diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index 368612605..a7472ee77 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -10,10 +10,11 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=mac80211
 
-PKG_VERSION:=5.10.85-1
-PKG_RELEASE:=1
-PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v5.10.85/
-PKG_HASH:=0b5f2d5acf572c448f102a186aaccd8b77bda182ac5166c7b2e3217870162784
+PKG_VERSION:=6.1.24
+PKG_RELEASE:=4
+# PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v5.15.58/
+PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources/
+PKG_HASH:=5d39aca7e34c33cb9b3e366117b2e86841b7bdd37933679d6b1e61be6b150648
 
 PKG_SOURCE:=backports-$(PKG_VERSION).tar.xz
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/backports-$(PKG_VERSION)
@@ -22,16 +23,10 @@ PKG_BUILD_PARALLEL:=1
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 
 PKG_DRIVERS = \
-	adm8211 \
-	airo \
-	hermes hermes-pci hermes-pcmcia hermes-plx\
-	lib80211 \
 	mac80211-hwsim \
 	mt7601u \
-	p54-common p54-pci p54-usb \
 	rsi91x rsi91x-usb rsi91x-sdio\
-	wlcore wl12xx wl18xx \
-	zd1211rw
+	wlcore wl12xx wl18xx
 
 PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_kmod-mac80211 \
@@ -57,7 +52,6 @@ config_package=$(if $(CONFIG_PACKAGE_kmod-$(1)),m)
 
 config-y:= \
 	WLAN \
-	CFG80211_WEXT \
 	CFG80211_CERTIFICATION_ONUS \
 	MAC80211_RC_MINSTREL \
 	MAC80211_RC_MINSTREL_HT \
@@ -98,7 +92,7 @@ PKG_CONFIG_DEPENDS += \
 define KernelPackage/cfg80211
   $(call KernelPackage/mac80211/Default)
   TITLE:=cfg80211 - wireless configuration API
-  DEPENDS+= +iw +wireless-regdb
+  DEPENDS+= +iw +iwinfo +wireless-regdb +USE_RFKILL:kmod-rfkill
   ABI_VERSION:=$(PKG_VERSION)-$(PKG_RELEASE)
   FILES:= \
 	$(PKG_BUILD_DIR)/compat/compat.ko \
@@ -127,7 +121,7 @@ define KernelPackage/mac80211
   $(call KernelPackage/mac80211/Default)
   TITLE:=Linux 802.11 Wireless Networking Stack
   # +kmod-crypto-cmac is a runtime only dependency of net/mac80211/aes_cmac.c
-  DEPENDS+= +kmod-cfg80211 +hostapd-common
+  DEPENDS+= +kmod-cfg80211 +kmod-crypto-cmac +kmod-crypto-ccm +kmod-crypto-gcm +hostapd-common
   KCONFIG:=\
 	CONFIG_AVERAGE=y
   FILES:= $(PKG_BUILD_DIR)/net/mac80211/mac80211.ko
@@ -166,106 +160,10 @@ define KernelPackage/mac80211/description
 Generic IEEE 802.11 Networking Stack (mac80211)
 endef
 
-define KernelPackage/adm8211
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=ADMTek 8211 support
-  DEPENDS+=@PCI_SUPPORT +kmod-mac80211 +kmod-eeprom-93cx6
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/admtek/adm8211.ko
-  AUTOLOAD:=$(call AutoProbe,adm8211)
-endef
-
-define KernelPackage/airo
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Cisco Aironet driver
-  DEPENDS+=@PCI_SUPPORT +@DRIVER_WEXT_SUPPORT +kmod-cfg80211 @TARGET_x86 @BROKEN
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/cisco/airo.ko
-  AUTOLOAD:=$(call AutoProbe,airo)
-endef
-
-define KernelPackage/airo/description
- Kernel support for Cisco Aironet cards
-endef
-
-define KernelPackage/hermes
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Hermes 802.11b chipset support
-  DEPENDS:=@PCI_SUPPORT||PCMCIA_SUPPORT +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT +kmod-crypto-michael-mic
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco.ko
-  AUTOLOAD:=$(call AutoProbe,orinoco)
-endef
-
-define KernelPackage/hermes/description
- Kernel support for Hermes 802.11b chipsets
-endef
-
-define KernelPackage/hermes-pci
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Intersil Prism 2.5 PCI support
-  DEPENDS:=@PCI_SUPPORT +kmod-hermes
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco_pci.ko
-  AUTOLOAD:=$(call AutoProbe,orinoco_pci)
-endef
-
-define KernelPackage/hermes-pci/description
- Kernel modules for Intersil Prism 2.5 PCI support
-endef
-
-define KernelPackage/hermes-plx
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=PLX9052 based PCI adaptor
-  DEPENDS:=@PCI_SUPPORT +kmod-hermes
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco_plx.ko
-  AUTOLOAD:=$(call AutoProbe,orinoco_plx)
-endef
-
-define KernelPackage/hermes-plx/description
- Kernel modules for Hermes in PLX9052 based PCI adaptors
-endef
-
-define KernelPackage/hermes-pcmcia
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Hermes based PCMCIA adaptors
-  DEPENDS:=@PCMCIA_SUPPORT +kmod-hermes +kmod-pcmcia-core
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/orinoco/orinoco_cs.ko
-  AUTOLOAD:=$(call AutoProbe,orinoco_cs)
-endef
-
-define KernelPackage/hermes-pcmcia/description
- Kernel modules for Hermes based PCMCIA adaptors
-endef
-
-
-define KernelPackage/lib80211
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=802.11 Networking stack
-  DEPENDS:=+kmod-cfg80211 +kmod-crypto-hash +kmod-crypto-ccm
-  FILES:= \
-	$(PKG_BUILD_DIR)/net/wireless/lib80211.ko \
-	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_wep.ko \
-	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_ccmp.ko \
-	$(PKG_BUILD_DIR)/net/wireless/lib80211_crypt_tkip.ko
-  AUTOLOAD:=$(call AutoProbe, \
-	lib80211 \
-	lib80211_crypt_wep \
-	lib80211_crypt_ccmp \
-	lib80211_crypt_tkip \
-  )
-endef
-
-define KernelPackage/lib80211/description
- Kernel modules for 802.11 Networking stack
- Includes:
- - lib80211
- - lib80211_crypt_wep
- - lib80211_crypt_tkip
- - lib80211_crytp_ccmp
-endef
-
-
 define KernelPackage/mac80211-hwsim
   $(call KernelPackage/mac80211/Default)
   TITLE:=mac80211 HW simulation device
-  DEPENDS+= +kmod-mac80211 +@DRIVER_11AC_SUPPORT +@DRIVER_11N_SUPPORT
+  DEPENDS+= +kmod-mac80211 +@DRIVER_11AX_SUPPORT +@DRIVER_11AC_SUPPORT
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mac80211_hwsim.ko
   AUTOLOAD:=$(call AutoProbe,mac80211_hwsim)
 endef
@@ -274,47 +172,15 @@ endef
 define KernelPackage/mt7601u
   $(call KernelPackage/mac80211/Default)
   TITLE:=MT7601U-based USB dongles Wireless Driver
-  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT @USB_SUPPORT +kmod-usb-core +mt7601u-firmware
+  DEPENDS+= +kmod-mac80211 @USB_SUPPORT +kmod-usb-core +mt7601u-firmware
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mediatek/mt7601u/mt7601u.ko
   AUTOLOAD:=$(call AutoProbe,mt7601u)
 endef
 
-define KernelPackage/p54/Default
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Prism54 Drivers
-endef
-
-define KernelPackage/p54/description
-  Kernel module for Prism54 chipsets (mac80211)
-endef
-
-define KernelPackage/p54-common
-  $(call KernelPackage/p54/Default)
-  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211 +kmod-lib-crc-ccitt
-  TITLE+= (COMMON)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54common.ko
-endef
-
-define KernelPackage/p54-pci
-  $(call KernelPackage/p54/Default)
-  TITLE+= (PCI)
-  DEPENDS+= @PCI_SUPPORT +kmod-p54-common +p54-pci-firmware
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54pci.ko
-  AUTOLOAD:=$(call AutoProbe,p54pci)
-endef
-
-define KernelPackage/p54-usb
-  $(call KernelPackage/p54/Default)
-  TITLE+= (USB)
-  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-p54-common +p54-usb-firmware
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intersil/p54/p54usb.ko
-  AUTOLOAD:=$(call AutoProbe,p54usb)
-endef
-
 define KernelPackage/rsi91x
   $(call KernelPackage/mac80211/Default)
   TITLE:=Redpine Signals Inc 91x WLAN driver support
-  DEPENDS+= +kmod-mac80211 +rs9113-firmware +@DRIVER_11N_SUPPORT
+  DEPENDS+= +kmod-mac80211 +rs9113-firmware
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/rsi/rsi_91x.ko
 endef
 
@@ -338,7 +204,7 @@ endef
 define KernelPackage/wlcore
   $(call KernelPackage/mac80211/Default)
   TITLE:=TI common driver part
-  DEPENDS+= +kmod-mmc +kmod-mac80211 +@DRIVER_11N_SUPPORT
+  DEPENDS+= +kmod-mmc +kmod-mac80211
   FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wlcore/wlcore.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ti/wlcore/wlcore_sdio.ko
@@ -376,23 +242,6 @@ define KernelPackage/wl18xx/description
 endef
 
 
-ZD1211FW_NAME:=zd1211-firmware
-ZD1211FW_VERSION:=1.4
-define Download/zd1211rw
-  FILE:=$(ZD1211FW_NAME)-$(ZD1211FW_VERSION).tar.bz2
-  URL:=@SF/zd1211/
-  HASH:=866308f6f59f7075f075d4959dff2ede47735c751251fecd1496df1ba4d338e1
-endef
-$(eval $(call Download,zd1211rw))
-
-define KernelPackage/zd1211rw
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Zydas ZD1211 support
-  DEPENDS+= @USB_SUPPORT +kmod-usb-core +kmod-mac80211
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/zydas/zd1211rw/zd1211rw.ko
-  AUTOLOAD:=$(call AutoProbe,zd1211rw)
-endef
-
 ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
   config-y += \
 	CFG80211_DEBUGFS \
@@ -404,30 +253,14 @@ ifdef CONFIG_PACKAGE_MAC80211_TRACING
 	IWLWIFI_DEVICE_TRACING
 endif
 
-config-$(call config_package,lib80211) += LIB80211 LIB80211_CRYPT_WEP LIB80211_CRYPT_CCMP LIB80211_CRYPT_TKIP
-
-config-$(call config_package,airo) += AIRO
-
 config-$(call config_package,mac80211-hwsim) += MAC80211_HWSIM
 config-$(call config_package,mt7601u) += MT7601U
 config-y += WL_MEDIATEK
 
-config-$(call config_package,p54-common) += P54_COMMON
-config-$(call config_package,p54-pci) += P54_PCI
-config-$(call config_package,p54-usb) += P54_USB
-
-config-$(call config_package,hermes) += HERMES
-config-$(call config_package,hermes-pci) += PCI_HERMES
-config-$(call config_package,hermes-plx) += PLX_HERMES
-config-$(call config_package,hermes-pcmcia) += PCMCIA_HERMES
-config-y += HERMES_PRISM
-
-config-$(call config_package,adm8211) += ADM8211
 config-$(call config_package,wlcore) += WLCORE WLCORE_SDIO
 config-$(call config_package,wl12xx) += WL12XX
 config-$(call config_package,wl18xx) += WL18XX
 config-y += WL_TI WILINK_PLATFORM_DATA
-config-$(call config_package,zd1211rw) += ZD1211RW
 config-$(call config_package,rsi91x) += RSI_91X
 config-$(call config_package,rsi91x-usb) += RSI_USB
 config-$(call config_package,rsi91x-sdio) += RSI_SDIO
@@ -440,8 +273,8 @@ ifeq ($(BUILD_VARIANT),smallbuffers)
 	C_DEFINES+= -DCONFIG_ATH10K_SMALLBUFFERS
 endif
 
-MAKE_OPTS:= -C "$(PKG_BUILD_DIR)" \
-	$(KERNEL_MAKE_FLAGS) \
+MAKE_OPTS:= \
+	$(subst -C $(LINUX_DIR),-C "$(PKG_BUILD_DIR)",$(KERNEL_MAKEOPTS)) \
 	EXTRA_CFLAGS="-I$(PKG_BUILD_DIR)/include $(IREMAP_CFLAGS) $(C_DEFINES)" \
 	KLIB_BUILD="$(LINUX_DIR)" \
 	MODPROBE=true \
@@ -464,9 +297,6 @@ define Build/Prepare
 	mkdir -p $(PKG_BUILD_DIR)
 	$(PKG_UNPACK)
 	$(Build/Patch)
-	$(TAR) -C $(PKG_BUILD_DIR) -xzf $(DL_DIR)/$(IPW2100_NAME)-$(IPW2100_VERSION).tgz
-	$(TAR) -C $(PKG_BUILD_DIR) -xzf $(DL_DIR)/$(IPW2200_NAME)-$(IPW2200_VERSION).tgz
-	$(TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(ZD1211FW_NAME)-$(ZD1211FW_VERSION).tar.bz2
 	rm -rf \
 		$(PKG_BUILD_DIR)/include/linux/ssb \
 		$(PKG_BUILD_DIR)/include/linux/bcma \
@@ -477,14 +307,14 @@ define Build/Prepare
 		$(PKG_BUILD_DIR)/include/linux/crc8.h \
 		$(PKG_BUILD_DIR)/include/linux/eeprom_93cx6.h \
 		$(PKG_BUILD_DIR)/include/linux/wl12xx.h \
-		$(PKG_BUILD_DIR)/include/linux/spi/libertas_spi.h \
+		$(PKG_BUILD_DIR)/include/linux/mhi.h \
 		$(PKG_BUILD_DIR)/include/net/ieee80211.h \
 		$(PKG_BUILD_DIR)/backport-include/linux/bcm47xx_nvram.h
 
 	echo 'compat-wireless-$(PKG_VERSION)-$(PKG_RELEASE)-$(REVISION)' > $(PKG_BUILD_DIR)/compat_version
 endef
 
-ifneq ($(CONFIG_PACKAGE_kmod-cfg80211)$(CONFIG_PACKAGE_kmod-lib80211),)
+ifneq ($(CONFIG_PACKAGE_kmod-cfg80211),)
  define Build/Compile/kmod
 	rm -rf $(PKG_BUILD_DIR)/modules
 	+$(MAKE) $(PKG_JOBS) $(MAKE_OPTS) modules
@@ -507,9 +337,15 @@ define Build/Patch
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/build,build/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/subsys,subsys/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath,ath/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath5k,ath5k/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath9k,ath9k/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath10k,ath10k/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath11k,ath11k/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mt7601u,mt7601u/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/brcm,brcm/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rtl,rtl/)
 	$(if $(QUILT),touch $(PKG_BUILD_DIR)/.quilt_used)
 endef
 
@@ -517,9 +353,15 @@ define Quilt/Refresh/Package
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/build,build/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/subsys,subsys/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath,ath/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath5k,ath5k/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath9k,ath9k/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath10k,ath10k/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath11k,ath11k/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mt7601u,mt7601u/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/brcm,brcm/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rtl,rtl/)
 endef
 
 define Build/Compile
@@ -545,17 +387,11 @@ endef
 define KernelPackage/cfg80211/install
 	$(INSTALL_DIR) $(1)/lib/wifi $(1)/lib/netifd/wireless
 	$(INSTALL_DATA) ./files/lib/wifi/mac80211.sh $(1)/lib/wifi
-	$(INSTALL_DATA) ./files/lib/netifd/mac80211.sh $(1)/lib/netifd
 	$(INSTALL_BIN) ./files/lib/netifd/wireless/mac80211.sh $(1)/lib/netifd/wireless
 	$(INSTALL_DIR) $(1)/etc/hotplug.d/ieee80211
 	$(INSTALL_DATA) ./files/mac80211.hotplug $(1)/etc/hotplug.d/ieee80211/10-wifi-detect
 endef
 
-define KernelPackage/zd1211rw/install
-	$(INSTALL_DIR) $(1)/lib/firmware/zd1211
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(ZD1211FW_NAME)/zd1211* $(1)/lib/firmware/zd1211
-endef
-
 $(eval $(foreach drv,$(PKG_DRIVERS),$(call KernelPackage,$(drv))))
 $(eval $(call KernelPackage,cfg80211))
 $(eval $(call KernelPackage,mac80211))
diff --git a/package/kernel/mac80211/ath.mk b/package/kernel/mac80211/ath.mk
index 78e00d5fa..dc08df4f6 100644
--- a/package/kernel/mac80211/ath.mk
+++ b/package/kernel/mac80211/ath.mk
@@ -1,6 +1,6 @@
 PKG_DRIVERS += \
 	ath ath5k ath6kl ath6kl-sdio ath6kl-usb ath9k ath9k-common ath9k-htc ath10k ath10k-smallbuffers \
-	carl9170 owl-loader ar5523 wil6210
+	ath11k ath11k-ahb ath11k-pci carl9170 owl-loader ar5523 wil6210
 
 PKG_CONFIG_DEPENDS += \
 	CONFIG_PACKAGE_ATH_DEBUG \
@@ -12,6 +12,7 @@ PKG_CONFIG_DEPENDS += \
 	CONFIG_ATH9K_TX99 \
 	CONFIG_ATH10K_LEDS \
 	CONFIG_ATH10K_THERMAL \
+	CONFIG_ATH11K_THERMAL \
 	CONFIG_ATH_USER_REGD
 
 ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
@@ -19,6 +20,7 @@ ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
 	ATH9K_DEBUGFS \
 	ATH9K_HTC_DEBUGFS \
 	ATH10K_DEBUGFS \
+	ATH11K_DEBUGFS \
 	CARL9170_DEBUGFS \
 	ATH5K_DEBUG \
 	ATH6KL_DEBUG \
@@ -28,16 +30,17 @@ endif
 ifdef CONFIG_PACKAGE_MAC80211_TRACING
   config-y += \
 	ATH10K_TRACING \
+	ATH11K_TRACING \
 	ATH6KL_TRACING \
 	ATH_TRACEPOINTS \
 	ATH5K_TRACER \
 	WIL6210_TRACING
 endif
 
-config-$(call config_package,ath) += ATH_CARDS ATH_COMMON ATH_REG_DYNAMIC_USER_REG_HINTS
-config-$(CONFIG_PACKAGE_ATH_DEBUG) += ATH_DEBUG ATH10K_DEBUG ATH9K_STATION_STATISTICS
+config-$(call config_package,ath) += ATH_CARDS ATH_COMMON
+config-$(CONFIG_PACKAGE_ATH_DEBUG) += ATH_DEBUG ATH10K_DEBUG ATH11K_DEBUG ATH9K_STATION_STATISTICS
 config-$(CONFIG_PACKAGE_ATH_DFS) += ATH9K_DFS_CERTIFIED ATH10K_DFS_CERTIFIED
-config-$(CONFIG_PACKAGE_ATH_SPECTRAL) += ATH9K_COMMON_SPECTRAL ATH10K_SPECTRAL
+config-$(CONFIG_PACKAGE_ATH_SPECTRAL) += ATH9K_COMMON_SPECTRAL ATH10K_SPECTRAL ATH11K_SPECTRAL
 config-$(CONFIG_PACKAGE_ATH_DYNACK) += ATH9K_DYNACK
 config-$(call config_package,ath9k) += ATH9K
 config-$(call config_package,ath9k-common) += ATH9K_COMMON
@@ -45,17 +48,21 @@ config-$(call config_package,owl-loader) += ATH9K_PCI_NO_EEPROM
 config-$(CONFIG_TARGET_ath79) += ATH9K_AHB
 config-$(CONFIG_TARGET_ipq40xx) += ATH10K_AHB
 config-$(CONFIG_PCI) += ATH9K_PCI
-config-$(CONFIG_ATH_USER_REGD) += ATH_USER_REGD
+config-$(CONFIG_ATH_USER_REGD) += ATH_USER_REGD ATH_REG_DYNAMIC_USER_REG_HINTS
 config-$(CONFIG_ATH9K_HWRNG) += ATH9K_HWRNG
 config-$(CONFIG_ATH9K_SUPPORT_PCOEM) += ATH9K_PCOEM
 config-$(CONFIG_ATH9K_TX99) += ATH9K_TX99
 config-$(CONFIG_ATH9K_UBNTHSR) += ATH9K_UBNTHSR
 config-$(CONFIG_ATH10K_LEDS) += ATH10K_LEDS
 config-$(CONFIG_ATH10K_THERMAL) += ATH10K_THERMAL
+config-$(CONFIG_ATH11K_THERMAL) += ATH11K_THERMAL
 
 config-$(call config_package,ath9k-htc) += ATH9K_HTC
 config-$(call config_package,ath10k) += ATH10K ATH10K_PCI
 config-$(call config_package,ath10k-smallbuffers) += ATH10K ATH10K_PCI ATH10K_SMALLBUFFERS
+config-$(call config_package,ath11k) += ATH11K
+config-$(call config_package,ath11k-ahb) += ATH11K_AHB
+config-$(call config_package,ath11k-pci) += ATH11K_PCI
 
 config-$(call config_package,ath5k) += ATH5K
 ifdef CONFIG_TARGET_ath25
@@ -154,7 +161,7 @@ define KernelPackage/ath6kl
   TITLE:=Atheros FullMAC wireless devices (common code for ath6kl_sdio and ath6kl_usb)
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath6kl
   HIDDEN:=1
-  DEPENDS+= +kmod-ath +@DRIVER_11N_SUPPORT
+  DEPENDS+= +kmod-ath
   FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath6kl/ath6kl_core.ko
 endef
 
@@ -191,7 +198,7 @@ define KernelPackage/ath9k-common
   TITLE:=Atheros 802.11n wireless devices (common code for ath9k and ath9k_htc)
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
   HIDDEN:=1
-  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ath79 +kmod-ath +@DRIVER_11N_SUPPORT
+  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ath79 +kmod-ath +kmod-random-core
   FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_common.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_hw.ko
@@ -218,7 +225,7 @@ define KernelPackage/ath9k/config
 		bool "Add wireless noise as source of randomness to kernel entropy pool"
 		depends on PACKAGE_kmod-ath9k
 		select PACKAGE_kmod-random-core
-		default n
+		default y
 
 	config ATH9K_SUPPORT_PCOEM
 		bool "Support chips used in PC OEM cards"
@@ -255,12 +262,13 @@ define KernelPackage/ath10k
   $(call KernelPackage/mac80211/Default)
   TITLE:=Atheros 802.11ac wireless cards support
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath10k
-  DEPENDS+= @PCI_SUPPORT +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT \
+  DEPENDS+= @PCI_SUPPORT +kmod-ath +@DRIVER_11AC_SUPPORT \
 	+ATH10K_THERMAL:kmod-hwmon-core +ATH10K_THERMAL:kmod-thermal
   FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_core.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_pci.ko
-  AUTOLOAD:=$(call AutoProbe,ath10k_pci)
+  AUTOLOAD:=$(call AutoProbe,ath10k_core ath10k_pci)
+  MODPARAMS.ath10k_core:=frame_mode=2
   VARIANT:=regular
 endef
 
@@ -289,10 +297,62 @@ define KernelPackage/ath10k-smallbuffers
   VARIANT:=smallbuffers
 endef
 
+define KernelPackage/ath11k
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Qualcomm 802.11ax wireless chipset support (common code)
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath11k
+  DEPENDS+= +kmod-ath +@DRIVER_11AC_SUPPORT +@DRIVER_11AX_SUPPORT \
+  +kmod-crypto-michael-mic +ATH11K_THERMAL:kmod-hwmon-core +ATH11K_THERMAL:kmod-thermal
+  FILES:=$(PKG_BUILD_DIR)/drivers/soc/qcom/qmi_helpers.ko \
+  $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath11k/ath11k.ko
+endef
+
+define KernelPackage/ath11k/description
+This module adds support for Qualcomm Technologies 802.11ax family of
+chipsets.
+endef
+
+define KernelPackage/ath11k/config
+
+       config ATH11K_THERMAL
+               bool "Enable thermal sensors and throttling support"
+               depends on PACKAGE_kmod-ath11k
+               default y if TARGET_ipq807x
+
+endef
+
+define KernelPackage/ath11k-ahb
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Qualcomm 802.11ax AHB wireless chipset support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath11k
+  DEPENDS+= @TARGET_ipq807x +kmod-ath11k +kmod-qrtr-smd
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath11k/ath11k_ahb.ko
+  AUTOLOAD:=$(call AutoProbe,ath11k_ahb)
+endef
+
+define KernelPackage/ath11k-ahb/description
+This module adds support for Qualcomm Technologies 802.11ax family of
+chipsets with AHB bus.
+endef
+
+define KernelPackage/ath11k-pci
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Qualcomm 802.11ax PCI wireless chipset support
+  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath11k
+  DEPENDS+= @PCI_SUPPORT +kmod-qrtr-mhi +kmod-ath11k
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath11k/ath11k_pci.ko
+  AUTOLOAD:=$(call AutoProbe,ath11k_pci)
+endef
+
+define KernelPackage/ath11k-pci/description
+This module adds support for Qualcomm Technologies 802.11ax family of
+chipsets with PCI bus.
+endef
+
 define KernelPackage/carl9170
   $(call KernelPackage/mac80211/Default)
   TITLE:=Driver for Atheros AR9170 USB sticks
-  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core +kmod-input-core +@DRIVER_11N_SUPPORT +carl9170-firmware
+  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core +kmod-input-core +carl9170-firmware
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/carl9170/carl9170.ko
   AUTOLOAD:=$(call AutoProbe,carl9170)
 endef
diff --git a/package/kernel/mac80211/broadcom.mk b/package/kernel/mac80211/broadcom.mk
index 0e2db6a74..cf80ad2d3 100644
--- a/package/kernel/mac80211/broadcom.mk
+++ b/package/kernel/mac80211/broadcom.mk
@@ -1,5 +1,5 @@
 PKG_DRIVERS += \
-	b43 b43legacy brcmsmac brcmfmac brcmutil
+	b43 brcmsmac brcmfmac brcmutil
 
 PKG_CONFIG_DEPENDS += \
 	CONFIG_PACKAGE_B43_DEBUG \
@@ -24,9 +24,6 @@ config-$(CONFIG_PACKAGE_B43_PHY_HT) += B43_PHY_HT
 config-$(CONFIG_PACKAGE_B43_PIO) += B43_PIO
 config-$(CONFIG_PACKAGE_B43_DEBUG) += B43_DEBUG
 
-config-$(call config_package,b43legacy) += B43LEGACY
-config-y += B43LEGACY_DMA_MODE
-
 config-$(call config_package,brcmutil) += BRCMUTIL
 config-$(call config_package,brcmsmac) += BRCMSMAC
 config-$(call config_package,brcmfmac) += BRCMFMAC
@@ -209,7 +206,7 @@ config PACKAGE_B43_USE_BCMA
 		default "16,28,29,30" if TARGET_bcm47xx_mips74k
 		default "5,6,7,8,9,10,11,13,15,16,28,29,30"
 		help
-		  This is a comma seperated list of core revision numbers.
+		  This is a comma separated list of core revision numbers.
 
 		  Example (keep files for rev5 only):
 		    5
@@ -224,7 +221,7 @@ config PACKAGE_B43_USE_BCMA
 		default "N,HT" if TARGET_bcm47xx_mips74k
 		default "G,N,LP,HT"
 		help
-		  This is a comma seperated list of PHY types:
+		  This is a comma separated list of PHY types:
 		    A  => A-PHY
 		    AG => Dual A-PHY G-PHY
 		    G  => G-PHY
@@ -248,11 +245,11 @@ config PACKAGE_B43_USE_BCMA
 		  This allows choosing buses that b43 should support.
 
 	config PACKAGE_B43_BUSES_BCMA_AND_SSB
-		depends on !TARGET_bcm47xx_legacy && !TARGET_bcm47xx_mips74k && !TARGET_bcm53xx
+		depends on !TARGET_bcm47xx_legacy && !TARGET_bcm47xx_mips74k && !TARGET_bcm53xx && !TARGET_bmips
 		bool "BCMA and SSB"
 
 	config PACKAGE_B43_BUSES_BCMA
-		depends on !TARGET_bcm47xx_legacy
+		depends on !TARGET_bcm47xx_legacy && !TARGET_bmips_bcm6358 && !TARGET_bmips_bcm6368
 		bool "BCMA only"
 
 	config PACKAGE_B43_BUSES_SSB
@@ -341,23 +338,6 @@ define KernelPackage/b43/description
 Kernel module for Broadcom 43xx wireless support (mac80211 stack) new
 endef
 
-define KernelPackage/b43legacy
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Broadcom 43xx-legacy wireless support
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/b43
-  KCONFIG:= \
-  	CONFIG_HW_RANDOM=y
-  DEPENDS+= +kmod-mac80211 +!(TARGET_bcm47xx||TARGET_bcm63xx):kmod-ssb @!TARGET_bcm47xx_mips74k +b43legacy-firmware
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/b43legacy/b43legacy.ko
-  AUTOLOAD:=$(call AutoProbe,b43legacy)
-  MENU:=1
-endef
-
-define KernelPackage/b43legacy/description
-Kernel module for Broadcom 43xx-legacy wireless support (mac80211 stack) new
-endef
-
-
 define KernelPackage/brcmutil
   $(call KernelPackage/mac80211/Default)
   TITLE:=Broadcom IEEE802.11n common driver parts
@@ -401,7 +381,7 @@ define KernelPackage/brcmsmac
   $(call KernelPackage/mac80211/Default)
   TITLE:=Broadcom IEEE802.11n PCIe SoftMAC WLAN driver
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT +!TARGET_bcm47xx:kmod-bcma +kmod-lib-cordic +kmod-lib-crc8 +kmod-brcmutil +!BRCMSMAC_USE_FW_FROM_WL:brcmsmac-firmware
+  DEPENDS+=@!TARGET_bcm47xx_legacy +kmod-mac80211 +!TARGET_bcm47xx:kmod-bcma +kmod-lib-cordic +kmod-lib-crc8 +kmod-brcmutil +!BRCMSMAC_USE_FW_FROM_WL:brcmsmac-firmware
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmsmac/brcmsmac.ko
   AUTOLOAD:=$(call AutoProbe,brcmsmac)
   MENU:=1
@@ -433,7 +413,7 @@ define KernelPackage/brcmfmac
   $(call KernelPackage/mac80211/Default)
   TITLE:=Broadcom IEEE802.11n USB FullMAC WLAN driver
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT \
+  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +@DRIVER_11AC_SUPPORT \
   	+kmod-brcmutil +BRCMFMAC_SDIO:kmod-mmc @!TARGET_uml \
 	+BRCMFMAC_USB:kmod-usb-core +BRCMFMAC_USB:brcmfmac-firmware-usb
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmfmac/brcmfmac.ko
@@ -450,7 +430,7 @@ define KernelPackage/brcmfmac/config
 	config BRCMFMAC_SDIO
 		bool "Enable SDIO bus interface support"
 		default y if TARGET_bcm27xx
-		default y if TARGET_rockchip
+		default y if TARGET_imx_cortexa7
 		default y if TARGET_sunxi
 		default n
 		help
diff --git a/package/kernel/mac80211/files/lib/netifd/mac80211.sh b/package/kernel/mac80211/files/lib/netifd/mac80211.sh
deleted file mode 100644
index 92e5c0e39..000000000
--- a/package/kernel/mac80211/files/lib/netifd/mac80211.sh
+++ /dev/null
@@ -1,36 +0,0 @@
-mac80211_phy_to_path() {
-	local phy="$1"
-
-	[ -x /usr/bin/readlink -a -h /sys/class/ieee80211/${phy} ] || return
-
-	local path="$(readlink -f /sys/class/ieee80211/${phy}/device)"
-	[ -n "$path" ] || return
-
-	path="${path##/sys/devices/}"
-	case "$path" in
-		platform*/pci*) path="${path##platform/}";;
-	esac
-
-	local p
-	local seq=""
-	for p in $(ls /sys/class/ieee80211/$phy/device/ieee80211); do
-		[ "$p" = "$phy" ] && {
-			echo "$path${seq:++$seq}"
-			break
-		}
-
-		seq=$((${seq:-0} + 1))
-	done
-}
-
-mac80211_path_to_phy() {
-	local path="$1"
-
-	local p
-	for p in $(ls /sys/class/ieee80211); do
-		local cur="$(mac80211_phy_to_path "$p")"
-		case "$cur" in
-			*$path) echo "$p"; return;;
-		esac
-	done
-}
diff --git a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
index 44936331d..5aaba9af2 100644
--- a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
+++ b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 . /lib/netifd/netifd-wireless.sh
 . /lib/netifd/hostapd.sh
-. /lib/netifd/mac80211.sh
+. /lib/functions/system.sh
 
 init_wireless_driver "$@"
 
@@ -29,8 +29,8 @@ drv_mac80211_init_device_config() {
 	config_add_string tx_burst
 	config_add_string distance
 	config_add_int beacon_int chanbw frag rts
-	config_add_int rxantenna txantenna antenna_gain txpower
-	config_add_boolean noscan ht_coex acs_exclude_dfs
+	config_add_int rxantenna txantenna antenna_gain txpower min_tx_power
+	config_add_boolean noscan ht_coex acs_exclude_dfs background_radar
 	config_add_array ht_capab
 	config_add_array channels
 	config_add_array scan_list
@@ -51,6 +51,8 @@ drv_mac80211_init_device_config() {
 		rx_antenna_pattern \
 		tx_antenna_pattern \
 		he_spr_sr_control \
+		he_spr_psr_enabled \
+		he_bss_color_enabled \
 		he_twt_required
 	config_add_int \
 		beamformer_antennas \
@@ -138,13 +140,15 @@ mac80211_hostapd_setup_base() {
 	[ -n "$acs_exclude_dfs" ] && [ "$acs_exclude_dfs" -gt 0 ] &&
 		append base_cfg "acs_exclude_dfs=1" "$N"
 
-	json_get_vars noscan ht_coex vendor_vht
-	json_get_values ht_capab_list ht_capab tx_burst
+	json_get_vars noscan ht_coex min_tx_power:0 tx_burst
+	json_get_values ht_capab_list ht_capab
 	json_get_values channel_list channels
 
 	[ "$auto_channel" = 0 ] && [ -z "$channel_list" ] && \
 		channel_list="$channel"
 
+	[ "$min_tx_power" -gt 0 ] && append base_cfg "min_tx_power=$min_tx_power"
+
 	set_default noscan 0
 
 	[ "$noscan" -gt 0 ] && hostapd_noscan=1
@@ -274,6 +278,11 @@ mac80211_hostapd_setup_base() {
 			vht_center_seg0=$idx
 		;;
 	esac
+	[ "$band" = "5g" ] && {
+		json_get_vars background_radar:0
+
+		[ "$background_radar" -eq 1 ] && append base_cfg "enable_background_radar=1" "$N"
+	}
 	[ "$band" = "6g" ] && {
 		op_class=
 		case "$htmode" in
@@ -284,7 +293,7 @@ mac80211_hostapd_setup_base() {
 	}
 	[ "$hwmode" = "a" ] || enable_ac=0
 
-	if [ "$enable_ac" != "0" -o "$vendor_vht" = "1" ]; then
+	if [ "$enable_ac" != "0" ]; then
 		json_get_vars \
 			rxldpc:1 \
 			short_gi_80:1 \
@@ -407,20 +416,21 @@ mac80211_hostapd_setup_base() {
 	if [ "$enable_ax" != "0" ]; then
 		json_get_vars \
 			he_su_beamformer:1 \
-			he_su_beamformee:0 \
+			he_su_beamformee:1 \
 			he_mu_beamformer:1 \
 			he_twt_required:0 \
-			he_spr_sr_control:0 \
-			he_spr_non_srg_obss_pd_max_offset:1 \
-			he_bss_color
+			he_spr_sr_control:3 \
+			he_spr_psr_enabled:0 \
+			he_spr_non_srg_obss_pd_max_offset:0 \
+			he_bss_color:128 \
+			he_bss_color_enabled:1
 
-		he_phy_cap=$(iw phy "$phy" info | awk -F "[()]" '/HE PHY Capabilities/ { print $2 }' | head -1)
+		he_phy_cap=$(iw phy "$phy" info | sed -n '/HE Iftypes: AP/,$p' | awk -F "[()]" '/HE PHY Capabilities/ { print $2 }' | head -1)
 		he_phy_cap=${he_phy_cap:2}
-		he_mac_cap=$(iw phy "$phy" info | awk -F "[()]" '/HE MAC Capabilities/ { print $2 }' | head -1)
+		he_mac_cap=$(iw phy "$phy" info | sed -n '/HE Iftypes: AP/,$p' | awk -F "[()]" '/HE MAC Capabilities/ { print $2 }' | head -1)
 		he_mac_cap=${he_mac_cap:2}
 
 		append base_cfg "ieee80211ax=1" "$N"
-		[ -n "$he_bss_color" ] && append base_cfg "he_bss_color=$he_bss_color" "$N"
 		[ "$hwmode" = "a" ] && {
 			append base_cfg "he_oper_chwidth=$vht_oper_chwidth" "$N"
 			append base_cfg "he_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
@@ -430,10 +440,21 @@ mac80211_hostapd_setup_base() {
 			he_su_beamformer:${he_phy_cap:6:2}:0x80:$he_su_beamformer \
 			he_su_beamformee:${he_phy_cap:8:2}:0x1:$he_su_beamformee \
 			he_mu_beamformer:${he_phy_cap:8:2}:0x2:$he_mu_beamformer \
-			he_spr_sr_control:${he_phy_cap:14:2}:0x1:$he_spr_sr_control \
+			he_spr_psr_enabled:${he_phy_cap:14:2}:0x1:$he_spr_psr_enabled \
 			he_twt_required:${he_mac_cap:0:2}:0x6:$he_twt_required
 
-		[ "$he_spr_sr_control" -gt 0 ] && append base_cfg "he_spr_non_srg_obss_pd_max_offset=$he_spr_non_srg_obss_pd_max_offset" "$N"
+		if [ "$he_bss_color_enabled" -gt 0 ]; then
+			append base_cfg "he_bss_color=$he_bss_color" "$N"
+			[ "$he_spr_non_srg_obss_pd_max_offset" -gt 0 ] && { \
+				append base_cfg "he_spr_non_srg_obss_pd_max_offset=$he_spr_non_srg_obss_pd_max_offset" "$N"
+				he_spr_sr_control=$((he_spr_sr_control | (1 << 2)))
+			}
+			[ "$he_spr_psr_enabled" -gt 0 ] || he_spr_sr_control=$((he_spr_sr_control | (1 << 0)))
+			append base_cfg "he_spr_sr_control=$he_spr_sr_control" "$N"
+		else
+			append base_cfg "he_bss_color_disabled=1" "$N"
+		fi
+
 
 		append base_cfg "he_default_pe_duration=4" "$N"
 		append base_cfg "he_rts_threshold=1023" "$N"
@@ -560,15 +581,77 @@ mac80211_generate_mac() {
 		$(( (0x$6 + $id) % 0x100 ))
 }
 
+get_board_phy_name() (
+	local path="$1"
+	local fallback_phy=""
+
+	__check_phy() {
+		local val="$1"
+		local key="$2"
+		local ref_path="$3"
+
+		json_select "$key"
+		json_get_values path
+		json_select ..
+
+		[ "${ref_path%+*}" = "$path" ] && fallback_phy=$key
+		[ "$ref_path" = "$path" ] || return 0
+
+		echo "$key"
+		exit
+	}
+
+	json_load_file /etc/board.json
+	json_for_each_item __check_phy wlan "$path"
+	[ -n "$fallback_phy" ] && echo "${fallback_phy}.${path##*+}"
+)
+
+rename_board_phy_by_path() {
+	local path="$1"
+
+	local new_phy="$(get_board_phy_name "$path")"
+	[ -z "$new_phy" -o "$new_phy" = "$phy" ] && return
+
+	iw "$phy" set name "$new_phy" && phy="$new_phy"
+}
+
+rename_board_phy_by_name() (
+	local phy="$1"
+	local suffix="${phy##*.}"
+	[ "$suffix" = "$phy" ] && suffix=
+
+	json_load_file /etc/board.json
+	json_select wlan
+	json_select "${phy%.*}" || return 0
+	json_get_values path
+
+	prev_phy="$(iwinfo nl80211 phyname "path=$path${suffix:++$suffix}")"
+	[ -n "$prev_phy" ] || return 0
+
+	[ "$prev_phy" = "$phy" ] && return 0
+
+	iw "$prev_phy" set name "$phy"
+)
+
 find_phy() {
-	[ -n "$phy" -a -d /sys/class/ieee80211/$phy ] && return 0
+	[ -n "$phy" ] && {
+		rename_board_phy_by_name "$phy"
+		[ -d /sys/class/ieee80211/$phy ] && return 0
+	}
 	[ -n "$path" ] && {
-		phy="$(mac80211_path_to_phy "$path")"
-		[ -n "$phy" ] && return 0
+		phy="$(iwinfo nl80211 phyname "path=$path")"
+		[ -n "$phy" ] && {
+			rename_board_phy_by_path "$path"
+			return 0
+		}
 	}
 	[ -n "$macaddr" ] && {
 		for phy in $(ls /sys/class/ieee80211 2>/dev/null); do
-			grep -i -q "$macaddr" "/sys/class/ieee80211/${phy}/macaddress" && return 0
+			grep -i -q "$macaddr" "/sys/class/ieee80211/${phy}/macaddress" && {
+				path="$(iwinfo nl80211 path "$phy")"
+				rename_board_phy_by_path "$path"
+				return 0
+			}
 		done
 	}
 	return 1
@@ -620,8 +703,7 @@ mac80211_iw_interface_add() {
 	}
 
 	[ "$rc" = 233 ] && {
-		#iw dev "$ifname" del >/dev/null 2>&1
-    	ip link set dev "$ifname" down 2>/dev/null
+		iw dev "$ifname" del >/dev/null 2>&1
 		[ "$?" = 0 ] && {
 			sleep 1
 
@@ -647,23 +729,40 @@ mac80211_iw_interface_add() {
 	return $rc
 }
 
+mac80211_set_ifname() {
+	local phy="$1"
+	local prefix="$2"
+	eval "ifname=\"$phy-$prefix\${idx_$prefix:-0}\"; idx_$prefix=\$((\${idx_$prefix:-0 } + 1))"
+}
+
 mac80211_prepare_vif() {
 	json_select config
 
 	json_get_vars ifname mode ssid wds powersave macaddr enable wpa_psk_file vlan_file
 
-	[ -n "$ifname" ] || ifname="wlan${phy#phy}${if_idx:+-$if_idx}"
-	if_idx=$((${if_idx:-0} + 1))
+	[ -n "$ifname" ] || {
+		local prefix;
+
+		case "$mode" in
+		ap|sta|mesh) prefix=$mode;;
+		adhoc) prefix=ibss;;
+		monitor) prefix=mon;;
+		esac
+
+		mac80211_set_ifname "$phy" "$prefix"
+	}
 
 	set_default wds 0
 	set_default powersave 0
 
 	json_select ..
 
-	[ -n "$macaddr" ] || {
+	if [ -z "$macaddr" ]; then
 		macaddr="$(mac80211_generate_mac $phy)"
 		macidx="$(($macidx + 1))"
-	}
+	elif [ "$macaddr" = 'random' ]; then
+		macaddr="$(macaddr_random)"
+	fi
 
 	json_add_object data
 	json_add_string ifname "$ifname"
@@ -744,13 +843,12 @@ mac80211_setup_supplicant() {
 	[ "$enable" = 0 ] && {
 		ubus call wpa_supplicant.${phy} config_remove "{\"iface\":\"$ifname\"}"
 		ip link set dev "$ifname" down
-		#iw dev "$ifname" del
+		iw dev "$ifname" del
 		return 0
 	}
 
 	wpa_supplicant_prepare_interface "$ifname" nl80211 || {
-		#iw dev "$ifname" del
-    	ip link set dev "$ifname" down
+		iw dev "$ifname" del
 		return 1
 	}
 	if [ "$mode" = "sta" ]; then
@@ -782,8 +880,7 @@ mac80211_setup_supplicant_noctl() {
 	local enable=$1
 	local spobj="$(ubus -S list | grep wpa_supplicant.${ifname})"
 	wpa_supplicant_prepare_interface "$ifname" nl80211 || {
-		#iw dev "$ifname" del
-    	ip link set dev "$ifname" down
+		iw dev "$ifname" del
 		return 1
 	}
 
@@ -804,8 +901,8 @@ mac80211_setup_supplicant_noctl() {
 
 mac80211_prepare_iw_htmode() {
 	case "$htmode" in
-		VHT20|HT20) iw_htmode=HT20;;
-		HT40*|VHT40|VHT160)
+		VHT20|HT20|HE20) iw_htmode=HT20;;
+		HT40*|VHT40|VHT160|HE40)
 			case "$band" in
 				2g)
 					case "$htmode" in
@@ -829,7 +926,7 @@ mac80211_prepare_iw_htmode() {
 			esac
 			[ "$auto_channel" -gt 0 ] && iw_htmode="HT40+"
 		;;
-		VHT80)
+		VHT80|HE80)
 			iw_htmode="80MHZ"
 		;;
 		NONE|NOHT)
@@ -936,7 +1033,7 @@ mac80211_setup_vif() {
 		mesh)
 			wireless_vif_parse_encryption
 			[ -z "$htmode" ] && htmode="NOHT";
-			if [ "$wpa" -gt 0 -o "$auto_channel" -gt 0 ] || chan_is_dfs "$phy" "$channel"; then
+			if wpa_supplicant -vmesh || [ "$wpa" -gt 0 -o "$auto_channel" -gt 0 ] || chan_is_dfs "$phy" "$channel"; then
 				mac80211_setup_supplicant $vif_enable || failed=1
 			else
 				mac80211_setup_mesh $vif_enable
@@ -1003,7 +1100,7 @@ mac80211_vap_cleanup() {
 	for wdev in $vaps; do
 		[ "$service" != "none" ] && ubus call ${service} config_remove "{\"iface\":\"$wdev\"}"
 		ip link set dev "$wdev" down 2>/dev/null
-		#iw dev "$wdev" del
+		iw dev "$wdev" del
 	done
 }
 
@@ -1064,7 +1161,7 @@ drv_mac80211_setup() {
 		done
 		if [ "$found" = "0" ]; then
 			ip link set dev "$wdev" down
-			#iw dev "$wdev" del
+			iw dev "$wdev" del
 		fi
 	done
 
diff --git a/package/kernel/mac80211/files/lib/wifi/mac80211.sh b/package/kernel/mac80211/files/lib/wifi/mac80211.sh
index 19d8542fb..e24a2a634 100644
--- a/package/kernel/mac80211/files/lib/wifi/mac80211.sh
+++ b/package/kernel/mac80211/files/lib/wifi/mac80211.sh
@@ -1,62 +1,49 @@
 #!/bin/sh
-. /lib/netifd/mac80211.sh
 
 append DRIVERS "mac80211"
 
-lookup_phy() {
-	[ -n "$phy" ] && {
-		[ -d /sys/class/ieee80211/$phy ] && return
-	}
-
-	local devpath
-	config_get devpath "$device" path
-	[ -n "$devpath" ] && {
-		phy="$(mac80211_path_to_phy "$devpath")"
-		[ -n "$phy" ] && return
-	}
-
-	local macaddr="$(config_get "$device" macaddr | tr 'A-Z' 'a-z')"
-	[ -n "$macaddr" ] && {
-		for _phy in /sys/class/ieee80211/*; do
-			[ -e "$_phy" ] || continue
-
-			[ "$macaddr" = "$(cat ${_phy}/macaddress)" ] || continue
-			phy="${_phy##*/}"
-			return
-		done
-	}
-	phy=
-	return
-}
-
-find_mac80211_phy() {
+check_mac80211_device() {
 	local device="$1"
+	local path="$2"
+	local macaddr="$3"
 
+	[ -n "$found" ] && return 0
+
+	phy_path=
 	config_get phy "$device" phy
-	lookup_phy
-	[ -n "$phy" -a -d "/sys/class/ieee80211/$phy" ] || {
-		echo "PHY for wifi device $1 not found"
-		return 1
+	json_select wlan
+	[ -n "$phy" ] && case "$phy" in
+		phy*)
+			[ -d /sys/class/ieee80211/$phy ] && \
+				phy_path="$(iwinfo nl80211 path "$dev")"
+		;;
+		*)
+			if json_is_a "$phy" object; then
+				json_select "$phy"
+				json_get_var phy_path path
+				json_select ..
+			elif json_is_a "${phy%.*}" object; then
+				json_select "${phy%.*}"
+				json_get_var phy_path path
+				json_select ..
+				phy_path="$phy_path+${phy##*.}"
+			fi
+		;;
+	esac
+	json_select ..
+	[ -n "$phy_path" ] || config_get phy_path "$device" path
+	[ -n "$path" -a "$phy_path" = "$path" ] && {
+		found=1
+		return 0
 	}
-	config_set "$device" phy "$phy"
 
-	config_get macaddr "$device" macaddr
-	[ -z "$macaddr" ] && {
-		config_set "$device" macaddr "$(cat /sys/class/ieee80211/${phy}/macaddress)"
-	}
+	config_get dev_macaddr "$device" macaddr
+
+	[ -n "$macaddr" -a "$dev_macaddr" = "$macaddr" ] && found=1
 
 	return 0
 }
 
-check_mac80211_device() {
-	config_get phy "$1" phy
-	[ -z "$phy" ] && {
-		find_mac80211_phy "$1" >/dev/null || return 0
-		config_get phy "$1" phy
-	}
-	[ "$phy" = "$dev" ] && found=1
-}
-
 
 __get_band_defaults() {
 	local phy="$1"
@@ -136,24 +123,41 @@ get_band_defaults() {
 	done
 }
 
+check_devidx() {
+	case "$1" in
+	radio[0-9]*)
+		local idx="${1#radio}"
+		[ "$devidx" -ge "${1#radio}" ] && devidx=$((idx + 1))
+		;;
+	esac
+}
+
+check_board_phy() {
+	local name="$2"
+
+	json_select "$name"
+	json_get_var phy_path path
+	json_select ..
+
+	if [ "$path" = "$phy_path" ]; then
+		board_dev="$name"
+	elif [ "${path%+*}" = "$phy_path" ]; then
+		fallback_board_dev="$name.${path#*+}"
+	fi
+}
+
 detect_mac80211() {
 	devidx=0
 	config_load wireless
-	while :; do
-		config_get type "radio$devidx" type
-		[ -n "$type" ] || break
-		devidx=$(($devidx + 1))
-	done
+	config_foreach check_devidx wifi-device
+
+	json_load_file /etc/board.json
 
 	for _dev in /sys/class/ieee80211/*; do
 		[ -e "$_dev" ] || continue
 
 		dev="${_dev##*/}"
 
-		found=0
-		config_foreach check_mac80211_device wifi-device
-		[ "$found" -gt 0 ] && continue
-
 		mode_band=""
 		channel=""
 		htmode=""
@@ -161,58 +165,53 @@ detect_mac80211() {
 
 		get_band_defaults "$dev"
 
-		path="$(mac80211_phy_to_path "$dev")"
-		if [ -n "$path" ]; then
-			dev_id="set wireless.radio${devidx}.path='$path'"
-		else
-			dev_id="set wireless.radio${devidx}.macaddr=$(cat /sys/class/ieee80211/${dev}/macaddress)"
-		fi
+		path="$(iwinfo nl80211 path "$dev")"
+		macaddr="$(cat /sys/class/ieee80211/${dev}/macaddress)"
 
-		if [ -x /usr/bin/readlink -a -h /sys/class/ieee80211/${dev} ]; then
-			product=`cat $(readlink -f /sys/class/ieee80211/${dev}/device)/uevent | grep PRODUCT= | cut -d= -f 2`
-		else
-			product=""
-		fi
+		# work around phy rename related race condition
+		[ -n "$path" -o -n "$macaddr" ] || continue
 
-		case "${product}" in
-		"bda/c811/200" | \
-		"bda/c820/200")
-			# 80211ac 5Ghz 433Mb
-			mode_band='5g'
-			htmode='VHT80'
-			channel='44'
-			# 80211n 2.4Ghz 150Mb
-			# mode_band='2g'
-			# htmode='HT40'
-			# channel='6'
-			;;
+		board_dev=
+		fallback_board_dev=
+		json_for_each_item check_board_phy wlan
+		[ -n "$board_dev" ] || board_dev="$fallback_board_dev"
+		[ -n "$board_dev" ] && dev="$board_dev"
 
-		*)
-			country=""
-			;;
+		found=
+		config_foreach check_mac80211_device wifi-device "$path" "$macaddr"
+		[ -n "$found" ] && continue
 
+		name="radio${devidx}"
+		devidx=$(($devidx + 1))
+		case "$dev" in
+			phy*)
+				if [ -n "$path" ]; then
+					dev_id="set wireless.${name}.path='$path'"
+				else
+					dev_id="set wireless.${name}.macaddr='$macaddr'"
+				fi
+				;;
+			*)
+				dev_id="set wireless.${name}.phy='$dev'"
+				;;
 		esac
 
-
 		uci -q batch <<-EOF
-			set wireless.radio${devidx}=wifi-device
-			set wireless.radio${devidx}.type=mac80211
+			set wireless.${name}=wifi-device
+			set wireless.${name}.type=mac80211
 			${dev_id}
-			set wireless.radio${devidx}.channel=${channel}
-			set wireless.radio${devidx}.band=${mode_band}
-			set wireless.radio${devidx}.htmode=${htmode}
-			set wireless.radio${devidx}.country='RU'
-			set wireless.radio${devidx}.disabled=0
+			set wireless.${name}.channel=${channel}
+			set wireless.${name}.band=${mode_band}
+			set wireless.${name}.htmode=$htmode
+			set wireless.${name}.disabled=1
 
-			set wireless.default_radio${devidx}=wifi-iface
-			set wireless.default_radio${devidx}.device=radio${devidx}
-			set wireless.default_radio${devidx}.network=lan
-			set wireless.default_radio${devidx}.mode=ap
-			set wireless.default_radio${devidx}.ssid=OpenWrt${devidx}
-			set wireless.default_radio${devidx}.encryption=none
+			set wireless.default_${name}=wifi-iface
+			set wireless.default_${name}.device=${name}
+			set wireless.default_${name}.network=lan
+			set wireless.default_${name}.mode=ap
+			set wireless.default_${name}.ssid=OpenWrt
+			set wireless.default_${name}.encryption=none
 EOF
 		uci -q commit wireless
-
-		devidx=$(($devidx + 1))
 	done
 }
diff --git a/package/kernel/mac80211/intel.mk b/package/kernel/mac80211/intel.mk
index 8bab727a4..8d374d73e 100644
--- a/package/kernel/mac80211/intel.mk
+++ b/package/kernel/mac80211/intel.mk
@@ -1,21 +1,12 @@
-PKG_DRIVERS += \
-	iwl-legacy iwl3945 iwl4965 iwlwifi \
-	libipw ipw2100 ipw2200 \
+PKG_DRIVERS += iwlwifi
 
-config-$(call config_package,iwl-legacy) += IWLEGACY
-config-$(call config_package,iwl3945) += IWL3945
-config-$(call config_package,iwl4965) += IWL4965
 config-$(call config_package,iwlwifi) += IWLWIFI IWLDVM IWLMVM
 config-$(CONFIG_PACKAGE_IWLWIFI_DEBUG)+= IWLWIFI_DEBUG
 config-$(CONFIG_PACKAGE_IWLWIFI_DEBUGFS)+= IWLWIFI_DEBUGFS
 
-config-$(call config_package,libipw) += LIBIPW
-config-$(call config_package,ipw2100) += IPW2100
-config-$(call config_package,ipw2200) += IPW2200
-
 define KernelPackage/iwlwifi
   $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT
+  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11AX_SUPPORT
   TITLE:=Intel AGN Wireless support
   FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/iwlwifi.ko \
@@ -84,117 +75,3 @@ define KernelPackage/iwlwifi/config
   endif
 endef
 
-define KernelPackage/iwl-legacy
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT
-  TITLE:=Intel legacy Wireless support
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwlegacy.ko
-  AUTOLOAD:=$(call AutoProbe,iwlegacy)
-endef
-
-define KernelPackage/iwl-legacy/description
- iwl-legacy kernel module for legacy Intel wireless support
-endef
-
-define KernelPackage/iwl3945
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +iwl3945-firmware
-  TITLE:=Intel iwl3945 Wireless support
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwl3945.ko
-  AUTOLOAD:=$(call AutoProbe,iwl3945)
-endef
-
-define KernelPackage/iwl3945/description
- iwl3945 kernel module for Intel 3945 support
-endef
-
-define KernelPackage/iwl4965
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 +kmod-iwl-legacy +@DRIVER_11N_SUPPORT +iwl4965-firmware
-  TITLE:=Intel iwl4965 Wireless support
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlegacy/iwl4965.ko
-  AUTOLOAD:=$(call AutoProbe,iwl4965)
-endef
-
-define KernelPackage/iwl4965/description
- iwl4965 kernel module for Intel 4965 support
-endef
-
-
-define KernelPackage/libipw
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=libipw for ipw2100 and ipw2200
-  DEPENDS:=@PCI_SUPPORT +kmod-crypto-michael-mic +kmod-crypto-ecb +kmod-lib80211 +kmod-cfg80211 +@DRIVER_WEXT_SUPPORT @!BIG_ENDIAN
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/libipw.ko
-  AUTOLOAD:=$(call AutoProbe,libipw)
-endef
-
-define KernelPackage/libipw/description
- Hardware independent IEEE 802.11 networking stack for ipw2100 and ipw2200.
-endef
-
-IPW2100_NAME:=ipw2100-fw
-IPW2100_VERSION:=1.3
-
-define Download/ipw2100
-  URL:= \
-	https://src.fedoraproject.org/repo/pkgs/ipw2100-firmware/ipw2100-fw-1.3.tgz/46aa75bcda1a00efa841f9707bbbd113/ \
-	https://archlinux.mirror.pkern.at/other/packages/ipw2100-fw/ \
-	http://mirror.ox.ac.uk/sites/ftp.openbsd.org/pub/OpenBSD/distfiles/firmware/ \
-	http://firmware.openbsd.org/firmware-dist/
-  FILE:=$(IPW2100_NAME)-$(IPW2100_VERSION).tgz
-  HASH:=e1107c455e48d324a616b47a622593bc8413dcce72026f72731c0b03dae3a7a2
-endef
-$(eval $(call Download,ipw2100))
-
-define KernelPackage/ipw2100
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Intel IPW2100 driver
-  DEPENDS:=@PCI_SUPPORT +kmod-libipw
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/ipw2100.ko
-  AUTOLOAD:=$(call AutoProbe,ipw2100)
-endef
-
-define KernelPackage/ipw2100/description
- Kernel support for Intel IPW2100
- Includes:
- - ipw2100
-endef
-
-IPW2200_NAME:=ipw2200-fw
-IPW2200_VERSION:=3.1
-
-define Download/ipw2200
-  URL:= \
-	https://src.fedoraproject.org/repo/pkgs/ipw2200-firmware/ipw2200-fw-3.1.tgz/eaba788643c7cc7483dd67ace70f6e99/ \
-	https://archlinux.mirror.pkern.at/other/packages/ipw2200-fw/ \
-	http://mirror.ox.ac.uk/sites/ftp.openbsd.org/pub/OpenBSD/distfiles/firmware/ \
-	http://firmware.openbsd.org/firmware-dist/
-  FILE:=$(IPW2200_NAME)-$(IPW2200_VERSION).tgz
-  HASH:=c6818c11c18cc030d55ff83f64b2bad8feef485e7742f84f94a61d811a6258bd
-endef
-$(eval $(call Download,ipw2200))
-
-define KernelPackage/ipw2200
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Intel IPW2200 driver
-  DEPENDS:=@PCI_SUPPORT +kmod-libipw
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/intel/ipw2x00/ipw2200.ko
-  AUTOLOAD:=$(call AutoProbe,ipw2200)
-endef
-
-define KernelPackage/ipw2200/description
- Kernel support for Intel IPW2200
- Includes:
- - ipw2200
-endef
-
-define KernelPackage/ipw2100/install
-	$(INSTALL_DIR) $(1)/lib/firmware
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/ipw2100-$(IPW2100_VERSION)*.fw $(1)/lib/firmware
-endef
-
-define KernelPackage/ipw2200/install
-	$(INSTALL_DIR) $(1)/lib/firmware
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/$(IPW2200_NAME)-$(IPW2200_VERSION)/ipw2200*.fw $(1)/lib/firmware
-endef
diff --git a/package/kernel/mac80211/marvell.mk b/package/kernel/mac80211/marvell.mk
index a0e67091e..dbd07a80d 100644
--- a/package/kernel/mac80211/marvell.mk
+++ b/package/kernel/mac80211/marvell.mk
@@ -1,54 +1,15 @@
 PKG_DRIVERS += \
-	libertas-sdio libertas-usb libertas-spi \
 	mwl8k mwifiex-pcie mwifiex-sdio
 
-config-$(call config_package,libertas-sdio) += LIBERTAS LIBERTAS_SDIO
-config-$(call config_package,libertas-usb) += LIBERTAS LIBERTAS_USB
-config-$(call config_package,libertas-spi) += LIBERTAS LIBERTAS_SPI
 config-$(call config_package,mwl8k) += MWL8K
 config-$(call config_package,mwifiex-pcie) += MWIFIEX MWIFIEX_PCIE
 config-$(call config_package,mwifiex-sdio) += MWIFIEX MWIFIEX_SDIO
 
-define KernelPackage/libertas-usb
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +kmod-usb-core +kmod-lib80211 +@DRIVER_WEXT_SUPPORT +libertas-usb-firmware
-  TITLE:=Marvell 88W8015 Wireless Driver
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/usb8xxx.ko
-  AUTOLOAD:=$(call AutoProbe,libertas usb8xxx)
-endef
-
-define KernelPackage/libertas-sdio
-  $(call KernelPackage/mac80211/Default)
-  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +kmod-mmc +@DRIVER_WEXT_SUPPORT @!TARGET_uml +libertas-sdio-firmware
-  TITLE:=Marvell 88W8686 Wireless Driver
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas_sdio.ko
-  AUTOLOAD:=$(call AutoProbe,libertas libertas_sdio)
-endef
-
-define KernelPackage/libertas-spi
-  $(call KernelPackage/mac80211/Default)
-  SUBMENU:=Wireless Drivers
-  DEPENDS+= +kmod-cfg80211 +kmod-lib80211 +@DRIVER_WEXT_SUPPORT @!TARGET_uml +libertas-spi-firmware
-  KCONFIG := \
-	CONFIG_SPI=y \
-	CONFIG_SPI_MASTER=y
-  TITLE:=Marvell 88W8686 SPI Wireless Driver
-  FILES:= \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/libertas/libertas_spi.ko
-  AUTOLOAD:=$(call AutoProbe,libertas libertas_spi)
-endef
-
-
 define KernelPackage/mwl8k
   $(call KernelPackage/mac80211/Default)
   TITLE:=Driver for Marvell TOPDOG 802.11 Wireless cards
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwl8k
-  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +mwl8k-firmware
+  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +mwl8k-firmware
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwl8k.ko
   AUTOLOAD:=$(call AutoProbe,mwl8k)
 endef
@@ -62,7 +23,7 @@ define KernelPackage/mwifiex-pcie
   $(call KernelPackage/mac80211/Default)
   TITLE:=Driver for Marvell 802.11n/802.11ac PCIe Wireless cards
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwifiex
-  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +mwifiex-pcie-firmware
+  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11AC_SUPPORT +mwifiex-pcie-firmware
   FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex_pcie.ko
@@ -77,7 +38,7 @@ define KernelPackage/mwifiex-sdio
   $(call KernelPackage/mac80211/Default)
   TITLE:=Driver for Marvell 802.11n/802.11ac SDIO Wireless cards
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwifiex
-  DEPENDS+= +kmod-mmc +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +mwifiex-sdio-firmware
+  DEPENDS+= +kmod-mmc +kmod-mac80211 +@DRIVER_11AC_SUPPORT +mwifiex-sdio-firmware
   FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex_sdio.ko
diff --git a/package/kernel/mac80211/patches/ath/120-owl-loader-compat.patch b/package/kernel/mac80211/patches/ath/120-owl-loader-compat.patch
deleted file mode 100644
index d1d6c9e2e..000000000
--- a/package/kernel/mac80211/patches/ath/120-owl-loader-compat.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From: Christian Lamparter <chunkeey@gmail.com>
-Date: Sat, 16 Nov 2019 19:25:24 +0100
-Subject: [PATCH] owl_loader: compatibility patch
-
-This patch includes OpenWrt specific changes that are
-not included in the upstream owl-loader.
-
-This includes a platform data handling changes for ar71xx.
-
-Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
-
---- a/drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c
-+++ b/drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c
-@@ -103,6 +103,7 @@ static void owl_fw_cb(const struct firmw
- {
- 	struct pci_dev *pdev = (struct pci_dev *)context;
- 	struct owl_ctx *ctx = (struct owl_ctx *)pci_get_drvdata(pdev);
-+	struct ath9k_platform_data *pdata = dev_get_platdata(&pdev->dev);
- 	struct pci_bus *bus;
- 
- 	complete(&ctx->eeprom_load);
-@@ -118,6 +119,16 @@ static void owl_fw_cb(const struct firmw
- 		goto release;
- 	}
- 
-+	if (pdata) {
-+		memcpy(pdata->eeprom_data, fw->data, fw->size);
-+
-+		/*
-+		 * eeprom has been successfully loaded - pass the data to ath9k
-+		 * but remove the eeprom_name, so it doesn't try to load it too.
-+		 */
-+		pdata->eeprom_name = NULL;
-+	}
-+
- 	if (ath9k_pci_fixup(pdev, (const u16 *)fw->data, fw->size))
- 		goto release;
- 
-@@ -137,8 +148,14 @@ release:
- static const char *owl_get_eeprom_name(struct pci_dev *pdev)
- {
- 	struct device *dev = &pdev->dev;
-+	struct ath9k_platform_data *pdata;
- 	char *eeprom_name;
- 
-+	/* try the existing platform data first */
-+	pdata = dev_get_platdata(dev);
-+	if (pdata && pdata->eeprom_name)
-+		return pdata->eeprom_name;
-+
- 	dev_dbg(dev, "using auto-generated eeprom filename\n");
- 
- 	eeprom_name = devm_kzalloc(dev, EEPROM_FILENAME_LEN, GFP_KERNEL);
diff --git a/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch b/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
index bf87d3551..fd5493de7 100644
--- a/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
+++ b/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
@@ -37,7 +37,7 @@
  	for (band = 0; band < NUM_NL80211_BANDS; band++) {
  		if (!wiphy->bands[band])
  			continue;
-@@ -378,6 +387,9 @@ ath_reg_apply_ir_flags(struct wiphy *wip
+@@ -379,6 +388,9 @@ ath_reg_apply_ir_flags(struct wiphy *wip
  {
  	struct ieee80211_supported_band *sband;
  
@@ -47,7 +47,7 @@
  	sband = wiphy->bands[NL80211_BAND_2GHZ];
  	if (!sband)
  		return;
-@@ -407,6 +419,9 @@ static void ath_reg_apply_radar_flags(st
+@@ -408,6 +420,9 @@ static void ath_reg_apply_radar_flags(st
  	struct ieee80211_channel *ch;
  	unsigned int i;
  
@@ -57,7 +57,7 @@
  	if (!wiphy->bands[NL80211_BAND_5GHZ])
  		return;
  
-@@ -639,6 +654,10 @@ ath_regd_init_wiphy(struct ath_regulator
+@@ -640,6 +655,10 @@ ath_regd_init_wiphy(struct ath_regulator
  	const struct ieee80211_regdomain *regd;
  
  	wiphy->reg_notifier = reg_notifier;
@@ -82,7 +82,7 @@
  	help
 --- a/local-symbols
 +++ b/local-symbols
-@@ -85,6 +85,7 @@ ADM8211=
+@@ -102,6 +102,7 @@ ADM8211=
  ATH_COMMON=
  WLAN_VENDOR_ATH=
  ATH_DEBUG=
diff --git a/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch b/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
index c6dc184e2..8d83921a3 100644
--- a/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
+++ b/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
@@ -1,6 +1,6 @@
 --- a/net/wireless/reg.c
 +++ b/net/wireless/reg.c
-@@ -3252,6 +3252,8 @@ void regulatory_hint_country_ie(struct w
+@@ -3370,6 +3370,8 @@ void regulatory_hint_country_ie(struct w
  	enum environment_cap env = ENVIRON_ANY;
  	struct regulatory_request *request = NULL, *lr;
  
@@ -9,7 +9,7 @@
  	/* IE len must be evenly divisible by 2 */
  	if (country_ie_len & 0x01)
  		return;
-@@ -3503,6 +3505,7 @@ static bool is_wiphy_all_set_reg_flag(en
+@@ -3621,6 +3623,7 @@ static bool is_wiphy_all_set_reg_flag(en
  
  void regulatory_hint_disconnect(void)
  {
diff --git a/package/kernel/mac80211/patches/ath/405-ath_regd_us.patch b/package/kernel/mac80211/patches/ath/405-ath_regd_us.patch
index 088833199..6723721a4 100644
--- a/package/kernel/mac80211/patches/ath/405-ath_regd_us.patch
+++ b/package/kernel/mac80211/patches/ath/405-ath_regd_us.patch
@@ -8,7 +8,7 @@
  	FRANCE_RES = 0x31,
  	FCC3_FCCA = 0x3A,
  	FCC3_WORLD = 0x3B,
-@@ -172,6 +173,7 @@ static struct reg_dmn_pair_mapping regDo
+@@ -173,6 +174,7 @@ static struct reg_dmn_pair_mapping regDo
  	{FCC2_WORLD, CTL_FCC, CTL_ETSI},
  	{FCC2_ETSIC, CTL_FCC, CTL_ETSI},
  	{FCC3_FCCA, CTL_FCC, CTL_FCC},
@@ -16,7 +16,7 @@
  	{FCC3_WORLD, CTL_FCC, CTL_ETSI},
  	{FCC3_ETSIC, CTL_FCC, CTL_ETSI},
  	{FCC4_FCCA, CTL_FCC, CTL_FCC},
-@@ -483,6 +485,7 @@ static struct country_code_to_enum_rd al
+@@ -486,6 +488,7 @@ static struct country_code_to_enum_rd al
  	{CTRY_UAE, NULL1_WORLD, "AE"},
  	{CTRY_UNITED_KINGDOM, ETSI1_WORLD, "GB"},
  	{CTRY_UNITED_STATES, FCC3_FCCA, "US"},
diff --git a/package/kernel/mac80211/patches/ath/406-ath_relax_default_regd.patch b/package/kernel/mac80211/patches/ath/406-ath_relax_default_regd.patch
index 35b0f2b76..ee4e46134 100644
--- a/package/kernel/mac80211/patches/ath/406-ath_relax_default_regd.patch
+++ b/package/kernel/mac80211/patches/ath/406-ath_relax_default_regd.patch
@@ -39,7 +39,7 @@
  bool ath_is_world_regd(struct ath_regulatory *reg)
  {
  	return is_wwr_sku(ath_regd_get_eepromRD(reg));
-@@ -658,6 +666,9 @@ ath_regd_init_wiphy(struct ath_regulator
+@@ -659,6 +667,9 @@ ath_regd_init_wiphy(struct ath_regulator
  	if (IS_ENABLED(CPTCFG_ATH_USER_REGD))
  		return 0;
  
diff --git a/package/kernel/mac80211/patches/ath/550-ath9k-disable-bands-via-dt.patch b/package/kernel/mac80211/patches/ath/550-ath9k-disable-bands-via-dt.patch
deleted file mode 100644
index 7d3a334c4..000000000
--- a/package/kernel/mac80211/patches/ath/550-ath9k-disable-bands-via-dt.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- a/drivers/net/wireless/ath/ath9k/init.c
-+++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -627,6 +627,12 @@ static int ath9k_of_init(struct ath_soft
- 
- 	ath_dbg(common, CONFIG, "parsing configuration from OF node\n");
- 
-+	if (of_property_read_bool(np, "qca,disable-2ghz"))
-+		ah->disable_2ghz = true;
-+
-+	if (of_property_read_bool(np, "qca,disable-5ghz"))
-+		ah->disable_5ghz = true;
-+
- 	if (of_property_read_bool(np, "qca,no-eeprom")) {
- 		/* ath9k-eeprom-<bus>-<id>.bin */
- 		scnprintf(eeprom_name, sizeof(eeprom_name),
diff --git a/package/kernel/mac80211/patches/ath/922-ath10k-increase-rx-buffer-size-to-2048.patch b/package/kernel/mac80211/patches/ath/922-ath10k-increase-rx-buffer-size-to-2048.patch
deleted file mode 100644
index 8f7a60eec..000000000
--- a/package/kernel/mac80211/patches/ath/922-ath10k-increase-rx-buffer-size-to-2048.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From: Linus Lüssing <ll@simonwunderlich.de>
-Date: Wed, 5 Feb 2020 20:10:43 +0100
-Subject: ath10k: increase rx buffer size to 2048
-
-Before, only frames with a maximum size of 1528 bytes could be
-transmitted between two 802.11s nodes.
-
-For batman-adv for instance, which adds its own header to each frame,
-we typically need an MTU of at least 1532 bytes to be able to transmit
-without fragmentation.
-
-This patch now increases the maxmimum frame size from 1528 to 1656
-bytes.
-
-Tested with two ath10k devices in 802.11s mode, as well as with
-batman-adv on top of 802.11s with forwarding disabled.
-
-Fix originally found and developed by Ben Greear.
-
-Link: https://github.com/greearb/ath10k-ct/issues/89
-Link: https://github.com/greearb/ath10k-ct/commit/9e5ab25027e0971fa24ccf93373324c08c4e992d
-Cc: Ben Greear <greearb@candelatech.com>
-Signed-off-by: Linus Lüssing <ll@simonwunderlich.de>
-
-Forwarded: https://patchwork.kernel.org/patch/11367055/
-
---- a/drivers/net/wireless/ath/ath10k/htt.h
-+++ b/drivers/net/wireless/ath/ath10k/htt.h
-@@ -2243,7 +2243,7 @@ struct htt_rx_chan_info {
-  * Should be: sizeof(struct htt_host_rx_desc) + max rx MSDU size,
-  * rounded up to a cache line size.
-  */
--#define HTT_RX_BUF_SIZE 1920
-+#define HTT_RX_BUF_SIZE 2048
- #define HTT_RX_MSDU_SIZE (HTT_RX_BUF_SIZE - (int)sizeof(struct htt_rx_desc))
- 
- /* Refill a bunch of RX buffers for each refill round so that FW/HW can handle
diff --git a/package/kernel/mac80211/patches/ath/983-ath10k-allow-vht-on-2g.patch b/package/kernel/mac80211/patches/ath/983-ath10k-allow-vht-on-2g.patch
deleted file mode 100644
index eeca88a61..000000000
--- a/package/kernel/mac80211/patches/ath/983-ath10k-allow-vht-on-2g.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -4718,6 +4718,7 @@ static void ath10k_mac_setup_ht_vht_cap(
- 	if (ar->phy_capability & WHAL_WLAN_11G_CAPABILITY) {
- 		band = &ar->mac.sbands[NL80211_BAND_2GHZ];
- 		band->ht_cap = ht_cap;
-+		band->vht_cap = vht_cap;
- 	}
- 	if (ar->phy_capability & WHAL_WLAN_11A_CAPABILITY) {
- 		band = &ar->mac.sbands[NL80211_BAND_5GHZ];
diff --git a/package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch b/package/kernel/mac80211/patches/ath10k/080-ath10k_thermal_config.patch
similarity index 97%
rename from package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch
rename to package/kernel/mac80211/patches/ath10k/080-ath10k_thermal_config.patch
index de6f9d9bb..41ad6006b 100644
--- a/package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch
+++ b/package/kernel/mac80211/patches/ath10k/080-ath10k_thermal_config.patch
@@ -37,7 +37,7 @@
  void ath10k_thermal_event_temperature(struct ath10k *ar, int temperature);
 --- a/local-symbols
 +++ b/local-symbols
-@@ -142,6 +142,7 @@ ATH10K_SNOC=
+@@ -161,6 +161,7 @@ ATH10K_SNOC=
  ATH10K_DEBUG=
  ATH10K_DEBUGFS=
  ATH10K_SPECTRAL=
diff --git a/package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
similarity index 94%
rename from package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch
rename to package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
index e004acc34..7a38cf3e4 100644
--- a/package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
@@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
 
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -3189,6 +3189,16 @@ int ath10k_core_register(struct ath10k *
+@@ -3516,6 +3516,16 @@ int ath10k_core_register(struct ath10k *
  
  	queue_work(ar->workqueue, &ar->register_work);
  
diff --git a/package/kernel/mac80211/patches/ath/930-ath10k_add_tpt_led_trigger.patch b/package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch
similarity index 89%
rename from package/kernel/mac80211/patches/ath/930-ath10k_add_tpt_led_trigger.patch
rename to package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch
index 41022b873..e8beed17e 100644
--- a/package/kernel/mac80211/patches/ath/930-ath10k_add_tpt_led_trigger.patch
+++ b/package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -9732,6 +9732,21 @@ static int ath10k_mac_init_rd(struct ath
+@@ -9909,6 +9909,21 @@ static int ath10k_mac_init_rd(struct ath
  	return 0;
  }
  
@@ -22,7 +22,7 @@
  int ath10k_mac_register(struct ath10k *ar)
  {
  	static const u32 cipher_suites[] = {
-@@ -10081,6 +10096,12 @@ int ath10k_mac_register(struct ath10k *a
+@@ -10267,6 +10282,12 @@ int ath10k_mac_register(struct ath10k *a
  
  	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
  
diff --git a/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch b/package/kernel/mac80211/patches/ath10k/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
similarity index 96%
rename from package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
rename to package/kernel/mac80211/patches/ath10k/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
index dd891a62b..1c1630c05 100644
--- a/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
+++ b/package/kernel/mac80211/patches/ath10k/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
@@ -85,7 +85,7 @@ v13:
  create mode 100644 drivers/net/wireless/ath/ath10k/leds.h
 --- a/drivers/net/wireless/ath/ath10k/Kconfig
 +++ b/drivers/net/wireless/ath/ath10k/Kconfig
-@@ -70,6 +70,16 @@ config ATH10K_DEBUGFS
+@@ -71,6 +71,16 @@ config ATH10K_DEBUGFS
  
  	  If unsure, say Y to make it easier to debug problems.
  
@@ -114,7 +114,7 @@ v13:
  ath10k_core-$(CONFIG_DEV_COREDUMP) += coredump.o
 --- a/local-symbols
 +++ b/local-symbols
-@@ -145,6 +145,7 @@ ATH10K_DEBUG=
+@@ -162,6 +162,7 @@ ATH10K_DEBUG=
  ATH10K_DEBUGFS=
  ATH10K_SPECTRAL=
  ATH10K_THERMAL=
@@ -124,7 +124,7 @@ v13:
  WCN36XX=
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -25,6 +25,7 @@
+@@ -26,6 +26,7 @@
  #include "testmode.h"
  #include "wmi-ops.h"
  #include "coredump.h"
@@ -132,7 +132,7 @@ v13:
  
  unsigned int ath10k_debug_mask;
  EXPORT_SYMBOL(ath10k_debug_mask);
-@@ -61,6 +62,7 @@ static const struct ath10k_hw_params ath
+@@ -65,6 +66,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA988X_2_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca988x hw2.0",
@@ -140,7 +140,7 @@ v13:
  		.patch_load_addr = QCA988X_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -130,6 +132,7 @@ static const struct ath10k_hw_params ath
+@@ -146,6 +148,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9887_1_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9887 hw1.0",
@@ -148,7 +148,7 @@ v13:
  		.patch_load_addr = QCA9887_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -335,6 +338,7 @@ static const struct ath10k_hw_params ath
+@@ -387,6 +390,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA99X0_2_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca99x0 hw2.0",
@@ -156,7 +156,7 @@ v13:
  		.patch_load_addr = QCA99X0_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.otp_exe_param = 0x00000700,
-@@ -375,6 +379,7 @@ static const struct ath10k_hw_params ath
+@@ -433,6 +437,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9984_1_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9984/qca9994 hw1.0",
@@ -164,7 +164,7 @@ v13:
  		.patch_load_addr = QCA9984_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -422,6 +427,7 @@ static const struct ath10k_hw_params ath
+@@ -486,6 +491,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9888_2_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9888 hw2.0",
@@ -172,7 +172,7 @@ v13:
  		.patch_load_addr = QCA9888_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -2904,6 +2910,10 @@ int ath10k_core_start(struct ath10k *ar,
+@@ -3231,6 +3237,10 @@ int ath10k_core_start(struct ath10k *ar,
  		goto err_hif_stop;
  	}
  
@@ -183,7 +183,7 @@ v13:
  	return 0;
  
  err_hif_stop:
-@@ -3162,9 +3172,18 @@ static void ath10k_core_register_work(st
+@@ -3489,9 +3499,18 @@ static void ath10k_core_register_work(st
  		goto err_spectral_destroy;
  	}
  
@@ -202,7 +202,7 @@ v13:
  err_spectral_destroy:
  	ath10k_spectral_destroy(ar);
  err_debug_destroy:
-@@ -3210,6 +3229,8 @@ void ath10k_core_unregister(struct ath10
+@@ -3537,6 +3556,8 @@ void ath10k_core_unregister(struct ath10
  	if (!test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags))
  		return;
  
@@ -221,7 +221,7 @@ v13:
  
  #include "htt.h"
  #include "htc.h"
-@@ -1237,6 +1238,13 @@ struct ath10k {
+@@ -1253,6 +1254,13 @@ struct ath10k {
  	} testmode;
  
  	struct {
@@ -237,7 +237,7 @@ v13:
  		u32 fw_crash_counter;
 --- a/drivers/net/wireless/ath/ath10k/hw.h
 +++ b/drivers/net/wireless/ath/ath10k/hw.h
-@@ -517,6 +517,7 @@ struct ath10k_hw_params {
+@@ -519,6 +519,7 @@ struct ath10k_hw_params {
  	const char *name;
  	u32 patch_load_addr;
  	int uart_pin;
diff --git a/package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch b/package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch
similarity index 92%
rename from package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch
rename to package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch
index 5781f9c7a..4c1f9aa81 100644
--- a/package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch
+++ b/package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch
@@ -16,9 +16,9 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
 
 --- a/drivers/net/wireless/ath/ath10k/core.h
 +++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -1290,6 +1290,10 @@ struct ath10k {
- 	bool coex_support;
- 	int coex_gpio_pin;
+@@ -1309,6 +1309,10 @@ struct ath10k {
+ 	s32 tx_power_2g_limit;
+ 	s32 tx_power_5g_limit;
  
 +#ifdef CPTCFG_MAC80211_LEDS
 +	const char *led_default_trigger;
@@ -42,7 +42,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
  	if (ret)
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -10098,7 +10098,7 @@ int ath10k_mac_register(struct ath10k *a
+@@ -10284,7 +10284,7 @@ int ath10k_mac_register(struct ath10k *a
  	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
  
  #ifdef CPTCFG_MAC80211_LEDS
diff --git a/package/kernel/mac80211/patches/ath/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch b/package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
similarity index 93%
rename from package/kernel/mac80211/patches/ath/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
rename to package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
index 1f1976589..3626debf1 100644
--- a/package/kernel/mac80211/patches/ath/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
+++ b/package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
@@ -28,7 +28,7 @@ Forwarded: no
 
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -1010,6 +1010,40 @@ static inline int ath10k_vdev_setup_sync
+@@ -1028,6 +1028,40 @@ static inline int ath10k_vdev_setup_sync
  	return ar->last_wmi_vdev_start_status;
  }
  
@@ -69,7 +69,7 @@ Forwarded: no
  static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
  {
  	struct cfg80211_chan_def *chandef = NULL;
-@@ -1042,7 +1076,8 @@ static int ath10k_monitor_vdev_start(str
+@@ -1060,7 +1094,8 @@ static int ath10k_monitor_vdev_start(str
  	arg.channel.min_power = 0;
  	arg.channel.max_power = channel->max_power * 2;
  	arg.channel.max_reg_power = channel->max_reg_power * 2;
@@ -79,7 +79,7 @@ Forwarded: no
  
  	reinit_completion(&ar->vdev_setup_done);
  	reinit_completion(&ar->vdev_delete_done);
-@@ -1488,7 +1523,8 @@ static int ath10k_vdev_start_restart(str
+@@ -1506,7 +1541,8 @@ static int ath10k_vdev_start_restart(str
  	arg.channel.min_power = 0;
  	arg.channel.max_power = chandef->chan->max_power * 2;
  	arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
@@ -89,7 +89,7 @@ Forwarded: no
  
