diff --git a/package/hostapd/Makefile b/package/hostapd/Makefile
index 6731ccb54c..6a82170fb9 100644
--- a/package/hostapd/Makefile
+++ b/package/hostapd/Makefile
@@ -8,16 +8,16 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hostapd
-PKG_VERSION:=20110402
+PKG_VERSION:=20110421
 PKG_RELEASE:=1
-PKG_REV:=4378fc14ebfb355705e7674bf347ea659bcd77bc
+PKG_REV:=0725cc7b7efc434910e89865c42eda7ce61bbf08
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=git://w1.fi/srv/git/hostap.git
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
 PKG_SOURCE_VERSION:=$(PKG_REV)
 PKG_SOURCE_PROTO:=git
-PKG_MIRROR_MD5SUM:=fd5e29bbfcb89a4e60fef633bd4efa94
+PKG_MIRROR_MD5SUM:=fa3f3182dc82f40c88398822ebfe693e
 
 PKG_BUILD_DEPENDS:= \
 	PACKAGE_kmod-madwifi:madwifi \
diff --git a/package/hostapd/patches/330-multicall_bridge_fix.patch b/package/hostapd/patches/330-multicall_bridge_fix.patch
index b67012242a..76a42431e8 100644
--- a/package/hostapd/patches/330-multicall_bridge_fix.patch
+++ b/package/hostapd/patches/330-multicall_bridge_fix.patch
@@ -34,7 +34,7 @@
  	return 0;
  }
  
-@@ -5623,8 +5636,6 @@ static void *i802_init(struct hostapd_da
+@@ -5638,8 +5651,6 @@ static void *i802_init(struct hostapd_da
  		br_ifindex = 0;
  	}
  
diff --git a/package/hostapd/patches/510-multicall.patch b/package/hostapd/patches/510-multicall.patch
index ec4fb9b9b0..81a18b90e3 100644
--- a/package/hostapd/patches/510-multicall.patch
+++ b/package/hostapd/patches/510-multicall.patch
@@ -132,7 +132,7 @@
  wpa_cli.exe: wpa_cli
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -3186,8 +3186,8 @@ union wpa_event_data {
+@@ -3187,8 +3187,8 @@ union wpa_event_data {
   * Driver wrapper code should call this function whenever an event is received
   * from the driver.
   */
@@ -145,7 +145,7 @@
  /*
 --- a/src/ap/drv_callbacks.c
 +++ b/src/ap/drv_callbacks.c
-@@ -443,8 +443,8 @@ static void hostapd_event_eapol_rx(struc
+@@ -448,8 +448,8 @@ static void hostapd_event_eapol_rx(struc
  }
  
  
@@ -179,7 +179,7 @@
  	for (;;) {
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -1734,8 +1734,8 @@ static void wpa_supplicant_event_unprot_
+@@ -1741,8 +1741,8 @@ static void wpa_supplicant_event_unprot_
  }
  
  
@@ -192,7 +192,7 @@
  	u16 reason_code = 0;
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2311,6 +2311,9 @@ static void wpa_supplicant_deinit_iface(
+@@ -2314,6 +2314,9 @@ static void wpa_supplicant_deinit_iface(
  		wpa_drv_deinit(wpa_s);
  }
  
@@ -202,7 +202,7 @@
  
  /**
   * wpa_supplicant_add_iface - Add a new network interface
-@@ -2494,6 +2497,7 @@ struct wpa_global * wpa_supplicant_init(
+@@ -2497,6 +2500,7 @@ struct wpa_global * wpa_supplicant_init(
  	wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
  #endif /* CONFIG_NO_WPA_MSG */
  
