwifi/patches/408-changeset_r3337.patch
+++ b/package/madwifi/patches/408-changeset_r3337.patch
@@ -10,7 +10,7 @@
  Please let us know if you think your name should be mentioned here!
 --- a/ath/if_ath.c
 +++ b/ath/if_ath.c
-@@ -3129,7 +3129,7 @@ ath_tx_startraw(struct net_device *dev, 
+@@ -3130,7 +3130,7 @@ ath_tx_startraw(struct net_device *dev, 
  	struct ath_softc *sc = dev->priv;
  	struct ath_hal *ah = sc->sc_ah;
  	struct ieee80211_phy_params *ph = (struct ieee80211_phy_params *)
diff --git a/package/madwifi/patches/450-new_hal.patch b/package/madwifi/patches/450-new_hal.patch
index 7494f0d4a0..625fd7640b 100644
--- a/package/madwifi/patches/450-new_hal.patch
+++ b/package/madwifi/patches/450-new_hal.patch
@@ -108,7 +108,7 @@
  	/*
  	 * Check if the MAC has multi-rate retry support.
  	 * We do this by trying to setup a fake extended
-@@ -7552,7 +7560,7 @@ ath_txq_setup(struct ath_softc *sc, int 
+@@ -7553,7 +7561,7 @@ ath_txq_setup(struct ath_softc *sc, int 
  	if (qtype == HAL_TX_QUEUE_UAPSD)
  		qi.tqi_qflags = HAL_TXQ_TXDESCINT_ENABLE;
  	else