  	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
  		arg.ssid = arvif->u.ap.ssid;
-@@ -3259,7 +3295,8 @@ static int ath10k_update_channel_list(st
+@@ -3437,7 +3473,8 @@ static int ath10k_update_channel_list(st
  			ch->min_power = 0;
  			ch->max_power = channel->max_power * 2;
  			ch->max_reg_power = channel->max_reg_power * 2;
diff --git a/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch b/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
new file mode 100644
index 000000000..084e28a2d
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
@@ -0,0 +1,37 @@
+From 22fb5991a44c78ff18ec0082dc90c809356eb893 Mon Sep 17 00:00:00 2001
+From: Ansuel Smith <ansuelsmth@gmail.com>
+Date: Sun, 27 Sep 2020 19:23:35 +0200
+Subject: [PATCH 1/2] ath10k: Try to get mac-address from dts
+
+Most of embedded device that have the ath10k wifi integrated store the
+mac-address in nvmem partitions. Try to fetch the mac-address using the
+standard 'of_get_mac_address' than in all the check also try to fetch the
+address using the nvmem api searching for a defined 'mac-address' cell.
+Mac-address defined in the dts have priority than any other address found.
+
+Tested-on: QCA9984 hw1.0 PCI 10.4
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+---
+ drivers/net/wireless/ath/ath10k/core.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -8,6 +8,7 @@
+ #include <linux/module.h>
+ #include <linux/firmware.h>
+ #include <linux/of.h>
++#include <linux/of_net.h>
+ #include <linux/property.h>
+ #include <linux/dmi.h>
+ #include <linux/ctype.h>
+@@ -3407,6 +3408,8 @@ static int ath10k_core_probe_fw(struct a
+ 
+ 	device_get_mac_address(ar->dev, ar->mac_addr);
+ 
++	of_get_mac_address(ar->dev->of_node, ar->mac_addr);
++
+ 	ret = ath10k_core_init_firmware_features(ar);
+ 	if (ret) {
+ 		ath10k_err(ar, "fatal problem with firmware features: %d\n",
diff --git a/package/kernel/mac80211/patches/ath/990-ath10k-small-buffers.patch b/package/kernel/mac80211/patches/ath10k/990-ath10k-small-buffers.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/990-ath10k-small-buffers.patch
rename to package/kernel/mac80211/patches/ath10k/990-ath10k-small-buffers.patch
diff --git a/package/kernel/mac80211/patches/ath11k/0001-wifi-ath11k-stop-tx-queues-immediately-upon-firmware.patch b/package/kernel/mac80211/patches/ath11k/0001-wifi-ath11k-stop-tx-queues-immediately-upon-firmware.patch
new file mode 100644
index 000000000..d0dc04feb
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0001-wifi-ath11k-stop-tx-queues-immediately-upon-firmware.patch
@@ -0,0 +1,78 @@
+From 81e60b2dfb2744ab6642c4aa62534b4f711fdc5d Mon Sep 17 00:00:00 2001
+From: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Date: Tue, 27 Sep 2022 09:18:54 +0300
+Subject: [PATCH] wifi: ath11k: stop tx queues immediately upon firmware exit
+
+Currently, recovery flag is set immediately upon firmware
+exit but tx queues are stopped once firmware arrives back
+and is ready which is during ath11k_core_restart. Once
+ieee80211 hw restart is completed, tx queues are resumed.
+If during the time delta between firmware exit and firmware
+ready, mac80211 send packets, currently ath11k will drop it
+since recovery flag will be set. But warning prints will
+come -
+  "ath11k c000000.wifi: failed to transmit frame -108"
+
+If more tx packets are there, this could lead to flooding
+of above print.
+
+However, actually tx queues should be stopped immediately
+when firmware leaves. This will prevent packets to get
+dropped when firmware is recovering.
+
+Add fix to stop tx queues immediately after firmware exit.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220923170235.18873-1-quic_adisi@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c | 5 +----
+ drivers/net/wireless/ath/ath11k/core.h | 1 +
+ drivers/net/wireless/ath/ath11k/qmi.c  | 3 +++
+ 3 files changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -1641,7 +1641,7 @@ static void ath11k_update_11d(struct wor
+ 	}
+ }
+ 
+-static void ath11k_core_pre_reconfigure_recovery(struct ath11k_base *ab)
++void ath11k_core_pre_reconfigure_recovery(struct ath11k_base *ab)
+ {
+ 	struct ath11k *ar;
+ 	struct ath11k_pdev *pdev;
+@@ -1730,9 +1730,6 @@ static void ath11k_core_restart(struct w
+ 	struct ath11k_base *ab = container_of(work, struct ath11k_base, restart_work);
+ 	int ret;
+ 
+-	if (!ab->is_reset)
+-		ath11k_core_pre_reconfigure_recovery(ab);
+-
+ 	ret = ath11k_core_reconfigure_on_crash(ab);
+ 	if (ret) {
+ 		ath11k_err(ab, "failed to reconfigure driver on crash recovery\n");
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -1158,6 +1158,7 @@ int ath11k_core_check_smbios(struct ath1
+ void ath11k_core_halt(struct ath11k *ar);
+ int ath11k_core_resume(struct ath11k_base *ab);
+ int ath11k_core_suspend(struct ath11k_base *ab);
++void ath11k_core_pre_reconfigure_recovery(struct ath11k_base *ab);
+ 
+ const struct firmware *ath11k_core_firmware_request(struct ath11k_base *ab,
+ 						    const char *filename);
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -3164,6 +3164,9 @@ static void ath11k_qmi_driver_event_work
+ 		case ATH11K_QMI_EVENT_SERVER_EXIT:
+ 			set_bit(ATH11K_FLAG_CRASH_FLUSH, &ab->dev_flags);
+ 			set_bit(ATH11K_FLAG_RECOVERY, &ab->dev_flags);
++
++			if (!ab->is_reset)
++				ath11k_core_pre_reconfigure_recovery(ab);
+ 			break;
+ 		case ATH11K_QMI_EVENT_REQUEST_MEM:
+ 			ret = ath11k_qmi_event_mem_request(qmi);
diff --git a/package/kernel/mac80211/patches/ath11k/0002-wifi-ath11k-Don-t-exit-on-wakeup-failure.patch b/package/kernel/mac80211/patches/ath11k/0002-wifi-ath11k-Don-t-exit-on-wakeup-failure.patch
new file mode 100644
index 000000000..47385e045
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0002-wifi-ath11k-Don-t-exit-on-wakeup-failure.patch
@@ -0,0 +1,45 @@
+From 45d2e268369b0c768d5a644f319758bcfd370521 Mon Sep 17 00:00:00 2001
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+Date: Wed, 28 Sep 2022 09:51:40 +0800
+Subject: [PATCH] wifi: ath11k: Don't exit on wakeup failure
+
+Currently, ath11k_pcic_read() returns an error if wakeup()
+fails, this makes firmware crash debug quite hard because we can
+get nothing.
+
+Change to go ahead on wakeup failure, in that case we still may
+get something valid to check. There should be no mislead due
+to incorrect content because we are aware of the failure with the
+log printed.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
+
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220928015140.5431-1-quic_bqiang@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/pcic.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/pcic.c
++++ b/drivers/net/wireless/ath/ath11k/pcic.c
+@@ -218,9 +218,16 @@ int ath11k_pcic_read(struct ath11k_base
+ 	if (wakeup_required && ab->pci.ops->wakeup) {
+ 		ret = ab->pci.ops->wakeup(ab);
+ 		if (ret) {
+-			ath11k_warn(ab, "failed to wakeup for read from 0x%x: %d\n",
+-				    start, ret);
+-			return ret;
++			ath11k_warn(ab,
++				    "wakeup failed, data may be invalid: %d",
++				    ret);
++			/* Even though wakeup() failed, continue processing rather
++			 * than returning because some parts of the data may still
++			 * be valid and useful in some cases, e.g. could give us
++			 * some clues on firmware crash.
++			 * Mislead due to invalid data could be avoided because we
++			 * are aware of the wakeup failure.
++			 */
+ 		}
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0005-wifi-ath11k-Fix-spelling-mistake-chnange-change.patch b/package/kernel/mac80211/patches/ath11k/0005-wifi-ath11k-Fix-spelling-mistake-chnange-change.patch
new file mode 100644
index 000000000..4b52252ef
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0005-wifi-ath11k-Fix-spelling-mistake-chnange-change.patch
@@ -0,0 +1,25 @@
+From a797f479bf3e02c6d179c2e6aeace7f9b22b0acd Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.i.king@gmail.com>
+Date: Wed, 28 Sep 2022 15:38:34 +0100
+Subject: [PATCH] wifi: ath11k: Fix spelling mistake "chnange" -> "change"
+
+There is a spelling mistake in an ath11k_dbg debug message. Fix it.
+
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220928143834.35189-1-colin.i.king@gmail.com
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -6829,7 +6829,7 @@ static void ath11k_wmi_event_peer_sta_ps
+ 	}
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI,
+-		   "peer sta ps chnange ev addr %pM state %u sup_bitmap %x ps_valid %u ts %u\n",
++		   "peer sta ps change ev addr %pM state %u sup_bitmap %x ps_valid %u ts %u\n",
+ 		   ev->peer_macaddr.addr, ev->peer_ps_state,
+ 		   ev->ps_supported_bitmap, ev->peer_ps_valid,
+ 		   ev->peer_ps_timestamp);
diff --git a/package/kernel/mac80211/patches/ath11k/0007-wifi-ath11k-suppress-add-interface-error.patch b/package/kernel/mac80211/patches/ath11k/0007-wifi-ath11k-suppress-add-interface-error.patch
new file mode 100644
index 000000000..fbef0abb8
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0007-wifi-ath11k-suppress-add-interface-error.patch
@@ -0,0 +1,52 @@
+From 638b26652b0438563a76ec90014c8cba34db982b Mon Sep 17 00:00:00 2001
+From: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Date: Thu, 6 Oct 2022 06:28:42 +0530
+Subject: [PATCH 7/9] wifi: ath11k: suppress add interface error
+
+In the VIF (other than monitor type) creation request, we should not
+throw the error code when the monitor VIF creation fails, since the
+actual VIF creation succeeds. If we throw the error code from driver
+then the actual VIF creation get fail. So suppress the monitor VIF
+creation error by throwing warning message instead of error code.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.6.0.1-00760-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221006005842.8599-1-quic_periyasa@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6421,18 +6421,16 @@ static int ath11k_mac_op_add_interface(s
+ 
+ 	ath11k_dp_vdev_tx_attach(ar, arvif);
+ 
++	ath11k_debugfs_add_interface(arvif);
++
+ 	if (vif->type != NL80211_IFTYPE_MONITOR &&
+ 	    test_bit(ATH11K_FLAG_MONITOR_CONF_ENABLED, &ar->monitor_flags)) {
+ 		ret = ath11k_mac_monitor_vdev_create(ar);
+-		if (ret) {
++		if (ret)
+ 			ath11k_warn(ar->ab, "failed to create monitor vdev during add interface: %d",
+ 				    ret);
+-			goto err_peer_del;
+-		}
+ 	}
+ 
+-	ath11k_debugfs_add_interface(arvif);
+-
+ 	mutex_unlock(&ar->conf_mutex);
+ 
+ 	return 0;
+@@ -6457,7 +6455,6 @@ err_vdev_del:
+ 	spin_unlock_bh(&ar->data_lock);
+ 
+ err:
+-	ath11k_debugfs_remove_interface(arvif);
+ 	mutex_unlock(&ar->conf_mutex);
+ 
+ 	return ret;
diff --git a/package/kernel/mac80211/patches/ath11k/0008-wifi-ath11k-add-support-to-configure-channel-dwell-t.patch b/package/kernel/mac80211/patches/ath11k/0008-wifi-ath11k-add-support-to-configure-channel-dwell-t.patch
new file mode 100644
index 000000000..d0b19fe59
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0008-wifi-ath11k-add-support-to-configure-channel-dwell-t.patch
@@ -0,0 +1,102 @@
+From c362daa213cdeb0a9e7c2ed84849544c24505720 Mon Sep 17 00:00:00 2001
+From: Manikanta Pubbisetty <quic_mpubbise@quicinc.com>
+Date: Fri, 7 Oct 2022 10:41:30 +0530
+Subject: [PATCH 8/9] wifi: ath11k: add support to configure channel dwell time
+
+Add support to configure channel dwell time during scan.
+Dwell time help to stay on the channel for a specified duration
+during scan and aid userspace in finding WiFi networks. Very
+useful in passive scans where longer dwell times are needed
+to find the WiFi networks.
+
+Configure channel dwell time from duration of the scan request
+received from mac80211 when the duration is non-zero. When the
+scan request does not have duration value, use the default ones,
+the current implementation.
+
+Advertise corresponding feature flag NL80211_EXT_FEATURE_SET_SCAN_DWELL
+to enable the feature.
+
+Change is applicable for all ath11k hardware.
+
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1
+
+Signed-off-by: Manikanta Pubbisetty <quic_mpubbise@quicinc.com>
+Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221007051130.6067-1-quic_mpubbise@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 33 +++++++++++++++++++++++----
+ 1 file changed, 29 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -241,7 +241,10 @@ const struct htt_rx_ring_tlv_filter ath1
+ #define ath11k_a_rates (ath11k_legacy_rates + 4)
+ #define ath11k_a_rates_size (ARRAY_SIZE(ath11k_legacy_rates) - 4)
+ 
+-#define ATH11K_MAC_SCAN_TIMEOUT_MSECS 200 /* in msecs */
++#define ATH11K_MAC_SCAN_CMD_EVT_OVERHEAD		200 /* in msecs */
++
++/* Overhead due to the processing of channel switch events from FW */
++#define ATH11K_SCAN_CHANNEL_SWITCH_WMI_EVT_OVERHEAD	10 /* in msecs */
+ 
+ static const u32 ath11k_smps_map[] = {
+ 	[WLAN_HT_CAP_SM_PS_STATIC] = WMI_PEER_SMPS_STATIC,
+@@ -3612,6 +3615,7 @@ static int ath11k_mac_op_hw_scan(struct
+ 	struct scan_req_params arg;
+ 	int ret = 0;
+ 	int i;
++	u32 scan_timeout;
+ 
+ 	mutex_lock(&ar->conf_mutex);
+ 
+@@ -3681,6 +3685,26 @@ static int ath11k_mac_op_hw_scan(struct
+ 		ether_addr_copy(arg.mac_mask.addr, req->mac_addr_mask);
+ 	}
+ 
++	/* if duration is set, default dwell times will be overwritten */
++	if (req->duration) {
++		arg.dwell_time_active = req->duration;
++		arg.dwell_time_active_2g = req->duration;
++		arg.dwell_time_active_6g = req->duration;
++		arg.dwell_time_passive = req->duration;
++		arg.dwell_time_passive_6g = req->duration;
++		arg.burst_duration = req->duration;
++
++		scan_timeout = min_t(u32, arg.max_rest_time *
++				(arg.num_chan - 1) + (req->duration +
++				ATH11K_SCAN_CHANNEL_SWITCH_WMI_EVT_OVERHEAD) *
++				arg.num_chan, arg.max_scan_time);
++	} else {
++		scan_timeout = arg.max_scan_time;
++	}
++
++	/* Add a margin to account for event/command processing */
++	scan_timeout += ATH11K_MAC_SCAN_CMD_EVT_OVERHEAD;
++
+ 	ret = ath11k_start_scan(ar, &arg);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to start hw scan: %d\n", ret);
+@@ -3689,10 +3713,8 @@ static int ath11k_mac_op_hw_scan(struct
+ 		spin_unlock_bh(&ar->data_lock);
+ 	}
+ 
+-	/* Add a 200ms margin to account for event/command processing */
+ 	ieee80211_queue_delayed_work(ar->hw, &ar->scan.timeout,
+-				     msecs_to_jiffies(arg.max_scan_time +
+-						      ATH11K_MAC_SCAN_TIMEOUT_MSECS));
++				     msecs_to_jiffies(scan_timeout));
+ 
+ exit:
+ 	kfree(arg.chan_list);
+@@ -9060,6 +9082,9 @@ static int __ath11k_mac_register(struct
+ 				      NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP);
+ 	}
+ 
++	wiphy_ext_feature_set(ar->hw->wiphy,
++			      NL80211_EXT_FEATURE_SET_SCAN_DWELL);
++
+ 	ath11k_reg_init(ar);
+ 
+ 	if (!test_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags)) {
diff --git a/package/kernel/mac80211/patches/ath11k/0010-wifi-ath11k-Fix-firmware-crash-on-vdev-delete-race-c.patch b/package/kernel/mac80211/patches/ath11k/0010-wifi-ath11k-Fix-firmware-crash-on-vdev-delete-race-c.patch
new file mode 100644
index 000000000..7275af06e
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0010-wifi-ath11k-Fix-firmware-crash-on-vdev-delete-race-c.patch
@@ -0,0 +1,116 @@
+From 3811fa1f231f1a3e29759efef4992116604aab8b Mon Sep 17 00:00:00 2001
+From: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
+Date: Tue, 11 Oct 2022 15:23:46 +0530
+Subject: [PATCH] wifi: ath11k: Fix firmware crash on vdev delete race
+ condition
+
+Current code does not wait for vdev delete completion on vdev create
+failures and tries to send another vdev create followed by vdev set
+param to firmware with same vdev id. This causes firmware crash.
+Fix this crash by waiting for vdev delete completion on vdev
+create failures.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.6.0.1-00905-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221011095346.3901-1-quic_ssreeela@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 60 +++++++++++++++++----------
+ 1 file changed, 37 insertions(+), 23 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6233,6 +6233,40 @@ void ath11k_mac_11d_scan_stop_all(struct
+ 	}
+ }
+ 
++static int ath11k_mac_vdev_delete(struct ath11k *ar, struct ath11k_vif *arvif)
++{
++	unsigned long time_left;
++	struct ieee80211_vif *vif = arvif->vif;
++	int ret = 0;
++
++	lockdep_assert_held(&ar->conf_mutex);
++
++	reinit_completion(&ar->vdev_delete_done);
++
++	ret = ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to delete WMI vdev %d: %d\n",
++			    arvif->vdev_id, ret);
++		return ret;
++	}
++
++	time_left = wait_for_completion_timeout(&ar->vdev_delete_done,
++						ATH11K_VDEV_DELETE_TIMEOUT_HZ);
++	if (time_left == 0) {
++		ath11k_warn(ar->ab, "Timeout in receiving vdev delete response\n");
++		return -ETIMEDOUT;
++	}
++
++	ar->ab->free_vdev_map |= 1LL << (arvif->vdev_id);
++	ar->allocated_vdev_map &= ~(1LL << arvif->vdev_id);
++	ar->num_created_vdevs--;
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "vdev %pM deleted, vdev_id %d\n",
++		   vif->addr, arvif->vdev_id);
++
++	return ret;
++}
++
+ static int ath11k_mac_op_add_interface(struct ieee80211_hw *hw,
+ 				       struct ieee80211_vif *vif)
+ {
+@@ -6468,10 +6502,7 @@ err_peer_del:
+ 	}
+ 
+ err_vdev_del:
+-	ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
+-	ar->num_created_vdevs--;
+-	ar->allocated_vdev_map &= ~(1LL << arvif->vdev_id);
+-	ab->free_vdev_map |= 1LL << arvif->vdev_id;
++	ath11k_mac_vdev_delete(ar, arvif);
+ 	spin_lock_bh(&ar->data_lock);
+ 	list_del(&arvif->list);
+ 	spin_unlock_bh(&ar->data_lock);
+@@ -6499,7 +6530,6 @@ static void ath11k_mac_op_remove_interfa
+ 	struct ath11k *ar = hw->priv;
+ 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+ 	struct ath11k_base *ab = ar->ab;
+-	unsigned long time_left;
+ 	int ret;
+ 	int i;
+ 
+@@ -6520,29 +6550,13 @@ static void ath11k_mac_op_remove_interfa
+ 				    arvif->vdev_id, ret);
+ 	}
+ 
+-	reinit_completion(&ar->vdev_delete_done);
+-
+-	ret = ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
++	ret = ath11k_mac_vdev_delete(ar, arvif);
+ 	if (ret) {
+-		ath11k_warn(ab, "failed to delete WMI vdev %d: %d\n",
++		ath11k_warn(ab, "failed to delete vdev %d: %d\n",
+ 			    arvif->vdev_id, ret);
+ 		goto err_vdev_del;
+ 	}
+ 
+-	time_left = wait_for_completion_timeout(&ar->vdev_delete_done,
+-						ATH11K_VDEV_DELETE_TIMEOUT_HZ);
+-	if (time_left == 0) {
+-		ath11k_warn(ab, "Timeout in receiving vdev delete response\n");
+-		goto err_vdev_del;
+-	}
+-
+-	ab->free_vdev_map |= 1LL << (arvif->vdev_id);
+-	ar->allocated_vdev_map &= ~(1LL << arvif->vdev_id);
+-	ar->num_created_vdevs--;
+-
+-	ath11k_dbg(ab, ATH11K_DBG_MAC, "vdev %pM deleted, vdev_id %d\n",
+-		   vif->addr, arvif->vdev_id);
+-
+ 	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
+ 		clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
+ 		ar->monitor_vdev_id = -1;
diff --git a/package/kernel/mac80211/patches/ath11k/0011-wifi-ath11k-fix-monitor-vdev-creation-with-firmware-.patch b/package/kernel/mac80211/patches/ath11k/0011-wifi-ath11k-fix-monitor-vdev-creation-with-firmware-.patch
new file mode 100644
index 000000000..2f066d0a5
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0011-wifi-ath11k-fix-monitor-vdev-creation-with-firmware-.patch
@@ -0,0 +1,40 @@
+From f3ca72b0327101a074a871539e61775d43908ca4 Mon Sep 17 00:00:00 2001
+From: Nagarajan Maran <quic_nmaran@quicinc.com>
+Date: Fri, 14 Oct 2022 21:20:54 +0530
+Subject: [PATCH] wifi: ath11k: fix monitor vdev creation with firmware
+ recovery
+
+During firmware recovery, the monitor interface is not
+getting created in the driver and firmware since
+the respective flags are not updated properly.
+
+So after firmware recovery is successful, when monitor
+interface is brought down manually, firmware assertion
+is observed, since we are trying to bring down the
+interface which is not yet created in the firmware.
+
+Fix this by updating the monitor flags properly per
+phy#, during firmware recovery.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221014155054.11471-1-quic_nmaran@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -1677,6 +1677,10 @@ void ath11k_core_pre_reconfigure_recover
+ 			     ath11k_mac_tx_mgmt_pending_free, ar);
+ 		idr_destroy(&ar->txmgmt_idr);
+ 		wake_up(&ar->txmgmt_empty_waitq);
++
++		ar->monitor_vdev_id = -1;
++		clear_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags);
++		clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
+ 	}
+ 
+ 	wake_up(&ab->wmi_ab.tx_credits_wq);
diff --git a/package/kernel/mac80211/patches/ath11k/0012-wifi-ath11k-Fix-qmi_msg_handler-data-structure-initi.patch b/package/kernel/mac80211/patches/ath11k/0012-wifi-ath11k-Fix-qmi_msg_handler-data-structure-initi.patch
new file mode 100644
index 000000000..fccfa4385
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0012-wifi-ath11k-Fix-qmi_msg_handler-data-structure-initi.patch
@@ -0,0 +1,33 @@
+From ed3725e15a154ebebf44e0c34806c57525483f92 Mon Sep 17 00:00:00 2001
+From: Rahul Bhattacharjee <quic_rbhattac@quicinc.com>
+Date: Fri, 21 Oct 2022 14:31:26 +0530
+Subject: [PATCH] wifi: ath11k: Fix qmi_msg_handler data structure
+ initialization
+
+qmi_msg_handler is required to be null terminated by QMI module.
+There might be a case where a handler for a msg id is not present in the
+handlers array which can lead to infinite loop while searching the handler
+and therefore out of bound access in qmi_invoke_handler().
+Hence update the initialization in qmi_msg_handler data structure.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Rahul Bhattacharjee <quic_rbhattac@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221021090126.28626-1-quic_rbhattac@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/qmi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -1702,6 +1702,9 @@ static struct qmi_elem_info qmi_wlfw_fw_
+ 		.data_type = QMI_EOTI,
+ 		.array_type = NO_ARRAY,
+ 	},
++
++	/* end of list */
++	{},
+ };
+ 
+ static int ath11k_qmi_host_cap_send(struct ath11k_base *ab)
diff --git a/package/kernel/mac80211/patches/ath11k/0013-wifi-ath11k-synchronize-ath11k_mac_he_gi_to_nl80211_.patch b/package/kernel/mac80211/patches/ath11k/0013-wifi-ath11k-synchronize-ath11k_mac_he_gi_to_nl80211_.patch
new file mode 100644
index 000000000..1e89b4d4f
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0013-wifi-ath11k-synchronize-ath11k_mac_he_gi_to_nl80211_.patch
@@ -0,0 +1,42 @@
+From dd1c2322694522f674c874f5fa02ac5ae39135dd Mon Sep 17 00:00:00 2001
+From: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
+Date: Mon, 31 Oct 2022 12:43:41 +0100
+Subject: [PATCH] wifi: ath11k: synchronize
+ ath11k_mac_he_gi_to_nl80211_he_gi()'s return type
+
+ath11k_mac_he_gi_to_nl80211_he_gi() generates a valid warning with gcc-13:
+  drivers/net/wireless/ath/ath11k/mac.c:321:20: error: conflicting types for 'ath11k_mac_he_gi_to_nl80211_he_gi' due to enum/integer mismatch; have 'enum nl80211_he_gi(u8)'
+  drivers/net/wireless/ath/ath11k/mac.h:166:5: note: previous declaration of 'ath11k_mac_he_gi_to_nl80211_he_gi' with type 'u32(u8)'
+
+I.e. the type of the return value ath11k_mac_he_gi_to_nl80211_he_gi() in
+the declaration is u32, while the definition spells enum nl80211_he_gi.
+Synchronize them to the latter.
+
+Cc: Martin Liska <mliska@suse.cz>
+Cc: Kalle Valo <kvalo@kernel.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: ath11k@lists.infradead.org
+Cc: linux-wireless@vger.kernel.org
+Cc: netdev@vger.kernel.org
+Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221031114341.10377-1-jirislaby@kernel.org
+---
+ drivers/net/wireless/ath/ath11k/mac.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.h
++++ b/drivers/net/wireless/ath/ath11k/mac.h
+@@ -163,7 +163,7 @@ void ath11k_mac_drain_tx(struct ath11k *
+ void ath11k_mac_peer_cleanup_all(struct ath11k *ar);
+ int ath11k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx);
+ u8 ath11k_mac_bw_to_mac80211_bw(u8 bw);
+-u32 ath11k_mac_he_gi_to_nl80211_he_gi(u8 sgi);
++enum nl80211_he_gi ath11k_mac_he_gi_to_nl80211_he_gi(u8 sgi);
+ enum nl80211_he_ru_alloc ath11k_mac_phy_he_ru_to_nl80211_he_ru_alloc(u16 ru_phy);
+ enum nl80211_he_ru_alloc ath11k_mac_he_ru_tones_to_nl80211_he_ru_alloc(u16 ru_tones);
+ enum ath11k_supported_bw ath11k_mac_mac80211_bw_to_ath11k_bw(enum rate_info_bw bw);
diff --git a/package/kernel/mac80211/patches/ath11k/0016-wifi-ath11k-Make-QMI-message-rules-const.patch b/package/kernel/mac80211/patches/ath11k/0016-wifi-ath11k-Make-QMI-message-rules-const.patch
new file mode 100644
index 000000000..1f48df73f
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0016-wifi-ath11k-Make-QMI-message-rules-const.patch
@@ -0,0 +1,341 @@
+From 93c1592889fca46d09d833455628bab05516cdbf Mon Sep 17 00:00:00 2001
+From: Jeff Johnson <quic_jjohnson@quicinc.com>
+Date: Wed, 14 Sep 2022 17:23:03 -0700
+Subject: [PATCH] wifi: ath11k: Make QMI message rules const
+
+Commit ff6d365898d4 ("soc: qcom: qmi: use const for struct
+qmi_elem_info") allows QMI message encoding/decoding rules to be
+const, so do that for ath11k.
+
+Compile tested only.
+
+Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220915002303.12206-1-quic_jjohnson@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/qmi.c | 72 +++++++++++++--------------
+ 1 file changed, 36 insertions(+), 36 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -29,7 +29,7 @@ module_param_named(cold_boot_cal, ath11k
+ MODULE_PARM_DESC(cold_boot_cal,
+ 		 "Decrease the channel switch time but increase the driver load time (Default: true)");
+ 
+-static struct qmi_elem_info qmi_wlanfw_host_cap_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_host_cap_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_OPT_FLAG,
+ 		.elem_len	= 1,
+@@ -280,7 +280,7 @@ static struct qmi_elem_info qmi_wlanfw_h
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_host_cap_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_host_cap_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -297,7 +297,7 @@ static struct qmi_elem_info qmi_wlanfw_h
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_ind_register_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_ind_register_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_OPT_FLAG,
+ 		.elem_len	= 1,
+@@ -522,7 +522,7 @@ static struct qmi_elem_info qmi_wlanfw_i
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_ind_register_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_ind_register_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -558,7 +558,7 @@ static struct qmi_elem_info qmi_wlanfw_i
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_mem_cfg_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_mem_cfg_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_8_BYTE,
+ 		.elem_len	= 1,
+@@ -590,7 +590,7 @@ static struct qmi_elem_info qmi_wlanfw_m
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_mem_seg_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_mem_seg_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -632,7 +632,7 @@ static struct qmi_elem_info qmi_wlanfw_m
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_request_mem_ind_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_request_mem_ind_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_DATA_LEN,
+ 		.elem_len	= 1,
+@@ -659,7 +659,7 @@ static struct qmi_elem_info qmi_wlanfw_r
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_mem_seg_resp_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_mem_seg_resp_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_8_BYTE,
+ 		.elem_len	= 1,
+@@ -699,7 +699,7 @@ static struct qmi_elem_info qmi_wlanfw_m
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_respond_mem_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_respond_mem_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_DATA_LEN,
+ 		.elem_len	= 1,
+@@ -726,7 +726,7 @@ static struct qmi_elem_info qmi_wlanfw_r
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_respond_mem_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_respond_mem_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -744,7 +744,7 @@ static struct qmi_elem_info qmi_wlanfw_r
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_cap_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_cap_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_EOTI,
+ 		.array_type	= NO_ARRAY,
+@@ -752,7 +752,7 @@ static struct qmi_elem_info qmi_wlanfw_c
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_device_info_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_device_info_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type      = QMI_EOTI,
+ 		.array_type     = NO_ARRAY,
+@@ -760,7 +760,7 @@ static struct qmi_elem_info qmi_wlanfw_d
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlfw_device_info_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlfw_device_info_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -814,7 +814,7 @@ static struct qmi_elem_info qmi_wlfw_dev
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_rf_chip_info_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_rf_chip_info_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -840,7 +840,7 @@ static struct qmi_elem_info qmi_wlanfw_r
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_rf_board_info_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_rf_board_info_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -857,7 +857,7 @@ static struct qmi_elem_info qmi_wlanfw_r
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_soc_info_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_soc_info_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -873,7 +873,7 @@ static struct qmi_elem_info qmi_wlanfw_s
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_fw_version_info_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_fw_version_info_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -899,7 +899,7 @@ static struct qmi_elem_info qmi_wlanfw_f
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_cap_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_cap_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -1100,7 +1100,7 @@ static struct qmi_elem_info qmi_wlanfw_c
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_bdf_download_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_bdf_download_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_1_BYTE,
+ 		.elem_len	= 1,
+@@ -1235,7 +1235,7 @@ static struct qmi_elem_info qmi_wlanfw_b
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_bdf_download_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_bdf_download_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -1253,7 +1253,7 @@ static struct qmi_elem_info qmi_wlanfw_b
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_m3_info_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_m3_info_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_8_BYTE,
+ 		.elem_len	= 1,
+@@ -1277,7 +1277,7 @@ static struct qmi_elem_info qmi_wlanfw_m
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_m3_info_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_m3_info_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -1294,7 +1294,7 @@ static struct qmi_elem_info qmi_wlanfw_m
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_ce_tgt_pipe_cfg_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_ce_tgt_pipe_cfg_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -1347,7 +1347,7 @@ static struct qmi_elem_info qmi_wlanfw_c
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_ce_svc_pipe_cfg_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_ce_svc_pipe_cfg_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -1382,7 +1382,7 @@ static struct qmi_elem_info qmi_wlanfw_c
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_shadow_reg_cfg_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_shadow_reg_cfg_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_2_BYTE,
+ 		.elem_len	= 1,
+@@ -1406,7 +1406,7 @@ static struct qmi_elem_info qmi_wlanfw_s
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_shadow_reg_v2_cfg_s_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_shadow_reg_v2_cfg_s_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -1423,7 +1423,7 @@ static struct qmi_elem_info qmi_wlanfw_s
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_wlan_mode_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_wlan_mode_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_UNSIGNED_4_BYTE,
+ 		.elem_len	= 1,
+@@ -1458,7 +1458,7 @@ static struct qmi_elem_info qmi_wlanfw_w
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_wlan_mode_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_wlan_mode_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -1476,7 +1476,7 @@ static struct qmi_elem_info qmi_wlanfw_w
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_wlan_cfg_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_wlan_cfg_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_OPT_FLAG,
+ 		.elem_len	= 1,
+@@ -1615,7 +1615,7 @@ static struct qmi_elem_info qmi_wlanfw_w
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_wlan_cfg_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_wlan_cfg_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -1632,28 +1632,28 @@ static struct qmi_elem_info qmi_wlanfw_w
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_mem_ready_ind_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_mem_ready_ind_msg_v01_ei[] = {
+ 	{
+ 		.data_type = QMI_EOTI,
+ 		.array_type = NO_ARRAY,
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_fw_ready_ind_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_fw_ready_ind_msg_v01_ei[] = {
+ 	{
+ 		.data_type = QMI_EOTI,
+ 		.array_type = NO_ARRAY,
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_cold_boot_cal_done_ind_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_cold_boot_cal_done_ind_msg_v01_ei[] = {
+ 	{
+ 		.data_type = QMI_EOTI,
+ 		.array_type = NO_ARRAY,
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_wlan_ini_req_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_wlan_ini_req_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_OPT_FLAG,
+ 		.elem_len	= 1,
+@@ -1679,7 +1679,7 @@ static struct qmi_elem_info qmi_wlanfw_w
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlanfw_wlan_ini_resp_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlanfw_wlan_ini_resp_msg_v01_ei[] = {
+ 	{
+ 		.data_type	= QMI_STRUCT,
+ 		.elem_len	= 1,
+@@ -1697,7 +1697,7 @@ static struct qmi_elem_info qmi_wlanfw_w
+ 	},
+ };
+ 
+-static struct qmi_elem_info qmi_wlfw_fw_init_done_ind_msg_v01_ei[] = {
++static const struct qmi_elem_info qmi_wlfw_fw_init_done_ind_msg_v01_ei[] = {
+ 	{
+ 		.data_type = QMI_EOTI,
+ 		.array_type = NO_ARRAY,
diff --git a/package/kernel/mac80211/patches/ath11k/0017-wifi-ath11k-Trigger-sta-disconnect-on-hardware-resta.patch b/package/kernel/mac80211/patches/ath11k/0017-wifi-ath11k-Trigger-sta-disconnect-on-hardware-resta.patch
new file mode 100644
index 000000000..f95e5027b
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0017-wifi-ath11k-Trigger-sta-disconnect-on-hardware-resta.patch
@@ -0,0 +1,119 @@
+From a018750a2cceaf4427c4ee3d9ce3e83a171d5bd6 Mon Sep 17 00:00:00 2001
+From: Youghandhar Chintala <quic_youghand@quicinc.com>
+Date: Fri, 4 Nov 2022 14:24:03 +0530
+Subject: [PATCH] wifi: ath11k: Trigger sta disconnect on hardware restart
+
+Currently after the hardware restart triggered from the driver, the
+station interface connection remains intact, since a disconnect trigger
+is not sent to userspace. This can lead to a problem in targets where
+the wifi mac sequence is added by the firmware.
+
+After the target restart, its wifi mac sequence number gets reset to
+zero. Hence AP to which our device is connected will receive frames with
+a  wifi mac sequence number jump to the past, thereby resulting in the
+AP dropping all these frames, until the frame arrives with a wifi mac
+sequence number which AP was expecting.
+
+To avoid such frame drops, its better to trigger a station disconnect
+upon target hardware restart which can be done with API
+ieee80211_reconfig_disconnect exposed to mac80211.
+
+The other targets are not affected by this change, since the hardware
+params flag is not set.
+
+Reported-by: kernel test robot <lkp@intel.com>
+
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1
+
+Signed-off-by: Youghandhar Chintala <quic_youghand@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221104085403.11025-1-quic_youghand@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c | 6 ++++++
+ drivers/net/wireless/ath/ath11k/hw.h   | 1 +
+ drivers/net/wireless/ath/ath11k/mac.c  | 7 +++++++
+ 3 files changed, 14 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -195,6 +195,7 @@ static const struct ath11k_hw_params ath
+ 		.tcl_ring_retry = true,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
++		.support_fw_mac_sequence = false,
+ 	},
+ 	{
+ 		.name = "qca6390 hw2.0",
+@@ -277,6 +278,7 @@ static const struct ath11k_hw_params ath
+ 		.tcl_ring_retry = true,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
++		.support_fw_mac_sequence = true,
+ 	},
+ 	{
+ 		.name = "qcn9074 hw1.0",
+@@ -356,6 +358,7 @@ static const struct ath11k_hw_params ath
+ 		.tcl_ring_retry = true,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
++		.support_fw_mac_sequence = false,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.0",
+@@ -438,6 +441,7 @@ static const struct ath11k_hw_params ath
+ 		.tcl_ring_retry = true,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
++		.support_fw_mac_sequence = true,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.1",
+@@ -519,6 +523,7 @@ static const struct ath11k_hw_params ath
+ 		.tcl_ring_retry = true,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
++		.support_fw_mac_sequence = true,
+ 	},
+ 	{
+ 		.name = "wcn6750 hw1.0",
+@@ -597,6 +602,7 @@ static const struct ath11k_hw_params ath
+ 		.tcl_ring_retry = false,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE_WCN6750,
+ 		.smp2p_wow_exit = true,
++		.support_fw_mac_sequence = true,
+ 	},
+ };
+ 
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -219,6 +219,7 @@ struct ath11k_hw_params {
+ 	bool tcl_ring_retry;
+ 	u32 tx_ring_size;
+ 	bool smp2p_wow_exit;
++	bool support_fw_mac_sequence;
+ };
+ 
+ struct ath11k_hw_ops {
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -8010,6 +8010,7 @@ ath11k_mac_op_reconfig_complete(struct i
+ 	struct ath11k *ar = hw->priv;
+ 	struct ath11k_base *ab = ar->ab;
+ 	int recovery_count;
++	struct ath11k_vif *arvif;
+ 
+ 	if (reconfig_type != IEEE80211_RECONFIG_TYPE_RESTART)
+ 		return;
+@@ -8045,6 +8046,12 @@ ath11k_mac_op_reconfig_complete(struct i
+ 				ath11k_dbg(ab, ATH11K_DBG_BOOT, "reset success\n");
+ 			}
+ 		}
++		if (ar->ab->hw_params.support_fw_mac_sequence) {
++			list_for_each_entry(arvif, &ar->arvifs, list) {
++				if (arvif->is_up && arvif->vdev_type == WMI_VDEV_TYPE_STA)
++					ieee80211_hw_restart_disconnect(arvif->vif);
++			}
++		}
+ 	}
+ 
+ 	mutex_unlock(&ar->conf_mutex);
diff --git a/package/kernel/mac80211/patches/ath11k/0018-wifi-ath11k-Fix-race-condition-with-struct-htt_ppdu_.patch b/package/kernel/mac80211/patches/ath11k/0018-wifi-ath11k-Fix-race-condition-with-struct-htt_ppdu_.patch
new file mode 100644
index 000000000..cef61ee34
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0018-wifi-ath11k-Fix-race-condition-with-struct-htt_ppdu_.patch
@@ -0,0 +1,103 @@
+From e44de90453bb2b46a523df78c39eb896bab35dcd Mon Sep 17 00:00:00 2001
+From: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
+Date: Tue, 29 Nov 2022 13:04:02 +0200
+Subject: [PATCH] wifi: ath11k: Fix race condition with struct
+ htt_ppdu_stats_info
+
+A crash happens when running the traffic with multiple clients:
+
+Crash Signature : Unable to handle kernel paging request at
+virtual address ffffffd700970918 During the crash, PC points to
+"ieee80211_tx_rate_update+0x30/0x68 [mac80211]"
+LR points to "ath11k_dp_htt_htc_t2h_msg_handler+0x5a8/0x8a0 [ath11k]".
+
+Struct ppdu_stats_info is allocated and accessed from event callback via copy
+engine tasklet, this has a problem when freeing it from ath11k_mac_op_stop().
+
+Use data_lock during entire ath11k_dp_htt_get_ppdu_desc() call to protect
+struct htt_ppdu_stats_info access and to avoid race condition when accessing it
+from ath11k_mac_op_stop().
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
+Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221124071104.22506-1-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -1535,13 +1535,12 @@ struct htt_ppdu_stats_info *ath11k_dp_ht
+ {
+ 	struct htt_ppdu_stats_info *ppdu_info;
+ 
+-	spin_lock_bh(&ar->data_lock);
++	lockdep_assert_held(&ar->data_lock);
++
+ 	if (!list_empty(&ar->ppdu_stats_info)) {
+ 		list_for_each_entry(ppdu_info, &ar->ppdu_stats_info, list) {
+-			if (ppdu_info->ppdu_id == ppdu_id) {
+-				spin_unlock_bh(&ar->data_lock);
++			if (ppdu_info->ppdu_id == ppdu_id)
+ 				return ppdu_info;
+-			}
+ 		}
+ 
+ 		if (ar->ppdu_stat_list_depth > HTT_PPDU_DESC_MAX_DEPTH) {
+@@ -1553,16 +1552,13 @@ struct htt_ppdu_stats_info *ath11k_dp_ht
+ 			kfree(ppdu_info);
+ 		}
+ 	}
+-	spin_unlock_bh(&ar->data_lock);
+ 
+ 	ppdu_info = kzalloc(sizeof(*ppdu_info), GFP_ATOMIC);
+ 	if (!ppdu_info)
+ 		return NULL;
+ 
+-	spin_lock_bh(&ar->data_lock);
+ 	list_add_tail(&ppdu_info->list, &ar->ppdu_stats_info);
+ 	ar->ppdu_stat_list_depth++;
+-	spin_unlock_bh(&ar->data_lock);
+ 
+ 	return ppdu_info;
+ }
+@@ -1586,16 +1582,17 @@ static int ath11k_htt_pull_ppdu_stats(st
+ 	ar = ath11k_mac_get_ar_by_pdev_id(ab, pdev_id);
+ 	if (!ar) {
+ 		ret = -EINVAL;
+-		goto exit;
++		goto out;
+ 	}
+ 
+ 	if (ath11k_debugfs_is_pktlog_lite_mode_enabled(ar))
+ 		trace_ath11k_htt_ppdu_stats(ar, skb->data, len);
+ 
++	spin_lock_bh(&ar->data_lock);
+ 	ppdu_info = ath11k_dp_htt_get_ppdu_desc(ar, ppdu_id);
+ 	if (!ppdu_info) {
+ 		ret = -EINVAL;
+-		goto exit;
++		goto out_unlock_data;
+ 	}
+ 
+ 	ppdu_info->ppdu_id = ppdu_id;
+@@ -1604,10 +1601,13 @@ static int ath11k_htt_pull_ppdu_stats(st
+ 				     (void *)ppdu_info);
+ 	if (ret) {
+ 		ath11k_warn(ab, "Failed to parse tlv %d\n", ret);
+-		goto exit;
++		goto out_unlock_data;
+ 	}
+ 
+-exit:
++out_unlock_data:
++	spin_unlock_bh(&ar->data_lock);
++
++out:
+ 	rcu_read_unlock();
+ 
+ 	return ret;
diff --git a/package/kernel/mac80211/patches/ath11k/0019-wifi-ath11k-update-hw-params-for-IPQ5018.patch b/package/kernel/mac80211/patches/ath11k/0019-wifi-ath11k-update-hw-params-for-IPQ5018.patch
new file mode 100644
index 000000000..25d39ddb0
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0019-wifi-ath11k-update-hw-params-for-IPQ5018.patch
@@ -0,0 +1,125 @@
+From 8dfe875aa24aec68baf6702018633c84c2c1feca Mon Sep 17 00:00:00 2001
+From: Sriram R <quic_srirrama@quicinc.com>
+Date: Fri, 2 Dec 2022 23:37:13 +0200
+Subject: [PATCH] wifi: ath11k: update hw params for IPQ5018
+
+Add new compatible string for IPQ5018 and add
+required hw params for IPQ5018. The hw descriptors size and
+datapath ops are similar to QCN9074, hence reuse the same.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221122132152.17771-3-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c | 71 ++++++++++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/core.h |  8 +++
+ 2 files changed, 79 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -604,6 +604,77 @@ static const struct ath11k_hw_params ath
+ 		.smp2p_wow_exit = true,
+ 		.support_fw_mac_sequence = true,
+ 	},
++	{
++		.hw_rev = ATH11K_HW_IPQ5018_HW10,
++		.name = "ipq5018 hw1.0",
++		.fw = {
++			.dir = "IPQ5018/hw1.0",
++			.board_size = 256 * 1024,
++			.cal_offset = 128 * 1024,
++		},
++		.max_radios = MAX_RADIOS_5018,
++		.bdf_addr = 0x4BA00000,
++		/* hal_desc_sz and hw ops are similar to qcn9074 */
++		.hal_desc_sz = sizeof(struct hal_rx_desc_qcn9074),
++		.qmi_service_ins_id = ATH11K_QMI_WLFW_SERVICE_INS_ID_V01_IPQ8074,
++		.ring_mask = &ath11k_hw_ring_mask_ipq8074,
++		.credit_flow = false,
++		.max_tx_ring = 1,
++		.spectral = {
++			.fft_sz = 2,
++			.fft_pad_sz = 0,
++			.summary_pad_sz = 16,
++			.fft_hdr_len = 24,
++			.max_fft_bins = 1024,
++		},
++		.internal_sleep_clock = false,
++		.host_ce_config = ath11k_host_ce_config_qcn9074,
++		.ce_count = CE_CNT_5018,
++		.rxdma1_enable = true,
++		.num_rxmda_per_pdev = RXDMA_PER_PDEV_5018,
++		.rx_mac_buf_ring = false,
++		.vdev_start_delay = false,
++		.htt_peer_map_v2 = true,
++		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
++			BIT(NL80211_IFTYPE_AP) |
++			BIT(NL80211_IFTYPE_MESH_POINT),
++		.supports_monitor = false,
++		.supports_sta_ps = false,
++		.supports_shadow_regs = false,
++		.fw_mem_mode = 0,
++		.num_vdevs = 16 + 1,
++		.num_peers = 512,
++		.supports_regdb = false,
++		.idle_ps = false,
++		.supports_suspend = false,
++		.hal_params = &ath11k_hw_hal_params_ipq8074,
++		.single_pdev_only = false,
++		.cold_boot_calib = true,
++		.fix_l1ss = true,
++		.supports_dynamic_smps_6ghz = false,
++		.alloc_cacheable_memory = true,
++		.supports_rssi_stats = false,
++		.fw_wmi_diag_event = false,
++		.current_cc_support = false,
++		.dbr_debug_support = true,
++		.global_reset = false,
++		.bios_sar_capa = NULL,
++		.m3_fw_support = false,
++		.fixed_bdf_addr = true,
++		.fixed_mem_region = true,
++		.static_window_map = false,
++		.hybrid_bus_type = false,
++		.fixed_fw_mem = false,
++		.support_off_channel_tx = false,
++		.supports_multi_bssid = false,
++
++		.sram_dump = {},
++
++		.tcl_ring_retry = true,
++		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
++		.smp2p_wow_exit = false,
++		.support_fw_mac_sequence = false,
++	},
+ };
+ 
+ static inline struct ath11k_pdev *ath11k_core_get_single_pdev(struct ath11k_base *ab)
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -142,6 +142,7 @@ enum ath11k_hw_rev {
+ 	ATH11K_HW_WCN6855_HW20,
+ 	ATH11K_HW_WCN6855_HW21,
+ 	ATH11K_HW_WCN6750_HW10,
++	ATH11K_HW_IPQ5018_HW10,
+ };
+ 
+ enum ath11k_firmware_mode {
+@@ -230,6 +231,13 @@ struct ath11k_he {
+ 
+ #define MAX_RADIOS 3
+ 
++/* ipq5018 hw param macros */
++#define MAX_RADIOS_5018	1
++#define CE_CNT_5018	6
++#define TARGET_CE_CNT_5018	9
++#define SVC_CE_MAP_LEN_5018	17
++#define RXDMA_PER_PDEV_5018	1
++
+ enum {
+ 	WMI_HOST_TP_SCALE_MAX   = 0,
+ 	WMI_HOST_TP_SCALE_50    = 1,
diff --git a/package/kernel/mac80211/patches/ath11k/0020-wifi-ath11k-update-ce-configurations-for-IPQ5018.patch b/package/kernel/mac80211/patches/ath11k/0020-wifi-ath11k-update-ce-configurations-for-IPQ5018.patch
new file mode 100644
index 000000000..95643a95f
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0020-wifi-ath11k-update-ce-configurations-for-IPQ5018.patch
@@ -0,0 +1,246 @@
+From 26af7aabd2d8225c6b2056234626ba5099610871 Mon Sep 17 00:00:00 2001
+From: Sriram R <quic_srirrama@quicinc.com>
+Date: Fri, 2 Dec 2022 23:37:14 +0200
+Subject: [PATCH] wifi: ath11k: update ce configurations for IPQ5018
+
+IPQ5018 is a single pdev device. Update host
+and target CE configurations accordingly.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221122132152.17771-4-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c |   4 +
+ drivers/net/wireless/ath/ath11k/core.h |   3 +
+ drivers/net/wireless/ath/ath11k/hw.c   | 191 +++++++++++++++++++++++++
+ 3 files changed, 198 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -630,6 +630,10 @@ static const struct ath11k_hw_params ath
+ 		.internal_sleep_clock = false,
+ 		.host_ce_config = ath11k_host_ce_config_qcn9074,
+ 		.ce_count = CE_CNT_5018,
++		.target_ce_config = ath11k_target_ce_config_wlan_ipq5018,
++		.target_ce_count = TARGET_CE_CNT_5018,
++		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_ipq5018,
++		.svc_to_ce_map_len = SVC_CE_MAP_LEN_5018,
+ 		.rxdma1_enable = true,
+ 		.num_rxmda_per_pdev = RXDMA_PER_PDEV_5018,
+ 		.rx_mac_buf_ring = false,
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -1145,6 +1145,9 @@ extern const struct service_to_pipe ath1
+ extern const struct ce_pipe_config ath11k_target_ce_config_wlan_qca6390[];
+ extern const struct service_to_pipe ath11k_target_service_to_ce_map_wlan_qca6390[];
+ 
++extern const struct ce_pipe_config ath11k_target_ce_config_wlan_ipq5018[];
++extern const struct service_to_pipe ath11k_target_service_to_ce_map_wlan_ipq5018[];
++
+ extern const struct ce_pipe_config ath11k_target_ce_config_wlan_qcn9074[];
+ extern const struct service_to_pipe ath11k_target_service_to_ce_map_wlan_qcn9074[];
+ int ath11k_core_qmi_firmware_ready(struct ath11k_base *ab);
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -1972,6 +1972,197 @@ const struct ath11k_hw_ring_mask ath11k_
+ 	},
+ };
+ 
++/* Target firmware's Copy Engine configuration for IPQ5018 */
++const struct ce_pipe_config ath11k_target_ce_config_wlan_ipq5018[] = {
++	/* CE0: host->target HTC control and raw streams */
++	{
++		.pipenum = __cpu_to_le32(0),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),
++		.nentries = __cpu_to_le32(32),
++		.nbytes_max = __cpu_to_le32(2048),
++		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
++		.reserved = __cpu_to_le32(0),
++	},
++
++	/* CE1: target->host HTT + HTC control */
++	{
++		.pipenum = __cpu_to_le32(1),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),
++		.nentries = __cpu_to_le32(32),
++		.nbytes_max = __cpu_to_le32(2048),
++		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
++		.reserved = __cpu_to_le32(0),
++	},
++
++	/* CE2: target->host WMI */
++	{
++		.pipenum = __cpu_to_le32(2),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),
++		.nentries = __cpu_to_le32(32),
++		.nbytes_max = __cpu_to_le32(2048),
++		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
++		.reserved = __cpu_to_le32(0),
++	},
++
++	/* CE3: host->target WMI */
++	{
++		.pipenum = __cpu_to_le32(3),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),
++		.nentries = __cpu_to_le32(32),
++		.nbytes_max = __cpu_to_le32(2048),
++		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
++		.reserved = __cpu_to_le32(0),
++	},
++
++	/* CE4: host->target HTT */
++	{
++		.pipenum = __cpu_to_le32(4),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),
++		.nentries = __cpu_to_le32(256),
++		.nbytes_max = __cpu_to_le32(256),
++		.flags = __cpu_to_le32(CE_ATTR_FLAGS | CE_ATTR_DIS_INTR),
++		.reserved = __cpu_to_le32(0),
++	},
++
++	/* CE5: target->host Pktlog */
++	{
++		.pipenum = __cpu_to_le32(5),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),
++		.nentries = __cpu_to_le32(32),
++		.nbytes_max = __cpu_to_le32(2048),
++		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
++		.reserved = __cpu_to_le32(0),
++	},
++
++	/* CE6: Reserved for target autonomous hif_memcpy */
++	{
++		.pipenum = __cpu_to_le32(6),
++		.pipedir = __cpu_to_le32(PIPEDIR_INOUT),
++		.nentries = __cpu_to_le32(32),
++		.nbytes_max = __cpu_to_le32(16384),
++		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
++		.reserved = __cpu_to_le32(0),
++	},
++
++	/* CE7 used only by Host */
++	{
++		.pipenum = __cpu_to_le32(7),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),
++		.nentries = __cpu_to_le32(32),
++		.nbytes_max = __cpu_to_le32(2048),
++		.flags = __cpu_to_le32(0x2000),
++		.reserved = __cpu_to_le32(0),
++	},
++
++	/* CE8 target->host used only by IPA */
++	{
++		.pipenum = __cpu_to_le32(8),
++		.pipedir = __cpu_to_le32(PIPEDIR_INOUT),
++		.nentries = __cpu_to_le32(32),
++		.nbytes_max = __cpu_to_le32(16384),
++		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
++		.reserved = __cpu_to_le32(0),
++	},
++};
++
++/* Map from service/endpoint to Copy Engine for IPQ5018.
++ * This table is derived from the CE TABLE, above.
++ * It is passed to the Target at startup for use by firmware.
++ */
++const struct service_to_pipe ath11k_target_service_to_ce_map_wlan_ipq5018[] = {
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_VO),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
++		.pipenum = __cpu_to_le32(3),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_VO),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(2),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_BK),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
++		.pipenum = __cpu_to_le32(3),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_BK),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(2),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_BE),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
++		.pipenum = __cpu_to_le32(3),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_BE),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(2),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_VI),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
++		.pipenum = __cpu_to_le32(3),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_VI),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(2),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_CONTROL),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
++		.pipenum = __cpu_to_le32(3),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_CONTROL),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(2),
++	},
++
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_RSVD_CTRL),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
++		.pipenum = __cpu_to_le32(0),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_RSVD_CTRL),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(1),
++	},
++
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_TEST_RAW_STREAMS),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
++		.pipenum = __cpu_to_le32(0),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_TEST_RAW_STREAMS),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(1),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_HTT_DATA_MSG),
++		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
++		.pipenum = __cpu_to_le32(4),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_HTT_DATA_MSG),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(1),
++	},
++	{
++		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_PKT_LOG),
++		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
++		.pipenum = __cpu_to_le32(5),
++	},
++
++       /* (Additions here) */
++
++	{ /* terminator entry */ }
++};
++
+ const struct ath11k_hw_regs ipq8074_regs = {
+ 	/* SW2TCL(x) R0 ring configuration address */
+ 	.hal_tcl1_ring_base_lsb = 0x00000510,
diff --git a/package/kernel/mac80211/patches/ath11k/0021-wifi-ath11k-remap-ce-register-space-for-IPQ5018.patch b/package/kernel/mac80211/patches/ath11k/0021-wifi-ath11k-remap-ce-register-space-for-IPQ5018.patch
new file mode 100644
index 000000000..d07a258ac
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0021-wifi-ath11k-remap-ce-register-space-for-IPQ5018.patch
@@ -0,0 +1,351 @@
+From b42b3678c91f3ca6e0888bf5a15c1e8678fd5f2d Mon Sep 17 00:00:00 2001
+From: Sriram R <quic_srirrama@quicinc.com>
+Date: Fri, 2 Dec 2022 23:37:14 +0200
+Subject: [PATCH] wifi: ath11k: remap ce register space for IPQ5018
+
+In IPQ5018 ce register space is moved out of wcss unlike
+ipq8074 or ipq6018 and the space is not contiguous,
+hence remap the CE registers to a new space to access them.
+
+Register read/write is modified to check if the register to be written
+falls in the CE register space and corresponding register is written.
+Also adjust the interrupt register address to ce irq enable/disable.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221122132152.17771-5-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/ahb.c  | 44 ++++++++++++++++++++++----
+ drivers/net/wireless/ath/ath11k/ce.h   | 16 ++++++++++
+ drivers/net/wireless/ath/ath11k/core.c |  8 +++++
+ drivers/net/wireless/ath/ath11k/core.h |  1 +
+ drivers/net/wireless/ath/ath11k/hal.c  | 17 ++++++----
+ drivers/net/wireless/ath/ath11k/hal.h  |  5 +++
+ drivers/net/wireless/ath/ath11k/hw.c   | 17 ++++++++++
+ drivers/net/wireless/ath/ath11k/hw.h   |  9 ++++++
+ drivers/net/wireless/ath/ath11k/pci.c  |  2 ++
+ 9 files changed, 107 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -267,30 +267,42 @@ static void ath11k_ahb_clearbit32(struct
+ static void ath11k_ahb_ce_irq_enable(struct ath11k_base *ab, u16 ce_id)
+ {
+ 	const struct ce_attr *ce_attr;
++	const struct ce_ie_addr *ce_ie_addr = ab->hw_params.ce_ie_addr;
++	u32 ie1_reg_addr, ie2_reg_addr, ie3_reg_addr;
++
++	ie1_reg_addr = ce_ie_addr->ie1_reg_addr + ATH11K_CE_OFFSET(ab);
++	ie2_reg_addr = ce_ie_addr->ie2_reg_addr + ATH11K_CE_OFFSET(ab);
++	ie3_reg_addr = ce_ie_addr->ie3_reg_addr + ATH11K_CE_OFFSET(ab);
+ 
+ 	ce_attr = &ab->hw_params.host_ce_config[ce_id];
+ 	if (ce_attr->src_nentries)
+-		ath11k_ahb_setbit32(ab, ce_id, CE_HOST_IE_ADDRESS);
++		ath11k_ahb_setbit32(ab, ce_id, ie1_reg_addr);
+ 
+ 	if (ce_attr->dest_nentries) {
+-		ath11k_ahb_setbit32(ab, ce_id, CE_HOST_IE_2_ADDRESS);
++		ath11k_ahb_setbit32(ab, ce_id, ie2_reg_addr);
+ 		ath11k_ahb_setbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,
+-				    CE_HOST_IE_3_ADDRESS);
++				    ie3_reg_addr);
+ 	}
+ }
+ 
+ static void ath11k_ahb_ce_irq_disable(struct ath11k_base *ab, u16 ce_id)
+ {
+ 	const struct ce_attr *ce_attr;
++	const struct ce_ie_addr *ce_ie_addr = ab->hw_params.ce_ie_addr;
++	u32 ie1_reg_addr, ie2_reg_addr, ie3_reg_addr;
++
++	ie1_reg_addr = ce_ie_addr->ie1_reg_addr + ATH11K_CE_OFFSET(ab);
++	ie2_reg_addr = ce_ie_addr->ie2_reg_addr + ATH11K_CE_OFFSET(ab);
++	ie3_reg_addr = ce_ie_addr->ie3_reg_addr + ATH11K_CE_OFFSET(ab);
+ 
+ 	ce_attr = &ab->hw_params.host_ce_config[ce_id];
+ 	if (ce_attr->src_nentries)
+-		ath11k_ahb_clearbit32(ab, ce_id, CE_HOST_IE_ADDRESS);
++		ath11k_ahb_clearbit32(ab, ce_id, ie1_reg_addr);
+ 
+ 	if (ce_attr->dest_nentries) {
+-		ath11k_ahb_clearbit32(ab, ce_id, CE_HOST_IE_2_ADDRESS);
++		ath11k_ahb_clearbit32(ab, ce_id, ie2_reg_addr);
+ 		ath11k_ahb_clearbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,
+-				      CE_HOST_IE_3_ADDRESS);
++				      ie3_reg_addr);
+ 	}
+ }
+ 
+@@ -1142,10 +1154,26 @@ static int ath11k_ahb_probe(struct platf
+ 		goto err_core_free;
+ 	}
+ 
++	ab->mem_ce = ab->mem;
++
+ 	ret = ath11k_core_pre_init(ab);
+ 	if (ret)
+ 		goto err_core_free;
+ 
++	if (ab->hw_params.ce_remap) {
++		const struct ce_remap *ce_remap = ab->hw_params.ce_remap;
++		/* ce register space is moved out of wcss unlike ipq8074 or ipq6018
++		 * and the space is not contiguous, hence remapping the CE registers
++		 * to a new space for accessing them.
++		 */
++		ab->mem_ce = ioremap(ce_remap->base, ce_remap->size);
++		if (IS_ERR(ab->mem_ce)) {
++			dev_err(&pdev->dev, "ce ioremap error\n");
++			ret = -ENOMEM;
++			goto err_core_free;
++		}
++	}
++
+ 	ret = ath11k_ahb_setup_resources(ab);
+ 	if (ret)
+ 		goto err_core_free;
+@@ -1236,6 +1264,10 @@ static void ath11k_ahb_free_resources(st
+ 	ath11k_ahb_release_smp2p_handle(ab);
+ 	ath11k_ahb_fw_resource_deinit(ab);
+ 	ath11k_ce_free_pipes(ab);
++
++	if (ab->hw_params.ce_remap)
++		iounmap(ab->mem_ce);
++
+ 	ath11k_core_free(ab);
+ 	platform_set_drvdata(pdev, NULL);
+ }
+--- a/drivers/net/wireless/ath/ath11k/ce.h
++++ b/drivers/net/wireless/ath/ath11k/ce.h
+@@ -49,6 +49,11 @@ void ath11k_ce_byte_swap(void *mem, u32
+ #define CE_HOST_IE_2_ADDRESS	0x00A18040
+ #define CE_HOST_IE_3_ADDRESS	CE_HOST_IE_ADDRESS
+ 
++/* CE IE registers are different for IPQ5018 */
++#define CE_HOST_IPQ5018_IE_ADDRESS		0x0841804C
++#define CE_HOST_IPQ5018_IE_2_ADDRESS		0x08418050
++#define CE_HOST_IPQ5018_IE_3_ADDRESS		CE_HOST_IPQ5018_IE_ADDRESS
++
+ #define CE_HOST_IE_3_SHIFT	0xC
+ 
+ #define CE_RING_IDX_INCR(nentries_mask, idx) (((idx) + 1) & (nentries_mask))
+@@ -84,6 +89,17 @@ struct ce_pipe_config {
+ 	__le32 reserved;
+ };
+ 
++struct ce_ie_addr {
++	u32 ie1_reg_addr;
++	u32 ie2_reg_addr;
++	u32 ie3_reg_addr;
++};
++
++struct ce_remap {
++	u32 base;
++	u32 size;
++};
++
+ struct ce_attr {
+ 	/* CE_ATTR_* values */
+ 	unsigned int flags;
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -54,6 +54,7 @@ static const struct ath11k_hw_params ath
+ 		.target_ce_count = 11,
+ 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_ipq8074,
+ 		.svc_to_ce_map_len = 21,
++		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
+ 		.single_pdev_only = false,
+ 		.rxdma1_enable = true,
+ 		.num_rxmda_per_pdev = 1,
+@@ -137,6 +138,7 @@ static const struct ath11k_hw_params ath
+ 		.target_ce_count = 11,
+ 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_ipq6018,
+ 		.svc_to_ce_map_len = 19,
++		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
+ 		.single_pdev_only = false,
+ 		.rxdma1_enable = true,
+ 		.num_rxmda_per_pdev = 1,
+@@ -218,6 +220,7 @@ static const struct ath11k_hw_params ath
+ 		.target_ce_count = 9,
+ 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_qca6390,
+ 		.svc_to_ce_map_len = 14,
++		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
+ 		.single_pdev_only = true,
+ 		.rxdma1_enable = false,
+ 		.num_rxmda_per_pdev = 2,
+@@ -301,6 +304,7 @@ static const struct ath11k_hw_params ath
+ 		.target_ce_count = 9,
+ 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_qcn9074,
+ 		.svc_to_ce_map_len = 18,
++		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
+ 		.rxdma1_enable = true,
+ 		.num_rxmda_per_pdev = 1,
+ 		.rx_mac_buf_ring = false,
+@@ -381,6 +385,7 @@ static const struct ath11k_hw_params ath
+ 		.target_ce_count = 9,
+ 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_qca6390,
+ 		.svc_to_ce_map_len = 14,
++		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
+ 		.single_pdev_only = true,
+ 		.rxdma1_enable = false,
+ 		.num_rxmda_per_pdev = 2,
+@@ -546,6 +551,7 @@ static const struct ath11k_hw_params ath
+ 		.target_ce_count = 9,
+ 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_qca6390,
+ 		.svc_to_ce_map_len = 14,
++		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
+ 		.single_pdev_only = true,
+ 		.rxdma1_enable = false,
+ 		.num_rxmda_per_pdev = 1,
+@@ -634,6 +640,8 @@ static const struct ath11k_hw_params ath
+ 		.target_ce_count = TARGET_CE_CNT_5018,
+ 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_ipq5018,
+ 		.svc_to_ce_map_len = SVC_CE_MAP_LEN_5018,
++		.ce_ie_addr = &ath11k_ce_ie_addr_ipq5018,
++		.ce_remap = &ath11k_ce_remap_ipq5018,
+ 		.rxdma1_enable = true,
+ 		.num_rxmda_per_pdev = RXDMA_PER_PDEV_5018,
+ 		.rx_mac_buf_ring = false,
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -851,6 +851,7 @@ struct ath11k_base {
+ 	struct ath11k_dp dp;
+ 
+ 	void __iomem *mem;
++	void __iomem *mem_ce;
+ 	unsigned long mem_len;
+ 
+ 	struct {
+--- a/drivers/net/wireless/ath/ath11k/hal.c
++++ b/drivers/net/wireless/ath/ath11k/hal.c
+@@ -1220,16 +1220,20 @@ static int ath11k_hal_srng_create_config
+ 	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_TCL_REG + HAL_TCL_STATUS_RING_HP;
+ 
+ 	s = &hal->srng_config[HAL_CE_SRC];
+-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab) + HAL_CE_DST_RING_BASE_LSB;
+-	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab) + HAL_CE_DST_RING_HP;
++	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab) + HAL_CE_DST_RING_BASE_LSB +
++		ATH11K_CE_OFFSET(ab);
++	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab) + HAL_CE_DST_RING_HP +
++		ATH11K_CE_OFFSET(ab);
+ 	s->reg_size[0] = HAL_SEQ_WCSS_UMAC_CE1_SRC_REG(ab) -
+ 		HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab);
+ 	s->reg_size[1] = HAL_SEQ_WCSS_UMAC_CE1_SRC_REG(ab) -
+ 		HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab);
+ 
+ 	s = &hal->srng_config[HAL_CE_DST];
+-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_RING_BASE_LSB;
+-	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_RING_HP;
++	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_RING_BASE_LSB +
++		ATH11K_CE_OFFSET(ab);
++	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_RING_HP +
++		ATH11K_CE_OFFSET(ab);
+ 	s->reg_size[0] = HAL_SEQ_WCSS_UMAC_CE1_DST_REG(ab) -
+ 		HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab);
+ 	s->reg_size[1] = HAL_SEQ_WCSS_UMAC_CE1_DST_REG(ab) -
+@@ -1237,8 +1241,9 @@ static int ath11k_hal_srng_create_config
+ 
+ 	s = &hal->srng_config[HAL_CE_DST_STATUS];
+ 	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) +
+-		HAL_CE_DST_STATUS_RING_BASE_LSB;
+-	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_STATUS_RING_HP;
++		HAL_CE_DST_STATUS_RING_BASE_LSB + ATH11K_CE_OFFSET(ab);
++	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_STATUS_RING_HP +
++		ATH11K_CE_OFFSET(ab);
+ 	s->reg_size[0] = HAL_SEQ_WCSS_UMAC_CE1_DST_REG(ab) -
+ 		HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab);
+ 	s->reg_size[1] = HAL_SEQ_WCSS_UMAC_CE1_DST_REG(ab) -
+--- a/drivers/net/wireless/ath/ath11k/hal.h
++++ b/drivers/net/wireless/ath/ath11k/hal.h
+@@ -321,6 +321,10 @@ struct ath11k_base;
+ #define HAL_WBM2SW_RELEASE_RING_BASE_MSB_RING_SIZE	0x000fffff
+ #define HAL_RXDMA_RING_MAX_SIZE				0x0000ffff
+ 
++/* IPQ5018 ce registers */
++#define HAL_IPQ5018_CE_WFSS_REG_BASE		0x08400000
++#define HAL_IPQ5018_CE_SIZE			0x200000
++
+ /* Add any other errors here and return them in
+  * ath11k_hal_rx_desc_get_err().
+  */
+@@ -519,6 +523,7 @@ enum hal_srng_dir {
+ #define HAL_SRNG_FLAGS_MSI_INTR			0x00020000
+ #define HAL_SRNG_FLAGS_CACHED                   0x20000000
+ #define HAL_SRNG_FLAGS_LMAC_RING		0x80000000
++#define HAL_SRNG_FLAGS_REMAP_CE_RING        0x10000000
+ 
+ #define HAL_SRNG_TLV_HDR_TAG		GENMASK(9, 1)
+ #define HAL_SRNG_TLV_HDR_LEN		GENMASK(25, 10)
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -2163,6 +2163,23 @@ const struct service_to_pipe ath11k_targ
+ 	{ /* terminator entry */ }
+ };
+ 
++const struct ce_ie_addr ath11k_ce_ie_addr_ipq8074 = {
++	.ie1_reg_addr = CE_HOST_IE_ADDRESS,
++	.ie2_reg_addr = CE_HOST_IE_2_ADDRESS,
++	.ie3_reg_addr = CE_HOST_IE_3_ADDRESS,
++};
++
++const struct ce_ie_addr ath11k_ce_ie_addr_ipq5018 = {
++	.ie1_reg_addr = CE_HOST_IPQ5018_IE_ADDRESS - HAL_IPQ5018_CE_WFSS_REG_BASE,
++	.ie2_reg_addr = CE_HOST_IPQ5018_IE_2_ADDRESS - HAL_IPQ5018_CE_WFSS_REG_BASE,
++	.ie3_reg_addr = CE_HOST_IPQ5018_IE_3_ADDRESS - HAL_IPQ5018_CE_WFSS_REG_BASE,
++};
++
++const struct ce_remap ath11k_ce_remap_ipq5018 = {
++	.base = HAL_IPQ5018_CE_WFSS_REG_BASE,
++	.size = HAL_IPQ5018_CE_SIZE,
++};
++
+ const struct ath11k_hw_regs ipq8074_regs = {
+ 	/* SW2TCL(x) R0 ring configuration address */
+ 	.hal_tcl1_ring_base_lsb = 0x00000510,
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -80,6 +80,8 @@
+ #define ATH11K_M3_FILE			"m3.bin"
+ #define ATH11K_REGDB_FILE_NAME		"regdb.bin"
+ 
++#define ATH11K_CE_OFFSET(ab)	(ab->mem_ce - ab->mem)
++
+ enum ath11k_hw_rate_cck {
+ 	ATH11K_HW_RATE_CCK_LP_11M = 0,
+ 	ATH11K_HW_RATE_CCK_LP_5_5M,
+@@ -158,6 +160,8 @@ struct ath11k_hw_params {
+ 	u32 target_ce_count;
+ 	const struct service_to_pipe *svc_to_ce_map;
+ 	u32 svc_to_ce_map_len;
++	const struct ce_ie_addr *ce_ie_addr;
++	const struct ce_remap *ce_remap;
+ 
+ 	bool single_pdev_only;
+ 
+@@ -277,6 +281,11 @@ extern const struct ath11k_hw_ring_mask
+ extern const struct ath11k_hw_ring_mask ath11k_hw_ring_mask_qcn9074;
+ extern const struct ath11k_hw_ring_mask ath11k_hw_ring_mask_wcn6750;
+ 
++extern const struct ce_ie_addr ath11k_ce_ie_addr_ipq8074;
++extern const struct ce_ie_addr ath11k_ce_ie_addr_ipq5018;
++
++extern const struct ce_remap ath11k_ce_remap_ipq5018;
++
+ extern const struct ath11k_hw_hal_params ath11k_hw_hal_params_ipq8074;
+ extern const struct ath11k_hw_hal_params ath11k_hw_hal_params_qca6390;
+ extern const struct ath11k_hw_hal_params ath11k_hw_hal_params_wcn6750;
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -543,6 +543,8 @@ static int ath11k_pci_claim(struct ath11
+ 		goto clear_master;
+ 	}
+ 
++	ab->mem_ce = ab->mem;
++
+ 	ath11k_dbg(ab, ATH11K_DBG_BOOT, "boot pci_mem 0x%pK\n", ab->mem);
+ 	return 0;
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0022-wifi-ath11k-update-hal-srng-regs-for-IPQ5018.patch b/package/kernel/mac80211/patches/ath11k/0022-wifi-ath11k-update-hal-srng-regs-for-IPQ5018.patch
new file mode 100644
index 000000000..35ea20a3c
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0022-wifi-ath11k-update-hal-srng-regs-for-IPQ5018.patch
@@ -0,0 +1,130 @@
+From 711b80acbdfb9667a9cf8374e13320a6e624ce73 Mon Sep 17 00:00:00 2001
+From: Sriram R <quic_srirrama@quicinc.com>
+Date: Fri, 2 Dec 2022 23:37:14 +0200
+Subject: [PATCH] wifi: ath11k: update hal srng regs for IPQ5018
+
+IPQ5018 hal srng register address & offsets are not
+similar to IPQ8074/IPQ6018/QCN9074, hence define a
+new set of srng register group data for IPQ5018.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221122132152.17771-6-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c |  1 +
+ drivers/net/wireless/ath/ath11k/hw.c   | 79 ++++++++++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/hw.h   |  1 +
+ 3 files changed, 81 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -634,6 +634,7 @@ static const struct ath11k_hw_params ath
+ 			.max_fft_bins = 1024,
+ 		},
+ 		.internal_sleep_clock = false,
++		.regs = &ipq5018_regs,
+ 		.host_ce_config = ath11k_host_ce_config_qcn9074,
+ 		.ce_count = CE_CNT_5018,
+ 		.target_ce_config = ath11k_target_ce_config_wlan_ipq5018,
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -2645,6 +2645,85 @@ static const struct ath11k_hw_tcl2wbm_rb
+ 	},
+ };
+ 
++const struct ath11k_hw_regs ipq5018_regs = {
++	/* SW2TCL(x) R0 ring configuration address */
++	.hal_tcl1_ring_base_lsb = 0x00000694,
++	.hal_tcl1_ring_base_msb = 0x00000698,
++	.hal_tcl1_ring_id =	0x0000069c,
++	.hal_tcl1_ring_misc = 0x000006a4,
++	.hal_tcl1_ring_tp_addr_lsb = 0x000006b0,
++	.hal_tcl1_ring_tp_addr_msb = 0x000006b4,
++	.hal_tcl1_ring_consumer_int_setup_ix0 = 0x000006c4,
++	.hal_tcl1_ring_consumer_int_setup_ix1 = 0x000006c8,
++	.hal_tcl1_ring_msi1_base_lsb = 0x000006dc,
++	.hal_tcl1_ring_msi1_base_msb = 0x000006e0,
++	.hal_tcl1_ring_msi1_data = 0x000006e4,
++	.hal_tcl2_ring_base_lsb = 0x000006ec,
++	.hal_tcl_ring_base_lsb = 0x0000079c,
++
++	/* TCL STATUS ring address */
++	.hal_tcl_status_ring_base_lsb = 0x000008a4,
++
++	/* REO2SW(x) R0 ring configuration address */
++	.hal_reo1_ring_base_lsb = 0x000001ec,
++	.hal_reo1_ring_base_msb = 0x000001f0,
++	.hal_reo1_ring_id = 0x000001f4,
++	.hal_reo1_ring_misc = 0x000001fc,
++	.hal_reo1_ring_hp_addr_lsb = 0x00000200,
++	.hal_reo1_ring_hp_addr_msb = 0x00000204,
++	.hal_reo1_ring_producer_int_setup = 0x00000210,
++	.hal_reo1_ring_msi1_base_lsb = 0x00000234,
++	.hal_reo1_ring_msi1_base_msb = 0x00000238,
++	.hal_reo1_ring_msi1_data = 0x0000023c,
++	.hal_reo2_ring_base_lsb = 0x00000244,
++	.hal_reo1_aging_thresh_ix_0 = 0x00000564,
++	.hal_reo1_aging_thresh_ix_1 = 0x00000568,
++	.hal_reo1_aging_thresh_ix_2 = 0x0000056c,
++	.hal_reo1_aging_thresh_ix_3 = 0x00000570,
++
++	/* REO2SW(x) R2 ring pointers (head/tail) address */
++	.hal_reo1_ring_hp = 0x00003028,
++	.hal_reo1_ring_tp = 0x0000302c,
++	.hal_reo2_ring_hp = 0x00003030,
++
++	/* REO2TCL R0 ring configuration address */
++	.hal_reo_tcl_ring_base_lsb = 0x000003fc,
++	.hal_reo_tcl_ring_hp = 0x00003058,
++
++	/* SW2REO ring address */
++	.hal_sw2reo_ring_base_lsb = 0x0000013c,
++	.hal_sw2reo_ring_hp = 0x00003018,
++
++	/* REO CMD ring address */
++	.hal_reo_cmd_ring_base_lsb = 0x000000e4,
++	.hal_reo_cmd_ring_hp = 0x00003010,
++
++	/* REO status address */
++	.hal_reo_status_ring_base_lsb = 0x00000504,
++	.hal_reo_status_hp = 0x00003070,
++
++	/* WCSS relative address */
++	.hal_seq_wcss_umac_ce0_src_reg = 0x08400000
++		- HAL_IPQ5018_CE_WFSS_REG_BASE,
++	.hal_seq_wcss_umac_ce0_dst_reg = 0x08401000
++		- HAL_IPQ5018_CE_WFSS_REG_BASE,
++	.hal_seq_wcss_umac_ce1_src_reg = 0x08402000
++		- HAL_IPQ5018_CE_WFSS_REG_BASE,
++	.hal_seq_wcss_umac_ce1_dst_reg = 0x08403000
++		- HAL_IPQ5018_CE_WFSS_REG_BASE,
++
++	/* WBM Idle address */
++	.hal_wbm_idle_link_ring_base_lsb = 0x00000874,
++	.hal_wbm_idle_link_ring_misc = 0x00000884,
++
++	/* SW2WBM release address */
++	.hal_wbm_release_ring_base_lsb = 0x000001ec,
++
++	/* WBM2SW release address */
++	.hal_wbm0_release_ring_base_lsb = 0x00000924,
++	.hal_wbm1_release_ring_base_lsb = 0x0000097c,
++};
++
+ const struct ath11k_hw_hal_params ath11k_hw_hal_params_ipq8074 = {
+ 	.rx_buf_rbm = HAL_RX_BUF_RBM_SW3_BM,
+ 	.tcl2wbm_rbm_map = ath11k_hw_tcl2wbm_rbm_map_ipq8074,
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -415,6 +415,7 @@ extern const struct ath11k_hw_regs qca63
+ extern const struct ath11k_hw_regs qcn9074_regs;
+ extern const struct ath11k_hw_regs wcn6855_regs;
+ extern const struct ath11k_hw_regs wcn6750_regs;
++extern const struct ath11k_hw_regs ipq5018_regs;
+ 
+ static inline const char *ath11k_bd_ie_type_str(enum ath11k_bd_ie_type type)
+ {
diff --git a/package/kernel/mac80211/patches/ath11k/0023-wifi-ath11k-initialize-hw_ops-for-IPQ5018.patch b/package/kernel/mac80211/patches/ath11k/0023-wifi-ath11k-initialize-hw_ops-for-IPQ5018.patch
new file mode 100644
index 000000000..5ef701a44
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0023-wifi-ath11k-initialize-hw_ops-for-IPQ5018.patch
@@ -0,0 +1,90 @@
+From ba60f2793d3a37a00da14bb56a26558a902d2831 Mon Sep 17 00:00:00 2001
+From: Sriram R <quic_srirrama@quicinc.com>
+Date: Fri, 2 Dec 2022 23:37:14 +0200
+Subject: [PATCH] wifi: ath11k: initialize hw_ops for IPQ5018
+
+The ipq5018_ops is initialized for IPQ5018. This is different from
+other platforms.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221122132152.17771-7-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c |  1 +
+ drivers/net/wireless/ath/ath11k/hw.c   | 40 ++++++++++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/hw.h   |  1 +
+ 3 files changed, 42 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -635,6 +635,7 @@ static const struct ath11k_hw_params ath
+ 		},
+ 		.internal_sleep_clock = false,
+ 		.regs = &ipq5018_regs,
++		.hw_ops = &ipq5018_ops,
+ 		.host_ce_config = ath11k_host_ce_config_qcn9074,
+ 		.ce_count = CE_CNT_5018,
+ 		.target_ce_config = ath11k_target_ce_config_wlan_ipq5018,
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -1084,6 +1084,46 @@ const struct ath11k_hw_ops wcn6750_ops =
+ 	.get_ring_selector = ath11k_hw_wcn6750_get_tcl_ring_selector,
+ };
+ 
++/* IPQ5018 hw ops is similar to QCN9074 except for the dest ring remap */
++const struct ath11k_hw_ops ipq5018_ops = {
++	.get_hw_mac_from_pdev_id = ath11k_hw_ipq6018_mac_from_pdev_id,
++	.wmi_init_config = ath11k_init_wmi_config_ipq8074,
++	.mac_id_to_pdev_id = ath11k_hw_mac_id_to_pdev_id_ipq8074,
++	.mac_id_to_srng_id = ath11k_hw_mac_id_to_srng_id_ipq8074,
++	.tx_mesh_enable = ath11k_hw_qcn9074_tx_mesh_enable,
++	.rx_desc_get_first_msdu = ath11k_hw_qcn9074_rx_desc_get_first_msdu,
++	.rx_desc_get_last_msdu = ath11k_hw_qcn9074_rx_desc_get_last_msdu,
++	.rx_desc_get_l3_pad_bytes = ath11k_hw_qcn9074_rx_desc_get_l3_pad_bytes,
++	.rx_desc_get_hdr_status = ath11k_hw_qcn9074_rx_desc_get_hdr_status,
++	.rx_desc_encrypt_valid = ath11k_hw_qcn9074_rx_desc_encrypt_valid,
++	.rx_desc_get_encrypt_type = ath11k_hw_qcn9074_rx_desc_get_encrypt_type,
++	.rx_desc_get_decap_type = ath11k_hw_qcn9074_rx_desc_get_decap_type,
++	.rx_desc_get_mesh_ctl = ath11k_hw_qcn9074_rx_desc_get_mesh_ctl,
++	.rx_desc_get_ldpc_support = ath11k_hw_qcn9074_rx_desc_get_ldpc_support,
++	.rx_desc_get_mpdu_seq_ctl_vld = ath11k_hw_qcn9074_rx_desc_get_mpdu_seq_ctl_vld,
++	.rx_desc_get_mpdu_fc_valid = ath11k_hw_qcn9074_rx_desc_get_mpdu_fc_valid,
++	.rx_desc_get_mpdu_start_seq_no = ath11k_hw_qcn9074_rx_desc_get_mpdu_start_seq_no,
++	.rx_desc_get_msdu_len = ath11k_hw_qcn9074_rx_desc_get_msdu_len,
++	.rx_desc_get_msdu_sgi = ath11k_hw_qcn9074_rx_desc_get_msdu_sgi,
++	.rx_desc_get_msdu_rate_mcs = ath11k_hw_qcn9074_rx_desc_get_msdu_rate_mcs,
++	.rx_desc_get_msdu_rx_bw = ath11k_hw_qcn9074_rx_desc_get_msdu_rx_bw,
++	.rx_desc_get_msdu_freq = ath11k_hw_qcn9074_rx_desc_get_msdu_freq,
++	.rx_desc_get_msdu_pkt_type = ath11k_hw_qcn9074_rx_desc_get_msdu_pkt_type,
++	.rx_desc_get_msdu_nss = ath11k_hw_qcn9074_rx_desc_get_msdu_nss,
++	.rx_desc_get_mpdu_tid = ath11k_hw_qcn9074_rx_desc_get_mpdu_tid,
++	.rx_desc_get_mpdu_peer_id = ath11k_hw_qcn9074_rx_desc_get_mpdu_peer_id,
++	.rx_desc_copy_attn_end_tlv = ath11k_hw_qcn9074_rx_desc_copy_attn_end,
++	.rx_desc_get_mpdu_start_tag = ath11k_hw_qcn9074_rx_desc_get_mpdu_start_tag,
++	.rx_desc_get_mpdu_ppdu_id = ath11k_hw_qcn9074_rx_desc_get_mpdu_ppdu_id,
++	.rx_desc_set_msdu_len = ath11k_hw_qcn9074_rx_desc_set_msdu_len,
++	.rx_desc_get_attention = ath11k_hw_qcn9074_rx_desc_get_attention,
++	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
++	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
++	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
++	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
++
++};
++
+ #define ATH11K_TX_RING_MASK_0 BIT(0)
+ #define ATH11K_TX_RING_MASK_1 BIT(1)
+ #define ATH11K_TX_RING_MASK_2 BIT(2)
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -275,6 +275,7 @@ extern const struct ath11k_hw_ops qca639
+ extern const struct ath11k_hw_ops qcn9074_ops;
+ extern const struct ath11k_hw_ops wcn6855_ops;
+ extern const struct ath11k_hw_ops wcn6750_ops;
++extern const struct ath11k_hw_ops ipq5018_ops;
+ 
+ extern const struct ath11k_hw_ring_mask ath11k_hw_ring_mask_ipq8074;
+ extern const struct ath11k_hw_ring_mask ath11k_hw_ring_mask_qca6390;
diff --git a/package/kernel/mac80211/patches/ath11k/0024-wifi-ath11k-add-new-hw-ops-for-IPQ5018-to-get-rx-des.patch b/package/kernel/mac80211/patches/ath11k/0024-wifi-ath11k-add-new-hw-ops-for-IPQ5018-to-get-rx-des.patch
new file mode 100644
index 000000000..64531f13f
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0024-wifi-ath11k-add-new-hw-ops-for-IPQ5018-to-get-rx-des.patch
@@ -0,0 +1,84 @@
+From 69968f88f1770d61cae0febef805fd00d66cf6a1 Mon Sep 17 00:00:00 2001
+From: Sriram R <quic_srirrama@quicinc.com>
+Date: Fri, 2 Dec 2022 23:37:15 +0200
+Subject: [PATCH] wifi: ath11k: add new hw ops for IPQ5018 to get rx dest ring
+ hashmap
+
+The Destination ring control register is different
+for IPQ5018 when compared to IPQ8074/IPQ6018/QCN9074.
+Hence create a new hw ops to fetch the hash ring map
+for different device variants. ipq5018 hw ops
+is similar to qcn9074 except for this change, so reuse
+all the qcn9074 ops for ipq5018.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221122132152.17771-8-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/hw.c | 44 ++++++++++++++++++++++++++++
+ 1 file changed, 44 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -791,6 +791,49 @@ static void ath11k_hw_wcn6855_reo_setup(
+ 			   ring_hash_map);
+ }
+ 
++static void ath11k_hw_ipq5018_reo_setup(struct ath11k_base *ab)
++{
++	u32 reo_base = HAL_SEQ_WCSS_UMAC_REO_REG;
++	u32 val;
++
++	/* Each hash entry uses three bits to map to a particular ring. */
++	u32 ring_hash_map = HAL_HASH_ROUTING_RING_SW1 << 0 |
++		HAL_HASH_ROUTING_RING_SW2 << 4 |
++		HAL_HASH_ROUTING_RING_SW3 << 8 |
++		HAL_HASH_ROUTING_RING_SW4 << 12 |
++		HAL_HASH_ROUTING_RING_SW1 << 16 |
++		HAL_HASH_ROUTING_RING_SW2 << 20 |
++		HAL_HASH_ROUTING_RING_SW3 << 24 |
++		HAL_HASH_ROUTING_RING_SW4 << 28;
++
++	val = ath11k_hif_read32(ab, reo_base + HAL_REO1_GEN_ENABLE);
++
++	val &= ~HAL_REO1_GEN_ENABLE_FRAG_DST_RING;
++	val |= FIELD_PREP(HAL_REO1_GEN_ENABLE_FRAG_DST_RING,
++			HAL_SRNG_RING_ID_REO2SW1) |
++		FIELD_PREP(HAL_REO1_GEN_ENABLE_AGING_LIST_ENABLE, 1) |
++		FIELD_PREP(HAL_REO1_GEN_ENABLE_AGING_FLUSH_ENABLE, 1);
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_GEN_ENABLE, val);
++
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_0(ab),
++			   HAL_DEFAULT_REO_TIMEOUT_USEC);
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_1(ab),
++			   HAL_DEFAULT_REO_TIMEOUT_USEC);
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_2(ab),
++			   HAL_DEFAULT_REO_TIMEOUT_USEC);
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_3(ab),
++			   HAL_DEFAULT_REO_TIMEOUT_USEC);
++
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_0,
++			   ring_hash_map);
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_1,
++			   ring_hash_map);
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_2,
++			   ring_hash_map);
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_3,
++			   ring_hash_map);
++}
++
+ static u16 ath11k_hw_ipq8074_mpdu_info_get_peerid(u8 *tlv_data)
+ {
+ 	u16 peer_id = 0;
+@@ -1117,6 +1160,7 @@ const struct ath11k_hw_ops ipq5018_ops =
+ 	.rx_desc_get_mpdu_ppdu_id = ath11k_hw_qcn9074_rx_desc_get_mpdu_ppdu_id,
+ 	.rx_desc_set_msdu_len = ath11k_hw_qcn9074_rx_desc_set_msdu_len,
+ 	.rx_desc_get_attention = ath11k_hw_qcn9074_rx_desc_get_attention,
++	.reo_setup = ath11k_hw_ipq5018_reo_setup,
+ 	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
+ 	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
+ 	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
diff --git a/package/kernel/mac80211/patches/ath11k/0025-wifi-ath11k-add-ipq5018-device-support.patch b/package/kernel/mac80211/patches/ath11k/0025-wifi-ath11k-add-ipq5018-device-support.patch
new file mode 100644
index 000000000..5b930e8d4
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0025-wifi-ath11k-add-ipq5018-device-support.patch
@@ -0,0 +1,31 @@
+From 25edca7bb18a2a40cc7e54c6f522e9b3c917e2c5 Mon Sep 17 00:00:00 2001
+From: Sriram R <quic_srirrama@quicinc.com>
+Date: Fri, 2 Dec 2022 23:37:15 +0200
+Subject: [PATCH] wifi: ath11k: add ipq5018 device support
+
+ipq5018 is a ahb 2ghz device, enable the compatible support for
+ipq5018 in ahb.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221122132152.17771-9-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/ahb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -32,6 +32,9 @@ static const struct of_device_id ath11k_
+ 	{ .compatible = "qcom,wcn6750-wifi",
+ 	  .data = (void *)ATH11K_HW_WCN6750_HW10,
+ 	},
++	{ .compatible = "qcom,ipq5018-wifi",
++	  .data = (void *)ATH11K_HW_IPQ5018_HW10,
++	},
+ 	{ }
+ };
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0026-wifi-ath11k-Fix-scan-request-param-frame-size-warnin.patch b/package/kernel/mac80211/patches/ath11k/0026-wifi-ath11k-Fix-scan-request-param-frame-size-warnin.patch
new file mode 100644
index 000000000..50c14e7b9
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0026-wifi-ath11k-Fix-scan-request-param-frame-size-warnin.patch
@@ -0,0 +1,161 @@
+From d45daa6d1a8da080f1b516c570a8428a7b9225e4 Mon Sep 17 00:00:00 2001
+From: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Date: Tue, 6 Dec 2022 00:51:25 +0530
+Subject: [PATCH] wifi: ath11k: Fix scan request param frame size warning
+
+Following warning was observed
+
+drivers/net/wireless/ath/ath11k/mac.c:2351:1: warning: the frame
+size of 1184 bytes is larger than 1024 bytes [-Wframe-larger-than=]
+
+A local variable is declared with a size larger than 1024 bytes
+this causing a compilation warning. Change the local variable to
+heap memory to fix the warning.
+
+Tested-on: IPQ8074 AHB WLAN.HK.2.7.0.1-01701-QCAHKSWPL_SILICONZ-1 v2
+
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221205192125.13533-1-quic_kathirve@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 83 +++++++++++++++------------
+ 1 file changed, 45 insertions(+), 38 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3612,7 +3612,7 @@ static int ath11k_mac_op_hw_scan(struct
+ 	struct ath11k *ar = hw->priv;
+ 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+ 	struct cfg80211_scan_request *req = &hw_req->req;
+-	struct scan_req_params arg;
++	struct scan_req_params *arg = NULL;
+ 	int ret = 0;
+ 	int i;
+ 	u32 scan_timeout;
+@@ -3640,72 +3640,78 @@ static int ath11k_mac_op_hw_scan(struct
+ 	if (ret)
+ 		goto exit;
+ 
+-	memset(&arg, 0, sizeof(arg));
+-	ath11k_wmi_start_scan_init(ar, &arg);
+-	arg.vdev_id = arvif->vdev_id;
+-	arg.scan_id = ATH11K_SCAN_ID;
++	arg = kzalloc(sizeof(*arg), GFP_KERNEL);
++
++	if (!arg) {
++		ret = -ENOMEM;
++		goto exit;
++	}
++
++	ath11k_wmi_start_scan_init(ar, arg);
++	arg->vdev_id = arvif->vdev_id;
++	arg->scan_id = ATH11K_SCAN_ID;
+ 
+ 	if (req->ie_len) {
+-		arg.extraie.ptr = kmemdup(req->ie, req->ie_len, GFP_KERNEL);
+-		if (!arg.extraie.ptr) {
++		arg->extraie.ptr = kmemdup(req->ie, req->ie_len, GFP_KERNEL);
++		if (!arg->extraie.ptr) {
+ 			ret = -ENOMEM;
+ 			goto exit;
+ 		}
+-		arg.extraie.len = req->ie_len;
++		arg->extraie.len = req->ie_len;
+ 	}
+ 
+ 	if (req->n_ssids) {
+-		arg.num_ssids = req->n_ssids;
+-		for (i = 0; i < arg.num_ssids; i++) {
+-			arg.ssid[i].length  = req->ssids[i].ssid_len;
+-			memcpy(&arg.ssid[i].ssid, req->ssids[i].ssid,
++		arg->num_ssids = req->n_ssids;
++		for (i = 0; i < arg->num_ssids; i++) {
++			arg->ssid[i].length  = req->ssids[i].ssid_len;
++			memcpy(&arg->ssid[i].ssid, req->ssids[i].ssid,
+ 			       req->ssids[i].ssid_len);
+ 		}
+ 	} else {
+-		arg.scan_flags |= WMI_SCAN_FLAG_PASSIVE;
++		arg->scan_flags |= WMI_SCAN_FLAG_PASSIVE;
+ 	}
+ 
+ 	if (req->n_channels) {
+-		arg.num_chan = req->n_channels;
+-		arg.chan_list = kcalloc(arg.num_chan, sizeof(*arg.chan_list),
+-					GFP_KERNEL);
++		arg->num_chan = req->n_channels;
++		arg->chan_list = kcalloc(arg->num_chan, sizeof(*arg->chan_list),
++					 GFP_KERNEL);
+ 
+-		if (!arg.chan_list) {
++		if (!arg->chan_list) {
+ 			ret = -ENOMEM;
+ 			goto exit;
+ 		}
+ 
+-		for (i = 0; i < arg.num_chan; i++)
+-			arg.chan_list[i] = req->channels[i]->center_freq;
++		for (i = 0; i < arg->num_chan; i++)
++			arg->chan_list[i] = req->channels[i]->center_freq;
+ 	}
+ 
+ 	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
+-		arg.scan_f_add_spoofed_mac_in_probe = 1;
+-		ether_addr_copy(arg.mac_addr.addr, req->mac_addr);
+-		ether_addr_copy(arg.mac_mask.addr, req->mac_addr_mask);
++		arg->scan_f_add_spoofed_mac_in_probe = 1;
++		ether_addr_copy(arg->mac_addr.addr, req->mac_addr);
++		ether_addr_copy(arg->mac_mask.addr, req->mac_addr_mask);
+ 	}
+ 
+ 	/* if duration is set, default dwell times will be overwritten */
+ 	if (req->duration) {
+-		arg.dwell_time_active = req->duration;
+-		arg.dwell_time_active_2g = req->duration;
+-		arg.dwell_time_active_6g = req->duration;
+-		arg.dwell_time_passive = req->duration;
+-		arg.dwell_time_passive_6g = req->duration;
+-		arg.burst_duration = req->duration;
++		arg->dwell_time_active = req->duration;
++		arg->dwell_time_active_2g = req->duration;
++		arg->dwell_time_active_6g = req->duration;
++		arg->dwell_time_passive = req->duration;
++		arg->dwell_time_passive_6g = req->duration;
++		arg->burst_duration = req->duration;
+ 
+-		scan_timeout = min_t(u32, arg.max_rest_time *
+-				(arg.num_chan - 1) + (req->duration +
++		scan_timeout = min_t(u32, arg->max_rest_time *
++				(arg->num_chan - 1) + (req->duration +
+ 				ATH11K_SCAN_CHANNEL_SWITCH_WMI_EVT_OVERHEAD) *
+-				arg.num_chan, arg.max_scan_time);
++				arg->num_chan, arg->max_scan_time);
+ 	} else {
+-		scan_timeout = arg.max_scan_time;
++		scan_timeout = arg->max_scan_time;
+ 	}
+ 
+ 	/* Add a margin to account for event/command processing */
+ 	scan_timeout += ATH11K_MAC_SCAN_CMD_EVT_OVERHEAD;
+ 
+-	ret = ath11k_start_scan(ar, &arg);
++	ret = ath11k_start_scan(ar, arg);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to start hw scan: %d\n", ret);
+ 		spin_lock_bh(&ar->data_lock);
+@@ -3717,10 +3723,11 @@ static int ath11k_mac_op_hw_scan(struct
+ 				     msecs_to_jiffies(scan_timeout));
+ 
+ exit:
+-	kfree(arg.chan_list);
+-
+-	if (req->ie_len)
+-		kfree(arg.extraie.ptr);
++	if (arg) {
++		kfree(arg->chan_list);
++		kfree(arg->extraie.ptr);
++		kfree(arg);
++	}
+ 
+ 	mutex_unlock(&ar->conf_mutex);
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0029-wifi-ath11k-Add-support-to-configure-FTM-responder-r.patch b/package/kernel/mac80211/patches/ath11k/0029-wifi-ath11k-Add-support-to-configure-FTM-responder-r.patch
new file mode 100644
index 000000000..f652d689b
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0029-wifi-ath11k-Add-support-to-configure-FTM-responder-r.patch
@@ -0,0 +1,169 @@
+From a27c6a5853eb9d4f293b99be73a6891fe88263c7 Mon Sep 17 00:00:00 2001
+From: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
+Date: Tue, 10 Jan 2023 15:30:57 +0200
+Subject: [PATCH] wifi: ath11k: Add support to configure FTM responder role
+
+Fine Timing Measurement(FTM) support is used to measure round trip
+time between two nodes.
+
+Enable FTM responder feature using hw_params on supported device.
+Since FTM functionality is offloaded to firmware, adding the
+interface allows user space to enable or disable FTM responder.
+Also add support for advertising the same in extended capabilities.
+
+QCA6390, WCN6855 and WCN6750 do not support this feature.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
+Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221220044435.10506-1-quic_rajkbhag@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c |  8 ++++++++
+ drivers/net/wireless/ath/ath11k/core.h |  1 +
+ drivers/net/wireless/ath/ath11k/hw.h   |  1 +
+ drivers/net/wireless/ath/ath11k/mac.c  | 20 +++++++++++++++++++-
+ drivers/net/wireless/ath/ath11k/wmi.h  |  1 +
+ 5 files changed, 30 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -116,6 +116,7 @@ static const struct ath11k_hw_params ath
+ 		.tcl_ring_retry = true,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
++		.ftm_responder = true,
+ 	},
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ6018_HW10,
+@@ -198,6 +199,7 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = false,
++		.ftm_responder = true,
+ 	},
+ 	{
+ 		.name = "qca6390 hw2.0",
+@@ -282,6 +284,7 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = true,
++		.ftm_responder = false,
+ 	},
+ 	{
+ 		.name = "qcn9074 hw1.0",
+@@ -363,6 +366,7 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = false,
++		.ftm_responder = true,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.0",
+@@ -447,6 +451,7 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = true,
++		.ftm_responder = false,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.1",
+@@ -529,6 +534,7 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = true,
++		.ftm_responder = false,
+ 	},
+ 	{
+ 		.name = "wcn6750 hw1.0",
+@@ -609,6 +615,7 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE_WCN6750,
+ 		.smp2p_wow_exit = true,
+ 		.support_fw_mac_sequence = true,
++		.ftm_responder = false,
+ 	},
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ5018_HW10,
+@@ -688,6 +695,7 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = false,
++		.ftm_responder = true,
+ 	},
+ };
+ 
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -346,6 +346,7 @@ struct ath11k_vif {
+ 
+ 	bool is_started;
+ 	bool is_up;
++	bool ftm_responder;
+ 	bool spectral_enabled;
+ 	bool ps;
+ 	u32 aid;
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -224,6 +224,7 @@ struct ath11k_hw_params {
+ 	u32 tx_ring_size;
+ 	bool smp2p_wow_exit;
+ 	bool support_fw_mac_sequence;
++	bool ftm_responder;
+ };
+ 
+ struct ath11k_hw_ops {
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3110,7 +3110,7 @@ static void ath11k_mac_op_bss_info_chang
+ 	u16 bitrate;
+ 	int ret = 0;
+ 	u8 rateidx;
+-	u32 rate;
++	u32 rate, param;
+ 	u32 ipv4_cnt;
+ 
+ 	mutex_lock(&ar->conf_mutex);
+@@ -3412,6 +3412,20 @@ static void ath11k_mac_op_bss_info_chang
+ 		}
+ 	}
+ 
++	if (changed & BSS_CHANGED_FTM_RESPONDER &&
++	    arvif->ftm_responder != info->ftm_responder &&
++	    ar->ab->hw_params.ftm_responder &&
++	    (vif->type == NL80211_IFTYPE_AP ||
++	     vif->type == NL80211_IFTYPE_MESH_POINT)) {
++		arvif->ftm_responder = info->ftm_responder;
++		param = WMI_VDEV_PARAM_ENABLE_DISABLE_RTT_RESPONDER_ROLE;
++		ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id, param,
++						    arvif->ftm_responder);
++		if (ret)
++			ath11k_warn(ar->ab, "Failed to set ftm responder %i: %d\n",
++				    arvif->vdev_id, ret);
++	}
++
+ 	if (changed & BSS_CHANGED_FILS_DISCOVERY ||
+ 	    changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP)
+ 		ath11k_mac_fils_discovery(arvif, info);
+@@ -9113,6 +9127,10 @@ static int __ath11k_mac_register(struct
+ 	wiphy_ext_feature_set(ar->hw->wiphy,
+ 			      NL80211_EXT_FEATURE_SET_SCAN_DWELL);
+ 
++	if (ab->hw_params.ftm_responder)
++		wiphy_ext_feature_set(ar->hw->wiphy,
++				      NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
++
+ 	ath11k_reg_init(ar);
+ 
+ 	if (!test_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags)) {
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -1073,6 +1073,7 @@ enum wmi_tlv_vdev_param {
+ 	WMI_VDEV_PARAM_ENABLE_BCAST_PROBE_RESPONSE,
+ 	WMI_VDEV_PARAM_FILS_MAX_CHANNEL_GUARD_TIME,
+ 	WMI_VDEV_PARAM_HE_LTF = 0x74,
++	WMI_VDEV_PARAM_ENABLE_DISABLE_RTT_RESPONDER_ROLE = 0x7d,
+ 	WMI_VDEV_PARAM_BA_MODE = 0x7e,
+ 	WMI_VDEV_PARAM_AUTORATE_MISC_CFG = 0x80,
+ 	WMI_VDEV_PARAM_SET_HE_SOUNDING_MODE = 0x87,
diff --git a/package/kernel/mac80211/patches/ath11k/0030-wifi-ath11k-add-channel-177-into-5-GHz-channel-list.patch b/package/kernel/mac80211/patches/ath11k/0030-wifi-ath11k-add-channel-177-into-5-GHz-channel-list.patch
new file mode 100644
index 000000000..d0ed9c54b
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0030-wifi-ath11k-add-channel-177-into-5-GHz-channel-list.patch
@@ -0,0 +1,41 @@
+From e5e94d10c85653609a2893c8d0ef24a27471b68f Mon Sep 17 00:00:00 2001
+From: Wen Gong <quic_wgong@quicinc.com>
+Date: Tue, 10 Jan 2023 15:30:58 +0200
+Subject: [PATCH] wifi: ath11k: add channel 177 into 5 GHz channel list
+
+Add support for the 5 GHz channel 177 with center frequency 5885 MHz and
+operating class 125 per IEEE Std 802.11ax-2021, Table E-4.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
+
+Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221220101912.30816-1-quic_wgong@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.h | 4 ++--
+ drivers/net/wireless/ath/ath11k/mac.c  | 1 +
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -521,8 +521,8 @@ struct ath11k_sta {
+ #define ATH11K_MIN_5G_FREQ 4150
+ #define ATH11K_MIN_6G_FREQ 5925
+ #define ATH11K_MAX_6G_FREQ 7115
+-#define ATH11K_NUM_CHANS 101
+-#define ATH11K_MAX_5G_CHAN 173
++#define ATH11K_NUM_CHANS 102
++#define ATH11K_MAX_5G_CHAN 177
+ 
+ enum ath11k_state {
+ 	ATH11K_STATE_OFF,
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -96,6 +96,7 @@ static const struct ieee80211_channel at
+ 	CHAN5G(165, 5825, 0),
+ 	CHAN5G(169, 5845, 0),
+ 	CHAN5G(173, 5865, 0),
++	CHAN5G(177, 5885, 0),
+ };
+ 
+ static const struct ieee80211_channel ath11k_6ghz_channels[] = {
diff --git a/package/kernel/mac80211/patches/ath11k/0031-wifi-ath11k-fix-ce-memory-mapping-for-ahb-devices.patch b/package/kernel/mac80211/patches/ath11k/0031-wifi-ath11k-fix-ce-memory-mapping-for-ahb-devices.patch
new file mode 100644
index 000000000..278679997
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0031-wifi-ath11k-fix-ce-memory-mapping-for-ahb-devices.patch
@@ -0,0 +1,114 @@
+From 53a998c4d7284debd77734d01e1466e59a1d03b2 Mon Sep 17 00:00:00 2001
+From: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+Date: Fri, 13 Jan 2023 12:02:09 +0530
+Subject: [PATCH] wifi: ath11k: fix ce memory mapping for ahb devices
+
+Currently ath11k_ahb module is not loaded successfully and the wifi
+interface is not created. Kernel trace is seen while loading the
+ath11k_ahb module. The issue is seen in all ath11k AHB devices except
+in IPQ5018.
+
+This happens because in ath11k_ahb_probe(), ab->mem_ce is initialized
+with the value of ab->mem. However, at this instant ab->mem is not
+yet set.
+
+Later, during write to a particular memory via ath11k_ahb_write32()
+this ab->mem_ce is used with particular offset. Since ab->mem_ce is
+not set properly this possibly leads to memory conflict to handle
+kernel paging request and the below trace is seen.
+
+[   93.035047] Unable to handle kernel paging request at virtual address ffff800100a00000
+[   93.035083] Mem abort info:
+[   93.041869]   ESR = 0x0000000096000045
+[   93.044561]   EC = 0x25: DABT (current EL), IL = 32 bits
+[   93.048377]   SET = 0, FnV = 0
+[   93.053840]   EA = 0, S1PTW = 0
+[   93.056704]   FSC = 0x05: level 1 translation fault
+[   93.059745] Data abort info:
+[   93.064603]   ISV = 0, ISS = 0x00000045
+[   93.067729]   CM = 0, WnR = 1
+[   93.071287] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000042219000
+[   93.074409] [ffff800100a00000] pgd=100000007ffff003, p4d=100000007ffff003, pud=0000000000000000
+[   93.081195] Internal error: Oops: 0000000096000045 [#1] PREEMPT SMP
+[   93.089598] Modules linked in: ath11k_ahb ath11k_pci ath11k qmi_helpers
+[   93.095851] CPU: 2 PID: 66 Comm: kworker/u8:3 Not tainted 6.1.0-rc8-wt-ath-658126-g58e4b9df840c-dirty #2
+[   93.102454] Hardware name: Qualcomm Technologies, Inc. IPQ8074/AP-HK14 (DT)
+[   93.112171] Workqueue: ath11k_qmi_driver_event ath11k_qmi_driver_event_work [ath11k]
+[   93.118856] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[   93.126838] pc : ath11k_ahb_write32+0xc/0x18 [ath11k_ahb]
+[   93.133520] lr : ath11k_hal_srng_setup+0x860/0x8f0 [ath11k]
+[   93.139075] sp : ffff80000aaebb70
+[   93.144452] x29: ffff80000aaebb70 x28: 0000000000000020 x27: ffff80000aaebc50
+[   93.147934] x26: ffff000004923750 x25: ffff000004921200 x24: ffff000004928000
+[   93.155051] x23: 0000000000000020 x22: ffff000004930000 x21: ffff000004923200
+[   93.162170] x20: ffff000004920000 x19: 00000000eea00000 x18: ffff0000049200f0
+[   93.169288] x17: 0000000000000000 x16: 0000000000000000 x15: 000000000000025e
+[   93.176405] x14: ffff000003c414f0 x13: 0000000000000000 x12: 0000000000000008
+[   93.183524] x11: ffff000003c41488 x10: 0000000000000040 x9 : 0000000000000000
+[   93.190641] x8 : ffff80000a9dd100 x7 : 0000000000000000 x6 : 000000000000003f
+[   93.197759] x5 : ffff800100a00400 x4 : ffff8000031f4018 x3 : 0000000000000004
+[   93.204877] x2 : 0000000047b62000 x1 : ffff800100a00000 x0 : ffff800012000000
+[   93.211996] Call trace:
+[   93.219104]  ath11k_ahb_write32+0xc/0x18 [ath11k_ahb]
+[   93.221366]  ath11k_ce_init_ring+0x184/0x278 [ath11k]
+[   93.226576]  ath11k_ce_init_pipes+0x4c/0x1a0 [ath11k]
+[   93.231610]  ath11k_core_qmi_firmware_ready+0x3c/0x568 [ath11k]
+[   93.236646]  ath11k_qmi_driver_event_work+0x168/0x4f8 [ath11k]
+[   93.242376]  process_one_work+0x144/0x350
+[   93.248275]  worker_thread+0x120/0x430
+[   93.252352]  kthread+0xf4/0x110
+[   93.255997]  ret_from_fork+0x10/0x20
+[   93.259043] Code: d503201f f94e1c00 8b214001 d50332bf (b9000022)
+[   93.262863] ---[ end trace 0000000000000000 ]---
+
+However, for the device IPQ5018 ath11k_hw_params .ce_remap is
+defined. This parameter is used to recalculate ab->mem_ce and hence,
+this issue is not seen in IPQ5018.
+
+Hence, fix this by initializing ab->mem_ce after ab->mem is set.
+ab->mem is set inside the ath11k_ahb_setup_resources() therefore
+initialize ab->mem_ce after ath11k_ahb_setup_resources().
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Fixes: b42b3678c91f ("wifi: ath11k: remap ce register space for IPQ5018")
+
+Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230113063209.7256-1-quic_rajkbhag@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/ahb.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -1157,12 +1157,16 @@ static int ath11k_ahb_probe(struct platf
+ 		goto err_core_free;
+ 	}
+ 
+-	ab->mem_ce = ab->mem;
+-
+ 	ret = ath11k_core_pre_init(ab);
+ 	if (ret)
+ 		goto err_core_free;
+ 
++	ret = ath11k_ahb_setup_resources(ab);
++	if (ret)
++		goto err_core_free;
++
++	ab->mem_ce = ab->mem;
++
+ 	if (ab->hw_params.ce_remap) {
+ 		const struct ce_remap *ce_remap = ab->hw_params.ce_remap;
+ 		/* ce register space is moved out of wcss unlike ipq8074 or ipq6018
+@@ -1177,10 +1181,6 @@ static int ath11k_ahb_probe(struct platf
+ 		}
+ 	}
+ 
+-	ret = ath11k_ahb_setup_resources(ab);
+-	if (ret)
+-		goto err_core_free;
+-
+ 	ret = ath11k_ahb_fw_resources_init(ab);
+ 	if (ret)
+ 		goto err_core_free;
diff --git a/package/kernel/mac80211/patches/ath11k/0033-wifi-ath11k-Set-ext-passive-scan-flag-to-adjust-pass.patch b/package/kernel/mac80211/patches/ath11k/0033-wifi-ath11k-Set-ext-passive-scan-flag-to-adjust-pass.patch
new file mode 100644
index 000000000..79b79e105
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0033-wifi-ath11k-Set-ext-passive-scan-flag-to-adjust-pass.patch
@@ -0,0 +1,73 @@
+From cf8f3d4deb02a8fdc806c46d4112b69868544697 Mon Sep 17 00:00:00 2001
+From: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+Date: Wed, 15 Feb 2023 20:31:36 +0200
+Subject: [PATCH] wifi: ath11k: Set ext passive scan flag to adjust passive
+ scan start time
+
+Set the WMI_SCAN_FLAG_EXT_PASSIVE_SCAN_START_TIME_ENHANCE flag
+while sending the scan command.  If this flag is enabled when the
+incoming scan request comes with a strict start time and its duration
+overlaps with next TBTT, then target adjust the start time accordingly
+for passive scan. Target supporting this feature will advertise
+WMI_TLV_SERVICE_PASSIVE_SCAN_START_TIME_ENHANCE.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01467-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221222131720.11368-1-quic_tamizhr@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 8 ++++++++
+ drivers/net/wireless/ath/ath11k/wmi.h | 3 +++
+ 2 files changed, 11 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -2068,6 +2068,12 @@ void ath11k_wmi_start_scan_init(struct a
+ 				  WMI_SCAN_EVENT_FOREIGN_CHAN |
+ 				  WMI_SCAN_EVENT_DEQUEUED;
+ 	arg->scan_flags |= WMI_SCAN_CHAN_STAT_EVENT;
++
++	if (test_bit(WMI_TLV_SERVICE_PASSIVE_SCAN_START_TIME_ENHANCE,
++		     ar->ab->wmi_ab.svc_map))
++		arg->scan_ctrl_flags_ext |=
++			WMI_SCAN_FLAG_EXT_PASSIVE_SCAN_START_TIME_ENHANCE;
++
+ 	arg->num_bssid = 1;
+ 
+ 	/* fill bssid_list[0] with 0xff, otherwise bssid and RA will be
+@@ -2149,6 +2155,8 @@ ath11k_wmi_copy_scan_event_cntrl_flags(s
+ 	/* for adaptive scan mode using 3 bits (21 - 23 bits) */
+ 	WMI_SCAN_SET_DWELL_MODE(cmd->scan_ctrl_flags,
+ 				param->adaptive_dwell_time_mode);
++
++	cmd->scan_ctrl_flags_ext = param->scan_ctrl_flags_ext;
+ }
+ 
+ int ath11k_wmi_send_scan_start_cmd(struct ath11k *ar,
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2093,6 +2093,7 @@ enum wmi_tlv_service {
+ 	WMI_TLV_SERVICE_EXT2_MSG = 220,
+ 	WMI_TLV_SERVICE_PEER_POWER_SAVE_DURATION_SUPPORT = 246,
+ 	WMI_TLV_SERVICE_SRG_SRP_SPATIAL_REUSE_SUPPORT = 249,
++	WMI_TLV_SERVICE_PASSIVE_SCAN_START_TIME_ENHANCE = 263,
+ 
+ 	/* The second 128 bits */
+ 	WMI_MAX_EXT_SERVICE = 256,
+@@ -3223,6 +3224,7 @@ struct  wmi_start_scan_cmd {
+ 
+ #define WMI_SCAN_DWELL_MODE_MASK 0x00E00000
+ #define WMI_SCAN_DWELL_MODE_SHIFT        21
++#define WMI_SCAN_FLAG_EXT_PASSIVE_SCAN_START_TIME_ENHANCE   0x00000800
+ 
+ enum {
+ 	WMI_SCAN_DWELL_MODE_DEFAULT      = 0,
+@@ -3270,6 +3272,7 @@ struct scan_req_params {
+ 		};
+ 		u32 scan_events;
+ 	};
++	u32 scan_ctrl_flags_ext;
+ 	u32 dwell_time_active;
+ 	u32 dwell_time_active_2g;
+ 	u32 dwell_time_passive;
diff --git a/package/kernel/mac80211/patches/ath11k/0034-wifi-ath11k-fix-return-value-check-in-ath11k_ahb_pro.patch b/package/kernel/mac80211/patches/ath11k/0034-wifi-ath11k-fix-return-value-check-in-ath11k_ahb_pro.patch
new file mode 100644
index 000000000..59132913b
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0034-wifi-ath11k-fix-return-value-check-in-ath11k_ahb_pro.patch
@@ -0,0 +1,27 @@
+From 342fcde9d91460f01f65707e16368a1571271a3a Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Fri, 17 Feb 2023 11:00:31 +0800
+Subject: [PATCH] wifi: ath11k: fix return value check in ath11k_ahb_probe()
+
+ioremap() returns NULL pointer not PTR_ERR() when it fails,
+so replace the IS_ERR() check with NULL pointer check.
+
+Fixes: b42b3678c91f ("wifi: ath11k: remap ce register space for IPQ5018")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230217030031.4021289-1-yangyingliang@huawei.com
+---
+ drivers/net/wireless/ath/ath11k/ahb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -1174,7 +1174,7 @@ static int ath11k_ahb_probe(struct platf
+ 		 * to a new space for accessing them.
+ 		 */
+ 		ab->mem_ce = ioremap(ce_remap->base, ce_remap->size);
+-		if (IS_ERR(ab->mem_ce)) {
++		if (!ab->mem_ce) {
+ 			dev_err(&pdev->dev, "ce ioremap error\n");
+ 			ret = -ENOMEM;
+ 			goto err_core_free;
diff --git a/package/kernel/mac80211/patches/ath11k/0035-wifi-ath11k-Use-platform_get_irq-to-get-the-interrup.patch b/package/kernel/mac80211/patches/ath11k/0035-wifi-ath11k-Use-platform_get_irq-to-get-the-interrup.patch
new file mode 100644
index 000000000..93a9da8fc
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0035-wifi-ath11k-Use-platform_get_irq-to-get-the-interrup.patch
@@ -0,0 +1,50 @@
+From f117276638b7600b981b3fe28550823cfbe1ef23 Mon Sep 17 00:00:00 2001
+From: Douglas Anderson <dianders@chromium.org>
+Date: Wed, 1 Feb 2023 08:54:42 -0800
+Subject: [PATCH] wifi: ath11k: Use platform_get_irq() to get the interrupt
+
+As of commit a1a2b7125e10 ("of/platform: Drop static setup of IRQ
+resource from DT core"), we need to use platform_get_irq() instead of
+platform_get_resource() to get our IRQs because
+platform_get_resource() simply won't get them anymore.
+
+This was already fixed in several other Atheros WiFi drivers,
+apparently in response to Zeal Robot reports. An example of another
+fix is commit 9503a1fc123d ("ath9k: Use platform_get_irq() to get the
+interrupt"). ath11k seems to have been missed in this effort, though.
+
+Without this change, WiFi wasn't coming up on my Qualcomm sc7280-based
+hardware. Specifically, "platform_get_resource(pdev, IORESOURCE_IRQ,
+i)" was failing even for i=0.
+
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1
+
+Fixes: a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core")
+Fixes: 00402f49d26f ("ath11k: Add support for WCN6750 device")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Tested-by: Jun Yu <junyuu@chromium.org>
+Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230201084131.v2.1.I69cf3d56c97098287fe3a70084ee515098390b70@changeid
+---
+ drivers/net/wireless/ath/ath11k/ahb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -874,11 +874,11 @@ static int ath11k_ahb_setup_msi_resource
+ 	ab->pci.msi.ep_base_data = int_prop + 32;
+ 
+ 	for (i = 0; i < ab->pci.msi.config->total_vectors; i++) {
+-		res = platform_get_resource(pdev, IORESOURCE_IRQ, i);
+-		if (!res)
+-			return -ENODEV;
++		ret = platform_get_irq(pdev, i);
++		if (ret < 0)
++			return ret;
+ 
+-		ab->pci.msi.irqs[i] = res->start;
++		ab->pci.msi.irqs[i] = ret;
+ 	}
+ 
+ 	set_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, &ab->dev_flags);
diff --git a/package/kernel/mac80211/patches/ath11k/0036-wifi-ath11k-fix-SAC-bug-on-peer-addition-with-sta-ba.patch b/package/kernel/mac80211/patches/ath11k/0036-wifi-ath11k-fix-SAC-bug-on-peer-addition-with-sta-ba.patch
new file mode 100644
index 000000000..b37f070ba
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0036-wifi-ath11k-fix-SAC-bug-on-peer-addition-with-sta-ba.patch
@@ -0,0 +1,53 @@
+From 60b7d62ba8cdbd073997bff0f1cdae8d844002c0 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 9 Feb 2023 23:26:22 +0100
+Subject: [PATCH] wifi: ath11k: fix SAC bug on peer addition with sta band
+ migration
+
+Fix sleep in atomic context warning detected by Smatch static checker
+analyzer.
+
+Following the locking pattern for peer_rhash_add lock tbl_mtx_lock mutex
+always even if sta is not transitioning to another band.
+This is peer_add function and a more secure locking should not cause
+performance regression.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
+
+Fixes: d673cb6fe6c0 ("wifi: ath11k: fix peer addition/deletion error on sta band migration")
+Reported-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230209222622.1751-1-ansuelsmth@gmail.com
+---
+ drivers/net/wireless/ath/ath11k/peer.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/peer.c
++++ b/drivers/net/wireless/ath/ath11k/peer.c
+@@ -382,22 +382,23 @@ int ath11k_peer_create(struct ath11k *ar
+ 		return -ENOBUFS;
+ 	}
+ 
++	mutex_lock(&ar->ab->tbl_mtx_lock);
+ 	spin_lock_bh(&ar->ab->base_lock);
+ 	peer = ath11k_peer_find_by_addr(ar->ab, param->peer_addr);
+ 	if (peer) {
+ 		if (peer->vdev_id == param->vdev_id) {
+ 			spin_unlock_bh(&ar->ab->base_lock);
++			mutex_unlock(&ar->ab->tbl_mtx_lock);
+ 			return -EINVAL;
+ 		}
+ 
+ 		/* Assume sta is transitioning to another band.
+ 		 * Remove here the peer from rhash.
+ 		 */
+-		mutex_lock(&ar->ab->tbl_mtx_lock);
+ 		ath11k_peer_rhash_delete(ar->ab, peer);
+-		mutex_unlock(&ar->ab->tbl_mtx_lock);
+ 	}
+ 	spin_unlock_bh(&ar->ab->base_lock);
++	mutex_unlock(&ar->ab->tbl_mtx_lock);
+ 
+ 	ret = ath11k_wmi_send_peer_create_cmd(ar, param);
+ 	if (ret) {
diff --git a/package/kernel/mac80211/patches/ath11k/0037-wifi-ath11k-allow-system-suspend-to-survive-ath11k.patch b/package/kernel/mac80211/patches/ath11k/0037-wifi-ath11k-allow-system-suspend-to-survive-ath11k.patch
new file mode 100644
index 000000000..fa680954e
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0037-wifi-ath11k-allow-system-suspend-to-survive-ath11k.patch
@@ -0,0 +1,43 @@
+From 7c15430822e71e90203d87e6d0cfe83fa058b0dc Mon Sep 17 00:00:00 2001
+From: Len Brown <len.brown@intel.com>
+Date: Wed, 1 Feb 2023 12:32:01 -0600
+Subject: [PATCH] wifi: ath11k: allow system suspend to survive ath11k
+
+When ath11k runs into internal errors upon suspend,
+it returns an error code to pci_pm_suspend, which
+aborts the entire system suspend.
+
+The driver should not abort system suspend, but should
+keep its internal errors to itself, and allow the system
+to suspend.  Otherwise, a user can suspend a laptop
+by closing the lid and sealing it into a case, assuming
+that is will suspend, rather than heating up and draining
+the battery when in transit.
+
+In practice, the ath11k device seems to have plenty of transient
+errors, and subsequent suspend cycles after this failure
+often succeed.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=216968
+
+Fixes: d1b0c33850d29 ("ath11k: implement suspend for QCA6390 PCI devices")
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230201183201.14431-1-len.brown@intel.com
+---
+ drivers/net/wireless/ath/ath11k/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -998,7 +998,7 @@ static __maybe_unused int ath11k_pci_pm_
+ 	if (ret)
+ 		ath11k_warn(ab, "failed to resume core: %d\n", ret);
+ 
+-	return ret;
++	return 0;
+ }
+ 
+ static SIMPLE_DEV_PM_OPS(ath11k_pci_pm_ops,
diff --git a/package/kernel/mac80211/patches/ath11k/0038-wifi-ath11k-modify-accessor-macros-to-match-index-si.patch b/package/kernel/mac80211/patches/ath11k/0038-wifi-ath11k-modify-accessor-macros-to-match-index-si.patch
new file mode 100644
index 000000000..42bf170a0
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0038-wifi-ath11k-modify-accessor-macros-to-match-index-si.patch
@@ -0,0 +1,61 @@
+From a96f10422e74cde27c100b321b127ec32ae75747 Mon Sep 17 00:00:00 2001
+From: Muna Sinada <quic_msinada@quicinc.com>
+Date: Fri, 24 Feb 2023 12:28:03 +0200
+Subject: [PATCH] wifi: ath11k: modify accessor macros to match index size
+
+HE PHY is only 11 bytes, therefore it should be using byte indexes
+instead of dword. Change corresponding macros to reflect this.
+
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/1666128501-12364-2-git-send-email-quic_msinada@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/wmi.h | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2859,30 +2859,32 @@ struct rx_reorder_queue_remove_params {
+ #define WMI_VDEV_PARAM_TXBF_SU_TX_BFER BIT(2)
+ #define WMI_VDEV_PARAM_TXBF_MU_TX_BFER BIT(3)
+ 
+-#define HECAP_PHYDWORD_0	0
+-#define HECAP_PHYDWORD_1	1
+-#define HECAP_PHYDWORD_2	2
++#define HE_PHYCAP_BYTE_0	0
++#define HE_PHYCAP_BYTE_1	1
++#define HE_PHYCAP_BYTE_2	2
++#define HE_PHYCAP_BYTE_3	3
++#define HE_PHYCAP_BYTE_4	4
+ 
+-#define HECAP_PHY_SU_BFER		BIT(31)
++#define HECAP_PHY_SU_BFER		BIT(7)
+ #define HECAP_PHY_SU_BFEE		BIT(0)
+ #define HECAP_PHY_MU_BFER		BIT(1)
+-#define HECAP_PHY_UL_MUMIMO		BIT(22)
+-#define HECAP_PHY_UL_MUOFDMA		BIT(23)
++#define HECAP_PHY_UL_MUMIMO		BIT(6)
++#define HECAP_PHY_UL_MUOFDMA		BIT(7)
+ 
+ #define HECAP_PHY_SUBFMR_GET(hecap_phy) \
+-	FIELD_GET(HECAP_PHY_SU_BFER, hecap_phy[HECAP_PHYDWORD_0])
++	FIELD_GET(HECAP_PHY_SU_BFER, hecap_phy[HE_PHYCAP_BYTE_3])
+ 
+ #define HECAP_PHY_SUBFME_GET(hecap_phy) \
+-	FIELD_GET(HECAP_PHY_SU_BFEE, hecap_phy[HECAP_PHYDWORD_1])
++	FIELD_GET(HECAP_PHY_SU_BFEE, hecap_phy[HE_PHYCAP_BYTE_4])
+ 
+ #define HECAP_PHY_MUBFMR_GET(hecap_phy) \
+-	FIELD_GET(HECAP_PHY_MU_BFER, hecap_phy[HECAP_PHYDWORD_1])
++	FIELD_GET(HECAP_PHY_MU_BFER, hecap_phy[HE_PHYCAP_BYTE_4])
+ 
+ #define HECAP_PHY_ULMUMIMO_GET(hecap_phy) \
+-	FIELD_GET(HECAP_PHY_UL_MUMIMO, hecap_phy[HECAP_PHYDWORD_0])
++	FIELD_GET(HECAP_PHY_UL_MUMIMO, hecap_phy[HE_PHYCAP_BYTE_2])
+ 
+ #define HECAP_PHY_ULOFDMA_GET(hecap_phy) \
+-	FIELD_GET(HECAP_PHY_UL_MUOFDMA, hecap_phy[HECAP_PHYDWORD_0])
++	FIELD_GET(HECAP_PHY_UL_MUOFDMA, hecap_phy[HE_PHYCAP_BYTE_2])
+ 
+ #define HE_MODE_SU_TX_BFEE	BIT(0)
+ #define HE_MODE_SU_TX_BFER	BIT(1)
diff --git a/package/kernel/mac80211/patches/ath11k/0039-wifi-ath11k-push-MU-MIMO-params-from-hostapd-to-hard.patch b/package/kernel/mac80211/patches/ath11k/0039-wifi-ath11k-push-MU-MIMO-params-from-hostapd-to-hard.patch
new file mode 100644
index 000000000..298ce1a61
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0039-wifi-ath11k-push-MU-MIMO-params-from-hostapd-to-hard.patch
@@ -0,0 +1,300 @@
+From 38dfe775d0abf511341f37c1cb77b919a3ad410b Mon Sep 17 00:00:00 2001
+From: Muna Sinada <quic_msinada@quicinc.com>
+Date: Fri, 24 Feb 2023 12:28:04 +0200
+Subject: [PATCH] wifi: ath11k: push MU-MIMO params from hostapd to hardware
+
+In the previous behaviour only HE IE in management frames are changed
+regarding MU-MIMO configurations and not in hardware. Adding push of
+MU-MIMO configurations to the hardware as well.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-00356-QCAHKSWPL_SILICONZ-1
+
+Co-developed-by: Anilkumar Kolli <quic_akolli@quicinc.com>
+Signed-off-by: Anilkumar Kolli <quic_akolli@quicinc.com>
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/1666128501-12364-3-git-send-email-quic_msinada@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 200 ++++++++++++++++----------
+ drivers/net/wireless/ath/ath11k/wmi.h |   3 +
+ 2 files changed, 130 insertions(+), 73 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -2699,6 +2699,117 @@ static int ath11k_setup_peer_smps(struct
+ 					 ath11k_smps_map[smps]);
+ }
+ 
++static bool ath11k_mac_set_he_txbf_conf(struct ath11k_vif *arvif)
++{
++	struct ath11k *ar = arvif->ar;
++	u32 param, value;
++	int ret;
++
++	if (!arvif->vif->bss_conf.he_support)
++		return true;
++
++	param = WMI_VDEV_PARAM_SET_HEMU_MODE;
++	value = 0;
++	if (arvif->vif->bss_conf.he_su_beamformer) {
++		value |= FIELD_PREP(HE_MODE_SU_TX_BFER, HE_SU_BFER_ENABLE);
++		if (arvif->vif->bss_conf.he_mu_beamformer &&
++		    arvif->vdev_type == WMI_VDEV_TYPE_AP)
++			value |= FIELD_PREP(HE_MODE_MU_TX_BFER, HE_MU_BFER_ENABLE);
++	}
++
++	if (arvif->vif->type != NL80211_IFTYPE_MESH_POINT) {
++		value |= FIELD_PREP(HE_MODE_DL_OFDMA, HE_DL_MUOFDMA_ENABLE) |
++			 FIELD_PREP(HE_MODE_UL_OFDMA, HE_UL_MUOFDMA_ENABLE);
++
++		if (arvif->vif->bss_conf.he_full_ul_mumimo)
++			value |= FIELD_PREP(HE_MODE_UL_MUMIMO, HE_UL_MUMIMO_ENABLE);
++
++		if (arvif->vif->bss_conf.he_su_beamformee)
++			value |= FIELD_PREP(HE_MODE_SU_TX_BFEE, HE_SU_BFEE_ENABLE);
++	}
++
++	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id, param, value);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to set vdev %d HE MU mode: %d\n",
++			    arvif->vdev_id, ret);
++		return false;
++	}
++
++	param = WMI_VDEV_PARAM_SET_HE_SOUNDING_MODE;
++	value =	FIELD_PREP(HE_VHT_SOUNDING_MODE, HE_VHT_SOUNDING_MODE_ENABLE) |
++		FIELD_PREP(HE_TRIG_NONTRIG_SOUNDING_MODE,
++			   HE_TRIG_NONTRIG_SOUNDING_MODE_ENABLE);
++	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
++					    param, value);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to set vdev %d sounding mode: %d\n",
++			    arvif->vdev_id, ret);
++		return false;
++	}
++	return true;
++}
++
++static bool ath11k_mac_vif_recalc_sta_he_txbf(struct ath11k *ar,
++					      struct ieee80211_vif *vif,
++					      struct ieee80211_sta_he_cap *he_cap)
++{
++	struct ath11k_vif *arvif = (void *)vif->drv_priv;
++	struct ieee80211_he_cap_elem he_cap_elem = {0};
++	struct ieee80211_sta_he_cap *cap_band = NULL;
++	struct cfg80211_chan_def def;
++	u32 param = WMI_VDEV_PARAM_SET_HEMU_MODE;
++	u32 hemode = 0;
++	int ret;
++
++	if (!vif->bss_conf.he_support)
++		return true;
++
++	if (vif->type != NL80211_IFTYPE_STATION)
++		return false;
++
++	if (WARN_ON(ath11k_mac_vif_chan(vif, &def)))
++		return false;
++
++	if (def.chan->band == NL80211_BAND_2GHZ)
++		cap_band = &ar->mac.iftype[NL80211_BAND_2GHZ][vif->type].he_cap;
++	else
++		cap_band = &ar->mac.iftype[NL80211_BAND_5GHZ][vif->type].he_cap;
++
++	memcpy(&he_cap_elem, &cap_band->he_cap_elem, sizeof(he_cap_elem));
++
++	if (HECAP_PHY_SUBFME_GET(he_cap_elem.phy_cap_info)) {
++		if (HECAP_PHY_SUBFMR_GET(he_cap->he_cap_elem.phy_cap_info))
++			hemode |= FIELD_PREP(HE_MODE_SU_TX_BFEE, HE_SU_BFEE_ENABLE);
++		if (HECAP_PHY_MUBFMR_GET(he_cap->he_cap_elem.phy_cap_info))
++			hemode |= FIELD_PREP(HE_MODE_MU_TX_BFEE, HE_MU_BFEE_ENABLE);
++	}
++
++	if (vif->type != NL80211_IFTYPE_MESH_POINT) {
++		hemode |= FIELD_PREP(HE_MODE_DL_OFDMA, HE_DL_MUOFDMA_ENABLE) |
++			  FIELD_PREP(HE_MODE_UL_OFDMA, HE_UL_MUOFDMA_ENABLE);
++
++		if (HECAP_PHY_ULMUMIMO_GET(he_cap_elem.phy_cap_info))
++			if (HECAP_PHY_ULMUMIMO_GET(he_cap->he_cap_elem.phy_cap_info))
++				hemode |= FIELD_PREP(HE_MODE_UL_MUMIMO,
++						     HE_UL_MUMIMO_ENABLE);
++
++		if (FIELD_GET(HE_MODE_MU_TX_BFEE, hemode))
++			hemode |= FIELD_PREP(HE_MODE_SU_TX_BFEE, HE_SU_BFEE_ENABLE);
++
++		if (FIELD_GET(HE_MODE_MU_TX_BFER, hemode))
++			hemode |= FIELD_PREP(HE_MODE_SU_TX_BFER, HE_SU_BFER_ENABLE);
++	}
++
++	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id, param, hemode);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to submit vdev param txbf 0x%x: %d\n",
++			    hemode, ret);
++		return false;
++	}
++
++	return true;
++}
++
+ static void ath11k_bss_assoc(struct ieee80211_hw *hw,
+ 			     struct ieee80211_vif *vif,
+ 			     struct ieee80211_bss_conf *bss_conf)
+@@ -2709,6 +2820,7 @@ static void ath11k_bss_assoc(struct ieee
+ 	struct ieee80211_sta *ap_sta;
+ 	struct ath11k_peer *peer;
+ 	bool is_auth = false;
++	struct ieee80211_sta_he_cap  he_cap;
+ 	int ret;
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+@@ -2726,6 +2838,9 @@ static void ath11k_bss_assoc(struct ieee
+ 		return;
+ 	}
+ 
++	/* he_cap here is updated at assoc success for sta mode only */
++	he_cap  = ap_sta->deflink.he_cap;
++
+ 	ath11k_peer_assoc_prepare(ar, vif, ap_sta, &peer_arg, false);
+ 
+ 	rcu_read_unlock();
+@@ -2753,6 +2868,12 @@ static void ath11k_bss_assoc(struct ieee
+ 		return;
+ 	}
+ 
++	if (!ath11k_mac_vif_recalc_sta_he_txbf(ar, vif, &he_cap)) {
++		ath11k_warn(ar->ab, "failed to recalc he txbf for vdev %i on bss %pM\n",
++			    arvif->vdev_id, bss_conf->bssid);
++		return;
++	}
++
+ 	WARN_ON(arvif->is_up);
+ 
+ 	arvif->aid = vif->cfg.aid;
+@@ -3202,6 +3323,8 @@ static void ath11k_mac_op_bss_info_chang
+ 		ether_addr_copy(arvif->bssid, info->bssid);
+ 
+ 	if (changed & BSS_CHANGED_BEACON_ENABLED) {
++		if (info->enable_beacon)
++			ath11k_mac_set_he_txbf_conf(arvif);
+ 		ath11k_control_beaconing(arvif, info);
+ 
+ 		if (arvif->is_up && vif->bss_conf.he_support &&
+@@ -5392,6 +5515,10 @@ static int ath11k_mac_copy_he_cap(struct
+ 
+ 		he_cap_elem->mac_cap_info[1] &=
+ 			IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_MASK;
++		he_cap_elem->phy_cap_info[0] &=
++			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
++		he_cap_elem->phy_cap_info[0] &=
++			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G;
+ 
+ 		he_cap_elem->phy_cap_info[5] &=
+ 			~IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK;
+@@ -6026,69 +6153,6 @@ ath11k_mac_setup_vdev_create_params(stru
+ 	}
+ }
+ 
+-static u32
+-ath11k_mac_prepare_he_mode(struct ath11k_pdev *pdev, u32 viftype)
+-{
+-	struct ath11k_pdev_cap *pdev_cap = &pdev->cap;
+-	struct ath11k_band_cap *cap_band = NULL;
+-	u32 *hecap_phy_ptr = NULL;
+-	u32 hemode = 0;
+-
+-	if (pdev->cap.supported_bands & WMI_HOST_WLAN_2G_CAP)
+-		cap_band = &pdev_cap->band[NL80211_BAND_2GHZ];
+-	else
+-		cap_band = &pdev_cap->band[NL80211_BAND_5GHZ];
+-
+-	hecap_phy_ptr = &cap_band->he_cap_phy_info[0];
+-
+-	hemode = FIELD_PREP(HE_MODE_SU_TX_BFEE, HE_SU_BFEE_ENABLE) |
+-		 FIELD_PREP(HE_MODE_SU_TX_BFER, HECAP_PHY_SUBFMR_GET(hecap_phy_ptr)) |
+-		 FIELD_PREP(HE_MODE_UL_MUMIMO, HECAP_PHY_ULMUMIMO_GET(hecap_phy_ptr));
+-
+-	/* TODO WDS and other modes */
+-	if (viftype == NL80211_IFTYPE_AP) {
+-		hemode |= FIELD_PREP(HE_MODE_MU_TX_BFER,
+-			  HECAP_PHY_MUBFMR_GET(hecap_phy_ptr)) |
+-			  FIELD_PREP(HE_MODE_DL_OFDMA, HE_DL_MUOFDMA_ENABLE) |
+-			  FIELD_PREP(HE_MODE_UL_OFDMA, HE_UL_MUOFDMA_ENABLE);
+-	} else {
+-		hemode |= FIELD_PREP(HE_MODE_MU_TX_BFEE, HE_MU_BFEE_ENABLE);
+-	}
+-
+-	return hemode;
+-}
+-
+-static int ath11k_set_he_mu_sounding_mode(struct ath11k *ar,
+-					  struct ath11k_vif *arvif)
+-{
+-	u32 param_id, param_value;
+-	struct ath11k_base *ab = ar->ab;
+-	int ret = 0;
+-
+-	param_id = WMI_VDEV_PARAM_SET_HEMU_MODE;
+-	param_value = ath11k_mac_prepare_he_mode(ar->pdev, arvif->vif->type);
+-	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
+-					    param_id, param_value);
+-	if (ret) {
+-		ath11k_warn(ab, "failed to set vdev %d HE MU mode: %d param_value %x\n",
+-			    arvif->vdev_id, ret, param_value);
+-		return ret;
+-	}
+-	param_id = WMI_VDEV_PARAM_SET_HE_SOUNDING_MODE;
+-	param_value =
+-		FIELD_PREP(HE_VHT_SOUNDING_MODE, HE_VHT_SOUNDING_MODE_ENABLE) |
+-		FIELD_PREP(HE_TRIG_NONTRIG_SOUNDING_MODE,
+-			   HE_TRIG_NONTRIG_SOUNDING_MODE_ENABLE);
+-	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
+-					    param_id, param_value);
+-	if (ret) {
+-		ath11k_warn(ab, "failed to set vdev %d HE MU mode: %d\n",
+-			    arvif->vdev_id, ret);
+-		return ret;
+-	}
+-	return ret;
+-}
+-
+ static void ath11k_mac_op_update_vif_offload(struct ieee80211_hw *hw,
+ 					     struct ieee80211_vif *vif)
+ {
+@@ -6757,7 +6821,6 @@ ath11k_mac_vdev_start_restart(struct ath
+ 	struct ath11k_base *ab = ar->ab;
+ 	struct wmi_vdev_start_req_arg arg = {};
+ 	const struct cfg80211_chan_def *chandef = &ctx->def;
+-	int he_support = arvif->vif->bss_conf.he_support;
+ 	int ret = 0;
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+@@ -6798,15 +6861,6 @@ ath11k_mac_vdev_start_restart(struct ath
+ 		spin_lock_bh(&ab->base_lock);
+ 		arg.regdomain = ar->ab->dfs_region;
+ 		spin_unlock_bh(&ab->base_lock);
+-
+-		if (he_support) {
+-			ret = ath11k_set_he_mu_sounding_mode(ar, arvif);
+-			if (ret) {
+-				ath11k_warn(ar->ab, "failed to set he mode vdev %i\n",
+-					    arg.vdev_id);
+-				return ret;
+-			}
+-		}
+ 	}
+ 
+ 	arg.channel.passive |= !!(chandef->chan->flags & IEEE80211_CHAN_NO_IR);
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2897,8 +2897,11 @@ struct rx_reorder_queue_remove_params {
+ #define HE_DL_MUOFDMA_ENABLE	1
+ #define HE_UL_MUOFDMA_ENABLE	1
+ #define HE_DL_MUMIMO_ENABLE	1
++#define HE_UL_MUMIMO_ENABLE	1
+ #define HE_MU_BFEE_ENABLE	1
+ #define HE_SU_BFEE_ENABLE	1
++#define HE_MU_BFER_ENABLE	1
++#define HE_SU_BFER_ENABLE	1
+ 
+ #define HE_VHT_SOUNDING_MODE_ENABLE		1
+ #define HE_SU_MU_SOUNDING_MODE_ENABLE		1
diff --git a/package/kernel/mac80211/patches/ath11k/0040-wifi-ath11k-move-HE-MCS-mapper-to-a-separate-functio.patch b/package/kernel/mac80211/patches/ath11k/0040-wifi-ath11k-move-HE-MCS-mapper-to-a-separate-functio.patch
new file mode 100644
index 000000000..6bc9880e1
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0040-wifi-ath11k-move-HE-MCS-mapper-to-a-separate-functio.patch
@@ -0,0 +1,67 @@
+From 8077c1bbbc28e527fb29143c46f32c6a9d6cadf0 Mon Sep 17 00:00:00 2001
+From: Muna Sinada <quic_msinada@quicinc.com>
+Date: Fri, 24 Feb 2023 12:28:04 +0200
+Subject: [PATCH] wifi: ath11k: move HE MCS mapper to a separate function
+
+Move HE MCS mapper to a separate function and call new function
+in ath11k_mac_copy_he_cap().
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-00356-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/1666128501-12364-4-git-send-email-quic_msinada@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 34 +++++++++++++++++----------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -5483,6 +5483,27 @@ static __le16 ath11k_mac_setup_he_6ghz_c
+ 	return cpu_to_le16(bcap->he_6ghz_capa);
+ }
+ 
++static void ath11k_mac_set_hemcsmap(struct ath11k *ar,
++				    struct ath11k_pdev_cap *cap,
++				    struct ieee80211_sta_he_cap *he_cap,
++				    int band)
++{
++	struct ath11k_band_cap *band_cap = &cap->band[band];
++
++	he_cap->he_mcs_nss_supp.rx_mcs_80 =
++		cpu_to_le16(band_cap->he_mcs & 0xffff);
++	he_cap->he_mcs_nss_supp.tx_mcs_80 =
++		cpu_to_le16(band_cap->he_mcs & 0xffff);
++	he_cap->he_mcs_nss_supp.rx_mcs_160 =
++		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++	he_cap->he_mcs_nss_supp.tx_mcs_160 =
++		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++	he_cap->he_mcs_nss_supp.rx_mcs_80p80 =
++		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++	he_cap->he_mcs_nss_supp.tx_mcs_80p80 =
++		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++}
++
+ static int ath11k_mac_copy_he_cap(struct ath11k *ar,
+ 				  struct ath11k_pdev_cap *cap,
+ 				  struct ieee80211_sband_iftype_data *data,
+@@ -5544,18 +5565,7 @@ static int ath11k_mac_copy_he_cap(struct
+ 			break;
+ 		}
+ 
+-		he_cap->he_mcs_nss_supp.rx_mcs_80 =
+-			cpu_to_le16(band_cap->he_mcs & 0xffff);
+-		he_cap->he_mcs_nss_supp.tx_mcs_80 =
+-			cpu_to_le16(band_cap->he_mcs & 0xffff);
+-		he_cap->he_mcs_nss_supp.rx_mcs_160 =
+-			cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
+-		he_cap->he_mcs_nss_supp.tx_mcs_160 =
+-			cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
+-		he_cap->he_mcs_nss_supp.rx_mcs_80p80 =
+-			cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
+-		he_cap->he_mcs_nss_supp.tx_mcs_80p80 =
+-			cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++		ath11k_mac_set_hemcsmap(ar, cap, he_cap, band);
+ 
+ 		memset(he_cap->ppe_thres, 0, sizeof(he_cap->ppe_thres));
+ 		if (he_cap_elem->phy_cap_info[6] &
diff --git a/package/kernel/mac80211/patches/ath11k/0041-wifi-ath11k-generate-rx-and-tx-mcs-maps-for-supporte.patch b/package/kernel/mac80211/patches/ath11k/0041-wifi-ath11k-generate-rx-and-tx-mcs-maps-for-supporte.patch
new file mode 100644
index 000000000..5cb7801b2
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0041-wifi-ath11k-generate-rx-and-tx-mcs-maps-for-supporte.patch
@@ -0,0 +1,64 @@
+From ebf82988f844dd98e6b007cffcc5e95986056995 Mon Sep 17 00:00:00 2001
+From: Muna Sinada <quic_msinada@quicinc.com>
+Date: Fri, 24 Feb 2023 12:28:04 +0200
+Subject: [PATCH] wifi: ath11k: generate rx and tx mcs maps for supported HE
+ mcs
+
+Generate rx and tx mcs maps in ath11k_mac_set_hemcsmap() and set them
+in supported mcs/nss for HE capabilities.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-00356-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/1666128501-12364-5-git-send-email-quic_msinada@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 30 ++++++++++++++++++++-------
+ 1 file changed, 23 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -5488,20 +5488,36 @@ static void ath11k_mac_set_hemcsmap(stru
+ 				    struct ieee80211_sta_he_cap *he_cap,
+ 				    int band)
+ {
+-	struct ath11k_band_cap *band_cap = &cap->band[band];
++	u16 txmcs_map, rxmcs_map;
++	u32 i;
+ 
++	rxmcs_map = 0;
++	txmcs_map = 0;
++	for (i = 0; i < 8; i++) {
++		if (i < ar->num_tx_chains &&
++		    (ar->cfg_tx_chainmask >> cap->tx_chain_mask_shift) & BIT(i))
++			txmcs_map |= IEEE80211_HE_MCS_SUPPORT_0_11 << (i * 2);
++		else
++			txmcs_map |= IEEE80211_HE_MCS_NOT_SUPPORTED << (i * 2);
++
++		if (i < ar->num_rx_chains &&
++		    (ar->cfg_rx_chainmask >> cap->tx_chain_mask_shift) & BIT(i))
++			rxmcs_map |= IEEE80211_HE_MCS_SUPPORT_0_11 << (i * 2);
++		else
++			rxmcs_map |= IEEE80211_HE_MCS_NOT_SUPPORTED << (i * 2);
++	}
+ 	he_cap->he_mcs_nss_supp.rx_mcs_80 =
+-		cpu_to_le16(band_cap->he_mcs & 0xffff);
++		cpu_to_le16(rxmcs_map & 0xffff);
+ 	he_cap->he_mcs_nss_supp.tx_mcs_80 =
+-		cpu_to_le16(band_cap->he_mcs & 0xffff);
++		cpu_to_le16(txmcs_map & 0xffff);
+ 	he_cap->he_mcs_nss_supp.rx_mcs_160 =
+-		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++		cpu_to_le16(rxmcs_map & 0xffff);
+ 	he_cap->he_mcs_nss_supp.tx_mcs_160 =
+-		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++		cpu_to_le16(txmcs_map & 0xffff);
+ 	he_cap->he_mcs_nss_supp.rx_mcs_80p80 =
+-		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++		cpu_to_le16(rxmcs_map & 0xffff);
+ 	he_cap->he_mcs_nss_supp.tx_mcs_80p80 =
+-		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
++		cpu_to_le16(txmcs_map & 0xffff);
+ }
+ 
+ static int ath11k_mac_copy_he_cap(struct ath11k *ar,
diff --git a/package/kernel/mac80211/patches/ath11k/0042-wifi-ath11k-Add-tx-ack-signal-support-for-management.patch b/package/kernel/mac80211/patches/ath11k/0042-wifi-ath11k-Add-tx-ack-signal-support-for-management.patch
new file mode 100644
index 000000000..8d4165731
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0042-wifi-ath11k-Add-tx-ack-signal-support-for-management.patch
@@ -0,0 +1,150 @@
+From 01c6c9fccbd51c1d9eab0f5794b0271b026178df Mon Sep 17 00:00:00 2001
+From: Abinaya Kalaiselvan <quic_akalaise@quicinc.com>
+Date: Mon, 19 Dec 2022 11:08:44 +0530
+Subject: [PATCH] wifi: ath11k: Add tx ack signal support for management
+ packets
+
+Add support to notify tx ack signal values for management
+packets to userspace through nl80211 interface.
+
+Advertise NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT flag
+to enable this feature and it will be used for data
+packets as well.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Abinaya Kalaiselvan <quic_akalaise@quicinc.com>
+Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20221219053844.4084486-1-quic_mkenna@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/hw.c  |  1 +
+ drivers/net/wireless/ath/ath11k/mac.c |  5 +++++
+ drivers/net/wireless/ath/ath11k/wmi.c | 27 ++++++++++++++++-----------
+ drivers/net/wireless/ath/ath11k/wmi.h |  3 +++
+ 4 files changed, 25 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -201,6 +201,7 @@ static void ath11k_init_wmi_config_ipq80
+ 	config->twt_ap_pdev_count = ab->num_radios;
+ 	config->twt_ap_sta_count = 1000;
+ 	config->flag1 |= WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64;
++	config->flag1 |= WMI_RSRC_CFG_FLAG1_ACK_RSSI;
+ }
+ 
+ static int ath11k_hw_mac_id_to_pdev_id_ipq8074(struct ath11k_hw_params *hw,
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -9174,6 +9174,11 @@ static int __ath11k_mac_register(struct
+ 		goto err_free_if_combs;
+ 	}
+ 
++	if (test_bit(WMI_TLV_SERVICE_TX_DATA_MGMT_ACK_RSSI,
++		     ar->ab->wmi_ab.svc_map))
++		wiphy_ext_feature_set(ar->hw->wiphy,
++				      NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
++
+ 	ar->hw->queues = ATH11K_HW_MAX_QUEUES;
+ 	ar->hw->wiphy->tx_queue_len = ATH11K_QUEUE_LEN;
+ 	ar->hw->offchannel_tx_hw_queue = ATH11K_HW_MAX_QUEUES - 1;
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -5229,8 +5229,8 @@ static int ath11k_pull_mgmt_rx_params_tl
+ 	return 0;
+ }
+ 
+-static int wmi_process_mgmt_tx_comp(struct ath11k *ar, u32 desc_id,
+-				    u32 status)
++static int wmi_process_mgmt_tx_comp(struct ath11k *ar,
++				    struct wmi_mgmt_tx_compl_event *tx_compl_param)
+ {
+ 	struct sk_buff *msdu;
+ 	struct ieee80211_tx_info *info;
+@@ -5238,24 +5238,29 @@ static int wmi_process_mgmt_tx_comp(stru
+ 	int num_mgmt;
+ 
+ 	spin_lock_bh(&ar->txmgmt_idr_lock);
+-	msdu = idr_find(&ar->txmgmt_idr, desc_id);
++	msdu = idr_find(&ar->txmgmt_idr, tx_compl_param->desc_id);
+ 
+ 	if (!msdu) {
+ 		ath11k_warn(ar->ab, "received mgmt tx compl for invalid msdu_id: %d\n",
+-			    desc_id);
++			    tx_compl_param->desc_id);
+ 		spin_unlock_bh(&ar->txmgmt_idr_lock);
+ 		return -ENOENT;
+ 	}
+ 
+-	idr_remove(&ar->txmgmt_idr, desc_id);
++	idr_remove(&ar->txmgmt_idr, tx_compl_param->desc_id);
+ 	spin_unlock_bh(&ar->txmgmt_idr_lock);
+ 
+ 	skb_cb = ATH11K_SKB_CB(msdu);
+ 	dma_unmap_single(ar->ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
+ 
+ 	info = IEEE80211_SKB_CB(msdu);
+-	if ((!(info->flags & IEEE80211_TX_CTL_NO_ACK)) && !status)
++	if ((!(info->flags & IEEE80211_TX_CTL_NO_ACK)) &&
++	    !tx_compl_param->status) {
+ 		info->flags |= IEEE80211_TX_STAT_ACK;
++		if (test_bit(WMI_TLV_SERVICE_TX_DATA_MGMT_ACK_RSSI,
++			     ar->ab->wmi_ab.svc_map))
++			info->status.ack_signal = tx_compl_param->ack_rssi;
++	}
+ 
+ 	ieee80211_tx_status_irqsafe(ar->hw, msdu);
+ 
+@@ -5267,7 +5272,7 @@ static int wmi_process_mgmt_tx_comp(stru
+ 
+ 	ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
+ 		   "wmi mgmt tx comp pending %d desc id %d\n",
+-		   num_mgmt, desc_id);
++		   num_mgmt, tx_compl_param->desc_id);
+ 
+ 	if (!num_mgmt)
+ 		wake_up(&ar->txmgmt_empty_waitq);
+@@ -5300,6 +5305,7 @@ static int ath11k_pull_mgmt_tx_compl_par
+ 	param->pdev_id = ev->pdev_id;
+ 	param->desc_id = ev->desc_id;
+ 	param->status = ev->status;
++	param->ack_rssi = ev->ack_rssi;
+ 
+ 	kfree(tb);
+ 	return 0;
+@@ -7070,13 +7076,12 @@ static void ath11k_mgmt_tx_compl_event(s
+ 		goto exit;
+ 	}
+ 
+-	wmi_process_mgmt_tx_comp(ar, tx_compl_param.desc_id,
+-				 tx_compl_param.status);
++	wmi_process_mgmt_tx_comp(ar, &tx_compl_param);
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_MGMT,
+-		   "mgmt tx compl ev pdev_id %d, desc_id %d, status %d",
++		   "mgmt tx compl ev pdev_id %d, desc_id %d, status %d ack_rssi %d",
+ 		   tx_compl_param.pdev_id, tx_compl_param.desc_id,
+-		   tx_compl_param.status);
++		   tx_compl_param.status, tx_compl_param.ack_rssi);
+ 
+ exit:
+ 	rcu_read_unlock();
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2311,6 +2311,7 @@ struct wmi_init_cmd {
+ } __packed;
+ 
+ #define WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64 BIT(5)
++#define WMI_RSRC_CFG_FLAG1_ACK_RSSI BIT(18)
+ 
+ struct wmi_resource_config {
+ 	u32 tlv_header;
+@@ -4550,6 +4551,8 @@ struct wmi_mgmt_tx_compl_event {
+ 	u32 desc_id;
+ 	u32 status;
+ 	u32 pdev_id;
++	u32 ppdu_id;
++	u32 ack_rssi;
+ } __packed;
+ 
+ struct wmi_scan_event {
diff --git a/package/kernel/mac80211/patches/ath11k/0043-wifi-ath11k-use-proper-regulatory-reference-for-band.patch b/package/kernel/mac80211/patches/ath11k/0043-wifi-ath11k-use-proper-regulatory-reference-for-band.patch
new file mode 100644
index 000000000..5bc195528
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0043-wifi-ath11k-use-proper-regulatory-reference-for-band.patch
@@ -0,0 +1,216 @@
+From 25e289e1f52e1f4fb1d07622c6a24f8d8a8e420d Mon Sep 17 00:00:00 2001
+From: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Date: Wed, 1 Mar 2023 16:20:58 +0200
+Subject: [PATCH] wifi: ath11k: use proper regulatory reference for bands
+
+Currently, during regulatory event, 2 GHz/5 GHz is referred
+to as 2G/5G including variable names. However, there is no
+such entity as 2G or 5G.
+
+Re-name such occurences to its proper name. No functional changes.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230110121024.14051-2-quic_adisi@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/reg.c | 20 ++++-----
+ drivers/net/wireless/ath/ath11k/wmi.c | 58 ++++++++++++++-------------
+ drivers/net/wireless/ath/ath11k/wmi.h | 28 ++++++-------
+ 3 files changed, 54 insertions(+), 52 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -619,7 +619,7 @@ ath11k_reg_build_regd(struct ath11k_base
+ 	u32 flags;
+ 	char alpha2[3];
+ 
+-	num_rules = reg_info->num_5g_reg_rules + reg_info->num_2g_reg_rules;
++	num_rules = reg_info->num_5ghz_reg_rules + reg_info->num_2ghz_reg_rules;
+ 
+ 	if (!num_rules)
+ 		goto ret;
+@@ -644,20 +644,20 @@ ath11k_reg_build_regd(struct ath11k_base
+ 		   alpha2, ath11k_reg_get_regdom_str(tmp_regd->dfs_region),
+ 		   reg_info->dfs_region, num_rules);
+ 	/* Update reg_rules[] below. Firmware is expected to
+-	 * send these rules in order(2G rules first and then 5G)
++	 * send these rules in order(2 GHz rules first and then 5 GHz)
+ 	 */
+ 	for (; i < num_rules; i++) {
+-		if (reg_info->num_2g_reg_rules &&
+-		    (i < reg_info->num_2g_reg_rules)) {
+-			reg_rule = reg_info->reg_rules_2g_ptr + i;
++		if (reg_info->num_2ghz_reg_rules &&
++		    (i < reg_info->num_2ghz_reg_rules)) {
++			reg_rule = reg_info->reg_rules_2ghz_ptr + i;
+ 			max_bw = min_t(u16, reg_rule->max_bw,
+-				       reg_info->max_bw_2g);
++				       reg_info->max_bw_2ghz);
+ 			flags = 0;
+-		} else if (reg_info->num_5g_reg_rules &&
+-			   (j < reg_info->num_5g_reg_rules)) {
+-			reg_rule = reg_info->reg_rules_5g_ptr + j++;
++		} else if (reg_info->num_5ghz_reg_rules &&
++			   (j < reg_info->num_5ghz_reg_rules)) {
++			reg_rule = reg_info->reg_rules_5ghz_ptr + j++;
+ 			max_bw = min_t(u16, reg_rule->max_bw,
+-				       reg_info->max_bw_5g);
++				       reg_info->max_bw_5ghz);
+ 
+ 			/* FW doesn't pass NL80211_RRF_AUTO_BW flag for
+ 			 * BW Auto correction, we can enable this by default
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -4959,7 +4959,7 @@ static int ath11k_pull_reg_chan_list_upd
+ 	const void **tb;
+ 	const struct wmi_reg_chan_list_cc_event *chan_list_event_hdr;
+ 	struct wmi_regulatory_rule_struct *wmi_reg_rule;
+-	u32 num_2g_reg_rules, num_5g_reg_rules;
++	u32 num_2ghz_reg_rules, num_5ghz_reg_rules;
+ 	int ret;
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI, "processing regulatory channel list\n");
+@@ -4978,10 +4978,10 @@ static int ath11k_pull_reg_chan_list_upd
+ 		return -EPROTO;
+ 	}
+ 
+-	reg_info->num_2g_reg_rules = chan_list_event_hdr->num_2g_reg_rules;
+-	reg_info->num_5g_reg_rules = chan_list_event_hdr->num_5g_reg_rules;
++	reg_info->num_2ghz_reg_rules = chan_list_event_hdr->num_2ghz_reg_rules;
++	reg_info->num_5ghz_reg_rules = chan_list_event_hdr->num_5ghz_reg_rules;
+ 
+-	if (!(reg_info->num_2g_reg_rules + reg_info->num_5g_reg_rules)) {
++	if (!(reg_info->num_2ghz_reg_rules + reg_info->num_5ghz_reg_rules)) {
+ 		ath11k_warn(ab, "No regulatory rules available in the event info\n");
+ 		kfree(tb);
+ 		return -EINVAL;
+@@ -5008,46 +5008,48 @@ static int ath11k_pull_reg_chan_list_upd
+ 	else if (chan_list_event_hdr->status_code == WMI_REG_SET_CC_STATUS_FAIL)
+ 		reg_info->status_code = REG_SET_CC_STATUS_FAIL;
+ 
+-	reg_info->min_bw_2g = chan_list_event_hdr->min_bw_2g;
+-	reg_info->max_bw_2g = chan_list_event_hdr->max_bw_2g;
+-	reg_info->min_bw_5g = chan_list_event_hdr->min_bw_5g;
+-	reg_info->max_bw_5g = chan_list_event_hdr->max_bw_5g;
++	reg_info->min_bw_2ghz = chan_list_event_hdr->min_bw_2ghz;
++	reg_info->max_bw_2ghz = chan_list_event_hdr->max_bw_2ghz;
++	reg_info->min_bw_5ghz = chan_list_event_hdr->min_bw_5ghz;
++	reg_info->max_bw_5ghz = chan_list_event_hdr->max_bw_5ghz;
+ 
+-	num_2g_reg_rules = reg_info->num_2g_reg_rules;
+-	num_5g_reg_rules = reg_info->num_5g_reg_rules;
++	num_2ghz_reg_rules = reg_info->num_2ghz_reg_rules;
++	num_5ghz_reg_rules = reg_info->num_5ghz_reg_rules;
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI,
+-		   "%s:cc %s dsf %d BW: min_2g %d max_2g %d min_5g %d max_5g %d",
++		   "%s:cc %s dsf %d BW: min_2ghz %d max_2ghz %d min_5ghz %d max_5ghz %d",
+ 		   __func__, reg_info->alpha2, reg_info->dfs_region,
+-		   reg_info->min_bw_2g, reg_info->max_bw_2g,
+-		   reg_info->min_bw_5g, reg_info->max_bw_5g);
++		   reg_info->min_bw_2ghz, reg_info->max_bw_2ghz,
++		   reg_info->min_bw_5ghz, reg_info->max_bw_5ghz);
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI,
+-		   "%s: num_2g_reg_rules %d num_5g_reg_rules %d", __func__,
+-		   num_2g_reg_rules, num_5g_reg_rules);
++		   "%s: num_2ghz_reg_rules %d num_5ghz_reg_rules %d", __func__,
++		   num_2ghz_reg_rules, num_5ghz_reg_rules);
+ 
+ 	wmi_reg_rule =
+ 		(struct wmi_regulatory_rule_struct *)((u8 *)chan_list_event_hdr
+ 						+ sizeof(*chan_list_event_hdr)
+ 						+ sizeof(struct wmi_tlv));
+ 
+-	if (num_2g_reg_rules) {
+-		reg_info->reg_rules_2g_ptr = create_reg_rules_from_wmi(num_2g_reg_rules,
+-								       wmi_reg_rule);
+-		if (!reg_info->reg_rules_2g_ptr) {
++	if (num_2ghz_reg_rules) {
++		reg_info->reg_rules_2ghz_ptr =
++				create_reg_rules_from_wmi(num_2ghz_reg_rules,
++							  wmi_reg_rule);
++		if (!reg_info->reg_rules_2ghz_ptr) {
+ 			kfree(tb);
+-			ath11k_warn(ab, "Unable to Allocate memory for 2g rules\n");
++			ath11k_warn(ab, "Unable to Allocate memory for 2 GHz rules\n");
+ 			return -ENOMEM;
+ 		}
+ 	}
+ 
+-	if (num_5g_reg_rules) {
+-		wmi_reg_rule += num_2g_reg_rules;
+-		reg_info->reg_rules_5g_ptr = create_reg_rules_from_wmi(num_5g_reg_rules,
+-								       wmi_reg_rule);
+-		if (!reg_info->reg_rules_5g_ptr) {
++	if (num_5ghz_reg_rules) {
++		wmi_reg_rule += num_2ghz_reg_rules;
++		reg_info->reg_rules_5ghz_ptr =
++				create_reg_rules_from_wmi(num_5ghz_reg_rules,
++							  wmi_reg_rule);
++		if (!reg_info->reg_rules_5ghz_ptr) {
+ 			kfree(tb);
+-			ath11k_warn(ab, "Unable to Allocate memory for 5g rules\n");
++			ath11k_warn(ab, "Unable to Allocate memory for 5 GHz rules\n");
+ 			return -ENOMEM;
+ 		}
+ 	}
+@@ -6619,8 +6621,8 @@ fallback:
+ 	WARN_ON(1);
+ mem_free:
+ 	if (reg_info) {
+-		kfree(reg_info->reg_rules_2g_ptr);
+-		kfree(reg_info->reg_rules_5g_ptr);
++		kfree(reg_info->reg_rules_2ghz_ptr);
++		kfree(reg_info->reg_rules_5ghz_ptr);
+ 		kfree(reg_info);
+ 	}
+ 	return ret;
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -4129,14 +4129,14 @@ struct cur_regulatory_info {
+ 	u8 alpha2[REG_ALPHA2_LEN + 1];
+ 	u32 dfs_region;
+ 	u32 phybitmap;
+-	u32 min_bw_2g;
+-	u32 max_bw_2g;
+-	u32 min_bw_5g;
+-	u32 max_bw_5g;
+-	u32 num_2g_reg_rules;
+-	u32 num_5g_reg_rules;
+-	struct cur_reg_rule *reg_rules_2g_ptr;
+-	struct cur_reg_rule *reg_rules_5g_ptr;
++	u32 min_bw_2ghz;
++	u32 max_bw_2ghz;
++	u32 min_bw_5ghz;
++	u32 max_bw_5ghz;
++	u32 num_2ghz_reg_rules;
++	u32 num_5ghz_reg_rules;
++	struct cur_reg_rule *reg_rules_2ghz_ptr;
++	struct cur_reg_rule *reg_rules_5ghz_ptr;
+ };
+ 
+ struct wmi_reg_chan_list_cc_event {
+@@ -4148,12 +4148,12 @@ struct wmi_reg_chan_list_cc_event {
+ 	u32 domain_code;
+ 	u32 dfs_region;
+ 	u32 phybitmap;
+-	u32 min_bw_2g;
+-	u32 max_bw_2g;
+-	u32 min_bw_5g;
+-	u32 max_bw_5g;
+-	u32 num_2g_reg_rules;
+-	u32 num_5g_reg_rules;
++	u32 min_bw_2ghz;
++	u32 max_bw_2ghz;
++	u32 min_bw_5ghz;
++	u32 max_bw_5ghz;
++	u32 num_2ghz_reg_rules;
++	u32 num_5ghz_reg_rules;
+ } __packed;
+ 
+ struct wmi_regulatory_rule_struct {
diff --git a/package/kernel/mac80211/patches/ath11k/0044-wifi-ath11k-add-support-to-parse-new-WMI-event-for-6.patch b/package/kernel/mac80211/patches/ath11k/0044-wifi-ath11k-add-support-to-parse-new-WMI-event-for-6.patch
new file mode 100644
index 000000000..e165c09dc
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0044-wifi-ath11k-add-support-to-parse-new-WMI-event-for-6.patch
@@ -0,0 +1,844 @@
+From 91fa00fa69224aae5afb720c5e68b22e4c4f7333 Mon Sep 17 00:00:00 2001
+From: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Date: Wed, 1 Mar 2023 16:20:59 +0200
+Subject: [PATCH] wifi: ath11k: add support to parse new WMI event for 6 GHz
+
+In order to support different power levels of 6 GHz AP and client,
+new WMI event for regulatory - WMI_REG_CHAN_LIST_CC_EXT_EVENTID is
+added in firmware. This event provides new parameters required for
+6 GHz regulatory rules.
+
+Add support for parsing 2.4 GHz, 5 GHz and 6 GHz reg rules and other
+parameters from WMI_REG_CHAN_LIST_CC_EXT_EVENTID.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Lavanya Suresh <quic_lavaks@quicinc.com>
+Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
+Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230110121024.14051-3-quic_adisi@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/reg.c |  37 ++-
+ drivers/net/wireless/ath/ath11k/wmi.c | 418 +++++++++++++++++++++++++-
+ drivers/net/wireless/ath/ath11k/wmi.h | 163 +++++++++-
+ 3 files changed, 584 insertions(+), 34 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -613,7 +613,7 @@ ath11k_reg_build_regd(struct ath11k_base
+ {
+ 	struct ieee80211_regdomain *tmp_regd, *default_regd, *new_regd = NULL;
+ 	struct cur_reg_rule *reg_rule;
+-	u8 i = 0, j = 0;
++	u8 i = 0, j = 0, k = 0;
+ 	u8 num_rules;
+ 	u16 max_bw;
+ 	u32 flags;
+@@ -621,6 +621,12 @@ ath11k_reg_build_regd(struct ath11k_base
+ 
+ 	num_rules = reg_info->num_5ghz_reg_rules + reg_info->num_2ghz_reg_rules;
+ 
++	/* FIXME: Currently taking reg rules for 6 GHz only from Indoor AP mode list.
++	 * This can be updated after complete 6 GHz regulatory support is added.
++	 */
++	if (reg_info->is_ext_reg_event)
++		num_rules += reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP];
++
+ 	if (!num_rules)
+ 		goto ret;
+ 
+@@ -666,6 +672,14 @@ ath11k_reg_build_regd(struct ath11k_base
+ 			 * per other BW rule flags we pass from here
+ 			 */
+ 			flags = NL80211_RRF_AUTO_BW;
++		} else if (reg_info->is_ext_reg_event &&
++			   reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP] &&
++			   (k < reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP])) {
++			reg_rule = reg_info->reg_rules_6ghz_ap_ptr[WMI_REG_INDOOR_AP] +
++				   k++;
++			max_bw = min_t(u16, reg_rule->max_bw,
++				       reg_info->max_bw_6ghz_ap[WMI_REG_INDOOR_AP]);
++			flags = NL80211_RRF_AUTO_BW;
+ 		} else {
+ 			break;
+ 		}
+@@ -693,12 +707,21 @@ ath11k_reg_build_regd(struct ath11k_base
+ 			continue;
+ 		}
+ 
+-		ath11k_dbg(ab, ATH11K_DBG_REG,
+-			   "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
+-			   i + 1, reg_rule->start_freq, reg_rule->end_freq,
+-			   max_bw, reg_rule->ant_gain, reg_rule->reg_power,
+-			   tmp_regd->reg_rules[i].dfs_cac_ms,
+-			   flags);
++		if (reg_info->is_ext_reg_event) {
++			ath11k_dbg(ab, ATH11K_DBG_REG,
++				   "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d) (%d, %d)\n",
++				   i + 1, reg_rule->start_freq, reg_rule->end_freq,
++				   max_bw, reg_rule->ant_gain, reg_rule->reg_power,
++				   tmp_regd->reg_rules[i].dfs_cac_ms, flags,
++				   reg_rule->psd_flag, reg_rule->psd_eirp);
++		} else {
++			ath11k_dbg(ab, ATH11K_DBG_REG,
++				   "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
++				   i + 1, reg_rule->start_freq, reg_rule->end_freq,
++				   max_bw, reg_rule->ant_gain, reg_rule->reg_power,
++				   tmp_regd->reg_rules[i].dfs_cac_ms,
++				   flags);
++		}
+ 	}
+ 
+ 	tmp_regd->n_reg_rules = i;
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -105,6 +105,8 @@ static const struct wmi_tlv_policy wmi_t
+ 		= { .min_len = sizeof(struct wmi_vdev_stopped_event) },
+ 	[WMI_TAG_REG_CHAN_LIST_CC_EVENT]
+ 		= { .min_len = sizeof(struct wmi_reg_chan_list_cc_event) },
++	[WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT]
++		= { .min_len = sizeof(struct wmi_reg_chan_list_cc_ext_event) },
+ 	[WMI_TAG_MGMT_RX_HDR]
+ 		= { .min_len = sizeof(struct wmi_mgmt_rx_hdr) },
+ 	[WMI_TAG_MGMT_TX_COMPL_EVENT]
+@@ -3974,6 +3976,10 @@ ath11k_wmi_copy_resource_config(struct w
+ 	wmi_cfg->sched_params = tg_cfg->sched_params;
+ 	wmi_cfg->twt_ap_pdev_count = tg_cfg->twt_ap_pdev_count;
+ 	wmi_cfg->twt_ap_sta_count = tg_cfg->twt_ap_sta_count;
++	wmi_cfg->host_service_flags &=
++		~(1 << WMI_CFG_HOST_SERVICE_FLAG_REG_CC_EXT);
++	wmi_cfg->host_service_flags |= (tg_cfg->is_reg_cc_ext_event_supported <<
++					WMI_CFG_HOST_SERVICE_FLAG_REG_CC_EXT);
+ }
+ 
+ static int ath11k_init_cmd_send(struct ath11k_pdev_wmi *wmi,
+@@ -4192,6 +4198,10 @@ int ath11k_wmi_cmd_init(struct ath11k_ba
+ 
+ 	ab->hw_params.hw_ops->wmi_init_config(ab, &config);
+ 
++	if (test_bit(WMI_TLV_SERVICE_REG_CC_EXT_EVENT_SUPPORT,
++		     ab->wmi_ab.svc_map))
++		config.is_reg_cc_ext_event_supported = 1;
++
+ 	memcpy(&wmi_sc->wlan_resource_config, &config, sizeof(config));
+ 
+ 	init_param.res_cfg = &wmi_sc->wlan_resource_config;
+@@ -4995,18 +5005,11 @@ static int ath11k_pull_reg_chan_list_upd
+ 	reg_info->phy_id = chan_list_event_hdr->phy_id;
+ 	reg_info->ctry_code = chan_list_event_hdr->country_id;
+ 	reg_info->reg_dmn_pair = chan_list_event_hdr->domain_code;
+-	if (chan_list_event_hdr->status_code == WMI_REG_SET_CC_STATUS_PASS)
+-		reg_info->status_code = REG_SET_CC_STATUS_PASS;
+-	else if (chan_list_event_hdr->status_code == WMI_REG_CURRENT_ALPHA2_NOT_FOUND)
+-		reg_info->status_code = REG_CURRENT_ALPHA2_NOT_FOUND;
+-	else if (chan_list_event_hdr->status_code == WMI_REG_INIT_ALPHA2_NOT_FOUND)
+-		reg_info->status_code = REG_INIT_ALPHA2_NOT_FOUND;
+-	else if (chan_list_event_hdr->status_code == WMI_REG_SET_CC_CHANGE_NOT_ALLOWED)
+-		reg_info->status_code = REG_SET_CC_CHANGE_NOT_ALLOWED;
+-	else if (chan_list_event_hdr->status_code == WMI_REG_SET_CC_STATUS_NO_MEMORY)
+-		reg_info->status_code = REG_SET_CC_STATUS_NO_MEMORY;
+-	else if (chan_list_event_hdr->status_code == WMI_REG_SET_CC_STATUS_FAIL)
+-		reg_info->status_code = REG_SET_CC_STATUS_FAIL;
++
++	reg_info->status_code =
++		ath11k_wmi_cc_setting_code_to_reg(chan_list_event_hdr->status_code);
++
++	reg_info->is_ext_reg_event = false;
+ 
+ 	reg_info->min_bw_2ghz = chan_list_event_hdr->min_bw_2ghz;
+ 	reg_info->max_bw_2ghz = chan_list_event_hdr->max_bw_2ghz;
+@@ -5060,6 +5063,372 @@ static int ath11k_pull_reg_chan_list_upd
+ 	return 0;
+ }
+ 
++static struct cur_reg_rule
++*create_ext_reg_rules_from_wmi(u32 num_reg_rules,
++			       struct wmi_regulatory_ext_rule *wmi_reg_rule)
++{
++	struct cur_reg_rule *reg_rule_ptr;
++	u32 count;
++
++	reg_rule_ptr =  kcalloc(num_reg_rules, sizeof(*reg_rule_ptr), GFP_ATOMIC);
++
++	if (!reg_rule_ptr)
++		return NULL;
++
++	for (count = 0; count < num_reg_rules; count++) {
++		reg_rule_ptr[count].start_freq =
++			u32_get_bits(wmi_reg_rule[count].freq_info,
++				     REG_RULE_START_FREQ);
++		reg_rule_ptr[count].end_freq =
++			u32_get_bits(wmi_reg_rule[count].freq_info,
++				     REG_RULE_END_FREQ);
++		reg_rule_ptr[count].max_bw =
++			u32_get_bits(wmi_reg_rule[count].bw_pwr_info,
++				     REG_RULE_MAX_BW);
++		reg_rule_ptr[count].reg_power =
++			u32_get_bits(wmi_reg_rule[count].bw_pwr_info,
++				     REG_RULE_REG_PWR);
++		reg_rule_ptr[count].ant_gain =
++			u32_get_bits(wmi_reg_rule[count].bw_pwr_info,
++				     REG_RULE_ANT_GAIN);
++		reg_rule_ptr[count].flags =
++			u32_get_bits(wmi_reg_rule[count].flag_info,
++				     REG_RULE_FLAGS);
++		reg_rule_ptr[count].psd_flag =
++			u32_get_bits(wmi_reg_rule[count].psd_power_info,
++				     REG_RULE_PSD_INFO);
++		reg_rule_ptr[count].psd_eirp =
++			u32_get_bits(wmi_reg_rule[count].psd_power_info,
++				     REG_RULE_PSD_EIRP);
++	}
++
++	return reg_rule_ptr;
++}
++
++static u8
++ath11k_invalid_5ghz_reg_ext_rules_from_wmi(u32 num_reg_rules,
++					   const struct wmi_regulatory_ext_rule *rule)
++{
++	u8 num_invalid_5ghz_rules = 0;
++	u32 count, start_freq;
++
++	for (count = 0; count < num_reg_rules; count++) {
++		start_freq = u32_get_bits(rule[count].freq_info,
++					  REG_RULE_START_FREQ);
++
++		if (start_freq >= ATH11K_MIN_6G_FREQ)
++			num_invalid_5ghz_rules++;
++	}
++
++	return num_invalid_5ghz_rules;
++}
++
++static int ath11k_pull_reg_chan_list_ext_update_ev(struct ath11k_base *ab,
++						   struct sk_buff *skb,
++						   struct cur_regulatory_info *reg_info)
++{
++	const void **tb;
++	const struct wmi_reg_chan_list_cc_ext_event *ext_chan_list_event_hdr;
++	struct wmi_regulatory_ext_rule *ext_wmi_reg_rule;
++	u32 num_2ghz_reg_rules, num_5ghz_reg_rules;
++	u32 num_6ghz_reg_rules_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
++	u32 num_6ghz_client[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
++	u32 total_reg_rules = 0;
++	int ret, i, j, num_invalid_5ghz_ext_rules = 0;
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI, "processing regulatory ext channel list\n");
++
++	tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC);
++	if (IS_ERR(tb)) {
++		ret = PTR_ERR(tb);
++		ath11k_warn(ab, "failed to parse tlv: %d\n", ret);
++		return ret;
++	}
++
++	ext_chan_list_event_hdr = tb[WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT];
++	if (!ext_chan_list_event_hdr) {
++		ath11k_warn(ab, "failed to fetch reg chan list ext update ev\n");
++		kfree(tb);
++		return -EPROTO;
++	}
++
++	reg_info->num_2ghz_reg_rules =
++			ext_chan_list_event_hdr->num_2ghz_reg_rules;
++	reg_info->num_5ghz_reg_rules =
++			ext_chan_list_event_hdr->num_5ghz_reg_rules;
++	reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP] =
++			ext_chan_list_event_hdr->num_6ghz_reg_rules_ap_lpi;
++	reg_info->num_6ghz_rules_ap[WMI_REG_STANDARD_POWER_AP] =
++			ext_chan_list_event_hdr->num_6ghz_reg_rules_ap_sp;
++	reg_info->num_6ghz_rules_ap[WMI_REG_VERY_LOW_POWER_AP] =
++			ext_chan_list_event_hdr->num_6ghz_reg_rules_ap_vlp;
++
++	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
++		reg_info->num_6ghz_rules_client[WMI_REG_INDOOR_AP][i] =
++			ext_chan_list_event_hdr->num_6ghz_reg_rules_client_lpi[i];
++		reg_info->num_6ghz_rules_client[WMI_REG_STANDARD_POWER_AP][i] =
++			ext_chan_list_event_hdr->num_6ghz_reg_rules_client_sp[i];
++		reg_info->num_6ghz_rules_client[WMI_REG_VERY_LOW_POWER_AP][i] =
++			ext_chan_list_event_hdr->num_6ghz_reg_rules_client_vlp[i];
++	}
++
++	num_2ghz_reg_rules = reg_info->num_2ghz_reg_rules;
++	num_5ghz_reg_rules = reg_info->num_5ghz_reg_rules;
++
++	total_reg_rules += num_2ghz_reg_rules;
++	total_reg_rules += num_5ghz_reg_rules;
++
++	if ((num_2ghz_reg_rules > MAX_REG_RULES) ||
++	    (num_5ghz_reg_rules > MAX_REG_RULES)) {
++		ath11k_warn(ab, "Num reg rules for 2.4 GHz/5 GHz exceeds max limit (num_2ghz_reg_rules: %d num_5ghz_reg_rules: %d max_rules: %d)\n",
++			    num_2ghz_reg_rules, num_5ghz_reg_rules, MAX_REG_RULES);
++		kfree(tb);
++		return -EINVAL;
++	}
++
++	for (i = 0; i < WMI_REG_CURRENT_MAX_AP_TYPE; i++) {
++		num_6ghz_reg_rules_ap[i] = reg_info->num_6ghz_rules_ap[i];
++
++		if (num_6ghz_reg_rules_ap[i] > MAX_6GHZ_REG_RULES) {
++			ath11k_warn(ab, "Num 6 GHz reg rules for AP mode(%d) exceeds max limit (num_6ghz_reg_rules_ap: %d, max_rules: %d)\n",
++				    i, num_6ghz_reg_rules_ap[i], MAX_6GHZ_REG_RULES);
++			kfree(tb);
++			return -EINVAL;
++		}
++
++		total_reg_rules += num_6ghz_reg_rules_ap[i];
++	}
++
++	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
++		num_6ghz_client[WMI_REG_INDOOR_AP][i] =
++			reg_info->num_6ghz_rules_client[WMI_REG_INDOOR_AP][i];
++		total_reg_rules += num_6ghz_client[WMI_REG_INDOOR_AP][i];
++
++		num_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
++			reg_info->num_6ghz_rules_client[WMI_REG_STANDARD_POWER_AP][i];
++		total_reg_rules += num_6ghz_client[WMI_REG_STANDARD_POWER_AP][i];
++
++		num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
++			reg_info->num_6ghz_rules_client[WMI_REG_VERY_LOW_POWER_AP][i];
++		total_reg_rules += num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i];
++
++		if ((num_6ghz_client[WMI_REG_INDOOR_AP][i] > MAX_6GHZ_REG_RULES) ||
++		    (num_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] >
++							     MAX_6GHZ_REG_RULES) ||
++		    (num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] >
++							     MAX_6GHZ_REG_RULES)) {
++			ath11k_warn(ab,
++				    "Num 6 GHz client reg rules exceeds max limit, for client(type: %d)\n",
++				    i);
++			kfree(tb);
++			return -EINVAL;
++		}
++	}
++
++	if (!total_reg_rules) {
++		ath11k_warn(ab, "No reg rules available\n");
++		kfree(tb);
++		return -EINVAL;
++	}
++
++	memcpy(reg_info->alpha2, &ext_chan_list_event_hdr->alpha2,
++	       REG_ALPHA2_LEN);
++
++	reg_info->dfs_region = ext_chan_list_event_hdr->dfs_region;
++	reg_info->phybitmap = ext_chan_list_event_hdr->phybitmap;
++	reg_info->num_phy = ext_chan_list_event_hdr->num_phy;
++	reg_info->phy_id = ext_chan_list_event_hdr->phy_id;
++	reg_info->ctry_code = ext_chan_list_event_hdr->country_id;
++	reg_info->reg_dmn_pair = ext_chan_list_event_hdr->domain_code;
++
++	reg_info->status_code =
++		ath11k_wmi_cc_setting_code_to_reg(ext_chan_list_event_hdr->status_code);
++
++	reg_info->is_ext_reg_event = true;
++
++	reg_info->min_bw_2ghz = ext_chan_list_event_hdr->min_bw_2ghz;
++	reg_info->max_bw_2ghz = ext_chan_list_event_hdr->max_bw_2ghz;
++	reg_info->min_bw_5ghz = ext_chan_list_event_hdr->min_bw_5ghz;
++	reg_info->max_bw_5ghz = ext_chan_list_event_hdr->max_bw_5ghz;
++
++	reg_info->min_bw_6ghz_ap[WMI_REG_INDOOR_AP] =
++			ext_chan_list_event_hdr->min_bw_6ghz_ap_lpi;
++	reg_info->max_bw_6ghz_ap[WMI_REG_INDOOR_AP] =
++			 ext_chan_list_event_hdr->max_bw_6ghz_ap_lpi;
++	reg_info->min_bw_6ghz_ap[WMI_REG_STANDARD_POWER_AP] =
++			ext_chan_list_event_hdr->min_bw_6ghz_ap_sp;
++	reg_info->max_bw_6ghz_ap[WMI_REG_STANDARD_POWER_AP] =
++			ext_chan_list_event_hdr->max_bw_6ghz_ap_sp;
++	reg_info->min_bw_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP] =
++			ext_chan_list_event_hdr->min_bw_6ghz_ap_vlp;
++	reg_info->max_bw_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP] =
++			ext_chan_list_event_hdr->max_bw_6ghz_ap_vlp;
++
++	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
++		reg_info->min_bw_6ghz_client[WMI_REG_INDOOR_AP][i] =
++				ext_chan_list_event_hdr->min_bw_6ghz_client_lpi[i];
++		reg_info->max_bw_6ghz_client[WMI_REG_INDOOR_AP][i] =
++				ext_chan_list_event_hdr->max_bw_6ghz_client_lpi[i];
++		reg_info->min_bw_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
++				ext_chan_list_event_hdr->min_bw_6ghz_client_sp[i];
++		reg_info->max_bw_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
++				ext_chan_list_event_hdr->max_bw_6ghz_client_sp[i];
++		reg_info->min_bw_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
++				ext_chan_list_event_hdr->min_bw_6ghz_client_vlp[i];
++		reg_info->max_bw_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
++				ext_chan_list_event_hdr->max_bw_6ghz_client_vlp[i];
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "%s:cc_ext %s dsf %d BW: min_2ghz %d max_2ghz %d min_5ghz %d max_5ghz %d",
++		   __func__, reg_info->alpha2, reg_info->dfs_region,
++		   reg_info->min_bw_2ghz, reg_info->max_bw_2ghz,
++		   reg_info->min_bw_5ghz, reg_info->max_bw_5ghz);
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "num_2ghz_reg_rules %d num_5ghz_reg_rules %d",
++		   num_2ghz_reg_rules, num_5ghz_reg_rules);
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "num_6ghz_reg_rules_ap_lpi: %d num_6ghz_reg_rules_ap_sp: %d num_6ghz_reg_rules_ap_vlp: %d",
++		   num_6ghz_reg_rules_ap[WMI_REG_INDOOR_AP],
++		   num_6ghz_reg_rules_ap[WMI_REG_STANDARD_POWER_AP],
++		   num_6ghz_reg_rules_ap[WMI_REG_VERY_LOW_POWER_AP]);
++
++	j = WMI_REG_DEFAULT_CLIENT;
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "6 GHz Regular client: num_6ghz_reg_rules_lpi: %d num_6ghz_reg_rules_sp: %d num_6ghz_reg_rules_vlp: %d",
++		   num_6ghz_client[WMI_REG_INDOOR_AP][j],
++		   num_6ghz_client[WMI_REG_STANDARD_POWER_AP][j],
++		   num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][j]);
++
++	j = WMI_REG_SUBORDINATE_CLIENT;
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "6 GHz Subordinate client: num_6ghz_reg_rules_lpi: %d num_6ghz_reg_rules_sp: %d num_6ghz_reg_rules_vlp: %d",
++		   num_6ghz_client[WMI_REG_INDOOR_AP][j],
++		   num_6ghz_client[WMI_REG_STANDARD_POWER_AP][j],
++		   num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][j]);
++
++	ext_wmi_reg_rule =
++		(struct wmi_regulatory_ext_rule *)((u8 *)ext_chan_list_event_hdr
++						   + sizeof(*ext_chan_list_event_hdr)
++						   + sizeof(struct wmi_tlv));
++	if (num_2ghz_reg_rules) {
++		reg_info->reg_rules_2ghz_ptr =
++			create_ext_reg_rules_from_wmi(num_2ghz_reg_rules,
++						      ext_wmi_reg_rule);
++
++		if (!reg_info->reg_rules_2ghz_ptr) {
++			kfree(tb);
++			ath11k_warn(ab, "Unable to Allocate memory for 2 GHz rules\n");
++			return -ENOMEM;
++		}
++	}
++
++	ext_wmi_reg_rule += num_2ghz_reg_rules;
++
++	/* Firmware might include 6 GHz reg rule in 5 GHz rule list
++	 * for few countries along with separate 6 GHz rule.
++	 * Having same 6 GHz reg rule in 5 GHz and 6 GHz rules list
++	 * causes intersect check to be true, and same rules will be
++	 * shown multiple times in iw cmd.
++	 * Hence, avoid parsing 6 GHz rule from 5 GHz reg rule list
++	 */
++	num_invalid_5ghz_ext_rules =
++		ath11k_invalid_5ghz_reg_ext_rules_from_wmi(num_5ghz_reg_rules,
++							   ext_wmi_reg_rule);
++
++	if (num_invalid_5ghz_ext_rules) {
++		ath11k_dbg(ab, ATH11K_DBG_WMI,
++			   "CC: %s 5 GHz reg rules number %d from fw, %d number of invalid 5 GHz rules",
++			   reg_info->alpha2, reg_info->num_5ghz_reg_rules,
++			   num_invalid_5ghz_ext_rules);
++
++		num_5ghz_reg_rules = num_5ghz_reg_rules - num_invalid_5ghz_ext_rules;
++		reg_info->num_5ghz_reg_rules = num_5ghz_reg_rules;
++	}
++
++	if (num_5ghz_reg_rules) {
++		reg_info->reg_rules_5ghz_ptr =
++			create_ext_reg_rules_from_wmi(num_5ghz_reg_rules,
++						      ext_wmi_reg_rule);
++
++		if (!reg_info->reg_rules_5ghz_ptr) {
++			kfree(tb);
++			ath11k_warn(ab, "Unable to Allocate memory for 5 GHz rules\n");
++			return -ENOMEM;
++		}
++	}
++
++	/* We have adjusted the number of 5 GHz reg rules above. But still those
++	 * many rules needs to be adjusted in ext_wmi_reg_rule.
++	 *
++	 * NOTE: num_invalid_5ghz_ext_rules will be 0 for rest other cases.
++	 */
++	ext_wmi_reg_rule += (num_5ghz_reg_rules + num_invalid_5ghz_ext_rules);
++
++	for (i = 0; i < WMI_REG_CURRENT_MAX_AP_TYPE; i++) {
++		reg_info->reg_rules_6ghz_ap_ptr[i] =
++			create_ext_reg_rules_from_wmi(num_6ghz_reg_rules_ap[i],
++						      ext_wmi_reg_rule);
++
++		if (!reg_info->reg_rules_6ghz_ap_ptr[i]) {
++			kfree(tb);
++			ath11k_warn(ab, "Unable to Allocate memory for 6 GHz AP rules\n");
++			return -ENOMEM;
++		}
++
++		ext_wmi_reg_rule += num_6ghz_reg_rules_ap[i];
++	}
++
++	for (j = 0; j < WMI_REG_CURRENT_MAX_AP_TYPE; j++) {
++		for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
++			reg_info->reg_rules_6ghz_client_ptr[j][i] =
++				create_ext_reg_rules_from_wmi(num_6ghz_client[j][i],
++							      ext_wmi_reg_rule);
++
++			if (!reg_info->reg_rules_6ghz_client_ptr[j][i]) {
++				kfree(tb);
++				ath11k_warn(ab, "Unable to Allocate memory for 6 GHz client rules\n");
++				return -ENOMEM;
++			}
++
++			ext_wmi_reg_rule += num_6ghz_client[j][i];
++		}
++	}
++
++	reg_info->client_type = ext_chan_list_event_hdr->client_type;
++	reg_info->rnr_tpe_usable = ext_chan_list_event_hdr->rnr_tpe_usable;
++	reg_info->unspecified_ap_usable =
++			ext_chan_list_event_hdr->unspecified_ap_usable;
++	reg_info->domain_code_6ghz_ap[WMI_REG_INDOOR_AP] =
++			ext_chan_list_event_hdr->domain_code_6ghz_ap_lpi;
++	reg_info->domain_code_6ghz_ap[WMI_REG_STANDARD_POWER_AP] =
++			ext_chan_list_event_hdr->domain_code_6ghz_ap_sp;
++	reg_info->domain_code_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP] =
++			ext_chan_list_event_hdr->domain_code_6ghz_ap_vlp;
++
++	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
++		reg_info->domain_code_6ghz_client[WMI_REG_INDOOR_AP][i] =
++				ext_chan_list_event_hdr->domain_code_6ghz_client_lpi[i];
++		reg_info->domain_code_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
++				ext_chan_list_event_hdr->domain_code_6ghz_client_sp[i];
++		reg_info->domain_code_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
++				ext_chan_list_event_hdr->domain_code_6ghz_client_vlp[i];
++	}
++
++	reg_info->domain_code_6ghz_super_id =
++			ext_chan_list_event_hdr->domain_code_6ghz_super_id;
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI, "6 GHz client_type: %d domain_code_6ghz_super_id: %d",
++		   reg_info->client_type, reg_info->domain_code_6ghz_super_id);
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI, "processed regulatory ext channel list\n");
++
++	kfree(tb);
++	return 0;
++}
++
+ static int ath11k_pull_peer_del_resp_ev(struct ath11k_base *ab, struct sk_buff *skb,
+ 					struct wmi_peer_delete_resp_event *peer_del_resp)
+ {
+@@ -6507,12 +6876,14 @@ static bool ath11k_reg_is_world_alpha(ch
+ 	return false;
+ }
+ 
+-static int ath11k_reg_chan_list_event(struct ath11k_base *ab, struct sk_buff *skb)
++static int ath11k_reg_chan_list_event(struct ath11k_base *ab,
++				      struct sk_buff *skb,
++				      enum wmi_reg_chan_list_cmd_type id)
+ {
+ 	struct cur_regulatory_info *reg_info = NULL;
+ 	struct ieee80211_regdomain *regd = NULL;
+ 	bool intersect = false;
+-	int ret = 0, pdev_idx;
++	int ret = 0, pdev_idx, i, j;
+ 	struct ath11k *ar;
+ 
+ 	reg_info = kzalloc(sizeof(*reg_info), GFP_ATOMIC);
+@@ -6521,7 +6892,11 @@ static int ath11k_reg_chan_list_event(st
+ 		goto fallback;
+ 	}
+ 
+-	ret = ath11k_pull_reg_chan_list_update_ev(ab, skb, reg_info);
++	if (id == WMI_REG_CHAN_LIST_CC_ID)
++		ret = ath11k_pull_reg_chan_list_update_ev(ab, skb, reg_info);
++	else
++		ret = ath11k_pull_reg_chan_list_ext_update_ev(ab, skb, reg_info);
++
+ 	if (ret) {
+ 		ath11k_warn(ab, "failed to extract regulatory info from received event\n");
+ 		goto fallback;
+@@ -6623,6 +6998,14 @@ mem_free:
+ 	if (reg_info) {
+ 		kfree(reg_info->reg_rules_2ghz_ptr);
+ 		kfree(reg_info->reg_rules_5ghz_ptr);
++		if (reg_info->is_ext_reg_event) {
++			for (i = 0; i < WMI_REG_CURRENT_MAX_AP_TYPE; i++)
++				kfree(reg_info->reg_rules_6ghz_ap_ptr[i]);
++
++			for (j = 0; j < WMI_REG_CURRENT_MAX_AP_TYPE; j++)
++				for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++)
++					kfree(reg_info->reg_rules_6ghz_client_ptr[j][i]);
++		}
+ 		kfree(reg_info);
+ 	}
+ 	return ret;
+@@ -8054,7 +8437,10 @@ static void ath11k_wmi_tlv_op_rx(struct
+ 		ath11k_service_ready_ext2_event(ab, skb);
+ 		break;
+ 	case WMI_REG_CHAN_LIST_CC_EVENTID:
+-		ath11k_reg_chan_list_event(ab, skb);
++		ath11k_reg_chan_list_event(ab, skb, WMI_REG_CHAN_LIST_CC_ID);
++		break;
++	case WMI_REG_CHAN_LIST_CC_EXT_EVENTID:
++		ath11k_reg_chan_list_event(ab, skb, WMI_REG_CHAN_LIST_CC_EXT_ID);
+ 		break;
+ 	case WMI_READY_EVENTID:
+ 		ath11k_ready_event(ab, skb);
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -797,6 +797,7 @@ enum wmi_tlv_event_id {
+ 	WMI_RMC_NEW_LEADER_EVENTID = WMI_TLV_CMD(WMI_GRP_RMC),
+ 	WMI_REG_CHAN_LIST_CC_EVENTID = WMI_TLV_CMD(WMI_GRP_REGULATORY),
+ 	WMI_11D_NEW_COUNTRY_EVENTID,
++	WMI_REG_CHAN_LIST_CC_EXT_EVENTID,
+ 	WMI_NDI_CAP_RSP_EVENTID = WMI_TLV_CMD(WMI_GRP_PROTOTYPE),
+ 	WMI_NDP_INITIATOR_RSP_EVENTID,
+ 	WMI_NDP_RESPONDER_RSP_EVENTID,
+@@ -1865,6 +1866,8 @@ enum wmi_tlv_tag {
+ 	WMI_TAG_PDEV_SRG_OBSS_BSSID_ENABLE_BITMAP_CMD,
+ 	WMI_TAG_PDEV_NON_SRG_OBSS_COLOR_ENABLE_BITMAP_CMD,
+ 	WMI_TAG_PDEV_NON_SRG_OBSS_BSSID_ENABLE_BITMAP_CMD,
++	WMI_TAG_REGULATORY_RULE_EXT_STRUCT = 0x3A9,
++	WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT,
+ 	WMI_TAG_PDEV_SET_BIOS_SAR_TABLE_CMD = 0x3D8,
+ 	WMI_TAG_PDEV_SET_BIOS_GEO_TABLE_CMD,
+ 	WMI_TAG_MAX
+@@ -2097,6 +2100,7 @@ enum wmi_tlv_service {
+ 
+ 	/* The second 128 bits */
+ 	WMI_MAX_EXT_SERVICE = 256,
++	WMI_TLV_SERVICE_REG_CC_EXT_EVENT_SUPPORT = 281,
+ 	WMI_TLV_SERVICE_BIOS_SAR_SUPPORT = 326,
+ 
+ 	/* The third 128 bits */
+@@ -2313,6 +2317,8 @@ struct wmi_init_cmd {
+ #define WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64 BIT(5)
+ #define WMI_RSRC_CFG_FLAG1_ACK_RSSI BIT(18)
+ 
++#define WMI_CFG_HOST_SERVICE_FLAG_REG_CC_EXT 4
++
+ struct wmi_resource_config {
+ 	u32 tlv_header;
+ 	u32 num_vdevs;
+@@ -2372,6 +2378,15 @@ struct wmi_resource_config {
+ 	u32 sched_params;
+ 	u32 twt_ap_pdev_count;
+ 	u32 twt_ap_sta_count;
++	u32 max_nlo_ssids;
++	u32 num_pkt_filters;
++	u32 num_max_sta_vdevs;
++	u32 max_bssid_indicator;
++	u32 ul_resp_config;
++	u32 msdu_flow_override_config0;
++	u32 msdu_flow_override_config1;
++	u32 flags2;
++	u32 host_service_flags;
+ } __packed;
+ 
+ struct wmi_service_ready_event {
+@@ -2854,6 +2869,8 @@ struct rx_reorder_queue_remove_params {
+ #define REG_RULE_MAX_BW				0x0000ffff
+ #define REG_RULE_REG_PWR			0x00ff0000
+ #define REG_RULE_ANT_GAIN			0xff000000
++#define REG_RULE_PSD_INFO			BIT(0)
++#define REG_RULE_PSD_EIRP			0xff0000
+ 
+ #define WMI_VDEV_PARAM_TXBF_SU_TX_BFEE BIT(0)
+ #define WMI_VDEV_PARAM_TXBF_MU_TX_BFEE BIT(1)
+@@ -4049,6 +4066,7 @@ struct wmi_he_rate_set {
+ 
+ #define MAX_REG_RULES 10
+ #define REG_ALPHA2_LEN 2
++#define MAX_6GHZ_REG_RULES 5
+ 
+ enum wmi_start_event_param {
+ 	WMI_VDEV_START_RESP_EVENT = 0,
+@@ -4079,16 +4097,6 @@ enum wmi_vdev_start_resp_status_code {
+ 	WMI_VDEV_START_RESPONSE_INVALID_REGDOMAIN = 4,
+ };
+ 
+-;
+-enum cc_setting_code {
+-	REG_SET_CC_STATUS_PASS = 0,
+-	REG_CURRENT_ALPHA2_NOT_FOUND = 1,
+-	REG_INIT_ALPHA2_NOT_FOUND = 2,
+-	REG_SET_CC_CHANGE_NOT_ALLOWED = 3,
+-	REG_SET_CC_STATUS_NO_MEMORY = 4,
+-	REG_SET_CC_STATUS_FAIL = 5,
+-};
+-
+ /* Regaulatory Rule Flags Passed by FW */
+ #define REGULATORY_CHAN_DISABLED     BIT(0)
+ #define REGULATORY_CHAN_NO_IR        BIT(1)
+@@ -4102,13 +4110,72 @@ enum cc_setting_code {
+ #define REGULATORY_CHAN_NO_20MHZ     BIT(11)
+ #define REGULATORY_CHAN_NO_10MHZ     BIT(12)
+ 
+-enum {
++enum wmi_reg_chan_list_cmd_type {
++	WMI_REG_CHAN_LIST_CC_ID = 0,
++	WMI_REG_CHAN_LIST_CC_EXT_ID = 1,
++};
++
++enum wmi_reg_cc_setting_code {
+ 	WMI_REG_SET_CC_STATUS_PASS = 0,
+ 	WMI_REG_CURRENT_ALPHA2_NOT_FOUND = 1,
+ 	WMI_REG_INIT_ALPHA2_NOT_FOUND = 2,
+ 	WMI_REG_SET_CC_CHANGE_NOT_ALLOWED = 3,
+ 	WMI_REG_SET_CC_STATUS_NO_MEMORY = 4,
+ 	WMI_REG_SET_CC_STATUS_FAIL = 5,
++
++	/* add new setting code above, update in
++	 * @enum cc_setting_code as well.
++	 * Also handle it in ath11k_wmi_cc_setting_code_to_reg()
++	 */
++};
++
++enum cc_setting_code {
++	REG_SET_CC_STATUS_PASS = 0,
++	REG_CURRENT_ALPHA2_NOT_FOUND = 1,
++	REG_INIT_ALPHA2_NOT_FOUND = 2,
++	REG_SET_CC_CHANGE_NOT_ALLOWED = 3,
++	REG_SET_CC_STATUS_NO_MEMORY = 4,
++	REG_SET_CC_STATUS_FAIL = 5,
++
++	/* add new setting code above, update in
++	 * @enum wmi_reg_cc_setting_code as well.
++	 */
++};
++
++static inline enum cc_setting_code
++ath11k_wmi_cc_setting_code_to_reg(enum wmi_reg_cc_setting_code status_code)
++{
++	switch (status_code) {
++	case WMI_REG_SET_CC_STATUS_PASS:
++		return REG_SET_CC_STATUS_PASS;
++	case WMI_REG_CURRENT_ALPHA2_NOT_FOUND:
++		return REG_CURRENT_ALPHA2_NOT_FOUND;
++	case WMI_REG_INIT_ALPHA2_NOT_FOUND:
++		return REG_INIT_ALPHA2_NOT_FOUND;
++	case WMI_REG_SET_CC_CHANGE_NOT_ALLOWED:
++		return REG_SET_CC_CHANGE_NOT_ALLOWED;
++	case WMI_REG_SET_CC_STATUS_NO_MEMORY:
++		return REG_SET_CC_STATUS_NO_MEMORY;
++	case WMI_REG_SET_CC_STATUS_FAIL:
++		return REG_SET_CC_STATUS_FAIL;
++	}
++
++	return REG_SET_CC_STATUS_FAIL;
++}
++
++enum wmi_reg_6ghz_ap_type {
++	WMI_REG_INDOOR_AP = 0,
++	WMI_REG_STANDARD_POWER_AP = 1,
++	WMI_REG_VERY_LOW_POWER_AP = 2,
++
++	WMI_REG_CURRENT_MAX_AP_TYPE,
++	WMI_REG_MAX_AP_TYPE = 7,
++};
++
++enum wmi_reg_6ghz_client_type {
++	WMI_REG_DEFAULT_CLIENT = 0,
++	WMI_REG_SUBORDINATE_CLIENT = 1,
++	WMI_REG_MAX_CLIENT_TYPE = 2,
+ };
+ 
+ struct cur_reg_rule {
+@@ -4118,6 +4185,8 @@ struct cur_reg_rule {
+ 	u8 reg_power;
+ 	u8 ant_gain;
+ 	u16 flags;
++	bool psd_flag;
++	s8 psd_eirp;
+ };
+ 
+ struct cur_regulatory_info {
+@@ -4137,6 +4206,22 @@ struct cur_regulatory_info {
+ 	u32 num_5ghz_reg_rules;
+ 	struct cur_reg_rule *reg_rules_2ghz_ptr;
+ 	struct cur_reg_rule *reg_rules_5ghz_ptr;
++	bool is_ext_reg_event;
++	enum wmi_reg_6ghz_client_type client_type;
++	bool rnr_tpe_usable;
++	bool unspecified_ap_usable;
++	u8 domain_code_6ghz_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
++	u8 domain_code_6ghz_client[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
++	u32 domain_code_6ghz_super_id;
++	u32 min_bw_6ghz_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
++	u32 max_bw_6ghz_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
++	u32 min_bw_6ghz_client[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
++	u32 max_bw_6ghz_client[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
++	u32 num_6ghz_rules_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
++	u32 num_6ghz_rules_client[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
++	struct cur_reg_rule *reg_rules_6ghz_ap_ptr[WMI_REG_CURRENT_MAX_AP_TYPE];
++	struct cur_reg_rule *reg_rules_6ghz_client_ptr
++		[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
+ };
+ 
+ struct wmi_reg_chan_list_cc_event {
+@@ -4163,6 +4248,61 @@ struct wmi_regulatory_rule_struct {
+ 	u32  flag_info;
+ };
+ 
++#define WMI_REG_CLIENT_MAX 4
++
++struct wmi_reg_chan_list_cc_ext_event {
++	u32 status_code;
++	u32 phy_id;
++	u32 alpha2;
++	u32 num_phy;
++	u32 country_id;
++	u32 domain_code;
++	u32 dfs_region;
++	u32 phybitmap;
++	u32 min_bw_2ghz;
++	u32 max_bw_2ghz;
++	u32 min_bw_5ghz;
++	u32 max_bw_5ghz;
++	u32 num_2ghz_reg_rules;
++	u32 num_5ghz_reg_rules;
++	u32 client_type;
++	u32 rnr_tpe_usable;
++	u32 unspecified_ap_usable;
++	u32 domain_code_6ghz_ap_lpi;
++	u32 domain_code_6ghz_ap_sp;
++	u32 domain_code_6ghz_ap_vlp;
++	u32 domain_code_6ghz_client_lpi[WMI_REG_CLIENT_MAX];
++	u32 domain_code_6ghz_client_sp[WMI_REG_CLIENT_MAX];
++	u32 domain_code_6ghz_client_vlp[WMI_REG_CLIENT_MAX];
++	u32 domain_code_6ghz_super_id;
++	u32 min_bw_6ghz_ap_sp;
++	u32 max_bw_6ghz_ap_sp;
++	u32 min_bw_6ghz_ap_lpi;
++	u32 max_bw_6ghz_ap_lpi;
++	u32 min_bw_6ghz_ap_vlp;
++	u32 max_bw_6ghz_ap_vlp;
++	u32 min_bw_6ghz_client_sp[WMI_REG_CLIENT_MAX];
++	u32 max_bw_6ghz_client_sp[WMI_REG_CLIENT_MAX];
++	u32 min_bw_6ghz_client_lpi[WMI_REG_CLIENT_MAX];
++	u32 max_bw_6ghz_client_lpi[WMI_REG_CLIENT_MAX];
++	u32 min_bw_6ghz_client_vlp[WMI_REG_CLIENT_MAX];
++	u32 max_bw_6ghz_client_vlp[WMI_REG_CLIENT_MAX];
++	u32 num_6ghz_reg_rules_ap_sp;
++	u32 num_6ghz_reg_rules_ap_lpi;
++	u32 num_6ghz_reg_rules_ap_vlp;
++	u32 num_6ghz_reg_rules_client_sp[WMI_REG_CLIENT_MAX];
++	u32 num_6ghz_reg_rules_client_lpi[WMI_REG_CLIENT_MAX];
++	u32 num_6ghz_reg_rules_client_vlp[WMI_REG_CLIENT_MAX];
++} __packed;
++
++struct wmi_regulatory_ext_rule {
++	u32 tlv_header;
++	u32 freq_info;
++	u32 bw_pwr_info;
++	u32 flag_info;
++	u32 psd_power_info;
++} __packed;
++
+ struct wmi_vdev_delete_resp_event {
+ 	u32 vdev_id;
+ } __packed;
+@@ -5358,6 +5498,7 @@ struct target_resource_config {
+ 	u32 sched_params;
+ 	u32 twt_ap_pdev_count;
+ 	u32 twt_ap_sta_count;
++	u8 is_reg_cc_ext_event_supported;
+ };
+ 
+ enum wmi_debug_log_param {
diff --git a/package/kernel/mac80211/patches/ath11k/0045-wifi-ath11k-add-debug-prints-in-regulatory-WMI-event.patch b/package/kernel/mac80211/patches/ath11k/0045-wifi-ath11k-add-debug-prints-in-regulatory-WMI-event.patch
new file mode 100644
index 000000000..b88e51928
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0045-wifi-ath11k-add-debug-prints-in-regulatory-WMI-event.patch
@@ -0,0 +1,567 @@
+From e238e62ba8868a784e485eb94451c87cd1b85cee Mon Sep 17 00:00:00 2001
+From: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Date: Wed, 1 Mar 2023 16:20:59 +0200
+Subject: [PATCH] wifi: ath11k: add debug prints in regulatory WMI event
+ processing
+
+Add some more debug prints in processing regulatory WMI event in order to
+increase more debuggability.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230110121024.14051-4-quic_adisi@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/reg.c |   2 +-
+ drivers/net/wireless/ath/ath11k/wmi.c | 207 ++++++++++++++++++--------
+ drivers/net/wireless/ath/ath11k/wmi.h | 142 ++++++++++++++++++
+ 3 files changed, 291 insertions(+), 60 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -646,7 +646,7 @@ ath11k_reg_build_regd(struct ath11k_base
+ 	tmp_regd->dfs_region = ath11k_map_fw_dfs_region(reg_info->dfs_region);
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_REG,
+-		   "\r\nCountry %s, CFG Regdomain %s FW Regdomain %d, num_reg_rules %d\n",
++		   "Country %s, CFG Regdomain %s FW Regdomain %d, num_reg_rules %d\n",
+ 		   alpha2, ath11k_reg_get_regdom_str(tmp_regd->dfs_region),
+ 		   reg_info->dfs_region, num_rules);
+ 	/* Update reg_rules[] below. Firmware is expected to
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -4925,6 +4925,26 @@ static int ath11k_pull_vdev_start_resp_t
+ 	return 0;
+ }
+ 
++static void ath11k_print_reg_rule(struct ath11k_base *ab, const char *band,
++				  u32 num_reg_rules,
++				  struct cur_reg_rule *reg_rule_ptr)
++{
++	struct cur_reg_rule *reg_rule = reg_rule_ptr;
++	u32 count;
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI, "number of reg rules in %s band: %d\n",
++		   band, num_reg_rules);
++
++	for (count = 0; count < num_reg_rules; count++) {
++		ath11k_dbg(ab, ATH11K_DBG_WMI,
++			   "reg rule %d: (%d - %d @ %d) (%d, %d) (FLAGS %d)\n",
++			   count + 1, reg_rule->start_freq, reg_rule->end_freq,
++			   reg_rule->max_bw, reg_rule->ant_gain,
++			   reg_rule->reg_power, reg_rule->flags);
++		reg_rule++;
++	}
++}
++
+ static struct cur_reg_rule
+ *create_reg_rules_from_wmi(u32 num_reg_rules,
+ 			   struct wmi_regulatory_rule_struct *wmi_reg_rule)
+@@ -5006,6 +5026,10 @@ static int ath11k_pull_reg_chan_list_upd
+ 	reg_info->ctry_code = chan_list_event_hdr->country_id;
+ 	reg_info->reg_dmn_pair = chan_list_event_hdr->domain_code;
+ 
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "status_code %s",
++		   ath11k_cc_status_to_str(reg_info->status_code));
++
+ 	reg_info->status_code =
+ 		ath11k_wmi_cc_setting_code_to_reg(chan_list_event_hdr->status_code);
+ 
+@@ -5020,13 +5044,13 @@ static int ath11k_pull_reg_chan_list_upd
+ 	num_5ghz_reg_rules = reg_info->num_5ghz_reg_rules;
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI,
+-		   "%s:cc %s dsf %d BW: min_2ghz %d max_2ghz %d min_5ghz %d max_5ghz %d",
+-		   __func__, reg_info->alpha2, reg_info->dfs_region,
++		   "cc %s dsf %d BW: min_2ghz %d max_2ghz %d min_5ghz %d max_5ghz %d",
++		   reg_info->alpha2, reg_info->dfs_region,
+ 		   reg_info->min_bw_2ghz, reg_info->max_bw_2ghz,
+ 		   reg_info->min_bw_5ghz, reg_info->max_bw_5ghz);
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI,
+-		   "%s: num_2ghz_reg_rules %d num_5ghz_reg_rules %d", __func__,
++		   "num_2ghz_reg_rules %d num_5ghz_reg_rules %d",
+ 		   num_2ghz_reg_rules, num_5ghz_reg_rules);
+ 
+ 	wmi_reg_rule =
+@@ -5043,6 +5067,10 @@ static int ath11k_pull_reg_chan_list_upd
+ 			ath11k_warn(ab, "Unable to Allocate memory for 2 GHz rules\n");
+ 			return -ENOMEM;
+ 		}
++
++		ath11k_print_reg_rule(ab, "2 GHz",
++				      num_2ghz_reg_rules,
++				      reg_info->reg_rules_2ghz_ptr);
+ 	}
+ 
+ 	if (num_5ghz_reg_rules) {
+@@ -5055,6 +5083,10 @@ static int ath11k_pull_reg_chan_list_upd
+ 			ath11k_warn(ab, "Unable to Allocate memory for 5 GHz rules\n");
+ 			return -ENOMEM;
+ 		}
++
++		ath11k_print_reg_rule(ab, "5 GHz",
++				      num_5ghz_reg_rules,
++				      reg_info->reg_rules_5ghz_ptr);
+ 	}
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI, "processed regulatory channel list\n");
+@@ -5128,7 +5160,7 @@ static int ath11k_pull_reg_chan_list_ext
+ 						   struct cur_regulatory_info *reg_info)
+ {
+ 	const void **tb;
+-	const struct wmi_reg_chan_list_cc_ext_event *ext_chan_list_event_hdr;
++	const struct wmi_reg_chan_list_cc_ext_event *ev;
+ 	struct wmi_regulatory_ext_rule *ext_wmi_reg_rule;
+ 	u32 num_2ghz_reg_rules, num_5ghz_reg_rules;
+ 	u32 num_6ghz_reg_rules_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
+@@ -5145,31 +5177,29 @@ static int ath11k_pull_reg_chan_list_ext
+ 		return ret;
+ 	}
+ 
+-	ext_chan_list_event_hdr = tb[WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT];
+-	if (!ext_chan_list_event_hdr) {
++	ev = tb[WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT];
++	if (!ev) {
+ 		ath11k_warn(ab, "failed to fetch reg chan list ext update ev\n");
+ 		kfree(tb);
+ 		return -EPROTO;
+ 	}
+ 
+-	reg_info->num_2ghz_reg_rules =
+-			ext_chan_list_event_hdr->num_2ghz_reg_rules;
+-	reg_info->num_5ghz_reg_rules =
+-			ext_chan_list_event_hdr->num_5ghz_reg_rules;
++	reg_info->num_2ghz_reg_rules = ev->num_2ghz_reg_rules;
++	reg_info->num_5ghz_reg_rules = ev->num_5ghz_reg_rules;
+ 	reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP] =
+-			ext_chan_list_event_hdr->num_6ghz_reg_rules_ap_lpi;
++			ev->num_6ghz_reg_rules_ap_lpi;
+ 	reg_info->num_6ghz_rules_ap[WMI_REG_STANDARD_POWER_AP] =
+-			ext_chan_list_event_hdr->num_6ghz_reg_rules_ap_sp;
++			ev->num_6ghz_reg_rules_ap_sp;
+ 	reg_info->num_6ghz_rules_ap[WMI_REG_VERY_LOW_POWER_AP] =
+-			ext_chan_list_event_hdr->num_6ghz_reg_rules_ap_vlp;
++			ev->num_6ghz_reg_rules_ap_vlp;
+ 
+ 	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
+ 		reg_info->num_6ghz_rules_client[WMI_REG_INDOOR_AP][i] =
+-			ext_chan_list_event_hdr->num_6ghz_reg_rules_client_lpi[i];
++			ev->num_6ghz_reg_rules_client_lpi[i];
+ 		reg_info->num_6ghz_rules_client[WMI_REG_STANDARD_POWER_AP][i] =
+-			ext_chan_list_event_hdr->num_6ghz_reg_rules_client_sp[i];
++			ev->num_6ghz_reg_rules_client_sp[i];
+ 		reg_info->num_6ghz_rules_client[WMI_REG_VERY_LOW_POWER_AP][i] =
+-			ext_chan_list_event_hdr->num_6ghz_reg_rules_client_vlp[i];
++			ev->num_6ghz_reg_rules_client_vlp[i];
+ 	}
+ 
+ 	num_2ghz_reg_rules = reg_info->num_2ghz_reg_rules;
+@@ -5231,57 +5261,79 @@ static int ath11k_pull_reg_chan_list_ext
+ 		return -EINVAL;
+ 	}
+ 
+-	memcpy(reg_info->alpha2, &ext_chan_list_event_hdr->alpha2,
+-	       REG_ALPHA2_LEN);
++	memcpy(reg_info->alpha2, &ev->alpha2, REG_ALPHA2_LEN);
++
++	reg_info->dfs_region = ev->dfs_region;
++	reg_info->phybitmap = ev->phybitmap;
++	reg_info->num_phy = ev->num_phy;
++	reg_info->phy_id = ev->phy_id;
++	reg_info->ctry_code = ev->country_id;
++	reg_info->reg_dmn_pair = ev->domain_code;
+ 
+-	reg_info->dfs_region = ext_chan_list_event_hdr->dfs_region;
+-	reg_info->phybitmap = ext_chan_list_event_hdr->phybitmap;
+-	reg_info->num_phy = ext_chan_list_event_hdr->num_phy;
+-	reg_info->phy_id = ext_chan_list_event_hdr->phy_id;
+-	reg_info->ctry_code = ext_chan_list_event_hdr->country_id;
+-	reg_info->reg_dmn_pair = ext_chan_list_event_hdr->domain_code;
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "status_code %s",
++		   ath11k_cc_status_to_str(reg_info->status_code));
+ 
+ 	reg_info->status_code =
+-		ath11k_wmi_cc_setting_code_to_reg(ext_chan_list_event_hdr->status_code);
++		ath11k_wmi_cc_setting_code_to_reg(ev->status_code);
+ 
+ 	reg_info->is_ext_reg_event = true;
+ 
+-	reg_info->min_bw_2ghz = ext_chan_list_event_hdr->min_bw_2ghz;
+-	reg_info->max_bw_2ghz = ext_chan_list_event_hdr->max_bw_2ghz;
+-	reg_info->min_bw_5ghz = ext_chan_list_event_hdr->min_bw_5ghz;
+-	reg_info->max_bw_5ghz = ext_chan_list_event_hdr->max_bw_5ghz;
++	reg_info->min_bw_2ghz = ev->min_bw_2ghz;
++	reg_info->max_bw_2ghz = ev->max_bw_2ghz;
++	reg_info->min_bw_5ghz = ev->min_bw_5ghz;
++	reg_info->max_bw_5ghz = ev->max_bw_5ghz;
+ 
+ 	reg_info->min_bw_6ghz_ap[WMI_REG_INDOOR_AP] =
+-			ext_chan_list_event_hdr->min_bw_6ghz_ap_lpi;
++			ev->min_bw_6ghz_ap_lpi;
+ 	reg_info->max_bw_6ghz_ap[WMI_REG_INDOOR_AP] =
+-			 ext_chan_list_event_hdr->max_bw_6ghz_ap_lpi;
++			ev->max_bw_6ghz_ap_lpi;
+ 	reg_info->min_bw_6ghz_ap[WMI_REG_STANDARD_POWER_AP] =
+-			ext_chan_list_event_hdr->min_bw_6ghz_ap_sp;
++			ev->min_bw_6ghz_ap_sp;
+ 	reg_info->max_bw_6ghz_ap[WMI_REG_STANDARD_POWER_AP] =
+-			ext_chan_list_event_hdr->max_bw_6ghz_ap_sp;
++			ev->max_bw_6ghz_ap_sp;
+ 	reg_info->min_bw_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP] =
+-			ext_chan_list_event_hdr->min_bw_6ghz_ap_vlp;
++			ev->min_bw_6ghz_ap_vlp;
+ 	reg_info->max_bw_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP] =
+-			ext_chan_list_event_hdr->max_bw_6ghz_ap_vlp;
++			ev->max_bw_6ghz_ap_vlp;
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "6 GHz AP BW: LPI (%d - %d), SP (%d - %d), VLP (%d - %d)\n",
++		   reg_info->min_bw_6ghz_ap[WMI_REG_INDOOR_AP],
++		   reg_info->max_bw_6ghz_ap[WMI_REG_INDOOR_AP],
++		   reg_info->min_bw_6ghz_ap[WMI_REG_STANDARD_POWER_AP],
++		   reg_info->max_bw_6ghz_ap[WMI_REG_STANDARD_POWER_AP],
++		   reg_info->min_bw_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP],
++		   reg_info->max_bw_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP]);
+ 
+ 	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
+ 		reg_info->min_bw_6ghz_client[WMI_REG_INDOOR_AP][i] =
+-				ext_chan_list_event_hdr->min_bw_6ghz_client_lpi[i];
++				ev->min_bw_6ghz_client_lpi[i];
+ 		reg_info->max_bw_6ghz_client[WMI_REG_INDOOR_AP][i] =
+-				ext_chan_list_event_hdr->max_bw_6ghz_client_lpi[i];
++				ev->max_bw_6ghz_client_lpi[i];
+ 		reg_info->min_bw_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
+-				ext_chan_list_event_hdr->min_bw_6ghz_client_sp[i];
++				ev->min_bw_6ghz_client_sp[i];
+ 		reg_info->max_bw_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
+-				ext_chan_list_event_hdr->max_bw_6ghz_client_sp[i];
++				ev->max_bw_6ghz_client_sp[i];
+ 		reg_info->min_bw_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
+-				ext_chan_list_event_hdr->min_bw_6ghz_client_vlp[i];
++				ev->min_bw_6ghz_client_vlp[i];
+ 		reg_info->max_bw_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
+-				ext_chan_list_event_hdr->max_bw_6ghz_client_vlp[i];
++				ev->max_bw_6ghz_client_vlp[i];
++
++		ath11k_dbg(ab, ATH11K_DBG_WMI,
++			   "6 GHz %s BW: LPI (%d - %d), SP (%d - %d), VLP (%d - %d)\n",
++			   ath11k_6ghz_client_type_to_str(i),
++			   reg_info->min_bw_6ghz_client[WMI_REG_INDOOR_AP][i],
++			   reg_info->max_bw_6ghz_client[WMI_REG_INDOOR_AP][i],
++			   reg_info->min_bw_6ghz_client[WMI_REG_STANDARD_POWER_AP][i],
++			   reg_info->max_bw_6ghz_client[WMI_REG_STANDARD_POWER_AP][i],
++			   reg_info->min_bw_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i],
++			   reg_info->max_bw_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i]);
+ 	}
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI,
+-		   "%s:cc_ext %s dsf %d BW: min_2ghz %d max_2ghz %d min_5ghz %d max_5ghz %d",
+-		   __func__, reg_info->alpha2, reg_info->dfs_region,
++		   "cc_ext %s dsf %d BW: min_2ghz %d max_2ghz %d min_5ghz %d max_5ghz %d",
++		   reg_info->alpha2, reg_info->dfs_region,
+ 		   reg_info->min_bw_2ghz, reg_info->max_bw_2ghz,
+ 		   reg_info->min_bw_5ghz, reg_info->max_bw_5ghz);
+ 
+@@ -5310,9 +5362,8 @@ static int ath11k_pull_reg_chan_list_ext
+ 		   num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][j]);
+ 
+ 	ext_wmi_reg_rule =
+-		(struct wmi_regulatory_ext_rule *)((u8 *)ext_chan_list_event_hdr
+-						   + sizeof(*ext_chan_list_event_hdr)
+-						   + sizeof(struct wmi_tlv));
++		(struct wmi_regulatory_ext_rule *)((u8 *)ev + sizeof(*ev) +
++						   sizeof(struct wmi_tlv));
+ 	if (num_2ghz_reg_rules) {
+ 		reg_info->reg_rules_2ghz_ptr =
+ 			create_ext_reg_rules_from_wmi(num_2ghz_reg_rules,
+@@ -5323,6 +5374,10 @@ static int ath11k_pull_reg_chan_list_ext
+ 			ath11k_warn(ab, "Unable to Allocate memory for 2 GHz rules\n");
+ 			return -ENOMEM;
+ 		}
++
++		ath11k_print_reg_rule(ab, "2 GHz",
++				      num_2ghz_reg_rules,
++				      reg_info->reg_rules_2ghz_ptr);
+ 	}
+ 
+ 	ext_wmi_reg_rule += num_2ghz_reg_rules;
+@@ -5358,6 +5413,10 @@ static int ath11k_pull_reg_chan_list_ext
+ 			ath11k_warn(ab, "Unable to Allocate memory for 5 GHz rules\n");
+ 			return -ENOMEM;
+ 		}
++
++		ath11k_print_reg_rule(ab, "5 GHz",
++				      num_5ghz_reg_rules,
++				      reg_info->reg_rules_5ghz_ptr);
+ 	}
+ 
+ 	/* We have adjusted the number of 5 GHz reg rules above. But still those
+@@ -5378,10 +5437,17 @@ static int ath11k_pull_reg_chan_list_ext
+ 			return -ENOMEM;
+ 		}
+ 
++		ath11k_print_reg_rule(ab, ath11k_6ghz_ap_type_to_str(i),
++				      num_6ghz_reg_rules_ap[i],
++				      reg_info->reg_rules_6ghz_ap_ptr[i]);
++
+ 		ext_wmi_reg_rule += num_6ghz_reg_rules_ap[i];
+ 	}
+ 
+ 	for (j = 0; j < WMI_REG_CURRENT_MAX_AP_TYPE; j++) {
++		ath11k_dbg(ab, ATH11K_DBG_WMI,
++			   "6 GHz AP type %s", ath11k_6ghz_ap_type_to_str(j));
++
+ 		for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
+ 			reg_info->reg_rules_6ghz_client_ptr[j][i] =
+ 				create_ext_reg_rules_from_wmi(num_6ghz_client[j][i],
+@@ -5393,35 +5459,58 @@ static int ath11k_pull_reg_chan_list_ext
+ 				return -ENOMEM;
+ 			}
+ 
++			ath11k_print_reg_rule(ab,
++					      ath11k_6ghz_client_type_to_str(i),
++					      num_6ghz_client[j][i],
++					      reg_info->reg_rules_6ghz_client_ptr[j][i]);
++
+ 			ext_wmi_reg_rule += num_6ghz_client[j][i];
+ 		}
+ 	}
+ 
+-	reg_info->client_type = ext_chan_list_event_hdr->client_type;
+-	reg_info->rnr_tpe_usable = ext_chan_list_event_hdr->rnr_tpe_usable;
++	reg_info->client_type = ev->client_type;
++	reg_info->rnr_tpe_usable = ev->rnr_tpe_usable;
+ 	reg_info->unspecified_ap_usable =
+-			ext_chan_list_event_hdr->unspecified_ap_usable;
++			ev->unspecified_ap_usable;
+ 	reg_info->domain_code_6ghz_ap[WMI_REG_INDOOR_AP] =
+-			ext_chan_list_event_hdr->domain_code_6ghz_ap_lpi;
++			ev->domain_code_6ghz_ap_lpi;
+ 	reg_info->domain_code_6ghz_ap[WMI_REG_STANDARD_POWER_AP] =
+-			ext_chan_list_event_hdr->domain_code_6ghz_ap_sp;
++			ev->domain_code_6ghz_ap_sp;
+ 	reg_info->domain_code_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP] =
+-			ext_chan_list_event_hdr->domain_code_6ghz_ap_vlp;
++			ev->domain_code_6ghz_ap_vlp;
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "6 GHz reg info client type %s rnr_tpe_usable %d unspecified_ap_usable %d AP sub domain: lpi %s, sp %s, vlp %s\n",
++		   ath11k_6ghz_client_type_to_str(reg_info->client_type),
++		   reg_info->rnr_tpe_usable,
++		   reg_info->unspecified_ap_usable,
++		   ath11k_sub_reg_6ghz_to_str(ev->domain_code_6ghz_ap_lpi),
++		   ath11k_sub_reg_6ghz_to_str(ev->domain_code_6ghz_ap_sp),
++		   ath11k_sub_reg_6ghz_to_str(ev->domain_code_6ghz_ap_vlp));
+ 
+ 	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
+ 		reg_info->domain_code_6ghz_client[WMI_REG_INDOOR_AP][i] =
+-				ext_chan_list_event_hdr->domain_code_6ghz_client_lpi[i];
++				ev->domain_code_6ghz_client_lpi[i];
+ 		reg_info->domain_code_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
+-				ext_chan_list_event_hdr->domain_code_6ghz_client_sp[i];
++				ev->domain_code_6ghz_client_sp[i];
+ 		reg_info->domain_code_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
+-				ext_chan_list_event_hdr->domain_code_6ghz_client_vlp[i];
++				ev->domain_code_6ghz_client_vlp[i];
++
++		ath11k_dbg(ab, ATH11K_DBG_WMI,
++			   "6 GHz client type %s client sub domain: lpi %s, sp %s, vlp %s\n",
++			   ath11k_6ghz_client_type_to_str(i),
++			   ath11k_sub_reg_6ghz_to_str(ev->domain_code_6ghz_client_lpi[i]),
++			   ath11k_sub_reg_6ghz_to_str(ev->domain_code_6ghz_client_sp[i]),
++			   ath11k_sub_reg_6ghz_to_str(ev->domain_code_6ghz_client_vlp[i])
++			  );
+ 	}
+ 
+-	reg_info->domain_code_6ghz_super_id =
+-			ext_chan_list_event_hdr->domain_code_6ghz_super_id;
++	reg_info->domain_code_6ghz_super_id = ev->domain_code_6ghz_super_id;
+ 
+-	ath11k_dbg(ab, ATH11K_DBG_WMI, "6 GHz client_type: %d domain_code_6ghz_super_id: %d",
+-		   reg_info->client_type, reg_info->domain_code_6ghz_super_id);
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "6 GHz client_type %s 6 GHz super domain %s",
++		   ath11k_6ghz_client_type_to_str(reg_info->client_type),
++		   ath11k_super_reg_6ghz_to_str(reg_info->domain_code_6ghz_super_id));
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_WMI, "processed regulatory ext channel list\n");
+ 
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -4139,6 +4139,7 @@ enum cc_setting_code {
+ 
+ 	/* add new setting code above, update in
+ 	 * @enum wmi_reg_cc_setting_code as well.
++	 * Also handle it in ath11k_cc_status_to_str()
+ 	 */
+ };
+ 
+@@ -4163,21 +4164,162 @@ ath11k_wmi_cc_setting_code_to_reg(enum w
+ 	return REG_SET_CC_STATUS_FAIL;
+ }
+ 
++static inline const char *ath11k_cc_status_to_str(enum cc_setting_code code)
++{
++	switch (code) {
++	case REG_SET_CC_STATUS_PASS:
++		return "REG_SET_CC_STATUS_PASS";
++	case REG_CURRENT_ALPHA2_NOT_FOUND:
++		return "REG_CURRENT_ALPHA2_NOT_FOUND";
++	case REG_INIT_ALPHA2_NOT_FOUND:
++		return "REG_INIT_ALPHA2_NOT_FOUND";
++	case REG_SET_CC_CHANGE_NOT_ALLOWED:
++		return "REG_SET_CC_CHANGE_NOT_ALLOWED";
++	case REG_SET_CC_STATUS_NO_MEMORY:
++		return "REG_SET_CC_STATUS_NO_MEMORY";
++	case REG_SET_CC_STATUS_FAIL:
++		return "REG_SET_CC_STATUS_FAIL";
++	}
++
++	return "Unknown CC status";
++}
++
+ enum wmi_reg_6ghz_ap_type {
+ 	WMI_REG_INDOOR_AP = 0,
+ 	WMI_REG_STANDARD_POWER_AP = 1,
+ 	WMI_REG_VERY_LOW_POWER_AP = 2,
+ 
++	/* add AP type above, handle in ath11k_6ghz_ap_type_to_str()
++	 */
+ 	WMI_REG_CURRENT_MAX_AP_TYPE,
+ 	WMI_REG_MAX_AP_TYPE = 7,
+ };
+ 
++static inline const char *
++ath11k_6ghz_ap_type_to_str(enum wmi_reg_6ghz_ap_type type)
++{
++	switch (type) {
++	case WMI_REG_INDOOR_AP:
++		return "INDOOR AP";
++	case WMI_REG_STANDARD_POWER_AP:
++		return "STANDARD POWER AP";
++	case WMI_REG_VERY_LOW_POWER_AP:
++		return "VERY LOW POWER AP";
++	case WMI_REG_CURRENT_MAX_AP_TYPE:
++		return "CURRENT_MAX_AP_TYPE";
++	case WMI_REG_MAX_AP_TYPE:
++		return "MAX_AP_TYPE";
++	}
++
++	return "unknown 6 GHz AP type";
++}
++
+ enum wmi_reg_6ghz_client_type {
+ 	WMI_REG_DEFAULT_CLIENT = 0,
+ 	WMI_REG_SUBORDINATE_CLIENT = 1,
+ 	WMI_REG_MAX_CLIENT_TYPE = 2,
++
++	/* add client type above, handle it in
++	 * ath11k_6ghz_client_type_to_str()
++	 */
++};
++
++static inline const char *
++ath11k_6ghz_client_type_to_str(enum wmi_reg_6ghz_client_type type)
++{
++	switch (type) {
++	case WMI_REG_DEFAULT_CLIENT:
++		return "DEFAULT CLIENT";
++	case WMI_REG_SUBORDINATE_CLIENT:
++		return "SUBORDINATE CLIENT";
++	case WMI_REG_MAX_CLIENT_TYPE:
++		return "MAX_CLIENT_TYPE";
++	}
++
++	return "unknown 6 GHz client type";
++}
++
++enum reg_subdomains_6ghz {
++	EMPTY_6GHZ = 0x0,
++	FCC1_CLIENT_LPI_REGULAR_6GHZ = 0x01,
++	FCC1_CLIENT_SP_6GHZ = 0x02,
++	FCC1_AP_LPI_6GHZ = 0x03,
++	FCC1_CLIENT_LPI_SUBORDINATE = FCC1_AP_LPI_6GHZ,
++	FCC1_AP_SP_6GHZ = 0x04,
++	ETSI1_LPI_6GHZ = 0x10,
++	ETSI1_VLP_6GHZ = 0x11,
++	ETSI2_LPI_6GHZ = 0x12,
++	ETSI2_VLP_6GHZ = 0x13,
++	APL1_LPI_6GHZ = 0x20,
++	APL1_VLP_6GHZ = 0x21,
++
++	/* add sub-domain above, handle it in
++	 * ath11k_sub_reg_6ghz_to_str()
++	 */
++};
++
++static inline const char *
++ath11k_sub_reg_6ghz_to_str(enum reg_subdomains_6ghz sub_id)
++{
++	switch (sub_id) {
++	case EMPTY_6GHZ:
++		return "N/A";
++	case FCC1_CLIENT_LPI_REGULAR_6GHZ:
++		return "FCC1_CLIENT_LPI_REGULAR_6GHZ";
++	case FCC1_CLIENT_SP_6GHZ:
++		return "FCC1_CLIENT_SP_6GHZ";
++	case FCC1_AP_LPI_6GHZ:
++		return "FCC1_AP_LPI_6GHZ/FCC1_CLIENT_LPI_SUBORDINATE";
++	case FCC1_AP_SP_6GHZ:
++		return "FCC1_AP_SP_6GHZ";
++	case ETSI1_LPI_6GHZ:
++		return "ETSI1_LPI_6GHZ";
++	case ETSI1_VLP_6GHZ:
++		return "ETSI1_VLP_6GHZ";
++	case ETSI2_LPI_6GHZ:
++		return "ETSI2_LPI_6GHZ";
++	case ETSI2_VLP_6GHZ:
++		return "ETSI2_VLP_6GHZ";
++	case APL1_LPI_6GHZ:
++		return "APL1_LPI_6GHZ";
++	case APL1_VLP_6GHZ:
++		return "APL1_VLP_6GHZ";
++	}
++
++	return "unknown sub reg id";
++}
++
++enum reg_super_domain_6ghz {
++	FCC1_6GHZ = 0x01,
++	ETSI1_6GHZ = 0x02,
++	ETSI2_6GHZ = 0x03,
++	APL1_6GHZ = 0x04,
++	FCC1_6GHZ_CL = 0x05,
++
++	/* add super domain above, handle it in
++	 * ath11k_super_reg_6ghz_to_str()
++	 */
+ };
+ 
++static inline const char *
++ath11k_super_reg_6ghz_to_str(enum reg_super_domain_6ghz domain_id)
++{
++	switch (domain_id) {
++	case FCC1_6GHZ:
++		return "FCC1_6GHZ";
++	case ETSI1_6GHZ:
++		return "ETSI1_6GHZ";
++	case ETSI2_6GHZ:
++		return "ETSI2_6GHZ";
++	case APL1_6GHZ:
++		return "APL1_6GHZ";
++	case FCC1_6GHZ_CL:
++		return "FCC1_6GHZ_CL";
++	}
++
++	return "unknown domain id";
++}
++
+ struct cur_reg_rule {
+ 	u16 start_freq;
+ 	u16 end_freq;