diff --git a/package/hostapd/patches/530-rescan_immediately.patch b/package/hostapd/patches/530-rescan_immediately.patch
index 0c8d846109..01a2ecdef1 100644
--- a/package/hostapd/patches/530-rescan_immediately.patch
+++ b/package/hostapd/patches/530-rescan_immediately.patch
@@ -1,11 +1,11 @@
---- a/wpa_supplicant/events.c
-+++ b/wpa_supplicant/events.c
-@@ -958,7 +958,7 @@ static int _wpa_supplicant_event_scan_re
- 			wpa_dbg(wpa_s, MSG_DEBUG, "Setup a new network");
- 			wpa_supplicant_associate(wpa_s, NULL, ssid);
- 		} else {
--			int timeout_sec = 5;
-+			int timeout_sec = 0;
- 			int timeout_usec = 0;
- #ifdef CONFIG_P2P
- 			if (wpa_s->p2p_in_provisioning) {
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -2070,7 +2070,7 @@ static struct wpa_supplicant * wpa_suppl
+ 	if (wpa_s == NULL)
+ 		return NULL;
+ 	wpa_s->scan_req = 1;
+-	wpa_s->scan_interval = 5;
++	wpa_s->scan_interval = 0;
+ 	wpa_s->new_connection = 1;
+ 	wpa_s->parent = wpa_s;
+ 
diff --git a/package/hostapd/patches/540-optional_rfkill.patch b/package/hostapd/patches/540-optional_rfkill.patch
index 4c9bf90747..ba5d806441 100644
--- a/package/hostapd/patches/540-optional_rfkill.patch
+++ b/package/hostapd/patches/540-optional_rfkill.patch
@@ -115,7 +115,7 @@
  
  	eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
  
-@@ -5693,7 +5711,9 @@ static void *i802_init(struct hostapd_da
+@@ -5708,7 +5726,9 @@ static void *i802_init(struct hostapd_da
  
  failed:
  	nl80211_remove_monitor_interface(drv);
diff --git a/package/hostapd/patches/551-nl80211_del_beacon_bss.patch b/package/hostapd/patches/551-nl80211_del_beacon_bss.patch
index 43c550a210..a4cf619f42 100644
--- a/package/hostapd/patches/551-nl80211_del_beacon_bss.patch
+++ b/package/hostapd/patches/551-nl80211_del_beacon_bss.patch
@@ -44,7 +44,7 @@
  
  /**
   * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
-@@ -6566,4 +6584,5 @@ const struct wpa_driver_ops wpa_driver_n
+@@ -6581,4 +6599,5 @@ const struct wpa_driver_ops wpa_driver_n
  	.set_intra_bss = nl80211_set_intra_bss,
  	.set_param = nl80211_set_param,
  	.get_radio_name = nl80211_get_radio_name,
@@ -52,7 +52,7 @@
  };
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -2240,6 +2240,8 @@ struct wpa_driver_ops {
+@@ -2241,6 +2241,8 @@ struct wpa_driver_ops {
  	 * @signal_info: Connection info structure
           */
  	int (*signal_poll)(void *priv, struct wpa_signal_info *signal_info);
diff --git a/package/hostapd/patches/553-ap_sta_support.patch b/package/hostapd/patches/553-ap_sta_support.patch
index 734aa04344..dfc24c42c4 100644
--- a/package/hostapd/patches/553-ap_sta_support.patch
+++ b/package/hostapd/patches/553-ap_sta_support.patch
@@ -107,7 +107,7 @@
  		wpa_s->new_connection = 1;
  		wpa_drv_set_operstate(wpa_s, 0);
  #ifndef IEEE8021X_EAPOL
-@@ -2154,6 +2211,21 @@ static int wpa_supplicant_init_iface(str
+@@ -2157,6 +2214,21 @@ static int wpa_supplicant_init_iface(str
  		os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
  			   sizeof(wpa_s->bridge_ifname));
  	}
diff --git a/package/hostapd/patches/560-disable_ctrl_iface_mib.patch b/package/hostapd/patches/560-disable_ctrl_iface_mib.patch
index e4a2c8ed63..3146d3c777 100644
--- a/package/hostapd/patches/560-disable_ctrl_iface_mib.patch
+++ b/package/hostapd/patches/560-disable_ctrl_iface_mib.patch
@@ -55,7 +55,7 @@
  