diff --git a/package/kernel/mac80211/patches/ath11k/0046-wifi-ath11k-Replace-fake-flex-array-with-flexible-ar.patch b/package/kernel/mac80211/patches/ath11k/0046-wifi-ath11k-Replace-fake-flex-array-with-flexible-ar.patch
new file mode 100644
index 000000000..bd1617856
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0046-wifi-ath11k-Replace-fake-flex-array-with-flexible-ar.patch
@@ -0,0 +1,246 @@
+From 3b1088a09ec9438523c251d8435e78988824bc0d Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
+Date: Tue, 7 Mar 2023 16:22:39 -0600
+Subject: [PATCH] wifi: ath11k: Replace fake flex-array with flexible-array
+ member
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Zero-length arrays as fake flexible arrays are deprecated and we are
+moving towards adopting C99 flexible-array members instead.
+
+Address 25 of the following warnings found with GCC-13 and
+-fstrict-flex-arrays=3 enabled:
+drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c:30:51: warning: array subscript <unknown> is outside array bounds of ‘const u32[0]’ {aka ‘const unsigned int[]’} [-Warray-bounds=]
+
+This helps with the ongoing efforts to tighten the FORTIFY_SOURCE
+routines on memcpy() and help us make progress towards globally
+enabling -fstrict-flex-arrays=3 [1].
+
+Link: https://github.com/KSPP/linux/issues/21
+Link: https://github.com/KSPP/linux/issues/266
+Link: https://gcc.gnu.org/pipermail/gcc-patches/2022-October/602902.html [1]
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/ZAe5L5DtmsQxzqRH@work
+---
+ .../wireless/ath/ath11k/debugfs_htt_stats.h   | 73 +++++++++++--------
+ 1 file changed, 43 insertions(+), 30 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.h
++++ b/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.h
+@@ -143,7 +143,8 @@ enum htt_tx_pdev_underrun_enum {
+ /* Bytes stored in little endian order */
+ /* Length should be multiple of DWORD */
+ struct htt_stats_string_tlv {
+-	u32 data[0]; /* Can be variable length */
++	 /* Can be variable length */
++	DECLARE_FLEX_ARRAY(u32, data);
+ } __packed;
+ 
+ #define HTT_STATS_MAC_ID	GENMASK(7, 0)
+@@ -205,27 +206,32 @@ struct htt_tx_pdev_stats_cmn_tlv {
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_pdev_stats_urrn_tlv_v {
+-	u32 urrn_stats[0]; /* HTT_TX_PDEV_MAX_URRN_STATS */
++	/* HTT_TX_PDEV_MAX_URRN_STATS */
++	DECLARE_FLEX_ARRAY(u32, urrn_stats);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_pdev_stats_flush_tlv_v {
+-	u32 flush_errs[0]; /* HTT_TX_PDEV_MAX_FLUSH_REASON_STATS */
++	/* HTT_TX_PDEV_MAX_FLUSH_REASON_STATS */
++	DECLARE_FLEX_ARRAY(u32, flush_errs);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_pdev_stats_sifs_tlv_v {
+-	u32 sifs_status[0]; /* HTT_TX_PDEV_MAX_SIFS_BURST_STATS */
++	/* HTT_TX_PDEV_MAX_SIFS_BURST_STATS */
++	DECLARE_FLEX_ARRAY(u32, sifs_status);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_pdev_stats_phy_err_tlv_v {
+-	u32  phy_errs[0]; /* HTT_TX_PDEV_MAX_PHY_ERR_STATS */
++	/* HTT_TX_PDEV_MAX_PHY_ERR_STATS */
++	DECLARE_FLEX_ARRAY(u32, phy_errs);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_pdev_stats_sifs_hist_tlv_v {
+-	u32 sifs_hist_status[0]; /* HTT_TX_PDEV_SIFS_BURST_HIST_STATS */
++	/* HTT_TX_PDEV_SIFS_BURST_HIST_STATS */
++	DECLARE_FLEX_ARRAY(u32, sifs_hist_status);
+ };
+ 
+ struct htt_tx_pdev_stats_tx_ppdu_stats_tlv_v {
+@@ -590,20 +596,20 @@ struct htt_tx_hwq_difs_latency_stats_tlv
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_hwq_cmd_result_stats_tlv_v {
+-	/* Histogram of sched cmd result */
+-	u32 cmd_result[0]; /* HTT_TX_HWQ_MAX_CMD_RESULT_STATS */
++	/* Histogram of sched cmd result, HTT_TX_HWQ_MAX_CMD_RESULT_STATS */
++	DECLARE_FLEX_ARRAY(u32, cmd_result);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_hwq_cmd_stall_stats_tlv_v {
+-	/* Histogram of various pause conitions */
+-	u32 cmd_stall_status[0]; /* HTT_TX_HWQ_MAX_CMD_STALL_STATS */
++	/* Histogram of various pause conitions, HTT_TX_HWQ_MAX_CMD_STALL_STATS */
++	DECLARE_FLEX_ARRAY(u32, cmd_stall_status);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_hwq_fes_result_stats_tlv_v {
+-	/* Histogram of number of user fes result */
+-	u32 fes_result[0]; /* HTT_TX_HWQ_MAX_FES_RESULT_STATS */
++	/* Histogram of number of user fes result, HTT_TX_HWQ_MAX_FES_RESULT_STATS */
++	DECLARE_FLEX_ARRAY(u32, fes_result);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size
+@@ -635,8 +641,8 @@ struct htt_tx_hwq_tried_mpdu_cnt_hist_tl
+  * #define WAL_TXOP_USED_HISTOGRAM_INTERVAL 1000 ( 1 ms )
+  */
+ struct htt_tx_hwq_txop_used_cnt_hist_tlv_v {
+-	/* Histogram of txop used cnt */
+-	u32 txop_used_cnt_hist[0]; /* HTT_TX_HWQ_TXOP_USED_CNT_HIST */
++	/* Histogram of txop used cnt,  HTT_TX_HWQ_TXOP_USED_CNT_HIST */
++	DECLARE_FLEX_ARRAY(u32, txop_used_cnt_hist);
+ };
+ 
+ /* == TX SELFGEN STATS == */
+@@ -804,17 +810,20 @@ struct htt_tx_pdev_mpdu_stats_tlv {
+ /* == TX SCHED STATS == */
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_sched_txq_cmd_posted_tlv_v {
+-	u32 sched_cmd_posted[0]; /* HTT_TX_PDEV_SCHED_TX_MODE_MAX */
++	/* HTT_TX_PDEV_SCHED_TX_MODE_MAX */
++	DECLARE_FLEX_ARRAY(u32, sched_cmd_posted);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_sched_txq_cmd_reaped_tlv_v {
+-	u32 sched_cmd_reaped[0]; /* HTT_TX_PDEV_SCHED_TX_MODE_MAX */
++	/* HTT_TX_PDEV_SCHED_TX_MODE_MAX */
++	DECLARE_FLEX_ARRAY(u32, sched_cmd_reaped);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_sched_txq_sched_order_su_tlv_v {
+-	u32 sched_order_su[0]; /* HTT_TX_PDEV_NUM_SCHED_ORDER_LOG */
++	/* HTT_TX_PDEV_NUM_SCHED_ORDER_LOG */
++	DECLARE_FLEX_ARRAY(u32, sched_order_su);
+ };
+ 
+ enum htt_sched_txq_sched_ineligibility_tlv_enum {
+@@ -842,7 +851,7 @@ enum htt_sched_txq_sched_ineligibility_t
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_sched_txq_sched_ineligibility_tlv_v {
+ 	/* indexed by htt_sched_txq_sched_ineligibility_tlv_enum */
+-	u32 sched_ineligibility[0];
++	DECLARE_FLEX_ARRAY(u32, sched_ineligibility);
+ };
+ 
+ #define	HTT_TX_PDEV_STATS_SCHED_PER_TXQ_MAC_ID	GENMASK(7, 0)
+@@ -888,18 +897,20 @@ struct htt_stats_tx_sched_cmn_tlv {
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_tqm_gen_mpdu_stats_tlv_v {
+-	u32 gen_mpdu_end_reason[0]; /* HTT_TX_TQM_MAX_GEN_MPDU_END_REASON */
++	/* HTT_TX_TQM_MAX_GEN_MPDU_END_REASON */
++	DECLARE_FLEX_ARRAY(u32, gen_mpdu_end_reason);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_tqm_list_mpdu_stats_tlv_v {
+-	u32 list_mpdu_end_reason[0]; /* HTT_TX_TQM_MAX_LIST_MPDU_END_REASON */
++	 /* HTT_TX_TQM_MAX_LIST_MPDU_END_REASON */
++	DECLARE_FLEX_ARRAY(u32, list_mpdu_end_reason);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_tx_tqm_list_mpdu_cnt_tlv_v {
+-	u32 list_mpdu_cnt_hist[0];
+-			/* HTT_TX_TQM_MAX_LIST_MPDU_CNT_HISTOGRAM_BINS */
++	/* HTT_TX_TQM_MAX_LIST_MPDU_CNT_HISTOGRAM_BINS */
++	DECLARE_FLEX_ARRAY(u32, list_mpdu_cnt_hist);
+ };
+ 
+ struct htt_tx_tqm_pdev_stats_tlv_v {
+@@ -1098,7 +1109,7 @@ struct htt_tx_de_compl_stats_tlv {
+  *                               ENTRIES_PER_BIN_COUNT)
+  */
+ struct htt_tx_de_fw2wbm_ring_full_hist_tlv {
+-	u32 fw2wbm_ring_full_hist[0];
++	DECLARE_FLEX_ARRAY(u32, fw2wbm_ring_full_hist);
+ };
+ 
+ struct htt_tx_de_cmn_stats_tlv {
+@@ -1151,7 +1162,7 @@ struct htt_ring_if_cmn_tlv {
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_sfm_client_user_tlv_v {
+ 	/* Number of DWORDS used per user and per client */
+-	u32 dwords_used_by_user_n[0];
++	DECLARE_FLEX_ARRAY(u32, dwords_used_by_user_n);
+ };
+ 
+ struct htt_sfm_client_tlv {
+@@ -1436,12 +1447,14 @@ struct htt_rx_soc_fw_stats_tlv {
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_rx_soc_fw_refill_ring_empty_tlv_v {
+-	u32 refill_ring_empty_cnt[0]; /* HTT_RX_STATS_REFILL_MAX_RING */
++	/* HTT_RX_STATS_REFILL_MAX_RING */
++	DECLARE_FLEX_ARRAY(u32, refill_ring_empty_cnt);
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_rx_soc_fw_refill_ring_num_refill_tlv_v {
+-	u32 refill_ring_num_refill[0]; /* HTT_RX_STATS_REFILL_MAX_RING */
++	/* HTT_RX_STATS_REFILL_MAX_RING */
++	DECLARE_FLEX_ARRAY(u32, refill_ring_num_refill);
+ };
+ 
+ /* RXDMA error code from WBM released packets */
+@@ -1473,7 +1486,7 @@ enum htt_rx_rxdma_error_code_enum {
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_rx_soc_fw_refill_ring_num_rxdma_err_tlv_v {
+-	u32 rxdma_err[0]; /* HTT_RX_RXDMA_MAX_ERR_CODE */
++	DECLARE_FLEX_ARRAY(u32, rxdma_err); /* HTT_RX_RXDMA_MAX_ERR_CODE */
+ };
+ 
+ /* REO error code from WBM released packets */
+@@ -1505,7 +1518,7 @@ enum htt_rx_reo_error_code_enum {
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_rx_soc_fw_refill_ring_num_reo_err_tlv_v {
+-	u32 reo_err[0]; /* HTT_RX_REO_MAX_ERR_CODE */
++	DECLARE_FLEX_ARRAY(u32, reo_err); /* HTT_RX_REO_MAX_ERR_CODE */
+ };
+ 
+ /* == RX PDEV STATS == */
+@@ -1622,13 +1635,13 @@ struct htt_rx_pdev_fw_stats_phy_err_tlv
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_rx_pdev_fw_ring_mpdu_err_tlv_v {
+ 	/* Num error MPDU for each RxDMA error type  */
+-	u32 fw_ring_mpdu_err[0]; /* HTT_RX_STATS_RXDMA_MAX_ERR */
++	DECLARE_FLEX_ARRAY(u32, fw_ring_mpdu_err); /* HTT_RX_STATS_RXDMA_MAX_ERR */
+ };
+ 
+ /* NOTE: Variable length TLV, use length spec to infer array size */
+ struct htt_rx_pdev_fw_mpdu_drop_tlv_v {
+ 	/* Num MPDU dropped  */
+-	u32 fw_mpdu_drop[0]; /* HTT_RX_STATS_FW_DROP_REASON_MAX */
++	DECLARE_FLEX_ARRAY(u32, fw_mpdu_drop); /* HTT_RX_STATS_FW_DROP_REASON_MAX */
+ };
+ 
+ #define HTT_PDEV_CCA_STATS_TX_FRAME_INFO_PRESENT               (0x1)
diff --git a/package/kernel/mac80211/patches/ath11k/0047-wifi-ath11k-fix-deinitialization-of-firmware-resourc.patch b/package/kernel/mac80211/patches/ath11k/0047-wifi-ath11k-fix-deinitialization-of-firmware-resourc.patch
new file mode 100644
index 000000000..eec11f50e
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0047-wifi-ath11k-fix-deinitialization-of-firmware-resourc.patch
@@ -0,0 +1,79 @@
+From 5a78ac33e3cb8822da64dd1af196e83664b332b0 Mon Sep 17 00:00:00 2001
+From: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Date: Thu, 9 Mar 2023 15:23:08 +0530
+Subject: [PATCH] wifi: ath11k: fix deinitialization of firmware resources
+
+Currently, in ath11k_ahb_fw_resources_init(), iommu domain
+mapping is done only for the chipsets having fixed firmware
+memory. Also, for such chipsets, mapping is done only if it
+does not have TrustZone support.
+
+During deinitialization, only if TrustZone support is not there,
+iommu is unmapped back. However, for non fixed firmware memory
+chipsets, TrustZone support is not there and this makes the
+condition check to true and it tries to unmap the memory which
+was not mapped during initialization.
+
+This leads to the following trace -
+
+[   83.198790] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
+[   83.259537] Modules linked in: ath11k_ahb ath11k qmi_helpers
+.. snip ..
+[   83.280286] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[   83.287228] pc : __iommu_unmap+0x30/0x140
+[   83.293907] lr : iommu_unmap+0x5c/0xa4
+[   83.298072] sp : ffff80000b3abad0
+.. snip ..
+[   83.369175] Call trace:
+[   83.376282]  __iommu_unmap+0x30/0x140
+[   83.378541]  iommu_unmap+0x5c/0xa4
+[   83.382360]  ath11k_ahb_fw_resource_deinit.part.12+0x2c/0xac [ath11k_ahb]
+[   83.385666]  ath11k_ahb_free_resources+0x140/0x17c [ath11k_ahb]
+[   83.392521]  ath11k_ahb_shutdown+0x34/0x40 [ath11k_ahb]
+[   83.398248]  platform_shutdown+0x20/0x2c
+[   83.403455]  device_shutdown+0x16c/0x1c4
+[   83.407621]  kernel_restart_prepare+0x34/0x3c
+[   83.411529]  kernel_restart+0x14/0x74
+[   83.415781]  __do_sys_reboot+0x1c4/0x22c
+[   83.419427]  __arm64_sys_reboot+0x1c/0x24
+[   83.423420]  invoke_syscall+0x44/0xfc
+[   83.427326]  el0_svc_common.constprop.3+0xac/0xe8
+[   83.430974]  do_el0_svc+0xa0/0xa8
+[   83.435659]  el0_svc+0x1c/0x44
+[   83.438957]  el0t_64_sync_handler+0x60/0x144
+[   83.441910]  el0t_64_sync+0x15c/0x160
+[   83.446343] Code: aa0103f4 f9400001 f90027a1 d2800001 (f94006a0)
+[   83.449903] ---[ end trace 0000000000000000 ]---
+
+This can be reproduced by probing an AHB chipset which is not
+having a fixed memory region. During reboot (or rmmod) trace
+can be seen.
+
+Fix this issue by adding a condition check on firmware fixed memory
+hw_param as done in the counter initialization function.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Fixes: f9eec4947add ("ath11k: Add support for targets without trustzone")
+Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230309095308.24937-1-quic_adisi@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/ahb.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -1078,6 +1078,12 @@ static int ath11k_ahb_fw_resource_deinit
+ 	struct iommu_domain *iommu;
+ 	size_t unmapped_size;
+ 
++	/* Chipsets not requiring MSA would have not initialized
++	 * MSA resources, return success in such cases.
++	 */
++	if (!ab->hw_params.fixed_fw_mem)
++		return 0;
++
+ 	if (ab_ahb->fw.use_tz)
+ 		return 0;
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0048-wifi-ath11k-fix-BUFFER_DONE-read-on-monitor-ring-rx-.patch b/package/kernel/mac80211/patches/ath11k/0048-wifi-ath11k-fix-BUFFER_DONE-read-on-monitor-ring-rx-.patch
new file mode 100644
index 000000000..3e2264533
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0048-wifi-ath11k-fix-BUFFER_DONE-read-on-monitor-ring-rx-.patch
@@ -0,0 +1,130 @@
+From 68e93ac5a31d4975b25f819b2dfe914c72abc3bb Mon Sep 17 00:00:00 2001
+From: Harshitha Prem <quic_hprem@quicinc.com>
+Date: Wed, 15 Mar 2023 12:24:43 +0200
+Subject: [PATCH] wifi: ath11k: fix BUFFER_DONE read on monitor ring rx  buffer
+
+Perform dma_sync_single_for_cpu() on monitor ring rx buffer before
+reading BUFFER_DONE tag and do dma_unmap_single() only after device
+had set BUFFER_DONE tag to the buffer.
+
+Also when BUFFER_DONE tag is not set, allow the buffer to get read
+next time without freeing skb.
+
+This helps to fix AP+Monitor VAP with flood traffic scenario to see
+monitor ring rx buffer overrun missing BUFFER_DONE tag to be set.
+
+Also remove redundant rx dma buf free performed on DP
+rx_mon_status_refill_ring.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sathishkumar Muruganandam <quic_murugana@quicinc.com>
+Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230309164434.32660-1-quic_hprem@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 57 ++++++++++---------------
+ 1 file changed, 23 insertions(+), 34 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -435,7 +435,6 @@ fail_free_skb:
+ static int ath11k_dp_rxdma_buf_ring_free(struct ath11k *ar,
+ 					 struct dp_rxdma_ring *rx_ring)
+ {
+-	struct ath11k_pdev_dp *dp = &ar->dp;
+ 	struct sk_buff *skb;
+ 	int buf_id;
+ 
+@@ -453,28 +452,6 @@ static int ath11k_dp_rxdma_buf_ring_free
+ 	idr_destroy(&rx_ring->bufs_idr);
+ 	spin_unlock_bh(&rx_ring->idr_lock);
+ 
+-	/* if rxdma1_enable is false, mon_status_refill_ring
+-	 * isn't setup, so don't clean.
+-	 */
+-	if (!ar->ab->hw_params.rxdma1_enable)
+-		return 0;
+-
+-	rx_ring = &dp->rx_mon_status_refill_ring[0];
+-
+-	spin_lock_bh(&rx_ring->idr_lock);
+-	idr_for_each_entry(&rx_ring->bufs_idr, skb, buf_id) {
+-		idr_remove(&rx_ring->bufs_idr, buf_id);
+-		/* XXX: Understand where internal driver does this dma_unmap
+-		 * of rxdma_buffer.
+-		 */
+-		dma_unmap_single(ar->ab->dev, ATH11K_SKB_RXCB(skb)->paddr,
+-				 skb->len + skb_tailroom(skb), DMA_BIDIRECTIONAL);
+-		dev_kfree_skb_any(skb);
+-	}
+-
+-	idr_destroy(&rx_ring->bufs_idr);
+-	spin_unlock_bh(&rx_ring->idr_lock);
+-
+ 	return 0;
+ }
+ 
+@@ -3029,39 +3006,51 @@ static int ath11k_dp_rx_reap_mon_status_
+ 
+ 			spin_lock_bh(&rx_ring->idr_lock);
+ 			skb = idr_find(&rx_ring->bufs_idr, buf_id);
++			spin_unlock_bh(&rx_ring->idr_lock);
++
+ 			if (!skb) {
+ 				ath11k_warn(ab, "rx monitor status with invalid buf_id %d\n",
+ 					    buf_id);
+-				spin_unlock_bh(&rx_ring->idr_lock);
+ 				pmon->buf_state = DP_MON_STATUS_REPLINISH;
+ 				goto move_next;
+ 			}
+ 
+-			idr_remove(&rx_ring->bufs_idr, buf_id);
+-			spin_unlock_bh(&rx_ring->idr_lock);
+-
+ 			rxcb = ATH11K_SKB_RXCB(skb);
+ 
+-			dma_unmap_single(ab->dev, rxcb->paddr,
+-					 skb->len + skb_tailroom(skb),
+-					 DMA_FROM_DEVICE);
++			dma_sync_single_for_cpu(ab->dev, rxcb->paddr,
++						skb->len + skb_tailroom(skb),
++						DMA_FROM_DEVICE);
+ 
+ 			tlv = (struct hal_tlv_hdr *)skb->data;
+ 			if (FIELD_GET(HAL_TLV_HDR_TAG, tlv->tl) !=
+ 					HAL_RX_STATUS_BUFFER_DONE) {
+-				ath11k_warn(ab, "mon status DONE not set %lx\n",
++				ath11k_warn(ab, "mon status DONE not set %lx, buf_id %d\n",
+ 					    FIELD_GET(HAL_TLV_HDR_TAG,
+-						      tlv->tl));
+-				dev_kfree_skb_any(skb);
++						      tlv->tl), buf_id);
++				/* If done status is missing, hold onto status
++				 * ring until status is done for this status
++				 * ring buffer.
++				 * Keep HP in mon_status_ring unchanged,
++				 * and break from here.
++				 * Check status for same buffer for next time
++				 */
+ 				pmon->buf_state = DP_MON_STATUS_NO_DMA;
+-				goto move_next;
++				break;
+ 			}
+ 
++			spin_lock_bh(&rx_ring->idr_lock);
++			idr_remove(&rx_ring->bufs_idr, buf_id);
++			spin_unlock_bh(&rx_ring->idr_lock);
+ 			if (ab->hw_params.full_monitor_mode) {
+ 				ath11k_dp_rx_mon_update_status_buf_state(pmon, tlv);
+ 				if (paddr == pmon->mon_status_paddr)
+ 					pmon->buf_state = DP_MON_STATUS_MATCH;
+ 			}
++
++			dma_unmap_single(ab->dev, rxcb->paddr,
++					 skb->len + skb_tailroom(skb),
++					 DMA_FROM_DEVICE);
++
+ 			__skb_queue_tail(skb_list, skb);
+ 		} else {
+ 			pmon->buf_state = DP_MON_STATUS_REPLINISH;
diff --git a/package/kernel/mac80211/patches/ath11k/0049-wifi-ath11k-Optimize-6-GHz-scan-time.patch b/package/kernel/mac80211/patches/ath11k/0049-wifi-ath11k-Optimize-6-GHz-scan-time.patch
new file mode 100644
index 000000000..f468990fe
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0049-wifi-ath11k-Optimize-6-GHz-scan-time.patch
@@ -0,0 +1,101 @@
+From 8b4d2f080afbd4280ecca0f4b3ceea943a7a86d0 Mon Sep 17 00:00:00 2001
+From: Manikanta Pubbisetty <quic_mpubbise@quicinc.com>
+Date: Thu, 23 Mar 2023 11:39:13 +0530
+Subject: [PATCH] wifi: ath11k: Optimize 6 GHz scan time
+
+Currently, time taken to scan all supported channels on WCN6750
+is ~8 seconds and connection time is almost 10 seconds. WCN6750
+supports three Wi-Fi bands (i.e., 2.4/5/6 GHz) and the numbers of
+channels for scan come around ~100 channels (default case).
+Since the chip doesn't have support for DBS (Dual Band Simultaneous),
+scans cannot be parallelized resulting in longer scan times.
+
+Among the 100 odd channels, ~60 channels are in 6 GHz band. Therefore,
+optimizing the scan for 6 GHz channels will bring down the overall
+scan time.
+
+WCN6750 firmware has support to scan a 6 GHz channel based on co-located
+AP information i.e., RNR IE which is found in the legacy 2.4/5 GHz scan
+results. When a scan request with all supported channel list is enqueued
+to the firmware, then based on WMI_SCAN_CHAN_FLAG_SCAN_ONLY_IF_RNR_FOUND
+scan channel flag, firmware will scan only those 6 GHz channels for which
+RNR IEs are found in the legacy scan results.
+
+In the proposed design, based on NL80211_SCAN_FLAG_COLOCATED_6GHZ scan
+flag, driver will set the WMI_SCAN_CHAN_FLAG_SCAN_ONLY_IF_RNR_FOUND flag
+for non-PSC channels. Since there is high probability to find 6 GHz APs
+on PSC channels, these channels are always scanned. Only non-PSC channels
+are selectively scanned based on cached RNR information from the legacy
+scan results.
+
+If NL80211_SCAN_FLAG_COLOCATED_6GHZ is not set in the scan flags,
+then scan will happen on all supported channels (default behavior).
+
+With these optimizations, scan time is improved by 1.5-1.8 seconds on
+WCN6750. Similar savings have been observed on WCN6855.
+
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1
+Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.16
+
+Signed-off-by: Manikanta Pubbisetty <quic_mpubbise@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230323060913.10097-1-quic_mpubbise@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 25 +++++++++++++++++++++++--
+ drivers/net/wireless/ath/ath11k/wmi.h |  4 ++++
+ 2 files changed, 27 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3819,8 +3819,29 @@ static int ath11k_mac_op_hw_scan(struct
+ 			goto exit;
+ 		}
+ 
+-		for (i = 0; i < arg->num_chan; i++)
+-			arg->chan_list[i] = req->channels[i]->center_freq;
++		for (i = 0; i < arg->num_chan; i++) {
++			if (test_bit(WMI_TLV_SERVICE_SCAN_CONFIG_PER_CHANNEL,
++				     ar->ab->wmi_ab.svc_map)) {
++				arg->chan_list[i] =
++					u32_encode_bits(req->channels[i]->center_freq,
++							WMI_SCAN_CONFIG_PER_CHANNEL_MASK);
++
++				/* If NL80211_SCAN_FLAG_COLOCATED_6GHZ is set in scan
++				 * flags, then scan all PSC channels in 6 GHz band and
++				 * those non-PSC channels where RNR IE is found during
++				 * the legacy 2.4/5 GHz scan.
++				 * If NL80211_SCAN_FLAG_COLOCATED_6GHZ is not set,
++				 * then all channels in 6 GHz will be scanned.
++				 */
++				if (req->channels[i]->band == NL80211_BAND_6GHZ &&
++				    req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ &&
++				    !cfg80211_channel_is_psc(req->channels[i]))
++					arg->chan_list[i] |=
++						WMI_SCAN_CH_FLAG_SCAN_ONLY_IF_RNR_FOUND;
++			} else {
++				arg->chan_list[i] = req->channels[i]->center_freq;
++			}
++		}
+ 	}
+ 
+ 	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2100,6 +2100,7 @@ enum wmi_tlv_service {
+ 
+ 	/* The second 128 bits */
+ 	WMI_MAX_EXT_SERVICE = 256,
++	WMI_TLV_SERVICE_SCAN_CONFIG_PER_CHANNEL = 265,
+ 	WMI_TLV_SERVICE_REG_CC_EXT_EVENT_SUPPORT = 281,
+ 	WMI_TLV_SERVICE_BIOS_SAR_SUPPORT = 326,
+ 
+@@ -3249,6 +3250,9 @@ struct  wmi_start_scan_cmd {
+ #define WMI_SCAN_DWELL_MODE_SHIFT        21
+ #define WMI_SCAN_FLAG_EXT_PASSIVE_SCAN_START_TIME_ENHANCE   0x00000800
+ 
++#define WMI_SCAN_CONFIG_PER_CHANNEL_MASK	GENMASK(19, 0)
++#define WMI_SCAN_CH_FLAG_SCAN_ONLY_IF_RNR_FOUND	BIT(20)
++
+ enum {
+ 	WMI_SCAN_DWELL_MODE_DEFAULT      = 0,
+ 	WMI_SCAN_DWELL_MODE_CONSERVATIVE = 1,
diff --git a/package/kernel/mac80211/patches/ath11k/0050-wifi-ath11k-Configure-the-FTM-responder-role-using-f.patch b/package/kernel/mac80211/patches/ath11k/0050-wifi-ath11k-Configure-the-FTM-responder-role-using-f.patch
new file mode 100644
index 000000000..bca08b177
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0050-wifi-ath11k-Configure-the-FTM-responder-role-using-f.patch
@@ -0,0 +1,117 @@
+From 813968c24126cc5c8320cd5db0e262069a535063 Mon Sep 17 00:00:00 2001
+From: Ganesh Babu Jothiram <quic_gjothira@quicinc.com>
+Date: Fri, 24 Mar 2023 16:57:00 +0200
+Subject: [PATCH] wifi: ath11k: Configure the FTM responder role using firmware
+ capability flag
+
+Fine Time Measurement(FTM) is offloaded feature to firmware.
+Hence, the configuration of FTM responder role is done using
+firmware capability flag instead of hw param.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Ganesh Babu Jothiram <quic_gjothira@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230317072034.8217-1-quic_gjothira@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c | 8 --------
+ drivers/net/wireless/ath/ath11k/hw.h   | 1 -
+ drivers/net/wireless/ath/ath11k/mac.c  | 4 ++--
+ 3 files changed, 2 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -116,7 +116,6 @@ static const struct ath11k_hw_params ath
+ 		.tcl_ring_retry = true,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+-		.ftm_responder = true,
+ 	},
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ6018_HW10,
+@@ -199,7 +198,6 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = false,
+-		.ftm_responder = true,
+ 	},
+ 	{
+ 		.name = "qca6390 hw2.0",
+@@ -284,7 +282,6 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = true,
+-		.ftm_responder = false,
+ 	},
+ 	{
+ 		.name = "qcn9074 hw1.0",
+@@ -366,7 +363,6 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = false,
+-		.ftm_responder = true,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.0",
+@@ -451,7 +447,6 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = true,
+-		.ftm_responder = false,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.1",
+@@ -534,7 +529,6 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = true,
+-		.ftm_responder = false,
+ 	},
+ 	{
+ 		.name = "wcn6750 hw1.0",
+@@ -615,7 +609,6 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE_WCN6750,
+ 		.smp2p_wow_exit = true,
+ 		.support_fw_mac_sequence = true,
+-		.ftm_responder = false,
+ 	},
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ5018_HW10,
+@@ -695,7 +688,6 @@ static const struct ath11k_hw_params ath
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = false,
+-		.ftm_responder = true,
+ 	},
+ };
+ 
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -224,7 +224,6 @@ struct ath11k_hw_params {
+ 	u32 tx_ring_size;
+ 	bool smp2p_wow_exit;
+ 	bool support_fw_mac_sequence;
+-	bool ftm_responder;
+ };
+ 
+ struct ath11k_hw_ops {
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3538,7 +3538,7 @@ static void ath11k_mac_op_bss_info_chang
+ 
+ 	if (changed & BSS_CHANGED_FTM_RESPONDER &&
+ 	    arvif->ftm_responder != info->ftm_responder &&
+-	    ar->ab->hw_params.ftm_responder &&
++	    test_bit(WMI_TLV_SERVICE_RTT, ar->ab->wmi_ab.svc_map) &&
+ 	    (vif->type == NL80211_IFTYPE_AP ||
+ 	     vif->type == NL80211_IFTYPE_MESH_POINT)) {
+ 		arvif->ftm_responder = info->ftm_responder;
+@@ -9234,7 +9234,7 @@ static int __ath11k_mac_register(struct
+ 	wiphy_ext_feature_set(ar->hw->wiphy,
+ 			      NL80211_EXT_FEATURE_SET_SCAN_DWELL);
+ 
+-	if (ab->hw_params.ftm_responder)
++	if (test_bit(WMI_TLV_SERVICE_RTT, ar->ab->wmi_ab.svc_map))
+ 		wiphy_ext_feature_set(ar->hw->wiphy,
+ 				      NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0051-wifi-ath11k-fix-rssi-station-dump-not-updated-in-QCN.patch b/package/kernel/mac80211/patches/ath11k/0051-wifi-ath11k-fix-rssi-station-dump-not-updated-in-QCN.patch
new file mode 100644
index 000000000..835dece1f
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0051-wifi-ath11k-fix-rssi-station-dump-not-updated-in-QCN.patch
@@ -0,0 +1,158 @@
+From 031ffa6c2cd305a57ccc6d610f2decd956b2e7f6 Mon Sep 17 00:00:00 2001
+From: P Praneesh <quic_ppranees@quicinc.com>
+Date: Fri, 24 Mar 2023 16:57:00 +0200
+Subject: [PATCH] wifi: ath11k: fix rssi station dump not updated in QCN9074
+
+In QCN9074, station dump signal values display default value which
+is -95 dbm, since there is firmware header change for HAL_RX_MPDU_START
+between QCN9074 and IPQ8074 which cause wrong peer_id fetch from msdu.
+Fix this by updating hal_rx_mpdu_info with corresponding QCN9074 tlv
+format.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01695-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230320110312.20639-1-quic_ppranees@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/hal_rx.c | 10 ++++++++-
+ drivers/net/wireless/ath/ath11k/hal_rx.h | 18 +++++++++++++++-
+ drivers/net/wireless/ath/ath11k/hw.c     | 27 ++++++++++++++++--------
+ drivers/net/wireless/ath/ath11k/hw.h     |  2 +-
+ 4 files changed, 45 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.c
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
+@@ -865,6 +865,12 @@ ath11k_hal_rx_populate_mu_user_info(void
+ 	ath11k_hal_rx_populate_byte_count(rx_tlv, ppdu_info, rx_user_status);
+ }
+ 
++static u16 ath11k_hal_rx_mpduinfo_get_peerid(struct ath11k_base *ab,
++					     struct hal_rx_mpdu_info *mpdu_info)
++{
++	return ab->hw_params.hw_ops->mpdu_info_get_peerid(mpdu_info);
++}
++
+ static enum hal_rx_mon_status
+ ath11k_hal_rx_parse_mon_status_tlv(struct ath11k_base *ab,
+ 				   struct hal_rx_mon_ppdu_info *ppdu_info,
+@@ -1459,9 +1465,11 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 		break;
+ 	}
+ 	case HAL_RX_MPDU_START: {
++		struct hal_rx_mpdu_info *mpdu_info =
++				(struct hal_rx_mpdu_info *)tlv_data;
+ 		u16 peer_id;
+ 
+-		peer_id = ab->hw_params.hw_ops->mpdu_info_get_peerid(tlv_data);
++		peer_id = ath11k_hal_rx_mpduinfo_get_peerid(ab, mpdu_info);
+ 		if (peer_id)
+ 			ppdu_info->peer_id = peer_id;
+ 		break;
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.h
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
+@@ -405,7 +405,7 @@ struct hal_rx_phyrx_rssi_legacy_info {
+ #define HAL_RX_MPDU_INFO_INFO0_PEERID_WCN6855	GENMASK(15, 0)
+ #define HAL_RX_MPDU_INFO_INFO1_MPDU_LEN		GENMASK(13, 0)
+ 
+-struct hal_rx_mpdu_info {
++struct hal_rx_mpdu_info_ipq8074 {
+ 	__le32 rsvd0;
+ 	__le32 info0;
+ 	__le32 rsvd1[11];
+@@ -413,12 +413,28 @@ struct hal_rx_mpdu_info {
+ 	__le32 rsvd2[9];
+ } __packed;
+ 
++struct hal_rx_mpdu_info_qcn9074 {
++	__le32 rsvd0[10];
++	__le32 info0;
++	__le32 rsvd1[2];
++	__le32 info1;
++	__le32 rsvd2[9];
++} __packed;
++
+ struct hal_rx_mpdu_info_wcn6855 {
+ 	__le32 rsvd0[8];
+ 	__le32 info0;
+ 	__le32 rsvd1[14];
+ } __packed;
+ 
++struct hal_rx_mpdu_info {
++	union {
++		struct hal_rx_mpdu_info_ipq8074 ipq8074;
++		struct hal_rx_mpdu_info_qcn9074 qcn9074;
++		struct hal_rx_mpdu_info_wcn6855 wcn6855;
++	} u;
++} __packed;
++
+ #define HAL_RX_PPDU_END_DURATION	GENMASK(23, 0)
+ struct hal_rx_ppdu_end_duration {
+ 	__le32 rsvd0[9];
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -835,26 +835,35 @@ static void ath11k_hw_ipq5018_reo_setup(
+ 			   ring_hash_map);
+ }
+ 
+-static u16 ath11k_hw_ipq8074_mpdu_info_get_peerid(u8 *tlv_data)
++static u16
++ath11k_hw_ipq8074_mpdu_info_get_peerid(struct hal_rx_mpdu_info *mpdu_info)
+ {
+ 	u16 peer_id = 0;
+-	struct hal_rx_mpdu_info *mpdu_info =
+-		(struct hal_rx_mpdu_info *)tlv_data;
+ 
+ 	peer_id = FIELD_GET(HAL_RX_MPDU_INFO_INFO0_PEERID,
+-			    __le32_to_cpu(mpdu_info->info0));
++			    __le32_to_cpu(mpdu_info->u.ipq8074.info0));
+ 
+ 	return peer_id;
+ }
+ 
+-static u16 ath11k_hw_wcn6855_mpdu_info_get_peerid(u8 *tlv_data)
++static u16
++ath11k_hw_qcn9074_mpdu_info_get_peerid(struct hal_rx_mpdu_info *mpdu_info)
++{
++	u16 peer_id = 0;
++
++	peer_id = FIELD_GET(HAL_RX_MPDU_INFO_INFO0_PEERID,
++			    __le32_to_cpu(mpdu_info->u.qcn9074.info0));
++
++	return peer_id;
++}
++
++static u16
++ath11k_hw_wcn6855_mpdu_info_get_peerid(struct hal_rx_mpdu_info *mpdu_info)
+ {
+ 	u16 peer_id = 0;
+-	struct hal_rx_mpdu_info_wcn6855 *mpdu_info =
+-		(struct hal_rx_mpdu_info_wcn6855 *)tlv_data;
+ 
+ 	peer_id = FIELD_GET(HAL_RX_MPDU_INFO_INFO0_PEERID_WCN6855,
+-			    __le32_to_cpu(mpdu_info->info0));
++			    __le32_to_cpu(mpdu_info->u.wcn6855.info0));
+ 	return peer_id;
+ }
+ 
+@@ -1042,7 +1051,7 @@ const struct ath11k_hw_ops qcn9074_ops =
+ 	.rx_desc_get_attention = ath11k_hw_qcn9074_rx_desc_get_attention,
+ 	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
+ 	.reo_setup = ath11k_hw_ipq8074_reo_setup,
+-	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
++	.mpdu_info_get_peerid = ath11k_hw_qcn9074_mpdu_info_get_peerid,
+ 	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -263,7 +263,7 @@ struct ath11k_hw_ops {
+ 	struct rx_attention *(*rx_desc_get_attention)(struct hal_rx_desc *desc);
+ 	u8 *(*rx_desc_get_msdu_payload)(struct hal_rx_desc *desc);
+ 	void (*reo_setup)(struct ath11k_base *ab);
+-	u16 (*mpdu_info_get_peerid)(u8 *tlv_data);
++	u16 (*mpdu_info_get_peerid)(struct hal_rx_mpdu_info *mpdu_info);
+ 	bool (*rx_desc_mac_addr2_valid)(struct hal_rx_desc *desc);
+ 	u8* (*rx_desc_mpdu_start_addr2)(struct hal_rx_desc *desc);
+ 	u32 (*get_ring_selector)(struct sk_buff *skb);
diff --git a/package/kernel/mac80211/patches/ath11k/0052-wifi-ath11k-Fix-invalid-management-rx-frame-length-i.patch b/package/kernel/mac80211/patches/ath11k/0052-wifi-ath11k-Fix-invalid-management-rx-frame-length-i.patch
new file mode 100644
index 000000000..0c1637fb0
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0052-wifi-ath11k-Fix-invalid-management-rx-frame-length-i.patch
@@ -0,0 +1,115 @@
+From 447b0398a9cd41ca343dfd43e555af92d6214487 Mon Sep 17 00:00:00 2001
+From: Bhagavathi Perumal S <quic_bperumal@quicinc.com>
+Date: Fri, 24 Mar 2023 16:57:00 +0200
+Subject: [PATCH] wifi: ath11k: Fix invalid management rx frame length issue
+
+The WMI management rx event has multiple arrays of TLVs, however the common
+WMI TLV parser won't handle multiple TLV tags of same type.
+So the multiple array tags of WMI management rx TLV is parsed incorrectly
+and the length calculated becomes wrong when the target sends multiple
+array tags.
+
+Add separate TLV parser to handle multiple arrays for WMI management rx
+TLV. This fixes invalid length issue when the target sends multiple array
+tags.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Bhagavathi Perumal S <quic_bperumal@quicinc.com>
+Co-developed-by: Nagarajan Maran <quic_nmaran@quicinc.com>
+Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230320133840.30162-1-quic_nmaran@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 45 +++++++++++++++++++++------
+ 1 file changed, 35 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -82,6 +82,12 @@ struct wmi_tlv_fw_stats_parse {
+ 	bool chain_rssi_done;
+ };
+ 
++struct wmi_tlv_mgmt_rx_parse {
++	const struct wmi_mgmt_rx_hdr *fixed;
++	const u8 *frame_buf;
++	bool frame_buf_done;
++};
++
+ static const struct wmi_tlv_policy wmi_tlv_policies[] = {
+ 	[WMI_TAG_ARRAY_BYTE]
+ 		= { .min_len = 0 },
+@@ -5633,28 +5639,49 @@ static int ath11k_pull_vdev_stopped_para
+ 	return 0;
+ }
+ 
++static int ath11k_wmi_tlv_mgmt_rx_parse(struct ath11k_base *ab,
++					u16 tag, u16 len,
++					const void *ptr, void *data)
++{
++	struct wmi_tlv_mgmt_rx_parse *parse = data;
++
++	switch (tag) {
++	case WMI_TAG_MGMT_RX_HDR:
++		parse->fixed = ptr;
++		break;
++	case WMI_TAG_ARRAY_BYTE:
++		if (!parse->frame_buf_done) {
++			parse->frame_buf = ptr;
++			parse->frame_buf_done = true;
++		}
++		break;
++	}
++	return 0;
++}
++
+ static int ath11k_pull_mgmt_rx_params_tlv(struct ath11k_base *ab,
+ 					  struct sk_buff *skb,
+ 					  struct mgmt_rx_event_params *hdr)
+ {
+-	const void **tb;
++	struct wmi_tlv_mgmt_rx_parse parse = { };
+ 	const struct wmi_mgmt_rx_hdr *ev;
+ 	const u8 *frame;
+ 	int ret;
+ 
+-	tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC);
+-	if (IS_ERR(tb)) {
+-		ret = PTR_ERR(tb);
+-		ath11k_warn(ab, "failed to parse tlv: %d\n", ret);
++	ret = ath11k_wmi_tlv_iter(ab, skb->data, skb->len,
++				  ath11k_wmi_tlv_mgmt_rx_parse,
++				  &parse);
++	if (ret) {
++		ath11k_warn(ab, "failed to parse mgmt rx tlv %d\n",
++			    ret);
+ 		return ret;
+ 	}
+ 
+-	ev = tb[WMI_TAG_MGMT_RX_HDR];
+-	frame = tb[WMI_TAG_ARRAY_BYTE];
++	ev = parse.fixed;
++	frame = parse.frame_buf;
+ 
+ 	if (!ev || !frame) {
+ 		ath11k_warn(ab, "failed to fetch mgmt rx hdr");
+-		kfree(tb);
+ 		return -EPROTO;
+ 	}
+ 
+@@ -5673,7 +5700,6 @@ static int ath11k_pull_mgmt_rx_params_tl
+ 
+ 	if (skb->len < (frame - skb->data) + hdr->buf_len) {
+ 		ath11k_warn(ab, "invalid length in mgmt rx hdr ev");
+-		kfree(tb);
+ 		return -EPROTO;
+ 	}
+ 
+@@ -5685,7 +5711,6 @@ static int ath11k_pull_mgmt_rx_params_tl
+ 
+ 	ath11k_ce_byte_swap(skb->data, hdr->buf_len);
+ 
+-	kfree(tb);
+ 	return 0;
+ }
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0053-wifi-ath11k-fix-writing-to-unintended-memory-region.patch b/package/kernel/mac80211/patches/ath11k/0053-wifi-ath11k-fix-writing-to-unintended-memory-region.patch
new file mode 100644
index 000000000..7b8a7d454
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0053-wifi-ath11k-fix-writing-to-unintended-memory-region.patch
@@ -0,0 +1,43 @@
+From 756a7f90878f0866fd2fe167ef37e90b47326b96 Mon Sep 17 00:00:00 2001
+From: P Praneesh <quic_ppranees@quicinc.com>
+Date: Fri, 24 Mar 2023 16:57:01 +0200
+Subject: [PATCH] wifi: ath11k: fix writing to unintended memory region
+
+While initializing spectral, the magic value is getting written to the
+invalid memory address leading to random boot-up crash. This occurs
+due to the incorrect index increment in ath11k_dbring_fill_magic_value
+function. Fix it by replacing the existing logic with memset32 to ensure
+there is no invalid memory access.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1
+
+Fixes: d3d358efc553 ("ath11k: add spectral/CFR buffer validation support")
+Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230321052900.16895-1-quic_ppranees@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dbring.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dbring.c
++++ b/drivers/net/wireless/ath/ath11k/dbring.c
+@@ -26,13 +26,13 @@ int ath11k_dbring_validate_buffer(struct
+ static void ath11k_dbring_fill_magic_value(struct ath11k *ar,
+ 					   void *buffer, u32 size)
+ {
+-	u32 *temp;
+-	int idx;
++	/* memset32 function fills buffer payload with the ATH11K_DB_MAGIC_VALUE
++	 * and the variable size is expected to be the number of u32 values
++	 * to be stored, not the number of bytes.
++	 */
++	size = size / sizeof(u32);
+ 
+-	size = size >> 2;
+-
+-	for (idx = 0, temp = buffer; idx < size; idx++, temp++)
+-		*temp++ = ATH11K_DB_MAGIC_VALUE;
++	memset32(buffer, ATH11K_DB_MAGIC_VALUE, size);
+ }
+ 
+ static int ath11k_dbring_bufs_replenish(struct ath11k *ar,
diff --git a/package/kernel/mac80211/patches/ath11k/0054-wifi-ath11k-Send-11d-scan-start-before-WMI_START_SCA.patch b/package/kernel/mac80211/patches/ath11k/0054-wifi-ath11k-Send-11d-scan-start-before-WMI_START_SCA.patch
new file mode 100644
index 000000000..0f8e63759
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0054-wifi-ath11k-Send-11d-scan-start-before-WMI_START_SCA.patch
@@ -0,0 +1,61 @@
+From e89a51aedf380bc60219dc9afa96c36507060fb3 Mon Sep 17 00:00:00 2001
+From: Manikanta Pubbisetty <quic_mpubbise@quicinc.com>
+Date: Wed, 15 Mar 2023 21:48:17 +0530
+Subject: [PATCH] wifi: ath11k: Send 11d scan start before WMI_START_SCAN_CMDID
+
+Firmwares advertising the support of triggering 11d algorithm on the
+scan results of a regular scan expects driver to send
+WMI_11D_SCAN_START_CMDID before sending WMI_START_SCAN_CMDID.
+Triggering 11d algorithm on the scan results of a normal scan helps
+in completely avoiding a separate 11d scan for determining regdomain.
+This indirectly helps in speeding up connections on station
+interfaces on the chipsets supporting 11D scan.
+
+To enable this feature, send WMI_11D_SCAN_START_CMDID just before
+sending WMI_START_SCAN_CMDID if the firmware advertises
+WMI_TLV_SERVICE_SUPPORT_11D_FOR_HOST_SCAN service flag.
+
+WCN6750 & WCN6855 supports this feature.
+
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1
+Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
+
+Signed-off-by: Manikanta Pubbisetty <quic_mpubbise@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230315161817.29627-1-quic_mpubbise@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 12 ++++++++++++
+ drivers/net/wireless/ath/ath11k/wmi.h |  1 +
+ 2 files changed, 13 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3755,6 +3755,18 @@ static int ath11k_mac_op_hw_scan(struct
+ 	int i;
+ 	u32 scan_timeout;
+ 
++	/* Firmwares advertising the support of triggering 11D algorithm
++	 * on the scan results of a regular scan expects driver to send
++	 * WMI_11D_SCAN_START_CMDID before sending WMI_START_SCAN_CMDID.
++	 * With this feature, separate 11D scan can be avoided since
++	 * regdomain can be determined with the scan results of the
++	 * regular scan.
++	 */
++	if (ar->state_11d == ATH11K_11D_PREPARING &&
++	    test_bit(WMI_TLV_SERVICE_SUPPORT_11D_FOR_HOST_SCAN,
++		     ar->ab->wmi_ab.svc_map))
++		ath11k_mac_11d_scan_start(ar, arvif->vdev_id);
++
+ 	mutex_lock(&ar->conf_mutex);
+ 
+ 	spin_lock_bh(&ar->data_lock);
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2103,6 +2103,7 @@ enum wmi_tlv_service {
+ 	WMI_TLV_SERVICE_SCAN_CONFIG_PER_CHANNEL = 265,
+ 	WMI_TLV_SERVICE_REG_CC_EXT_EVENT_SUPPORT = 281,
+ 	WMI_TLV_SERVICE_BIOS_SAR_SUPPORT = 326,
++	WMI_TLV_SERVICE_SUPPORT_11D_FOR_HOST_SCAN = 357,
+ 
+ 	/* The third 128 bits */
+ 	WMI_MAX_EXT2_SERVICE = 384
diff --git a/package/kernel/mac80211/patches/ath11k/0055-wifi-ath11k-Remove-redundant-pci_clear_master.patch b/package/kernel/mac80211/patches/ath11k/0055-wifi-ath11k-Remove-redundant-pci_clear_master.patch
new file mode 100644
index 000000000..0439727e7
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0055-wifi-ath11k-Remove-redundant-pci_clear_master.patch
@@ -0,0 +1,58 @@
+From f812e2a9f85d6bea78957ccb5197e4491316848b Mon Sep 17 00:00:00 2001
+From: Cai Huoqing <cai.huoqing@linux.dev>
+Date: Thu, 23 Mar 2023 19:26:09 +0800
+Subject: [PATCH] wifi: ath11k: Remove redundant pci_clear_master
+
+Remove pci_clear_master to simplify the code,
+the bus-mastering is also cleared in do_pci_disable_device,
+like this:
+./drivers/pci/pci.c:2197
+static void do_pci_disable_device(struct pci_dev *dev)
+{
+	u16 pci_command;
+
+	pci_read_config_word(dev, PCI_COMMAND, &pci_command);
+	if (pci_command & PCI_COMMAND_MASTER) {
+		pci_command &= ~PCI_COMMAND_MASTER;
+		pci_write_config_word(dev, PCI_COMMAND, pci_command);
+	}
+
+	pcibios_disable_device(dev);
+}.
+And dev->is_busmaster is set to 0 in pci_disable_device.
+
+Signed-off-by: Cai Huoqing <cai.huoqing@linux.dev>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230323112613.7550-1-cai.huoqing@linux.dev
+---
+ drivers/net/wireless/ath/ath11k/pci.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -540,7 +540,7 @@ static int ath11k_pci_claim(struct ath11
+ 	if (!ab->mem) {
+ 		ath11k_err(ab, "failed to map pci bar %d\n", ATH11K_PCI_BAR_NUM);
+ 		ret = -EIO;
+-		goto clear_master;
++		goto release_region;
+ 	}
+ 
+ 	ab->mem_ce = ab->mem;
+@@ -548,8 +548,6 @@ static int ath11k_pci_claim(struct ath11
+ 	ath11k_dbg(ab, ATH11K_DBG_BOOT, "boot pci_mem 0x%pK\n", ab->mem);
+ 	return 0;
+ 
+-clear_master:
+-	pci_clear_master(pdev);
+ release_region:
+ 	pci_release_region(pdev, ATH11K_PCI_BAR_NUM);
+ disable_device:
+@@ -565,7 +563,6 @@ static void ath11k_pci_free_region(struc
+ 
+ 	pci_iounmap(pci_dev, ab->mem);
+ 	ab->mem = NULL;
+-	pci_clear_master(pci_dev);
+ 	pci_release_region(pci_dev, ATH11K_PCI_BAR_NUM);
+ 	if (pci_is_enabled(pci_dev))
+ 		pci_disable_device(pci_dev);
diff --git a/package/kernel/mac80211/patches/ath11k/0056-wifi-ath11k-Disable-Spectral-scan-upon-removing-inte.patch b/package/kernel/mac80211/patches/ath11k/0056-wifi-ath11k-Disable-Spectral-scan-upon-removing-inte.patch
new file mode 100644
index 000000000..44532a4d7
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0056-wifi-ath11k-Disable-Spectral-scan-upon-removing-inte.patch
@@ -0,0 +1,36 @@
+From 5c690db63b45c6c4c4932b13173af71df369dba5 Mon Sep 17 00:00:00 2001
+From: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+Date: Tue, 28 Mar 2023 12:41:50 +0530
+Subject: [PATCH] wifi: ath11k: Disable Spectral scan upon removing interface
+
+Host might receive spectral events during interface
+down sequence and this might create below errors.
+
+failed to handle dma buf release event -22
+failed to handle dma buf release event -22
+
+Fix this by disabling spectral config during remove interface.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230328071150.29645-1-quic_tamizhr@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6685,6 +6685,11 @@ static void ath11k_mac_op_remove_interfa
+ 	ath11k_dbg(ab, ATH11K_DBG_MAC, "mac remove interface (vdev %d)\n",
+ 		   arvif->vdev_id);
+ 
++	ret = ath11k_spectral_vif_stop(arvif);
++	if (ret)
++		ath11k_warn(ab, "failed to stop spectral for vdev %i: %d\n",
++			    arvif->vdev_id, ret);
++
+ 	if (arvif->vdev_type == WMI_VDEV_TYPE_STA)
+ 		ath11k_mac_11d_scan_stop(ar);
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0057-wifi-ath11k-enable-SAR-support-on-WCN6750.patch b/package/kernel/mac80211/patches/ath11k/0057-wifi-ath11k-enable-SAR-support-on-WCN6750.patch
new file mode 100644
index 000000000..5e64e552c
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0057-wifi-ath11k-enable-SAR-support-on-WCN6750.patch
@@ -0,0 +1,29 @@
+From abf57d84973ce1abcb67504ac0df8aea1fe09a76 Mon Sep 17 00:00:00 2001
+From: Youghandhar Chintala <quic_youghand@quicinc.com>
+Date: Tue, 28 Mar 2023 17:04:55 +0530
+Subject: [PATCH] wifi: ath11k: enable SAR support on WCN6750
+
+Currently, SAR is enabled only on WCN6855, enable this for WCN6750 too. This
+functionality gets triggered, when the user space application calls
+NL80211_CMD_SET_SAR_SPECS.
+
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1
+
+Signed-off-by: Youghandhar Chintala <quic_youghand@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230328113455.11252-1-quic_youghand@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -593,7 +593,7 @@ static const struct ath11k_hw_params ath
+ 		.current_cc_support = true,
+ 		.dbr_debug_support = false,
+ 		.global_reset = false,
+-		.bios_sar_capa = NULL,
++		.bios_sar_capa = &ath11k_hw_sar_capa_wcn6855,
+ 		.m3_fw_support = false,
+ 		.fixed_bdf_addr = false,
+ 		.fixed_mem_region = false,
diff --git a/package/kernel/mac80211/patches/ath11k/0058-wifi-ath11k-pci-Add-more-MODULE_FIRMWARE-entries.patch b/package/kernel/mac80211/patches/ath11k/0058-wifi-ath11k-pci-Add-more-MODULE_FIRMWARE-entries.patch
new file mode 100644
index 000000000..585864eff
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0058-wifi-ath11k-pci-Add-more-MODULE_FIRMWARE-entries.patch
@@ -0,0 +1,36 @@
+From 06c58473969239e00d76b683edd511952060ca56 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 30 Mar 2023 16:37:18 +0200
+Subject: [PATCH] wifi: ath11k: pci: Add more MODULE_FIRMWARE() entries
+
+As there are a few more models supported by the driver, let's add the
+missing MODULE_FIRMWARE() entries for them.  The lack of them resulted
+in the missing device enablement on some systems, such as the
+installation image of openSUSE.
+
+While we are at it, use the wildcard instead of listing each firmware
+files individually for each.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230330143718.19511-1-tiwai@suse.de
+---
+ drivers/net/wireless/ath/ath11k/pci.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -1036,7 +1036,8 @@ module_exit(ath11k_pci_exit);
+ MODULE_DESCRIPTION("Driver support for Qualcomm Technologies 802.11ax WLAN PCIe devices");
+ MODULE_LICENSE("Dual BSD/GPL");
+ 
+-/* QCA639x 2.0 firmware files */
+-MODULE_FIRMWARE(ATH11K_FW_DIR "/QCA6390/hw2.0/" ATH11K_BOARD_API2_FILE);
+-MODULE_FIRMWARE(ATH11K_FW_DIR "/QCA6390/hw2.0/" ATH11K_AMSS_FILE);
+-MODULE_FIRMWARE(ATH11K_FW_DIR "/QCA6390/hw2.0/" ATH11K_M3_FILE);
++/* firmware files */
++MODULE_FIRMWARE(ATH11K_FW_DIR "/QCA6390/hw2.0/*");
++MODULE_FIRMWARE(ATH11K_FW_DIR "/QCN9074/hw1.0/*");
++MODULE_FIRMWARE(ATH11K_FW_DIR "/WCN6855/hw2.0/*");
++MODULE_FIRMWARE(ATH11K_FW_DIR "/WCN6855/hw2.1/*");
diff --git a/package/kernel/mac80211/patches/ath11k/0059-wifi-ath11k-print-a-warning-when-crypto_alloc_shash-.patch b/package/kernel/mac80211/patches/ath11k/0059-wifi-ath11k-print-a-warning-when-crypto_alloc_shash-.patch
new file mode 100644
index 000000000..fab52a0fa
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0059-wifi-ath11k-print-a-warning-when-crypto_alloc_shash-.patch
@@ -0,0 +1,34 @@
+From a87a9110ac0dcbfd9458b6665c141fa1c16a669d Mon Sep 17 00:00:00 2001
+From: Kalle Valo <quic_kvalo@quicinc.com>
+Date: Wed, 5 Apr 2023 12:04:25 +0300
+Subject: [PATCH] wifi: ath11k: print a warning when crypto_alloc_shash() fails
+
+Christoph reported that ath11k failed to initialise when michael_mic.ko
+module was not installed. To make it easier to notice that case print a
+warning when crypto_alloc_shash() fails.
+
+Compile tested only.
+
+Reported-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/all/20221130133016.GC3055@lst.de/
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230405090425.1351-1-kvalo@kernel.org
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -3106,8 +3106,11 @@ int ath11k_peer_rx_frag_setup(struct ath
+ 	int i;
+ 
+ 	tfm = crypto_alloc_shash("michael_mic", 0, 0);
+-	if (IS_ERR(tfm))
++	if (IS_ERR(tfm)) {
++		ath11k_warn(ab, "failed to allocate michael_mic shash: %ld\n",
++			    PTR_ERR(tfm));
+ 		return PTR_ERR(tfm);
++	}
+ 
+ 	spin_lock_bh(&ab->base_lock);
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0060-wifi-ath11k-Ignore-frags-from-uninitialized-peer-in-.patch b/package/kernel/mac80211/patches/ath11k/0060-wifi-ath11k-Ignore-frags-from-uninitialized-peer-in-.patch
new file mode 100644
index 000000000..5bbf9e04a
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0060-wifi-ath11k-Ignore-frags-from-uninitialized-peer-in-.patch
@@ -0,0 +1,104 @@
+From a06bfb3c9f69f303692cdae87bc0899d2ae8b2a6 Mon Sep 17 00:00:00 2001
+From: Harshitha Prem <quic_hprem@quicinc.com>
+Date: Tue, 4 Apr 2023 00:11:54 +0530
+Subject: [PATCH] wifi: ath11k: Ignore frags from uninitialized peer in dp.
+
+When max virtual ap interfaces are configured in all the bands with
+ACS and hostapd restart is done every 60s, a crash is observed at
+random times.
+In this certain scenario, a fragmented packet is received for
+self peer, for which rx_tid and rx_frags are not initialized in
+datapath. While handling this fragment, crash is observed as the
+rx_frag list is uninitialised and when we walk in
+ath11k_dp_rx_h_sort_frags, skb null leads to exception.
+
+To address this, before processing received fragments we check
+dp_setup_done flag is set to ensure that peer has completed its
+dp peer setup for fragment queue, else ignore processing the
+fragments.
+
+Call trace:
+  ath11k_dp_process_rx_err+0x550/0x1084 [ath11k]
+  ath11k_dp_service_srng+0x70/0x370 [ath11k]
+  0xffffffc009693a04
+  __napi_poll+0x30/0xa4
+  net_rx_action+0x118/0x270
+  __do_softirq+0x10c/0x244
+  irq_exit+0x64/0xb4
+  __handle_domain_irq+0x88/0xac
+  gic_handle_irq+0x74/0xbc
+  el1_irq+0xf0/0x1c0
+  arch_cpu_idle+0x10/0x18
+  do_idle+0x104/0x248
+  cpu_startup_entry+0x20/0x64
+  rest_init+0xd0/0xdc
+  arch_call_rest_init+0xc/0x14
+  start_kernel+0x480/0x4b8
+  Code: f9400281 f94066a2 91405021 b94a0023 (f9406401)
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
+Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230403184155.8670-2-quic_nmaran@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp.c    | 4 +++-
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 8 ++++++++
+ drivers/net/wireless/ath/ath11k/peer.h  | 1 +
+ 3 files changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp.c
++++ b/drivers/net/wireless/ath/ath11k/dp.c
+@@ -36,6 +36,7 @@ void ath11k_dp_peer_cleanup(struct ath11
+ 	}
+ 
+ 	ath11k_peer_rx_tid_cleanup(ar, peer);
++	peer->dp_setup_done = false;
+ 	crypto_free_shash(peer->tfm_mmic);
+ 	spin_unlock_bh(&ab->base_lock);
+ }
+@@ -72,7 +73,8 @@ int ath11k_dp_peer_setup(struct ath11k *
+ 	ret = ath11k_peer_rx_frag_setup(ar, addr, vdev_id);
+ 	if (ret) {
+ 		ath11k_warn(ab, "failed to setup rx defrag context\n");
+-		return ret;
++		tid--;
++		goto peer_clean;
+ 	}
+ 
+ 	/* TODO: Setup other peer specific resource used in data path */
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -3130,6 +3130,7 @@ int ath11k_peer_rx_frag_setup(struct ath
+ 	}
+ 
+ 	peer->tfm_mmic = tfm;
++	peer->dp_setup_done = true;
+ 	spin_unlock_bh(&ab->base_lock);
+ 
+ 	return 0;
+@@ -3575,6 +3576,13 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
+ 		ret = -ENOENT;
+ 		goto out_unlock;
+ 	}
++	if (!peer->dp_setup_done) {
++		ath11k_warn(ab, "The peer %pM [%d] has uninitialized datapath\n",
++			    peer->addr, peer_id);
++		ret = -ENOENT;
++		goto out_unlock;
++	}
++
+ 	rx_tid = &peer->rx_tid[tid];
+ 
+ 	if ((!skb_queue_empty(&rx_tid->rx_frags) && seqno != rx_tid->cur_sn) ||
+--- a/drivers/net/wireless/ath/ath11k/peer.h
++++ b/drivers/net/wireless/ath/ath11k/peer.h
+@@ -35,6 +35,7 @@ struct ath11k_peer {
+ 	u16 sec_type;
+ 	u16 sec_type_grp;
+ 	bool is_authorized;
++	bool dp_setup_done;
+ };
+ 
+ void ath11k_peer_unmap_event(struct ath11k_base *ab, u16 peer_id);
diff --git a/package/kernel/mac80211/patches/ath11k/0061-wifi-ath11k-fix-undefined-behavior-with-__fls-in-dp.patch b/package/kernel/mac80211/patches/ath11k/0061-wifi-ath11k-fix-undefined-behavior-with-__fls-in-dp.patch
new file mode 100644
index 000000000..d68c19f16
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0061-wifi-ath11k-fix-undefined-behavior-with-__fls-in-dp.patch
@@ -0,0 +1,29 @@
+From 41e02bf4ae32cf2ac47b08b4caaa9c1a032e4ce7 Mon Sep 17 00:00:00 2001
+From: Harshitha Prem <quic_hprem@quicinc.com>
+Date: Tue, 4 Apr 2023 00:11:55 +0530
+Subject: [PATCH] wifi: ath11k: fix undefined behavior with __fls in dp
+
+"__fls" would have an undefined behavior if the argument is passed
+as "0". Hence, added changes to handle the same.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
+Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230403184155.8670-3-quic_nmaran@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -3598,7 +3598,7 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
+ 		goto out_unlock;
+ 	}
+ 
+-	if (frag_no > __fls(rx_tid->rx_frag_bitmap))
++	if (!rx_tid->rx_frag_bitmap || (frag_no > __fls(rx_tid->rx_frag_bitmap)))
+ 		__skb_queue_tail(&rx_tid->rx_frags, msdu);
+ 	else
+ 		ath11k_dp_rx_h_sort_frags(ar, &rx_tid->rx_frags, msdu);
diff --git a/package/kernel/mac80211/patches/ath11k/0062-wifi-ath11k-fix-double-free-of-peer-rx_tid-during-re.patch b/package/kernel/mac80211/patches/ath11k/0062-wifi-ath11k-fix-double-free-of-peer-rx_tid-during-re.patch
new file mode 100644
index 000000000..dd37b1e4f
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0062-wifi-ath11k-fix-double-free-of-peer-rx_tid-during-re.patch
@@ -0,0 +1,144 @@
+From 93a91f40c25c3d0e61f8540a7accf105090f9995 Mon Sep 17 00:00:00 2001
+From: Harshitha Prem <quic_hprem@quicinc.com>
+Date: Mon, 17 Apr 2023 13:35:00 +0300
+Subject: [PATCH] wifi: ath11k: fix double free of peer rx_tid during reo cmd
+ failure
+
+Peer rx_tid is locally copied thrice during peer_rx_tid_cleanup to
+send REO_CMD_UPDATE_RX_QUEUE followed by REO_CMD_FLUSH_CACHE to flush
+all aged REO descriptors from HW cache.
+
+When sending REO_CMD_FLUSH_CACHE fails, we do dma unmap of already
+mapped rx_tid->vaddr and free it. This is not checked during
+reo_cmd_list_cleanup() and dp_reo_cmd_free() before trying to free and
+unmap again.
+
+Fix this by setting rx_tid->vaddr NULL in rx tid delete and also
+wherever freeing it to check in reo_cmd_list_cleanup() and
+reo_cmd_free() before trying to free again.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sathishkumar Muruganandam <quic_murugana@quicinc.com>
+Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230403182420.23375-2-quic_hprem@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 43 ++++++++++++++++++-------
+ 1 file changed, 31 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -668,13 +668,18 @@ void ath11k_dp_reo_cmd_list_cleanup(stru
+ 	struct ath11k_dp *dp = &ab->dp;
+ 	struct dp_reo_cmd *cmd, *tmp;
+ 	struct dp_reo_cache_flush_elem *cmd_cache, *tmp_cache;
++	struct dp_rx_tid *rx_tid;
+ 
+ 	spin_lock_bh(&dp->reo_cmd_lock);
+ 	list_for_each_entry_safe(cmd, tmp, &dp->reo_cmd_list, list) {
+ 		list_del(&cmd->list);
+-		dma_unmap_single(ab->dev, cmd->data.paddr,
+-				 cmd->data.size, DMA_BIDIRECTIONAL);
+-		kfree(cmd->data.vaddr);
++		rx_tid = &cmd->data;
++		if (rx_tid->vaddr) {
++			dma_unmap_single(ab->dev, rx_tid->paddr,
++					 rx_tid->size, DMA_BIDIRECTIONAL);
++			kfree(rx_tid->vaddr);
++			rx_tid->vaddr = NULL;
++		}
+ 		kfree(cmd);
+ 	}
+ 
+@@ -682,9 +687,13 @@ void ath11k_dp_reo_cmd_list_cleanup(stru
+ 				 &dp->reo_cmd_cache_flush_list, list) {
+ 		list_del(&cmd_cache->list);
+ 		dp->reo_cmd_cache_flush_count--;
+-		dma_unmap_single(ab->dev, cmd_cache->data.paddr,
+-				 cmd_cache->data.size, DMA_BIDIRECTIONAL);
+-		kfree(cmd_cache->data.vaddr);
++		rx_tid = &cmd_cache->data;
++		if (rx_tid->vaddr) {
++			dma_unmap_single(ab->dev, rx_tid->paddr,
++					 rx_tid->size, DMA_BIDIRECTIONAL);
++			kfree(rx_tid->vaddr);
++			rx_tid->vaddr = NULL;
++		}
+ 		kfree(cmd_cache);
+ 	}
+ 	spin_unlock_bh(&dp->reo_cmd_lock);
+@@ -698,10 +707,12 @@ static void ath11k_dp_reo_cmd_free(struc
+ 	if (status != HAL_REO_CMD_SUCCESS)
+ 		ath11k_warn(dp->ab, "failed to flush rx tid hw desc, tid %d status %d\n",
+ 			    rx_tid->tid, status);
+-
+-	dma_unmap_single(dp->ab->dev, rx_tid->paddr, rx_tid->size,
+-			 DMA_BIDIRECTIONAL);
+-	kfree(rx_tid->vaddr);
++	if (rx_tid->vaddr) {
++		dma_unmap_single(dp->ab->dev, rx_tid->paddr, rx_tid->size,
++				 DMA_BIDIRECTIONAL);
++		kfree(rx_tid->vaddr);
++		rx_tid->vaddr = NULL;
++	}
+ }
+ 
+ static void ath11k_dp_reo_cache_flush(struct ath11k_base *ab,
+@@ -740,6 +751,7 @@ static void ath11k_dp_reo_cache_flush(st
+ 		dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
+ 				 DMA_BIDIRECTIONAL);
+ 		kfree(rx_tid->vaddr);
++		rx_tid->vaddr = NULL;
+ 	}
+ }
+ 
+@@ -792,6 +804,7 @@ free_desc:
+ 	dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
+ 			 DMA_BIDIRECTIONAL);
+ 	kfree(rx_tid->vaddr);
++	rx_tid->vaddr = NULL;
+ }
+ 
+ void ath11k_peer_rx_tid_delete(struct ath11k *ar,
+@@ -804,6 +817,8 @@ void ath11k_peer_rx_tid_delete(struct at
+ 	if (!rx_tid->active)
+ 		return;
+ 
++	rx_tid->active = false;
++
+ 	cmd.flag = HAL_REO_CMD_FLG_NEED_STATUS;
+ 	cmd.addr_lo = lower_32_bits(rx_tid->paddr);
+ 	cmd.addr_hi = upper_32_bits(rx_tid->paddr);
+@@ -818,9 +833,11 @@ void ath11k_peer_rx_tid_delete(struct at
+ 		dma_unmap_single(ar->ab->dev, rx_tid->paddr, rx_tid->size,
+ 				 DMA_BIDIRECTIONAL);
+ 		kfree(rx_tid->vaddr);
++		rx_tid->vaddr = NULL;
+ 	}
+ 
+-	rx_tid->active = false;
++	rx_tid->paddr = 0;
++	rx_tid->size = 0;
+ }
+ 
+ static int ath11k_dp_rx_link_desc_return(struct ath11k_base *ab,
+@@ -967,6 +984,7 @@ static void ath11k_dp_rx_tid_mem_free(st
+ 	dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
+ 			 DMA_BIDIRECTIONAL);
+ 	kfree(rx_tid->vaddr);
++	rx_tid->vaddr = NULL;
+ 
+ 	rx_tid->active = false;
+ 
+@@ -1067,7 +1085,8 @@ int ath11k_peer_rx_tid_setup(struct ath1
+ 	return ret;
+ 
+ err_mem_free:
+-	kfree(vaddr);
++	kfree(rx_tid->vaddr);
++	rx_tid->vaddr = NULL;
+ 
+ 	return ret;
+ }
diff --git a/package/kernel/mac80211/patches/ath11k/0063-wifi-ath11k-Prevent-REO-cmd-failures.patch b/package/kernel/mac80211/patches/ath11k/0063-wifi-ath11k-Prevent-REO-cmd-failures.patch
new file mode 100644
index 000000000..4b9af1806
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0063-wifi-ath11k-Prevent-REO-cmd-failures.patch
@@ -0,0 +1,43 @@
+From a8ae833657a45746debde85c38bb7f070d344026 Mon Sep 17 00:00:00 2001
+From: Harshitha Prem <quic_hprem@quicinc.com>
+Date: Mon, 17 Apr 2023 13:35:01 +0300
+Subject: [PATCH] wifi: ath11k: Prevent REO cmd failures
+
+Prevent REO cmd failures causing double free by increasing REO cmd
+ring size and moving REO status ring mask to IRQ group 3 from group
+0 to separate from tx completion ring on IRQ group 0 which may delay
+reo status processing.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sathishkumar Muruganandam <quic_murugana@quicinc.com>
+Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230403182420.23375-3-quic_hprem@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp.h | 2 +-
+ drivers/net/wireless/ath/ath11k/hw.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -214,7 +214,7 @@ struct ath11k_pdev_dp {
+ #define DP_REO_REINJECT_RING_SIZE	32
+ #define DP_RX_RELEASE_RING_SIZE		1024
+ #define DP_REO_EXCEPTION_RING_SIZE	128
+-#define DP_REO_CMD_RING_SIZE		128
++#define DP_REO_CMD_RING_SIZE		256
+ #define DP_REO_STATUS_RING_SIZE		2048
+ #define DP_RXDMA_BUF_RING_SIZE		4096
+ #define DP_RXDMA_REFILL_RING_SIZE	2048
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -1233,6 +1233,7 @@ const struct ath11k_hw_ring_mask ath11k_
+ 		ATH11K_RX_WBM_REL_RING_MASK_0,
+ 	},
+ 	.reo_status = {
++		0, 0, 0,
+ 		ATH11K_REO_STATUS_RING_MASK_0,
+ 	},
+ 	.rxdma2host = {
diff --git a/package/kernel/mac80211/patches/ath11k/0064-wifi-ath11k-add-peer-mac-information-in-failure-case.patch b/package/kernel/mac80211/patches/ath11k/0064-wifi-ath11k-add-peer-mac-information-in-failure-case.patch
new file mode 100644
index 000000000..fbcbdfff7
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0064-wifi-ath11k-add-peer-mac-information-in-failure-case.patch
@@ -0,0 +1,74 @@
+From 20487cc3ff36bbfa9505f0a078ba98f09abfc717 Mon Sep 17 00:00:00 2001
+From: Harshitha Prem <quic_hprem@quicinc.com>
+Date: Mon, 17 Apr 2023 13:35:01 +0300
+Subject: [PATCH] wifi: ath11k: add peer mac information in failure cases
+
+During reo command failure, the peer mac detail for which the reo
+command was not successful is unknown. Hence, to improve the
+debuggability, add the peer mac information in the failure cases
+which would be useful during multi client cases.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sathishkumar Muruganandam <quic_murugana@quicinc.com>
+Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230403182420.23375-4-quic_hprem@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -1009,7 +1009,8 @@ int ath11k_peer_rx_tid_setup(struct ath1
+ 
+ 	peer = ath11k_peer_find(ab, vdev_id, peer_mac);
+ 	if (!peer) {
+-		ath11k_warn(ab, "failed to find the peer to set up rx tid\n");
++		ath11k_warn(ab, "failed to find the peer %pM to set up rx tid\n",
++			    peer_mac);
+ 		spin_unlock_bh(&ab->base_lock);
+ 		return -ENOENT;
+ 	}
+@@ -1022,7 +1023,8 @@ int ath11k_peer_rx_tid_setup(struct ath1
+ 						    ba_win_sz, ssn, true);
+ 		spin_unlock_bh(&ab->base_lock);
+ 		if (ret) {
+-			ath11k_warn(ab, "failed to update reo for rx tid %d\n", tid);
++			ath11k_warn(ab, "failed to update reo for peer %pM rx tid %d\n: %d",
++				    peer_mac, tid, ret);
+ 			return ret;
+ 		}
+ 
+@@ -1030,8 +1032,8 @@ int ath11k_peer_rx_tid_setup(struct ath1
+ 							     peer_mac, paddr,
+ 							     tid, 1, ba_win_sz);
+ 		if (ret)
+-			ath11k_warn(ab, "failed to send wmi command to update rx reorder queue, tid :%d (%d)\n",
+-				    tid, ret);
++			ath11k_warn(ab, "failed to send wmi rx reorder queue for peer %pM tid %d: %d\n",
++				    peer_mac, tid, ret);
+ 		return ret;
+ 	}
+ 
+@@ -1064,6 +1066,8 @@ int ath11k_peer_rx_tid_setup(struct ath1
+ 	ret = dma_mapping_error(ab->dev, paddr);
+ 	if (ret) {
+ 		spin_unlock_bh(&ab->base_lock);
++		ath11k_warn(ab, "failed to setup dma map for peer %pM rx tid %d: %d\n",
++			    peer_mac, tid, ret);
+ 		goto err_mem_free;
+ 	}
+ 
+@@ -1077,8 +1081,8 @@ int ath11k_peer_rx_tid_setup(struct ath1
+ 	ret = ath11k_wmi_peer_rx_reorder_queue_setup(ar, vdev_id, peer_mac,
+ 						     paddr, tid, 1, ba_win_sz);
+ 	if (ret) {
+-		ath11k_warn(ar->ab, "failed to setup rx reorder queue, tid :%d (%d)\n",
+-			    tid, ret);
++		ath11k_warn(ar->ab, "failed to setup rx reorder queue for peer %pM tid %d: %d\n",
++			    peer_mac, tid, ret);
+ 		ath11k_dp_rx_tid_mem_free(ab, peer_mac, vdev_id, tid);
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0065-wifi-ath11k-fix-tx-status-reporting-in-encap-offload.patch b/package/kernel/mac80211/patches/ath11k/0065-wifi-ath11k-fix-tx-status-reporting-in-encap-offload.patch
new file mode 100644
index 000000000..e2fe41915
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0065-wifi-ath11k-fix-tx-status-reporting-in-encap-offload.patch
@@ -0,0 +1,119 @@
+From 6257c702264c44d74c6b71f0c62a7665da2dc356 Mon Sep 17 00:00:00 2001
+From: Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
+Date: Mon, 17 Apr 2023 13:35:02 +0300
+Subject: [PATCH] wifi: ath11k: fix tx status reporting in encap offload mode
+
+ieee80211_tx_status() treats packets in 802.11 frame format and
+tries to extract sta address from packet header. When tx encap
+offload is enabled, this becomes invalid operation. Hence, switch
+to using ieee80211_tx_status_ext() after filling in station
+address for handling both 802.11 and 802.3 frames.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230403195738.25367-2-quic_pradeepc@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp.h    |  4 +++
+ drivers/net/wireless/ath/ath11k/dp_tx.c | 33 ++++++++++++++++++++++++-
+ drivers/net/wireless/ath/ath11k/dp_tx.h |  1 +
+ 3 files changed, 37 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -303,12 +303,16 @@ struct ath11k_dp {
+ 
+ #define HTT_TX_WBM_COMP_STATUS_OFFSET 8
+ 
++#define HTT_INVALID_PEER_ID	0xffff
++
+ /* HTT tx completion is overlaid in wbm_release_ring */
+ #define HTT_TX_WBM_COMP_INFO0_STATUS		GENMASK(12, 9)
+ #define HTT_TX_WBM_COMP_INFO0_REINJECT_REASON	GENMASK(16, 13)
+ #define HTT_TX_WBM_COMP_INFO0_REINJECT_REASON	GENMASK(16, 13)
+ 
+ #define HTT_TX_WBM_COMP_INFO1_ACK_RSSI		GENMASK(31, 24)
++#define HTT_TX_WBM_COMP_INFO2_SW_PEER_ID	GENMASK(15, 0)
++#define HTT_TX_WBM_COMP_INFO2_VALID		BIT(21)
+ 
+ struct htt_tx_wbm_completion {
+ 	u32 info0;
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -316,10 +316,12 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 				 struct dp_tx_ring *tx_ring,
+ 				 struct ath11k_dp_htt_wbm_tx_status *ts)
+ {
++	struct ieee80211_tx_status status = { 0 };
+ 	struct sk_buff *msdu;
+ 	struct ieee80211_tx_info *info;
+ 	struct ath11k_skb_cb *skb_cb;
+ 	struct ath11k *ar;
++	struct ath11k_peer *peer;
+ 
+ 	spin_lock(&tx_ring->tx_idr_lock);
+ 	msdu = idr_remove(&tx_ring->txbuf_idr, ts->msdu_id);
+@@ -341,6 +343,11 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 
+ 	dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
+ 
++	if (!skb_cb->vif) {
++		dev_kfree_skb_any(msdu);
++		return;
++	}
++
+ 	memset(&info->status, 0, sizeof(info->status));
+ 
+ 	if (ts->acked) {
+@@ -355,7 +362,23 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 		}
+ 	}
+ 
+-	ieee80211_tx_status(ar->hw, msdu);
++	spin_lock_bh(&ab->base_lock);
++	peer = ath11k_peer_find_by_id(ab, ts->peer_id);
++	if (!peer || !peer->sta) {
++		ath11k_dbg(ab, ATH11K_DBG_DATA,
++			   "dp_tx: failed to find the peer with peer_id %d\n",
++			    ts->peer_id);
++		spin_unlock_bh(&ab->base_lock);
++		dev_kfree_skb_any(msdu);
++		return;
++	}
++	spin_unlock_bh(&ab->base_lock);
++
++	status.sta = peer->sta;
++	status.info = info;
++	status.skb = msdu;
++
++	ieee80211_tx_status_ext(ar->hw, &status);
+ }
+ 
+ static void
+@@ -379,7 +402,15 @@ ath11k_dp_tx_process_htt_tx_complete(str
+ 		ts.msdu_id = msdu_id;
+ 		ts.ack_rssi = FIELD_GET(HTT_TX_WBM_COMP_INFO1_ACK_RSSI,
+ 					status_desc->info1);
++
++		if (FIELD_GET(HTT_TX_WBM_COMP_INFO2_VALID, status_desc->info2))
++			ts.peer_id = FIELD_GET(HTT_TX_WBM_COMP_INFO2_SW_PEER_ID,
++					       status_desc->info2);
++		else
++			ts.peer_id = HTT_INVALID_PEER_ID;
++
+ 		ath11k_dp_tx_htt_tx_complete_buf(ab, tx_ring, &ts);
++
+ 		break;
+ 	case HAL_WBM_REL_HTT_TX_COMP_STATUS_REINJ:
+ 	case HAL_WBM_REL_HTT_TX_COMP_STATUS_INSPECT:
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.h
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.h
+@@ -13,6 +13,7 @@ struct ath11k_dp_htt_wbm_tx_status {
+ 	u32 msdu_id;
+ 	bool acked;
+ 	int ack_rssi;
++	u16 peer_id;
+ };
+ 
+ void ath11k_dp_tx_update_txcompl(struct ath11k *ar, struct hal_tx_status *ts);
diff --git a/package/kernel/mac80211/patches/ath11k/0066-wifi-ath11k-Fix-incorrect-update-of-radiotap-fields.patch b/package/kernel/mac80211/patches/ath11k/0066-wifi-ath11k-Fix-incorrect-update-of-radiotap-fields.patch
new file mode 100644
index 000000000..4f9458010
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0066-wifi-ath11k-Fix-incorrect-update-of-radiotap-fields.patch
@@ -0,0 +1,49 @@
+From 2f0c9ac8362da09c80f1cd422ef7fd6fa9b252b9 Mon Sep 17 00:00:00 2001
+From: Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
+Date: Mon, 17 Apr 2023 13:35:02 +0300
+Subject: [PATCH] wifi: ath11k: Fix incorrect update of radiotap fields
+
+Fix incorrect update of ppdu stats causing incorrect radiotap
+fields.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230403195738.25367-3-quic_pradeepc@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/hal_rx.c | 4 ++--
+ drivers/net/wireless/ath/ath11k/hal_rx.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.c
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
+@@ -1029,7 +1029,7 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 		info1 = __le32_to_cpu(vht_sig->info1);
+ 
+ 		ppdu_info->ldpc = FIELD_GET(HAL_RX_VHT_SIG_A_INFO_INFO1_SU_MU_CODING,
+-					    info0);
++					    info1);
+ 		ppdu_info->mcs = FIELD_GET(HAL_RX_VHT_SIG_A_INFO_INFO1_MCS,
+ 					   info1);
+ 		gi_setting = FIELD_GET(HAL_RX_VHT_SIG_A_INFO_INFO1_GI_SETTING,
+@@ -1452,7 +1452,7 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 		 * PHYRX_OTHER_RECEIVE_INFO TLV.
+ 		 */
+ 		ppdu_info->rssi_comb =
+-			FIELD_GET(HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB,
++			FIELD_GET(HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RSSI_COMB,
+ 				  __le32_to_cpu(rssi->info0));
+ 
+ 		if (db2dbm) {
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.h
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
+@@ -385,7 +385,7 @@ struct hal_rx_he_sig_b2_ofdma_info {
+ 	__le32 info0;
+ } __packed;
+ 
+-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB	GENMASK(15, 8)
++#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RSSI_COMB	GENMASK(15, 8)
+ 
+ #define HAL_RX_PHYRX_RSSI_PREAMBLE_PRI20	GENMASK(7, 0)
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0067-wifi-ath11k-Fix-SKB-corruption-in-REO-destination-ri.patch b/package/kernel/mac80211/patches/ath11k/0067-wifi-ath11k-Fix-SKB-corruption-in-REO-destination-ri.patch
new file mode 100644
index 000000000..8b300f3a7
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0067-wifi-ath11k-Fix-SKB-corruption-in-REO-destination-ri.patch
@@ -0,0 +1,70 @@
+From f9fff67d2d7ca6fa8066132003a3deef654c55b1 Mon Sep 17 00:00:00 2001
+From: Nagarajan Maran <quic_nmaran@quicinc.com>
+Date: Mon, 17 Apr 2023 13:35:02 +0300
+Subject: [PATCH] wifi: ath11k: Fix SKB corruption in REO destination ring
+
+While running traffics for a long time, randomly an RX descriptor
+filled with value "0" from REO destination ring is received.
+This descriptor which is invalid causes the wrong SKB (SKB stored in
+the IDR lookup with buffer id "0") to be fetched which in turn
+causes SKB memory corruption issue and the same leads to crash
+after some time.
+
+Changed the start id for idr allocation to "1" and the buffer id "0"
+is reserved for error validation. Introduced Sanity check to validate
+the descriptor, before processing the SKB.
+
+Crash Signature :
+
+Unable to handle kernel paging request at virtual address 3f004900
+PC points to "b15_dma_inv_range+0x30/0x50"
+LR points to "dma_cache_maint_page+0x8c/0x128".
+The Backtrace obtained is as follows:
+[<8031716c>] (b15_dma_inv_range) from [<80313a4c>] (dma_cache_maint_page+0x8c/0x128)
+[<80313a4c>] (dma_cache_maint_page) from [<80313b90>] (__dma_page_dev_to_cpu+0x28/0xcc)
+[<80313b90>] (__dma_page_dev_to_cpu) from [<7fb5dd68>] (ath11k_dp_process_rx+0x1e8/0x4a4 [ath11k])
+[<7fb5dd68>] (ath11k_dp_process_rx [ath11k]) from [<7fb53c20>] (ath11k_dp_service_srng+0xb0/0x2ac [ath11k])
+[<7fb53c20>] (ath11k_dp_service_srng [ath11k]) from [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll+0x1c/0x78 [ath11k_pci])
+[<7f67bba4>] (ath11k_pci_ext_grp_napi_poll [ath11k_pci]) from [<807d5cf4>] (__napi_poll+0x28/0xb8)
+[<807d5cf4>] (__napi_poll) from [<807d5f28>] (net_rx_action+0xf0/0x280)
+[<807d5f28>] (net_rx_action) from [<80302148>] (__do_softirq+0xd0/0x280)
+[<80302148>] (__do_softirq) from [<80320408>] (irq_exit+0x74/0xd4)
+[<80320408>] (irq_exit) from [<803638a4>] (__handle_domain_irq+0x90/0xb4)
+[<803638a4>] (__handle_domain_irq) from [<805bedec>] (gic_handle_irq+0x58/0x90)
+[<805bedec>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c)
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230403191533.28114-1-quic_nmaran@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -389,10 +389,10 @@ int ath11k_dp_rxbufs_replenish(struct at
+ 			goto fail_free_skb;
+ 
+ 		spin_lock_bh(&rx_ring->idr_lock);
+-		buf_id = idr_alloc(&rx_ring->bufs_idr, skb, 0,
+-				   rx_ring->bufs_max * 3, GFP_ATOMIC);
++		buf_id = idr_alloc(&rx_ring->bufs_idr, skb, 1,
++				   (rx_ring->bufs_max * 3) + 1, GFP_ATOMIC);
+ 		spin_unlock_bh(&rx_ring->idr_lock);
+-		if (buf_id < 0)
++		if (buf_id <= 0)
+ 			goto fail_dma_unmap;
+ 
+ 		desc = ath11k_hal_srng_src_get_next_entry(ab, srng);
+@@ -2665,6 +2665,9 @@ try_again:
+ 				   cookie);
+ 		mac_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_PDEV_ID, cookie);
+ 
++		if (unlikely(buf_id == 0))
++			continue;
++
+ 		ar = ab->pdevs[mac_id].ar;
+ 		rx_ring = &ar->dp.rx_refill_buf_ring;
+ 		spin_lock_bh(&rx_ring->idr_lock);
diff --git a/package/kernel/mac80211/patches/ath11k/0068-wifi-ath11k-Remove-disabling-of-80-80-and-160-MHz.patch b/package/kernel/mac80211/patches/ath11k/0068-wifi-ath11k-Remove-disabling-of-80-80-and-160-MHz.patch
new file mode 100644
index 000000000..ce5ffd273
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0068-wifi-ath11k-Remove-disabling-of-80-80-and-160-MHz.patch
@@ -0,0 +1,49 @@
+From b100722a777f6455d913666a376f81342b2cb995 Mon Sep 17 00:00:00 2001
+From: Muna Sinada <quic_msinada@quicinc.com>
+Date: Mon, 17 Apr 2023 13:22:27 -0700
+Subject: [PATCH] wifi: ath11k: Remove disabling of 80+80 and 160 MHz
+
+This is a regression fix for 80+80 and 160 MHz support bits being
+cleared, therefore not adverised. Remove disable of 80+80 and 160 MHz
+capability flags and assign valid center frequency 2 similar to
+VHT80_80.
+
+Fixes: 38dfe775d0ab ("wifi: ath11k: push MU-MIMO params from hostapd to hardware")
+Reported-by: Robert Marko <robert.marko@sartura.hr>
+Tested-by: Robert Marko <robert.marko@sartura.hr> # IPQ8074 WLAN.HK.2.9.0.1-01385-QCAHKSWPL_SILICONZ-1
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217299
+Co-developed-by: P Praneesh <quic_ppranees@quicinc.com>
+Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/1681762947-13882-1-git-send-email-quic_msinada@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 4 ----
+ drivers/net/wireless/ath/ath11k/wmi.c | 3 ++-
+ 2 files changed, 2 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -5585,10 +5585,6 @@ static int ath11k_mac_copy_he_cap(struct
+ 
+ 		he_cap_elem->mac_cap_info[1] &=
+ 			IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_MASK;
+-		he_cap_elem->phy_cap_info[0] &=
+-			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
+-		he_cap_elem->phy_cap_info[0] &=
+-			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G;
+ 
+ 		he_cap_elem->phy_cap_info[5] &=
+ 			~IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK;
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -871,7 +871,8 @@ static void ath11k_wmi_put_wmi_channel(s
+ 
+ 		chan->band_center_freq2 = arg->channel.band_center_freq1;
+ 
+-	} else if (arg->channel.mode == MODE_11AC_VHT80_80) {
++	} else if ((arg->channel.mode == MODE_11AC_VHT80_80) ||
++		   (arg->channel.mode == MODE_11AX_HE80_80)) {
+ 		chan->band_center_freq2 = arg->channel.band_center_freq2;
+ 	} else {
+ 		chan->band_center_freq2 = 0;
diff --git a/package/kernel/mac80211/patches/ath11k/0069-wifi-ath11k-fix-registration-of-6Ghz-only-phy-withou.patch b/package/kernel/mac80211/patches/ath11k/0069-wifi-ath11k-fix-registration-of-6Ghz-only-phy-withou.patch
new file mode 100644
index 000000000..32468dbc4
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0069-wifi-ath11k-fix-registration-of-6Ghz-only-phy-withou.patch
@@ -0,0 +1,61 @@
+From e2ceb1de2f83aafd8003f0b72dfd4b7441e97d14 Mon Sep 17 00:00:00 2001
+From: Maxime Bizon <mbizon@freebox.fr>
+Date: Fri, 21 Apr 2023 16:54:45 +0200
+Subject: [PATCH] wifi: ath11k: fix registration of 6Ghz-only phy without the
+ full channel range
+
+Because of what seems to be a typo, a 6Ghz-only phy for which the BDF
+does not allow the 7115Mhz channel will fail to register:
+
+  WARNING: CPU: 2 PID: 106 at net/wireless/core.c:907 wiphy_register+0x914/0x954
+  Modules linked in: ath11k_pci sbsa_gwdt
+  CPU: 2 PID: 106 Comm: kworker/u8:5 Not tainted 6.3.0-rc7-next-20230418-00549-g1e096a17625a-dirty #9
+  Hardware name: Freebox V7R Board (DT)
+  Workqueue: ath11k_qmi_driver_event ath11k_qmi_driver_event_work
+  pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+  pc : wiphy_register+0x914/0x954
+  lr : ieee80211_register_hw+0x67c/0xc10
+  sp : ffffff800b123aa0
+  x29: ffffff800b123aa0 x28: 0000000000000000 x27: 0000000000000000
+  x26: 0000000000000000 x25: 0000000000000006 x24: ffffffc008d51418
+  x23: ffffffc008cb0838 x22: ffffff80176c2460 x21: 0000000000000168
+  x20: ffffff80176c0000 x19: ffffff80176c03e0 x18: 0000000000000014
+  x17: 00000000cbef338c x16: 00000000d2a26f21 x15: 00000000ad6bb85f
+  x14: 0000000000000020 x13: 0000000000000020 x12: 00000000ffffffbd
+  x11: 0000000000000208 x10: 00000000fffffdf7 x9 : ffffffc009394718
+  x8 : ffffff80176c0528 x7 : 000000007fffffff x6 : 0000000000000006
+  x5 : 0000000000000005 x4 : ffffff800b304284 x3 : ffffff800b304284
+  x2 : ffffff800b304d98 x1 : 0000000000000000 x0 : 0000000000000000
+  Call trace:
+   wiphy_register+0x914/0x954
+   ieee80211_register_hw+0x67c/0xc10
+   ath11k_mac_register+0x7c4/0xe10
+   ath11k_core_qmi_firmware_ready+0x1f4/0x570
+   ath11k_qmi_driver_event_work+0x198/0x590
+   process_one_work+0x1b8/0x328
+   worker_thread+0x6c/0x414
+   kthread+0x100/0x104
+   ret_from_fork+0x10/0x20
+  ---[ end trace 0000000000000000 ]---
+  ath11k_pci 0002:01:00.0: ieee80211 registration failed: -22
+  ath11k_pci 0002:01:00.0: failed register the radio with mac80211: -22
+  ath11k_pci 0002:01:00.0: failed to create pdev core: -22
+
+Signed-off-by: Maxime Bizon <mbizon@freebox.fr>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230421145445.2612280-1-mbizon@freebox.fr
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -8892,7 +8892,7 @@ static int ath11k_mac_setup_channels_rat
+ 	}
+ 
+ 	if (supported_bands & WMI_HOST_WLAN_5G_CAP) {
+-		if (reg_cap->high_5ghz_chan >= ATH11K_MAX_6G_FREQ) {
++		if (reg_cap->high_5ghz_chan >= ATH11K_MIN_6G_FREQ) {
+ 			channels = kmemdup(ath11k_6ghz_channels,
+ 					   sizeof(ath11k_6ghz_channels), GFP_KERNEL);
+ 			if (!channels) {
diff --git a/package/kernel/mac80211/patches/ath11k/0070-wifi-ath-work-around-false-positive-stringop-overrea.patch b/package/kernel/mac80211/patches/ath11k/0070-wifi-ath-work-around-false-positive-stringop-overrea.patch
new file mode 100644
index 000000000..aa4df16a9
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0070-wifi-ath-work-around-false-positive-stringop-overrea.patch
@@ -0,0 +1,84 @@
+From 695df2f417d25202bdac9cde3c82d2acb6492b4d Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 5 May 2023 16:11:25 +0300
+Subject: [PATCH] wifi: ath: work around false-positive stringop-overread
+ warning
+
+In a rare arm64 randconfig build, I got multiple warnings for ath11k
+and ath12k:
+
+In function 'ath11k_peer_assoc_h_ht',
+    inlined from 'ath11k_peer_assoc_prepare' at drivers/net/wireless/ath/ath11k/mac.c:2665:2:
+drivers/net/wireless/ath/ath11k/mac.c:1709:13: error: 'ath11k_peer_assoc_h_ht_masked' reading 10 bytes from a region of size 0 [-Werror=stringop-overread]
+ 1709 |         if (ath11k_peer_assoc_h_ht_masked(ht_mcs_mask))
+      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This happens whenever gcc-13 fails to inline one of the functions
+that take a fixed-length array argument but gets passed a pointer.
+
+Change these functions to all take a regular pointer argument
+instead.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230417205447.1800912-1-arnd@kernel.org
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -433,7 +433,7 @@ u8 ath11k_mac_bitrate_to_idx(const struc
+ }
+ 
+ static u32
+-ath11k_mac_max_ht_nss(const u8 ht_mcs_mask[IEEE80211_HT_MCS_MASK_LEN])
++ath11k_mac_max_ht_nss(const u8 *ht_mcs_mask)
+ {
+ 	int nss;
+ 
+@@ -445,7 +445,7 @@ ath11k_mac_max_ht_nss(const u8 ht_mcs_ma
+ }
+ 
+ static u32
+-ath11k_mac_max_vht_nss(const u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
++ath11k_mac_max_vht_nss(const u16 *vht_mcs_mask)
+ {
+ 	int nss;
+ 
+@@ -457,7 +457,7 @@ ath11k_mac_max_vht_nss(const u16 vht_mcs
+ }
+ 
+ static u32
+-ath11k_mac_max_he_nss(const u16 he_mcs_mask[NL80211_HE_NSS_MAX])
++ath11k_mac_max_he_nss(const u16 *he_mcs_mask)
+ {
+ 	int nss;
+ 
+@@ -1658,7 +1658,7 @@ static void ath11k_peer_assoc_h_rates(st
+ }
+ 
+ static bool
+-ath11k_peer_assoc_h_ht_masked(const u8 ht_mcs_mask[IEEE80211_HT_MCS_MASK_LEN])
++ath11k_peer_assoc_h_ht_masked(const u8 *ht_mcs_mask)
+ {
+ 	int nss;
+ 
+@@ -1670,7 +1670,7 @@ ath11k_peer_assoc_h_ht_masked(const u8 h
+ }
+ 
+ static bool
+-ath11k_peer_assoc_h_vht_masked(const u16 vht_mcs_mask[])
++ath11k_peer_assoc_h_vht_masked(const u16 *vht_mcs_mask)
+ {
+ 	int nss;
+ 
+@@ -2065,7 +2065,7 @@ static u16 ath11k_peer_assoc_h_he_limit(
+ }
+ 
+ static bool
+-ath11k_peer_assoc_h_he_masked(const u16 he_mcs_mask[NL80211_HE_NSS_MAX])
++ath11k_peer_assoc_h_he_masked(const u16 *he_mcs_mask)
+ {
+ 	int nss;
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0071-wifi-ath11k-driver-settings-for-MBSSID-and-EMA.patch b/package/kernel/mac80211/patches/ath11k/0071-wifi-ath11k-driver-settings-for-MBSSID-and-EMA.patch
new file mode 100644
index 000000000..bede4819c
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0071-wifi-ath11k-driver-settings-for-MBSSID-and-EMA.patch
@@ -0,0 +1,133 @@
+From a08dbb04d7365a04d52882143cf196005bfc88c3 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Fri, 5 May 2023 16:11:27 +0300
+Subject: [PATCH 71/77] wifi: ath11k: driver settings for MBSSID and EMA
+
+Advertise the driver support for multiple BSSID (MBSSID) and
+enhanced multi-BSSID advertisements (EMA) by setting extended
+capabilities.
+
+Configure mbssid_max_interfaces and ema_max_profile_periodicity
+fields in structure wiphy which are used to advertise maximum number
+of interfaces and profile periodicity supported by the driver.
+
+Add new WMI fields to configure maximum vdev count supported for
+MBSSID and profile periodicity in case of EMA.
+Setting WMI_RSRC_CFG_FLAG2_CALC_NEXT_DTIM_COUNT_SET flag
+indicates that the firmware should track and update the DTIM counts
+for each non-transmitted profile.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Co-developed-by: John Crispin <john@phrozen.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230405221648.17950-2-quic_alokad@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/hw.c  | 3 +++
+ drivers/net/wireless/ath/ath11k/hw.h  | 1 +
+ drivers/net/wireless/ath/ath11k/mac.c | 7 +++++++
+ drivers/net/wireless/ath/ath11k/wmi.c | 3 +++
+ drivers/net/wireless/ath/ath11k/wmi.h | 6 ++++++
+ 5 files changed, 20 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -202,6 +202,9 @@ static void ath11k_init_wmi_config_ipq80
+ 	config->twt_ap_sta_count = 1000;
+ 	config->flag1 |= WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64;
+ 	config->flag1 |= WMI_RSRC_CFG_FLAG1_ACK_RSSI;
++	config->ema_max_vap_cnt = ab->num_radios;
++	config->ema_max_profile_period = TARGET_EMA_MAX_PROFILE_PERIOD;
++	config->beacon_tx_offload_max_vdev += config->ema_max_vap_cnt;
+ }
+ 
+ static int ath11k_hw_mac_id_to_pdev_id_ipq8074(struct ath11k_hw_params *hw,
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -64,6 +64,7 @@
+ #define TARGET_NUM_WDS_ENTRIES		32
+ #define TARGET_DMA_BURST_SIZE		1
+ #define TARGET_RX_BATCHMODE		1
++#define TARGET_EMA_MAX_PROFILE_PERIOD	8
+ 
+ #define ATH11K_HW_MAX_QUEUES		4
+ #define ATH11K_QUEUE_LEN		4096
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -9001,19 +9001,23 @@ static int ath11k_mac_setup_iface_combin
+ 
+ static const u8 ath11k_if_types_ext_capa[] = {
+ 	[0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
++	[2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
+ 	[7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
+ };
+ 
+ static const u8 ath11k_if_types_ext_capa_sta[] = {
+ 	[0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
++	[2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
+ 	[7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
+ 	[9] = WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT,
+ };
+ 
+ static const u8 ath11k_if_types_ext_capa_ap[] = {
+ 	[0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
++	[2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
+ 	[7] = WLAN_EXT_CAPA8_OPMODE_NOTIF,
+ 	[9] = WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT,
++	[10] = WLAN_EXT_CAPA11_EMA_SUPPORT,
+ };
+ 
+ static const struct wiphy_iftype_ext_capab ath11k_iftypes_ext_capa[] = {
+@@ -9251,6 +9255,9 @@ static int __ath11k_mac_register(struct
+ 		wiphy_ext_feature_set(ar->hw->wiphy,
+ 				      NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
+ 
++	ar->hw->wiphy->mbssid_max_interfaces = TARGET_NUM_VDEVS(ab);
++	ar->hw->wiphy->ema_max_profile_periodicity = TARGET_EMA_MAX_PROFILE_PERIOD;
++
+ 	ath11k_reg_init(ar);
+ 
+ 	if (!test_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags)) {
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -3987,6 +3987,9 @@ ath11k_wmi_copy_resource_config(struct w
+ 		~(1 << WMI_CFG_HOST_SERVICE_FLAG_REG_CC_EXT);
+ 	wmi_cfg->host_service_flags |= (tg_cfg->is_reg_cc_ext_event_supported <<
+ 					WMI_CFG_HOST_SERVICE_FLAG_REG_CC_EXT);
++	wmi_cfg->flags2 = WMI_RSRC_CFG_FLAG2_CALC_NEXT_DTIM_COUNT_SET;
++	wmi_cfg->ema_max_vap_cnt = tg_cfg->ema_max_vap_cnt;
++	wmi_cfg->ema_max_profile_period = tg_cfg->ema_max_profile_period;
+ }
+ 
+ static int ath11k_init_cmd_send(struct ath11k_pdev_wmi *wmi,
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2317,6 +2317,7 @@ struct wmi_init_cmd {
+ } __packed;
+ 
+ #define WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64 BIT(5)
++#define WMI_RSRC_CFG_FLAG2_CALC_NEXT_DTIM_COUNT_SET BIT(9)
+ #define WMI_RSRC_CFG_FLAG1_ACK_RSSI BIT(18)
+ 
+ #define WMI_CFG_HOST_SERVICE_FLAG_REG_CC_EXT 4
+@@ -2389,6 +2390,9 @@ struct wmi_resource_config {
+ 	u32 msdu_flow_override_config1;
+ 	u32 flags2;
+ 	u32 host_service_flags;
++	u32 max_rnr_neighbours;
++	u32 ema_max_vap_cnt;
++	u32 ema_max_profile_period;
+ } __packed;
+ 
+ struct wmi_service_ready_event {
+@@ -5646,6 +5650,8 @@ struct target_resource_config {
+ 	u32 twt_ap_pdev_count;
+ 	u32 twt_ap_sta_count;
+ 	u8 is_reg_cc_ext_event_supported;
++	u32 ema_max_vap_cnt;
++	u32 ema_max_profile_period;
+ };
+ 
+ enum wmi_debug_log_param {
diff --git a/package/kernel/mac80211/patches/ath11k/0072-wifi-ath11k-MBSSID-configuration-during-vdev-create-.patch b/package/kernel/mac80211/patches/ath11k/0072-wifi-ath11k-MBSSID-configuration-during-vdev-create-.patch
new file mode 100644
index 000000000..4ba071731
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0072-wifi-ath11k-MBSSID-configuration-during-vdev-create-.patch
@@ -0,0 +1,215 @@
+From 5a81610acf66c4ad6e1a1fbd09f3f555fca863b1 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Fri, 5 May 2023 16:11:27 +0300
+Subject: [PATCH 72/77] wifi: ath11k: MBSSID configuration during vdev
+ create/start
+
+Configure multiple BSSID flags and index of the transmitting interface
+in vdev create/start commands depending on the service bit
+WMI_TLV_SERVICE_MBSS_PARAM_IN_VDEV_START_SUPPORT.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Co-developed-by: John Crispin <john@phrozen.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230405221648.17950-3-quic_alokad@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 70 +++++++++++++++++++++++++--
+ drivers/net/wireless/ath/ath11k/wmi.c |  5 ++
+ drivers/net/wireless/ath/ath11k/wmi.h | 19 ++++++++
+ 3 files changed, 90 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6181,17 +6181,62 @@ static void ath11k_mac_op_stop(struct ie
+ 	atomic_set(&ar->num_pending_mgmt_tx, 0);
+ }
+ 
+-static void
+-ath11k_mac_setup_vdev_create_params(struct ath11k_vif *arvif,
+-				    struct vdev_create_params *params)
++static int ath11k_mac_setup_vdev_params_mbssid(struct ath11k_vif *arvif,
++					       u32 *flags, u32 *tx_vdev_id)
++{
++	struct ath11k *ar = arvif->ar;
++	struct ath11k_vif *tx_arvif;
++	struct ieee80211_vif *tx_vif;
++
++	*tx_vdev_id = 0;
++	tx_vif = arvif->vif->mbssid_tx_vif;
++	if (!tx_vif) {
++		*flags = WMI_HOST_VDEV_FLAGS_NON_MBSSID_AP;
++		return 0;
++	}
++
++	tx_arvif = (void *)tx_vif->drv_priv;
++
++	if (arvif->vif->bss_conf.nontransmitted) {
++		if (ar->hw->wiphy != ieee80211_vif_to_wdev(tx_vif)->wiphy)
++			return -EINVAL;
++
++		*flags = WMI_HOST_VDEV_FLAGS_NON_TRANSMIT_AP;
++		*tx_vdev_id = ath11k_vif_to_arvif(tx_vif)->vdev_id;
++	} else if (tx_arvif == arvif) {
++		*flags = WMI_HOST_VDEV_FLAGS_TRANSMIT_AP;
++	} else {
++		return -EINVAL;
++	}
++
++	if (arvif->vif->bss_conf.ema_ap)
++		*flags |= WMI_HOST_VDEV_FLAGS_EMA_MODE;
++
++	return 0;
++}
++
++static int ath11k_mac_setup_vdev_create_params(struct ath11k_vif *arvif,
++					       struct vdev_create_params *params)
+ {
+ 	struct ath11k *ar = arvif->ar;
+ 	struct ath11k_pdev *pdev = ar->pdev;
++	int ret;
+ 
+ 	params->if_id = arvif->vdev_id;
+ 	params->type = arvif->vdev_type;
+ 	params->subtype = arvif->vdev_subtype;
+ 	params->pdev_id = pdev->pdev_id;
++	params->mbssid_flags = 0;
++	params->mbssid_tx_vdev_id = 0;
++
++	if (!test_bit(WMI_TLV_SERVICE_MBSS_PARAM_IN_VDEV_START_SUPPORT,
++		      ar->ab->wmi_ab.svc_map)) {
++		ret = ath11k_mac_setup_vdev_params_mbssid(arvif,
++							  &params->mbssid_flags,
++							  &params->mbssid_tx_vdev_id);
++		if (ret)
++			return ret;
++	}
+ 
+ 	if (pdev->cap.supported_bands & WMI_HOST_WLAN_2G_CAP) {
+ 		params->chains[NL80211_BAND_2GHZ].tx = ar->num_tx_chains;
+@@ -6206,6 +6251,7 @@ ath11k_mac_setup_vdev_create_params(stru
+ 		params->chains[NL80211_BAND_6GHZ].tx = ar->num_tx_chains;
+ 		params->chains[NL80211_BAND_6GHZ].rx = ar->num_rx_chains;
+ 	}
++	return 0;
+ }
+ 
+ static void ath11k_mac_op_update_vif_offload(struct ieee80211_hw *hw,
+@@ -6500,7 +6546,12 @@ static int ath11k_mac_op_add_interface(s
+ 	for (i = 0; i < ARRAY_SIZE(vif->hw_queue); i++)
+ 		vif->hw_queue[i] = i % (ATH11K_HW_MAX_QUEUES - 1);
+ 
+-	ath11k_mac_setup_vdev_create_params(arvif, &vdev_param);
++	ret = ath11k_mac_setup_vdev_create_params(arvif, &vdev_param);
++	if (ret) {
++		ath11k_warn(ab, "failed to create vdev parameters %d: %d\n",
++			    arvif->vdev_id, ret);
++		goto err;
++	}
+ 
+ 	ret = ath11k_wmi_vdev_create(ar, vif->addr, &vdev_param);
+ 	if (ret) {
+@@ -6905,6 +6956,17 @@ ath11k_mac_vdev_start_restart(struct ath
+ 	arg.pref_tx_streams = ar->num_tx_chains;
+ 	arg.pref_rx_streams = ar->num_rx_chains;
+ 
++	arg.mbssid_flags = 0;
++	arg.mbssid_tx_vdev_id = 0;
++	if (test_bit(WMI_TLV_SERVICE_MBSS_PARAM_IN_VDEV_START_SUPPORT,
++		     ar->ab->wmi_ab.svc_map)) {
++		ret = ath11k_mac_setup_vdev_params_mbssid(arvif,
++							  &arg.mbssid_flags,
++							  &arg.mbssid_tx_vdev_id);
++		if (ret)
++			return ret;
++	}
++
+ 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
+ 		arg.ssid = arvif->u.ap.ssid;
+ 		arg.ssid_len = arvif->u.ap.ssid_len;
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -724,6 +724,9 @@ int ath11k_wmi_vdev_create(struct ath11k
+ 	cmd->vdev_subtype = param->subtype;
+ 	cmd->num_cfg_txrx_streams = WMI_NUM_SUPPORTED_BAND_MAX;
+ 	cmd->pdev_id = param->pdev_id;
++	cmd->mbssid_flags = param->mbssid_flags;
++	cmd->mbssid_tx_vdev_id = param->mbssid_tx_vdev_id;
++
+ 	ether_addr_copy(cmd->vdev_macaddr.addr, macaddr);
+ 
+ 	ptr = skb->data + sizeof(*cmd);
+@@ -941,6 +944,8 @@ int ath11k_wmi_vdev_start(struct ath11k
+ 	cmd->cac_duration_ms = arg->cac_duration_ms;
+ 	cmd->regdomain = arg->regdomain;
+ 	cmd->he_ops = arg->he_ops;
++	cmd->mbssid_flags = arg->mbssid_flags;
++	cmd->mbssid_tx_vdev_id = arg->mbssid_tx_vdev_id;
+ 
+ 	if (!restart) {
+ 		if (arg->ssid) {
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -137,6 +137,14 @@ enum {
+ 	WMI_AUTORATE_3200NS_GI = BIT(11),
+ };
+ 
++enum {
++	WMI_HOST_VDEV_FLAGS_NON_MBSSID_AP       = 0x00000001,
++	WMI_HOST_VDEV_FLAGS_TRANSMIT_AP         = 0x00000002,
++	WMI_HOST_VDEV_FLAGS_NON_TRANSMIT_AP     = 0x00000004,
++	WMI_HOST_VDEV_FLAGS_EMA_MODE            = 0x00000008,
++	WMI_HOST_VDEV_FLAGS_SCAN_MODE_VAP       = 0x00000010,
++};
++
+ /*
+  * wmi command groups.
+  */
+@@ -2096,6 +2104,7 @@ enum wmi_tlv_service {
+ 	WMI_TLV_SERVICE_EXT2_MSG = 220,
+ 	WMI_TLV_SERVICE_PEER_POWER_SAVE_DURATION_SUPPORT = 246,
+ 	WMI_TLV_SERVICE_SRG_SRP_SPATIAL_REUSE_SUPPORT = 249,
++	WMI_TLV_SERVICE_MBSS_PARAM_IN_VDEV_START_SUPPORT = 253,
+ 	WMI_TLV_SERVICE_PASSIVE_SCAN_START_TIME_ENHANCE = 263,
+ 
+ 	/* The second 128 bits */
+@@ -2583,6 +2592,8 @@ struct vdev_create_params {
+ 		u8 rx;
+ 	} chains[NUM_NL80211_BANDS];
+ 	u32 pdev_id;
++	u32 mbssid_flags;
++	u32 mbssid_tx_vdev_id;
+ };
+ 
+ struct wmi_vdev_create_cmd {
+@@ -2593,6 +2604,8 @@ struct wmi_vdev_create_cmd {
+ 	struct wmi_mac_addr vdev_macaddr;
+ 	u32 num_cfg_txrx_streams;
+ 	u32 pdev_id;
++	u32 mbssid_flags;
++	u32 mbssid_tx_vdev_id;
+ } __packed;
+ 
+ struct wmi_vdev_txrx_streams {
+@@ -2656,6 +2669,9 @@ struct wmi_vdev_start_request_cmd {
+ 	u32 he_ops;
+ 	u32 cac_duration_ms;
+ 	u32 regdomain;
++	u32 min_data_rate;
++	u32 mbssid_flags;
++	u32 mbssid_tx_vdev_id;
+ } __packed;
+ 
+ #define MGMT_TX_DL_FRM_LEN		     64
+@@ -2825,6 +2841,9 @@ struct wmi_vdev_start_req_arg {
+ 	u32 pref_rx_streams;
+ 	u32 pref_tx_streams;
+ 	u32 num_noa_descriptors;
++	u32 min_data_rate;
++	u32 mbssid_flags;
++	u32 mbssid_tx_vdev_id;
+ };
+ 
+ struct peer_create_params {
diff --git a/package/kernel/mac80211/patches/ath11k/0073-wifi-ath11k-rename-MBSSID-fields-in-wmi_vdev_up_cmd.patch b/package/kernel/mac80211/patches/ath11k/0073-wifi-ath11k-rename-MBSSID-fields-in-wmi_vdev_up_cmd.patch
new file mode 100644
index 000000000..023a1dbb9
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0073-wifi-ath11k-rename-MBSSID-fields-in-wmi_vdev_up_cmd.patch
@@ -0,0 +1,52 @@
+From cf604e72bc6e6db68c7fcaa8779b03ec14b8d2fa Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Fri, 5 May 2023 16:11:27 +0300
+Subject: [PATCH 73/77] wifi: ath11k: rename MBSSID fields in wmi_vdev_up_cmd
+
+Rename trans_bssid to tx_vdev_bssid to make it similar to vdev_bssid.
+
+Rename profile_num to nontx_profile_cnt, and profile_idx to
+nontx_profile_idx which makes it clear that these store configurations
+related to MBSSID non-transmitting profiles.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230405221648.17950-4-quic_alokad@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 6 +++---
+ drivers/net/wireless/ath/ath11k/wmi.h | 6 +++---
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1029,10 +1029,10 @@ int ath11k_wmi_vdev_up(struct ath11k *ar
+ 		bss_conf = &arvif->vif->bss_conf;
+ 
+ 		if (bss_conf->nontransmitted) {
+-			ether_addr_copy(cmd->trans_bssid.addr,
++			ether_addr_copy(cmd->tx_vdev_bssid.addr,
+ 					bss_conf->transmitter_bssid);
+-			cmd->profile_idx = bss_conf->bssid_index;
+-			cmd->profile_num = bss_conf->bssid_indicator;
++			cmd->nontx_profile_idx = bss_conf->bssid_index;
++			cmd->nontx_profile_cnt = bss_conf->bssid_indicator;
+ 		}
+ 	}
+ 
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2625,9 +2625,9 @@ struct wmi_vdev_up_cmd {
+ 	u32 vdev_id;
+ 	u32 vdev_assoc_id;
+ 	struct wmi_mac_addr vdev_bssid;
+-	struct wmi_mac_addr trans_bssid;
+-	u32 profile_idx;
+-	u32 profile_num;
++	struct wmi_mac_addr tx_vdev_bssid;
++	u32 nontx_profile_idx;
++	u32 nontx_profile_cnt;
+ } __packed;
+ 
+ struct wmi_vdev_stop_cmd {
diff --git a/package/kernel/mac80211/patches/ath11k/0074-wifi-ath11k-MBSSID-parameter-configuration-in-AP-mod.patch b/package/kernel/mac80211/patches/ath11k/0074-wifi-ath11k-MBSSID-parameter-configuration-in-AP-mod.patch
new file mode 100644
index 000000000..d93e27dd4
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0074-wifi-ath11k-MBSSID-parameter-configuration-in-AP-mod.patch
@@ -0,0 +1,138 @@
+From c82dc33f252fd8883be66f2d0230af0fd734c683 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Fri, 5 May 2023 16:11:27 +0300
+Subject: [PATCH 74/77] wifi: ath11k: MBSSID parameter configuration in AP mode
+
+Include MBSSID parameters in WMI vdev up operation.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Co-developed-by: John Crispin <john@phrozen.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230405221648.17950-5-quic_alokad@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 29 +++++++++++++++++++++------
+ drivers/net/wireless/ath/ath11k/wmi.c |  8 +++++++-
+ drivers/net/wireless/ath/ath11k/wmi.h |  3 ++-
+ 3 files changed, 32 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -964,7 +964,7 @@ static int ath11k_mac_monitor_vdev_start
+ 		return ret;
+ 	}
+ 
+-	ret = ath11k_wmi_vdev_up(ar, vdev_id, 0, ar->mac_addr);
++	ret = ath11k_wmi_vdev_up(ar, vdev_id, 0, ar->mac_addr, NULL, 0, 0);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to put up monitor vdev %i: %d\n",
+ 			    vdev_id, ret);
+@@ -1423,6 +1423,7 @@ static void ath11k_control_beaconing(str
+ 				     struct ieee80211_bss_conf *info)
+ {
+ 	struct ath11k *ar = arvif->ar;
++	struct ath11k_vif *tx_arvif = NULL;
+ 	int ret = 0;
+ 
+ 	lockdep_assert_held(&arvif->ar->conf_mutex);
+@@ -1451,8 +1452,14 @@ static void ath11k_control_beaconing(str
+ 
+ 	ether_addr_copy(arvif->bssid, info->bssid);
+ 
++	if (arvif->vif->mbssid_tx_vif)
++		tx_arvif = (struct ath11k_vif *)arvif->vif->mbssid_tx_vif->drv_priv;
++
+ 	ret = ath11k_wmi_vdev_up(arvif->ar, arvif->vdev_id, arvif->aid,
+-				 arvif->bssid);
++				 arvif->bssid,
++				 tx_arvif ? tx_arvif->bssid : NULL,
++				 info->bssid_index,
++				 1 << info->bssid_indicator);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to bring up vdev %d: %i\n",
+ 			    arvif->vdev_id, ret);
+@@ -2879,7 +2886,8 @@ static void ath11k_bss_assoc(struct ieee
+ 	arvif->aid = vif->cfg.aid;
+ 	ether_addr_copy(arvif->bssid, bss_conf->bssid);
+ 
+-	ret = ath11k_wmi_vdev_up(ar, arvif->vdev_id, arvif->aid, arvif->bssid);
++	ret = ath11k_wmi_vdev_up(ar, arvif->vdev_id, arvif->aid, arvif->bssid,
++				 NULL, 0, 0);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to set vdev %d up: %d\n",
+ 			    arvif->vdev_id, ret);
+@@ -7133,7 +7141,8 @@ ath11k_mac_update_vif_chan(struct ath11k
+ 			   int n_vifs)
+ {
+ 	struct ath11k_base *ab = ar->ab;
+-	struct ath11k_vif *arvif;
++	struct ath11k_vif *arvif, *tx_arvif = NULL;
++	struct ieee80211_vif *mbssid_tx_vif;
+ 	int ret;
+ 	int i;
+ 	bool monitor_vif = false;
+@@ -7187,8 +7196,15 @@ ath11k_mac_update_vif_chan(struct ath11k
+ 			ath11k_warn(ab, "failed to update bcn tmpl during csa: %d\n",
+ 				    ret);
+ 
++		mbssid_tx_vif = arvif->vif->mbssid_tx_vif;
++		if (mbssid_tx_vif)
++			tx_arvif = (struct ath11k_vif *)mbssid_tx_vif->drv_priv;
++
+ 		ret = ath11k_wmi_vdev_up(arvif->ar, arvif->vdev_id, arvif->aid,
+-					 arvif->bssid);
++					 arvif->bssid,
++					 tx_arvif ? tx_arvif->bssid : NULL,
++					 arvif->vif->bss_conf.bssid_index,
++					 1 << arvif->vif->bss_conf.bssid_indicator);
+ 		if (ret) {
+ 			ath11k_warn(ab, "failed to bring vdev up %d: %d\n",
+ 				    arvif->vdev_id, ret);
+@@ -7306,7 +7322,8 @@ static int ath11k_start_vdev_delay(struc
+ 	}
+ 
+ 	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
+-		ret = ath11k_wmi_vdev_up(ar, arvif->vdev_id, 0, ar->mac_addr);
++		ret = ath11k_wmi_vdev_up(ar, arvif->vdev_id, 0, ar->mac_addr,
++					 NULL, 0, 0);
+ 		if (ret) {
+ 			ath11k_warn(ab, "failed put monitor up: %d\n", ret);
+ 			return ret;
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1001,7 +1001,8 @@ int ath11k_wmi_vdev_start(struct ath11k
+ 	return ret;
+ }
+ 
+-int ath11k_wmi_vdev_up(struct ath11k *ar, u32 vdev_id, u32 aid, const u8 *bssid)
++int ath11k_wmi_vdev_up(struct ath11k *ar, u32 vdev_id, u32 aid, const u8 *bssid,
++		       u8 *tx_bssid, u32 nontx_profile_idx, u32 nontx_profile_cnt)
+ {
+ 	struct ath11k_pdev_wmi *wmi = ar->wmi;
+ 	struct wmi_vdev_up_cmd *cmd;
+@@ -1025,6 +1026,11 @@ int ath11k_wmi_vdev_up(struct ath11k *ar
+ 
+ 	ether_addr_copy(cmd->vdev_bssid.addr, bssid);
+ 
++	cmd->nontx_profile_idx = nontx_profile_idx;
++	cmd->nontx_profile_cnt = nontx_profile_cnt;
++	if (tx_bssid)
++		ether_addr_copy(cmd->tx_vdev_bssid.addr, tx_bssid);
++
+ 	if (arvif && arvif->vif->type == NL80211_IFTYPE_STATION) {
+ 		bss_conf = &arvif->vif->bss_conf;
+ 
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -6301,7 +6301,8 @@ int ath11k_wmi_bcn_tmpl(struct ath11k *a
+ 			struct sk_buff *bcn);
+ int ath11k_wmi_vdev_down(struct ath11k *ar, u8 vdev_id);
+ int ath11k_wmi_vdev_up(struct ath11k *ar, u32 vdev_id, u32 aid,
+-		       const u8 *bssid);
++		       const u8 *bssid, u8 *tx_bssid, u32 nontx_profile_idx,
++		       u32 nontx_profile_cnt);
+ int ath11k_wmi_vdev_stop(struct ath11k *ar, u8 vdev_id);
+ int ath11k_wmi_vdev_start(struct ath11k *ar, struct wmi_vdev_start_req_arg *arg,
+ 			  bool restart);
diff --git a/package/kernel/mac80211/patches/ath11k/0075-wifi-ath11k-refactor-vif-parameter-configurations.patch b/package/kernel/mac80211/patches/ath11k/0075-wifi-ath11k-refactor-vif-parameter-configurations.patch
new file mode 100644
index 000000000..8509e5597
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0075-wifi-ath11k-refactor-vif-parameter-configurations.patch
@@ -0,0 +1,86 @@
+From cb9bea773c85e372931cd7a177db4165adf29d95 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Fri, 5 May 2023 16:11:28 +0300
+Subject: [PATCH 75/77] wifi: ath11k: refactor vif parameter configurations
+
+Security parameters for each non-transmitting profile can be
+different when MBSSID is enabled and this information is included
+in the MBSSID element in the Beacon frame. Current implementation
+to set rsnie_present and wpaie_present does not parse this element
+hence it applies only to the transmitting interface.
+
+Move the code to a separate function to make additions for
+non-transmitting interfaces cleaner.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230405221648.17950-6-quic_alokad@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 41 ++++++++++++++++-----------
+ 1 file changed, 24 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -1351,28 +1351,14 @@ err_mon_del:
+ 	return ret;
+ }
+ 
+-static int ath11k_mac_setup_bcn_tmpl(struct ath11k_vif *arvif)
++static void ath11k_mac_set_vif_params(struct ath11k_vif *arvif,
++				      struct sk_buff *bcn)
+ {
+-	struct ath11k *ar = arvif->ar;
+-	struct ath11k_base *ab = ar->ab;
+-	struct ieee80211_hw *hw = ar->hw;
+-	struct ieee80211_vif *vif = arvif->vif;
+-	struct ieee80211_mutable_offsets offs = {};
+-	struct sk_buff *bcn;
+ 	struct ieee80211_mgmt *mgmt;
+ 	u8 *ies;
+-	int ret;
+-
+-	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
+-		return 0;
+-
+-	bcn = ieee80211_beacon_get_template(hw, vif, &offs, 0);
+-	if (!bcn) {
+-		ath11k_warn(ab, "failed to get beacon template from mac80211\n");
+-		return -EPERM;
+-	}
+ 
+ 	ies = bcn->data + ieee80211_get_hdrlen_from_skb(bcn);
++	mgmt = (struct ieee80211_mgmt *)bcn->data;
+ 	ies += sizeof(mgmt->u.beacon);
+ 
+ 	if (cfg80211_find_ie(WLAN_EID_RSN, ies, (skb_tail_pointer(bcn) - ies)))
+@@ -1386,7 +1372,28 @@ static int ath11k_mac_setup_bcn_tmpl(str
+ 		arvif->wpaie_present = true;
+ 	else
+ 		arvif->wpaie_present = false;
++}
++
++static int ath11k_mac_setup_bcn_tmpl(struct ath11k_vif *arvif)
++{
++	struct ath11k *ar = arvif->ar;
++	struct ath11k_base *ab = ar->ab;
++	struct ieee80211_hw *hw = ar->hw;
++	struct ieee80211_vif *vif = arvif->vif;
++	struct ieee80211_mutable_offsets offs = {};
++	struct sk_buff *bcn;
++	int ret;
++
++	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
++		return 0;
++
++	bcn = ieee80211_beacon_get_template(hw, vif, &offs, 0);
++	if (!bcn) {
++		ath11k_warn(ab, "failed to get beacon template from mac80211\n");
++		return -EPERM;
++	}
+ 
++	ath11k_mac_set_vif_params(arvif, bcn);
+ 	ret = ath11k_wmi_bcn_tmpl(ar, arvif->vdev_id, &offs, bcn);
+ 
+ 	kfree_skb(bcn);
diff --git a/package/kernel/mac80211/patches/ath11k/0076-wifi-ath11k-MBSSID-beacon-support.patch b/package/kernel/mac80211/patches/ath11k/0076-wifi-ath11k-MBSSID-beacon-support.patch
new file mode 100644
index 000000000..d23ea8dee
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0076-wifi-ath11k-MBSSID-beacon-support.patch
@@ -0,0 +1,190 @@
+From 335a92765d308dfe22826f5562cd4b4389b45e71 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Fri, 5 May 2023 16:11:28 +0300
+Subject: [PATCH 76/77] wifi: ath11k: MBSSID beacon support
+
+- Split ath11k_mac_setup_bcn_tmpl() to move the beacon retrieval and
+  WMI command to a new function, ath11k_mac_setup_bcn_tmpl_legacy().
+  In the original function add checks to use the transmitting interface
+  when MBSSID is enabled.
+- Set rsnie_present and wpaie_present fields for the non-transmitting
+  interfaces when MBSSID is enabled.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Co-developed-by: John Crispin <john@phrozen.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230405221648.17950-7-quic_alokad@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 116 ++++++++++++++++++++++++--
+ drivers/net/wireless/ath/ath11k/wmi.c |   1 +
+ 2 files changed, 112 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -1351,6 +1351,84 @@ err_mon_del:
+ 	return ret;
+ }
+ 
++static void ath11k_mac_setup_nontx_vif_rsnie(struct ath11k_vif *arvif,
++					     bool tx_arvif_rsnie_present,
++					     const u8 *profile, u8 profile_len)
++{
++	if (cfg80211_find_ie(WLAN_EID_RSN, profile, profile_len)) {
++		arvif->rsnie_present = true;
++	} else if (tx_arvif_rsnie_present) {
++		int i;
++		u8 nie_len;
++		const u8 *nie = cfg80211_find_ext_ie(WLAN_EID_EXT_NON_INHERITANCE,
++						     profile, profile_len);
++		if (!nie)
++			return;
++
++		nie_len = nie[1];
++		nie += 2;
++		for (i = 0; i < nie_len; i++) {
++			if (nie[i] == WLAN_EID_RSN) {
++				arvif->rsnie_present = false;
++				break;
++			}
++		}
++	}
++}
++
++static bool ath11k_mac_set_nontx_vif_params(struct ath11k_vif *tx_arvif,
++					    struct ath11k_vif *arvif,
++					    struct sk_buff *bcn)
++{
++	struct ieee80211_mgmt *mgmt;
++	const u8 *ies, *profile, *next_profile;
++	int ies_len;
++
++	ies = bcn->data + ieee80211_get_hdrlen_from_skb(bcn);
++	mgmt = (struct ieee80211_mgmt *)bcn->data;
++	ies += sizeof(mgmt->u.beacon);
++	ies_len = skb_tail_pointer(bcn) - ies;
++
++	ies = cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ies, ies_len);
++	arvif->rsnie_present = tx_arvif->rsnie_present;
++
++	while (ies) {
++		u8 mbssid_len;
++
++		ies_len -= (2 + ies[1]);
++		mbssid_len = ies[1] - 1;
++		profile = &ies[3];
++
++		while (mbssid_len) {
++			u8 profile_len;
++
++			profile_len = profile[1];
++			next_profile = profile + (2 + profile_len);
++			mbssid_len -= (2 + profile_len);
++
++			profile += 2;
++			profile_len -= (2 + profile[1]);
++			profile += (2 + profile[1]); /* nontx capabilities */
++			profile_len -= (2 + profile[1]);
++			profile += (2 + profile[1]); /* SSID */
++			if (profile[2] == arvif->vif->bss_conf.bssid_index) {
++				profile_len -= 5;
++				profile = profile + 5;
++				ath11k_mac_setup_nontx_vif_rsnie(arvif,
++								 tx_arvif->rsnie_present,
++								 profile,
++								 profile_len);
++				return true;
++			}
++			profile = next_profile;
++		}
++		ies = cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, profile,
++				       ies_len);
++	}
++
++	return false;
++}
++
+ static void ath11k_mac_set_vif_params(struct ath11k_vif *arvif,
+ 				      struct sk_buff *bcn)
+ {
+@@ -1374,18 +1452,26 @@ static void ath11k_mac_set_vif_params(st
+ 		arvif->wpaie_present = false;
+ }
+ 
+-static int ath11k_mac_setup_bcn_tmpl(struct ath11k_vif *arvif)
++static int ath11k_mac_setup_bcn_tmpl_mbssid(struct ath11k_vif *arvif)
+ {
+ 	struct ath11k *ar = arvif->ar;
+ 	struct ath11k_base *ab = ar->ab;
++	struct ath11k_vif *tx_arvif = arvif;
+ 	struct ieee80211_hw *hw = ar->hw;
+ 	struct ieee80211_vif *vif = arvif->vif;
+ 	struct ieee80211_mutable_offsets offs = {};
+ 	struct sk_buff *bcn;
+ 	int ret;
+ 
+-	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
+-		return 0;
++	if (arvif->vif->mbssid_tx_vif) {
++		tx_arvif = (void *)arvif->vif->mbssid_tx_vif->drv_priv;
++		if (tx_arvif != arvif) {
++			ar = tx_arvif->ar;
++			ab = ar->ab;
++			hw = ar->hw;
++			vif = tx_arvif->vif;
++		}
++	}
+ 
+ 	bcn = ieee80211_beacon_get_template(hw, vif, &offs, 0);
+ 	if (!bcn) {
+@@ -1393,9 +1479,12 @@ static int ath11k_mac_setup_bcn_tmpl(str
+ 		return -EPERM;
+ 	}
+ 
+-	ath11k_mac_set_vif_params(arvif, bcn);
+-	ret = ath11k_wmi_bcn_tmpl(ar, arvif->vdev_id, &offs, bcn);
++	if (tx_arvif == arvif)
++		ath11k_mac_set_vif_params(tx_arvif, bcn);
++	else if (!ath11k_mac_set_nontx_vif_params(tx_arvif, arvif, bcn))
++		return -EINVAL;
+ 
++	ret = ath11k_wmi_bcn_tmpl(ar, arvif->vdev_id, &offs, bcn);
+ 	kfree_skb(bcn);
+ 
+ 	if (ret)
+@@ -1405,6 +1494,23 @@ static int ath11k_mac_setup_bcn_tmpl(str
+ 	return ret;
+ }
+ 
++static int ath11k_mac_setup_bcn_tmpl(struct ath11k_vif *arvif)
++{
++	struct ieee80211_vif *vif = arvif->vif;
++
++	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
++		return 0;
++
++	/* Target does not expect beacon templates for the already up
++	 * non-transmitting interfaces, and results in a crash if sent.
++	 */
++	if (vif->mbssid_tx_vif &&
++	    arvif != (void *)vif->mbssid_tx_vif->drv_priv && arvif->is_up)
++		return 0;
++
++	return ath11k_mac_setup_bcn_tmpl_mbssid(arvif);
++}
++
+ void ath11k_mac_bcn_tx_event(struct ath11k_vif *arvif)
+ {
+ 	struct ieee80211_vif *vif = arvif->vif;
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1737,6 +1737,7 @@ int ath11k_wmi_bcn_tmpl(struct ath11k *a
+ 	}
+ 
+ 	cmd->buf_len = bcn->len;
++	cmd->mbssid_ie_offset = offs->mbssid_off;
+ 
+ 	ptr = skb->data + sizeof(*cmd);
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0077-wifi-ath11k-EMA-beacon-support.patch b/package/kernel/mac80211/patches/ath11k/0077-wifi-ath11k-EMA-beacon-support.patch
new file mode 100644
index 000000000..51353fa3e
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0077-wifi-ath11k-EMA-beacon-support.patch
@@ -0,0 +1,156 @@
+From 87bd401138161008fdb82fbca6e213af117bfeb9 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Fri, 5 May 2023 16:11:28 +0300
+Subject: [PATCH 77/77] wifi: ath11k: EMA beacon support
+
+Add new function ath11k_mac_setup_bcn_tmpl_ema() which invokes the new
+API provided by MAC80211 to retrieve EMA beacons.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Co-developed-by: John Crispin <john@phrozen.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230405221648.17950-8-quic_alokad@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 59 ++++++++++++++++++++++++++-
+ drivers/net/wireless/ath/ath11k/wmi.c |  3 +-
+ drivers/net/wireless/ath/ath11k/wmi.h | 11 ++++-
+ 3 files changed, 70 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -1452,6 +1452,60 @@ static void ath11k_mac_set_vif_params(st
+ 		arvif->wpaie_present = false;
+ }
+ 
++static int ath11k_mac_setup_bcn_tmpl_ema(struct ath11k_vif *arvif)
++{
++	struct ath11k_vif *tx_arvif;
++	struct ieee80211_ema_beacons *beacons;
++	int ret = 0;
++	bool nontx_vif_params_set = false;
++	u32 params = 0;
++	u8 i = 0;
++
++	tx_arvif = (void *)arvif->vif->mbssid_tx_vif->drv_priv;
++
++	beacons = ieee80211_beacon_get_template_ema_list(tx_arvif->ar->hw,
++							 tx_arvif->vif, 0);
++	if (!beacons || !beacons->cnt) {
++		ath11k_warn(arvif->ar->ab,
++			    "failed to get ema beacon templates from mac80211\n");
++		return -EPERM;
++	}
++
++	if (tx_arvif == arvif)
++		ath11k_mac_set_vif_params(tx_arvif, beacons->bcn[0].skb);
++	else
++		arvif->wpaie_present = tx_arvif->wpaie_present;
++
++	for (i = 0; i < beacons->cnt; i++) {
++		if (tx_arvif != arvif && !nontx_vif_params_set)
++			nontx_vif_params_set =
++				ath11k_mac_set_nontx_vif_params(tx_arvif, arvif,
++								beacons->bcn[i].skb);
++
++		params = beacons->cnt;
++		params |= (i << WMI_EMA_TMPL_IDX_SHIFT);
++		params |= ((!i ? 1 : 0) << WMI_EMA_FIRST_TMPL_SHIFT);
++		params |= ((i + 1 == beacons->cnt ? 1 : 0) << WMI_EMA_LAST_TMPL_SHIFT);
++
++		ret = ath11k_wmi_bcn_tmpl(tx_arvif->ar, tx_arvif->vdev_id,
++					  &beacons->bcn[i].offs,
++					  beacons->bcn[i].skb, params);
++		if (ret) {
++			ath11k_warn(tx_arvif->ar->ab,
++				    "failed to set ema beacon template id %i error %d\n",
++				    i, ret);
++			break;
++		}
++	}
++
++	ieee80211_beacon_free_ema_list(beacons);
++
++	if (tx_arvif != arvif && !nontx_vif_params_set)
++		return -EINVAL; /* Profile not found in the beacons */
++
++	return ret;
++}
++
+ static int ath11k_mac_setup_bcn_tmpl_mbssid(struct ath11k_vif *arvif)
+ {
+ 	struct ath11k *ar = arvif->ar;
+@@ -1484,7 +1538,7 @@ static int ath11k_mac_setup_bcn_tmpl_mbs
+ 	else if (!ath11k_mac_set_nontx_vif_params(tx_arvif, arvif, bcn))
+ 		return -EINVAL;
+ 
+-	ret = ath11k_wmi_bcn_tmpl(ar, arvif->vdev_id, &offs, bcn);
++	ret = ath11k_wmi_bcn_tmpl(ar, arvif->vdev_id, &offs, bcn, 0);
+ 	kfree_skb(bcn);
+ 
+ 	if (ret)
+@@ -1508,6 +1562,9 @@ static int ath11k_mac_setup_bcn_tmpl(str
+ 	    arvif != (void *)vif->mbssid_tx_vif->drv_priv && arvif->is_up)
+ 		return 0;
+ 
++	if (vif->bss_conf.ema_ap && vif->mbssid_tx_vif)
++		return ath11k_mac_setup_bcn_tmpl_ema(arvif);
++
+ 	return ath11k_mac_setup_bcn_tmpl_mbssid(arvif);
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1699,7 +1699,7 @@ int ath11k_wmi_send_bcn_offload_control_
+ 
+ int ath11k_wmi_bcn_tmpl(struct ath11k *ar, u32 vdev_id,
+ 			struct ieee80211_mutable_offsets *offs,
+-			struct sk_buff *bcn)
++			struct sk_buff *bcn, u32 ema_params)
+ {
+ 	struct ath11k_pdev_wmi *wmi = ar->wmi;
+ 	struct wmi_bcn_tmpl_cmd *cmd;
+@@ -1738,6 +1738,7 @@ int ath11k_wmi_bcn_tmpl(struct ath11k *a
+ 
+ 	cmd->buf_len = bcn->len;
+ 	cmd->mbssid_ie_offset = offs->mbssid_off;
++	cmd->ema_params = ema_params;
+ 
+ 	ptr = skb->data + sizeof(*cmd);
+ 
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -3566,6 +3566,10 @@ struct wmi_get_pdev_temperature_cmd {
+ 
+ #define WMI_BEACON_TX_BUFFER_SIZE	512
+ 
++#define WMI_EMA_TMPL_IDX_SHIFT            8
++#define WMI_EMA_FIRST_TMPL_SHIFT          16
++#define WMI_EMA_LAST_TMPL_SHIFT           24
++
+ struct wmi_bcn_tmpl_cmd {
+ 	u32 tlv_header;
+ 	u32 vdev_id;
+@@ -3576,6 +3580,11 @@ struct wmi_bcn_tmpl_cmd {
+ 	u32 csa_event_bitmap;
+ 	u32 mbssid_ie_offset;
+ 	u32 esp_ie_offset;
++	u32 csc_switch_count_offset;
++	u32 csc_event_bitmap;
++	u32 mu_edca_ie_offset;
++	u32 feature_enable_bitmap;
++	u32 ema_params;
+ } __packed;
+ 
+ struct wmi_key_seq_counter {
+@@ -6298,7 +6307,7 @@ int ath11k_wmi_mgmt_send(struct ath11k *
+ 			 struct sk_buff *frame);
+ int ath11k_wmi_bcn_tmpl(struct ath11k *ar, u32 vdev_id,
+ 			struct ieee80211_mutable_offsets *offs,
+-			struct sk_buff *bcn);
++			struct sk_buff *bcn, u32 ema_param);
+ int ath11k_wmi_vdev_down(struct ath11k *ar, u8 vdev_id);
+ int ath11k_wmi_vdev_up(struct ath11k *ar, u32 vdev_id, u32 aid,
+ 		       const u8 *bssid, u8 *tx_bssid, u32 nontx_profile_idx,
diff --git a/package/kernel/mac80211/patches/ath11k/0078-wifi-ath11k-Relocate-the-func-ath11k_mac_bitrate_mas.patch b/package/kernel/mac80211/patches/ath11k/0078-wifi-ath11k-Relocate-the-func-ath11k_mac_bitrate_mas.patch
new file mode 100644
index 000000000..610bf7251
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0078-wifi-ath11k-Relocate-the-func-ath11k_mac_bitrate_mas.patch
@@ -0,0 +1,75 @@
+From 570eec3d40505c30babbe3b8f85a38496c975ab2 Mon Sep 17 00:00:00 2001
+From: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
+Date: Tue, 9 May 2023 20:07:23 +0300
+Subject: [PATCH] wifi: ath11k: Relocate the func
+ ath11k_mac_bitrate_mask_num_ht_rates() and change hweight16 to hweight8
+
+Relocate the function ath11k_mac_bitrate_mask_num_ht_rates() definition
+to call this function from other functions which helps to avoid the
+compilation error (function not defined).
+
+ht_mcs[] is 1 byte array and it is enough to use hweight8() instead
+of hweight16(). Hence, fixed the same.
+
+Tested on: Compile tested only.
+
+Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230504092033.3542456-2-quic_mkenna@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 30 +++++++++++++--------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include <net/mac80211.h>
+@@ -4338,6 +4338,20 @@ exit:
+ }
+ 
+ static int
++ath11k_mac_bitrate_mask_num_ht_rates(struct ath11k *ar,
++				     enum nl80211_band band,
++				     const struct cfg80211_bitrate_mask *mask)
++{
++	int num_rates = 0;
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(mask->control[band].ht_mcs); i++)
++		num_rates += hweight8(mask->control[band].ht_mcs[i]);
++
++	return num_rates;
++}
++
++static int
+ ath11k_mac_bitrate_mask_num_vht_rates(struct ath11k *ar,
+ 				      enum nl80211_band band,
+ 				      const struct cfg80211_bitrate_mask *mask)
+@@ -7791,20 +7805,6 @@ static void ath11k_mac_op_flush(struct i
+ 	ath11k_mac_flush_tx_complete(ar);
+ }
+ 
+-static int
+-ath11k_mac_bitrate_mask_num_ht_rates(struct ath11k *ar,
+-				     enum nl80211_band band,
+-				     const struct cfg80211_bitrate_mask *mask)
+-{
+-	int num_rates = 0;
+-	int i;
+-
+-	for (i = 0; i < ARRAY_SIZE(mask->control[band].ht_mcs); i++)
+-		num_rates += hweight16(mask->control[band].ht_mcs[i]);
+-
+-	return num_rates;
+-}
+-
+ static bool
+ ath11k_mac_has_single_legacy_rate(struct ath11k *ar,
+ 				  enum nl80211_band band,
diff --git a/package/kernel/mac80211/patches/ath11k/0079-wifi-ath11k-Send-HT-fixed-rate-in-WMI-peer-fixed-par.patch b/package/kernel/mac80211/patches/ath11k/0079-wifi-ath11k-Send-HT-fixed-rate-in-WMI-peer-fixed-par.patch
new file mode 100644
index 000000000..6282f4462
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0079-wifi-ath11k-Send-HT-fixed-rate-in-WMI-peer-fixed-par.patch
@@ -0,0 +1,141 @@
+From df8e3729ffc0aa645839693f74ee7b6d999cdf64 Mon Sep 17 00:00:00 2001
+From: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
+Date: Tue, 9 May 2023 20:07:24 +0300
+Subject: [PATCH] wifi: ath11k: Send HT fixed rate in WMI peer fixed param
+
+Due to the firmware behavior with HT fixed rate setting,
+HT fixed rate MCS with NSS > 1 are treated as NSS = 1
+HT rates in the firmware and enables the HT fixed rate of
+NSS = 1.
+
+This leads to HT fixed rate is always configured for NSS = 1
+even though the user sets NSS = 2 or > 1 HT fixed MCS in the
+set bitrate command.
+
+Currently HT fixed MCS is sent via WMI peer assoc command.
+Fix this issue, by sending the HT fixed rate MCS in WMI peer
+fixed param instead of sending in peer assoc command.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230504092033.3542456-3-quic_mkenna@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 63 ++++++++++++++++++++++++++-
+ 1 file changed, 61 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -4480,6 +4480,54 @@ ath11k_mac_set_peer_he_fixed_rate(struct
+ 	return ret;
+ }
+ 
++static int
++ath11k_mac_set_peer_ht_fixed_rate(struct ath11k_vif *arvif,
++				  struct ieee80211_sta *sta,
++				  const struct cfg80211_bitrate_mask *mask,
++				  enum nl80211_band band)
++{
++	struct ath11k *ar = arvif->ar;
++	u8 ht_rate, nss = 0;
++	u32 rate_code;
++	int ret, i;
++
++	lockdep_assert_held(&ar->conf_mutex);
++
++	for (i = 0; i < ARRAY_SIZE(mask->control[band].ht_mcs); i++) {
++		if (hweight8(mask->control[band].ht_mcs[i]) == 1) {
++			nss = i + 1;
++			ht_rate = ffs(mask->control[band].ht_mcs[i]) - 1;
++		}
++	}
++
++	if (!nss) {
++		ath11k_warn(ar->ab, "No single HT Fixed rate found to set for %pM",
++			    sta->addr);
++		return -EINVAL;
++	}
++
++	/* Avoid updating invalid nss as fixed rate*/
++	if (nss > sta->deflink.rx_nss)
++		return -EINVAL;
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
++		   "Setting Fixed HT Rate for peer %pM. Device will not switch to any other selected rates",
++		   sta->addr);
++
++	rate_code = ATH11K_HW_RATE_CODE(ht_rate, nss - 1,
++					WMI_RATE_PREAMBLE_HT);
++	ret = ath11k_wmi_set_peer_param(ar, sta->addr,
++					arvif->vdev_id,
++					WMI_PEER_PARAM_FIXED_RATE,
++					rate_code);
++	if (ret)
++		ath11k_warn(ar->ab,
++			    "failed to update STA %pM HT Fixed Rate %d: %d\n",
++			    sta->addr, rate_code, ret);
++
++	return ret;
++}
++
+ static int ath11k_station_assoc(struct ath11k *ar,
+ 				struct ieee80211_vif *vif,
+ 				struct ieee80211_sta *sta,
+@@ -4491,7 +4539,7 @@ static int ath11k_station_assoc(struct a
+ 	struct cfg80211_chan_def def;
+ 	enum nl80211_band band;
+ 	struct cfg80211_bitrate_mask *mask;
+-	u8 num_vht_rates, num_he_rates;
++	u8 num_ht_rates, num_vht_rates, num_he_rates;
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+ 
+@@ -4519,6 +4567,7 @@ static int ath11k_station_assoc(struct a
+ 
+ 	num_vht_rates = ath11k_mac_bitrate_mask_num_vht_rates(ar, band, mask);
+ 	num_he_rates = ath11k_mac_bitrate_mask_num_he_rates(ar, band, mask);
++	num_ht_rates = ath11k_mac_bitrate_mask_num_ht_rates(ar, band, mask);
+ 
+ 	/* If single VHT/HE rate is configured (by set_bitrate_mask()),
+ 	 * peer_assoc will disable VHT/HE. This is now enabled by a peer specific
+@@ -4535,6 +4584,11 @@ static int ath11k_station_assoc(struct a
+ 							band);
+ 		if (ret)
+ 			return ret;
++	} else if (sta->deflink.ht_cap.ht_supported && num_ht_rates == 1) {
++		ret = ath11k_mac_set_peer_ht_fixed_rate(arvif, sta, mask,
++							band);
++		if (ret)
++			return ret;
+ 	}
+ 
+ 	/* Re-assoc is run only to update supported rates for given station. It
+@@ -4608,7 +4662,7 @@ static void ath11k_sta_rc_update_wk(stru
+ 	const u16 *vht_mcs_mask;
+ 	const u16 *he_mcs_mask;
+ 	u32 changed, bw, nss, smps, bw_prev;
+-	int err, num_vht_rates, num_he_rates;
++	int err, num_ht_rates, num_vht_rates, num_he_rates;
+ 	const struct cfg80211_bitrate_mask *mask;
+ 	struct peer_assoc_params peer_arg;
+ 	enum wmi_phy_mode peer_phymode;
+@@ -4724,6 +4778,8 @@ static void ath11k_sta_rc_update_wk(stru
+ 
+ 	if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
+ 		mask = &arvif->bitrate_mask;
++		num_ht_rates = ath11k_mac_bitrate_mask_num_ht_rates(ar, band,
++								    mask);
+ 		num_vht_rates = ath11k_mac_bitrate_mask_num_vht_rates(ar, band,
+ 								      mask);
+ 		num_he_rates = ath11k_mac_bitrate_mask_num_he_rates(ar, band,
+@@ -4746,6 +4802,9 @@ static void ath11k_sta_rc_update_wk(stru
+ 		} else if (sta->deflink.he_cap.has_he && num_he_rates == 1) {
+ 			ath11k_mac_set_peer_he_fixed_rate(arvif, sta, mask,
+ 							  band);
++		} else if (sta->deflink.ht_cap.ht_supported && num_ht_rates == 1) {
++			ath11k_mac_set_peer_ht_fixed_rate(arvif, sta, mask,
++							  band);
+ 		} else {
+ 			/* If the peer is non-VHT/HE or no fixed VHT/HE rate
+ 			 * is provided in the new bitrate mask we set the
diff --git a/package/kernel/mac80211/patches/ath11k/0080-wifi-ath11k-add-support-default-regdb-while-searchin.patch b/package/kernel/mac80211/patches/ath11k/0080-wifi-ath11k-add-support-default-regdb-while-searchin.patch
new file mode 100644
index 000000000..5ff40aac7
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0080-wifi-ath11k-add-support-default-regdb-while-searchin.patch
@@ -0,0 +1,127 @@
+From 88ca89202f8e8afb5225eb5244d79cd67c15d744 Mon Sep 17 00:00:00 2001
+From: Wen Gong <quic_wgong@quicinc.com>
+Date: Fri, 26 May 2023 12:41:06 +0300
+Subject: [PATCH] wifi: ath11k: add support default regdb while searching
+ board-2.bin for WCN6855
+
+Sometimes board-2.bin does not have the regdb data which matched the
+parameters such as vendor, device, subsystem-vendor, subsystem-device
+and etc. Add default regdb data with 'bus=%s' into board-2.bin for
+WCN6855, then ath11k use 'bus=pci' to search regdb data in board-2.bin
+for WCN6855.
+
+kernel: [  122.515808] ath11k_pci 0000:03:00.0: boot using board name 'bus=pci,vendor=17cb,device=1103,subsystem-vendor=17cb,subsystem-device=3374,qmi-chip-id=2,qmi-board-id=262'
+kernel: [  122.517240] ath11k_pci 0000:03:00.0: boot firmware request ath11k/WCN6855/hw2.0/board-2.bin size 6179564
+kernel: [  122.517280] ath11k_pci 0000:03:00.0: failed to fetch regdb data for bus=pci,vendor=17cb,device=1103,subsystem-vendor=17cb,subsystem-device=3374,qmi-chip-id=2,qmi-board-id=262 from ath11k/WCN6855/hw2.0/board-2.bin
+kernel: [  122.517464] ath11k_pci 0000:03:00.0: boot using board name 'bus=pci'
+kernel: [  122.518901] ath11k_pci 0000:03:00.0: boot firmware request ath11k/WCN6855/hw2.0/board-2.bin size 6179564
+kernel: [  122.518915] ath11k_pci 0000:03:00.0: board name
+kernel: [  122.518917] ath11k_pci 0000:03:00.0: 00000000: 62 75 73 3d 70 63 69                             bus=pci
+kernel: [  122.518918] ath11k_pci 0000:03:00.0: boot found match regdb data for name 'bus=pci'
+kernel: [  122.518920] ath11k_pci 0000:03:00.0: boot found regdb data for 'bus=pci'
+kernel: [  122.518921] ath11k_pci 0000:03:00.0: fetched regdb
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
+
+Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230517133959.8224-1-quic_wgong@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/core.c | 53 +++++++++++++++++++-------
+ 1 file changed, 40 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -961,7 +961,8 @@ int ath11k_core_check_dt(struct ath11k_b
+ }
+ 
+ static int __ath11k_core_create_board_name(struct ath11k_base *ab, char *name,
+-					   size_t name_len, bool with_variant)
++					   size_t name_len, bool with_variant,
++					   bool bus_type_mode)
+ {
+ 	/* strlen(',variant=') + strlen(ab->qmi.target.bdf_ext) */
+ 	char variant[9 + ATH11K_QMI_BDF_EXT_STR_LENGTH] = { 0 };
+@@ -972,15 +973,20 @@ static int __ath11k_core_create_board_na
+ 
+ 	switch (ab->id.bdf_search) {
+ 	case ATH11K_BDF_SEARCH_BUS_AND_BOARD:
+-		scnprintf(name, name_len,
+-			  "bus=%s,vendor=%04x,device=%04x,subsystem-vendor=%04x,subsystem-device=%04x,qmi-chip-id=%d,qmi-board-id=%d%s",
+-			  ath11k_bus_str(ab->hif.bus),
+-			  ab->id.vendor, ab->id.device,
+-			  ab->id.subsystem_vendor,
+-			  ab->id.subsystem_device,
+-			  ab->qmi.target.chip_id,
+-			  ab->qmi.target.board_id,
+-			  variant);
++		if (bus_type_mode)
++			scnprintf(name, name_len,
++				  "bus=%s",
++				  ath11k_bus_str(ab->hif.bus));
++		else
++			scnprintf(name, name_len,
++				  "bus=%s,vendor=%04x,device=%04x,subsystem-vendor=%04x,subsystem-device=%04x,qmi-chip-id=%d,qmi-board-id=%d%s",
++				  ath11k_bus_str(ab->hif.bus),
++				  ab->id.vendor, ab->id.device,
++				  ab->id.subsystem_vendor,
++				  ab->id.subsystem_device,
++				  ab->qmi.target.chip_id,
++				  ab->qmi.target.board_id,
++				  variant);
+ 		break;
+ 	default:
+ 		scnprintf(name, name_len,
+@@ -999,13 +1005,19 @@ static int __ath11k_core_create_board_na
+ static int ath11k_core_create_board_name(struct ath11k_base *ab, char *name,
+ 					 size_t name_len)
+ {
+-	return __ath11k_core_create_board_name(ab, name, name_len, true);
++	return __ath11k_core_create_board_name(ab, name, name_len, true, false);
+ }
+ 
+ static int ath11k_core_create_fallback_board_name(struct ath11k_base *ab, char *name,
+ 						  size_t name_len)
+ {
+-	return __ath11k_core_create_board_name(ab, name, name_len, false);
++	return __ath11k_core_create_board_name(ab, name, name_len, false, false);
++}
++
++static int ath11k_core_create_bus_type_board_name(struct ath11k_base *ab, char *name,
++						  size_t name_len)
++{
++	return __ath11k_core_create_board_name(ab, name, name_len, false, true);
+ }
+ 
+ const struct firmware *ath11k_core_firmware_request(struct ath11k_base *ab,
+@@ -1309,7 +1321,7 @@ success:
+ 
+ int ath11k_core_fetch_regdb(struct ath11k_base *ab, struct ath11k_board_data *bd)
+ {
+-	char boardname[BOARD_NAME_SIZE];
++	char boardname[BOARD_NAME_SIZE], default_boardname[BOARD_NAME_SIZE];
+ 	int ret;
+ 
+ 	ret = ath11k_core_create_board_name(ab, boardname, BOARD_NAME_SIZE);
+@@ -1323,6 +1335,21 @@ int ath11k_core_fetch_regdb(struct ath11
+ 						 ATH11K_BD_IE_REGDB,
+ 						 ATH11K_BD_IE_REGDB_NAME,
+ 						 ATH11K_BD_IE_REGDB_DATA);
++	if (!ret)
++		goto exit;
++
++	ret = ath11k_core_create_bus_type_board_name(ab, default_boardname,
++						     BOARD_NAME_SIZE);
++	if (ret) {
++		ath11k_dbg(ab, ATH11K_DBG_BOOT,
++			   "failed to create default board name for regdb: %d", ret);
++		goto exit;
++	}
++
++	ret = ath11k_core_fetch_board_data_api_n(ab, bd, default_boardname,
++						 ATH11K_BD_IE_REGDB,
++						 ATH11K_BD_IE_REGDB_NAME,
++						 ATH11K_BD_IE_REGDB_DATA);
+ 	if (!ret)
+ 		goto exit;
+ 
diff --git a/package/kernel/mac80211/patches/ath11k/0081-wifi-ath11k-remove-unused-function-ath11k_tm_event_w.patch b/package/kernel/mac80211/patches/ath11k/0081-wifi-ath11k-remove-unused-function-ath11k_tm_event_w.patch
new file mode 100644
index 000000000..b5dc83f00
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0081-wifi-ath11k-remove-unused-function-ath11k_tm_event_w.patch
@@ -0,0 +1,128 @@
+From 86f85575a3f6a20cef1c8bb98e78585fe3a53ccc Mon Sep 17 00:00:00 2001
+From: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
+Date: Fri, 26 May 2023 12:41:06 +0300
+Subject: [PATCH 82/84] wifi: ath11k: remove unused function
+ ath11k_tm_event_wmi()
+
+The function ath11k_tm_event_wmi() is only defined and it is not used
+anywhere. Hence remove the unused.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
+Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230517135934.16408-2-quic_rajkbhag@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/testmode.c | 64 +---------------------
+ drivers/net/wireless/ath/ath11k/testmode.h |  8 +--
+ 2 files changed, 2 insertions(+), 70 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/testmode.c
++++ b/drivers/net/wireless/ath/ath11k/testmode.c
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
++ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include "testmode.h"
+@@ -20,69 +21,6 @@ static const struct nla_policy ath11k_tm
+ 	[ATH11K_TM_ATTR_VERSION_MINOR]	= { .type = NLA_U32 },
+ };
+ 
+-/* Returns true if callee consumes the skb and the skb should be discarded.
+- * Returns false if skb is not used. Does not sleep.
+- */
+-bool ath11k_tm_event_wmi(struct ath11k *ar, u32 cmd_id, struct sk_buff *skb)
+-{
+-	struct sk_buff *nl_skb;
+-	bool consumed;
+-	int ret;
+-
+-	ath11k_dbg(ar->ab, ATH11K_DBG_TESTMODE,
+-		   "testmode event wmi cmd_id %d skb %pK skb->len %d\n",
+-		   cmd_id, skb, skb->len);
+-
+-	ath11k_dbg_dump(ar->ab, ATH11K_DBG_TESTMODE, NULL, "", skb->data, skb->len);
+-
+-	spin_lock_bh(&ar->data_lock);
+-
+-	consumed = true;
+-
+-	nl_skb = cfg80211_testmode_alloc_event_skb(ar->hw->wiphy,
+-						   2 * sizeof(u32) + skb->len,
+-						   GFP_ATOMIC);
+-	if (!nl_skb) {
+-		ath11k_warn(ar->ab,
+-			    "failed to allocate skb for testmode wmi event\n");
+-		goto out;
+-	}
+-
+-	ret = nla_put_u32(nl_skb, ATH11K_TM_ATTR_CMD, ATH11K_TM_CMD_WMI);
+-	if (ret) {
+-		ath11k_warn(ar->ab,
+-			    "failed to put testmode wmi event cmd attribute: %d\n",
+-			    ret);
+-		kfree_skb(nl_skb);
+-		goto out;
+-	}
+-
+-	ret = nla_put_u32(nl_skb, ATH11K_TM_ATTR_WMI_CMDID, cmd_id);
+-	if (ret) {
+-		ath11k_warn(ar->ab,
+-			    "failed to put testmode wmi even cmd_id: %d\n",
+-			    ret);
+-		kfree_skb(nl_skb);
+-		goto out;
+-	}
+-
+-	ret = nla_put(nl_skb, ATH11K_TM_ATTR_DATA, skb->len, skb->data);
+-	if (ret) {
+-		ath11k_warn(ar->ab,
+-			    "failed to copy skb to testmode wmi event: %d\n",
+-			    ret);
+-		kfree_skb(nl_skb);
+-		goto out;
+-	}
+-
+-	cfg80211_testmode_event(nl_skb, GFP_ATOMIC);
+-
+-out:
+-	spin_unlock_bh(&ar->data_lock);
+-
+-	return consumed;
+-}
+-
+ static int ath11k_tm_cmd_get_version(struct ath11k *ar, struct nlattr *tb[])
+ {
+ 	struct sk_buff *skb;
+--- a/drivers/net/wireless/ath/ath11k/testmode.h
++++ b/drivers/net/wireless/ath/ath11k/testmode.h
+@@ -1,24 +1,18 @@
+ /* SPDX-License-Identifier: BSD-3-Clause-Clear */
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
++ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include "core.h"
+ 
+ #ifdef CPTCFG_NL80211_TESTMODE
+ 
+-bool ath11k_tm_event_wmi(struct ath11k *ar, u32 cmd_id, struct sk_buff *skb);
+ int ath11k_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		  void *data, int len);
+ 
+ #else
+ 
+-static inline bool ath11k_tm_event_wmi(struct ath11k *ar, u32 cmd_id,
+-				       struct sk_buff *skb)
+-{
+-	return false;
+-}
+-
+ static inline int ath11k_tm_cmd(struct ieee80211_hw *hw,
+ 				struct ieee80211_vif *vif,
+ 				void *data, int len)
diff --git a/package/kernel/mac80211/patches/ath11k/0082-wifi-ath11k-factory-test-mode-support.patch b/package/kernel/mac80211/patches/ath11k/0082-wifi-ath11k-factory-test-mode-support.patch
new file mode 100644
index 000000000..f1b262724
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0082-wifi-ath11k-factory-test-mode-support.patch
@@ -0,0 +1,850 @@
+From b43310e44edc823a7f02af1e1e2b4e8a9abc7d91 Mon Sep 17 00:00:00 2001
+From: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
+Date: Fri, 26 May 2023 12:41:07 +0300
+Subject: [PATCH 83/84] wifi: ath11k: factory test mode support
+
+Add support to process factory test mode commands (FTM) for calibration.
+By default firmware start with NORMAL mode and to process the FTM commands
+firmware needs to be restarted in FTM mode using module parameter ftm_mode.
+The pre-request is all the radios should be down before starting the test.
+
+When start command ATH11K_TM_CMD_TESTMODE_START is received, ar->state
+is set to Test Mode. If the FTM command or event length is greater
+than 256 bytes, it will be broken down into multiple segments and
+encoded with TLV header if it is segmented commands, else it is sent
+to firmware as it is.
+
+On receiving UTF event from firmware, if it is segmented event, the driver
+will wait until it receives all the segments and notify the complete
+data to user application. In case the segmented sequence are missed or
+lost from the firmware, driver will skip the already received partial data.
+
+In case of unsegmented UTF event from firmware, driver notifies the
+data to the user application as it comes. Applications handles
+the data further.
+
+Command to boot in ftm mode:
+
+insmod ath11k ftm_mode=1
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
+Co-developed-by: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
+Signed-off-by: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
+Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230517135934.16408-4-quic_rajkbhag@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/ahb.c        |   3 +-
+ drivers/net/wireless/ath/ath11k/core.c       |  21 +-
+ drivers/net/wireless/ath/ath11k/core.h       |  16 +-
+ drivers/net/wireless/ath/ath11k/debug.h      |   1 +
+ drivers/net/wireless/ath/ath11k/mac.c        |  11 +-
+ drivers/net/wireless/ath/ath11k/pci.c        |   3 +-
+ drivers/net/wireless/ath/ath11k/testmode.c   | 350 ++++++++++++++++++-
+ drivers/net/wireless/ath/ath11k/testmode.h   |   6 +
+ drivers/net/wireless/ath/ath11k/testmode_i.h |  18 +-
+ drivers/net/wireless/ath/ath11k/wmi.c        |  11 +-
+ drivers/net/wireless/ath/ath11k/wmi.h        |  22 ++
+ drivers/net/wireless/ath/ath11k/wow.c        |   3 +-
+ 12 files changed, 444 insertions(+), 21 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include <linux/module.h>
+@@ -1155,6 +1155,7 @@ static int ath11k_ahb_probe(struct platf
+ 	ab->hif.ops = hif_ops;
+ 	ab->pdev = pdev;
+ 	ab->hw_rev = hw_rev;
++	ab->fw_mode = ATH11K_FIRMWARE_MODE_NORMAL;
+ 	platform_set_drvdata(pdev, ab);
+ 
+ 	ret = ath11k_pcic_register_pci_ops(ab, pci_ops);
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include <linux/module.h>
+@@ -32,6 +32,10 @@ module_param_named(frame_mode, ath11k_fr
+ MODULE_PARM_DESC(frame_mode,
+ 		 "Datapath frame mode (0: raw, 1: native wifi (default), 2: ethernet)");
+ 
++bool ath11k_ftm_mode;
++module_param_named(ftm_mode, ath11k_ftm_mode, bool, 0444);
++MODULE_PARM_DESC(ftm_mode, "Boots up in factory test mode");
++
+ static const struct ath11k_hw_params ath11k_hw_params[] = {
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ8074,
+@@ -1381,6 +1385,11 @@ static int ath11k_core_soc_create(struct
+ {
+ 	int ret;
+ 
++	if (ath11k_ftm_mode) {
++		ab->fw_mode = ATH11K_FIRMWARE_MODE_FTM;
++		ath11k_info(ab, "Booting in factory test mode\n");
++	}
++
+ 	ret = ath11k_qmi_init_service(ab);
+ 	if (ret) {
+ 		ath11k_err(ab, "failed to initialize qmi :%d\n", ret);
+@@ -1607,7 +1616,7 @@ int ath11k_core_qmi_firmware_ready(struc
+ {
+ 	int ret;
+ 
+-	ret = ath11k_core_start_firmware(ab, ATH11K_FIRMWARE_MODE_NORMAL);
++	ret = ath11k_core_start_firmware(ab, ab->fw_mode);
+ 	if (ret) {
+ 		ath11k_err(ab, "failed to start firmware: %d\n", ret);
+ 		return ret;
+@@ -1772,7 +1781,8 @@ void ath11k_core_pre_reconfigure_recover
+ 	for (i = 0; i < ab->num_radios; i++) {
+ 		pdev = &ab->pdevs[i];
+ 		ar = pdev->ar;
+-		if (!ar || ar->state == ATH11K_STATE_OFF)
++		if (!ar || ar->state == ATH11K_STATE_OFF ||
++		    ar->state == ATH11K_STATE_FTM)
+ 			continue;
+ 
+ 		ieee80211_stop_queues(ar->hw);
+@@ -1841,7 +1851,12 @@ static void ath11k_core_post_reconfigure
+ 			ath11k_warn(ab,
+ 				    "device is wedged, will not restart radio %d\n", i);
+ 			break;
++		case ATH11K_STATE_FTM:
++			ath11k_dbg(ab, ATH11K_DBG_TESTMODE,
++				   "fw mode reset done radio %d\n", i);
++			break;
+ 		}
++
+ 		mutex_unlock(&ar->conf_mutex);
+ 	}
+ 	complete(&ab->driver_recovery);
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -1,7 +1,7 @@
+ /* SPDX-License-Identifier: BSD-3-Clause-Clear */
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #ifndef ATH11K_CORE_H
+@@ -52,6 +52,7 @@
+ #define ATH11K_SMBIOS_BDF_EXT_MAGIC "BDF_"
+ 
+ extern unsigned int ath11k_frame_mode;
++extern bool ath11k_ftm_mode;
+ 
+ #define ATH11K_SCAN_TIMEOUT_HZ (20 * HZ)
+ 
+@@ -277,6 +278,7 @@ enum ath11k_dev_flags {
+ 	ATH11K_FLAG_FIXED_MEM_RGN,
+ 	ATH11K_FLAG_DEVICE_INIT_DONE,
+ 	ATH11K_FLAG_MULTI_MSI_VECTORS,
++	ATH11K_FLAG_FTM_SEGMENTED,
+ };
+ 
+ enum ath11k_monitor_flags {
+@@ -530,6 +532,7 @@ enum ath11k_state {
+ 	ATH11K_STATE_RESTARTING,
+ 	ATH11K_STATE_RESTARTED,
+ 	ATH11K_STATE_WEDGED,
++	ATH11K_STATE_FTM,
+ 	/* Add other states as required */
+ };
+ 
+@@ -709,6 +712,8 @@ struct ath11k {
+ 	u32 last_ppdu_id;
+ 	u32 cached_ppdu_id;
+ 	int monitor_vdev_id;
++	struct completion fw_mode_reset;
++	u8 ftm_msgref;
+ #ifdef CPTCFG_ATH11K_DEBUGFS
+ 	struct ath11k_debug debug;
+ #endif
+@@ -838,6 +843,7 @@ struct ath11k_msi_config {
+ /* Master structure to hold the hw data which may be used in core module */
+ struct ath11k_base {
+ 	enum ath11k_hw_rev hw_rev;
++	enum ath11k_firmware_mode fw_mode;
+ 	struct platform_device *pdev;
+ 	struct device *dev;
+ 	struct ath11k_qmi qmi;
+@@ -978,6 +984,14 @@ struct ath11k_base {
+ 		const struct ath11k_pci_ops *ops;
+ 	} pci;
+ 
++#ifdef CPTCFG_NL80211_TESTMODE
++	struct {
++		u32 data_pos;
++		u32 expected_seq;
++		u8 *eventdata;
++	} testmode;
++#endif
++
+ 	/* must be last */
+ 	u8 drv_priv[] __aligned(sizeof(void *));
+ };
+--- a/drivers/net/wireless/ath/ath11k/debug.h
++++ b/drivers/net/wireless/ath/ath11k/debug.h
+@@ -1,6 +1,7 @@
+ /* SPDX-License-Identifier: BSD-3-Clause-Clear */
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
++ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #ifndef _ATH11K_DEBUG_H_
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -643,7 +643,10 @@ struct ath11k *ath11k_mac_get_ar_by_pdev
+ 		return NULL;
+ 
+ 	for (i = 0; i < ab->num_radios; i++) {
+-		pdev = rcu_dereference(ab->pdevs_active[i]);
++		if (ab->fw_mode == ATH11K_FIRMWARE_MODE_FTM)
++			pdev = &ab->pdevs[i];
++		else
++			pdev = rcu_dereference(ab->pdevs_active[i]);
+ 
+ 		if (pdev && pdev->pdev_id == pdev_id)
+ 			return (pdev->ar ? pdev->ar : NULL);
+@@ -6271,6 +6274,11 @@ static int ath11k_mac_op_start(struct ie
+ 	struct ath11k_pdev *pdev = ar->pdev;
+ 	int ret;
+ 
++	if (ath11k_ftm_mode) {
++		ath11k_warn(ab, "mac operations not supported in factory test mode\n");
++		return -EOPNOTSUPP;
++	}
++
+ 	ath11k_mac_drain_tx(ar);
+ 	mutex_lock(&ar->conf_mutex);
+ 
+@@ -6285,6 +6293,7 @@ static int ath11k_mac_op_start(struct ie
+ 	case ATH11K_STATE_RESTARTED:
+ 	case ATH11K_STATE_WEDGED:
+ 	case ATH11K_STATE_ON:
++	case ATH11K_STATE_FTM:
+ 		WARN_ON(1);
+ 		ret = -EINVAL;
+ 		goto err;
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2019-2020 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2022, Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include <linux/module.h>
+@@ -745,6 +745,7 @@ static int ath11k_pci_probe(struct pci_d
+ 	ab_pci->ab = ab;
+ 	ab_pci->pdev = pdev;
+ 	ab->hif.ops = &ath11k_pci_hif_ops;
++	ab->fw_mode = ATH11K_FIRMWARE_MODE_NORMAL;
+ 	pci_set_drvdata(pdev, ab);
+ 	spin_lock_init(&ab_pci->window_lock);
+ 
+--- a/drivers/net/wireless/ath/ath11k/testmode.c
++++ b/drivers/net/wireless/ath/ath11k/testmode.c
+@@ -12,6 +12,9 @@
+ #include "core.h"
+ #include "testmode_i.h"
+ 
++#define ATH11K_FTM_SEGHDR_CURRENT_SEQ		GENMASK(3, 0)
++#define ATH11K_FTM_SEGHDR_TOTAL_SEGMENTS	GENMASK(7, 4)
++
+ static const struct nla_policy ath11k_tm_policy[ATH11K_TM_ATTR_MAX + 1] = {
+ 	[ATH11K_TM_ATTR_CMD]		= { .type = NLA_U32 },
+ 	[ATH11K_TM_ATTR_DATA]		= { .type = NLA_BINARY,
+@@ -21,13 +24,217 @@ static const struct nla_policy ath11k_tm
+ 	[ATH11K_TM_ATTR_VERSION_MINOR]	= { .type = NLA_U32 },
+ };
+ 
++static struct ath11k *ath11k_tm_get_ar(struct ath11k_base *ab)
++{
++	struct ath11k_pdev *pdev;
++	struct ath11k *ar = NULL;
++	int i;
++
++	for (i = 0; i < ab->num_radios; i++) {
++		pdev = &ab->pdevs[i];
++		ar = pdev->ar;
++
++		if (ar && ar->state == ATH11K_STATE_FTM)
++			break;
++	}
++
++	return ar;
++}
++
++/* This function handles unsegmented events. Data in various events are aggregated
++ * in application layer, this event is unsegmented from host perspective.
++ */
++static void ath11k_tm_wmi_event_unsegmented(struct ath11k_base *ab, u32 cmd_id,
++					    struct sk_buff *skb)
++{
++	struct sk_buff *nl_skb;
++	struct ath11k *ar;
++
++	ath11k_dbg(ab, ATH11K_DBG_TESTMODE,
++		   "event wmi cmd_id %d skb length %d\n",
++		   cmd_id, skb->len);
++	ath11k_dbg_dump(ab, ATH11K_DBG_TESTMODE, NULL, "", skb->data, skb->len);
++
++	ar = ath11k_tm_get_ar(ab);
++	if (!ar) {
++		ath11k_warn(ab, "testmode event not handled due to invalid pdev\n");
++		return;
++	}
++
++	spin_lock_bh(&ar->data_lock);
++
++	nl_skb = cfg80211_testmode_alloc_event_skb(ar->hw->wiphy,
++						   2 * nla_total_size(sizeof(u32)) +
++						   nla_total_size(skb->len),
++						   GFP_ATOMIC);
++	if (!nl_skb) {
++		ath11k_warn(ab,
++			    "failed to allocate skb for unsegmented testmode wmi event\n");
++		goto out;
++	}
++
++	if (nla_put_u32(nl_skb, ATH11K_TM_ATTR_CMD, ATH11K_TM_CMD_WMI) ||
++	    nla_put_u32(nl_skb, ATH11K_TM_ATTR_WMI_CMDID, cmd_id) ||
++	    nla_put(nl_skb, ATH11K_TM_ATTR_DATA, skb->len, skb->data)) {
++		ath11k_warn(ab, "failed to populate testmode unsegmented event\n");
++		kfree_skb(nl_skb);
++		goto out;
++	}
++
++	cfg80211_testmode_event(nl_skb, GFP_ATOMIC);
++	spin_unlock_bh(&ar->data_lock);
++	return;
++
++out:
++	spin_unlock_bh(&ar->data_lock);
++	ath11k_warn(ab, "Failed to send testmode event to higher layers\n");
++}
++
++/* This function handles segmented events. Data of various events received
++ * from firmware is aggregated and sent to application layer
++ */
++static int ath11k_tm_process_event(struct ath11k_base *ab, u32 cmd_id,
++				   const struct wmi_ftm_event_msg *ftm_msg,
++				   u16 length)
++{
++	struct sk_buff *nl_skb;
++	int ret = 0;
++	struct ath11k *ar;
++	u8 const *buf_pos;
++	u16 datalen;
++	u8 total_segments, current_seq;
++	u32 data_pos;
++	u32 pdev_id;
++
++	ath11k_dbg(ab, ATH11K_DBG_TESTMODE,
++		   "event wmi cmd_id %d ftm event msg %pK datalen %d\n",
++		   cmd_id, ftm_msg, length);
++	ath11k_dbg_dump(ab, ATH11K_DBG_TESTMODE, NULL, "", ftm_msg, length);
++	pdev_id = DP_HW2SW_MACID(ftm_msg->seg_hdr.pdev_id);
++
++	if (pdev_id >= ab->num_radios) {
++		ath11k_warn(ab, "testmode event not handled due to invalid pdev id: %d\n",
++			    pdev_id);
++		return -EINVAL;
++	}
++
++	ar = ab->pdevs[pdev_id].ar;
++	if (!ar) {
++		ath11k_warn(ab, "testmode event not handled due to absence of pdev\n");
++		return -ENODEV;
++	}
++
++	current_seq = FIELD_GET(ATH11K_FTM_SEGHDR_CURRENT_SEQ,
++				ftm_msg->seg_hdr.segmentinfo);
++	total_segments = FIELD_GET(ATH11K_FTM_SEGHDR_TOTAL_SEGMENTS,
++				   ftm_msg->seg_hdr.segmentinfo);
++	datalen = length - (sizeof(struct wmi_ftm_seg_hdr));
++	buf_pos = ftm_msg->data;
++
++	spin_lock_bh(&ar->data_lock);
++
++	if (current_seq == 0) {
++		ab->testmode.expected_seq = 0;
++		ab->testmode.data_pos = 0;
++	}
++
++	data_pos = ab->testmode.data_pos;
++
++	if ((data_pos + datalen) > ATH11K_FTM_EVENT_MAX_BUF_LENGTH) {
++		ath11k_warn(ab, "Invalid ftm event length at %d: %d\n",
++			    data_pos, datalen);
++		ret = -EINVAL;
++		goto out;
++	}
++
++	memcpy(&ab->testmode.eventdata[data_pos], buf_pos, datalen);
++	data_pos += datalen;
++
++	if (++ab->testmode.expected_seq != total_segments) {
++		ab->testmode.data_pos = data_pos;
++		ath11k_dbg(ab, ATH11K_DBG_TESTMODE,
++			   "partial data received current_seq %d total_seg %d\n",
++			    current_seq, total_segments);
++		goto out;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_TESTMODE,
++		   "total data length pos %d len %d\n",
++		    data_pos, ftm_msg->seg_hdr.len);
++	nl_skb = cfg80211_testmode_alloc_event_skb(ar->hw->wiphy,
++						   2 * nla_total_size(sizeof(u32)) +
++						   nla_total_size(data_pos),
++						   GFP_ATOMIC);
++	if (!nl_skb) {
++		ath11k_warn(ab,
++			    "failed to allocate skb for segmented testmode wmi event\n");
++		ret = -ENOMEM;
++		goto out;
++	}
++
++	if (nla_put_u32(nl_skb, ATH11K_TM_ATTR_CMD,
++			ATH11K_TM_CMD_WMI_FTM) ||
++	    nla_put_u32(nl_skb, ATH11K_TM_ATTR_WMI_CMDID, cmd_id) ||
++	    nla_put(nl_skb, ATH11K_TM_ATTR_DATA, data_pos,
++		    &ab->testmode.eventdata[0])) {
++		ath11k_warn(ab, "failed to populate segmented testmode event");
++		kfree_skb(nl_skb);
++		ret = -ENOBUFS;
++		goto out;
++	}
++
++	cfg80211_testmode_event(nl_skb, GFP_ATOMIC);
++
++out:
++	spin_unlock_bh(&ar->data_lock);
++	return ret;
++}
++
++static void ath11k_tm_wmi_event_segmented(struct ath11k_base *ab, u32 cmd_id,
++					  struct sk_buff *skb)
++{
++	const void **tb;
++	const struct wmi_ftm_event_msg *ev;
++	u16 length;
++	int ret;
++
++	tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC);
++	if (IS_ERR(tb)) {
++		ret = PTR_ERR(tb);
++		ath11k_warn(ab, "failed to parse ftm event tlv: %d\n", ret);
++		return;
++	}
++
++	ev = tb[WMI_TAG_ARRAY_BYTE];
++	if (!ev) {
++		ath11k_warn(ab, "failed to fetch ftm msg\n");
++		kfree(tb);
++		return;
++	}
++
++	length = skb->len - TLV_HDR_SIZE;
++	ret = ath11k_tm_process_event(ab, cmd_id, ev, length);
++	if (ret)
++		ath11k_warn(ab, "Failed to process ftm event\n");
++
++	kfree(tb);
++}
++
++void ath11k_tm_wmi_event(struct ath11k_base *ab, u32 cmd_id, struct sk_buff *skb)
++{
++	if (test_bit(ATH11K_FLAG_FTM_SEGMENTED, &ab->dev_flags))
++		ath11k_tm_wmi_event_segmented(ab, cmd_id, skb);
++	else
++		ath11k_tm_wmi_event_unsegmented(ab, cmd_id, skb);
++}
++
+ static int ath11k_tm_cmd_get_version(struct ath11k *ar, struct nlattr *tb[])
+ {
+ 	struct sk_buff *skb;
+ 	int ret;
+ 
+ 	ath11k_dbg(ar->ab, ATH11K_DBG_TESTMODE,
+-		   "testmode cmd get version_major %d version_minor %d\n",
++		   "cmd get version_major %d version_minor %d\n",
+ 		   ATH11K_TESTMODE_VERSION_MAJOR,
+ 		   ATH11K_TESTMODE_VERSION_MINOR);
+ 
+@@ -53,6 +260,43 @@ static int ath11k_tm_cmd_get_version(str
+ 	return cfg80211_testmode_reply(skb);
+ }
+ 
++static int ath11k_tm_cmd_testmode_start(struct ath11k *ar, struct nlattr *tb[])
++{
++	int ret;
++
++	mutex_lock(&ar->conf_mutex);
++
++	if (ar->state == ATH11K_STATE_FTM) {
++		ret = -EALREADY;
++		goto err;
++	}
++
++	/* start utf only when the driver is not in use  */
++	if (ar->state != ATH11K_STATE_OFF) {
++		ret = -EBUSY;
++		goto err;
++	}
++
++	ar->ab->testmode.eventdata = kzalloc(ATH11K_FTM_EVENT_MAX_BUF_LENGTH,
++					     GFP_KERNEL);
++	if (!ar->ab->testmode.eventdata) {
++		ret = -ENOMEM;
++		goto err;
++	}
++
++	ar->state = ATH11K_STATE_FTM;
++	ar->ftm_msgref = 0;
++
++	mutex_unlock(&ar->conf_mutex);
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_TESTMODE, "cmd start\n");
++	return 0;
++
++err:
++	mutex_unlock(&ar->conf_mutex);
++	return ret;
++}
++
+ static int ath11k_tm_cmd_wmi(struct ath11k *ar, struct nlattr *tb[])
+ {
+ 	struct ath11k_pdev_wmi *wmi = ar->wmi;
+@@ -63,11 +307,6 @@ static int ath11k_tm_cmd_wmi(struct ath1
+ 
+ 	mutex_lock(&ar->conf_mutex);
+ 
+-	if (ar->state != ATH11K_STATE_ON) {
+-		ret = -ENETDOWN;
+-		goto out;
+-	}
+-
+ 	if (!tb[ATH11K_TM_ATTR_DATA]) {
+ 		ret = -EINVAL;
+ 		goto out;
+@@ -80,11 +319,17 @@ static int ath11k_tm_cmd_wmi(struct ath1
+ 
+ 	buf = nla_data(tb[ATH11K_TM_ATTR_DATA]);
+ 	buf_len = nla_len(tb[ATH11K_TM_ATTR_DATA]);
++	if (!buf_len) {
++		ath11k_warn(ar->ab, "No data present in testmode wmi command\n");
++		ret = -EINVAL;
++		goto out;
++	}
++
+ 	cmd_id = nla_get_u32(tb[ATH11K_TM_ATTR_WMI_CMDID]);
+ 
+ 	ath11k_dbg(ar->ab, ATH11K_DBG_TESTMODE,
+-		   "testmode cmd wmi cmd_id %d buf %pK buf_len %d\n",
+-		   cmd_id, buf, buf_len);
++		   "cmd wmi cmd_id %d buf length %d\n",
++		   cmd_id, buf_len);
+ 
+ 	ath11k_dbg_dump(ar->ab, ATH11K_DBG_TESTMODE, NULL, "", buf, buf_len);
+ 
+@@ -111,6 +356,91 @@ out:
+ 	return ret;
+ }
+ 
++static int ath11k_tm_cmd_wmi_ftm(struct ath11k *ar, struct nlattr *tb[])
++{
++	struct ath11k_pdev_wmi *wmi = ar->wmi;
++	struct ath11k_base *ab = ar->ab;
++	struct sk_buff *skb;
++	u32 cmd_id, buf_len, hdr_info;
++	int ret;
++	void *buf;
++	u8 segnumber = 0, seginfo;
++	u16 chunk_len, total_bytes, num_segments;
++	u8 *bufpos;
++	struct wmi_ftm_cmd *ftm_cmd;
++
++	set_bit(ATH11K_FLAG_FTM_SEGMENTED, &ab->dev_flags);
++
++	mutex_lock(&ar->conf_mutex);
++
++	if (ar->state != ATH11K_STATE_FTM) {
++		ret = -ENETDOWN;
++		goto out;
++	}
++
++	if (!tb[ATH11K_TM_ATTR_DATA]) {
++		ret = -EINVAL;
++		goto out;
++	}
++
++	buf = nla_data(tb[ATH11K_TM_ATTR_DATA]);
++	buf_len = nla_len(tb[ATH11K_TM_ATTR_DATA]);
++	cmd_id = WMI_PDEV_UTF_CMDID;
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_TESTMODE,
++		   "cmd wmi ftm cmd_id %d buffer length %d\n",
++		   cmd_id, buf_len);
++	ath11k_dbg_dump(ar->ab, ATH11K_DBG_TESTMODE, NULL, "", buf, buf_len);
++
++	bufpos = buf;
++	total_bytes = buf_len;
++	num_segments = total_bytes / MAX_WMI_UTF_LEN;
++
++	if (buf_len - (num_segments * MAX_WMI_UTF_LEN))
++		num_segments++;
++
++	while (buf_len) {
++		chunk_len = min_t(u16, buf_len, MAX_WMI_UTF_LEN);
++
++		skb = ath11k_wmi_alloc_skb(wmi->wmi_ab, (chunk_len +
++					   sizeof(struct wmi_ftm_cmd)));
++		if (!skb) {
++			ret = -ENOMEM;
++			goto out;
++		}
++
++		ftm_cmd = (struct wmi_ftm_cmd *)skb->data;
++		hdr_info = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_BYTE) |
++			   FIELD_PREP(WMI_TLV_LEN, (chunk_len +
++				      sizeof(struct wmi_ftm_seg_hdr)));
++		ftm_cmd->tlv_header = hdr_info;
++		ftm_cmd->seg_hdr.len = total_bytes;
++		ftm_cmd->seg_hdr.msgref = ar->ftm_msgref;
++		seginfo = FIELD_PREP(ATH11K_FTM_SEGHDR_TOTAL_SEGMENTS, num_segments) |
++			  FIELD_PREP(ATH11K_FTM_SEGHDR_CURRENT_SEQ, segnumber);
++		ftm_cmd->seg_hdr.segmentinfo = seginfo;
++		segnumber++;
++
++		memcpy(&ftm_cmd->data, bufpos, chunk_len);
++
++		ret = ath11k_wmi_cmd_send(wmi, skb, cmd_id);
++		if (ret) {
++			ath11k_warn(ar->ab, "failed to send wmi ftm command: %d\n", ret);
++			goto out;
++		}
++
++		buf_len -= chunk_len;
++		bufpos += chunk_len;
++	}
++
++	ar->ftm_msgref++;
++	ret = 0;
++
++out:
++	mutex_unlock(&ar->conf_mutex);
++	return ret;
++}
++
+ int ath11k_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		  void *data, int len)
+ {
+@@ -131,6 +461,10 @@ int ath11k_tm_cmd(struct ieee80211_hw *h
+ 		return ath11k_tm_cmd_get_version(ar, tb);
+ 	case ATH11K_TM_CMD_WMI:
+ 		return ath11k_tm_cmd_wmi(ar, tb);
++	case ATH11K_TM_CMD_TESTMODE_START:
++		return ath11k_tm_cmd_testmode_start(ar, tb);
++	case ATH11K_TM_CMD_WMI_FTM:
++		return ath11k_tm_cmd_wmi_ftm(ar, tb);
+ 	default:
+ 		return -EOPNOTSUPP;
+ 	}
+--- a/drivers/net/wireless/ath/ath11k/testmode.h
++++ b/drivers/net/wireless/ath/ath11k/testmode.h
+@@ -8,11 +8,17 @@
+ 
+ #ifdef CPTCFG_NL80211_TESTMODE
+ 
++void ath11k_tm_wmi_event(struct ath11k_base *ab, u32 cmd_id, struct sk_buff *skb);
+ int ath11k_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		  void *data, int len);
+ 
+ #else
+ 
++static inline void ath11k_tm_wmi_event(struct ath11k_base *ab, u32 cmd_id,
++				       struct sk_buff *skb)
++{
++}
++
+ static inline int ath11k_tm_cmd(struct ieee80211_hw *hw,
+ 				struct ieee80211_vif *vif,
+ 				void *data, int len)
+--- a/drivers/net/wireless/ath/ath11k/testmode_i.h
++++ b/drivers/net/wireless/ath/ath11k/testmode_i.h
+@@ -1,6 +1,7 @@
+ /* SPDX-License-Identifier: BSD-3-Clause-Clear */
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
++ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ /* "API" level of the ath11k testmode interface. Bump it after every
+@@ -11,9 +12,10 @@
+ /* Bump this after every _compatible_ interface change, for example
+  * addition of a new command or an attribute.
+  */
+-#define ATH11K_TESTMODE_VERSION_MINOR 0
++#define ATH11K_TESTMODE_VERSION_MINOR 1
+ 
+ #define ATH11K_TM_DATA_MAX_LEN		5000
++#define ATH11K_FTM_EVENT_MAX_BUF_LENGTH 2048
+ 
+ enum ath11k_tm_attr {
+ 	__ATH11K_TM_ATTR_INVALID		= 0,
+@@ -47,4 +49,18 @@ enum ath11k_tm_cmd {
+ 	 * ATH11K_TM_ATTR_DATA.
+ 	 */
+ 	ATH11K_TM_CMD_WMI = 1,
++
++	/* Boots the UTF firmware, the netdev interface must be down at the
++	 * time.
++	 */
++	ATH11K_TM_CMD_TESTMODE_START = 2,
++
++	/* The command used to transmit a FTM WMI command to the firmware
++	 * and the event to receive WMI events from the firmware. The data
++	 * received only contain the payload, need to add the tlv header
++	 * and send the cmd to firmware with command id WMI_PDEV_UTF_CMDID.
++	 * The data payload size could be large and the driver needs to
++	 * send segmented data to firmware.
++	 */
++	ATH11K_TM_CMD_WMI_FTM = 3,
+ };
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021, Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2021, 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ #include <linux/skbuff.h>
+ #include <linux/ctype.h>
+@@ -19,6 +19,7 @@
+ #include "mac.h"
+ #include "hw.h"
+ #include "peer.h"
++#include "testmode.h"
+ 
+ struct wmi_tlv_policy {
+ 	size_t min_len;
+@@ -237,9 +238,8 @@ static int ath11k_wmi_tlv_parse(struct a
+ 				   (void *)tb);
+ }
+ 
+-static const void **
+-ath11k_wmi_tlv_parse_alloc(struct ath11k_base *ab, const void *ptr,
+-			   size_t len, gfp_t gfp)
++const void **ath11k_wmi_tlv_parse_alloc(struct ath11k_base *ab, const void *ptr,
++					size_t len, gfp_t gfp)
+ {
+ 	const void **tb;
+ 	int ret;
+@@ -8628,6 +8628,9 @@ static void ath11k_wmi_tlv_op_rx(struct
+ 	case WMI_PDEV_CSA_SWITCH_COUNT_STATUS_EVENTID:
+ 		ath11k_wmi_pdev_csa_switch_count_status_event(ab, skb);
+ 		break;
++	case WMI_PDEV_UTF_EVENTID:
++		ath11k_tm_wmi_event(ab, id, skb);
++		break;
+ 	case WMI_PDEV_TEMPERATURE_EVENTID:
+ 		ath11k_wmi_pdev_temperature_event(ab, skb);
+ 		break;
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -1,6 +1,7 @@
+ /* SPDX-License-Identifier: BSD-3-Clause-Clear */
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
++ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #ifndef ATH11K_WMI_H
+@@ -68,6 +69,7 @@ struct wmi_tlv {
+ 
+ #define WMI_APPEND_TO_EXISTING_CHAN_LIST_FLAG 1
+ 
++#define MAX_WMI_UTF_LEN 252
+ #define WMI_BA_MODE_BUFFER_SIZE_256  3
+ /*
+  * HW mode config type replicated from FW header
+@@ -3564,6 +3566,24 @@ struct wmi_get_pdev_temperature_cmd {
+ 	u32 pdev_id;
+ } __packed;
+ 
++struct wmi_ftm_seg_hdr {
++	u32 len;
++	u32 msgref;
++	u32 segmentinfo;
++	u32 pdev_id;
++} __packed;
++
++struct wmi_ftm_cmd {
++	u32 tlv_header;
++	struct wmi_ftm_seg_hdr seg_hdr;
++	u8 data[];
++} __packed;
++
++struct wmi_ftm_event_msg {
++	struct wmi_ftm_seg_hdr seg_hdr;
++	u8 data[];
++} __packed;
++
+ #define WMI_BEACON_TX_BUFFER_SIZE	512
+ 
+ #define WMI_EMA_TMPL_IDX_SHIFT            8
+@@ -6300,6 +6320,8 @@ enum wmi_sta_keepalive_method {
+ #define WMI_STA_KEEPALIVE_INTERVAL_DEFAULT	30
+ #define WMI_STA_KEEPALIVE_INTERVAL_DISABLE	0
+ 
++const void **ath11k_wmi_tlv_parse_alloc(struct ath11k_base *ab, const void *ptr,
++					size_t len, gfp_t gfp);
+ int ath11k_wmi_cmd_send(struct ath11k_pdev_wmi *wmi, struct sk_buff *skb,
+ 			u32 cmd_id);
+ struct sk_buff *ath11k_wmi_alloc_skb(struct ath11k_wmi_base *wmi_sc, u32 len);
+--- a/drivers/net/wireless/ath/ath11k/wow.c
++++ b/drivers/net/wireless/ath/ath11k/wow.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2020 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2022, Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include <linux/delay.h>
+@@ -838,6 +838,7 @@ exit:
+ 		case ATH11K_STATE_RESTARTING:
+ 		case ATH11K_STATE_RESTARTED:
+ 		case ATH11K_STATE_WEDGED:
++		case ATH11K_STATE_FTM:
+ 			ath11k_warn(ar->ab, "encountered unexpected device state %d on resume, cannot recover\n",
+ 				    ar->state);
+ 			ret = -EIO;
diff --git a/package/kernel/mac80211/patches/ath11k/0083-wifi-ath11k-Allow-ath11k-to-boot-without-caldata-in-.patch b/package/kernel/mac80211/patches/ath11k/0083-wifi-ath11k-Allow-ath11k-to-boot-without-caldata-in-.patch
new file mode 100644
index 000000000..5a1fa8829
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0083-wifi-ath11k-Allow-ath11k-to-boot-without-caldata-in-.patch
@@ -0,0 +1,47 @@
+From 8aeba427296bff6a6051686f1d139c89a0b00e4c Mon Sep 17 00:00:00 2001
+From: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
+Date: Fri, 26 May 2023 12:41:07 +0300
+Subject: [PATCH 84/84] wifi: ath11k: Allow ath11k to boot without caldata in
+ ftm mode
+
+Currently, if ath11k is unable to load the calibration data file it will
+always exit. However the calibration data may not be present in factory
+test mode, so update the logic to allow the driver to execute in FTM mode
+even if downloading the calibration data fails.
+
+Tested-on : IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
+Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230517135934.16408-5-quic_rajkbhag@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/qmi.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include <linux/elf.h>
+@@ -2460,6 +2460,14 @@ static int ath11k_qmi_load_bdf_qmi(struc
+ 
+ 		fw_entry = ath11k_core_firmware_request(ab, ATH11K_DEFAULT_CAL_FILE);
+ 		if (IS_ERR(fw_entry)) {
++			/* Caldata may not be present during first time calibration in
++			 * factory hence allow to boot without loading caldata in ftm mode
++			 */
++			if (ath11k_ftm_mode) {
++				ath11k_info(ab,
++					    "Booting without cal data file in factory test mode\n");
++				return 0;
++			}
+ 			ret = PTR_ERR(fw_entry);
+ 			ath11k_warn(ab,
+ 				    "qmi failed to load CAL data file:%s\n",
diff --git a/package/kernel/mac80211/patches/ath11k/0084-wifi-ath11k-Add-HTT-stats-for-PHY-reset-case.patch b/package/kernel/mac80211/patches/ath11k/0084-wifi-ath11k-Add-HTT-stats-for-PHY-reset-case.patch
new file mode 100644
index 000000000..946f5f7b5
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/0084-wifi-ath11k-Add-HTT-stats-for-PHY-reset-case.patch
@@ -0,0 +1,261 @@
+From 2d4f9093e2d8531ad0a2bb98fe5b36dc8addf2a2 Mon Sep 17 00:00:00 2001
+From: Nidhi Jain <quic_nidhjain@quicinc.com>
+Date: Fri, 26 May 2023 12:41:07 +0300
+Subject: [PATCH] wifi: ath11k: Add HTT stats for PHY reset case
+
+New HTT stats are added with stats type 37 to
+provide PHY reset stats and PHY reset counter stats.
+
+PHY reset stats are used to display the current
+PHY-related operation information such as band, CCA
+threshold, current operating channel etc.,
+
+PHY reset counter stats are used to display the
+PHY reset counter values like calibration counts,
+temperature based recalibration counts etc.,
+
+Usage:
+echo 37 > /sys/kernel/debug/ieee80211/phyX/ath11k/htt_stats_type
+cat /sys/kernel/debug/ieee80211/phyx/ath11k/htt_stats
+
+Output:
+
+HTT_PHY_RESET_STATS_TLV:
+pdev_id = 0
+chan_mhz = 5180
+chan_band_center_freq1 = 5210
+chan_band_center_freq2 = 0
+chan_phy_mode = 18
+chan_flags = 0x8
+chan_num = 36
+reset_cause = 0x50000
+prev_reset_cause = 0x50000
+phy_warm_reset_src = 0x0
+rx_gain_tbl_mode = 0
+xbar_val = 0xfac688
+force_calibration = 0
+phyrf_mode = 0
+phy_homechan = 0
+phy_tx_ch_mask = 0x3
+phy_rx_ch_mask = 0x3
+phybb_ini_mask = 0x5
+phyrf_ini_mask = 0x0
+phy_dfs_en_mask = 0x0
+phy_sscan_en_mask = 0x0
+phy_synth_sel_mask = 0x0
+phy_adfs_freq = 0
+cck_fir_settings = 0x0
+phy_dyn_pri_chan = 6
+cca_thresh = 0x26232020
+dyn_cca_status = 0
+rxdesense_thresh_hw = 0xcfe0afe
+rxdesense_thresh_sw = 0xcfe0afe
+
+HTT_PHY_RESET_COUNTERS_TLV:
+pdev_id = 0
+cf_active_low_fail_cnt = 0
+cf_active_low_pass_cnt = 0
+phy_off_through_vreg_cnt = 0
+force_calibration_cnt = 0
+rf_mode_switch_phy_off_cnt = 0
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Nidhi Jain <quic_nidhjain@quicinc.com>
+Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230517141242.2754293-1-quic_mkenna@quicinc.com
+---
+ .../wireless/ath/ath11k/debugfs_htt_stats.c   | 114 ++++++++++++++++++
+ .../wireless/ath/ath11k/debugfs_htt_stats.h   |  43 +++++++
+ 2 files changed, 157 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c
+@@ -4011,6 +4011,114 @@ void htt_print_phy_stats_tlv(const void
+ 	stats_req->buf_len = len;
+ }
+ 
++static inline void
++htt_print_phy_reset_counters_tlv(const void *tag_buf,
++				 u16 tag_len,
++				 struct debug_htt_stats_req *stats_req)
++{
++	const struct htt_phy_reset_counters_tlv *htt_stats_buf = tag_buf;
++	u8 *buf = stats_req->buf;
++	u32 len = stats_req->buf_len;
++	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
++
++	if (tag_len < sizeof(*htt_stats_buf))
++		return;
++
++	len += scnprintf(buf + len, buf_len - len, "HTT_PHY_RESET_COUNTERS_TLV:\n");
++
++	len += scnprintf(buf + len, buf_len - len, "pdev_id = %u\n",
++			 htt_stats_buf->pdev_id);
++	len += scnprintf(buf + len, buf_len - len, "cf_active_low_fail_cnt = %u\n",
++			 htt_stats_buf->cf_active_low_fail_cnt);
++	len += scnprintf(buf + len, buf_len - len, "cf_active_low_pass_cnt = %u\n",
++			 htt_stats_buf->cf_active_low_pass_cnt);
++	len += scnprintf(buf + len, buf_len - len, "phy_off_through_vreg_cnt = %u\n",
++			 htt_stats_buf->phy_off_through_vreg_cnt);
++	len += scnprintf(buf + len, buf_len - len, "force_calibration_cnt = %u\n",
++			 htt_stats_buf->force_calibration_cnt);
++	len += scnprintf(buf + len, buf_len - len, "rf_mode_switch_phy_off_cnt = %u\n",
++			 htt_stats_buf->rf_mode_switch_phy_off_cnt);
++
++	stats_req->buf_len = len;
++}
++
++static inline void
++htt_print_phy_reset_stats_tlv(const void *tag_buf,
++			      u16 tag_len,
++			      struct debug_htt_stats_req *stats_req)
++{
++	const struct htt_phy_reset_stats_tlv *htt_stats_buf = tag_buf;
++	u8 *buf = stats_req->buf;
++	u32 len = stats_req->buf_len;
++	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
++
++	if (tag_len < sizeof(*htt_stats_buf))
++		return;
++
++	len += scnprintf(buf + len, buf_len - len, "HTT_PHY_RESET_STATS_TLV:\n");
++
++	len += scnprintf(buf + len, buf_len - len, "pdev_id = %u\n",
++			 htt_stats_buf->pdev_id);
++	len += scnprintf(buf + len, buf_len - len, "chan_mhz = %u\n",
++			 htt_stats_buf->chan_mhz);
++	len += scnprintf(buf + len, buf_len - len, "chan_band_center_freq1 = %u\n",
++			 htt_stats_buf->chan_band_center_freq1);
++	len += scnprintf(buf + len, buf_len - len, "chan_band_center_freq2 = %u\n",
++			 htt_stats_buf->chan_band_center_freq2);
++	len += scnprintf(buf + len, buf_len - len, "chan_phy_mode = %u\n",
++			 htt_stats_buf->chan_phy_mode);
++	len += scnprintf(buf + len, buf_len - len, "chan_flags = 0x%0x\n",
++			 htt_stats_buf->chan_flags);
++	len += scnprintf(buf + len, buf_len - len, "chan_num = %u\n",
++			 htt_stats_buf->chan_num);
++	len += scnprintf(buf + len, buf_len - len, "reset_cause = 0x%0x\n",
++			 htt_stats_buf->reset_cause);
++	len += scnprintf(buf + len, buf_len - len, "prev_reset_cause = 0x%0x\n",
++			 htt_stats_buf->prev_reset_cause);
++	len += scnprintf(buf + len, buf_len - len, "phy_warm_reset_src = 0x%0x\n",
++			 htt_stats_buf->phy_warm_reset_src);
++	len += scnprintf(buf + len, buf_len - len, "rx_gain_tbl_mode = %d\n",
++			 htt_stats_buf->rx_gain_tbl_mode);
++	len += scnprintf(buf + len, buf_len - len, "xbar_val = 0x%0x\n",
++			 htt_stats_buf->xbar_val);
++	len += scnprintf(buf + len, buf_len - len, "force_calibration = %u\n",
++			 htt_stats_buf->force_calibration);
++	len += scnprintf(buf + len, buf_len - len, "phyrf_mode = %u\n",
++			 htt_stats_buf->phyrf_mode);
++	len += scnprintf(buf + len, buf_len - len, "phy_homechan = %u\n",
++			 htt_stats_buf->phy_homechan);
++	len += scnprintf(buf + len, buf_len - len, "phy_tx_ch_mask = 0x%0x\n",
++			 htt_stats_buf->phy_tx_ch_mask);
++	len += scnprintf(buf + len, buf_len - len, "phy_rx_ch_mask = 0x%0x\n",
++			 htt_stats_buf->phy_rx_ch_mask);
++	len += scnprintf(buf + len, buf_len - len, "phybb_ini_mask = 0x%0x\n",
++			 htt_stats_buf->phybb_ini_mask);
++	len += scnprintf(buf + len, buf_len - len, "phyrf_ini_mask = 0x%0x\n",
++			 htt_stats_buf->phyrf_ini_mask);
++	len += scnprintf(buf + len, buf_len - len, "phy_dfs_en_mask = 0x%0x\n",
++			 htt_stats_buf->phy_dfs_en_mask);
++	len += scnprintf(buf + len, buf_len - len, "phy_sscan_en_mask = 0x%0x\n",
++			 htt_stats_buf->phy_sscan_en_mask);
++	len += scnprintf(buf + len, buf_len - len, "phy_synth_sel_mask = 0x%0x\n",
++			 htt_stats_buf->phy_synth_sel_mask);
++	len += scnprintf(buf + len, buf_len - len, "phy_adfs_freq = %u\n",
++			 htt_stats_buf->phy_adfs_freq);
++	len += scnprintf(buf + len, buf_len - len, "cck_fir_settings = 0x%0x\n",
++			 htt_stats_buf->cck_fir_settings);
++	len += scnprintf(buf + len, buf_len - len, "phy_dyn_pri_chan = %u\n",
++			 htt_stats_buf->phy_dyn_pri_chan);
++	len += scnprintf(buf + len, buf_len - len, "cca_thresh = 0x%0x\n",
++			 htt_stats_buf->cca_thresh);
++	len += scnprintf(buf + len, buf_len - len, "dyn_cca_status = %u\n",
++			 htt_stats_buf->dyn_cca_status);
++	len += scnprintf(buf + len, buf_len - len, "rxdesense_thresh_hw = 0x%x\n",
++			 htt_stats_buf->rxdesense_thresh_hw);
++	len += scnprintf(buf + len, buf_len - len, "rxdesense_thresh_sw = 0x%x\n",
++			 htt_stats_buf->rxdesense_thresh_sw);
++
++	stats_req->buf_len = len;
++}
++
+ static inline
+ void htt_print_peer_ctrl_path_txrx_stats_tlv(const void *tag_buf,
+ 					     struct debug_htt_stats_req *stats_req)
+@@ -4425,6 +4533,12 @@ static int ath11k_dbg_htt_ext_stats_pars
+ 	case HTT_STATS_PHY_STATS_TAG:
+ 		htt_print_phy_stats_tlv(tag_buf, stats_req);
+ 		break;
++	case HTT_STATS_PHY_RESET_COUNTERS_TAG:
++		htt_print_phy_reset_counters_tlv(tag_buf, len, stats_req);
++		break;
++	case HTT_STATS_PHY_RESET_STATS_TAG:
++		htt_print_phy_reset_stats_tlv(tag_buf, len, stats_req);
++		break;
+ 	case HTT_STATS_PEER_CTRL_PATH_TXRX_STATS_TAG:
+ 		htt_print_peer_ctrl_path_txrx_stats_tlv(tag_buf, stats_req);
+ 		break;
+--- a/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.h
++++ b/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.h
+@@ -111,6 +111,8 @@ enum htt_tlv_tag_t {
+ 	HTT_STATS_TXBF_OFDMA_STEER_STATS_TAG		    = 116,
+ 	HTT_STATS_PHY_COUNTERS_TAG			    = 121,
+ 	HTT_STATS_PHY_STATS_TAG				    = 122,
++	HTT_STATS_PHY_RESET_COUNTERS_TAG		    = 123,
++	HTT_STATS_PHY_RESET_STATS_TAG			    = 124,
+ 
+ 	HTT_STATS_MAX_TAG,
+ };
+@@ -1964,6 +1966,47 @@ struct htt_phy_stats_tlv {
+ 	u32 fw_run_time;
+ };
+ 
++struct htt_phy_reset_counters_tlv {
++	u32 pdev_id;
++	u32 cf_active_low_fail_cnt;
++	u32 cf_active_low_pass_cnt;
++	u32 phy_off_through_vreg_cnt;
++	u32 force_calibration_cnt;
++	u32 rf_mode_switch_phy_off_cnt;
++};
++
++struct htt_phy_reset_stats_tlv {
++	u32 pdev_id;
++	u32 chan_mhz;
++	u32 chan_band_center_freq1;
++	u32 chan_band_center_freq2;
++	u32 chan_phy_mode;
++	u32 chan_flags;
++	u32 chan_num;
++	u32 reset_cause;
++	u32 prev_reset_cause;
++	u32 phy_warm_reset_src;
++	u32 rx_gain_tbl_mode;
++	u32 xbar_val;
++	u32 force_calibration;
++	u32 phyrf_mode;
++	u32 phy_homechan;
++	u32 phy_tx_ch_mask;
++	u32 phy_rx_ch_mask;
++	u32 phybb_ini_mask;
++	u32 phyrf_ini_mask;
++	u32 phy_dfs_en_mask;
++	u32 phy_sscan_en_mask;
++	u32 phy_synth_sel_mask;
++	u32 phy_adfs_freq;
++	u32 cck_fir_settings;
++	u32 phy_dyn_pri_chan;
++	u32 cca_thresh;
++	u32 dyn_cca_status;
++	u32 rxdesense_thresh_hw;
++	u32 rxdesense_thresh_sw;
++};
++
+ struct htt_peer_ctrl_path_txrx_stats_tlv {
+ 	/* peer mac address */
+ 	u8 peer_mac_addr[ETH_ALEN];
diff --git a/package/kernel/mac80211/patches/ath11k/100-wifi-ath11k-use-unique-QRTR-instance-ID.patch b/package/kernel/mac80211/patches/ath11k/100-wifi-ath11k-use-unique-QRTR-instance-ID.patch
new file mode 100644
index 000000000..39d5a61d5
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/100-wifi-ath11k-use-unique-QRTR-instance-ID.patch
@@ -0,0 +1,162 @@
+From 534a5f99d589cfa6b244b4433c192b6a278a67ff Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sat, 5 Nov 2022 20:15:40 +0100
+Subject: [PATCH] wifi: ath11k: use unique QRTR instance ID
+
+Currently, trying to use AHB + PCI/MHI cards or multiple PCI/MHI cards
+will cause a clash in the QRTR instance node ID and prevent the driver
+from talking via QMI to the card and thus initializing it with:
+[    9.836329] ath11k c000000.wifi: host capability request failed: 1 90
+[    9.842047] ath11k c000000.wifi: failed to send qmi host cap: -22
+
+So, in order to allow for this combination of cards, especially AHB + PCI
+cards like IPQ8074 + QCN9074 (Used by me and tested on) set the desired
+QRTR instance ID offset by calculating a unique one based on PCI domain
+and bus ID-s and writing it to bits 7-0 of BHI_ERRDBG2 MHI register by
+using the SBL state callback that is added as part of the series.
+We also have to make sure that new QRTR offset is added on top of the
+default QRTR instance ID-s that are currently used in the driver.
+
+This finally allows using AHB + PCI or multiple PCI cards on the same
+system.
+
+Since this is not supported on QCA6390 and like, its limited to QCN9074
+which is known to support changing QRTR instance ID.
+
+Before:
+root@OpenWrt:/# qrtr-lookup
+  Service Version Instance Node  Port
+     1054       1        0    7     1 <unknown>
+       69       1        2    7     3 ATH10k WLAN firmware service
+
+After:
+root@OpenWrt:/# qrtr-lookup
+  Service Version Instance Node  Port
+     1054       1        0    7     1 <unknown>
+       69       1        2    7     3 ATH10k WLAN firmware service
+       15       1        0    8     1 Test service
+       69       1        8    8     2 ATH10k WLAN firmware service
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/net/wireless/ath/ath11k/mhi.c | 49 ++++++++++++++++++---------
+ drivers/net/wireless/ath/ath11k/mhi.h |  3 ++
+ drivers/net/wireless/ath/ath11k/pci.c |  9 ++++-
+ 3 files changed, 44 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mhi.c
++++ b/drivers/net/wireless/ath/ath11k/mhi.c
+@@ -294,6 +294,34 @@ static void ath11k_mhi_op_runtime_put(st
+ {
+ }
+ 
++static int ath11k_mhi_op_read_reg(struct mhi_controller *mhi_cntrl,
++				  void __iomem *addr,
++				  u32 *out)
++{
++	*out = readl(addr);
++
++	return 0;
++}
++
++static void ath11k_mhi_op_write_reg(struct mhi_controller *mhi_cntrl,
++				    void __iomem *addr,
++				    u32 val)
++{
++	writel(val, addr);
++}
++
++static void ath11k_mhi_qrtr_instance_set(struct mhi_controller *mhi_cntrl)
++{
++	struct ath11k_base *ab = dev_get_drvdata(mhi_cntrl->cntrl_dev);
++
++	if (ab->hw_rev == ATH11K_HW_QCN9074_HW10) {
++		ath11k_mhi_op_write_reg(mhi_cntrl,
++					mhi_cntrl->bhi + BHI_ERRDBG2,
++					FIELD_PREP(QRTR_INSTANCE_MASK,
++					ab->qmi.service_ins_id - ab->hw_params.qmi_service_ins_id));
++	}
++}
++
+ static char *ath11k_mhi_op_callback_to_str(enum mhi_callback reason)
+ {
+ 	switch (reason) {
+@@ -315,6 +343,8 @@ static char *ath11k_mhi_op_callback_to_s
+ 		return "MHI_CB_FATAL_ERROR";
+ 	case MHI_CB_BW_REQ:
+ 		return "MHI_CB_BW_REQ";
++	case MHI_CB_EE_SBL_MODE:
++		return "MHI_CB_EE_SBL_MODE";
+ 	default:
+ 		return "UNKNOWN";
+ 	}
+@@ -336,27 +366,14 @@ static void ath11k_mhi_op_status_cb(stru
+ 		if (!(test_bit(ATH11K_FLAG_UNREGISTERING, &ab->dev_flags)))
+ 			queue_work(ab->workqueue_aux, &ab->reset_work);
+ 		break;
++	case MHI_CB_EE_SBL_MODE:
++		ath11k_mhi_qrtr_instance_set(mhi_cntrl);
++		break;
+ 	default:
+ 		break;
+ 	}
+ }
+ 
+-static int ath11k_mhi_op_read_reg(struct mhi_controller *mhi_cntrl,
+-				  void __iomem *addr,
+-				  u32 *out)
+-{
+-	*out = readl(addr);
+-
+-	return 0;
+-}
+-
+-static void ath11k_mhi_op_write_reg(struct mhi_controller *mhi_cntrl,
+-				    void __iomem *addr,
+-				    u32 val)
+-{
+-	writel(val, addr);
+-}
+-
+ static int ath11k_mhi_read_addr_from_dt(struct mhi_controller *mhi_ctrl)
+ {
+ 	struct device_node *np;
+--- a/drivers/net/wireless/ath/ath11k/mhi.h
++++ b/drivers/net/wireless/ath/ath11k/mhi.h
+@@ -16,6 +16,9 @@
+ #define MHICTRL					0x38
+ #define MHICTRL_RESET_MASK			0x2
+ 
++#define BHI_ERRDBG2				0x38
++#define QRTR_INSTANCE_MASK			GENMASK(7, 0)
++
+ int ath11k_mhi_start(struct ath11k_pci *ar_pci);
+ void ath11k_mhi_stop(struct ath11k_pci *ar_pci);
+ int ath11k_mhi_register(struct ath11k_pci *ar_pci);
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -370,13 +370,20 @@ static void ath11k_pci_sw_reset(struct a
+ static void ath11k_pci_init_qmi_ce_config(struct ath11k_base *ab)
+ {
+ 	struct ath11k_qmi_ce_cfg *cfg = &ab->qmi.ce_cfg;
++	struct ath11k_pci *ab_pci = ath11k_pci_priv(ab);
++	struct pci_bus *bus = ab_pci->pdev->bus;
+ 
+ 	cfg->tgt_ce = ab->hw_params.target_ce_config;
+ 	cfg->tgt_ce_len = ab->hw_params.target_ce_count;
+ 
+ 	cfg->svc_to_ce_map = ab->hw_params.svc_to_ce_map;
+ 	cfg->svc_to_ce_map_len = ab->hw_params.svc_to_ce_map_len;
+-	ab->qmi.service_ins_id = ab->hw_params.qmi_service_ins_id;
++
++	if (ab->hw_rev == ATH11K_HW_QCN9074_HW10) {
++		ab->qmi.service_ins_id = ab->hw_params.qmi_service_ins_id +
++		(((pci_domain_nr(bus) & 0xF) << 4) | (bus->number & 0xF));
++	} else
++		ab->qmi.service_ins_id = ab->hw_params.qmi_service_ins_id;
+ 
+ 	ath11k_ce_get_shadow_config(ab, &cfg->shadow_reg_v2,
+ 				    &cfg->shadow_reg_v2_len);
diff --git a/package/kernel/mac80211/patches/ath11k/900-ath11k-control-thermal-support-via-symbol.patch b/package/kernel/mac80211/patches/ath11k/900-ath11k-control-thermal-support-via-symbol.patch
new file mode 100644
index 000000000..60720a721
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/900-ath11k-control-thermal-support-via-symbol.patch
@@ -0,0 +1,66 @@
+From 703d6551f71e7290619d6effe2a25a64e10538b7 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Thu, 15 Dec 2022 12:20:52 +0100
+Subject: [PATCH] ath11k: control thermal support via symbol
+
+Currently, thermal support will get built if CONFIG_THERMAL is reachable,
+however this is not suitable for OpenWrt as with ALL_KMODS being set to y
+ATH11K_THERMAL wont get selected and so hwmon and thermal kmods wont get
+pulled in resulting in a build-failure.
+
+So, to avoid that, lets do what is already done for ath10k and add a
+config symbol into backports for enabling thermal support.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/net/wireless/ath/ath11k/Kconfig   | 7 +++++++
+ drivers/net/wireless/ath/ath11k/Makefile  | 2 +-
+ drivers/net/wireless/ath/ath11k/thermal.h | 2 +-
+ local-symbols                             | 1 +
+ 4 files changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/Kconfig
++++ b/drivers/net/wireless/ath/ath11k/Kconfig
+@@ -61,3 +61,10 @@ config ATH11K_SPECTRAL
+ 	  Enable ath11k spectral scan support
+ 
+ 	  Say Y to enable access to the FFT/spectral data via debugfs.
++
++config ATH11K_THERMAL
++	bool "ath11k thermal sensors and throttling support"
++	depends on ATH11K
++	depends on THERMAL
++	help
++	  Enable ath11k thermal sensors and throttling support.
+--- a/drivers/net/wireless/ath/ath11k/Makefile
++++ b/drivers/net/wireless/ath/ath11k/Makefile
+@@ -22,7 +22,7 @@ ath11k-y += core.o \
+ ath11k-$(CPTCFG_ATH11K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o
+ ath11k-$(CPTCFG_NL80211_TESTMODE) += testmode.o
+ ath11k-$(CPTCFG_ATH11K_TRACING) += trace.o
+-ath11k-$(CONFIG_THERMAL) += thermal.o
++ath11k-$(CPTCFG_ATH11K_THERMAL) += thermal.o
+ ath11k-$(CPTCFG_ATH11K_SPECTRAL) += spectral.o
+ ath11k-$(CONFIG_PM) += wow.o
+ 
+--- a/drivers/net/wireless/ath/ath11k/thermal.h
++++ b/drivers/net/wireless/ath/ath11k/thermal.h
+@@ -25,7 +25,7 @@ struct ath11k_thermal {
+ 	int temperature;
+ };
+ 
+-#if IS_REACHABLE(CONFIG_THERMAL)
++#if IS_REACHABLE(CPTCFG_ATH11K_THERMAL)
+ int ath11k_thermal_register(struct ath11k_base *sc);
+ void ath11k_thermal_unregister(struct ath11k_base *sc);
+ int ath11k_thermal_set_throttling(struct ath11k *ar, u32 throttle_state);
+--- a/local-symbols
++++ b/local-symbols
+@@ -174,6 +174,7 @@ ATH11K_DEBUG=
+ ATH11K_DEBUGFS=
+ ATH11K_TRACING=
+ ATH11K_SPECTRAL=
++ATH11K_THERMAL=
+ WLAN_VENDOR_ATMEL=
+ ATMEL=
+ PCI_ATMEL=
diff --git a/package/kernel/mac80211/patches/ath11k/901-wifi-ath11k-pci-fix-compilation-in-5.16-and-older.patch b/package/kernel/mac80211/patches/ath11k/901-wifi-ath11k-pci-fix-compilation-in-5.16-and-older.patch
new file mode 100644
index 000000000..721565638
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/901-wifi-ath11k-pci-fix-compilation-in-5.16-and-older.patch
@@ -0,0 +1,29 @@
+From 04178918e7f6b5f34dde81ec79ee8a1ccace3be3 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Mon, 17 Oct 2022 11:45:03 +0200
+Subject: [PATCH] wifi: ath11k: pci: fix compilation in 5.16 and older
+
+Commit ("genirq/msi, treewide: Use a named struct for PCI/MSI attributes")
+changed the msi_desc structure a bit, however that is only available in
+kernels 5.17 and newer, so check for kernel version to allow compilation
+in 5.16 and older.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/net/wireless/ath/ath11k/pci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -458,7 +458,11 @@ static int ath11k_pci_alloc_msi(struct a
+ 	pci_read_config_dword(pci_dev, pci_dev->msi_cap + PCI_MSI_ADDRESS_LO,
+ 			      &ab->pci.msi.addr_lo);
+ 
++#if (LINUX_VERSION_CODE > KERNEL_VERSION(5, 17, 0))
+ 	if (msi_desc->pci.msi_attrib.is_64) {
++#else
++	if (msi_desc->msi_attrib.is_64) {
++#endif
+ 		pci_read_config_dword(pci_dev, pci_dev->msi_cap + PCI_MSI_ADDRESS_HI,
+ 				      &ab->pci.msi.addr_hi);
+ 	} else {
diff --git a/package/kernel/mac80211/patches/ath11k/902-ath11k-Disable-coldboot-calibration-for-IPQ8074.patch b/package/kernel/mac80211/patches/ath11k/902-ath11k-Disable-coldboot-calibration-for-IPQ8074.patch
new file mode 100644
index 000000000..5454fa75e
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/902-ath11k-Disable-coldboot-calibration-for-IPQ8074.patch
@@ -0,0 +1,24 @@
+From dd3b9c59cfa1e9e0b73a575f4646be905691eaef Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sat, 16 Oct 2021 19:34:10 +0200
+Subject: [PATCH 241/241] ath11k: Disable coldboot calibration for IPQ8074
+
+There is a bug with the remoteproc reset after coldboot calibration,
+so until that is resolved disabled it to allow using the radio.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/net/wireless/ath/ath11k/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -86,7 +86,7 @@ static const struct ath11k_hw_params ath
+ 		.supports_shadow_regs = false,
+ 		.idle_ps = false,
+ 		.supports_sta_ps = false,
+-		.cold_boot_calib = true,
++		.cold_boot_calib = false,
+ 		.cbcal_restart_fw = true,
+ 		.fw_mem_mode = 0,
+ 		.num_vdevs = 16 + 1,
diff --git a/package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch b/package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch
new file mode 100644
index 000000000..22c2493ca
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch
@@ -0,0 +1,74 @@
+From fb1c40c225cbc413d82c872dd8c8af3469b2b921 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Fri, 16 Dec 2022 17:17:52 +0100
+Subject: [PATCH] ath11k: support setting FW memory mode via DT
+
+ath11k is really memory intensive for devices with less that 1GB of RAM,
+so lets allow saving a significant amount of memory by setting the FW to
+Mode-1 via DTS for devices that need it.
+
+However the drawback is reduced number of VDEV-s and peers which is a
+reasonable tradeoff.
+
+Mode-2 allows for further reduction, but it has further restrictions.
+
+While we are here, lets add a print to be able to easily determine what
+FW memory mode is being used.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ drivers/net/wireless/ath/ath11k/core.c | 28 ++++++++++++++++++++++++--
+ 1 file changed, 26 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -36,7 +36,7 @@ bool ath11k_ftm_mode;
+ module_param_named(ftm_mode, ath11k_ftm_mode, bool, 0444);
+ MODULE_PARM_DESC(ftm_mode, "Boots up in factory test mode");
+ 
+-static const struct ath11k_hw_params ath11k_hw_params[] = {
++static struct ath11k_hw_params ath11k_hw_params[] = {
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ8074,
+ 		.name = "ipq8074 hw2.0",
+@@ -1953,7 +1953,8 @@ static void ath11k_core_reset(struct wor
+ static int ath11k_init_hw_params(struct ath11k_base *ab)
+ {
+ 	const struct ath11k_hw_params *hw_params = NULL;
+-	int i;
++	u32 fw_mem_mode;
++	int i, ret;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(ath11k_hw_params); i++) {
+ 		hw_params = &ath11k_hw_params[i];
+@@ -1969,7 +1970,30 @@ static int ath11k_init_hw_params(struct
+ 
+ 	ab->hw_params = *hw_params;
+ 
++	ret = of_property_read_u32(ab->dev->of_node,
++				   "qcom,ath11k-fw-memory-mode",
++				   &fw_mem_mode);
++	if (!ret) {
++		if (fw_mem_mode == 0) {
++			ab->hw_params.fw_mem_mode = 0;
++			ab->hw_params.num_vdevs = 16 + 1;
++			ab->hw_params.num_peers = 512;
++		}
++		else if (fw_mem_mode == 1) {
++			ab->hw_params.fw_mem_mode = 1;
++			ab->hw_params.num_vdevs = 8;
++			ab->hw_params.num_peers = 128;
++		} else if (fw_mem_mode == 2) {
++			ab->hw_params.fw_mem_mode = 2;
++			ab->hw_params.num_vdevs = 8;
++			ab->hw_params.num_peers = 128;
++			ab->hw_params.cold_boot_calib = false;
++		} else
++			ath11k_info(ab, "Unsupported FW memory mode: %u\n", fw_mem_mode);
++	}
++
+ 	ath11k_info(ab, "%s\n", ab->hw_params.name);
++	ath11k_info(ab, "FW memory mode: %d\n", ab->hw_params.fw_mem_mode);
+ 
+ 	return 0;
+ }
diff --git a/package/kernel/mac80211/patches/ath11k/905-ath11k-remove-intersection-support-for-regulatory-ru.patch b/package/kernel/mac80211/patches/ath11k/905-ath11k-remove-intersection-support-for-regulatory-ru.patch
new file mode 100644
index 000000000..b0ceb00ba
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/905-ath11k-remove-intersection-support-for-regulatory-ru.patch
@@ -0,0 +1,317 @@
+From abdd0985a36189ef2cc0e393b027276e86137ace Mon Sep 17 00:00:00 2001
+From: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Date: Tue, 11 Apr 2023 20:08:49 +0200
+Subject: [PATCH] ath11k: remove intersection support for regulatory rules
+
+Currently, regulatory rules from new country settings is intersected with
+rules from default country settings(during initialisation) in order to prevent
+users to bypass their default country settings such as power limits, channel
+flags, etc.
+
+However, the country setting in the BDF will take higher higher precendence
+and FW will protect it. Therefore, there is no need to handle intersection
+on the driver side now.
+
+Remove regulatory rules intersection logic support.
+
+Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/reg.c | 168 +++-----------------------
+ drivers/net/wireless/ath/ath11k/reg.h |   2 +-
+ drivers/net/wireless/ath/ath11k/wmi.c |  24 +---
+ 3 files changed, 16 insertions(+), 178 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -352,129 +352,6 @@ static u32 ath11k_map_fw_reg_flags(u16 r
+ 	return flags;
+ }
+ 
+-static bool
+-ath11k_reg_can_intersect(struct ieee80211_reg_rule *rule1,
+-			 struct ieee80211_reg_rule *rule2)
+-{
+-	u32 start_freq1, end_freq1;
+-	u32 start_freq2, end_freq2;
+-
+-	start_freq1 = rule1->freq_range.start_freq_khz;
+-	start_freq2 = rule2->freq_range.start_freq_khz;
+-
+-	end_freq1 = rule1->freq_range.end_freq_khz;
+-	end_freq2 = rule2->freq_range.end_freq_khz;
+-
+-	if ((start_freq1 >= start_freq2 &&
+-	     start_freq1 < end_freq2) ||
+-	    (start_freq2 > start_freq1 &&
+-	     start_freq2 < end_freq1))
+-		return true;
+-
+-	/* TODO: Should we restrict intersection feasibility
+-	 *  based on min bandwidth of the intersected region also,
+-	 *  say the intersected rule should have a  min bandwidth
+-	 * of 20MHz?
+-	 */
+-
+-	return false;
+-}
+-
+-static void ath11k_reg_intersect_rules(struct ieee80211_reg_rule *rule1,
+-				       struct ieee80211_reg_rule *rule2,
+-				       struct ieee80211_reg_rule *new_rule)
+-{
+-	u32 start_freq1, end_freq1;
+-	u32 start_freq2, end_freq2;
+-	u32 freq_diff, max_bw;
+-
+-	start_freq1 = rule1->freq_range.start_freq_khz;
+-	start_freq2 = rule2->freq_range.start_freq_khz;
+-
+-	end_freq1 = rule1->freq_range.end_freq_khz;
+-	end_freq2 = rule2->freq_range.end_freq_khz;
+-
+-	new_rule->freq_range.start_freq_khz = max_t(u32, start_freq1,
+-						    start_freq2);
+-	new_rule->freq_range.end_freq_khz = min_t(u32, end_freq1, end_freq2);
+-
+-	freq_diff = new_rule->freq_range.end_freq_khz -
+-			new_rule->freq_range.start_freq_khz;
+-	max_bw = min_t(u32, rule1->freq_range.max_bandwidth_khz,
+-		       rule2->freq_range.max_bandwidth_khz);
+-	new_rule->freq_range.max_bandwidth_khz = min_t(u32, max_bw, freq_diff);
+-
+-	new_rule->power_rule.max_antenna_gain =
+-		min_t(u32, rule1->power_rule.max_antenna_gain,
+-		      rule2->power_rule.max_antenna_gain);
+-
+-	new_rule->power_rule.max_eirp = min_t(u32, rule1->power_rule.max_eirp,
+-					      rule2->power_rule.max_eirp);
+-
+-	/* Use the flags of both the rules */
+-	new_rule->flags = rule1->flags | rule2->flags;
+-
+-	/* To be safe, lts use the max cac timeout of both rules */
+-	new_rule->dfs_cac_ms = max_t(u32, rule1->dfs_cac_ms,
+-				     rule2->dfs_cac_ms);
+-}
+-
+-static struct ieee80211_regdomain *
+-ath11k_regd_intersect(struct ieee80211_regdomain *default_regd,
+-		      struct ieee80211_regdomain *curr_regd)
+-{
+-	u8 num_old_regd_rules, num_curr_regd_rules, num_new_regd_rules;
+-	struct ieee80211_reg_rule *old_rule, *curr_rule, *new_rule;
+-	struct ieee80211_regdomain *new_regd = NULL;
+-	u8 i, j, k;
+-
+-	num_old_regd_rules = default_regd->n_reg_rules;
+-	num_curr_regd_rules = curr_regd->n_reg_rules;
+-	num_new_regd_rules = 0;
+-
+-	/* Find the number of intersecting rules to allocate new regd memory */
+-	for (i = 0; i < num_old_regd_rules; i++) {
+-		old_rule = default_regd->reg_rules + i;
+-		for (j = 0; j < num_curr_regd_rules; j++) {
+-			curr_rule = curr_regd->reg_rules + j;
+-
+-			if (ath11k_reg_can_intersect(old_rule, curr_rule))
+-				num_new_regd_rules++;
+-		}
+-	}
+-
+-	if (!num_new_regd_rules)
+-		return NULL;
+-
+-	new_regd = kzalloc(sizeof(*new_regd) + (num_new_regd_rules *
+-			sizeof(struct ieee80211_reg_rule)),
+-			GFP_ATOMIC);
+-
+-	if (!new_regd)
+-		return NULL;
+-
+-	/* We set the new country and dfs region directly and only trim
+-	 * the freq, power, antenna gain by intersecting with the
+-	 * default regdomain. Also MAX of the dfs cac timeout is selected.
+-	 */
+-	new_regd->n_reg_rules = num_new_regd_rules;
+-	memcpy(new_regd->alpha2, curr_regd->alpha2, sizeof(new_regd->alpha2));
+-	new_regd->dfs_region = curr_regd->dfs_region;
+-	new_rule = new_regd->reg_rules;
+-
+-	for (i = 0, k = 0; i < num_old_regd_rules; i++) {
+-		old_rule = default_regd->reg_rules + i;
+-		for (j = 0; j < num_curr_regd_rules; j++) {
+-			curr_rule = curr_regd->reg_rules + j;
+-
+-			if (ath11k_reg_can_intersect(old_rule, curr_rule))
+-				ath11k_reg_intersect_rules(old_rule, curr_rule,
+-							   (new_rule + k++));
+-		}
+-	}
+-	return new_regd;
+-}
+-
+ static const char *
+ ath11k_reg_get_regdom_str(enum nl80211_dfs_regions dfs_region)
+ {
+@@ -609,9 +486,9 @@ ath11k_reg_update_weather_radar_band(str
+ 
+ struct ieee80211_regdomain *
+ ath11k_reg_build_regd(struct ath11k_base *ab,
+-		      struct cur_regulatory_info *reg_info, bool intersect)
++		      struct cur_regulatory_info *reg_info)
+ {
+-	struct ieee80211_regdomain *tmp_regd, *default_regd, *new_regd = NULL;
++	struct ieee80211_regdomain *new_regd = NULL;
+ 	struct cur_reg_rule *reg_rule;
+ 	u8 i = 0, j = 0, k = 0;
+ 	u8 num_rules;
+@@ -628,26 +505,26 @@ ath11k_reg_build_regd(struct ath11k_base
+ 		num_rules += reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP];
+ 
+ 	if (!num_rules)
+-		goto ret;
++		return new_regd;
+ 
+ 	/* Add max additional rules to accommodate weather radar band */
+ 	if (reg_info->dfs_region == ATH11K_DFS_REG_ETSI)
+ 		num_rules += 2;
+ 
+-	tmp_regd =  kzalloc(sizeof(*tmp_regd) +
++	new_regd =  kzalloc(sizeof(*new_regd) +
+ 			(num_rules * sizeof(struct ieee80211_reg_rule)),
+ 			GFP_ATOMIC);
+-	if (!tmp_regd)
+-		goto ret;
++	if (!new_regd)
++		return new_regd;
+ 
+-	memcpy(tmp_regd->alpha2, reg_info->alpha2, REG_ALPHA2_LEN + 1);
++	memcpy(new_regd->alpha2, reg_info->alpha2, REG_ALPHA2_LEN + 1);
+ 	memcpy(alpha2, reg_info->alpha2, REG_ALPHA2_LEN + 1);
+ 	alpha2[2] = '\0';
+-	tmp_regd->dfs_region = ath11k_map_fw_dfs_region(reg_info->dfs_region);
++	new_regd->dfs_region = ath11k_map_fw_dfs_region(reg_info->dfs_region);
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_REG,
+ 		   "Country %s, CFG Regdomain %s FW Regdomain %d, num_reg_rules %d\n",
+-		   alpha2, ath11k_reg_get_regdom_str(tmp_regd->dfs_region),
++		   alpha2, ath11k_reg_get_regdom_str(new_regd->dfs_region),
+ 		   reg_info->dfs_region, num_rules);
+ 	/* Update reg_rules[] below. Firmware is expected to
+ 	 * send these rules in order(2 GHz rules first and then 5 GHz)
+@@ -686,7 +563,7 @@ ath11k_reg_build_regd(struct ath11k_base
+ 
+ 		flags |= ath11k_map_fw_reg_flags(reg_rule->flags);
+ 
+-		ath11k_reg_update_rule(tmp_regd->reg_rules + i,
++		ath11k_reg_update_rule(new_regd->reg_rules + i,
+ 				       reg_rule->start_freq,
+ 				       reg_rule->end_freq, max_bw,
+ 				       reg_rule->ant_gain, reg_rule->reg_power,
+@@ -701,7 +578,7 @@ ath11k_reg_build_regd(struct ath11k_base
+ 		    reg_info->dfs_region == ATH11K_DFS_REG_ETSI &&
+ 		    (reg_rule->end_freq > ETSI_WEATHER_RADAR_BAND_LOW &&
+ 		    reg_rule->start_freq < ETSI_WEATHER_RADAR_BAND_HIGH)){
+-			ath11k_reg_update_weather_radar_band(ab, tmp_regd,
++			ath11k_reg_update_weather_radar_band(ab, new_regd,
+ 							     reg_rule, &i,
+ 							     flags, max_bw);
+ 			continue;
+@@ -712,37 +589,20 @@ ath11k_reg_build_regd(struct ath11k_base
+ 				   "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d) (%d, %d)\n",
+ 				   i + 1, reg_rule->start_freq, reg_rule->end_freq,
+ 				   max_bw, reg_rule->ant_gain, reg_rule->reg_power,
+-				   tmp_regd->reg_rules[i].dfs_cac_ms, flags,
++				   new_regd->reg_rules[i].dfs_cac_ms, flags,
+ 				   reg_rule->psd_flag, reg_rule->psd_eirp);
+ 		} else {
+ 			ath11k_dbg(ab, ATH11K_DBG_REG,
+ 				   "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
+ 				   i + 1, reg_rule->start_freq, reg_rule->end_freq,
+ 				   max_bw, reg_rule->ant_gain, reg_rule->reg_power,
+-				   tmp_regd->reg_rules[i].dfs_cac_ms,
++				   new_regd->reg_rules[i].dfs_cac_ms,
+ 				   flags);
+ 		}
+ 	}
+ 
+-	tmp_regd->n_reg_rules = i;
+-
+-	if (intersect) {
+-		default_regd = ab->default_regd[reg_info->phy_id];
+-
+-		/* Get a new regd by intersecting the received regd with
+-		 * our default regd.
+-		 */
+-		new_regd = ath11k_regd_intersect(default_regd, tmp_regd);
+-		kfree(tmp_regd);
+-		if (!new_regd) {
+-			ath11k_warn(ab, "Unable to create intersected regdomain\n");
+-			goto ret;
+-		}
+-	} else {
+-		new_regd = tmp_regd;
+-	}
++	new_regd->n_reg_rules = i;
+ 
+-ret:
+ 	return new_regd;
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/reg.h
++++ b/drivers/net/wireless/ath/ath11k/reg.h
+@@ -30,7 +30,7 @@ void ath11k_reg_free(struct ath11k_base
+ void ath11k_regd_update_work(struct work_struct *work);
+ struct ieee80211_regdomain *
+ ath11k_reg_build_regd(struct ath11k_base *ab,
+-		      struct cur_regulatory_info *reg_info, bool intersect);
++		      struct cur_regulatory_info *reg_info);
+ int ath11k_regd_update(struct ath11k *ar);
+ int ath11k_reg_update_chan_list(struct ath11k *ar, bool wait);
+ #endif
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -6996,24 +6996,12 @@ static void ath11k_wmi_htc_tx_complete(s
+ 		wake_up(&wmi->tx_ce_desc_wq);
+ }
+ 
+-static bool ath11k_reg_is_world_alpha(char *alpha)
+-{
+-	if (alpha[0] == '0' && alpha[1] == '0')
+-		return true;
+-
+-	if (alpha[0] == 'n' && alpha[1] == 'a')
+-		return true;
+-
+-	return false;
+-}
+-
+ static int ath11k_reg_chan_list_event(struct ath11k_base *ab,
+ 				      struct sk_buff *skb,
+ 				      enum wmi_reg_chan_list_cmd_type id)
+ {
+ 	struct cur_regulatory_info *reg_info = NULL;
+ 	struct ieee80211_regdomain *regd = NULL;
+-	bool intersect = false;
+ 	int ret = 0, pdev_idx, i, j;
+ 	struct ath11k *ar;
+ 
+@@ -7075,17 +7063,7 @@ static int ath11k_reg_chan_list_event(st
+ 		    (char *)reg_info->alpha2, 2))
+ 		goto mem_free;
+ 
+-	/* Intersect new rules with default regd if a new country setting was
+-	 * requested, i.e a default regd was already set during initialization
+-	 * and the regd coming from this event has a valid country info.
+-	 */
+-	if (ab->default_regd[pdev_idx] &&
+-	    !ath11k_reg_is_world_alpha((char *)
+-		ab->default_regd[pdev_idx]->alpha2) &&
+-	    !ath11k_reg_is_world_alpha((char *)reg_info->alpha2))
+-		intersect = true;
+-
+-	regd = ath11k_reg_build_regd(ab, reg_info, intersect);
++	regd = ath11k_reg_build_regd(ab, reg_info);
+ 	if (!regd) {
+ 		ath11k_warn(ab, "failed to build regd from reg_info\n");
+ 		goto fallback;
diff --git a/package/kernel/mac80211/patches/ath/201-ath5k-WAR-for-AR71xx-PCI-bug.patch b/package/kernel/mac80211/patches/ath5k/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
similarity index 95%
rename from package/kernel/mac80211/patches/ath/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
rename to package/kernel/mac80211/patches/ath5k/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
index 21516ffde..4fc97dfae 100644
--- a/package/kernel/mac80211/patches/ath/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
+++ b/package/kernel/mac80211/patches/ath5k/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
@@ -17,7 +17,7 @@
  	{ AR5K_RXNOFRM,		8 },
 --- a/drivers/net/wireless/ath/ath5k/dma.c
 +++ b/drivers/net/wireless/ath/ath5k/dma.c
-@@ -869,10 +869,18 @@ ath5k_hw_dma_init(struct ath5k_hw *ah)
+@@ -854,10 +854,18 @@ ath5k_hw_dma_init(struct ath5k_hw *ah)
  	 * guess we can tweak it and see how it goes ;-)
  	 */
  	if (ah->ah_version != AR5K_AR5210) {
diff --git a/package/kernel/mac80211/patches/ath/411-ath5k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/ath5k/411-ath5k_allow_adhoc_and_ap.patch
similarity index 89%
rename from package/kernel/mac80211/patches/ath/411-ath5k_allow_adhoc_and_ap.patch
rename to package/kernel/mac80211/patches/ath5k/411-ath5k_allow_adhoc_and_ap.patch
index 9dbe047c9..1df4aab57 100644
--- a/package/kernel/mac80211/patches/ath/411-ath5k_allow_adhoc_and_ap.patch
+++ b/package/kernel/mac80211/patches/ath5k/411-ath5k_allow_adhoc_and_ap.patch
@@ -18,7 +18,7 @@
  		goto end;
 --- a/drivers/net/wireless/ath/ath5k/base.c
 +++ b/drivers/net/wireless/ath/ath5k/base.c
-@@ -1964,7 +1964,7 @@ ath5k_beacon_send(struct ath5k_hw *ah)
+@@ -2009,7 +2009,7 @@ ath5k_beacon_send(struct ath5k_hw *ah)
  	}
  
  	if ((ah->opmode == NL80211_IFTYPE_AP && ah->num_ap_vifs +
@@ -27,7 +27,7 @@
  			ah->opmode == NL80211_IFTYPE_MESH_POINT) {
  		u64 tsf = ath5k_hw_get_tsf64(ah);
  		u32 tsftu = TSF_TO_TU(tsf);
-@@ -2050,7 +2050,7 @@ ath5k_beacon_update_timers(struct ath5k_
+@@ -2095,7 +2095,7 @@ ath5k_beacon_update_timers(struct ath5k_
  
  	intval = ah->bintval & AR5K_BEACON_PERIOD;
  	if (ah->opmode == NL80211_IFTYPE_AP && ah->num_ap_vifs
@@ -36,7 +36,7 @@
  		intval /= ATH_BCBUF;	/* staggered multi-bss beacons */
  		if (intval < 15)
  			ATH5K_WARN(ah, "intval %u is too low, min 15\n",
-@@ -2516,6 +2516,7 @@ static const struct ieee80211_iface_limi
+@@ -2561,6 +2561,7 @@ static const struct ieee80211_iface_limi
  				 BIT(NL80211_IFTYPE_MESH_POINT) |
  #endif
  				 BIT(NL80211_IFTYPE_AP) },
diff --git a/package/kernel/mac80211/patches/ath/420-ath5k_disable_fast_cc.patch b/package/kernel/mac80211/patches/ath5k/420-ath5k_disable_fast_cc.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/420-ath5k_disable_fast_cc.patch
rename to package/kernel/mac80211/patches/ath5k/420-ath5k_disable_fast_cc.patch
diff --git a/package/kernel/mac80211/patches/ath/430-add_ath5k_platform.patch b/package/kernel/mac80211/patches/ath5k/430-add_ath5k_platform.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/430-add_ath5k_platform.patch
rename to package/kernel/mac80211/patches/ath5k/430-add_ath5k_platform.patch
diff --git a/package/kernel/mac80211/patches/ath/432-ath5k_add_pciids.patch b/package/kernel/mac80211/patches/ath5k/432-ath5k_add_pciids.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/432-ath5k_add_pciids.patch
rename to package/kernel/mac80211/patches/ath5k/432-ath5k_add_pciids.patch
diff --git a/package/kernel/mac80211/patches/ath/440-ath5k_channel_bw_debugfs.patch b/package/kernel/mac80211/patches/ath5k/440-ath5k_channel_bw_debugfs.patch
similarity index 98%
rename from package/kernel/mac80211/patches/ath/440-ath5k_channel_bw_debugfs.patch
rename to package/kernel/mac80211/patches/ath5k/440-ath5k_channel_bw_debugfs.patch
index 92fb90c16..a63f0c881 100644
--- a/package/kernel/mac80211/patches/ath/440-ath5k_channel_bw_debugfs.patch
+++ b/package/kernel/mac80211/patches/ath5k/440-ath5k_channel_bw_debugfs.patch
@@ -130,7 +130,7 @@ drivers/net/wireless/ath/ath5k/debug.c |   86 ++++++++++++++++++++++++++++++++
  	/* Antenna Control */
 --- a/drivers/net/wireless/ath/ath5k/base.c
 +++ b/drivers/net/wireless/ath/ath5k/base.c
-@@ -466,6 +466,9 @@ ath5k_chan_set(struct ath5k_hw *ah, stru
+@@ -465,6 +465,9 @@ ath5k_chan_set(struct ath5k_hw *ah, stru
  		return -EINVAL;
  	}
  
diff --git a/package/kernel/mac80211/patches/ath/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch b/package/kernel/mac80211/patches/ath9k/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
similarity index 89%
rename from package/kernel/mac80211/patches/ath/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
rename to package/kernel/mac80211/patches/ath9k/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
index d648a3a3e..3a0171d4a 100644
--- a/package/kernel/mac80211/patches/ath/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
+++ b/package/kernel/mac80211/patches/ath9k/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
@@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1435,8 +1435,12 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1434,8 +1434,12 @@ static bool ath9k_hw_set_reset(struct at
  	if (!AR_SREV_9100(ah))
  		REG_WRITE(ah, AR_RC, 0);
  
diff --git a/package/kernel/mac80211/patches/ath/351-ath9k_hw-issue-external-reset-for-QCA955x.patch b/package/kernel/mac80211/patches/ath9k/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
similarity index 95%
rename from package/kernel/mac80211/patches/ath/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
rename to package/kernel/mac80211/patches/ath9k/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
index 5f265b84c..53b7ba08b 100644
--- a/package/kernel/mac80211/patches/ath/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
+++ b/package/kernel/mac80211/patches/ath9k/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1312,39 +1312,56 @@ void ath9k_hw_get_delta_slope_vals(struc
+@@ -1311,39 +1311,56 @@ void ath9k_hw_get_delta_slope_vals(struc
  	*coef_exponent = coef_exp - 16;
  }
  
@@ -94,7 +94,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	return true;
  }
  
-@@ -1397,24 +1414,24 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1396,24 +1413,24 @@ static bool ath9k_hw_set_reset(struct at
  			rst_flags |= AR_RTC_RC_MAC_COLD;
  	}
  
diff --git a/package/kernel/mac80211/patches/ath/354-ath9k-force-rx_clear-when-disabling-rx.patch b/package/kernel/mac80211/patches/ath9k/354-ath9k-force-rx_clear-when-disabling-rx.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/354-ath9k-force-rx_clear-when-disabling-rx.patch
rename to package/kernel/mac80211/patches/ath9k/354-ath9k-force-rx_clear-when-disabling-rx.patch
diff --git a/package/kernel/mac80211/patches/ath/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch b/package/kernel/mac80211/patches/ath9k/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
similarity index 89%
rename from package/kernel/mac80211/patches/ath/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
rename to package/kernel/mac80211/patches/ath9k/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
index 406d03e2f..385eea011 100644
--- a/package/kernel/mac80211/patches/ath/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
+++ b/package/kernel/mac80211/patches/ath9k/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
@@ -8,7 +8,7 @@ This reverts commit 71f5137bf010c6faffab50c0ec15374c59c4a411.
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2979,7 +2979,8 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2977,7 +2977,8 @@ void ath9k_hw_apply_txpower(struct ath_h
  {
  	struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
  	struct ieee80211_channel *channel;
@@ -18,7 +18,7 @@ This reverts commit 71f5137bf010c6faffab50c0ec15374c59c4a411.
  	u16 ctl = NO_CTL;
  
  	if (!chan)
-@@ -2991,9 +2992,14 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2989,9 +2990,14 @@ void ath9k_hw_apply_txpower(struct ath_h
  	channel = chan->chan;
  	chan_pwr = min_t(int, channel->max_power * 2, MAX_COMBINED_POWER);
  	new_pwr = min_t(int, chan_pwr, reg->power_limit);
diff --git a/package/kernel/mac80211/patches/ath/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch b/package/kernel/mac80211/patches/ath9k/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
similarity index 91%
rename from package/kernel/mac80211/patches/ath/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
rename to package/kernel/mac80211/patches/ath9k/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
index 12cbd27e1..0c3edc126 100644
--- a/package/kernel/mac80211/patches/ath/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
+++ b/package/kernel/mac80211/patches/ath9k/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
@@ -11,7 +11,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2998,6 +2998,10 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2996,6 +2996,10 @@ void ath9k_hw_apply_txpower(struct ath_h
  	if (ant_gain > max_gain)
  		ant_reduction = ant_gain - max_gain;
  
diff --git a/package/kernel/mac80211/patches/ath/401-ath9k_blink_default.patch b/package/kernel/mac80211/patches/ath9k/401-ath9k_blink_default.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/401-ath9k_blink_default.patch
rename to package/kernel/mac80211/patches/ath9k/401-ath9k_blink_default.patch
diff --git a/package/kernel/mac80211/patches/ath/410-ath9k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/ath9k/410-ath9k_allow_adhoc_and_ap.patch
similarity index 73%
rename from package/kernel/mac80211/patches/ath/410-ath9k_allow_adhoc_and_ap.patch
rename to package/kernel/mac80211/patches/ath9k/410-ath9k_allow_adhoc_and_ap.patch
index 17dd8f659..b2f2763e8 100644
--- a/package/kernel/mac80211/patches/ath/410-ath9k_allow_adhoc_and_ap.patch
+++ b/package/kernel/mac80211/patches/ath9k/410-ath9k_allow_adhoc_and_ap.patch
@@ -1,10 +1,10 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -830,6 +830,7 @@ static const struct ieee80211_iface_limi
+@@ -882,6 +882,7 @@ static const struct ieee80211_iface_limi
  				 BIT(NL80211_IFTYPE_AP) },
  	{ .max = 1,	.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
  				 BIT(NL80211_IFTYPE_P2P_GO) },
 +	{ .max = 1,	.types = BIT(NL80211_IFTYPE_ADHOC) },
  };
  
- #ifdef CPTCFG_WIRELESS_WDS
+ #ifdef CPTCFG_ATH9K_CHANNEL_CONTEXT
diff --git a/package/kernel/mac80211/patches/ath/450-ath9k-enabled-MFP-capability-unconditionally.patch b/package/kernel/mac80211/patches/ath9k/450-ath9k-enabled-MFP-capability-unconditionally.patch
similarity index 90%
rename from package/kernel/mac80211/patches/ath/450-ath9k-enabled-MFP-capability-unconditionally.patch
rename to package/kernel/mac80211/patches/ath9k/450-ath9k-enabled-MFP-capability-unconditionally.patch
index ea94b5238..f424ca530 100644
--- a/package/kernel/mac80211/patches/ath/450-ath9k-enabled-MFP-capability-unconditionally.patch
+++ b/package/kernel/mac80211/patches/ath9k/450-ath9k-enabled-MFP-capability-unconditionally.patch
@@ -14,7 +14,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -927,6 +927,7 @@ static void ath9k_set_hw_capab(struct at
+@@ -963,6 +963,7 @@ static void ath9k_set_hw_capab(struct at
  	ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
  	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
  	ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
@@ -22,7 +22,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  
  	if (ath9k_ps_enable)
  		ieee80211_hw_set(hw, SUPPORTS_PS);
-@@ -939,9 +940,6 @@ static void ath9k_set_hw_capab(struct at
+@@ -975,9 +976,6 @@ static void ath9k_set_hw_capab(struct at
  				IEEE80211_RADIOTAP_MCS_HAVE_STBC;
  	}
  
diff --git a/package/kernel/mac80211/patches/ath/500-ath9k_eeprom_debugfs.patch b/package/kernel/mac80211/patches/ath9k/500-ath9k_eeprom_debugfs.patch
similarity index 89%
rename from package/kernel/mac80211/patches/ath/500-ath9k_eeprom_debugfs.patch
rename to package/kernel/mac80211/patches/ath9k/500-ath9k_eeprom_debugfs.patch
index 48ccc8130..2f5e75be8 100644
--- a/package/kernel/mac80211/patches/ath/500-ath9k_eeprom_debugfs.patch
+++ b/package/kernel/mac80211/patches/ath9k/500-ath9k_eeprom_debugfs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1364,6 +1364,53 @@ void ath9k_deinit_debug(struct ath_softc
+@@ -1413,6 +1413,54 @@ void ath9k_deinit_debug(struct ath_softc
  	ath9k_cmn_spectral_deinit_debug(&sc->spec_priv);
  }
  
@@ -39,7 +39,8 @@
 +		} else {
 +			bytes = 2;
 +		}
-+		copy_to_user(user_buf, from, bytes);
++		if (copy_to_user(user_buf, from, bytes))
++			return -EFAULT;
 +		user_buf += bytes;
 +	}
 +	return *ppos - pos;
@@ -54,7 +55,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1383,6 +1430,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1432,6 +1480,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  	ath9k_tx99_init_debug(sc);
  	ath9k_cmn_spectral_init_debug(&sc->spec_priv, sc->debug.debugfs_phy);
  
diff --git a/package/kernel/mac80211/patches/ath/501-ath9k_ahb_init.patch b/package/kernel/mac80211/patches/ath9k/501-ath9k_ahb_init.patch
similarity index 91%
rename from package/kernel/mac80211/patches/ath/501-ath9k_ahb_init.patch
rename to package/kernel/mac80211/patches/ath9k/501-ath9k_ahb_init.patch
index b9c784eb2..740ddc39d 100644
--- a/package/kernel/mac80211/patches/ath/501-ath9k_ahb_init.patch
+++ b/package/kernel/mac80211/patches/ath9k/501-ath9k_ahb_init.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1143,25 +1143,25 @@ static int __init ath9k_init(void)
+@@ -1178,25 +1178,25 @@ static int __init ath9k_init(void)
  {
  	int error;
  
diff --git a/package/kernel/mac80211/patches/ath/510-ath9k_intr_mitigation_tweak.patch b/package/kernel/mac80211/patches/ath9k/510-ath9k_intr_mitigation_tweak.patch
similarity index 87%
rename from package/kernel/mac80211/patches/ath/510-ath9k_intr_mitigation_tweak.patch
rename to package/kernel/mac80211/patches/ath9k/510-ath9k_intr_mitigation_tweak.patch
index 75b48b480..fda050a8f 100644
--- a/package/kernel/mac80211/patches/ath/510-ath9k_intr_mitigation_tweak.patch
+++ b/package/kernel/mac80211/patches/ath9k/510-ath9k_intr_mitigation_tweak.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -403,13 +403,8 @@ static void ath9k_hw_init_config(struct
+@@ -402,13 +402,8 @@ static void ath9k_hw_init_config(struct
  
  	ah->config.rx_intr_mitigation = true;
  
diff --git a/package/kernel/mac80211/patches/ath/511-ath9k_reduce_rxbuf.patch b/package/kernel/mac80211/patches/ath9k/511-ath9k_reduce_rxbuf.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/511-ath9k_reduce_rxbuf.patch
rename to package/kernel/mac80211/patches/ath9k/511-ath9k_reduce_rxbuf.patch
diff --git a/package/kernel/mac80211/patches/ath/512-ath9k_channelbw_debugfs.patch b/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch
similarity index 96%
rename from package/kernel/mac80211/patches/ath/512-ath9k_channelbw_debugfs.patch
rename to package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch
index 126d1d5c6..a871e458a 100644
--- a/package/kernel/mac80211/patches/ath/512-ath9k_channelbw_debugfs.patch
+++ b/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1411,6 +1411,52 @@ static const struct file_operations fops
+@@ -1461,6 +1461,52 @@ static const struct file_operations fops
  	.owner = THIS_MODULE
  };
  
@@ -53,7 +53,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1432,6 +1478,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1482,6 +1528,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  
  	debugfs_create_file("eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
  			    &fops_eeprom);
diff --git a/package/kernel/mac80211/patches/ath/513-ath9k_add_pci_ids.patch b/package/kernel/mac80211/patches/ath9k/513-ath9k_add_pci_ids.patch
similarity index 93%
rename from package/kernel/mac80211/patches/ath/513-ath9k_add_pci_ids.patch
rename to package/kernel/mac80211/patches/ath9k/513-ath9k_add_pci_ids.patch
index 113c35625..a085e3a1f 100644
--- a/package/kernel/mac80211/patches/ath/513-ath9k_add_pci_ids.patch
+++ b/package/kernel/mac80211/patches/ath9k/513-ath9k_add_pci_ids.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -663,6 +663,7 @@ int ath9k_hw_init(struct ath_hw *ah)
+@@ -662,6 +662,7 @@ int ath9k_hw_init(struct ath_hw *ah)
  
  	/* These are all the AR5008/AR9001/AR9002/AR9003 hardware family of chipsets */
  	switch (ah->hw_version.devid) {
diff --git a/package/kernel/mac80211/patches/ath/530-ath9k_extra_leds.patch b/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
similarity index 95%
rename from package/kernel/mac80211/patches/ath/530-ath9k_extra_leds.patch
rename to package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
index 5fd5c73a2..74506657e 100644
--- a/package/kernel/mac80211/patches/ath/530-ath9k_extra_leds.patch
+++ b/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -844,6 +844,9 @@ static inline int ath9k_dump_btcoex(stru
+@@ -843,6 +843,9 @@ static inline int ath9k_dump_btcoex(stru
  #ifdef CPTCFG_MAC80211_LEDS
  void ath_init_leds(struct ath_softc *sc);
  void ath_deinit_leds(struct ath_softc *sc);
@@ -10,7 +10,7 @@
  #else
  static inline void ath_init_leds(struct ath_softc *sc)
  {
-@@ -980,6 +983,13 @@ void ath_ant_comb_scan(struct ath_softc
+@@ -979,6 +982,13 @@ void ath_ant_comb_scan(struct ath_softc
  
  #define ATH9K_NUM_CHANCTX  2 /* supports 2 operating channels */
  
@@ -24,7 +24,7 @@
  struct ath_softc {
  	struct ieee80211_hw *hw;
  	struct device *dev;
-@@ -1033,9 +1043,8 @@ struct ath_softc {
+@@ -1032,9 +1042,8 @@ struct ath_softc {
  	spinlock_t chan_lock;
  
  #ifdef CPTCFG_MAC80211_LEDS
@@ -181,7 +181,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1055,7 +1055,7 @@ int ath9k_init_device(u16 devid, struct
+@@ -1088,7 +1088,7 @@ int ath9k_init_device(u16 devid, struct
  
  #ifdef CPTCFG_MAC80211_LEDS
  	/* must be initialized before ieee80211_register_hw */
@@ -192,7 +192,7 @@
  #endif
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1456,6 +1456,61 @@ static const struct file_operations fops
+@@ -1506,6 +1506,61 @@ static const struct file_operations fops
  	.llseek = default_llseek,
  };
  
@@ -254,7 +254,7 @@
  
  int ath9k_init_debug(struct ath_hw *ah)
  {
-@@ -1480,6 +1535,10 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1530,6 +1585,10 @@ int ath9k_init_debug(struct ath_hw *ah)
  			    &fops_eeprom);
  	debugfs_create_file("chanbw", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
  			    sc, &fops_chanbw);
diff --git a/package/kernel/mac80211/patches/ath/531-ath9k_extra_platform_leds.patch b/package/kernel/mac80211/patches/ath9k/531-ath9k_extra_platform_leds.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/531-ath9k_extra_platform_leds.patch
rename to package/kernel/mac80211/patches/ath9k/531-ath9k_extra_platform_leds.patch
diff --git a/package/kernel/mac80211/patches/ath/540-ath9k_reduce_ani_interval.patch b/package/kernel/mac80211/patches/ath9k/540-ath9k_reduce_ani_interval.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/540-ath9k_reduce_ani_interval.patch
rename to package/kernel/mac80211/patches/ath9k/540-ath9k_reduce_ani_interval.patch
diff --git a/package/kernel/mac80211/patches/ath/542-ath9k_debugfs_diag.patch b/package/kernel/mac80211/patches/ath9k/542-ath9k_debugfs_diag.patch
similarity index 91%
rename from package/kernel/mac80211/patches/ath/542-ath9k_debugfs_diag.patch
rename to package/kernel/mac80211/patches/ath9k/542-ath9k_debugfs_diag.patch
index 76f9846fa..e09bbc08e 100644
--- a/package/kernel/mac80211/patches/ath/542-ath9k_debugfs_diag.patch
+++ b/package/kernel/mac80211/patches/ath9k/542-ath9k_debugfs_diag.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1512,6 +1512,50 @@ static const struct file_operations fops
+@@ -1562,6 +1562,50 @@ static const struct file_operations fops
  #endif
  
  
@@ -51,7 +51,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1539,6 +1583,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1589,6 +1633,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  	debugfs_create_file("gpio_led", S_IWUSR,
  			   sc->debug.debugfs_phy, sc, &fops_gpio_led);
  #endif
@@ -84,7 +84,7 @@
  	bool reset_power_on;
  	bool htc_reset_init;
  
-@@ -1077,6 +1085,7 @@ void ath9k_hw_check_nav(struct ath_hw *a
+@@ -1079,6 +1087,7 @@ void ath9k_hw_check_nav(struct ath_hw *a
  bool ath9k_hw_check_alive(struct ath_hw *ah);
  
  bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode);
@@ -94,7 +94,7 @@
  struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1882,6 +1882,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
+@@ -1881,6 +1881,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
  }
  EXPORT_SYMBOL(ath9k_hw_get_tsf_offset);
  
@@ -115,7 +115,7 @@
  int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
  		   struct ath9k_hw_cal_data *caldata, bool fastcc)
  {
-@@ -2090,6 +2104,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2089,6 +2103,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		ar9003_hw_disable_phy_restart(ah);
  
  	ath9k_hw_apply_gpio_override(ah);
diff --git a/package/kernel/mac80211/patches/ath/543-ath9k_entropy_from_adc.patch b/package/kernel/mac80211/patches/ath9k/543-ath9k_entropy_from_adc.patch
similarity index 92%
rename from package/kernel/mac80211/patches/ath/543-ath9k_entropy_from_adc.patch
rename to package/kernel/mac80211/patches/ath9k/543-ath9k_entropy_from_adc.patch
index 0d938a373..6acc864d1 100644
--- a/package/kernel/mac80211/patches/ath/543-ath9k_entropy_from_adc.patch
+++ b/package/kernel/mac80211/patches/ath9k/543-ath9k_entropy_from_adc.patch
@@ -18,7 +18,7 @@
  	void (*spectral_scan_trigger)(struct ath_hw *ah);
 --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-@@ -1927,6 +1927,26 @@ void ar9003_hw_init_rate_txpower(struct
+@@ -1918,6 +1918,26 @@ void ar9003_hw_init_rate_txpower(struct
  	}
  }
  
@@ -45,7 +45,7 @@
  void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
  {
  	struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
-@@ -1963,6 +1983,7 @@ void ar9003_hw_attach_phy_ops(struct ath
+@@ -1954,6 +1974,7 @@ void ar9003_hw_attach_phy_ops(struct ath
  	priv_ops->set_radar_params = ar9003_hw_set_radar_params;
  	priv_ops->fast_chan_change = ar9003_hw_fast_chan_change;
  
@@ -55,7 +55,7 @@
  	ops->spectral_scan_config = ar9003_hw_spectral_scan_config;
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -818,7 +818,8 @@ static void ath9k_init_txpower_limits(st
+@@ -870,7 +870,8 @@ static void ath9k_init_txpower_limits(st
  	if (ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
  		ath9k_init_band_txpower(sc, NL80211_BAND_5GHZ);
  
@@ -65,7 +65,7 @@
  }
  
  static const struct ieee80211_iface_limit if_limits[] = {
-@@ -1015,6 +1016,18 @@ static void ath9k_set_hw_capab(struct at
+@@ -1048,6 +1049,18 @@ static void ath9k_set_hw_capab(struct at
  	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);
  }
  
@@ -84,9 +84,9 @@
  int ath9k_init_device(u16 devid, struct ath_softc *sc,
  		    const struct ath_bus_ops *bus_ops)
  {
-@@ -1060,6 +1073,8 @@ int ath9k_init_device(u16 devid, struct
- 		ARRAY_SIZE(ath9k_tpt_blink));
- #endif
+@@ -1095,6 +1108,8 @@ int ath9k_init_device(u16 devid, struct
+ 
+ 	wiphy_read_of_freq_limits(hw->wiphy);
  
 +	ath_get_initial_entropy(sc);
 +
@@ -110,7 +110,7 @@
  static inline void ath9k_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-@@ -1349,9 +1349,30 @@ void ar5008_hw_init_rate_txpower(struct
+@@ -1340,9 +1340,30 @@ void ar5008_hw_init_rate_txpower(struct
  	}
  }
  
@@ -141,7 +141,7 @@
  	static const u32 ar5416_cca_regs[6] = {
  		AR_PHY_CCA,
  		AR_PHY_CH1_CCA,
-@@ -1366,6 +1387,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
+@@ -1357,6 +1378,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
  	if (ret)
  	    return ret;
  
diff --git a/package/kernel/mac80211/patches/ath/544-ath9k-ar933x-usb-hang-workaround.patch b/package/kernel/mac80211/patches/ath9k/544-ath9k-ar933x-usb-hang-workaround.patch
similarity index 84%
rename from package/kernel/mac80211/patches/ath/544-ath9k-ar933x-usb-hang-workaround.patch
rename to package/kernel/mac80211/patches/ath9k/544-ath9k-ar933x-usb-hang-workaround.patch
index 2d2b83707..23a81864f 100644
--- a/package/kernel/mac80211/patches/ath/544-ath9k-ar933x-usb-hang-workaround.patch
+++ b/package/kernel/mac80211/patches/ath9k/544-ath9k-ar933x-usb-hang-workaround.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -248,6 +248,19 @@ void ath9k_hw_get_channel_centers(struct
+@@ -247,6 +247,19 @@ void ath9k_hw_get_channel_centers(struct
  		centers->synth_center + (extoff * HT40_CHANNEL_CENTER_SHIFT);
  }
  
@@ -20,7 +20,7 @@
  /******************/
  /* Chip Revisions */
  /******************/
-@@ -1455,6 +1468,9 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1454,6 +1467,9 @@ static bool ath9k_hw_set_reset(struct at
  		udelay(50);
  	}
  
@@ -30,7 +30,7 @@
  	return true;
  }
  
-@@ -1554,6 +1570,9 @@ static bool ath9k_hw_chip_reset(struct a
+@@ -1553,6 +1569,9 @@ static bool ath9k_hw_chip_reset(struct a
  		ar9003_hw_internal_regulator_apply(ah);
  	ath9k_hw_init_pll(ah, chan);
  
@@ -40,7 +40,7 @@
  	return true;
  }
  
-@@ -1860,8 +1879,14 @@ static int ath9k_hw_do_fastcc(struct ath
+@@ -1859,8 +1878,14 @@ static int ath9k_hw_do_fastcc(struct ath
  	if (AR_SREV_9271(ah))
  		ar9002_hw_load_ani_reg(ah, chan);
  
@@ -55,7 +55,7 @@
  	return -EINVAL;
  }
  
-@@ -2115,6 +2140,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2114,6 +2139,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		ath9k_hw_set_radar_params(ah);
  	}
  
diff --git a/package/kernel/mac80211/patches/ath/545-ath9k_ani_ws_detect.patch b/package/kernel/mac80211/patches/ath9k/545-ath9k_ani_ws_detect.patch
similarity index 96%
rename from package/kernel/mac80211/patches/ath/545-ath9k_ani_ws_detect.patch
rename to package/kernel/mac80211/patches/ath9k/545-ath9k_ani_ws_detect.patch
index 466767adb..d3bf07ff9 100644
--- a/package/kernel/mac80211/patches/ath/545-ath9k_ani_ws_detect.patch
+++ b/package/kernel/mac80211/patches/ath9k/545-ath9k_ani_ws_detect.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-@@ -978,55 +978,6 @@ static bool ar5008_hw_ani_control_new(st
+@@ -969,55 +969,6 @@ static bool ar5008_hw_ani_control_new(st
  		 * on == 0 means more noise imm
  		 */
  		u32 on = param ? 1 : 0;
@@ -79,7 +79,7 @@
  static const u8 ofdm2pwr[] = {
  	ALL_TARGET_LEGACY_6_24,
  	ALL_TARGET_LEGACY_6_24,
-@@ -1077,11 +1063,6 @@ static bool ar9003_hw_ani_control(struct
+@@ -1068,11 +1054,6 @@ static bool ar9003_hw_ani_control(struct
  	struct ath_common *common = ath9k_hw_common(ah);
  	struct ath9k_channel *chan = ah->curchan;
  	struct ar5416AniState *aniState = &ah->ani;
@@ -91,7 +91,7 @@
  	s32 value, value2;
  
  	switch (cmd & ah->ani_function) {
-@@ -1095,61 +1076,6 @@ static bool ar9003_hw_ani_control(struct
+@@ -1086,61 +1067,6 @@ static bool ar9003_hw_ani_control(struct
  		 */
  		u32 on = param ? 1 : 0;
  
diff --git a/package/kernel/mac80211/patches/ath/547-ath9k_led_defstate_fix.patch b/package/kernel/mac80211/patches/ath9k/547-ath9k_led_defstate_fix.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/547-ath9k_led_defstate_fix.patch
rename to package/kernel/mac80211/patches/ath9k/547-ath9k_led_defstate_fix.patch
diff --git a/package/kernel/mac80211/patches/ath/548-ath9k_enable_gpio_chip.patch b/package/kernel/mac80211/patches/ath9k/548-ath9k_enable_gpio_chip.patch
similarity index 98%
rename from package/kernel/mac80211/patches/ath/548-ath9k_enable_gpio_chip.patch
rename to package/kernel/mac80211/patches/ath9k/548-ath9k_enable_gpio_chip.patch
index 88198a456..78206d286 100644
--- a/package/kernel/mac80211/patches/ath/548-ath9k_enable_gpio_chip.patch
+++ b/package/kernel/mac80211/patches/ath9k/548-ath9k_enable_gpio_chip.patch
@@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  #include "common.h"
  #include "debug.h"
-@@ -990,6 +991,14 @@ struct ath_led {
+@@ -989,6 +990,14 @@ struct ath_led {
  	struct led_classdev cdev;
  };
  
@@ -33,7 +33,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  struct ath_softc {
  	struct ieee80211_hw *hw;
  	struct device *dev;
-@@ -1045,6 +1054,9 @@ struct ath_softc {
+@@ -1044,6 +1053,9 @@ struct ath_softc {
  #ifdef CPTCFG_MAC80211_LEDS
  	const char *led_default_trigger;
  	struct list_head leds;
diff --git a/package/kernel/mac80211/patches/ath/549-ath9k_enable_gpio_buttons.patch b/package/kernel/mac80211/patches/ath9k/549-ath9k_enable_gpio_buttons.patch
similarity index 98%
rename from package/kernel/mac80211/patches/ath/549-ath9k_enable_gpio_buttons.patch
rename to package/kernel/mac80211/patches/ath9k/549-ath9k_enable_gpio_buttons.patch
index 83076b8ae..716e09f35 100644
--- a/package/kernel/mac80211/patches/ath/549-ath9k_enable_gpio_buttons.patch
+++ b/package/kernel/mac80211/patches/ath9k/549-ath9k_enable_gpio_buttons.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 ---
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -1056,6 +1056,7 @@ struct ath_softc {
+@@ -1055,6 +1055,7 @@ struct ath_softc {
  	struct list_head leds;
  #ifdef CONFIG_GPIOLIB
  	struct ath9k_gpio_chip *gpiochip;
diff --git a/package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch b/package/kernel/mac80211/patches/ath9k/551-ath9k_ubnt_uap_plus_hsr.patch
similarity index 99%
rename from package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch
rename to package/kernel/mac80211/patches/ath9k/551-ath9k_ubnt_uap_plus_hsr.patch
index e9cf00769..efc4b9187 100644
--- a/package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch
+++ b/package/kernel/mac80211/patches/ath9k/551-ath9k_ubnt_uap_plus_hsr.patch
@@ -371,7 +371,7 @@
  
 --- a/local-symbols
 +++ b/local-symbols
-@@ -112,6 +112,7 @@ ATH9K_WOW=
+@@ -129,6 +129,7 @@ ATH9K_WOW=
  ATH9K_RFKILL=
  ATH9K_CHANNEL_CONTEXT=
  ATH9K_PCOEM=
diff --git a/package/kernel/mac80211/patches/ath/552-ahb_of.patch b/package/kernel/mac80211/patches/ath9k/552-ath9k-ahb_of.patch
similarity index 93%
rename from package/kernel/mac80211/patches/ath/552-ahb_of.patch
rename to package/kernel/mac80211/patches/ath9k/552-ath9k-ahb_of.patch
index 8fd6e4409..57eef54e8 100644
--- a/package/kernel/mac80211/patches/ath/552-ahb_of.patch
+++ b/package/kernel/mac80211/patches/ath9k/552-ath9k-ahb_of.patch
@@ -16,7 +16,7 @@
  
  static const struct platform_device_id ath9k_platform_id_table[] = {
  	{
-@@ -69,6 +77,242 @@ static const struct ath_bus_ops ath_ahb_
+@@ -69,6 +77,236 @@ static const struct ath_bus_ops ath_ahb_
  	.eeprom_read = ath_ahb_eeprom_read,
  };
  
@@ -218,12 +218,6 @@
 +	else
 +		pdata->led_pin = -1;
 +
-+	if (of_property_read_bool(pdev->dev.of_node, "qca,disable-2ghz"))
-+		pdata->disable_2ghz = true;
-+
-+	if (of_property_read_bool(pdev->dev.of_node, "qca,disable-5ghz"))
-+		pdata->disable_5ghz = true;
-+
 +	if (of_property_read_bool(pdev->dev.of_node, "qca,tx-gain-buffalo"))
 +		pdata->tx_gain_buffalo = true;
 +
@@ -259,7 +253,7 @@
  static int ath_ahb_probe(struct platform_device *pdev)
  {
  	void __iomem *mem;
-@@ -80,6 +324,17 @@ static int ath_ahb_probe(struct platform
+@@ -80,6 +318,17 @@ static int ath_ahb_probe(struct platform
  	int ret = 0;
  	struct ath_hw *ah;
  	char hw_name[64];
@@ -277,7 +271,7 @@
  
  	if (!dev_get_platdata(&pdev->dev)) {
  		dev_err(&pdev->dev, "no platform data specified\n");
-@@ -122,13 +377,16 @@ static int ath_ahb_probe(struct platform
+@@ -118,13 +367,16 @@ static int ath_ahb_probe(struct platform
  	sc->mem = mem;
  	sc->irq = irq;
  
@@ -295,7 +289,7 @@
  	if (ret) {
  		dev_err(&pdev->dev, "failed to initialize device\n");
  		goto err_irq;
-@@ -159,6 +417,9 @@ static int ath_ahb_remove(struct platfor
+@@ -155,6 +407,9 @@ static int ath_ahb_remove(struct platfor
  		free_irq(sc->irq, sc);
  		ieee80211_free_hw(sc->hw);
  	}
@@ -305,7 +299,7 @@
  
  	return 0;
  }
-@@ -168,6 +429,9 @@ static struct platform_driver ath_ahb_dr
+@@ -164,6 +419,9 @@ static struct platform_driver ath_ahb_dr
  	.remove     = ath_ahb_remove,
  	.driver		= {
  		.name	= "ath9k",
@@ -325,7 +319,7 @@
  
  #include "common.h"
  #include "debug.h"
-@@ -1012,6 +1013,9 @@ struct ath_softc {
+@@ -1011,6 +1012,9 @@ struct ath_softc {
  	struct ath_hw *sc_ah;
  	void __iomem *mem;
  	int irq;
diff --git a/package/kernel/mac80211/patches/ath/553-ath9k_of_gpio_mask.patch b/package/kernel/mac80211/patches/ath9k/553-ath9k_of_gpio_mask.patch
similarity index 80%
rename from package/kernel/mac80211/patches/ath/553-ath9k_of_gpio_mask.patch
rename to package/kernel/mac80211/patches/ath9k/553-ath9k_of_gpio_mask.patch
index 8e0041e3e..6d1820ecb 100644
--- a/package/kernel/mac80211/patches/ath/553-ath9k_of_gpio_mask.patch
+++ b/package/kernel/mac80211/patches/ath9k/553-ath9k_of_gpio_mask.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -654,6 +654,12 @@ static int ath9k_of_init(struct ath_soft
+@@ -696,6 +696,12 @@ static int ath9k_of_init(struct ath_soft
  	return 0;
  }
  
@@ -13,7 +13,7 @@
  static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
  			    const struct ath_bus_ops *bus_ops)
  {
-@@ -757,6 +763,9 @@ static int ath9k_init_softc(u16 devid, s
+@@ -803,6 +809,9 @@ static int ath9k_init_softc(u16 devid, s
  	if (ret)
  		goto err_hw;
  
diff --git a/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch b/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
index 52ae7a8eb..22b67c49d 100644
--- a/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
+++ b/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
@@ -20,7 +20,7 @@
  
  	if (phy->type == B43_PHYTYPE_B) {
  		value16 = b43_read16(dev, 0x005E);
-@@ -3985,7 +3985,6 @@ static int b43_op_config(struct ieee8021
+@@ -3986,7 +3986,6 @@ static int b43_op_config(struct ieee8021
  	struct b43_wldev *dev = wl->current_dev;
  	struct b43_phy *phy = &dev->phy;
  	struct ieee80211_conf *conf = &hw->conf;
@@ -28,7 +28,7 @@
  	int err = 0;
  
  	mutex_lock(&wl->mutex);
-@@ -4028,11 +4027,9 @@ static int b43_op_config(struct ieee8021
+@@ -4029,11 +4028,9 @@ static int b43_op_config(struct ieee8021
  	}
  
  	/* Antennas for RX and management frame TX. */
@@ -89,8 +89,8 @@
 +
  static const struct ieee80211_ops b43_hw_ops = {
  	.tx			= b43_op_tx,
- 	.conf_tx		= b43_op_conf_tx,
-@@ -5197,6 +5235,8 @@ static const struct ieee80211_ops b43_hw
+ 	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+@@ -5198,6 +5236,8 @@ static const struct ieee80211_ops b43_hw
  	.sw_scan_complete	= b43_op_sw_scan_complete_notifier,
  	.get_survey		= b43_op_get_survey,
  	.rfkill_poll		= b43_rfkill_poll,
@@ -99,7 +99,7 @@
  };
  
  /* Hard-reset the chip. Do not call this directly.
-@@ -5498,6 +5538,8 @@ static int b43_one_core_attach(struct b4
+@@ -5499,6 +5539,8 @@ static int b43_one_core_attach(struct b4
  	if (!wldev)
  		goto out;
  
@@ -108,7 +108,7 @@
  	wldev->use_pio = b43_modparam_pio;
  	wldev->dev = dev;
  	wldev->wl = wl;
-@@ -5592,6 +5634,9 @@ static struct b43_wl *b43_wireless_init(
+@@ -5590,6 +5632,9 @@ static struct b43_wl *b43_wireless_init(
  
  	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
  
diff --git a/package/kernel/mac80211/patches/brcm/815-b43-always-take-overlapping-devs.patch b/package/kernel/mac80211/patches/brcm/815-b43-always-take-overlapping-devs.patch
index a8eae1941..3700eaa1a 100644
--- a/package/kernel/mac80211/patches/brcm/815-b43-always-take-overlapping-devs.patch
+++ b/package/kernel/mac80211/patches/brcm/815-b43-always-take-overlapping-devs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/b43/main.c
 +++ b/drivers/net/wireless/broadcom/b43/main.c
-@@ -114,7 +114,7 @@ static int b43_modparam_pio = 0;
+@@ -114,7 +114,7 @@ static int b43_modparam_pio;
  module_param_named(pio, b43_modparam_pio, int, 0644);
  MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
  
diff --git a/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch b/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch
deleted file mode 100644
index c9730e29f..000000000
--- a/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
-Date: Mon, 8 Jun 2015 16:11:40 +0200
-Subject: [PATCH] brcmfmac: register wiphy(s) during module_init
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This is needed by OpenWrt which expects all PHYs to be created after
-module loads successfully.
-
-Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -431,6 +431,7 @@ struct brcmf_fw {
- 	struct brcmf_fw_request *req;
- 	u32 curpos;
- 	void (*done)(struct device *dev, int err, struct brcmf_fw_request *req);
-+	struct completion *completion;
- };
- 
- static void brcmf_fw_request_done(const struct firmware *fw, void *ctx);
-@@ -638,6 +639,8 @@ static void brcmf_fw_request_done(const
- 		fwctx->req = NULL;
- 	}
- 	fwctx->done(fwctx->dev, ret, fwctx->req);
-+	if (fwctx->completion)
-+		complete(fwctx->completion);
- 	kfree(fwctx);
- }
- 
-@@ -662,6 +665,8 @@ int brcmf_fw_get_firmwares(struct device
- {
- 	struct brcmf_fw_item *first = &req->items[0];
- 	struct brcmf_fw *fwctx;
-+	struct completion completion;
-+	unsigned long time_left;
- 	int ret;
- 
- 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
-@@ -678,6 +683,9 @@ int brcmf_fw_get_firmwares(struct device
- 	fwctx->dev = dev;
- 	fwctx->req = req;
- 	fwctx->done = fw_cb;
-+ 
-+	init_completion(&completion);
-+	fwctx->completion = &completion;
- 
- 	ret = request_firmware_nowait(THIS_MODULE, true, first->path,
- 				      fwctx->dev, GFP_KERNEL, fwctx,
-@@ -685,6 +693,12 @@ int brcmf_fw_get_firmwares(struct device
- 	if (ret < 0)
- 		brcmf_fw_request_done(NULL, fwctx);
- 
-+
-+	time_left = wait_for_completion_timeout(&completion,
-+						msecs_to_jiffies(5000));
-+	if (!time_left && fwctx)
-+		fwctx->completion = NULL;
-+
- 	return 0;
- }
- 
diff --git a/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch b/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
index 7b4cb250f..b82b442a1 100644
--- a/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
+++ b/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
@@ -10,7 +10,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -715,8 +715,36 @@ static struct wireless_dev *brcmf_cfg802
+@@ -713,8 +713,36 @@ static struct wireless_dev *brcmf_cfg802
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
  	struct brcmf_pub *drvr = cfg->pub;
  	struct wireless_dev *wdev;
diff --git a/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch b/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
index 774656f1f..080ab8f7e 100644
--- a/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
+++ b/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
@@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2961,6 +2961,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+@@ -2976,6 +2976,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
  	 * preference in cfg struct to apply this to
  	 * FW later while initializing the dongle
  	 */
diff --git a/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch b/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
index 9658bda1c..25191b643 100644
--- a/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
+++ b/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
@@ -12,9 +12,9 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
-@@ -12,6 +12,36 @@
- #include "common.h"
- #include "of.h"
+@@ -65,6 +65,36 @@ static int brcmf_of_get_country_codes(st
+ 	return 0;
+ }
  
 +/* TODO: FIXME: Use DT */
 +static void brcmf_of_probe_cc(struct device *dev,
@@ -49,12 +49,12 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,
  		    struct brcmf_mp_device *settings)
  {
-@@ -43,6 +73,8 @@ void brcmf_of_probe(struct device *dev,
+@@ -106,6 +136,8 @@ void brcmf_of_probe(struct device *dev,
  		of_node_put(root);
  	}
  
 +	brcmf_of_probe_cc(dev, settings);
 +
- 	if (!np || bus_type != BRCMF_BUSTYPE_SDIO ||
- 	    !of_device_is_compatible(np, "brcm,bcm4329-fmac"))
+ 	if (!np || !of_device_is_compatible(np, "brcm,bcm4329-fmac"))
  		return;
+ 
diff --git a/package/kernel/mac80211/patches/brcm/865-brcmfmac-Read-alternative-firmware-names-from-DT.patch b/package/kernel/mac80211/patches/brcm/865-brcmfmac-Read-alternative-firmware-names-from-DT.patch
new file mode 100644
index 000000000..8df285f8b
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/865-brcmfmac-Read-alternative-firmware-names-from-DT.patch
@@ -0,0 +1,191 @@
+From 4e32024cbb14230af3048e249e84f8c2b25ce45a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 28 Oct 2021 15:03:16 +0100
+Subject: [PATCH] brcmfmac: Read alternative firmware names from DT
+
+Add the ability to load the names of alternative firmwares from the
+Device Tree node. This permits separate firmwares for 43436s and 43438
+and allows downstream firmwares to coexist with upstream.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/of.c | 36 ++++++++++++++
+ .../wireless/broadcom/brcm80211/brcmfmac/of.h |  7 +++
+ .../broadcom/brcm80211/brcmfmac/sdio.c        | 47 +++++++++++++++++--
+ 3 files changed, 87 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
+@@ -11,6 +11,7 @@
+ #include "debug.h"
+ #include "core.h"
+ #include "common.h"
++#include "firmware.h"
+ #include "of.h"
+ 
+ static int brcmf_of_get_country_codes(struct device *dev,
+@@ -168,3 +169,38 @@ void brcmf_of_probe(struct device *dev,
+ 	sdio->oob_irq_nr = irq;
+ 	sdio->oob_irq_flags = irqf;
+ }
++
++struct brcmf_firmware_mapping *
++brcmf_of_fwnames(struct device *dev, u32 *fwname_count)
++{
++	struct device_node *np = dev->of_node;
++	struct brcmf_firmware_mapping *fwnames;
++	struct device_node *map_np, *fw_np;
++	int of_count;
++	int count = 0;
++
++	map_np = of_get_child_by_name(np, "firmwares");
++	of_count = of_get_child_count(map_np);
++	if (!of_count)
++		return NULL;
++
++	fwnames = devm_kcalloc(dev, of_count,
++			       sizeof(struct brcmf_firmware_mapping),
++			       GFP_KERNEL);
++
++	for_each_child_of_node(map_np, fw_np)
++	{
++		struct brcmf_firmware_mapping *cur = &fwnames[count];
++
++		if (of_property_read_u32(fw_np, "chipid", &cur->chipid) ||
++		    of_property_read_u32(fw_np, "revmask", &cur->revmask))
++			continue;
++		cur->fw_base = of_get_property(fw_np, "fw_base", NULL);
++		if (cur->fw_base)
++			count++;
++	}
++
++	*fwname_count = count;
++
++	return count ? fwnames : NULL;
++}
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
+@@ -5,9 +5,20 @@
+ #ifdef CONFIG_OF
+ void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,
+ 		    struct brcmf_mp_device *settings);
++#ifdef CPTCFG_BRCMFMAC_SDIO
++struct brcmf_firmware_mapping *
++brcmf_of_fwnames(struct device *dev, u32 *map_count);
++#endif
+ #else
+ static void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,
+ 			   struct brcmf_mp_device *settings)
+ {
+ }
++#ifdef CPTCFG_BRCMFMAC_SDIO
++static struct brcmf_firmware_mapping *
++brcmf_of_fwnames(struct device *dev, u32 *map_count)
++{
++	return NULL;
++}
++#endif
+ #endif /* CONFIG_OF */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -35,6 +35,7 @@
+ #include "core.h"
+ #include "common.h"
+ #include "bcdc.h"
++#include "of.h"
+ 
+ #define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2500)
+ #define CTL_DONE_TIMEOUT	msecs_to_jiffies(2500)
+@@ -634,7 +635,7 @@ MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "b
+ /* per-board firmware binaries */
+ MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "brcmfmac*-sdio.*.bin");
+ 
+-static const struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
++static const struct brcmf_firmware_mapping sdio_fwnames[] = {
+ 	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
+ 	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x0000001F, 43241B0),
+ 	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x00000020, 43241B4),
+@@ -662,6 +663,9 @@ static const struct brcmf_firmware_mappi
+ 	BRCMF_FW_ENTRY(CY_CC_43752_CHIP_ID, 0xFFFFFFFF, 43752)
+ };
+ 
++static const struct brcmf_firmware_mapping *brcmf_sdio_fwnames = sdio_fwnames;
++static u32 brcmf_sdio_fwnames_count = ARRAY_SIZE(sdio_fwnames);
++
+ #define TXCTL_CREDITS	2
+ 
+ static void pkt_align(struct sk_buff *p, int len, int align)
+@@ -4193,6 +4197,9 @@ static const struct brcmf_bus_ops brcmf_
+ #define BRCMF_SDIO_FW_NVRAM	1
+ #define BRCMF_SDIO_FW_CLM	2
+ 
++static struct brcmf_fw_request *
++brcmf_sdio_prepare_fw_request(struct brcmf_sdio *bus);
++
+ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+ 					 struct brcmf_fw_request *fwreq)
+ {
+@@ -4208,6 +4215,22 @@ static void brcmf_sdio_firmware_callback
+ 
+ 	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
+ 
++	if (err && brcmf_sdio_fwnames != sdio_fwnames) {
++		/* Try again with the standard firmware names */
++		brcmf_sdio_fwnames = sdio_fwnames;
++		brcmf_sdio_fwnames_count = ARRAY_SIZE(sdio_fwnames);
++		kfree(fwreq);
++		fwreq = brcmf_sdio_prepare_fw_request(bus);
++		if (!fwreq) {
++			err = -ENOMEM;
++			goto fail;
++		}
++		err = brcmf_fw_get_firmwares(dev, fwreq,
++					     brcmf_sdio_firmware_callback);
++		if (!err)
++			return;
++	}
++
+ 	if (err)
+ 		goto fail;
+ 
+@@ -4418,7 +4441,7 @@ brcmf_sdio_prepare_fw_request(struct brc
+ 
+ 	fwreq = brcmf_fw_alloc_request(bus->ci->chip, bus->ci->chiprev,
+ 				       brcmf_sdio_fwnames,
+-				       ARRAY_SIZE(brcmf_sdio_fwnames),
++				       brcmf_sdio_fwnames_count,
+ 				       fwnames, ARRAY_SIZE(fwnames));
+ 	if (!fwreq)
+ 		return NULL;
+@@ -4438,6 +4461,9 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	struct brcmf_sdio *bus;
+ 	struct workqueue_struct *wq;
+ 	struct brcmf_fw_request *fwreq;
++	struct brcmf_firmware_mapping *of_fwnames, *fwnames = NULL;
++	const int fwname_size = sizeof(struct brcmf_firmware_mapping);
++	u32 of_fw_count;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+@@ -4520,6 +4546,21 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 
+ 	brcmf_dbg(INFO, "completed!!\n");
+ 
++	of_fwnames = brcmf_of_fwnames(sdiodev->dev, &of_fw_count);
++	if (of_fwnames)
++		fwnames = devm_kcalloc(sdiodev->dev,
++				       of_fw_count + brcmf_sdio_fwnames_count,
++				       fwname_size, GFP_KERNEL);
++
++	if (fwnames) {
++		/* The array is scanned in order, so overrides come first */
++		memcpy(fwnames, of_fwnames, of_fw_count * fwname_size);
++		memcpy(fwnames + of_fw_count, sdio_fwnames,
++		       brcmf_sdio_fwnames_count * fwname_size);
++		brcmf_sdio_fwnames = fwnames;
++		brcmf_sdio_fwnames_count += of_fw_count;
++	}
++
+ 	fwreq = brcmf_sdio_prepare_fw_request(bus);
+ 	if (!fwreq) {
+ 		ret = -ENOMEM;
diff --git a/package/kernel/mac80211/patches/brcm/998-survey.patch b/package/kernel/mac80211/patches/brcm/998-survey.patch
deleted file mode 100644
index 25a12c783..000000000
--- a/package/kernel/mac80211/patches/brcm/998-survey.patch
+++ /dev/null
@@ -1,148 +0,0 @@
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2913,6 +2913,63 @@ done:
- }
- 
- static int
-+brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
-+			   int idx, struct survey_info *survey)
-+{
-+	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
-+	struct brcmf_if *ifp = netdev_priv(ndev);
-+	struct brcmu_chan ch;
-+	enum nl80211_band band = 0;
-+	s32 err = 0;
-+	int noise;
-+	u32 freq;
-+	u32 chanspec;
-+
-+	memset(survey, 0, sizeof(struct survey_info));
-+	if (idx != 0) {
-+		if (idx >= cfg->pub->num_chan_stats || cfg->pub->chan_stats == NULL)
-+			return -ENOENT;
-+		if (cfg->pub->chan_stats[idx].freq == 0)
-+			return -ENOENT;
-+		survey->filled = SURVEY_INFO_NOISE_DBM;
-+		survey->channel = ieee80211_get_channel(wiphy, cfg->pub->chan_stats[idx].freq);
-+		survey->noise = cfg->pub->chan_stats[idx].noise;
-+		return 0;
-+	}
-+
-+	err = brcmf_fil_iovar_int_get(ifp, "chanspec", &chanspec);
-+	if (err) {
-+		brcmf_err("chanspec failed (%d)\n", err);
-+		return err;
-+	}
-+
-+	ch.chspec = chanspec;
-+	cfg->d11inf.decchspec(&ch);
-+
-+	switch (ch.band) {
-+	case BRCMU_CHAN_BAND_2G:
-+		band = NL80211_BAND_2GHZ;
-+		break;
-+	case BRCMU_CHAN_BAND_5G:
-+		band = NL80211_BAND_5GHZ;
-+		break;
-+	}
-+
-+	freq = ieee80211_channel_to_frequency(ch.control_ch_num, band);
-+	survey->channel = ieee80211_get_channel(wiphy, freq);
-+
-+	err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PHY_NOISE, &noise);
-+	if (err) {
-+		brcmf_err("Could not get noise (%d)\n", err);
-+		return err;
-+	}
-+
-+	survey->filled = SURVEY_INFO_NOISE_DBM | SURVEY_INFO_IN_USE;
-+	survey->noise = le32_to_cpu(noise);
-+	return 0;
-+}
-+
-+static int
- brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
- 			    int idx, u8 *mac, struct station_info *sinfo)
- {
-@@ -3008,6 +3065,7 @@ static s32 brcmf_inform_single_bss(struc
- 	struct brcmu_chan ch;
- 	u16 channel;
- 	u32 freq;
-+	int i;
- 	u16 notify_capability;
- 	u16 notify_interval;
- 	u8 *notify_ie;
-@@ -3032,6 +3090,17 @@ static s32 brcmf_inform_single_bss(struc
- 		band = NL80211_BAND_5GHZ;
- 
- 	freq = ieee80211_channel_to_frequency(channel, band);
-+	for (i = 0;i < cfg->pub->num_chan_stats;i++) {
-+		if (freq == cfg->pub->chan_stats[i].freq)
-+			break;
-+		if (cfg->pub->chan_stats[i].freq == 0)
-+			break;
-+	}
-+	if (i < cfg->pub->num_chan_stats) {
-+		cfg->pub->chan_stats[i].freq = freq;
-+		cfg->pub->chan_stats[i].noise = bi->phy_noise;
-+	}
-+
- 	bss_data.chan = ieee80211_get_channel(wiphy, freq);
- 	bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
- 	bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
-@@ -5518,6 +5587,7 @@ static struct cfg80211_ops brcmf_cfg8021
- 	.leave_ibss = brcmf_cfg80211_leave_ibss,
- 	.get_station = brcmf_cfg80211_get_station,
- 	.dump_station = brcmf_cfg80211_dump_station,
-+	.dump_survey = brcmf_cfg80211_dump_survey,
- 	.set_tx_power = brcmf_cfg80211_set_tx_power,
- 	.get_tx_power = brcmf_cfg80211_get_tx_power,
- 	.add_key = brcmf_cfg80211_add_key,
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1356,6 +1356,8 @@ int brcmf_attach(struct device *dev)
- 
- 	/* Link to bus module */
- 	drvr->hdrlen = 0;
-+	drvr->chan_stats = vzalloc(256 * sizeof(struct brcmf_chan_stats));
-+	drvr->num_chan_stats = 256;
- 
- 	/* Attach and link in the protocol */
- 	ret = brcmf_proto_attach(drvr);
-@@ -1438,6 +1440,12 @@ void brcmf_detach(struct device *dev)
- 	if (drvr == NULL)
- 		return;
- 
-+	drvr->num_chan_stats = 0;
-+	if (drvr->chan_stats) {
-+		vfree(drvr->chan_stats);
-+		drvr->chan_stats = NULL;
-+	}
-+
- #ifdef CONFIG_INET
- 	unregister_inetaddr_notifier(&drvr->inetaddr_notifier);
- #endif
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -91,6 +91,11 @@ struct brcmf_rev_info {
- 	u32 nvramrev;
- };
- 
-+struct brcmf_chan_stats {
-+	u32 freq;
-+	int noise;
-+};
-+
- /* Common structure for module and instance linkage */
- struct brcmf_pub {
- 	/* Linkage ponters */
-@@ -100,6 +105,9 @@ struct brcmf_pub {
- 	struct cfg80211_ops *ops;
- 	struct brcmf_cfg80211_info *config;
- 
-+	int num_chan_stats;
-+	struct brcmf_chan_stats *chan_stats;
-+
- 	/* Internal brcmf items */
- 	uint hdrlen;		/* Total BRCMF header length (proto + bus) */
- 
diff --git a/package/kernel/mac80211/patches/build/003-remove_bogus_modparams.patch b/package/kernel/mac80211/patches/build/003-remove_bogus_modparams.patch
index 8fa465a7e..aa26c8cb2 100644
--- a/package/kernel/mac80211/patches/build/003-remove_bogus_modparams.patch
+++ b/package/kernel/mac80211/patches/build/003-remove_bogus_modparams.patch
@@ -1,6 +1,6 @@
 --- a/compat/main.c
 +++ b/compat/main.c
-@@ -20,31 +20,6 @@ MODULE_LICENSE("GPL");
+@@ -19,31 +19,6 @@ MODULE_LICENSE("GPL");
  #error "You need a CPTCFG_VERSION"
  #endif
  
diff --git a/package/kernel/mac80211/patches/build/004-kconfig_backport_fix.patch b/package/kernel/mac80211/patches/build/004-kconfig_backport_fix.patch
deleted file mode 100644
index 2c9572ec9..000000000
--- a/package/kernel/mac80211/patches/build/004-kconfig_backport_fix.patch
+++ /dev/null
@@ -1,28 +0,0 @@
---- a/backport-include/linux/kconfig.h
-+++ b/backport-include/linux/kconfig.h
-@@ -5,6 +5,8 @@
- #include_next <linux/kconfig.h>
- #endif
- 
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3,4,0)
-+
- #ifndef __ARG_PLACEHOLDER_1
- #define __ARG_PLACEHOLDER_1 0,
- #define config_enabled(cfg) _config_enabled(cfg)
-@@ -16,6 +18,7 @@
-  * 3.1 - 3.3 had a broken version of this, so undef
-  * (they didn't have __ARG_PLACEHOLDER_1)
-  */
-+
- #undef IS_ENABLED
- #define IS_ENABLED(option) \
-         (config_enabled(option) || config_enabled(option##_MODULE))
-@@ -31,6 +34,8 @@
- #undef IS_BUILTIN
- #define IS_BUILTIN(option) config_enabled(option)
- 
-+#endif
-+
- #ifndef IS_REACHABLE
- /*
-  * IS_REACHABLE(CONFIG_FOO) evaluates to 1 if the currently compiled
diff --git a/package/kernel/mac80211/patches/build/010-disable_rfkill.patch b/package/kernel/mac80211/patches/build/010-disable_rfkill.patch
deleted file mode 100644
index d5253063c..000000000
--- a/package/kernel/mac80211/patches/build/010-disable_rfkill.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- a/backport-include/linux/rfkill.h
-+++ b/backport-include/linux/rfkill.h
-@@ -2,6 +2,12 @@
- #define __COMPAT_RFKILL_H
- #include <linux/version.h>
- 
-+#undef CONFIG_RFKILL
-+#undef CONFIG_RFKILL_FULL
-+#undef CONFIG_RFKILL_LEDS
-+#undef CONFIG_RFKILL_MODULE
-+#undef CONFIG_RFKILL_FULL_MODULE
-+
- #if LINUX_VERSION_IS_GEQ(3,10,0)
- #include_next <linux/rfkill.h>
- #else
diff --git a/package/kernel/mac80211/patches/build/015-ipw200-mtu.patch b/package/kernel/mac80211/patches/build/015-ipw200-mtu.patch
deleted file mode 100644
index 68db4f72d..000000000
--- a/package/kernel/mac80211/patches/build/015-ipw200-mtu.patch
+++ /dev/null
@@ -1,34 +0,0 @@
---- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
-+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
-@@ -11470,6 +11470,15 @@ static const struct attribute_group ipw_
- 	.attrs = ipw_sysfs_entries,
- };
- 
-+#if LINUX_VERSION_IS_LESS(4,10,0)
-+static int __change_mtu(struct net_device *ndev, int new_mtu){
-+	if (new_mtu < 68 || new_mtu > LIBIPW_DATA_LEN)
-+		return -EINVAL;
-+	ndev->mtu = new_mtu;
-+	return 0;
-+}
-+#endif
-+
- #ifdef CPTCFG_IPW2200_PROMISCUOUS
- static int ipw_prom_open(struct net_device *dev)
- {
-@@ -11518,15 +11527,6 @@ static netdev_tx_t ipw_prom_hard_start_x
- 	return NETDEV_TX_OK;
- }
- 
--#if LINUX_VERSION_IS_LESS(4,10,0)
--static int __change_mtu(struct net_device *ndev, int new_mtu){
--	if (new_mtu < 68 || new_mtu > LIBIPW_DATA_LEN)
--		return -EINVAL;
--	ndev->mtu = new_mtu;
--	return 0;
--}
--#endif
--
- static const struct net_device_ops ipw_prom_netdev_ops = {
- #if LINUX_VERSION_IS_LESS(4,10,0)
- 	.ndo_change_mtu = __change_mtu,
diff --git a/package/kernel/mac80211/patches/build/050-lib80211_option.patch b/package/kernel/mac80211/patches/build/050-lib80211_option.patch
deleted file mode 100644
index c1b1bc757..000000000
--- a/package/kernel/mac80211/patches/build/050-lib80211_option.patch
+++ /dev/null
@@ -1,34 +0,0 @@
---- a/net/wireless/Kconfig
-+++ b/net/wireless/Kconfig
-@@ -188,7 +188,7 @@ config CFG80211_WEXT_EXPORT
- endif # CFG80211
- 
- config LIB80211
--	tristate
-+	tristate "lib80211"
- 	depends on m
- 	default n
- 	help
-@@ -198,19 +198,19 @@ config LIB80211
- 	  Drivers should select this themselves if needed.
- 
- config LIB80211_CRYPT_WEP
--	tristate
-+	tristate "lib80211 WEP support"
- 	depends on m
- 	select BPAUTO_CRYPTO_LIB_ARC4
- 
- config LIB80211_CRYPT_CCMP
--	tristate
-+	tristate "lib80211 CCMP support"
- 	depends on m
- 	depends on CRYPTO
- 	depends on CRYPTO_AES
- 	depends on CRYPTO_CCM
- 
- config LIB80211_CRYPT_TKIP
--	tristate
-+	tristate "lib80211 TKIP support"
- 	depends on m
- 	select BPAUTO_CRYPTO_LIB_ARC4
- 
diff --git a/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch b/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch
index ff2ce2071..4ad2ac081 100644
--- a/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch
+++ b/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch
@@ -1,9 +1,9 @@
 --- a/local-symbols
 +++ b/local-symbols
-@@ -437,43 +437,6 @@ USB_SIERRA_NET=
- USB_VL600=
+@@ -470,43 +470,6 @@ USB_VL600=
  USB_NET_CH9200=
  USB_NET_AQC111=
+ USB_RTL8153_ECM=
 -SSB_POSSIBLE=
 -SSB=
 -SSB_SPROM=
@@ -99,7 +99,7 @@
  	return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
  #else
  	return bus->chipco.dev;
-@@ -4870,7 +4870,7 @@ static int b43_wireless_core_init(struct
+@@ -4871,7 +4871,7 @@ static int b43_wireless_core_init(struct
  	}
  	if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
  		hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
@@ -158,27 +158,6 @@
  	pcidev = bus->pcicore.dev;
  #endif
  	gpiodev = bus->chipco.dev ? : pcidev;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
-@@ -24,7 +24,7 @@ struct brcms_led {
- 	struct gpio_desc *gpiod;
- };
- 
--#ifdef CPTCFG_BCMA_DRIVER_GPIO
-+#ifdef CONFIG_BCMA_DRIVER_GPIO
- void brcms_led_unregister(struct brcms_info *wl);
- int brcms_led_register(struct brcms_info *wl);
- #else
---- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
-@@ -42,6 +42,6 @@ brcmsmac-y := \
- 	brcms_trace_events.o \
- 	debug.o
- 
--brcmsmac-$(CPTCFG_BCMA_DRIVER_GPIO) += led.o
-+brcmsmac-$(CONFIG_BCMA_DRIVER_GPIO) += led.o
- 
- obj-$(CPTCFG_BRCMSMAC)	+= brcmsmac.o
 --- a/drivers/net/wireless/broadcom/brcm80211/Kconfig
 +++ b/drivers/net/wireless/broadcom/brcm80211/Kconfig
 @@ -8,7 +8,7 @@ config BRCMSMAC
@@ -187,15 +166,15 @@
  	depends on BCMA_POSSIBLE
 -	select BCMA
 +	depends on BCMA
- 	select NEW_LEDS if BCMA_DRIVER_GPIO
- 	select LEDS_CLASS if BCMA_DRIVER_GPIO
  	select BRCMUTIL
+ 	depends on FW_LOADER
+ 	depends on CORDIC
 --- a/Kconfig.local
 +++ b/Kconfig.local
-@@ -1315,117 +1315,6 @@ config BACKPORTED_USB_NET_CH9200
- config BACKPORTED_USB_NET_AQC111
+@@ -1414,117 +1414,6 @@ config BACKPORTED_USB_NET_AQC111
+ config BACKPORTED_USB_RTL8153_ECM
  	tristate
- 	default USB_NET_AQC111
+ 	default USB_RTL8153_ECM
 -config BACKPORTED_SSB_POSSIBLE
 -	tristate
 -	default SSB_POSSIBLE
@@ -312,7 +291,7 @@
  	default USB_ACM
 --- a/Kconfig.sources
 +++ b/Kconfig.sources
-@@ -7,9 +7,6 @@ source "$BACKPORT_DIR/net/mac80211/Kconf
+@@ -10,9 +10,6 @@ source "$BACKPORT_DIR/drivers/soc/qcom/K
  source "$BACKPORT_DIR/drivers/net/wireless/Kconfig"
  source "$BACKPORT_DIR/drivers/net/usb/Kconfig"
  
@@ -324,9 +303,9 @@
  source "$BACKPORT_DIR/drivers/staging/Kconfig"
 --- a/Makefile.kernel
 +++ b/Makefile.kernel
-@@ -40,8 +40,6 @@ obj-y += compat/
- obj-$(CPTCFG_CFG80211) += net/wireless/
- obj-$(CPTCFG_MAC80211) += net/mac80211/
+@@ -43,8 +43,6 @@ obj-$(CPTCFG_QRTR) += net/qrtr/
+ obj-$(CPTCFG_QCOM_QMI_HELPERS) += drivers/soc/qcom/
+ obj-$(CPTCFG_MHI_BUS) += drivers/bus/mhi/
  obj-$(CPTCFG_WLAN) += drivers/net/wireless/
 -obj-$(CPTCFG_SSB) += drivers/ssb/
 -obj-$(CPTCFG_BCMA) += drivers/bcma/
diff --git a/package/kernel/mac80211/patches/build/070-remove-broken-wext-select.patch b/package/kernel/mac80211/patches/build/070-remove-broken-wext-select.patch
new file mode 100644
index 000000000..121b7faad
--- /dev/null
+++ b/package/kernel/mac80211/patches/build/070-remove-broken-wext-select.patch
@@ -0,0 +1,10 @@
+--- a/drivers/staging/rtl8723bs/Kconfig
++++ b/drivers/staging/rtl8723bs/Kconfig
+@@ -5,7 +5,6 @@ config RTL8723BS
+ 	depends on m
+ 	depends on WLAN && MMC && CFG80211
+ 	depends on m
+-	select CFG80211_WEXT
+ 	depends on CRYPTO
+ 	select BPAUTO_CRYPTO_LIB_ARC4
+ 	help
diff --git a/package/kernel/mac80211/patches/build/080-resv_start_op.patch b/package/kernel/mac80211/patches/build/080-resv_start_op.patch
new file mode 100644
index 000000000..40b8e94a2
--- /dev/null
+++ b/package/kernel/mac80211/patches/build/080-resv_start_op.patch
@@ -0,0 +1,24 @@
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -5363,7 +5363,9 @@ static struct genl_family hwsim_genl_fam
+ 	.module = THIS_MODULE,
+ 	.small_ops = hwsim_ops,
+ 	.n_small_ops = ARRAY_SIZE(hwsim_ops),
++#if LINUX_VERSION_IS_GEQ(6,1,0)
+ 	.resv_start_op = HWSIM_CMD_DEL_MAC_ADDR + 1,
++#endif
+ 	.mcgrps = hwsim_mcgrps,
+ 	.n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
+ };
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -17233,7 +17233,9 @@ static struct genl_family nl80211_fam __
+ 	.n_ops = ARRAY_SIZE(nl80211_ops),
+ 	.small_ops = nl80211_small_ops,
+ 	.n_small_ops = ARRAY_SIZE(nl80211_small_ops),
++#if LINUX_VERSION_IS_GEQ(6,1,0)
+ 	.resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
++#endif
+ 	.mcgrps = nl80211_mcgrps,
+ 	.n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
+ 	.parallel_ops = true,
diff --git a/package/kernel/mac80211/patches/build/090-bcma-otp.patch b/package/kernel/mac80211/patches/build/090-bcma-otp.patch
new file mode 100644
index 000000000..397477612
--- /dev/null
+++ b/package/kernel/mac80211/patches/build/090-bcma-otp.patch
@@ -0,0 +1,13 @@
+--- /dev/null
++++ b/backport-include/linux/bcma/bcma_driver_chipcommon.h
+@@ -0,0 +1,10 @@
++#ifndef __BACKPORT_BCMA_DRIVER_CHIPCOMMON_H
++#define __BACKPORT_BCMA_DRIVER_CHIPCOMMON_H
++
++#include_next <linux/bcma/bcma_driver_chipcommon.h>
++
++#ifndef BCMA_CC_SROM_CONTROL_OTP_PRESENT
++#define BCMA_CC_SROM_CONTROL_OTP_PRESENT 0x00000020
++#endif
++
++#endif
diff --git a/package/kernel/mac80211/patches/build/100-backports-drop-QRTR-and-MHI.patch b/package/kernel/mac80211/patches/build/100-backports-drop-QRTR-and-MHI.patch
new file mode 100644
index 000000000..b017a0ce1
--- /dev/null
+++ b/package/kernel/mac80211/patches/build/100-backports-drop-QRTR-and-MHI.patch
@@ -0,0 +1,76 @@
+From 54e0f9aaf340377fb76acdffee9ec7372c4b70ae Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Mon, 17 Oct 2022 11:35:36 +0200
+Subject: [PATCH] backports: drop QRTR and MHI
+
+Backports currently include QRTR and MHI due to ath11k-pci requiring them,
+however this at the same time prevents us from adding ath11k-ahb as it
+also requires QRTR however its AHB variant from the kernel will conflict
+with the core provided by backports.
+
+Since MHI also conflicts with existing OpenWrt kmods providing MHI drop
+both from backports and use the ones provided by OpenWrt kernel.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ Kconfig.sources                         | 2 --
+ Makefile.kernel                         | 2 --
+ drivers/net/wireless/ath/ath11k/Kconfig | 6 +++---
+ local-symbols                           | 8 --------
+ 4 files changed, 3 insertions(+), 15 deletions(-)
+
+--- a/Kconfig.sources
++++ b/Kconfig.sources
+@@ -4,8 +4,6 @@ source "$BACKPORT_DIR/compat/Kconfig"
+ # these are copied from the kernel
+ source "$BACKPORT_DIR/net/wireless/Kconfig"
+ source "$BACKPORT_DIR/net/mac80211/Kconfig"
+-source "$BACKPORT_DIR/net/qrtr/Kconfig"
+-source "$BACKPORT_DIR/drivers/bus/mhi/Kconfig"
+ source "$BACKPORT_DIR/drivers/soc/qcom/Kconfig"
+ source "$BACKPORT_DIR/drivers/net/wireless/Kconfig"
+ source "$BACKPORT_DIR/drivers/net/usb/Kconfig"
+--- a/Makefile.kernel
++++ b/Makefile.kernel
+@@ -39,9 +39,7 @@ obj-y += compat/
+ 
+ obj-$(CPTCFG_CFG80211) += net/wireless/
+ obj-$(CPTCFG_MAC80211) += net/mac80211/
+-obj-$(CPTCFG_QRTR) += net/qrtr/
+ obj-$(CPTCFG_QCOM_QMI_HELPERS) += drivers/soc/qcom/
+-obj-$(CPTCFG_MHI_BUS) += drivers/bus/mhi/
+ obj-$(CPTCFG_WLAN) += drivers/net/wireless/
+ obj-$(CPTCFG_USB_NET_RNDIS_WLAN) += drivers/net/usb/
+ 
+--- a/drivers/net/wireless/ath/ath11k/Kconfig
++++ b/drivers/net/wireless/ath/ath11k/Kconfig
+@@ -25,9 +25,9 @@ config ATH11K_PCI
+ 	tristate "Atheros ath11k PCI support"
+ 	depends on m
+ 	depends on ATH11K && PCI
+-	select MHI_BUS
+-	select QRTR
+-	select QRTR_MHI
++	depends on MHI_BUS
++	depends on QRTR
++	depends on QRTR_MHI
+ 	help
+ 	  This module adds support for PCIE bus
+ 
+--- a/local-symbols
++++ b/local-symbols
+@@ -65,14 +65,6 @@ MAC80211_MESH_PS_DEBUG=
+ MAC80211_TDLS_DEBUG=
+ MAC80211_DEBUG_COUNTERS=
+ MAC80211_STA_HASH_MAX_SIZE=
+-QRTR=
+-QRTR_SMD=
+-QRTR_TUN=
+-QRTR_MHI=
+-MHI_BUS=
+-MHI_BUS_DEBUG=
+-MHI_BUS_PCI_GENERIC=
+-MHI_BUS_EP=
+ QCOM_AOSS_QMP=
+ QCOM_COMMAND_DB=
+ QCOM_CPR=
diff --git a/package/kernel/mac80211/patches/build/110-backport_napi_build_skb.patch b/package/kernel/mac80211/patches/build/110-backport_napi_build_skb.patch
new file mode 100644
index 000000000..1e152fece
--- /dev/null
+++ b/package/kernel/mac80211/patches/build/110-backport_napi_build_skb.patch
@@ -0,0 +1,11 @@
+--- a/backport-include/linux/skbuff.h
++++ b/backport-include/linux/skbuff.h
+@@ -144,4 +144,8 @@ static inline u64 skb_get_kcov_handle(st
+ #define napi_build_skb build_skb
+ #endif
+ 
++#if LINUX_VERSION_IS_LESS(5,11,0)
++#define napi_build_skb build_skb
++#endif
++
+ #endif /* __BACKPORT_SKBUFF_H */
diff --git a/package/kernel/mac80211/patches/mt7601u/001-wifi-mt7601u-update-firmware-path.patch b/package/kernel/mac80211/patches/mt7601u/001-wifi-mt7601u-update-firmware-path.patch
new file mode 100644
index 000000000..5d982906c
--- /dev/null
+++ b/package/kernel/mac80211/patches/mt7601u/001-wifi-mt7601u-update-firmware-path.patch
@@ -0,0 +1,55 @@
+From patchwork Mon May 15 22:56:53 2023
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 13242309
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@vger.kernel.org>
+Date: Tue, 16 May 2023 00:56:53 +0200
+From: Daniel Golle <daniel@makrotopia.org>
+To: Jakub Kicinski <kuba@kernel.org>, Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Matthias Brugger <matthias.bgg@gmail.com>,
+        AngeloGioacchino Del Regno
+        <angelogioacchino.delregno@collabora.com>,
+        linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
+        linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
+        linux-mediatek@lists.infradead.org
+Subject: [PATCH] wifi: mt7601u: update firmware path
+Message-ID: 
+ <fefcbf36f13873ae0d97438a0156b87e7e1ae64e.1684191377.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+mt7601u.bin was moved to mediatek/ folder in linux-wireless via commit
+8451c2b1 ("mt76xx: Move the old Mediatek WiFi firmware to mediatek")
+and linux-firmware release 20230515.
+
+Update the firmware path requested by the mt7601u driver to follow up
+with the move of the file.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/wireless/mediatek/mt7601u/usb.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+
+base-commit: 0d9b41daa5907756a31772d8af8ac5ff25cf17c1
+
+--- a/drivers/net/wireless/mediatek/mt7601u/usb.h
++++ b/drivers/net/wireless/mediatek/mt7601u/usb.h
+@@ -8,7 +8,7 @@
+ 
+ #include "mt7601u.h"
+ 
+-#define MT7601U_FIRMWARE	"mt7601u.bin"
++#define MT7601U_FIRMWARE	"mediatek/mt7601u.bin"
+ 
+ #define MT_VEND_REQ_MAX_RETRY	10
+ #define MT_VEND_REQ_TOUT_MS	300
diff --git a/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch b/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
index d358cfe36..11536651b 100644
--- a/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
+++ b/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/mwl8k.c
 +++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -5695,6 +5695,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
+@@ -5703,6 +5703,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
  MODULE_FIRMWARE(MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API));
  
  static const struct pci_device_id mwl8k_pci_id_table[] = {
diff --git a/package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch b/package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch
index dfa0e502f..1dbcb1bfe 100644
--- a/package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch
+++ b/package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/libertas/cfg.c
 +++ b/drivers/net/wireless/marvell/libertas/cfg.c
-@@ -2053,6 +2053,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
+@@ -2052,6 +2052,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
  		goto err_wiphy_new;
  	}
  
diff --git a/package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch b/package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch
index c2d0a5890..b47aee549 100644
--- a/package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch
+++ b/package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/libertas/cfg.c
 +++ b/drivers/net/wireless/marvell/libertas/cfg.c
-@@ -2129,6 +2129,8 @@ int lbs_cfg_register(struct lbs_private
+@@ -2128,6 +2128,8 @@ int lbs_cfg_register(struct lbs_private
  	wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
  	wdev->wiphy->reg_notifier = lbs_reg_notifier;
  
diff --git a/package/kernel/mac80211/patches/mwl/900-mwifiex-increase-the-global-limit-up-to-4-SSID.patch b/package/kernel/mac80211/patches/mwl/900-mwifiex-increase-the-global-limit-up-to-4-SSID.patch
new file mode 100644
index 000000000..caa139a2c
--- /dev/null
+++ b/package/kernel/mac80211/patches/mwl/900-mwifiex-increase-the-global-limit-up-to-4-SSID.patch
@@ -0,0 +1,41 @@
+From ef8098cd6cb8b5989afef2e8461fe6ba9570a854 Mon Sep 17 00:00:00 2001
+From: Josef Schlehofer <pepe.schlehofer@gmail.com>
+Date: Wed, 24 Nov 2021 12:47:40 +0100
+Subject: [PATCH] mwifiex: increase the global limit up to 4 SSID
+
+Firmware for SDIO (88W8997), which is used in Turris MOX SDIO addon [1],
+allows up to 4 SSID. Unfortunately, driver (even in mainline kernel)
+has a global limit for all Marvell cards up to 3 SSID.
+
+Pali Rohár tested this patch and verified that the SDIO Wi-Fi addon works
+with the 4 SSID. So, let's increase the global limit from 3 to 4.
+
+Ideally, this patch should be done differently before sending
+it to Linux kernel. It means that limit definition should be moved to
+the card-specific structure.
+
+[1] https://docs.turris.cz/hw/mox/addons/#wi-fi-sdio
+---
+ drivers/net/wireless/marvell/mwifiex/decl.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/decl.h
++++ b/drivers/net/wireless/marvell/mwifiex/decl.h
+@@ -18,7 +18,7 @@
+ #include <net/cfg80211.h>
+ 
+ #define MWIFIEX_BSS_COEX_COUNT	     2
+-#define MWIFIEX_MAX_BSS_NUM         (3)
++#define MWIFIEX_MAX_BSS_NUM         (4)
+ 
+ #define MWIFIEX_DMA_ALIGN_SZ	    64
+ #define MWIFIEX_RX_HEADROOM	    64
+@@ -100,7 +100,7 @@
+ #define MWIFIEX_RATE_INDEX_OFDM0   4
+ 
+ #define MWIFIEX_MAX_STA_NUM		3
+-#define MWIFIEX_MAX_UAP_NUM		3
++#define MWIFIEX_MAX_UAP_NUM		4
+ #define MWIFIEX_MAX_P2P_NUM		3
+ 
+ #define MWIFIEX_A_BAND_START_FREQ	5000
diff --git a/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
index a35cf1875..c8d24283a 100644
--- a/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/mwl8k.c
 +++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -6280,6 +6280,8 @@ static int mwl8k_probe(struct pci_dev *p
+@@ -6289,6 +6289,8 @@ static int mwl8k_probe(struct pci_dev *p
  
  	priv->running_bsses = 0;
  
@@ -9,7 +9,7 @@
  	return rc;
  
  err_stop_firmware:
-@@ -6313,8 +6315,6 @@ static void mwl8k_remove(struct pci_dev
+@@ -6322,8 +6324,6 @@ static void mwl8k_remove(struct pci_dev
  		return;
  	priv = hw->priv;
  
diff --git a/package/kernel/mac80211/patches/mwl/950-mwifiex-Print-stringified-name-of-command-in-error-l.patch b/package/kernel/mac80211/patches/mwl/950-mwifiex-Print-stringified-name-of-command-in-error-l.patch
new file mode 100644
index 000000000..98ed9e60e
--- /dev/null
+++ b/package/kernel/mac80211/patches/mwl/950-mwifiex-Print-stringified-name-of-command-in-error-l.patch
@@ -0,0 +1,189 @@
+From f7252b1b5755150535af226e806594bbefd45e0f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Sun, 26 Sep 2021 14:39:44 +0200
+Subject: [PATCH] mwifiex: Print stringified name of command in error log
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Failed hex command number in error log is hard to understand.
+So add also more human readable stringified command name into error log.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/cmdevt.c | 96 +++++++++++++++++--
+ drivers/net/wireless/marvell/mwifiex/main.h   |  2 +
+ .../wireless/marvell/mwifiex/sta_cmdresp.c    |  5 +-
+ .../net/wireless/marvell/mwifiex/uap_cmd.c    |  3 +-
+ 4 files changed, 95 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c
++++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c
+@@ -16,6 +16,85 @@
+ 
+ static void mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter);
+ 
++const char *
++mwifiex_cmd_to_str(u16 command)
++{
++	switch (command) {
++	case HostCmd_CMD_GET_HW_SPEC:			return "GET_HW_SPEC";
++	case HostCmd_CMD_802_11_SCAN:			return "SCAN";
++	case HostCmd_CMD_802_11_GET_LOG:		return "GET_LOG";
++	case HostCmd_CMD_MAC_MULTICAST_ADR:		return "MAC_MULTICAST_ADR";
++	case HostCmd_CMD_802_11_EEPROM_ACCESS:		return "EEPROM_ACCESS";
++	case HostCmd_CMD_802_11_ASSOCIATE:		return "ASSOCIATE";
++	case HostCmd_CMD_802_11_SNMP_MIB:		return "SNMP_MIB";
++	case HostCmd_CMD_MAC_REG_ACCESS:		return "MAC_REG_ACCESS";
++	case HostCmd_CMD_BBP_REG_ACCESS:		return "BBP_REG_ACCESS";
++	case HostCmd_CMD_RF_REG_ACCESS:			return "RF_REG_ACCESS";
++	case HostCmd_CMD_PMIC_REG_ACCESS:		return "PMIC_REG_ACCESS";
++	case HostCmd_CMD_RF_TX_PWR:			return "RF_TX_PWR";
++	case HostCmd_CMD_RF_ANTENNA:			return "RF_ANTENNA";
++	case HostCmd_CMD_802_11_DEAUTHENTICATE:		return "DEAUTHENTICATE";
++	case HostCmd_CMD_MAC_CONTROL:			return "MAC_CONTROL";
++	case HostCmd_CMD_802_11_AD_HOC_START:		return "AD_HOC_START";
++	case HostCmd_CMD_802_11_AD_HOC_JOIN:		return "AD_HOC_JOIN";
++	case HostCmd_CMD_802_11_AD_HOC_STOP:		return "AD_HOC_STOP";
++	case HostCmd_CMD_802_11_MAC_ADDRESS:		return "MAC_ADDRESS";
++	case HostCmd_CMD_802_11D_DOMAIN_INFO:		return "DOMAIN_INFO";
++	case HostCmd_CMD_802_11_KEY_MATERIAL:		return "KEY_MATERIAL";
++	case HostCmd_CMD_802_11_BG_SCAN_CONFIG:		return "BG_SCAN_CONFIG";
++	case HostCmd_CMD_802_11_BG_SCAN_QUERY:		return "BG_SCAN_QUERY";
++	case HostCmd_CMD_WMM_GET_STATUS:		return "WMM_GET_STATUS";
++	case HostCmd_CMD_802_11_SUBSCRIBE_EVENT:	return "SUBSCRIBE_EVENT";
++	case HostCmd_CMD_802_11_TX_RATE_QUERY:		return "TX_RATE_QUERY";
++	case HostCmd_CMD_802_11_IBSS_COALESCING_STATUS:	return "IBSS_COALESCING_STATUS";
++	case HostCmd_CMD_MEM_ACCESS:			return "MEM_ACCESS";
++	case HostCmd_CMD_CFG_DATA:			return "CFG_DATA";
++	case HostCmd_CMD_VERSION_EXT:			return "VERSION_EXT";
++	case HostCmd_CMD_MEF_CFG:			return "MEF_CFG";
++	case HostCmd_CMD_RSSI_INFO:			return "RSSI_INFO";
++	case HostCmd_CMD_FUNC_INIT:			return "FUNC_INIT";
++	case HostCmd_CMD_FUNC_SHUTDOWN:			return "FUNC_SHUTDOWN";
++	case HOST_CMD_APCMD_SYS_RESET:			return "SYS_RESET";
++	case HostCmd_CMD_UAP_SYS_CONFIG:		return "UAP_SYS_CONFIG";
++	case HostCmd_CMD_UAP_BSS_START:			return "UAP_BSS_START";
++	case HostCmd_CMD_UAP_BSS_STOP:			return "UAP_BSS_STOP";
++	case HOST_CMD_APCMD_STA_LIST:			return "STA_LIST";
++	case HostCmd_CMD_UAP_STA_DEAUTH:		return "UAP_STA_DEAUTH";
++	case HostCmd_CMD_11N_CFG:			return "11N_CFG";
++	case HostCmd_CMD_11N_ADDBA_REQ:			return "ADDBA_REQ";
++	case HostCmd_CMD_11N_ADDBA_RSP:			return "ADDBA_RSP";
++	case HostCmd_CMD_11N_DELBA:			return "DELBA";
++	case HostCmd_CMD_RECONFIGURE_TX_BUFF:		return "RECONFIGURE_TX_BUFF";
++	case HostCmd_CMD_CHAN_REPORT_REQUEST:		return "CHAN_REPORT_REQUEST";
++	case HostCmd_CMD_AMSDU_AGGR_CTRL:		return "AMSDU_AGGR_CTRL";
++	case HostCmd_CMD_TXPWR_CFG:			return "TXPWR_CFG";
++	case HostCmd_CMD_TX_RATE_CFG:			return "TX_RATE_CFG";
++	case HostCmd_CMD_ROBUST_COEX:			return "ROBUST_COEX";
++	case HostCmd_CMD_802_11_PS_MODE_ENH:		return "PS_MODE_ENH";
++	case HostCmd_CMD_802_11_HS_CFG_ENH:		return "HS_CFG_ENH";
++	case HostCmd_CMD_P2P_MODE_CFG:			return "P2P_MODE_CFG";
++	case HostCmd_CMD_CAU_REG_ACCESS:		return "CAU_REG_ACCESS";
++	case HostCmd_CMD_SET_BSS_MODE:			return "SET_BSS_MODE";
++	case HostCmd_CMD_PCIE_DESC_DETAILS:		return "PCIE_DESC_DETAILS";
++	case HostCmd_CMD_802_11_SCAN_EXT:		return "SCAN_EXT";
++	case HostCmd_CMD_COALESCE_CFG:			return "COALESCE_CFG";
++	case HostCmd_CMD_MGMT_FRAME_REG:		return "MGMT_FRAME_REG";
++	case HostCmd_CMD_REMAIN_ON_CHAN:		return "REMAIN_ON_CHAN";
++	case HostCmd_CMD_GTK_REKEY_OFFLOAD_CFG:		return "GTK_REKEY_OFFLOAD_CFG";
++	case HostCmd_CMD_11AC_CFG:			return "11AC_CFG";
++	case HostCmd_CMD_HS_WAKEUP_REASON:		return "HS_WAKEUP_REASON";
++	case HostCmd_CMD_TDLS_CONFIG:			return "TDLS_CONFIG";
++	case HostCmd_CMD_MC_POLICY:			return "MC_POLICY";
++	case HostCmd_CMD_TDLS_OPER:			return "TDLS_OPER";
++	case HostCmd_CMD_FW_DUMP_EVENT:			return "FW_DUMP_EVENT";
++	case HostCmd_CMD_SDIO_SP_RX_AGGR_CFG:		return "SDIO_SP_RX_AGGR_CFG";
++	case HostCmd_CMD_STA_CONFIGURE:			return "STA_CONFIGURE";
++	case HostCmd_CMD_CHAN_REGION_CFG:		return "CHAN_REGION_CFG";
++	case HostCmd_CMD_PACKET_AGGR_CTRL:		return "PACKET_AGGR_CTRL";
++	default:					return "UNKNOWN";
++	}
++}
++
+ /*
+  * This function initializes a command node.
+  *
+@@ -193,8 +272,8 @@ static int mwifiex_dnld_cmd_to_fw(struct
+ 	    cmd_code != HostCmd_CMD_FUNC_SHUTDOWN &&
+ 	    cmd_code != HostCmd_CMD_FUNC_INIT) {
+ 		mwifiex_dbg(adapter, ERROR,
+-			    "DNLD_CMD: FW in reset state, ignore cmd %#x\n",
+-			cmd_code);
++			    "DNLD_CMD: FW in reset state, ignore cmd %s (%#x)\n",
++			    mwifiex_cmd_to_str(cmd_code), cmd_code);
+ 		mwifiex_recycle_cmd_node(adapter, cmd_node);
+ 		queue_work(adapter->workqueue, &adapter->main_work);
+ 		return -1;
+@@ -653,8 +732,8 @@ int mwifiex_send_cmd(struct mwifiex_priv
+ 	/* Return error, since the command preparation failed */
+ 	if (ret) {
+ 		mwifiex_dbg(adapter, ERROR,
+-			    "PREP_CMD: cmd %#x preparation failed\n",
+-			cmd_no);
++			    "PREP_CMD: cmd %s (%#x) preparation failed\n",
++			    mwifiex_cmd_to_str(cmd_no), cmd_no);
+ 		mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
+ 		return -1;
+ 	}
+@@ -902,8 +981,9 @@ int mwifiex_process_cmdresp(struct mwifi
+ 	if (adapter->hw_status == MWIFIEX_HW_STATUS_INITIALIZING) {
+ 		if (ret) {
+ 			mwifiex_dbg(adapter, ERROR,
+-				    "%s: cmd %#x failed during\t"
+-				    "initialization\n", __func__, cmdresp_no);
++				    "%s: cmd %s (%#x) failed during\t"
++				    "initialization\n", __func__,
++				    mwifiex_cmd_to_str(cmdresp_no), cmdresp_no);
+ 			mwifiex_init_fw_complete(adapter);
+ 			return -1;
+ 		} else if (adapter->last_init_cmd == cmdresp_no)
+@@ -1273,8 +1353,8 @@ mwifiex_process_sleep_confirm_resp(struc
+ 
+ 	if (command != HostCmd_CMD_802_11_PS_MODE_ENH) {
+ 		mwifiex_dbg(adapter, ERROR,
+-			    "%s: rcvd unexpected resp for cmd %#x, result = %x\n",
+-			    __func__, command, result);
++			    "%s: rcvd unexpected resp for cmd %s (%#x), result = %x\n",
++			    __func__, mwifiex_cmd_to_str(command), command, result);
+ 		return;
+ 	}
+ 
+--- a/drivers/net/wireless/marvell/mwifiex/main.h
++++ b/drivers/net/wireless/marvell/mwifiex/main.h
+@@ -1099,6 +1099,8 @@ void mwifiex_cancel_all_pending_cmd(stru
+ void mwifiex_cancel_pending_scan_cmd(struct mwifiex_adapter *adapter);
+ void mwifiex_cancel_scan(struct mwifiex_adapter *adapter);
+ 
++const char *mwifiex_cmd_to_str(u16 command);
++
+ void mwifiex_recycle_cmd_node(struct mwifiex_adapter *adapter,
+ 			      struct cmd_ctrl_node *cmd_node);
+ 
+--- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+@@ -36,8 +36,9 @@ mwifiex_process_cmdresp_error(struct mwi
+ 	struct host_cmd_ds_802_11_ps_mode_enh *pm;
+ 
+ 	mwifiex_dbg(adapter, ERROR,
+-		    "CMD_RESP: cmd %#x error, result=%#x\n",
+-		    resp->command, resp->result);
++		    "CMD_RESP: cmd %s (%#x) error, result=%#x\n",
++		    mwifiex_cmd_to_str(le16_to_cpu(resp->command)),
++		    le16_to_cpu(resp->command), le16_to_cpu(resp->result));
+ 
+ 	if (adapter->curr_cmd->wait_q_enabled)
+ 		adapter->cmd_wait_q.status = -1;
+--- a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
++++ b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
+@@ -794,7 +794,8 @@ int mwifiex_uap_prepare_cmd(struct mwifi
+ 		break;
+ 	default:
+ 		mwifiex_dbg(priv->adapter, ERROR,
+-			    "PREP_CMD: unknown cmd %#x\n", cmd_no);
++			    "PREP_CMD: unknown cmd (%s) %#x\n",
++			    mwifiex_cmd_to_str(cmd_no), cmd_no);
+ 		return -1;
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/rt2x00/002-rt2x00-define-RF5592-in-init_eeprom-routine.patch b/package/kernel/mac80211/patches/rt2x00/002-rt2x00-define-RF5592-in-init_eeprom-routine.patch
deleted file mode 100644
index a50a19528..000000000
--- a/package/kernel/mac80211/patches/rt2x00/002-rt2x00-define-RF5592-in-init_eeprom-routine.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From patchwork Thu Dec 27 14:05:26 2018
-Content-Type: text/plain; charset="utf-8"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 8bit
-X-Patchwork-Submitter: Tom Psyborg <pozega.tomislav@gmail.com>
-X-Patchwork-Id: 10743707
-X-Patchwork-Delegate: kvalo@adurom.com
-From: =?utf-8?q?Tomislav_Po=C5=BEega?= <pozega.tomislav@gmail.com>
-To: linux-wireless@vger.kernel.org
-Cc: kvalo@codeaurora.org, hauke@hauke-m.de, nbd@nbd.name,
-        john@phrozen.org, sgruszka@redhat.com, daniel@makrotopia.org
-Subject: [PATCH 2/2] rt2x00: define RF5592 in init_eeprom routine
-Date: Thu, 27 Dec 2018 15:05:26 +0100
-Message-Id: <1545919526-4074-2-git-send-email-pozega.tomislav@gmail.com>
-X-Mailer: git-send-email 1.7.0.4
-In-Reply-To: <1545919526-4074-1-git-send-email-pozega.tomislav@gmail.com>
-References: <1545919526-4074-1-git-send-email-pozega.tomislav@gmail.com>
-MIME-Version: 1.0
-Sender: linux-wireless-owner@vger.kernel.org
-Precedence: bulk
-List-ID: <linux-wireless.vger.kernel.org>
-X-Mailing-List: linux-wireless@vger.kernel.org
-X-Virus-Scanned: ClamAV using ClamSMTP
-
-This patch fixes following crash on Linksys EA2750 during 5GHz wifi
-init:
-
-[    7.955153] rt2800pci 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
-[    7.962259] rt2800pci 0000:01:00.0: loaded eeprom from mtd device "Factory"
-[    7.969435] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 5592, rev 0222 detected
-[    7.977348] ieee80211 phy0: rt2800_init_eeprom: Error - Invalid RF chipset 0x0000 detected
-[    7.985793] ieee80211 phy0: rt2x00lib_probe_dev: Error - Failed to allocate device
-[    7.993569] CPU 0 Unable to handle kernel paging request at virtual address 00000024, epc == 800c8f54, ra == 80249ff8
-[    8.004408] Oops[#1]:
-
-Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    2 ++
- 1 files changed, 2 insertions(+), 0 deletions(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -9416,6 +9416,8 @@ static int rt2800_init_eeprom(struct rt2
- 		rf = RF3853;
- 	else if (rt2x00_rt(rt2x00dev, RT5350))
- 		rf = RF5350;
-+	else if (rt2x00_rt(rt2x00dev, RT5592))
-+		rf = RF5592;
- 	else
- 		rf = rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_RF_TYPE);
- 
diff --git a/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch b/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
index e74d9a9aa..ab0fa3670 100644
--- a/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
+++ b/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
@@ -1,6 +1,6 @@
 --- a/local-symbols
 +++ b/local-symbols
-@@ -332,6 +332,7 @@ RT2X00_LIB_FIRMWARE=
+@@ -347,6 +347,7 @@ RT2X00_LIB_FIRMWARE=
  RT2X00_LIB_CRYPTO=
  RT2X00_LIB_LEDS=
  RT2X00_LIB_DEBUGFS=
@@ -48,7 +48,7 @@
  obj-$(CPTCFG_RT2X00_LIB_MMIO)		+= rt2x00mmio.o
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-@@ -37,6 +37,8 @@ struct rt2800_drv_data {
+@@ -47,6 +47,8 @@ struct rt2800_drv_data {
  	struct ieee80211_sta *wcid_to_sta[STA_IDS_SIZE];
  };
  
@@ -57,7 +57,7 @@
  struct rt2800_ops {
  	u32 (*register_read)(struct rt2x00_dev *rt2x00dev,
  			      const unsigned int offset);
-@@ -135,6 +137,15 @@ static inline int rt2800_read_eeprom(str
+@@ -145,6 +147,15 @@ static inline int rt2800_read_eeprom(str
  {
  	const struct rt2800_ops *rt2800ops = rt2x00dev->ops->drv;
  
@@ -95,7 +95,7 @@
  /* Firmware functions */
  static char *rt2800soc_get_firmware_name(struct rt2x00_dev *rt2x00dev)
  {
-@@ -167,7 +154,6 @@ static const struct rt2800_ops rt2800soc
+@@ -168,7 +155,6 @@ static const struct rt2800_ops rt2800soc
  	.register_multiread	= rt2x00mmio_register_multiread,
  	.register_multiwrite	= rt2x00mmio_register_multiwrite,
  	.regbusy_read		= rt2x00mmio_regbusy_read,
@@ -105,7 +105,7 @@
  	.drv_init_registers	= rt2800mmio_init_registers,
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -694,6 +694,7 @@ enum rt2x00_capability_flags {
+@@ -703,6 +703,7 @@ enum rt2x00_capability_flags {
  	REQUIRE_HT_TX_DESC,
  	REQUIRE_PS_AUTOWAKE,
  	REQUIRE_DELAYED_RFKILL,
@@ -113,7 +113,7 @@
  
  	/*
  	 * Capabilities
-@@ -970,6 +971,11 @@ struct rt2x00_dev {
+@@ -980,6 +981,11 @@ struct rt2x00_dev {
  	const struct firmware *fw;
  
  	/*
@@ -127,7 +127,7 @@
  	DECLARE_KFIFO_PTR(txstatus_fifo, u32);
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1406,6 +1406,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+@@ -1419,6 +1419,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
  	INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
  	INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
  
@@ -138,7 +138,7 @@
  	/*
  	 * Let the driver probe the device to detect the capabilities.
  	 */
-@@ -1549,6 +1553,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
+@@ -1559,6 +1563,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
  	 * Free the driver data.
  	 */
  	kfree(rt2x00dev->drv_data);
@@ -193,7 +193,7 @@
 +	if (pdata && pdata->eeprom_file_name)
 +		return pdata->eeprom_file_name;
 +
-+	return NULL
++	return NULL;
 +}
 +
 +static int rt2x00lib_request_eeprom_file(struct rt2x00_dev *rt2x00dev)
diff --git a/package/kernel/mac80211/patches/rt2x00/603-rt2x00-of_load_eeprom_filename.patch b/package/kernel/mac80211/patches/rt2x00/603-rt2x00-of_load_eeprom_filename.patch
index 9dffef181..431e09023 100644
--- a/package/kernel/mac80211/patches/rt2x00/603-rt2x00-of_load_eeprom_filename.patch
+++ b/package/kernel/mac80211/patches/rt2x00/603-rt2x00-of_load_eeprom_filename.patch
@@ -8,7 +8,7 @@
  
  #include "rt2x00.h"
  #include "rt2x00lib.h"
-@@ -34,11 +35,21 @@ static const char *
+@@ -34,10 +35,20 @@ static const char *
  rt2x00lib_get_eeprom_file_name(struct rt2x00_dev *rt2x00dev)
  {
  	struct rt2x00_platform_data *pdata = rt2x00dev->dev->platform_data;
@@ -20,14 +20,12 @@
  	if (pdata && pdata->eeprom_file_name)
  		return pdata->eeprom_file_name;
  
--	return NULL
 +#ifdef CONFIG_OF
 +	np = rt2x00dev->dev->of_node;
 +	if (np && of_property_read_string(np, "ralink,eeprom", &eep) == 0)
 +	    return eep;
 +#endif
 +
-+	return NULL;
+ 	return NULL;
  }
  
- static int rt2x00lib_request_eeprom_file(struct rt2x00_dev *rt2x00dev)
diff --git a/package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch b/package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch
index 6a8e594d5..ffee2189d 100644
--- a/package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch
+++ b/package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch
@@ -12,7 +12,7 @@
  #endif /* _RT2X00_PLATFORM_H */
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1012,6 +1012,22 @@ static int rt2x00lib_probe_hw_modes(stru
+@@ -1007,6 +1007,22 @@ static int rt2x00lib_probe_hw_modes(stru
  	unsigned int num_rates;
  	unsigned int i;
  
@@ -37,7 +37,7 @@
  		num_rates += 4;
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -399,6 +399,7 @@ struct hw_mode_spec {
+@@ -408,6 +408,7 @@ struct hw_mode_spec {
  	unsigned int supported_bands;
  #define SUPPORT_BAND_2GHZ	0x00000001
  #define SUPPORT_BAND_5GHZ	0x00000002
diff --git a/package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch b/package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch
index b5b2c6103..37553bb80 100644
--- a/package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch
+++ b/package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch
@@ -1,19 +1,18 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -990,8 +990,13 @@ static void rt2x00lib_rate(struct ieee80
+@@ -989,6 +989,12 @@ static void rt2x00lib_rate(struct ieee80
  
  void rt2x00lib_set_mac_address(struct rt2x00_dev *rt2x00dev, u8 *eeprom_mac_addr)
  {
 +	struct rt2x00_platform_data *pdata;
- 	const char *mac_addr;
- 
++
 +	pdata = rt2x00dev->dev->platform_data;
 +	if (pdata && pdata->mac_address)
 +		ether_addr_copy(eeprom_mac_addr, pdata->mac_address);
 +
- 	mac_addr = of_get_mac_address(rt2x00dev->dev->of_node);
- 	if (!IS_ERR(mac_addr))
- 		ether_addr_copy(eeprom_mac_addr, mac_addr);
+ 	of_get_mac_address(rt2x00dev->dev->of_node, eeprom_mac_addr);
+ 
+ 	if (!is_valid_ether_addr(eeprom_mac_addr)) {
 --- a/include/linux/rt2x00_platform.h
 +++ b/include/linux/rt2x00_platform.h
 @@ -14,6 +14,7 @@
diff --git a/package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch b/package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch
index ff8b2c947..6211809c0 100644
--- a/package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch
+++ b/package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1016,6 +1016,16 @@ static int rt2x00lib_probe_hw_modes(stru
+@@ -1012,6 +1012,16 @@ static int rt2x00lib_probe_hw_modes(stru
  	struct ieee80211_rate *rates;
  	unsigned int num_rates;
  	unsigned int i;
diff --git a/package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch b/package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
index 38f8b7717..8964f8bf1 100644
--- a/package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
+++ b/package/kernel/mac80211/patches/rt2x00/609-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
@@ -13,7 +13,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
-@@ -224,10 +224,17 @@ static int rt2800soc_probe(struct platfo
+@@ -225,10 +225,17 @@ static int rt2800soc_probe(struct platfo
  	return rt2x00soc_probe(pdev, &rt2800soc_ops);
  }
  
diff --git a/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch b/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
index 039c6f6af..acc8a8edb 100644
--- a/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
+++ b/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
@@ -8,7 +8,7 @@
  
  #include "rt2x00.h"
  #include "rt2800lib.h"
-@@ -9530,6 +9531,17 @@ static int rt2800_init_eeprom(struct rt2
+@@ -11131,6 +11132,17 @@ static int rt2800_init_eeprom(struct rt2
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_assoc, LED_TYPE_ASSOC);
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_qual, LED_TYPE_QUALITY);
  