 --- a/wpa_supplicant/ctrl_iface.c
 +++ b/wpa_supplicant/ctrl_iface.c
-@@ -2896,6 +2896,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -2927,6 +2927,7 @@ char * wpa_supplicant_ctrl_iface_process
  			reply_len = -1;
  	} else if (os_strncmp(buf, "NOTE ", 5) == 0) {
  		wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
@@ -63,7 +63,7 @@
  	} else if (os_strcmp(buf, "MIB") == 0) {
  		reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
  		if (reply_len >= 0) {
-@@ -2907,6 +2908,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -2938,6 +2939,7 @@ char * wpa_supplicant_ctrl_iface_process
  			else
  				reply_len += res;
  		}
@@ -71,7 +71,7 @@
  	} else if (os_strncmp(buf, "STATUS", 6) == 0) {
  		reply_len = wpa_supplicant_ctrl_iface_status(
  			wpa_s, buf + 6, reply, reply_size);
-@@ -3200,6 +3202,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -3243,6 +3245,7 @@ char * wpa_supplicant_ctrl_iface_process
  		reply_len = wpa_supplicant_ctrl_iface_bss(
  			wpa_s, buf + 4, reply, reply_size);
  #ifdef CONFIG_AP
@@ -79,7 +79,7 @@
  	} else if (os_strcmp(buf, "STA-FIRST") == 0) {
  		reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
  	} else if (os_strncmp(buf, "STA ", 4) == 0) {
-@@ -3208,6 +3211,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -3251,6 +3254,7 @@ char * wpa_supplicant_ctrl_iface_process
  	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
  		reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
  						   reply_size);
@@ -105,7 +105,7 @@
 +#endif
 --- a/src/ap/ieee802_1x.c
 +++ b/src/ap/ieee802_1x.c
-@@ -1876,6 +1876,7 @@ static const char * bool_txt(Boolean boo
+@@ -1895,6 +1895,7 @@ static const char * bool_txt(Boolean boo
  	return bool ? "TRUE" : "FALSE";
  }
  
@@ -113,7 +113,7 @@
  
  int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
  {
-@@ -2027,6 +2028,7 @@ int ieee802_1x_get_mib_sta(struct hostap
+@@ -2046,6 +2047,7 @@ int ieee802_1x_get_mib_sta(struct hostap
  	return len;
  }
  
diff --git a/package/hostapd/patches/710-bring_down_interface.patch b/package/hostapd/patches/710-bring_down_interface.patch
index 9ee9925d6f..20e226471b 100644
--- a/package/hostapd/patches/710-bring_down_interface.patch
+++ b/package/hostapd/patches/710-bring_down_interface.patch
@@ -1,6 +1,6 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -4904,9 +4904,6 @@ static int wpa_driver_nl80211_set_mode(v
+@@ -4919,9 +4919,6 @@ static int wpa_driver_nl80211_set_mode(v
  			/* Try to set the mode again while the interface is
  			 * down */
  			ret = nl80211_set_mode(drv, drv->ifindex, nlmode);
@@ -10,7 +10,7 @@
  			if (!ret)
  				break;
  		} else
-@@ -4919,6 +4916,8 @@ static int wpa_driver_nl80211_set_mode(v
+@@ -4934,6 +4931,8 @@ static int wpa_driver_nl80211_set_mode(v
  		wpa_printf(MSG_DEBUG, "nl80211: Mode change succeeded while "
  			   "interface is down");
  		drv->nlmode = nlmode;
diff --git a/package/hostapd/patches/730-fix_wds_bridge_handling.patch b/package/hostapd/patches/730-fix_wds_bridge_handling.patch
index c5c8606d85..78d13dda9f 100644
--- a/package/hostapd/patches/730-fix_wds_bridge_handling.patch
+++ b/package/hostapd/patches/730-fix_wds_bridge_handling.patch
@@ -1,6 +1,6 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -5487,6 +5487,9 @@ static int i802_set_wds_sta(void *priv, 
+@@ -5502,6 +5502,9 @@ static int i802_set_wds_sta(void *priv, 
  		linux_set_iface_flags(drv->ioctl_sock, name, 1);
  		return i802_set_sta_vlan(priv, addr, name, 0);
  	} else {
@@ -10,7 +10,7 @@
  		i802_set_sta_vlan(priv, addr, bss->ifname, 0);
  		return wpa_driver_nl80211_if_remove(priv, WPA_IF_AP_VLAN,
  						    name);
-@@ -5927,14 +5930,14 @@ static int wpa_driver_nl80211_if_remove(
+@@ -5942,14 +5945,14 @@ static int wpa_driver_nl80211_if_remove(
  		return -1;
  