diff --git a/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch b/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
index 88d6dd559..5ef5fc8de 100644
--- a/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
+++ b/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1344,7 +1344,7 @@ static inline void rt2x00lib_set_if_comb
+@@ -1358,7 +1358,7 @@ static inline void rt2x00lib_set_if_comb
  	 */
  	if_limit = &rt2x00dev->if_limits_ap;
  	if_limit->max = rt2x00dev->ops->max_ap_intf;
diff --git a/package/kernel/mac80211/patches/rt2x00/612-rt2x00-led-tpt-trigger-support.patch b/package/kernel/mac80211/patches/rt2x00/612-rt2x00-led-tpt-trigger-support.patch
deleted file mode 100644
index fca1fb2cd..000000000
--- a/package/kernel/mac80211/patches/rt2x00/612-rt2x00-led-tpt-trigger-support.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From: David Bauer <mail@david-bauer.net>
-Date: Mon, 16 Dec 2019 20:47:06 +0100
-Subject: [PATCH] rt2x00: add throughput LED trigger
-
-This adds a (currently missing) throughput LED trigger for the rt2x00
-driver. Previously, LED triggers had to be assigned to the netdev, which
-was limited to a single VAP.
-
-Signed-off-by: David Bauer <mail@david-bauer.net>
-Tested-by: Christoph Krapp <achterin@googlemail.com>
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1129,6 +1129,19 @@ static void rt2x00lib_remove_hw(struct r
- 	kfree(rt2x00dev->spec.channels_info);
- }
- 
-+static const struct ieee80211_tpt_blink rt2x00_tpt_blink[] = {
-+	{ .throughput = 0 * 1024, .blink_time = 334 },
-+	{ .throughput = 1 * 1024, .blink_time = 260 },
-+	{ .throughput = 2 * 1024, .blink_time = 220 },
-+	{ .throughput = 5 * 1024, .blink_time = 190 },
-+	{ .throughput = 10 * 1024, .blink_time = 170 },
-+	{ .throughput = 25 * 1024, .blink_time = 150 },
-+	{ .throughput = 54 * 1024, .blink_time = 130 },
-+	{ .throughput = 120 * 1024, .blink_time = 110 },
-+	{ .throughput = 265 * 1024, .blink_time = 80 },
-+	{ .throughput = 586 * 1024, .blink_time = 50 },
-+};
-+
- static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
- {
- 	struct hw_mode_spec *spec = &rt2x00dev->spec;
-@@ -1210,6 +1223,10 @@ static int rt2x00lib_probe_hw(struct rt2
- 
- #undef RT2X00_TASKLET_INIT
- 
-+	ieee80211_create_tpt_led_trigger(rt2x00dev->hw,
-+		IEEE80211_TPT_LEDTRIG_FL_RADIO, rt2x00_tpt_blink,
-+		ARRAY_SIZE(rt2x00_tpt_blink));
-+
- 	/*
- 	 * Register HW.
- 	 */
diff --git a/package/kernel/mac80211/patches/rt2x00/650-rt2x00-add-support-for-external-PA-on-MT7620.patch b/package/kernel/mac80211/patches/rt2x00/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
deleted file mode 100644
index 20452cd8a..000000000
--- a/package/kernel/mac80211/patches/rt2x00/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From 9782a7f7488443568fa4d6088b73c9aff7eb8510 Mon Sep 17 00:00:00 2001
-From: Daniel Golle <daniel@makrotopia.org>
-Date: Wed, 19 Apr 2017 16:14:53 +0200
-Subject: [PATCH] rt2x00: add support for external PA on MT7620
-To: Stanislaw Gruszka <sgruszka@redhat.com>
-Cc: Helmut Schaa <helmut.schaa@googlemail.com>,
-    linux-wireless@vger.kernel.org,
-    Kalle Valo <kvalo@codeaurora.org>
-Content-Type: text/plain; charset="UTF-8"
-Content-Transfer-Encoding: quoted-printable
-
-Signed-off-by: Daniel Golle <daniel@makrotopia.org>
-Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
-[pozega.tomislav@gmail.com: use chanreg and dccal helpers.]
-
----
- drivers/net/wireless/ralink/rt2x00/rt2800.h    |  1 +
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 70 +++++++++++++++++++++++++-
- 2 files changed, 70 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
-@@ -2739,6 +2739,7 @@ enum rt2800_eeprom_word {
- #define EEPROM_NIC_CONF2_RX_STREAM	FIELD16(0x000f)
- #define EEPROM_NIC_CONF2_TX_STREAM	FIELD16(0x00f0)
- #define EEPROM_NIC_CONF2_CRYSTAL	FIELD16(0x0600)
-+#define EEPROM_NIC_CONF2_EXTERNAL_PA	FIELD16(0xc000)
- 
- /*
-  * EEPROM LNA
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -4356,6 +4356,45 @@ static void rt2800_config_channel(struct
- 		rt2800_iq_calibrate(rt2x00dev, rf->channel);
- 	}
- 
-+	if (rt2x00_rt(rt2x00dev, RT6352)) {
-+		if (test_bit(CAPABILITY_EXTERNAL_PA_TX0,
-+			     &rt2x00dev->cap_flags)) {
-+			rt2x00_warn(rt2x00dev, "Using incomplete support for " \
-+					       "external PA\n");
-+			reg = rt2800_register_read(rt2x00dev, RF_CONTROL3);
-+			reg |= 0x00000101;
-+			rt2800_register_write(rt2x00dev, RF_CONTROL3, reg);
-+
-+			reg = rt2800_register_read(rt2x00dev, RF_BYPASS3);
-+			reg |= 0x00000101;
-+			rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
-+
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0x73);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0x73);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0x73);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 46, 0x27);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0xC8);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xA4);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 49, 0x05);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 54, 0x27);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0xC8);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xA4);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 57, 0x05);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x27);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0xC8);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xA4);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 61, 0x05);
-+			rt2800_rfcsr_write_dccal(rt2x00dev, 05, 0x00);
-+
-+			rt2800_register_write(rt2x00dev, TX0_RF_GAIN_CORRECT,
-+					      0x36303636);
-+			rt2800_register_write(rt2x00dev, TX0_RF_GAIN_ATTEN,
-+					      0x6C6C6B6C);
-+			rt2800_register_write(rt2x00dev, TX1_RF_GAIN_ATTEN,
-+					      0x6C6C6B6C);
-+		}
-+	}
-+
- 	bbp = rt2800_bbp_read(rt2x00dev, 4);
- 	rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * conf_is_ht40(conf));
- 	rt2800_bbp_write(rt2x00dev, 4, bbp);
-@@ -9559,7 +9598,8 @@ static int rt2800_init_eeprom(struct rt2
- 	 */
- 	eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1);
- 
--	if (rt2x00_rt(rt2x00dev, RT3352)) {
-+	if (rt2x00_rt(rt2x00dev, RT3352) ||
-+	    rt2x00_rt(rt2x00dev, RT6352)) {
- 		if (rt2x00_get_field16(eeprom,
- 		    EEPROM_NIC_CONF1_EXTERNAL_TX0_PA_3352))
- 		    __set_bit(CAPABILITY_EXTERNAL_PA_TX0,
-@@ -9570,6 +9610,18 @@ static int rt2800_init_eeprom(struct rt2
- 			      &rt2x00dev->cap_flags);
- 	}
- 
-+	eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_NIC_CONF2);
-+
-+	if (rt2x00_rt(rt2x00dev, RT6352) && eeprom != 0 && eeprom != 0xffff) {
-+		if (rt2x00_get_field16(eeprom,
-+		    EEPROM_NIC_CONF2_EXTERNAL_PA)) {
-+		    __set_bit(CAPABILITY_EXTERNAL_PA_TX0,
-+			      &rt2x00dev->cap_flags);
-+		    __set_bit(CAPABILITY_EXTERNAL_PA_TX1,
-+			      &rt2x00dev->cap_flags);
-+		}
-+	}
-+
- 	return 0;
- }
- 
diff --git a/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch b/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch
deleted file mode 100644
index 6be847478..000000000
--- a/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch
+++ /dev/null
@@ -1,67 +0,0 @@
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8419,6 +8419,56 @@ static void rt2800_init_rfcsr_5592(struc
- 	rt2800_led_open_drain_enable(rt2x00dev);
- }
- 
-+static void rt2800_rf_self_txdc_cal(struct rt2x00_dev *rt2x00dev)
-+{
-+	u8 rfb5r1_org, rfb7r1_org, rfvalue;
-+	u32 mac0518, mac051c, mac0528, mac052c;
-+	u8 i;
-+
-+	rt2x00_info(rt2x00dev, "RF Tx self calibration start\n");
-+	mac0518 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
-+	mac051c = rt2800_register_read(rt2x00dev, RF_BYPASS0);
-+	mac0528 = rt2800_register_read(rt2x00dev, RF_CONTROL2);
-+	mac052c = rt2800_register_read(rt2x00dev, RF_BYPASS2);
-+
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x0);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS2, 0x0);
-+
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0xC);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x3306);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL2, 0x3330);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS2, 0xfffff);
-+	rfb5r1_org = rt2800_rfcsr_read_bank(rt2x00dev, 5, 1);
-+	rfb7r1_org = rt2800_rfcsr_read_bank(rt2x00dev, 7, 1);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 1, 0x4);
-+	for (i = 0; i < 100; i = i + 1) {
-+		udelay(50);
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 1);
-+		if((rfvalue & 0x04) != 0x4)
-+			break;
-+	}
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 1, rfb5r1_org);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 1, 0x4);
-+	for (i = 0; i < 100; i = i + 1) {
-+		udelay(50);
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 1);
-+		if((rfvalue & 0x04) != 0x4)
-+			break;
-+	}
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 1, rfb7r1_org);
-+
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x0);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS2, 0x0);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, mac0518);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, mac051c);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL2, mac0528);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS2, mac052c);
-+
-+	rt2x00_info(rt2x00dev, "RF Tx self calibration end\n");
-+}
-+
- static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
- 				       bool set_bw, bool is_ht40)
- {
-@@ -9026,6 +9076,7 @@ static void rt2800_init_rfcsr_6352(struc
- 	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
- 	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
- 
-+	rt2800_rf_self_txdc_cal(rt2x00dev);
- 	rt2800_bw_filter_calibration(rt2x00dev, true);
- 	rt2800_bw_filter_calibration(rt2x00dev, false);
- }
diff --git a/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch b/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch
deleted file mode 100644
index 3ed0ff7ef..000000000
--- a/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch
+++ /dev/null
@@ -1,166 +0,0 @@
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8469,6 +8469,155 @@ static void rt2800_rf_self_txdc_cal(stru
- 	rt2x00_info(rt2x00dev, "RF Tx self calibration end\n");
- }
- 
-+static int rt2800_calcrcalibrationcode(struct rt2x00_dev *rt2x00dev, int d1, int d2)
-+{
-+	int calcode;
-+	calcode = ((d2 - d1) * 1000) / 43;
-+	if ((calcode%10) >= 5)
-+		calcode += 10;
-+	calcode = (calcode / 10);
-+
-+	return calcode;
-+}
-+
-+static void rt2800_r_calibration(struct rt2x00_dev *rt2x00dev)
-+{
-+	u32 savemacsysctrl;
-+	u8 saverfb0r1, saverfb0r34, saverfb0r35;
-+	u8 saverfb5r4, saverfb5r17, saverfb5r18;
-+	u8 saverfb5r19, saverfb5r20;
-+	u8 savebbpr22, savebbpr47, savebbpr49;
-+	u8 bytevalue = 0;
-+	int rcalcode;
-+	u8 r_cal_code = 0;
-+	char d1 = 0, d2 = 0;
-+	u8 rfvalue;
-+	u32 MAC_RF_BYPASS0, MAC_RF_CONTROL0, MAC_PWR_PIN_CFG;
-+	u32 maccfg, macstatus;
-+	int i;
-+
-+	saverfb0r1 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
-+	saverfb0r34 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 34);
-+	saverfb0r35 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 35);
-+	saverfb5r4 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 4);
-+	saverfb5r17 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 17);
-+	saverfb5r18 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 18);
-+	saverfb5r19 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 19);
-+	saverfb5r20 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 20);
-+
-+	savebbpr22 = rt2800_bbp_read(rt2x00dev, 22);
-+	savebbpr47 = rt2800_bbp_read(rt2x00dev, 47);
-+	savebbpr49 = rt2800_bbp_read(rt2x00dev, 49);
-+
-+	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	MAC_RF_BYPASS0 = rt2800_register_read(rt2x00dev, RF_BYPASS0);
-+	MAC_RF_CONTROL0 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
-+	MAC_PWR_PIN_CFG = rt2800_register_read(rt2x00dev, PWR_PIN_CFG);
-+
-+	maccfg = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	maccfg &= (~0x04);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, maccfg);
-+
-+	for (i = 0; i < 10000; i++) {
-+		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macstatus & 0x1)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	if (i == 10000)
-+		rt2x00_warn(rt2x00dev, "Wait MAC Tx Status to MAX !!!\n");
-+
-+	maccfg = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	maccfg &= (~0x04);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, maccfg);
-+
-+	for (i = 0; i < 10000; i++) {
-+		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macstatus & 0x2)
-+			udelay(50);
-+		else
-+			break;
-+		}
-+
-+	if (i == 10000)
-+		rt2x00_warn(rt2x00dev, "Wait MAC Rx Status to MAX !!!\n");
-+
-+	rfvalue = (MAC_RF_BYPASS0 | 0x3004);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, rfvalue);
-+	rfvalue = (MAC_RF_CONTROL0 | (~0x3002));
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, rfvalue);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, 0x27);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 17, 0x80);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 18, 0x83);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 19, 0x00);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 20, 0x20);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, 0x00);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 34, 0x13);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x00);
-+
-+	rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0x1);
-+
-+	rt2800_bbp_write(rt2x00dev, 47, 0x04);
-+	rt2800_bbp_write(rt2x00dev, 22, 0x80);
-+	udelay(100);
-+	bytevalue = rt2800_bbp_read(rt2x00dev, 49);
-+	if (bytevalue > 128)
-+		d1 = bytevalue - 256;
-+	else
-+		d1 = (char)bytevalue;
-+	rt2800_bbp_write(rt2x00dev, 22, 0x0);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x01);
-+
-+	rt2800_bbp_write(rt2x00dev, 22, 0x80);
-+	udelay(100);
-+	bytevalue = rt2800_bbp_read(rt2x00dev, 49);
-+	if (bytevalue > 128)
-+		d2 = bytevalue - 256;
-+	else
-+		d2 = (char)bytevalue;
-+	rt2800_bbp_write(rt2x00dev, 22, 0x0);
-+
-+	rcalcode = rt2800_calcrcalibrationcode(rt2x00dev, d1, d2);
-+	if (rcalcode < 0)
-+		r_cal_code = 256 + rcalcode;
-+	else
-+		r_cal_code = (u8)rcalcode;
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 7, r_cal_code);
-+
-+	rt2800_bbp_write(rt2x00dev, 22, 0x0);
-+
-+	bytevalue = rt2800_bbp_read(rt2x00dev, 21);
-+	bytevalue |= 0x1;
-+	rt2800_bbp_write(rt2x00dev, 21, bytevalue);
-+	bytevalue = rt2800_bbp_read(rt2x00dev, 21);
-+	bytevalue &= (~0x1);
-+	rt2800_bbp_write(rt2x00dev, 21, bytevalue);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, saverfb0r1);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 34, saverfb0r34);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, saverfb0r35);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, saverfb5r4);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 17, saverfb5r17);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 18, saverfb5r18);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 19, saverfb5r19);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 20, saverfb5r20);
-+
-+	rt2800_bbp_write(rt2x00dev, 22, savebbpr22);
-+	rt2800_bbp_write(rt2x00dev, 47, savebbpr47);
-+	rt2800_bbp_write(rt2x00dev, 49, savebbpr49);
-+
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, MAC_RF_BYPASS0);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, MAC_RF_CONTROL0);
-+
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
-+	rt2800_register_write(rt2x00dev, PWR_PIN_CFG, MAC_PWR_PIN_CFG);
-+}
-+
- static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
- 				       bool set_bw, bool is_ht40)
- {
-@@ -9076,6 +9225,7 @@ static void rt2800_init_rfcsr_6352(struc
- 	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
- 	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
- 
-+	rt2800_r_calibration(rt2x00dev);
- 	rt2800_rf_self_txdc_cal(rt2x00dev);
- 	rt2800_bw_filter_calibration(rt2x00dev, true);
- 	rt2800_bw_filter_calibration(rt2x00dev, false);
diff --git a/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch b/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch
deleted file mode 100644
index 77be986d1..000000000
--- a/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch
+++ /dev/null
@@ -1,81 +0,0 @@
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8618,6 +8618,70 @@ static void rt2800_r_calibration(struct
- 	rt2800_register_write(rt2x00dev, PWR_PIN_CFG, MAC_PWR_PIN_CFG);
- }
- 
-+static void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev)
-+{
-+	u8 bbpreg = 0;
-+	u32 macvalue = 0, macvalue1 = 0;
-+	u8 saverfb0r2, saverfb5r4, saverfb7r4, rfvalue;
-+	int i;
-+
-+	saverfb0r2 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 2);
-+	rfvalue = saverfb0r2;
-+	rfvalue |= 0x03;
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfvalue);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 141);
-+	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
-+	bbpreg |= 0x10;
-+	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
-+
-+	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x8);
-+
-+	for (i = 0; i < 10000; i++) {
-+		macvalue1 = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue1 & 0x1)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	saverfb5r4 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 0);
-+	saverfb7r4 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 4);
-+	saverfb5r4 = saverfb5r4 & (~0x40);
-+	saverfb7r4 = saverfb7r4 & (~0x40);
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 4, 0x64);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, saverfb5r4);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 4, saverfb7r4);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 141);
-+	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
-+	bbpreg = bbpreg & (~0x40);
-+	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
-+	bbpreg |= 0x48;
-+	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
-+
-+	for (i = 0; i < 10000; i++) {
-+		bbpreg = rt2800_bbp_read(rt2x00dev, 159);
-+		if ((bbpreg & 0x40)==0)
-+			break;
-+		udelay(50);
-+	}
-+
-+	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
-+	bbpreg = bbpreg & (~0x40);
-+	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
-+
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 141);
-+	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
-+	bbpreg &= (~0x10);
-+	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, saverfb0r2);
-+}
-+
- static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
- 				       bool set_bw, bool is_ht40)
- {
-@@ -9227,6 +9291,7 @@ static void rt2800_init_rfcsr_6352(struc
- 
- 	rt2800_r_calibration(rt2x00dev);
- 	rt2800_rf_self_txdc_cal(rt2x00dev);
-+	rt2800_rxdcoc_calibration(rt2x00dev);
- 	rt2800_bw_filter_calibration(rt2x00dev, true);
- 	rt2800_bw_filter_calibration(rt2x00dev, false);
- }
diff --git a/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch b/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch
deleted file mode 100644
index 7352ad036..000000000
--- a/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch
+++ /dev/null
@@ -1,395 +0,0 @@
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8682,6 +8682,384 @@ static void rt2800_rxdcoc_calibration(st
- 	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, saverfb0r2);
- }
- 
-+static u32 rt2800_do_sqrt_accumulation(u32 si) {
-+	u32 root, root_pre, bit;
-+	char i;
-+	bit = 1 << 15;
-+	root = 0;
-+	for (i = 15; i >= 0; i = i - 1) {
-+		root_pre = root + bit;
-+		if ((root_pre*root_pre) <= si)
-+			root = root_pre;
-+		bit = bit >> 1;
-+	}
-+
-+	return root;
-+}
-+
-+static void rt2800_rxiq_calibration(struct rt2x00_dev *rt2x00dev) {
-+	u8 rfb0r1, rfb0r2, rfb0r42;
-+	u8 rfb4r0, rfb4r19;
-+	u8 rfb5r3, rfb5r4, rfb5r17, rfb5r18, rfb5r19, rfb5r20;
-+	u8 rfb6r0, rfb6r19;
-+	u8 rfb7r3, rfb7r4, rfb7r17, rfb7r18, rfb7r19, rfb7r20;
-+
-+	u8 bbp1, bbp4;
-+	u8 bbpr241, bbpr242;
-+	u32 i;
-+	u8 ch_idx;
-+	u8 bbpval;
-+	u8 rfval, vga_idx = 0;
-+	int mi = 0, mq = 0, si = 0, sq = 0, riq = 0;
-+	int sigma_i, sigma_q, r_iq, g_rx;
-+	int g_imb;
-+	int ph_rx;
-+	u32 savemacsysctrl = 0;
-+	u32 orig_RF_CONTROL0 = 0;
-+	u32 orig_RF_BYPASS0 = 0;
-+	u32 orig_RF_CONTROL1 = 0;
-+	u32 orig_RF_BYPASS1 = 0;
-+	u32 orig_RF_CONTROL3 = 0;
-+	u32 orig_RF_BYPASS3 = 0;
-+	u32 macstatus, bbpval1 = 0;
-+	u8 rf_vga_table[] = {0x20, 0x21, 0x22, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f};
-+
-+	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	orig_RF_CONTROL0 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
-+	orig_RF_BYPASS0 = rt2800_register_read(rt2x00dev, RF_BYPASS0);
-+	orig_RF_CONTROL1 = rt2800_register_read(rt2x00dev, RF_CONTROL1);
-+	orig_RF_BYPASS1 = rt2800_register_read(rt2x00dev, RF_BYPASS1);
-+	orig_RF_CONTROL3 = rt2800_register_read(rt2x00dev, RF_CONTROL3);
-+	orig_RF_BYPASS3 = rt2800_register_read(rt2x00dev, RF_BYPASS3);
-+
-+	bbp1 = rt2800_bbp_read(rt2x00dev, 1);
-+	bbp4 = rt2800_bbp_read(rt2x00dev, 4);
-+
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x0);
-+
-+	for (i = 0; i < 10000; i++) {
-+		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macstatus & 0x3)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	if (i == 10000)
-+		rt2x00_warn(rt2x00dev, "Wait MAC Status to MAX !!!\n");
-+
-+	bbpval = bbp4 & (~0x18);
-+	bbpval = bbp4 | 0x00;
-+	rt2800_bbp_write(rt2x00dev, 4, bbpval);
-+
-+	bbpval = rt2800_bbp_read(rt2x00dev, 21);
-+	bbpval = bbpval | 1;
-+	rt2800_bbp_write(rt2x00dev, 21, bbpval);
-+	bbpval = bbpval & 0xfe;
-+	rt2800_bbp_write(rt2x00dev, 21, bbpval);
-+
-+	rt2800_register_write(rt2x00dev, RF_CONTROL1, 0x00000202);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS1, 0x00000303);
-+	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags))
-+		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x0101);
-+	else
-+		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x0000);
-+
-+	rt2800_register_write(rt2x00dev, RF_BYPASS3, 0xf1f1);
-+
-+	rfb0r1 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
-+	rfb0r2 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 2);
-+	rfb0r42 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 42);
-+	rfb4r0 = rt2800_rfcsr_read_bank(rt2x00dev, 4, 0);
-+	rfb4r19 = rt2800_rfcsr_read_bank(rt2x00dev, 4, 19);
-+	rfb5r3 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 3);
-+	rfb5r4 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 4);
-+	rfb5r17 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 17);
-+	rfb5r18 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 18);
-+	rfb5r19 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 19);
-+	rfb5r20 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 20);
-+
-+	rfb6r0 = rt2800_rfcsr_read_bank(rt2x00dev, 6, 0);
-+	rfb6r19 = rt2800_rfcsr_read_bank(rt2x00dev, 6, 19);
-+	rfb7r3 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 3);
-+	rfb7r4 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 4);
-+	rfb7r17 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 17);
-+	rfb7r18 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 18);
-+	rfb7r19 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 19);
-+	rfb7r20 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 20);
-+
-+	rt2800_rfcsr_write_chanreg(rt2x00dev, 0, 0x87);
-+	rt2800_rfcsr_write_chanreg(rt2x00dev, 19, 0x27);
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 3, 0x38);
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 4, 0x38);
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x80);
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 18, 0xC1);
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 19, 0x60);
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 20, 0x00);
-+
-+	rt2800_bbp_write(rt2x00dev, 23, 0x0);
-+	rt2800_bbp_write(rt2x00dev, 24, 0x0);
-+
-+	rt2800_bbp_dcoc_write(rt2x00dev, 5, 0x0);
-+
-+	bbpr241 = rt2800_bbp_read(rt2x00dev, 241);
-+	bbpr242 = rt2800_bbp_read(rt2x00dev, 242);
-+
-+	rt2800_bbp_write(rt2x00dev, 241, 0x10);
-+	rt2800_bbp_write(rt2x00dev, 242, 0x84);
-+	rt2800_bbp_write(rt2x00dev, 244, 0x31);
-+
-+	bbpval = rt2800_bbp_dcoc_read(rt2x00dev, 3);
-+	bbpval = bbpval & (~0x7);
-+	rt2800_bbp_dcoc_write(rt2x00dev, 3, bbpval);
-+
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000004);
-+	udelay(1);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000006);
-+	usleep_range(1, 200);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00003376);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001006);
-+	udelay(1);
-+	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+		rt2800_bbp_write(rt2x00dev, 23, 0x06);
-+		rt2800_bbp_write(rt2x00dev, 24, 0x06);
-+	} else {
-+		rt2800_bbp_write(rt2x00dev, 23, 0x02);
-+		rt2800_bbp_write(rt2x00dev, 24, 0x02);
-+	}
-+
-+	for (ch_idx = 0; ch_idx < 2; ch_idx = ch_idx + 1) {
-+		if (ch_idx == 0) {
-+			rfval = rfb0r1 & (~0x3);
-+			rfval = rfb0r1 | 0x1;
-+			rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, rfval);
-+			rfval = rfb0r2 & (~0x33);
-+			rfval = rfb0r2 | 0x11;
-+			rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfval);
-+			rfval = rfb0r42 & (~0x50);
-+			rfval = rfb0r42 | 0x10;
-+			rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfval);
-+
-+			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001006);
-+			udelay(1);
-+
-+			bbpval = bbp1 & (~ 0x18);
-+			bbpval = bbpval | 0x00;
-+			rt2800_bbp_write(rt2x00dev, 1, bbpval);
-+
-+			rt2800_bbp_dcoc_write(rt2x00dev, 1, 0x00);
-+		} else {
-+			rfval = rfb0r1 & (~0x3);
-+			rfval = rfb0r1 | 0x2;
-+			rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, rfval);
-+			rfval = rfb0r2 & (~0x33);
-+			rfval = rfb0r2 | 0x22;
-+			rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfval);
-+			rfval = rfb0r42 & (~0x50);
-+			rfval = rfb0r42 | 0x40;
-+			rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfval);
-+
-+			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002006);
-+			udelay(1);
-+
-+			bbpval = bbp1 & (~ 0x18);
-+			bbpval = bbpval | 0x08;
-+			rt2800_bbp_write(rt2x00dev, 1, bbpval);
-+
-+			rt2800_bbp_dcoc_write(rt2x00dev, 1, 0x01);
-+		}
-+		udelay(500);
-+
-+		vga_idx = 0;
-+			while (vga_idx < 11) {
-+				rt2800_rfcsr_write_dccal(rt2x00dev, 3, rf_vga_table[vga_idx]);
-+				rt2800_rfcsr_write_dccal(rt2x00dev, 4, rf_vga_table[vga_idx]);
-+
-+				rt2800_bbp_dcoc_write(rt2x00dev, 0, 0x93);
-+
-+				for (i = 0; i < 10000; i++) {
-+					bbpval = rt2800_bbp_read(rt2x00dev, 159);
-+					if ((bbpval & 0xff) == 0x93)
-+						udelay(50);
-+					else
-+						break;
-+					}
-+
-+				if ((bbpval & 0xff) == 0x93) {
-+					rt2x00_warn(rt2x00dev, "Fatal Error: Calibration doesn't finish");
-+					goto restore_value;
-+				}
-+
-+				for (i = 0; i < 5; i++) {
-+					u32 bbptemp = 0;
-+					u8 value = 0;
-+					int result = 0;
-+
-+					rt2800_bbp_write(rt2x00dev, 158, 0x1e);
-+					rt2800_bbp_write(rt2x00dev, 159, i);
-+					rt2800_bbp_write(rt2x00dev, 158, 0x22);
-+					value = rt2800_bbp_read(rt2x00dev, 159);
-+					bbptemp = bbptemp + (value << 24);
-+					rt2800_bbp_write(rt2x00dev, 158, 0x21);
-+					value = rt2800_bbp_read(rt2x00dev, 159);
-+					bbptemp = bbptemp + (value << 16);
-+					rt2800_bbp_write(rt2x00dev, 158, 0x20);
-+					value = rt2800_bbp_read(rt2x00dev, 159);
-+					bbptemp = bbptemp + (value << 8);
-+					rt2800_bbp_write(rt2x00dev, 158, 0x1f);
-+					value = rt2800_bbp_read(rt2x00dev, 159);
-+					bbptemp = bbptemp + value;
-+
-+					if ((i < 2) && (bbptemp & 0x800000))
-+						result = (bbptemp & 0xffffff) - 0x1000000;
-+					else if (i == 4)
-+						result = bbptemp;
-+					else
-+						result = bbptemp;
-+
-+					if (i == 0)
-+						mi = result/4096;
-+					else if (i == 1)
-+						mq = result/4096;
-+					else if (i == 2)
-+						si = bbptemp/4096;
-+					else if (i == 3)
-+						sq = bbptemp/4096;
-+					else
-+						riq = result/4096;
-+				}
-+
-+				bbpval1 = si - mi*mi;
-+				rt2x00_dbg(rt2x00dev, "RXIQ si=%d, sq=%d, riq=%d, bbpval %d, vga_idx %d", si, sq, riq, bbpval1, vga_idx);
-+
-+				if (bbpval1 >= (100*100))
-+					break;
-+
-+				if (bbpval1 <= 100)
-+					vga_idx = vga_idx + 9;
-+				else if (bbpval1 <= 158)
-+					vga_idx = vga_idx + 8;
-+				else if (bbpval1 <= 251)
-+					vga_idx = vga_idx + 7;
-+				else if (bbpval1 <= 398)
-+					vga_idx = vga_idx + 6;
-+				else if (bbpval1 <= 630)
-+					vga_idx = vga_idx + 5;
-+				else if (bbpval1 <= 1000)
-+					vga_idx = vga_idx + 4;
-+				else if (bbpval1 <= 1584)
-+					vga_idx = vga_idx + 3;
-+				else if (bbpval1 <= 2511)
-+					vga_idx = vga_idx + 2;
-+				else
-+					vga_idx = vga_idx + 1;
-+			}
-+
-+		sigma_i = rt2800_do_sqrt_accumulation(100*(si - mi*mi));
-+		sigma_q = rt2800_do_sqrt_accumulation(100*(sq - mq*mq));
-+		r_iq = 10*(riq-(mi*mq));
-+
-+		rt2x00_dbg(rt2x00dev, "Sigma_i=%d, Sigma_q=%d, R_iq=%d", sigma_i, sigma_q, r_iq);
-+
-+		if (((sigma_i <= 1400 ) && (sigma_i >= 1000))
-+			&& ((sigma_i - sigma_q) <= 112)
-+			&& ((sigma_i - sigma_q) >= -112)
-+			&& ((mi <= 32) && (mi >= -32))
-+			&& ((mq <= 32) && (mq >= -32))) {
-+				r_iq = 10*(riq-(mi*mq));
-+				rt2x00_dbg(rt2x00dev, "RXIQ Sigma_i=%d, Sigma_q=%d, R_iq=%d\n", sigma_i, sigma_q, r_iq);
-+
-+				g_rx = (1000 * sigma_q) / sigma_i;
-+				g_imb = ((-2) * 128 * (1000 - g_rx)) / (1000 + g_rx);
-+				ph_rx = (r_iq * 2292) / (sigma_i * sigma_q);
-+				rt2x00_info(rt2x00dev, "RXIQ G_imb=%d, Ph_rx=%d\n", g_imb, ph_rx);
-+
-+				if ((ph_rx > 20) || (ph_rx < -20)) {
-+					ph_rx = 0;
-+					rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
-+				}
-+
-+				if ((g_imb > 12) || (g_imb < -12)) {
-+					g_imb = 0;
-+					rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
-+				}
-+			}
-+		else {
-+			g_imb = 0;
-+			ph_rx = 0;
-+			rt2x00_dbg(rt2x00dev, "RXIQ Sigma_i=%d, Sigma_q=%d, R_iq=%d\n", sigma_i, sigma_q, r_iq);
-+			rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
-+		}
-+
-+		if (ch_idx == 0) {
-+			rt2800_bbp_write(rt2x00dev, 158, 0x37);
-+			rt2800_bbp_write(rt2x00dev, 159, g_imb & 0x3f);
-+			rt2800_bbp_write(rt2x00dev, 158, 0x35);
-+			rt2800_bbp_write(rt2x00dev, 159, ph_rx & 0x3f);
-+		} else {
-+			rt2800_bbp_write(rt2x00dev, 158, 0x55);
-+			rt2800_bbp_write(rt2x00dev, 159, g_imb & 0x3f);
-+			rt2800_bbp_write(rt2x00dev, 158, 0x53);
-+			rt2800_bbp_write(rt2x00dev, 159, ph_rx & 0x3f);
-+		}
-+	}
-+
-+restore_value:
-+	rt2800_bbp_write(rt2x00dev, 158, 0x3);
-+	bbpval = rt2800_bbp_read(rt2x00dev, 159);
-+	rt2800_bbp_write(rt2x00dev, 159, (bbpval | 0x07));
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 1, bbp1);
-+	rt2800_bbp_write(rt2x00dev, 4, bbp4);
-+	rt2800_bbp_write(rt2x00dev, 241, bbpr241);
-+	rt2800_bbp_write(rt2x00dev, 242, bbpr242);
-+
-+	rt2800_bbp_write(rt2x00dev, 244, 0x00);
-+	bbpval = rt2800_bbp_read(rt2x00dev, 21);
-+	bbpval |= 0x1;
-+	rt2800_bbp_write(rt2x00dev, 21, bbpval);
-+	usleep_range(10, 200);
-+	bbpval &= 0xfe;
-+	rt2800_bbp_write(rt2x00dev, 21, bbpval);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, rfb0r1);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfb0r2);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfb0r42);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 4, 0, rfb4r0);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 4, 19, rfb4r19);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 3, rfb5r3);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, rfb5r4);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 17, rfb5r17);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 18, rfb5r18);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 19, rfb5r19);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 20, rfb5r20);
-+
-+	rt2800_rfcsr_write_bank(rt2x00dev, 6, 0, rfb6r0);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 6, 19, rfb6r19);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 3, rfb7r3);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 4, rfb7r4);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 17, rfb7r17);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 18, rfb7r18);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 19, rfb7r19);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 20, rfb7r20);
-+
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000006);
-+	udelay(1);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000004);
-+	udelay(1);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, orig_RF_CONTROL0);
-+	udelay(1);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, orig_RF_BYPASS0);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL1, orig_RF_CONTROL1);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS1, orig_RF_BYPASS1);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL3, orig_RF_CONTROL3);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS3, orig_RF_BYPASS3);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
-+}
-+
- static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
- 				       bool set_bw, bool is_ht40)
- {
-@@ -9294,6 +9672,7 @@ static void rt2800_init_rfcsr_6352(struc
- 	rt2800_rxdcoc_calibration(rt2x00dev);
- 	rt2800_bw_filter_calibration(rt2x00dev, true);
- 	rt2800_bw_filter_calibration(rt2x00dev, false);
-+	rt2800_rxiq_calibration(rt2x00dev);
- }
- 
- static void rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
diff --git a/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch b/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch
deleted file mode 100644
index fe0961baa..000000000
--- a/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch
+++ /dev/null
@@ -1,973 +0,0 @@
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -9060,6 +9060,943 @@ restore_value:
- 	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
- }
- 
-+static void rt2800_rf_configstore(struct rt2x00_dev *rt2x00dev, rf_reg_pair rf_reg_record[][13], u8 chain)
-+{
-+	u8 rfvalue = 0;
-+
-+	if (chain == CHAIN_0) {
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
-+		rf_reg_record[CHAIN_0][0].bank = 0;
-+		rf_reg_record[CHAIN_0][0].reg = 1;
-+		rf_reg_record[CHAIN_0][0].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 2);
-+		rf_reg_record[CHAIN_0][1].bank = 0;
-+		rf_reg_record[CHAIN_0][1].reg = 2;
-+		rf_reg_record[CHAIN_0][1].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 35);
-+		rf_reg_record[CHAIN_0][2].bank = 0;
-+		rf_reg_record[CHAIN_0][2].reg = 35;
-+		rf_reg_record[CHAIN_0][2].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 42);
-+		rf_reg_record[CHAIN_0][3].bank = 0;
-+		rf_reg_record[CHAIN_0][3].reg = 42;
-+		rf_reg_record[CHAIN_0][3].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 4, 0);
-+		rf_reg_record[CHAIN_0][4].bank = 4;
-+		rf_reg_record[CHAIN_0][4].reg = 0;
-+		rf_reg_record[CHAIN_0][4].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 4, 2);
-+		rf_reg_record[CHAIN_0][5].bank = 4;
-+		rf_reg_record[CHAIN_0][5].reg = 2;
-+		rf_reg_record[CHAIN_0][5].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 4, 34);
-+		rf_reg_record[CHAIN_0][6].bank = 4;
-+		rf_reg_record[CHAIN_0][6].reg = 34;
-+		rf_reg_record[CHAIN_0][6].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 3);
-+		rf_reg_record[CHAIN_0][7].bank = 5;
-+		rf_reg_record[CHAIN_0][7].reg = 3;
-+		rf_reg_record[CHAIN_0][7].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 4);
-+		rf_reg_record[CHAIN_0][8].bank = 5;
-+		rf_reg_record[CHAIN_0][8].reg = 4;
-+		rf_reg_record[CHAIN_0][8].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 17);
-+		rf_reg_record[CHAIN_0][9].bank = 5;
-+		rf_reg_record[CHAIN_0][9].reg = 17;
-+		rf_reg_record[CHAIN_0][9].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 18);
-+		rf_reg_record[CHAIN_0][10].bank = 5;
-+		rf_reg_record[CHAIN_0][10].reg = 18;
-+		rf_reg_record[CHAIN_0][10].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 19);
-+		rf_reg_record[CHAIN_0][11].bank = 5;
-+		rf_reg_record[CHAIN_0][11].reg = 19;
-+		rf_reg_record[CHAIN_0][11].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 20);
-+		rf_reg_record[CHAIN_0][12].bank = 5;
-+		rf_reg_record[CHAIN_0][12].reg = 20;
-+		rf_reg_record[CHAIN_0][12].value = rfvalue;
-+	} else if (chain == CHAIN_1) {
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
-+		rf_reg_record[CHAIN_1][0].bank = 0;
-+		rf_reg_record[CHAIN_1][0].reg = 1;
-+		rf_reg_record[CHAIN_1][0].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 2);
-+		rf_reg_record[CHAIN_1][1].bank = 0;
-+		rf_reg_record[CHAIN_1][1].reg = 2;
-+		rf_reg_record[CHAIN_1][1].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 35);
-+		rf_reg_record[CHAIN_1][2].bank = 0;
-+		rf_reg_record[CHAIN_1][2].reg = 35;
-+		rf_reg_record[CHAIN_1][2].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 0, 42);
-+		rf_reg_record[CHAIN_1][3].bank = 0;
-+		rf_reg_record[CHAIN_1][3].reg = 42;
-+		rf_reg_record[CHAIN_1][3].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 6, 0);
-+		rf_reg_record[CHAIN_1][4].bank = 6;
-+		rf_reg_record[CHAIN_1][4].reg = 0;
-+		rf_reg_record[CHAIN_1][4].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 6, 2);
-+		rf_reg_record[CHAIN_1][5].bank = 6;
-+		rf_reg_record[CHAIN_1][5].reg = 2;
-+		rf_reg_record[CHAIN_1][5].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 6, 34);
-+		rf_reg_record[CHAIN_1][6].bank = 6;
-+		rf_reg_record[CHAIN_1][6].reg = 34;
-+		rf_reg_record[CHAIN_1][6].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 3);
-+		rf_reg_record[CHAIN_1][7].bank = 7;
-+		rf_reg_record[CHAIN_1][7].reg = 3;
-+		rf_reg_record[CHAIN_1][7].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 4);
-+		rf_reg_record[CHAIN_1][8].bank = 7;
-+		rf_reg_record[CHAIN_1][8].reg = 4;
-+		rf_reg_record[CHAIN_1][8].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 17);
-+		rf_reg_record[CHAIN_1][9].bank = 7;
-+		rf_reg_record[CHAIN_1][9].reg = 17;
-+		rf_reg_record[CHAIN_1][9].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 18);
-+		rf_reg_record[CHAIN_1][10].bank = 7;
-+		rf_reg_record[CHAIN_1][10].reg = 18;
-+		rf_reg_record[CHAIN_1][10].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 19);
-+		rf_reg_record[CHAIN_1][11].bank = 7;
-+		rf_reg_record[CHAIN_1][11].reg = 19;
-+		rf_reg_record[CHAIN_1][11].value = rfvalue;
-+		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 20);
-+		rf_reg_record[CHAIN_1][12].bank = 7;
-+		rf_reg_record[CHAIN_1][12].reg = 20;
-+		rf_reg_record[CHAIN_1][12].value = rfvalue;
-+	} else {
-+		rt2x00_warn(rt2x00dev, "Unknown chain = %u\n", chain);
-+		return;
-+	}
-+
-+	return;
-+}
-+
-+static void rt2800_rf_configrecover(struct rt2x00_dev *rt2x00dev, rf_reg_pair rf_record[][13])
-+{
-+	u8 chain_index = 0, record_index = 0;
-+	u8 bank = 0, rf_register = 0, value = 0;
-+
-+	for (chain_index = 0; chain_index < 2; chain_index++) {
-+		for (record_index = 0; record_index < 13; record_index++) {
-+			bank = rf_record[chain_index][record_index].bank;
-+			rf_register = rf_record[chain_index][record_index].reg;
-+			value = rf_record[chain_index][record_index].value;
-+			rt2800_rfcsr_write_bank(rt2x00dev, bank, rf_register, value);
-+			rt2x00_dbg(rt2x00dev, "bank: %d, rf_register: %d, value: %x\n", bank, rf_register, value);
-+		}
-+	}
-+
-+	return;
-+}
-+
-+static void rt2800_setbbptonegenerator(struct rt2x00_dev *rt2x00dev)
-+{
-+	rt2800_bbp_write(rt2x00dev, 158, 0xAA);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0xAB);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x0A);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0xAC);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x3F);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0xAD);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x3F);
-+
-+	rt2800_bbp_write(rt2x00dev, 244, 0x40);
-+
-+	return;
-+}
-+
-+static u32 rt2800_do_fft_accumulation(struct rt2x00_dev *rt2x00dev, u8 tidx, u8 read_neg)
-+{
-+	u32 macvalue = 0;
-+	int fftout_i = 0, fftout_q = 0;
-+	u32 ptmp=0, pint = 0;
-+	u8 bbp = 0;
-+	u8 tidxi;
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x9b);
-+
-+	bbp = 0x9b;
-+
-+	while (bbp == 0x9b) {
-+		udelay(10);
-+		bbp = rt2800_bbp_read(rt2x00dev, 159);
-+		bbp = bbp & 0xff;
-+	}
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0xba);
-+	rt2800_bbp_write(rt2x00dev, 159, tidx);
-+	rt2800_bbp_write(rt2x00dev, 159, tidx);
-+	rt2800_bbp_write(rt2x00dev, 159, tidx);
-+
-+	macvalue = rt2800_register_read(rt2x00dev, 0x057C);
-+
-+	fftout_i = (macvalue >> 16);
-+	fftout_i = (fftout_i & 0x8000) ? (fftout_i - 0x10000) : fftout_i;
-+	fftout_q = (macvalue & 0xffff);
-+	fftout_q = (fftout_q & 0x8000) ? (fftout_q - 0x10000) : fftout_q;
-+	ptmp = (fftout_i * fftout_i);
-+	ptmp = ptmp + (fftout_q * fftout_q);
-+	pint = ptmp;
-+	rt2x00_dbg(rt2x00dev, "I = %d,  Q = %d, power = %x\n", fftout_i, fftout_q, pint);
-+	if (read_neg) {
-+		pint = pint >> 1;
-+		tidxi = 0x40 - tidx;
-+		tidxi = tidxi & 0x3f;
-+
-+		rt2800_bbp_write(rt2x00dev, 158, 0xba);
-+		rt2800_bbp_write(rt2x00dev, 159, tidxi);
-+		rt2800_bbp_write(rt2x00dev, 159, tidxi);
-+		rt2800_bbp_write(rt2x00dev, 159, tidxi);
-+
-+		macvalue = rt2800_register_read(rt2x00dev, 0x057C);
-+
-+		fftout_i = (macvalue >> 16);
-+		fftout_i = (fftout_i & 0x8000) ? (fftout_i - 0x10000) : fftout_i;
-+		fftout_q = (macvalue & 0xffff);
-+		fftout_q = (fftout_q & 0x8000) ? (fftout_q - 0x10000) : fftout_q;
-+		ptmp = (fftout_i * fftout_i);
-+		ptmp = ptmp + (fftout_q * fftout_q);
-+		ptmp = ptmp >> 1;
-+		pint = pint + ptmp;
-+	}
-+
-+	return pint;
-+}
-+
-+static u32 rt2800_read_fft_accumulation(struct rt2x00_dev *rt2x00dev, u8 tidx) {
-+	u32 macvalue = 0;
-+	int fftout_i = 0, fftout_q = 0;
-+	u32 ptmp=0, pint = 0;
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0xBA);
-+	rt2800_bbp_write(rt2x00dev, 159, tidx);
-+	rt2800_bbp_write(rt2x00dev, 159, tidx);
-+	rt2800_bbp_write(rt2x00dev, 159, tidx);
-+
-+	macvalue = rt2800_register_read(rt2x00dev, 0x057C);
-+
-+	fftout_i = (macvalue >> 16);
-+	fftout_i = (fftout_i & 0x8000) ? (fftout_i - 0x10000) : fftout_i;
-+	fftout_q = (macvalue & 0xffff);
-+	fftout_q = (fftout_q & 0x8000) ? (fftout_q - 0x10000) : fftout_q;
-+	ptmp = (fftout_i * fftout_i);
-+	ptmp = ptmp + (fftout_q * fftout_q);
-+	pint = ptmp;
-+	rt2x00_info(rt2x00dev, "I = %d,  Q = %d, power = %x\n", fftout_i, fftout_q, pint);
-+
-+	return pint;
-+}
-+
-+static void rt2800_write_dc(struct rt2x00_dev *rt2x00dev, u8 ch_idx, u8 alc, u8 iorq, u8 dc)
-+{
-+	u8 bbp = 0;
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0xb0);
-+	bbp = alc | 0x80;
-+	rt2800_bbp_write(rt2x00dev, 159, bbp);
-+
-+	if (ch_idx == 0)
-+		bbp = (iorq == 0) ? 0xb1: 0xb2;
-+	else
-+		bbp = (iorq == 0) ? 0xb8: 0xb9;
-+
-+	rt2800_bbp_write(rt2x00dev, 158, bbp);
-+	bbp = dc;
-+	rt2800_bbp_write(rt2x00dev, 159, bbp);
-+
-+	return;
-+}
-+
-+static void rt2800_loft_search(struct rt2x00_dev *rt2x00dev, u8 ch_idx, u8 alc_idx, u8 dc_result[][RF_ALC_NUM][2])
-+{
-+	u32 p0 = 0, p1 = 0, pf = 0;
-+	char idx0 = 0, idx1 = 0;
-+	u8 idxf[] = {0x00, 0x00};
-+	u8 ibit = 0x20;
-+	u8 iorq;
-+	char bidx;
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0xb0);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x80);
-+
-+	for (bidx = 5; bidx >= 0; bidx--) {
-+		for (iorq = 0; iorq <= 1; iorq++) {
-+			rt2x00_dbg(rt2x00dev, "\n========================================================\n");
-+
-+			if (idxf[iorq] == 0x20) {
-+				idx0 = 0x20;
-+				p0 = pf;
-+			} else {
-+				idx0 = idxf[iorq] - ibit;
-+				idx0 = idx0 & 0x3F;
-+				rt2800_write_dc(rt2x00dev, ch_idx, 0, iorq, idx0);
-+				p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
-+			}
-+
-+			idx1 = idxf[iorq] + ((bidx == 5) ? 0 : ibit);
-+			idx1 = idx1 & 0x3F;
-+			rt2800_write_dc(rt2x00dev, ch_idx, 0, iorq, idx1);
-+			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
-+
-+			rt2x00_dbg(rt2x00dev, "alc=%u, IorQ=%u, idx_final=%2x\n", alc_idx, iorq, idxf[iorq]);
-+			rt2x00_dbg(rt2x00dev, "p0=%x, p1=%x, pf=%x, idx_0=%x, idx_1=%x, ibit=%x !\n", p0, p1, pf, idx0, idx1, ibit);
-+
-+			if ((bidx != 5) && (pf <= p0) && (pf < p1)) {
-+				pf = pf;
-+				idxf[iorq] = idxf[iorq];
-+			} else if (p0 < p1) {
-+				pf = p0;
-+				idxf[iorq] = idx0 & 0x3F;
-+			} else {
-+				pf = p1;
-+				idxf[iorq] = idx1 & 0x3F;
-+			}
-+			rt2x00_dbg(rt2x00dev, "IorQ=%u, idx_final[%u]:%x, pf:%8x\n", iorq, iorq, idxf[iorq], pf);
-+
-+			rt2800_write_dc(rt2x00dev, ch_idx, 0, iorq, idxf[iorq]);
-+
-+		}
-+		ibit = ibit >> 1;
-+	}
-+	dc_result[ch_idx][alc_idx][0] = idxf[0];
-+	dc_result[ch_idx][alc_idx][1] = idxf[1];
-+
-+	return;
-+}
-+
-+static void rt2800_iq_search(struct rt2x00_dev *rt2x00dev, u8 ch_idx, u8 *ges, u8 *pes)
-+{
-+	u32 p0 = 0, p1 = 0, pf = 0;
-+	char perr = 0, gerr = 0, iq_err = 0;
-+	char pef = 0, gef = 0;
-+	char psta, pend;
-+	char gsta, gend;
-+
-+	u8 ibit = 0x20;
-+	u8 first_search = 0x00, touch_neg_max = 0x00;
-+	char idx0 = 0, idx1 = 0;
-+	u8 gop;
-+	u8 bbp = 0;
-+	char bidx;
-+
-+	rt2x00_info(rt2x00dev, "IQCalibration Start!\n");
-+	for (bidx = 5; bidx >= 1; bidx--) {
-+		for (gop = 0; gop < 2; gop++) {
-+			rt2x00_dbg(rt2x00dev, "\n========================================================\n");
-+
-+			if ((gop == 1) || (bidx < 4)) {
-+				if (gop == 0)
-+					iq_err = gerr;
-+				else
-+					iq_err = perr;
-+
-+				first_search = (gop == 0) ? (bidx == 3) : (bidx == 5);
-+				touch_neg_max = (gop) ? ((iq_err & 0x0F) == 0x08) : ((iq_err & 0x3F) == 0x20);
-+
-+				if (touch_neg_max) {
-+					p0 = pf;
-+					idx0 = iq_err;
-+				} else {
-+					idx0 = iq_err - ibit;
-+					bbp = (ch_idx == 0) ? ((gop == 0) ? 0x28 : 0x29): ((gop == 0) ? 0x46 : 0x47);
-+
-+					rt2800_bbp_write(rt2x00dev, 158, bbp);
-+					rt2800_bbp_write(rt2x00dev, 159, idx0);
-+
-+					p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 1);
-+				}
-+
-+				idx1 = iq_err + (first_search ? 0 : ibit);
-+				idx1 = (gop == 0) ? (idx1 & 0x0F) : (idx1 & 0x3F);
-+
-+				bbp = (ch_idx == 0) ? (gop == 0) ? 0x28 : 0x29 : (gop == 0) ? 0x46 : 0x47;
-+
-+				rt2800_bbp_write(rt2x00dev, 158, bbp);
-+				rt2800_bbp_write(rt2x00dev, 159, idx1);
-+
-+				p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 1);
-+
-+				rt2x00_dbg(rt2x00dev, "p0=%x, p1=%x, pwer_final=%x, idx0=%x, idx1=%x, iq_err=%x, gop=%d, ibit=%x !\n", p0, p1, pf, idx0, idx1, iq_err, gop, ibit);
-+
-+				if ((!first_search) && (pf <= p0) && (pf < p1)) {
-+					pf = pf;
-+				} else if (p0 < p1) {
-+					pf = p0;
-+					iq_err = idx0;
-+				} else {
-+					pf = p1;
-+					iq_err = idx1;
-+				}
-+
-+				bbp = (ch_idx == 0) ? (gop == 0) ? 0x28 : 0x29 : (gop == 0) ? 0x46 : 0x47;
-+
-+				rt2800_bbp_write(rt2x00dev, 158, bbp);
-+				rt2800_bbp_write(rt2x00dev, 159, iq_err);
-+
-+				if (gop == 0)
-+					gerr = iq_err;
-+				else
-+					perr = iq_err;
-+
-+				rt2x00_dbg(rt2x00dev, "IQCalibration pf=%8x (%2x, %2x) !\n", pf, gerr & 0x0F, perr & 0x3F);
-+
-+			}
-+		}
-+
-+		if (bidx > 0)
-+			ibit = (ibit >> 1);
-+	}
-+	gerr = (gerr & 0x08) ? (gerr & 0x0F) - 0x10 : (gerr & 0x0F);
-+	perr = (perr & 0x20) ? (perr & 0x3F) - 0x40 : (perr & 0x3F);
-+
-+	gerr = (gerr < -0x07) ? -0x07 : (gerr > 0x05) ? 0x05 : gerr;
-+	gsta = gerr - 1;
-+	gend = gerr + 2;
-+
-+	perr = (perr < -0x1f) ? -0x1f : (perr > 0x1d) ? 0x1d : perr;
-+	psta = perr - 1;
-+	pend = perr + 2;
-+
-+	for (gef = gsta; gef <= gend; gef = gef + 1)
-+		for (pef = psta; pef <= pend; pef = pef + 1) {
-+			bbp = (ch_idx == 0) ? 0x28 : 0x46;
-+			rt2800_bbp_write(rt2x00dev, 158, bbp);
-+			rt2800_bbp_write(rt2x00dev, 159, gef & 0x0F);
-+
-+			bbp = (ch_idx == 0) ? 0x29 : 0x47;
-+			rt2800_bbp_write(rt2x00dev, 158, bbp);
-+			rt2800_bbp_write(rt2x00dev, 159, pef & 0x3F);
-+
-+			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 1);
-+			if ((gef == gsta) && (pef == psta)) {
-+				pf = p1;
-+				gerr = gef;
-+				perr = pef;
-+			}
-+			else if (pf > p1){
-+				pf = p1;
-+				gerr = gef;
-+				perr = pef;
-+			}
-+			rt2x00_dbg(rt2x00dev, "Fine IQCalibration p1=%8x pf=%8x (%2x, %2x) !\n", p1, pf, gef & 0x0F, pef & 0x3F);
-+		}
-+
-+	ges[ch_idx] = gerr & 0x0F;
-+	pes[ch_idx] = perr & 0x3F;
-+
-+	rt2x00_info(rt2x00dev, "IQCalibration Done! CH = %u, (gain=%2x, phase=%2x)\n", ch_idx, gerr & 0x0F, perr & 0x3F);
-+
-+	return;
-+}
-+
-+static void rt2800_rf_aux_tx0_loopback(struct rt2x00_dev *rt2x00dev)
-+{
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, 0x21);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, 0x10);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x00);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, 0x1b);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 4, 0, 0x81);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 4, 2, 0x81);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 4, 34, 0xee);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 3, 0x2d);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, 0x2d);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 17, 0x80);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 18, 0xd7);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 19, 0xa2);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 5, 20, 0x20);
-+}
-+
-+static void rt2800_rf_aux_tx1_loopback(struct rt2x00_dev *rt2x00dev)
-+{
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, 0x22);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, 0x20);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x00);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, 0x4b);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 6, 0, 0x81);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 6, 2, 0x81);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 6, 34, 0xee);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 3, 0x2d);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 4, 0x2d);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 17, 0x80);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 18, 0xd7);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 19, 0xa2);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 7, 20, 0x20);
-+}
-+
-+void rt2800_loft_iq_calibration(struct rt2x00_dev *rt2x00dev)
-+{
-+	rf_reg_pair rf_store[CHAIN_NUM][13];
-+	u32 macorg1 = 0;
-+	u32 macorg2 = 0;
-+	u32 macorg3 = 0;
-+	u32 macorg4 = 0;
-+	u32 macorg5 = 0;
-+	u32 orig528 = 0;
-+	u32 orig52c = 0;
-+
-+	u32 savemacsysctrl = 0, mtxcycle = 0;
-+	u32 macvalue = 0;
-+	u32 mac13b8 = 0;
-+	u32 p0 = 0, p1 = 0;
-+	u32 p0_idx10 = 0, p1_idx10 = 0;
-+
-+	u8 rfvalue;
-+	u8 loft_dc_search_result[CHAIN_NUM][RF_ALC_NUM][2];
-+	u8 ger[CHAIN_NUM], per[CHAIN_NUM];
-+	u8 rf_gain[] = {0x00, 0x01, 0x02, 0x04, 0x08, 0x0c};
-+	u8 rfvga_gain_table[] = {0x24, 0x25, 0x26, 0x27, 0x28, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3F};
-+
-+	u8 vga_gain[] = {14, 14};
-+	u8 bbp_2324gain[] = {0x16, 0x14, 0x12, 0x10, 0x0c, 0x08};
-+	u8 bbp = 0, ch_idx = 0, rf_alc_idx = 0, idx = 0;
-+	u8 bbpr30, rfb0r39, rfb0r42;
-+	u8 bbpr1;
-+	u8 bbpr4;
-+	u8 bbpr241, bbpr242;
-+	u8 count_step;
-+
-+	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	macorg1 = rt2800_register_read(rt2x00dev, TX_PIN_CFG);
-+	macorg2 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
-+	macorg3 = rt2800_register_read(rt2x00dev, RF_BYPASS0);
-+	macorg4 = rt2800_register_read(rt2x00dev, RF_CONTROL3);
-+	macorg5 = rt2800_register_read(rt2x00dev, RF_BYPASS3);
-+	mac13b8 = rt2800_register_read(rt2x00dev, 0x13b8);
-+	orig528 = rt2800_register_read(rt2x00dev, RF_CONTROL2);
-+	orig52c = rt2800_register_read(rt2x00dev, RF_BYPASS2);
-+
-+	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	macvalue &= (~0x04);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
-+
-+	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
-+		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue & 0x01)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	macvalue &= (~0x08);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
-+
-+	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
-+		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue & 0x02)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	for (ch_idx = 0; ch_idx < 2; ch_idx++) {
-+		rt2800_rf_configstore(rt2x00dev, rf_store, ch_idx);
-+	}
-+
-+	bbpr30 = rt2800_bbp_read(rt2x00dev, 30);
-+	rfb0r39 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 39);
-+	rfb0r42 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 42);
-+
-+	rt2800_bbp_write(rt2x00dev, 30, 0x1F);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 39, 0x80);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, 0x5B);
-+
-+	rt2800_bbp_write(rt2x00dev, 23, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 24, 0x00);
-+
-+	rt2800_setbbptonegenerator(rt2x00dev);
-+
-+	for (ch_idx = 0; ch_idx < 2; ch_idx ++) {
-+		rt2800_bbp_write(rt2x00dev, 23, 0x00);
-+		rt2800_bbp_write(rt2x00dev, 24, 0x00);
-+		rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00);
-+		rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0x0000000F);
-+		rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000004);
-+		rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00003306);
-+		rt2800_register_write(rt2x00dev, 0x13b8, 0x10);
-+		udelay(1);
-+
-+		if (ch_idx == 0) {
-+			rt2800_rf_aux_tx0_loopback(rt2x00dev);
-+		} else {
-+			rt2800_rf_aux_tx1_loopback(rt2x00dev);
-+		}
-+		udelay(1);
-+
-+		if (ch_idx == 0) {
-+			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001004);
-+		} else {
-+			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002004);
-+		}
-+
-+		rt2800_bbp_write(rt2x00dev, 158, 0x05);
-+		rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+
-+		rt2800_bbp_write(rt2x00dev, 158, 0x01);
-+		if (ch_idx == 0)
-+			rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+		else
-+			rt2800_bbp_write(rt2x00dev, 159, 0x01);
-+
-+		vga_gain[ch_idx] = 18;
-+		for (rf_alc_idx = 0; rf_alc_idx < 3; rf_alc_idx++) {
-+			rt2800_bbp_write(rt2x00dev, 23, bbp_2324gain[rf_alc_idx]);
-+			rt2800_bbp_write(rt2x00dev, 24, bbp_2324gain[rf_alc_idx]);
-+
-+			macvalue = rt2800_register_read(rt2x00dev, RF_CONTROL3);
-+			macvalue &= (~0x0000F1F1);
-+			macvalue |= (rf_gain[rf_alc_idx] << 4);
-+			macvalue |= (rf_gain[rf_alc_idx] << 12);
-+			rt2800_register_write(rt2x00dev, RF_CONTROL3, macvalue);
-+			macvalue = (0x0000F1F1);
-+			rt2800_register_write(rt2x00dev, RF_BYPASS3, macvalue);
-+
-+			if (rf_alc_idx == 0) {
-+				rt2800_write_dc(rt2x00dev, ch_idx, 0, 1, 0x21);
-+				for (;vga_gain[ch_idx] > 0;vga_gain[ch_idx] = vga_gain[ch_idx] - 2) {
-+					rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
-+					rt2800_rfcsr_write_dccal(rt2x00dev, 3, rfvalue);
-+					rt2800_rfcsr_write_dccal(rt2x00dev, 4, rfvalue);
-+					rt2800_write_dc(rt2x00dev, ch_idx, 0, 1, 0x00);
-+					rt2800_write_dc(rt2x00dev, ch_idx, 0, 0, 0x00);
-+					p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
-+					rt2800_write_dc(rt2x00dev, ch_idx, 0, 0, 0x21);
-+					p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
-+					rt2x00_dbg(rt2x00dev, "LOFT AGC %d %d\n", p0, p1);
-+					if ((p0 < 7000*7000) && (p1 < (7000*7000))) {
-+						break;
-+					}
-+				}
-+
-+				rt2800_write_dc(rt2x00dev, ch_idx, 0, 0, 0x00);
-+				rt2800_write_dc(rt2x00dev, ch_idx, 0, 1, 0x00);
-+
-+				rt2x00_dbg(rt2x00dev, "Used VGA %d %x\n",vga_gain[ch_idx], rfvga_gain_table[vga_gain[ch_idx]]);
-+
-+				if (vga_gain[ch_idx] < 0)
-+					vga_gain[ch_idx] = 0;
-+		 	}
-+
-+			rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
-+
-+			rt2800_rfcsr_write_dccal(rt2x00dev, 3, rfvalue);
-+			rt2800_rfcsr_write_dccal(rt2x00dev, 4, rfvalue);
-+
-+			rt2800_loft_search(rt2x00dev, ch_idx, rf_alc_idx, loft_dc_search_result);
-+		}
-+	}
-+
-+	for (rf_alc_idx = 0; rf_alc_idx < 3; rf_alc_idx++) {
-+		for (idx = 0; idx < 4; idx++) {
-+			rt2800_bbp_write(rt2x00dev, 158, 0xB0);
-+			bbp = (idx<<2) + rf_alc_idx;
-+			rt2800_bbp_write(rt2x00dev, 159, bbp);
-+			rt2x00_dbg(rt2x00dev, " ALC %2x,", bbp);
-+
-+			rt2800_bbp_write(rt2x00dev, 158, 0xb1);
-+			bbp = loft_dc_search_result[CHAIN_0][rf_alc_idx][0x00];
-+			bbp = bbp & 0x3F;
-+			rt2800_bbp_write(rt2x00dev, 159, bbp);
-+			rt2x00_dbg(rt2x00dev, " I0 %2x,", bbp);
-+
-+			rt2800_bbp_write(rt2x00dev, 158, 0xb2);
-+			bbp = loft_dc_search_result[CHAIN_0][rf_alc_idx][0x01];
-+			bbp = bbp & 0x3F;
-+			rt2800_bbp_write(rt2x00dev, 159, bbp);
-+			rt2x00_dbg(rt2x00dev, " Q0 %2x,", bbp);
-+
-+			rt2800_bbp_write(rt2x00dev, 158, 0xb8);
-+			bbp = loft_dc_search_result[CHAIN_1][rf_alc_idx][0x00];
-+			bbp = bbp & 0x3F;
-+			rt2800_bbp_write(rt2x00dev, 159, bbp);
-+			rt2x00_dbg(rt2x00dev, " I1 %2x,", bbp);
-+
-+			rt2800_bbp_write(rt2x00dev, 158, 0xb9);
-+			bbp = loft_dc_search_result[CHAIN_1][rf_alc_idx][0x01];
-+			bbp = bbp & 0x3F;
-+			rt2800_bbp_write(rt2x00dev, 159, bbp);
-+			rt2x00_dbg(rt2x00dev, " Q1 %2x\n", bbp);
-+		}
-+	}
-+
-+	rt2800_bbp_write(rt2x00dev, 23, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 24, 0x00);
-+
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x04);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+
-+	bbp = 0x00;
-+	rt2800_bbp_write(rt2x00dev, 244, 0x00);
-+
-+	rt2800_bbp_write(rt2x00dev, 21, 0x01);
-+	udelay(1);
-+	rt2800_bbp_write(rt2x00dev, 21, 0x00);
-+
-+	rt2800_rf_configrecover(rt2x00dev, rf_store);
-+
-+	rt2800_register_write(rt2x00dev, TX_PIN_CFG, macorg1);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x04);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, macorg2);
-+	udelay(1);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, macorg3);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL3, macorg4);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS3, macorg5);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL2, orig528);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS2, orig52c);
-+	rt2800_register_write(rt2x00dev, 0x13b8, mac13b8);
-+
-+	rt2x00_info(rt2x00dev, "LOFT Calibration Done!\n");
-+
-+	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	macorg1 = rt2800_register_read(rt2x00dev, TX_PIN_CFG);
-+	macorg2 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
-+	macorg3 = rt2800_register_read(rt2x00dev, RF_BYPASS0);
-+	macorg4 = rt2800_register_read(rt2x00dev, RF_CONTROL3);
-+	macorg5 = rt2800_register_read(rt2x00dev, RF_BYPASS3);
-+
-+	bbpr1 = rt2800_bbp_read(rt2x00dev, 1);
-+	bbpr4 = rt2800_bbp_read(rt2x00dev, 4);
-+	bbpr241 = rt2800_bbp_read(rt2x00dev, 241);
-+	bbpr242 = rt2800_bbp_read(rt2x00dev, 242);
-+	mac13b8 = rt2800_register_read(rt2x00dev, 0x13b8);
-+
-+	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	macvalue &= (~0x04);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
-+	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
-+		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue & 0x01)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
-+	macvalue &= (~0x08);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
-+	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
-+		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue & 0x02)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x00000101);
-+		rt2800_register_write(rt2x00dev, RF_BYPASS3, 0x0000F1F1);
-+	}
-+
-+	rt2800_bbp_write(rt2x00dev, 23, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 24, 0x00);
-+
-+	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+		rt2800_bbp_write(rt2x00dev, 4, bbpr4 & (~0x18));
-+		rt2800_bbp_write(rt2x00dev, 21, 0x01);
-+		udelay(1);
-+		rt2800_bbp_write(rt2x00dev, 21, 0x00);
-+
-+		rt2800_bbp_write(rt2x00dev, 241, 0x14);
-+		rt2800_bbp_write(rt2x00dev, 242, 0x80);
-+		rt2800_bbp_write(rt2x00dev, 244, 0x31);
-+	} else {
-+		rt2800_setbbptonegenerator(rt2x00dev);
-+	}
-+
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00000004);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00003306);
-+	udelay(1);
-+
-+	rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0x0000000F);
-+
-+	if (!test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x00000000);
-+		rt2800_register_write(rt2x00dev, RF_BYPASS3, 0x0000F1F1);
-+	}
-+
-+	rt2800_register_write(rt2x00dev, 0x13b8, 0x00000010);
-+
-+	for (ch_idx = 0; ch_idx < 2; ch_idx++) {
-+		rt2800_rf_configstore(rt2x00dev, rf_store, ch_idx);
-+	}
-+
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 3, 0x3B);
-+	rt2800_rfcsr_write_dccal(rt2x00dev, 4, 0x3B);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x03);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x60);
-+	rt2800_bbp_write(rt2x00dev, 158, 0xB0);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x80);
-+
-+	for (ch_idx = 0; ch_idx < 2; ch_idx ++) {
-+		rt2800_bbp_write(rt2x00dev, 23, 0x00);
-+		rt2800_bbp_write(rt2x00dev, 24, 0x00);
-+
-+		if (ch_idx == 0) {
-+			rt2800_bbp_write(rt2x00dev, 158, 0x01);
-+			rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+				bbp = bbpr1 & (~0x18);
-+				bbp = bbp | 0x00;
-+				rt2800_bbp_write(rt2x00dev, 1, bbp);
-+			}
-+			rt2800_rf_aux_tx0_loopback(rt2x00dev);
-+			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001004);
-+		} else {
-+			rt2800_bbp_write(rt2x00dev, 158, 0x01);
-+			rt2800_bbp_write(rt2x00dev, 159, 0x01);
-+			if (test_bit(CAPABILITY_EXTERNAL_PA_TX1, &rt2x00dev->cap_flags)) {
-+				bbp = bbpr1 & (~0x18);
-+				bbp = bbp | 0x08;
-+				rt2800_bbp_write(rt2x00dev, 1, bbp);
-+			}
-+			rt2800_rf_aux_tx1_loopback(rt2x00dev);
-+			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002004);
-+		}
-+
-+		rt2800_bbp_write(rt2x00dev, 158, 0x05);
-+		rt2800_bbp_write(rt2x00dev, 159, 0x04);
-+
-+		bbp = (ch_idx == 0) ? 0x28 : 0x46;
-+		rt2800_bbp_write(rt2x00dev, 158, bbp);
-+		rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+
-+		if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+			rt2800_bbp_write(rt2x00dev, 23, 0x06);
-+			rt2800_bbp_write(rt2x00dev, 24, 0x06);
-+			count_step = 1;
-+		} else {
-+			rt2800_bbp_write(rt2x00dev, 23, 0x1F);
-+			rt2800_bbp_write(rt2x00dev, 24, 0x1F);
-+			count_step = 2;
-+		}
-+
-+		for (;vga_gain[ch_idx] < 19; vga_gain[ch_idx]=(vga_gain[ch_idx] + count_step)) {
-+			rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
-+			rt2800_rfcsr_write_dccal(rt2x00dev, 3, rfvalue);
-+			rt2800_rfcsr_write_dccal(rt2x00dev, 4, rfvalue);
-+
-+			bbp = (ch_idx == 0) ? 0x29 : 0x47;
-+			rt2800_bbp_write(rt2x00dev, 158, bbp);
-+			rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+			p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 0);
-+			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+				p0_idx10 = rt2800_read_fft_accumulation(rt2x00dev, 0x0A);
-+			}
-+
-+			bbp = (ch_idx == 0) ? 0x29 : 0x47;
-+			rt2800_bbp_write(rt2x00dev, 158, bbp);
-+			rt2800_bbp_write(rt2x00dev, 159, 0x21);
-+			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 0);
-+			if (test_bit(CAPABILITY_EXTERNAL_PA_TX1, &rt2x00dev->cap_flags)) {
-+				p1_idx10 = rt2800_read_fft_accumulation(rt2x00dev, 0x0A);
-+			}
-+
-+			rt2x00_dbg(rt2x00dev, "IQ AGC %d %d\n", p0, p1);
-+
-+			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+				rt2x00_dbg(rt2x00dev, "IQ AGC IDX 10 %d %d\n", p0_idx10, p1_idx10);
-+				if ((p0_idx10 > 7000*7000) || (p1_idx10 > 7000*7000)) {
-+					if (vga_gain[ch_idx]!=0)
-+						vga_gain[ch_idx] = vga_gain[ch_idx]-1;
-+					break;
-+				}
-+			}
-+
-+			if ((p0 > 2500*2500) || (p1 > 2500*2500)) {
-+				break;
-+			}
-+		}
-+
-+		if (vga_gain[ch_idx] > 18)
-+			vga_gain[ch_idx] = 18;
-+		rt2x00_dbg(rt2x00dev, "Used VGA %d %x\n",vga_gain[ch_idx], rfvga_gain_table[vga_gain[ch_idx]]);
-+
-+		bbp = (ch_idx == 0) ? 0x29 : 0x47;
-+		rt2800_bbp_write(rt2x00dev, 158, bbp);
-+		rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+
-+		rt2800_iq_search(rt2x00dev, ch_idx, ger, per);
-+	}
-+
-+	rt2800_bbp_write(rt2x00dev, 23, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 24, 0x00);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x04);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x28);
-+	bbp = ger[CHAIN_0] & 0x0F;
-+	rt2800_bbp_write(rt2x00dev, 159, bbp);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x29);
-+	bbp = per[CHAIN_0] & 0x3F;
-+	rt2800_bbp_write(rt2x00dev, 159, bbp);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x46);
-+	bbp = ger[CHAIN_1] & 0x0F;
-+	rt2800_bbp_write(rt2x00dev, 159, bbp);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x47);
-+	bbp = per[CHAIN_1] & 0x3F;
-+	rt2800_bbp_write(rt2x00dev, 159, bbp);
-+
-+	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+		rt2800_bbp_write(rt2x00dev, 1, bbpr1);
-+		rt2800_bbp_write(rt2x00dev, 241, bbpr241);
-+		rt2800_bbp_write(rt2x00dev, 242, bbpr242);
-+	}
-+	rt2800_bbp_write(rt2x00dev, 244, 0x00);
-+
-+	rt2800_bbp_write(rt2x00dev, 158, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+	rt2800_bbp_write(rt2x00dev, 158, 0xB0);
-+	rt2800_bbp_write(rt2x00dev, 159, 0x00);
-+
-+	rt2800_bbp_write(rt2x00dev, 30, bbpr30);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 39, rfb0r39);
-+	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfb0r42);
-+
-+	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
-+		rt2800_bbp_write(rt2x00dev, 4, bbpr4);
-+	}
-+
-+	rt2800_bbp_write(rt2x00dev, 21, 0x01);
-+	udelay(1);
-+	rt2800_bbp_write(rt2x00dev, 21, 0x00);
-+
-+	rt2800_rf_configrecover(rt2x00dev, rf_store);
-+
-+	rt2800_register_write(rt2x00dev, TX_PIN_CFG, macorg1);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, 0x00);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL0, macorg2);
-+	udelay(1);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS0, macorg3);
-+	rt2800_register_write(rt2x00dev, RF_CONTROL3, macorg4);
-+	rt2800_register_write(rt2x00dev, RF_BYPASS3, macorg5);
-+	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
-+	rt2800_register_write(rt2x00dev, 0x13b8, mac13b8);
-+
-+	rt2x00_info(rt2x00dev, "TX IQ Calibration Done!\n");
-+
-+	return;
-+}
-+
- static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
- 				       bool set_bw, bool is_ht40)
- {
-@@ -9672,6 +10609,7 @@ static void rt2800_init_rfcsr_6352(struc
- 	rt2800_rxdcoc_calibration(rt2x00dev);
- 	rt2800_bw_filter_calibration(rt2x00dev, true);
- 	rt2800_bw_filter_calibration(rt2x00dev, false);
-+	rt2800_loft_iq_calibration(rt2x00dev);
- 	rt2800_rxiq_calibration(rt2x00dev);
- }
- 
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-@@ -17,6 +17,16 @@
- #define WCID_START	33
- #define WCID_END	222
- #define STA_IDS_SIZE	(WCID_END - WCID_START + 2)
-+#define CHAIN_0		0x0
-+#define CHAIN_1		0x1
-+#define RF_ALC_NUM	6
-+#define CHAIN_NUM	2
-+
-+typedef struct rf_reg_pair {
-+	u8 bank;
-+	u8 reg;
-+	u8 value;
-+} rf_reg_pair;
- 
- /* RT2800 driver data structure */
- struct rt2800_drv_data {
diff --git a/package/kernel/mac80211/patches/rt2x00/992-rt2x00-save-survey-for-every-channel-visited.patch b/package/kernel/mac80211/patches/rt2x00/992-rt2x00-save-survey-for-every-channel-visited.patch
deleted file mode 100644
index 31a7baeee..000000000
--- a/package/kernel/mac80211/patches/rt2x00/992-rt2x00-save-survey-for-every-channel-visited.patch
+++ /dev/null
@@ -1,183 +0,0 @@
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -1238,6 +1238,8 @@ void rt2800_watchdog(struct rt2x00_dev *
- 	if (test_bit(DEVICE_STATE_SCANNING, &rt2x00dev->flags))
- 		return;
- 
-+	rt2800_update_survey(rt2x00dev);
-+
- 	queue_for_each(rt2x00dev, queue) {
- 		switch (queue->qid) {
- 		case QID_AC_VO:
-@@ -1274,6 +1276,18 @@ void rt2800_watchdog(struct rt2x00_dev *
- }
- EXPORT_SYMBOL_GPL(rt2800_watchdog);
- 
-+void rt2800_update_survey(struct rt2x00_dev *rt2x00dev)
-+{
-+	struct ieee80211_channel *chan = rt2x00dev->hw->conf.chandef.chan;
-+	struct rt2x00_chan_survey *chan_survey =
-+		   &rt2x00dev->chan_survey[chan->hw_value];
-+
-+	chan_survey->time_idle += rt2800_register_read(rt2x00dev, CH_IDLE_STA);
-+	chan_survey->time_busy += rt2800_register_read(rt2x00dev, CH_BUSY_STA);
-+	chan_survey->time_ext_busy += rt2800_register_read(rt2x00dev, CH_BUSY_STA_SEC);
-+}
-+EXPORT_SYMBOL_GPL(rt2800_update_survey);
-+
- static unsigned int rt2800_hw_beacon_base(struct rt2x00_dev *rt2x00dev,
- 					  unsigned int index)
- {
-@@ -12199,26 +12213,30 @@ int rt2800_get_survey(struct ieee80211_h
- {
- 	struct rt2x00_dev *rt2x00dev = hw->priv;
- 	struct ieee80211_conf *conf = &hw->conf;
--	u32 idle, busy, busy_ext;
-+	struct rt2x00_chan_survey *chan_survey =
-+		   &rt2x00dev->chan_survey[idx];
-+	enum nl80211_band band = NL80211_BAND_2GHZ;
- 
--	if (idx != 0)
-+	if (idx >= rt2x00dev->bands[band].n_channels) {
-+		idx -= rt2x00dev->bands[band].n_channels;
-+		band = NL80211_BAND_5GHZ;
-+	}
-+
-+	if (idx >= rt2x00dev->bands[band].n_channels)
- 		return -ENOENT;
- 
--	survey->channel = conf->chandef.chan;
-+	if (idx == 0)
-+		rt2800_update_survey(rt2x00dev);
- 
--	idle = rt2800_register_read(rt2x00dev, CH_IDLE_STA);
--	busy = rt2800_register_read(rt2x00dev, CH_BUSY_STA);
--	busy_ext = rt2800_register_read(rt2x00dev, CH_BUSY_STA_SEC);
--
--	if (idle || busy) {
--		survey->filled = SURVEY_INFO_TIME |
--				 SURVEY_INFO_TIME_BUSY |
--				 SURVEY_INFO_TIME_EXT_BUSY;
--
--		survey->time = (idle + busy) / 1000;
--		survey->time_busy = busy / 1000;
--		survey->time_ext_busy = busy_ext / 1000;
--	}
-+	survey->channel = &rt2x00dev->bands[band].channels[idx];
-+
-+	survey->filled = SURVEY_INFO_TIME |
-+			 SURVEY_INFO_TIME_BUSY |
-+			 SURVEY_INFO_TIME_EXT_BUSY;
-+
-+	survey->time = div_u64(chan_survey->time_idle + chan_survey->time_busy, 1000);
-+	survey->time_busy = div_u64(chan_survey->time_busy, 1000);
-+	survey->time_ext_busy = div_u64(chan_survey->time_ext_busy, 1000);
- 
- 	if (!(hw->conf.flags & IEEE80211_CONF_OFFCHANNEL))
- 		survey->filled |= SURVEY_INFO_IN_USE;
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-@@ -243,6 +243,7 @@ bool rt2800_txstatus_timeout(struct rt2x
- bool rt2800_txstatus_pending(struct rt2x00_dev *rt2x00dev);
- 
- void rt2800_watchdog(struct rt2x00_dev *rt2x00dev);
-+void rt2800_update_survey(struct rt2x00_dev *rt2x00dev);
- 
- void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc);
- void rt2800_clear_beacon(struct queue_entry *entry);
---- a/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
-@@ -360,6 +360,7 @@ static const struct rt2x00lib_ops rt2800
- 	.gain_calibration	= rt2800_gain_calibration,
- 	.vco_calibration	= rt2800_vco_calibration,
- 	.watchdog		= rt2800_watchdog,
-+	.update_survey		= rt2800_update_survey,
- 	.start_queue		= rt2800mmio_start_queue,
- 	.kick_queue		= rt2800mmio_kick_queue,
- 	.stop_queue		= rt2800mmio_stop_queue,
---- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
-@@ -214,6 +214,7 @@ static const struct rt2x00lib_ops rt2800
- 	.gain_calibration	= rt2800_gain_calibration,
- 	.vco_calibration	= rt2800_vco_calibration,
- 	.watchdog		= rt2800_watchdog,
-+	.update_survey		= rt2800_update_survey,
- 	.start_queue		= rt2800mmio_start_queue,
- 	.kick_queue		= rt2800mmio_kick_queue,
- 	.stop_queue		= rt2800mmio_stop_queue,
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -183,6 +183,15 @@ struct rf_channel {
- };
- 
- /*
-+ * Information structure for channel survey.
-+ */
-+struct rt2x00_chan_survey {
-+	u64 time_idle;
-+	u64 time_busy;
-+	u64 time_ext_busy;
-+};
-+
-+/*
-  * Channel information structure
-  */
- struct channel_info {
-@@ -567,6 +576,7 @@ struct rt2x00lib_ops {
- 	 * Data queue handlers.
- 	 */
- 	void (*watchdog) (struct rt2x00_dev *rt2x00dev);
-+	void (*update_survey) (struct rt2x00_dev *rt2x00dev);
- 	void (*start_queue) (struct data_queue *queue);
- 	void (*kick_queue) (struct data_queue *queue);
- 	void (*stop_queue) (struct data_queue *queue);
-@@ -755,6 +765,7 @@ struct rt2x00_dev {
- 	 */
- 	struct ieee80211_hw *hw;
- 	struct ieee80211_supported_band bands[NUM_NL80211_BANDS];
-+	struct rt2x00_chan_survey *chan_survey;
- 	enum nl80211_band curr_band;
- 	int curr_freq;
- 
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1057,6 +1057,12 @@ static int rt2x00lib_probe_hw_modes(stru
- 	if (!rates)
- 		goto exit_free_channels;
- 
-+	rt2x00dev->chan_survey =
-+		kcalloc(spec->num_channels, sizeof(struct rt2x00_chan_survey),
-+			GFP_KERNEL);
-+	if (!rt2x00dev->chan_survey)
-+		goto exit_free_rates;
-+
- 	/*
- 	 * Initialize Rate list.
- 	 */
-@@ -1108,6 +1114,8 @@ static int rt2x00lib_probe_hw_modes(stru
- 
- 	return 0;
- 
-+ exit_free_rates:
-+	kfree(rates);
-  exit_free_channels:
- 	kfree(channels);
- 	rt2x00_err(rt2x00dev, "Allocation ieee80211 modes failed\n");
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
-@@ -317,6 +317,15 @@ int rt2x00mac_config(struct ieee80211_hw
- 		return 0;
- 
- 	/*
-+	 * To provide correct survey data for survey-based ACS algorithm
-+	 * we have to save survey data for current channel before switching.
-+	 */
-+	if (rt2x00dev->ops->lib->update_survey &&
-+	    (changed & IEEE80211_CONF_CHANGE_CHANNEL)) {
-+		rt2x00dev->ops->lib->update_survey(rt2x00dev);
-+	}
-+
-+	/*
- 	 * Some configuration parameters (e.g. channel and antenna values) can
- 	 * only be set when the radio is enabled, but do require the RX to
- 	 * be off. During this period we should keep link tuning enabled,
diff --git a/package/kernel/mac80211/patches/rt2x00/994-rt2x00-import-support-for-external-LNA-on-MT7620.patch b/package/kernel/mac80211/patches/rt2x00/994-rt2x00-import-support-for-external-LNA-on-MT7620.patch
new file mode 100644
index 000000000..deaa03be6
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/994-rt2x00-import-support-for-external-LNA-on-MT7620.patch
@@ -0,0 +1,161 @@
+From 0fce1109f894ec7fcd72cb098843a1eff786716a Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Fri, 16 Sep 2022 20:49:42 +0100
+Subject: [PATCH 16/16] rt2x00: import support for external LNA on MT7620
+To: linux-wireless@vger.kernel.org,
+    Stanislaw Gruszka <stf_xl@wp.pl>,
+    Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+    David S. Miller <davem@davemloft.net>,
+    Eric Dumazet <edumazet@google.com>,
+    Jakub Kicinski <kuba@kernel.org>,
+    Paolo Abeni <pabeni@redhat.com>,
+    Johannes Berg <johannes.berg@intel.com>
+
+In order to carry out calibration on boards with ePA or eLNA the PA pin
+needs to be switch to GPIO mode on MT7620. Implement that by selecting
+pinctrl state "pa_gpio" which should be defined for MT7620 boards with
+eLNA or ePA beside the "default" state.
+
+Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 58 +++++++++++++++++++
+ drivers/net/wireless/ralink/rt2x00/rt2x00.h   |  5 ++
+ .../net/wireless/ralink/rt2x00/rt2x00soc.c    | 15 +++++
+ 3 files changed, 78 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -304,6 +304,24 @@ static void rt2800_rf_write(struct rt2x0
+ 	mutex_unlock(&rt2x00dev->csr_mutex);
+ }
+ 
++void rt6352_enable_pa_pin(struct rt2x00_dev *rt2x00dev, int enable)
++{
++	if (!rt2x00dev->pinctrl)
++		return;
++
++	if (enable) {
++		if (!rt2x00dev->pins_default)
++			return;
++
++		pinctrl_select_state(rt2x00dev->pinctrl, rt2x00dev->pins_default);
++	} else {
++		if (!rt2x00dev->pins_pa_gpio)
++			return;
++
++		pinctrl_select_state(rt2x00dev->pinctrl, rt2x00dev->pins_pa_gpio);
++	}
++}
++
+ static const unsigned int rt2800_eeprom_map[EEPROM_WORD_COUNT] = {
+ 	[EEPROM_CHIP_ID]		= 0x0000,
+ 	[EEPROM_VERSION]		= 0x0001,
+@@ -4469,6 +4487,29 @@ static void rt2800_config_channel(struct
+ 			rt2800_register_write(rt2x00dev, TX1_RF_GAIN_ATTEN,
+ 					      0x6C6C6B6C);
+ 		}
++
++		if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
++			reg = rt2800_register_read(rt2x00dev, RF_CONTROL3);
++			reg |= 0x00000101;
++			rt2800_register_write(rt2x00dev, RF_CONTROL3, reg);
++
++			reg = rt2800_register_read(rt2x00dev, RF_BYPASS3);
++			reg |= 0x00000101;
++			rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
++
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x66);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x20);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 18, 0x42);
++			rt2800_bbp_write(rt2x00dev, 75, 0x68);
++			rt2800_bbp_write(rt2x00dev, 76, 0x4C);
++			rt2800_bbp_write(rt2x00dev, 79, 0x1C);
++			rt2800_bbp_write(rt2x00dev, 80, 0x0C);
++			rt2800_bbp_write(rt2x00dev, 82, 0xB6);
++			/* bank 0 RF reg 42 and glrt BBP reg 141 will be set in
++			 * config channel function in dependence of channel and
++			 * HT20/HT40 so don't touch it
++			 */
++		}
+ 	}
+ 
+ 	bbp = rt2800_bbp_read(rt2x00dev, 4);
+@@ -10583,6 +10624,7 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
+ 
++	rt6352_enable_pa_pin(rt2x00dev, 0);
+ 	rt2800_r_calibration(rt2x00dev);
+ 	rt2800_rf_self_txdc_cal(rt2x00dev);
+ 	rt2800_rxdcoc_calibration(rt2x00dev);
+@@ -10590,6 +10632,22 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_bw_filter_calibration(rt2x00dev, false);
+ 	rt2800_loft_iq_calibration(rt2x00dev);
+ 	rt2800_rxiq_calibration(rt2x00dev);
++	rt6352_enable_pa_pin(rt2x00dev, 1);
++
++	if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x66);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x20);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 18, 0x42);
++		rt2800_bbp_write(rt2x00dev, 75, 0x68);
++		rt2800_bbp_write(rt2x00dev, 76, 0x4C);
++		rt2800_bbp_write(rt2x00dev, 79, 0x1C);
++		rt2800_bbp_write(rt2x00dev, 80, 0x0C);
++		rt2800_bbp_write(rt2x00dev, 82, 0xB6);
++		/* bank 0 RF reg 42 and glrt BBP reg 141 will be set in config
++		 * channel function in dependence of channel and HT20/HT40,
++		 * so don't touch them here.
++		 */
++	}
+ }
+ 
+ static void rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -28,6 +28,7 @@
+ #include <linux/average.h>
+ #include <linux/usb.h>
+ #include <linux/clk.h>
++#include <linux/pinctrl/consumer.h>
+ #include <linux/rt2x00_platform.h>
+ 
+ #include <net/mac80211.h>
+@@ -1029,6 +1030,11 @@ struct rt2x00_dev {
+ 
+ 	/* Clock for System On Chip devices. */
+ 	struct clk *clk;
++
++	/* pinctrl and states for System On Chip devices with PA/LNA. */
++	struct pinctrl *pinctrl;
++	struct pinctrl_state *pins_default;
++	struct pinctrl_state *pins_pa_gpio;
+ };
+ 
+ struct rt2x00_bar_list_entry {
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
+@@ -97,6 +97,21 @@ int rt2x00soc_probe(struct platform_devi
+ 	if (retval)
+ 		goto exit_free_reg;
+ 
++	rt2x00dev->pinctrl = devm_pinctrl_get(&pdev->dev);
++	if (IS_ERR(rt2x00dev->pinctrl)) {
++		rt2x00dev->pinctrl = NULL;
++		rt2x00dev->pins_default = NULL;
++		rt2x00dev->pins_pa_gpio = NULL;
++	} else {
++		rt2x00dev->pins_default = pinctrl_lookup_state(rt2x00dev->pinctrl, "default");
++		if (IS_ERR(rt2x00dev->pins_default))
++			rt2x00dev->pins_default = NULL;
++
++		rt2x00dev->pins_pa_gpio = pinctrl_lookup_state(rt2x00dev->pinctrl, "pa_gpio");
++		if (IS_ERR(rt2x00dev->pins_pa_gpio))
++			rt2x00dev->pins_pa_gpio = NULL;
++	}
++
+ 	return 0;
+ 
+ exit_free_reg:
diff --git a/package/kernel/mac80211/patches/rt2x00/990-rt2x00-mt7620-introduce-accessors-for-CHIP_VER-register.patch b/package/kernel/mac80211/patches/rt2x00/995-rt2x00-mt7620-introduce-accessors-for-CHIP_VER-register.patch
similarity index 92%
rename from package/kernel/mac80211/patches/rt2x00/990-rt2x00-mt7620-introduce-accessors-for-CHIP_VER-register.patch
rename to package/kernel/mac80211/patches/rt2x00/995-rt2x00-mt7620-introduce-accessors-for-CHIP_VER-register.patch
index 76114fe9a..97a56de2b 100644
--- a/package/kernel/mac80211/patches/rt2x00/990-rt2x00-mt7620-introduce-accessors-for-CHIP_VER-register.patch
+++ b/package/kernel/mac80211/patches/rt2x00/995-rt2x00-mt7620-introduce-accessors-for-CHIP_VER-register.patch
@@ -50,8 +50,8 @@
 +
  static const struct ieee80211_ops rt2800pci_mac80211_ops = {
  	.tx			= rt2x00mac_tx,
- 	.start			= rt2x00mac_start,
-@@ -328,6 +332,9 @@ static const struct rt2800_ops rt2800pci
+ 	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+@@ -329,6 +333,9 @@ static const struct rt2800_ops rt2800pci
  	.drv_init_registers	= rt2800mmio_init_registers,
  	.drv_get_txwi		= rt2800mmio_get_txwi,
  	.drv_get_dma_done	= rt2800mmio_get_dma_done,
@@ -103,8 +103,8 @@
 +
  static const struct ieee80211_ops rt2800soc_mac80211_ops = {
  	.tx			= rt2x00mac_tx,
- 	.start			= rt2x00mac_start,
-@@ -159,6 +186,9 @@ static const struct rt2800_ops rt2800soc
+ 	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+@@ -160,6 +187,9 @@ static const struct rt2800_ops rt2800soc
  	.drv_init_registers	= rt2800mmio_init_registers,
  	.drv_get_txwi		= rt2800mmio_get_txwi,
  	.drv_get_dma_done	= rt2800mmio_get_dma_done,
@@ -126,8 +126,8 @@
 +
  static const struct ieee80211_ops rt2800usb_mac80211_ops = {
  	.tx			= rt2x00mac_tx,
- 	.start			= rt2x00mac_start,
-@@ -671,6 +675,9 @@ static const struct rt2800_ops rt2800usb
+ 	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+@@ -672,6 +676,9 @@ static const struct rt2800_ops rt2800usb
  	.drv_init_registers	= rt2800usb_init_registers,
  	.drv_get_txwi		= rt2800usb_get_txwi,
  	.drv_get_dma_done	= rt2800usb_get_dma_done,
diff --git a/package/kernel/mac80211/patches/rt2x00/991-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch b/package/kernel/mac80211/patches/rt2x00/996-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch
similarity index 95%
rename from package/kernel/mac80211/patches/rt2x00/991-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch
rename to package/kernel/mac80211/patches/rt2x00/996-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch
index 3de00b226..dab6e05ff 100644
--- a/package/kernel/mac80211/patches/rt2x00/991-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch
+++ b/package/kernel/mac80211/patches/rt2x00/996-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
-@@ -1042,6 +1042,11 @@
+@@ -1044,6 +1044,11 @@
  #define MIMO_PS_CFG_RX_STBY_POL		FIELD32(0x00000010)
  #define MIMO_PS_CFG_RX_RX_STBY0		FIELD32(0x00000020)
  
@@ -14,7 +14,7 @@
   */
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -3685,14 +3685,16 @@ static void rt2800_config_channel_rf7620
+@@ -3778,14 +3778,16 @@ static void rt2800_config_channel_rf7620
  	rt2x00_set_field8(&rfcsr, RFCSR19_K, rf->rf4);
  	rt2800_rfcsr_write(rt2x00dev, 19, rfcsr);
  
@@ -39,7 +39,7 @@
  
  	rfcsr = rt2800_rfcsr_read(rt2x00dev, 1);
  	rt2x00_set_field8(&rfcsr, RFCSR1_TX2_EN_MT7620,
-@@ -3726,18 +3728,23 @@ static void rt2800_config_channel_rf7620
+@@ -3819,18 +3821,23 @@ static void rt2800_config_channel_rf7620
  		rt2800_rfcsr_write_dccal(rt2x00dev, 59, 0x20);
  	}
  
@@ -73,9 +73,9 @@
  
  	if (!test_bit(DEVICE_STATE_SCANNING, &rt2x00dev->flags)) {
  		if (conf_is_ht40(conf)) {
-@@ -3837,25 +3844,29 @@ static void rt2800_config_alc(struct rt2
- 	if (i == 10000)
- 		rt2x00_warn(rt2x00dev, "Wait MAC Status to MAX !!!\n");
+@@ -3929,25 +3936,29 @@ static void rt2800_config_alc(struct rt2
+ 	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY)))
+ 		rt2x00_warn(rt2x00dev, "RF busy while configuring ALC\n");
  
 -	if (chan->center_freq > 2457) {
 -		bbp = rt2800_bbp_read(rt2x00dev, 30);
@@ -121,12 +121,12 @@
  	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, mac_sys_ctrl);
  
  	rt2800_vco_calibration(rt2x00dev);
-@@ -5887,18 +5898,33 @@ static int rt2800_init_registers(struct
+@@ -6011,18 +6022,33 @@ static int rt2800_init_registers(struct
  	} else if (rt2x00_rt(rt2x00dev, RT5350)) {
  		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
  	} else if (rt2x00_rt(rt2x00dev, RT6352)) {
 -		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000401);
--		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0000);
+-		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0001);
 -		rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
 -		rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x00000000);
 -		rt2800_register_write(rt2x00dev, TX0_BB_GAIN_ATTEN, 0x0);
@@ -150,7 +150,7 @@
 +					      0x00550055);
 +		} else {
 +			rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000401);
-+			rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0000);
++			rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0001);
 +			rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
 +			rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x00000000);
 +			rt2800_register_write(rt2x00dev, TX0_BB_GAIN_ATTEN, 0x0);
@@ -167,7 +167,7 @@
  		reg = rt2800_register_read(rt2x00dev, TX_ALC_CFG_1);
  		rt2x00_set_field32(&reg, TX_ALC_CFG_1_ROS_BUSY_EN, 0);
  		rt2800_register_write(rt2x00dev, TX_ALC_CFG_1, reg);
-@@ -7042,14 +7068,16 @@ static void rt2800_init_bbp_6352(struct
+@@ -7127,14 +7153,16 @@ static void rt2800_init_bbp_6352(struct
  	rt2800_bbp_write(rt2x00dev, 188, 0x00);
  	rt2800_bbp_write(rt2x00dev, 189, 0x00);
  
@@ -192,7 +192,7 @@
  
  	/* BBP for G band GLRT function (BBP_128 ~ BBP_221) */
  	rt2800_bbp_glrt_write(rt2x00dev, 0, 0x00);
-@@ -10388,31 +10416,36 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10408,31 +10436,36 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write(rt2x00dev, 42, 0x5B);
  	rt2800_rfcsr_write(rt2x00dev, 43, 0x00);
  
@@ -254,7 +254,7 @@
  
  	/* Initialize RF channel register to default value */
  	rt2800_rfcsr_write_chanreg(rt2x00dev, 0, 0x03);
-@@ -10478,63 +10511,71 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10498,63 +10531,71 @@ static void rt2800_init_rfcsr_6352(struc
  
  	rt2800_rfcsr_write_bank(rt2x00dev, 6, 45, 0xC5);
  
@@ -383,7 +383,7 @@
  
  	/* Initialize RF DC calibration register to default value */
  	rt2800_rfcsr_write_dccal(rt2x00dev, 0, 0x47);
-@@ -10597,12 +10638,17 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10617,12 +10658,17 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write_dccal(rt2x00dev, 62, 0x00);
  	rt2800_rfcsr_write_dccal(rt2x00dev, 63, 0x00);
  
@@ -404,5 +404,5 @@
 +		rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
 +	}
  
+ 	rt6352_enable_pa_pin(rt2x00dev, 0);
  	rt2800_r_calibration(rt2x00dev);
- 	rt2800_rf_self_txdc_cal(rt2x00dev);
diff --git a/package/kernel/mac80211/patches/rtl/002-v5.13-rtlwifi-implement-set_tim-by-update-beacon-content.patch b/package/kernel/mac80211/patches/rtl/002-v5.13-rtlwifi-implement-set_tim-by-update-beacon-content.patch
deleted file mode 100644
index 3daf65e96..000000000
--- a/package/kernel/mac80211/patches/rtl/002-v5.13-rtlwifi-implement-set_tim-by-update-beacon-content.patch
+++ /dev/null
@@ -1,118 +0,0 @@
-Date: Mon, 19 Apr 2021 14:59:56 +0800
-From: Ping-Ke Shih <pkshih@realtek.com>
-To: <kvalo@codeaurora.org>
-CC: <linux-wireless@vger.kernel.org>, <mail@maciej.szmigiero.name>,
-        <Larry.Finger@lwfinger.net>
-Subject: [PATCH] rtlwifi: implement set_tim by update beacon content
-
-Once beacon content is changed, we update the content to wifi card by
-send_beacon_frame(). Then, STA with PS can wake up properly to receive its
-packets.
-
-Since we update beacon content to PCI wifi devices every beacon interval,
-the only one usb device, 8192CU, needs to update beacon content when
-mac80211 calling set_tim.
-
-Reported-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
-Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
-Tested-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
----
- drivers/net/wireless/realtek/rtlwifi/core.c | 32 +++++++++++++++++++++
- drivers/net/wireless/realtek/rtlwifi/core.h |  1 +
- drivers/net/wireless/realtek/rtlwifi/usb.c  |  3 ++
- drivers/net/wireless/realtek/rtlwifi/wifi.h |  1 +
- 4 files changed, 37 insertions(+)
-
---- a/drivers/net/wireless/realtek/rtlwifi/core.c
-+++ b/drivers/net/wireless/realtek/rtlwifi/core.c
-@@ -1018,6 +1018,25 @@ static void send_beacon_frame(struct iee
- 	}
- }
- 
-+void rtl_update_beacon_work_callback(struct work_struct *work)
-+{
-+	struct rtl_works *rtlworks =
-+	    container_of(work, struct rtl_works, update_beacon_work);
-+	struct ieee80211_hw *hw = rtlworks->hw;
-+	struct rtl_priv *rtlpriv = rtl_priv(hw);
-+	struct ieee80211_vif *vif = rtlpriv->mac80211.vif;
-+
-+	if (!vif) {
-+		WARN_ONCE(true, "no vif to update beacon\n");
-+		return;
-+	}
-+
-+	mutex_lock(&rtlpriv->locks.conf_mutex);
-+	send_beacon_frame(hw, vif);
-+	mutex_unlock(&rtlpriv->locks.conf_mutex);
-+}
-+EXPORT_SYMBOL_GPL(rtl_update_beacon_work_callback);
-+
- static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
- 				    struct ieee80211_vif *vif,
- 				    struct ieee80211_bss_conf *bss_conf,
-@@ -1747,6 +1766,18 @@ static void rtl_op_flush(struct ieee8021
- 		rtlpriv->intf_ops->flush(hw, queues, drop);
- }
- 
-+static int rtl_op_set_tim(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
-+			  bool set)
-+{
-+	struct rtl_priv *rtlpriv = rtl_priv(hw);
-+	struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-+
-+	if (rtlhal->hw_type == HARDWARE_TYPE_RTL8192CU)
-+		schedule_work(&rtlpriv->works.update_beacon_work);
-+
-+	return 0;
-+}
-+
- /*	Description:
-  *		This routine deals with the Power Configuration CMD
-  *		 parsing for RTL8723/RTL8188E Series IC.
-@@ -1903,6 +1934,7 @@ const struct ieee80211_ops rtl_ops = {
- 	.sta_add = rtl_op_sta_add,
- 	.sta_remove = rtl_op_sta_remove,
- 	.flush = rtl_op_flush,
-+	.set_tim = rtl_op_set_tim,
- };
- EXPORT_SYMBOL_GPL(rtl_ops);
- 
---- a/drivers/net/wireless/realtek/rtlwifi/core.h
-+++ b/drivers/net/wireless/realtek/rtlwifi/core.h
-@@ -60,5 +60,6 @@ void rtl_bb_delay(struct ieee80211_hw *h
- bool rtl_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb);
- bool rtl_btc_status_false(void);
- void rtl_dm_diginit(struct ieee80211_hw *hw, u32 cur_igval);
-+void rtl_update_beacon_work_callback(struct work_struct *work);
- 
- #endif
---- a/drivers/net/wireless/realtek/rtlwifi/usb.c
-+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
-@@ -807,6 +807,7 @@ static void rtl_usb_stop(struct ieee8021
- 
- 	tasklet_kill(&rtlusb->rx_work_tasklet);
- 	cancel_work_sync(&rtlpriv->works.lps_change_work);
-+	cancel_work_sync(&rtlpriv->works.update_beacon_work);
- 
- 	flush_workqueue(rtlpriv->works.rtl_wq);
- 
-@@ -1033,6 +1034,8 @@ int rtl_usb_probe(struct usb_interface *
- 		  rtl_fill_h2c_cmd_work_callback);
- 	INIT_WORK(&rtlpriv->works.lps_change_work,
- 		  rtl_lps_change_work_callback);
-+	INIT_WORK(&rtlpriv->works.update_beacon_work,
-+		  rtl_update_beacon_work_callback);
- 
- 	rtlpriv->usb_data_index = 0;
- 	init_completion(&rtlpriv->firmware_loading_complete);
---- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
-+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
-@@ -2487,6 +2487,7 @@ struct rtl_works {
- 
- 	struct work_struct lps_change_work;
- 	struct work_struct fill_h2c_cmd;
-+	struct work_struct update_beacon_work;
- };
- 
- struct rtl_debug {
diff --git a/package/kernel/mac80211/patches/subsys/010-sync-nl80211_h.patch b/package/kernel/mac80211/patches/subsys/010-sync-nl80211_h.patch
deleted file mode 100644
index e1f66ac1c..000000000
--- a/package/kernel/mac80211/patches/subsys/010-sync-nl80211_h.patch
+++ /dev/null
@@ -1,297 +0,0 @@
---- a/include/uapi/linux/nl80211.h
-+++ b/include/uapi/linux/nl80211.h
-@@ -655,6 +655,9 @@
-  *	When a security association was established on an 802.1X network using
-  *	fast transition, this event should be followed by an
-  *	%NL80211_CMD_PORT_AUTHORIZED event.
-+ *	Following a %NL80211_CMD_ROAM event userspace can issue
-+ *	%NL80211_CMD_GET_SCAN in order to obtain the scan information for the
-+ *	new BSS the card/driver roamed to.
-  * @NL80211_CMD_DISCONNECT: drop a given connection; also used to notify
-  *	userspace that a connection was dropped by the AP or due to other
-  *	reasons, for this the %NL80211_ATTR_DISCONNECTED_BY_AP and
-@@ -757,7 +760,8 @@
-  *	of any other interfaces, and other interfaces will again take
-  *	precedence when they are used.
-  *
-- * @NL80211_CMD_SET_WDS_PEER: Set the MAC address of the peer on a WDS interface.
-+ * @NL80211_CMD_SET_WDS_PEER: Set the MAC address of the peer on a WDS interface
-+ *	(no longer supported).
-  *
-  * @NL80211_CMD_SET_MULTICAST_TO_UNICAST: Configure if this AP should perform
-  *	multicast to unicast conversion. When enabled, all multicast packets
-@@ -1177,6 +1181,10 @@
-  *	includes the contents of the frame. %NL80211_ATTR_ACK flag is included
-  *	if the recipient acknowledged the frame.
-  *
-+ * @NL80211_CMD_SET_SAR_SPECS: SAR power limitation configuration is
-+ *	passed using %NL80211_ATTR_SAR_SPEC. %NL80211_ATTR_WIPHY is used to
-+ *	specify the wiphy index to be applied to.
-+ *
-  * @NL80211_CMD_MAX: highest used command number
-  * @__NL80211_CMD_AFTER_LAST: internal use
-  */
-@@ -1407,6 +1415,8 @@ enum nl80211_commands {
- 
- 	NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS,
- 
-+	NL80211_CMD_SET_SAR_SPECS,
-+
- 	/* add new commands above here */
- 
- 	/* used to define NL80211_CMD_MAX below */
-@@ -1750,8 +1760,9 @@ enum nl80211_commands {
-  *	specify just a single bitrate, which is to be used for the beacon.
-  *	The driver must also specify support for this with the extended
-  *	features NL80211_EXT_FEATURE_BEACON_RATE_LEGACY,
-- *	NL80211_EXT_FEATURE_BEACON_RATE_HT and
-- *	NL80211_EXT_FEATURE_BEACON_RATE_VHT.
-+ *	NL80211_EXT_FEATURE_BEACON_RATE_HT,
-+ *	NL80211_EXT_FEATURE_BEACON_RATE_VHT and
-+ *	NL80211_EXT_FEATURE_BEACON_RATE_HE.
-  *
-  * @NL80211_ATTR_FRAME_MATCH: A binary attribute which typically must contain
-  *	at least one byte, currently used with @NL80211_CMD_REGISTER_FRAME.
-@@ -1955,8 +1966,15 @@ enum nl80211_commands {
-  * @NL80211_ATTR_PROBE_RESP: Probe Response template data. Contains the entire
-  *	probe-response frame. The DA field in the 802.11 header is zero-ed out,
-  *	to be filled by the FW.
-- * @NL80211_ATTR_DISABLE_HT:  Force HT capable interfaces to disable
-- *      this feature.  Currently, only supported in mac80211 drivers.
-+ * @NL80211_ATTR_DISABLE_HT: Force HT capable interfaces to disable
-+ *      this feature during association. This is a flag attribute.
-+ *	Currently only supported in mac80211 drivers.
-+ * @NL80211_ATTR_DISABLE_VHT: Force VHT capable interfaces to disable
-+ *      this feature during association. This is a flag attribute.
-+ *	Currently only supported in mac80211 drivers.
-+ * @NL80211_ATTR_DISABLE_HE: Force HE capable interfaces to disable
-+ *      this feature during association. This is a flag attribute.
-+ *	Currently only supported in mac80211 drivers.
-  * @NL80211_ATTR_HT_CAPABILITY_MASK: Specify which bits of the
-  *      ATTR_HT_CAPABILITY to which attention should be paid.
-  *      Currently, only mac80211 NICs support this feature.
-@@ -2077,7 +2095,8 @@ enum nl80211_commands {
-  *	until the channel switch event.
-  * @NL80211_ATTR_CH_SWITCH_BLOCK_TX: flag attribute specifying that transmission
-  *	must be blocked on the current channel (before the channel switch
-- *	operation).
-+ *	operation). Also included in the channel switch started event if quiet
-+ *	was requested by the AP.
-  * @NL80211_ATTR_CSA_IES: Nested set of attributes containing the IE information
-  *	for the time while performing a channel switch.
-  * @NL80211_ATTR_CNTDWN_OFFS_BEACON: An array of offsets (u16) to the channel
-@@ -2527,6 +2546,20 @@ enum nl80211_commands {
-  *	override mask. Used with NL80211_ATTR_S1G_CAPABILITY in
-  *	NL80211_CMD_ASSOCIATE or NL80211_CMD_CONNECT.
-  *
-+ * @NL80211_ATTR_SAE_PWE: Indicates the mechanism(s) allowed for SAE PWE
-+ *	derivation in WPA3-Personal networks which are using SAE authentication.
-+ *	This is a u8 attribute that encapsulates one of the values from
-+ *	&enum nl80211_sae_pwe_mechanism.
-+ *
-+ * @NL80211_ATTR_SAR_SPEC: SAR power limitation specification when
-+ *	used with %NL80211_CMD_SET_SAR_SPECS. The message contains fields
-+ *	of %nl80211_sar_attrs which specifies the sar type and related
-+ *	sar specs. Sar specs contains array of %nl80211_sar_specs_attrs.
-+ *
-+ * @NL80211_ATTR_RECONNECT_REQUESTED: flag attribute, used with deauth and
-+ *	disassoc events to indicate that an immediate reconnect to the AP
-+ *	is desired.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3016,6 +3049,14 @@ enum nl80211_attrs {
- 	NL80211_ATTR_S1G_CAPABILITY,
- 	NL80211_ATTR_S1G_CAPABILITY_MASK,
- 
-+	NL80211_ATTR_SAE_PWE,
-+
-+	NL80211_ATTR_RECONNECT_REQUESTED,
-+
-+	NL80211_ATTR_SAR_SPEC,
-+
-+	NL80211_ATTR_DISABLE_HE,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -5896,6 +5937,19 @@ enum nl80211_feature_flags {
-  * @NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP: Driver/device supports
-  *	unsolicited broadcast probe response transmission
-  *
-+ * @NL80211_EXT_FEATURE_BEACON_RATE_HE: Driver supports beacon rate
-+ *	configuration (AP/mesh) with HE rates.
-+ *
-+ * @NL80211_EXT_FEATURE_SECURE_LTF: Device supports secure LTF measurement
-+ *      exchange protocol.
-+ *
-+ * @NL80211_EXT_FEATURE_SECURE_RTT: Device supports secure RTT measurement
-+ *      exchange protocol.
-+ *
-+ * @NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE: Device supports management
-+ *      frame protection for all management frames exchanged during the
-+ *      negotiation and range measurement procedure.
-+ *
-  * @NUM_NL80211_EXT_FEATURES: number of extended features.
-  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
-  */
-@@ -5956,6 +6010,10 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_SAE_OFFLOAD_AP,
- 	NL80211_EXT_FEATURE_FILS_DISCOVERY,
- 	NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP,
-+	NL80211_EXT_FEATURE_BEACON_RATE_HE,
-+	NL80211_EXT_FEATURE_SECURE_LTF,
-+	NL80211_EXT_FEATURE_SECURE_RTT,
-+	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
- 
- 	/* add new features before the definition below */
- 	NUM_NL80211_EXT_FEATURES,
-@@ -6253,11 +6311,13 @@ struct nl80211_vendor_cmd_info {
-  * @NL80211_TDLS_PEER_HT: TDLS peer is HT capable.
-  * @NL80211_TDLS_PEER_VHT: TDLS peer is VHT capable.
-  * @NL80211_TDLS_PEER_WMM: TDLS peer is WMM capable.
-+ * @NL80211_TDLS_PEER_HE: TDLS peer is HE capable.
-  */
- enum nl80211_tdls_peer_capability {
- 	NL80211_TDLS_PEER_HT = 1<<0,
- 	NL80211_TDLS_PEER_VHT = 1<<1,
- 	NL80211_TDLS_PEER_WMM = 1<<2,
-+	NL80211_TDLS_PEER_HE = 1<<3,
- };
- 
- /**
-@@ -6849,6 +6909,9 @@ enum nl80211_peer_measurement_ftm_capa {
-  *      if neither %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED nor
-  *	%NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set, EDCA based
-  *	ranging will be used.
-+ * @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK: negotiate for LMR feedback. Only
-+ *	valid if either %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED or
-+ *	%NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
-  *
-  * @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal
-  * @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number
-@@ -6867,6 +6930,7 @@ enum nl80211_peer_measurement_ftm_req {
- 	NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC,
- 	NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED,
- 	NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED,
-+	NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK,
- 
- 	/* keep last */
- 	NUM_NL80211_PMSR_FTM_REQ_ATTR,
-@@ -7124,4 +7188,115 @@ enum nl80211_unsol_bcast_probe_resp_attr
- 	NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX =
- 		__NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_LAST - 1
- };
-+
-+/**
-+ * enum nl80211_sae_pwe_mechanism - The mechanism(s) allowed for SAE PWE
-+ *	derivation. Applicable only when WPA3-Personal SAE authentication is
-+ *	used.
-+ *
-+ * @NL80211_SAE_PWE_UNSPECIFIED: not specified, used internally to indicate that
-+ *	attribute is not present from userspace.
-+ * @NL80211_SAE_PWE_HUNT_AND_PECK: hunting-and-pecking loop only
-+ * @NL80211_SAE_PWE_HASH_TO_ELEMENT: hash-to-element only
-+ * @NL80211_SAE_PWE_BOTH: both hunting-and-pecking loop and hash-to-element
-+ *	can be used.
-+ */
-+enum nl80211_sae_pwe_mechanism {
-+	NL80211_SAE_PWE_UNSPECIFIED,
-+	NL80211_SAE_PWE_HUNT_AND_PECK,
-+	NL80211_SAE_PWE_HASH_TO_ELEMENT,
-+	NL80211_SAE_PWE_BOTH,
-+};
-+
-+/**
-+ * enum nl80211_sar_type - type of SAR specs
-+ *
-+ * @NL80211_SAR_TYPE_POWER: power limitation specified in 0.25dBm unit
-+ *
-+ */
-+enum nl80211_sar_type {
-+	NL80211_SAR_TYPE_POWER,
-+
-+	/* add new type here */
-+
-+	/* Keep last */
-+	NUM_NL80211_SAR_TYPE,
-+};
-+
-+/**
-+ * enum nl80211_sar_attrs - Attributes for SAR spec
-+ *
-+ * @NL80211_SAR_ATTR_TYPE: the SAR type as defined in &enum nl80211_sar_type.
-+ *
-+ * @NL80211_SAR_ATTR_SPECS: Nested array of SAR power
-+ *	limit specifications. Each specification contains a set
-+ *	of %nl80211_sar_specs_attrs.
-+ *
-+ *	For SET operation, it contains array of %NL80211_SAR_ATTR_SPECS_POWER
-+ *	and %NL80211_SAR_ATTR_SPECS_RANGE_INDEX.
-+ *
-+ *	For sar_capa dump, it contains array of
-+ *	%NL80211_SAR_ATTR_SPECS_START_FREQ
-+ *	and %NL80211_SAR_ATTR_SPECS_END_FREQ.
-+ *
-+ * @__NL80211_SAR_ATTR_LAST: Internal
-+ * @NL80211_SAR_ATTR_MAX: highest sar attribute
-+ *
-+ * These attributes are used with %NL80211_CMD_SET_SAR_SPEC
-+ */
-+enum nl80211_sar_attrs {
-+	__NL80211_SAR_ATTR_INVALID,
-+
-+	NL80211_SAR_ATTR_TYPE,
-+	NL80211_SAR_ATTR_SPECS,
-+
-+	__NL80211_SAR_ATTR_LAST,
-+	NL80211_SAR_ATTR_MAX = __NL80211_SAR_ATTR_LAST - 1,
-+};
-+
-+/**
-+ * enum nl80211_sar_specs_attrs - Attributes for SAR power limit specs
-+ *
-+ * @NL80211_SAR_ATTR_SPECS_POWER: Required (s32)value to specify the actual
-+ *	power limit value in units of 0.25 dBm if type is
-+ *	NL80211_SAR_TYPE_POWER. (i.e., a value of 44 represents 11 dBm).
-+ *	0 means userspace doesn't have SAR limitation on this associated range.
-+ *
-+ * @NL80211_SAR_ATTR_SPECS_RANGE_INDEX: Required (u32) value to specify the
-+ *	index of exported freq range table and the associated power limitation
-+ *	is applied to this range.
-+ *
-+ *	Userspace isn't required to set all the ranges advertised by WLAN driver,
-+ *	and userspace can skip some certain ranges. These skipped ranges don't
-+ *	have SAR limitations, and they are same as setting the
-+ *	%NL80211_SAR_ATTR_SPECS_POWER to any unreasonable high value because any
-+ *	value higher than regulatory allowed value just means SAR power
-+ *	limitation is removed, but it's required to set at least one range.
-+ *	It's not allowed to set duplicated range in one SET operation.
-+ *
-+ *	Every SET operation overwrites previous SET operation.
-+ *
-+ * @NL80211_SAR_ATTR_SPECS_START_FREQ: Required (u32) value to specify the start
-+ *	frequency of this range edge when registering SAR capability to wiphy.
-+ *	It's not a channel center frequency. The unit is kHz.
-+ *
-+ * @NL80211_SAR_ATTR_SPECS_END_FREQ: Required (u32) value to specify the end
-+ *	frequency of this range edge when registering SAR capability to wiphy.
-+ *	It's not a channel center frequency. The unit is kHz.
-+ *
-+ * @__NL80211_SAR_ATTR_SPECS_LAST: Internal
-+ * @NL80211_SAR_ATTR_SPECS_MAX: highest sar specs attribute
-+ */
-+enum nl80211_sar_specs_attrs {
-+	__NL80211_SAR_ATTR_SPECS_INVALID,
-+
-+	NL80211_SAR_ATTR_SPECS_POWER,
-+	NL80211_SAR_ATTR_SPECS_RANGE_INDEX,
-+	NL80211_SAR_ATTR_SPECS_START_FREQ,
-+	NL80211_SAR_ATTR_SPECS_END_FREQ,
-+
-+	__NL80211_SAR_ATTR_SPECS_LAST,
-+	NL80211_SAR_ATTR_SPECS_MAX = __NL80211_SAR_ATTR_SPECS_LAST - 1,
-+};
-+
- #endif /* __LINUX_NL80211_H */
diff --git a/package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch b/package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch
deleted file mode 100644
index a03b06091..000000000
--- a/package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch
+++ /dev/null
@@ -1,699 +0,0 @@
---- a/net/mac80211/Makefile
-+++ b/net/mac80211/Makefile
-@@ -7,7 +7,6 @@ mac80211-y := \
- 	driver-ops.o \
- 	sta_info.o \
- 	wep.o \
--	aead_api.o \
- 	wpa.o \
- 	scan.o offchannel.o \
- 	ht.o agg-tx.o agg-rx.o \
-@@ -19,8 +18,8 @@ mac80211-y := \
- 	rate.o \
- 	michael.o \
- 	tkip.o \
-+	aes_ccm.o \
- 	aes_cmac.o \
--	aes_gmac.o \
- 	fils_aead.o \
- 	cfg.o \
- 	ethtool.o \
---- a/net/mac80211/aead_api.c
-+++ /dev/null
-@@ -1,113 +0,0 @@
--// SPDX-License-Identifier: GPL-2.0-only
--/*
-- * Copyright 2003-2004, Instant802 Networks, Inc.
-- * Copyright 2005-2006, Devicescape Software, Inc.
-- * Copyright 2014-2015, Qualcomm Atheros, Inc.
-- *
-- * Rewrite: Copyright (C) 2013 Linaro Ltd <ard.biesheuvel@linaro.org>
-- */
--
--#include <linux/kernel.h>
--#include <linux/types.h>
--#include <linux/err.h>
--#include <linux/scatterlist.h>
--#include <crypto/aead.h>
--
--#include "aead_api.h"
--
--int aead_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad, size_t aad_len,
--		 u8 *data, size_t data_len, u8 *mic)
--{
--	size_t mic_len = crypto_aead_authsize(tfm);
--	struct scatterlist sg[3];
--	struct aead_request *aead_req;
--	int reqsize = sizeof(*aead_req) + crypto_aead_reqsize(tfm);
--	u8 *__aad;
--	int ret;
--
--	aead_req = kzalloc(reqsize + aad_len, GFP_ATOMIC);
--	if (!aead_req)
--		return -ENOMEM;
--
--	__aad = (u8 *)aead_req + reqsize;
--	memcpy(__aad, aad, aad_len);
--
--	sg_init_table(sg, 3);
--	sg_set_buf(&sg[0], __aad, aad_len);
--	sg_set_buf(&sg[1], data, data_len);
--	sg_set_buf(&sg[2], mic, mic_len);
--
--	aead_request_set_tfm(aead_req, tfm);
--	aead_request_set_crypt(aead_req, sg, sg, data_len, b_0);
--	aead_request_set_ad(aead_req, sg[0].length);
--
--	ret = crypto_aead_encrypt(aead_req);
--	kfree_sensitive(aead_req);
--
--	return ret;
--}
--
--int aead_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad, size_t aad_len,
--		 u8 *data, size_t data_len, u8 *mic)
--{
--	size_t mic_len = crypto_aead_authsize(tfm);
--	struct scatterlist sg[3];
--	struct aead_request *aead_req;
--	int reqsize = sizeof(*aead_req) + crypto_aead_reqsize(tfm);
--	u8 *__aad;
--	int err;
--
--	if (data_len == 0)
--		return -EINVAL;
--
--	aead_req = kzalloc(reqsize + aad_len, GFP_ATOMIC);
--	if (!aead_req)
--		return -ENOMEM;
--
--	__aad = (u8 *)aead_req + reqsize;
--	memcpy(__aad, aad, aad_len);
--
--	sg_init_table(sg, 3);
--	sg_set_buf(&sg[0], __aad, aad_len);
--	sg_set_buf(&sg[1], data, data_len);
--	sg_set_buf(&sg[2], mic, mic_len);
--
--	aead_request_set_tfm(aead_req, tfm);
--	aead_request_set_crypt(aead_req, sg, sg, data_len + mic_len, b_0);
--	aead_request_set_ad(aead_req, sg[0].length);
--
--	err = crypto_aead_decrypt(aead_req);
--	kfree_sensitive(aead_req);
--
--	return err;
--}
--
--struct crypto_aead *
--aead_key_setup_encrypt(const char *alg, const u8 key[],
--		       size_t key_len, size_t mic_len)
--{
--	struct crypto_aead *tfm;
--	int err;
--
--	tfm = crypto_alloc_aead(alg, 0, CRYPTO_ALG_ASYNC);
--	if (IS_ERR(tfm))
--		return tfm;
--
--	err = crypto_aead_setkey(tfm, key, key_len);
--	if (err)
--		goto free_aead;
--	err = crypto_aead_setauthsize(tfm, mic_len);
--	if (err)
--		goto free_aead;
--
--	return tfm;
--
--free_aead:
--	crypto_free_aead(tfm);
--	return ERR_PTR(err);
--}
--
--void aead_key_free(struct crypto_aead *tfm)
--{
--	crypto_free_aead(tfm);
--}
---- a/net/mac80211/aead_api.h
-+++ /dev/null
-@@ -1,23 +0,0 @@
--/* SPDX-License-Identifier: GPL-2.0-only */
--
--#ifndef _AEAD_API_H
--#define _AEAD_API_H
--
--#include <crypto/aead.h>
--#include <linux/crypto.h>
--
--struct crypto_aead *
--aead_key_setup_encrypt(const char *alg, const u8 key[],
--		       size_t key_len, size_t mic_len);
--
--int aead_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
--		 size_t aad_len, u8 *data,
--		 size_t data_len, u8 *mic);
--
--int aead_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
--		 size_t aad_len, u8 *data,
--		 size_t data_len, u8 *mic);
--
--void aead_key_free(struct crypto_aead *tfm);
--
--#endif /* _AEAD_API_H */
---- a/net/mac80211/aes_ccm.h
-+++ b/net/mac80211/aes_ccm.h
-@@ -7,39 +7,17 @@
- #ifndef AES_CCM_H
- #define AES_CCM_H
- 
--#include "aead_api.h"
-+#include <linux/crypto.h>
- 
--#define CCM_AAD_LEN	32
--
--static inline struct crypto_aead *
--ieee80211_aes_key_setup_encrypt(const u8 key[], size_t key_len, size_t mic_len)
--{
--	return aead_key_setup_encrypt("ccm(aes)", key, key_len, mic_len);
--}
--
--static inline int
--ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm,
--			  u8 *b_0, u8 *aad, u8 *data,
--			  size_t data_len, u8 *mic)
--{
--	return aead_encrypt(tfm, b_0, aad + 2,
--			    be16_to_cpup((__be16 *)aad),
--			    data, data_len, mic);
--}
--
--static inline int
--ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm,
--			  u8 *b_0, u8 *aad, u8 *data,
--			  size_t data_len, u8 *mic)
--{
--	return aead_decrypt(tfm, b_0, aad + 2,
--			    be16_to_cpup((__be16 *)aad),
--			    data, data_len, mic);
--}
--
--static inline void ieee80211_aes_key_free(struct crypto_aead *tfm)
--{
--	return aead_key_free(tfm);
--}
-+struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[],
-+						      size_t key_len,
-+						      size_t mic_len);
-+void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
-+			       u8 *data, size_t data_len, u8 *mic,
-+			       size_t mic_len);
-+int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
-+			      u8 *data, size_t data_len, u8 *mic,
-+			      size_t mic_len);
-+void ieee80211_aes_key_free(struct crypto_cipher *tfm);
- 
- #endif /* AES_CCM_H */
---- /dev/null
-+++ b/net/mac80211/aes_gcm.c
-@@ -0,0 +1,109 @@
-+/*
-+ * Copyright 2014-2015, Qualcomm Atheros, Inc.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation.
-+ */
-+
-+#include <linux/kernel.h>
-+#include <linux/types.h>
-+#include <linux/err.h>
-+#include <crypto/aead.h>
-+
-+#include <net/mac80211.h>
-+#include "key.h"
-+#include "aes_gcm.h"
-+
-+int ieee80211_aes_gcm_encrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
-+			      u8 *data, size_t data_len, u8 *mic)
-+{
-+	struct scatterlist sg[3];
-+	struct aead_request *aead_req;
-+	int reqsize = sizeof(*aead_req) + crypto_aead_reqsize(tfm);
-+	u8 *__aad;
-+
-+	aead_req = kzalloc(reqsize + GCM_AAD_LEN, GFP_ATOMIC);
-+	if (!aead_req)
-+		return -ENOMEM;
-+
-+	__aad = (u8 *)aead_req + reqsize;
-+	memcpy(__aad, aad, GCM_AAD_LEN);
-+
-+	sg_init_table(sg, 3);
-+	sg_set_buf(&sg[0], &__aad[2], be16_to_cpup((__be16 *)__aad));
-+	sg_set_buf(&sg[1], data, data_len);
-+	sg_set_buf(&sg[2], mic, IEEE80211_GCMP_MIC_LEN);
-+
-+	aead_request_set_tfm(aead_req, tfm);
-+	aead_request_set_crypt(aead_req, sg, sg, data_len, j_0);
-+	aead_request_set_ad(aead_req, sg[0].length);
-+
-+	crypto_aead_encrypt(aead_req);
-+	kzfree(aead_req);
-+	return 0;
-+}
-+
-+int ieee80211_aes_gcm_decrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
-+			      u8 *data, size_t data_len, u8 *mic)
-+{
-+	struct scatterlist sg[3];
-+	struct aead_request *aead_req;
-+	int reqsize = sizeof(*aead_req) + crypto_aead_reqsize(tfm);
-+	u8 *__aad;
-+	int err;
-+
-+	if (data_len == 0)
-+		return -EINVAL;
-+
-+	aead_req = kzalloc(reqsize + GCM_AAD_LEN, GFP_ATOMIC);
-+	if (!aead_req)
-+		return -ENOMEM;
-+
-+	__aad = (u8 *)aead_req + reqsize;
-+	memcpy(__aad, aad, GCM_AAD_LEN);
-+
-+	sg_init_table(sg, 3);
-+	sg_set_buf(&sg[0], &__aad[2], be16_to_cpup((__be16 *)__aad));
-+	sg_set_buf(&sg[1], data, data_len);
-+	sg_set_buf(&sg[2], mic, IEEE80211_GCMP_MIC_LEN);
-+
-+	aead_request_set_tfm(aead_req, tfm);
-+	aead_request_set_crypt(aead_req, sg, sg,
-+			       data_len + IEEE80211_GCMP_MIC_LEN, j_0);
-+	aead_request_set_ad(aead_req, sg[0].length);
-+
-+	err = crypto_aead_decrypt(aead_req);
-+	kzfree(aead_req);
-+
-+	return err;
-+}
-+
-+struct crypto_aead *ieee80211_aes_gcm_key_setup_encrypt(const u8 key[],
-+							size_t key_len)
-+{
-+	struct crypto_aead *tfm;
-+	int err;
-+
-+	tfm = crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC);
-+	if (IS_ERR(tfm))
-+		return tfm;
-+
-+	err = crypto_aead_setkey(tfm, key, key_len);
-+	if (err)
-+		goto free_aead;
-+	err = crypto_aead_setauthsize(tfm, IEEE80211_GCMP_MIC_LEN);
-+	if (err)
-+		goto free_aead;
-+
-+	return tfm;
-+
-+free_aead:
-+	crypto_free_aead(tfm);
-+	return ERR_PTR(err);
-+}
-+
-+void ieee80211_aes_gcm_key_free(struct crypto_aead *tfm)
-+{
-+	crypto_free_aead(tfm);
-+}
---- a/net/mac80211/aes_gcm.h
-+++ b/net/mac80211/aes_gcm.h
-@@ -6,38 +6,30 @@
- #ifndef AES_GCM_H
- #define AES_GCM_H
- 
--#include "aead_api.h"
-+#include <linux/crypto.h>
- 
--#define GCM_AAD_LEN	32
--
--static inline int ieee80211_aes_gcm_encrypt(struct crypto_aead *tfm,
--					    u8 *j_0, u8 *aad,  u8 *data,
--					    size_t data_len, u8 *mic)
-+static inline void
-+ieee80211_aes_gcm_encrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
-+			  u8 *data, size_t data_len, u8 *mic)
- {
--	return aead_encrypt(tfm, j_0, aad + 2,
--			    be16_to_cpup((__be16 *)aad),
--			    data, data_len, mic);
- }
- 
--static inline int ieee80211_aes_gcm_decrypt(struct crypto_aead *tfm,
--					    u8 *j_0, u8 *aad, u8 *data,
--					    size_t data_len, u8 *mic)
-+static inline int
-+ieee80211_aes_gcm_decrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
-+			  u8 *data, size_t data_len, u8 *mic)
- {
--	return aead_decrypt(tfm, j_0, aad + 2,
--			    be16_to_cpup((__be16 *)aad),
--			    data, data_len, mic);
-+    return -EOPNOTSUPP;
- }
- 
- static inline struct crypto_aead *
- ieee80211_aes_gcm_key_setup_encrypt(const u8 key[], size_t key_len)
- {
--	return aead_key_setup_encrypt("gcm(aes)", key,
--				      key_len, IEEE80211_GCMP_MIC_LEN);
-+    return NULL;
- }
- 
--static inline void ieee80211_aes_gcm_key_free(struct crypto_aead *tfm)
-+static inline void
-+ieee80211_aes_gcm_key_free(struct crypto_aead *tfm)
- {
--	return aead_key_free(tfm);
- }
- 
- #endif /* AES_GCM_H */
---- a/net/mac80211/wpa.c
-+++ b/net/mac80211/wpa.c
-@@ -312,7 +312,8 @@ ieee80211_crypto_tkip_decrypt(struct iee
- }
- 
- 
--static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad)
-+static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad,
-+				u16 data_len)
- {
- 	__le16 mask_fc;
- 	int a4_included, mgmt;
-@@ -342,14 +343,8 @@ static void ccmp_special_blocks(struct s
- 	else
- 		qos_tid = 0;
- 
--	/* In CCM, the initial vectors (IV) used for CTR mode encryption and CBC
--	 * mode authentication are not allowed to collide, yet both are derived
--	 * from this vector b_0. We only set L := 1 here to indicate that the
--	 * data size can be represented in (L+1) bytes. The CCM layer will take
--	 * care of storing the data length in the top (L+1) bytes and setting
--	 * and clearing the other bits as is required to derive the two IVs.
--	 */
--	b_0[0] = 0x1;
-+	/* First block, b_0 */
-+	b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
- 
- 	/* Nonce: Nonce Flags | A2 | PN
- 	 * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
-@@ -357,6 +352,8 @@ static void ccmp_special_blocks(struct s
- 	b_0[1] = qos_tid | (mgmt << 4);
- 	memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
- 	memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
-+	/* l(m) */
-+	put_unaligned_be16(data_len, &b_0[14]);
- 
- 	/* AAD (extra authenticate-only data) / masked 802.11 header
- 	 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
-@@ -413,7 +410,7 @@ static int ccmp_encrypt_skb(struct ieee8
- 	u8 *pos;
- 	u8 pn[6];
- 	u64 pn64;
--	u8 aad[CCM_AAD_LEN];
-+	u8 aad[2 * AES_BLOCK_SIZE];
- 	u8 b_0[AES_BLOCK_SIZE];
- 
- 	if (info->control.hw_key &&
-@@ -468,9 +465,11 @@ static int ccmp_encrypt_skb(struct ieee8
- 		return 0;
- 
- 	pos += IEEE80211_CCMP_HDR_LEN;
--	ccmp_special_blocks(skb, pn, b_0, aad);
--	return ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
--					 skb_put(skb, mic_len));
-+	ccmp_special_blocks(skb, pn, b_0, aad, len);
-+	ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
-+				  skb_put(skb, mic_len), mic_len);
-+
-+	return 0;
- }
- 
- 
-@@ -546,13 +545,13 @@ ieee80211_crypto_ccmp_decrypt(struct iee
- 			u8 aad[2 * AES_BLOCK_SIZE];
- 			u8 b_0[AES_BLOCK_SIZE];
- 			/* hardware didn't decrypt/verify MIC */
--			ccmp_special_blocks(skb, pn, b_0, aad);
-+			ccmp_special_blocks(skb, pn, b_0, aad, data_len);
- 
- 			if (ieee80211_aes_ccm_decrypt(
- 				    key->u.ccmp.tfm, b_0, aad,
- 				    skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN,
- 				    data_len,
--				    skb->data + skb->len - mic_len))
-+				    skb->data + skb->len - mic_len, mic_len))
- 				return RX_DROP_UNUSABLE;
- 		}
- 
-@@ -649,7 +648,7 @@ static int gcmp_encrypt_skb(struct ieee8
- 	u8 *pos;
- 	u8 pn[6];
- 	u64 pn64;
--	u8 aad[GCM_AAD_LEN];
-+	u8 aad[2 * AES_BLOCK_SIZE];
- 	u8 j_0[AES_BLOCK_SIZE];
- 
- 	if (info->control.hw_key &&
-@@ -706,8 +705,10 @@ static int gcmp_encrypt_skb(struct ieee8
- 
- 	pos += IEEE80211_GCMP_HDR_LEN;
- 	gcmp_special_blocks(skb, pn, j_0, aad);
--	return ieee80211_aes_gcm_encrypt(key->u.gcmp.tfm, j_0, aad, pos, len,
--					 skb_put(skb, IEEE80211_GCMP_MIC_LEN));
-+	ieee80211_aes_gcm_encrypt(key->u.gcmp.tfm, j_0, aad, pos, len,
-+				  skb_put(skb, IEEE80211_GCMP_MIC_LEN));
-+
-+	return 0;
- }
- 
- ieee80211_tx_result
-@@ -1139,9 +1140,9 @@ ieee80211_crypto_aes_gmac_encrypt(struct
- 	struct ieee80211_key *key = tx->key;
- 	struct ieee80211_mmie_16 *mmie;
- 	struct ieee80211_hdr *hdr;
--	u8 aad[GMAC_AAD_LEN];
-+	u8 aad[20];
- 	u64 pn64;
--	u8 nonce[GMAC_NONCE_LEN];
-+	u8 nonce[12];
- 
- 	if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
- 		return TX_DROP;
-@@ -1187,7 +1188,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct
- 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
- 	struct ieee80211_key *key = rx->key;
- 	struct ieee80211_mmie_16 *mmie;
--	u8 aad[GMAC_AAD_LEN], *mic, ipn[6], nonce[GMAC_NONCE_LEN];
-+	u8 aad[20], *mic, ipn[6], nonce[12];
- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
- 
- 	if (!ieee80211_is_mgmt(hdr->frame_control))
---- /dev/null
-+++ b/net/mac80211/aes_ccm.c
-@@ -0,0 +1,144 @@
-+/*
-+ * Copyright 2003-2004, Instant802 Networks, Inc.
-+ * Copyright 2005-2006, Devicescape Software, Inc.
-+ *
-+ * Rewrite: Copyright (C) 2013 Linaro Ltd <ard.biesheuvel@linaro.org>
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation.
-+ */
-+
-+#include <linux/kernel.h>
-+#include <linux/types.h>
-+#include <linux/err.h>
-+#include <crypto/aead.h>
-+#include <crypto/aes.h>
-+
-+#include <net/mac80211.h>
-+#include "key.h"
-+#include "aes_ccm.h"
-+
-+static void aes_ccm_prepare(struct crypto_cipher *tfm, u8 *b_0, u8 *aad, u8 *s_0,
-+			    u8 *a, u8 *b)
-+{
-+	int i;
-+
-+	crypto_cipher_encrypt_one(tfm, b, b_0);
-+
-+	/* Extra Authenticate-only data (always two AES blocks) */
-+	for (i = 0; i < AES_BLOCK_SIZE; i++)
-+		aad[i] ^= b[i];
-+	crypto_cipher_encrypt_one(tfm, b, aad);
-+
-+	aad += AES_BLOCK_SIZE;
-+
-+	for (i = 0; i < AES_BLOCK_SIZE; i++)
-+		aad[i] ^= b[i];
-+	crypto_cipher_encrypt_one(tfm, a, aad);
-+
-+	/* Mask out bits from auth-only-b_0 */
-+	b_0[0] &= 0x07;
-+
-+	/* S_0 is used to encrypt T (= MIC) */
-+	b_0[14] = 0;
-+	b_0[15] = 0;
-+	crypto_cipher_encrypt_one(tfm, s_0, b_0);
-+}
-+
-+
-+void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
-+			       u8 *data, size_t data_len, u8 *mic,
-+			       size_t mic_len)
-+{
-+	int i, j, last_len, num_blocks;
-+	u8 b[AES_BLOCK_SIZE];
-+	u8 s_0[AES_BLOCK_SIZE];
-+	u8 e[AES_BLOCK_SIZE];
-+	u8 *pos, *cpos;
-+
-+	num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
-+	last_len = data_len % AES_BLOCK_SIZE;
-+	aes_ccm_prepare(tfm, b_0, aad, s_0, b, b);
-+
-+	/* Process payload blocks */
-+	pos = data;
-+	cpos = data;
-+	for (j = 1; j <= num_blocks; j++) {
-+		int blen = (j == num_blocks && last_len) ?
-+			last_len : AES_BLOCK_SIZE;
-+
-+		/* Authentication followed by encryption */
-+		for (i = 0; i < blen; i++)
-+			b[i] ^= pos[i];
-+		crypto_cipher_encrypt_one(tfm, b, b);
-+
-+		b_0[14] = (j >> 8) & 0xff;
-+		b_0[15] = j & 0xff;
-+		crypto_cipher_encrypt_one(tfm, e, b_0);
-+		for (i = 0; i < blen; i++)
-+			*cpos++ = *pos++ ^ e[i];
-+	}
-+
-+	for (i = 0; i < mic_len; i++)
-+		mic[i] = b[i] ^ s_0[i];
-+}
-+
-+int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
-+			      u8 *data, size_t data_len, u8 *mic,
-+			      size_t mic_len)
-+{
-+	int i, j, last_len, num_blocks;
-+	u8 *pos, *cpos;
-+	u8 a[AES_BLOCK_SIZE];
-+	u8 b[AES_BLOCK_SIZE];
-+	u8 s_0[AES_BLOCK_SIZE];
-+
-+	num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
-+	last_len = data_len % AES_BLOCK_SIZE;
-+	aes_ccm_prepare(tfm, b_0, aad, s_0, a, b);
-+
-+	/* Process payload blocks */
-+	cpos = data;
-+	pos = data;
-+	for (j = 1; j <= num_blocks; j++) {
-+		int blen = (j == num_blocks && last_len) ?
-+			last_len : AES_BLOCK_SIZE;
-+
-+		/* Decryption followed by authentication */
-+		b_0[14] = (j >> 8) & 0xff;
-+		b_0[15] = j & 0xff;
-+		crypto_cipher_encrypt_one(tfm, b, b_0);
-+		for (i = 0; i < blen; i++) {
-+			*pos = *cpos++ ^ b[i];
-+			a[i] ^= *pos++;
-+		}
-+		crypto_cipher_encrypt_one(tfm, a, a);
-+	}
-+
-+	for (i = 0; i < mic_len; i++) {
-+		if ((mic[i] ^ s_0[i]) != a[i])
-+			return -1;
-+	}
-+
-+	return 0;
-+}
-+
-+struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[],
-+						      size_t key_len,
-+						      size_t mic_len)
-+{
-+	struct crypto_cipher *tfm;
-+
-+	tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
-+	if (!IS_ERR(tfm))
-+		crypto_cipher_setkey(tfm, key, key_len);
-+
-+	return tfm;
-+}
-+
-+
-+void ieee80211_aes_key_free(struct crypto_cipher *tfm)
-+{
-+	crypto_free_cipher(tfm);
-+}
---- a/net/mac80211/Kconfig
-+++ b/net/mac80211/Kconfig
-@@ -6,8 +6,6 @@ config MAC80211
- 	depends on CRYPTO
- 	select BPAUTO_CRYPTO_LIB_ARC4
- 	depends on CRYPTO_AES
--	depends on CRYPTO_CCM
--	depends on CRYPTO_GCM
- 	depends on CRYPTO_CMAC
- 	depends on CRC32
- 	help
---- a/net/mac80211/aes_gmac.h
-+++ b/net/mac80211/aes_gmac.h
-@@ -12,10 +12,22 @@
- #define GMAC_MIC_LEN	16
- #define GMAC_NONCE_LEN	12
- 
--struct crypto_aead *ieee80211_aes_gmac_key_setup(const u8 key[],
--						 size_t key_len);
--int ieee80211_aes_gmac(struct crypto_aead *tfm, const u8 *aad, u8 *nonce,
--		       const u8 *data, size_t data_len, u8 *mic);
--void ieee80211_aes_gmac_key_free(struct crypto_aead *tfm);
-+static inline struct crypto_aead *
-+ieee80211_aes_gmac_key_setup(const u8 key[], size_t key_len)
-+{
-+	return NULL;
-+}
-+
-+static inline int
-+ieee80211_aes_gmac(struct crypto_aead *tfm, const u8 *aad, u8 *nonce,
-+		   const u8 *data, size_t data_len, u8 *mic)
-+{
-+	return -EOPNOTSUPP;
-+}
-+
-+static inline void
-+ieee80211_aes_gmac_key_free(struct crypto_aead *tfm)
-+{
-+}
- 
- #endif /* AES_GMAC_H */
---- a/net/mac80211/key.h
-+++ b/net/mac80211/key.h
-@@ -89,7 +89,7 @@ struct ieee80211_key {
- 			 * Management frames.
- 			 */
- 			u8 rx_pn[IEEE80211_NUM_TIDS + 1][IEEE80211_CCMP_PN_LEN];
--			struct crypto_aead *tfm;
-+			struct crypto_cipher *tfm;
- 			u32 replays; /* dot11RSNAStatsCCMPReplays */
- 		} ccmp;
- 		struct {
diff --git a/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
index c6fafb77b..4d4a2a8f5 100644
--- a/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
+++ b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
@@ -1,12 +1,19 @@
-Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnects
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 27 Oct 2014 00:00:00 +0100
+Subject: [PATCH] mac80211: preseve AP mode keys across STA reconnect
+
+Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnect
+---
+ net/mac80211/cfg.c | 1 -
+ 1 file changed, 1 deletion(-)
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1307,7 +1307,6 @@ static int ieee80211_stop_ap(struct wiph
- 	sdata->vif.bss_conf.ftmr_params = NULL;
+@@ -1519,7 +1519,6 @@ static int ieee80211_stop_ap(struct wiph
+ 	link_conf->bssid_indicator = 0;
  
  	__sta_info_flush(sdata, true);
 -	ieee80211_free_keys(sdata, true);
  
- 	sdata->vif.bss_conf.enable_beacon = false;
+ 	link_conf->enable_beacon = false;
  	sdata->beacon_rate_set = false;
diff --git a/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch b/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
index 172e5b04f..f315ae5ca 100644
--- a/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
+++ b/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
@@ -1,6 +1,15 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 11 Dec 2014 00:00:00 +0100
+Subject: [PATCH] cfg80211: add support for changing the device mac address via
+ sysfs
+
+---
+ net/wireless/sysfs.c | 27 ++++++++++++++++++++++-----
+ 1 file changed, 22 insertions(+), 5 deletions(-)
+
 --- a/net/wireless/sysfs.c
 +++ b/net/wireless/sysfs.c
-@@ -23,18 +23,35 @@ static inline struct cfg80211_registered
+@@ -24,18 +24,35 @@ static inline struct cfg80211_registered
  	return container_of(dev, struct cfg80211_registered_device, wiphy.dev);
  }
  
diff --git a/package/kernel/mac80211/patches/subsys/130-disable-fils.patch b/package/kernel/mac80211/patches/subsys/130-disable-fils.patch
deleted file mode 100644
index 9c6e971f9..000000000
--- a/package/kernel/mac80211/patches/subsys/130-disable-fils.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-Disable FILS support, since it pulls in crypto hash support
-
---- a/net/mac80211/fils_aead.h
-+++ b/net/mac80211/fils_aead.h
-@@ -7,7 +7,7 @@
- #ifndef FILS_AEAD_H
- #define FILS_AEAD_H
- 
--#if LINUX_VERSION_IS_GEQ(4,3,0)
-+#if 0 /* LINUX_VERSION_IS_GEQ(4,3,0) */
- int fils_encrypt_assoc_req(struct sk_buff *skb,
- 			   struct ieee80211_mgd_assoc_data *assoc_data);
- int fils_decrypt_assoc_resp(struct ieee80211_sub_if_data *sdata,
---- a/net/mac80211/fils_aead.c
-+++ b/net/mac80211/fils_aead.c
-@@ -1,4 +1,4 @@
--#if LINUX_VERSION_IS_GEQ(4,3,0)
-+#if 0 /* LINUX_VERSION_IS_GEQ(4,3,0) */
- // SPDX-License-Identifier: GPL-2.0-only
- /*
-  * FILS AEAD for (Re)Association Request/Response frames
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -591,7 +591,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
- 			   NL80211_FEATURE_MAC_ON_CREATE |
- 			   NL80211_FEATURE_USERSPACE_MPM |
- 			   NL80211_FEATURE_FULL_AP_CLIENT_STATE;
--#if LINUX_VERSION_IS_GEQ(4,3,0)
-+#if 0 /* LINUX_VERSION_IS_GEQ(4,3,0) */
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_STA);
- #endif
- 	wiphy_ext_feature_set(wiphy,
diff --git a/package/kernel/mac80211/patches/subsys/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch b/package/kernel/mac80211/patches/subsys/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
deleted file mode 100644
index c3bf7ccc7..000000000
--- a/package/kernel/mac80211/patches/subsys/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
+++ /dev/null
@@ -1,230 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 7 Oct 2017 09:37:28 +0200
-Subject: [PATCH] Revert "mac80211: aes-cmac: switch to shash CMAC
- driver"
-
-This reverts commit 26717828b75dd5c46e97f7f4a9b937d038bb2852.
-Reduces mac80211 dependencies for LEDE
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/aes_cmac.c
-+++ b/net/mac80211/aes_cmac.c
-@@ -19,67 +19,151 @@
- #define CMAC_TLEN_256 16 /* CMAC TLen = 128 bits (16 octets) */
- #define AAD_LEN 20
- 
--static const u8 zero[CMAC_TLEN_256];
- 
--void ieee80211_aes_cmac(struct crypto_shash *tfm, const u8 *aad,
-+void gf_mulx(u8 *pad)
-+{
-+	int i, carry;
-+
-+	carry = pad[0] & 0x80;
-+	for (i = 0; i < AES_BLOCK_SIZE - 1; i++)
-+		pad[i] = (pad[i] << 1) | (pad[i + 1] >> 7);
-+	pad[AES_BLOCK_SIZE - 1] <<= 1;
-+	if (carry)
-+		pad[AES_BLOCK_SIZE - 1] ^= 0x87;
-+}
-+
-+void aes_cmac_vector(struct crypto_cipher *tfm, size_t num_elem,
-+		     const u8 *addr[], const size_t *len, u8 *mac,
-+		     size_t mac_len)
-+{
-+	u8 cbc[AES_BLOCK_SIZE], pad[AES_BLOCK_SIZE];
-+	const u8 *pos, *end;
-+	size_t i, e, left, total_len;
-+
-+	memset(cbc, 0, AES_BLOCK_SIZE);
-+
-+	total_len = 0;
-+	for (e = 0; e < num_elem; e++)
-+		total_len += len[e];
-+	left = total_len;
-+
-+	e = 0;
-+	pos = addr[0];
-+	end = pos + len[0];
-+
-+	while (left >= AES_BLOCK_SIZE) {
-+		for (i = 0; i < AES_BLOCK_SIZE; i++) {
-+			cbc[i] ^= *pos++;
-+			if (pos >= end) {
-+				e++;
-+				pos = addr[e];
-+				end = pos + len[e];
-+			}
-+		}
-+		if (left > AES_BLOCK_SIZE)
-+			crypto_cipher_encrypt_one(tfm, cbc, cbc);
-+		left -= AES_BLOCK_SIZE;
-+	}
-+
-+	memset(pad, 0, AES_BLOCK_SIZE);
-+	crypto_cipher_encrypt_one(tfm, pad, pad);
-+	gf_mulx(pad);
-+
-+	if (left || total_len == 0) {
-+		for (i = 0; i < left; i++) {
-+			cbc[i] ^= *pos++;
-+			if (pos >= end) {
-+				e++;
-+				pos = addr[e];
-+				end = pos + len[e];
-+			}
-+		}
-+		cbc[left] ^= 0x80;
-+		gf_mulx(pad);
-+	}
-+
-+	for (i = 0; i < AES_BLOCK_SIZE; i++)
-+		pad[i] ^= cbc[i];
-+	crypto_cipher_encrypt_one(tfm, pad, pad);
-+	memcpy(mac, pad, mac_len);
-+}
-+
-+
-+void ieee80211_aes_cmac(struct crypto_cipher *tfm, const u8 *aad,
- 			const u8 *data, size_t data_len, u8 *mic)
- {
--	SHASH_DESC_ON_STACK(desc, tfm);
--	u8 out[AES_BLOCK_SIZE];
-+	const u8 *addr[4];
-+	size_t len[4];
-+	u8 zero[CMAC_TLEN];
- 	const __le16 *fc;
- 
--	desc->tfm = tfm;
--
--	crypto_shash_init(desc);
--	crypto_shash_update(desc, aad, AAD_LEN);
-+	memset(zero, 0, CMAC_TLEN);
-+	addr[0] = aad;
-+	len[0] = AAD_LEN;
- 	fc = (const __le16 *)aad;
- 	if (ieee80211_is_beacon(*fc)) {
- 		/* mask Timestamp field to zero */
--		crypto_shash_update(desc, zero, 8);
--		crypto_shash_update(desc, data + 8, data_len - 8 - CMAC_TLEN);
-+		addr[1] = zero;
-+		len[1] = 8;
-+		addr[2] = data + 8;
-+		len[2] = data_len - 8 - CMAC_TLEN;
-+		addr[3] = zero;
-+		len[3] = CMAC_TLEN;
-+		aes_cmac_vector(tfm, 4, addr, len, mic, CMAC_TLEN);
- 	} else {
--		crypto_shash_update(desc, data, data_len - CMAC_TLEN);
-+		addr[1] = data;
-+		len[1] = data_len - CMAC_TLEN;
-+		addr[2] = zero;
-+		len[2] = CMAC_TLEN;
-+		aes_cmac_vector(tfm, 3, addr, len, mic, CMAC_TLEN);
- 	}
--	crypto_shash_finup(desc, zero, CMAC_TLEN, out);
--
--	memcpy(mic, out, CMAC_TLEN);
- }
- 
--void ieee80211_aes_cmac_256(struct crypto_shash *tfm, const u8 *aad,
-+void ieee80211_aes_cmac_256(struct crypto_cipher *tfm, const u8 *aad,
- 			    const u8 *data, size_t data_len, u8 *mic)
- {
--	SHASH_DESC_ON_STACK(desc, tfm);
-+	const u8 *addr[4];
-+	size_t len[4];
-+	u8 zero[CMAC_TLEN_256];
- 	const __le16 *fc;
- 
--	desc->tfm = tfm;
--
--	crypto_shash_init(desc);
--	crypto_shash_update(desc, aad, AAD_LEN);
-+	memset(zero, 0, CMAC_TLEN_256);
-+	addr[0] = aad;
-+	len[0] = AAD_LEN;
-+	addr[1] = data;
- 	fc = (const __le16 *)aad;
- 	if (ieee80211_is_beacon(*fc)) {
- 		/* mask Timestamp field to zero */
--		crypto_shash_update(desc, zero, 8);
--		crypto_shash_update(desc, data + 8,
--				    data_len - 8 - CMAC_TLEN_256);
-+		addr[1] = zero;
-+		len[1] = 8;
-+		addr[2] = data + 8;
-+		len[2] = data_len - 8 - CMAC_TLEN_256;
-+		addr[3] = zero;
-+		len[3] = CMAC_TLEN_256;
-+		aes_cmac_vector(tfm, 4, addr, len, mic, CMAC_TLEN_256);
- 	} else {
--		crypto_shash_update(desc, data, data_len - CMAC_TLEN_256);
-+		addr[1] = data;
-+		len[1] = data_len - CMAC_TLEN_256;
-+		addr[2] = zero;
-+		len[2] = CMAC_TLEN_256;
-+		aes_cmac_vector(tfm, 3, addr, len, mic, CMAC_TLEN_256);
- 	}
--	crypto_shash_finup(desc, zero, CMAC_TLEN_256, mic);
- }
- 
--struct crypto_shash *ieee80211_aes_cmac_key_setup(const u8 key[],
--						  size_t key_len)
-+struct crypto_cipher *ieee80211_aes_cmac_key_setup(const u8 key[],
-+						   size_t key_len)
- {
--	struct crypto_shash *tfm;
-+	struct crypto_cipher *tfm;
- 
--	tfm = crypto_alloc_shash("cmac(aes)", 0, 0);
-+	tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
- 	if (!IS_ERR(tfm))
--		crypto_shash_setkey(tfm, key, key_len);
-+		crypto_cipher_setkey(tfm, key, key_len);
- 
- 	return tfm;
- }
- 
--void ieee80211_aes_cmac_key_free(struct crypto_shash *tfm)
-+
-+void ieee80211_aes_cmac_key_free(struct crypto_cipher *tfm)
- {
--	crypto_free_shash(tfm);
-+	crypto_free_cipher(tfm);
- }
---- a/net/mac80211/aes_cmac.h
-+++ b/net/mac80211/aes_cmac.h
-@@ -7,14 +7,13 @@
- #define AES_CMAC_H
- 
- #include <linux/crypto.h>
--#include <crypto/hash.h>
- 
--struct crypto_shash *ieee80211_aes_cmac_key_setup(const u8 key[],
--						  size_t key_len);
--void ieee80211_aes_cmac(struct crypto_shash *tfm, const u8 *aad,
-+struct crypto_cipher *ieee80211_aes_cmac_key_setup(const u8 key[],
-+						   size_t key_len);
-+void ieee80211_aes_cmac(struct crypto_cipher *tfm, const u8 *aad,
- 			const u8 *data, size_t data_len, u8 *mic);
--void ieee80211_aes_cmac_256(struct crypto_shash *tfm, const u8 *aad,
-+void ieee80211_aes_cmac_256(struct crypto_cipher *tfm, const u8 *aad,
- 			    const u8 *data, size_t data_len, u8 *mic);
--void ieee80211_aes_cmac_key_free(struct crypto_shash *tfm);
-+void ieee80211_aes_cmac_key_free(struct crypto_cipher *tfm);
- 
- #endif /* AES_CMAC_H */
---- a/net/mac80211/key.h
-+++ b/net/mac80211/key.h
-@@ -94,7 +94,7 @@ struct ieee80211_key {
- 		} ccmp;
- 		struct {
- 			u8 rx_pn[IEEE80211_CMAC_PN_LEN];
--			struct crypto_shash *tfm;
-+			struct crypto_cipher *tfm;
- 			u32 replays; /* dot11RSNAStatsCMACReplays */
- 			u32 icverrors; /* dot11RSNAStatsCMACICVErrors */
- 		} aes_cmac;
diff --git a/package/kernel/mac80211/patches/subsys/132-mac80211-remove-cmac-dependency.patch b/package/kernel/mac80211/patches/subsys/132-mac80211-remove-cmac-dependency.patch
deleted file mode 100644
index df67d2f10..000000000
--- a/package/kernel/mac80211/patches/subsys/132-mac80211-remove-cmac-dependency.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/net/mac80211/Kconfig
-+++ b/net/mac80211/Kconfig
-@@ -6,7 +6,6 @@ config MAC80211
- 	depends on CRYPTO
- 	select BPAUTO_CRYPTO_LIB_ARC4
- 	depends on CRYPTO_AES
--	depends on CRYPTO_CMAC
- 	depends on CRC32
- 	help
- 	  This option enables the hardware independent IEEE 802.11
diff --git a/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch b/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch
deleted file mode 100644
index 8d086625e..000000000
--- a/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch
+++ /dev/null
@@ -1,67 +0,0 @@
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -321,7 +321,7 @@ void ieee80211_restart_hw(struct ieee802
- }
- EXPORT_SYMBOL(ieee80211_restart_hw);
- 
--#ifdef CONFIG_INET
-+#ifdef __disabled__CONFIG_INET
- static int ieee80211_ifa_changed(struct notifier_block *nb,
- 				 unsigned long data, void *arg)
- {
-@@ -380,7 +380,7 @@ static int ieee80211_ifa_changed(struct
- }
- #endif
- 
--#if IS_ENABLED(CONFIG_IPV6)
-+#if IS_ENABLED(__disabled__CONFIG_IPV6)
- static int ieee80211_ifa6_changed(struct notifier_block *nb,
- 				  unsigned long data, void *arg)
- {
-@@ -1315,14 +1315,14 @@ int ieee80211_register_hw(struct ieee802
- 
- 	rtnl_unlock();
- 
--#ifdef CONFIG_INET
-+#ifdef __disabled__CONFIG_INET
- 	local->ifa_notifier.notifier_call = ieee80211_ifa_changed;
- 	result = register_inetaddr_notifier(&local->ifa_notifier);
- 	if (result)
- 		goto fail_ifa;
- #endif
- 
--#if IS_ENABLED(CONFIG_IPV6)
-+#if IS_ENABLED(__disabled__CONFIG_IPV6)
- 	local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
- 	result = register_inet6addr_notifier(&local->ifa6_notifier);
- 	if (result)
-@@ -1331,13 +1331,13 @@ int ieee80211_register_hw(struct ieee802
- 
- 	return 0;
- 
--#if IS_ENABLED(CONFIG_IPV6)
-+#if IS_ENABLED(__disabled__CONFIG_IPV6)
-  fail_ifa6:
--#ifdef CONFIG_INET
-+#ifdef __disabled__CONFIG_INET
- 	unregister_inetaddr_notifier(&local->ifa_notifier);
- #endif
- #endif
--#if defined(CONFIG_INET) || defined(CONFIG_IPV6)
-+#if defined(__disabled__CONFIG_INET) || defined(__disabled__CONFIG_IPV6)
-  fail_ifa:
- #endif
- 	wiphy_unregister(local->hw.wiphy);
-@@ -1365,10 +1365,10 @@ void ieee80211_unregister_hw(struct ieee
- 	tasklet_kill(&local->tx_pending_tasklet);
- 	tasklet_kill(&local->tasklet);
- 
--#ifdef CONFIG_INET
-+#ifdef __disabled__CONFIG_INET
- 	unregister_inetaddr_notifier(&local->ifa_notifier);
- #endif
--#if IS_ENABLED(CONFIG_IPV6)
-+#if IS_ENABLED(__disabled__CONFIG_IPV6)
- 	unregister_inet6addr_notifier(&local->ifa6_notifier);
- #endif
- 
diff --git a/package/kernel/mac80211/patches/subsys/210-ap_scan.patch b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
index f8c3821c5..10b842d9a 100644
--- a/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
+++ b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
@@ -1,11 +1,19 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 3 Oct 2012 00:00:00 +0200
+Subject: [PATCH] mac80211: allow scans in access point mode (for site survey)
+
+---
+ net/mac80211/cfg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2463,7 +2463,7 @@ static int ieee80211_scan(struct wiphy *
- 		 * the  frames sent while scanning on other channel will be
- 		 * lost)
+@@ -2727,6 +2727,8 @@ static int ieee80211_scan(struct wiphy *
  		 */
--		if (sdata->u.ap.beacon &&
-+		if (0 && sdata->u.ap.beacon &&
- 		    (!(wiphy->features & NL80211_FEATURE_AP_SCAN) ||
- 		     !(req->flags & NL80211_SCAN_FLAG_AP)))
- 			return -EOPNOTSUPP;
+ 		fallthrough;
+ 	case NL80211_IFTYPE_AP:
++		/* skip check */
++		break;
+ 		/*
+ 		 * If the scan has been forced (and the driver supports
+ 		 * forcing), don't care about being beaconing already.
diff --git a/package/kernel/mac80211/patches/subsys/300-cfg80211-support-immediate-reconnect-request-hint.patch b/package/kernel/mac80211/patches/subsys/300-cfg80211-support-immediate-reconnect-request-hint.patch
deleted file mode 100644
index c551164ab..000000000
--- a/package/kernel/mac80211/patches/subsys/300-cfg80211-support-immediate-reconnect-request-hint.patch
+++ /dev/null
@@ -1,279 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Sun, 6 Dec 2020 14:54:42 +0200
-Subject: [PATCH] cfg80211: support immediate reconnect request hint
-
-There are cases where it's necessary to disconnect, but an
-immediate reconnection is desired. Support a hint to userspace
-that this is the case, by including a new attribute in the
-deauth or disassoc event.
-
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Link: https://lore.kernel.org/r/iwlwifi.20201206145305.58d33941fb9d.I0e7168c205c7949529c8e3b86f3c9b12c01a7017@changeid
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -6408,13 +6408,15 @@ void cfg80211_abandon_assoc(struct net_d
-  * @dev: network device
-  * @buf: 802.11 frame (header + body)
-  * @len: length of the frame data
-+ * @reconnect: immediate reconnect is desired (include the nl80211 attribute)
-  *
-  * This function is called whenever deauthentication has been processed in
-  * station mode. This includes both received deauthentication frames and
-  * locally generated ones. This function may sleep. The caller must hold the
-  * corresponding wdev's mutex.
-  */
--void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len);
-+void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len,
-+			   bool reconnect);
- 
- /**
-  * cfg80211_rx_unprot_mlme_mgmt - notification of unprotected mlme mgmt frame
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -2725,7 +2725,7 @@ static void ieee80211_report_disconnect(
- 	};
- 
- 	if (tx)
--		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len);
-+		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len, false);
- 	else
- 		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);
- 
-@@ -4719,7 +4719,8 @@ void ieee80211_mgd_quiesce(struct ieee80
- 		if (ifmgd->auth_data)
- 			ieee80211_destroy_auth_data(sdata, false);
- 		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
--				      IEEE80211_DEAUTH_FRAME_LEN);
-+				      IEEE80211_DEAUTH_FRAME_LEN,
-+				      false);
- 	}
- 
- 	/* This is a bit of a hack - we should find a better and more generic
---- a/net/wireless/mlme.c
-+++ b/net/wireless/mlme.c
-@@ -4,7 +4,7 @@
-  *
-  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
-  * Copyright (c) 2015		Intel Deutschland GmbH
-- * Copyright (C) 2019 Intel Corporation
-+ * Copyright (C) 2019-2020 Intel Corporation
-  */
- 
- #include <linux/kernel.h>
-@@ -81,7 +81,8 @@ static void cfg80211_process_auth(struct
- }
- 
- static void cfg80211_process_deauth(struct wireless_dev *wdev,
--				    const u8 *buf, size_t len)
-+				    const u8 *buf, size_t len,
-+				    bool reconnect)
- {
- 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
- 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
-@@ -89,7 +90,7 @@ static void cfg80211_process_deauth(stru
- 	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
- 	bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
- 
--	nl80211_send_deauth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
-+	nl80211_send_deauth(rdev, wdev->netdev, buf, len, reconnect, GFP_KERNEL);
- 
- 	if (!wdev->current_bss ||
- 	    !ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
-@@ -100,7 +101,8 @@ static void cfg80211_process_deauth(stru
- }
- 
- static void cfg80211_process_disassoc(struct wireless_dev *wdev,
--				      const u8 *buf, size_t len)
-+				      const u8 *buf, size_t len,
-+				      bool reconnect)
- {
- 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
- 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
-@@ -108,7 +110,8 @@ static void cfg80211_process_disassoc(st
- 	u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
- 	bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
- 
--	nl80211_send_disassoc(rdev, wdev->netdev, buf, len, GFP_KERNEL);
-+	nl80211_send_disassoc(rdev, wdev->netdev, buf, len, reconnect,
-+			      GFP_KERNEL);
- 
- 	if (WARN_ON(!wdev->current_bss ||
- 		    !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
-@@ -133,9 +136,9 @@ void cfg80211_rx_mlme_mgmt(struct net_de
- 	if (ieee80211_is_auth(mgmt->frame_control))
- 		cfg80211_process_auth(wdev, buf, len);
- 	else if (ieee80211_is_deauth(mgmt->frame_control))
--		cfg80211_process_deauth(wdev, buf, len);
-+		cfg80211_process_deauth(wdev, buf, len, false);
- 	else if (ieee80211_is_disassoc(mgmt->frame_control))
--		cfg80211_process_disassoc(wdev, buf, len);
-+		cfg80211_process_disassoc(wdev, buf, len, false);
- }
- EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt);
- 
-@@ -180,22 +183,23 @@ void cfg80211_abandon_assoc(struct net_d
- }
- EXPORT_SYMBOL(cfg80211_abandon_assoc);
- 
--void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
-+void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len,
-+			   bool reconnect)
- {
- 	struct wireless_dev *wdev = dev->ieee80211_ptr;
- 	struct ieee80211_mgmt *mgmt = (void *)buf;
- 
- 	ASSERT_WDEV_LOCK(wdev);
- 
--	trace_cfg80211_tx_mlme_mgmt(dev, buf, len);
-+	trace_cfg80211_tx_mlme_mgmt(dev, buf, len, reconnect);
- 
- 	if (WARN_ON(len < 2))
- 		return;
- 
- 	if (ieee80211_is_deauth(mgmt->frame_control))
--		cfg80211_process_deauth(wdev, buf, len);
-+		cfg80211_process_deauth(wdev, buf, len, reconnect);
- 	else
--		cfg80211_process_disassoc(wdev, buf, len);
-+		cfg80211_process_disassoc(wdev, buf, len, reconnect);
- }
- EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt);
- 
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -736,6 +736,7 @@ static const struct nla_policy nl80211_p
- 		NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
- 	[NL80211_ATTR_S1G_CAPABILITY_MASK] =
- 		NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
-+	[NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
- };
- 
- /* policy for the key attributes */
-@@ -15902,7 +15903,7 @@ static void nl80211_send_mlme_event(stru
- 				    const u8 *buf, size_t len,
- 				    enum nl80211_commands cmd, gfp_t gfp,
- 				    int uapsd_queues, const u8 *req_ies,
--				    size_t req_ies_len)
-+				    size_t req_ies_len, bool reconnect)
- {
- 	struct sk_buff *msg;
- 	void *hdr;
-@@ -15924,6 +15925,9 @@ static void nl80211_send_mlme_event(stru
- 	     nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
- 		goto nla_put_failure;
- 
-+	if (reconnect && nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
-+		goto nla_put_failure;
-+
- 	if (uapsd_queues >= 0) {
- 		struct nlattr *nla_wmm =
- 			nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
-@@ -15952,7 +15956,8 @@ void nl80211_send_rx_auth(struct cfg8021
- 			  size_t len, gfp_t gfp)
- {
- 	nl80211_send_mlme_event(rdev, netdev, buf, len,
--				NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0);
-+				NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0,
-+				false);
- }
- 
- void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
-@@ -15962,23 +15967,25 @@ void nl80211_send_rx_assoc(struct cfg802
- {
- 	nl80211_send_mlme_event(rdev, netdev, buf, len,
- 				NL80211_CMD_ASSOCIATE, gfp, uapsd_queues,
--				req_ies, req_ies_len);
-+				req_ies, req_ies_len, false);
- }
- 
- void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
- 			 struct net_device *netdev, const u8 *buf,
--			 size_t len, gfp_t gfp)
-+			 size_t len, bool reconnect, gfp_t gfp)
- {
- 	nl80211_send_mlme_event(rdev, netdev, buf, len,
--				NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0);
-+				NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0,
-+				reconnect);
- }
- 
- void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
- 			   struct net_device *netdev, const u8 *buf,
--			   size_t len, gfp_t gfp)
-+			   size_t len, bool reconnect, gfp_t gfp)
- {
- 	nl80211_send_mlme_event(rdev, netdev, buf, len,
--				NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0);
-+				NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0,
-+				reconnect);
- }
- 
- void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
-@@ -16009,7 +16016,7 @@ void cfg80211_rx_unprot_mlme_mgmt(struct
- 
- 	trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
- 	nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
--				NULL, 0);
-+				NULL, 0, false);
- }
- EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
- 
---- a/net/wireless/nl80211.h
-+++ b/net/wireless/nl80211.h
-@@ -1,7 +1,7 @@
- /* SPDX-License-Identifier: GPL-2.0 */
- /*
-  * Portions of this file
-- * Copyright (C) 2018 Intel Corporation
-+ * Copyright (C) 2018, 2020 Intel Corporation
-  */
- #ifndef __NET_WIRELESS_NL80211_H
- #define __NET_WIRELESS_NL80211_H
-@@ -69,10 +69,12 @@ void nl80211_send_rx_assoc(struct cfg802
- 			   const u8 *req_ies, size_t req_ies_len);
- void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
- 			 struct net_device *netdev,
--			 const u8 *buf, size_t len, gfp_t gfp);
-+			 const u8 *buf, size_t len,
-+			 bool reconnect, gfp_t gfp);
- void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
- 			   struct net_device *netdev,
--			   const u8 *buf, size_t len, gfp_t gfp);
-+			   const u8 *buf, size_t len,
-+			   bool reconnect, gfp_t gfp);
- void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
- 			       struct net_device *netdev,
- 			       const u8 *addr, gfp_t gfp);
---- a/net/wireless/trace.h
-+++ b/net/wireless/trace.h
-@@ -2684,19 +2684,23 @@ DEFINE_EVENT(netdev_frame_event, cfg8021
- );
- 
- TRACE_EVENT(cfg80211_tx_mlme_mgmt,
--	TP_PROTO(struct net_device *netdev, const u8 *buf, int len),
--	TP_ARGS(netdev, buf, len),
-+	TP_PROTO(struct net_device *netdev, const u8 *buf, int len,
-+		 bool reconnect),
-+	TP_ARGS(netdev, buf, len, reconnect),
- 	TP_STRUCT__entry(
- 		NETDEV_ENTRY
- 		__dynamic_array(u8, frame, len)
-+		__field(int, reconnect)
- 	),
- 	TP_fast_assign(
- 		NETDEV_ASSIGN;
- 		memcpy(__get_dynamic_array(frame), buf, len);
-+		__entry->reconnect = reconnect;
- 	),
--	TP_printk(NETDEV_PR_FMT ", ftype:0x%.2x",
-+	TP_printk(NETDEV_PR_FMT ", ftype:0x%.2x reconnect:%d",
- 		  NETDEV_PR_ARG,
--		  le16_to_cpup((__le16 *)__get_dynamic_array(frame)))
-+		  le16_to_cpup((__le16 *)__get_dynamic_array(frame)),
-+		  __entry->reconnect)
- );
- 
- DECLARE_EVENT_CLASS(netdev_mac_evt,
diff --git a/package/kernel/mac80211/patches/subsys/304-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch b/package/kernel/mac80211/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
similarity index 96%
rename from package/kernel/mac80211/patches/subsys/304-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
rename to package/kernel/mac80211/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
index d09d70725..63b217747 100644
--- a/package/kernel/mac80211/patches/subsys/304-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
+++ b/package/kernel/mac80211/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
@@ -28,7 +28,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -357,6 +357,7 @@ struct sta_info *sta_info_alloc(struct i
+@@ -554,6 +554,7 @@ __sta_info_alloc(struct ieee80211_sub_if
  	INIT_WORK(&sta->drv_deliver_wk, sta_deliver_ps_frames);
  	INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
  	mutex_init(&sta->ampdu_mlme.mtx);
diff --git a/package/kernel/mac80211/patches/subsys/301-mac80211-support-driver-based-disconnect-with-reconn.patch b/package/kernel/mac80211/patches/subsys/301-mac80211-support-driver-based-disconnect-with-reconn.patch
deleted file mode 100644
index cc9602df7..000000000
--- a/package/kernel/mac80211/patches/subsys/301-mac80211-support-driver-based-disconnect-with-reconn.patch
+++ /dev/null
@@ -1,271 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Sun, 6 Dec 2020 14:54:43 +0200
-Subject: [PATCH] mac80211: support driver-based disconnect with reconnect hint
-
-Support the driver indicating that a disconnection needs
-to be performed, and pass through the reconnect hint in
-this case.
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Link: https://lore.kernel.org/r/iwlwifi.20201206145305.5c8dab7a22a0.I58459fdf6968b16c90cab9c574f0f04ca22b0c79@changeid
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -5885,6 +5885,17 @@ void ieee80211_beacon_loss(struct ieee80
- void ieee80211_connection_loss(struct ieee80211_vif *vif);
- 
- /**
-+ * ieee80211_disconnect - request disconnection
-+ *
-+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
-+ * @reconnect: immediate reconnect is desired
-+ *
-+ * Request disconnection from the current network and, if enabled, send a
-+ * hint to the higher layers that immediate reconnect is desired.
-+ */
-+void ieee80211_disconnect(struct ieee80211_vif *vif, bool reconnect);
-+
-+/**
-  * ieee80211_resume_disconnect - disconnect from AP after resume
-  *
-  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -450,7 +450,9 @@ struct ieee80211_if_managed {
- 	unsigned long probe_timeout;
- 	int probe_send_count;
- 	bool nullfunc_failed;
--	bool connection_loss;
-+	u8 connection_loss:1,
-+	   driver_disconnect:1,
-+	   reconnect:1;
- 
- 	struct cfg80211_bss *associated;
- 	struct ieee80211_mgd_auth_data *auth_data;
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -2716,7 +2716,7 @@ EXPORT_SYMBOL(ieee80211_ap_probereq_get)
- 
- static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
- 					const u8 *buf, size_t len, bool tx,
--					u16 reason)
-+					u16 reason, bool reconnect)
- {
- 	struct ieee80211_event event = {
- 		.type = MLME_EVENT,
-@@ -2725,7 +2725,7 @@ static void ieee80211_report_disconnect(
- 	};
- 
- 	if (tx)
--		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len, false);
-+		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len, reconnect);
- 	else
- 		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);
- 
-@@ -2747,13 +2747,18 @@ static void __ieee80211_disconnect(struc
- 
- 	tx = !sdata->csa_block_tx;
- 
--	/* AP is probably out of range (or not reachable for another reason) so
--	 * remove the bss struct for that AP.
--	 */
--	cfg80211_unlink_bss(local->hw.wiphy, ifmgd->associated);
-+	if (!ifmgd->driver_disconnect) {
-+		/*
-+		 * AP is probably out of range (or not reachable for another
-+		 * reason) so remove the bss struct for that AP.
-+		 */
-+		cfg80211_unlink_bss(local->hw.wiphy, ifmgd->associated);
-+	}
- 
- 	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
--			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
-+			       ifmgd->driver_disconnect ?
-+					WLAN_REASON_DEAUTH_LEAVING :
-+					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
- 			       tx, frame_buf);
- 	mutex_lock(&local->mtx);
- 	sdata->vif.csa_active = false;
-@@ -2766,7 +2771,9 @@ static void __ieee80211_disconnect(struc
- 	mutex_unlock(&local->mtx);
- 
- 	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
--				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
-+				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
-+				    ifmgd->reconnect);
-+	ifmgd->reconnect = false;
- 
- 	sdata_unlock(sdata);
- }
-@@ -2785,6 +2792,13 @@ static void ieee80211_beacon_connection_
- 		sdata_info(sdata, "Connection to AP %pM lost\n",
- 			   ifmgd->bssid);
- 		__ieee80211_disconnect(sdata);
-+		ifmgd->connection_loss = false;
-+	} else if (ifmgd->driver_disconnect) {
-+		sdata_info(sdata,
-+			   "Driver requested disconnection from AP %pM\n",
-+			   ifmgd->bssid);
-+		__ieee80211_disconnect(sdata);
-+		ifmgd->driver_disconnect = false;
- 	} else {
- 		ieee80211_mgd_probe_ap(sdata, true);
- 	}
-@@ -2823,6 +2837,21 @@ void ieee80211_connection_loss(struct ie
- }
- EXPORT_SYMBOL(ieee80211_connection_loss);
- 
-+void ieee80211_disconnect(struct ieee80211_vif *vif, bool reconnect)
-+{
-+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-+	struct ieee80211_hw *hw = &sdata->local->hw;
-+
-+	trace_api_disconnect(sdata, reconnect);
-+
-+	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
-+		return;
-+
-+	sdata->u.mgd.driver_disconnect = true;
-+	sdata->u.mgd.reconnect = reconnect;
-+	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
-+}
-+EXPORT_SYMBOL(ieee80211_disconnect);
- 
- static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
- 					bool assoc)
-@@ -3126,7 +3155,7 @@ static void ieee80211_rx_mgmt_deauth(str
- 		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
- 
- 		ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
--					    reason_code);
-+					    reason_code, false);
- 		return;
- 	}
- 
-@@ -3175,7 +3204,8 @@ static void ieee80211_rx_mgmt_disassoc(s
- 
- 	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
- 
--	ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code);
-+	ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code,
-+				    false);
- }
- 
- static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
-@@ -4199,7 +4229,8 @@ static void ieee80211_rx_mgmt_beacon(str
- 				       true, deauth_buf);
- 		ieee80211_report_disconnect(sdata, deauth_buf,
- 					    sizeof(deauth_buf), true,
--					    WLAN_REASON_DEAUTH_LEAVING);
-+					    WLAN_REASON_DEAUTH_LEAVING,
-+					    false);
- 		return;
- 	}
- 
-@@ -4344,7 +4375,7 @@ static void ieee80211_sta_connection_los
- 			       tx, frame_buf);
- 
- 	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
--				    reason);
-+				    reason, false);
- }
- 
- static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
-@@ -5434,7 +5465,8 @@ int ieee80211_mgd_auth(struct ieee80211_
- 
- 		ieee80211_report_disconnect(sdata, frame_buf,
- 					    sizeof(frame_buf), true,
--					    WLAN_REASON_UNSPECIFIED);
-+					    WLAN_REASON_UNSPECIFIED,
-+					    false);
- 	}
- 
- 	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
-@@ -5506,7 +5538,8 @@ int ieee80211_mgd_assoc(struct ieee80211
- 
- 		ieee80211_report_disconnect(sdata, frame_buf,
- 					    sizeof(frame_buf), true,
--					    WLAN_REASON_UNSPECIFIED);
-+					    WLAN_REASON_UNSPECIFIED,
-+					    false);
- 	}
- 
- 	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
-@@ -5809,7 +5842,7 @@ int ieee80211_mgd_deauth(struct ieee8021
- 		ieee80211_destroy_auth_data(sdata, false);
- 		ieee80211_report_disconnect(sdata, frame_buf,
- 					    sizeof(frame_buf), true,
--					    req->reason_code);
-+					    req->reason_code, false);
- 
- 		return 0;
- 	}
-@@ -5829,7 +5862,7 @@ int ieee80211_mgd_deauth(struct ieee8021
- 		ieee80211_destroy_assoc_data(sdata, false, true);
- 		ieee80211_report_disconnect(sdata, frame_buf,
- 					    sizeof(frame_buf), true,
--					    req->reason_code);
-+					    req->reason_code, false);
- 		return 0;
- 	}
- 
-@@ -5844,7 +5877,7 @@ int ieee80211_mgd_deauth(struct ieee8021
- 				       req->reason_code, tx, frame_buf);
- 		ieee80211_report_disconnect(sdata, frame_buf,
- 					    sizeof(frame_buf), true,
--					    req->reason_code);
-+					    req->reason_code, false);
- 		return 0;
- 	}
- 
-@@ -5877,7 +5910,7 @@ int ieee80211_mgd_disassoc(struct ieee80
- 			       frame_buf);
- 
- 	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
--				    req->reason_code);
-+				    req->reason_code, false);
- 
- 	return 0;
- }
---- a/net/mac80211/trace.h
-+++ b/net/mac80211/trace.h
-@@ -2,7 +2,7 @@
- /*
- * Portions of this file
- * Copyright(c) 2016-2017 Intel Deutschland GmbH
--* Copyright (C) 2018 - 2019 Intel Corporation
-+* Copyright (C) 2018 - 2020 Intel Corporation
- */
- 
- #if !defined(__MAC80211_DRIVER_TRACE) || defined(TRACE_HEADER_MULTI_READ)
-@@ -2086,6 +2086,27 @@ TRACE_EVENT(api_connection_loss,
- 	)
- );
- 
-+TRACE_EVENT(api_disconnect,
-+	TP_PROTO(struct ieee80211_sub_if_data *sdata, bool reconnect),
-+
-+	TP_ARGS(sdata, reconnect),
-+
-+	TP_STRUCT__entry(
-+		VIF_ENTRY
-+		__field(int, reconnect)
-+	),
-+
-+	TP_fast_assign(
-+		VIF_ASSIGN;
-+		__entry->reconnect = reconnect;
-+	),
-+
-+	TP_printk(
-+		VIF_PR_FMT " reconnect:%d",
-+		VIF_PR_ARG, __entry->reconnect
-+	)
-+);
-+
- TRACE_EVENT(api_cqm_rssi_notify,
- 	TP_PROTO(struct ieee80211_sub_if_data *sdata,
- 		 enum nl80211_cqm_rssi_threshold_event rssi_event,
diff --git a/package/kernel/mac80211/patches/subsys/302-cfg80211-Add-support-to-configure-SAE-PWE-value-to-d.patch b/package/kernel/mac80211/patches/subsys/302-cfg80211-Add-support-to-configure-SAE-PWE-value-to-d.patch
deleted file mode 100644
index da88d1413..000000000
--- a/package/kernel/mac80211/patches/subsys/302-cfg80211-Add-support-to-configure-SAE-PWE-value-to-d.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From: Rohan Dutta <drohan@codeaurora.org>
-Date: Tue, 27 Oct 2020 12:09:10 +0200
-Subject: [PATCH] cfg80211: Add support to configure SAE PWE value to drivers
-
-Add support to configure SAE PWE preference from userspace to drivers in
-both AP and STA modes. This is needed for cases where the driver takes
-care of Authentication frame processing (SME in the driver) so that
-correct enforcement of the acceptable PWE derivation mechanism can be
-performed.
-
-The userspace applications can pass the sae_pwe value using the
-NL80211_ATTR_SAE_PWE attribute in the NL80211_CMD_CONNECT and
-NL80211_CMD_START_AP commands to the driver. This allows selection
-between the hunting-and-pecking loop and hash-to-element options for PWE
-derivation. For backwards compatibility, this new attribute is optional
-and if not included, the driver is notified of the value being
-unspecified.
-
-Signed-off-by: Rohan Dutta <drohan@codeaurora.org>
-Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
-Link: https://lore.kernel.org/r/20201027100910.22283-1-jouni@codeaurora.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -1009,6 +1009,14 @@ struct survey_info {
-  * @sae_pwd: password for SAE authentication (for devices supporting SAE
-  *	offload)
-  * @sae_pwd_len: length of SAE password (for devices supporting SAE offload)
-+ * @sae_pwe: The mechanisms allowed for SAE PWE derivation
-+ *	NL80211_SAE_PWE_UNSPECIFIED: Not-specified, used to indicate userspace
-+ *		did not specify any preference. The driver should follow its
-+ *		internal policy in such a scenario.
-+ *	NL80211_SAE_PWE_HUNT_AND_PECK: Allow hunting-and-pecking loop only
-+ *	NL80211_SAE_PWE_HASH_TO_ELEMENT: Allow hash-to-element only
-+ *	NL80211_SAE_PWE_BOTH: Allow either hunting-and-pecking loop
-+ *		or hash-to-element
-  */
- struct cfg80211_crypto_settings {
- 	u32 wpa_versions;
-@@ -1027,6 +1035,7 @@ struct cfg80211_crypto_settings {
- 	const u8 *psk;
- 	const u8 *sae_pwd;
- 	u8 sae_pwd_len;
-+	enum nl80211_sae_pwe_mechanism sae_pwe;
- };
- 
- /**
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -736,6 +736,9 @@ static const struct nla_policy nl80211_p
- 		NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
- 	[NL80211_ATTR_S1G_CAPABILITY_MASK] =
- 		NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
-+	[NL80211_ATTR_SAE_PWE] =
-+		NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
-+				 NL80211_SAE_PWE_BOTH),
- 	[NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
- };
- 
-@@ -9763,6 +9766,12 @@ static int nl80211_crypto_settings(struc
- 			nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
- 	}
- 
-+	if (info->attrs[NL80211_ATTR_SAE_PWE])
-+		settings->sae_pwe =
-+			nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]);
-+	else
-+		settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED;
-+
- 	return 0;
- }
- 
diff --git a/package/kernel/mac80211/patches/subsys/353-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch b/package/kernel/mac80211/patches/subsys/302-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
similarity index 100%
rename from package/kernel/mac80211/patches/subsys/353-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
rename to package/kernel/mac80211/patches/subsys/302-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
diff --git a/package/kernel/mac80211/patches/subsys/354-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch b/package/kernel/mac80211/patches/subsys/303-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
similarity index 94%
rename from package/kernel/mac80211/patches/subsys/354-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
rename to package/kernel/mac80211/patches/subsys/303-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
index 16bcbc2ef..f26477e81 100644
--- a/package/kernel/mac80211/patches/subsys/354-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
+++ b/package/kernel/mac80211/patches/subsys/303-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
@@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/rc80211_minstrel_ht.c
 +++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -700,7 +700,8 @@ minstrel_ht_calc_rate_stats(struct minst
+@@ -769,7 +769,8 @@ minstrel_ht_calc_rate_stats(struct minst
  	unsigned int cur_prob;
  
  	if (unlikely(mrs->attempts > 0)) {
diff --git a/package/kernel/mac80211/patches/subsys/355-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch b/package/kernel/mac80211/patches/subsys/304-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
similarity index 89%
rename from package/kernel/mac80211/patches/subsys/355-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
rename to package/kernel/mac80211/patches/subsys/304-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
index aec2e0778..9b3cc3a66 100644
--- a/package/kernel/mac80211/patches/subsys/355-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
+++ b/package/kernel/mac80211/patches/subsys/304-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
@@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/rc80211_minstrel_ht.c
 +++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -511,6 +511,14 @@ minstrel_ht_set_best_prob_rate(struct mi
+@@ -580,6 +580,14 @@ minstrel_ht_set_best_prob_rate(struct mi
  	int cur_tp_avg, cur_group, cur_idx;
  	int max_gpr_group, max_gpr_idx;
  	int max_gpr_tp_avg, max_gpr_prob;
@@ -33,7 +33,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	cur_group = MI_RATE_GROUP(index);
  	cur_idx = MI_RATE_IDX(index);
-@@ -532,11 +540,6 @@ minstrel_ht_set_best_prob_rate(struct mi
+@@ -601,11 +609,6 @@ minstrel_ht_set_best_prob_rate(struct mi
  	    !minstrel_ht_is_legacy_group(max_tp_group))
  		return;
  
@@ -45,7 +45,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	max_gpr_group = MI_RATE_GROUP(mg->max_group_prob_rate);
  	max_gpr_idx = MI_RATE_IDX(mg->max_group_prob_rate);
  	max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_avg;
-@@ -594,40 +597,6 @@ minstrel_ht_assign_best_tp_rates(struct
+@@ -663,40 +666,6 @@ minstrel_ht_assign_best_tp_rates(struct
  
  }
  
@@ -60,7 +60,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 -	int tmp_max_streams, group, tmp_idx, tmp_prob;
 -	int tmp_tp = 0;
 -
--	if (!mi->sta->ht_cap.ht_supported)
+-	if (!mi->sta->deflink.ht_cap.ht_supported)
 -		return;
 -
 -	group = MI_RATE_GROUP(mi->max_tp_rate[0]);
@@ -86,7 +86,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static u16
  __minstrel_ht_get_sample_rate(struct minstrel_ht_sta *mi,
  			      enum minstrel_sample_type type)
-@@ -1111,8 +1080,6 @@ minstrel_ht_update_stats(struct minstrel
+@@ -1176,8 +1145,6 @@ minstrel_ht_update_stats(struct minstrel
  
  	mi->max_prob_rate = tmp_max_prob_rate;
  
@@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	minstrel_ht_refill_sample_rates(mi);
  
  #ifdef CPTCFG_MAC80211_DEBUGFS
-@@ -1157,7 +1124,7 @@ minstrel_ht_txstat_valid(struct minstrel
+@@ -1256,7 +1223,7 @@ minstrel_ht_ri_txstat_valid(struct minst
  }
  
  static void
@@ -104,7 +104,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  {
  	int group, orig_group;
  
-@@ -1172,11 +1139,7 @@ minstrel_downgrade_rate(struct minstrel_
+@@ -1271,11 +1238,7 @@ minstrel_downgrade_rate(struct minstrel_
  		    minstrel_mcs_groups[orig_group].streams)
  			continue;
  
@@ -117,7 +117,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}
  }
  
-@@ -1210,7 +1173,7 @@ minstrel_ht_tx_status(void *priv, struct
+@@ -1286,7 +1249,7 @@ minstrel_ht_tx_status(void *priv, struct
  	struct ieee80211_tx_info *info = st->info;
  	struct minstrel_ht_sta *mi = priv_sta;
  	struct ieee80211_tx_rate *ar = info->status.rates;
@@ -126,7 +126,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	struct minstrel_priv *mp = priv;
  	u32 update_interval = mp->update_interval;
  	bool last, update = false;
-@@ -1256,18 +1219,13 @@ minstrel_ht_tx_status(void *priv, struct
+@@ -1354,18 +1317,13 @@ minstrel_ht_tx_status(void *priv, struct
  		/*
  		 * check for sudden death of spatial multiplexing,
  		 * downgrade to a lower number of streams if necessary.
diff --git a/package/kernel/mac80211/patches/subsys/305-mac80211-fix-regression-in-SSN-handling-of-addba-tx.patch b/package/kernel/mac80211/patches/subsys/305-mac80211-fix-regression-in-SSN-handling-of-addba-tx.patch
deleted file mode 100644
index 6ffdffc56..000000000
--- a/package/kernel/mac80211/patches/subsys/305-mac80211-fix-regression-in-SSN-handling-of-addba-tx.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 24 Nov 2021 10:30:41 +0100
-Subject: [PATCH] mac80211: fix regression in SSN handling of addba tx
-
-Some drivers that do their own sequence number allocation (e.g. ath9k) rely
-on being able to modify params->ssn on starting tx ampdu sessions.
-This was broken by a change that modified it to use sta->tid_seq[tid] instead.
-
-Cc: stable@vger.kernel.org
-Fixes: 31d8bb4e07f8 ("mac80211: agg-tx: refactor sending addba")
-Reported-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/agg-tx.c
-+++ b/net/mac80211/agg-tx.c
-@@ -480,8 +480,7 @@ static void ieee80211_send_addba_with_ti
- 
- 	/* send AddBA request */
- 	ieee80211_send_addba_request(sdata, sta->sta.addr, tid,
--				     tid_tx->dialog_token,
--				     sta->tid_seq[tid] >> 4,
-+				     tid_tx->dialog_token, tid_tx->ssn,
- 				     buf_size, tid_tx->timeout);
- 
- 	WARN_ON(test_and_set_bit(HT_AGG_STATE_SENT_ADDBA, &tid_tx->state));
-@@ -523,6 +522,7 @@ void ieee80211_tx_ba_session_handle_star
- 
- 	params.ssn = sta->tid_seq[tid] >> 4;
- 	ret = drv_ampdu_action(local, sdata, &params);
-+	tid_tx->ssn = params.ssn;
- 	if (ret == IEEE80211_AMPDU_TX_START_DELAY_ADDBA) {
- 		return;
- 	} else if (ret == IEEE80211_AMPDU_TX_START_IMMEDIATE) {
---- a/net/mac80211/sta_info.h
-+++ b/net/mac80211/sta_info.h
-@@ -190,6 +190,7 @@ struct tid_ampdu_tx {
- 	u8 stop_initiator;
- 	bool tx_stop;
- 	u16 buf_size;
-+	u16 ssn;
- 
- 	u16 failed_bar_ssn;
- 	bool bar_pending;
diff --git a/package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch b/package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
new file mode 100644
index 000000000..0ac972955
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
@@ -0,0 +1,53 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 26 Jun 2022 11:43:25 +0200
+Subject: [PATCH] mac80211: increase quantum for airtime scheduler
+
+Given the typical AQL budget and queue length, a quantum of 256 with the
+default station weight often requires iterating over all queues frequently,
+until one of them becomes eligible.
+Improve performance by using 8 times station weight as scheduler quantum
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -90,6 +90,8 @@ extern const u8 ieee80211_ac_to_qos_mask
+  */
+ #define AIRTIME_ACTIVE_DURATION (HZ / 10)
+ 
++#define AIRTIME_QUANTUM_SHIFT	3
++
+ struct ieee80211_bss {
+ 	u32 device_ts_beacon, device_ts_presp;
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3984,7 +3984,7 @@ struct ieee80211_txq *ieee80211_next_txq
+ 
+ 		if (deficit < 0)
+ 			sta->airtime[txqi->txq.ac].deficit +=
+-				sta->airtime_weight;
++				sta->airtime_weight << AIRTIME_QUANTUM_SHIFT;
+ 
+ 		if (deficit < 0 || !aql_check) {
+ 			list_move_tail(&txqi->schedule_order,
+@@ -4127,7 +4127,8 @@ bool ieee80211_txq_may_transmit(struct i
+ 		}
+ 		sta = container_of(iter->txq.sta, struct sta_info, sta);
+ 		if (ieee80211_sta_deficit(sta, ac) < 0)
+-			sta->airtime[ac].deficit += sta->airtime_weight;
++			sta->airtime[ac].deficit += sta->airtime_weight <<
++						    AIRTIME_QUANTUM_SHIFT;
+ 		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
+ 	}
+ 
+@@ -4135,7 +4136,7 @@ bool ieee80211_txq_may_transmit(struct i
+ 	if (sta->airtime[ac].deficit >= 0)
+ 		goto out;
+ 
+-	sta->airtime[ac].deficit += sta->airtime_weight;
++	sta->airtime[ac].deficit += sta->airtime_weight << AIRTIME_QUANTUM_SHIFT;
+ 	list_move_tail(&txqi->schedule_order, &local->active_txqs[ac]);
+ 	spin_unlock_bh(&local->active_txq_lock[ac]);
+ 
diff --git a/package/kernel/mac80211/patches/subsys/306-01-v6.2-wifi-mac80211-add-internal-handler-for-wake_tx_queue.patch b/package/kernel/mac80211/patches/subsys/306-01-v6.2-wifi-mac80211-add-internal-handler-for-wake_tx_queue.patch
new file mode 100644
index 000000000..d14ba05e6
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/306-01-v6.2-wifi-mac80211-add-internal-handler-for-wake_tx_queue.patch
@@ -0,0 +1,183 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Sun, 9 Oct 2022 18:30:38 +0200
+Subject: [PATCH] wifi: mac80211: add internal handler for wake_tx_queue
+
+Start to align the TX handling to only use internal TX queues (iTXQs):
+
+Provide a handler for drivers not having a custom wake_tx_queue
+callback and update the documentation.
+
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -89,15 +89,13 @@
+ /**
+  * DOC: mac80211 software tx queueing
+  *
+- * mac80211 provides an optional intermediate queueing implementation designed
+- * to allow the driver to keep hardware queues short and provide some fairness
+- * between different stations/interfaces.
+- * In this model, the driver pulls data frames from the mac80211 queue instead
+- * of letting mac80211 push them via drv_tx().
+- * Other frames (e.g. control or management) are still pushed using drv_tx().
++ * mac80211 uses an intermediate queueing implementation, designed to allow the
++ * driver to keep hardware queues short and to provide some fairness between
++ * different stations/interfaces.
+  *
+- * Drivers indicate that they use this model by implementing the .wake_tx_queue
+- * driver operation.
++ * Drivers must provide the .wake_tx_queue driver operation by either
++ * linking it to ieee80211_handle_wake_tx_queue() or implementing a custom
++ * handler.
+  *
+  * Intermediate queues (struct ieee80211_txq) are kept per-sta per-tid, with
+  * another per-sta for non-data/non-mgmt and bufferable management frames, and
+@@ -106,9 +104,12 @@
+  * The driver is expected to initialize its private per-queue data for stations
+  * and interfaces in the .add_interface and .sta_add ops.
+  *
+- * The driver can't access the queue directly. To dequeue a frame from a
+- * txq, it calls ieee80211_tx_dequeue(). Whenever mac80211 adds a new frame to a
+- * queue, it calls the .wake_tx_queue driver op.
++ * The driver can't access the internal TX queues (iTXQs) directly.
++ * Whenever mac80211 adds a new frame to a queue, it calls the .wake_tx_queue
++ * driver op.
++ * Drivers implementing a custom .wake_tx_queue op can get them by calling
++ * ieee80211_tx_dequeue(). Drivers using ieee80211_handle_wake_tx_queue() will
++ * simply get the individual frames pushed via the .tx driver operation.
+  *
+  * Drivers can optionally delegate responsibility for scheduling queues to
+  * mac80211, to take advantage of airtime fairness accounting. In this case, to
+@@ -2248,8 +2249,8 @@ struct ieee80211_link_sta {
+  *	For non MLO STA it will point to the deflink data. For MLO STA
+  *	ieee80211_sta_recalc_aggregates() must be called to update it.
+  * @support_p2p_ps: indicates whether the STA supports P2P PS mechanism or not.
+- * @txq: per-TID data TX queues (if driver uses the TXQ abstraction); note that
+- *	the last entry (%IEEE80211_NUM_TIDS) is used for non-data frames
++ * @txq: per-TID data TX queues; note that the last entry (%IEEE80211_NUM_TIDS)
++ *	is used for non-data frames
+  * @deflink: This holds the default link STA information, for non MLO STA all link
+  *	specific STA information is accessed through @deflink or through
+  *	link[0] which points to address of @deflink. For MLO Link STA
+@@ -5687,7 +5688,7 @@ void ieee80211_key_replay(struct ieee802
+  * @hw: pointer as obtained from ieee80211_alloc_hw().
+  * @queue: queue number (counted from zero).
+  *
+- * Drivers should use this function instead of netif_wake_queue.
++ * Drivers must use this function instead of netif_wake_queue.
+  */
+ void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue);
+ 
+@@ -5696,7 +5697,7 @@ void ieee80211_wake_queue(struct ieee802
+  * @hw: pointer as obtained from ieee80211_alloc_hw().
+  * @queue: queue number (counted from zero).
+  *
+- * Drivers should use this function instead of netif_stop_queue.
++ * Drivers must use this function instead of netif_stop_queue.
+  */
+ void ieee80211_stop_queue(struct ieee80211_hw *hw, int queue);
+ 
+@@ -5705,7 +5706,7 @@ void ieee80211_stop_queue(struct ieee802
+  * @hw: pointer as obtained from ieee80211_alloc_hw().
+  * @queue: queue number (counted from zero).
+  *
+- * Drivers should use this function instead of netif_stop_queue.
++ * Drivers must use this function instead of netif_queue_stopped.
+  *
+  * Return: %true if the queue is stopped. %false otherwise.
+  */
+@@ -5716,7 +5717,7 @@ int ieee80211_queue_stopped(struct ieee8
+  * ieee80211_stop_queues - stop all queues
+  * @hw: pointer as obtained from ieee80211_alloc_hw().
+  *
+- * Drivers should use this function instead of netif_stop_queue.
++ * Drivers must use this function instead of netif_tx_stop_all_queues.
+  */
+ void ieee80211_stop_queues(struct ieee80211_hw *hw);
+ 
+@@ -5724,7 +5725,7 @@ void ieee80211_stop_queues(struct ieee80
+  * ieee80211_wake_queues - wake all queues
+  * @hw: pointer as obtained from ieee80211_alloc_hw().
+  *
+- * Drivers should use this function instead of netif_wake_queue.
++ * Drivers must use this function instead of netif_tx_wake_all_queues.
+  */
+ void ieee80211_wake_queues(struct ieee80211_hw *hw);
+ 
+@@ -6946,6 +6947,18 @@ static inline struct sk_buff *ieee80211_
+ }
+ 
+ /**
++ * ieee80211_handle_wake_tx_queue - mac80211 handler for wake_tx_queue callback
++ *
++ * @hw: pointer as obtained from wake_tx_queue() callback().
++ * @txq: pointer as obtained from wake_tx_queue() callback().
++ *
++ * Drivers can use this function for the mandatory mac80211 wake_tx_queue
++ * callback in struct ieee80211_ops. They should not call this function.
++ */
++void ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,
++				    struct ieee80211_txq *txq);
++
++/**
+  * ieee80211_next_txq - get next tx queue to pull packets from
+  *
+  * @hw: pointer as obtained from ieee80211_alloc_hw()
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -288,6 +288,52 @@ __le16 ieee80211_ctstoself_duration(stru
+ }
+ EXPORT_SYMBOL(ieee80211_ctstoself_duration);
+ 
++static void wake_tx_push_queue(struct ieee80211_local *local,
++			       struct ieee80211_sub_if_data *sdata,
++			       struct ieee80211_txq *queue)
++{
++	int q = sdata->vif.hw_queue[queue->ac];
++	struct ieee80211_tx_control control = {
++		.sta = queue->sta,
++	};
++	struct sk_buff *skb;
++	unsigned long flags;
++	bool q_stopped;
++
++	while (1) {
++		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
++		q_stopped = local->queue_stop_reasons[q];
++		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
++
++		if (q_stopped)
++			break;
++
++		skb = ieee80211_tx_dequeue(&local->hw, queue);
++		if (!skb)
++			break;
++
++		drv_tx(local, &control, skb);
++	}
++}
++
++/* wake_tx_queue handler for driver not implementing a custom one*/
++void ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,
++				    struct ieee80211_txq *txq)
++{
++	struct ieee80211_local *local = hw_to_local(hw);
++	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
++	struct ieee80211_txq *queue;
++
++	/* Use ieee80211_next_txq() for airtime fairness accounting */
++	ieee80211_txq_schedule_start(hw, txq->ac);
++	while ((queue = ieee80211_next_txq(hw, txq->ac))) {
++		wake_tx_push_queue(local, sdata, queue);
++		ieee80211_return_txq(hw, queue, false);
++	}
++	ieee80211_txq_schedule_end(hw, txq->ac);
++}
++EXPORT_SYMBOL(ieee80211_handle_wake_tx_queue);
++
+ static void __ieee80211_wake_txqs(struct ieee80211_sub_if_data *sdata, int ac)
+ {
+ 	struct ieee80211_local *local = sdata->local;
diff --git a/package/kernel/mac80211/patches/subsys/306-02-v6.2-wifi-mac80211-add-wake_tx_queue-callback-to-drivers.patch b/package/kernel/mac80211/patches/subsys/306-02-v6.2-wifi-mac80211-add-wake_tx_queue-callback-to-drivers.patch
new file mode 100644
index 000000000..fee038d90
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/306-02-v6.2-wifi-mac80211-add-wake_tx_queue-callback-to-drivers.patch
@@ -0,0 +1,396 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Sun, 9 Oct 2022 18:30:39 +0200
+Subject: [PATCH] wifi: mac80211: add wake_tx_queue callback to drivers
+
+mac80211 is fully switching over to the internal TX queue (iTXQ)
+implementation. Update all drivers not yet providing the now mandatory
+wake_tx_queue() callback.
+
+As an side effect the netdev interfaces of all updated drivers will
+switch to the noqueue qdisc.
+
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+[add staging drivers]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/drivers/net/wireless/admtek/adm8211.c
++++ b/drivers/net/wireless/admtek/adm8211.c
+@@ -1760,6 +1760,7 @@ static int adm8211_alloc_rings(struct ie
+ 
+ static const struct ieee80211_ops adm8211_ops = {
+ 	.tx			= adm8211_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= adm8211_start,
+ 	.stop			= adm8211_stop,
+ 	.add_interface		= adm8211_add_interface,
+--- a/drivers/net/wireless/ath/ar5523/ar5523.c
++++ b/drivers/net/wireless/ath/ar5523/ar5523.c
+@@ -1361,6 +1361,7 @@ static const struct ieee80211_ops ar5523
+ 	.start			= ar5523_start,
+ 	.stop			= ar5523_stop,
+ 	.tx			= ar5523_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.set_rts_threshold	= ar5523_set_rts_threshold,
+ 	.add_interface		= ar5523_add_interface,
+ 	.remove_interface	= ar5523_remove_interface,
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -8587,6 +8587,7 @@ err_fallback:
+ 
+ static const struct ieee80211_ops ath11k_ops = {
+ 	.tx				= ath11k_mac_op_tx,
++	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
+ 	.start                          = ath11k_mac_op_start,
+ 	.stop                           = ath11k_mac_op_stop,
+ 	.reconfig_complete              = ath11k_mac_op_reconfig_complete,
+--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
++++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+@@ -781,6 +781,7 @@ static int ath5k_set_ringparam(struct ie
+ 
+ const struct ieee80211_ops ath5k_hw_ops = {
+ 	.tx			= ath5k_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= ath5k_start,
+ 	.stop			= ath5k_stop,
+ 	.add_interface		= ath5k_add_interface,
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+@@ -1870,6 +1870,7 @@ static void ath9k_htc_channel_switch_bea
+ 
+ struct ieee80211_ops ath9k_htc_ops = {
+ 	.tx                 = ath9k_htc_tx,
++	.wake_tx_queue      = ieee80211_handle_wake_tx_queue,
+ 	.start              = ath9k_htc_start,
+ 	.stop               = ath9k_htc_stop,
+ 	.add_interface      = ath9k_htc_add_interface,
+--- a/drivers/net/wireless/ath/carl9170/main.c
++++ b/drivers/net/wireless/ath/carl9170/main.c
+@@ -1715,6 +1715,7 @@ static const struct ieee80211_ops carl91
+ 	.start			= carl9170_op_start,
+ 	.stop			= carl9170_op_stop,
+ 	.tx			= carl9170_op_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.flush			= carl9170_op_flush,
+ 	.add_interface		= carl9170_op_add_interface,
+ 	.remove_interface	= carl9170_op_remove_interface,
+--- a/drivers/net/wireless/ath/wcn36xx/main.c
++++ b/drivers/net/wireless/ath/wcn36xx/main.c
+@@ -1362,6 +1362,7 @@ static const struct ieee80211_ops wcn36x
+ 	.prepare_multicast	= wcn36xx_prepare_multicast,
+ 	.configure_filter       = wcn36xx_configure_filter,
+ 	.tx			= wcn36xx_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.set_key		= wcn36xx_set_key,
+ 	.hw_scan		= wcn36xx_hw_scan,
+ 	.cancel_hw_scan		= wcn36xx_cancel_hw_scan,
+--- a/drivers/net/wireless/atmel/at76c50x-usb.c
++++ b/drivers/net/wireless/atmel/at76c50x-usb.c
+@@ -2187,6 +2187,7 @@ static int at76_set_key(struct ieee80211
+ 
+ static const struct ieee80211_ops at76_ops = {
+ 	.tx = at76_mac80211_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.add_interface = at76_add_interface,
+ 	.remove_interface = at76_remove_interface,
+ 	.config = at76_config,
+--- a/drivers/net/wireless/broadcom/b43/main.c
++++ b/drivers/net/wireless/broadcom/b43/main.c
+@@ -5171,6 +5171,7 @@ static int b43_op_get_survey(struct ieee
+ 
+ static const struct ieee80211_ops b43_hw_ops = {
+ 	.tx			= b43_op_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.conf_tx		= b43_op_conf_tx,
+ 	.add_interface		= b43_op_add_interface,
+ 	.remove_interface	= b43_op_remove_interface,
+--- a/drivers/net/wireless/broadcom/b43legacy/main.c
++++ b/drivers/net/wireless/broadcom/b43legacy/main.c
+@@ -3532,6 +3532,7 @@ static int b43legacy_op_get_survey(struc
+ 
+ static const struct ieee80211_ops b43legacy_hw_ops = {
+ 	.tx			= b43legacy_op_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.conf_tx		= b43legacy_op_conf_tx,
+ 	.add_interface		= b43legacy_op_add_interface,
+ 	.remove_interface	= b43legacy_op_remove_interface,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
+@@ -962,6 +962,7 @@ static int brcms_ops_beacon_set_tim(stru
+ 
+ static const struct ieee80211_ops brcms_ops = {
+ 	.tx = brcms_ops_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = brcms_ops_start,
+ 	.stop = brcms_ops_stop,
+ 	.add_interface = brcms_ops_add_interface,
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -3439,6 +3439,7 @@ static const struct attribute_group il39
+ 
+ static struct ieee80211_ops il3945_mac_ops __ro_after_init = {
+ 	.tx = il3945_mac_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = il3945_mac_start,
+ 	.stop = il3945_mac_stop,
+ 	.add_interface = il_mac_add_interface,
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -6308,6 +6308,7 @@ il4965_tx_queue_set_status(struct il_pri
+ 
+ static const struct ieee80211_ops il4965_mac_ops = {
+ 	.tx = il4965_mac_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = il4965_mac_start,
+ 	.stop = il4965_mac_stop,
+ 	.add_interface = il_mac_add_interface,
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c
+@@ -1571,6 +1571,7 @@ static void iwlagn_mac_sta_notify(struct
+ 
+ const struct ieee80211_ops iwlagn_hw_ops = {
+ 	.tx = iwlagn_mac_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = iwlagn_mac_start,
+ 	.stop = iwlagn_mac_stop,
+ #ifdef CONFIG_PM_SLEEP
+--- a/drivers/net/wireless/intersil/p54/main.c
++++ b/drivers/net/wireless/intersil/p54/main.c
+@@ -705,6 +705,7 @@ static void p54_set_coverage_class(struc
+ 
+ static const struct ieee80211_ops p54_ops = {
+ 	.tx			= p54_tx_80211,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= p54_start,
+ 	.stop			= p54_stop,
+ 	.add_interface		= p54_add_interface,
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3109,6 +3109,7 @@ static int mac80211_hwsim_change_sta_lin
+ 
+ #define HWSIM_COMMON_OPS					\
+ 	.tx = mac80211_hwsim_tx,				\
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,	\
+ 	.start = mac80211_hwsim_start,				\
+ 	.stop = mac80211_hwsim_stop,				\
+ 	.add_interface = mac80211_hwsim_add_interface,		\
+--- a/drivers/net/wireless/marvell/libertas_tf/main.c
++++ b/drivers/net/wireless/marvell/libertas_tf/main.c
+@@ -474,6 +474,7 @@ static int lbtf_op_get_survey(struct iee
+ 
+ static const struct ieee80211_ops lbtf_ops = {
+ 	.tx			= lbtf_op_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= lbtf_op_start,
+ 	.stop			= lbtf_op_stop,
+ 	.add_interface		= lbtf_op_add_interface,
+--- a/drivers/net/wireless/marvell/mwl8k.c
++++ b/drivers/net/wireless/marvell/mwl8k.c
+@@ -5611,6 +5611,7 @@ static void mwl8k_sw_scan_complete(struc
+ 
+ static const struct ieee80211_ops mwl8k_ops = {
+ 	.tx			= mwl8k_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= mwl8k_start,
+ 	.stop			= mwl8k_stop,
+ 	.add_interface		= mwl8k_add_interface,
+--- a/drivers/net/wireless/mediatek/mt7601u/main.c
++++ b/drivers/net/wireless/mediatek/mt7601u/main.c
+@@ -406,6 +406,7 @@ out:
+ 
+ const struct ieee80211_ops mt7601u_ops = {
+ 	.tx = mt7601u_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = mt7601u_start,
+ 	.stop = mt7601u_stop,
+ 	.add_interface = mt7601u_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
+@@ -1706,6 +1706,7 @@ static int rt2400pci_tx_last_beacon(stru
+ 
+ static const struct ieee80211_ops rt2400pci_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2500pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2500pci.c
+@@ -2004,6 +2004,7 @@ static int rt2500pci_tx_last_beacon(stru
+ 
+ static const struct ieee80211_ops rt2500pci_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2500usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2500usb.c
+@@ -1795,6 +1795,7 @@ static int rt2500usb_probe_hw(struct rt2
+ 
+ static const struct ieee80211_ops rt2500usb_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
+@@ -288,6 +288,7 @@ static int rt2800pci_read_eeprom(struct
+ 
+ static const struct ieee80211_ops rt2800pci_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+@@ -133,6 +133,7 @@ static int rt2800soc_write_firmware(stru
+ 
+ static const struct ieee80211_ops rt2800soc_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
+@@ -630,6 +630,7 @@ static int rt2800usb_probe_hw(struct rt2
+ 
+ static const struct ieee80211_ops rt2800usb_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt61pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt61pci.c
+@@ -2873,6 +2873,7 @@ static u64 rt61pci_get_tsf(struct ieee80
+ 
+ static const struct ieee80211_ops rt61pci_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt73usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt73usb.c
+@@ -2292,6 +2292,7 @@ static u64 rt73usb_get_tsf(struct ieee80
+ 
+ static const struct ieee80211_ops rt73usb_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
+@@ -1608,6 +1608,7 @@ static void rtl8180_configure_filter(str
+ 
+ static const struct ieee80211_ops rtl8180_ops = {
+ 	.tx			= rtl8180_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rtl8180_start,
+ 	.stop			= rtl8180_stop,
+ 	.add_interface		= rtl8180_add_interface,
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+@@ -1378,6 +1378,7 @@ static int rtl8187_conf_tx(struct ieee80
+ 
+ static const struct ieee80211_ops rtl8187_ops = {
+ 	.tx			= rtl8187_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rtl8187_start,
+ 	.stop			= rtl8187_stop,
+ 	.add_interface		= rtl8187_add_interface,
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -6548,6 +6548,7 @@ static void rtl8xxxu_stop(struct ieee802
+ 
+ static const struct ieee80211_ops rtl8xxxu_ops = {
+ 	.tx = rtl8xxxu_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.add_interface = rtl8xxxu_add_interface,
+ 	.remove_interface = rtl8xxxu_remove_interface,
+ 	.config = rtl8xxxu_config,
+--- a/drivers/net/wireless/realtek/rtlwifi/core.c
++++ b/drivers/net/wireless/realtek/rtlwifi/core.c
+@@ -1912,6 +1912,7 @@ const struct ieee80211_ops rtl_ops = {
+ 	.start = rtl_op_start,
+ 	.stop = rtl_op_stop,
+ 	.tx = rtl_op_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.add_interface = rtl_op_add_interface,
+ 	.remove_interface = rtl_op_remove_interface,
+ 	.change_interface = rtl_op_change_interface,
+--- a/drivers/net/wireless/realtek/rtw88/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw88/mac80211.c
+@@ -896,6 +896,7 @@ static void rtw_ops_sta_rc_update(struct
+ 
+ const struct ieee80211_ops rtw_ops = {
+ 	.tx			= rtw_ops_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.wake_tx_queue		= rtw_ops_wake_tx_queue,
+ 	.start			= rtw_ops_start,
+ 	.stop			= rtw_ops_stop,
+--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
+@@ -918,6 +918,7 @@ static int rtw89_ops_set_tid_config(stru
+ 
+ const struct ieee80211_ops rtw89_ops = {
+ 	.tx			= rtw89_ops_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.wake_tx_queue		= rtw89_ops_wake_tx_queue,
+ 	.start			= rtw89_ops_start,
+ 	.stop			= rtw89_ops_stop,
+--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
++++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+@@ -1958,6 +1958,7 @@ static int rsi_mac80211_resume(struct ie
+ 
+ static const struct ieee80211_ops mac80211_ops = {
+ 	.tx = rsi_mac80211_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = rsi_mac80211_start,
+ 	.stop = rsi_mac80211_stop,
+ 	.add_interface = rsi_mac80211_add_interface,
+--- a/drivers/net/wireless/st/cw1200/main.c
++++ b/drivers/net/wireless/st/cw1200/main.c
+@@ -209,6 +209,7 @@ static const struct ieee80211_ops cw1200
+ 	.remove_interface	= cw1200_remove_interface,
+ 	.change_interface	= cw1200_change_interface,
+ 	.tx			= cw1200_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.hw_scan		= cw1200_hw_scan,
+ 	.set_tim		= cw1200_set_tim,
+ 	.sta_notify		= cw1200_sta_notify,
+--- a/drivers/net/wireless/ti/wl1251/main.c
++++ b/drivers/net/wireless/ti/wl1251/main.c
+@@ -1359,6 +1359,7 @@ static const struct ieee80211_ops wl1251
+ 	.prepare_multicast = wl1251_op_prepare_multicast,
+ 	.configure_filter = wl1251_op_configure_filter,
+ 	.tx = wl1251_op_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.set_key = wl1251_op_set_key,
+ 	.hw_scan = wl1251_op_hw_scan,
+ 	.bss_info_changed = wl1251_op_bss_info_changed,
+--- a/drivers/net/wireless/ti/wlcore/main.c
++++ b/drivers/net/wireless/ti/wlcore/main.c
+@@ -5942,6 +5942,7 @@ static const struct ieee80211_ops wl1271
+ 	.prepare_multicast = wl1271_op_prepare_multicast,
+ 	.configure_filter = wl1271_op_configure_filter,
+ 	.tx = wl1271_op_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.set_key = wlcore_op_set_key,
+ 	.hw_scan = wl1271_op_hw_scan,
+ 	.cancel_hw_scan = wl1271_op_cancel_hw_scan,
+--- a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
++++ b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
+@@ -1344,6 +1344,7 @@ static u64 zd_op_get_tsf(struct ieee8021
+ 
+ static const struct ieee80211_ops zd_ops = {
+ 	.tx			= zd_op_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= zd_op_start,
+ 	.stop			= zd_op_stop,
+ 	.add_interface		= zd_op_add_interface,
diff --git a/package/kernel/mac80211/patches/subsys/306-03-v6.2-wifi-mac80211-Drop-support-for-TX-push-path.patch b/package/kernel/mac80211/patches/subsys/306-03-v6.2-wifi-mac80211-Drop-support-for-TX-push-path.patch
new file mode 100644
index 000000000..f9f9977ce
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/306-03-v6.2-wifi-mac80211-Drop-support-for-TX-push-path.patch
@@ -0,0 +1,683 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Sun, 9 Oct 2022 18:30:40 +0200
+Subject: [PATCH] wifi: mac80211: Drop support for TX push path
+
+All drivers are now using mac80211 internal queues (iTXQs).
+Drop mac80211 internal support for the old push path.
+
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4346,9 +4346,6 @@ static int ieee80211_get_txq_stats(struc
+ 	struct ieee80211_sub_if_data *sdata;
+ 	int ret = 0;
+ 
+-	if (!local->ops->wake_tx_queue)
+-		return 1;
+-
+ 	spin_lock_bh(&local->fq.lock);
+ 	rcu_read_lock();
+ 
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -663,9 +663,7 @@ void debugfs_hw_add(struct ieee80211_loc
+ 	DEBUGFS_ADD_MODE(force_tx_status, 0600);
+ 	DEBUGFS_ADD_MODE(aql_enable, 0600);
+ 	DEBUGFS_ADD(aql_pending);
+-
+-	if (local->ops->wake_tx_queue)
+-		DEBUGFS_ADD_MODE(aqm, 0600);
++	DEBUGFS_ADD_MODE(aqm, 0600);
+ 
+ 	DEBUGFS_ADD_MODE(airtime_flags, 0600);
+ 
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -677,8 +677,7 @@ static void add_common_files(struct ieee
+ 	DEBUGFS_ADD(rc_rateidx_vht_mcs_mask_5ghz);
+ 	DEBUGFS_ADD(hw_queues);
+ 
+-	if (sdata->local->ops->wake_tx_queue &&
+-	    sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
++	if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
+ 	    sdata->vif.type != NL80211_IFTYPE_NAN)
+ 		DEBUGFS_ADD(aqm);
+ }
+--- a/net/mac80211/debugfs_sta.c
++++ b/net/mac80211/debugfs_sta.c
+@@ -1057,10 +1057,8 @@ void ieee80211_sta_debugfs_add(struct st
+ 	DEBUGFS_ADD_COUNTER(rx_fragments, deflink.rx_stats.fragments);
+ 	DEBUGFS_ADD_COUNTER(tx_filtered, deflink.status_stats.filtered);
+ 
+-	if (local->ops->wake_tx_queue) {
+-		DEBUGFS_ADD(aqm);
+-		DEBUGFS_ADD(airtime);
+-	}
++	DEBUGFS_ADD(aqm);
++	DEBUGFS_ADD(airtime);
+ 
+ 	if (wiphy_ext_feature_isset(local->hw.wiphy,
+ 				    NL80211_EXT_FEATURE_AQL))
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -2294,7 +2294,6 @@ void ieee80211_wake_queue_by_reason(stru
+ void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
+ 				    enum queue_stop_reason reason,
+ 				    bool refcounted);
+-void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue);
+ void ieee80211_add_pending_skb(struct ieee80211_local *local,
+ 			       struct sk_buff *skb);
+ void ieee80211_add_pending_skbs(struct ieee80211_local *local,
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -460,12 +460,6 @@ static void ieee80211_do_stop(struct iee
+ 	if (cancel_scan)
+ 		ieee80211_scan_cancel(local);
+ 
+-	/*
+-	 * Stop TX on this interface first.
+-	 */
+-	if (!local->ops->wake_tx_queue && sdata->dev)
+-		netif_tx_stop_all_queues(sdata->dev);
+-
+ 	ieee80211_roc_purge(local, sdata);
+ 
+ 	switch (sdata->vif.type) {
+@@ -813,13 +807,6 @@ static void ieee80211_uninit(struct net_
+ 	ieee80211_teardown_sdata(IEEE80211_DEV_TO_SUB_IF(dev));
+ }
+ 
+-static u16 ieee80211_netdev_select_queue(struct net_device *dev,
+-					 struct sk_buff *skb,
+-					 struct net_device *sb_dev)
+-{
+-	return ieee80211_select_queue(IEEE80211_DEV_TO_SUB_IF(dev), skb);
+-}
+-
+ static void
+ ieee80211_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
+ {
+@@ -833,7 +820,6 @@ static const struct net_device_ops ieee8
+ 	.ndo_start_xmit		= ieee80211_subif_start_xmit,
+ 	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
+ 	.ndo_set_mac_address 	= ieee80211_change_mac,
+-	.ndo_select_queue	= ieee80211_netdev_select_queue,
+ 	.ndo_get_stats64	= ieee80211_get_stats64,
+ };
+ 
+@@ -941,7 +927,6 @@ static const struct net_device_ops ieee8
+ 	.ndo_start_xmit		= ieee80211_subif_start_xmit_8023,
+ 	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
+ 	.ndo_set_mac_address	= ieee80211_change_mac,
+-	.ndo_select_queue	= ieee80211_netdev_select_queue,
+ 	.ndo_get_stats64	= ieee80211_get_stats64,
+ 	.ndo_fill_forward_path	= ieee80211_netdev_fill_forward_path,
+ };
+@@ -1443,35 +1428,6 @@ int ieee80211_do_open(struct wireless_de
+ 
+ 	ieee80211_recalc_ps(local);
+ 
+-	if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+-	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+-	    local->ops->wake_tx_queue) {
+-		/* XXX: for AP_VLAN, actually track AP queues */
+-		if (dev)
+-			netif_tx_start_all_queues(dev);
+-	} else if (dev) {
+-		unsigned long flags;
+-		int n_acs = IEEE80211_NUM_ACS;
+-		int ac;
+-
+-		if (local->hw.queues < IEEE80211_NUM_ACS)
+-			n_acs = 1;
+-
+-		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+-		if (sdata->vif.cab_queue == IEEE80211_INVAL_HW_QUEUE ||
+-		    (local->queue_stop_reasons[sdata->vif.cab_queue] == 0 &&
+-		     skb_queue_empty(&local->pending[sdata->vif.cab_queue]))) {
+-			for (ac = 0; ac < n_acs; ac++) {
+-				int ac_queue = sdata->vif.hw_queue[ac];
+-
+-				if (local->queue_stop_reasons[ac_queue] == 0 &&
+-				    skb_queue_empty(&local->pending[ac_queue]))
+-					netif_start_subqueue(dev, ac);
+-			}
+-		}
+-		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+-	}
+-
+ 	set_bit(SDATA_STATE_RUNNING, &sdata->state);
+ 
+ 	return 0;
+@@ -1501,17 +1457,12 @@ static void ieee80211_if_setup(struct ne
+ {
+ 	ether_setup(dev);
+ 	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
++	dev->priv_flags |= IFF_NO_QUEUE;
+ 	dev->netdev_ops = &ieee80211_dataif_ops;
+ 	dev->needs_free_netdev = true;
+ 	dev->priv_destructor = ieee80211_if_free;
+ }
+ 
+-static void ieee80211_if_setup_no_queue(struct net_device *dev)
+-{
+-	ieee80211_if_setup(dev);
+-	dev->priv_flags |= IFF_NO_QUEUE;
+-}
+-
+ static void ieee80211_iface_process_skb(struct ieee80211_local *local,
+ 					struct ieee80211_sub_if_data *sdata,
+ 					struct sk_buff *skb)
+@@ -2096,9 +2047,7 @@ int ieee80211_if_add(struct ieee80211_lo
+ 	struct net_device *ndev = NULL;
+ 	struct ieee80211_sub_if_data *sdata = NULL;
+ 	struct txq_info *txqi;
+-	void (*if_setup)(struct net_device *dev);
+ 	int ret, i;
+-	int txqs = 1;
+ 
+ 	ASSERT_RTNL();
+ 
+@@ -2121,30 +2070,18 @@ int ieee80211_if_add(struct ieee80211_lo
+ 				 sizeof(void *));
+ 		int txq_size = 0;
+ 
+-		if (local->ops->wake_tx_queue &&
+-		    type != NL80211_IFTYPE_AP_VLAN &&
++		if (type != NL80211_IFTYPE_AP_VLAN &&
+ 		    (type != NL80211_IFTYPE_MONITOR ||
+ 		     (params->flags & MONITOR_FLAG_ACTIVE)))
+ 			txq_size += sizeof(struct txq_info) +
+ 				    local->hw.txq_data_size;
+ 
+-		if (local->ops->wake_tx_queue) {
+-			if_setup = ieee80211_if_setup_no_queue;
+-		} else {
+-			if_setup = ieee80211_if_setup;
+-			if (local->hw.queues >= IEEE80211_NUM_ACS)
+-				txqs = IEEE80211_NUM_ACS;
+-		}
+-
+ 		ndev = alloc_netdev_mqs(size + txq_size,
+ 					name, name_assign_type,
+-					if_setup, txqs, 1);
++					ieee80211_if_setup, 1, 1);
+ 		if (!ndev)
+ 			return -ENOMEM;
+ 
+-		if (!local->ops->wake_tx_queue && local->hw.wiphy->tx_queue_len)
+-			ndev->tx_queue_len = local->hw.wiphy->tx_queue_len;
+-
+ 		dev_net_set(ndev, wiphy_net(local->hw.wiphy));
+ 
+ 		ndev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -630,7 +630,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 
+ 	if (WARN_ON(!ops->tx || !ops->start || !ops->stop || !ops->config ||
+ 		    !ops->add_interface || !ops->remove_interface ||
+-		    !ops->configure_filter))
++		    !ops->configure_filter || !ops->wake_tx_queue))
+ 		return NULL;
+ 
+ 	if (WARN_ON(ops->sta_state && (ops->sta_add || ops->sta_remove)))
+@@ -719,9 +719,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 	if (!ops->set_key)
+ 		wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
+ 
+-	if (ops->wake_tx_queue)
+-		wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_TXQS);
+-
++	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_TXQS);
+ 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_RRM);
+ 
+ 	wiphy->bss_priv_size = sizeof(struct ieee80211_bss);
+@@ -834,10 +832,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 		atomic_set(&local->agg_queue_stop[i], 0);
+ 	}
+ 	tasklet_setup(&local->tx_pending_tasklet, ieee80211_tx_pending);
+-
+-	if (ops->wake_tx_queue)
+-		tasklet_setup(&local->wake_txqs_tasklet, ieee80211_wake_txqs);
+-
++	tasklet_setup(&local->wake_txqs_tasklet, ieee80211_wake_txqs);
+ 	tasklet_setup(&local->tasklet, ieee80211_tasklet_handler);
+ 
+ 	skb_queue_head_init(&local->skb_queue);
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1571,9 +1571,6 @@ static void sta_ps_start(struct sta_info
+ 
+ 	ieee80211_clear_fast_xmit(sta);
+ 
+-	if (!sta->sta.txq[0])
+-		return;
+-
+ 	for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
+ 		struct ieee80211_txq *txq = sta->sta.txq[tid];
+ 		struct txq_info *txqi = to_txq_info(txq);
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -140,17 +140,15 @@ static void __cleanup_single_sta(struct
+ 		atomic_dec(&ps->num_sta_ps);
+ 	}
+ 
+-	if (sta->sta.txq[0]) {
+-		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
+-			struct txq_info *txqi;
++	for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
++		struct txq_info *txqi;
+ 
+-			if (!sta->sta.txq[i])
+-				continue;
++		if (!sta->sta.txq[i])
++			continue;
+ 
+-			txqi = to_txq_info(sta->sta.txq[i]);
++		txqi = to_txq_info(sta->sta.txq[i]);
+ 
+-			ieee80211_txq_purge(local, txqi);
+-		}
++		ieee80211_txq_purge(local, txqi);
+ 	}
+ 
+ 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+@@ -425,8 +423,7 @@ void sta_info_free(struct ieee80211_loca
+ 
+ 	sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
+ 
+-	if (sta->sta.txq[0])
+-		kfree(to_txq_info(sta->sta.txq[0]));
++	kfree(to_txq_info(sta->sta.txq[0]));
+ 	kfree(rcu_dereference_raw(sta->sta.rates));
+ #ifdef CPTCFG_MAC80211_MESH
+ 	kfree(sta->mesh);
+@@ -527,6 +524,8 @@ __sta_info_alloc(struct ieee80211_sub_if
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_hw *hw = &local->hw;
+ 	struct sta_info *sta;
++	void *txq_data;
++	int size;
+ 	int i;
+ 
+ 	sta = kzalloc(sizeof(*sta) + hw->sta_data_size, gfp);
+@@ -597,21 +596,18 @@ __sta_info_alloc(struct ieee80211_sub_if
+ 
+ 	sta->last_connected = ktime_get_seconds();
+ 
+-	if (local->ops->wake_tx_queue) {
+-		void *txq_data;
+-		int size = sizeof(struct txq_info) +
+-			   ALIGN(hw->txq_data_size, sizeof(void *));
++	size = sizeof(struct txq_info) +
++	       ALIGN(hw->txq_data_size, sizeof(void *));
+ 
+-		txq_data = kcalloc(ARRAY_SIZE(sta->sta.txq), size, gfp);
+-		if (!txq_data)
+-			goto free;
++	txq_data = kcalloc(ARRAY_SIZE(sta->sta.txq), size, gfp);
++	if (!txq_data)
++		goto free;
+ 
+-		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
+-			struct txq_info *txq = txq_data + i * size;
++	for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
++		struct txq_info *txq = txq_data + i * size;
+ 
+-			/* might not do anything for the bufferable MMPDU TXQ */
+-			ieee80211_txq_init(sdata, sta, txq, i);
+-		}
++		/* might not do anything for the (bufferable) MMPDU TXQ */
++		ieee80211_txq_init(sdata, sta, txq, i);
+ 	}
+ 
+ 	if (sta_prepare_rate_control(local, sta, gfp))
+@@ -685,8 +681,7 @@ __sta_info_alloc(struct ieee80211_sub_if
+ 	return sta;
+ 
+ free_txq:
+-	if (sta->sta.txq[0])
+-		kfree(to_txq_info(sta->sta.txq[0]));
++	kfree(to_txq_info(sta->sta.txq[0]));
+ free:
+ 	sta_info_free_link(&sta->deflink);
+ #ifdef CPTCFG_MAC80211_MESH
+@@ -1960,9 +1955,6 @@ ieee80211_sta_ps_deliver_response(struct
+ 		 * TIM recalculation.
+ 		 */
+ 
+-		if (!sta->sta.txq[0])
+-			return;
+-
+ 		for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
+ 			if (!sta->sta.txq[tid] ||
+ 			    !(driver_release_tids & BIT(tid)) ||
+@@ -2447,7 +2439,7 @@ static void sta_set_tidstats(struct sta_
+ 		tidstats->tx_msdu_failed = sta->deflink.status_stats.msdu_failed[tid];
+ 	}
+ 
+-	if (local->ops->wake_tx_queue && tid < IEEE80211_NUM_TIDS) {
++	if (tid < IEEE80211_NUM_TIDS) {
+ 		spin_lock_bh(&local->fq.lock);
+ 		rcu_read_lock();
+ 
+@@ -2775,9 +2767,6 @@ unsigned long ieee80211_sta_last_active(
+ 
+ static void sta_update_codel_params(struct sta_info *sta, u32 thr)
+ {
+-	if (!sta->sdata->local->ops->wake_tx_queue)
+-		return;
+-
+ 	if (thr && thr < STA_SLOW_THRESHOLD * sta->local->num_sta) {
+ 		sta->cparams.target = MS2TIME(50);
+ 		sta->cparams.interval = MS2TIME(300);
+--- a/net/mac80211/tdls.c
++++ b/net/mac80211/tdls.c
+@@ -1016,7 +1016,6 @@ ieee80211_tdls_prep_mgmt_packet(struct w
+ 		skb->priority = 256 + 5;
+ 		break;
+ 	}
+-	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, skb));
+ 
+ 	/*
+ 	 * Set the WLAN_TDLS_TEARDOWN flag to indicate a teardown in progress.
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1600,9 +1600,6 @@ int ieee80211_txq_setup_flows(struct iee
+ 	bool supp_vht = false;
+ 	enum nl80211_band band;
+ 
+-	if (!local->ops->wake_tx_queue)
+-		return 0;
+-
+ 	ret = fq_init(fq, 4096);
+ 	if (ret)
+ 		return ret;
+@@ -1650,9 +1647,6 @@ void ieee80211_txq_teardown_flows(struct
+ {
+ 	struct fq *fq = &local->fq;
+ 
+-	if (!local->ops->wake_tx_queue)
+-		return;
+-
+ 	kfree(local->cvars);
+ 	local->cvars = NULL;
+ 
+@@ -1669,8 +1663,7 @@ static bool ieee80211_queue_skb(struct i
+ 	struct ieee80211_vif *vif;
+ 	struct txq_info *txqi;
+ 
+-	if (!local->ops->wake_tx_queue ||
+-	    sdata->vif.type == NL80211_IFTYPE_MONITOR)
++	if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
+ 		return false;
+ 
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+@@ -4193,12 +4186,7 @@ void __ieee80211_subif_start_xmit(struct
+ 	if (IS_ERR(sta))
+ 		sta = NULL;
+ 
+-	if (local->ops->wake_tx_queue) {
+-		u16 queue = __ieee80211_select_queue(sdata, sta, skb);
+-		skb_set_queue_mapping(skb, queue);
+-		skb_get_hash(skb);
+-	}
+-
++	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
+ 	ieee80211_aggr_check(sdata, sta, skb);
+ 
+ 	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
+@@ -4509,11 +4497,7 @@ static void ieee80211_8023_xmit(struct i
+ 	struct tid_ampdu_tx *tid_tx;
+ 	u8 tid;
+ 
+-	if (local->ops->wake_tx_queue) {
+-		u16 queue = __ieee80211_select_queue(sdata, sta, skb);
+-		skb_set_queue_mapping(skb, queue);
+-		skb_get_hash(skb);
+-	}
++	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
+ 
+ 	if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)) &&
+ 	    test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
+@@ -4767,9 +4751,6 @@ void ieee80211_tx_pending(struct tasklet
+ 			if (!txok)
+ 				break;
+ 		}
+-
+-		if (skb_queue_empty(&local->pending[i]))
+-			ieee80211_propagate_queue_wake(local, i);
+ 	}
+ 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+ 
+@@ -5962,10 +5943,9 @@ int ieee80211_tx_control_port(struct wip
+ 	}
+ 
+ 	if (!IS_ERR(sta)) {
+-		u16 queue = __ieee80211_select_queue(sdata, sta, skb);
++		u16 queue = ieee80211_select_queue(sdata, sta, skb);
+ 
+ 		skb_set_queue_mapping(skb, queue);
+-		skb_get_hash(skb);
+ 
+ 		/*
+ 		 * for MLO STA, the SA should be the AP MLD address, but
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -444,39 +444,6 @@ void ieee80211_wake_txqs(struct tasklet_
+ 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+ }
+ 
+-void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
+-{
+-	struct ieee80211_sub_if_data *sdata;
+-	int n_acs = IEEE80211_NUM_ACS;
+-
+-	if (local->ops->wake_tx_queue)
+-		return;
+-
+-	if (local->hw.queues < IEEE80211_NUM_ACS)
+-		n_acs = 1;
+-
+-	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+-		int ac;
+-
+-		if (!sdata->dev)
+-			continue;
+-
+-		if (sdata->vif.cab_queue != IEEE80211_INVAL_HW_QUEUE &&
+-		    local->queue_stop_reasons[sdata->vif.cab_queue] != 0)
+-			continue;
+-
+-		for (ac = 0; ac < n_acs; ac++) {
+-			int ac_queue = sdata->vif.hw_queue[ac];
+-
+-			if (ac_queue == queue ||
+-			    (sdata->vif.cab_queue == queue &&
+-			     local->queue_stop_reasons[ac_queue] == 0 &&
+-			     skb_queue_empty(&local->pending[ac_queue])))
+-				netif_wake_subqueue(sdata->dev, ac);
+-		}
+-	}
+-}
+-
+ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
+ 				   enum queue_stop_reason reason,
+ 				   bool refcounted,
+@@ -507,11 +474,7 @@ static void __ieee80211_wake_queue(struc
+ 		/* someone still has this queue stopped */
+ 		return;
+ 
+-	if (skb_queue_empty(&local->pending[queue])) {
+-		rcu_read_lock();
+-		ieee80211_propagate_queue_wake(local, queue);
+-		rcu_read_unlock();
+-	} else
++	if (!skb_queue_empty(&local->pending[queue]))
+ 		tasklet_schedule(&local->tx_pending_tasklet);
+ 
+ 	/*
+@@ -521,12 +484,10 @@ static void __ieee80211_wake_queue(struc
+ 	 * release someone's lock, but it is fine because all the callers of
+ 	 * __ieee80211_wake_queue call it right before releasing the lock.
+ 	 */
+-	if (local->ops->wake_tx_queue) {
+-		if (reason == IEEE80211_QUEUE_STOP_REASON_DRIVER)
+-			tasklet_schedule(&local->wake_txqs_tasklet);
+-		else
+-			_ieee80211_wake_txqs(local, flags);
+-	}
++	if (reason == IEEE80211_QUEUE_STOP_REASON_DRIVER)
++		tasklet_schedule(&local->wake_txqs_tasklet);
++	else
++		_ieee80211_wake_txqs(local, flags);
+ }
+ 
+ void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
+@@ -554,8 +515,6 @@ static void __ieee80211_stop_queue(struc
+ 				   bool refcounted)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+-	struct ieee80211_sub_if_data *sdata;
+-	int n_acs = IEEE80211_NUM_ACS;
+ 
+ 	trace_stop_queue(local, queue, reason);
+ 
+@@ -567,27 +526,7 @@ static void __ieee80211_stop_queue(struc
+ 	else
+ 		local->q_stop_reasons[queue][reason]++;
+ 
+-	if (__test_and_set_bit(reason, &local->queue_stop_reasons[queue]))
+-		return;
+-
+-	if (local->hw.queues < IEEE80211_NUM_ACS)
+-		n_acs = 1;
+-
+-	rcu_read_lock();
+-	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+-		int ac;
+-
+-		if (!sdata->dev)
+-			continue;
+-
+-		for (ac = 0; ac < n_acs; ac++) {
+-			if (!local->ops->wake_tx_queue &&
+-			    (sdata->vif.hw_queue[ac] == queue ||
+-			     sdata->vif.cab_queue == queue))
+-				netif_stop_subqueue(sdata->dev, ac);
+-		}
+-	}
+-	rcu_read_unlock();
++	set_bit(reason, &local->queue_stop_reasons[queue]);
+ }
+ 
+ void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
+--- a/net/mac80211/wme.c
++++ b/net/mac80211/wme.c
+@@ -122,6 +122,9 @@ u16 ieee80211_select_queue_80211(struct
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	u8 *p;
+ 
++	/* Ensure hash is set prior to potential SW encryption */
++	skb_get_hash(skb);
++
+ 	if ((info->control.flags & IEEE80211_TX_CTRL_DONT_REORDER) ||
+ 	    local->hw.queues < IEEE80211_NUM_ACS)
+ 		return 0;
+@@ -141,13 +144,16 @@ u16 ieee80211_select_queue_80211(struct
+ 	return ieee80211_downgrade_queue(sdata, NULL, skb);
+ }
+ 
+-u16 __ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+-			     struct sta_info *sta, struct sk_buff *skb)
++u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
++			   struct sta_info *sta, struct sk_buff *skb)
+ {
+ 	const struct ethhdr *eth = (void *)skb->data;
+ 	struct mac80211_qos_map *qos_map;
+ 	bool qos;
+ 
++	/* Ensure hash is set prior to potential SW encryption */
++	skb_get_hash(skb);
++
+ 	/* all mesh/ocb stations are required to support WME */
+ 	if ((sdata->vif.type == NL80211_IFTYPE_MESH_POINT &&
+ 	    !is_multicast_ether_addr(eth->h_dest)) ||
+@@ -178,59 +184,6 @@ u16 __ieee80211_select_queue(struct ieee
+ 	return ieee80211_downgrade_queue(sdata, sta, skb);
+ }
+ 
+-
+-/* Indicate which queue to use. */
+-u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+-			   struct sk_buff *skb)
+-{
+-	struct ieee80211_local *local = sdata->local;
+-	struct sta_info *sta = NULL;
+-	const u8 *ra = NULL;
+-	u16 ret;
+-
+-	/* when using iTXQ, we can do this later */
+-	if (local->ops->wake_tx_queue)
+-		return 0;
+-
+-	if (local->hw.queues < IEEE80211_NUM_ACS || skb->len < 6) {
+-		skb->priority = 0; /* required for correct WPA/11i MIC */
+-		return 0;
+-	}
+-
+-	rcu_read_lock();
+-	switch (sdata->vif.type) {
+-	case NL80211_IFTYPE_AP_VLAN:
+-		sta = rcu_dereference(sdata->u.vlan.sta);
+-		if (sta)
+-			break;
+-		fallthrough;
+-	case NL80211_IFTYPE_AP:
+-		ra = skb->data;
+-		break;
+-	case NL80211_IFTYPE_STATION:
+-		/* might be a TDLS station */
+-		sta = sta_info_get(sdata, skb->data);
+-		if (sta)
+-			break;
+-
+-		ra = sdata->deflink.u.mgd.bssid;
+-		break;
+-	case NL80211_IFTYPE_ADHOC:
+-		ra = skb->data;
+-		break;
+-	default:
+-		break;
+-	}
+-
+-	if (!sta && ra && !is_multicast_ether_addr(ra))
+-		sta = sta_info_get(sdata, ra);
+-
+-	ret = __ieee80211_select_queue(sdata, sta, skb);
+-
+-	rcu_read_unlock();
+-	return ret;
+-}
+-
+ /**
+  * ieee80211_set_qos_hdr - Fill in the QoS header if there is one.
+  *
+--- a/net/mac80211/wme.h
++++ b/net/mac80211/wme.h
+@@ -13,10 +13,8 @@
+ u16 ieee80211_select_queue_80211(struct ieee80211_sub_if_data *sdata,
+ 				 struct sk_buff *skb,
+ 				 struct ieee80211_hdr *hdr);
+-u16 __ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+-			     struct sta_info *sta, struct sk_buff *skb);
+ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+-			   struct sk_buff *skb);
++			   struct sta_info *sta, struct sk_buff *skb);
+ void ieee80211_set_qos_hdr(struct ieee80211_sub_if_data *sdata,
+ 			   struct sk_buff *skb);
+ 
diff --git a/package/kernel/mac80211/patches/subsys/306-04-v6.2-wifi-realtek-remove-duplicated-wake_tx_queue.patch b/package/kernel/mac80211/patches/subsys/306-04-v6.2-wifi-realtek-remove-duplicated-wake_tx_queue.patch
new file mode 100644
index 000000000..f0dfc75a7
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/306-04-v6.2-wifi-realtek-remove-duplicated-wake_tx_queue.patch
@@ -0,0 +1,32 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 10 Oct 2022 19:17:46 +0200
+Subject: [PATCH] wifi: realtek: remove duplicated wake_tx_queue
+
+By accident, the previous patch duplicated the initialization
+of the wake_tx_queue callback. Fix that by removing the new
+initializations.
+
+Fixes: a790cc3a4fad ("wifi: mac80211: add wake_tx_queue callback to drivers")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/drivers/net/wireless/realtek/rtw88/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw88/mac80211.c
+@@ -896,7 +896,6 @@ static void rtw_ops_sta_rc_update(struct
+ 
+ const struct ieee80211_ops rtw_ops = {
+ 	.tx			= rtw_ops_tx,
+-	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.wake_tx_queue		= rtw_ops_wake_tx_queue,
+ 	.start			= rtw_ops_start,
+ 	.stop			= rtw_ops_stop,
+--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
+@@ -918,7 +918,6 @@ static int rtw89_ops_set_tid_config(stru
+ 
+ const struct ieee80211_ops rtw89_ops = {
+ 	.tx			= rtw89_ops_tx,
+-	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.wake_tx_queue		= rtw89_ops_wake_tx_queue,
+ 	.start			= rtw89_ops_start,
+ 	.stop			= rtw89_ops_stop,
diff --git a/package/kernel/mac80211/patches/subsys/306-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch b/package/kernel/mac80211/patches/subsys/306-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch
deleted file mode 100644
index f58d2eb4c..000000000
--- a/package/kernel/mac80211/patches/subsys/306-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From: Xing Song <xing.song@mediatek.com>
-Date: Tue, 23 Nov 2021 11:31:23 +0800
-Subject: [PATCH] mac80211: set up the fwd_skb->dev for mesh forwarding
-
-Mesh forwarding requires that the fwd_skb->dev is set up for TX handling,
-otherwise the following warning will be generated, so set it up for the
-pending frames.
-
-[   72.835674 ] WARNING: CPU: 0 PID: 1193 at __skb_flow_dissect+0x284/0x1298
-[   72.842379 ] Modules linked in: ksmbd pppoe ppp_async l2tp_ppp ...
-[   72.962020 ] CPU: 0 PID: 1193 Comm: kworker/u5:1 Tainted: P S 5.4.137 #0
-[   72.969938 ] Hardware name: MT7622_MT7531 RFB (DT)
-[   72.974659 ] Workqueue: napi_workq napi_workfn
-[   72.979025 ] pstate: 60000005 (nZCv daif -PAN -UAO)
-[   72.983822 ] pc : __skb_flow_dissect+0x284/0x1298
-[   72.988444 ] lr : __skb_flow_dissect+0x54/0x1298
-[   72.992977 ] sp : ffffffc010c738c0
-[   72.996293 ] x29: ffffffc010c738c0 x28: 0000000000000000
-[   73.001615 ] x27: 000000000000ffc2 x26: ffffff800c2eb818
-[   73.006937 ] x25: ffffffc010a987c8 x24: 00000000000000ce
-[   73.012259 ] x23: ffffffc010c73a28 x22: ffffffc010a99c60
-[   73.017581 ] x21: 000000000000ffc2 x20: ffffff80094da800
-[   73.022903 ] x19: 0000000000000000 x18: 0000000000000014
-[   73.028226 ] x17: 00000000084d16af x16: 00000000d1fc0bab
-[   73.033548 ] x15: 00000000715f6034 x14: 000000009dbdd301
-[   73.038870 ] x13: 00000000ea4dcbc3 x12: 0000000000000040
-[   73.044192 ] x11: 000000000eb00ff0 x10: 0000000000000000
-[   73.049513 ] x9 : 000000000eb00073 x8 : 0000000000000088
-[   73.054834 ] x7 : 0000000000000000 x6 : 0000000000000001
-[   73.060155 ] x5 : 0000000000000000 x4 : 0000000000000000
-[   73.065476 ] x3 : ffffffc010a98000 x2 : 0000000000000000
-[   73.070797 ] x1 : 0000000000000000 x0 : 0000000000000000
-[   73.076120 ] Call trace:
-[   73.078572 ]  __skb_flow_dissect+0x284/0x1298
-[   73.082846 ]  __skb_get_hash+0x7c/0x228
-[   73.086629 ]  ieee80211_txq_may_transmit+0x7fc/0x17b8 [mac80211]
-[   73.092564 ]  ieee80211_tx_prepare_skb+0x20c/0x268 [mac80211]
-[   73.098238 ]  ieee80211_tx_pending+0x144/0x330 [mac80211]
-[   73.103560 ]  tasklet_action_common.isra.16+0xb4/0x158
-[   73.108618 ]  tasklet_action+0x2c/0x38
-[   73.112286 ]  __do_softirq+0x168/0x3b0
-[   73.115954 ]  do_softirq.part.15+0x88/0x98
-[   73.119969 ]  __local_bh_enable_ip+0xb0/0xb8
-[   73.124156 ]  napi_workfn+0x58/0x90
-[   73.127565 ]  process_one_work+0x20c/0x478
-[   73.131579 ]  worker_thread+0x50/0x4f0
-[   73.135249 ]  kthread+0x124/0x128
-[   73.138484 ]  ret_from_fork+0x10/0x1c
-
-Signed-off-by: Xing Song <xing.song@mediatek.com>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -2941,6 +2941,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
- 	if (!fwd_skb)
- 		goto out;
- 
-+	fwd_skb->dev = sdata->dev;
- 	fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
- 	fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
- 	info = IEEE80211_SKB_CB(fwd_skb);
diff --git a/package/kernel/mac80211/patches/subsys/308-mac80211-send-ADDBA-requests-using-the-tid-queue-of-.patch b/package/kernel/mac80211/patches/subsys/308-mac80211-send-ADDBA-requests-using-the-tid-queue-of-.patch
deleted file mode 100644
index 1c213289c..000000000
--- a/package/kernel/mac80211/patches/subsys/308-mac80211-send-ADDBA-requests-using-the-tid-queue-of-.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Thu, 2 Dec 2021 13:30:05 +0100
-Subject: [PATCH] mac80211: send ADDBA requests using the tid/queue of the
- aggregation session
-
-Sending them out on a different queue can cause a race condition where a
-number of packets in the queue may be discarded by the receiver, because
-the ADDBA request is sent too early.
-This affects any driver with software A-MPDU setup which does not allocate
-packet seqno in hardware on tx, regardless of whether iTXQ is used or not.
-The only driver I've seen that explicitly deals with this issue internally
-is mwl8k.
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/agg-tx.c
-+++ b/net/mac80211/agg-tx.c
-@@ -106,7 +106,7 @@ static void ieee80211_send_addba_request
- 	mgmt->u.action.u.addba_req.start_seq_num =
- 					cpu_to_le16(start_seq_num << 4);
- 
--	ieee80211_tx_skb(sdata, skb);
-+	ieee80211_tx_skb_tid(sdata, skb, tid);
- }
- 
- void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
diff --git a/package/kernel/mac80211/patches/subsys/309-mac80211-agg-tx-don-t-schedule_and_wake_txq-under-st.patch b/package/kernel/mac80211/patches/subsys/309-mac80211-agg-tx-don-t-schedule_and_wake_txq-under-st.patch
deleted file mode 100644
index 008ee49cf..000000000
--- a/package/kernel/mac80211/patches/subsys/309-mac80211-agg-tx-don-t-schedule_and_wake_txq-under-st.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Mon, 29 Nov 2021 15:32:47 +0200
-Subject: [PATCH] mac80211: agg-tx: don't schedule_and_wake_txq() under
- sta->lock
-
-When we call ieee80211_agg_start_txq(), that will in turn call
-schedule_and_wake_txq(). Called from ieee80211_stop_tx_ba_cb()
-this is done under sta->lock, which leads to certain circular
-lock dependencies, as reported by Chris Murphy:
-https://lore.kernel.org/r/CAJCQCtSXJ5qA4bqSPY=oLRMbv-irihVvP7A2uGutEbXQVkoNaw@mail.gmail.com
-
-In general, ieee80211_agg_start_txq() is usually not called
-with sta->lock held, only in this one place. But it's always
-called with sta->ampdu_mlme.mtx held, and that's therefore
-clearly sufficient.
-
-Change ieee80211_stop_tx_ba_cb() to also call it without the
-sta->lock held, by factoring it out of ieee80211_remove_tid_tx()
-(which is only called in this one place).
-
-This breaks the locking chain and makes it less likely that
-we'll have similar locking chain problems in the future.
-
-Reported-by: Chris Murphy <lists@colorremedies.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
----
-
---- a/net/mac80211/agg-tx.c
-+++ b/net/mac80211/agg-tx.c
-@@ -9,7 +9,7 @@
-  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
-  * Copyright 2007-2010, Intel Corporation
-  * Copyright(c) 2015-2017 Intel Deutschland GmbH
-- * Copyright (C) 2018 - 2020 Intel Corporation
-+ * Copyright (C) 2018 - 2021 Intel Corporation
-  */
- 
- #include <linux/ieee80211.h>
-@@ -213,6 +213,8 @@ ieee80211_agg_start_txq(struct sta_info
- 	struct ieee80211_txq *txq = sta->sta.txq[tid];
- 	struct txq_info *txqi;
- 
-+	lockdep_assert_held(&sta->ampdu_mlme.mtx);
-+
- 	if (!txq)
- 		return;
- 
-@@ -290,7 +292,6 @@ static void ieee80211_remove_tid_tx(stru
- 	ieee80211_assign_tid_tx(sta, tid, NULL);
- 
- 	ieee80211_agg_splice_finish(sta->sdata, tid);
--	ieee80211_agg_start_txq(sta, tid, false);
- 
- 	kfree_rcu(tid_tx, rcu_head);
- }
-@@ -889,6 +890,7 @@ void ieee80211_stop_tx_ba_cb(struct sta_
- {
- 	struct ieee80211_sub_if_data *sdata = sta->sdata;
- 	bool send_delba = false;
-+	bool start_txq = false;
- 
- 	ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n",
- 	       sta->sta.addr, tid);
-@@ -906,10 +908,14 @@ void ieee80211_stop_tx_ba_cb(struct sta_
- 		send_delba = true;
- 
- 	ieee80211_remove_tid_tx(sta, tid);
-+	start_txq = true;
- 
-  unlock_sta:
- 	spin_unlock_bh(&sta->lock);
- 
-+	if (start_txq)
-+		ieee80211_agg_start_txq(sta, tid, false);
-+
- 	if (send_delba)
- 		ieee80211_send_delba(sdata, sta->sta.addr, tid,
- 			WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
diff --git a/package/kernel/mac80211/patches/subsys/310-net-fq_impl-bulk-free-packets-from-a-flow-on-overmem.patch b/package/kernel/mac80211/patches/subsys/310-net-fq_impl-bulk-free-packets-from-a-flow-on-overmem.patch
deleted file mode 100644
index 05a888006..000000000
--- a/package/kernel/mac80211/patches/subsys/310-net-fq_impl-bulk-free-packets-from-a-flow-on-overmem.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 25 Nov 2020 18:03:46 +0100
-Subject: [PATCH] net/fq_impl: bulk-free packets from a flow on overmemory
-
-This is similar to what sch_fq_codel does. It also amortizes the worst
-case cost of a follow-up patch that changes the selection of the biggest
-flow for dropping packets
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/include/net/fq_impl.h
-+++ b/include/net/fq_impl.h
-@@ -11,17 +11,25 @@
- 
- /* functions that are embedded into includer */
- 
-+
-+static void
-+__fq_adjust_removal(struct fq *fq, struct fq_flow *flow, unsigned int packets,
-+		    unsigned int bytes, unsigned int truesize)
-+{
-+	struct fq_tin *tin = flow->tin;
-+
-+	tin->backlog_bytes -= bytes;
-+	tin->backlog_packets -= packets;
-+	flow->backlog -= bytes;
-+	fq->backlog -= packets;
-+	fq->memory_usage -= truesize;
-+}
-+
- static void fq_adjust_removal(struct fq *fq,
- 			      struct fq_flow *flow,
- 			      struct sk_buff *skb)
- {
--	struct fq_tin *tin = flow->tin;
--
--	tin->backlog_bytes -= skb->len;
--	tin->backlog_packets--;
--	flow->backlog -= skb->len;
--	fq->backlog--;
--	fq->memory_usage -= skb->truesize;
-+	__fq_adjust_removal(fq, flow, 1, skb->len, skb->truesize);
- }
- 
- static void fq_rejigger_backlog(struct fq *fq, struct fq_flow *flow)
-@@ -59,6 +67,34 @@ static struct sk_buff *fq_flow_dequeue(s
- 	return skb;
- }
- 
-+static int fq_flow_drop(struct fq *fq, struct fq_flow *flow,
-+			fq_skb_free_t free_func)
-+{
-+	unsigned int packets = 0, bytes = 0, truesize = 0;
-+	struct fq_tin *tin = flow->tin;
-+	struct sk_buff *skb;
-+	int pending;
-+
-+	lockdep_assert_held(&fq->lock);
-+
-+	pending = min_t(int, 32, skb_queue_len(&flow->queue) / 2);
-+	do {
-+		skb = __skb_dequeue(&flow->queue);
-+		if (!skb)
-+			break;
-+
-+		packets++;
-+		bytes += skb->len;
-+		truesize += skb->truesize;
-+		free_func(fq, tin, flow, skb);
-+	} while (packets < pending);
-+
-+	__fq_adjust_removal(fq, flow, packets, bytes, truesize);
-+	fq_rejigger_backlog(fq, flow);
-+
-+	return packets;
-+}
-+
- static struct sk_buff *fq_tin_dequeue(struct fq *fq,
- 				      struct fq_tin *tin,
- 				      fq_tin_dequeue_t dequeue_func)
-@@ -190,12 +226,9 @@ static void fq_tin_enqueue(struct fq *fq
- 		if (!flow)
- 			return;
- 
--		skb = fq_flow_dequeue(fq, flow);
--		if (!skb)
-+		if (!fq_flow_drop(fq, flow, free_func))
- 			return;
- 
--		free_func(fq, flow->tin, flow, skb);
--
- 		flow->tin->overlimit++;
- 		fq->overlimit++;
- 		if (oom) {
diff --git a/package/kernel/mac80211/patches/subsys/310-v6.2-mac80211-add-support-for-restricting-netdev-features.patch b/package/kernel/mac80211/patches/subsys/310-v6.2-mac80211-add-support-for-restricting-netdev-features.patch
new file mode 100644
index 000000000..812b12189
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/310-v6.2-mac80211-add-support-for-restricting-netdev-features.patch
@@ -0,0 +1,506 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 9 Oct 2022 20:15:46 +0200
+Subject: [PATCH] mac80211: add support for restricting netdev features per vif
+
+This can be used to selectively disable feature flags for checksum offload,
+scatter/gather or GSO by changing vif->netdev_features.
+Removing features from vif->netdev_features does not affect the netdev
+features themselves, but instead fixes up skbs in the tx path so that the
+offloads are not needed in the driver.
+
+Aside from making it easier to deal with vif type based hardware limitations,
+this also makes it possible to optimize performance on hardware without native
+GSO support by declaring GSO support in hw->netdev_features and removing it
+from vif->netdev_features. This allows mac80211 to handle GSO segmentation
+after the sta lookup, but before itxq enqueue, thus reducing the number of
+unnecessary sta lookups, as well as some other per-packet processing.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/fq_impl.h
++++ b/include/net/fq_impl.h
+@@ -200,6 +200,7 @@ static void fq_tin_enqueue(struct fq *fq
+ 			   fq_skb_free_t free_func)
+ {
+ 	struct fq_flow *flow;
++	struct sk_buff *next;
+ 	bool oom;
+ 
+ 	lockdep_assert_held(&fq->lock);
+@@ -214,11 +215,15 @@ static void fq_tin_enqueue(struct fq *fq
+ 	}
+ 
+ 	flow->tin = tin;
+-	flow->backlog += skb->len;
+-	tin->backlog_bytes += skb->len;
+-	tin->backlog_packets++;
+-	fq->memory_usage += skb->truesize;
+-	fq->backlog++;
++	skb_list_walk_safe(skb, skb, next) {
++		skb_mark_not_on_list(skb);
++		flow->backlog += skb->len;
++		tin->backlog_bytes += skb->len;
++		tin->backlog_packets++;
++		fq->memory_usage += skb->truesize;
++		fq->backlog++;
++		__skb_queue_tail(&flow->queue, skb);
++	}
+ 
+ 	if (list_empty(&flow->flowchain)) {
+ 		flow->deficit = fq->quantum;
+@@ -226,7 +231,6 @@ static void fq_tin_enqueue(struct fq *fq
+ 			      &tin->new_flows);
+ 	}
+ 
+-	__skb_queue_tail(&flow->queue, skb);
+ 	oom = (fq->memory_usage > fq->memory_limit);
+ 	while (fq->backlog > fq->limit || oom) {
+ 		flow = fq_find_fattest_flow(fq);
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1807,6 +1807,10 @@ struct ieee80211_vif_cfg {
+  * @addr: address of this interface
+  * @p2p: indicates whether this AP or STA interface is a p2p
+  *	interface, i.e. a GO or p2p-sta respectively
++ * @netdev_features: tx netdev features supported by the hardware for this
++ *	vif. mac80211 initializes this to hw->netdev_features, and the driver
++ *	can mask out specific tx features. mac80211 will handle software fixup
++ *	for masked offloads (GSO, CSUM)
+  * @driver_flags: flags/capabilities the driver has for this interface,
+  *	these need to be set (or cleared) when the interface is added
+  *	or, if supported by the driver, the interface type is changed
+@@ -1846,6 +1850,7 @@ struct ieee80211_vif {
+ 
+ 	struct ieee80211_txq *txq;
+ 
++	netdev_features_t netdev_features;
+ 	u32 driver_flags;
+ 	u32 offload_flags;
+ 
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -2181,6 +2181,7 @@ int ieee80211_if_add(struct ieee80211_lo
+ 		ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+ 		ndev->hw_features |= ndev->features &
+ 					MAC80211_SUPPORTED_FEATURES_TX;
++		sdata->vif.netdev_features = local->hw.netdev_features;
+ 
+ 		netdev_set_default_ethtool_ops(ndev, &ieee80211_ethtool_ops);
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1356,7 +1356,11 @@ static struct txq_info *ieee80211_get_tx
+ 
+ static void ieee80211_set_skb_enqueue_time(struct sk_buff *skb)
+ {
+-	IEEE80211_SKB_CB(skb)->control.enqueue_time = codel_get_time();
++	struct sk_buff *next;
++	codel_time_t now = codel_get_time();
++
++	skb_list_walk_safe(skb, skb, next)
++		IEEE80211_SKB_CB(skb)->control.enqueue_time = now;
+ }
+ 
+ static u32 codel_skb_len_func(const struct sk_buff *skb)
+@@ -3579,55 +3583,79 @@ ieee80211_xmit_fast_finish(struct ieee80
+ 	return TX_CONTINUE;
+ }
+ 
+-static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
+-				struct sta_info *sta,
+-				struct ieee80211_fast_tx *fast_tx,
+-				struct sk_buff *skb)
++static netdev_features_t
++ieee80211_sdata_netdev_features(struct ieee80211_sub_if_data *sdata)
+ {
+-	struct ieee80211_local *local = sdata->local;
+-	u16 ethertype = (skb->data[12] << 8) | skb->data[13];
+-	int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
+-	int hw_headroom = sdata->local->hw.extra_tx_headroom;
+-	struct ethhdr eth;
+-	struct ieee80211_tx_info *info;
+-	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
+-	struct ieee80211_tx_data tx;
+-	ieee80211_tx_result r;
+-	struct tid_ampdu_tx *tid_tx = NULL;
+-	u8 tid = IEEE80211_NUM_TIDS;
++	if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
++		return sdata->vif.netdev_features;
+ 
+-	/* control port protocol needs a lot of special handling */
+-	if (cpu_to_be16(ethertype) == sdata->control_port_protocol)
+-		return false;
++	if (!sdata->bss)
++		return 0;
+ 
+-	/* only RFC 1042 SNAP */
+-	if (ethertype < ETH_P_802_3_MIN)
+-		return false;
++	sdata = container_of(sdata->bss, struct ieee80211_sub_if_data, u.ap);
++	return sdata->vif.netdev_features;
++}
+ 
+-	/* don't handle TX status request here either */
+-	if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
+-		return false;
++static struct sk_buff *
++ieee80211_tx_skb_fixup(struct sk_buff *skb, netdev_features_t features)
++{
++	if (skb_is_gso(skb)) {
++		struct sk_buff *segs;
+ 
+-	if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
+-		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
+-		tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
+-		if (tid_tx) {
+-			if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
+-				return false;
+-			if (tid_tx->timeout)
+-				tid_tx->last_tx = jiffies;
+-		}
++		segs = skb_gso_segment(skb, features);
++		if (!segs)
++			return skb;
++		if (IS_ERR(segs))
++			goto free;
++
++		consume_skb(skb);
++		return segs;
+ 	}
+ 
+-	/* after this point (skb is modified) we cannot return false */
++	if (skb_needs_linearize(skb, features) && __skb_linearize(skb))
++		goto free;
++
++	if (skb->ip_summed == CHECKSUM_PARTIAL) {
++		int ofs = skb_checksum_start_offset(skb);
++
++		if (skb->encapsulation)
++			skb_set_inner_transport_header(skb, ofs);
++		else
++			skb_set_transport_header(skb, ofs);
++
++		if (skb_csum_hwoffload_help(skb, features))
++			goto free;
++	}
++
++	skb_mark_not_on_list(skb);
++	return skb;
++
++free:
++	kfree_skb(skb);
++	return NULL;
++}
++
++static void __ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
++				  struct sta_info *sta,
++				  struct ieee80211_fast_tx *fast_tx,
++				  struct sk_buff *skb, u8 tid, bool ampdu)
++{
++	struct ieee80211_local *local = sdata->local;
++	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
++	struct ieee80211_tx_info *info;
++	struct ieee80211_tx_data tx;
++	ieee80211_tx_result r;
++	int hw_headroom = sdata->local->hw.extra_tx_headroom;
++	int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
++	struct ethhdr eth;
+ 
+ 	skb = skb_share_check(skb, GFP_ATOMIC);
+ 	if (unlikely(!skb))
+-		return true;
++		return;
+ 
+ 	if ((hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) &&
+ 	    ieee80211_amsdu_aggregate(sdata, sta, fast_tx, skb))
+-		return true;
++		return;
+ 
+ 	/* will not be crypto-handled beyond what we do here, so use false
+ 	 * as the may-encrypt argument for the resize to not account for
+@@ -3636,10 +3664,8 @@ static bool ieee80211_xmit_fast(struct i
+ 	if (unlikely(ieee80211_skb_resize(sdata, skb,
+ 					  max_t(int, extra_head + hw_headroom -
+ 						     skb_headroom(skb), 0),
+-					  ENCRYPT_NO))) {
+-		kfree_skb(skb);
+-		return true;
+-	}
++					  ENCRYPT_NO)))
++		goto free;
+ 
+ 	memcpy(&eth, skb->data, ETH_HLEN - 2);
+ 	hdr = skb_push(skb, extra_head);
+@@ -3653,7 +3679,7 @@ static bool ieee80211_xmit_fast(struct i
+ 	info->control.vif = &sdata->vif;
+ 	info->flags = IEEE80211_TX_CTL_FIRST_FRAGMENT |
+ 		      IEEE80211_TX_CTL_DONTFRAG |
+-		      (tid_tx ? IEEE80211_TX_CTL_AMPDU : 0);
++		      (ampdu ? IEEE80211_TX_CTL_AMPDU : 0);
+ 	info->control.flags = IEEE80211_TX_CTRL_FAST_XMIT |
+ 			      u32_encode_bits(IEEE80211_LINK_UNSPECIFIED,
+ 					      IEEE80211_TX_CTRL_MLO_LINK);
+@@ -3677,16 +3703,14 @@ static bool ieee80211_xmit_fast(struct i
+ 	tx.key = fast_tx->key;
+ 
+ 	if (ieee80211_queue_skb(local, sdata, sta, skb))
+-		return true;
++		return;
+ 
+ 	tx.skb = skb;
+ 	r = ieee80211_xmit_fast_finish(sdata, sta, fast_tx->pn_offs,
+ 				       fast_tx->key, &tx);
+ 	tx.skb = NULL;
+-	if (r == TX_DROP) {
+-		kfree_skb(skb);
+-		return true;
+-	}
++	if (r == TX_DROP)
++		goto free;
+ 
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+ 		sdata = container_of(sdata->bss,
+@@ -3694,6 +3718,56 @@ static bool ieee80211_xmit_fast(struct i
+ 
+ 	__skb_queue_tail(&tx.skbs, skb);
+ 	ieee80211_tx_frags(local, &sdata->vif, sta, &tx.skbs, false);
++	return;
++
++free:
++	kfree_skb(skb);
++}
++
++static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
++				struct sta_info *sta,
++				struct ieee80211_fast_tx *fast_tx,
++				struct sk_buff *skb)
++{
++	u16 ethertype = (skb->data[12] << 8) | skb->data[13];
++	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
++	struct tid_ampdu_tx *tid_tx = NULL;
++	struct sk_buff *next;
++	u8 tid = IEEE80211_NUM_TIDS;
++
++	/* control port protocol needs a lot of special handling */
++	if (cpu_to_be16(ethertype) == sdata->control_port_protocol)
++		return false;
++
++	/* only RFC 1042 SNAP */
++	if (ethertype < ETH_P_802_3_MIN)
++		return false;
++
++	/* don't handle TX status request here either */
++	if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
++		return false;
++
++	if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
++		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++		tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
++		if (tid_tx) {
++			if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
++				return false;
++			if (tid_tx->timeout)
++				tid_tx->last_tx = jiffies;
++		}
++	}
++
++	/* after this point (skb is modified) we cannot return false */
++	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
++	if (!skb)
++		return true;
++
++	skb_list_walk_safe(skb, skb, next) {
++		skb_mark_not_on_list(skb);
++		__ieee80211_xmit_fast(sdata, sta, fast_tx, skb, tid, tid_tx);
++	}
++
+ 	return true;
+ }
+ 
+@@ -4201,31 +4275,14 @@ void __ieee80211_subif_start_xmit(struct
+ 			goto out;
+ 	}
+ 
+-	if (skb_is_gso(skb)) {
+-		struct sk_buff *segs;
+-
+-		segs = skb_gso_segment(skb, 0);
+-		if (IS_ERR(segs)) {
+-			goto out_free;
+-		} else if (segs) {
+-			consume_skb(skb);
+-			skb = segs;
+-		}
+-	} else {
+-		/* we cannot process non-linear frames on this path */
+-		if (skb_linearize(skb))
+-			goto out_free;
+-
+-		/* the frame could be fragmented, software-encrypted, and other
+-		 * things so we cannot really handle checksum offload with it -
+-		 * fix it up in software before we handle anything else.
+-		 */
+-		if (skb->ip_summed == CHECKSUM_PARTIAL) {
+-			skb_set_transport_header(skb,
+-						 skb_checksum_start_offset(skb));
+-			if (skb_checksum_help(skb))
+-				goto out_free;
+-		}
++	/* the frame could be fragmented, software-encrypted, and other
++	 * things so we cannot really handle checksum or GSO offload.
++	 * fix it up in software before we handle anything else.
++	 */
++	skb = ieee80211_tx_skb_fixup(skb, 0);
++	if (!skb) {
++		len = 0;
++		goto out;
+ 	}
+ 
+ 	skb_list_walk_safe(skb, skb, next) {
+@@ -4443,9 +4500,11 @@ normal:
+ 	return NETDEV_TX_OK;
+ }
+ 
+-static bool ieee80211_tx_8023(struct ieee80211_sub_if_data *sdata,
+-			      struct sk_buff *skb, struct sta_info *sta,
+-			      bool txpending)
++
++
++static bool __ieee80211_tx_8023(struct ieee80211_sub_if_data *sdata,
++				struct sk_buff *skb, struct sta_info *sta,
++				bool txpending)
+ {
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_tx_control control = {};
+@@ -4454,14 +4513,6 @@ static bool ieee80211_tx_8023(struct iee
+ 	unsigned long flags;
+ 	int q = info->hw_queue;
+ 
+-	if (sta)
+-		sk_pacing_shift_update(skb->sk, local->hw.tx_sk_pacing_shift);
+-
+-	ieee80211_tpt_led_trig_tx(local, skb->len);
+-
+-	if (ieee80211_queue_skb(local, sdata, sta, skb))
+-		return true;
+-
+ 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+ 
+ 	if (local->queue_stop_reasons[q] ||
+@@ -4488,6 +4539,26 @@ static bool ieee80211_tx_8023(struct iee
+ 	return true;
+ }
+ 
++static bool ieee80211_tx_8023(struct ieee80211_sub_if_data *sdata,
++			      struct sk_buff *skb, struct sta_info *sta,
++			      bool txpending)
++{
++	struct ieee80211_local *local = sdata->local;
++	struct sk_buff *next;
++	bool ret = true;
++
++	if (ieee80211_queue_skb(local, sdata, sta, skb))
++		return true;
++
++	skb_list_walk_safe(skb, skb, next) {
++		skb_mark_not_on_list(skb);
++		if (!__ieee80211_tx_8023(sdata, skb, sta, txpending))
++			ret = false;
++	}
++
++	return ret;
++}
++
+ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
+ 				struct net_device *dev, struct sta_info *sta,
+ 				struct ieee80211_key *key, struct sk_buff *skb)
+@@ -4495,9 +4566,13 @@ static void ieee80211_8023_xmit(struct i
+ 	struct ieee80211_tx_info *info;
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct tid_ampdu_tx *tid_tx;
++	struct sk_buff *seg, *next;
++	unsigned int skbs = 0, len = 0;
++	u16 queue;
+ 	u8 tid;
+ 
+-	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
++	queue = ieee80211_select_queue(sdata, sta, skb);
++	skb_set_queue_mapping(skb, queue);
+ 
+ 	if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)) &&
+ 	    test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
+@@ -4507,9 +4582,6 @@ static void ieee80211_8023_xmit(struct i
+ 	if (unlikely(!skb))
+ 		return;
+ 
+-	info = IEEE80211_SKB_CB(skb);
+-	memset(info, 0, sizeof(*info));
+-
+ 	ieee80211_aggr_check(sdata, sta, skb);
+ 
+ 	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
+@@ -4523,22 +4595,20 @@ static void ieee80211_8023_xmit(struct i
+ 			return;
+ 		}
+ 
+-		info->flags |= IEEE80211_TX_CTL_AMPDU;
+ 		if (tid_tx->timeout)
+ 			tid_tx->last_tx = jiffies;
+ 	}
+ 
+-	if (unlikely(skb->sk &&
+-		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS))
+-		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
+-							     &info->flags, NULL);
++	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
++	if (!skb)
++		return;
+ 
+-	info->hw_queue = sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
++	info = IEEE80211_SKB_CB(skb);
++	memset(info, 0, sizeof(*info));
++	if (tid_tx)
++		info->flags |= IEEE80211_TX_CTL_AMPDU;
+ 
+-	dev_sw_netstats_tx_add(dev, 1, skb->len);
+-
+-	sta->deflink.tx_stats.bytes[skb_get_queue_mapping(skb)] += skb->len;
+-	sta->deflink.tx_stats.packets[skb_get_queue_mapping(skb)]++;
++	info->hw_queue = sdata->vif.hw_queue[queue];
+ 
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+ 		sdata = container_of(sdata->bss,
+@@ -4550,6 +4620,24 @@ static void ieee80211_8023_xmit(struct i
+ 	if (key)
+ 		info->control.hw_key = &key->conf;
+ 
++	skb_list_walk_safe(skb, seg, next) {
++		skbs++;
++		len += seg->len;
++		if (seg != skb)
++			memcpy(IEEE80211_SKB_CB(seg), info, sizeof(*info));
++	}
++
++	if (unlikely(skb->sk &&
++		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS))
++		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
++							     &info->flags, NULL);
++
++	dev_sw_netstats_tx_add(dev, skbs, len);
++	sta->deflink.tx_stats.packets[queue] += skbs;
++	sta->deflink.tx_stats.bytes[queue] += len;
++
++	ieee80211_tpt_led_trig_tx(local, len);
++
+ 	ieee80211_tx_8023(sdata, skb, sta, false);
+ 
+ 	return;
+@@ -4591,6 +4679,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+ 		    key->conf.cipher == WLAN_CIPHER_SUITE_TKIP))
+ 		goto skip_offload;
+ 
++	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
+ 	ieee80211_8023_xmit(sdata, dev, sta, key, skb);
+ 	goto out;
+ 
diff --git a/package/kernel/mac80211/patches/subsys/311-net-fq_impl-drop-get_default_func-move-default-flow-.patch b/package/kernel/mac80211/patches/subsys/311-net-fq_impl-drop-get_default_func-move-default-flow-.patch
deleted file mode 100644
index 9ff376a02..000000000
--- a/package/kernel/mac80211/patches/subsys/311-net-fq_impl-drop-get_default_func-move-default-flow-.patch
+++ /dev/null
@@ -1,144 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 25 Nov 2020 18:09:10 +0100
-Subject: [PATCH] net/fq_impl: drop get_default_func, move default flow to
- fq_tin
-
-Simplifies the code and prepares for a rework of scanning for flows on
-overmemory drop.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/include/net/fq.h
-+++ b/include/net/fq.h
-@@ -47,6 +47,7 @@ struct fq_flow {
- struct fq_tin {
- 	struct list_head new_flows;
- 	struct list_head old_flows;
-+	struct fq_flow default_flow;
- 	u32 backlog_bytes;
- 	u32 backlog_packets;
- 	u32 overlimit;
---- a/include/net/fq_impl.h
-+++ b/include/net/fq_impl.h
-@@ -151,8 +151,7 @@ static u32 fq_flow_idx(struct fq *fq, st
- 
- static struct fq_flow *fq_flow_classify(struct fq *fq,
- 					struct fq_tin *tin, u32 idx,
--					struct sk_buff *skb,
--					fq_flow_get_default_t get_default_func)
-+					struct sk_buff *skb)
- {
- 	struct fq_flow *flow;
- 
-@@ -160,7 +159,7 @@ static struct fq_flow *fq_flow_classify(
- 
- 	flow = &fq->flows[idx];
- 	if (flow->tin && flow->tin != tin) {
--		flow = get_default_func(fq, tin, idx, skb);
-+		flow = &tin->default_flow;
- 		tin->collisions++;
- 		fq->collisions++;
- 	}
-@@ -192,15 +191,14 @@ static void fq_recalc_backlog(struct fq
- static void fq_tin_enqueue(struct fq *fq,
- 			   struct fq_tin *tin, u32 idx,
- 			   struct sk_buff *skb,
--			   fq_skb_free_t free_func,
--			   fq_flow_get_default_t get_default_func)
-+			   fq_skb_free_t free_func)
- {
- 	struct fq_flow *flow;
- 	bool oom;
- 
- 	lockdep_assert_held(&fq->lock);
- 
--	flow = fq_flow_classify(fq, tin, idx, skb, get_default_func);
-+	flow = fq_flow_classify(fq, tin, idx, skb);
- 
- 	flow->tin = tin;
- 	flow->backlog += skb->len;
-@@ -331,6 +329,7 @@ static void fq_tin_init(struct fq_tin *t
- {
- 	INIT_LIST_HEAD(&tin->new_flows);
- 	INIT_LIST_HEAD(&tin->old_flows);
-+	fq_flow_init(&tin->default_flow);
- }
- 
- static int fq_init(struct fq *fq, int flows_cnt)
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -846,7 +846,6 @@ enum txq_info_flags {
-  */
- struct txq_info {
- 	struct fq_tin tin;
--	struct fq_flow def_flow;
- 	struct codel_vars def_cvars;
- 	struct codel_stats cstats;
- 	struct sk_buff_head frags;
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1322,7 +1322,7 @@ static struct sk_buff *codel_dequeue_fun
- 	fq = &local->fq;
- 
- 	if (cvars == &txqi->def_cvars)
--		flow = &txqi->def_flow;
-+		flow = &txqi->tin.default_flow;
- 	else
- 		flow = &fq->flows[cvars - local->cvars];
- 
-@@ -1365,7 +1365,7 @@ static struct sk_buff *fq_tin_dequeue_fu
- 		cparams = &local->cparams;
- 	}
- 
--	if (flow == &txqi->def_flow)
-+	if (flow == &tin->default_flow)
- 		cvars = &txqi->def_cvars;
- 	else
- 		cvars = &local->cvars[flow - fq->flows];
-@@ -1392,17 +1392,6 @@ static void fq_skb_free_func(struct fq *
- 	ieee80211_free_txskb(&local->hw, skb);
- }
- 
--static struct fq_flow *fq_flow_get_default_func(struct fq *fq,
--						struct fq_tin *tin,
--						int idx,
--						struct sk_buff *skb)
--{
--	struct txq_info *txqi;
--
--	txqi = container_of(tin, struct txq_info, tin);
--	return &txqi->def_flow;
--}
--
- static void ieee80211_txq_enqueue(struct ieee80211_local *local,
- 				  struct txq_info *txqi,
- 				  struct sk_buff *skb)
-@@ -1415,8 +1404,7 @@ static void ieee80211_txq_enqueue(struct
- 
- 	spin_lock_bh(&fq->lock);
- 	fq_tin_enqueue(fq, tin, flow_idx, skb,
--		       fq_skb_free_func,
--		       fq_flow_get_default_func);
-+		       fq_skb_free_func);
- 	spin_unlock_bh(&fq->lock);
- }
- 
-@@ -1459,7 +1447,6 @@ void ieee80211_txq_init(struct ieee80211
- 			struct txq_info *txqi, int tid)
- {
- 	fq_tin_init(&txqi->tin);
--	fq_flow_init(&txqi->def_flow);
- 	codel_vars_init(&txqi->def_cvars);
- 	codel_stats_init(&txqi->cstats);
- 	__skb_queue_head_init(&txqi->frags);
-@@ -3336,8 +3323,7 @@ static bool ieee80211_amsdu_aggregate(st
- 	 */
- 
- 	tin = &txqi->tin;
--	flow = fq_flow_classify(fq, tin, flow_idx, skb,
--				fq_flow_get_default_func);
-+	flow = fq_flow_classify(fq, tin, flow_idx, skb);
- 	head = skb_peek_tail(&flow->queue);
- 	if (!head || skb_is_gso(head))
- 		goto out;
diff --git a/package/kernel/mac80211/patches/subsys/311-v6.2-wifi-mac80211-fix-and-simplify-unencrypted-drop-chec.patch b/package/kernel/mac80211/patches/subsys/311-v6.2-wifi-mac80211-fix-and-simplify-unencrypted-drop-chec.patch
new file mode 100644
index 000000000..804b02eb3
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/311-v6.2-wifi-mac80211-fix-and-simplify-unencrypted-drop-chec.patch
@@ -0,0 +1,87 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 1 Dec 2022 14:57:30 +0100
+Subject: [PATCH] wifi: mac80211: fix and simplify unencrypted drop check for
+ mesh
+
+ieee80211_drop_unencrypted is called from ieee80211_rx_h_mesh_fwding and
+ieee80211_frame_allowed.
+
+Since ieee80211_rx_h_mesh_fwding can forward packets for other mesh nodes
+and is called earlier, it needs to check the decryptions status and if the
+packet is using the control protocol on its own, instead of deferring to
+the later call from ieee80211_frame_allowed.
+
+Because of that, ieee80211_drop_unencrypted has a mesh specific check
+that skips over the mesh header in order to check the payload protocol.
+This code is invalid when called from ieee80211_frame_allowed, since that
+happens after the 802.11->802.3 conversion.
+
+Fix this by moving the mesh specific check directly into
+ieee80211_rx_h_mesh_fwding.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://lore.kernel.org/r/20221201135730.19723-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2403,7 +2403,6 @@ static int ieee80211_802_1x_port_control
+ 
+ static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
+ {
+-	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
+ 	struct sk_buff *skb = rx->skb;
+ 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ 
+@@ -2414,31 +2413,6 @@ static int ieee80211_drop_unencrypted(st
+ 	if (status->flag & RX_FLAG_DECRYPTED)
+ 		return 0;
+ 
+-	/* check mesh EAPOL frames first */
+-	if (unlikely(rx->sta && ieee80211_vif_is_mesh(&rx->sdata->vif) &&
+-		     ieee80211_is_data(fc))) {
+-		struct ieee80211s_hdr *mesh_hdr;
+-		u16 hdr_len = ieee80211_hdrlen(fc);
+-		u16 ethertype_offset;
+-		__be16 ethertype;
+-
+-		if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr))
+-			goto drop_check;
+-
+-		/* make sure fixed part of mesh header is there, also checks skb len */
+-		if (!pskb_may_pull(rx->skb, hdr_len + 6))
+-			goto drop_check;
+-
+-		mesh_hdr = (struct ieee80211s_hdr *)(skb->data + hdr_len);
+-		ethertype_offset = hdr_len + ieee80211_get_mesh_hdrlen(mesh_hdr) +
+-				   sizeof(rfc1042_header);
+-
+-		if (skb_copy_bits(rx->skb, ethertype_offset, &ethertype, 2) == 0 &&
+-		    ethertype == rx->sdata->control_port_protocol)
+-			return 0;
+-	}
+-
+-drop_check:
+ 	/* Drop unencrypted frames if key is set. */
+ 	if (unlikely(!ieee80211_has_protected(fc) &&
+ 		     !ieee80211_is_any_nullfunc(fc) &&
+@@ -2892,8 +2866,16 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ 	hdr = (struct ieee80211_hdr *) skb->data;
+ 	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+ 
+-	if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
+-		return RX_DROP_MONITOR;
++	if (ieee80211_drop_unencrypted(rx, hdr->frame_control)) {
++		int offset = hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr) +
++			     sizeof(rfc1042_header);
++		__be16 ethertype;
++
++		if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr) ||
++		    skb_copy_bits(rx->skb, offset, &ethertype, 2) != 0 ||
++		    ethertype != rx->sdata->control_port_protocol)
++			return RX_DROP_MONITOR;
++	}
+ 
+ 	/* frame is in RMC, don't forward */
+ 	if (ieee80211_is_data(hdr->frame_control) &&
diff --git a/package/kernel/mac80211/patches/subsys/312-net-fq_impl-do-not-maintain-a-backlog-sorted-list-of.patch b/package/kernel/mac80211/patches/subsys/312-net-fq_impl-do-not-maintain-a-backlog-sorted-list-of.patch
deleted file mode 100644
index 1d7bbee40..000000000
--- a/package/kernel/mac80211/patches/subsys/312-net-fq_impl-do-not-maintain-a-backlog-sorted-list-of.patch
+++ /dev/null
@@ -1,317 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 25 Nov 2020 18:10:34 +0100
-Subject: [PATCH] net/fq_impl: do not maintain a backlog-sorted list of
- flows
-
-A sorted flow list is only needed to drop packets in the biggest flow when
-hitting the overmemory condition.
-By scanning flows only when needed, we can avoid paying the cost of
-maintaining the list under normal conditions
-In order to avoid scanning lots of empty flows and touching too many cold
-cache lines, a bitmap of flows with backlog is maintained
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/include/net/fq.h
-+++ b/include/net/fq.h
-@@ -19,8 +19,6 @@ struct fq_tin;
-  * @flowchain: can be linked to fq_tin's new_flows or old_flows. Used for DRR++
-  *	(deficit round robin) based round robin queuing similar to the one
-  *	found in net/sched/sch_fq_codel.c
-- * @backlogchain: can be linked to other fq_flow and fq. Used to keep track of
-- *	fat flows and efficient head-dropping if packet limit is reached
-  * @queue: sk_buff queue to hold packets
-  * @backlog: number of bytes pending in the queue. The number of packets can be
-  *	found in @queue.qlen
-@@ -29,7 +27,6 @@ struct fq_tin;
- struct fq_flow {
- 	struct fq_tin *tin;
- 	struct list_head flowchain;
--	struct list_head backlogchain;
- 	struct sk_buff_head queue;
- 	u32 backlog;
- 	int deficit;
-@@ -47,6 +44,7 @@ struct fq_flow {
- struct fq_tin {
- 	struct list_head new_flows;
- 	struct list_head old_flows;
-+	struct list_head tin_list;
- 	struct fq_flow default_flow;
- 	u32 backlog_bytes;
- 	u32 backlog_packets;
-@@ -60,14 +58,14 @@ struct fq_tin {
- /**
-  * struct fq - main container for fair queuing purposes
-  *
-- * @backlogs: linked to fq_flows. Used to maintain fat flows for efficient
-- *	head-dropping when @backlog reaches @limit
-  * @limit: max number of packets that can be queued across all flows
-  * @backlog: number of packets queued across all flows
-  */
- struct fq {
- 	struct fq_flow *flows;
--	struct list_head backlogs;
-+	unsigned long *flows_bitmap;
-+
-+	struct list_head tin_backlog;
- 	spinlock_t lock;
- 	u32 flows_cnt;
- 	u32 limit;
---- a/include/net/fq_impl.h
-+++ b/include/net/fq_impl.h
-@@ -17,12 +17,24 @@ __fq_adjust_removal(struct fq *fq, struc
- 		    unsigned int bytes, unsigned int truesize)
- {
- 	struct fq_tin *tin = flow->tin;
-+	int idx;
- 
- 	tin->backlog_bytes -= bytes;
- 	tin->backlog_packets -= packets;
- 	flow->backlog -= bytes;
- 	fq->backlog -= packets;
- 	fq->memory_usage -= truesize;
-+
-+	if (flow->backlog)
-+		return;
-+
-+	if (flow == &tin->default_flow) {
-+		list_del_init(&tin->tin_list);
-+		return;
-+	}
-+
-+	idx = flow - fq->flows;
-+	__clear_bit(idx, fq->flows_bitmap);
- }
- 
- static void fq_adjust_removal(struct fq *fq,
-@@ -32,24 +44,6 @@ static void fq_adjust_removal(struct fq
- 	__fq_adjust_removal(fq, flow, 1, skb->len, skb->truesize);
- }
- 
--static void fq_rejigger_backlog(struct fq *fq, struct fq_flow *flow)
--{
--	struct fq_flow *i;
--
--	if (flow->backlog == 0) {
--		list_del_init(&flow->backlogchain);
--	} else {
--		i = flow;
--
--		list_for_each_entry_continue(i, &fq->backlogs, backlogchain)
--			if (i->backlog < flow->backlog)
--				break;
--
--		list_move_tail(&flow->backlogchain,
--			       &i->backlogchain);
--	}
--}
--
- static struct sk_buff *fq_flow_dequeue(struct fq *fq,
- 				       struct fq_flow *flow)
- {
-@@ -62,7 +56,6 @@ static struct sk_buff *fq_flow_dequeue(s
- 		return NULL;
- 
- 	fq_adjust_removal(fq, flow, skb);
--	fq_rejigger_backlog(fq, flow);
- 
- 	return skb;
- }
-@@ -90,7 +83,6 @@ static int fq_flow_drop(struct fq *fq, s
- 	} while (packets < pending);
- 
- 	__fq_adjust_removal(fq, flow, packets, bytes, truesize);
--	fq_rejigger_backlog(fq, flow);
- 
- 	return packets;
- }
-@@ -170,22 +162,36 @@ static struct fq_flow *fq_flow_classify(
- 	return flow;
- }
- 
--static void fq_recalc_backlog(struct fq *fq,
--			      struct fq_tin *tin,
--			      struct fq_flow *flow)
--{
--	struct fq_flow *i;
--
--	if (list_empty(&flow->backlogchain))
--		list_add_tail(&flow->backlogchain, &fq->backlogs);
--
--	i = flow;
--	list_for_each_entry_continue_reverse(i, &fq->backlogs,
--					     backlogchain)
--		if (i->backlog > flow->backlog)
--			break;
-+static struct fq_flow *fq_find_fattest_flow(struct fq *fq)
-+{
-+	struct fq_tin *tin;
-+	struct fq_flow *flow = NULL;
-+	u32 len = 0;
-+	int i;
-+
-+	for_each_set_bit(i, fq->flows_bitmap, fq->flows_cnt) {
-+		struct fq_flow *cur = &fq->flows[i];
-+		unsigned int cur_len;
-+
-+		cur_len = cur->backlog;
-+		if (cur_len <= len)
-+			continue;
-+
-+		flow = cur;
-+		len = cur_len;
-+	}
- 
--	list_move(&flow->backlogchain, &i->backlogchain);
-+	list_for_each_entry(tin, &fq->tin_backlog, tin_list) {
-+		unsigned int cur_len = tin->default_flow.backlog;
-+
-+		if (cur_len <= len)
-+			continue;
-+
-+		flow = &tin->default_flow;
-+		len = cur_len;
-+	}
-+
-+	return flow;
- }
- 
- static void fq_tin_enqueue(struct fq *fq,
-@@ -200,6 +206,13 @@ static void fq_tin_enqueue(struct fq *fq
- 
- 	flow = fq_flow_classify(fq, tin, idx, skb);
- 
-+	if (!flow->backlog) {
-+		if (flow != &tin->default_flow)
-+			__set_bit(idx, fq->flows_bitmap);
-+		else if (list_empty(&tin->tin_list))
-+			list_add(&tin->tin_list, &fq->tin_backlog);
-+	}
-+
- 	flow->tin = tin;
- 	flow->backlog += skb->len;
- 	tin->backlog_bytes += skb->len;
-@@ -207,8 +220,6 @@ static void fq_tin_enqueue(struct fq *fq
- 	fq->memory_usage += skb->truesize;
- 	fq->backlog++;
- 
--	fq_recalc_backlog(fq, tin, flow);
--
- 	if (list_empty(&flow->flowchain)) {
- 		flow->deficit = fq->quantum;
- 		list_add_tail(&flow->flowchain,
-@@ -218,9 +229,7 @@ static void fq_tin_enqueue(struct fq *fq
- 	__skb_queue_tail(&flow->queue, skb);
- 	oom = (fq->memory_usage > fq->memory_limit);
- 	while (fq->backlog > fq->limit || oom) {
--		flow = list_first_entry_or_null(&fq->backlogs,
--						struct fq_flow,
--						backlogchain);
-+		flow = fq_find_fattest_flow(fq);
- 		if (!flow)
- 			return;
- 
-@@ -255,8 +264,6 @@ static void fq_flow_filter(struct fq *fq
- 		fq_adjust_removal(fq, flow, skb);
- 		free_func(fq, tin, flow, skb);
- 	}
--
--	fq_rejigger_backlog(fq, flow);
- }
- 
- static void fq_tin_filter(struct fq *fq,
-@@ -279,16 +286,18 @@ static void fq_flow_reset(struct fq *fq,
- 			  struct fq_flow *flow,
- 			  fq_skb_free_t free_func)
- {
-+	struct fq_tin *tin = flow->tin;
- 	struct sk_buff *skb;
- 
- 	while ((skb = fq_flow_dequeue(fq, flow)))
--		free_func(fq, flow->tin, flow, skb);
-+		free_func(fq, tin, flow, skb);
- 
--	if (!list_empty(&flow->flowchain))
-+	if (!list_empty(&flow->flowchain)) {
- 		list_del_init(&flow->flowchain);
--
--	if (!list_empty(&flow->backlogchain))
--		list_del_init(&flow->backlogchain);
-+		if (list_empty(&tin->new_flows) &&
-+		    list_empty(&tin->old_flows))
-+			list_del_init(&tin->tin_list);
-+	}
- 
- 	flow->tin = NULL;
- 
-@@ -314,6 +323,7 @@ static void fq_tin_reset(struct fq *fq,
- 		fq_flow_reset(fq, flow, free_func);
- 	}
- 
-+	WARN_ON_ONCE(!list_empty(&tin->tin_list));
- 	WARN_ON_ONCE(tin->backlog_bytes);
- 	WARN_ON_ONCE(tin->backlog_packets);
- }
-@@ -321,7 +331,6 @@ static void fq_tin_reset(struct fq *fq,
- static void fq_flow_init(struct fq_flow *flow)
- {
- 	INIT_LIST_HEAD(&flow->flowchain);
--	INIT_LIST_HEAD(&flow->backlogchain);
- 	__skb_queue_head_init(&flow->queue);
- }
- 
-@@ -329,6 +338,7 @@ static void fq_tin_init(struct fq_tin *t
- {
- 	INIT_LIST_HEAD(&tin->new_flows);
- 	INIT_LIST_HEAD(&tin->old_flows);
-+	INIT_LIST_HEAD(&tin->tin_list);
- 	fq_flow_init(&tin->default_flow);
- }
- 
-@@ -337,8 +347,8 @@ static int fq_init(struct fq *fq, int fl
- 	int i;
- 
- 	memset(fq, 0, sizeof(fq[0]));
--	INIT_LIST_HEAD(&fq->backlogs);
- 	spin_lock_init(&fq->lock);
-+	INIT_LIST_HEAD(&fq->tin_backlog);
- 	fq->flows_cnt = max_t(u32, flows_cnt, 1);
- 	fq->quantum = 300;
- 	fq->limit = 8192;
-@@ -348,6 +358,14 @@ static int fq_init(struct fq *fq, int fl
- 	if (!fq->flows)
- 		return -ENOMEM;
- 
-+	fq->flows_bitmap = kcalloc(BITS_TO_LONGS(fq->flows_cnt), sizeof(long),
-+				   GFP_KERNEL);
-+	if (!fq->flows_bitmap) {
-+		kvfree(fq->flows);
-+		fq->flows = NULL;
-+		return -ENOMEM;
-+	}
-+
- 	for (i = 0; i < fq->flows_cnt; i++)
- 		fq_flow_init(&fq->flows[i]);
- 
-@@ -364,6 +382,9 @@ static void fq_reset(struct fq *fq,
- 
- 	kvfree(fq->flows);
- 	fq->flows = NULL;
-+
-+	kfree(fq->flows_bitmap);
-+	fq->flows_bitmap = NULL;
- }
- 
- #endif
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3398,8 +3398,6 @@ out_recalc:
- 	if (head->len != orig_len) {
- 		flow->backlog += head->len - orig_len;
- 		tin->backlog_bytes += head->len - orig_len;
--
--		fq_recalc_backlog(fq, tin, flow);
- 	}
- out:
- 	spin_unlock_bh(&fq->lock);
diff --git a/package/kernel/mac80211/patches/subsys/312-v6.3-wifi-cfg80211-move-A-MSDU-check-in-ieee80211_data_to.patch b/package/kernel/mac80211/patches/subsys/312-v6.3-wifi-cfg80211-move-A-MSDU-check-in-ieee80211_data_to.patch
new file mode 100644
index 000000000..f668905cc
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/312-v6.3-wifi-cfg80211-move-A-MSDU-check-in-ieee80211_data_to.patch
@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 2 Dec 2022 13:53:11 +0100
+Subject: [PATCH] wifi: cfg80211: move A-MSDU check in
+ ieee80211_data_to_8023_exthdr
+
+When parsing the outer A-MSDU header, don't check for inner bridge tunnel
+or RFC1042 headers. This is handled by ieee80211_amsdu_to_8023s already.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -631,8 +631,9 @@ int ieee80211_data_to_8023_exthdr(struct
+ 		break;
+ 	}
+ 
+-	if (likely(skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
+-	           ((!is_amsdu && ether_addr_equal(payload.hdr, rfc1042_header) &&
++	if (likely(!is_amsdu &&
++		   skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
++	           ((ether_addr_equal(payload.hdr, rfc1042_header) &&
+ 		     payload.proto != htons(ETH_P_AARP) &&
+ 		     payload.proto != htons(ETH_P_IPX)) ||
+ 		    ether_addr_equal(payload.hdr, bridge_tunnel_header)))) {
diff --git a/package/kernel/mac80211/patches/subsys/313-v6.3-wifi-cfg80211-factor-out-bridge-tunnel-RFC1042-heade.patch b/package/kernel/mac80211/patches/subsys/313-v6.3-wifi-cfg80211-factor-out-bridge-tunnel-RFC1042-heade.patch
new file mode 100644
index 000000000..864105786
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/313-v6.3-wifi-cfg80211-factor-out-bridge-tunnel-RFC1042-heade.patch
@@ -0,0 +1,76 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 2 Dec 2022 13:54:15 +0100
+Subject: [PATCH] wifi: cfg80211: factor out bridge tunnel / RFC1042 header
+ check
+
+The same check is done in multiple places, unify it.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -542,6 +542,21 @@ unsigned int ieee80211_get_mesh_hdrlen(s
+ }
+ EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
+ 
++static bool ieee80211_get_8023_tunnel_proto(const void *hdr, __be16 *proto)
++{
++	const __be16 *hdr_proto = hdr + ETH_ALEN;
++
++	if (!(ether_addr_equal(hdr, rfc1042_header) &&
++	      *hdr_proto != htons(ETH_P_AARP) &&
++	      *hdr_proto != htons(ETH_P_IPX)) &&
++	    !ether_addr_equal(hdr, bridge_tunnel_header))
++		return false;
++
++	*proto = *hdr_proto;
++
++	return true;
++}
++
+ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
+ 				  const u8 *addr, enum nl80211_iftype iftype,
+ 				  u8 data_offset, bool is_amsdu)
+@@ -633,14 +648,9 @@ int ieee80211_data_to_8023_exthdr(struct
+ 
+ 	if (likely(!is_amsdu &&
+ 		   skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
+-	           ((ether_addr_equal(payload.hdr, rfc1042_header) &&
+-		     payload.proto != htons(ETH_P_AARP) &&
+-		     payload.proto != htons(ETH_P_IPX)) ||
+-		    ether_addr_equal(payload.hdr, bridge_tunnel_header)))) {
+-		/* remove RFC1042 or Bridge-Tunnel encapsulation and
+-		 * replace EtherType */
++		   ieee80211_get_8023_tunnel_proto(&payload, &tmp.h_proto))) {
++		/* remove RFC1042 or Bridge-Tunnel encapsulation */
+ 		hdrlen += ETH_ALEN + 2;
+-		tmp.h_proto = payload.proto;
+ 		skb_postpull_rcsum(skb, &payload, ETH_ALEN + 2);
+ 	} else {
+ 		tmp.h_proto = htons(skb->len - hdrlen);
+@@ -756,8 +766,6 @@ void ieee80211_amsdu_to_8023s(struct sk_
+ {
+ 	unsigned int hlen = ALIGN(extra_headroom, 4);
+ 	struct sk_buff *frame = NULL;
+-	u16 ethertype;
+-	u8 *payload;
+ 	int offset = 0, remaining;
+ 	struct ethhdr eth;
+ 	bool reuse_frag = skb->head_frag && !skb_has_frag_list(skb);
+@@ -811,14 +819,8 @@ void ieee80211_amsdu_to_8023s(struct sk_
+ 		frame->dev = skb->dev;
+ 		frame->priority = skb->priority;
+ 
+-		payload = frame->data;
+-		ethertype = (payload[6] << 8) | payload[7];
+-		if (likely((ether_addr_equal(payload, rfc1042_header) &&
+-			    ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
+-			   ether_addr_equal(payload, bridge_tunnel_header))) {
+-			eth.h_proto = htons(ethertype);
++		if (likely(ieee80211_get_8023_tunnel_proto(frame->data, &eth.h_proto)))
+ 			skb_pull(frame, ETH_ALEN + 2);
+-		}
+ 
+ 		memcpy(skb_push(frame, sizeof(eth)), &eth, sizeof(eth));
+ 		__skb_queue_tail(list, frame);
diff --git a/package/kernel/mac80211/patches/subsys/314-v6.3-wifi-mac80211-remove-mesh-forwarding-congestion-chec.patch b/package/kernel/mac80211/patches/subsys/314-v6.3-wifi-mac80211-remove-mesh-forwarding-congestion-chec.patch
new file mode 100644
index 000000000..515176f0d
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/314-v6.3-wifi-mac80211-remove-mesh-forwarding-congestion-chec.patch
@@ -0,0 +1,54 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 2 Dec 2022 17:01:46 +0100
+Subject: [PATCH] wifi: mac80211: remove mesh forwarding congestion check
+
+Now that all drivers use iTXQ, it does not make sense to check to drop
+tx forwarding packets when the driver has stopped the queues.
+fq_codel will take care of dropping packets when the queues fill up
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -603,8 +603,6 @@ IEEE80211_IF_FILE(fwded_mcast, u.mesh.ms
+ IEEE80211_IF_FILE(fwded_unicast, u.mesh.mshstats.fwded_unicast, DEC);
+ IEEE80211_IF_FILE(fwded_frames, u.mesh.mshstats.fwded_frames, DEC);
+ IEEE80211_IF_FILE(dropped_frames_ttl, u.mesh.mshstats.dropped_frames_ttl, DEC);
+-IEEE80211_IF_FILE(dropped_frames_congestion,
+-		  u.mesh.mshstats.dropped_frames_congestion, DEC);
+ IEEE80211_IF_FILE(dropped_frames_no_route,
+ 		  u.mesh.mshstats.dropped_frames_no_route, DEC);
+ 
+@@ -740,7 +738,6 @@ static void add_mesh_stats(struct ieee80
+ 	MESHSTATS_ADD(fwded_frames);
+ 	MESHSTATS_ADD(dropped_frames_ttl);
+ 	MESHSTATS_ADD(dropped_frames_no_route);
+-	MESHSTATS_ADD(dropped_frames_congestion);
+ #undef MESHSTATS_ADD
+ }
+ 
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -329,7 +329,6 @@ struct mesh_stats {
+ 	__u32 fwded_frames;		/* Mesh total forwarded frames */
+ 	__u32 dropped_frames_ttl;	/* Not transmitted since mesh_ttl == 0*/
+ 	__u32 dropped_frames_no_route;	/* Not transmitted, no route found */
+-	__u32 dropped_frames_congestion;/* Not forwarded due to congestion */
+ };
+ 
+ #define PREQ_Q_F_START		0x1
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2926,11 +2926,6 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ 		return RX_CONTINUE;
+ 
+ 	ac = ieee802_1d_to_ac[skb->priority];
+-	q = sdata->vif.hw_queue[ac];
+-	if (ieee80211_queue_stopped(&local->hw, q)) {
+-		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
+-		return RX_DROP_MONITOR;
+-	}
+ 	skb_set_queue_mapping(skb, ac);
+ 
+ 	if (!--mesh_hdr->ttl) {
diff --git a/package/kernel/mac80211/patches/subsys/315-mac80211-add-rx-decapsulation-offload-support.patch b/package/kernel/mac80211/patches/subsys/315-mac80211-add-rx-decapsulation-offload-support.patch
deleted file mode 100644
index 226df9830..000000000
--- a/package/kernel/mac80211/patches/subsys/315-mac80211-add-rx-decapsulation-offload-support.patch
+++ /dev/null
@@ -1,570 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 16 Dec 2020 21:34:03 +0100
-Subject: [PATCH] mac80211: add rx decapsulation offload support
-
-This allows drivers to pass 802.3 frames to mac80211, with some restrictions:
-
-- the skb must be passed with a valid sta
-- fast-rx needs to be active for the sta
-- monitor mode needs to be disabled
-
-mac80211 will tell the driver when it is safe to enable rx decap offload for
-a particular station.
-
-In order to implement support, a driver must:
-
-- call ieee80211_hw_set(hw, SUPPORTS_RX_DECAP_OFFLOAD)
-- implement ops->sta_set_decap_offload
-- mark 802.3 frames with RX_FLAG_8023
-
-If it doesn't want to enable offload for some vif types, it can mask out
-IEEE80211_OFFLOAD_DECAP_ENABLED in vif->offload_flags from within the
-.add_interface or .update_vif_offload driver ops
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -1297,6 +1297,8 @@ ieee80211_tx_info_clear_status(struct ie
-  *	the "0-length PSDU" field included there.  The value for it is
-  *	in &struct ieee80211_rx_status.  Note that if this value isn't
-  *	known the frame shouldn't be reported.
-+ * @RX_FLAG_8023: the frame has an 802.3 header (decap offload performed by
-+ *	hardware or driver)
-  */
- enum mac80211_rx_flags {
- 	RX_FLAG_MMIC_ERROR		= BIT(0),
-@@ -1329,6 +1331,7 @@ enum mac80211_rx_flags {
- 	RX_FLAG_RADIOTAP_HE_MU		= BIT(27),
- 	RX_FLAG_RADIOTAP_LSIG		= BIT(28),
- 	RX_FLAG_NO_PSDU			= BIT(29),
-+	RX_FLAG_8023			= BIT(30),
- };
- 
- /**
-@@ -1650,11 +1653,15 @@ enum ieee80211_vif_flags {
-  *	The driver supports sending frames passed as 802.3 frames by mac80211.
-  *	It must also support sending 802.11 packets for the same interface.
-  * @IEEE80211_OFFLOAD_ENCAP_4ADDR: support 4-address mode encapsulation offload
-+ * @IEEE80211_OFFLOAD_DECAP_ENABLED: rx encapsulation offload is enabled
-+ *	The driver supports passing received 802.11 frames as 802.3 frames to
-+ *	mac80211.
-  */
- 
- enum ieee80211_offload_flags {
- 	IEEE80211_OFFLOAD_ENCAP_ENABLED		= BIT(0),
- 	IEEE80211_OFFLOAD_ENCAP_4ADDR		= BIT(1),
-+	IEEE80211_OFFLOAD_DECAP_ENABLED		= BIT(2),
- };
- 
- /**
-@@ -2390,6 +2397,9 @@ struct ieee80211_txq {
-  * @IEEE80211_HW_SUPPORTS_TX_ENCAP_OFFLOAD: Hardware supports tx encapsulation
-  *	offload
-  *
-+ * @IEEE80211_HW_SUPPORTS_RX_DECAP_OFFLOAD: Hardware supports rx decapsulation
-+ *	offload
-+ *
-  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
-  */
- enum ieee80211_hw_flags {
-@@ -2443,6 +2453,7 @@ enum ieee80211_hw_flags {
- 	IEEE80211_HW_SUPPORTS_ONLY_HE_MULTI_BSSID,
- 	IEEE80211_HW_AMPDU_KEYBORDER_SUPPORT,
- 	IEEE80211_HW_SUPPORTS_TX_ENCAP_OFFLOAD,
-+	IEEE80211_HW_SUPPORTS_RX_DECAP_OFFLOAD,
- 
- 	/* keep last, obviously */
- 	NUM_IEEE80211_HW_FLAGS
-@@ -4196,6 +4207,9 @@ struct ieee80211_ops {
- 				   struct ieee80211_vif *vif);
- 	void (*sta_set_4addr)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 			      struct ieee80211_sta *sta, bool enabled);
-+	void (*sta_set_decap_offload)(struct ieee80211_hw *hw,
-+				      struct ieee80211_vif *vif,
-+				      struct ieee80211_sta *sta, bool enabled);
- };
- 
- /**
---- a/net/mac80211/debugfs.c
-+++ b/net/mac80211/debugfs.c
-@@ -405,6 +405,7 @@ static const char *hw_flag_names[] = {
- 	FLAG(SUPPORTS_ONLY_HE_MULTI_BSSID),
- 	FLAG(AMPDU_KEYBORDER_SUPPORT),
- 	FLAG(SUPPORTS_TX_ENCAP_OFFLOAD),
-+	FLAG(SUPPORTS_RX_DECAP_OFFLOAD),
- #undef FLAG
- };
- 
---- a/net/mac80211/debugfs_sta.c
-+++ b/net/mac80211/debugfs_sta.c
-@@ -79,6 +79,7 @@ static const char * const sta_flag_names
- 	FLAG(MPSP_RECIPIENT),
- 	FLAG(PS_DELIVER),
- 	FLAG(USES_ENCRYPTION),
-+	FLAG(DECAP_OFFLOAD),
- #undef FLAG
- };
- 
---- a/net/mac80211/driver-ops.h
-+++ b/net/mac80211/driver-ops.h
-@@ -1413,4 +1413,20 @@ static inline void drv_sta_set_4addr(str
- 	trace_drv_return_void(local);
- }
- 
-+static inline void drv_sta_set_decap_offload(struct ieee80211_local *local,
-+					     struct ieee80211_sub_if_data *sdata,
-+					     struct ieee80211_sta *sta,
-+					     bool enabled)
-+{
-+	sdata = get_bss_sdata(sdata);
-+	if (!check_sdata_in_driver(sdata))
-+		return;
-+
-+	trace_drv_sta_set_decap_offload(local, sdata, sta, enabled);
-+	if (local->ops->sta_set_decap_offload)
-+		local->ops->sta_set_decap_offload(&local->hw, &sdata->vif, sta,
-+						  enabled);
-+	trace_drv_return_void(local);
-+}
-+
- #endif /* __MAC80211_DRIVER_OPS */
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -856,7 +856,7 @@ static const struct net_device_ops ieee8
- 
- };
- 
--static bool ieee80211_iftype_supports_encap_offload(enum nl80211_iftype iftype)
-+static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
- {
- 	switch (iftype) {
- 	/* P2P GO and client are mapped to AP/STATION types */
-@@ -876,7 +876,7 @@ static bool ieee80211_set_sdata_offload_
- 	flags = sdata->vif.offload_flags;
- 
- 	if (ieee80211_hw_check(&local->hw, SUPPORTS_TX_ENCAP_OFFLOAD) &&
--	    ieee80211_iftype_supports_encap_offload(sdata->vif.type)) {
-+	    ieee80211_iftype_supports_hdr_offload(sdata->vif.type)) {
- 		flags |= IEEE80211_OFFLOAD_ENCAP_ENABLED;
- 
- 		if (!ieee80211_hw_check(&local->hw, SUPPORTS_TX_FRAG) &&
-@@ -889,10 +889,21 @@ static bool ieee80211_set_sdata_offload_
- 		flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
- 	}
- 
-+	if (ieee80211_hw_check(&local->hw, SUPPORTS_RX_DECAP_OFFLOAD) &&
-+	    ieee80211_iftype_supports_hdr_offload(sdata->vif.type)) {
-+		flags |= IEEE80211_OFFLOAD_DECAP_ENABLED;
-+
-+		if (local->monitors)
-+			flags &= ~IEEE80211_OFFLOAD_DECAP_ENABLED;
-+	} else {
-+		flags &= ~IEEE80211_OFFLOAD_DECAP_ENABLED;
-+	}
-+
- 	if (sdata->vif.offload_flags == flags)
- 		return false;
- 
- 	sdata->vif.offload_flags = flags;
-+	ieee80211_check_fast_rx_iface(sdata);
- 	return true;
- }
- 
-@@ -910,7 +921,7 @@ static void ieee80211_set_vif_encap_ops(
- 	}
- 
- 	if (!ieee80211_hw_check(&local->hw, SUPPORTS_TX_ENCAP_OFFLOAD) ||
--	    !ieee80211_iftype_supports_encap_offload(bss->vif.type))
-+	    !ieee80211_iftype_supports_hdr_offload(bss->vif.type))
- 		return;
- 
- 	enabled = bss->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED;
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -4198,7 +4198,9 @@ void ieee80211_check_fast_rx(struct sta_
- 		.vif_type = sdata->vif.type,
- 		.control_port_protocol = sdata->control_port_protocol,
- 	}, *old, *new = NULL;
-+	bool set_offload = false;
- 	bool assign = false;
-+	bool offload;
- 
- 	/* use sparse to check that we don't return without updating */
- 	__acquire(check_fast_rx);
-@@ -4311,6 +4313,17 @@ void ieee80211_check_fast_rx(struct sta_
- 	if (assign)
- 		new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);
- 
-+	offload = assign &&
-+		  (sdata->vif.offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED);
-+
-+	if (offload)
-+		set_offload = !test_and_set_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
-+	else
-+		set_offload = test_and_clear_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
-+
-+	if (set_offload)
-+		drv_sta_set_decap_offload(local, sdata, &sta->sta, assign);
-+
- 	spin_lock_bh(&sta->lock);
- 	old = rcu_dereference_protected(sta->fast_rx, true);
- 	rcu_assign_pointer(sta->fast_rx, new);
-@@ -4357,6 +4370,108 @@ void ieee80211_check_fast_rx_iface(struc
- 	mutex_unlock(&local->sta_mtx);
- }
- 
-+static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
-+			      struct ieee80211_fast_rx *fast_rx,
-+			      int orig_len)
-+{
-+	struct ieee80211_sta_rx_stats *stats;
-+	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
-+	struct sta_info *sta = rx->sta;
-+	struct sk_buff *skb = rx->skb;
-+	void *sa = skb->data + ETH_ALEN;
-+	void *da = skb->data;
-+
-+	stats = &sta->rx_stats;
-+	if (fast_rx->uses_rss)
-+		stats = this_cpu_ptr(sta->pcpu_rx_stats);
-+
-+	/* statistics part of ieee80211_rx_h_sta_process() */
-+	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
-+		stats->last_signal = status->signal;
-+		if (!fast_rx->uses_rss)
-+			ewma_signal_add(&sta->rx_stats_avg.signal,
-+					-status->signal);
-+	}
-+
-+	if (status->chains) {
-+		int i;
-+
-+		stats->chains = status->chains;
-+		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
-+			int signal = status->chain_signal[i];
-+
-+			if (!(status->chains & BIT(i)))
-+				continue;
-+
-+			stats->chain_signal_last[i] = signal;
-+			if (!fast_rx->uses_rss)
-+				ewma_signal_add(&sta->rx_stats_avg.chain_signal[i],
-+						-signal);
-+		}
-+	}
-+	/* end of statistics */
-+
-+	stats->last_rx = jiffies;
-+	stats->last_rate = sta_stats_encode_rate(status);
-+
-+	stats->fragments++;
-+	stats->packets++;
-+
-+	skb->dev = fast_rx->dev;
-+
-+	ieee80211_rx_stats(fast_rx->dev, skb->len);
-+
-+	/* The seqno index has the same property as needed
-+	 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
-+	 * for non-QoS-data frames. Here we know it's a data
-+	 * frame, so count MSDUs.
-+	 */
-+	u64_stats_update_begin(&stats->syncp);
-+	stats->msdu[rx->seqno_idx]++;
-+	stats->bytes += orig_len;
-+	u64_stats_update_end(&stats->syncp);
-+
-+	if (fast_rx->internal_forward) {
-+		struct sk_buff *xmit_skb = NULL;
-+		if (is_multicast_ether_addr(da)) {
-+			xmit_skb = skb_copy(skb, GFP_ATOMIC);
-+		} else if (!ether_addr_equal(da, sa) &&
-+			   sta_info_get(rx->sdata, da)) {
-+			xmit_skb = skb;
-+			skb = NULL;
-+		}
-+
-+		if (xmit_skb) {
-+			/*
-+			 * Send to wireless media and increase priority by 256
-+			 * to keep the received priority instead of
-+			 * reclassifying the frame (see cfg80211_classify8021d).
-+			 */
-+			xmit_skb->priority += 256;
-+			xmit_skb->protocol = htons(ETH_P_802_3);
-+			skb_reset_network_header(xmit_skb);
-+			skb_reset_mac_header(xmit_skb);
-+			dev_queue_xmit(xmit_skb);
-+		}
-+
-+		if (!skb)
-+			return;
-+	}
-+
-+	/* deliver to local stack */
-+	skb->protocol = eth_type_trans(skb, fast_rx->dev);
-+	memset(skb->cb, 0, sizeof(skb->cb));
-+	if (rx->list)
-+#if LINUX_VERSION_IS_GEQ(4,19,0)
-+		list_add_tail(&skb->list, rx->list);
-+#else
-+		__skb_queue_tail(rx->list, skb);
-+#endif
-+	else
-+		netif_receive_skb(skb);
-+
-+}
-+
- static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
- 				     struct ieee80211_fast_rx *fast_rx)
- {
-@@ -4377,9 +4492,6 @@ static bool ieee80211_invoke_fast_rx(str
- 	} addrs __aligned(2);
- 	struct ieee80211_sta_rx_stats *stats = &sta->rx_stats;
- 
--	if (fast_rx->uses_rss)
--		stats = this_cpu_ptr(sta->pcpu_rx_stats);
--
- 	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
- 	 * to a common data structure; drivers can implement that per queue
- 	 * but we don't have that information in mac80211
-@@ -4453,32 +4565,6 @@ static bool ieee80211_invoke_fast_rx(str
- 	    pskb_trim(skb, skb->len - fast_rx->icv_len))
- 		goto drop;
- 
--	/* statistics part of ieee80211_rx_h_sta_process() */
--	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
--		stats->last_signal = status->signal;
--		if (!fast_rx->uses_rss)
--			ewma_signal_add(&sta->rx_stats_avg.signal,
--					-status->signal);
--	}
--
--	if (status->chains) {
--		int i;
--
--		stats->chains = status->chains;
--		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
--			int signal = status->chain_signal[i];
--
--			if (!(status->chains & BIT(i)))
--				continue;
--
--			stats->chain_signal_last[i] = signal;
--			if (!fast_rx->uses_rss)
--				ewma_signal_add(&sta->rx_stats_avg.chain_signal[i],
--						-signal);
--		}
--	}
--	/* end of statistics */
--
- 	if (rx->key && !ieee80211_has_protected(hdr->frame_control))
- 		goto drop;
- 
-@@ -4490,12 +4576,6 @@ static bool ieee80211_invoke_fast_rx(str
- 		return true;
- 	}
- 
--	stats->last_rx = jiffies;
--	stats->last_rate = sta_stats_encode_rate(status);
--
--	stats->fragments++;
--	stats->packets++;
--
- 	/* do the header conversion - first grab the addresses */
- 	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
- 	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
-@@ -4504,62 +4584,14 @@ static bool ieee80211_invoke_fast_rx(str
- 	/* push the addresses in front */
- 	memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
- 
--	skb->dev = fast_rx->dev;
--
--	ieee80211_rx_stats(fast_rx->dev, skb->len);
--
--	/* The seqno index has the same property as needed
--	 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
--	 * for non-QoS-data frames. Here we know it's a data
--	 * frame, so count MSDUs.
--	 */
--	u64_stats_update_begin(&stats->syncp);
--	stats->msdu[rx->seqno_idx]++;
--	stats->bytes += orig_len;
--	u64_stats_update_end(&stats->syncp);
--
--	if (fast_rx->internal_forward) {
--		struct sk_buff *xmit_skb = NULL;
--		if (is_multicast_ether_addr(addrs.da)) {
--			xmit_skb = skb_copy(skb, GFP_ATOMIC);
--		} else if (!ether_addr_equal(addrs.da, addrs.sa) &&
--			   sta_info_get(rx->sdata, addrs.da)) {
--			xmit_skb = skb;
--			skb = NULL;
--		}
--
--		if (xmit_skb) {
--			/*
--			 * Send to wireless media and increase priority by 256
--			 * to keep the received priority instead of
--			 * reclassifying the frame (see cfg80211_classify8021d).
--			 */
--			xmit_skb->priority += 256;
--			xmit_skb->protocol = htons(ETH_P_802_3);
--			skb_reset_network_header(xmit_skb);
--			skb_reset_mac_header(xmit_skb);
--			dev_queue_xmit(xmit_skb);
--		}
--
--		if (!skb)
--			return true;
--	}
--
--	/* deliver to local stack */
--	skb->protocol = eth_type_trans(skb, fast_rx->dev);
--	memset(skb->cb, 0, sizeof(skb->cb));
--	if (rx->list)
--#if LINUX_VERSION_IS_GEQ(4,19,0)
--		list_add_tail(&skb->list, rx->list);
--#else
--		__skb_queue_tail(rx->list, skb);
--#endif
--	else
--		netif_receive_skb(skb);
-+	ieee80211_rx_8023(rx, fast_rx, orig_len);
- 
- 	return true;
-  drop:
- 	dev_kfree_skb(skb);
-+	if (fast_rx->uses_rss)
-+		stats = this_cpu_ptr(sta->pcpu_rx_stats);
-+
- 	stats->dropped++;
- 	return true;
- }
-@@ -4613,6 +4645,47 @@ static bool ieee80211_prepare_and_rx_han
- 	return true;
- }
- 
-+static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw,
-+				       struct ieee80211_sta *pubsta,
-+				       struct sk_buff *skb,
-+#if LINUX_VERSION_IS_GEQ(4,19,0)
-+				       struct list_head *list)
-+#else
-+				       struct sk_buff_head *list)
-+#endif
-+{
-+	struct ieee80211_local *local = hw_to_local(hw);
-+	struct ieee80211_fast_rx *fast_rx;
-+	struct ieee80211_rx_data rx;
-+
-+	memset(&rx, 0, sizeof(rx));
-+	rx.skb = skb;
-+	rx.local = local;
-+	rx.list = list;
-+
-+	I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
-+
-+	/* drop frame if too short for header */
-+	if (skb->len < sizeof(struct ethhdr))
-+		goto drop;
-+
-+	if (!pubsta)
-+		goto drop;
-+
-+	rx.sta = container_of(pubsta, struct sta_info, sta);
-+	rx.sdata = rx.sta->sdata;
-+
-+	fast_rx = rcu_dereference(rx.sta->fast_rx);
-+	if (!fast_rx)
-+		goto drop;
-+
-+	ieee80211_rx_8023(&rx, fast_rx, skb->len);
-+	return;
-+
-+drop:
-+	dev_kfree_skb(skb);
-+}
-+
- /*
-  * This is the actual Rx frames handler. as it belongs to Rx path it must
-  * be called with rcu_read_lock protection.
-@@ -4850,15 +4923,20 @@ void ieee80211_rx_list(struct ieee80211_
- 	 * if it was previously present.
- 	 * Also, frames with less than 16 bytes are dropped.
- 	 */
--	skb = ieee80211_rx_monitor(local, skb, rate);
--	if (!skb)
--		return;
-+	if (!(status->flag & RX_FLAG_8023)) {
-+		skb = ieee80211_rx_monitor(local, skb, rate);
-+		if (!skb)
-+			return;
-+	}
- 
- 	ieee80211_tpt_led_trig_rx(local,
- 			((struct ieee80211_hdr *)skb->data)->frame_control,
- 			skb->len);
- 
--	__ieee80211_rx_handle_packet(hw, pubsta, skb, list);
-+	if (status->flag & RX_FLAG_8023)
-+		__ieee80211_rx_handle_8023(hw, pubsta, skb, list);
-+	else
-+		__ieee80211_rx_handle_packet(hw, pubsta, skb, list);
- 
- 	return;
-  drop:
---- a/net/mac80211/sta_info.h
-+++ b/net/mac80211/sta_info.h
-@@ -71,6 +71,7 @@
-  *	until pending frames are delivered
-  * @WLAN_STA_USES_ENCRYPTION: This station was configured for encryption,
-  *	so drop all packets without a key later.
-+ * @WLAN_STA_DECAP_OFFLOAD: This station uses rx decap offload
-  *
-  * @NUM_WLAN_STA_FLAGS: number of defined flags
-  */
-@@ -102,6 +103,7 @@ enum ieee80211_sta_info_flags {
- 	WLAN_STA_MPSP_RECIPIENT,
- 	WLAN_STA_PS_DELIVER,
- 	WLAN_STA_USES_ENCRYPTION,
-+	WLAN_STA_DECAP_OFFLOAD,
- 
- 	NUM_WLAN_STA_FLAGS,
- };
---- a/net/mac80211/trace.h
-+++ b/net/mac80211/trace.h
-@@ -2761,7 +2761,7 @@ DEFINE_EVENT(local_sdata_addr_evt, drv_u
- 	TP_ARGS(local, sdata)
- );
- 
--TRACE_EVENT(drv_sta_set_4addr,
-+DECLARE_EVENT_CLASS(sta_flag_evt,
- 	TP_PROTO(struct ieee80211_local *local,
- 		 struct ieee80211_sub_if_data *sdata,
- 		 struct ieee80211_sta *sta, bool enabled),
-@@ -2788,6 +2788,22 @@ TRACE_EVENT(drv_sta_set_4addr,
- 	)
- );
- 
-+DEFINE_EVENT(sta_flag_evt, drv_sta_set_4addr,
-+	TP_PROTO(struct ieee80211_local *local,
-+		 struct ieee80211_sub_if_data *sdata,
-+		 struct ieee80211_sta *sta, bool enabled),
-+
-+	TP_ARGS(local, sdata, sta, enabled)
-+);
-+
-+DEFINE_EVENT(sta_flag_evt, drv_sta_set_decap_offload,
-+	TP_PROTO(struct ieee80211_local *local,
-+		 struct ieee80211_sub_if_data *sdata,
-+		 struct ieee80211_sta *sta, bool enabled),
-+
-+	TP_ARGS(local, sdata, sta, enabled)
-+);
-+
- #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
- 
- #undef TRACE_INCLUDE_PATH
diff --git a/package/kernel/mac80211/patches/subsys/315-v6.3-wifi-mac80211-fix-receiving-A-MSDU-frames-on-mesh-in.patch b/package/kernel/mac80211/patches/subsys/315-v6.3-wifi-mac80211-fix-receiving-A-MSDU-frames-on-mesh-in.patch
new file mode 100644
index 000000000..59b799b6b
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/315-v6.3-wifi-mac80211-fix-receiving-A-MSDU-frames-on-mesh-in.patch
@@ -0,0 +1,762 @@
+From 986e43b19ae9176093da35e0a844e65c8bf9ede7 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 13 Feb 2023 11:08:54 +0100
+Subject: [PATCH] wifi: mac80211: fix receiving A-MSDU frames on mesh
+ interfaces
+
+The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets
+on mesh interfaces, because it assumes that the Mesh Control field is always
+directly after the 802.11 header.
+802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is
+actually part of the A-MSDU subframe header.
+This makes more sense, since it allows packets for multiple different
+destinations to be included in the same A-MSDU, as long as RA and TID are
+still the same.
+Another issue is the fact that the A-MSDU subframe length field was apparently
+accidentally defined as little-endian in the standard.
+
+In order to fix this, the mesh forwarding path needs happen at a different
+point in the receive path.
+
+ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field
+and leave it in after the ethernet header. This also affects the source/dest
+MAC address fields, which now in the case of mesh point to the mesh SA/DA.
+
+ieee80211_amsdu_to_8023s is changed to deal with the endian difference and
+to add the Mesh Control length to the subframe length, since it's not covered
+by the MSDU length field.
+
+With these changes, the mac80211 will get the same packet structure for
+converted regular data packets and unpacked A-MSDU subframes.
+
+The mesh forwarding checks are now only performed after the A-MSDU decap.
+For locally received packets, the Mesh Control header is stripped away.
+For forwarded packets, a new 802.11 header gets added.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name
+[fix fortify build error]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ .../wireless/marvell/mwifiex/11n_rxreorder.c  |   2 +-
+ include/net/cfg80211.h                        |  27 +-
+ net/mac80211/rx.c                             | 350 ++++++++++--------
+ net/wireless/util.c                           | 120 +++---
+ 4 files changed, 297 insertions(+), 202 deletions(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
++++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+@@ -33,7 +33,7 @@ static int mwifiex_11n_dispatch_amsdu_pk
+ 		skb_trim(skb, le16_to_cpu(local_rx_pd->rx_pkt_length));
+ 
+ 		ieee80211_amsdu_to_8023s(skb, &list, priv->curr_addr,
+-					 priv->wdev.iftype, 0, NULL, NULL);
++					 priv->wdev.iftype, 0, NULL, NULL, false);
+ 
+ 		while (!skb_queue_empty(&list)) {
+ 			struct rx_packet_hdr *rx_hdr;
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -6208,11 +6208,36 @@ static inline int ieee80211_data_to_8023
+  * @extra_headroom: The hardware extra headroom for SKBs in the @list.
+  * @check_da: DA to check in the inner ethernet header, or NULL
+  * @check_sa: SA to check in the inner ethernet header, or NULL
++ * @mesh_control: A-MSDU subframe header includes the mesh control field
+  */
+ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
+ 			      const u8 *addr, enum nl80211_iftype iftype,
+ 			      const unsigned int extra_headroom,
+-			      const u8 *check_da, const u8 *check_sa);
++			      const u8 *check_da, const u8 *check_sa,
++			      bool mesh_control);
++
++/**
++ * ieee80211_get_8023_tunnel_proto - get RFC1042 or bridge tunnel encap protocol
++ *
++ * Check for RFC1042 or bridge tunnel header and fetch the encapsulated
++ * protocol.
++ *
++ * @hdr: pointer to the MSDU payload
++ * @proto: destination pointer to store the protocol
++ * Return: true if encapsulation was found
++ */
++bool ieee80211_get_8023_tunnel_proto(const void *hdr, __be16 *proto);
++
++/**
++ * ieee80211_strip_8023_mesh_hdr - strip mesh header from converted 802.3 frames
++ *
++ * Strip the mesh header, which was left in by ieee80211_data_to_8023 as part
++ * of the MSDU data. Also move any source/destination addresses from the mesh
++ * header to the ethernet header (if present).
++ *
++ * @skb: The 802.3 frame with embedded mesh header
++ */
++int ieee80211_strip_8023_mesh_hdr(struct sk_buff *skb);
+ 
+ /**
+  * cfg80211_classify8021d - determine the 802.1p/1d tag for a data frame
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2720,6 +2720,174 @@ ieee80211_deliver_skb(struct ieee80211_r
+ 	}
+ }
+ 
++static ieee80211_rx_result
++ieee80211_rx_mesh_data(struct ieee80211_sub_if_data *sdata, struct sta_info *sta,
++		       struct sk_buff *skb)
++{
++#ifdef CPTCFG_MAC80211_MESH
++	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
++	struct ieee80211_local *local = sdata->local;
++	uint16_t fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA;
++	struct ieee80211_hdr hdr = {
++		.frame_control = cpu_to_le16(fc)
++	};
++	struct ieee80211_hdr *fwd_hdr;
++	struct ieee80211s_hdr *mesh_hdr;
++	struct ieee80211_tx_info *info;
++	struct sk_buff *fwd_skb;
++	struct ethhdr *eth;
++	bool multicast;
++	int tailroom = 0;
++	int hdrlen, mesh_hdrlen;
++	u8 *qos;
++
++	if (!ieee80211_vif_is_mesh(&sdata->vif))
++		return RX_CONTINUE;
++
++	if (!pskb_may_pull(skb, sizeof(*eth) + 6))
++		return RX_DROP_MONITOR;
++
++	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(*eth));
++	mesh_hdrlen = ieee80211_get_mesh_hdrlen(mesh_hdr);
++
++	if (!pskb_may_pull(skb, sizeof(*eth) + mesh_hdrlen))
++		return RX_DROP_MONITOR;
++
++	eth = (struct ethhdr *)skb->data;
++	multicast = is_multicast_ether_addr(eth->h_dest);
++
++	mesh_hdr = (struct ieee80211s_hdr *)(eth + 1);
++	if (!mesh_hdr->ttl)
++		return RX_DROP_MONITOR;
++
++	/* frame is in RMC, don't forward */
++	if (is_multicast_ether_addr(eth->h_dest) &&
++	    mesh_rmc_check(sdata, eth->h_source, mesh_hdr))
++		return RX_DROP_MONITOR;
++
++	/* Frame has reached destination.  Don't forward */
++	if (ether_addr_equal(sdata->vif.addr, eth->h_dest))
++		goto rx_accept;
++
++	if (!ifmsh->mshcfg.dot11MeshForwarding) {
++		if (is_multicast_ether_addr(eth->h_dest))
++			goto rx_accept;
++
++		return RX_DROP_MONITOR;
++	}
++
++	/* forward packet */
++	if (sdata->crypto_tx_tailroom_needed_cnt)
++		tailroom = IEEE80211_ENCRYPT_TAILROOM;
++
++	if (!--mesh_hdr->ttl) {
++		if (multicast)
++			goto rx_accept;
++
++		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
++		return RX_DROP_MONITOR;
++	}
++
++	if (mesh_hdr->flags & MESH_FLAGS_AE) {
++		struct mesh_path *mppath;
++		char *proxied_addr;
++
++		if (multicast)
++			proxied_addr = mesh_hdr->eaddr1;
++		else if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
++			/* has_a4 already checked in ieee80211_rx_mesh_check */
++			proxied_addr = mesh_hdr->eaddr2;
++		else
++			return RX_DROP_MONITOR;
++
++		rcu_read_lock();
++		mppath = mpp_path_lookup(sdata, proxied_addr);
++		if (!mppath) {
++			mpp_path_add(sdata, proxied_addr, eth->h_source);
++		} else {
++			spin_lock_bh(&mppath->state_lock);
++			if (!ether_addr_equal(mppath->mpp, eth->h_source))
++				memcpy(mppath->mpp, eth->h_source, ETH_ALEN);
++			mppath->exp_time = jiffies;
++			spin_unlock_bh(&mppath->state_lock);
++		}
++		rcu_read_unlock();
++	}
++
++	skb_set_queue_mapping(skb, ieee802_1d_to_ac[skb->priority]);
++
++	ieee80211_fill_mesh_addresses(&hdr, &hdr.frame_control,
++				      eth->h_dest, eth->h_source);
++	hdrlen = ieee80211_hdrlen(hdr.frame_control);
++	if (multicast) {
++		int extra_head = sizeof(struct ieee80211_hdr) - sizeof(*eth);
++
++		fwd_skb = skb_copy_expand(skb, local->tx_headroom + extra_head +
++					       IEEE80211_ENCRYPT_HEADROOM,
++					  tailroom, GFP_ATOMIC);
++		if (!fwd_skb)
++			goto rx_accept;
++	} else {
++		fwd_skb = skb;
++		skb = NULL;
++
++		if (skb_cow_head(fwd_skb, hdrlen - sizeof(struct ethhdr)))
++			return RX_DROP_UNUSABLE;
++	}
++
++	fwd_hdr = skb_push(fwd_skb, hdrlen - sizeof(struct ethhdr));
++	memcpy(fwd_hdr, &hdr, hdrlen - 2);
++	qos = ieee80211_get_qos_ctl(fwd_hdr);
++	qos[0] = qos[1] = 0;
++
++	skb_reset_mac_header(fwd_skb);
++	hdrlen += mesh_hdrlen;
++	if (ieee80211_get_8023_tunnel_proto(fwd_skb->data + hdrlen,
++					    &fwd_skb->protocol))
++		hdrlen += ETH_ALEN;
++	else
++		fwd_skb->protocol = htons(fwd_skb->len - hdrlen);
++	skb_set_network_header(fwd_skb, hdrlen);
++
++	info = IEEE80211_SKB_CB(fwd_skb);
++	memset(info, 0, sizeof(*info));
++	info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
++	info->control.vif = &sdata->vif;
++	info->control.jiffies = jiffies;
++	if (multicast) {
++		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
++		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
++		/* update power mode indication when forwarding */
++		ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
++	} else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
++		/* mesh power mode flags updated in mesh_nexthop_lookup */
++		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
++	} else {
++		/* unable to resolve next hop */
++		if (sta)
++			mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
++					   hdr.addr3, 0,
++					   WLAN_REASON_MESH_PATH_NOFORWARD,
++					   sta->sta.addr);
++		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
++		kfree_skb(fwd_skb);
++		goto rx_accept;
++	}
++
++	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
++	fwd_skb->dev = sdata->dev;
++	ieee80211_add_pending_skb(local, fwd_skb);
++
++rx_accept:
++	if (!skb)
++		return RX_QUEUED;
++
++	ieee80211_strip_8023_mesh_hdr(skb);
++#endif
++
++	return RX_CONTINUE;
++}
++
+ static ieee80211_rx_result debug_noinline
+ __ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
+ {
+@@ -2728,8 +2896,10 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ 	__le16 fc = hdr->frame_control;
+ 	struct sk_buff_head frame_list;
++	static ieee80211_rx_result res;
+ 	struct ethhdr ethhdr;
+ 	const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
++	bool mesh = false;
+ 
+ 	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
+ 		check_da = NULL;
+@@ -2746,6 +2916,8 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 			break;
+ 		case NL80211_IFTYPE_MESH_POINT:
+ 			check_sa = NULL;
++			check_da = NULL;
++			mesh = true;
+ 			break;
+ 		default:
+ 			break;
+@@ -2763,17 +2935,29 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
+ 				 rx->sdata->vif.type,
+ 				 rx->local->hw.extra_tx_headroom,
+-				 check_da, check_sa);
++				 check_da, check_sa, mesh);
+ 
+ 	while (!skb_queue_empty(&frame_list)) {
+ 		rx->skb = __skb_dequeue(&frame_list);
+ 
+-		if (!ieee80211_frame_allowed(rx, fc)) {
+-			dev_kfree_skb(rx->skb);
++		res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
++		switch (res) {
++		case RX_QUEUED:
+ 			continue;
++		case RX_CONTINUE:
++			break;
++		default:
++			goto free;
+ 		}
+ 
++		if (!ieee80211_frame_allowed(rx, fc))
++			goto free;
++
+ 		ieee80211_deliver_skb(rx);
++		continue;
++
++free:
++		dev_kfree_skb(rx->skb);
+ 	}
+ 
+ 	return RX_QUEUED;
+@@ -2806,6 +2990,8 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
+ 			if (!rx->sdata->u.mgd.use_4addr)
+ 				return RX_DROP_UNUSABLE;
+ 			break;
++		case NL80211_IFTYPE_MESH_POINT:
++			break;
+ 		default:
+ 			return RX_DROP_UNUSABLE;
+ 		}
+@@ -2834,155 +3020,6 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
+ 	return __ieee80211_rx_h_amsdu(rx, 0);
+ }
+ 
+-#ifdef CPTCFG_MAC80211_MESH
+-static ieee80211_rx_result
+-ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+-{
+-	struct ieee80211_hdr *fwd_hdr, *hdr;
+-	struct ieee80211_tx_info *info;
+-	struct ieee80211s_hdr *mesh_hdr;
+-	struct sk_buff *skb = rx->skb, *fwd_skb;
+-	struct ieee80211_local *local = rx->local;
+-	struct ieee80211_sub_if_data *sdata = rx->sdata;
+-	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+-	u16 ac, q, hdrlen;
+-	int tailroom = 0;
+-
+-	hdr = (struct ieee80211_hdr *) skb->data;
+-	hdrlen = ieee80211_hdrlen(hdr->frame_control);
+-
+-	/* make sure fixed part of mesh header is there, also checks skb len */
+-	if (!pskb_may_pull(rx->skb, hdrlen + 6))
+-		return RX_DROP_MONITOR;
+-
+-	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+-
+-	/* make sure full mesh header is there, also checks skb len */
+-	if (!pskb_may_pull(rx->skb,
+-			   hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
+-		return RX_DROP_MONITOR;
+-
+-	/* reload pointers */
+-	hdr = (struct ieee80211_hdr *) skb->data;
+-	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+-
+-	if (ieee80211_drop_unencrypted(rx, hdr->frame_control)) {
+-		int offset = hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr) +
+-			     sizeof(rfc1042_header);
+-		__be16 ethertype;
+-
+-		if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr) ||
+-		    skb_copy_bits(rx->skb, offset, &ethertype, 2) != 0 ||
+-		    ethertype != rx->sdata->control_port_protocol)
+-			return RX_DROP_MONITOR;
+-	}
+-
+-	/* frame is in RMC, don't forward */
+-	if (ieee80211_is_data(hdr->frame_control) &&
+-	    is_multicast_ether_addr(hdr->addr1) &&
+-	    mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
+-		return RX_DROP_MONITOR;
+-
+-	if (!ieee80211_is_data(hdr->frame_control))
+-		return RX_CONTINUE;
+-
+-	if (!mesh_hdr->ttl)
+-		return RX_DROP_MONITOR;
+-
+-	if (mesh_hdr->flags & MESH_FLAGS_AE) {
+-		struct mesh_path *mppath;
+-		char *proxied_addr;
+-		char *mpp_addr;
+-
+-		if (is_multicast_ether_addr(hdr->addr1)) {
+-			mpp_addr = hdr->addr3;
+-			proxied_addr = mesh_hdr->eaddr1;
+-		} else if ((mesh_hdr->flags & MESH_FLAGS_AE) ==
+-			    MESH_FLAGS_AE_A5_A6) {
+-			/* has_a4 already checked in ieee80211_rx_mesh_check */
+-			mpp_addr = hdr->addr4;
+-			proxied_addr = mesh_hdr->eaddr2;
+-		} else {
+-			return RX_DROP_MONITOR;
+-		}
+-
+-		rcu_read_lock();
+-		mppath = mpp_path_lookup(sdata, proxied_addr);
+-		if (!mppath) {
+-			mpp_path_add(sdata, proxied_addr, mpp_addr);
+-		} else {
+-			spin_lock_bh(&mppath->state_lock);
+-			if (!ether_addr_equal(mppath->mpp, mpp_addr))
+-				memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
+-			mppath->exp_time = jiffies;
+-			spin_unlock_bh(&mppath->state_lock);
+-		}
+-		rcu_read_unlock();
+-	}
+-
+-	/* Frame has reached destination.  Don't forward */
+-	if (!is_multicast_ether_addr(hdr->addr1) &&
+-	    ether_addr_equal(sdata->vif.addr, hdr->addr3))
+-		return RX_CONTINUE;
+-
+-	ac = ieee802_1d_to_ac[skb->priority];
+-	skb_set_queue_mapping(skb, ac);
+-
+-	if (!--mesh_hdr->ttl) {
+-		if (!is_multicast_ether_addr(hdr->addr1))
+-			IEEE80211_IFSTA_MESH_CTR_INC(ifmsh,
+-						     dropped_frames_ttl);
+-		goto out;
+-	}
+-
+-	if (!ifmsh->mshcfg.dot11MeshForwarding)
+-		goto out;
+-
+-	if (sdata->crypto_tx_tailroom_needed_cnt)
+-		tailroom = IEEE80211_ENCRYPT_TAILROOM;
+-
+-	fwd_skb = skb_copy_expand(skb, local->tx_headroom +
+-				       IEEE80211_ENCRYPT_HEADROOM,
+-				  tailroom, GFP_ATOMIC);
+-	if (!fwd_skb)
+-		goto out;
+-
+-	fwd_skb->dev = sdata->dev;
+-	fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
+-	fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
+-	info = IEEE80211_SKB_CB(fwd_skb);
+-	memset(info, 0, sizeof(*info));
+-	info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
+-	info->control.vif = &rx->sdata->vif;
+-	info->control.jiffies = jiffies;
+-	if (is_multicast_ether_addr(fwd_hdr->addr1)) {
+-		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
+-		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
+-		/* update power mode indication when forwarding */
+-		ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
+-	} else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
+-		/* mesh power mode flags updated in mesh_nexthop_lookup */
+-		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
+-	} else {
+-		/* unable to resolve next hop */
+-		mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
+-				   fwd_hdr->addr3, 0,
+-				   WLAN_REASON_MESH_PATH_NOFORWARD,
+-				   fwd_hdr->addr2);
+-		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
+-		kfree_skb(fwd_skb);
+-		return RX_DROP_MONITOR;
+-	}
+-
+-	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
+-	ieee80211_add_pending_skb(local, fwd_skb);
+- out:
+-	if (is_multicast_ether_addr(hdr->addr1))
+-		return RX_CONTINUE;
+-	return RX_DROP_MONITOR;
+-}
+-#endif
+-
+ static ieee80211_rx_result debug_noinline
+ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
+ {
+@@ -2991,6 +3028,7 @@ ieee80211_rx_h_data(struct ieee80211_rx_
+ 	struct net_device *dev = sdata->dev;
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+ 	__le16 fc = hdr->frame_control;
++	static ieee80211_rx_result res;
+ 	bool port_control;
+ 	int err;
+ 
+@@ -3017,6 +3055,10 @@ ieee80211_rx_h_data(struct ieee80211_rx_
+ 	if (unlikely(err))
+ 		return RX_DROP_UNUSABLE;
+ 
++	res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
++	if (res != RX_CONTINUE)
++		return res;
++
+ 	if (!ieee80211_frame_allowed(rx, fc))
+ 		return RX_DROP_MONITOR;
+ 
+@@ -3987,10 +4029,6 @@ static void ieee80211_rx_handlers(struct
+ 		CALL_RXH(ieee80211_rx_h_defragment);
+ 		CALL_RXH(ieee80211_rx_h_michael_mic_verify);
+ 		/* must be after MMIC verify so header is counted in MPDU mic */
+-#ifdef CPTCFG_MAC80211_MESH
+-		if (ieee80211_vif_is_mesh(&rx->sdata->vif))
+-			CALL_RXH(ieee80211_rx_h_mesh_fwding);
+-#endif
+ 		CALL_RXH(ieee80211_rx_h_amsdu);
+ 		CALL_RXH(ieee80211_rx_h_data);
+ 
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -542,7 +542,7 @@ unsigned int ieee80211_get_mesh_hdrlen(s
+ }
+ EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
+ 
+-static bool ieee80211_get_8023_tunnel_proto(const void *hdr, __be16 *proto)
++bool ieee80211_get_8023_tunnel_proto(const void *hdr, __be16 *proto)
+ {
+ 	const __be16 *hdr_proto = hdr + ETH_ALEN;
+ 
+@@ -556,6 +556,49 @@ static bool ieee80211_get_8023_tunnel_pr
+ 
+ 	return true;
+ }
++EXPORT_SYMBOL(ieee80211_get_8023_tunnel_proto);
++
++int ieee80211_strip_8023_mesh_hdr(struct sk_buff *skb)
++{
++	const void *mesh_addr;
++	struct {
++		struct ethhdr eth;
++		u8 flags;
++	} payload;
++	int hdrlen;
++	int ret;
++
++	ret = skb_copy_bits(skb, 0, &payload, sizeof(payload));
++	if (ret)
++		return ret;
++
++	hdrlen = sizeof(payload.eth) + __ieee80211_get_mesh_hdrlen(payload.flags);
++
++	if (likely(pskb_may_pull(skb, hdrlen + 8) &&
++		   ieee80211_get_8023_tunnel_proto(skb->data + hdrlen,
++						   &payload.eth.h_proto)))
++		hdrlen += ETH_ALEN + 2;
++	else if (!pskb_may_pull(skb, hdrlen))
++		return -EINVAL;
++
++	mesh_addr = skb->data + sizeof(payload.eth) + ETH_ALEN;
++	switch (payload.flags & MESH_FLAGS_AE) {
++	case MESH_FLAGS_AE_A4:
++		memcpy(&payload.eth.h_source, mesh_addr, ETH_ALEN);
++		break;
++	case MESH_FLAGS_AE_A5_A6:
++		memcpy(&payload.eth, mesh_addr, 2 * ETH_ALEN);
++		break;
++	default:
++		break;
++	}
++
++	pskb_pull(skb, hdrlen - sizeof(payload.eth));
++	memcpy(skb->data, &payload.eth, sizeof(payload.eth));
++
++	return 0;
++}
++EXPORT_SYMBOL(ieee80211_strip_8023_mesh_hdr);
+ 
+ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
+ 				  const u8 *addr, enum nl80211_iftype iftype,
+@@ -568,7 +611,6 @@ int ieee80211_data_to_8023_exthdr(struct
+ 	} payload;
+ 	struct ethhdr tmp;
+ 	u16 hdrlen;
+-	u8 mesh_flags = 0;
+ 
+ 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
+ 		return -1;
+@@ -589,12 +631,6 @@ int ieee80211_data_to_8023_exthdr(struct
+ 	memcpy(tmp.h_dest, ieee80211_get_DA(hdr), ETH_ALEN);
+ 	memcpy(tmp.h_source, ieee80211_get_SA(hdr), ETH_ALEN);
+ 
+-	if (iftype == NL80211_IFTYPE_MESH_POINT &&
+-	    skb_copy_bits(skb, hdrlen, &mesh_flags, 1) < 0)
+-		return -1;
+-
+-	mesh_flags &= MESH_FLAGS_AE;
+-
+ 	switch (hdr->frame_control &
+ 		cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
+ 	case cpu_to_le16(IEEE80211_FCTL_TODS):
+@@ -608,17 +644,6 @@ int ieee80211_data_to_8023_exthdr(struct
+ 			     iftype != NL80211_IFTYPE_AP_VLAN &&
+ 			     iftype != NL80211_IFTYPE_STATION))
+ 			return -1;
+-		if (iftype == NL80211_IFTYPE_MESH_POINT) {
+-			if (mesh_flags == MESH_FLAGS_AE_A4)
+-				return -1;
+-			if (mesh_flags == MESH_FLAGS_AE_A5_A6 &&
+-			    skb_copy_bits(skb, hdrlen +
+-					  offsetof(struct ieee80211s_hdr, eaddr1),
+-					  tmp.h_dest, 2 * ETH_ALEN) < 0)
+-				return -1;
+-
+-			hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
+-		}
+ 		break;
+ 	case cpu_to_le16(IEEE80211_FCTL_FROMDS):
+ 		if ((iftype != NL80211_IFTYPE_STATION &&
+@@ -627,16 +652,6 @@ int ieee80211_data_to_8023_exthdr(struct
+ 		    (is_multicast_ether_addr(tmp.h_dest) &&
+ 		     ether_addr_equal(tmp.h_source, addr)))
+ 			return -1;
+-		if (iftype == NL80211_IFTYPE_MESH_POINT) {
+-			if (mesh_flags == MESH_FLAGS_AE_A5_A6)
+-				return -1;
+-			if (mesh_flags == MESH_FLAGS_AE_A4 &&
+-			    skb_copy_bits(skb, hdrlen +
+-					  offsetof(struct ieee80211s_hdr, eaddr1),
+-					  tmp.h_source, ETH_ALEN) < 0)
+-				return -1;
+-			hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
+-		}
+ 		break;
+ 	case cpu_to_le16(0):
+ 		if (iftype != NL80211_IFTYPE_ADHOC &&
+@@ -646,7 +661,7 @@ int ieee80211_data_to_8023_exthdr(struct
+ 		break;
+ 	}
+ 
+-	if (likely(!is_amsdu &&
++	if (likely(!is_amsdu && iftype != NL80211_IFTYPE_MESH_POINT &&
+ 		   skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
+ 		   ieee80211_get_8023_tunnel_proto(&payload, &tmp.h_proto))) {
+ 		/* remove RFC1042 or Bridge-Tunnel encapsulation */
+@@ -722,7 +737,8 @@ __ieee80211_amsdu_copy_frag(struct sk_bu
+ 
+ static struct sk_buff *
+ __ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen,
+-		       int offset, int len, bool reuse_frag)
++		       int offset, int len, bool reuse_frag,
++		       int min_len)
+ {
+ 	struct sk_buff *frame;
+ 	int cur_len = len;
+@@ -736,7 +752,7 @@ __ieee80211_amsdu_copy(struct sk_buff *s
+ 	 * in the stack later.
+ 	 */
+ 	if (reuse_frag)
+-		cur_len = min_t(int, len, 32);
++		cur_len = min_t(int, len, min_len);
+ 
+ 	/*
+ 	 * Allocate and reserve two bytes more for payload
+@@ -746,6 +762,7 @@ __ieee80211_amsdu_copy(struct sk_buff *s
+ 	if (!frame)
+ 		return NULL;
+ 
++	frame->priority = skb->priority;
+ 	skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
+ 	skb_copy_bits(skb, offset, skb_put(frame, cur_len), cur_len);
+ 
+@@ -762,23 +779,37 @@ __ieee80211_amsdu_copy(struct sk_buff *s
+ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
+ 			      const u8 *addr, enum nl80211_iftype iftype,
+ 			      const unsigned int extra_headroom,
+-			      const u8 *check_da, const u8 *check_sa)
++			      const u8 *check_da, const u8 *check_sa,
++			      bool mesh_control)
+ {
+ 	unsigned int hlen = ALIGN(extra_headroom, 4);
+ 	struct sk_buff *frame = NULL;
+ 	int offset = 0, remaining;
+-	struct ethhdr eth;
++	struct {
++		struct ethhdr eth;
++		uint8_t flags;
++	} hdr;
+ 	bool reuse_frag = skb->head_frag && !skb_has_frag_list(skb);
+ 	bool reuse_skb = false;
+ 	bool last = false;
++	int copy_len = sizeof(hdr.eth);
++
++	if (iftype == NL80211_IFTYPE_MESH_POINT)
++		copy_len = sizeof(hdr);
+ 
+ 	while (!last) {
+ 		unsigned int subframe_len;
+-		int len;
++		int len, mesh_len = 0;
+ 		u8 padding;
+ 
+-		skb_copy_bits(skb, offset, &eth, sizeof(eth));
+-		len = ntohs(eth.h_proto);
++		skb_copy_bits(skb, offset, &hdr, copy_len);
++		if (iftype == NL80211_IFTYPE_MESH_POINT)
++			mesh_len = __ieee80211_get_mesh_hdrlen(hdr.flags);
++		if (mesh_control)
++			len = le16_to_cpu(*(__le16 *)&hdr.eth.h_proto) + mesh_len;
++		else
++			len = ntohs(hdr.eth.h_proto);
++
+ 		subframe_len = sizeof(struct ethhdr) + len;
+ 		padding = (4 - subframe_len) & 0x3;
+ 
+@@ -787,16 +818,16 @@ void ieee80211_amsdu_to_8023s(struct sk_
+ 		if (subframe_len > remaining)
+ 			goto purge;
+ 		/* mitigate A-MSDU aggregation injection attacks */
+-		if (ether_addr_equal(eth.h_dest, rfc1042_header))
++		if (ether_addr_equal(hdr.eth.h_dest, rfc1042_header))
+ 			goto purge;
+ 
+ 		offset += sizeof(struct ethhdr);
+ 		last = remaining <= subframe_len + padding;
+ 
+ 		/* FIXME: should we really accept multicast DA? */
+-		if ((check_da && !is_multicast_ether_addr(eth.h_dest) &&
+-		     !ether_addr_equal(check_da, eth.h_dest)) ||
+-		    (check_sa && !ether_addr_equal(check_sa, eth.h_source))) {
++		if ((check_da && !is_multicast_ether_addr(hdr.eth.h_dest) &&
++		     !ether_addr_equal(check_da, hdr.eth.h_dest)) ||
++		    (check_sa && !ether_addr_equal(check_sa, hdr.eth.h_source))) {
+ 			offset += len + padding;
+ 			continue;
+ 		}
+@@ -808,7 +839,7 @@ void ieee80211_amsdu_to_8023s(struct sk_
+ 			reuse_skb = true;
+ 		} else {
+ 			frame = __ieee80211_amsdu_copy(skb, hlen, offset, len,
+-						       reuse_frag);
++						       reuse_frag, 32 + mesh_len);
+ 			if (!frame)
+ 				goto purge;
+ 
+@@ -819,10 +850,11 @@ void ieee80211_amsdu_to_8023s(struct sk_
+ 		frame->dev = skb->dev;
+ 		frame->priority = skb->priority;
+ 
+-		if (likely(ieee80211_get_8023_tunnel_proto(frame->data, &eth.h_proto)))
++		if (likely(iftype != NL80211_IFTYPE_MESH_POINT &&
++			   ieee80211_get_8023_tunnel_proto(frame->data, &hdr.eth.h_proto)))
+ 			skb_pull(frame, ETH_ALEN + 2);
+ 
+-		memcpy(skb_push(frame, sizeof(eth)), &eth, sizeof(eth));
++		memcpy(skb_push(frame, sizeof(hdr.eth)), &hdr.eth, sizeof(hdr.eth));
+ 		__skb_queue_tail(list, frame);
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/subsys/316-mac80211-enable-QoS-support-for-nl80211-ctrl-port.patch b/package/kernel/mac80211/patches/subsys/316-mac80211-enable-QoS-support-for-nl80211-ctrl-port.patch
deleted file mode 100644
index 91987ed75..000000000
--- a/package/kernel/mac80211/patches/subsys/316-mac80211-enable-QoS-support-for-nl80211-ctrl-port.patch
+++ /dev/null
@@ -1,116 +0,0 @@
-From: Markus Theil <markus.theil@tu-ilmenau.de>
-Date: Sat, 6 Feb 2021 12:51:12 +0100
-Subject: [PATCH] mac80211: enable QoS support for nl80211 ctrl port
-
-This patch unifies sending control port frames
-over nl80211 and AF_PACKET sockets a little more.
-
-Before this patch, EAPOL frames got QoS prioritization
-only when using AF_PACKET sockets.
-
-__ieee80211_select_queue only selects a QoS-enabled queue
-for control port frames, when the control port protocol
-is set correctly on the skb. For the AF_PACKET path this
-works, but the nl80211 path used ETH_P_802_3.
-
-Another check for injected frames in wme.c then prevented
-the QoS TID to be copied in the frame.
-
-In order to fix this, get rid of the frame injection marking
-for nl80211 ctrl port and set the correct ethernet protocol.
-
-Please note:
-An erlier version of this path tried to prevent
-frame aggregation for control port frames in order to speed up
-the initial connection setup a little. This seemed to cause
-issues on my older Intel dvm-based hardware, and was therefore
-removed again. Future commits which try to reintroduce this
-have to check carefully how hw behaves with aggregated and
-non-aggregated traffic for the same TID.
-My NIC: Intel(R) Centrino(R) Ultimate-N 6300 AGN, REV=0x74
-
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
-Link: https://lore.kernel.org/r/20210206115112.567881-1-markus.theil@tu-ilmenau.de
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -628,16 +628,12 @@ static void ieee80211_report_ack_skb(str
- 		u64 cookie = IEEE80211_SKB_CB(skb)->ack.cookie;
- 		struct ieee80211_sub_if_data *sdata;
- 		struct ieee80211_hdr *hdr = (void *)skb->data;
--		__be16 ethertype = 0;
--
--		if (skb->len >= ETH_HLEN && skb->protocol == cpu_to_be16(ETH_P_802_3))
--			skb_copy_bits(skb, 2 * ETH_ALEN, &ethertype, ETH_TLEN);
- 
- 		rcu_read_lock();
- 		sdata = ieee80211_sdata_from_skb(local, skb);
- 		if (sdata) {
--			if (ethertype == sdata->control_port_protocol ||
--			    ethertype == cpu_to_be16(ETH_P_PREAUTH))
-+			if (skb->protocol == sdata->control_port_protocol ||
-+			    skb->protocol == cpu_to_be16(ETH_P_PREAUTH))
- 				cfg80211_control_port_tx_status(&sdata->wdev,
- 								cookie,
- 								skb->data,
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1195,9 +1195,7 @@ ieee80211_tx_prepare(struct ieee80211_su
- 			tx->sta = rcu_dereference(sdata->u.vlan.sta);
- 			if (!tx->sta && sdata->wdev.use_4addr)
- 				return TX_DROP;
--		} else if (info->flags & (IEEE80211_TX_INTFL_NL80211_FRAME_TX |
--					  IEEE80211_TX_CTL_INJECTED) ||
--			   tx->sdata->control_port_protocol == tx->skb->protocol) {
-+		} else if (tx->sdata->control_port_protocol == tx->skb->protocol) {
- 			tx->sta = sta_info_get_bss(sdata, hdr->addr1);
- 		}
- 		if (!tx->sta && !is_multicast_ether_addr(hdr->addr1))
-@@ -5455,6 +5453,7 @@ int ieee80211_tx_control_port(struct wip
- {
- 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
- 	struct ieee80211_local *local = sdata->local;
-+	struct sta_info *sta;
- 	struct sk_buff *skb;
- 	struct ethhdr *ehdr;
- 	u32 ctrl_flags = 0;
-@@ -5477,8 +5476,7 @@ int ieee80211_tx_control_port(struct wip
- 	if (cookie)
- 		ctrl_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
- 
--	flags |= IEEE80211_TX_INTFL_NL80211_FRAME_TX |
--		 IEEE80211_TX_CTL_INJECTED;
-+	flags |= IEEE80211_TX_INTFL_NL80211_FRAME_TX;
- 
- 	skb = dev_alloc_skb(local->hw.extra_tx_headroom +
- 			    sizeof(struct ethhdr) + len);
-@@ -5495,10 +5493,25 @@ int ieee80211_tx_control_port(struct wip
- 	ehdr->h_proto = proto;
- 
- 	skb->dev = dev;
--	skb->protocol = htons(ETH_P_802_3);
-+	skb->protocol = proto;
- 	skb_reset_network_header(skb);
- 	skb_reset_mac_header(skb);
- 
-+	/* update QoS header to prioritize control port frames if possible,
-+	 * priorization also happens for control port frames send over
-+	 * AF_PACKET
-+	 */
-+	rcu_read_lock();
-+
-+	if (ieee80211_lookup_ra_sta(sdata, skb, &sta) == 0 && !IS_ERR(sta)) {
-+		u16 queue = __ieee80211_select_queue(sdata, sta, skb);
-+
-+		skb_set_queue_mapping(skb, queue);
-+		skb_get_hash(skb);
-+	}
-+
-+	rcu_read_unlock();
-+
- 	/* mutex lock is only needed for incrementing the cookie counter */
- 	mutex_lock(&local->mtx);
- 
diff --git a/package/kernel/mac80211/patches/subsys/316-v6.3-wifi-mac80211-add-a-workaround-for-receiving-non-sta.patch b/package/kernel/mac80211/patches/subsys/316-v6.3-wifi-mac80211-add-a-workaround-for-receiving-non-sta.patch
new file mode 100644
index 000000000..6dc98ae16
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/316-v6.3-wifi-mac80211-add-a-workaround-for-receiving-non-sta.patch
@@ -0,0 +1,145 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 9 Dec 2022 21:15:04 +0100
+Subject: [PATCH] wifi: mac80211: add a workaround for receiving
+ non-standard mesh A-MSDU
+
+At least ath10k and ath11k supported hardware (maybe more) does not implement
+mesh A-MSDU aggregation in a standard compliant way.
+802.11-2020 9.3.2.2.2 declares that the Mesh Control field is part of the
+A-MSDU header. As such, its length must not be included in the subframe
+length field.
+Hardware affected by this bug treats the mesh control field as part of the
+MSDU data and sets the length accordingly.
+In order to avoid packet loss, keep track of which stations are affected
+by this and take it into account when converting A-MSDU to 802.3 + mesh control
+packets.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -6194,6 +6194,19 @@ static inline int ieee80211_data_to_8023
+ }
+ 
+ /**
++ * ieee80211_is_valid_amsdu - check if subframe lengths of an A-MSDU are valid
++ *
++ * This is used to detect non-standard A-MSDU frames, e.g. the ones generated
++ * by ath10k and ath11k, where the subframe length includes the length of the
++ * mesh control field.
++ *
++ * @skb: The input A-MSDU frame without any headers.
++ * @mesh_hdr: use standard compliant mesh A-MSDU subframe header
++ * Returns: true if subframe header lengths are valid for the @mesh_hdr mode
++ */
++bool ieee80211_is_valid_amsdu(struct sk_buff *skb, bool mesh_hdr);
++
++/**
+  * ieee80211_amsdu_to_8023s - decode an IEEE 802.11n A-MSDU frame
+  *
+  * Decode an IEEE 802.11 A-MSDU and convert it to a list of 802.3 frames.
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2899,7 +2899,6 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 	static ieee80211_rx_result res;
+ 	struct ethhdr ethhdr;
+ 	const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
+-	bool mesh = false;
+ 
+ 	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
+ 		check_da = NULL;
+@@ -2917,7 +2916,6 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 		case NL80211_IFTYPE_MESH_POINT:
+ 			check_sa = NULL;
+ 			check_da = NULL;
+-			mesh = true;
+ 			break;
+ 		default:
+ 			break;
+@@ -2932,10 +2930,21 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 					  data_offset, true))
+ 		return RX_DROP_UNUSABLE;
+ 
++	if (rx->sta && rx->sta->amsdu_mesh_control < 0) {
++		bool valid_std = ieee80211_is_valid_amsdu(skb, true);
++		bool valid_nonstd = ieee80211_is_valid_amsdu(skb, false);
++
++		if (valid_std && !valid_nonstd)
++			rx->sta->amsdu_mesh_control = 1;
++		else if (valid_nonstd && !valid_std)
++			rx->sta->amsdu_mesh_control = 0;
++	}
++
+ 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
+ 				 rx->sdata->vif.type,
+ 				 rx->local->hw.extra_tx_headroom,
+-				 check_da, check_sa, mesh);
++				 check_da, check_sa,
++				 rx->sta->amsdu_mesh_control);
+ 
+ 	while (!skb_queue_empty(&frame_list)) {
+ 		rx->skb = __skb_dequeue(&frame_list);
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -591,6 +591,9 @@ __sta_info_alloc(struct ieee80211_sub_if
+ 
+ 	sta->sta_state = IEEE80211_STA_NONE;
+ 
++	if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
++		sta->amsdu_mesh_control = -1;
++
+ 	/* Mark TID as unreserved */
+ 	sta->reserved_tid = IEEE80211_TID_UNRESERVED;
+ 
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -702,6 +702,7 @@ struct sta_info {
+ 	struct codel_params cparams;
+ 
+ 	u8 reserved_tid;
++	s8 amsdu_mesh_control;
+ 
+ 	struct cfg80211_chan_def tdls_chandef;
+ 
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -776,6 +776,38 @@ __ieee80211_amsdu_copy(struct sk_buff *s
+ 	return frame;
+ }
+ 
++bool ieee80211_is_valid_amsdu(struct sk_buff *skb, bool mesh_hdr)
++{
++	int offset = 0, remaining, subframe_len, padding;
++
++	for (offset = 0; offset < skb->len; offset += subframe_len + padding) {
++		struct {
++		    __be16 len;
++		    u8 mesh_flags;
++		} hdr;
++		u16 len;
++
++		if (skb_copy_bits(skb, offset + 2 * ETH_ALEN, &hdr, sizeof(hdr)) < 0)
++			return false;
++
++		if (mesh_hdr)
++			len = le16_to_cpu(*(__le16 *)&hdr.len) +
++			      __ieee80211_get_mesh_hdrlen(hdr.mesh_flags);
++		else
++			len = ntohs(hdr.len);
++
++		subframe_len = sizeof(struct ethhdr) + len;
++		padding = (4 - subframe_len) & 0x3;
++		remaining = skb->len - offset;
++
++		if (subframe_len > remaining)
++			return false;
++	}
++
++	return true;
++}
++EXPORT_SYMBOL(ieee80211_is_valid_amsdu);
++
+ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
+ 			      const u8 *addr, enum nl80211_iftype iftype,
+ 			      const unsigned int extra_headroom,
diff --git a/package/kernel/mac80211/patches/subsys/318-wifi-mac80211-fix-race-in-mesh-sequence-number-assig.patch b/package/kernel/mac80211/patches/subsys/318-wifi-mac80211-fix-race-in-mesh-sequence-number-assig.patch
new file mode 100644
index 000000000..7d01ffdff
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/318-wifi-mac80211-fix-race-in-mesh-sequence-number-assig.patch
@@ -0,0 +1,37 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 15 Feb 2023 15:21:37 +0100
+Subject: [PATCH] wifi: mac80211: fix race in mesh sequence number
+ assignment
+
+Since the sequence number is shared across different tx queues, it needs
+to be atomic in order to avoid accidental duplicate assignment
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -696,7 +696,7 @@ struct ieee80211_if_mesh {
+ 	struct mesh_stats mshstats;
+ 	struct mesh_config mshcfg;
+ 	atomic_t estab_plinks;
+-	u32 mesh_seqnum;
++	atomic_t mesh_seqnum;
+ 	bool accepting_plinks;
+ 	int num_gates;
+ 	struct beacon_data __rcu *beacon;
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -752,10 +752,8 @@ unsigned int ieee80211_new_mesh_header(s
+ 
+ 	meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
+ 
+-	/* FIXME: racy -- TX on multiple queues can be concurrent */
+-	put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &meshhdr->seqnum);
+-	sdata->u.mesh.mesh_seqnum++;
+-
++	put_unaligned_le32(atomic_inc_return(&sdata->u.mesh.mesh_seqnum),
++			   &meshhdr->seqnum);
+ 	if (addr4or5 && !addr6) {
+ 		meshhdr->flags |= MESH_FLAGS_AE_A4;
+ 		memcpy(meshhdr->eaddr1, addr4or5, ETH_ALEN);
diff --git a/package/kernel/mac80211/patches/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch b/package/kernel/mac80211/patches/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch
new file mode 100644
index 000000000..968d2885f