  #ifdef HOSTAPD
diff --git a/package/hostapd/patches/800-dynamic_20_40_mhz.patch b/package/hostapd/patches/800-dynamic_20_40_mhz.patch
new file mode 100644
index 0000000000..4fc677ef1c
--- /dev/null
+++ b/package/hostapd/patches/800-dynamic_20_40_mhz.patch
@@ -0,0 +1,182 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -1901,6 +1901,10 @@ struct hostapd_config * hostapd_config_r
+ 					   "ht_capab", line);
+ 				errors++;
+ 			}
++		} else if (os_strcmp(buf, "dynamic_ht40") == 0) {
++			conf->dynamic_ht40 = atoi(pos);
++			if (conf->dynamic_ht40 == 1)
++				conf->dynamic_ht40 = 1500;
+ 		} else if (os_strcmp(buf, "require_ht") == 0) {
+ 			conf->require_ht = atoi(pos);
+ #endif /* CONFIG_IEEE80211N */
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -393,6 +393,7 @@ struct hostapd_config {
+ 	int ieee80211n;
+ 	int secondary_channel;
+ 	int require_ht;
++	int dynamic_ht40;
+ };
+ 
+ 
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -285,6 +285,7 @@ static void hostapd_cleanup_iface_pre(st
+  */
+ static void hostapd_cleanup_iface(struct hostapd_iface *iface)
+ {
++	hostapd_deinit_ht(iface);
+ 	hostapd_free_hw_features(iface->hw_features, iface->num_hw_features);
+ 	iface->hw_features = NULL;
+ 	os_free(iface->current_rates);
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -220,6 +220,9 @@ struct hostapd_iface {
+ 	/* Overlapping BSS information */
+ 	int olbc_ht;
+ 
++	int force_20mhz;
++	struct os_time last_20mhz_trigger;
++
+ 	u16 ht_op_mode;
+ 	void (*scan_cb)(struct hostapd_iface *iface);
+ 
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -1242,6 +1242,9 @@ static void handle_beacon(struct hostapd
+ 					     sizeof(mgmt->u.beacon)), &elems,
+ 				      0);
+ 
++	if (!elems.ht_capabilities)
++		hostapd_trigger_20mhz(hapd->iface);
++
+ 	ap_list_process_beacon(hapd->iface, mgmt, &elems, fi);
+ }
+ 
+--- a/src/ap/ieee802_11.h
++++ b/src/ap/ieee802_11.h
+@@ -65,4 +65,17 @@ void hostapd_tx_status(struct hostapd_da
+ void ieee802_11_rx_from_unknown(struct hostapd_data *hapd, const u8 *src,
+ 				int wds);
+ 
++#ifdef CONFIG_IEEE80211N
++void hostapd_trigger_20mhz(struct hostapd_iface *iface);
++void hostapd_deinit_ht(struct hostapd_iface *iface);
++
++#else
++static inline void hostapd_deinit_ht(struct hostapd_iface *iface)
++{
++}
++static inline void hostapd_trigger_20mhz(struct hostapd_iface *iface)
++{
++}
++#endif /* CONFIG_IEEE80211N */
++
+ #endif /* IEEE802_11_H */
+--- a/src/ap/ieee802_11_ht.c
++++ b/src/ap/ieee802_11_ht.c
+@@ -70,12 +70,15 @@ u8 * hostapd_eid_ht_operation(struct hos
+ 
+ 	oper->control_chan = hapd->iconf->channel;
+ 	oper->operation_mode = host_to_le16(hapd->iface->ht_op_mode);
+-	if (hapd->iconf->secondary_channel == 1)