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch
@@ -0,0 +1,850 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 26 Feb 2023 13:53:08 +0100
+Subject: [PATCH] wifi: mac80211: mesh fast xmit support
+
+Previously, fast xmit only worked on interface types where initially a
+sta lookup is performed, and a cached header can be attached to the sta,
+requiring only some fields to be updated at runtime.
+
+This technique is not directly applicable for a mesh device type due
+to the dynamic nature of the topology and protocol. There are more
+addresses that need to be filled, and there is an extra header with a
+dynamic length based on the addressing mode.
+
+Change the code to cache entries contain a copy of the mesh subframe header +
+bridge tunnel header, as well as an embedded struct ieee80211_fast_tx, which
+contains the information for building the 802.11 header.
+
+Add a mesh specific early fast xmit call, which looks up a cached entry and
+adds only the mesh subframe header, before passing it over to the generic
+fast xmit code.
+
+To ensure the changes in network are reflected in these cached headers,
+flush affected cached entries on path changes, as well as other conditions
+that currently trigger a fast xmit check in other modes (key changes etc.)
+
+This code is loosely based on a previous implementation by:
+Sriram R <quic_srirrama@quicinc.com>
+
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -37,6 +37,7 @@
+ extern const struct cfg80211_ops mac80211_config_ops;
+ 
+ struct ieee80211_local;
++struct ieee80211_mesh_fast_tx;
+ 
+ /* Maximum number of broadcast/multicast frames to buffer when some of the
+  * associated stations are using power saving. */
+@@ -656,6 +657,19 @@ struct mesh_table {
+ 	atomic_t entries;		/* Up to MAX_MESH_NEIGHBOURS */
+ };
+ 
++/**
++ * struct mesh_tx_cache - mesh fast xmit header cache
++ *
++ * @rht: hash table containing struct ieee80211_mesh_fast_tx, using skb DA as key
++ * @walk_head: linked list containing all ieee80211_mesh_fast_tx objects
++ * @walk_lock: lock protecting walk_head and rht
++ */
++struct mesh_tx_cache {
++	struct rhashtable rht;
++	struct hlist_head walk_head;
++	spinlock_t walk_lock;
++};
++
+ struct ieee80211_if_mesh {
+ 	struct timer_list housekeeping_timer;
+ 	struct timer_list mesh_path_timer;
+@@ -734,6 +748,7 @@ struct ieee80211_if_mesh {
+ 	struct mesh_table mpp_paths; /* Store paths for MPP&MAP */
+ 	int mesh_paths_generation;
+ 	int mpp_paths_generation;
++	struct mesh_tx_cache tx_cache;
+ };
+ 
+ #ifdef CPTCFG_MAC80211_MESH
+@@ -2002,6 +2017,11 @@ int ieee80211_tx_control_port(struct wip
+ 			      int link_id, u64 *cookie);
+ int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,
+ 			      const u8 *buf, size_t len);
++void __ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
++			   struct sta_info *sta,
++			   struct ieee80211_fast_tx *fast_tx,
++			   struct sk_buff *skb, bool ampdu,
++			   const u8 *da, const u8 *sa);
+ 
+ /* HT */
+ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -10,6 +10,7 @@
+ #include <asm/unaligned.h>
+ #include "ieee80211_i.h"
+ #include "mesh.h"
++#include "wme.h"
+ #include "driver-ops.h"
+ 
+ static int mesh_allocated;
+@@ -698,6 +699,95 @@ ieee80211_mesh_update_bss_params(struct
+ 			__le32_to_cpu(he_oper->he_oper_params);
+ }
+ 
++bool ieee80211_mesh_xmit_fast(struct ieee80211_sub_if_data *sdata,
++			      struct sk_buff *skb, u32 ctrl_flags)
++{
++	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
++	struct ieee80211_mesh_fast_tx *entry;
++	struct ieee80211s_hdr *meshhdr;
++	u8 sa[ETH_ALEN] __aligned(2);
++	struct tid_ampdu_tx *tid_tx;
++	struct sta_info *sta;
++	bool copy_sa = false;
++	u16 ethertype;
++	u8 tid;
++
++	if (ctrl_flags & IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP)
++		return false;
++
++	if (ifmsh->mshcfg.dot11MeshNolearn)
++		return false;
++
++	/* Add support for these cases later */
++	if (ifmsh->ps_peers_light_sleep || ifmsh->ps_peers_deep_sleep)
++		return false;
++
++	if (is_multicast_ether_addr(skb->data))
++		return false;
++
++	ethertype = (skb->data[12] << 8) | skb->data[13];
++	if (ethertype < ETH_P_802_3_MIN)
++		return false;
++
++	if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
++		return false;
++
++	if (skb->ip_summed == CHECKSUM_PARTIAL) {
++		skb_set_transport_header(skb, skb_checksum_start_offset(skb));
++		if (skb_checksum_help(skb))
++			return false;
++	}
++
++	entry = mesh_fast_tx_get(sdata, skb->data);
++	if (!entry)
++		return false;
++
++	if (skb_headroom(skb) < entry->hdrlen + entry->fast_tx.hdr_len)
++		return false;
++
++	sta = rcu_dereference(entry->mpath->next_hop);
++	if (!sta)
++		return false;
++
++	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
++	if (tid_tx) {
++		if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
++			return false;
++		if (tid_tx->timeout)
++			tid_tx->last_tx = jiffies;
++	}
++
++	skb = skb_share_check(skb, GFP_ATOMIC);
++	if (!skb)
++		return true;
++
++	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
++
++	meshhdr = (struct ieee80211s_hdr *)entry->hdr;
++	if ((meshhdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6) {
++		/* preserve SA from eth header for 6-addr frames */
++		ether_addr_copy(sa, skb->data + ETH_ALEN);
++		copy_sa = true;
++	}
++
++	memcpy(skb_push(skb, entry->hdrlen - 2 * ETH_ALEN), entry->hdr,
++	       entry->hdrlen);
++
++	meshhdr = (struct ieee80211s_hdr *)skb->data;
++	put_unaligned_le32(atomic_inc_return(&sdata->u.mesh.mesh_seqnum),
++			   &meshhdr->seqnum);
++	meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
++	if (copy_sa)
++	    ether_addr_copy(meshhdr->eaddr2, sa);
++
++	skb_push(skb, 2 * ETH_ALEN);
++	__ieee80211_xmit_fast(sdata, sta, &entry->fast_tx, skb, tid_tx,
++			      entry->mpath->dst, sdata->vif.addr);
++
++	return true;
++}
++
+ /**
+  * ieee80211_fill_mesh_addresses - fill addresses of a locally originated mesh frame
+  * @hdr:	802.11 frame header
+@@ -780,6 +870,8 @@ static void ieee80211_mesh_housekeeping(
+ 	changed = mesh_accept_plinks_update(sdata);
+ 	ieee80211_mbss_info_change_notify(sdata, changed);
+ 
++	mesh_fast_tx_gc(sdata);
++
+ 	mod_timer(&ifmsh->housekeeping_timer,
+ 		  round_jiffies(jiffies +
+ 				IEEE80211_MESH_HOUSEKEEPING_INTERVAL));
+--- a/net/mac80211/mesh.h
++++ b/net/mac80211/mesh.h
+@@ -122,11 +122,41 @@ struct mesh_path {
+ 	u8 rann_snd_addr[ETH_ALEN];
+ 	u32 rann_metric;
+ 	unsigned long last_preq_to_root;
++	unsigned long fast_tx_check;
+ 	bool is_root;
+ 	bool is_gate;
+ 	u32 path_change_count;
+ };
+ 
++#define MESH_FAST_TX_CACHE_MAX_SIZE		512
++#define MESH_FAST_TX_CACHE_THRESHOLD_SIZE	384
++#define MESH_FAST_TX_CACHE_TIMEOUT		8000 /* msecs */
++
++/**
++ * struct ieee80211_mesh_fast_tx - cached mesh fast tx entry
++ * @rhash: rhashtable pointer
++ * @addr_key: The Ethernet DA which is the key for this entry
++ * @fast_tx: base fast_tx data
++ * @hdr: cached mesh and rfc1042 headers
++ * @hdrlen: length of mesh + rfc1042
++ * @walk_list: list containing all the fast tx entries
++ * @mpath: mesh path corresponding to the Mesh DA
++ * @mppath: MPP entry corresponding to this DA
++ * @timestamp: Last used time of this entry
++ */
++struct ieee80211_mesh_fast_tx {
++	struct rhash_head rhash;
++	u8 addr_key[ETH_ALEN] __aligned(2);
++
++	struct ieee80211_fast_tx fast_tx;
++	u8 hdr[sizeof(struct ieee80211s_hdr) + sizeof(rfc1042_header)];
++	u16 hdrlen;
++
++	struct mesh_path *mpath, *mppath;
++	struct hlist_node walk_list;
++	unsigned long timestamp;
++};
++
+ /* Recent multicast cache */
+ /* RMC_BUCKETS must be a power of 2, maximum 256 */
+ #define RMC_BUCKETS		256
+@@ -298,6 +328,20 @@ void mesh_path_discard_frame(struct ieee
+ void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata);
+ 
+ bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt);
++struct ieee80211_mesh_fast_tx *
++mesh_fast_tx_get(struct ieee80211_sub_if_data *sdata, const u8 *addr);
++bool ieee80211_mesh_xmit_fast(struct ieee80211_sub_if_data *sdata,
++			      struct sk_buff *skb, u32 ctrl_flags);
++void mesh_fast_tx_cache(struct ieee80211_sub_if_data *sdata,
++			struct sk_buff *skb, struct mesh_path *mpath);
++void mesh_fast_tx_gc(struct ieee80211_sub_if_data *sdata);
++void mesh_fast_tx_flush_addr(struct ieee80211_sub_if_data *sdata,
++			     const u8 *addr);
++void mesh_fast_tx_flush_mpath(struct mesh_path *mpath);
++void mesh_fast_tx_flush_sta(struct ieee80211_sub_if_data *sdata,
++			    struct sta_info *sta);
++void mesh_path_refresh(struct ieee80211_sub_if_data *sdata,
++		       struct mesh_path *mpath, const u8 *addr);
+ 
+ #ifdef CPTCFG_MAC80211_MESH
+ static inline
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -394,6 +394,7 @@ static u32 hwmp_route_info_get(struct ie
+ 	u32 orig_sn, orig_metric;
+ 	unsigned long orig_lifetime, exp_time;
+ 	u32 last_hop_metric, new_metric;
++	bool flush_mpath = false;
+ 	bool process = true;
+ 	u8 hopcount;
+ 
+@@ -491,8 +492,10 @@ static u32 hwmp_route_info_get(struct ie
+ 		}
+ 
+ 		if (fresh_info) {
+-			if (rcu_access_pointer(mpath->next_hop) != sta)
++			if (rcu_access_pointer(mpath->next_hop) != sta) {
+ 				mpath->path_change_count++;
++				flush_mpath = true;
++			}
+ 			mesh_path_assign_nexthop(mpath, sta);
+ 			mpath->flags |= MESH_PATH_SN_VALID;
+ 			mpath->metric = new_metric;
+@@ -502,6 +505,8 @@ static u32 hwmp_route_info_get(struct ie
+ 			mpath->hop_count = hopcount;
+ 			mesh_path_activate(mpath);
+ 			spin_unlock_bh(&mpath->state_lock);
++			if (flush_mpath)
++				mesh_fast_tx_flush_mpath(mpath);
+ 			ewma_mesh_fail_avg_init(&sta->mesh->fail_avg);
+ 			/* init it at a low value - 0 start is tricky */
+ 			ewma_mesh_fail_avg_add(&sta->mesh->fail_avg, 1);
+@@ -539,8 +544,10 @@ static u32 hwmp_route_info_get(struct ie
+ 		}
+ 
+ 		if (fresh_info) {
+-			if (rcu_access_pointer(mpath->next_hop) != sta)
++			if (rcu_access_pointer(mpath->next_hop) != sta) {
+ 				mpath->path_change_count++;
++				flush_mpath = true;
++			}
+ 			mesh_path_assign_nexthop(mpath, sta);
+ 			mpath->metric = last_hop_metric;
+ 			mpath->exp_time = time_after(mpath->exp_time, exp_time)
+@@ -548,6 +555,8 @@ static u32 hwmp_route_info_get(struct ie
+ 			mpath->hop_count = 1;
+ 			mesh_path_activate(mpath);
+ 			spin_unlock_bh(&mpath->state_lock);
++			if (flush_mpath)
++				mesh_fast_tx_flush_mpath(mpath);
+ 			ewma_mesh_fail_avg_init(&sta->mesh->fail_avg);
+ 			/* init it at a low value - 0 start is tricky */
+ 			ewma_mesh_fail_avg_add(&sta->mesh->fail_avg, 1);
+@@ -1215,6 +1224,20 @@ static int mesh_nexthop_lookup_nolearn(s
+ 	return 0;
+ }
+ 
++void mesh_path_refresh(struct ieee80211_sub_if_data *sdata,
++		       struct mesh_path *mpath, const u8 *addr)
++{
++	if (mpath->flags & (MESH_PATH_REQ_QUEUED | MESH_PATH_FIXED |
++			    MESH_PATH_RESOLVING))
++		return;
++
++	if (time_after(jiffies,
++		       mpath->exp_time -
++		       msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time)) &&
++	    (!addr || ether_addr_equal(sdata->vif.addr, addr)))
++		mesh_queue_preq(mpath, PREQ_Q_F_START | PREQ_Q_F_REFRESH);
++}
++
+ /**
+  * mesh_nexthop_lookup - put the appropriate next hop on a mesh frame. Calling
+  * this function is considered "using" the associated mpath, so preempt a path
+@@ -1242,19 +1265,15 @@ int mesh_nexthop_lookup(struct ieee80211
+ 	if (!mpath || !(mpath->flags & MESH_PATH_ACTIVE))
+ 		return -ENOENT;
+ 
+-	if (time_after(jiffies,
+-		       mpath->exp_time -
+-		       msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time)) &&
+-	    ether_addr_equal(sdata->vif.addr, hdr->addr4) &&
+-	    !(mpath->flags & MESH_PATH_RESOLVING) &&
+-	    !(mpath->flags & MESH_PATH_FIXED))
+-		mesh_queue_preq(mpath, PREQ_Q_F_START | PREQ_Q_F_REFRESH);
++	mesh_path_refresh(sdata, mpath, hdr->addr4);
+ 
+ 	next_hop = rcu_dereference(mpath->next_hop);
+ 	if (next_hop) {
+ 		memcpy(hdr->addr1, next_hop->sta.addr, ETH_ALEN);
+ 		memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
+ 		ieee80211_mps_set_frame_flags(sdata, next_hop, hdr);
++		if (ieee80211_hw_check(&sdata->local->hw, SUPPORT_FAST_XMIT))
++			mesh_fast_tx_cache(sdata, skb, mpath);
+ 		return 0;
+ 	}
+ 
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -14,6 +14,7 @@
+ #include "wme.h"
+ #include "ieee80211_i.h"
+ #include "mesh.h"
++#include <linux/rhashtable.h>
+ 
+ static void mesh_path_free_rcu(struct mesh_table *tbl, struct mesh_path *mpath);
+ 
+@@ -32,6 +33,41 @@ static const struct rhashtable_params me
+ 	.hashfn = mesh_table_hash,
+ };
+ 
++static const struct rhashtable_params fast_tx_rht_params = {
++	.nelem_hint = 10,
++	.automatic_shrinking = true,
++	.key_len = ETH_ALEN,
++	.key_offset = offsetof(struct ieee80211_mesh_fast_tx, addr_key),
++	.head_offset = offsetof(struct ieee80211_mesh_fast_tx, rhash),
++	.hashfn = mesh_table_hash,
++};
++
++static void __mesh_fast_tx_entry_free(void *ptr, void *tblptr)
++{
++	struct ieee80211_mesh_fast_tx *entry = ptr;
++
++	kfree_rcu(entry, fast_tx.rcu_head);
++}
++
++static void mesh_fast_tx_deinit(struct ieee80211_sub_if_data *sdata)
++{
++	struct mesh_tx_cache *cache;
++
++	cache = &sdata->u.mesh.tx_cache;
++	rhashtable_free_and_destroy(&cache->rht,
++				    __mesh_fast_tx_entry_free, NULL);
++}
++
++static void mesh_fast_tx_init(struct ieee80211_sub_if_data *sdata)
++{
++	struct mesh_tx_cache *cache;
++
++	cache = &sdata->u.mesh.tx_cache;
++	rhashtable_init(&cache->rht, &fast_tx_rht_params);
++	INIT_HLIST_HEAD(&cache->walk_head);
++	spin_lock_init(&cache->walk_lock);
++}
++
+ static inline bool mpath_expired(struct mesh_path *mpath)
+ {
+ 	return (mpath->flags & MESH_PATH_ACTIVE) &&
+@@ -381,6 +417,243 @@ struct mesh_path *mesh_path_new(struct i
+ 	return new_mpath;
+ }
+ 
++static void mesh_fast_tx_entry_free(struct mesh_tx_cache *cache,
++				    struct ieee80211_mesh_fast_tx *entry)
++{
++	hlist_del_rcu(&entry->walk_list);
++	rhashtable_remove_fast(&cache->rht, &entry->rhash, fast_tx_rht_params);
++	kfree_rcu(entry, fast_tx.rcu_head);
++}
++
++struct ieee80211_mesh_fast_tx *
++mesh_fast_tx_get(struct ieee80211_sub_if_data *sdata, const u8 *addr)
++{
++	struct ieee80211_mesh_fast_tx *entry;
++	struct mesh_tx_cache *cache;
++
++	cache = &sdata->u.mesh.tx_cache;
++	entry = rhashtable_lookup(&cache->rht, addr, fast_tx_rht_params);
++	if (!entry)
++		return NULL;
++
++	if (!(entry->mpath->flags & MESH_PATH_ACTIVE) ||
++	    mpath_expired(entry->mpath)) {
++		spin_lock_bh(&cache->walk_lock);
++		entry = rhashtable_lookup(&cache->rht, addr, fast_tx_rht_params);
++		if (entry)
++		    mesh_fast_tx_entry_free(cache, entry);
++		spin_unlock_bh(&cache->walk_lock);
++		return NULL;
++	}
++
++	mesh_path_refresh(sdata, entry->mpath, NULL);
++	if (entry->mppath)
++		entry->mppath->exp_time = jiffies;
++	entry->timestamp = jiffies;
++
++	return entry;
++}
++
++void mesh_fast_tx_cache(struct ieee80211_sub_if_data *sdata,
++			struct sk_buff *skb, struct mesh_path *mpath)
++{
++	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
++	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++	struct ieee80211_mesh_fast_tx *entry, *prev;
++	struct ieee80211_mesh_fast_tx build = {};
++	struct ieee80211s_hdr *meshhdr;
++	struct mesh_tx_cache *cache;
++	struct ieee80211_key *key;
++	struct mesh_path *mppath;
++	struct sta_info *sta;
++	u8 *qc;
++
++	if (sdata->noack_map ||
++	    !ieee80211_is_data_qos(hdr->frame_control))
++		return;
++
++	build.fast_tx.hdr_len = ieee80211_hdrlen(hdr->frame_control);
++	meshhdr = (struct ieee80211s_hdr *)(skb->data + build.fast_tx.hdr_len);
++	build.hdrlen = ieee80211_get_mesh_hdrlen(meshhdr);
++
++	cache = &sdata->u.mesh.tx_cache;
++	if (atomic_read(&cache->rht.nelems) >= MESH_FAST_TX_CACHE_MAX_SIZE)
++		return;
++
++	sta = rcu_dereference(mpath->next_hop);
++	if (!sta)
++		return;
++
++	if ((meshhdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6) {
++		/* This is required to keep the mppath alive */
++		mppath = mpp_path_lookup(sdata, meshhdr->eaddr1);
++		if (!mppath)
++			return;
++		build.mppath = mppath;
++	} else if (ieee80211_has_a4(hdr->frame_control)) {
++		mppath = mpath;
++	} else {
++		return;
++	}
++
++	/* rate limit, in case fast xmit can't be enabled */
++	if (mppath->fast_tx_check == jiffies)
++		return;
++
++	mppath->fast_tx_check = jiffies;
++
++	/*
++	 * Same use of the sta lock as in ieee80211_check_fast_xmit, in order
++	 * to protect against concurrent sta key updates.
++	 */
++	spin_lock_bh(&sta->lock);
++	key = rcu_access_pointer(sta->ptk[sta->ptk_idx]);
++	if (!key)
++		key = rcu_access_pointer(sdata->default_unicast_key);
++	build.fast_tx.key = key;
++
++	if (key) {
++		bool gen_iv, iv_spc;
++
++		gen_iv = key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV;
++		iv_spc = key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE;
++
++		if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) ||
++		    (key->flags & KEY_FLAG_TAINTED))
++			goto unlock_sta;
++
++		switch (key->conf.cipher) {
++		case WLAN_CIPHER_SUITE_CCMP:
++		case WLAN_CIPHER_SUITE_CCMP_256:
++			if (gen_iv)
++				build.fast_tx.pn_offs = build.fast_tx.hdr_len;
++			if (gen_iv || iv_spc)
++				build.fast_tx.hdr_len += IEEE80211_CCMP_HDR_LEN;
++			break;
++		case WLAN_CIPHER_SUITE_GCMP:
++		case WLAN_CIPHER_SUITE_GCMP_256:
++			if (gen_iv)
++				build.fast_tx.pn_offs = build.fast_tx.hdr_len;
++			if (gen_iv || iv_spc)
++				build.fast_tx.hdr_len += IEEE80211_GCMP_HDR_LEN;
++			break;
++		default:
++			goto unlock_sta;
++		}
++	}
++
++	memcpy(build.addr_key, mppath->dst, ETH_ALEN);
++	build.timestamp = jiffies;
++	build.fast_tx.band = info->band;
++	build.fast_tx.da_offs = offsetof(struct ieee80211_hdr, addr3);
++	build.fast_tx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
++	build.mpath = mpath;
++	memcpy(build.hdr, meshhdr, build.hdrlen);
++	memcpy(build.hdr + build.hdrlen, rfc1042_header, sizeof(rfc1042_header));
++	build.hdrlen += sizeof(rfc1042_header);
++	memcpy(build.fast_tx.hdr, hdr, build.fast_tx.hdr_len);
++
++	hdr = (struct ieee80211_hdr *)build.fast_tx.hdr;
++	if (build.fast_tx.key)
++		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
++
++	qc = ieee80211_get_qos_ctl(hdr);
++	qc[1] |= IEEE80211_QOS_CTL_MESH_CONTROL_PRESENT >> 8;
++
++	entry = kmemdup(&build, sizeof(build), GFP_ATOMIC);
++	if (!entry)
++		goto unlock_sta;
++
++	spin_lock(&cache->walk_lock);
++	prev = rhashtable_lookup_get_insert_fast(&cache->rht,
++						 &entry->rhash,
++						 fast_tx_rht_params);
++	if (unlikely(IS_ERR(prev))) {
++		kfree(entry);
++		goto unlock_cache;
++	}
++
++	/*
++	 * replace any previous entry in the hash table, in case we're
++	 * replacing it with a different type (e.g. mpath -> mpp)
++	 */
++	if (unlikely(prev)) {
++		rhashtable_replace_fast(&cache->rht, &prev->rhash,
++					&entry->rhash, fast_tx_rht_params);
++		hlist_del_rcu(&prev->walk_list);
++		kfree_rcu(prev, fast_tx.rcu_head);
++	}
++
++	hlist_add_head(&entry->walk_list, &cache->walk_head);
++
++unlock_cache:
++	spin_unlock(&cache->walk_lock);
++unlock_sta:
++	spin_unlock_bh(&sta->lock);
++}
++
++void mesh_fast_tx_gc(struct ieee80211_sub_if_data *sdata)
++{
++	unsigned long timeout = msecs_to_jiffies(MESH_FAST_TX_CACHE_TIMEOUT);
++	struct mesh_tx_cache *cache;
++	struct ieee80211_mesh_fast_tx *entry;
++	struct hlist_node *n;
++
++	cache = &sdata->u.mesh.tx_cache;
++	if (atomic_read(&cache->rht.nelems) < MESH_FAST_TX_CACHE_THRESHOLD_SIZE)
++		return;
++
++	spin_lock_bh(&cache->walk_lock);
++	hlist_for_each_entry_safe(entry, n, &cache->walk_head, walk_list)
++		if (!time_is_after_jiffies(entry->timestamp + timeout))
++			mesh_fast_tx_entry_free(cache, entry);
++	spin_unlock_bh(&cache->walk_lock);
++}
++
++void mesh_fast_tx_flush_mpath(struct mesh_path *mpath)
++{
++	struct ieee80211_sub_if_data *sdata = mpath->sdata;
++	struct mesh_tx_cache *cache = &sdata->u.mesh.tx_cache;
++	struct ieee80211_mesh_fast_tx *entry;
++	struct hlist_node *n;
++
++	cache = &sdata->u.mesh.tx_cache;
++	spin_lock_bh(&cache->walk_lock);
++	hlist_for_each_entry_safe(entry, n, &cache->walk_head, walk_list)
++		if (entry->mpath == mpath)
++			mesh_fast_tx_entry_free(cache, entry);
++	spin_unlock_bh(&cache->walk_lock);
++}
++
++void mesh_fast_tx_flush_sta(struct ieee80211_sub_if_data *sdata,
++			    struct sta_info *sta)
++{
++	struct mesh_tx_cache *cache = &sdata->u.mesh.tx_cache;
++	struct ieee80211_mesh_fast_tx *entry;
++	struct hlist_node *n;
++
++	cache = &sdata->u.mesh.tx_cache;
++	spin_lock_bh(&cache->walk_lock);
++	hlist_for_each_entry_safe(entry, n, &cache->walk_head, walk_list)
++		if (rcu_access_pointer(entry->mpath->next_hop) == sta)
++			mesh_fast_tx_entry_free(cache, entry);
++	spin_unlock_bh(&cache->walk_lock);
++}
++
++void mesh_fast_tx_flush_addr(struct ieee80211_sub_if_data *sdata,
++			     const u8 *addr)
++{
++	struct mesh_tx_cache *cache = &sdata->u.mesh.tx_cache;
++	struct ieee80211_mesh_fast_tx *entry;
++
++	cache = &sdata->u.mesh.tx_cache;
++	spin_lock_bh(&cache->walk_lock);
++	entry = rhashtable_lookup(&cache->rht, addr, fast_tx_rht_params);
++	if (entry)
++		mesh_fast_tx_entry_free(cache, entry);
++	spin_unlock_bh(&cache->walk_lock);
++}
++
+ /**
+  * mesh_path_add - allocate and add a new path to the mesh path table
+  * @dst: destination address of the path (ETH_ALEN length)
+@@ -464,6 +737,8 @@ int mpp_path_add(struct ieee80211_sub_if
+ 
+ 	if (ret)
+ 		kfree(new_mpath);
++	else
++		mesh_fast_tx_flush_addr(sdata, dst);
+ 
+ 	sdata->u.mesh.mpp_paths_generation++;
+ 	return ret;
+@@ -523,6 +798,10 @@ static void __mesh_path_del(struct mesh_
+ {
+ 	hlist_del_rcu(&mpath->walk_list);
+ 	rhashtable_remove_fast(&tbl->rhead, &mpath->rhash, mesh_rht_params);
++	if (tbl == &mpath->sdata->u.mesh.mpp_paths)
++		mesh_fast_tx_flush_addr(mpath->sdata, mpath->dst);
++	else
++		mesh_fast_tx_flush_mpath(mpath);
+ 	mesh_path_free_rcu(tbl, mpath);
+ }
+ 
+@@ -747,6 +1026,7 @@ void mesh_path_fix_nexthop(struct mesh_p
+ 	mpath->exp_time = 0;
+ 	mpath->flags = MESH_PATH_FIXED | MESH_PATH_SN_VALID;
+ 	mesh_path_activate(mpath);
++	mesh_fast_tx_flush_mpath(mpath);
+ 	spin_unlock_bh(&mpath->state_lock);
+ 	ewma_mesh_fail_avg_init(&next_hop->mesh->fail_avg);
+ 	/* init it at a low value - 0 start is tricky */
+@@ -758,6 +1038,7 @@ void mesh_pathtbl_init(struct ieee80211_
+ {
+ 	mesh_table_init(&sdata->u.mesh.mesh_paths);
+ 	mesh_table_init(&sdata->u.mesh.mpp_paths);
++	mesh_fast_tx_init(sdata);
+ }
+ 
+ static
+@@ -785,6 +1066,7 @@ void mesh_path_expire(struct ieee80211_s
+ 
+ void mesh_pathtbl_unregister(struct ieee80211_sub_if_data *sdata)
+ {
++	mesh_fast_tx_deinit(sdata);
+ 	mesh_table_free(&sdata->u.mesh.mesh_paths);
+ 	mesh_table_free(&sdata->u.mesh.mpp_paths);
+ }
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2791,6 +2791,7 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 	if (mesh_hdr->flags & MESH_FLAGS_AE) {
+ 		struct mesh_path *mppath;
+ 		char *proxied_addr;
++		bool update = false;
+ 
+ 		if (multicast)
+ 			proxied_addr = mesh_hdr->eaddr1;
+@@ -2806,11 +2807,18 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 			mpp_path_add(sdata, proxied_addr, eth->h_source);
+ 		} else {
+ 			spin_lock_bh(&mppath->state_lock);
+-			if (!ether_addr_equal(mppath->mpp, eth->h_source))
++			if (!ether_addr_equal(mppath->mpp, eth->h_source)) {
+ 				memcpy(mppath->mpp, eth->h_source, ETH_ALEN);
++				update = true;
++			}
+ 			mppath->exp_time = jiffies;
+ 			spin_unlock_bh(&mppath->state_lock);
+ 		}
++
++		/* flush fast xmit cache if the address path changed */
++		if (update)
++			mesh_fast_tx_flush_addr(sdata, proxied_addr);
++
+ 		rcu_read_unlock();
+ 	}
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3022,6 +3022,9 @@ void ieee80211_check_fast_xmit(struct st
+ 	if (!ieee80211_hw_check(&local->hw, SUPPORT_FAST_XMIT))
+ 		return;
+ 
++	if (ieee80211_vif_is_mesh(&sdata->vif))
++		mesh_fast_tx_flush_sta(sdata, sta);
++
+ 	/* Locking here protects both the pointer itself, and against concurrent
+ 	 * invocations winning data access races to, e.g., the key pointer that
+ 	 * is used.
+@@ -3403,6 +3406,9 @@ static bool ieee80211_amsdu_aggregate(st
+ 	if (sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
+ 		return false;
+ 
++	if (ieee80211_vif_is_mesh(&sdata->vif))
++		return false;
++
+ 	if (skb_is_gso(skb))
+ 		return false;
+ 
+@@ -3635,10 +3641,11 @@ free:
+ 	return NULL;
+ }
+ 
+-static void __ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
+-				  struct sta_info *sta,
+-				  struct ieee80211_fast_tx *fast_tx,
+-				  struct sk_buff *skb, u8 tid, bool ampdu)
++void __ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
++			   struct sta_info *sta,
++			   struct ieee80211_fast_tx *fast_tx,
++			   struct sk_buff *skb, bool ampdu,
++			   const u8 *da, const u8 *sa)
+ {
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
+@@ -3647,7 +3654,6 @@ static void __ieee80211_xmit_fast(struct
+ 	ieee80211_tx_result r;
+ 	int hw_headroom = sdata->local->hw.extra_tx_headroom;
+ 	int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
+-	struct ethhdr eth;
+ 
+ 	skb = skb_share_check(skb, GFP_ATOMIC);
+ 	if (unlikely(!skb))
+@@ -3667,11 +3673,10 @@ static void __ieee80211_xmit_fast(struct
+ 					  ENCRYPT_NO)))
+ 		goto free;
+ 
+-	memcpy(&eth, skb->data, ETH_HLEN - 2);
+ 	hdr = skb_push(skb, extra_head);
+ 	memcpy(skb->data, fast_tx->hdr, fast_tx->hdr_len);
+-	memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN);
+-	memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN);
++	memcpy(skb->data + fast_tx->da_offs, da, ETH_ALEN);
++	memcpy(skb->data + fast_tx->sa_offs, sa, ETH_ALEN);
+ 
+ 	info = IEEE80211_SKB_CB(skb);
+ 	memset(info, 0, sizeof(*info));
+@@ -3690,7 +3695,8 @@ static void __ieee80211_xmit_fast(struct
+ #endif
+ 
+ 	if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
+-		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++		u8 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++
+ 		*ieee80211_get_qos_ctl(hdr) = tid;
+ 	}
+ 
+@@ -3733,6 +3739,7 @@ static bool ieee80211_xmit_fast(struct i
+ 	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
+ 	struct tid_ampdu_tx *tid_tx = NULL;
+ 	struct sk_buff *next;
++	struct ethhdr eth;
+ 	u8 tid = IEEE80211_NUM_TIDS;
+ 
+ 	/* control port protocol needs a lot of special handling */
+@@ -3758,6 +3765,8 @@ static bool ieee80211_xmit_fast(struct i
+ 		}
+ 	}
+ 
++	memcpy(&eth, skb->data, ETH_HLEN - 2);
++
+ 	/* after this point (skb is modified) we cannot return false */
+ 	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
+ 	if (!skb)
+@@ -3765,7 +3774,8 @@ static bool ieee80211_xmit_fast(struct i
+ 
+ 	skb_list_walk_safe(skb, skb, next) {
+ 		skb_mark_not_on_list(skb);
+-		__ieee80211_xmit_fast(sdata, sta, fast_tx, skb, tid, tid_tx);
++		__ieee80211_xmit_fast(sdata, sta, fast_tx, skb, tid_tx,
++				      eth.h_dest, eth.h_source);
+ 	}
+ 
+ 	return true;
+@@ -4252,8 +4262,15 @@ void __ieee80211_subif_start_xmit(struct
+ 		return;
+ 	}
+ 
++	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
++
+ 	rcu_read_lock();
+ 
++	if (ieee80211_vif_is_mesh(&sdata->vif) &&
++	    ieee80211_hw_check(&local->hw, SUPPORT_FAST_XMIT) &&
++	    ieee80211_mesh_xmit_fast(sdata, skb, ctrl_flags))
++		goto out;
++
+ 	if (ieee80211_lookup_ra_sta(sdata, skb, &sta))
+ 		goto out_free;
+ 
+@@ -4263,8 +4280,6 @@ void __ieee80211_subif_start_xmit(struct
+ 	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
+ 	ieee80211_aggr_check(sdata, sta, skb);
+ 
+-	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
+-
+ 	if (sta) {
+ 		struct ieee80211_fast_tx *fast_tx;
+ 
diff --git a/package/kernel/mac80211/patches/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch b/package/kernel/mac80211/patches/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch
new file mode 100644
index 000000000..28b1ff110
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch
@@ -0,0 +1,132 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 16 Feb 2023 11:07:30 +0100
+Subject: [PATCH] wifi: mac80211: use mesh header cache to speed up mesh
+ forwarding
+
+Significantly reduces mesh forwarding path CPU usage and enables the
+direct use of iTXQ.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2720,6 +2720,65 @@ ieee80211_deliver_skb(struct ieee80211_r
+ 	}
+ }
+ 
++#ifdef CPTCFG_MAC80211_MESH
++static bool
++ieee80211_rx_mesh_fast_forward(struct ieee80211_sub_if_data *sdata,
++			       struct sk_buff *skb, int hdrlen)
++{
++	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
++	struct ieee80211_mesh_fast_tx *entry = NULL;
++	struct ieee80211s_hdr *mesh_hdr;
++	struct tid_ampdu_tx *tid_tx;
++	struct sta_info *sta;
++	struct ethhdr eth;
++	u8 tid;
++
++	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(eth));
++	if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
++		entry = mesh_fast_tx_get(sdata, mesh_hdr->eaddr1);
++	else if (!(mesh_hdr->flags & MESH_FLAGS_AE))
++		entry = mesh_fast_tx_get(sdata, skb->data);
++	if (!entry)
++		return false;
++
++	sta = rcu_dereference(entry->mpath->next_hop);
++	if (!sta)
++		return false;
++
++	if (skb_linearize(skb))
++		return false;
++
++	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
++	if (tid_tx) {
++		if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
++			return false;
++
++		if (tid_tx->timeout)
++			tid_tx->last_tx = jiffies;
++	}
++
++	ieee80211_aggr_check(sdata, sta, skb);
++
++	if (ieee80211_get_8023_tunnel_proto(skb->data + hdrlen,
++					    &skb->protocol))
++		hdrlen += ETH_ALEN;
++	else
++		skb->protocol = htons(skb->len - hdrlen);
++	skb_set_network_header(skb, hdrlen + 2);
++
++	skb->dev = sdata->dev;
++	memcpy(&eth, skb->data, ETH_HLEN - 2);
++	skb_pull(skb, 2);
++	__ieee80211_xmit_fast(sdata, sta, &entry->fast_tx, skb, tid_tx,
++			      eth.h_dest, eth.h_source);
++	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
++	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
++
++	return true;
++}
++#endif
++
+ static ieee80211_rx_result
+ ieee80211_rx_mesh_data(struct ieee80211_sub_if_data *sdata, struct sta_info *sta,
+ 		       struct sk_buff *skb)
+@@ -2824,6 +2883,10 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 
+ 	skb_set_queue_mapping(skb, ieee802_1d_to_ac[skb->priority]);
+ 
++	if (!multicast &&
++	    ieee80211_rx_mesh_fast_forward(sdata, skb, mesh_hdrlen))
++		return RX_QUEUED;
++
+ 	ieee80211_fill_mesh_addresses(&hdr, &hdr.frame_control,
+ 				      eth->h_dest, eth->h_source);
+ 	hdrlen = ieee80211_hdrlen(hdr.frame_control);
+@@ -2862,6 +2925,7 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 	info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
+ 	info->control.vif = &sdata->vif;
+ 	info->control.jiffies = jiffies;
++	fwd_skb->dev = sdata->dev;
+ 	if (multicast) {
+ 		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
+ 		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
+@@ -2883,7 +2947,6 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 	}
+ 
+ 	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
+-	fwd_skb->dev = sdata->dev;
+ 	ieee80211_add_pending_skb(local, fwd_skb);
+ 
+ rx_accept:
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -2022,6 +2022,8 @@ void __ieee80211_xmit_fast(struct ieee80
+ 			   struct ieee80211_fast_tx *fast_tx,
+ 			   struct sk_buff *skb, bool ampdu,
+ 			   const u8 *da, const u8 *sa);
++void ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata,
++			  struct sta_info *sta, struct sk_buff *skb);
+ 
+ /* HT */
+ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1191,10 +1191,8 @@ static bool ieee80211_tx_prep_agg(struct
+ 	return queued;
+ }
+ 
+-static void
+-ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata,
+-		     struct sta_info *sta,
+-		     struct sk_buff *skb)
++void ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata,
++			  struct sta_info *sta, struct sk_buff *skb)
+ {
+ 	struct rate_control_ref *ref = sdata->local->rate_ctrl;
+ 	u16 tid;
diff --git a/package/kernel/mac80211/patches/subsys/321-mac80211-fix-mesh-forwarding.patch b/package/kernel/mac80211/patches/subsys/321-mac80211-fix-mesh-forwarding.patch
new file mode 100644
index 000000000..e2b268ae4
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/321-mac80211-fix-mesh-forwarding.patch
@@ -0,0 +1,32 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Feb 2023 12:50:50 +0100
+Subject: [PATCH] mac80211: fix mesh forwarding
+
+Linearize packets (needed for forwarding A-MSDU subframes).
+Fix network header offset to fix flow dissector (and fair queueing).
+
+Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2904,6 +2904,9 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 
+ 		if (skb_cow_head(fwd_skb, hdrlen - sizeof(struct ethhdr)))
+ 			return RX_DROP_UNUSABLE;
++
++		if (skb_linearize(fwd_skb))
++			return RX_DROP_UNUSABLE;
+ 	}
+ 
+ 	fwd_hdr = skb_push(fwd_skb, hdrlen - sizeof(struct ethhdr));
+@@ -2918,7 +2921,7 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 		hdrlen += ETH_ALEN;
+ 	else
+ 		fwd_skb->protocol = htons(fwd_skb->len - hdrlen);
+-	skb_set_network_header(fwd_skb, hdrlen);
++	skb_set_network_header(fwd_skb, hdrlen + 2);
+ 
+ 	info = IEEE80211_SKB_CB(fwd_skb);
+ 	memset(info, 0, sizeof(*info));
diff --git a/package/kernel/mac80211/patches/subsys/322-wifi-mac80211-fix-mesh-path-discovery-based-on-unica.patch b/package/kernel/mac80211/patches/subsys/322-wifi-mac80211-fix-mesh-path-discovery-based-on-unica.patch
new file mode 100644
index 000000000..292a89ef9
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/322-wifi-mac80211-fix-mesh-path-discovery-based-on-unica.patch
@@ -0,0 +1,52 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 26 Feb 2023 20:30:20 +0100
+Subject: [PATCH] wifi: mac80211: fix mesh path discovery based on unicast
+ packets
+
+If a packet has reached its intended destination, it was bumped to the code
+that accepts it, without first checking if a mesh_path needs to be created
+based on the discovered source.
+Fix this by moving the destination address check further down
+
+Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2824,17 +2824,6 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 	    mesh_rmc_check(sdata, eth->h_source, mesh_hdr))
+ 		return RX_DROP_MONITOR;
+ 
+-	/* Frame has reached destination.  Don't forward */
+-	if (ether_addr_equal(sdata->vif.addr, eth->h_dest))
+-		goto rx_accept;
+-
+-	if (!ifmsh->mshcfg.dot11MeshForwarding) {
+-		if (is_multicast_ether_addr(eth->h_dest))
+-			goto rx_accept;
+-
+-		return RX_DROP_MONITOR;
+-	}
+-
+ 	/* forward packet */
+ 	if (sdata->crypto_tx_tailroom_needed_cnt)
+ 		tailroom = IEEE80211_ENCRYPT_TAILROOM;
+@@ -2881,6 +2870,17 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 		rcu_read_unlock();
+ 	}
+ 
++	/* Frame has reached destination.  Don't forward */
++	if (ether_addr_equal(sdata->vif.addr, eth->h_dest))
++		goto rx_accept;
++
++	if (!ifmsh->mshcfg.dot11MeshForwarding) {
++		if (is_multicast_ether_addr(eth->h_dest))
++			goto rx_accept;
++
++		return RX_DROP_MONITOR;
++	}
++
+ 	skb_set_queue_mapping(skb, ieee802_1d_to_ac[skb->priority]);
+ 
+ 	if (!multicast &&
diff --git a/package/kernel/mac80211/patches/subsys/323-v6.3-wifi-mac80211-Add-VHT-MU-MIMO-related-flags-in-ieee8.patch b/package/kernel/mac80211/patches/subsys/323-v6.3-wifi-mac80211-Add-VHT-MU-MIMO-related-flags-in-ieee8.patch
new file mode 100644
index 000000000..e23dc4d22
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/323-v6.3-wifi-mac80211-Add-VHT-MU-MIMO-related-flags-in-ieee8.patch
@@ -0,0 +1,68 @@
+From: Muna Sinada <quic_msinada@quicinc.com>
+Date: Wed, 5 Oct 2022 14:54:45 -0700
+Subject: [PATCH] wifi: mac80211: Add VHT MU-MIMO related flags in
+ ieee80211_bss_conf
+
+Adding flags for SU Beamformer, SU Beamformee, MU Beamformer and
+MU Beamformee for VHT. This is utilized to pass MU-MIMO
+configurations from user space to driver in AP mode.
+
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Link: https://lore.kernel.org/r/1665006886-23874-1-git-send-email-quic_msinada@quicinc.com
+[fixed indentation, removed redundant !!]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -653,6 +653,14 @@ struct ieee80211_fils_discovery {
+  *	write-protected by sdata_lock and local->mtx so holding either is fine
+  *	for read access.
+  * @color_change_color: the bss color that will be used after the change.
++ * @vht_su_beamformer: in AP mode, does this BSS support operation as an VHT SU
++ *	beamformer
++ * @vht_su_beamformee: in AP mode, does this BSS support operation as an VHT SU
++ *	beamformee
++ * @vht_mu_beamformer: in AP mode, does this BSS support operation as an VHT MU
++ *	beamformer
++ * @vht_mu_beamformee: in AP mode, does this BSS support operation as an VHT MU
++ *	beamformee
+  */
+ struct ieee80211_bss_conf {
+ 	const u8 *bssid;
+@@ -726,6 +734,11 @@ struct ieee80211_bss_conf {
+ 
+ 	bool color_change_active;
+ 	u8 color_change_color;
++
++	bool vht_su_beamformer;
++	bool vht_su_beamformee;
++	bool vht_mu_beamformer;
++	bool vht_mu_beamformee;
+ };
+ 
+ /**
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1252,6 +1252,21 @@ static int ieee80211_start_ap(struct wip
+ 	prev_beacon_int = link_conf->beacon_int;
+ 	link_conf->beacon_int = params->beacon_interval;
+ 
++	if (params->vht_cap) {
++		link_conf->vht_su_beamformer =
++			params->vht_cap->vht_cap_info &
++				cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
++		link_conf->vht_su_beamformee =
++			params->vht_cap->vht_cap_info &
++				cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
++		link_conf->vht_mu_beamformer =
++			params->vht_cap->vht_cap_info &
++				cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE);
++		link_conf->vht_mu_beamformee =
++			params->vht_cap->vht_cap_info &
++				cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
++	}
++
+ 	if (params->he_cap && params->he_oper) {
+ 		link_conf->he_support = true;
+ 		link_conf->htc_trig_based_pkt_ext =
diff --git a/package/kernel/mac80211/patches/subsys/324-v6.3-wifi-mac80211-Add-HE-MU-MIMO-related-flags-in-ieee80.patch b/package/kernel/mac80211/patches/subsys/324-v6.3-wifi-mac80211-Add-HE-MU-MIMO-related-flags-in-ieee80.patch
new file mode 100644
index 000000000..f843dba12
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/324-v6.3-wifi-mac80211-Add-HE-MU-MIMO-related-flags-in-ieee80.patch
@@ -0,0 +1,68 @@
+From: Muna Sinada <quic_msinada@quicinc.com>
+Date: Wed, 5 Oct 2022 14:54:46 -0700
+Subject: [PATCH] wifi: mac80211: Add HE MU-MIMO related flags in
+ ieee80211_bss_conf
+
+Adding flags for SU Beamformer, SU Beamformee, MU Beamformer and Full
+Bandwidth UL MU-MIMO for HE. This is utilized to pass MU-MIMO
+configurations from user space to driver in AP mode.
+
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Link: https://lore.kernel.org/r/1665006886-23874-2-git-send-email-quic_msinada@quicinc.com
+[fixed indentation, removed redundant !!]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -661,6 +661,15 @@ struct ieee80211_fils_discovery {
+  *	beamformer
+  * @vht_mu_beamformee: in AP mode, does this BSS support operation as an VHT MU
+  *	beamformee
++ * @he_su_beamformer: in AP-mode, does this BSS support operation as an HE SU
++ *	beamformer
++ * @he_su_beamformee: in AP-mode, does this BSS support operation as an HE SU
++ *	beamformee
++ * @he_mu_beamformer: in AP-mode, does this BSS support operation as an HE MU
++ *	beamformer
++ * @he_full_ul_mumimo: does this BSS support the reception (AP) or transmission
++ *	(non-AP STA) of an HE TB PPDU on an RU that spans the entire PPDU
++ *	bandwidth
+  */
+ struct ieee80211_bss_conf {
+ 	const u8 *bssid;
+@@ -739,6 +748,10 @@ struct ieee80211_bss_conf {
+ 	bool vht_su_beamformee;
+ 	bool vht_mu_beamformer;
+ 	bool vht_mu_beamformee;
++	bool he_su_beamformer;
++	bool he_su_beamformee;
++	bool he_mu_beamformer;
++	bool he_full_ul_mumimo;
+ };
+ 
+ /**
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1281,6 +1281,21 @@ static int ieee80211_start_ap(struct wip
+ 			changed |= BSS_CHANGED_HE_BSS_COLOR;
+ 	}
+ 
++	if (params->he_cap) {
++		link_conf->he_su_beamformer =
++			params->he_cap->phy_cap_info[3] &
++				IEEE80211_HE_PHY_CAP3_SU_BEAMFORMER;
++		link_conf->he_su_beamformee =
++			params->he_cap->phy_cap_info[4] &
++				IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE;
++		link_conf->he_mu_beamformer =
++			params->he_cap->phy_cap_info[4] &
++				IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER;
++		link_conf->he_full_ul_mumimo =
++			params->he_cap->phy_cap_info[2] &
++				IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO;
++	}
++
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP &&
+ 	    params->mbssid_config.tx_wdev) {
+ 		err = ieee80211_set_ap_mbssid_options(sdata,
diff --git a/package/kernel/mac80211/patches/subsys/325-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch b/package/kernel/mac80211/patches/subsys/325-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch
new file mode 100644
index 000000000..1be5fcfbf
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/325-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch
@@ -0,0 +1,60 @@
+From: Ryder Lee <ryder.lee@mediatek.com>
+Date: Sat, 18 Feb 2023 01:50:05 +0800
+Subject: [PATCH] wifi: mac80211: introduce
+ ieee80211_refresh_tx_agg_session_timer()
+
+This allows low level drivers to refresh the tx agg session timer, based on
+querying stats from the firmware usually. Especially for some mt76 devices
+support .net_fill_forward_path would bypass mac80211, which leads to tx BA
+session timeout for certain clients.
+
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -5964,6 +5964,18 @@ void ieee80211_queue_delayed_work(struct
+ 				  unsigned long delay);
+ 
+ /**
++ * ieee80211_refresh_tx_agg_session_timer - Refresh a tx agg session timer.
++ * @sta: the station for which to start a BA session
++ * @tid: the TID to BA on.
++ *
++ * This function allows low level driver to refresh tx agg session timer
++ * to maintain BA session, the session level will still be managed by the
++ * mac80211.
++ */
++void ieee80211_refresh_tx_agg_session_timer(struct ieee80211_sta *sta,
++					    u16 tid);
++
++/**
+  * ieee80211_start_tx_ba_session - Start a tx Block Ack session.
+  * @sta: the station for which to start a BA session
+  * @tid: the TID to BA on.
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -554,6 +554,23 @@ void ieee80211_tx_ba_session_handle_star
+ 	ieee80211_send_addba_with_timeout(sta, tid_tx);
+ }
+ 
++void ieee80211_refresh_tx_agg_session_timer(struct ieee80211_sta *pubsta,
++					    u16 tid)
++{
++	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
++	struct tid_ampdu_tx *tid_tx;
++
++	if (WARN_ON_ONCE(tid >= IEEE80211_NUM_TIDS))
++		return;
++
++	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
++	if (!tid_tx)
++		return;
++
++	tid_tx->last_tx = jiffies;
++}
++EXPORT_SYMBOL(ieee80211_refresh_tx_agg_session_timer);
++
+ /*
+  * After accepting the AddBA Response we activated a timer,
+  * resetting it after each frame that we send.
diff --git a/package/kernel/mac80211/patches/subsys/326-wifi-mac80211-add-mesh-fast-rx-support.patch b/package/kernel/mac80211/patches/subsys/326-wifi-mac80211-add-mesh-fast-rx-support.patch
new file mode 100644
index 000000000..11f39c2d1
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/326-wifi-mac80211-add-mesh-fast-rx-support.patch
@@ -0,0 +1,77 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 2 Mar 2023 13:52:29 +0100
+Subject: [PATCH] wifi: mac80211: add mesh fast-rx support
+
+This helps bring down rx CPU usage by avoiding calls to the rx handlers in
+the slow path. Supports forwarding and local rx, including A-MSDU.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4564,6 +4564,12 @@ void ieee80211_check_fast_rx(struct sta_
+ 		}
+ 
+ 		break;
++	case NL80211_IFTYPE_MESH_POINT:
++		fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_FROMDS |
++						      IEEE80211_FCTL_TODS);
++		fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
++		fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
++		break;
+ 	default:
+ 		goto clear;
+ 	}
+@@ -4772,6 +4778,7 @@ static bool ieee80211_invoke_fast_rx(str
+ 	struct sk_buff *skb = rx->skb;
+ 	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
++	static ieee80211_rx_result res;
+ 	int orig_len = skb->len;
+ 	int hdrlen = ieee80211_hdrlen(hdr->frame_control);
+ 	int snap_offs = hdrlen;
+@@ -4833,7 +4840,8 @@ static bool ieee80211_invoke_fast_rx(str
+ 		snap_offs += IEEE80211_CCMP_HDR_LEN;
+ 	}
+ 
+-	if (!(status->rx_flags & IEEE80211_RX_AMSDU)) {
++	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
++	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
+ 		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
+ 			return false;
+ 
+@@ -4872,13 +4880,29 @@ static bool ieee80211_invoke_fast_rx(str
+ 	/* do the header conversion - first grab the addresses */
+ 	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
+ 	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
+-	skb_postpull_rcsum(skb, skb->data + snap_offs,
+-			   sizeof(rfc1042_header) + 2);
+-	/* remove the SNAP but leave the ethertype */
+-	skb_pull(skb, snap_offs + sizeof(rfc1042_header));
++	if (ieee80211_vif_is_mesh(&rx->sdata->vif)) {
++	    skb_pull(skb, snap_offs - 2);
++	    put_unaligned_be16(skb->len - 2, skb->data);
++	} else {
++	    skb_postpull_rcsum(skb, skb->data + snap_offs,
++			       sizeof(rfc1042_header) + 2);
++
++	    /* remove the SNAP but leave the ethertype */
++	    skb_pull(skb, snap_offs + sizeof(rfc1042_header));
++	}
+ 	/* push the addresses in front */
+ 	memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
+ 
++	res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
++	switch (res) {
++	case RX_QUEUED:
++		return true;
++	case RX_CONTINUE:
++		break;
++	default:
++		goto drop;
++	}
++
+ 	ieee80211_rx_8023(rx, fast_rx, orig_len);
+ 
+ 	return true;
diff --git a/package/kernel/mac80211/patches/subsys/327-wifi-mac80211-add-support-for-letting-drivers-regist.patch b/package/kernel/mac80211/patches/subsys/327-wifi-mac80211-add-support-for-letting-drivers-regist.patch
new file mode 100644
index 000000000..ac290b536
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/327-wifi-mac80211-add-support-for-letting-drivers-regist.patch
@@ -0,0 +1,149 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Mar 2023 14:28:08 +0100
+Subject: [PATCH] wifi: mac80211: add support for letting drivers register tc
+ offload support
+
+On newer MediaTek SoCs (e.g. MT7986), WLAN->WLAN or WLAN->Ethernet flows can
+be offloaded by the SoC. In order to support that, the .ndo_setup_tc op is
+needed.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -4192,6 +4192,10 @@ struct ieee80211_prep_tx_info {
+  *	Note that a sta can also be inserted or removed with valid links,
+  *	i.e. passed to @sta_add/@sta_state with sta->valid_links not zero.
+  *	In fact, cannot change from having valid_links and not having them.
++ * @net_setup_tc: Called from .ndo_setup_tc in order to prepare hardware
++ *	flow offloading for flows originating from the vif.
++ *	Note that the driver must not assume that the vif driver_data is valid
++ *	at this point, since the callback can be called during netdev teardown.
+  */
+ struct ieee80211_ops {
+ 	void (*tx)(struct ieee80211_hw *hw,
+@@ -4547,6 +4551,11 @@ struct ieee80211_ops {
+ 				struct ieee80211_vif *vif,
+ 				struct ieee80211_sta *sta,
+ 				u16 old_links, u16 new_links);
++	int (*net_setup_tc)(struct ieee80211_hw *hw,
++			    struct ieee80211_vif *vif,
++			    struct net_device *dev,
++			    enum tc_setup_type type,
++			    void *type_data);
+ };
+ 
+ /**
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1470,6 +1470,23 @@ static inline int drv_net_fill_forward_p
+ 	return ret;
+ }
+ 
++static inline int drv_net_setup_tc(struct ieee80211_local *local,
++				   struct ieee80211_sub_if_data *sdata,
++				   struct net_device *dev,
++				   enum tc_setup_type type, void *type_data)
++{
++	int ret = -EOPNOTSUPP;
++
++	sdata = get_bss_sdata(sdata);
++	trace_drv_net_setup_tc(local, sdata, type);
++	if (local->ops->net_setup_tc)
++		ret = local->ops->net_setup_tc(&local->hw, &sdata->vif, dev,
++					       type, type_data);
++	trace_drv_return_int(local, ret);
++
++	return ret;
++}
++
+ int drv_change_vif_links(struct ieee80211_local *local,
+ 			 struct ieee80211_sub_if_data *sdata,
+ 			 u16 old_links, u16 new_links,
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1939,7 +1939,8 @@ void ieee80211_color_collision_detection
+ /* interface handling */
+ #define MAC80211_SUPPORTED_FEATURES_TX	(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \
+ 					 NETIF_F_HW_CSUM | NETIF_F_SG | \
+-					 NETIF_F_HIGHDMA | NETIF_F_GSO_SOFTWARE)
++					 NETIF_F_HIGHDMA | NETIF_F_GSO_SOFTWARE | \
++					 NETIF_F_HW_TC)
+ #define MAC80211_SUPPORTED_FEATURES_RX	(NETIF_F_RXCSUM)
+ #define MAC80211_SUPPORTED_FEATURES	(MAC80211_SUPPORTED_FEATURES_TX | \
+ 					 MAC80211_SUPPORTED_FEATURES_RX)
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -813,6 +813,21 @@ ieee80211_get_stats64(struct net_device
+ 	dev_fetch_sw_netstats(stats, dev->tstats);
+ }
+ 
++static int ieee80211_netdev_setup_tc(struct net_device *dev,
++				     enum tc_setup_type type, void *type_data)
++{
++	struct ieee80211_sub_if_data *sdata;
++	struct ieee80211_local *local;
++
++	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
++	local = sdata->local;
++
++	if (!local->ops->net_setup_tc)
++		return -EOPNOTSUPP;
++
++	return drv_net_setup_tc(local, sdata, dev, type, type_data);
++}
++
+ static const struct net_device_ops ieee80211_dataif_ops = {
+ 	.ndo_open		= ieee80211_open,
+ 	.ndo_stop		= ieee80211_stop,
+@@ -821,6 +836,7 @@ static const struct net_device_ops ieee8
+ 	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
+ 	.ndo_set_mac_address 	= ieee80211_change_mac,
+ 	.ndo_get_stats64	= ieee80211_get_stats64,
++	.ndo_setup_tc		= ieee80211_netdev_setup_tc,
+ };
+ 
+ static u16 ieee80211_monitor_select_queue(struct net_device *dev,
+@@ -929,6 +945,7 @@ static const struct net_device_ops ieee8
+ 	.ndo_set_mac_address	= ieee80211_change_mac,
+ 	.ndo_get_stats64	= ieee80211_get_stats64,
+ 	.ndo_fill_forward_path	= ieee80211_netdev_fill_forward_path,
++	.ndo_setup_tc		= ieee80211_netdev_setup_tc,
+ };
+ 
+ static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -2478,6 +2478,31 @@ DEFINE_EVENT(sta_event, drv_net_fill_for
+ 	TP_ARGS(local, sdata, sta)
+ );
+ 
++TRACE_EVENT(drv_net_setup_tc,
++	TP_PROTO(struct ieee80211_local *local,
++		 struct ieee80211_sub_if_data *sdata,
++		 u8 type),
++
++	TP_ARGS(local, sdata, type),
++
++	TP_STRUCT__entry(
++		LOCAL_ENTRY
++		VIF_ENTRY
++		__field(u8, type)
++	),
++
++	TP_fast_assign(
++		LOCAL_ASSIGN;
++		VIF_ASSIGN;
++		__entry->type = type;
++	),
++
++	TP_printk(
++		LOCAL_PR_FMT VIF_PR_FMT " type:%d\n",
++		LOCAL_PR_ARG, VIF_PR_ARG, __entry->type
++	)
++);
++
+ TRACE_EVENT(drv_change_vif_links,
+ 	TP_PROTO(struct ieee80211_local *local,
+ 		 struct ieee80211_sub_if_data *sdata,
diff --git a/package/kernel/mac80211/patches/subsys/329-wifi-mac80211-fix-receiving-mesh-packets-in-forwardi.patch b/package/kernel/mac80211/patches/subsys/329-wifi-mac80211-fix-receiving-mesh-packets-in-forwardi.patch
new file mode 100644
index 000000000..6882694da
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/329-wifi-mac80211-fix-receiving-mesh-packets-in-forwardi.patch
@@ -0,0 +1,50 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 26 Mar 2023 17:11:34 +0200
+Subject: [PATCH] wifi: mac80211: fix receiving mesh packets in forwarding=0
+ networks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When forwarding is set to 0, frames are typically sent with ttl=1.
+Move the ttl decrement check below the check for local receive in order to
+fix packet drops.
+
+Reported-by: Thomas Hühn <thomas.huehn@hs-nordhausen.de>
+Reported-by: Nick Hainke <vincent@systemli.org>
+Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2828,14 +2828,6 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 	if (sdata->crypto_tx_tailroom_needed_cnt)
+ 		tailroom = IEEE80211_ENCRYPT_TAILROOM;
+ 
+-	if (!--mesh_hdr->ttl) {
+-		if (multicast)
+-			goto rx_accept;
+-
+-		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
+-		return RX_DROP_MONITOR;
+-	}
+-
+ 	if (mesh_hdr->flags & MESH_FLAGS_AE) {
+ 		struct mesh_path *mppath;
+ 		char *proxied_addr;
+@@ -2874,6 +2866,14 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 	if (ether_addr_equal(sdata->vif.addr, eth->h_dest))
+ 		goto rx_accept;
+ 
++	if (!--mesh_hdr->ttl) {
++		if (multicast)
++			goto rx_accept;
++
++		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
++		return RX_DROP_MONITOR;
++	}
++
+ 	if (!ifmsh->mshcfg.dot11MeshForwarding) {
+ 		if (is_multicast_ether_addr(eth->h_dest))
+ 			goto rx_accept;
diff --git a/package/kernel/mac80211/patches/subsys/330-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch b/package/kernel/mac80211/patches/subsys/330-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch
new file mode 100644
index 000000000..079dd2a86
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/330-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch
@@ -0,0 +1,134 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 29 Mar 2023 16:46:26 +0200
+Subject: [PATCH] wifi: ieee80211: correctly mark FTM frames non-bufferable
+
+The checks of whether or not a frame is bufferable were not
+taking into account that some action frames aren't, such as
+FTM. Check this, which requires some changes to the function
+ieee80211_is_bufferable_mmpdu() since we need the whole skb
+for the checks now.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+Reviewed-by: Peer, Ilan <ilan.peer@intel.com>
+---
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -601,8 +601,9 @@ static void iwl_mvm_skb_prepare_status(s
+ 
+ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
+ 				      struct ieee80211_tx_info *info,
+-				      struct ieee80211_hdr *hdr)
++				      struct sk_buff *skb)
+ {
++	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 	struct iwl_mvm_vif *mvmvif =
+ 		iwl_mvm_vif_from_mac80211(info->control.vif);
+ 	__le16 fc = hdr->frame_control;
+@@ -621,7 +622,7 @@ static int iwl_mvm_get_ctrl_vif_queue(st
+ 		 * reason 7 ("Class 3 frame received from nonassociated STA").
+ 		 */
+ 		if (ieee80211_is_mgmt(fc) &&
+-		    (!ieee80211_is_bufferable_mmpdu(fc) ||
++		    (!ieee80211_is_bufferable_mmpdu(skb) ||
+ 		     ieee80211_is_deauth(fc) || ieee80211_is_disassoc(fc)))
+ 			return mvm->probe_queue;
+ 
+@@ -740,7 +741,7 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mv
+ 			else
+ 				sta_id = mvmvif->mcast_sta.sta_id;
+ 
+-			queue = iwl_mvm_get_ctrl_vif_queue(mvm, &info, hdr);
++			queue = iwl_mvm_get_ctrl_vif_queue(mvm, &info, skb);
+ 		} else if (info.control.vif->type == NL80211_IFTYPE_MONITOR) {
+ 			queue = mvm->snif_queue;
+ 			sta_id = mvm->snif_sta.sta_id;
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -772,20 +772,6 @@ static inline bool ieee80211_is_any_null
+ }
+ 
+ /**
+- * ieee80211_is_bufferable_mmpdu - check if frame is bufferable MMPDU
+- * @fc: frame control field in little-endian byteorder
+- */
+-static inline bool ieee80211_is_bufferable_mmpdu(__le16 fc)
+-{
+-	/* IEEE 802.11-2012, definition of "bufferable management frame";
+-	 * note that this ignores the IBSS special case. */
+-	return ieee80211_is_mgmt(fc) &&
+-	       (ieee80211_is_action(fc) ||
+-		ieee80211_is_disassoc(fc) ||
+-		ieee80211_is_deauth(fc));
+-}
+-
+-/**
+  * ieee80211_is_first_frag - check if IEEE80211_SCTL_FRAG is not set
+  * @seq_ctrl: frame sequence control bytes in little-endian byteorder
+  */
+@@ -4121,6 +4107,44 @@ static inline u8 *ieee80211_get_DA(struc
+ }
+ 
+ /**
++ * ieee80211_is_bufferable_mmpdu - check if frame is bufferable MMPDU
++ * @skb: the skb to check, starting with the 802.11 header
++ */
++static inline bool ieee80211_is_bufferable_mmpdu(struct sk_buff *skb)
++{
++	struct ieee80211_mgmt *mgmt = (void *)skb->data;
++	__le16 fc = mgmt->frame_control;
++
++	/*
++	 * IEEE 802.11 REVme D2.0 definition of bufferable MMPDU;
++	 * note that this ignores the IBSS special case.
++	 */
++	if (!ieee80211_is_mgmt(fc))
++		return false;
++
++	if (ieee80211_is_disassoc(fc) || ieee80211_is_deauth(fc))
++		return true;
++
++	if (!ieee80211_is_action(fc))
++		return false;
++
++	if (skb->len < offsetofend(typeof(*mgmt), u.action.u.ftm.action_code))
++		return true;
++
++	/* action frame - additionally check for non-bufferable FTM */
++
++	if (mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
++	    mgmt->u.action.category != WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION)
++		return true;
++
++	if (mgmt->u.action.u.ftm.action_code == WLAN_PUB_ACTION_FTM_REQUEST ||
++	    mgmt->u.action.u.ftm.action_code == WLAN_PUBLIC_ACTION_FTM_RESPONSE)
++		return false;
++
++	return true;
++}
++
++/**
+  * _ieee80211_is_robust_mgmt_frame - check if frame is a robust management frame
+  * @hdr: the frame (buffer must include at least the first octet of payload)
+  */
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -488,7 +488,7 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
+ 		int ac = skb_get_queue_mapping(tx->skb);
+ 
+ 		if (ieee80211_is_mgmt(hdr->frame_control) &&
+-		    !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
++		    !ieee80211_is_bufferable_mmpdu(tx->skb)) {
+ 			info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
+ 			return TX_CONTINUE;
+ 		}
+@@ -1326,7 +1326,7 @@ static struct txq_info *ieee80211_get_tx
+ 	if (!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
+ 	    unlikely(!ieee80211_is_data_present(hdr->frame_control))) {
+ 		if ((!ieee80211_is_mgmt(hdr->frame_control) ||
+-		     ieee80211_is_bufferable_mmpdu(hdr->frame_control) ||
++		     ieee80211_is_bufferable_mmpdu(skb) ||
+ 		     vif->type == NL80211_IFTYPE_STATION) &&
+ 		    sta && sta->uploaded) {
+ 			/*
diff --git a/package/kernel/mac80211/patches/subsys/331-wifi-mac80211-flush-queues-on-STA-removal.patch b/package/kernel/mac80211/patches/subsys/331-wifi-mac80211-flush-queues-on-STA-removal.patch
new file mode 100644
index 000000000..00232ec1b
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/331-wifi-mac80211-flush-queues-on-STA-removal.patch
@@ -0,0 +1,36 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 Mar 2023 11:42:12 +0100
+Subject: [PATCH] wifi: mac80211: flush queues on STA removal
+
+When we remove a station, we first make it unreachable,
+then we (must) remove its keys, and then remove the
+station itself. Depending on the hardware design, if
+we have hardware crypto at all, frames still sitting
+on hardware queues may then be transmitted without a
+valid key, possibly unencrypted or with a fixed key.
+
+Fix this by flushing the queues when removing stations
+so this cannot happen.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+---
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1271,6 +1271,14 @@ static void __sta_info_destroy_part2(str
+ 		WARN_ON_ONCE(ret);
+ 	}
+ 
++	/* Flush queues before removing keys, as that might remove them
++	 * from hardware, and then depending on the offload method, any
++	 * frames sitting on hardware queues might be sent out without
++	 * any encryption at all.
++	 */
++	if (local->ops->set_key)
++		ieee80211_flush_queues(local, sta->sdata, false);
++
+ 	/* now keys can no longer be reached */
+ 	ieee80211_free_sta_keys(local, sta);
+ 
diff --git a/package/kernel/mac80211/patches/subsys/332-wifi-iwlwifi-mvm-support-flush-on-AP-interfaces.patch b/package/kernel/mac80211/patches/subsys/332-wifi-iwlwifi-mvm-support-flush-on-AP-interfaces.patch
new file mode 100644
index 000000000..3c31dfedd
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/332-wifi-iwlwifi-mvm-support-flush-on-AP-interfaces.patch
@@ -0,0 +1,34 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 Mar 2023 12:02:58 +0100
+Subject: [PATCH] wifi: iwlwifi: mvm: support flush on AP interfaces
+
+Support TX flush on AP interfaces so that we will do a
+proper flush for frames on the queue before keys are
+removed.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+---
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -4854,9 +4854,6 @@ static void iwl_mvm_mac_flush(struct iee
+ 		return;
+ 	}
+ 
+-	if (vif->type != NL80211_IFTYPE_STATION)
+-		return;
+-
+ 	/* Make sure we're done with the deferred traffic before flushing */
+ 	flush_work(&mvm->add_stream_wk);
+ 
+@@ -4874,9 +4871,6 @@ static void iwl_mvm_mac_flush(struct iee
+ 		if (mvmsta->vif != vif)
+ 			continue;
+ 
+-		/* make sure only TDLS peers or the AP are flushed */
+-		WARN_ON(i != mvmvif->ap_sta_id && !sta->tdls);
+-
+ 		if (drop) {
+ 			if (iwl_mvm_flush_sta(mvm, mvmsta, false))
+ 				IWL_ERR(mvm, "flush request fail\n");
diff --git a/package/kernel/mac80211/patches/subsys/333-wifi-mac80211-add-flush_sta-method.patch b/package/kernel/mac80211/patches/subsys/333-wifi-mac80211-add-flush_sta-method.patch
new file mode 100644
index 000000000..3bba0b7e6
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/333-wifi-mac80211-add-flush_sta-method.patch
@@ -0,0 +1,91 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 Mar 2023 11:53:51 +0100
+Subject: [PATCH] wifi: mac80211: add flush_sta method
+
+Some drivers like iwlwifi might have per-STA queues, so we
+may want to flush/drop just those queues rather than all
+when removing a station. Add a separate method for that.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -3918,6 +3918,10 @@ struct ieee80211_prep_tx_info {
+  *	Note that vif can be NULL.
+  *	The callback can sleep.
+  *
++ * @flush_sta: Flush or drop all pending frames from the hardware queue(s) for
++ *	the given station, as it's about to be removed.
++ *	The callback can sleep.
++ *
+  * @channel_switch: Drivers that need (or want) to offload the channel
+  *	switch operation for CSAs received from the AP may implement this
+  *	callback. They must then call ieee80211_chswitch_done() to indicate
+@@ -4372,6 +4376,8 @@ struct ieee80211_ops {
+ #endif
+ 	void (*flush)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		      u32 queues, bool drop);
++	void (*flush_sta)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
++			  struct ieee80211_sta *sta);
+ 	void (*channel_switch)(struct ieee80211_hw *hw,
+ 			       struct ieee80211_vif *vif,
+ 			       struct ieee80211_channel_switch *ch_switch);
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -617,6 +617,21 @@ static inline void drv_flush(struct ieee
+ 	trace_drv_return_void(local);
+ }
+ 
++static inline void drv_flush_sta(struct ieee80211_local *local,
++				 struct ieee80211_sub_if_data *sdata,
++				 struct sta_info *sta)
++{
++	might_sleep();
++
++	if (sdata && !check_sdata_in_driver(sdata))
++		return;
++
++	trace_drv_flush_sta(local, sdata, &sta->sta);
++	if (local->ops->flush_sta)
++		local->ops->flush_sta(&local->hw, &sdata->vif, &sta->sta);
++	trace_drv_return_void(local);
++}
++
+ static inline void drv_channel_switch(struct ieee80211_local *local,
+ 				      struct ieee80211_sub_if_data *sdata,
+ 				      struct ieee80211_channel_switch *ch_switch)
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1276,8 +1276,12 @@ static void __sta_info_destroy_part2(str
+ 	 * frames sitting on hardware queues might be sent out without
+ 	 * any encryption at all.
+ 	 */
+-	if (local->ops->set_key)
+-		ieee80211_flush_queues(local, sta->sdata, false);
++	if (local->ops->set_key) {
++		if (local->ops->flush_sta)
++			drv_flush_sta(local, sta->sdata, sta);
++		else
++			ieee80211_flush_queues(local, sta->sdata, false);
++	}
+ 
+ 	/* now keys can no longer be reached */
+ 	ieee80211_free_sta_keys(local, sta);
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -1177,6 +1177,13 @@ TRACE_EVENT(drv_flush,
+ 	)
+ );
+ 
++DEFINE_EVENT(sta_event, drv_flush_sta,
++	TP_PROTO(struct ieee80211_local *local,
++		 struct ieee80211_sub_if_data *sdata,
++		 struct ieee80211_sta *sta),
++	TP_ARGS(local, sdata, sta)
++);
++
+ TRACE_EVENT(drv_channel_switch,
+ 	TP_PROTO(struct ieee80211_local *local,
+ 		 struct ieee80211_sub_if_data *sdata,
diff --git a/package/kernel/mac80211/patches/subsys/334-wifi-iwlwifi-mvm-support-new-flush_sta-method.patch b/package/kernel/mac80211/patches/subsys/334-wifi-iwlwifi-mvm-support-new-flush_sta-method.patch
new file mode 100644
index 000000000..18f39d505
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/334-wifi-iwlwifi-mvm-support-new-flush_sta-method.patch
@@ -0,0 +1,53 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 Mar 2023 12:05:35 +0100
+Subject: [PATCH] wifi: iwlwifi: mvm: support new flush_sta method
+
+For iwlwifi this is simple to implement, and on newer hardware
+it's an improvement since we have per-station queues.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+---
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -4890,6 +4890,31 @@ static void iwl_mvm_mac_flush(struct iee
+ 		iwl_trans_wait_tx_queues_empty(mvm->trans, msk);
+ }
+ 
++static void iwl_mvm_mac_flush_sta(struct ieee80211_hw *hw,
++				  struct ieee80211_vif *vif,
++				  struct ieee80211_sta *sta)
++{
++	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
++	int i;
++
++	mutex_lock(&mvm->mutex);
++	for (i = 0; i < mvm->fw->ucode_capa.num_stations; i++) {
++		struct iwl_mvm_sta *mvmsta;
++		struct ieee80211_sta *tmp;
++
++		tmp = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
++						lockdep_is_held(&mvm->mutex));
++		if (tmp != sta)
++			continue;
++
++		mvmsta = iwl_mvm_sta_from_mac80211(sta);
++
++		if (iwl_mvm_flush_sta(mvm, mvmsta, false))
++			IWL_ERR(mvm, "flush request fail\n");
++	}
++	mutex_unlock(&mvm->mutex);
++}
++
+ static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
+ 				  struct survey_info *survey)
+ {
+@@ -5417,6 +5442,7 @@ const struct ieee80211_ops iwl_mvm_hw_op
+ 	.mgd_complete_tx = iwl_mvm_mac_mgd_complete_tx,
+ 	.mgd_protect_tdls_discover = iwl_mvm_mac_mgd_protect_tdls_discover,
+ 	.flush = iwl_mvm_mac_flush,
++	.flush_sta = iwl_mvm_mac_flush_sta,
+ 	.sched_scan_start = iwl_mvm_mac_sched_scan_start,
+ 	.sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
+ 	.set_key = iwl_mvm_mac_set_key,
diff --git a/package/kernel/mac80211/patches/subsys/335-wifi-mac80211-add-LDPC-related-flags-in-ieee80211_bs.patch b/package/kernel/mac80211/patches/subsys/335-wifi-mac80211-add-LDPC-related-flags-in-ieee80211_bs.patch
new file mode 100644
index 000000000..1b379b76a
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/335-wifi-mac80211-add-LDPC-related-flags-in-ieee80211_bs.patch
@@ -0,0 +1,62 @@
+From: Ryder Lee <ryder.lee@mediatek.com>
+Date: Sat, 18 Feb 2023 01:49:25 +0800
+Subject: [PATCH] wifi: mac80211: add LDPC related flags in ieee80211_bss_conf
+
+This is utilized to pass LDPC configurations from user space
+(i.e. hostapd) to driver.
+
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Link: https://lore.kernel.org/r/1de696aaa34efd77a926eb657b8c0fda05aaa177.1676628065.git.ryder.lee@mediatek.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -653,6 +653,9 @@ struct ieee80211_fils_discovery {
+  *	write-protected by sdata_lock and local->mtx so holding either is fine
+  *	for read access.
+  * @color_change_color: the bss color that will be used after the change.
++ * @ht_ldpc: in AP mode, indicates interface has HT LDPC capability.
++ * @vht_ldpc: in AP mode, indicates interface has VHT LDPC capability.
++ * @he_ldpc: in AP mode, indicates interface has HE LDPC capability.
+  * @vht_su_beamformer: in AP mode, does this BSS support operation as an VHT SU
+  *	beamformer
+  * @vht_su_beamformee: in AP mode, does this BSS support operation as an VHT SU
+@@ -744,6 +747,9 @@ struct ieee80211_bss_conf {
+ 	bool color_change_active;
+ 	u8 color_change_color;
+ 
++	bool ht_ldpc;
++	bool vht_ldpc;
++	bool he_ldpc;
+ 	bool vht_su_beamformer;
+ 	bool vht_su_beamformee;
+ 	bool vht_mu_beamformer;
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1252,7 +1252,15 @@ static int ieee80211_start_ap(struct wip
+ 	prev_beacon_int = link_conf->beacon_int;
+ 	link_conf->beacon_int = params->beacon_interval;
+ 
++	if (params->ht_cap)
++		link_conf->ht_ldpc =
++			params->ht_cap->cap_info &
++				cpu_to_le16(IEEE80211_HT_CAP_LDPC_CODING);
++
+ 	if (params->vht_cap) {
++		link_conf->vht_ldpc =
++			params->vht_cap->vht_cap_info &
++				cpu_to_le32(IEEE80211_VHT_CAP_RXLDPC);
+ 		link_conf->vht_su_beamformer =
+ 			params->vht_cap->vht_cap_info &
+ 				cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
+@@ -1282,6 +1290,9 @@ static int ieee80211_start_ap(struct wip
+ 	}
+ 
+ 	if (params->he_cap) {
++		link_conf->he_ldpc =
++			params->he_cap->phy_cap_info[1] &
++				IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD;
+ 		link_conf->he_su_beamformer =
+ 			params->he_cap->phy_cap_info[3] &
+ 				IEEE80211_HE_PHY_CAP3_SU_BEAMFORMER;
diff --git a/package/kernel/mac80211/patches/subsys/336-v6.4-wifi-mac80211-generate-EMA-beacons-in-AP-mode.patch b/package/kernel/mac80211/patches/subsys/336-v6.4-wifi-mac80211-generate-EMA-beacons-in-AP-mode.patch
new file mode 100644
index 000000000..088f468e3
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/336-v6.4-wifi-mac80211-generate-EMA-beacons-in-AP-mode.patch
@@ -0,0 +1,372 @@
+From bd54f3c29077f23dad92ef82a78061b40be30c65 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Mon, 5 Dec 2022 16:50:37 -0800
+Subject: [PATCH] wifi: mac80211: generate EMA beacons in AP mode
+
+Add APIs to generate an array of beacons for an EMA AP (enhanced
+multiple BSSID advertisements), each including a single MBSSID element.
+EMA profile periodicity equals the count of elements.
+
+- ieee80211_beacon_get_template_ema_list() - Generate and return all
+EMA beacon templates. Drivers must call ieee80211_beacon_free_ema_list()
+to free the memory. No change in the prototype for the existing API,
+ieee80211_beacon_get_template(), which should be used for non-EMA AP.
+
+- ieee80211_beacon_get_template_ema_index() - Generate a beacon which
+includes the multiple BSSID element at the given index. Drivers can use
+this function in a loop until NULL is returned which indicates end of
+available MBSSID elements.
+
+- ieee80211_beacon_free_ema_list() - free the memory allocated for the
+list of EMA beacon templates.
+
+Modify existing functions ieee80211_beacon_get_ap(),
+ieee80211_get_mbssid_beacon_len() and ieee80211_beacon_add_mbssid()
+to accept a new parameter for EMA index.
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Co-developed-by: John Crispin <john@phrozen.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Link: https://lore.kernel.org/r/20221206005040.3177-2-quic_alokad@quicinc.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ include/net/mac80211.h     |  68 +++++++++++++++++++
+ net/mac80211/cfg.c         |  11 +--
+ net/mac80211/ieee80211_i.h |  10 ++-
+ net/mac80211/tx.c          | 134 ++++++++++++++++++++++++++++++++++---
+ 4 files changed, 205 insertions(+), 18 deletions(-)
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -5252,6 +5252,74 @@ ieee80211_beacon_get_template(struct iee
+ 			      unsigned int link_id);
+ 
+ /**
++ * ieee80211_beacon_get_template_ema_index - EMA beacon template generation
++ * @hw: pointer obtained from ieee80211_alloc_hw().
++ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
++ * @offs: &struct ieee80211_mutable_offsets pointer to struct that will
++ *	receive the offsets that may be updated by the driver.
++ * @link_id: the link id to which the beacon belongs (or 0 for a non-MLD AP).
++ * @ema_index: index of the beacon in the EMA set.
++ *
++ * This function follows the same rules as ieee80211_beacon_get_template()
++ * but returns a beacon template which includes multiple BSSID element at the
++ * requested index.
++ *
++ * Return: The beacon template. %NULL indicates the end of EMA templates.
++ */
++struct sk_buff *
++ieee80211_beacon_get_template_ema_index(struct ieee80211_hw *hw,
++					struct ieee80211_vif *vif,
++					struct ieee80211_mutable_offsets *offs,
++					unsigned int link_id, u8 ema_index);
++
++/**
++ * struct ieee80211_ema_beacons - List of EMA beacons
++ * @cnt: count of EMA beacons.
++ *
++ * @bcn: array of EMA beacons.
++ * @bcn.skb: the skb containing this specific beacon
++ * @bcn.offs: &struct ieee80211_mutable_offsets pointer to struct that will
++ *	receive the offsets that may be updated by the driver.
++ */
++struct ieee80211_ema_beacons {
++	u8 cnt;
++	struct {
++		struct sk_buff *skb;
++		struct ieee80211_mutable_offsets offs;
++	} bcn[];
++};
++
++/**
++ * ieee80211_beacon_get_template_ema_list - EMA beacon template generation
++ * @hw: pointer obtained from ieee80211_alloc_hw().
++ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
++ * @link_id: the link id to which the beacon belongs (or 0 for a non-MLD AP)
++ *
++ * This function follows the same rules as ieee80211_beacon_get_template()
++ * but allocates and returns a pointer to list of all beacon templates required
++ * to cover all profiles in the multiple BSSID set. Each template includes only
++ * one multiple BSSID element.
++ *
++ * Driver must call ieee80211_beacon_free_ema_list() to free the memory.
++ *
++ * Return: EMA beacon templates of type struct ieee80211_ema_beacons *.
++ *	%NULL on error.
++ */
++struct ieee80211_ema_beacons *
++ieee80211_beacon_get_template_ema_list(struct ieee80211_hw *hw,
++				       struct ieee80211_vif *vif,
++				       unsigned int link_id);
++
++/**
++ * ieee80211_beacon_free_ema_list - free an EMA beacon template list
++ * @ema_beacons: list of EMA beacons of type &struct ieee80211_ema_beacons pointers.
++ *
++ * This function will free a list previously acquired by calling
++ * ieee80211_beacon_get_template_ema_list()
++ */
++void ieee80211_beacon_free_ema_list(struct ieee80211_ema_beacons *ema_beacons);
++
++/**
+  * ieee80211_beacon_get_tim - beacon generation function
+  * @hw: pointer obtained from ieee80211_alloc_hw().
+  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1122,11 +1122,11 @@ static int ieee80211_assign_beacon(struc
+ 	if (params->mbssid_ies) {
+ 		mbssid = params->mbssid_ies;
+ 		size += struct_size(new->mbssid_ies, elem, mbssid->cnt);
+-		size += ieee80211_get_mbssid_beacon_len(mbssid);
++		size += ieee80211_get_mbssid_beacon_len(mbssid, mbssid->cnt);
+ 	} else if (old && old->mbssid_ies) {
+ 		mbssid = old->mbssid_ies;
+ 		size += struct_size(new->mbssid_ies, elem, mbssid->cnt);
+-		size += ieee80211_get_mbssid_beacon_len(mbssid);
++		size += ieee80211_get_mbssid_beacon_len(mbssid, mbssid->cnt);
+ 	}
+ 
+ 	new = kzalloc(size, GFP_KERNEL);
+@@ -3384,8 +3384,11 @@ cfg80211_beacon_dup(struct cfg80211_beac
+ 
+ 	len = beacon->head_len + beacon->tail_len + beacon->beacon_ies_len +
+ 	      beacon->proberesp_ies_len + beacon->assocresp_ies_len +
+-	      beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len +
+-	      ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies);
++	      beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len;
++
++	if (beacon->mbssid_ies)
++		len += ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies,
++						       beacon->mbssid_ies->cnt);
+ 
+ 	new_beacon = kzalloc(sizeof(*new_beacon) + len, GFP_KERNEL);
+ 	if (!new_beacon)
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1182,13 +1182,17 @@ ieee80211_vif_get_shift(struct ieee80211
+ }
+ 
+ static inline int
+-ieee80211_get_mbssid_beacon_len(struct cfg80211_mbssid_elems *elems)
++ieee80211_get_mbssid_beacon_len(struct cfg80211_mbssid_elems *elems, u8 i)
+ {
+-	int i, len = 0;
++	int len = 0;
+ 
+-	if (!elems)
++	if (!elems || !elems->cnt || i > elems->cnt)
+ 		return 0;
+ 
++	if (i < elems->cnt)
++		return elems->elem[i].len;
++
++	/* i == elems->cnt, calculate total length of all MBSSID elements */
+ 	for (i = 0; i < elems->cnt; i++)
+ 		len += elems->elem[i].len;
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -5205,13 +5205,20 @@ ieee80211_beacon_get_finish(struct ieee8
+ }
+ 
+ static void
+-ieee80211_beacon_add_mbssid(struct sk_buff *skb, struct beacon_data *beacon)
++ieee80211_beacon_add_mbssid(struct sk_buff *skb, struct beacon_data *beacon,
++			    u8 i)
+ {
+-	int i;
++	if (!beacon->mbssid_ies || !beacon->mbssid_ies->cnt ||
++	    i > beacon->mbssid_ies->cnt)
++		return;
+ 
+-	if (!beacon->mbssid_ies)
++	if (i < beacon->mbssid_ies->cnt) {
++		skb_put_data(skb, beacon->mbssid_ies->elem[i].data,
++			     beacon->mbssid_ies->elem[i].len);
+ 		return;
++	}
+ 
++	/* i == beacon->mbssid_ies->cnt, include all MBSSID elements */
+ 	for (i = 0; i < beacon->mbssid_ies->cnt; i++)
+ 		skb_put_data(skb, beacon->mbssid_ies->elem[i].data,
+ 			     beacon->mbssid_ies->elem[i].len);
+@@ -5224,7 +5231,8 @@ ieee80211_beacon_get_ap(struct ieee80211
+ 			struct ieee80211_mutable_offsets *offs,
+ 			bool is_template,
+ 			struct beacon_data *beacon,
+-			struct ieee80211_chanctx_conf *chanctx_conf)
++			struct ieee80211_chanctx_conf *chanctx_conf,
++			u8 ema_index)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+@@ -5243,7 +5251,9 @@ ieee80211_beacon_get_ap(struct ieee80211
+ 	/* headroom, head length,
+ 	 * tail length, maximum TIM length and multiple BSSID length
+ 	 */
+-	mbssid_len = ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies);
++	mbssid_len = ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies,
++						     ema_index);
++
+ 	skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
+ 			    beacon->tail_len + 256 +
+ 			    local->hw.extra_beacon_tailroom + mbssid_len);
+@@ -5261,7 +5271,7 @@ ieee80211_beacon_get_ap(struct ieee80211
+ 		offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
+ 
+ 		if (mbssid_len) {
+-			ieee80211_beacon_add_mbssid(skb, beacon);
++			ieee80211_beacon_add_mbssid(skb, beacon, ema_index);
+ 			offs->mbssid_off = skb->len - mbssid_len;
+ 		}
+ 
+@@ -5280,12 +5290,51 @@ ieee80211_beacon_get_ap(struct ieee80211
+ 	return skb;
+ }
+ 
++static struct ieee80211_ema_beacons *
++ieee80211_beacon_get_ap_ema_list(struct ieee80211_hw *hw,
++				 struct ieee80211_vif *vif,
++				 struct ieee80211_link_data *link,
++				 struct ieee80211_mutable_offsets *offs,
++				 bool is_template, struct beacon_data *beacon,
++				 struct ieee80211_chanctx_conf *chanctx_conf)
++{
++	struct ieee80211_ema_beacons *ema = NULL;
++
++	if (!beacon->mbssid_ies || !beacon->mbssid_ies->cnt)
++		return NULL;
++
++	ema = kzalloc(struct_size(ema, bcn, beacon->mbssid_ies->cnt),
++		      GFP_ATOMIC);
++	if (!ema)
++		return NULL;
++
++	for (ema->cnt = 0; ema->cnt < beacon->mbssid_ies->cnt; ema->cnt++) {
++		ema->bcn[ema->cnt].skb =
++			ieee80211_beacon_get_ap(hw, vif, link,
++						&ema->bcn[ema->cnt].offs,
++						is_template, beacon,
++						chanctx_conf, ema->cnt);
++		if (!ema->bcn[ema->cnt].skb)
++			break;
++	}
++
++	if (ema->cnt == beacon->mbssid_ies->cnt)
++		return ema;
++
++	ieee80211_beacon_free_ema_list(ema);
++	return NULL;
++}
++
++#define IEEE80211_INCLUDE_ALL_MBSSID_ELEMS -1
++
+ static struct sk_buff *
+ __ieee80211_beacon_get(struct ieee80211_hw *hw,
+ 		       struct ieee80211_vif *vif,
+ 		       struct ieee80211_mutable_offsets *offs,
+ 		       bool is_template,
+-		       unsigned int link_id)
++		       unsigned int link_id,
++		       int ema_index,
++		       struct ieee80211_ema_beacons **ema_beacons)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct beacon_data *beacon = NULL;
+@@ -5314,8 +5363,29 @@ __ieee80211_beacon_get(struct ieee80211_
+ 		if (!beacon)
+ 			goto out;
+ 
+-		skb = ieee80211_beacon_get_ap(hw, vif, link, offs, is_template,
+-					      beacon, chanctx_conf);
++		if (ema_beacons) {
++			*ema_beacons =
++				ieee80211_beacon_get_ap_ema_list(hw, vif, link,
++								 offs,
++								 is_template,
++								 beacon,
++								 chanctx_conf);
++		} else {
++			if (beacon->mbssid_ies && beacon->mbssid_ies->cnt) {
++				if (ema_index >= beacon->mbssid_ies->cnt)
++					goto out; /* End of MBSSID elements */
++
++				if (ema_index <= IEEE80211_INCLUDE_ALL_MBSSID_ELEMS)
++					ema_index = beacon->mbssid_ies->cnt;
++			} else {
++				ema_index = 0;
++			}
++
++			skb = ieee80211_beacon_get_ap(hw, vif, link, offs,
++						      is_template, beacon,
++						      chanctx_conf,
++						      ema_index);
++		}
+ 	} else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+ 		struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+ 		struct ieee80211_hdr *hdr;
+@@ -5403,10 +5473,50 @@ ieee80211_beacon_get_template(struct iee
+ 			      struct ieee80211_mutable_offsets *offs,
+ 			      unsigned int link_id)
+ {
+-	return __ieee80211_beacon_get(hw, vif, offs, true, link_id);
++	return __ieee80211_beacon_get(hw, vif, offs, true, link_id,
++				      IEEE80211_INCLUDE_ALL_MBSSID_ELEMS, NULL);
+ }
+ EXPORT_SYMBOL(ieee80211_beacon_get_template);
+ 
++struct sk_buff *
++ieee80211_beacon_get_template_ema_index(struct ieee80211_hw *hw,
++					struct ieee80211_vif *vif,
++					struct ieee80211_mutable_offsets *offs,
++					unsigned int link_id, u8 ema_index)
++{
++	return __ieee80211_beacon_get(hw, vif, offs, true, link_id, ema_index,
++				      NULL);
++}
++EXPORT_SYMBOL(ieee80211_beacon_get_template_ema_index);
++
++void ieee80211_beacon_free_ema_list(struct ieee80211_ema_beacons *ema_beacons)
++{
++	u8 i;
++
++	if (!ema_beacons)
++		return;
++
++	for (i = 0; i < ema_beacons->cnt; i++)
++		kfree_skb(ema_beacons->bcn[i].skb);
++
++	kfree(ema_beacons);
++}
++EXPORT_SYMBOL(ieee80211_beacon_free_ema_list);
++
++struct ieee80211_ema_beacons *
++ieee80211_beacon_get_template_ema_list(struct ieee80211_hw *hw,
++				       struct ieee80211_vif *vif,
++				       unsigned int link_id)
++{
++	struct ieee80211_ema_beacons *ema_beacons = NULL;
++
++	WARN_ON(__ieee80211_beacon_get(hw, vif, NULL, false, link_id, 0,
++				       &ema_beacons));
++
++	return ema_beacons;
++}
++EXPORT_SYMBOL(ieee80211_beacon_get_template_ema_list);
++
+ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
+ 					 struct ieee80211_vif *vif,
+ 					 u16 *tim_offset, u16 *tim_length,
+@@ -5414,7 +5524,9 @@ struct sk_buff *ieee80211_beacon_get_tim
+ {
+ 	struct ieee80211_mutable_offsets offs = {};
+ 	struct sk_buff *bcn = __ieee80211_beacon_get(hw, vif, &offs, false,
+-						     link_id);
++						     link_id,
++						     IEEE80211_INCLUDE_ALL_MBSSID_ELEMS,
++						     NULL);
+ 	struct sk_buff *copy;
+ 	int shift;
+ 
diff --git a/package/kernel/mac80211/patches/subsys/337-mac80211-minstrel_ht-clean-up-CCK-code.patch b/package/kernel/mac80211/patches/subsys/337-mac80211-minstrel_ht-clean-up-CCK-code.patch
deleted file mode 100644
index f667d2c94..000000000
--- a/package/kernel/mac80211/patches/subsys/337-mac80211-minstrel_ht-clean-up-CCK-code.patch
+++ /dev/null
@@ -1,166 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 25 Dec 2020 16:22:52 +0100
-Subject: [PATCH] mac80211: minstrel_ht: clean up CCK code
-
-- move ack overhead out of rate duration table
-- remove cck_supported, cck_supported_short
-
-Preparation for adding OFDM legacy rates support
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -136,20 +136,16 @@
- 	__VHT_GROUP(_streams, _sgi, _bw,				\
- 		    VHT_GROUP_SHIFT(_streams, _sgi, _bw))
- 
--#define CCK_DURATION(_bitrate, _short, _len)		\
-+#define CCK_DURATION(_bitrate, _short)			\
- 	(1000 * (10 /* SIFS */ +			\
- 	 (_short ? 72 + 24 : 144 + 48) +		\
--	 (8 * (_len + 4) * 10) / (_bitrate)))
--
--#define CCK_ACK_DURATION(_bitrate, _short)			\
--	(CCK_DURATION((_bitrate > 10 ? 20 : 10), false, 60) +	\
--	 CCK_DURATION(_bitrate, _short, AVG_PKT_SIZE))
-+	 (8 * (AVG_PKT_SIZE + 4) * 10) / (_bitrate)))
- 
- #define CCK_DURATION_LIST(_short, _s)			\
--	CCK_ACK_DURATION(10, _short) >> _s,		\
--	CCK_ACK_DURATION(20, _short) >> _s,		\
--	CCK_ACK_DURATION(55, _short) >> _s,		\
--	CCK_ACK_DURATION(110, _short) >> _s
-+	CCK_DURATION(10, _short) >> _s,			\
-+	CCK_DURATION(20, _short) >> _s,			\
-+	CCK_DURATION(55, _short) >> _s,			\
-+	CCK_DURATION(110, _short) >> _s
- 
- #define __CCK_GROUP(_s)					\
- 	[MINSTREL_CCK_GROUP] = {			\
-@@ -163,7 +159,7 @@
- 	}
- 
- #define CCK_GROUP_SHIFT					\
--	GROUP_SHIFT(CCK_ACK_DURATION(10, false))
-+	GROUP_SHIFT(CCK_DURATION(10, false))
- 
- #define CCK_GROUP __CCK_GROUP(CCK_GROUP_SHIFT)
- 
-@@ -349,15 +345,19 @@ int
- minstrel_ht_get_tp_avg(struct minstrel_ht_sta *mi, int group, int rate,
- 		       int prob_avg)
- {
--	unsigned int nsecs = 0;
-+	unsigned int nsecs = 0, overhead = mi->overhead;
-+	unsigned int ampdu_len = 1;
- 
- 	/* do not account throughput if sucess prob is below 10% */
- 	if (prob_avg < MINSTREL_FRAC(10, 100))
- 		return 0;
- 
--	if (group != MINSTREL_CCK_GROUP)
--		nsecs = 1000 * mi->overhead / minstrel_ht_avg_ampdu_len(mi);
-+	if (group == MINSTREL_CCK_GROUP)
-+		overhead = mi->overhead_legacy;
-+	else
-+		ampdu_len = minstrel_ht_avg_ampdu_len(mi);
- 
-+	nsecs = 1000 * overhead / ampdu_len;
- 	nsecs += minstrel_mcs_groups[group].duration[rate] <<
- 		 minstrel_mcs_groups[group].shift;
- 
-@@ -1031,7 +1031,10 @@ minstrel_calc_retransmit(struct minstrel
- 	ctime += (t_slot * cw) >> 1;
- 	cw = min((cw << 1) | 1, mp->cw_max);
- 
--	if (index / MCS_GROUP_RATES != MINSTREL_CCK_GROUP) {
-+	if (index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
-+		overhead = mi->overhead_legacy;
-+		overhead_rtscts = mi->overhead_legacy_rtscts;
-+	} else {
- 		overhead = mi->overhead;
- 		overhead_rtscts = mi->overhead_rtscts;
- 	}
-@@ -1369,18 +1372,14 @@ minstrel_ht_update_cck(struct minstrel_p
- 	if (!ieee80211_hw_check(mp->hw, SUPPORTS_HT_CCK_RATES))
- 		return;
- 
--	mi->cck_supported = 0;
--	mi->cck_supported_short = 0;
- 	for (i = 0; i < 4; i++) {
- 		if (!rate_supported(sta, sband->band, mp->cck_rates[i]))
- 			continue;
- 
--		mi->cck_supported |= BIT(i);
-+		mi->supported[MINSTREL_CCK_GROUP] |= BIT(i);
- 		if (sband->bitrates[i].flags & IEEE80211_RATE_SHORT_PREAMBLE)
--			mi->cck_supported_short |= BIT(i);
-+			mi->supported[MINSTREL_CCK_GROUP] |= BIT(i + 4);
- 	}
--
--	mi->supported[MINSTREL_CCK_GROUP] = mi->cck_supported;
- }
- 
- static void
-@@ -1394,12 +1393,13 @@ minstrel_ht_update_caps(void *priv, stru
- 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
- 	u16 ht_cap = sta->ht_cap.cap;
- 	struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
-+	const struct ieee80211_rate *ctl_rate;
-+	bool ldpc, erp;
- 	int use_vht;
- 	int n_supported = 0;
- 	int ack_dur;
- 	int stbc;
- 	int i;
--	bool ldpc;
- 
- 	/* fall back to the old minstrel for legacy stations */
- 	if (!sta->ht_cap.ht_supported)
-@@ -1423,6 +1423,14 @@ minstrel_ht_update_caps(void *priv, stru
- 	mi->overhead += ack_dur;
- 	mi->overhead_rtscts = mi->overhead + 2 * ack_dur;
- 
-+	ctl_rate = &sband->bitrates[rate_lowest_index(sband, sta)];
-+	erp = ctl_rate->flags & IEEE80211_RATE_ERP_G;
-+	ack_dur = ieee80211_frame_duration(sband->band, 10,
-+					   ctl_rate->bitrate, erp, 1,
-+					   ieee80211_chandef_get_shift(chandef));
-+	mi->overhead_legacy = ack_dur;
-+	mi->overhead_legacy_rtscts = mi->overhead_legacy + 2 * ack_dur;
-+
- 	mi->avg_ampdu_len = MINSTREL_FRAC(1, 1);
- 
- 	/* When using MRR, sample more on the first attempt, without delay */
-@@ -1523,8 +1531,6 @@ minstrel_ht_update_caps(void *priv, stru
- 	if (!n_supported)
- 		goto use_legacy;
- 
--	mi->supported[MINSTREL_CCK_GROUP] |= mi->cck_supported_short << 4;
--
- 	/* create an initial rate table with the lowest supported rates */
- 	minstrel_ht_update_stats(mp, mi, true);
- 	minstrel_ht_update_rates(mp, mi);
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -77,6 +77,8 @@ struct minstrel_ht_sta {
- 	/* overhead time in usec for each frame */
- 	unsigned int overhead;
- 	unsigned int overhead_rtscts;
-+	unsigned int overhead_legacy;
-+	unsigned int overhead_legacy_rtscts;
- 
- 	unsigned int total_packets_last;
- 	unsigned int total_packets_cur;
-@@ -97,9 +99,6 @@ struct minstrel_ht_sta {
- 	/* current MCS group to be sampled */
- 	u8 sample_group;
- 
--	u8 cck_supported;
--	u8 cck_supported_short;
--
- 	/* Bitfield of supported MCS rates of all groups */
- 	u16 supported[MINSTREL_GROUPS_NB];
- 
diff --git a/package/kernel/mac80211/patches/subsys/338-mac80211-minstrel_ht-add-support-for-OFDM-rates-on-n.patch b/package/kernel/mac80211/patches/subsys/338-mac80211-minstrel_ht-add-support-for-OFDM-rates-on-n.patch
deleted file mode 100644
index abefde710..000000000
--- a/package/kernel/mac80211/patches/subsys/338-mac80211-minstrel_ht-add-support-for-OFDM-rates-on-n.patch
+++ /dev/null
@@ -1,762 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 26 Dec 2020 13:56:42 +0100
-Subject: [PATCH] mac80211: minstrel_ht: add support for OFDM rates on
- non-HT clients
-
-The legacy minstrel code is essentially unmaintained and receives only very
-little testing. In order to bring the significant algorithm improvements from
-minstrel_ht to legacy clients, this patch adds support for OFDM rates to
-minstrel_ht and removes the fallback to the legacy codepath.
-This also makes it work much better on hardware with rate selection constraints,
-e.g. mt76.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel.h
-+++ b/net/mac80211/rc80211_minstrel.h
-@@ -152,6 +152,7 @@ struct minstrel_priv {
- 	unsigned int lookaround_rate_mrr;
- 
- 	u8 cck_rates[4];
-+	u8 ofdm_rates[NUM_NL80211_BANDS][8];
- 
- #ifdef CPTCFG_MAC80211_DEBUGFS
- 	/*
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -163,6 +163,38 @@
- 
- #define CCK_GROUP __CCK_GROUP(CCK_GROUP_SHIFT)
- 
-+#define OFDM_DURATION(_bitrate)				\
-+	(1000 * (16 /* SIFS + signal ext */ +		\
-+	 16 /* T_PREAMBLE */ +				\
-+	 4 /* T_SIGNAL */ +				\
-+	 4 * (((16 + 80 * (AVG_PKT_SIZE + 4) + 6) /	\
-+	      ((_bitrate) * 4)))))
-+
-+#define OFDM_DURATION_LIST(_s)				\
-+	OFDM_DURATION(60) >> _s,			\
-+	OFDM_DURATION(90) >> _s,			\
-+	OFDM_DURATION(120) >> _s,			\
-+	OFDM_DURATION(180) >> _s,			\
-+	OFDM_DURATION(240) >> _s,			\
-+	OFDM_DURATION(360) >> _s,			\
-+	OFDM_DURATION(480) >> _s,			\
-+	OFDM_DURATION(540) >> _s
-+
-+#define __OFDM_GROUP(_s)				\
-+	[MINSTREL_OFDM_GROUP] = {			\
-+		.streams = 1,				\
-+		.flags = 0,				\
-+		.shift = _s,				\
-+		.duration = {				\
-+			OFDM_DURATION_LIST(_s),		\
-+		}					\
-+	}
-+
-+#define OFDM_GROUP_SHIFT				\
-+	GROUP_SHIFT(OFDM_DURATION(60))
-+
-+#define OFDM_GROUP __OFDM_GROUP(OFDM_GROUP_SHIFT)
-+
- 
- static bool minstrel_vht_only = true;
- module_param(minstrel_vht_only, bool, 0644);
-@@ -199,6 +231,7 @@ const struct mcs_group minstrel_mcs_grou
- 	MCS_GROUP(4, 1, BW_40),
- 
- 	CCK_GROUP,
-+	OFDM_GROUP,
- 
- 	VHT_GROUP(1, 0, BW_20),
- 	VHT_GROUP(2, 0, BW_20),
-@@ -231,6 +264,8 @@ const struct mcs_group minstrel_mcs_grou
- 	VHT_GROUP(4, 1, BW_80),
- };
- 
-+const s16 minstrel_cck_bitrates[4] = { 10, 20, 55, 110 };
-+const s16 minstrel_ofdm_bitrates[8] = { 60, 90, 120, 180, 240, 360, 480, 540 };
- static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES] __read_mostly;
- 
- static void
-@@ -275,6 +310,13 @@ minstrel_get_valid_vht_rates(int bw, int
- 	return 0x3ff & ~mask;
- }
- 
-+static bool
-+minstrel_ht_is_legacy_group(int group)
-+{
-+	return group == MINSTREL_CCK_GROUP ||
-+	       group == MINSTREL_OFDM_GROUP;
-+}
-+
- /*
-  * Look up an MCS group index based on mac80211 rate information
-  */
-@@ -304,21 +346,34 @@ minstrel_ht_get_stats(struct minstrel_pr
- 	if (rate->flags & IEEE80211_TX_RC_MCS) {
- 		group = minstrel_ht_get_group_idx(rate);
- 		idx = rate->idx % 8;
--	} else if (rate->flags & IEEE80211_TX_RC_VHT_MCS) {
-+		goto out;
-+	}
-+
-+	if (rate->flags & IEEE80211_TX_RC_VHT_MCS) {
- 		group = minstrel_vht_get_group_idx(rate);
- 		idx = ieee80211_rate_get_vht_mcs(rate);
--	} else {
--		group = MINSTREL_CCK_GROUP;
-+		goto out;
-+	}
- 
--		for (idx = 0; idx < ARRAY_SIZE(mp->cck_rates); idx++)
--			if (rate->idx == mp->cck_rates[idx])
--				break;
-+	group = MINSTREL_CCK_GROUP;
-+	for (idx = 0; idx < ARRAY_SIZE(mp->cck_rates); idx++) {
-+		if (rate->idx != mp->cck_rates[idx])
-+			continue;
- 
- 		/* short preamble */
- 		if ((mi->supported[group] & BIT(idx + 4)) &&
- 		    (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
--			idx += 4;
-+				idx += 4;
-+		goto out;
- 	}
-+
-+	group = MINSTREL_OFDM_GROUP;
-+	for (idx = 0; idx < ARRAY_SIZE(mp->ofdm_rates[0]); idx++)
-+		if (rate->idx == mp->ofdm_rates[mi->band][idx])
-+			goto out;
-+
-+	idx = 0;
-+out:
- 	return &mi->groups[group].rates[idx];
- }
- 
-@@ -352,7 +407,7 @@ minstrel_ht_get_tp_avg(struct minstrel_h
- 	if (prob_avg < MINSTREL_FRAC(10, 100))
- 		return 0;
- 
--	if (group == MINSTREL_CCK_GROUP)
-+	if (minstrel_ht_is_legacy_group(group))
- 		overhead = mi->overhead_legacy;
- 	else
- 		ampdu_len = minstrel_ht_avg_ampdu_len(mi);
-@@ -439,8 +494,8 @@ minstrel_ht_set_best_prob_rate(struct mi
- 	/* if max_tp_rate[0] is from MCS_GROUP max_prob_rate get selected from
- 	 * MCS_GROUP as well as CCK_GROUP rates do not allow aggregation */
- 	max_tp_group = mi->max_tp_rate[0] / MCS_GROUP_RATES;
--	if((index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) &&
--	    (max_tp_group != MINSTREL_CCK_GROUP))
-+	if (minstrel_ht_is_legacy_group(index / MCS_GROUP_RATES) &&
-+	    !minstrel_ht_is_legacy_group(max_tp_group))
- 		return;
- 
- 	max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
-@@ -476,13 +531,13 @@ minstrel_ht_set_best_prob_rate(struct mi
- static void
- minstrel_ht_assign_best_tp_rates(struct minstrel_ht_sta *mi,
- 				 u16 tmp_mcs_tp_rate[MAX_THR_RATES],
--				 u16 tmp_cck_tp_rate[MAX_THR_RATES])
-+				 u16 tmp_legacy_tp_rate[MAX_THR_RATES])
- {
- 	unsigned int tmp_group, tmp_idx, tmp_cck_tp, tmp_mcs_tp, tmp_prob;
- 	int i;
- 
--	tmp_group = tmp_cck_tp_rate[0] / MCS_GROUP_RATES;
--	tmp_idx = tmp_cck_tp_rate[0] % MCS_GROUP_RATES;
-+	tmp_group = tmp_legacy_tp_rate[0] / MCS_GROUP_RATES;
-+	tmp_idx = tmp_legacy_tp_rate[0] % MCS_GROUP_RATES;
- 	tmp_prob = mi->groups[tmp_group].rates[tmp_idx].prob_avg;
- 	tmp_cck_tp = minstrel_ht_get_tp_avg(mi, tmp_group, tmp_idx, tmp_prob);
- 
-@@ -493,7 +548,7 @@ minstrel_ht_assign_best_tp_rates(struct
- 
- 	if (tmp_cck_tp > tmp_mcs_tp) {
- 		for(i = 0; i < MAX_THR_RATES; i++) {
--			minstrel_ht_sort_best_tp_rates(mi, tmp_cck_tp_rate[i],
-+			minstrel_ht_sort_best_tp_rates(mi, tmp_legacy_tp_rate[i],
- 						       tmp_mcs_tp_rate);
- 		}
- 	}
-@@ -511,6 +566,9 @@ minstrel_ht_prob_rate_reduce_streams(str
- 	int tmp_max_streams, group, tmp_idx, tmp_prob;
- 	int tmp_tp = 0;
- 
-+	if (!mi->sta->ht_cap.ht_supported)
-+		return;
-+
- 	tmp_max_streams = minstrel_mcs_groups[mi->max_tp_rate[0] /
- 			  MCS_GROUP_RATES].streams;
- 	for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
-@@ -675,7 +733,8 @@ minstrel_ht_update_stats(struct minstrel
- 	struct minstrel_rate_stats *mrs;
- 	int group, i, j, cur_prob;
- 	u16 tmp_mcs_tp_rate[MAX_THR_RATES], tmp_group_tp_rate[MAX_THR_RATES];
--	u16 tmp_cck_tp_rate[MAX_THR_RATES], index;
-+	u16 tmp_legacy_tp_rate[MAX_THR_RATES], index;
-+	bool ht_supported = mi->sta->ht_cap.ht_supported;
- 
- 	mi->sample_mode = MINSTREL_SAMPLE_IDLE;
- 
-@@ -704,21 +763,29 @@ minstrel_ht_update_stats(struct minstrel
- 	mi->sample_count = 0;
- 
- 	memset(tmp_mcs_tp_rate, 0, sizeof(tmp_mcs_tp_rate));
--	memset(tmp_cck_tp_rate, 0, sizeof(tmp_cck_tp_rate));
-+	memset(tmp_legacy_tp_rate, 0, sizeof(tmp_legacy_tp_rate));
- 	if (mi->supported[MINSTREL_CCK_GROUP])
--		for (j = 0; j < ARRAY_SIZE(tmp_cck_tp_rate); j++)
--			tmp_cck_tp_rate[j] = MINSTREL_CCK_GROUP * MCS_GROUP_RATES;
-+		for (j = 0; j < ARRAY_SIZE(tmp_legacy_tp_rate); j++)
-+			tmp_legacy_tp_rate[j] = MINSTREL_CCK_GROUP * MCS_GROUP_RATES;
-+	else if (mi->supported[MINSTREL_OFDM_GROUP])
-+		for (j = 0; j < ARRAY_SIZE(tmp_legacy_tp_rate); j++)
-+			tmp_legacy_tp_rate[j] = MINSTREL_OFDM_GROUP * MCS_GROUP_RATES;
- 
- 	if (mi->supported[MINSTREL_VHT_GROUP_0])
- 		index = MINSTREL_VHT_GROUP_0 * MCS_GROUP_RATES;
--	else
-+	else if (ht_supported)
- 		index = MINSTREL_HT_GROUP_0 * MCS_GROUP_RATES;
-+	else if (mi->supported[MINSTREL_CCK_GROUP])
-+		index = MINSTREL_CCK_GROUP * MCS_GROUP_RATES;
-+	else
-+		index = MINSTREL_OFDM_GROUP * MCS_GROUP_RATES;
- 
- 	for (j = 0; j < ARRAY_SIZE(tmp_mcs_tp_rate); j++)
- 		tmp_mcs_tp_rate[j] = index;
- 
- 	/* Find best rate sets within all MCS groups*/
- 	for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
-+		u16 *tp_rate = tmp_mcs_tp_rate;
- 
- 		mg = &mi->groups[group];
- 		if (!mi->supported[group])
-@@ -730,6 +797,9 @@ minstrel_ht_update_stats(struct minstrel
- 		for(j = 0; j < MAX_THR_RATES; j++)
- 			tmp_group_tp_rate[j] = MCS_GROUP_RATES * group;
- 
-+		if (group == MINSTREL_CCK_GROUP && ht_supported)
-+			tp_rate = tmp_legacy_tp_rate;
-+
- 		for (i = 0; i < MCS_GROUP_RATES; i++) {
- 			if (!(mi->supported[group] & BIT(i)))
- 				continue;
-@@ -745,13 +815,7 @@ minstrel_ht_update_stats(struct minstrel
- 				continue;
- 
- 			/* Find max throughput rate set */
--			if (group != MINSTREL_CCK_GROUP) {
--				minstrel_ht_sort_best_tp_rates(mi, index,
--							       tmp_mcs_tp_rate);
--			} else if (group == MINSTREL_CCK_GROUP) {
--				minstrel_ht_sort_best_tp_rates(mi, index,
--							       tmp_cck_tp_rate);
--			}
-+			minstrel_ht_sort_best_tp_rates(mi, index, tp_rate);
- 
- 			/* Find max throughput rate set within a group */
- 			minstrel_ht_sort_best_tp_rates(mi, index,
-@@ -766,7 +830,8 @@ minstrel_ht_update_stats(struct minstrel
- 	}
- 
- 	/* Assign new rate set per sta */
--	minstrel_ht_assign_best_tp_rates(mi, tmp_mcs_tp_rate, tmp_cck_tp_rate);
-+	minstrel_ht_assign_best_tp_rates(mi, tmp_mcs_tp_rate,
-+					 tmp_legacy_tp_rate);
- 	memcpy(mi->max_tp_rate, tmp_mcs_tp_rate, sizeof(mi->max_tp_rate));
- 
- 	/* Try to increase robustness of max_prob_rate*/
-@@ -795,8 +860,11 @@ minstrel_ht_update_stats(struct minstrel
- }
- 
- static bool
--minstrel_ht_txstat_valid(struct minstrel_priv *mp, struct ieee80211_tx_rate *rate)
-+minstrel_ht_txstat_valid(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
-+			 struct ieee80211_tx_rate *rate)
- {
-+	int i;
-+
- 	if (rate->idx < 0)
- 		return false;
- 
-@@ -807,10 +875,15 @@ minstrel_ht_txstat_valid(struct minstrel
- 	    rate->flags & IEEE80211_TX_RC_VHT_MCS)
- 		return true;
- 
--	return rate->idx == mp->cck_rates[0] ||
--	       rate->idx == mp->cck_rates[1] ||
--	       rate->idx == mp->cck_rates[2] ||
--	       rate->idx == mp->cck_rates[3];
-+	for (i = 0; i < ARRAY_SIZE(mp->cck_rates); i++)
-+		if (rate->idx == mp->cck_rates[i])
-+			return true;
-+
-+	for (i = 0; i < ARRAY_SIZE(mp->ofdm_rates[0]); i++)
-+		if (rate->idx == mp->ofdm_rates[mi->band][i])
-+			return true;
-+
-+	return false;
- }
- 
- static void
-@@ -897,11 +970,6 @@ minstrel_ht_tx_status(void *priv, struct
- 	bool sample_status = false;
- 	int i;
- 
--	if (!msp->is_ht)
--		return mac80211_minstrel.tx_status_ext(priv, sband,
--						       &msp->legacy, st);
--
--
- 	/* This packet was aggregated but doesn't carry status info */
- 	if ((info->flags & IEEE80211_TX_CTL_AMPDU) &&
- 	    !(info->flags & IEEE80211_TX_STAT_AMPDU))
-@@ -930,10 +998,10 @@ minstrel_ht_tx_status(void *priv, struct
- 	if (mi->sample_mode != MINSTREL_SAMPLE_IDLE)
- 		rate_sample = minstrel_get_ratestats(mi, mi->sample_rate);
- 
--	last = !minstrel_ht_txstat_valid(mp, &ar[0]);
-+	last = !minstrel_ht_txstat_valid(mp, mi, &ar[0]);
- 	for (i = 0; !last; i++) {
- 		last = (i == IEEE80211_TX_MAX_RATES - 1) ||
--		       !minstrel_ht_txstat_valid(mp, &ar[i + 1]);
-+		       !minstrel_ht_txstat_valid(mp, mi, &ar[i + 1]);
- 
- 		rate = minstrel_ht_get_stats(mp, mi, &ar[i]);
- 		if (rate == rate_sample)
-@@ -1031,7 +1099,7 @@ minstrel_calc_retransmit(struct minstrel
- 	ctime += (t_slot * cw) >> 1;
- 	cw = min((cw << 1) | 1, mp->cw_max);
- 
--	if (index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
-+	if (minstrel_ht_is_legacy_group(index / MCS_GROUP_RATES)) {
- 		overhead = mi->overhead_legacy;
- 		overhead_rtscts = mi->overhead_legacy_rtscts;
- 	} else {
-@@ -1064,7 +1132,8 @@ static void
- minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
-                      struct ieee80211_sta_rates *ratetbl, int offset, int index)
- {
--	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
-+	int group_idx = index / MCS_GROUP_RATES;
-+	const struct mcs_group *group = &minstrel_mcs_groups[group_idx];
- 	struct minstrel_rate_stats *mrs;
- 	u8 idx;
- 	u16 flags = group->flags;
-@@ -1083,13 +1152,17 @@ minstrel_ht_set_rate(struct minstrel_pri
- 		ratetbl->rate[offset].count_rts = mrs->retry_count_rtscts;
- 	}
- 
--	if (index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP)
-+	index %= MCS_GROUP_RATES;
-+	if (group_idx == MINSTREL_CCK_GROUP)
- 		idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
-+	else if (group_idx == MINSTREL_OFDM_GROUP)
-+		idx = mp->ofdm_rates[mi->band][index %
-+					       ARRAY_SIZE(mp->ofdm_rates[0])];
- 	else if (flags & IEEE80211_TX_RC_VHT_MCS)
- 		idx = ((group->streams - 1) << 4) |
--		      ((index % MCS_GROUP_RATES) & 0xF);
-+		      (index & 0xF);
- 	else
--		idx = index % MCS_GROUP_RATES + (group->streams - 1) * 8;
-+		idx = index + (group->streams - 1) * 8;
- 
- 	/* enable RTS/CTS if needed:
- 	 *  - if station is in dynamic SMPS (and streams > 1)
-@@ -1304,11 +1377,8 @@ minstrel_ht_get_rate(void *priv, struct
- 	struct minstrel_priv *mp = priv;
- 	int sample_idx;
- 
--	if (!msp->is_ht)
--		return mac80211_minstrel.get_rate(priv, sta, &msp->legacy, txrc);
--
- 	if (!(info->flags & IEEE80211_TX_CTL_AMPDU) &&
--	    mi->max_prob_rate / MCS_GROUP_RATES != MINSTREL_CCK_GROUP)
-+	    !minstrel_ht_is_legacy_group(mi->max_prob_rate / MCS_GROUP_RATES))
- 		minstrel_aggr_check(sta, txrc->skb);
- 
- 	info->flags |= mi->tx_flags;
-@@ -1349,6 +1419,9 @@ minstrel_ht_get_rate(void *priv, struct
- 	if (sample_group == &minstrel_mcs_groups[MINSTREL_CCK_GROUP]) {
- 		int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
- 		rate->idx = mp->cck_rates[idx];
-+	} else if (sample_group == &minstrel_mcs_groups[MINSTREL_OFDM_GROUP]) {
-+		int idx = sample_idx % ARRAY_SIZE(mp->ofdm_rates[0]);
-+		rate->idx = mp->ofdm_rates[mi->band][idx];
- 	} else if (sample_group->flags & IEEE80211_TX_RC_VHT_MCS) {
- 		ieee80211_rate_set_vht(rate, sample_idx % MCS_GROUP_RATES,
- 				       sample_group->streams);
-@@ -1369,11 +1442,13 @@ minstrel_ht_update_cck(struct minstrel_p
- 	if (sband->band != NL80211_BAND_2GHZ)
- 		return;
- 
--	if (!ieee80211_hw_check(mp->hw, SUPPORTS_HT_CCK_RATES))
-+	if (sta->ht_cap.ht_supported &&
-+	    !ieee80211_hw_check(mp->hw, SUPPORTS_HT_CCK_RATES))
- 		return;
- 
- 	for (i = 0; i < 4; i++) {
--		if (!rate_supported(sta, sband->band, mp->cck_rates[i]))
-+		if (mp->cck_rates[i] == 0xff ||
-+		    !rate_supported(sta, sband->band, mp->cck_rates[i]))
- 			continue;
- 
- 		mi->supported[MINSTREL_CCK_GROUP] |= BIT(i);
-@@ -1383,9 +1458,30 @@ minstrel_ht_update_cck(struct minstrel_p
- }
- 
- static void
-+minstrel_ht_update_ofdm(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
-+			struct ieee80211_supported_band *sband,
-+			struct ieee80211_sta *sta)
-+{
-+	const u8 *rates;
-+	int i;
-+
-+	if (sta->ht_cap.ht_supported)
-+		return;
-+
-+	rates = mp->ofdm_rates[sband->band];
-+	for (i = 0; i < ARRAY_SIZE(mp->ofdm_rates[0]); i++) {
-+		if (rates[i] == 0xff ||
-+		    !rate_supported(sta, sband->band, rates[i]))
-+			continue;
-+
-+		mi->supported[MINSTREL_OFDM_GROUP] |= BIT(i);
-+	}
-+}
-+
-+static void
- minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
- 			struct cfg80211_chan_def *chandef,
--                        struct ieee80211_sta *sta, void *priv_sta)
-+			struct ieee80211_sta *sta, void *priv_sta)
- {
- 	struct minstrel_priv *mp = priv;
- 	struct minstrel_ht_sta_priv *msp = priv_sta;
-@@ -1401,10 +1497,6 @@ minstrel_ht_update_caps(void *priv, stru
- 	int stbc;
- 	int i;
- 
--	/* fall back to the old minstrel for legacy stations */
--	if (!sta->ht_cap.ht_supported)
--		goto use_legacy;
--
- 	BUILD_BUG_ON(ARRAY_SIZE(minstrel_mcs_groups) != MINSTREL_GROUPS_NB);
- 
- 	if (vht_cap->vht_supported)
-@@ -1412,10 +1504,10 @@ minstrel_ht_update_caps(void *priv, stru
- 	else
- 		use_vht = 0;
- 
--	msp->is_ht = true;
- 	memset(mi, 0, sizeof(*mi));
- 
- 	mi->sta = sta;
-+	mi->band = sband->band;
- 	mi->last_stats_update = jiffies;
- 
- 	ack_dur = ieee80211_frame_duration(sband->band, 10, 60, 1, 1, 0);
-@@ -1464,10 +1556,8 @@ minstrel_ht_update_caps(void *priv, stru
- 		int bw, nss;
- 
- 		mi->supported[i] = 0;
--		if (i == MINSTREL_CCK_GROUP) {
--			minstrel_ht_update_cck(mp, mi, sband, sta);
-+		if (minstrel_ht_is_legacy_group(i))
- 			continue;
--		}
- 
- 		if (gflags & IEEE80211_TX_RC_SHORT_GI) {
- 			if (gflags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
-@@ -1528,22 +1618,12 @@ minstrel_ht_update_caps(void *priv, stru
- 			n_supported++;
- 	}
- 
--	if (!n_supported)
--		goto use_legacy;
-+	minstrel_ht_update_cck(mp, mi, sband, sta);
-+	minstrel_ht_update_ofdm(mp, mi, sband, sta);
- 
- 	/* create an initial rate table with the lowest supported rates */
- 	minstrel_ht_update_stats(mp, mi, true);
- 	minstrel_ht_update_rates(mp, mi);
--
--	return;
--
--use_legacy:
--	msp->is_ht = false;
--	memset(&msp->legacy, 0, sizeof(msp->legacy));
--	msp->legacy.r = msp->ratelist;
--	msp->legacy.sample_table = msp->sample_table;
--	return mac80211_minstrel.rate_init(priv, sband, chandef, sta,
--					   &msp->legacy);
- }
- 
- static void
-@@ -1611,40 +1691,70 @@ minstrel_ht_free_sta(void *priv, struct
- }
- 
- static void
--minstrel_ht_init_cck_rates(struct minstrel_priv *mp)
-+minstrel_ht_fill_rate_array(u8 *dest, struct ieee80211_supported_band *sband,
-+			    const s16 *bitrates, int n_rates, u32 rate_flags)
- {
--	static const int bitrates[4] = { 10, 20, 55, 110 };
--	struct ieee80211_supported_band *sband;
--	u32 rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
- 	int i, j;
- 
--	sband = mp->hw->wiphy->bands[NL80211_BAND_2GHZ];
--	if (!sband)
--		return;
--
- 	for (i = 0; i < sband->n_bitrates; i++) {
- 		struct ieee80211_rate *rate = &sband->bitrates[i];
- 
--		if (rate->flags & IEEE80211_RATE_ERP_G)
--			continue;
--
- 		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
- 			continue;
- 
--		for (j = 0; j < ARRAY_SIZE(bitrates); j++) {
-+		for (j = 0; j < n_rates; j++) {
- 			if (rate->bitrate != bitrates[j])
- 				continue;
- 
--			mp->cck_rates[j] = i;
-+			dest[j] = i;
- 			break;
- 		}
- 	}
- }
- 
-+static void
-+minstrel_ht_init_cck_rates(struct minstrel_priv *mp)
-+{
-+	static const s16 bitrates[4] = { 10, 20, 55, 110 };
-+	struct ieee80211_supported_band *sband;
-+	u32 rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
-+
-+	memset(mp->cck_rates, 0xff, sizeof(mp->cck_rates));
-+	sband = mp->hw->wiphy->bands[NL80211_BAND_2GHZ];
-+	if (!sband)
-+		return;
-+
-+	BUILD_BUG_ON(ARRAY_SIZE(mp->cck_rates) != ARRAY_SIZE(bitrates));
-+	minstrel_ht_fill_rate_array(mp->cck_rates, sband,
-+				    minstrel_cck_bitrates,
-+				    ARRAY_SIZE(minstrel_cck_bitrates),
-+				    rate_flags);
-+}
-+
-+static void
-+minstrel_ht_init_ofdm_rates(struct minstrel_priv *mp, enum nl80211_band band)
-+{
-+	static const s16 bitrates[8] = { 60, 90, 120, 180, 240, 360, 480, 540 };
-+	struct ieee80211_supported_band *sband;
-+	u32 rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
-+
-+	memset(mp->ofdm_rates[band], 0xff, sizeof(mp->ofdm_rates[band]));
-+	sband = mp->hw->wiphy->bands[band];
-+	if (!sband)
-+		return;
-+
-+	BUILD_BUG_ON(ARRAY_SIZE(mp->ofdm_rates[band]) != ARRAY_SIZE(bitrates));
-+	minstrel_ht_fill_rate_array(mp->ofdm_rates[band], sband,
-+				    minstrel_ofdm_bitrates,
-+				    ARRAY_SIZE(minstrel_ofdm_bitrates),
-+				    rate_flags);
-+}
-+
- static void *
- minstrel_ht_alloc(struct ieee80211_hw *hw)
- {
- 	struct minstrel_priv *mp;
-+	int i;
- 
- 	mp = kzalloc(sizeof(struct minstrel_priv), GFP_ATOMIC);
- 	if (!mp)
-@@ -1681,6 +1791,8 @@ minstrel_ht_alloc(struct ieee80211_hw *h
- 	mp->new_avg = true;
- 
- 	minstrel_ht_init_cck_rates(mp);
-+	for (i = 0; i < ARRAY_SIZE(mp->hw->wiphy->bands); i++)
-+	    minstrel_ht_init_ofdm_rates(mp, i);
- 
- 	return mp;
- }
-@@ -1713,9 +1825,6 @@ static u32 minstrel_ht_get_expected_thro
- 	struct minstrel_ht_sta *mi = &msp->ht;
- 	int i, j, prob, tp_avg;
- 
--	if (!msp->is_ht)
--		return mac80211_minstrel.get_expected_throughput(priv_sta);
--
- 	i = mi->max_tp_rate[0] / MCS_GROUP_RATES;
- 	j = mi->max_tp_rate[0] % MCS_GROUP_RATES;
- 	prob = mi->groups[i].rates[j].prob_avg;
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -18,14 +18,15 @@
- 				 MINSTREL_HT_STREAM_GROUPS)
- #define MINSTREL_VHT_GROUPS_NB	(MINSTREL_MAX_STREAMS *		\
- 				 MINSTREL_VHT_STREAM_GROUPS)
--#define MINSTREL_CCK_GROUPS_NB	1
-+#define MINSTREL_LEGACY_GROUPS_NB	2
- #define MINSTREL_GROUPS_NB	(MINSTREL_HT_GROUPS_NB +	\
- 				 MINSTREL_VHT_GROUPS_NB +	\
--				 MINSTREL_CCK_GROUPS_NB)
-+				 MINSTREL_LEGACY_GROUPS_NB)
- 
- #define MINSTREL_HT_GROUP_0	0
- #define MINSTREL_CCK_GROUP	(MINSTREL_HT_GROUP_0 + MINSTREL_HT_GROUPS_NB)
--#define MINSTREL_VHT_GROUP_0	(MINSTREL_CCK_GROUP + 1)
-+#define MINSTREL_OFDM_GROUP	(MINSTREL_CCK_GROUP + 1)
-+#define MINSTREL_VHT_GROUP_0	(MINSTREL_OFDM_GROUP + 1)
- 
- #define MCS_GROUP_RATES		10
- 
-@@ -37,6 +38,8 @@ struct mcs_group {
- 	u16 duration[MCS_GROUP_RATES];
- };
- 
-+extern const s16 minstrel_cck_bitrates[4];
-+extern const s16 minstrel_ofdm_bitrates[8];
- extern const struct mcs_group minstrel_mcs_groups[];
- 
- struct minstrel_mcs_group_data {
-@@ -99,6 +102,8 @@ struct minstrel_ht_sta {
- 	/* current MCS group to be sampled */
- 	u8 sample_group;
- 
-+	u8 band;
-+
- 	/* Bitfield of supported MCS rates of all groups */
- 	u16 supported[MINSTREL_GROUPS_NB];
- 
-@@ -107,13 +112,9 @@ struct minstrel_ht_sta {
- };
- 
- struct minstrel_ht_sta_priv {
--	union {
--		struct minstrel_ht_sta ht;
--		struct minstrel_sta_info legacy;
--	};
-+	struct minstrel_ht_sta ht;
- 	void *ratelist;
- 	void *sample_table;
--	bool is_ht;
- };
- 
- void minstrel_ht_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir);
---- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
-+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
-@@ -52,7 +52,6 @@ minstrel_ht_stats_dump(struct minstrel_h
- 
- 	for (j = 0; j < MCS_GROUP_RATES; j++) {
- 		struct minstrel_rate_stats *mrs = &mi->groups[i].rates[j];
--		static const int bitrates[4] = { 10, 20, 55, 110 };
- 		int idx = i * MCS_GROUP_RATES + j;
- 		unsigned int duration;
- 
-@@ -67,6 +66,9 @@ minstrel_ht_stats_dump(struct minstrel_h
- 			p += sprintf(p, "VHT%c0 ", htmode);
- 			p += sprintf(p, "%cGI ", gimode);
- 			p += sprintf(p, "%d  ", mg->streams);
-+		} else if (i == MINSTREL_OFDM_GROUP) {
-+			p += sprintf(p, "OFDM       ");
-+			p += sprintf(p, "1 ");
- 		} else {
- 			p += sprintf(p, "CCK    ");
- 			p += sprintf(p, "%cP  ", j < 4 ? 'L' : 'S');
-@@ -84,7 +86,12 @@ minstrel_ht_stats_dump(struct minstrel_h
- 		} else if (gflags & IEEE80211_TX_RC_VHT_MCS) {
- 			p += sprintf(p, "  MCS%-1u/%1u", j, mg->streams);
- 		} else {
--			int r = bitrates[j % 4];
-+			int r;
-+
-+			if (i == MINSTREL_OFDM_GROUP)
-+				r = minstrel_ofdm_bitrates[j % 8];
-+			else
-+				r = minstrel_cck_bitrates[j % 4];
- 
- 			p += sprintf(p, "   %2u.%1uM", r / 10, r % 10);
- 		}
-@@ -124,16 +131,8 @@ minstrel_ht_stats_open(struct inode *ino
- 	struct minstrel_ht_sta *mi = &msp->ht;
- 	struct minstrel_debugfs_info *ms;
- 	unsigned int i;
--	int ret;
- 	char *p;
- 
--	if (!msp->is_ht) {
--		inode->i_private = &msp->legacy;
--		ret = minstrel_stats_open(inode, file);
--		inode->i_private = msp;
--		return ret;
--	}
--
- 	ms = kmalloc(32768, GFP_KERNEL);
- 	if (!ms)
- 		return -ENOMEM;
-@@ -199,7 +198,6 @@ minstrel_ht_stats_csv_dump(struct minstr
- 
- 	for (j = 0; j < MCS_GROUP_RATES; j++) {
- 		struct minstrel_rate_stats *mrs = &mi->groups[i].rates[j];
--		static const int bitrates[4] = { 10, 20, 55, 110 };
- 		int idx = i * MCS_GROUP_RATES + j;
- 		unsigned int duration;
- 
-@@ -214,6 +212,8 @@ minstrel_ht_stats_csv_dump(struct minstr
- 			p += sprintf(p, "VHT%c0,", htmode);
- 			p += sprintf(p, "%cGI,", gimode);
- 			p += sprintf(p, "%d,", mg->streams);
-+		} else if (i == MINSTREL_OFDM_GROUP) {
-+			p += sprintf(p, "OFDM,,1,");
- 		} else {
- 			p += sprintf(p, "CCK,");
- 			p += sprintf(p, "%cP,", j < 4 ? 'L' : 'S');
-@@ -231,7 +231,13 @@ minstrel_ht_stats_csv_dump(struct minstr
- 		} else if (gflags & IEEE80211_TX_RC_VHT_MCS) {
- 			p += sprintf(p, ",MCS%-1u/%1u,", j, mg->streams);
- 		} else {
--			int r = bitrates[j % 4];
-+			int r;
-+
-+			if (i == MINSTREL_OFDM_GROUP)
-+				r = minstrel_ofdm_bitrates[j % 8];
-+			else
-+				r = minstrel_cck_bitrates[j % 4];
-+
- 			p += sprintf(p, ",%2u.%1uM,", r / 10, r % 10);
- 		}
- 
-@@ -274,18 +280,9 @@ minstrel_ht_stats_csv_open(struct inode
- 	struct minstrel_ht_sta *mi = &msp->ht;
- 	struct minstrel_debugfs_info *ms;
- 	unsigned int i;
--	int ret;
- 	char *p;
- 
--	if (!msp->is_ht) {
--		inode->i_private = &msp->legacy;
--		ret = minstrel_stats_csv_open(inode, file);
--		inode->i_private = msp;
--		return ret;
--	}
--
- 	ms = kmalloc(32768, GFP_KERNEL);
--
- 	if (!ms)
- 		return -ENOMEM;
- 
diff --git a/package/kernel/mac80211/patches/subsys/339-mac80211-remove-legacy-minstrel-rate-control.patch b/package/kernel/mac80211/patches/subsys/339-mac80211-remove-legacy-minstrel-rate-control.patch
deleted file mode 100644
index 96ee595ac..000000000
--- a/package/kernel/mac80211/patches/subsys/339-mac80211-remove-legacy-minstrel-rate-control.patch
+++ /dev/null
@@ -1,1328 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 26 Dec 2020 14:23:47 +0100
-Subject: [PATCH] mac80211: remove legacy minstrel rate control
-
-Now that minstrel_ht supports legacy rates, it is no longer needed
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
- delete mode 100644 net/mac80211/rc80211_minstrel.c
- delete mode 100644 net/mac80211/rc80211_minstrel.h
- delete mode 100644 net/mac80211/rc80211_minstrel_debugfs.c
-
---- a/net/mac80211/Makefile
-+++ b/net/mac80211/Makefile
-@@ -55,11 +55,9 @@ mac80211-$(CONFIG_PM) += pm.o
- CFLAGS_trace.o := -I$(src)
- 
- rc80211_minstrel-y := \
--	rc80211_minstrel.o \
- 	rc80211_minstrel_ht.o
- 
- rc80211_minstrel-$(CPTCFG_MAC80211_DEBUGFS) += \
--	rc80211_minstrel_debugfs.o \
- 	rc80211_minstrel_ht_debugfs.o
- 
- mac80211-$(CPTCFG_MAC80211_RC_MINSTREL) += $(rc80211_minstrel-y)
---- a/net/mac80211/rc80211_minstrel.c
-+++ /dev/null
-@@ -1,574 +0,0 @@
--/*
-- * Copyright (C) 2008 Felix Fietkau <nbd@openwrt.org>
-- *
-- * This program is free software; you can redistribute it and/or modify
-- * it under the terms of the GNU General Public License version 2 as
-- * published by the Free Software Foundation.
-- *
-- * Based on minstrel.c:
-- *   Copyright (C) 2005-2007 Derek Smithies <derek@indranet.co.nz>
-- *   Sponsored by Indranet Technologies Ltd
-- *
-- * Based on sample.c:
-- *   Copyright (c) 2005 John Bicket
-- *   All rights reserved.
-- *
-- *   Redistribution and use in source and binary forms, with or without
-- *   modification, are permitted provided that the following conditions
-- *   are met:
-- *   1. Redistributions of source code must retain the above copyright
-- *      notice, this list of conditions and the following disclaimer,
-- *      without modification.
-- *   2. Redistributions in binary form must reproduce at minimum a disclaimer
-- *      similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
-- *      redistribution must be conditioned upon including a substantially
-- *      similar Disclaimer requirement for further binary redistribution.
-- *   3. Neither the names of the above-listed copyright holders nor the names
-- *      of any contributors may be used to endorse or promote products derived
-- *      from this software without specific prior written permission.
-- *
-- *   Alternatively, this software may be distributed under the terms of the
-- *   GNU General Public License ("GPL") version 2 as published by the Free
-- *   Software Foundation.
-- *
-- *   NO WARRANTY
-- *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-- *   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-- *   LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
-- *   AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
-- *   THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
-- *   OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-- *   SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-- *   INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
-- *   IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-- *   ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
-- *   THE POSSIBILITY OF SUCH DAMAGES.
-- */
--#include <linux/netdevice.h>
--#include <linux/types.h>
--#include <linux/skbuff.h>
--#include <linux/debugfs.h>
--#include <linux/random.h>
--#include <linux/ieee80211.h>
--#include <linux/slab.h>
--#include <net/mac80211.h>
--#include "rate.h"
--#include "rc80211_minstrel.h"
--
--#define SAMPLE_TBL(_mi, _idx, _col) \
--		_mi->sample_table[(_idx * SAMPLE_COLUMNS) + _col]
--
--/* convert mac80211 rate index to local array index */
--static inline int
--rix_to_ndx(struct minstrel_sta_info *mi, int rix)
--{
--	int i = rix;
--	for (i = rix; i >= 0; i--)
--		if (mi->r[i].rix == rix)
--			break;
--	return i;
--}
--
--/* return current EMWA throughput */
--int minstrel_get_tp_avg(struct minstrel_rate *mr, int prob_avg)
--{
--	int usecs;
--
--	usecs = mr->perfect_tx_time;
--	if (!usecs)
--		usecs = 1000000;
--
--	/* reset thr. below 10% success */
--	if (mr->stats.prob_avg < MINSTREL_FRAC(10, 100))
--		return 0;
--
--	if (prob_avg > MINSTREL_FRAC(90, 100))
--		return MINSTREL_TRUNC(100000 * (MINSTREL_FRAC(90, 100) / usecs));
--	else
--		return MINSTREL_TRUNC(100000 * (prob_avg / usecs));
--}
--
--/* find & sort topmost throughput rates */
--static inline void
--minstrel_sort_best_tp_rates(struct minstrel_sta_info *mi, int i, u8 *tp_list)
--{
--	int j;
--	struct minstrel_rate_stats *tmp_mrs;
--	struct minstrel_rate_stats *cur_mrs = &mi->r[i].stats;
--
--	for (j = MAX_THR_RATES; j > 0; --j) {
--		tmp_mrs = &mi->r[tp_list[j - 1]].stats;
--		if (minstrel_get_tp_avg(&mi->r[i], cur_mrs->prob_avg) <=
--		    minstrel_get_tp_avg(&mi->r[tp_list[j - 1]], tmp_mrs->prob_avg))
--			break;
--	}
--
--	if (j < MAX_THR_RATES - 1)
--		memmove(&tp_list[j + 1], &tp_list[j], MAX_THR_RATES - (j + 1));
--	if (j < MAX_THR_RATES)
--		tp_list[j] = i;
--}
--
--static void
--minstrel_set_rate(struct minstrel_sta_info *mi, struct ieee80211_sta_rates *ratetbl,
--		  int offset, int idx)
--{
--	struct minstrel_rate *r = &mi->r[idx];
--
--	ratetbl->rate[offset].idx = r->rix;
--	ratetbl->rate[offset].count = r->adjusted_retry_count;
--	ratetbl->rate[offset].count_cts = r->retry_count_cts;
--	ratetbl->rate[offset].count_rts = r->stats.retry_count_rtscts;
--}
--
--static void
--minstrel_update_rates(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
--{
--	struct ieee80211_sta_rates *ratetbl;
--	int i = 0;
--
--	ratetbl = kzalloc(sizeof(*ratetbl), GFP_ATOMIC);
--	if (!ratetbl)
--		return;
--
--	/* Start with max_tp_rate */
--	minstrel_set_rate(mi, ratetbl, i++, mi->max_tp_rate[0]);
--
--	if (mp->hw->max_rates >= 3) {
--		/* At least 3 tx rates supported, use max_tp_rate2 next */
--		minstrel_set_rate(mi, ratetbl, i++, mi->max_tp_rate[1]);
--	}
--
--	if (mp->hw->max_rates >= 2) {
--		/* At least 2 tx rates supported, use max_prob_rate next */
--		minstrel_set_rate(mi, ratetbl, i++, mi->max_prob_rate);
--	}
--
--	/* Use lowest rate last */
--	ratetbl->rate[i].idx = mi->lowest_rix;
--	ratetbl->rate[i].count = mp->max_retry;
--	ratetbl->rate[i].count_cts = mp->max_retry;
--	ratetbl->rate[i].count_rts = mp->max_retry;
--
--	rate_control_set_rates(mp->hw, mi->sta, ratetbl);
--}
--
--/*
--* Recalculate statistics and counters of a given rate
--*/
--void
--minstrel_calc_rate_stats(struct minstrel_priv *mp,
--			 struct minstrel_rate_stats *mrs)
--{
--	unsigned int cur_prob;
--
--	if (unlikely(mrs->attempts > 0)) {
--		mrs->sample_skipped = 0;
--		cur_prob = MINSTREL_FRAC(mrs->success, mrs->attempts);
--		if (mp->new_avg) {
--			minstrel_filter_avg_add(&mrs->prob_avg,
--						&mrs->prob_avg_1, cur_prob);
--		} else if (unlikely(!mrs->att_hist)) {
--			mrs->prob_avg = cur_prob;
--		} else {
--			/*update exponential weighted moving avarage */
--			mrs->prob_avg = minstrel_ewma(mrs->prob_avg,
--						      cur_prob,
--						      EWMA_LEVEL);
--		}
--		mrs->att_hist += mrs->attempts;
--		mrs->succ_hist += mrs->success;
--	} else {
--		mrs->sample_skipped++;
--	}
--
--	mrs->last_success = mrs->success;
--	mrs->last_attempts = mrs->attempts;
--	mrs->success = 0;
--	mrs->attempts = 0;
--}
--
--static void
--minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
--{
--	u8 tmp_tp_rate[MAX_THR_RATES];
--	u8 tmp_prob_rate = 0;
--	int i, tmp_cur_tp, tmp_prob_tp;
--
--	for (i = 0; i < MAX_THR_RATES; i++)
--	    tmp_tp_rate[i] = 0;
--
--	for (i = 0; i < mi->n_rates; i++) {
--		struct minstrel_rate *mr = &mi->r[i];
--		struct minstrel_rate_stats *mrs = &mi->r[i].stats;
--		struct minstrel_rate_stats *tmp_mrs = &mi->r[tmp_prob_rate].stats;
--
--		/* Update statistics of success probability per rate */
--		minstrel_calc_rate_stats(mp, mrs);
--
--		/* Sample less often below the 10% chance of success.
--		 * Sample less often above the 95% chance of success. */
--		if (mrs->prob_avg > MINSTREL_FRAC(95, 100) ||
--		    mrs->prob_avg < MINSTREL_FRAC(10, 100)) {
--			mr->adjusted_retry_count = mrs->retry_count >> 1;
--			if (mr->adjusted_retry_count > 2)
--				mr->adjusted_retry_count = 2;
--			mr->sample_limit = 4;
--		} else {
--			mr->sample_limit = -1;
--			mr->adjusted_retry_count = mrs->retry_count;
--		}
--		if (!mr->adjusted_retry_count)
--			mr->adjusted_retry_count = 2;
--
--		minstrel_sort_best_tp_rates(mi, i, tmp_tp_rate);
--
--		/* To determine the most robust rate (max_prob_rate) used at
--		 * 3rd mmr stage we distinct between two cases:
--		 * (1) if any success probabilitiy >= 95%, out of those rates
--		 * choose the maximum throughput rate as max_prob_rate
--		 * (2) if all success probabilities < 95%, the rate with
--		 * highest success probability is chosen as max_prob_rate */
--		if (mrs->prob_avg >= MINSTREL_FRAC(95, 100)) {
--			tmp_cur_tp = minstrel_get_tp_avg(mr, mrs->prob_avg);
--			tmp_prob_tp = minstrel_get_tp_avg(&mi->r[tmp_prob_rate],
--							  tmp_mrs->prob_avg);
--			if (tmp_cur_tp >= tmp_prob_tp)
--				tmp_prob_rate = i;
--		} else {
--			if (mrs->prob_avg >= tmp_mrs->prob_avg)
--				tmp_prob_rate = i;
--		}
--	}
--
--	/* Assign the new rate set */
--	memcpy(mi->max_tp_rate, tmp_tp_rate, sizeof(mi->max_tp_rate));
--	mi->max_prob_rate = tmp_prob_rate;
--
--#ifdef CPTCFG_MAC80211_DEBUGFS
--	/* use fixed index if set */
--	if (mp->fixed_rate_idx != -1) {
--		mi->max_tp_rate[0] = mp->fixed_rate_idx;
--		mi->max_tp_rate[1] = mp->fixed_rate_idx;
--		mi->max_prob_rate = mp->fixed_rate_idx;
--	}
--#endif
--
--	/* Reset update timer */
--	mi->last_stats_update = jiffies;
--
--	minstrel_update_rates(mp, mi);
--}
--
--static void
--minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
--		   void *priv_sta, struct ieee80211_tx_status *st)
--{
--	struct ieee80211_tx_info *info = st->info;
--	struct minstrel_priv *mp = priv;
--	struct minstrel_sta_info *mi = priv_sta;
--	struct ieee80211_tx_rate *ar = info->status.rates;
--	int i, ndx;
--	int success;
--
--	success = !!(info->flags & IEEE80211_TX_STAT_ACK);
--
--	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
--		if (ar[i].idx < 0 || !ar[i].count)
--			break;
--
--		ndx = rix_to_ndx(mi, ar[i].idx);
--		if (ndx < 0)
--			continue;
--
--		mi->r[ndx].stats.attempts += ar[i].count;
--
--		if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0))
--			mi->r[ndx].stats.success += success;
--	}
--
--	if (time_after(jiffies, mi->last_stats_update +
--				mp->update_interval / (mp->new_avg ? 2 : 1)))
--		minstrel_update_stats(mp, mi);
--}
--
--
--static inline unsigned int
--minstrel_get_retry_count(struct minstrel_rate *mr,
--			 struct ieee80211_tx_info *info)
--{
--	u8 retry = mr->adjusted_retry_count;
--
--	if (info->control.use_rts)
--		retry = max_t(u8, 2, min(mr->stats.retry_count_rtscts, retry));
--	else if (info->control.use_cts_prot)
--		retry = max_t(u8, 2, min(mr->retry_count_cts, retry));
--	return retry;
--}
--
--
--static int
--minstrel_get_next_sample(struct minstrel_sta_info *mi)
--{
--	unsigned int sample_ndx;
--	sample_ndx = SAMPLE_TBL(mi, mi->sample_row, mi->sample_column);
--	mi->sample_row++;
--	if ((int) mi->sample_row >= mi->n_rates) {
--		mi->sample_row = 0;
--		mi->sample_column++;
--		if (mi->sample_column >= SAMPLE_COLUMNS)
--			mi->sample_column = 0;
--	}
--	return sample_ndx;
--}
--
--static void
--minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
--		  void *priv_sta, struct ieee80211_tx_rate_control *txrc)
--{
--	struct sk_buff *skb = txrc->skb;
--	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
--	struct minstrel_sta_info *mi = priv_sta;
--	struct minstrel_priv *mp = priv;
--	struct ieee80211_tx_rate *rate = &info->control.rates[0];
--	struct minstrel_rate *msr, *mr;
--	unsigned int ndx;
--	bool mrr_capable;
--	bool prev_sample;
--	int delta;
--	int sampling_ratio;
--
--	/* check multi-rate-retry capabilities & adjust lookaround_rate */
--	mrr_capable = mp->has_mrr &&
--		      !txrc->rts &&
--		      !txrc->bss_conf->use_cts_prot;
--	if (mrr_capable)
--		sampling_ratio = mp->lookaround_rate_mrr;
--	else
--		sampling_ratio = mp->lookaround_rate;
--
--	/* increase sum packet counter */
--	mi->total_packets++;
--
--#ifdef CPTCFG_MAC80211_DEBUGFS
--	if (mp->fixed_rate_idx != -1)
--		return;
--#endif
--
--	/* Don't use EAPOL frames for sampling on non-mrr hw */
--	if (mp->hw->max_rates == 1 &&
--	    (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO))
--		return;
--
--	delta = (mi->total_packets * sampling_ratio / 100) -
--			mi->sample_packets;
--
--	/* delta < 0: no sampling required */
--	prev_sample = mi->prev_sample;
--	mi->prev_sample = false;
--	if (delta < 0 || (!mrr_capable && prev_sample))
--		return;
--
--	if (mi->total_packets >= 10000) {
--		mi->sample_packets = 0;
--		mi->total_packets = 0;
--	} else if (delta > mi->n_rates * 2) {
--		/* With multi-rate retry, not every planned sample
--		 * attempt actually gets used, due to the way the retry
--		 * chain is set up - [max_tp,sample,prob,lowest] for
--		 * sample_rate < max_tp.
--		 *
--		 * If there's too much sampling backlog and the link
--		 * starts getting worse, minstrel would start bursting
--		 * out lots of sampling frames, which would result
--		 * in a large throughput loss. */
--		mi->sample_packets += (delta - mi->n_rates * 2);
--	}
--
--	/* get next random rate sample */
--	ndx = minstrel_get_next_sample(mi);
--	msr = &mi->r[ndx];
--	mr = &mi->r[mi->max_tp_rate[0]];
--
--	/* Decide if direct ( 1st mrr stage) or indirect (2nd mrr stage)
--	 * rate sampling method should be used.
--	 * Respect such rates that are not sampled for 20 interations.
--	 */
--	if (msr->perfect_tx_time < mr->perfect_tx_time ||
--	    msr->stats.sample_skipped >= 20) {
--		if (!msr->sample_limit)
--			return;
--
--		mi->sample_packets++;
--		if (msr->sample_limit > 0)
--			msr->sample_limit--;
--	}
--
--	/* If we're not using MRR and the sampling rate already
--	 * has a probability of >95%, we shouldn't be attempting
--	 * to use it, as this only wastes precious airtime */
--	if (!mrr_capable &&
--	   (mi->r[ndx].stats.prob_avg > MINSTREL_FRAC(95, 100)))
--		return;
--
--	mi->prev_sample = true;
--
--	rate->idx = mi->r[ndx].rix;
--	rate->count = minstrel_get_retry_count(&mi->r[ndx], info);
--	info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
--}
--
--
--static void
--calc_rate_durations(enum nl80211_band band,
--		    struct minstrel_rate *d,
--		    struct ieee80211_rate *rate,
--		    struct cfg80211_chan_def *chandef)
--{
--	int erp = !!(rate->flags & IEEE80211_RATE_ERP_G);
--	int shift = ieee80211_chandef_get_shift(chandef);
--
--	d->perfect_tx_time = ieee80211_frame_duration(band, 1200,
--			DIV_ROUND_UP(rate->bitrate, 1 << shift), erp, 1,
--			shift);
--	d->ack_time = ieee80211_frame_duration(band, 10,
--			DIV_ROUND_UP(rate->bitrate, 1 << shift), erp, 1,
--			shift);
--}
--
--static void
--init_sample_table(struct minstrel_sta_info *mi)
--{
--	unsigned int i, col, new_idx;
--	u8 rnd[8];
--
--	mi->sample_column = 0;
--	mi->sample_row = 0;
--	memset(mi->sample_table, 0xff, SAMPLE_COLUMNS * mi->n_rates);
--
--	for (col = 0; col < SAMPLE_COLUMNS; col++) {
--		prandom_bytes(rnd, sizeof(rnd));
--		for (i = 0; i < mi->n_rates; i++) {
--			new_idx = (i + rnd[i & 7]) % mi->n_rates;
--			while (SAMPLE_TBL(mi, new_idx, col) != 0xff)
--				new_idx = (new_idx + 1) % mi->n_rates;
--
--			SAMPLE_TBL(mi, new_idx, col) = i;
--		}
--	}
--}
--
--static void
--minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
--		   struct cfg80211_chan_def *chandef,
--		   struct ieee80211_sta *sta, void *priv_sta)
--{
--	struct minstrel_sta_info *mi = priv_sta;
--	struct minstrel_priv *mp = priv;
--	struct ieee80211_rate *ctl_rate;
--	unsigned int i, n = 0;
--	unsigned int t_slot = 9; /* FIXME: get real slot time */
--	u32 rate_flags;
--
--	mi->sta = sta;
--	mi->lowest_rix = rate_lowest_index(sband, sta);
--	ctl_rate = &sband->bitrates[mi->lowest_rix];
--	mi->sp_ack_dur = ieee80211_frame_duration(sband->band, 10,
--				ctl_rate->bitrate,
--				!!(ctl_rate->flags & IEEE80211_RATE_ERP_G), 1,
--				ieee80211_chandef_get_shift(chandef));
--
--	rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
--	memset(mi->max_tp_rate, 0, sizeof(mi->max_tp_rate));
--	mi->max_prob_rate = 0;
--
--	for (i = 0; i < sband->n_bitrates; i++) {
--		struct minstrel_rate *mr = &mi->r[n];
--		struct minstrel_rate_stats *mrs = &mi->r[n].stats;
--		unsigned int tx_time = 0, tx_time_cts = 0, tx_time_rtscts = 0;
--		unsigned int tx_time_single;
--		unsigned int cw = mp->cw_min;
--		int shift;
--
--		if (!rate_supported(sta, sband->band, i))
--			continue;
--		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
--			continue;
--
--		n++;
--		memset(mr, 0, sizeof(*mr));
--		memset(mrs, 0, sizeof(*mrs));
--
--		mr->rix = i;
--		shift = ieee80211_chandef_get_shift(chandef);
--		mr->bitrate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
--					   (1 << shift) * 5);
--		calc_rate_durations(sband->band, mr, &sband->bitrates[i],
--				    chandef);
--
--		/* calculate maximum number of retransmissions before
--		 * fallback (based on maximum segment size) */
--		mr->sample_limit = -1;
--		mrs->retry_count = 1;
--		mr->retry_count_cts = 1;
--		mrs->retry_count_rtscts = 1;
--		tx_time = mr->perfect_tx_time + mi->sp_ack_dur;
--		do {
--			/* add one retransmission */
--			tx_time_single = mr->ack_time + mr->perfect_tx_time;
--
--			/* contention window */
--			tx_time_single += (t_slot * cw) >> 1;
--			cw = min((cw << 1) | 1, mp->cw_max);
--
--			tx_time += tx_time_single;
--			tx_time_cts += tx_time_single + mi->sp_ack_dur;
--			tx_time_rtscts += tx_time_single + 2 * mi->sp_ack_dur;
--			if ((tx_time_cts < mp->segment_size) &&
--				(mr->retry_count_cts < mp->max_retry))
--				mr->retry_count_cts++;
--			if ((tx_time_rtscts < mp->segment_size) &&
--				(mrs->retry_count_rtscts < mp->max_retry))
--				mrs->retry_count_rtscts++;
--		} while ((tx_time < mp->segment_size) &&
--				(++mr->stats.retry_count < mp->max_retry));
--		mr->adjusted_retry_count = mrs->retry_count;
--		if (!(sband->bitrates[i].flags & IEEE80211_RATE_ERP_G))
--			mr->retry_count_cts = mrs->retry_count;
--	}
--
--	for (i = n; i < sband->n_bitrates; i++) {
--		struct minstrel_rate *mr = &mi->r[i];
--		mr->rix = -1;
--	}
--
--	mi->n_rates = n;
--	mi->last_stats_update = jiffies;
--
--	init_sample_table(mi);
--	minstrel_update_rates(mp, mi);
--}
--
--static u32 minstrel_get_expected_throughput(void *priv_sta)
--{
--	struct minstrel_sta_info *mi = priv_sta;
--	struct minstrel_rate_stats *tmp_mrs;
--	int idx = mi->max_tp_rate[0];
--	int tmp_cur_tp;
--
--	/* convert pkt per sec in kbps (1200 is the average pkt size used for
--	 * computing cur_tp
--	 */
--	tmp_mrs = &mi->r[idx].stats;
--	tmp_cur_tp = minstrel_get_tp_avg(&mi->r[idx], tmp_mrs->prob_avg) * 10;
--	tmp_cur_tp = tmp_cur_tp * 1200 * 8 / 1024;
--
--	return tmp_cur_tp;
--}
--
--const struct rate_control_ops mac80211_minstrel = {
--	.tx_status_ext = minstrel_tx_status,
--	.get_rate = minstrel_get_rate,
--	.rate_init = minstrel_rate_init,
--	.get_expected_throughput = minstrel_get_expected_throughput,
--};
---- a/net/mac80211/rc80211_minstrel.h
-+++ /dev/null
-@@ -1,185 +0,0 @@
--/* SPDX-License-Identifier: GPL-2.0-only */
--/*
-- * Copyright (C) 2008 Felix Fietkau <nbd@openwrt.org>
-- */
--
--#ifndef __RC_MINSTREL_H
--#define __RC_MINSTREL_H
--
--#define EWMA_LEVEL	96	/* ewma weighting factor [/EWMA_DIV] */
--#define EWMA_DIV	128
--#define SAMPLE_COLUMNS	10	/* number of columns in sample table */
--
--/* scaled fraction values */
--#define MINSTREL_SCALE  12
--#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / div)
--#define MINSTREL_TRUNC(val) ((val) >> MINSTREL_SCALE)
--
--/* number of highest throughput rates to consider*/
--#define MAX_THR_RATES 4
--
--/*
-- * Coefficients for moving average with noise filter (period=16),
-- * scaled by 10 bits
-- *
-- * a1 = exp(-pi * sqrt(2) / period)
-- * coeff2 = 2 * a1 * cos(sqrt(2) * 2 * pi / period)
-- * coeff3 = -sqr(a1)
-- * coeff1 = 1 - coeff2 - coeff3
-- */
--#define MINSTREL_AVG_COEFF1		(MINSTREL_FRAC(1, 1) - \
--					 MINSTREL_AVG_COEFF2 - \
--					 MINSTREL_AVG_COEFF3)
--#define MINSTREL_AVG_COEFF2		0x00001499
--#define MINSTREL_AVG_COEFF3		-0x0000092e
--
--/*
-- * Perform EWMA (Exponentially Weighted Moving Average) calculation
-- */
--static inline int
--minstrel_ewma(int old, int new, int weight)
--{
--	int diff, incr;
--
--	diff = new - old;
--	incr = (EWMA_DIV - weight) * diff / EWMA_DIV;
--
--	return old + incr;
--}
--
--static inline int minstrel_filter_avg_add(u16 *prev_1, u16 *prev_2, s32 in)
--{
--	s32 out_1 = *prev_1;
--	s32 out_2 = *prev_2;
--	s32 val;
--
--	if (!in)
--		in += 1;
--
--	if (!out_1) {
--		val = out_1 = in;
--		goto out;
--	}
--
--	val = MINSTREL_AVG_COEFF1 * in;
--	val += MINSTREL_AVG_COEFF2 * out_1;
--	val += MINSTREL_AVG_COEFF3 * out_2;
--	val >>= MINSTREL_SCALE;
--
--	if (val > 1 << MINSTREL_SCALE)
--		val = 1 << MINSTREL_SCALE;
--	if (val < 0)
--		val = 1;
--
--out:
--	*prev_2 = out_1;
--	*prev_1 = val;
--
--	return val;
--}
--
--struct minstrel_rate_stats {
--	/* current / last sampling period attempts/success counters */
--	u16 attempts, last_attempts;
--	u16 success, last_success;
--
--	/* total attempts/success counters */
--	u32 att_hist, succ_hist;
--
--	/* prob_avg - moving average of prob */
--	u16 prob_avg;
--	u16 prob_avg_1;
--
--	/* maximum retry counts */
--	u8 retry_count;
--	u8 retry_count_rtscts;
--
--	u8 sample_skipped;
--	bool retry_updated;
--};
--
--struct minstrel_rate {
--	int bitrate;
--
--	s8 rix;
--	u8 retry_count_cts;
--	u8 adjusted_retry_count;
--
--	unsigned int perfect_tx_time;
--	unsigned int ack_time;
--
--	int sample_limit;
--
--	struct minstrel_rate_stats stats;
--};
--
--struct minstrel_sta_info {
--	struct ieee80211_sta *sta;
--
--	unsigned long last_stats_update;
--	unsigned int sp_ack_dur;
--	unsigned int rate_avg;
--
--	unsigned int lowest_rix;
--
--	u8 max_tp_rate[MAX_THR_RATES];
--	u8 max_prob_rate;
--	unsigned int total_packets;
--	unsigned int sample_packets;
--
--	unsigned int sample_row;
--	unsigned int sample_column;
--
--	int n_rates;
--	struct minstrel_rate *r;
--	bool prev_sample;
--
--	/* sampling table */
--	u8 *sample_table;
--};
--
--struct minstrel_priv {
--	struct ieee80211_hw *hw;
--	bool has_mrr;
--	bool new_avg;
--	u32 sample_switch;
--	unsigned int cw_min;
--	unsigned int cw_max;
--	unsigned int max_retry;
--	unsigned int segment_size;
--	unsigned int update_interval;
--	unsigned int lookaround_rate;
--	unsigned int lookaround_rate_mrr;
--
--	u8 cck_rates[4];
--	u8 ofdm_rates[NUM_NL80211_BANDS][8];
--
--#ifdef CPTCFG_MAC80211_DEBUGFS
--	/*
--	 * enable fixed rate processing per RC
--	 *   - write static index to debugfs:ieee80211/phyX/rc/fixed_rate_idx
--	 *   - write -1 to enable RC processing again
--	 *   - setting will be applied on next update
--	 */
--	u32 fixed_rate_idx;
--#endif
--};
--
--struct minstrel_debugfs_info {
--	size_t len;
--	char buf[];
--};
--
--extern const struct rate_control_ops mac80211_minstrel;
--void minstrel_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir);
--
--/* Recalculate success probabilities and counters for a given rate using EWMA */
--void minstrel_calc_rate_stats(struct minstrel_priv *mp,
--			      struct minstrel_rate_stats *mrs);
--int minstrel_get_tp_avg(struct minstrel_rate *mr, int prob_avg);
--
--/* debugfs */
--int minstrel_stats_open(struct inode *inode, struct file *file);
--int minstrel_stats_csv_open(struct inode *inode, struct file *file);
--
--#endif
---- a/net/mac80211/rc80211_minstrel_debugfs.c
-+++ /dev/null
-@@ -1,172 +0,0 @@
--/*
-- * Copyright (C) 2008 Felix Fietkau <nbd@openwrt.org>
-- *
-- * This program is free software; you can redistribute it and/or modify
-- * it under the terms of the GNU General Public License version 2 as
-- * published by the Free Software Foundation.
-- *
-- * Based on minstrel.c:
-- *   Copyright (C) 2005-2007 Derek Smithies <derek@indranet.co.nz>
-- *   Sponsored by Indranet Technologies Ltd
-- *
-- * Based on sample.c:
-- *   Copyright (c) 2005 John Bicket
-- *   All rights reserved.
-- *
-- *   Redistribution and use in source and binary forms, with or without
-- *   modification, are permitted provided that the following conditions
-- *   are met:
-- *   1. Redistributions of source code must retain the above copyright
-- *      notice, this list of conditions and the following disclaimer,
-- *      without modification.
-- *   2. Redistributions in binary form must reproduce at minimum a disclaimer
-- *      similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
-- *      redistribution must be conditioned upon including a substantially
-- *      similar Disclaimer requirement for further binary redistribution.
-- *   3. Neither the names of the above-listed copyright holders nor the names
-- *      of any contributors may be used to endorse or promote products derived
-- *      from this software without specific prior written permission.
-- *
-- *   Alternatively, this software may be distributed under the terms of the
-- *   GNU General Public License ("GPL") version 2 as published by the Free
-- *   Software Foundation.
-- *
-- *   NO WARRANTY
-- *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-- *   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-- *   LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
-- *   AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
-- *   THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
-- *   OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-- *   SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-- *   INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
-- *   IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-- *   ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
-- *   THE POSSIBILITY OF SUCH DAMAGES.
-- */
--#include <linux/netdevice.h>
--#include <linux/types.h>
--#include <linux/skbuff.h>
--#include <linux/debugfs.h>
--#include <linux/ieee80211.h>
--#include <linux/slab.h>
--#include <linux/export.h>
--#include <net/mac80211.h>
--#include "rc80211_minstrel.h"
--
--int
--minstrel_stats_open(struct inode *inode, struct file *file)
--{
--	struct minstrel_sta_info *mi = inode->i_private;
--	struct minstrel_debugfs_info *ms;
--	unsigned int i, tp_max, tp_avg, eprob;
--	char *p;
--
--	ms = kmalloc(2048, GFP_KERNEL);
--	if (!ms)
--		return -ENOMEM;
--
--	file->private_data = ms;
--	p = ms->buf;
--	p += sprintf(p, "\n");
--	p += sprintf(p,
--		     "best   __________rate_________    ____statistics___    ____last_____    ______sum-of________\n");
--	p += sprintf(p,
--		     "rate  [name idx airtime max_tp]  [avg(tp) avg(prob)]  [retry|suc|att]  [#success | #attempts]\n");
--
--	for (i = 0; i < mi->n_rates; i++) {
--		struct minstrel_rate *mr = &mi->r[i];
--		struct minstrel_rate_stats *mrs = &mi->r[i].stats;
--
--		*(p++) = (i == mi->max_tp_rate[0]) ? 'A' : ' ';
--		*(p++) = (i == mi->max_tp_rate[1]) ? 'B' : ' ';
--		*(p++) = (i == mi->max_tp_rate[2]) ? 'C' : ' ';
--		*(p++) = (i == mi->max_tp_rate[3]) ? 'D' : ' ';
--		*(p++) = (i == mi->max_prob_rate) ? 'P' : ' ';
--
--		p += sprintf(p, " %3u%s ", mr->bitrate / 2,
--				(mr->bitrate & 1 ? ".5" : "  "));
--		p += sprintf(p, "%3u  ", i);
--		p += sprintf(p, "%6u ", mr->perfect_tx_time);
--
--		tp_max = minstrel_get_tp_avg(mr, MINSTREL_FRAC(100,100));
--		tp_avg = minstrel_get_tp_avg(mr, mrs->prob_avg);
--		eprob = MINSTREL_TRUNC(mrs->prob_avg * 1000);
--
--		p += sprintf(p, "%4u.%1u    %4u.%1u     %3u.%1u"
--				"     %3u   %3u %-3u   "
--				"%9llu   %-9llu\n",
--				tp_max / 10, tp_max % 10,
--				tp_avg / 10, tp_avg % 10,
--				eprob / 10, eprob % 10,
--				mrs->retry_count,
--				mrs->last_success,
--				mrs->last_attempts,
--				(unsigned long long)mrs->succ_hist,
--				(unsigned long long)mrs->att_hist);
--	}
--	p += sprintf(p, "\nTotal packet count::    ideal %d      "
--			"lookaround %d\n\n",
--			mi->total_packets - mi->sample_packets,
--			mi->sample_packets);
--	ms->len = p - ms->buf;
--
--	WARN_ON(ms->len + sizeof(*ms) > 2048);
--
--	return 0;
--}
--
--int
--minstrel_stats_csv_open(struct inode *inode, struct file *file)
--{
--	struct minstrel_sta_info *mi = inode->i_private;
--	struct minstrel_debugfs_info *ms;
--	unsigned int i, tp_max, tp_avg, eprob;
--	char *p;
--
--	ms = kmalloc(2048, GFP_KERNEL);
--	if (!ms)
--		return -ENOMEM;
--
--	file->private_data = ms;
--	p = ms->buf;
--
--	for (i = 0; i < mi->n_rates; i++) {
--		struct minstrel_rate *mr = &mi->r[i];
--		struct minstrel_rate_stats *mrs = &mi->r[i].stats;
--
--		p += sprintf(p, "%s" ,((i == mi->max_tp_rate[0]) ? "A" : ""));
--		p += sprintf(p, "%s" ,((i == mi->max_tp_rate[1]) ? "B" : ""));
--		p += sprintf(p, "%s" ,((i == mi->max_tp_rate[2]) ? "C" : ""));
--		p += sprintf(p, "%s" ,((i == mi->max_tp_rate[3]) ? "D" : ""));
--		p += sprintf(p, "%s" ,((i == mi->max_prob_rate) ? "P" : ""));
--
--		p += sprintf(p, ",%u%s", mr->bitrate / 2,
--				(mr->bitrate & 1 ? ".5," : ","));
--		p += sprintf(p, "%u,", i);
--		p += sprintf(p, "%u,",mr->perfect_tx_time);
--
--		tp_max = minstrel_get_tp_avg(mr, MINSTREL_FRAC(100,100));
--		tp_avg = minstrel_get_tp_avg(mr, mrs->prob_avg);
--		eprob = MINSTREL_TRUNC(mrs->prob_avg * 1000);
--
--		p += sprintf(p, "%u.%u,%u.%u,%u.%u,%u,%u,%u,"
--				"%llu,%llu,%d,%d\n",
--				tp_max / 10, tp_max % 10,
--				tp_avg / 10, tp_avg % 10,
--				eprob / 10, eprob % 10,
--				mrs->retry_count,
--				mrs->last_success,
--				mrs->last_attempts,
--				(unsigned long long)mrs->succ_hist,
--				(unsigned long long)mrs->att_hist,
--				mi->total_packets - mi->sample_packets,
--				mi->sample_packets);
--
--	}
--	ms->len = p - ms->buf;
--
--	WARN_ON(ms->len + sizeof(*ms) > 2048);
--
--	return 0;
--}
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -13,7 +13,6 @@
- #include <net/mac80211.h>
- #include "rate.h"
- #include "sta_info.h"
--#include "rc80211_minstrel.h"
- #include "rc80211_minstrel_ht.h"
- 
- #define AVG_AMPDU_SIZE	16
-@@ -716,6 +715,83 @@ out:
- 	mi->sample_mode = MINSTREL_SAMPLE_ACTIVE;
- }
- 
-+static inline int
-+minstrel_ewma(int old, int new, int weight)
-+{
-+	int diff, incr;
-+
-+	diff = new - old;
-+	incr = (EWMA_DIV - weight) * diff / EWMA_DIV;
-+
-+	return old + incr;
-+}
-+
-+static inline int minstrel_filter_avg_add(u16 *prev_1, u16 *prev_2, s32 in)
-+{
-+	s32 out_1 = *prev_1;
-+	s32 out_2 = *prev_2;
-+	s32 val;
-+
-+	if (!in)
-+		in += 1;
-+
-+	if (!out_1) {
-+		val = out_1 = in;
-+		goto out;
-+	}
-+
-+	val = MINSTREL_AVG_COEFF1 * in;
-+	val += MINSTREL_AVG_COEFF2 * out_1;
-+	val += MINSTREL_AVG_COEFF3 * out_2;
-+	val >>= MINSTREL_SCALE;
-+
-+	if (val > 1 << MINSTREL_SCALE)
-+		val = 1 << MINSTREL_SCALE;
-+	if (val < 0)
-+		val = 1;
-+
-+out:
-+	*prev_2 = out_1;
-+	*prev_1 = val;
-+
-+	return val;
-+}
-+
-+/*
-+* Recalculate statistics and counters of a given rate
-+*/
-+static void
-+minstrel_ht_calc_rate_stats(struct minstrel_priv *mp,
-+			    struct minstrel_rate_stats *mrs)
-+{
-+	unsigned int cur_prob;
-+
-+	if (unlikely(mrs->attempts > 0)) {
-+		mrs->sample_skipped = 0;
-+		cur_prob = MINSTREL_FRAC(mrs->success, mrs->attempts);
-+		if (mp->new_avg) {
-+			minstrel_filter_avg_add(&mrs->prob_avg,
-+						&mrs->prob_avg_1, cur_prob);
-+		} else if (unlikely(!mrs->att_hist)) {
-+			mrs->prob_avg = cur_prob;
-+		} else {
-+			/*update exponential weighted moving avarage */
-+			mrs->prob_avg = minstrel_ewma(mrs->prob_avg,
-+						      cur_prob,
-+						      EWMA_LEVEL);
-+		}
-+		mrs->att_hist += mrs->attempts;
-+		mrs->succ_hist += mrs->success;
-+	} else {
-+		mrs->sample_skipped++;
-+	}
-+
-+	mrs->last_success = mrs->success;
-+	mrs->last_attempts = mrs->attempts;
-+	mrs->success = 0;
-+	mrs->attempts = 0;
-+}
-+
- /*
-  * Update rate statistics and select new primary rates
-  *
-@@ -808,7 +884,7 @@ minstrel_ht_update_stats(struct minstrel
- 
- 			mrs = &mg->rates[i];
- 			mrs->retry_updated = false;
--			minstrel_calc_rate_stats(mp, mrs);
-+			minstrel_ht_calc_rate_stats(mp, mrs);
- 			cur_prob = mrs->prob_avg;
- 
- 			if (minstrel_ht_get_tp_avg(mi, group, i, cur_prob) == 0)
-@@ -960,8 +1036,7 @@ minstrel_ht_tx_status(void *priv, struct
-                       void *priv_sta, struct ieee80211_tx_status *st)
- {
- 	struct ieee80211_tx_info *info = st->info;
--	struct minstrel_ht_sta_priv *msp = priv_sta;
--	struct minstrel_ht_sta *mi = &msp->ht;
-+	struct minstrel_ht_sta *mi = priv_sta;
- 	struct ieee80211_tx_rate *ar = info->status.rates;
- 	struct minstrel_rate_stats *rate, *rate2, *rate_sample = NULL;
- 	struct minstrel_priv *mp = priv;
-@@ -1372,8 +1447,7 @@ minstrel_ht_get_rate(void *priv, struct
- 	const struct mcs_group *sample_group;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
- 	struct ieee80211_tx_rate *rate = &info->status.rates[0];
--	struct minstrel_ht_sta_priv *msp = priv_sta;
--	struct minstrel_ht_sta *mi = &msp->ht;
-+	struct minstrel_ht_sta *mi = priv_sta;
- 	struct minstrel_priv *mp = priv;
- 	int sample_idx;
- 
-@@ -1484,8 +1558,7 @@ minstrel_ht_update_caps(void *priv, stru
- 			struct ieee80211_sta *sta, void *priv_sta)
- {
- 	struct minstrel_priv *mp = priv;
--	struct minstrel_ht_sta_priv *msp = priv_sta;
--	struct minstrel_ht_sta *mi = &msp->ht;
-+	struct minstrel_ht_sta *mi = priv_sta;
- 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
- 	u16 ht_cap = sta->ht_cap.cap;
- 	struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
-@@ -1647,7 +1720,7 @@ static void *
- minstrel_ht_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
- {
- 	struct ieee80211_supported_band *sband;
--	struct minstrel_ht_sta_priv *msp;
-+	struct minstrel_ht_sta *mi;
- 	struct minstrel_priv *mp = priv;
- 	struct ieee80211_hw *hw = mp->hw;
- 	int max_rates = 0;
-@@ -1659,35 +1732,13 @@ minstrel_ht_alloc_sta(void *priv, struct
- 			max_rates = sband->n_bitrates;
- 	}
- 
--	msp = kzalloc(sizeof(*msp), gfp);
--	if (!msp)
--		return NULL;
--
--	msp->ratelist = kcalloc(max_rates, sizeof(struct minstrel_rate), gfp);
--	if (!msp->ratelist)
--		goto error;
--
--	msp->sample_table = kmalloc_array(max_rates, SAMPLE_COLUMNS, gfp);
--	if (!msp->sample_table)
--		goto error1;
--
--	return msp;
--
--error1:
--	kfree(msp->ratelist);
--error:
--	kfree(msp);
--	return NULL;
-+	return kzalloc(sizeof(*mi), gfp);
- }
- 
- static void
- minstrel_ht_free_sta(void *priv, struct ieee80211_sta *sta, void *priv_sta)
- {
--	struct minstrel_ht_sta_priv *msp = priv_sta;
--
--	kfree(msp->sample_table);
--	kfree(msp->ratelist);
--	kfree(msp);
-+	kfree(priv_sta);
- }
- 
- static void
-@@ -1768,12 +1819,6 @@ minstrel_ht_alloc(struct ieee80211_hw *h
- 	mp->cw_min = 15;
- 	mp->cw_max = 1023;
- 
--	/* number of packets (in %) to use for sampling other rates
--	 * sample less often for non-mrr packets, because the overhead
--	 * is much higher than with mrr */
--	mp->lookaround_rate = 5;
--	mp->lookaround_rate_mrr = 10;
--
- 	/* maximum time that the hw is allowed to stay in one MRR segment */
- 	mp->segment_size = 6000;
- 
-@@ -1821,8 +1866,7 @@ minstrel_ht_free(void *priv)
- 
- static u32 minstrel_ht_get_expected_throughput(void *priv_sta)
- {
--	struct minstrel_ht_sta_priv *msp = priv_sta;
--	struct minstrel_ht_sta *mi = &msp->ht;
-+	struct minstrel_ht_sta *mi = priv_sta;
- 	int i, j, prob, tp_avg;
- 
- 	i = mi->max_tp_rate[0] / MCS_GROUP_RATES;
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -6,6 +6,33 @@
- #ifndef __RC_MINSTREL_HT_H
- #define __RC_MINSTREL_HT_H
- 
-+/* number of highest throughput rates to consider*/
-+#define MAX_THR_RATES 4
-+#define SAMPLE_COLUMNS	10	/* number of columns in sample table */
-+
-+/* scaled fraction values */
-+#define MINSTREL_SCALE  12
-+#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / div)
-+#define MINSTREL_TRUNC(val) ((val) >> MINSTREL_SCALE)
-+
-+#define EWMA_LEVEL	96	/* ewma weighting factor [/EWMA_DIV] */
-+#define EWMA_DIV	128
-+
-+/*
-+ * Coefficients for moving average with noise filter (period=16),
-+ * scaled by 10 bits
-+ *
-+ * a1 = exp(-pi * sqrt(2) / period)
-+ * coeff2 = 2 * a1 * cos(sqrt(2) * 2 * pi / period)
-+ * coeff3 = -sqr(a1)
-+ * coeff1 = 1 - coeff2 - coeff3
-+ */
-+#define MINSTREL_AVG_COEFF1		(MINSTREL_FRAC(1, 1) - \
-+					 MINSTREL_AVG_COEFF2 - \
-+					 MINSTREL_AVG_COEFF3)
-+#define MINSTREL_AVG_COEFF2		0x00001499
-+#define MINSTREL_AVG_COEFF3		-0x0000092e
-+
- /*
-  * The number of streams can be changed to 2 to reduce code
-  * size and memory footprint.
-@@ -30,6 +57,32 @@
- 
- #define MCS_GROUP_RATES		10
- 
-+struct minstrel_priv {
-+	struct ieee80211_hw *hw;
-+	bool has_mrr;
-+	bool new_avg;
-+	u32 sample_switch;
-+	unsigned int cw_min;
-+	unsigned int cw_max;
-+	unsigned int max_retry;
-+	unsigned int segment_size;
-+	unsigned int update_interval;
-+
-+	u8 cck_rates[4];
-+	u8 ofdm_rates[NUM_NL80211_BANDS][8];
-+
-+#ifdef CPTCFG_MAC80211_DEBUGFS
-+	/*
-+	 * enable fixed rate processing per RC
-+	 *   - write static index to debugfs:ieee80211/phyX/rc/fixed_rate_idx
-+	 *   - write -1 to enable RC processing again
-+	 *   - setting will be applied on next update
-+	 */
-+	u32 fixed_rate_idx;
-+#endif
-+};
-+
-+
- struct mcs_group {
- 	u16 flags;
- 	u8 streams;
-@@ -42,6 +95,26 @@ extern const s16 minstrel_cck_bitrates[4
- extern const s16 minstrel_ofdm_bitrates[8];
- extern const struct mcs_group minstrel_mcs_groups[];
- 
-+struct minstrel_rate_stats {
-+	/* current / last sampling period attempts/success counters */
-+	u16 attempts, last_attempts;
-+	u16 success, last_success;
-+
-+	/* total attempts/success counters */
-+	u32 att_hist, succ_hist;
-+
-+	/* prob_avg - moving average of prob */
-+	u16 prob_avg;
-+	u16 prob_avg_1;
-+
-+	/* maximum retry counts */
-+	u8 retry_count;
-+	u8 retry_count_rtscts;
-+
-+	u8 sample_skipped;
-+	bool retry_updated;
-+};
-+
- struct minstrel_mcs_group_data {
- 	u8 index;
- 	u8 column;
-@@ -111,12 +184,6 @@ struct minstrel_ht_sta {
- 	struct minstrel_mcs_group_data groups[MINSTREL_GROUPS_NB];
- };
- 
--struct minstrel_ht_sta_priv {
--	struct minstrel_ht_sta ht;
--	void *ratelist;
--	void *sample_table;
--};
--
- void minstrel_ht_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir);
- int minstrel_ht_get_tp_avg(struct minstrel_ht_sta *mi, int group, int rate,
- 			   int prob_avg);
---- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
-+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
-@@ -9,9 +9,13 @@
- #include <linux/ieee80211.h>
- #include <linux/export.h>
- #include <net/mac80211.h>
--#include "rc80211_minstrel.h"
- #include "rc80211_minstrel_ht.h"
- 
-+struct minstrel_debugfs_info {
-+	size_t len;
-+	char buf[];
-+};
-+
- static ssize_t
- minstrel_stats_read(struct file *file, char __user *buf, size_t len, loff_t *ppos)
- {
-@@ -127,8 +131,7 @@ minstrel_ht_stats_dump(struct minstrel_h
- static int
- minstrel_ht_stats_open(struct inode *inode, struct file *file)
- {
--	struct minstrel_ht_sta_priv *msp = inode->i_private;
--	struct minstrel_ht_sta *mi = &msp->ht;
-+	struct minstrel_ht_sta *mi = inode->i_private;
- 	struct minstrel_debugfs_info *ms;
- 	unsigned int i;
- 	char *p;
-@@ -276,8 +279,7 @@ minstrel_ht_stats_csv_dump(struct minstr
- static int
- minstrel_ht_stats_csv_open(struct inode *inode, struct file *file)
- {
--	struct minstrel_ht_sta_priv *msp = inode->i_private;
--	struct minstrel_ht_sta *mi = &msp->ht;
-+	struct minstrel_ht_sta *mi = inode->i_private;
- 	struct minstrel_debugfs_info *ms;
- 	unsigned int i;
- 	char *p;
-@@ -313,10 +315,8 @@ static const struct file_operations mins
- void
- minstrel_ht_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir)
- {
--	struct minstrel_ht_sta_priv *msp = priv_sta;
--
--	debugfs_create_file("rc_stats", 0444, dir, msp,
-+	debugfs_create_file("rc_stats", 0444, dir, priv_sta,
- 			    &minstrel_ht_stat_fops);
--	debugfs_create_file("rc_stats_csv", 0444, dir, msp,
-+	debugfs_create_file("rc_stats_csv", 0444, dir, priv_sta,
- 			    &minstrel_ht_stat_csv_fops);
- }
diff --git a/package/kernel/mac80211/patches/subsys/340-mac80211-minstrel_ht-remove-old-ewma-based-rate-aver.patch b/package/kernel/mac80211/patches/subsys/340-mac80211-minstrel_ht-remove-old-ewma-based-rate-aver.patch
deleted file mode 100644
index 9b6a614aa..000000000
--- a/package/kernel/mac80211/patches/subsys/340-mac80211-minstrel_ht-remove-old-ewma-based-rate-aver.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 26 Dec 2020 14:34:30 +0100
-Subject: [PATCH] mac80211: minstrel_ht: remove old ewma based rate average
- code
-
-The new noise filter has been the default for a while now with no reported
-downside and significant improvement compared to the old code.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -769,17 +769,8 @@ minstrel_ht_calc_rate_stats(struct minst
- 	if (unlikely(mrs->attempts > 0)) {
- 		mrs->sample_skipped = 0;
- 		cur_prob = MINSTREL_FRAC(mrs->success, mrs->attempts);
--		if (mp->new_avg) {
--			minstrel_filter_avg_add(&mrs->prob_avg,
--						&mrs->prob_avg_1, cur_prob);
--		} else if (unlikely(!mrs->att_hist)) {
--			mrs->prob_avg = cur_prob;
--		} else {
--			/*update exponential weighted moving avarage */
--			mrs->prob_avg = minstrel_ewma(mrs->prob_avg,
--						      cur_prob,
--						      EWMA_LEVEL);
--		}
-+		minstrel_filter_avg_add(&mrs->prob_avg,