+-		oper->ht_param |= HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE |
+-			HT_INFO_HT_PARAM_REC_TRANS_CHNL_WIDTH;
+-	if (hapd->iconf->secondary_channel == -1)
+-		oper->ht_param |= HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW |
+-			HT_INFO_HT_PARAM_REC_TRANS_CHNL_WIDTH;
++
++	if (!hapd->iface->force_20mhz) {
++		if (hapd->iconf->secondary_channel == 1)
++			oper->ht_param |= HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE |
++				HT_INFO_HT_PARAM_REC_TRANS_CHNL_WIDTH;
++		if (hapd->iconf->secondary_channel == -1)
++			oper->ht_param |= HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW |
++				HT_INFO_HT_PARAM_REC_TRANS_CHNL_WIDTH;
++	}
+ 
+ 	pos += sizeof(*oper);
+ 
+@@ -265,3 +268,80 @@ void hostapd_get_ht_capab(struct hostapd
+ 
+ 	neg_ht_cap->ht_capabilities_info = host_to_le16(cap);
+ }
++
++static int hostapd_set_force_20mhz(struct hostapd_iface *iface);
++
++static int hostapd_restore_40mhz(void *eloop_data, void *user_ctx)
++{
++	struct hostapd_iface *iface = eloop_data;
++	struct os_time time;
++	int timeout;
++
++	if (!iface->last_20mhz_trigger.sec)
++	    return;
++
++	os_get_time(&time);
++	timeout = iface->last_20mhz_trigger.sec + iface->conf->dynamic_ht40 -
++		  time.sec;
++
++	if (timeout > 0) {
++		eloop_register_timeout(timeout, 0, hostapd_restore_40mhz,
++				       iface, NULL);
++		return;
++	}
++
++	iface->last_20mhz_trigger.sec = 0;
++	iface->last_20mhz_trigger.usec = 0;
++
++	iface->force_20mhz = 0;
++	hostapd_set_force_20mhz(iface);
++}
++
++static int hostapd_set_force_20mhz(struct hostapd_iface *iface)
++{
++	int secondary_channel;
++	int i;
++
++	ieee802_11_set_beacons(iface);
++
++	for (i = 0; i < iface->num_bss; i++) {
++		struct hostapd_data *hapd = iface->bss[i];
++
++		if (iface->force_20mhz)
++			secondary_channel = 0;
++		else
++			secondary_channel = hapd->iconf->secondary_channel;
++
++		if (hostapd_set_freq(hapd, hapd->iconf->hw_mode, iface->freq,
++					 hapd->iconf->channel,
++					 hapd->iconf->ieee80211n,
++					 secondary_channel)) {
++			wpa_printf(MSG_ERROR, "Could not set channel for "
++				   "kernel driver");
++		}
++	}
++}
++
++void hostapd_deinit_ht(struct hostapd_iface *iface)
++{
++	eloop_cancel_timeout(hostapd_restore_40mhz, iface, NULL);
++}
++
++void hostapd_trigger_20mhz(struct hostapd_iface *iface)
++{
++	if (!iface->conf->dynamic_ht40)
++		return;
++
++	if (!iface->force_20mhz) {
++		iface->force_20mhz = 1;
++		hostapd_set_force_20mhz(iface);
++	}
++
++	if (!iface->last_20mhz_trigger.sec) {
++		eloop_cancel_timeout(hostapd_restore_40mhz, iface, NULL);
++		eloop_register_timeout(iface->conf->dynamic_ht40, 0,
++				       hostapd_restore_40mhz, iface, NULL);
++	}
++
++	os_get_time(&iface->last_20mhz_trigger);
++}