-+					&mrs->prob_avg_1, cur_prob);
- 		mrs->att_hist += mrs->attempts;
- 		mrs->succ_hist += mrs->success;
- 	} else {
-@@ -913,10 +904,8 @@ minstrel_ht_update_stats(struct minstrel
- 	/* Try to increase robustness of max_prob_rate*/
- 	minstrel_ht_prob_rate_reduce_streams(mi);
- 
--	/* try to sample all available rates during each interval */
--	mi->sample_count *= 8;
--	if (mp->new_avg)
--		mi->sample_count /= 2;
-+	/* try to sample half of all available rates during each interval */
-+	mi->sample_count *= 4;
- 
- 	if (sample)
- 		minstrel_ht_rate_sample_switch(mp, mi);
-@@ -1040,7 +1029,7 @@ minstrel_ht_tx_status(void *priv, struct
- 	struct ieee80211_tx_rate *ar = info->status.rates;
- 	struct minstrel_rate_stats *rate, *rate2, *rate_sample = NULL;
- 	struct minstrel_priv *mp = priv;
--	u32 update_interval = mp->update_interval / 2;
-+	u32 update_interval = mp->update_interval;
- 	bool last, update = false;
- 	bool sample_status = false;
- 	int i;
-@@ -1090,9 +1079,8 @@ minstrel_ht_tx_status(void *priv, struct
- 
- 	switch (mi->sample_mode) {
- 	case MINSTREL_SAMPLE_IDLE:
--		if (mp->new_avg &&
--		    (mp->hw->max_rates > 1 ||
--		     mi->total_packets_cur < SAMPLE_SWITCH_THR))
-+		if (mp->hw->max_rates > 1 ||
-+		     mi->total_packets_cur < SAMPLE_SWITCH_THR)
- 			update_interval /= 2;
- 		break;
- 
-@@ -1832,8 +1820,7 @@ minstrel_ht_alloc(struct ieee80211_hw *h
- 		mp->has_mrr = true;
- 
- 	mp->hw = hw;
--	mp->update_interval = HZ / 10;
--	mp->new_avg = true;
-+	mp->update_interval = HZ / 20;
- 
- 	minstrel_ht_init_cck_rates(mp);
- 	for (i = 0; i < ARRAY_SIZE(mp->hw->wiphy->bands); i++)
-@@ -1853,8 +1840,6 @@ static void minstrel_ht_add_debugfs(stru
- 			   &mp->fixed_rate_idx);
- 	debugfs_create_u32("sample_switch", S_IRUGO | S_IWUSR, debugfsdir,
- 			   &mp->sample_switch);
--	debugfs_create_bool("new_avg", S_IRUGO | S_IWUSR, debugfsdir,
--			   &mp->new_avg);
- }
- #endif
- 
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -60,7 +60,6 @@
- struct minstrel_priv {
- 	struct ieee80211_hw *hw;
- 	bool has_mrr;
--	bool new_avg;
- 	u32 sample_switch;
- 	unsigned int cw_min;
- 	unsigned int cw_max;
diff --git a/package/kernel/mac80211/patches/subsys/341-mac80211-minstrel_ht-improve-ampdu-length-estimation.patch b/package/kernel/mac80211/patches/subsys/341-mac80211-minstrel_ht-improve-ampdu-length-estimation.patch
deleted file mode 100644
index a8e6e8995..000000000
--- a/package/kernel/mac80211/patches/subsys/341-mac80211-minstrel_ht-improve-ampdu-length-estimation.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 26 Dec 2020 19:08:19 +0100
-Subject: [PATCH] mac80211: minstrel_ht: improve ampdu length estimation
-
-If the driver does not report A-MPDU length, estimate it based on the rate.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -382,13 +382,37 @@ minstrel_get_ratestats(struct minstrel_h
- 	return &mi->groups[index / MCS_GROUP_RATES].rates[index % MCS_GROUP_RATES];
- }
- 
-+static inline int
-+minstrel_get_duration(int index)
-+{
-+	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
-+	unsigned int duration = group->duration[index % MCS_GROUP_RATES];
-+	return duration << group->shift;
-+}
-+
- static unsigned int
- minstrel_ht_avg_ampdu_len(struct minstrel_ht_sta *mi)
- {
--	if (!mi->avg_ampdu_len)
--		return AVG_AMPDU_SIZE;
-+	int duration;
-+
-+	if (mi->avg_ampdu_len)
-+		return MINSTREL_TRUNC(mi->avg_ampdu_len);
-+
-+	if (minstrel_ht_is_legacy_group(mi->max_tp_rate[0] / MCS_GROUP_RATES))
-+		return 1;
-+
-+	duration = minstrel_get_duration(mi->max_tp_rate[0]);
- 
--	return MINSTREL_TRUNC(mi->avg_ampdu_len);
-+	if (duration > 400 * 1000)
-+		return 2;
-+
-+	if (duration > 250 * 1000)
-+		return 4;
-+
-+	if (duration > 150 * 1000)
-+		return 8;
-+
-+	return 16;
- }
- 
- /*
-@@ -588,14 +612,6 @@ minstrel_ht_prob_rate_reduce_streams(str
- 	}
- }
- 
--static inline int
--minstrel_get_duration(int index)
--{
--	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
--	unsigned int duration = group->duration[index % MCS_GROUP_RATES];
--	return duration << group->shift;
--}
--
- static bool
- minstrel_ht_probe_group(struct minstrel_ht_sta *mi, const struct mcs_group *tp_group,
- 						int tp_idx, const struct mcs_group *group)
diff --git a/package/kernel/mac80211/patches/subsys/342-mac80211-minstrel_ht-improve-sample-rate-selection.patch b/package/kernel/mac80211/patches/subsys/342-mac80211-minstrel_ht-improve-sample-rate-selection.patch
deleted file mode 100644
index e08452523..000000000
--- a/package/kernel/mac80211/patches/subsys/342-mac80211-minstrel_ht-improve-sample-rate-selection.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 26 Dec 2020 19:12:22 +0100
-Subject: [PATCH] mac80211: minstrel_ht: improve sample rate selection
-
-Always allow sampling of rates faster than the primary max throughput rate.
-When the second max_tp_rate is higher than the first one, sample attempts were
-previously skipped, potentially causing rate control to get stuck at a slightly
-lower rate
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -1379,13 +1379,13 @@ minstrel_get_sample_rate(struct minstrel
- 	mrs = &mg->rates[sample_idx];
- 	sample_idx += sample_group * MCS_GROUP_RATES;
- 
--	/* Set tp_rate1, tp_rate2 to the highest / second highest max_tp_rate */
-+	tp_rate1 = mi->max_tp_rate[0];
-+
-+	/* Set tp_rate2 to the second highest max_tp_rate */
- 	if (minstrel_get_duration(mi->max_tp_rate[0]) >
- 	    minstrel_get_duration(mi->max_tp_rate[1])) {
--		tp_rate1 = mi->max_tp_rate[1];
- 		tp_rate2 = mi->max_tp_rate[0];
- 	} else {
--		tp_rate1 = mi->max_tp_rate[0];
- 		tp_rate2 = mi->max_tp_rate[1];
- 	}
- 
diff --git a/package/kernel/mac80211/patches/subsys/343-mac80211-minstrel_ht-fix-max-probability-rate-select.patch b/package/kernel/mac80211/patches/subsys/343-mac80211-minstrel_ht-fix-max-probability-rate-select.patch
deleted file mode 100644
index 0dbfa9d4f..000000000
--- a/package/kernel/mac80211/patches/subsys/343-mac80211-minstrel_ht-fix-max-probability-rate-select.patch
+++ /dev/null
@@ -1,124 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 26 Dec 2020 19:09:08 +0100
-Subject: [PATCH] mac80211: minstrel_ht: fix max probability rate selection
-
-- do not select rates faster than the max throughput rate if probability is lower
-- reset previous rate before sorting again
-
-This ensures that the max prob rate gets set to a more reliable rate
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -495,12 +495,13 @@ minstrel_ht_sort_best_tp_rates(struct mi
-  * Find and set the topmost probability rate per sta and per group
-  */
- static void
--minstrel_ht_set_best_prob_rate(struct minstrel_ht_sta *mi, u16 index)
-+minstrel_ht_set_best_prob_rate(struct minstrel_ht_sta *mi, u16 *dest, u16 index)
- {
- 	struct minstrel_mcs_group_data *mg;
- 	struct minstrel_rate_stats *mrs;
- 	int tmp_group, tmp_idx, tmp_tp_avg, tmp_prob;
--	int max_tp_group, cur_tp_avg, cur_group, cur_idx;
-+	int max_tp_group, max_tp_idx, max_tp_prob;
-+	int cur_tp_avg, cur_group, cur_idx;
- 	int max_gpr_group, max_gpr_idx;
- 	int max_gpr_tp_avg, max_gpr_prob;
- 
-@@ -509,18 +510,26 @@ minstrel_ht_set_best_prob_rate(struct mi
- 	mg = &mi->groups[index / MCS_GROUP_RATES];
- 	mrs = &mg->rates[index % MCS_GROUP_RATES];
- 
--	tmp_group = mi->max_prob_rate / MCS_GROUP_RATES;
--	tmp_idx = mi->max_prob_rate % MCS_GROUP_RATES;
-+	tmp_group = *dest / MCS_GROUP_RATES;
-+	tmp_idx = *dest % MCS_GROUP_RATES;
- 	tmp_prob = mi->groups[tmp_group].rates[tmp_idx].prob_avg;
- 	tmp_tp_avg = minstrel_ht_get_tp_avg(mi, tmp_group, tmp_idx, tmp_prob);
- 
- 	/* if max_tp_rate[0] is from MCS_GROUP max_prob_rate get selected from
- 	 * MCS_GROUP as well as CCK_GROUP rates do not allow aggregation */
- 	max_tp_group = mi->max_tp_rate[0] / MCS_GROUP_RATES;
-+	max_tp_idx = mi->max_tp_rate[0] % MCS_GROUP_RATES;
-+	max_tp_prob = mi->groups[max_tp_group].rates[max_tp_idx].prob_avg;
-+
- 	if (minstrel_ht_is_legacy_group(index / MCS_GROUP_RATES) &&
- 	    !minstrel_ht_is_legacy_group(max_tp_group))
- 		return;
- 
-+	/* skip rates faster than max tp rate with lower prob */
-+	if (minstrel_get_duration(mi->max_tp_rate[0]) > minstrel_get_duration(index) &&
-+	    mrs->prob_avg < max_tp_prob)
-+		return;
-+
- 	max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
- 	max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
- 	max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_avg;
-@@ -538,7 +547,7 @@ minstrel_ht_set_best_prob_rate(struct mi
- 			mg->max_group_prob_rate = index;
- 	} else {
- 		if (mrs->prob_avg > tmp_prob)
--			mi->max_prob_rate = index;
-+			*dest = index;
- 		if (mrs->prob_avg > max_gpr_prob)
- 			mg->max_group_prob_rate = index;
- 	}
-@@ -816,7 +825,8 @@ minstrel_ht_update_stats(struct minstrel
- 	struct minstrel_rate_stats *mrs;
- 	int group, i, j, cur_prob;
- 	u16 tmp_mcs_tp_rate[MAX_THR_RATES], tmp_group_tp_rate[MAX_THR_RATES];
--	u16 tmp_legacy_tp_rate[MAX_THR_RATES], index;
-+	u16 tmp_legacy_tp_rate[MAX_THR_RATES], tmp_max_prob_rate;
-+	u16 index;
- 	bool ht_supported = mi->sta->ht_cap.ht_supported;
- 
- 	mi->sample_mode = MINSTREL_SAMPLE_IDLE;
-@@ -863,6 +873,7 @@ minstrel_ht_update_stats(struct minstrel
- 	else
- 		index = MINSTREL_OFDM_GROUP * MCS_GROUP_RATES;
- 
-+	tmp_max_prob_rate = index;
- 	for (j = 0; j < ARRAY_SIZE(tmp_mcs_tp_rate); j++)
- 		tmp_mcs_tp_rate[j] = index;
- 
-@@ -903,9 +914,6 @@ minstrel_ht_update_stats(struct minstrel
- 			/* Find max throughput rate set within a group */
- 			minstrel_ht_sort_best_tp_rates(mi, index,
- 						       tmp_group_tp_rate);
--
--			/* Find max probability rate per group and global */
--			minstrel_ht_set_best_prob_rate(mi, index);
- 		}
- 
- 		memcpy(mg->max_group_tp_rate, tmp_group_tp_rate,
-@@ -917,6 +925,27 @@ minstrel_ht_update_stats(struct minstrel
- 					 tmp_legacy_tp_rate);
- 	memcpy(mi->max_tp_rate, tmp_mcs_tp_rate, sizeof(mi->max_tp_rate));
- 
-+	for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
-+		if (!mi->supported[group])
-+			continue;
-+
-+		mg = &mi->groups[group];
-+		mg->max_group_prob_rate = MCS_GROUP_RATES * group;
-+
-+		for (i = 0; i < MCS_GROUP_RATES; i++) {
-+			if (!(mi->supported[group] & BIT(i)))
-+				continue;
-+
-+			index = MCS_GROUP_RATES * group + i;
-+
-+			/* Find max probability rate per group and global */
-+			minstrel_ht_set_best_prob_rate(mi, &tmp_max_prob_rate,
-+						       index);
-+		}
-+	}
-+
-+	mi->max_prob_rate = tmp_max_prob_rate;
-+
- 	/* Try to increase robustness of max_prob_rate*/
- 	minstrel_ht_prob_rate_reduce_streams(mi);
- 
diff --git a/package/kernel/mac80211/patches/subsys/344-mac80211-minstrel_ht-increase-stats-update-interval.patch b/package/kernel/mac80211/patches/subsys/344-mac80211-minstrel_ht-increase-stats-update-interval.patch
deleted file mode 100644
index 9972a9414..000000000
--- a/package/kernel/mac80211/patches/subsys/344-mac80211-minstrel_ht-increase-stats-update-interval.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 26 Dec 2020 19:14:58 +0100
-Subject: [PATCH] mac80211: minstrel_ht: increase stats update interval
-
-The shorter interval was leading to too many frames being used for probing
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -1865,7 +1865,7 @@ minstrel_ht_alloc(struct ieee80211_hw *h
- 		mp->has_mrr = true;
- 
- 	mp->hw = hw;
--	mp->update_interval = HZ / 20;
-+	mp->update_interval = HZ / 10;
- 
- 	minstrel_ht_init_cck_rates(mp);
- 	for (i = 0; i < ARRAY_SIZE(mp->hw->wiphy->bands); i++)
diff --git a/package/kernel/mac80211/patches/subsys/345-mac80211-minstrel_ht-fix-rounding-error-in-throughpu.patch b/package/kernel/mac80211/patches/subsys/345-mac80211-minstrel_ht-fix-rounding-error-in-throughpu.patch
deleted file mode 100644
index 1df5dec03..000000000
--- a/package/kernel/mac80211/patches/subsys/345-mac80211-minstrel_ht-fix-rounding-error-in-throughpu.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 15 Jan 2021 12:15:06 +0100
-Subject: [PATCH] mac80211: minstrel_ht: fix rounding error in throughput
- calculation
-
-On lower data rates, the throughput calculation has a significant rounding
-error, causing rates like 48M and 54M OFDM to share the same throughput
-value with >= 90% success probablity.
-
-This is because the result of the division (prob_avg * 1000) / nsecs
-is really small (8 in this example).
-
-Improve accuracy by moving over some zeroes, making better use of the full
-range of u32 before the division.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -445,10 +445,9 @@ minstrel_ht_get_tp_avg(struct minstrel_h
- 	 * (prob is scaled - see MINSTREL_FRAC above)
- 	 */
- 	if (prob_avg > MINSTREL_FRAC(90, 100))
--		return MINSTREL_TRUNC(100000 * ((MINSTREL_FRAC(90, 100) * 1000)
--								      / nsecs));
--	else
--		return MINSTREL_TRUNC(100000 * ((prob_avg * 1000) / nsecs));
-+		prob_avg = MINSTREL_FRAC(90, 100);
-+
-+	return MINSTREL_TRUNC(100 * ((prob_avg * 1000000) / nsecs));
- }
- 
- /*
diff --git a/package/kernel/mac80211/patches/subsys/346-mac80211-minstrel_ht-use-bitfields-to-encode-rate-in.patch b/package/kernel/mac80211/patches/subsys/346-mac80211-minstrel_ht-use-bitfields-to-encode-rate-in.patch
deleted file mode 100644
index 6aa6f0ed9..000000000
--- a/package/kernel/mac80211/patches/subsys/346-mac80211-minstrel_ht-use-bitfields-to-encode-rate-in.patch
+++ /dev/null
@@ -1,412 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Thu, 21 Jan 2021 18:29:30 +0100
-Subject: [PATCH] mac80211: minstrel_ht: use bitfields to encode rate
- indexes
-
-Get rid of a lot of divisions and modulo operations
-Reduces code size and improves performance
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -379,14 +379,14 @@ out:
- static inline struct minstrel_rate_stats *
- minstrel_get_ratestats(struct minstrel_ht_sta *mi, int index)
- {
--	return &mi->groups[index / MCS_GROUP_RATES].rates[index % MCS_GROUP_RATES];
-+	return &mi->groups[MI_RATE_GROUP(index)].rates[MI_RATE_IDX(index)];
- }
- 
--static inline int
--minstrel_get_duration(int index)
-+static inline int minstrel_get_duration(int index)
- {
--	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
--	unsigned int duration = group->duration[index % MCS_GROUP_RATES];
-+	const struct mcs_group *group = &minstrel_mcs_groups[MI_RATE_GROUP(index)];
-+	unsigned int duration = group->duration[MI_RATE_IDX(index)];
-+
- 	return duration << group->shift;
- }
- 
-@@ -398,7 +398,7 @@ minstrel_ht_avg_ampdu_len(struct minstre
- 	if (mi->avg_ampdu_len)
- 		return MINSTREL_TRUNC(mi->avg_ampdu_len);
- 
--	if (minstrel_ht_is_legacy_group(mi->max_tp_rate[0] / MCS_GROUP_RATES))
-+	if (minstrel_ht_is_legacy_group(MI_RATE_GROUP(mi->max_tp_rate[0])))
- 		return 1;
- 
- 	duration = minstrel_get_duration(mi->max_tp_rate[0]);
-@@ -465,14 +465,14 @@ minstrel_ht_sort_best_tp_rates(struct mi
- 	int tmp_group, tmp_idx, tmp_tp_avg, tmp_prob;
- 	int j = MAX_THR_RATES;
- 
--	cur_group = index / MCS_GROUP_RATES;
--	cur_idx = index  % MCS_GROUP_RATES;
-+	cur_group = MI_RATE_GROUP(index);
-+	cur_idx = MI_RATE_IDX(index);
- 	cur_prob = mi->groups[cur_group].rates[cur_idx].prob_avg;
- 	cur_tp_avg = minstrel_ht_get_tp_avg(mi, cur_group, cur_idx, cur_prob);
- 
- 	do {
--		tmp_group = tp_list[j - 1] / MCS_GROUP_RATES;
--		tmp_idx = tp_list[j - 1] % MCS_GROUP_RATES;
-+		tmp_group = MI_RATE_GROUP(tp_list[j - 1]);
-+		tmp_idx = MI_RATE_IDX(tp_list[j - 1]);
- 		tmp_prob = mi->groups[tmp_group].rates[tmp_idx].prob_avg;
- 		tmp_tp_avg = minstrel_ht_get_tp_avg(mi, tmp_group, tmp_idx,
- 						    tmp_prob);
-@@ -504,23 +504,23 @@ minstrel_ht_set_best_prob_rate(struct mi
- 	int max_gpr_group, max_gpr_idx;
- 	int max_gpr_tp_avg, max_gpr_prob;
- 
--	cur_group = index / MCS_GROUP_RATES;
--	cur_idx = index % MCS_GROUP_RATES;
--	mg = &mi->groups[index / MCS_GROUP_RATES];
--	mrs = &mg->rates[index % MCS_GROUP_RATES];
-+	cur_group = MI_RATE_GROUP(index);
-+	cur_idx = MI_RATE_IDX(index);
-+	mg = &mi->groups[cur_group];
-+	mrs = &mg->rates[cur_idx];
- 
--	tmp_group = *dest / MCS_GROUP_RATES;
--	tmp_idx = *dest % MCS_GROUP_RATES;
-+	tmp_group = MI_RATE_GROUP(*dest);
-+	tmp_idx = MI_RATE_IDX(*dest);
- 	tmp_prob = mi->groups[tmp_group].rates[tmp_idx].prob_avg;
- 	tmp_tp_avg = minstrel_ht_get_tp_avg(mi, tmp_group, tmp_idx, tmp_prob);
- 
- 	/* if max_tp_rate[0] is from MCS_GROUP max_prob_rate get selected from
- 	 * MCS_GROUP as well as CCK_GROUP rates do not allow aggregation */
--	max_tp_group = mi->max_tp_rate[0] / MCS_GROUP_RATES;
--	max_tp_idx = mi->max_tp_rate[0] % MCS_GROUP_RATES;
-+	max_tp_group = MI_RATE_GROUP(mi->max_tp_rate[0]);
-+	max_tp_idx = MI_RATE_IDX(mi->max_tp_rate[0]);
- 	max_tp_prob = mi->groups[max_tp_group].rates[max_tp_idx].prob_avg;
- 
--	if (minstrel_ht_is_legacy_group(index / MCS_GROUP_RATES) &&
-+	if (minstrel_ht_is_legacy_group(MI_RATE_GROUP(index)) &&
- 	    !minstrel_ht_is_legacy_group(max_tp_group))
- 		return;
- 
-@@ -529,8 +529,8 @@ minstrel_ht_set_best_prob_rate(struct mi
- 	    mrs->prob_avg < max_tp_prob)
- 		return;
- 
--	max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
--	max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
-+	max_gpr_group = MI_RATE_GROUP(mg->max_group_prob_rate);
-+	max_gpr_idx = MI_RATE_IDX(mg->max_group_prob_rate);
- 	max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_avg;
- 
- 	if (mrs->prob_avg > MINSTREL_FRAC(75, 100)) {
-@@ -567,13 +567,13 @@ minstrel_ht_assign_best_tp_rates(struct
- 	unsigned int tmp_group, tmp_idx, tmp_cck_tp, tmp_mcs_tp, tmp_prob;
- 	int i;
- 
--	tmp_group = tmp_legacy_tp_rate[0] / MCS_GROUP_RATES;
--	tmp_idx = tmp_legacy_tp_rate[0] % MCS_GROUP_RATES;
-+	tmp_group = MI_RATE_GROUP(tmp_legacy_tp_rate[0]);
-+	tmp_idx = MI_RATE_IDX(tmp_legacy_tp_rate[0]);
- 	tmp_prob = mi->groups[tmp_group].rates[tmp_idx].prob_avg;
- 	tmp_cck_tp = minstrel_ht_get_tp_avg(mi, tmp_group, tmp_idx, tmp_prob);
- 
--	tmp_group = tmp_mcs_tp_rate[0] / MCS_GROUP_RATES;
--	tmp_idx = tmp_mcs_tp_rate[0] % MCS_GROUP_RATES;
-+	tmp_group = MI_RATE_GROUP(tmp_mcs_tp_rate[0]);
-+	tmp_idx = MI_RATE_IDX(tmp_mcs_tp_rate[0]);
- 	tmp_prob = mi->groups[tmp_group].rates[tmp_idx].prob_avg;
- 	tmp_mcs_tp = minstrel_ht_get_tp_avg(mi, tmp_group, tmp_idx, tmp_prob);
- 
-@@ -600,14 +600,14 @@ minstrel_ht_prob_rate_reduce_streams(str
- 	if (!mi->sta->ht_cap.ht_supported)
- 		return;
- 
--	tmp_max_streams = minstrel_mcs_groups[mi->max_tp_rate[0] /
--			  MCS_GROUP_RATES].streams;
-+	group = MI_RATE_GROUP(mi->max_tp_rate[0]);
-+	tmp_max_streams = minstrel_mcs_groups[group].streams;
- 	for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
- 		mg = &mi->groups[group];
- 		if (!mi->supported[group] || group == MINSTREL_CCK_GROUP)
- 			continue;
- 
--		tmp_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
-+		tmp_idx = MI_RATE_IDX(mg->max_group_prob_rate);
- 		tmp_prob = mi->groups[group].rates[tmp_idx].prob_avg;
- 
- 		if (tmp_tp < minstrel_ht_get_tp_avg(mi, group, tmp_idx, tmp_prob) &&
-@@ -644,8 +644,8 @@ minstrel_ht_find_probe_rates(struct mins
- 	int i, g, max_dur;
- 	int tp_idx;
- 
--	tp_group = &minstrel_mcs_groups[mi->max_tp_rate[0] / MCS_GROUP_RATES];
--	tp_idx = mi->max_tp_rate[0] % MCS_GROUP_RATES;
-+	tp_group = &minstrel_mcs_groups[MI_RATE_GROUP(mi->max_tp_rate[0])];
-+	tp_idx = MI_RATE_IDX(mi->max_tp_rate[0]);
- 
- 	max_dur = minstrel_get_duration(mi->max_tp_rate[0]);
- 	if (faster_rate)
-@@ -670,7 +670,7 @@ minstrel_ht_find_probe_rates(struct mins
- 			if ((group->duration[i] << group->shift) > max_dur)
- 				continue;
- 
--			idx = g * MCS_GROUP_RATES + i;
-+			idx = MI_RATE(g, i);
- 			if (idx == mi->max_tp_rate[0])
- 				continue;
- 
-@@ -712,10 +712,10 @@ minstrel_ht_rate_sample_switch(struct mi
- 
- 	/* If no suitable rate was found, try to pick the next one in the group */
- 	if (!n_rates) {
--		int g_idx = mi->max_tp_rate[0] / MCS_GROUP_RATES;
-+		int g_idx = MI_RATE_GROUP(mi->max_tp_rate[0]);
- 		u16 supported = mi->supported[g_idx];
- 
--		supported >>= mi->max_tp_rate[0] % MCS_GROUP_RATES;
-+		supported >>= MI_RATE_IDX(mi->max_tp_rate[0]);
- 		for (i = 0; supported; supported >>= 1, i++) {
- 			if (!(supported & 1))
- 				continue;
-@@ -854,24 +854,27 @@ minstrel_ht_update_stats(struct minstrel
- 	mi->sample_slow = 0;
- 	mi->sample_count = 0;
- 
--	memset(tmp_mcs_tp_rate, 0, sizeof(tmp_mcs_tp_rate));
--	memset(tmp_legacy_tp_rate, 0, sizeof(tmp_legacy_tp_rate));
- 	if (mi->supported[MINSTREL_CCK_GROUP])
--		for (j = 0; j < ARRAY_SIZE(tmp_legacy_tp_rate); j++)
--			tmp_legacy_tp_rate[j] = MINSTREL_CCK_GROUP * MCS_GROUP_RATES;
-+		group = MINSTREL_CCK_GROUP;
- 	else if (mi->supported[MINSTREL_OFDM_GROUP])
--		for (j = 0; j < ARRAY_SIZE(tmp_legacy_tp_rate); j++)
--			tmp_legacy_tp_rate[j] = MINSTREL_OFDM_GROUP * MCS_GROUP_RATES;
-+		group = MINSTREL_OFDM_GROUP;
-+	else
-+		group = 0;
-+
-+	index = MI_RATE(group, 0);
-+	for (j = 0; j < ARRAY_SIZE(tmp_legacy_tp_rate); j++)
-+		tmp_legacy_tp_rate[j] = index;
- 
- 	if (mi->supported[MINSTREL_VHT_GROUP_0])
--		index = MINSTREL_VHT_GROUP_0 * MCS_GROUP_RATES;
-+		group = MINSTREL_VHT_GROUP_0;
- 	else if (ht_supported)
--		index = MINSTREL_HT_GROUP_0 * MCS_GROUP_RATES;
-+		group = MINSTREL_HT_GROUP_0;
- 	else if (mi->supported[MINSTREL_CCK_GROUP])
--		index = MINSTREL_CCK_GROUP * MCS_GROUP_RATES;
-+		group = MINSTREL_CCK_GROUP;
- 	else
--		index = MINSTREL_OFDM_GROUP * MCS_GROUP_RATES;
-+		group = MINSTREL_OFDM_GROUP;
- 
-+	index = MI_RATE(group, 0);
- 	tmp_max_prob_rate = index;
- 	for (j = 0; j < ARRAY_SIZE(tmp_mcs_tp_rate); j++)
- 		tmp_mcs_tp_rate[j] = index;
-@@ -888,7 +891,7 @@ minstrel_ht_update_stats(struct minstrel
- 
- 		/* (re)Initialize group rate indexes */
- 		for(j = 0; j < MAX_THR_RATES; j++)
--			tmp_group_tp_rate[j] = MCS_GROUP_RATES * group;
-+			tmp_group_tp_rate[j] = MI_RATE(group, 0);
- 
- 		if (group == MINSTREL_CCK_GROUP && ht_supported)
- 			tp_rate = tmp_legacy_tp_rate;
-@@ -897,7 +900,7 @@ minstrel_ht_update_stats(struct minstrel
- 			if (!(mi->supported[group] & BIT(i)))
- 				continue;
- 
--			index = MCS_GROUP_RATES * group + i;
-+			index = MI_RATE(group, i);
- 
- 			mrs = &mg->rates[i];
- 			mrs->retry_updated = false;
-@@ -929,13 +932,13 @@ minstrel_ht_update_stats(struct minstrel
- 			continue;
- 
- 		mg = &mi->groups[group];
--		mg->max_group_prob_rate = MCS_GROUP_RATES * group;
-+		mg->max_group_prob_rate = MI_RATE(group, 0);
- 
- 		for (i = 0; i < MCS_GROUP_RATES; i++) {
- 			if (!(mi->supported[group] & BIT(i)))
- 				continue;
- 
--			index = MCS_GROUP_RATES * group + i;
-+			index = MI_RATE(group, i);
- 
- 			/* Find max probability rate per group and global */
- 			minstrel_ht_set_best_prob_rate(mi, &tmp_max_prob_rate,
-@@ -1022,7 +1025,7 @@ minstrel_downgrade_rate(struct minstrel_
- {
- 	int group, orig_group;
- 
--	orig_group = group = *idx / MCS_GROUP_RATES;
-+	orig_group = group = MI_RATE_GROUP(*idx);
- 	while (group > 0) {
- 		group--;
- 
-@@ -1206,7 +1209,7 @@ minstrel_calc_retransmit(struct minstrel
- 	ctime += (t_slot * cw) >> 1;
- 	cw = min((cw << 1) | 1, mp->cw_max);
- 
--	if (minstrel_ht_is_legacy_group(index / MCS_GROUP_RATES)) {
-+	if (minstrel_ht_is_legacy_group(MI_RATE_GROUP(index))) {
- 		overhead = mi->overhead_legacy;
- 		overhead_rtscts = mi->overhead_legacy_rtscts;
- 	} else {
-@@ -1239,7 +1242,7 @@ static void
- minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
-                      struct ieee80211_sta_rates *ratetbl, int offset, int index)
- {
--	int group_idx = index / MCS_GROUP_RATES;
-+	int group_idx = MI_RATE_GROUP(index);
- 	const struct mcs_group *group = &minstrel_mcs_groups[group_idx];
- 	struct minstrel_rate_stats *mrs;
- 	u8 idx;
-@@ -1259,7 +1262,7 @@ minstrel_ht_set_rate(struct minstrel_pri
- 		ratetbl->rate[offset].count_rts = mrs->retry_count_rtscts;
- 	}
- 
--	index %= MCS_GROUP_RATES;
-+	index = MI_RATE_IDX(index);
- 	if (group_idx == MINSTREL_CCK_GROUP)
- 		idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
- 	else if (group_idx == MINSTREL_OFDM_GROUP)
-@@ -1289,17 +1292,17 @@ minstrel_ht_set_rate(struct minstrel_pri
- static inline int
- minstrel_ht_get_prob_avg(struct minstrel_ht_sta *mi, int rate)
- {
--	int group = rate / MCS_GROUP_RATES;
--	rate %= MCS_GROUP_RATES;
-+	int group = MI_RATE_GROUP(rate);
-+	rate = MI_RATE_IDX(rate);
- 	return mi->groups[group].rates[rate].prob_avg;
- }
- 
- static int
- minstrel_ht_get_max_amsdu_len(struct minstrel_ht_sta *mi)
- {
--	int group = mi->max_prob_rate / MCS_GROUP_RATES;
-+	int group = MI_RATE_GROUP(mi->max_prob_rate);
- 	const struct mcs_group *g = &minstrel_mcs_groups[group];
--	int rate = mi->max_prob_rate % MCS_GROUP_RATES;
-+	int rate = MI_RATE_IDX(mi->max_prob_rate);
- 	unsigned int duration;
- 
- 	/* Disable A-MSDU if max_prob_rate is bad */
-@@ -1405,7 +1408,7 @@ minstrel_get_sample_rate(struct minstrel
- 		return -1;
- 
- 	mrs = &mg->rates[sample_idx];
--	sample_idx += sample_group * MCS_GROUP_RATES;
-+	sample_idx += MI_RATE(sample_group, 0);
- 
- 	tp_rate1 = mi->max_tp_rate[0];
- 
-@@ -1455,8 +1458,7 @@ minstrel_get_sample_rate(struct minstrel
- 	 * if the link is working perfectly.
- 	 */
- 
--	cur_max_tp_streams = minstrel_mcs_groups[tp_rate1 /
--		MCS_GROUP_RATES].streams;
-+	cur_max_tp_streams = minstrel_mcs_groups[MI_RATE_GROUP(tp_rate1)].streams;
- 	if (sample_dur >= minstrel_get_duration(tp_rate2) &&
- 	    (cur_max_tp_streams - 1 <
- 	     minstrel_mcs_groups[sample_group].streams ||
-@@ -1484,7 +1486,7 @@ minstrel_ht_get_rate(void *priv, struct
- 	int sample_idx;
- 
- 	if (!(info->flags & IEEE80211_TX_CTL_AMPDU) &&
--	    !minstrel_ht_is_legacy_group(mi->max_prob_rate / MCS_GROUP_RATES))
-+	    !minstrel_ht_is_legacy_group(MI_RATE_GROUP(mi->max_prob_rate)))
- 		minstrel_aggr_check(sta, txrc->skb);
- 
- 	info->flags |= mi->tx_flags;
-@@ -1512,8 +1514,8 @@ minstrel_ht_get_rate(void *priv, struct
- 	if (sample_idx < 0)
- 		return;
- 
--	sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
--	sample_idx %= MCS_GROUP_RATES;
-+	sample_group = &minstrel_mcs_groups[MI_RATE_GROUP(sample_idx)];
-+	sample_idx = MI_RATE_IDX(sample_idx);
- 
- 	if (sample_group == &minstrel_mcs_groups[MINSTREL_CCK_GROUP] &&
- 	    (sample_idx >= 4) != txrc->short_preamble)
-@@ -1529,7 +1531,7 @@ minstrel_ht_get_rate(void *priv, struct
- 		int idx = sample_idx % ARRAY_SIZE(mp->ofdm_rates[0]);
- 		rate->idx = mp->ofdm_rates[mi->band][idx];
- 	} else if (sample_group->flags & IEEE80211_TX_RC_VHT_MCS) {
--		ieee80211_rate_set_vht(rate, sample_idx % MCS_GROUP_RATES,
-+		ieee80211_rate_set_vht(rate, MI_RATE_IDX(sample_idx),
- 				       sample_group->streams);
- 	} else {
- 		rate->idx = sample_idx + (sample_group->streams - 1) * 8;
-@@ -1898,8 +1900,8 @@ static u32 minstrel_ht_get_expected_thro
- 	struct minstrel_ht_sta *mi = priv_sta;
- 	int i, j, prob, tp_avg;
- 
--	i = mi->max_tp_rate[0] / MCS_GROUP_RATES;
--	j = mi->max_tp_rate[0] % MCS_GROUP_RATES;
-+	i = MI_RATE_GROUP(mi->max_tp_rate[0]);
-+	j = MI_RATE_IDX(mi->max_tp_rate[0]);
- 	prob = mi->groups[i].rates[j].prob_avg;
- 
- 	/* convert tp_avg from pkt per second in kbps */
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -6,6 +6,8 @@
- #ifndef __RC_MINSTREL_HT_H
- #define __RC_MINSTREL_HT_H
- 
-+#include <linux/bitfield.h>
-+
- /* number of highest throughput rates to consider*/
- #define MAX_THR_RATES 4
- #define SAMPLE_COLUMNS	10	/* number of columns in sample table */
-@@ -57,6 +59,17 @@
- 
- #define MCS_GROUP_RATES		10
- 
-+#define MI_RATE_IDX_MASK	GENMASK(3, 0)
-+#define MI_RATE_GROUP_MASK	GENMASK(15, 4)
-+
-+#define MI_RATE(_group, _idx)				\
-+	(FIELD_PREP(MI_RATE_GROUP_MASK, _group) |	\
-+	 FIELD_PREP(MI_RATE_IDX_MASK, _idx))
-+
-+#define MI_RATE_IDX(_rate) FIELD_GET(MI_RATE_IDX_MASK, _rate)
-+#define MI_RATE_GROUP(_rate) FIELD_GET(MI_RATE_GROUP_MASK, _rate)
-+
-+
- struct minstrel_priv {
- 	struct ieee80211_hw *hw;
- 	bool has_mrr;
---- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
-+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
-@@ -56,7 +56,7 @@ minstrel_ht_stats_dump(struct minstrel_h
- 
- 	for (j = 0; j < MCS_GROUP_RATES; j++) {
- 		struct minstrel_rate_stats *mrs = &mi->groups[i].rates[j];
--		int idx = i * MCS_GROUP_RATES + j;
-+		int idx = MI_RATE(i, j);
- 		unsigned int duration;
- 
- 		if (!(mi->supported[i] & BIT(j)))
-@@ -201,7 +201,7 @@ minstrel_ht_stats_csv_dump(struct minstr
- 
- 	for (j = 0; j < MCS_GROUP_RATES; j++) {
- 		struct minstrel_rate_stats *mrs = &mi->groups[i].rates[j];
--		int idx = i * MCS_GROUP_RATES + j;
-+		int idx = MI_RATE(i, j);
- 		unsigned int duration;
- 
- 		if (!(mi->supported[i] & BIT(j)))
diff --git a/package/kernel/mac80211/patches/subsys/347-mac80211-minstrel_ht-update-total-packets-counter-in.patch b/package/kernel/mac80211/patches/subsys/347-mac80211-minstrel_ht-update-total-packets-counter-in.patch
deleted file mode 100644
index dce810493..000000000
--- a/package/kernel/mac80211/patches/subsys/347-mac80211-minstrel_ht-update-total-packets-counter-in.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 22 Jan 2021 18:21:13 +0100
-Subject: [PATCH] mac80211: minstrel_ht: update total packets counter in tx
- status path
-
-Keep the update in one place and prepare for further rework
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -1092,6 +1092,16 @@ minstrel_ht_tx_status(void *priv, struct
- 		info->status.ampdu_len = 1;
- 	}
- 
-+	/* wraparound */
-+	if (mi->total_packets >= ~0 - info->status.ampdu_len) {
-+		mi->total_packets = 0;
-+		mi->sample_packets = 0;
-+	}
-+
-+	mi->total_packets += info->status.ampdu_len;
-+	if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
-+		mi->sample_packets += info->status.ampdu_len;
-+
- 	mi->ampdu_packets++;
- 	mi->ampdu_len += info->status.ampdu_len;
- 
-@@ -1103,9 +1113,6 @@ minstrel_ht_tx_status(void *priv, struct
- 		mi->sample_count--;
- 	}
- 
--	if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
--		mi->sample_packets += info->status.ampdu_len;
--
- 	if (mi->sample_mode != MINSTREL_SAMPLE_IDLE)
- 		rate_sample = minstrel_get_ratestats(mi, mi->sample_rate);
- 
-@@ -1503,14 +1510,6 @@ minstrel_ht_get_rate(void *priv, struct
- 	else
- 		sample_idx = minstrel_get_sample_rate(mp, mi);
- 
--	mi->total_packets++;
--
--	/* wraparound */
--	if (mi->total_packets == ~0) {
--		mi->total_packets = 0;
--		mi->sample_packets = 0;
--	}
--
- 	if (sample_idx < 0)
- 		return;
- 
diff --git a/package/kernel/mac80211/patches/subsys/348-mac80211-minstrel_ht-reduce-the-need-to-sample-slowe.patch b/package/kernel/mac80211/patches/subsys/348-mac80211-minstrel_ht-reduce-the-need-to-sample-slowe.patch
deleted file mode 100644
index dc6f11e4b..000000000
--- a/package/kernel/mac80211/patches/subsys/348-mac80211-minstrel_ht-reduce-the-need-to-sample-slowe.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 22 Jan 2021 19:24:59 +0100
-Subject: [PATCH] mac80211: minstrel_ht: reduce the need to sample slower
- rates
-
-In order to more gracefully be able to fall back to lower rates without too
-much throughput fluctuations, initialize all untested rates below tested ones
-to the maximum probabilty of higher rates.
-Usually this leads to untested lower rates getting initialized with a
-probability value of 100%, making them better candidates for fallback without
-having to rely on random probing
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -791,14 +791,11 @@ minstrel_ht_calc_rate_stats(struct minst
- 	unsigned int cur_prob;
- 
- 	if (unlikely(mrs->attempts > 0)) {
--		mrs->sample_skipped = 0;
- 		cur_prob = MINSTREL_FRAC(mrs->success, mrs->attempts);
- 		minstrel_filter_avg_add(&mrs->prob_avg,
- 					&mrs->prob_avg_1, cur_prob);
- 		mrs->att_hist += mrs->attempts;
- 		mrs->succ_hist += mrs->success;
--	} else {
--		mrs->sample_skipped++;
- 	}
- 
- 	mrs->last_success = mrs->success;
-@@ -851,7 +848,6 @@ minstrel_ht_update_stats(struct minstrel
- 		mi->ampdu_packets = 0;
- 	}
- 
--	mi->sample_slow = 0;
- 	mi->sample_count = 0;
- 
- 	if (mi->supported[MINSTREL_CCK_GROUP])
-@@ -882,6 +878,7 @@ minstrel_ht_update_stats(struct minstrel
- 	/* Find best rate sets within all MCS groups*/
- 	for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
- 		u16 *tp_rate = tmp_mcs_tp_rate;
-+		u16 last_prob = 0;
- 
- 		mg = &mi->groups[group];
- 		if (!mi->supported[group])
-@@ -896,7 +893,7 @@ minstrel_ht_update_stats(struct minstrel
- 		if (group == MINSTREL_CCK_GROUP && ht_supported)
- 			tp_rate = tmp_legacy_tp_rate;
- 
--		for (i = 0; i < MCS_GROUP_RATES; i++) {
-+		for (i = MCS_GROUP_RATES - 1; i >= 0; i--) {
- 			if (!(mi->supported[group] & BIT(i)))
- 				continue;
- 
-@@ -905,6 +902,11 @@ minstrel_ht_update_stats(struct minstrel
- 			mrs = &mg->rates[i];
- 			mrs->retry_updated = false;
- 			minstrel_ht_calc_rate_stats(mp, mrs);
-+
-+			if (mrs->att_hist)
-+				last_prob = max(last_prob, mrs->prob_avg);
-+			else
-+				mrs->prob_avg = max(last_prob, mrs->prob_avg);
- 			cur_prob = mrs->prob_avg;
- 
- 			if (minstrel_ht_get_tp_avg(mi, group, i, cur_prob) == 0)
-@@ -1469,13 +1471,9 @@ minstrel_get_sample_rate(struct minstrel
- 	if (sample_dur >= minstrel_get_duration(tp_rate2) &&
- 	    (cur_max_tp_streams - 1 <
- 	     minstrel_mcs_groups[sample_group].streams ||
--	     sample_dur >= minstrel_get_duration(mi->max_prob_rate))) {
--		if (mrs->sample_skipped < 20)
-+	     sample_dur >= minstrel_get_duration(mi->max_prob_rate)))
- 			return -1;
- 
--		if (mi->sample_slow++ > 2)
--			return -1;
--	}
- 	mi->sample_tries--;
- 
- 	return sample_idx;
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -123,7 +123,6 @@ struct minstrel_rate_stats {
- 	u8 retry_count;
- 	u8 retry_count_rtscts;
- 
--	u8 sample_skipped;
- 	bool retry_updated;
- };
- 
-@@ -179,7 +178,6 @@ struct minstrel_ht_sta {
- 	u8 sample_wait;
- 	u8 sample_tries;
- 	u8 sample_count;
--	u8 sample_slow;
- 
- 	enum minstrel_sample_mode sample_mode;
- 	u16 sample_rate;
diff --git a/package/kernel/mac80211/patches/subsys/349-mac80211-minstrel_ht-significantly-redesign-the-rate.patch b/package/kernel/mac80211/patches/subsys/349-mac80211-minstrel_ht-significantly-redesign-the-rate.patch
deleted file mode 100644
index 09f6fd221..000000000
--- a/package/kernel/mac80211/patches/subsys/349-mac80211-minstrel_ht-significantly-redesign-the-rate.patch
+++ /dev/null
@@ -1,767 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 22 Jan 2021 23:57:50 +0100
-Subject: [PATCH] mac80211: minstrel_ht: significantly redesign the rate
- probing strategy
-
-The biggest flaw in current minstrel_ht is the fact that it needs way too
-many probing packets to be able to quickly find the best rate.
-Depending on the wifi hardware and operating mode, this can significantly
-reduce throughput when not operating at the highest available data rate.
-
-In order to be able to significantly reduce the amount of rate sampling,
-we need a much smarter selection of probing rates.
-
-The new approach introduced by this patch maintains a limited set of
-available rates to be tested during a statistics window.
-
-They are split into distinct categories:
-- MINSTREL_SAMPLE_TYPE_INC - incremental rate upgrade:
-  Pick the next rate group and find the first rate that is faster than
-  the current max. throughput rate
-- MINSTREL_SAMPLE_TYPE_JUMP - random testing of higher rates:
-  Pick a random rate from the next group that is faster than the current
-  max throughput rate. This allows faster adaptation when the link changes
-  significantly
-- MINSTREL_SAMPLE_TYPE_SLOW - test a rate between max_prob, max_tp2 and
-  max_tp in order to reduce the gap between them
-
-In order to prioritize sampling, every 6 attempts are split into 3x INC,
-2x JUMP, 1x SLOW.
-
-Available rates are checked and refilled on every stats window update.
-
-With this approach, we finally get a very small delta in throughput when
-comparing setting the optimal data rate as a fixed rate vs normal rate
-control operation.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -266,6 +266,14 @@ const struct mcs_group minstrel_mcs_grou
- const s16 minstrel_cck_bitrates[4] = { 10, 20, 55, 110 };
- const s16 minstrel_ofdm_bitrates[8] = { 60, 90, 120, 180, 240, 360, 480, 540 };
- static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES] __read_mostly;
-+static const u8 minstrel_sample_seq[] = {
-+	MINSTREL_SAMPLE_TYPE_INC,
-+	MINSTREL_SAMPLE_TYPE_JUMP,
-+	MINSTREL_SAMPLE_TYPE_INC,
-+	MINSTREL_SAMPLE_TYPE_JUMP,
-+	MINSTREL_SAMPLE_TYPE_INC,
-+	MINSTREL_SAMPLE_TYPE_SLOW,
-+};
- 
- static void
- minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi);
-@@ -620,77 +628,31 @@ minstrel_ht_prob_rate_reduce_streams(str
- 	}
- }
- 
--static bool
--minstrel_ht_probe_group(struct minstrel_ht_sta *mi, const struct mcs_group *tp_group,
--						int tp_idx, const struct mcs_group *group)
--{
--	if (group->bw < tp_group->bw)
--		return false;
--
--	if (group->streams == tp_group->streams)
--		return true;
--
--	if (tp_idx < 4 && group->streams == tp_group->streams - 1)
--		return true;
--
--	return group->streams == tp_group->streams + 1;
--}
--
--static void
--minstrel_ht_find_probe_rates(struct minstrel_ht_sta *mi, u16 *rates, int *n_rates,
--			     bool faster_rate)
-+static u16
-+__minstrel_ht_get_sample_rate(struct minstrel_ht_sta *mi,
-+			      enum minstrel_sample_type type)
- {
--	const struct mcs_group *group, *tp_group;
--	int i, g, max_dur;
--	int tp_idx;
--
--	tp_group = &minstrel_mcs_groups[MI_RATE_GROUP(mi->max_tp_rate[0])];
--	tp_idx = MI_RATE_IDX(mi->max_tp_rate[0]);
--
--	max_dur = minstrel_get_duration(mi->max_tp_rate[0]);
--	if (faster_rate)
--		max_dur -= max_dur / 16;
--
--	for (g = 0; g < MINSTREL_GROUPS_NB; g++) {
--		u16 supported = mi->supported[g];
--
--		if (!supported)
--			continue;
-+	u16 *rates = mi->sample[type].sample_rates;
-+	u16 cur;
-+	int i;
- 
--		group = &minstrel_mcs_groups[g];
--		if (!minstrel_ht_probe_group(mi, tp_group, tp_idx, group))
-+	for (i = 0; i < MINSTREL_SAMPLE_RATES; i++) {
-+		if (!rates[i])
- 			continue;
- 
--		for (i = 0; supported; supported >>= 1, i++) {
--			int idx;
--
--			if (!(supported & 1))
--				continue;
--
--			if ((group->duration[i] << group->shift) > max_dur)
--				continue;
--
--			idx = MI_RATE(g, i);
--			if (idx == mi->max_tp_rate[0])
--				continue;
--
--			rates[(*n_rates)++] = idx;
--			break;
--		}
-+		cur = rates[i];
-+		rates[i] = 0;
-+		return cur;
- 	}
-+
-+	return 0;
- }
- 
- static void
- minstrel_ht_rate_sample_switch(struct minstrel_priv *mp,
- 			       struct minstrel_ht_sta *mi)
- {
--	struct minstrel_rate_stats *mrs;
--	u16 rates[MINSTREL_GROUPS_NB];
--	int n_rates = 0;
--	int probe_rate = 0;
--	bool faster_rate;
--	int i;
--	u8 random;
-+	u16 rate;
- 
- 	/*
- 	 * Use rate switching instead of probing packets for devices with
-@@ -699,43 +661,11 @@ minstrel_ht_rate_sample_switch(struct mi
- 	if (mp->hw->max_rates > 1)
- 		return;
- 
--	/*
--	 * If the current EWMA prob is >75%, look for a rate that's 6.25%
--	 * faster than the max tp rate.
--	 * If that fails, look again for a rate that is at least as fast
--	 */
--	mrs = minstrel_get_ratestats(mi, mi->max_tp_rate[0]);
--	faster_rate = mrs->prob_avg > MINSTREL_FRAC(75, 100);
--	minstrel_ht_find_probe_rates(mi, rates, &n_rates, faster_rate);
--	if (!n_rates && faster_rate)
--		minstrel_ht_find_probe_rates(mi, rates, &n_rates, false);
--
--	/* If no suitable rate was found, try to pick the next one in the group */
--	if (!n_rates) {
--		int g_idx = MI_RATE_GROUP(mi->max_tp_rate[0]);
--		u16 supported = mi->supported[g_idx];
--
--		supported >>= MI_RATE_IDX(mi->max_tp_rate[0]);
--		for (i = 0; supported; supported >>= 1, i++) {
--			if (!(supported & 1))
--				continue;
--
--			probe_rate = mi->max_tp_rate[0] + i;
--			goto out;
--		}
--
-+	rate = __minstrel_ht_get_sample_rate(mi, MINSTREL_SAMPLE_TYPE_INC);
-+	if (!rate)
- 		return;
--	}
--
--	i = 0;
--	if (n_rates > 1) {
--		random = prandom_u32();
--		i = random % n_rates;
--	}
--	probe_rate = rates[i];
- 
--out:
--	mi->sample_rate = probe_rate;
-+	mi->sample_rate = rate;
- 	mi->sample_mode = MINSTREL_SAMPLE_ACTIVE;
- }
- 
-@@ -804,6 +734,274 @@ minstrel_ht_calc_rate_stats(struct minst
- 	mrs->attempts = 0;
- }
- 
-+static bool
-+minstrel_ht_find_sample_rate(struct minstrel_ht_sta *mi, int type, int idx)
-+{
-+	int i;
-+
-+	for (i = 0; i < MINSTREL_SAMPLE_RATES; i++) {
-+		u16 cur = mi->sample[type].sample_rates[i];
-+
-+		if (cur == idx)
-+			return true;
-+
-+		if (!cur)
-+			break;
-+	}
-+
-+	return false;
-+}
-+
-+static int
-+minstrel_ht_move_sample_rates(struct minstrel_ht_sta *mi, int type,
-+			      u32 fast_rate_dur, u32 slow_rate_dur)
-+{
-+	u16 *rates = mi->sample[type].sample_rates;
-+	int i, j;
-+
-+	for (i = 0, j = 0; i < MINSTREL_SAMPLE_RATES; i++) {
-+		u32 duration;
-+		bool valid = false;
-+		u16 cur;
-+
-+		cur = rates[i];
-+		if (!cur)
-+			continue;
-+
-+		duration = minstrel_get_duration(cur);
-+		switch (type) {
-+		case MINSTREL_SAMPLE_TYPE_SLOW:
-+			valid = duration > fast_rate_dur &&
-+				duration < slow_rate_dur;
-+			break;
-+		case MINSTREL_SAMPLE_TYPE_INC:
-+		case MINSTREL_SAMPLE_TYPE_JUMP:
-+			valid = duration < fast_rate_dur;
-+			break;
-+		default:
-+			valid = false;
-+			break;
-+		}
-+
-+		if (!valid) {
-+			rates[i] = 0;
-+			continue;
-+		}
-+
-+		if (i == j)
-+			continue;
-+
-+		rates[j++] = cur;
-+		rates[i] = 0;
-+	}
-+
-+	return j;
-+}
-+
-+static int
-+minstrel_ht_group_min_rate_offset(struct minstrel_ht_sta *mi, int group,
-+				  u32 max_duration)
-+{
-+	u16 supported = mi->supported[group];
-+	int i;
-+
-+	for (i = 0; i < MCS_GROUP_RATES && supported; i++, supported >>= 1) {
-+		if (!(supported & BIT(0)))
-+			continue;
-+
-+		if (minstrel_get_duration(MI_RATE(group, i)) >= max_duration)
-+			continue;
-+
-+		return i;
-+	}
-+
-+	return -1;
-+}
-+
-+/*
-+ * Incremental update rates:
-+ * Flip through groups and pick the first group rate that is faster than the
-+ * highest currently selected rate
-+ */
-+static u16
-+minstrel_ht_next_inc_rate(struct minstrel_ht_sta *mi, u32 fast_rate_dur)
-+{
-+	struct minstrel_mcs_group_data *mg;
-+	u8 type = MINSTREL_SAMPLE_TYPE_INC;
-+	int i, index = 0;
-+	u8 group;
-+
-+	group = mi->sample[type].sample_group;
-+	for (i = 0; i < ARRAY_SIZE(minstrel_mcs_groups); i++) {
-+		group = (group + 1) % ARRAY_SIZE(minstrel_mcs_groups);
-+		mg = &mi->groups[group];
-+
-+		index = minstrel_ht_group_min_rate_offset(mi, group,
-+							  fast_rate_dur);
-+		if (index < 0)
-+			continue;
-+
-+		index = MI_RATE(group, index & 0xf);
-+		if (!minstrel_ht_find_sample_rate(mi, type, index))
-+			goto out;
-+	}
-+	index = 0;
-+
-+out:
-+	mi->sample[type].sample_group = group;
-+
-+	return index;
-+}
-+
-+static int
-+minstrel_ht_next_group_sample_rate(struct minstrel_ht_sta *mi, int group,
-+				   u16 supported, int offset)
-+{
-+	struct minstrel_mcs_group_data *mg = &mi->groups[group];
-+	u16 idx;
-+	int i;
-+
-+	for (i = 0; i < MCS_GROUP_RATES; i++) {
-+		idx = sample_table[mg->column][mg->index];
-+		if (++mg->index >= MCS_GROUP_RATES) {
-+			mg->index = 0;
-+			if (++mg->column >= ARRAY_SIZE(sample_table))
-+				mg->column = 0;
-+		}
-+
-+		if (idx < offset)
-+			continue;
-+
-+		if (!(supported & BIT(idx)))
-+			continue;
-+
-+		return MI_RATE(group, idx);
-+	}
-+
-+	return -1;
-+}
-+
-+/*
-+ * Jump rates:
-+ * Sample random rates, use those that are faster than the highest
-+ * currently selected rate. Rates between the fastest and the slowest
-+ * get sorted into the slow sample bucket, but only if it has room
-+ */
-+static u16
-+minstrel_ht_next_jump_rate(struct minstrel_ht_sta *mi, u32 fast_rate_dur,
-+			   u32 slow_rate_dur, int *slow_rate_ofs)
-+{
-+	struct minstrel_mcs_group_data *mg;
-+	struct minstrel_rate_stats *mrs;
-+	u32 max_duration = slow_rate_dur;
-+	int i, index, offset;
-+	u16 *slow_rates;
-+	u16 supported;
-+	u32 duration;
-+	u8 group;
-+
-+	if (*slow_rate_ofs >= MINSTREL_SAMPLE_RATES)
-+		max_duration = fast_rate_dur;
-+
-+	slow_rates = mi->sample[MINSTREL_SAMPLE_TYPE_SLOW].sample_rates;
-+	group = mi->sample[MINSTREL_SAMPLE_TYPE_JUMP].sample_group;
-+	for (i = 0; i < ARRAY_SIZE(minstrel_mcs_groups); i++) {
-+		u8 type;
-+
-+		group = (group + 1) % ARRAY_SIZE(minstrel_mcs_groups);
-+		mg = &mi->groups[group];
-+
-+		supported = mi->supported[group];
-+		if (!supported)
-+			continue;
-+
-+		offset = minstrel_ht_group_min_rate_offset(mi, group,
-+							   max_duration);
-+		if (offset < 0)
-+			continue;
-+
-+		index = minstrel_ht_next_group_sample_rate(mi, group, supported,
-+							   offset);
-+		if (index < 0)
-+			continue;
-+
-+		duration = minstrel_get_duration(index);
-+		if (duration < fast_rate_dur)
-+			type = MINSTREL_SAMPLE_TYPE_JUMP;
-+		else
-+			type = MINSTREL_SAMPLE_TYPE_SLOW;
-+
-+		if (minstrel_ht_find_sample_rate(mi, type, index))
-+			continue;
-+
-+		if (type == MINSTREL_SAMPLE_TYPE_JUMP)
-+			goto found;
-+
-+		if (*slow_rate_ofs >= MINSTREL_SAMPLE_RATES)
-+			continue;
-+
-+		if (duration >= slow_rate_dur)
-+			continue;
-+
-+		/* skip slow rates with high success probability */
-+		mrs = minstrel_get_ratestats(mi, index);
-+		if (mrs->prob_avg > MINSTREL_FRAC(95, 100))
-+			continue;
-+
-+		slow_rates[(*slow_rate_ofs)++] = index;
-+		if (*slow_rate_ofs >= MINSTREL_SAMPLE_RATES)
-+			max_duration = fast_rate_dur;
-+	}
-+	index = 0;
-+
-+found:
-+	mi->sample[MINSTREL_SAMPLE_TYPE_JUMP].sample_group = group;
-+
-+	return index;
-+}
-+
-+static void
-+minstrel_ht_refill_sample_rates(struct minstrel_ht_sta *mi)
-+{
-+	u32 prob_dur = minstrel_get_duration(mi->max_prob_rate);
-+	u32 tp_dur = minstrel_get_duration(mi->max_tp_rate[0]);
-+	u32 tp2_dur = minstrel_get_duration(mi->max_tp_rate[1]);
-+	u32 fast_rate_dur = min(min(tp_dur, tp2_dur), prob_dur);
-+	u32 slow_rate_dur = max(max(tp_dur, tp2_dur), prob_dur);
-+	u16 *rates;
-+	int i, j;
-+
-+	rates = mi->sample[MINSTREL_SAMPLE_TYPE_INC].sample_rates;
-+	i = minstrel_ht_move_sample_rates(mi, MINSTREL_SAMPLE_TYPE_INC,
-+					  fast_rate_dur, slow_rate_dur);
-+	while (i < MINSTREL_SAMPLE_RATES) {
-+		rates[i] = minstrel_ht_next_inc_rate(mi, tp_dur);
-+		if (!rates[i])
-+			break;
-+
-+		i++;
-+	}
-+
-+	rates = mi->sample[MINSTREL_SAMPLE_TYPE_JUMP].sample_rates;
-+	i = minstrel_ht_move_sample_rates(mi, MINSTREL_SAMPLE_TYPE_JUMP,
-+					  fast_rate_dur, slow_rate_dur);
-+	j = minstrel_ht_move_sample_rates(mi, MINSTREL_SAMPLE_TYPE_SLOW,
-+					  fast_rate_dur, slow_rate_dur);
-+	while (i < MINSTREL_SAMPLE_RATES) {
-+		rates[i] = minstrel_ht_next_jump_rate(mi, fast_rate_dur,
-+						      slow_rate_dur, &j);
-+		if (!rates[i])
-+			break;
-+
-+		i++;
-+	}
-+
-+	for (i = 0; i < ARRAY_SIZE(mi->sample); i++)
-+		memcpy(mi->sample[i].cur_sample_rates, mi->sample[i].sample_rates,
-+		       sizeof(mi->sample[i].cur_sample_rates));
-+}
-+
-+
- /*
-  * Update rate statistics and select new primary rates
-  *
-@@ -848,8 +1046,6 @@ minstrel_ht_update_stats(struct minstrel
- 		mi->ampdu_packets = 0;
- 	}
- 
--	mi->sample_count = 0;
--
- 	if (mi->supported[MINSTREL_CCK_GROUP])
- 		group = MINSTREL_CCK_GROUP;
- 	else if (mi->supported[MINSTREL_OFDM_GROUP])
-@@ -884,8 +1080,6 @@ minstrel_ht_update_stats(struct minstrel
- 		if (!mi->supported[group])
- 			continue;
- 
--		mi->sample_count++;
--
- 		/* (re)Initialize group rate indexes */
- 		for(j = 0; j < MAX_THR_RATES; j++)
- 			tmp_group_tp_rate[j] = MI_RATE(group, 0);
-@@ -952,9 +1146,7 @@ minstrel_ht_update_stats(struct minstrel
- 
- 	/* Try to increase robustness of max_prob_rate*/
- 	minstrel_ht_prob_rate_reduce_streams(mi);
--
--	/* try to sample half of all available rates during each interval */
--	mi->sample_count *= 4;
-+	minstrel_ht_refill_sample_rates(mi);
- 
- 	if (sample)
- 		minstrel_ht_rate_sample_switch(mp, mi);
-@@ -971,6 +1163,7 @@ minstrel_ht_update_stats(struct minstrel
- 
- 	/* Reset update timer */
- 	mi->last_stats_update = jiffies;
-+	mi->sample_time = jiffies;
- }
- 
- static bool
-@@ -1001,28 +1194,6 @@ minstrel_ht_txstat_valid(struct minstrel
- }
- 
- static void
--minstrel_set_next_sample_idx(struct minstrel_ht_sta *mi)
--{
--	struct minstrel_mcs_group_data *mg;
--
--	for (;;) {
--		mi->sample_group++;
--		mi->sample_group %= ARRAY_SIZE(minstrel_mcs_groups);
--		mg = &mi->groups[mi->sample_group];
--
--		if (!mi->supported[mi->sample_group])
--			continue;
--
--		if (++mg->index >= MCS_GROUP_RATES) {
--			mg->index = 0;
--			if (++mg->column >= ARRAY_SIZE(sample_table))
--				mg->column = 0;
--		}
--		break;
--	}
--}
--
--static void
- minstrel_downgrade_rate(struct minstrel_ht_sta *mi, u16 *idx, bool primary)
- {
- 	int group, orig_group;
-@@ -1107,14 +1278,6 @@ minstrel_ht_tx_status(void *priv, struct
- 	mi->ampdu_packets++;
- 	mi->ampdu_len += info->status.ampdu_len;
- 
--	if (!mi->sample_wait && !mi->sample_tries && mi->sample_count > 0) {
--		int avg_ampdu_len = minstrel_ht_avg_ampdu_len(mi);
--
--		mi->sample_wait = 16 + 2 * avg_ampdu_len;
--		mi->sample_tries = 1;
--		mi->sample_count--;
--	}
--
- 	if (mi->sample_mode != MINSTREL_SAMPLE_IDLE)
- 		rate_sample = minstrel_get_ratestats(mi, mi->sample_rate);
- 
-@@ -1386,97 +1549,20 @@ minstrel_ht_update_rates(struct minstrel
- 	rate_control_set_rates(mp->hw, mi->sta, rates);
- }
- 
--static int
--minstrel_get_sample_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
-+static u16
-+minstrel_ht_get_sample_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
- {
--	struct minstrel_rate_stats *mrs;
--	struct minstrel_mcs_group_data *mg;
--	unsigned int sample_dur, sample_group, cur_max_tp_streams;
--	int tp_rate1, tp_rate2;
--	int sample_idx = 0;
--
--	if (mp->hw->max_rates == 1 && mp->sample_switch &&
--	    (mi->total_packets_cur >= SAMPLE_SWITCH_THR ||
--	     mp->sample_switch == 1))
--		return -1;
--
--	if (mi->sample_wait > 0) {
--		mi->sample_wait--;
--		return -1;
--	}
--
--	if (!mi->sample_tries)
--		return -1;
--
--	sample_group = mi->sample_group;
--	mg = &mi->groups[sample_group];
--	sample_idx = sample_table[mg->column][mg->index];
--	minstrel_set_next_sample_idx(mi);
--
--	if (!(mi->supported[sample_group] & BIT(sample_idx)))
--		return -1;
-+	u8 seq;
- 
--	mrs = &mg->rates[sample_idx];
--	sample_idx += MI_RATE(sample_group, 0);
--
--	tp_rate1 = mi->max_tp_rate[0];
--
--	/* Set tp_rate2 to the second highest max_tp_rate */
--	if (minstrel_get_duration(mi->max_tp_rate[0]) >
--	    minstrel_get_duration(mi->max_tp_rate[1])) {
--		tp_rate2 = mi->max_tp_rate[0];
-+	if (mp->hw->max_rates > 1) {
-+		seq = mi->sample_seq;
-+		mi->sample_seq = (seq + 1) % ARRAY_SIZE(minstrel_sample_seq);
-+		seq = minstrel_sample_seq[seq];
- 	} else {
--		tp_rate2 = mi->max_tp_rate[1];
-+		seq = MINSTREL_SAMPLE_TYPE_INC;
- 	}
- 
--	/*
--	 * Sampling might add some overhead (RTS, no aggregation)
--	 * to the frame. Hence, don't use sampling for the highest currently
--	 * used highest throughput or probability rate.
--	 */
--	if (sample_idx == mi->max_tp_rate[0] || sample_idx == mi->max_prob_rate)
--		return -1;
--
--	/*
--	 * Do not sample if the probability is already higher than 95%,
--	 * or if the rate is 3 times slower than the current max probability
--	 * rate, to avoid wasting airtime.
--	 */
--	sample_dur = minstrel_get_duration(sample_idx);
--	if (mrs->prob_avg > MINSTREL_FRAC(95, 100) ||
--	    minstrel_get_duration(mi->max_prob_rate) * 3 < sample_dur)
--		return -1;
--
--
--	/*
--	 * For devices with no configurable multi-rate retry, skip sampling
--	 * below the per-group max throughput rate, and only use one sampling
--	 * attempt per rate
--	 */
--	if (mp->hw->max_rates == 1 &&
--	    (minstrel_get_duration(mg->max_group_tp_rate[0]) < sample_dur ||
--	     mrs->attempts))
--		return -1;
--
--	/* Skip already sampled slow rates */
--	if (sample_dur >= minstrel_get_duration(tp_rate1) && mrs->attempts)
--		return -1;
--
--	/*
--	 * Make sure that lower rates get sampled only occasionally,
--	 * if the link is working perfectly.
--	 */
--
--	cur_max_tp_streams = minstrel_mcs_groups[MI_RATE_GROUP(tp_rate1)].streams;
--	if (sample_dur >= minstrel_get_duration(tp_rate2) &&
--	    (cur_max_tp_streams - 1 <
--	     minstrel_mcs_groups[sample_group].streams ||
--	     sample_dur >= minstrel_get_duration(mi->max_prob_rate)))
--			return -1;
--
--	mi->sample_tries--;
--
--	return sample_idx;
-+	return __minstrel_ht_get_sample_rate(mi, seq);
- }
- 
- static void
-@@ -1488,7 +1574,7 @@ minstrel_ht_get_rate(void *priv, struct
- 	struct ieee80211_tx_rate *rate = &info->status.rates[0];
- 	struct minstrel_ht_sta *mi = priv_sta;
- 	struct minstrel_priv *mp = priv;
--	int sample_idx;
-+	u16 sample_idx;
- 
- 	if (!(info->flags & IEEE80211_TX_CTL_AMPDU) &&
- 	    !minstrel_ht_is_legacy_group(MI_RATE_GROUP(mi->max_prob_rate)))
-@@ -1504,11 +1590,19 @@ minstrel_ht_get_rate(void *priv, struct
- 	/* Don't use EAPOL frames for sampling on non-mrr hw */
- 	if (mp->hw->max_rates == 1 &&
- 	    (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO))
--		sample_idx = -1;
--	else
--		sample_idx = minstrel_get_sample_rate(mp, mi);
-+		return;
-+
-+	if (mp->hw->max_rates == 1 && mp->sample_switch &&
-+	    (mi->total_packets_cur >= SAMPLE_SWITCH_THR ||
-+	     mp->sample_switch == 1))
-+		return;
-+
-+	if (time_is_before_jiffies(mi->sample_time))
-+		return;
- 
--	if (sample_idx < 0)
-+	mi->sample_time = jiffies + MINSTREL_SAMPLE_INTERVAL;
-+	sample_idx = minstrel_ht_get_sample_rate(mp, mi);
-+	if (!sample_idx)
- 		return;
- 
- 	sample_group = &minstrel_mcs_groups[MI_RATE_GROUP(sample_idx)];
-@@ -1629,16 +1723,6 @@ minstrel_ht_update_caps(void *priv, stru
- 
- 	mi->avg_ampdu_len = MINSTREL_FRAC(1, 1);
- 
--	/* When using MRR, sample more on the first attempt, without delay */
--	if (mp->has_mrr) {
--		mi->sample_count = 16;
--		mi->sample_wait = 0;
--	} else {
--		mi->sample_count = 8;
--		mi->sample_wait = 8;
--	}
--	mi->sample_tries = 4;
--
- 	if (!use_vht) {
- 		stbc = (ht_cap & IEEE80211_HT_CAP_RX_STBC) >>
- 			IEEE80211_HT_CAP_RX_STBC_SHIFT;
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -69,6 +69,8 @@
- #define MI_RATE_IDX(_rate) FIELD_GET(MI_RATE_IDX_MASK, _rate)
- #define MI_RATE_GROUP(_rate) FIELD_GET(MI_RATE_GROUP_MASK, _rate)
- 
-+#define MINSTREL_SAMPLE_RATES		5 /* rates per sample type */
-+#define MINSTREL_SAMPLE_INTERVAL	(HZ / 50)
- 
- struct minstrel_priv {
- 	struct ieee80211_hw *hw;
-@@ -126,6 +128,13 @@ struct minstrel_rate_stats {
- 	bool retry_updated;
- };
- 
-+enum minstrel_sample_type {
-+	MINSTREL_SAMPLE_TYPE_INC,
-+	MINSTREL_SAMPLE_TYPE_JUMP,
-+	MINSTREL_SAMPLE_TYPE_SLOW,
-+	__MINSTREL_SAMPLE_TYPE_MAX
-+};
-+
- struct minstrel_mcs_group_data {
- 	u8 index;
- 	u8 column;
-@@ -144,6 +153,12 @@ enum minstrel_sample_mode {
- 	MINSTREL_SAMPLE_PENDING,
- };
- 
-+struct minstrel_sample_category {
-+	u8 sample_group;
-+	u16 sample_rates[MINSTREL_SAMPLE_RATES];
-+	u16 cur_sample_rates[MINSTREL_SAMPLE_RATES];
-+};
-+
- struct minstrel_ht_sta {
- 	struct ieee80211_sta *sta;
- 
-@@ -175,16 +190,14 @@ struct minstrel_ht_sta {
- 	/* tx flags to add for frames for this sta */
- 	u32 tx_flags;
- 
--	u8 sample_wait;
--	u8 sample_tries;
--	u8 sample_count;
-+	unsigned long sample_time;
-+	struct minstrel_sample_category sample[__MINSTREL_SAMPLE_TYPE_MAX];
-+
-+	u8 sample_seq;
- 
- 	enum minstrel_sample_mode sample_mode;
- 	u16 sample_rate;
- 
--	/* current MCS group to be sampled */
--	u8 sample_group;
--
- 	u8 band;
- 
- 	/* Bitfield of supported MCS rates of all groups */
diff --git a/package/kernel/mac80211/patches/subsys/350-mac80211-minstrel_ht-show-sampling-rates-in-debugfs.patch b/package/kernel/mac80211/patches/subsys/350-mac80211-minstrel_ht-show-sampling-rates-in-debugfs.patch
deleted file mode 100644
index 041ba31a3..000000000
--- a/package/kernel/mac80211/patches/subsys/350-mac80211-minstrel_ht-show-sampling-rates-in-debugfs.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 23 Jan 2021 00:10:34 +0100
-Subject: [PATCH] mac80211: minstrel_ht: show sampling rates in debugfs
-
-This makes it easier to see what rates are going to be tested next
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
-+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
-@@ -32,6 +32,18 @@ minstrel_stats_release(struct inode *ino
- 	return 0;
- }
- 
-+static bool
-+minstrel_ht_is_sample_rate(struct minstrel_ht_sta *mi, int idx)
-+{
-+	int type, i;
-+
-+	for (type = 0; type < ARRAY_SIZE(mi->sample); type++)
-+		for (i = 0; i < MINSTREL_SAMPLE_RATES; i++)
-+			if (mi->sample[type].cur_sample_rates[i] == idx)
-+				return true;
-+	return false;
-+}
-+
- static char *
- minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
- {
-@@ -84,6 +96,7 @@ minstrel_ht_stats_dump(struct minstrel_h
- 		*(p++) = (idx == mi->max_tp_rate[2]) ? 'C' : ' ';
- 		*(p++) = (idx == mi->max_tp_rate[3]) ? 'D' : ' ';
- 		*(p++) = (idx == mi->max_prob_rate) ? 'P' : ' ';
-+		*(p++) = minstrel_ht_is_sample_rate(mi, idx) ? 'S' : ' ';
- 
- 		if (gflags & IEEE80211_TX_RC_MCS) {
- 			p += sprintf(p, "  MCS%-2u", (mg->streams - 1) * 8 + j);
-@@ -145,9 +158,9 @@ minstrel_ht_stats_open(struct inode *ino
- 
- 	p += sprintf(p, "\n");
- 	p += sprintf(p,
--		     "              best   ____________rate__________    ____statistics___    _____last____    ______sum-of________\n");
-+		     "              best    ____________rate__________    ____statistics___    _____last____    ______sum-of________\n");
- 	p += sprintf(p,
--		     "mode guard #  rate  [name   idx airtime  max_tp]  [avg(tp) avg(prob)]  [retry|suc|att]  [#success | #attempts]\n");
-+		     "mode guard #  rate   [name   idx airtime  max_tp]  [avg(tp) avg(prob)]  [retry|suc|att]  [#success | #attempts]\n");
- 
- 	p = minstrel_ht_stats_dump(mi, MINSTREL_CCK_GROUP, p);
- 	for (i = 0; i < MINSTREL_CCK_GROUP; i++)
-@@ -228,6 +241,7 @@ minstrel_ht_stats_csv_dump(struct minstr
- 		p += sprintf(p, "%s" ,((idx == mi->max_tp_rate[2]) ? "C" : ""));
- 		p += sprintf(p, "%s" ,((idx == mi->max_tp_rate[3]) ? "D" : ""));
- 		p += sprintf(p, "%s" ,((idx == mi->max_prob_rate) ? "P" : ""));
-+		p += sprintf(p, "%s", (minstrel_ht_is_sample_rate(mi, idx) ? "S" : ""));
- 
- 		if (gflags & IEEE80211_TX_RC_MCS) {
- 			p += sprintf(p, ",MCS%-2u,", (mg->streams - 1) * 8 + j);
diff --git a/package/kernel/mac80211/patches/subsys/351-mac80211-minstrel_ht-remove-sample-rate-switching-co.patch b/package/kernel/mac80211/patches/subsys/351-mac80211-minstrel_ht-remove-sample-rate-switching-co.patch
deleted file mode 100644
index 8170ff85f..000000000
--- a/package/kernel/mac80211/patches/subsys/351-mac80211-minstrel_ht-remove-sample-rate-switching-co.patch
+++ /dev/null
@@ -1,279 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 23 Jan 2021 07:18:26 +0100
-Subject: [PATCH] mac80211: minstrel_ht: remove sample rate switching code for
- constrained devices
-
-This was added to mitigate the effects of too much sampling on devices that
-use a static global fallback table instead of configurable multi-rate retry.
-Now that the sampling algorithm is improved, this code path no longer performs
-any better than the standard probing on affected devices.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -648,27 +648,6 @@ __minstrel_ht_get_sample_rate(struct min
- 	return 0;
- }
- 
--static void
--minstrel_ht_rate_sample_switch(struct minstrel_priv *mp,
--			       struct minstrel_ht_sta *mi)
--{
--	u16 rate;
--
--	/*
--	 * Use rate switching instead of probing packets for devices with
--	 * little control over retry fallback behavior
--	 */
--	if (mp->hw->max_rates > 1)
--		return;
--
--	rate = __minstrel_ht_get_sample_rate(mi, MINSTREL_SAMPLE_TYPE_INC);
--	if (!rate)
--		return;
--
--	mi->sample_rate = rate;
--	mi->sample_mode = MINSTREL_SAMPLE_ACTIVE;
--}
--
- static inline int
- minstrel_ewma(int old, int new, int weight)
- {
-@@ -1012,8 +991,7 @@ minstrel_ht_refill_sample_rates(struct m
-  *    higher throughput rates, even if the probablity is a bit lower
-  */
- static void
--minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
--			 bool sample)
-+minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
- {
- 	struct minstrel_mcs_group_data *mg;
- 	struct minstrel_rate_stats *mrs;
-@@ -1023,18 +1001,6 @@ minstrel_ht_update_stats(struct minstrel
- 	u16 index;
- 	bool ht_supported = mi->sta->ht_cap.ht_supported;
- 
--	mi->sample_mode = MINSTREL_SAMPLE_IDLE;
--
--	if (sample) {
--		mi->total_packets_cur = mi->total_packets -
--					mi->total_packets_last;
--		mi->total_packets_last = mi->total_packets;
--	}
--	if (!mp->sample_switch)
--		sample = false;
--	if (mi->total_packets_cur < SAMPLE_SWITCH_THR && mp->sample_switch != 1)
--	    sample = false;
--
- 	if (mi->ampdu_packets > 0) {
- 		if (!ieee80211_hw_check(mp->hw, TX_STATUS_NO_AMPDU_LEN))
- 			mi->avg_ampdu_len = minstrel_ewma(mi->avg_ampdu_len,
-@@ -1148,16 +1114,12 @@ minstrel_ht_update_stats(struct minstrel
- 	minstrel_ht_prob_rate_reduce_streams(mi);
- 	minstrel_ht_refill_sample_rates(mi);
- 
--	if (sample)
--		minstrel_ht_rate_sample_switch(mp, mi);
--
- #ifdef CPTCFG_MAC80211_DEBUGFS
- 	/* use fixed index if set */
- 	if (mp->fixed_rate_idx != -1) {
- 		for (i = 0; i < 4; i++)
- 			mi->max_tp_rate[i] = mp->fixed_rate_idx;
- 		mi->max_prob_rate = mp->fixed_rate_idx;
--		mi->sample_mode = MINSTREL_SAMPLE_IDLE;
- 	}
- #endif
- 
-@@ -1247,11 +1209,10 @@ minstrel_ht_tx_status(void *priv, struct
- 	struct ieee80211_tx_info *info = st->info;
- 	struct minstrel_ht_sta *mi = priv_sta;
- 	struct ieee80211_tx_rate *ar = info->status.rates;
--	struct minstrel_rate_stats *rate, *rate2, *rate_sample = NULL;
-+	struct minstrel_rate_stats *rate, *rate2;
- 	struct minstrel_priv *mp = priv;
- 	u32 update_interval = mp->update_interval;
- 	bool last, update = false;
--	bool sample_status = false;
- 	int i;
- 
- 	/* This packet was aggregated but doesn't carry status info */
-@@ -1278,49 +1239,18 @@ minstrel_ht_tx_status(void *priv, struct
- 	mi->ampdu_packets++;
- 	mi->ampdu_len += info->status.ampdu_len;
- 
--	if (mi->sample_mode != MINSTREL_SAMPLE_IDLE)
--		rate_sample = minstrel_get_ratestats(mi, mi->sample_rate);
--
- 	last = !minstrel_ht_txstat_valid(mp, mi, &ar[0]);
- 	for (i = 0; !last; i++) {
- 		last = (i == IEEE80211_TX_MAX_RATES - 1) ||
- 		       !minstrel_ht_txstat_valid(mp, mi, &ar[i + 1]);
- 
- 		rate = minstrel_ht_get_stats(mp, mi, &ar[i]);
--		if (rate == rate_sample)
--			sample_status = true;
--
- 		if (last)
- 			rate->success += info->status.ampdu_ack_len;
- 
- 		rate->attempts += ar[i].count * info->status.ampdu_len;
- 	}
- 
--	switch (mi->sample_mode) {
--	case MINSTREL_SAMPLE_IDLE:
--		if (mp->hw->max_rates > 1 ||
--		     mi->total_packets_cur < SAMPLE_SWITCH_THR)
--			update_interval /= 2;
--		break;
--
--	case MINSTREL_SAMPLE_ACTIVE:
--		if (!sample_status)
--			break;
--
--		mi->sample_mode = MINSTREL_SAMPLE_PENDING;
--		update = true;
--		break;
--
--	case MINSTREL_SAMPLE_PENDING:
--		if (sample_status)
--			break;
--
--		update = true;
--		minstrel_ht_update_stats(mp, mi, false);
--		break;
--	}
--
--
- 	if (mp->hw->max_rates > 1) {
- 		/*
- 		 * check for sudden death of spatial multiplexing,
-@@ -1343,7 +1273,7 @@ minstrel_ht_tx_status(void *priv, struct
- 
- 	if (time_after(jiffies, mi->last_stats_update + update_interval)) {
- 		update = true;
--		minstrel_ht_update_stats(mp, mi, true);
-+		minstrel_ht_update_stats(mp, mi);
- 	}
- 
- 	if (update)
-@@ -1522,18 +1452,14 @@ static void
- minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
- {
- 	struct ieee80211_sta_rates *rates;
--	u16 first_rate = mi->max_tp_rate[0];
- 	int i = 0;
- 
--	if (mi->sample_mode == MINSTREL_SAMPLE_ACTIVE)
--		first_rate = mi->sample_rate;
--
- 	rates = kzalloc(sizeof(*rates), GFP_ATOMIC);
- 	if (!rates)
- 		return;
- 
- 	/* Start with max_tp_rate[0] */
--	minstrel_ht_set_rate(mp, mi, rates, i++, first_rate);
-+	minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_tp_rate[0]);
- 
- 	if (mp->hw->max_rates >= 3) {
- 		/* At least 3 tx rates supported, use max_tp_rate[1] next */
-@@ -1592,11 +1518,6 @@ minstrel_ht_get_rate(void *priv, struct
- 	    (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO))
- 		return;
- 
--	if (mp->hw->max_rates == 1 && mp->sample_switch &&
--	    (mi->total_packets_cur >= SAMPLE_SWITCH_THR ||
--	     mp->sample_switch == 1))
--		return;
--
- 	if (time_is_before_jiffies(mi->sample_time))
- 		return;
- 
-@@ -1810,7 +1731,7 @@ minstrel_ht_update_caps(void *priv, stru
- 	minstrel_ht_update_ofdm(mp, mi, sband, sta);
- 
- 	/* create an initial rate table with the lowest supported rates */
--	minstrel_ht_update_stats(mp, mi, true);
-+	minstrel_ht_update_stats(mp, mi);
- 	minstrel_ht_update_rates(mp, mi);
- }
- 
-@@ -1926,8 +1847,6 @@ minstrel_ht_alloc(struct ieee80211_hw *h
- 	if (!mp)
- 		return NULL;
- 
--	mp->sample_switch = -1;
--
- 	/* contention window settings
- 	 * Just an approximation. Using the per-queue values would complicate
- 	 * the calculations and is probably unnecessary */
-@@ -1947,7 +1866,7 @@ minstrel_ht_alloc(struct ieee80211_hw *h
- 		mp->has_mrr = true;
- 
- 	mp->hw = hw;
--	mp->update_interval = HZ / 10;
-+	mp->update_interval = HZ / 20;
- 
- 	minstrel_ht_init_cck_rates(mp);
- 	for (i = 0; i < ARRAY_SIZE(mp->hw->wiphy->bands); i++)
-@@ -1965,8 +1884,6 @@ static void minstrel_ht_add_debugfs(stru
- 	mp->fixed_rate_idx = (u32) -1;
- 	debugfs_create_u32("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir,
- 			   &mp->fixed_rate_idx);
--	debugfs_create_u32("sample_switch", S_IRUGO | S_IWUSR, debugfsdir,
--			   &mp->sample_switch);
- }
- #endif
- 
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -75,7 +75,6 @@
- struct minstrel_priv {
- 	struct ieee80211_hw *hw;
- 	bool has_mrr;
--	u32 sample_switch;
- 	unsigned int cw_min;
- 	unsigned int cw_max;
- 	unsigned int max_retry;
-@@ -147,12 +146,6 @@ struct minstrel_mcs_group_data {
- 	struct minstrel_rate_stats rates[MCS_GROUP_RATES];
- };
- 
--enum minstrel_sample_mode {
--	MINSTREL_SAMPLE_IDLE,
--	MINSTREL_SAMPLE_ACTIVE,
--	MINSTREL_SAMPLE_PENDING,
--};
--
- struct minstrel_sample_category {
- 	u8 sample_group;
- 	u16 sample_rates[MINSTREL_SAMPLE_RATES];
-@@ -182,23 +175,19 @@ struct minstrel_ht_sta {
- 	unsigned int overhead_legacy;
- 	unsigned int overhead_legacy_rtscts;
- 
--	unsigned int total_packets_last;
--	unsigned int total_packets_cur;
- 	unsigned int total_packets;
- 	unsigned int sample_packets;
- 
- 	/* tx flags to add for frames for this sta */
- 	u32 tx_flags;
- 
--	unsigned long sample_time;
--	struct minstrel_sample_category sample[__MINSTREL_SAMPLE_TYPE_MAX];
-+	u8 band;
- 
- 	u8 sample_seq;
--
--	enum minstrel_sample_mode sample_mode;
- 	u16 sample_rate;
- 
--	u8 band;
-+	unsigned long sample_time;
-+	struct minstrel_sample_category sample[__MINSTREL_SAMPLE_TYPE_MAX];
- 
- 	/* Bitfield of supported MCS rates of all groups */
- 	u16 supported[MINSTREL_GROUPS_NB];
diff --git a/package/kernel/mac80211/patches/subsys/352-mac80211-minstrel_ht-fix-regression-in-the-max_prob_.patch b/package/kernel/mac80211/patches/subsys/352-mac80211-minstrel_ht-fix-regression-in-the-max_prob_.patch
deleted file mode 100644
index a366a921d..000000000
--- a/package/kernel/mac80211/patches/subsys/352-mac80211-minstrel_ht-fix-regression-in-the-max_prob_.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 26 Jan 2021 16:40:52 +0100
-Subject: [PATCH] mac80211: minstrel_ht: fix regression in the max_prob_rate
- fix
-
-Since mi->max_prob_rate is overwritten after the loop that calls
-minstrel_ht_set_best_prob_rate, the new best rate needs to be written to *dest
-
-Fixes: a7fca4e4037f ("mac80211: minstrel_ht: fix max probability rate selection")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -545,7 +545,7 @@ minstrel_ht_set_best_prob_rate(struct mi
- 		cur_tp_avg = minstrel_ht_get_tp_avg(mi, cur_group, cur_idx,
- 						    mrs->prob_avg);
- 		if (cur_tp_avg > tmp_tp_avg)
--			mi->max_prob_rate = index;
-+			*dest = index;
- 
- 		max_gpr_tp_avg = minstrel_ht_get_tp_avg(mi, max_gpr_group,
- 							max_gpr_idx,
diff --git a/package/kernel/mac80211/patches/subsys/371-mac80211-don-t-apply-flow-control-on-management-fram.patch b/package/kernel/mac80211/patches/subsys/371-mac80211-don-t-apply-flow-control-on-management-fram.patch
deleted file mode 100644
index 0d3b42f3b..000000000
--- a/package/kernel/mac80211/patches/subsys/371-mac80211-don-t-apply-flow-control-on-management-fram.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Fri, 19 Mar 2021 23:28:01 +0100
-Subject: [PATCH] mac80211: don't apply flow control on management frames
-
-In some cases (depending on the driver, but it's true e.g. for
-iwlwifi) we're using an internal TXQ for management packets,
-mostly to simplify the code and to have a place to queue them.
-However, it appears that in certain cases we can confuse the
-code and management frames are dropped, which is certainly not
-what we want.
-
-Short-circuit the processing of management frames. To keep the
-impact minimal, only put them on the frags queue and check the
-tid == management only for doing that and to skip the airtime
-fairness checks, if applicable.
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -5,7 +5,7 @@
-  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
-  * Copyright 2007	Johannes Berg <johannes@sipsolutions.net>
-  * Copyright 2013-2014  Intel Mobile Communications GmbH
-- * Copyright (C) 2018-2020 Intel Corporation
-+ * Copyright (C) 2018-2021 Intel Corporation
-  *
-  * Transmit and frame generation functions.
-  */
-@@ -1401,8 +1401,17 @@ static void ieee80211_txq_enqueue(struct
- 	ieee80211_set_skb_enqueue_time(skb);
- 
- 	spin_lock_bh(&fq->lock);
--	fq_tin_enqueue(fq, tin, flow_idx, skb,
--		       fq_skb_free_func);
-+	/*
-+	 * For management frames, don't really apply codel etc.,
-+	 * we don't want to apply any shaping or anything we just
-+	 * want to simplify the driver API by having them on the
-+	 * txqi.
-+	 */
-+	if (unlikely(txqi->txq.tid == IEEE80211_NUM_TIDS))
-+		__skb_queue_tail(&txqi->frags, skb);
-+	else
-+		fq_tin_enqueue(fq, tin, flow_idx, skb,
-+			       fq_skb_free_func);
- 	spin_unlock_bh(&fq->lock);
- }
- 
-@@ -3878,6 +3887,9 @@ bool ieee80211_txq_airtime_check(struct
- 	if (!txq->sta)
- 		return true;
- 
-+	if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
-+		return true;
-+
- 	sta = container_of(txq->sta, struct sta_info, sta);
- 	if (atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
- 	    sta->airtime[txq->ac].aql_limit_low)
diff --git a/package/kernel/mac80211/patches/subsys/372-mac80211-set-sk_pacing_shift-for-802.3-txpath.patch b/package/kernel/mac80211/patches/subsys/372-mac80211-set-sk_pacing_shift-for-802.3-txpath.patch
deleted file mode 100644
index 9e57d01e0..000000000
--- a/package/kernel/mac80211/patches/subsys/372-mac80211-set-sk_pacing_shift-for-802.3-txpath.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Mon, 8 Mar 2021 23:01:49 +0100
-Subject: [PATCH] mac80211: set sk_pacing_shift for 802.3 txpath
-
-Similar to 802.11 txpath, set socket sk_pacing_shift for 802.3 tx path.
-
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -4205,6 +4205,9 @@ static bool ieee80211_tx_8023(struct iee
- 	unsigned long flags;
- 	int q = info->hw_queue;
- 
-+	if (sta)
-+		sk_pacing_shift_update(skb->sk, local->hw.tx_sk_pacing_shift);
-+
- 	if (ieee80211_queue_skb(local, sdata, sta, skb))
- 		return true;
- 
diff --git a/package/kernel/mac80211/patches/subsys/373-mac80211-support-Rx-timestamp-calculation-for-all-pr.patch b/package/kernel/mac80211/patches/subsys/373-mac80211-support-Rx-timestamp-calculation-for-all-pr.patch
deleted file mode 100644
index 117fb35fc..000000000
--- a/package/kernel/mac80211/patches/subsys/373-mac80211-support-Rx-timestamp-calculation-for-all-pr.patch
+++ /dev/null
@@ -1,134 +0,0 @@
-From: Avraham Stern <avraham.stern@intel.com>
-Date: Sun, 6 Dec 2020 14:54:45 +0200
-Subject: [PATCH] mac80211: support Rx timestamp calculation for all preamble
- types
-
-Add support for calculating the Rx timestamp for HE frames.
-Since now all frame types are supported, allow setting the Rx
-timestamp regardless of the frame type.
-
-Signed-off-by: Avraham Stern <avraham.stern@intel.com>
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Link: https://lore.kernel.org/r/iwlwifi.20201206145305.4786559af475.Ia54486bb0a12e5351f9d5c60ef6fcda7c9e7141c@changeid
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -1587,13 +1587,8 @@ ieee80211_have_rx_timestamp(struct ieee8
- {
- 	WARN_ON_ONCE(status->flag & RX_FLAG_MACTIME_START &&
- 		     status->flag & RX_FLAG_MACTIME_END);
--	if (status->flag & (RX_FLAG_MACTIME_START | RX_FLAG_MACTIME_END))
--		return true;
--	/* can't handle non-legacy preamble yet */
--	if (status->flag & RX_FLAG_MACTIME_PLCP_START &&
--	    status->encoding == RX_ENC_LEGACY)
--		return true;
--	return false;
-+	return !!(status->flag & (RX_FLAG_MACTIME_START | RX_FLAG_MACTIME_END |
-+				  RX_FLAG_MACTIME_PLCP_START));
- }
- 
- void ieee80211_vif_inc_num_mcast(struct ieee80211_sub_if_data *sdata);
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -3665,6 +3665,7 @@ u64 ieee80211_calculate_rx_timestamp(str
- 	u64 ts = status->mactime;
- 	struct rate_info ri;
- 	u16 rate;
-+	u8 n_ltf;
- 
- 	if (WARN_ON(!ieee80211_have_rx_timestamp(status)))
- 		return 0;
-@@ -3675,11 +3676,58 @@ u64 ieee80211_calculate_rx_timestamp(str
- 
- 	/* Fill cfg80211 rate info */
- 	switch (status->encoding) {
-+	case RX_ENC_HE:
-+		ri.flags |= RATE_INFO_FLAGS_HE_MCS;
-+		ri.mcs = status->rate_idx;
-+		ri.nss = status->nss;
-+		ri.he_ru_alloc = status->he_ru;
-+		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
-+			ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
-+
-+		/*
-+		 * See P802.11ax_D6.0, section 27.3.4 for
-+		 * VHT PPDU format.
-+		 */
-+		if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
-+			mpdu_offset += 2;
-+			ts += 36;
-+
-+			/*
-+			 * TODO:
-+			 * For HE MU PPDU, add the HE-SIG-B.
-+			 * For HE ER PPDU, add 8us for the HE-SIG-A.
-+			 * For HE TB PPDU, add 4us for the HE-STF.
-+			 * Add the HE-LTF durations - variable.
-+			 */
-+		}
-+
-+		break;
- 	case RX_ENC_HT:
- 		ri.mcs = status->rate_idx;
- 		ri.flags |= RATE_INFO_FLAGS_MCS;
- 		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
- 			ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
-+
-+		/*
-+		 * See P802.11REVmd_D3.0, section 19.3.2 for
-+		 * HT PPDU format.
-+		 */
-+		if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
-+			mpdu_offset += 2;
-+			if (status->enc_flags & RX_ENC_FLAG_HT_GF)
-+				ts += 24;
-+			else
-+				ts += 32;
-+
-+			/*
-+			 * Add Data HT-LTFs per streams
-+			 * TODO: add Extension HT-LTFs, 4us per LTF
-+			 */
-+			n_ltf = ((ri.mcs >> 3) & 3) + 1;
-+			n_ltf = n_ltf == 3 ? 4 : n_ltf;
-+			ts += n_ltf * 4;
-+		}
-+
- 		break;
- 	case RX_ENC_VHT:
- 		ri.flags |= RATE_INFO_FLAGS_VHT_MCS;
-@@ -3687,6 +3735,23 @@ u64 ieee80211_calculate_rx_timestamp(str
- 		ri.nss = status->nss;
- 		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
- 			ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
-+
-+		/*
-+		 * See P802.11REVmd_D3.0, section 21.3.2 for
-+		 * VHT PPDU format.
-+		 */
-+		if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
-+			mpdu_offset += 2;
-+			ts += 36;
-+
-+			/*
-+			 * Add VHT-LTFs per streams
-+			 */
-+			n_ltf = (ri.nss != 1) && (ri.nss % 2) ?
-+				ri.nss + 1 : ri.nss;
-+			ts += 4 * n_ltf;
-+		}
-+
- 		break;
- 	default:
- 		WARN_ON(1);
-@@ -3710,7 +3775,6 @@ u64 ieee80211_calculate_rx_timestamp(str
- 		ri.legacy = DIV_ROUND_UP(bitrate, (1 << shift));
- 
- 		if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
--			/* TODO: handle HT/VHT preambles */
- 			if (status->band == NL80211_BAND_5GHZ) {
- 				ts += 20 << shift;
- 				mpdu_offset += 2;
diff --git a/package/kernel/mac80211/patches/subsys/374-mac80211-move-A-MPDU-session-check-from-minstrel_ht-.patch b/package/kernel/mac80211/patches/subsys/374-mac80211-move-A-MPDU-session-check-from-minstrel_ht-.patch
deleted file mode 100644
index bab8917ff..000000000
--- a/package/kernel/mac80211/patches/subsys/374-mac80211-move-A-MPDU-session-check-from-minstrel_ht-.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Thu, 17 Jun 2021 17:56:54 +0200
-Subject: [PATCH] mac80211: move A-MPDU session check from minstrel_ht to
- mac80211
-
-This avoids calling back into tx handlers from within the rate control module.
-Preparation for deferring rate control until tx dequeue
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -6160,6 +6160,11 @@ enum rate_control_capabilities {
- 	 * otherwise the NSS difference doesn't bother us.
- 	 */
- 	RATE_CTRL_CAPA_VHT_EXT_NSS_BW = BIT(0),
-+	/**
-+	 * @RATE_CTRL_CAPA_AMPDU_TRIGGER:
-+	 * mac80211 should start A-MPDU sessions on tx
-+	 */
-+	RATE_CTRL_CAPA_AMPDU_TRIGGER = BIT(1),
- };
- 
- struct rate_control_ops {
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -1144,29 +1144,6 @@ minstrel_downgrade_prob_rate(struct mins
- }
- 
- static void
--minstrel_aggr_check(struct ieee80211_sta *pubsta, struct sk_buff *skb)
--{
--	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
--	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
--	u16 tid;
--
--	if (skb_get_queue_mapping(skb) == IEEE80211_AC_VO)
--		return;
--
--	if (unlikely(!ieee80211_is_data_qos(hdr->frame_control)))
--		return;
--
--	if (unlikely(skb->protocol == cpu_to_be16(ETH_P_PAE)))
--		return;
--
--	tid = ieee80211_get_tid(hdr);
--	if (likely(sta->ampdu_mlme.tid_tx[tid]))
--		return;
--
--	ieee80211_start_tx_ba_session(pubsta, tid, 0);
--}
--
--static void
- minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
-                       void *priv_sta, struct ieee80211_tx_status *st)
- {
-@@ -1461,10 +1438,6 @@ minstrel_ht_get_rate(void *priv, struct
- 	struct minstrel_priv *mp = priv;
- 	u16 sample_idx;
- 
--	if (!(info->flags & IEEE80211_TX_CTL_AMPDU) &&
--	    !minstrel_ht_is_legacy_group(MI_RATE_GROUP(mi->max_prob_rate)))
--		minstrel_aggr_check(sta, txrc->skb);
--
- 	info->flags |= mi->tx_flags;
- 
- #ifdef CPTCFG_MAC80211_DEBUGFS
-@@ -1870,6 +1843,7 @@ static u32 minstrel_ht_get_expected_thro
- 
- static const struct rate_control_ops mac80211_minstrel_ht = {
- 	.name = "minstrel_ht",
-+	.capa = RATE_CTRL_CAPA_AMPDU_TRIGGER,
- 	.tx_status_ext = minstrel_ht_tx_status,
- 	.get_rate = minstrel_ht_get_rate,
- 	.rate_init = minstrel_ht_rate_init,
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3965,6 +3965,29 @@ void ieee80211_txq_schedule_start(struct
- }
- EXPORT_SYMBOL(ieee80211_txq_schedule_start);
- 
-+static void
-+ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata,
-+		     struct sta_info *sta,
-+		     struct sk_buff *skb)
-+{
-+	struct rate_control_ref *ref = sdata->local->rate_ctrl;
-+	u16 tid;
-+
-+	if (!ref || !(ref->ops->capa & RATE_CTRL_CAPA_AMPDU_TRIGGER))
-+		return;
-+
-+	if (!sta || !sta->sta.ht_cap.ht_supported ||
-+	    !sta->sta.wme || skb_get_queue_mapping(skb) == IEEE80211_AC_VO ||
-+	    skb->protocol == sdata->control_port_protocol)
-+		return;
-+
-+	tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
-+	if (likely(sta->ampdu_mlme.tid_tx[tid]))
-+		return;
-+
-+	ieee80211_start_tx_ba_session(&sta->sta, tid, 0);
-+}
-+
- void __ieee80211_subif_start_xmit(struct sk_buff *skb,
- 				  struct net_device *dev,
- 				  u32 info_flags,
-@@ -3995,6 +4018,8 @@ void __ieee80211_subif_start_xmit(struct
- 		skb_get_hash(skb);
- 	}
- 
-+	ieee80211_aggr_check(sdata, sta, skb);
-+
- 	if (sta) {
- 		struct ieee80211_fast_tx *fast_tx;
- 
-@@ -4258,6 +4283,8 @@ static void ieee80211_8023_xmit(struct i
- 
- 	memset(info, 0, sizeof(*info));
- 
-+	ieee80211_aggr_check(sdata, sta, skb);
-+
- 	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
- 	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
- 	if (tid_tx) {
diff --git a/package/kernel/mac80211/patches/subsys/375-mac80211-call-ieee80211_tx_h_rate_ctrl-when-dequeue.patch b/package/kernel/mac80211/patches/subsys/375-mac80211-call-ieee80211_tx_h_rate_ctrl-when-dequeue.patch
deleted file mode 100644
index 36c46c2f8..000000000
--- a/package/kernel/mac80211/patches/subsys/375-mac80211-call-ieee80211_tx_h_rate_ctrl-when-dequeue.patch
+++ /dev/null
@@ -1,114 +0,0 @@
-From: Ryder Lee <ryder.lee@mediatek.com>
-Date: Fri, 28 May 2021 14:05:41 +0800
-Subject: [PATCH] mac80211: call ieee80211_tx_h_rate_ctrl() when dequeue
-
-Make ieee80211_tx_h_rate_ctrl() get called on dequeue to improve
-performance since it reduces the turnaround time for rate control.
-
-Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1778,8 +1778,6 @@ static int invoke_tx_handlers_early(stru
- 	CALL_TXH(ieee80211_tx_h_ps_buf);
- 	CALL_TXH(ieee80211_tx_h_check_control_port_protocol);
- 	CALL_TXH(ieee80211_tx_h_select_key);
--	if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
--		CALL_TXH(ieee80211_tx_h_rate_ctrl);
- 
-  txh_done:
- 	if (unlikely(res == TX_DROP)) {
-@@ -1812,6 +1810,9 @@ static int invoke_tx_handlers_late(struc
- 		goto txh_done;
- 	}
- 
-+	if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
-+		CALL_TXH(ieee80211_tx_h_rate_ctrl);
-+
- 	CALL_TXH(ieee80211_tx_h_michael_mic_add);
- 	CALL_TXH(ieee80211_tx_h_sequence);
- 	CALL_TXH(ieee80211_tx_h_fragment);
-@@ -3416,15 +3417,21 @@ out:
-  * Can be called while the sta lock is held. Anything that can cause packets to
-  * be generated will cause deadlock!
-  */
--static void ieee80211_xmit_fast_finish(struct ieee80211_sub_if_data *sdata,
--				       struct sta_info *sta, u8 pn_offs,
--				       struct ieee80211_key *key,
--				       struct sk_buff *skb)
-+static ieee80211_tx_result
-+ieee80211_xmit_fast_finish(struct ieee80211_sub_if_data *sdata,
-+			   struct sta_info *sta, u8 pn_offs,
-+			   struct ieee80211_key *key,
-+			   struct ieee80211_tx_data *tx)
- {
-+	struct sk_buff *skb = tx->skb;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_hdr *hdr = (void *)skb->data;
- 	u8 tid = IEEE80211_NUM_TIDS;
- 
-+	if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL) &&
-+	    ieee80211_tx_h_rate_ctrl(tx) != TX_CONTINUE)
-+		return TX_DROP;
-+
- 	if (key)
- 		info->control.hw_key = &key->conf;
- 
-@@ -3473,6 +3480,8 @@ static void ieee80211_xmit_fast_finish(s
- 			break;
- 		}
- 	}
-+
-+	return TX_CONTINUE;
- }
- 
- static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
-@@ -3576,24 +3585,17 @@ static bool ieee80211_xmit_fast(struct i
- 	tx.sta = sta;
- 	tx.key = fast_tx->key;
- 
--	if (!ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL)) {
--		tx.skb = skb;
--		r = ieee80211_tx_h_rate_ctrl(&tx);
--		skb = tx.skb;
--		tx.skb = NULL;
--
--		if (r != TX_CONTINUE) {
--			if (r != TX_QUEUED)
--				kfree_skb(skb);
--			return true;
--		}
--	}
--
- 	if (ieee80211_queue_skb(local, sdata, sta, skb))
- 		return true;
- 
--	ieee80211_xmit_fast_finish(sdata, sta, fast_tx->pn_offs,
--				   fast_tx->key, skb);
-+	tx.skb = skb;
-+	r = ieee80211_xmit_fast_finish(sdata, sta, fast_tx->pn_offs,
-+				       fast_tx->key, &tx);
-+	tx.skb = NULL;
-+	if (r == TX_DROP) {
-+		kfree_skb(skb);
-+		return true;
-+	}
- 
- 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
- 		sdata = container_of(sdata->bss,
-@@ -3704,8 +3706,12 @@ begin:
- 		    (tx.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV))
- 			pn_offs = ieee80211_hdrlen(hdr->frame_control);
- 
--		ieee80211_xmit_fast_finish(sta->sdata, sta, pn_offs,
--					   tx.key, skb);
-+		r = ieee80211_xmit_fast_finish(sta->sdata, sta, pn_offs,
-+					       tx.key, &tx);
-+		if (r != TX_CONTINUE) {
-+			ieee80211_free_txskb(&local->hw, skb);
-+			goto begin;
-+		}
- 	} else {
- 		if (invoke_tx_handlers_late(&tx))
- 			goto begin;
diff --git a/package/kernel/mac80211/patches/subsys/376-mac80211-add-rate-control-support-for-encap-offload.patch b/package/kernel/mac80211/patches/subsys/376-mac80211-add-rate-control-support-for-encap-offload.patch
deleted file mode 100644
index 11890ae3f..000000000
--- a/package/kernel/mac80211/patches/subsys/376-mac80211-add-rate-control-support-for-encap-offload.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-From: Ryder Lee <ryder.lee@mediatek.com>
-Date: Fri, 28 May 2021 14:05:43 +0800
-Subject: [PATCH] mac80211: add rate control support for encap offload
-
-The software rate control cannot deal with encap offload, so fix it.
-
-Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
----
-
---- a/net/mac80211/rate.c
-+++ b/net/mac80211/rate.c
-@@ -297,15 +297,11 @@ void ieee80211_check_rate_mask(struct ie
- static bool rc_no_data_or_no_ack_use_min(struct ieee80211_tx_rate_control *txrc)
- {
- 	struct sk_buff *skb = txrc->skb;
--	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
--	__le16 fc;
--
--	fc = hdr->frame_control;
- 
- 	return (info->flags & (IEEE80211_TX_CTL_NO_ACK |
- 			       IEEE80211_TX_CTL_USE_MINRATE)) ||
--		!ieee80211_is_data(fc);
-+		!ieee80211_is_tx_data(skb);
- }
- 
- static void rc_send_low_basicrate(struct ieee80211_tx_rate *rate,
-@@ -870,7 +866,6 @@ void ieee80211_get_tx_rates(struct ieee8
- 			    int max_rates)
- {
- 	struct ieee80211_sub_if_data *sdata;
--	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_supported_band *sband;
- 
-@@ -882,7 +877,7 @@ void ieee80211_get_tx_rates(struct ieee8
- 	sdata = vif_to_sdata(vif);
- 	sband = sdata->local->hw.wiphy->bands[info->band];
- 
--	if (ieee80211_is_data(hdr->frame_control))
-+	if (ieee80211_is_tx_data(skb))
- 		rate_control_apply_mask(sdata, sta, sband, dest, max_rates);
- 
- 	if (dest[0].idx < 0)
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -679,6 +679,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
- 	u32 len;
- 	struct ieee80211_tx_rate_control txrc;
- 	struct ieee80211_sta_rates *ratetbl = NULL;
-+	bool encap = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
- 	bool assoc = false;
- 
- 	memset(&txrc, 0, sizeof(txrc));
-@@ -720,7 +721,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
- 	 * just wants a probe response.
- 	 */
- 	if (tx->sdata->vif.bss_conf.use_short_preamble &&
--	    (ieee80211_is_data(hdr->frame_control) ||
-+	    (ieee80211_is_tx_data(tx->skb) ||
- 	     (tx->sta && test_sta_flag(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
- 		txrc.short_preamble = true;
- 
-@@ -742,7 +743,8 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
- 		 "%s: Dropped data frame as no usable bitrate found while "
- 		 "scanning and associated. Target station: "
- 		 "%pM on %d GHz band\n",
--		 tx->sdata->name, hdr->addr1,
-+		 tx->sdata->name,
-+		 encap ? ((struct ethhdr *)hdr)->h_dest : hdr->addr1,
- 		 info->band ? 5 : 2))
- 		return TX_DROP;
- 
-@@ -776,7 +778,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
- 
- 	if (txrc.reported_rate.idx < 0) {
- 		txrc.reported_rate = tx->rate;
--		if (tx->sta && ieee80211_is_data(hdr->frame_control))
-+		if (tx->sta && ieee80211_is_tx_data(tx->skb))
- 			tx->sta->tx_stats.last_rate = txrc.reported_rate;
- 	} else if (tx->sta)
- 		tx->sta->tx_stats.last_rate = txrc.reported_rate;
-@@ -3694,8 +3696,16 @@ begin:
- 	else
- 		info->flags &= ~IEEE80211_TX_CTL_AMPDU;
- 
--	if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP)
-+	if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
-+		if (!ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL)) {
-+			r = ieee80211_tx_h_rate_ctrl(&tx);
-+			if (r != TX_CONTINUE) {
-+				ieee80211_free_txskb(&local->hw, skb);
-+				goto begin;
-+			}
-+		}
- 		goto encap_out;
-+	}
- 
- 	if (info->control.flags & IEEE80211_TX_CTRL_FAST_XMIT) {
- 		struct sta_info *sta = container_of(txq->sta, struct sta_info,
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -6733,4 +6733,22 @@ struct sk_buff *ieee80211_get_fils_disco
- struct sk_buff *
- ieee80211_get_unsol_bcast_probe_resp_tmpl(struct ieee80211_hw *hw,
- 					  struct ieee80211_vif *vif);
-+
-+/**
-+ * ieee80211_is_tx_data - check if frame is a data frame
-+ *
-+ * The function is used to check if a frame is a data frame. Frames with
-+ * hardware encapsulation enabled are data frames.
-+ *
-+ * @skb: the frame to be transmitted.
-+ */
-+static inline bool ieee80211_is_tx_data(struct sk_buff *skb)
-+{
-+	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	struct ieee80211_hdr *hdr = (void *) skb->data;
-+
-+	return info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP ||
-+	       ieee80211_is_data(hdr->frame_control);
-+}
-+
- #endif /* MAC80211_H */
diff --git a/package/kernel/mac80211/patches/subsys/377-mac80211-minstrel_ht-fix-sample-time-check.patch b/package/kernel/mac80211/patches/subsys/377-mac80211-minstrel_ht-fix-sample-time-check.patch
deleted file mode 100644
index 054662f3e..000000000
--- a/package/kernel/mac80211/patches/subsys/377-mac80211-minstrel_ht-fix-sample-time-check.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Thu, 17 Jun 2021 12:05:54 +0200
-Subject: [PATCH] mac80211: minstrel_ht: fix sample time check
-
-We need to skip sampling if the next sample time is after jiffies, not before.
-This patch fixes an issue where in some cases only very little sampling (or none
-at all) is performed, leading to really bad data rates
-
-Fixes: 80d55154b2f8 ("mac80211: minstrel_ht: significantly redesign the rate probing strategy")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -1450,7 +1450,7 @@ minstrel_ht_get_rate(void *priv, struct
- 	    (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO))
- 		return;
- 
--	if (time_is_before_jiffies(mi->sample_time))
-+	if (time_is_after_jiffies(mi->sample_time))
- 		return;
- 
- 	mi->sample_time = jiffies + MINSTREL_SAMPLE_INTERVAL;
diff --git a/package/kernel/mac80211/patches/subsys/379-mac80211-fix-starting-aggregation-sessions-on-mesh-i.patch b/package/kernel/mac80211/patches/subsys/379-mac80211-fix-starting-aggregation-sessions-on-mesh-i.patch
deleted file mode 100644
index a684b5938..000000000
--- a/package/kernel/mac80211/patches/subsys/379-mac80211-fix-starting-aggregation-sessions-on-mesh-i.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 29 Jun 2021 13:25:09 +0200
-Subject: [PATCH] mac80211: fix starting aggregation sessions on mesh
- interfaces
-
-The logic for starting aggregation sessions was recently moved from minstrel_ht
-to mac80211, into the subif tx handler just after the sta lookup.
-Unfortunately this didn't work for mesh interfaces, since the sta lookup is
-deferred until a much later point in time on those.
-Fix this by also calling the aggregation check right after the deferred sta
-lookup.
-
-Fixes: 08a46c642001 ("mac80211: move A-MPDU session check from minstrel_ht to mac80211")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1159,6 +1159,29 @@ static bool ieee80211_tx_prep_agg(struct
- 	return queued;
- }
- 
-+static void
-+ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata,
-+		     struct sta_info *sta,
-+		     struct sk_buff *skb)
-+{
-+	struct rate_control_ref *ref = sdata->local->rate_ctrl;
-+	u16 tid;
-+
-+	if (!ref || !(ref->ops->capa & RATE_CTRL_CAPA_AMPDU_TRIGGER))
-+		return;
-+
-+	if (!sta || !sta->sta.ht_cap.ht_supported ||
-+	    !sta->sta.wme || skb_get_queue_mapping(skb) == IEEE80211_AC_VO ||
-+	    skb->protocol == sdata->control_port_protocol)
-+		return;
-+
-+	tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
-+	if (likely(sta->ampdu_mlme.tid_tx[tid]))
-+		return;
-+
-+	ieee80211_start_tx_ba_session(&sta->sta, tid, 0);
-+}
-+
- /*
-  * initialises @tx
-  * pass %NULL for the station if unknown, a valid pointer if known
-@@ -1172,6 +1195,7 @@ ieee80211_tx_prepare(struct ieee80211_su
- 	struct ieee80211_local *local = sdata->local;
- 	struct ieee80211_hdr *hdr;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	bool aggr_check = false;
- 	int tid;
- 
- 	memset(tx, 0, sizeof(*tx));
-@@ -1200,8 +1224,10 @@ ieee80211_tx_prepare(struct ieee80211_su
- 		} else if (tx->sdata->control_port_protocol == tx->skb->protocol) {
- 			tx->sta = sta_info_get_bss(sdata, hdr->addr1);
- 		}
--		if (!tx->sta && !is_multicast_ether_addr(hdr->addr1))
-+		if (!tx->sta && !is_multicast_ether_addr(hdr->addr1)) {
- 			tx->sta = sta_info_get(sdata, hdr->addr1);
-+			aggr_check = true;
-+		}
- 	}
- 
- 	if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
-@@ -1211,8 +1237,12 @@ ieee80211_tx_prepare(struct ieee80211_su
- 		struct tid_ampdu_tx *tid_tx;
- 
- 		tid = ieee80211_get_tid(hdr);
--
- 		tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]);
-+		if (!tid_tx && aggr_check) {
-+			ieee80211_aggr_check(sdata, tx->sta, skb);
-+			tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]);
-+		}
-+
- 		if (tid_tx) {
- 			bool queued;
- 
-@@ -3981,29 +4011,6 @@ void ieee80211_txq_schedule_start(struct
- }
- EXPORT_SYMBOL(ieee80211_txq_schedule_start);
- 
--static void
--ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata,
--		     struct sta_info *sta,
--		     struct sk_buff *skb)
--{
--	struct rate_control_ref *ref = sdata->local->rate_ctrl;
--	u16 tid;
--
--	if (!ref || !(ref->ops->capa & RATE_CTRL_CAPA_AMPDU_TRIGGER))
--		return;
--
--	if (!sta || !sta->sta.ht_cap.ht_supported ||
--	    !sta->sta.wme || skb_get_queue_mapping(skb) == IEEE80211_AC_VO ||
--	    skb->protocol == sdata->control_port_protocol)
--		return;
--
--	tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
--	if (likely(sta->ampdu_mlme.tid_tx[tid]))
--		return;
--
--	ieee80211_start_tx_ba_session(&sta->sta, tid, 0);
--}
--
- void __ieee80211_subif_start_xmit(struct sk_buff *skb,
- 				  struct net_device *dev,
- 				  u32 info_flags,
diff --git a/package/kernel/mac80211/patches/subsys/380-mac80211-introduce-aql_enable-node-in-debugfs.patch b/package/kernel/mac80211/patches/subsys/380-mac80211-introduce-aql_enable-node-in-debugfs.patch
deleted file mode 100644
index be370174d..000000000
--- a/package/kernel/mac80211/patches/subsys/380-mac80211-introduce-aql_enable-node-in-debugfs.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Sat, 9 Jan 2021 18:57:51 +0100
-Subject: [PATCH] mac80211: introduce aql_enable node in debugfs
-
-Introduce aql_enable node in debugfs in order to enable/disable aql.
-This is useful for debugging purpose.
-
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://lore.kernel.org/r/e7a934d5d84e4796c4f97ea5de4e66c824296b07.1610214851.git.lorenzo@kernel.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/debugfs.c
-+++ b/net/mac80211/debugfs.c
-@@ -281,6 +281,56 @@ static const struct file_operations aql_
- 	.llseek = default_llseek,
- };
- 
-+static ssize_t aql_enable_read(struct file *file, char __user *user_buf,
-+			       size_t count, loff_t *ppos)
-+{
-+	char buf[3];
-+	int len;
-+
-+	len = scnprintf(buf, sizeof(buf), "%d\n",
-+			!static_key_false(&aql_disable.key));
-+
-+	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-+}
-+
-+static ssize_t aql_enable_write(struct file *file, const char __user *user_buf,
-+				size_t count, loff_t *ppos)
-+{
-+	bool aql_disabled = static_key_false(&aql_disable.key);
-+	char buf[3];
-+	size_t len;
-+
-+	if (count > sizeof(buf))
-+		return -EINVAL;
-+
-+	if (copy_from_user(buf, user_buf, count))
-+		return -EFAULT;
-+
-+	buf[sizeof(buf) - 1] = '\0';
-+	len = strlen(buf);
-+	if (len > 0 && buf[len - 1] == '\n')
-+		buf[len - 1] = 0;
-+
-+	if (buf[0] == '0' && buf[1] == '\0') {
-+		if (!aql_disabled)
-+			static_branch_inc(&aql_disable);
-+	} else if (buf[0] == '1' && buf[1] == '\0') {
-+		if (aql_disabled)
-+			static_branch_dec(&aql_disable);
-+	} else {
-+		return -EINVAL;
-+	}
-+
-+	return count;
-+}
-+
-+static const struct file_operations aql_enable_ops = {
-+	.write = aql_enable_write,
-+	.read = aql_enable_read,
-+	.open = simple_open,
-+	.llseek = default_llseek,
-+};
-+
- static ssize_t force_tx_status_read(struct file *file,
- 				    char __user *user_buf,
- 				    size_t count,
-@@ -569,6 +619,7 @@ void debugfs_hw_add(struct ieee80211_loc
- 	DEBUGFS_ADD(power);
- 	DEBUGFS_ADD(hw_conf);
- 	DEBUGFS_ADD_MODE(force_tx_status, 0600);
-+	DEBUGFS_ADD_MODE(aql_enable, 0600);
- 
- 	if (local->ops->wake_tx_queue)
- 		DEBUGFS_ADD_MODE(aqm, 0600);
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -1140,6 +1140,8 @@ enum mac80211_scan_state {
- 	SCAN_ABORT,
- };
- 
-+DECLARE_STATIC_KEY_FALSE(aql_disable);
-+
- struct ieee80211_local {
- 	/* embed the driver visible part.
- 	 * don't cast (use the static inlines below), but we keep
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3921,6 +3921,8 @@ void __ieee80211_schedule_txq(struct iee
- }
- EXPORT_SYMBOL(__ieee80211_schedule_txq);
- 
-+DEFINE_STATIC_KEY_FALSE(aql_disable);
-+
- bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,
- 				 struct ieee80211_txq *txq)
- {
-@@ -3930,6 +3932,9 @@ bool ieee80211_txq_airtime_check(struct
- 	if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
- 		return true;
- 
-+	if (static_branch_unlikely(&aql_disable))
-+		return true;
-+
- 	if (!txq->sta)
- 		return true;
- 
diff --git a/package/kernel/mac80211/patches/subsys/381-mac80211-rearrange-struct-txq_info-for-fewer-holes.patch b/package/kernel/mac80211/patches/subsys/381-mac80211-rearrange-struct-txq_info-for-fewer-holes.patch
deleted file mode 100644
index 708ad6f46..000000000
--- a/package/kernel/mac80211/patches/subsys/381-mac80211-rearrange-struct-txq_info-for-fewer-holes.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Fri, 18 Jun 2021 13:41:44 +0300
-Subject: [PATCH] mac80211: rearrange struct txq_info for fewer holes
-
-We can slightly decrease the size of struct txq_info by
-rearranging some fields for fewer holes, so do that.
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Link: https://lore.kernel.org/r/iwlwifi.20210618133832.1bf019a1fe2e.Ib54622b8d6dc1a9a7dc484e573c073119450538b@changeid
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -5,7 +5,7 @@
-  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
-  * Copyright 2007-2010	Johannes Berg <johannes@sipsolutions.net>
-  * Copyright 2013-2015  Intel Mobile Communications GmbH
-- * Copyright (C) 2018-2020 Intel Corporation
-+ * Copyright (C) 2018-2021 Intel Corporation
-  */
- 
- #ifndef IEEE80211_I_H
-@@ -848,9 +848,12 @@ struct txq_info {
- 	struct fq_tin tin;
- 	struct codel_vars def_cvars;
- 	struct codel_stats cstats;
--	struct sk_buff_head frags;
--	struct list_head schedule_order;
-+
- 	u16 schedule_round;
-+	struct list_head schedule_order;
-+
-+	struct sk_buff_head frags;
-+
- 	unsigned long flags;
- 
- 	/* keep last! */
diff --git a/package/kernel/mac80211/patches/subsys/382-mac80211-Switch-to-a-virtual-time-based-airtime-sche.patch b/package/kernel/mac80211/patches/subsys/382-mac80211-Switch-to-a-virtual-time-based-airtime-sche.patch
deleted file mode 100644
index fc29074cf..000000000
--- a/package/kernel/mac80211/patches/subsys/382-mac80211-Switch-to-a-virtual-time-based-airtime-sche.patch
+++ /dev/null
@@ -1,1277 +0,0 @@
-From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@redhat.com>
-Date: Wed, 23 Jun 2021 15:47:55 +0200
-Subject: [PATCH] mac80211: Switch to a virtual time-based airtime scheduler
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This switches the airtime scheduler in mac80211 to use a virtual
-time-based scheduler instead of the round-robin scheduler used before.
-This has a couple of advantages:
-
-- No need to sync up the round-robin scheduler in firmware/hardware with
-  the round-robin airtime scheduler.
-
-- If several stations are eligible for transmission we can schedule both
-  of them; no need to hard-block the scheduling rotation until the head
-  of the queue has used up its quantum.
-
-- The check of whether a station is eligible for transmission becomes
-  simpler (in ieee80211_txq_may_transmit()).
-
-The drawback is that scheduling becomes slightly more expensive, as we
-need to maintain an rbtree of TXQs sorted by virtual time. This means
-that ieee80211_register_airtime() becomes O(logN) in the number of
-currently scheduled TXQs because it can change the order of the
-scheduled stations. We mitigate this overhead by only resorting when a
-station changes position in the tree, and hopefully N rarely grows too
-big (it's only TXQs currently backlogged, not all associated stations),
-so it shouldn't be too big of an issue.
-
-To prevent divisions in the fast path, we maintain both station sums and
-pre-computed reciprocals of the sums. This turns the fast-path operation
-into a multiplication, with divisions only happening as the number of
-active stations change (to re-compute the current sum of all active
-station weights). To prevent this re-computation of the reciprocal from
-happening too frequently, we use a time-based notion of station
-activity, instead of updating the weight every time a station gets
-scheduled or de-scheduled. As queues can oscillate between empty and
-occupied quite frequently, this can significantly cut down on the number
-of re-computations. It also has the added benefit of making the station
-airtime calculation independent on whether the queue happened to have
-drained at the time an airtime value was accounted.
-
-Co-developed-by: Yibo Zhao <yiboz@codeaurora.org>
-Signed-off-by: Yibo Zhao <yiboz@codeaurora.org>
-Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
-Link: https://lore.kernel.org/r/20210623134755.235545-1-toke@redhat.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -6557,9 +6557,6 @@ static inline void ieee80211_txq_schedul
- {
- }
- 
--void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
--			      struct ieee80211_txq *txq, bool force);
--
- /**
-  * ieee80211_schedule_txq - schedule a TXQ for transmission
-  *
-@@ -6572,11 +6569,7 @@ void __ieee80211_schedule_txq(struct iee
-  * The driver may call this function if it has buffered packets for
-  * this TXQ internally.
-  */
--static inline void
--ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
--{
--	__ieee80211_schedule_txq(hw, txq, true);
--}
-+void ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq);
- 
- /**
-  * ieee80211_return_txq - return a TXQ previously acquired by ieee80211_next_txq()
-@@ -6588,12 +6581,8 @@ ieee80211_schedule_txq(struct ieee80211_
-  * The driver may set force=true if it has buffered packets for this TXQ
-  * internally.
-  */
--static inline void
--ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq,
--		     bool force)
--{
--	__ieee80211_schedule_txq(hw, txq, force);
--}
-+void ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq,
-+			  bool force);
- 
- /**
-  * ieee80211_txq_may_transmit - check whether TXQ is allowed to transmit
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -1461,6 +1461,38 @@ static void sta_apply_mesh_params(struct
- #endif
- }
- 
-+static void sta_apply_airtime_params(struct ieee80211_local *local,
-+				     struct sta_info *sta,
-+				     struct station_parameters *params)
-+{
-+	u8 ac;
-+
-+	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
-+		struct airtime_sched_info *air_sched = &local->airtime[ac];
-+		struct airtime_info *air_info = &sta->airtime[ac];
-+		struct txq_info *txqi;
-+		u8 tid;
-+
-+		spin_lock_bh(&air_sched->lock);
-+		for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
-+			if (air_info->weight == params->airtime_weight ||
-+			    !sta->sta.txq[tid] ||
-+			    ac != ieee80211_ac_from_tid(tid))
-+				continue;
-+
-+			airtime_weight_set(air_info, params->airtime_weight);
-+
-+			txqi = to_txq_info(sta->sta.txq[tid]);
-+			if (RB_EMPTY_NODE(&txqi->schedule_order))
-+				continue;
-+
-+			ieee80211_update_airtime_weight(local, air_sched,
-+							0, true);
-+		}
-+		spin_unlock_bh(&air_sched->lock);
-+	}
-+}
-+
- static int sta_apply_parameters(struct ieee80211_local *local,
- 				struct sta_info *sta,
- 				struct station_parameters *params)
-@@ -1648,7 +1680,8 @@ static int sta_apply_parameters(struct i
- 		sta_apply_mesh_params(local, sta, params);
- 
- 	if (params->airtime_weight)
--		sta->airtime_weight = params->airtime_weight;
-+		sta_apply_airtime_params(local, sta, params);
-+
- 
- 	/* set the STA state after all sta info from usermode has been set */
- 	if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) ||
---- a/net/mac80211/debugfs.c
-+++ b/net/mac80211/debugfs.c
-@@ -216,14 +216,14 @@ static ssize_t aql_txq_limit_read(struct
- 			"VI	%u		%u\n"
- 			"BE	%u		%u\n"
- 			"BK	%u		%u\n",
--			local->aql_txq_limit_low[IEEE80211_AC_VO],
--			local->aql_txq_limit_high[IEEE80211_AC_VO],
--			local->aql_txq_limit_low[IEEE80211_AC_VI],
--			local->aql_txq_limit_high[IEEE80211_AC_VI],
--			local->aql_txq_limit_low[IEEE80211_AC_BE],
--			local->aql_txq_limit_high[IEEE80211_AC_BE],
--			local->aql_txq_limit_low[IEEE80211_AC_BK],
--			local->aql_txq_limit_high[IEEE80211_AC_BK]);
-+			local->airtime[IEEE80211_AC_VO].aql_txq_limit_low,
-+			local->airtime[IEEE80211_AC_VO].aql_txq_limit_high,
-+			local->airtime[IEEE80211_AC_VI].aql_txq_limit_low,
-+			local->airtime[IEEE80211_AC_VI].aql_txq_limit_high,
-+			local->airtime[IEEE80211_AC_BE].aql_txq_limit_low,
-+			local->airtime[IEEE80211_AC_BE].aql_txq_limit_high,
-+			local->airtime[IEEE80211_AC_BK].aql_txq_limit_low,
-+			local->airtime[IEEE80211_AC_BK].aql_txq_limit_high);
- 	return simple_read_from_buffer(user_buf, count, ppos,
- 				       buf, len);
- }
-@@ -255,11 +255,11 @@ static ssize_t aql_txq_limit_write(struc
- 	if (ac >= IEEE80211_NUM_ACS)
- 		return -EINVAL;
- 
--	q_limit_low_old = local->aql_txq_limit_low[ac];
--	q_limit_high_old = local->aql_txq_limit_high[ac];
-+	q_limit_low_old = local->airtime[ac].aql_txq_limit_low;
-+	q_limit_high_old = local->airtime[ac].aql_txq_limit_high;
- 
--	local->aql_txq_limit_low[ac] = q_limit_low;
--	local->aql_txq_limit_high[ac] = q_limit_high;
-+	local->airtime[ac].aql_txq_limit_low = q_limit_low;
-+	local->airtime[ac].aql_txq_limit_high = q_limit_high;
- 
- 	mutex_lock(&local->sta_mtx);
- 	list_for_each_entry(sta, &local->sta_list, list) {
-@@ -382,6 +382,46 @@ static const struct file_operations forc
- 	.llseek = default_llseek,
- };
- 
-+static ssize_t airtime_read(struct file *file,
-+			    char __user *user_buf,
-+			    size_t count,
-+			    loff_t *ppos)
-+{
-+	struct ieee80211_local *local = file->private_data;
-+	char buf[200];
-+	u64 v_t[IEEE80211_NUM_ACS];
-+	u64 wt[IEEE80211_NUM_ACS];
-+	int len = 0, ac;
-+
-+	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
-+		spin_lock_bh(&local->airtime[ac].lock);
-+		v_t[ac] = local->airtime[ac].v_t;
-+		wt[ac] = local->airtime[ac].weight_sum;
-+		spin_unlock_bh(&local->airtime[ac].lock);
-+	}
-+	len = scnprintf(buf, sizeof(buf),
-+			"\tVO         VI         BE         BK\n"
-+			"Virt-t\t%-10llu %-10llu %-10llu %-10llu\n"
-+			"Weight\t%-10llu %-10llu %-10llu %-10llu\n",
-+			v_t[0],
-+			v_t[1],
-+			v_t[2],
-+			v_t[3],
-+			wt[0],
-+			wt[1],
-+			wt[2],
-+			wt[3]);
-+
-+	return simple_read_from_buffer(user_buf, count, ppos,
-+				       buf, len);
-+}
-+
-+static const struct file_operations airtime_ops = {
-+	.read = airtime_read,
-+	.open = simple_open,
-+	.llseek = default_llseek,
-+};
-+
- #ifdef CONFIG_PM
- static ssize_t reset_write(struct file *file, const char __user *user_buf,
- 			   size_t count, loff_t *ppos)
-@@ -624,7 +664,11 @@ void debugfs_hw_add(struct ieee80211_loc
- 	if (local->ops->wake_tx_queue)
- 		DEBUGFS_ADD_MODE(aqm, 0600);
- 
--	DEBUGFS_ADD_MODE(airtime_flags, 0600);
-+	if (wiphy_ext_feature_isset(local->hw.wiphy,
-+				    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) {
-+		DEBUGFS_ADD_MODE(airtime, 0600);
-+		DEBUGFS_ADD_MODE(airtime_flags, 0600);
-+	}
- 
- 	DEBUGFS_ADD(aql_txq_limit);
- 	debugfs_create_u32("aql_threshold", 0600,
---- a/net/mac80211/debugfs_netdev.c
-+++ b/net/mac80211/debugfs_netdev.c
-@@ -513,6 +513,34 @@ static ssize_t ieee80211_if_fmt_aqm(
- }
- IEEE80211_IF_FILE_R(aqm);
- 
-+static ssize_t ieee80211_if_fmt_airtime(
-+	const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
-+{
-+	struct ieee80211_local *local = sdata->local;
-+	struct ieee80211_txq *txq = sdata->vif.txq;
-+	struct airtime_info *air_info;
-+	int len;
-+
-+	if (!txq)
-+		return 0;
-+
-+	spin_lock_bh(&local->airtime[txq->ac].lock);
-+	air_info = to_airtime_info(txq);
-+	len = scnprintf(buf,
-+			buflen,
-+			"RX: %llu us\nTX: %llu us\nWeight: %u\n"
-+			"Virt-T: %lld us\n",
-+			air_info->rx_airtime,
-+			air_info->tx_airtime,
-+			air_info->weight,
-+			air_info->v_t);
-+	spin_unlock_bh(&local->airtime[txq->ac].lock);
-+
-+	return len;
-+}
-+
-+IEEE80211_IF_FILE_R(airtime);
-+
- IEEE80211_IF_FILE(multicast_to_unicast, u.ap.multicast_to_unicast, HEX);
- 
- /* IBSS attributes */
-@@ -661,8 +689,10 @@ static void add_common_files(struct ieee
- 
- 	if (sdata->local->ops->wake_tx_queue &&
- 	    sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
--	    sdata->vif.type != NL80211_IFTYPE_NAN)
-+	    sdata->vif.type != NL80211_IFTYPE_NAN) {
- 		DEBUGFS_ADD(aqm);
-+		DEBUGFS_ADD(airtime);
-+	}
- }
- 
- static void add_sta_files(struct ieee80211_sub_if_data *sdata)
---- a/net/mac80211/debugfs_sta.c
-+++ b/net/mac80211/debugfs_sta.c
-@@ -202,7 +202,7 @@ static ssize_t sta_airtime_read(struct f
- 	size_t bufsz = 400;
- 	char *buf = kzalloc(bufsz, GFP_KERNEL), *p = buf;
- 	u64 rx_airtime = 0, tx_airtime = 0;
--	s64 deficit[IEEE80211_NUM_ACS];
-+	u64 v_t[IEEE80211_NUM_ACS];
- 	ssize_t rv;
- 	int ac;
- 
-@@ -210,18 +210,18 @@ static ssize_t sta_airtime_read(struct f
- 		return -ENOMEM;
- 
- 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
--		spin_lock_bh(&local->active_txq_lock[ac]);
-+		spin_lock_bh(&local->airtime[ac].lock);
- 		rx_airtime += sta->airtime[ac].rx_airtime;
- 		tx_airtime += sta->airtime[ac].tx_airtime;
--		deficit[ac] = sta->airtime[ac].deficit;
--		spin_unlock_bh(&local->active_txq_lock[ac]);
-+		v_t[ac] = sta->airtime[ac].v_t;
-+		spin_unlock_bh(&local->airtime[ac].lock);
- 	}
- 
- 	p += scnprintf(p, bufsz + buf - p,
- 		"RX: %llu us\nTX: %llu us\nWeight: %u\n"
--		"Deficit: VO: %lld us VI: %lld us BE: %lld us BK: %lld us\n",
--		rx_airtime, tx_airtime, sta->airtime_weight,
--		deficit[0], deficit[1], deficit[2], deficit[3]);
-+		"Virt-T: VO: %lld us VI: %lld us BE: %lld us BK: %lld us\n",
-+		rx_airtime, tx_airtime, sta->airtime[0].weight,
-+		v_t[0], v_t[1], v_t[2], v_t[3]);
- 
- 	rv = simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
- 	kfree(buf);
-@@ -236,11 +236,11 @@ static ssize_t sta_airtime_write(struct
- 	int ac;
- 
- 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
--		spin_lock_bh(&local->active_txq_lock[ac]);
-+		spin_lock_bh(&local->airtime[ac].lock);
- 		sta->airtime[ac].rx_airtime = 0;
- 		sta->airtime[ac].tx_airtime = 0;
--		sta->airtime[ac].deficit = sta->airtime_weight;
--		spin_unlock_bh(&local->active_txq_lock[ac]);
-+		sta->airtime[ac].v_t = 0;
-+		spin_unlock_bh(&local->airtime[ac].lock);
- 	}
- 
- 	return count;
-@@ -263,10 +263,10 @@ static ssize_t sta_aql_read(struct file
- 		return -ENOMEM;
- 
- 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
--		spin_lock_bh(&local->active_txq_lock[ac]);
-+		spin_lock_bh(&local->airtime[ac].lock);
- 		q_limit_l[ac] = sta->airtime[ac].aql_limit_low;
- 		q_limit_h[ac] = sta->airtime[ac].aql_limit_high;
--		spin_unlock_bh(&local->active_txq_lock[ac]);
-+		spin_unlock_bh(&local->airtime[ac].lock);
- 		q_depth[ac] = atomic_read(&sta->airtime[ac].aql_tx_pending);
- 	}
- 
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -840,20 +840,16 @@ enum txq_info_flags {
-  * @def_flow: used as a fallback flow when a packet destined to @tin hashes to
-  *	a fq_flow which is already owned by a different tin
-  * @def_cvars: codel vars for @def_flow
-- * @frags: used to keep fragments created after dequeue
-  * @schedule_order: used with ieee80211_local->active_txqs
-- * @schedule_round: counter to prevent infinite loops on TXQ scheduling
-+ * @frags: used to keep fragments created after dequeue
-  */
- struct txq_info {
- 	struct fq_tin tin;
- 	struct codel_vars def_cvars;
- 	struct codel_stats cstats;
--
--	u16 schedule_round;
--	struct list_head schedule_order;
-+	struct rb_node schedule_order;
- 
- 	struct sk_buff_head frags;
--
- 	unsigned long flags;
- 
- 	/* keep last! */
-@@ -930,6 +926,8 @@ struct ieee80211_sub_if_data {
- 	struct ieee80211_tx_queue_params tx_conf[IEEE80211_NUM_ACS];
- 	struct mac80211_qos_map __rcu *qos_map;
- 
-+	struct airtime_info airtime[IEEE80211_NUM_ACS];
-+
- 	struct work_struct csa_finalize_work;
- 	bool csa_block_tx; /* write-protected by sdata_lock and local->mtx */
- 	struct cfg80211_chan_def csa_chandef;
-@@ -1143,6 +1141,44 @@ enum mac80211_scan_state {
- 	SCAN_ABORT,
- };
- 
-+/**
-+ * struct airtime_sched_info - state used for airtime scheduling and AQL
-+ *
-+ * @lock: spinlock that protects all the fields in this struct
-+ * @active_txqs: rbtree of currently backlogged queues, sorted by virtual time
-+ * @schedule_pos: the current position maintained while a driver walks the tree
-+ *                with ieee80211_next_txq()
-+ * @active_list: list of struct airtime_info structs that were active within
-+ *               the last AIRTIME_ACTIVE_DURATION (100 ms), used to compute
-+ *               weight_sum
-+ * @last_weight_update: used for rate limiting walking active_list
-+ * @last_schedule_time: tracks the last time a transmission was scheduled; used
-+ *                      for catching up v_t if no stations are eligible for
-+ *                      transmission.
-+ * @v_t: global virtual time; queues with v_t < this are eligible for
-+ *       transmission
-+ * @weight_sum: total sum of all active stations used for dividing airtime
-+ * @weight_sum_reciprocal: reciprocal of weight_sum (to avoid divisions in fast
-+ *                         path - see comment above
-+ *                         IEEE80211_RECIPROCAL_DIVISOR_64)
-+ * @aql_txq_limit_low: AQL limit when total outstanding airtime
-+ *                     is < IEEE80211_AQL_THRESHOLD
-+ * @aql_txq_limit_high: AQL limit when total outstanding airtime
-+ *                      is > IEEE80211_AQL_THRESHOLD
-+ */
-+struct airtime_sched_info {
-+	spinlock_t lock;
-+	struct rb_root_cached active_txqs;
-+	struct rb_node *schedule_pos;
-+	struct list_head active_list;
-+	u64 last_weight_update;
-+	u64 last_schedule_activity;
-+	u64 v_t;
-+	u64 weight_sum;
-+	u64 weight_sum_reciprocal;
-+	u32 aql_txq_limit_low;
-+	u32 aql_txq_limit_high;
-+};
- DECLARE_STATIC_KEY_FALSE(aql_disable);
- 
- struct ieee80211_local {
-@@ -1156,13 +1192,8 @@ struct ieee80211_local {
- 	struct codel_params cparams;
- 
- 	/* protects active_txqs and txqi->schedule_order */
--	spinlock_t active_txq_lock[IEEE80211_NUM_ACS];
--	struct list_head active_txqs[IEEE80211_NUM_ACS];
--	u16 schedule_round[IEEE80211_NUM_ACS];
--
-+	struct airtime_sched_info airtime[IEEE80211_NUM_ACS];
- 	u16 airtime_flags;
--	u32 aql_txq_limit_low[IEEE80211_NUM_ACS];
--	u32 aql_txq_limit_high[IEEE80211_NUM_ACS];
- 	u32 aql_threshold;
- 	atomic_t aql_total_pending_airtime;
- 
-@@ -1581,6 +1612,125 @@ static inline bool txq_has_queue(struct
- 	return !(skb_queue_empty(&txqi->frags) && !txqi->tin.backlog_packets);
- }
- 
-+static inline struct airtime_info *to_airtime_info(struct ieee80211_txq *txq)
-+{
-+	struct ieee80211_sub_if_data *sdata;
-+	struct sta_info *sta;
-+
-+	if (txq->sta) {
-+		sta = container_of(txq->sta, struct sta_info, sta);
-+		return &sta->airtime[txq->ac];
-+	}
-+
-+	sdata = vif_to_sdata(txq->vif);
-+	return &sdata->airtime[txq->ac];
-+}
-+
-+/* To avoid divisions in the fast path, we keep pre-computed reciprocals for
-+ * airtime weight calculations. There are two different weights to keep track
-+ * of: The per-station weight and the sum of weights per phy.
-+ *
-+ * For the per-station weights (kept in airtime_info below), we use 32-bit
-+ * reciprocals with a devisor of 2^19. This lets us keep the multiplications and
-+ * divisions for the station weights as 32-bit operations at the cost of a bit
-+ * of rounding error for high weights; but the choice of divisor keeps rounding
-+ * errors <10% for weights <2^15, assuming no more than 8ms of airtime is
-+ * reported at a time.
-+ *
-+ * For the per-phy sum of weights the values can get higher, so we use 64-bit
-+ * operations for those with a 32-bit divisor, which should avoid any
-+ * significant rounding errors.
-+ */
-+#define IEEE80211_RECIPROCAL_DIVISOR_64 0x100000000ULL
-+#define IEEE80211_RECIPROCAL_SHIFT_64 32
-+#define IEEE80211_RECIPROCAL_DIVISOR_32 0x80000U
-+#define IEEE80211_RECIPROCAL_SHIFT_32 19
-+
-+static inline void airtime_weight_set(struct airtime_info *air_info, u16 weight)
-+{
-+	if (air_info->weight == weight)
-+		return;
-+
-+	air_info->weight = weight;
-+	if (weight) {
-+		air_info->weight_reciprocal =
-+			IEEE80211_RECIPROCAL_DIVISOR_32 / weight;
-+	} else {
-+		air_info->weight_reciprocal = 0;
-+	}
-+}
-+
-+static inline void airtime_weight_sum_set(struct airtime_sched_info *air_sched,
-+					  int weight_sum)
-+{
-+	if (air_sched->weight_sum == weight_sum)
-+		return;
-+
-+	air_sched->weight_sum = weight_sum;
-+	if (air_sched->weight_sum) {
-+		air_sched->weight_sum_reciprocal = IEEE80211_RECIPROCAL_DIVISOR_64;
-+		do_div(air_sched->weight_sum_reciprocal, air_sched->weight_sum);
-+	} else {
-+		air_sched->weight_sum_reciprocal = 0;
-+	}
-+}
-+
-+/* A problem when trying to enforce airtime fairness is that we want to divide
-+ * the airtime between the currently *active* stations. However, basing this on
-+ * the instantaneous queue state of stations doesn't work, as queues tend to
-+ * oscillate very quickly between empty and occupied, leading to the scheduler
-+ * thinking only a single station is active when deciding whether to allow
-+ * transmission (and thus not throttling correctly).
-+ *
-+ * To fix this we use a timer-based notion of activity: a station is considered
-+ * active if it has been scheduled within the last 100 ms; we keep a separate
-+ * list of all the stations considered active in this manner, and lazily update
-+ * the total weight of active stations from this list (filtering the stations in
-+ * the list by their 'last active' time).
-+ *
-+ * We add one additional safeguard to guard against stations that manage to get
-+ * scheduled every 100 ms but don't transmit a lot of data, and thus don't use
-+ * up any airtime. Such stations would be able to get priority for an extended
-+ * period of time if they do start transmitting at full capacity again, and so
-+ * we add an explicit maximum for how far behind a station is allowed to fall in
-+ * the virtual airtime domain. This limit is set to a relatively high value of
-+ * 20 ms because the main mechanism for catching up idle stations is the active
-+ * state as described above; i.e., the hard limit should only be hit in
-+ * pathological cases.
-+ */
-+#define AIRTIME_ACTIVE_DURATION (100 * NSEC_PER_MSEC)
-+#define AIRTIME_MAX_BEHIND 20000 /* 20 ms */
-+
-+static inline bool airtime_is_active(struct airtime_info *air_info, u64 now)
-+{
-+	return air_info->last_scheduled >= now - AIRTIME_ACTIVE_DURATION;
-+}
-+
-+static inline void airtime_set_active(struct airtime_sched_info *air_sched,
-+				      struct airtime_info *air_info, u64 now)
-+{
-+	air_info->last_scheduled = now;
-+	air_sched->last_schedule_activity = now;
-+	list_move_tail(&air_info->list, &air_sched->active_list);
-+}
-+
-+static inline bool airtime_catchup_v_t(struct airtime_sched_info *air_sched,
-+				       u64 v_t, u64 now)
-+{
-+	air_sched->v_t = v_t;
-+	return true;
-+}
-+
-+static inline void init_airtime_info(struct airtime_info *air_info,
-+				     struct airtime_sched_info *air_sched)
-+{
-+	atomic_set(&air_info->aql_tx_pending, 0);
-+	air_info->aql_limit_low = air_sched->aql_txq_limit_low;
-+	air_info->aql_limit_high = air_sched->aql_txq_limit_high;
-+	airtime_weight_set(air_info, IEEE80211_DEFAULT_AIRTIME_WEIGHT);
-+	INIT_LIST_HEAD(&air_info->list);
-+}
-+
- static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
- {
- 	return ether_addr_equal(raddr, addr) ||
-@@ -1821,6 +1971,14 @@ int ieee80211_tx_control_port(struct wip
- 			      u64 *cookie);
- int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,
- 			      const u8 *buf, size_t len);
-+void ieee80211_resort_txq(struct ieee80211_hw *hw,
-+			  struct ieee80211_txq *txq);
-+void ieee80211_unschedule_txq(struct ieee80211_hw *hw,
-+			      struct ieee80211_txq *txq,
-+			      bool purge);
-+void ieee80211_update_airtime_weight(struct ieee80211_local *local,
-+				     struct airtime_sched_info *air_sched,
-+				     u64 now, bool force);
- 
- /* HT */
- void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -2088,6 +2088,9 @@ int ieee80211_if_add(struct ieee80211_lo
- 		}
- 	}
- 
-+	for (i = 0; i < IEEE80211_NUM_ACS; i++)
-+		init_airtime_info(&sdata->airtime[i], &local->airtime[i]);
-+
- 	ieee80211_set_default_queues(sdata);
- 
- 	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -693,10 +693,13 @@ struct ieee80211_hw *ieee80211_alloc_hw_
- 	spin_lock_init(&local->queue_stop_reason_lock);
- 
- 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
--		INIT_LIST_HEAD(&local->active_txqs[i]);
--		spin_lock_init(&local->active_txq_lock[i]);
--		local->aql_txq_limit_low[i] = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L;
--		local->aql_txq_limit_high[i] =
-+		struct airtime_sched_info *air_sched = &local->airtime[i];
-+
-+		air_sched->active_txqs = RB_ROOT_CACHED;
-+		INIT_LIST_HEAD(&air_sched->active_list);
-+		spin_lock_init(&air_sched->lock);
-+		air_sched->aql_txq_limit_low = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L;
-+		air_sched->aql_txq_limit_high =
- 			IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H;
- 	}
- 
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -1573,12 +1573,8 @@ static void sta_ps_start(struct sta_info
- 
- 	for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
- 		struct ieee80211_txq *txq = sta->sta.txq[tid];
--		struct txq_info *txqi = to_txq_info(txq);
- 
--		spin_lock(&local->active_txq_lock[txq->ac]);
--		if (!list_empty(&txqi->schedule_order))
--			list_del_init(&txqi->schedule_order);
--		spin_unlock(&local->active_txq_lock[txq->ac]);
-+		ieee80211_unschedule_txq(&local->hw, txq, false);
- 
- 		if (txq_has_queue(txq))
- 			set_bit(tid, &sta->txq_buffered_tids);
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -426,15 +426,11 @@ struct sta_info *sta_info_alloc(struct i
- 	if (sta_prepare_rate_control(local, sta, gfp))
- 		goto free_txq;
- 
--	sta->airtime_weight = IEEE80211_DEFAULT_AIRTIME_WEIGHT;
- 
- 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
- 		skb_queue_head_init(&sta->ps_tx_buf[i]);
- 		skb_queue_head_init(&sta->tx_filtered[i]);
--		sta->airtime[i].deficit = sta->airtime_weight;
--		atomic_set(&sta->airtime[i].aql_tx_pending, 0);
--		sta->airtime[i].aql_limit_low = local->aql_txq_limit_low[i];
--		sta->airtime[i].aql_limit_high = local->aql_txq_limit_high[i];
-+		init_airtime_info(&sta->airtime[i], &local->airtime[i]);
- 	}
- 
- 	for (i = 0; i < IEEE80211_NUM_TIDS; i++)
-@@ -1893,24 +1889,59 @@ void ieee80211_sta_set_buffered(struct i
- }
- EXPORT_SYMBOL(ieee80211_sta_set_buffered);
- 
--void ieee80211_sta_register_airtime(struct ieee80211_sta *pubsta, u8 tid,
--				    u32 tx_airtime, u32 rx_airtime)
-+void ieee80211_register_airtime(struct ieee80211_txq *txq,
-+				u32 tx_airtime, u32 rx_airtime)
- {
--	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
--	struct ieee80211_local *local = sta->sdata->local;
--	u8 ac = ieee80211_ac_from_tid(tid);
-+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
-+	struct ieee80211_local *local = sdata->local;
-+	u64 weight_sum, weight_sum_reciprocal;
-+	struct airtime_sched_info *air_sched;
-+	struct airtime_info *air_info;
- 	u32 airtime = 0;
- 
--	if (sta->local->airtime_flags & AIRTIME_USE_TX)
-+	air_sched = &local->airtime[txq->ac];
-+	air_info = to_airtime_info(txq);
-+
-+	if (local->airtime_flags & AIRTIME_USE_TX)
- 		airtime += tx_airtime;
--	if (sta->local->airtime_flags & AIRTIME_USE_RX)
-+	if (local->airtime_flags & AIRTIME_USE_RX)
- 		airtime += rx_airtime;
- 
--	spin_lock_bh(&local->active_txq_lock[ac]);
--	sta->airtime[ac].tx_airtime += tx_airtime;
--	sta->airtime[ac].rx_airtime += rx_airtime;
--	sta->airtime[ac].deficit -= airtime;
--	spin_unlock_bh(&local->active_txq_lock[ac]);
-+	/* Weights scale so the unit weight is 256 */
-+	airtime <<= 8;
-+
-+	spin_lock_bh(&air_sched->lock);
-+
-+	air_info->tx_airtime += tx_airtime;
-+	air_info->rx_airtime += rx_airtime;
-+
-+	if (air_sched->weight_sum) {
-+		weight_sum = air_sched->weight_sum;
-+		weight_sum_reciprocal = air_sched->weight_sum_reciprocal;
-+	} else {
-+		weight_sum = air_info->weight;
-+		weight_sum_reciprocal = air_info->weight_reciprocal;
-+	}
-+
-+	/* Round the calculation of global vt */
-+	air_sched->v_t += (u64)((airtime + (weight_sum >> 1)) *
-+				weight_sum_reciprocal) >> IEEE80211_RECIPROCAL_SHIFT_64;
-+	air_info->v_t += (u32)((airtime + (air_info->weight >> 1)) *
-+			       air_info->weight_reciprocal) >> IEEE80211_RECIPROCAL_SHIFT_32;
-+	ieee80211_resort_txq(&local->hw, txq);
-+
-+	spin_unlock_bh(&air_sched->lock);
-+}
-+
-+void ieee80211_sta_register_airtime(struct ieee80211_sta *pubsta, u8 tid,
-+				    u32 tx_airtime, u32 rx_airtime)
-+{
-+	struct ieee80211_txq *txq = pubsta->txq[tid];
-+
-+	if (!txq)
-+		return;
-+
-+	ieee80211_register_airtime(txq, tx_airtime, rx_airtime);
- }
- EXPORT_SYMBOL(ieee80211_sta_register_airtime);
- 
-@@ -2354,7 +2385,7 @@ void sta_set_sinfo(struct sta_info *sta,
- 	}
- 
- 	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT))) {
--		sinfo->airtime_weight = sta->airtime_weight;
-+		sinfo->airtime_weight = sta->airtime[0].weight;
- 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT);
- 	}
- 
---- a/net/mac80211/sta_info.h
-+++ b/net/mac80211/sta_info.h
-@@ -135,18 +135,25 @@ enum ieee80211_agg_stop_reason {
- #define AIRTIME_USE_TX		BIT(0)
- #define AIRTIME_USE_RX		BIT(1)
- 
-+
- struct airtime_info {
- 	u64 rx_airtime;
- 	u64 tx_airtime;
--	s64 deficit;
-+	u64 v_t;
-+	u64 last_scheduled;
-+	struct list_head list;
- 	atomic_t aql_tx_pending; /* Estimated airtime for frames pending */
- 	u32 aql_limit_low;
- 	u32 aql_limit_high;
-+	u32 weight_reciprocal;
-+	u16 weight;
- };
- 
- void ieee80211_sta_update_pending_airtime(struct ieee80211_local *local,
- 					  struct sta_info *sta, u8 ac,
- 					  u16 tx_airtime, bool tx_completed);
-+void ieee80211_register_airtime(struct ieee80211_txq *txq,
-+				u32 tx_airtime, u32 rx_airtime);
- 
- struct sta_info;
- 
-@@ -516,7 +523,6 @@ struct ieee80211_fragment_cache {
-  * @tid_seq: per-TID sequence numbers for sending to this STA
-  * @airtime: per-AC struct airtime_info describing airtime statistics for this
-  *	station
-- * @airtime_weight: station weight for airtime fairness calculation purposes
-  * @ampdu_mlme: A-MPDU state machine state
-  * @mesh: mesh STA information
-  * @debugfs_dir: debug filesystem directory dentry
-@@ -647,7 +653,6 @@ struct sta_info {
- 	u16 tid_seq[IEEE80211_QOS_CTL_TID_MASK + 1];
- 
- 	struct airtime_info airtime[IEEE80211_NUM_ACS];
--	u16 airtime_weight;
- 
- 	/*
- 	 * Aggregation information, locked with lock.
---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -972,6 +972,25 @@ static void __ieee80211_tx_status(struct
- 		if (!(info->flags & IEEE80211_TX_CTL_INJECTED) && acked)
- 			ieee80211_frame_acked(sta, skb);
- 
-+	} else if (wiphy_ext_feature_isset(local->hw.wiphy,
-+					   NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) {
-+		struct ieee80211_sub_if_data *sdata;
-+		struct ieee80211_txq *txq;
-+		u32 airtime;
-+
-+		/* Account airtime to multicast queue */
-+		sdata = ieee80211_sdata_from_skb(local, skb);
-+
-+		if (sdata && (txq = sdata->vif.txq)) {
-+			airtime = info->status.tx_time ?:
-+				ieee80211_calc_expected_tx_airtime(hw,
-+								   &sdata->vif,
-+								   NULL,
-+								   skb->len,
-+								   false);
-+
-+			ieee80211_register_airtime(txq, airtime, 0);
-+		}
- 	}
- 
- 	/* SNMP counters
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -18,6 +18,7 @@
- #include <linux/bitmap.h>
- #include <linux/rcupdate.h>
- #include <linux/export.h>
-+#include <linux/timekeeping.h>
- #include <net/net_namespace.h>
- #include <net/ieee80211_radiotap.h>
- #include <net/cfg80211.h>
-@@ -1489,7 +1490,7 @@ void ieee80211_txq_init(struct ieee80211
- 	codel_vars_init(&txqi->def_cvars);
- 	codel_stats_init(&txqi->cstats);
- 	__skb_queue_head_init(&txqi->frags);
--	INIT_LIST_HEAD(&txqi->schedule_order);
-+	RB_CLEAR_NODE(&txqi->schedule_order);
- 
- 	txqi->txq.vif = &sdata->vif;
- 
-@@ -1533,9 +1534,7 @@ void ieee80211_txq_purge(struct ieee8021
- 	ieee80211_purge_tx_queue(&local->hw, &txqi->frags);
- 	spin_unlock_bh(&fq->lock);
- 
--	spin_lock_bh(&local->active_txq_lock[txqi->txq.ac]);
--	list_del_init(&txqi->schedule_order);
--	spin_unlock_bh(&local->active_txq_lock[txqi->txq.ac]);
-+	ieee80211_unschedule_txq(&local->hw, &txqi->txq, true);
- }
- 
- void ieee80211_txq_set_params(struct ieee80211_local *local)
-@@ -3831,102 +3830,259 @@ EXPORT_SYMBOL(ieee80211_tx_dequeue);
- struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
- {
- 	struct ieee80211_local *local = hw_to_local(hw);
-+	struct airtime_sched_info *air_sched;
-+	u64 now = ktime_get_boottime_ns();
- 	struct ieee80211_txq *ret = NULL;
--	struct txq_info *txqi = NULL, *head = NULL;
--	bool found_eligible_txq = false;
-+	struct airtime_info *air_info;
-+	struct txq_info *txqi = NULL;
-+	struct rb_node *node;
-+	bool first = false;
- 
--	spin_lock_bh(&local->active_txq_lock[ac]);
-+	air_sched = &local->airtime[ac];
-+	spin_lock_bh(&air_sched->lock);
- 
-- begin:
--	txqi = list_first_entry_or_null(&local->active_txqs[ac],
--					struct txq_info,
--					schedule_order);
--	if (!txqi)
-+	node = air_sched->schedule_pos;
-+
-+begin:
-+	if (!node) {
-+		node = rb_first_cached(&air_sched->active_txqs);
-+		first = true;
-+	} else {
-+		node = rb_next(node);
-+	}
-+
-+	if (!node)
- 		goto out;
- 
--	if (txqi == head) {
--		if (!found_eligible_txq)
--			goto out;
--		else
--			found_eligible_txq = false;
-+	txqi = container_of(node, struct txq_info, schedule_order);
-+	air_info = to_airtime_info(&txqi->txq);
-+
-+	if (air_info->v_t > air_sched->v_t &&
-+	    (!first || !airtime_catchup_v_t(air_sched, air_info->v_t, now)))
-+		goto out;
-+
-+	if (!ieee80211_txq_airtime_check(hw, &txqi->txq)) {
-+		first = false;
-+		goto begin;
- 	}
- 
--	if (!head)
--		head = txqi;
-+	air_sched->schedule_pos = node;
-+	air_sched->last_schedule_activity = now;
-+	ret = &txqi->txq;
-+out:
-+	spin_unlock_bh(&air_sched->lock);
-+	return ret;
-+}
-+EXPORT_SYMBOL(ieee80211_next_txq);
- 
--	if (txqi->txq.sta) {
--		struct sta_info *sta = container_of(txqi->txq.sta,
--						    struct sta_info, sta);
--		bool aql_check = ieee80211_txq_airtime_check(hw, &txqi->txq);
--		s64 deficit = sta->airtime[txqi->txq.ac].deficit;
-+static void __ieee80211_insert_txq(struct rb_root_cached *root,
-+				   struct txq_info *txqi)
-+{
-+	struct rb_node **new = &root->rb_root.rb_node;
-+	struct airtime_info *old_air, *new_air;
-+	struct rb_node *parent = NULL;
-+	struct txq_info *__txqi;
-+	bool leftmost = true;
-+
-+	while (*new) {
-+		parent = *new;
-+		__txqi = rb_entry(parent, struct txq_info, schedule_order);
-+		old_air = to_airtime_info(&__txqi->txq);
-+		new_air = to_airtime_info(&txqi->txq);
- 
--		if (aql_check)
--			found_eligible_txq = true;
-+		if (new_air->v_t <= old_air->v_t) {
-+			new = &parent->rb_left;
-+		} else {
-+			new = &parent->rb_right;
-+			leftmost = false;
-+		}
-+	}
- 
--		if (deficit < 0)
--			sta->airtime[txqi->txq.ac].deficit +=
--				sta->airtime_weight;
--
--		if (deficit < 0 || !aql_check) {
--			list_move_tail(&txqi->schedule_order,
--				       &local->active_txqs[txqi->txq.ac]);
--			goto begin;
-+	rb_link_node(&txqi->schedule_order, parent, new);
-+	rb_insert_color_cached(&txqi->schedule_order, root, leftmost);
-+}
-+
-+void ieee80211_resort_txq(struct ieee80211_hw *hw,
-+			  struct ieee80211_txq *txq)
-+{
-+	struct airtime_info *air_info = to_airtime_info(txq);
-+	struct ieee80211_local *local = hw_to_local(hw);
-+	struct txq_info *txqi = to_txq_info(txq);
-+	struct airtime_sched_info *air_sched;
-+
-+	air_sched = &local->airtime[txq->ac];
-+
-+	lockdep_assert_held(&air_sched->lock);
-+
-+	if (!RB_EMPTY_NODE(&txqi->schedule_order)) {
-+		struct airtime_info *a_prev = NULL, *a_next = NULL;
-+		struct txq_info *t_prev, *t_next;
-+		struct rb_node *n_prev, *n_next;
-+
-+		/* Erasing a node can cause an expensive rebalancing operation,
-+		 * so we check the previous and next nodes first and only remove
-+		 * and re-insert if the current node is not already in the
-+		 * correct position.
-+		 */
-+		if ((n_prev = rb_prev(&txqi->schedule_order)) != NULL) {
-+			t_prev = container_of(n_prev, struct txq_info,
-+					      schedule_order);
-+			a_prev = to_airtime_info(&t_prev->txq);
-+		}
-+
-+		if ((n_next = rb_next(&txqi->schedule_order)) != NULL) {
-+			t_next = container_of(n_next, struct txq_info,
-+					      schedule_order);
-+			a_next = to_airtime_info(&t_next->txq);
- 		}
-+
-+		if ((!a_prev || a_prev->v_t <= air_info->v_t) &&
-+		    (!a_next || a_next->v_t > air_info->v_t))
-+			return;
-+
-+		if (air_sched->schedule_pos == &txqi->schedule_order)
-+			air_sched->schedule_pos = n_prev;
-+
-+		rb_erase_cached(&txqi->schedule_order,
-+				&air_sched->active_txqs);
-+		RB_CLEAR_NODE(&txqi->schedule_order);
-+		__ieee80211_insert_txq(&air_sched->active_txqs, txqi);
- 	}
-+}
-+
-+void ieee80211_update_airtime_weight(struct ieee80211_local *local,
-+				     struct airtime_sched_info *air_sched,
-+				     u64 now, bool force)
-+{
-+	struct airtime_info *air_info, *tmp;
-+	u64 weight_sum = 0;
-+
-+	if (unlikely(!now))
-+		now = ktime_get_boottime_ns();
-+
-+	lockdep_assert_held(&air_sched->lock);
-+
-+	if (!force && (air_sched->last_weight_update <
-+		       now - AIRTIME_ACTIVE_DURATION))
-+		return;
-+
-+	list_for_each_entry_safe(air_info, tmp,
-+				 &air_sched->active_list, list) {
-+		if (airtime_is_active(air_info, now))
-+			weight_sum += air_info->weight;
-+		else
-+			list_del_init(&air_info->list);
-+	}
-+	airtime_weight_sum_set(air_sched, weight_sum);
-+	air_sched->last_weight_update = now;
-+}
- 
-+void ieee80211_schedule_txq(struct ieee80211_hw *hw,
-+			    struct ieee80211_txq *txq)
-+	__acquires(txq_lock) __releases(txq_lock)
-+{
-+	struct ieee80211_local *local = hw_to_local(hw);
-+	struct txq_info *txqi = to_txq_info(txq);
-+	struct airtime_sched_info *air_sched;
-+	u64 now = ktime_get_boottime_ns();
-+	struct airtime_info *air_info;
-+	u8 ac = txq->ac;
-+	bool was_active;
- 
--	if (txqi->schedule_round == local->schedule_round[ac])
-+	air_sched = &local->airtime[ac];
-+	air_info = to_airtime_info(txq);
-+
-+	spin_lock_bh(&air_sched->lock);
-+	was_active = airtime_is_active(air_info, now);
-+	airtime_set_active(air_sched, air_info, now);
-+
-+	if (!RB_EMPTY_NODE(&txqi->schedule_order))
- 		goto out;
- 
--	list_del_init(&txqi->schedule_order);
--	txqi->schedule_round = local->schedule_round[ac];
--	ret = &txqi->txq;
-+	/* If the station has been inactive for a while, catch up its v_t so it
-+	 * doesn't get indefinite priority; see comment above the definition of
-+	 * AIRTIME_MAX_BEHIND.
-+	 */
-+	if ((!was_active && air_info->v_t < air_sched->v_t) ||
-+	    air_info->v_t < air_sched->v_t - AIRTIME_MAX_BEHIND)
-+		air_info->v_t = air_sched->v_t;
-+
-+	ieee80211_update_airtime_weight(local, air_sched, now, !was_active);
-+	__ieee80211_insert_txq(&air_sched->active_txqs, txqi);
- 
- out:
--	spin_unlock_bh(&local->active_txq_lock[ac]);
--	return ret;
-+	spin_unlock_bh(&air_sched->lock);
- }
--EXPORT_SYMBOL(ieee80211_next_txq);
-+EXPORT_SYMBOL(ieee80211_schedule_txq);
- 
--void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
--			      struct ieee80211_txq *txq,
--			      bool force)
-+static void __ieee80211_unschedule_txq(struct ieee80211_hw *hw,
-+				       struct ieee80211_txq *txq,
-+				       bool purge)
- {
- 	struct ieee80211_local *local = hw_to_local(hw);
- 	struct txq_info *txqi = to_txq_info(txq);
-+	struct airtime_sched_info *air_sched;
-+	struct airtime_info *air_info;
- 
--	spin_lock_bh(&local->active_txq_lock[txq->ac]);
-+	air_sched = &local->airtime[txq->ac];
-+	air_info = to_airtime_info(&txqi->txq);
- 
--	if (list_empty(&txqi->schedule_order) &&
--	    (force || !skb_queue_empty(&txqi->frags) ||
--	     txqi->tin.backlog_packets)) {
--		/* If airtime accounting is active, always enqueue STAs at the
--		 * head of the list to ensure that they only get moved to the
--		 * back by the airtime DRR scheduler once they have a negative
--		 * deficit. A station that already has a negative deficit will
--		 * get immediately moved to the back of the list on the next
--		 * call to ieee80211_next_txq().
--		 */
--		if (txqi->txq.sta && local->airtime_flags &&
--		    wiphy_ext_feature_isset(local->hw.wiphy,
--					    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
--			list_add(&txqi->schedule_order,
--				 &local->active_txqs[txq->ac]);
--		else
--			list_add_tail(&txqi->schedule_order,
--				      &local->active_txqs[txq->ac]);
-+	lockdep_assert_held(&air_sched->lock);
-+
-+	if (purge) {
-+		list_del_init(&air_info->list);
-+		ieee80211_update_airtime_weight(local, air_sched, 0, true);
- 	}
- 
--	spin_unlock_bh(&local->active_txq_lock[txq->ac]);
-+	if (RB_EMPTY_NODE(&txqi->schedule_order))
-+		return;
-+
-+	if (air_sched->schedule_pos == &txqi->schedule_order)
-+		air_sched->schedule_pos = rb_prev(&txqi->schedule_order);
-+
-+	if (!purge)
-+		airtime_set_active(air_sched, air_info,
-+				   ktime_get_boottime_ns());
-+
-+	rb_erase_cached(&txqi->schedule_order,
-+			&air_sched->active_txqs);
-+	RB_CLEAR_NODE(&txqi->schedule_order);
-+}
-+
-+void ieee80211_unschedule_txq(struct ieee80211_hw *hw,
-+			      struct ieee80211_txq *txq,
-+			      bool purge)
-+	__acquires(txq_lock) __releases(txq_lock)
-+{
-+	struct ieee80211_local *local = hw_to_local(hw);
-+
-+	spin_lock_bh(&local->airtime[txq->ac].lock);
-+	__ieee80211_unschedule_txq(hw, txq, purge);
-+	spin_unlock_bh(&local->airtime[txq->ac].lock);
-+}
-+
-+void ieee80211_return_txq(struct ieee80211_hw *hw,
-+			  struct ieee80211_txq *txq, bool force)
-+{
-+	struct ieee80211_local *local = hw_to_local(hw);
-+	struct txq_info *txqi = to_txq_info(txq);
-+
-+	spin_lock_bh(&local->airtime[txq->ac].lock);
-+
-+	if (!RB_EMPTY_NODE(&txqi->schedule_order) && !force &&
-+	    !txq_has_queue(txq))
-+		__ieee80211_unschedule_txq(hw, txq, false);
-+
-+	spin_unlock_bh(&local->airtime[txq->ac].lock);
- }
--EXPORT_SYMBOL(__ieee80211_schedule_txq);
-+EXPORT_SYMBOL(ieee80211_return_txq);
- 
- DEFINE_STATIC_KEY_FALSE(aql_disable);
- 
- bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,
- 				 struct ieee80211_txq *txq)
- {
--	struct sta_info *sta;
-+	struct airtime_info *air_info = to_airtime_info(txq);
- 	struct ieee80211_local *local = hw_to_local(hw);
- 
- 	if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
-@@ -3941,15 +4097,12 @@ bool ieee80211_txq_airtime_check(struct
- 	if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
- 		return true;
- 
--	sta = container_of(txq->sta, struct sta_info, sta);
--	if (atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
--	    sta->airtime[txq->ac].aql_limit_low)
-+	if (atomic_read(&air_info->aql_tx_pending) < air_info->aql_limit_low)
- 		return true;
- 
- 	if (atomic_read(&local->aql_total_pending_airtime) <
- 	    local->aql_threshold &&
--	    atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
--	    sta->airtime[txq->ac].aql_limit_high)
-+	    atomic_read(&air_info->aql_tx_pending) < air_info->aql_limit_high)
- 		return true;
- 
- 	return false;
-@@ -3959,60 +4112,59 @@ EXPORT_SYMBOL(ieee80211_txq_airtime_chec
- bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
- 				struct ieee80211_txq *txq)
- {
-+	struct txq_info *first_txqi = NULL, *txqi = to_txq_info(txq);
- 	struct ieee80211_local *local = hw_to_local(hw);
--	struct txq_info *iter, *tmp, *txqi = to_txq_info(txq);
--	struct sta_info *sta;
--	u8 ac = txq->ac;
-+	struct airtime_sched_info *air_sched;
-+	struct airtime_info *air_info;
-+	struct rb_node *node = NULL;
-+	bool ret = false;
-+	u64 now;
- 
--	spin_lock_bh(&local->active_txq_lock[ac]);
- 
--	if (!txqi->txq.sta)
--		goto out;
-+	if (!ieee80211_txq_airtime_check(hw, txq))
-+		return false;
-+
-+	air_sched = &local->airtime[txq->ac];
-+	spin_lock_bh(&air_sched->lock);
- 
--	if (list_empty(&txqi->schedule_order))
-+	if (RB_EMPTY_NODE(&txqi->schedule_order))
- 		goto out;
- 
--	list_for_each_entry_safe(iter, tmp, &local->active_txqs[ac],
--				 schedule_order) {
--		if (iter == txqi)
--			break;
-+	now = ktime_get_boottime_ns();
- 
--		if (!iter->txq.sta) {
--			list_move_tail(&iter->schedule_order,
--				       &local->active_txqs[ac]);
--			continue;
--		}
--		sta = container_of(iter->txq.sta, struct sta_info, sta);
--		if (sta->airtime[ac].deficit < 0)
--			sta->airtime[ac].deficit += sta->airtime_weight;
--		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
-+	/* Like in ieee80211_next_txq(), make sure the first station in the
-+	 * scheduling order is eligible for transmission to avoid starvation.
-+	 */
-+	node = rb_first_cached(&air_sched->active_txqs);
-+	if (node) {
-+		first_txqi = container_of(node, struct txq_info,
-+					  schedule_order);
-+		air_info = to_airtime_info(&first_txqi->txq);
-+
-+		if (air_sched->v_t < air_info->v_t)
-+			airtime_catchup_v_t(air_sched, air_info->v_t, now);
- 	}
- 
--	sta = container_of(txqi->txq.sta, struct sta_info, sta);
--	if (sta->airtime[ac].deficit >= 0)
--		goto out;
--
--	sta->airtime[ac].deficit += sta->airtime_weight;
--	list_move_tail(&txqi->schedule_order, &local->active_txqs[ac]);
--	spin_unlock_bh(&local->active_txq_lock[ac]);
-+	air_info = to_airtime_info(&txqi->txq);
-+	if (air_info->v_t <= air_sched->v_t) {
-+		air_sched->last_schedule_activity = now;
-+		ret = true;
-+	}
- 
--	return false;
- out:
--	if (!list_empty(&txqi->schedule_order))
--		list_del_init(&txqi->schedule_order);
--	spin_unlock_bh(&local->active_txq_lock[ac]);
--
--	return true;
-+	spin_unlock_bh(&air_sched->lock);
-+	return ret;
- }
- EXPORT_SYMBOL(ieee80211_txq_may_transmit);
- 
- void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
- {
- 	struct ieee80211_local *local = hw_to_local(hw);
-+	struct airtime_sched_info *air_sched = &local->airtime[ac];
- 
--	spin_lock_bh(&local->active_txq_lock[ac]);
--	local->schedule_round[ac]++;
--	spin_unlock_bh(&local->active_txq_lock[ac]);
-+	spin_lock_bh(&air_sched->lock);
-+	air_sched->schedule_pos = NULL;
-+	spin_unlock_bh(&air_sched->lock);
- }
- EXPORT_SYMBOL(ieee80211_txq_schedule_start);
- 
diff --git a/package/kernel/mac80211/patches/subsys/384-nl80211-add-common-API-to-configure-SAR-power-limita.patch b/package/kernel/mac80211/patches/subsys/384-nl80211-add-common-API-to-configure-SAR-power-limita.patch
deleted file mode 100644
index a47e29794..000000000
--- a/package/kernel/mac80211/patches/subsys/384-nl80211-add-common-API-to-configure-SAR-power-limita.patch
+++ /dev/null
@@ -1,398 +0,0 @@
-From: Carl Huang <cjhuang@codeaurora.org>
-Date: Thu, 3 Dec 2020 05:37:26 -0500
-Subject: [PATCH] nl80211: add common API to configure SAR power limitations
-
-NL80211_CMD_SET_SAR_SPECS is added to configure SAR from
-user space. NL80211_ATTR_SAR_SPEC is used to pass the SAR
-power specification when used with NL80211_CMD_SET_SAR_SPECS.
-
-Wireless driver needs to register SAR type, supported frequency
-ranges to wiphy, so user space can query it. The index in
-frequency range is used to specify which sub band the power
-limitation applies to. The SAR type is for compatibility, so later
-other SAR mechanism can be implemented without breaking the user
-space SAR applications.
-
-Normal process is user space queries the SAR capability, and
-gets the index of supported frequency ranges and associates the
-power limitation with this index and sends to kernel.
-
-Here is an example of message send to kernel:
-8c 00 00 00 08 00 01 00 00 00 00 00 38 00 2b 81
-08 00 01 00 00 00 00 00 2c 00 02 80 14 00 00 80
-08 00 02 00 00 00 00 00 08 00 01 00 38 00 00 00
-14 00 01 80 08 00 02 00 01 00 00 00 08 00 01 00
-48 00 00 00
-
-NL80211_CMD_SET_SAR_SPECS:  0x8c
-NL80211_ATTR_WIPHY:     0x01(phy idx is 0)
-NL80211_ATTR_SAR_SPEC:  0x812b (NLA_NESTED)
-NL80211_SAR_ATTR_TYPE:  0x00 (NL80211_SAR_TYPE_POWER)
-NL80211_SAR_ATTR_SPECS: 0x8002 (NLA_NESTED)
-freq range 0 power: 0x38 in 0.25dbm unit (14dbm)
-freq range 1 power: 0x48 in 0.25dbm unit (18dbm)
-
-Signed-off-by: Carl Huang <cjhuang@codeaurora.org>
-Reviewed-by: Brian Norris <briannorris@chromium.org>
-Reviewed-by: Abhishek Kumar <kuabhs@chromium.org>
-Link: https://lore.kernel.org/r/20201203103728.3034-2-cjhuang@codeaurora.org
-[minor edits, NLA parse cleanups]
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -1737,6 +1737,54 @@ struct station_info {
- 	u8 connected_to_as;
- };
- 
-+/**
-+ * struct cfg80211_sar_sub_specs - sub specs limit
-+ * @power: power limitation in 0.25dbm
-+ * @freq_range_index: index the power limitation applies to
-+ */
-+struct cfg80211_sar_sub_specs {
-+	s32 power;
-+	u32 freq_range_index;
-+};
-+
-+/**
-+ * struct cfg80211_sar_specs - sar limit specs
-+ * @type: it's set with power in 0.25dbm or other types
-+ * @num_sub_specs: number of sar sub specs
-+ * @sub_specs: memory to hold the sar sub specs
-+ */
-+struct cfg80211_sar_specs {
-+	enum nl80211_sar_type type;
-+	u32 num_sub_specs;
-+	struct cfg80211_sar_sub_specs sub_specs[];
-+};
-+
-+
-+/**
-+ * @struct cfg80211_sar_chan_ranges - sar frequency ranges
-+ * @start_freq:  start range edge frequency
-+ * @end_freq:    end range edge frequency
-+ */
-+struct cfg80211_sar_freq_ranges {
-+	u32 start_freq;
-+	u32 end_freq;
-+};
-+
-+/**
-+ * struct cfg80211_sar_capa - sar limit capability
-+ * @type: it's set via power in 0.25dbm or other types
-+ * @num_freq_ranges: number of frequency ranges
-+ * @freq_ranges: memory to hold the freq ranges.
-+ *
-+ * Note: WLAN driver may append new ranges or split an existing
-+ * range to small ones and then append them.
-+ */
-+struct cfg80211_sar_capa {
-+	enum nl80211_sar_type type;
-+	u32 num_freq_ranges;
-+	const struct cfg80211_sar_freq_ranges *freq_ranges;
-+};
-+
- #if IS_ENABLED(CPTCFG_CFG80211)
- /**
-  * cfg80211_get_station - retrieve information about a given station
-@@ -4259,6 +4307,8 @@ struct cfg80211_ops {
- 				  struct cfg80211_tid_config *tid_conf);
- 	int	(*reset_tid_config)(struct wiphy *wiphy, struct net_device *dev,
- 				    const u8 *peer, u8 tids);
-+	int	(*set_sar_specs)(struct wiphy *wiphy,
-+				 struct cfg80211_sar_specs *sar);
- };
- 
- /*
-@@ -5030,6 +5080,8 @@ struct wiphy {
- 
- 	u8 max_data_retry_count;
- 
-+	const struct cfg80211_sar_capa *sar_capa;
-+
- 	char priv[] __aligned(NETDEV_ALIGN);
- };
- 
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -405,6 +405,18 @@ nl80211_unsol_bcast_probe_resp_policy[NL
- 						       .len = IEEE80211_MAX_DATA_LEN }
- };
- 
-+static const struct nla_policy
-+sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
-+	[NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
-+	[NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
-+};
-+
-+static const struct nla_policy
-+sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
-+	[NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
-+	[NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
-+};
-+
- static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
- 	[0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
- 	[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
-@@ -739,6 +751,7 @@ static const struct nla_policy nl80211_p
- 	[NL80211_ATTR_SAE_PWE] =
- 		NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
- 				 NL80211_SAE_PWE_BOTH),
-+	[NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
- 	[NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
- };
- 
-@@ -2117,6 +2130,56 @@ fail:
- 	return -ENOBUFS;
- }
- 
-+static int
-+nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
-+		      struct sk_buff *msg)
-+{
-+	struct nlattr *sar_capa, *specs, *sub_freq_range;
-+	u8 num_freq_ranges;
-+	int i;
-+
-+	if (!rdev->wiphy.sar_capa)
-+		return 0;
-+
-+	num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
-+
-+	sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
-+	if (!sar_capa)
-+		return -ENOSPC;
-+
-+	if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
-+		goto fail;
-+
-+	specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
-+	if (!specs)
-+		goto fail;
-+
-+	/* report supported freq_ranges */
-+	for (i = 0; i < num_freq_ranges; i++) {
-+		sub_freq_range = nla_nest_start(msg, i + 1);
-+		if (!sub_freq_range)
-+			goto fail;
-+
-+		if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
-+				rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
-+			goto fail;
-+
-+		if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
-+				rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
-+			goto fail;
-+
-+		nla_nest_end(msg, sub_freq_range);
-+	}
-+
-+	nla_nest_end(msg, specs);
-+	nla_nest_end(msg, sar_capa);
-+
-+	return 0;
-+fail:
-+	nla_nest_cancel(msg, sar_capa);
-+	return -ENOBUFS;
-+}
-+
- struct nl80211_dump_wiphy_state {
- 	s64 filter_wiphy;
- 	long start;
-@@ -2366,6 +2429,8 @@ static int nl80211_send_wiphy(struct cfg
- 			CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
- 			CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
- 			CMD(update_ft_ies, UPDATE_FT_IES);
-+			if (rdev->wiphy.sar_capa)
-+				CMD(set_sar_specs, SET_SAR_SPECS);
- 		}
- #undef CMD
- 
-@@ -2691,6 +2756,11 @@ static int nl80211_send_wiphy(struct cfg
- 
- 		if (nl80211_put_tid_config_support(rdev, msg))
- 			goto nla_put_failure;
-+		state->split_start++;
-+		break;
-+	case 16:
-+		if (nl80211_put_sar_specs(rdev, msg))
-+			goto nla_put_failure;
- 
- 		/* done */
- 		state->split_start = 0;
-@@ -14712,6 +14782,111 @@ static void nl80211_post_doit(__genl_con
- 	}
- }
- 
-+static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
-+				     struct cfg80211_sar_specs *sar_specs,
-+				     struct nlattr *spec[], int index)
-+{
-+	u32 range_index, i;
-+
-+	if (!sar_specs || !spec)
-+		return -EINVAL;
-+
-+	if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
-+	    !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
-+		return -EINVAL;
-+
-+	range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
-+
-+	/* check if range_index exceeds num_freq_ranges */
-+	if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
-+		return -EINVAL;
-+
-+	/* check if range_index duplicates */
-+	for (i = 0; i < index; i++) {
-+		if (sar_specs->sub_specs[i].freq_range_index == range_index)
-+			return -EINVAL;
-+	}
-+
-+	sar_specs->sub_specs[index].power =
-+		nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
-+
-+	sar_specs->sub_specs[index].freq_range_index = range_index;
-+
-+	return 0;
-+}
-+
-+static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
-+{
-+	struct cfg80211_registered_device *rdev = info->user_ptr[0];
-+	struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
-+	struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
-+	struct cfg80211_sar_specs *sar_spec;
-+	enum nl80211_sar_type type;
-+	struct nlattr *spec_list;
-+	u32 specs;
-+	int rem, err;
-+
-+	if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
-+		return -EOPNOTSUPP;
-+
-+	if (!info->attrs[NL80211_ATTR_SAR_SPEC])
-+		return -EINVAL;
-+
-+	nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
-+			 info->attrs[NL80211_ATTR_SAR_SPEC],
-+			 NULL, NULL);
-+
-+	if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
-+		return -EINVAL;
-+
-+	type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
-+	if (type != rdev->wiphy.sar_capa->type)
-+		return -EINVAL;
-+
-+	specs = 0;
-+	nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
-+		specs++;
-+
-+	if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
-+		return -EINVAL;
-+
-+	sar_spec = kzalloc(sizeof(*sar_spec) +
-+			   specs * sizeof(struct cfg80211_sar_sub_specs),
-+			   GFP_KERNEL);
-+	if (!sar_spec)
-+		return -ENOMEM;
-+
-+	sar_spec->type = type;
-+	specs = 0;
-+	nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
-+		nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
-+				 spec_list, NULL, NULL);
-+
-+		switch (type) {
-+		case NL80211_SAR_TYPE_POWER:
-+			if (nl80211_set_sar_sub_specs(rdev, sar_spec,
-+						      spec, specs)) {
-+				err = -EINVAL;
-+				goto error;
-+			}
-+			break;
-+		default:
-+			err = -EINVAL;
-+			goto error;
-+		}
-+		specs++;
-+	}
-+
-+	sar_spec->num_sub_specs = specs;
-+
-+	rdev->cur_cmd_info = info;
-+	err = rdev_set_sar_specs(rdev, sar_spec);
-+	rdev->cur_cmd_info = NULL;
-+error:
-+	kfree(sar_spec);
-+	return err;
-+}
-+
- static __genl_const struct genl_ops nl80211_ops[] = {
- 	{
- 		.cmd = NL80211_CMD_GET_WIPHY,
-@@ -15575,6 +15750,14 @@ static const struct genl_small_ops nl802
- 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
- 				  NL80211_FLAG_NEED_RTNL,
- 	},
-+	{
-+		.cmd = NL80211_CMD_SET_SAR_SPECS,
-+		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-+		.doit = nl80211_set_sar_specs,
-+		.flags = GENL_UNS_ADMIN_PERM,
-+		.internal_flags = NL80211_FLAG_NEED_WIPHY |
-+				  NL80211_FLAG_NEED_RTNL,
-+	},
- };
- 
- static struct genl_family nl80211_fam __genl_ro_after_init = {
---- a/net/wireless/rdev-ops.h
-+++ b/net/wireless/rdev-ops.h
-@@ -1356,4 +1356,16 @@ static inline int rdev_reset_tid_config(
- 	return ret;
- }
- 
-+static inline int rdev_set_sar_specs(struct cfg80211_registered_device *rdev,
-+				     struct cfg80211_sar_specs *sar)
-+{
-+	int ret;
-+
-+	trace_rdev_set_sar_specs(&rdev->wiphy, sar);
-+	ret = rdev->ops->set_sar_specs(&rdev->wiphy, sar);
-+	trace_rdev_return_int(&rdev->wiphy, ret);
-+
-+	return ret;
-+}
-+
- #endif /* __CFG80211_RDEV_OPS */
---- a/net/wireless/trace.h
-+++ b/net/wireless/trace.h
-@@ -3551,6 +3551,25 @@ TRACE_EVENT(rdev_reset_tid_config,
- 	TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", peer: " MAC_PR_FMT ", tids: 0x%x",
- 		  WIPHY_PR_ARG, NETDEV_PR_ARG, MAC_PR_ARG(peer), __entry->tids)
- );
-+
-+TRACE_EVENT(rdev_set_sar_specs,
-+	TP_PROTO(struct wiphy *wiphy, struct cfg80211_sar_specs *sar),
-+	TP_ARGS(wiphy, sar),
-+	TP_STRUCT__entry(
-+		WIPHY_ENTRY
-+		__field(u16, type)
-+		__field(u16, num)
-+	),
-+	TP_fast_assign(
-+		WIPHY_ASSIGN;
-+		__entry->type = sar->type;
-+		__entry->num = sar->num_sub_specs;
-+
-+	),
-+	TP_printk(WIPHY_PR_FMT ", Set type:%d, num_specs:%d",
-+		  WIPHY_PR_ARG, __entry->type, __entry->num)
-+);
-+
- #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
- 
- #undef TRACE_INCLUDE_PATH
diff --git a/package/kernel/mac80211/patches/subsys/385-mac80211-add-ieee80211_set_sar_specs.patch b/package/kernel/mac80211/patches/subsys/385-mac80211-add-ieee80211_set_sar_specs.patch
deleted file mode 100644
index c351bc812..000000000
--- a/package/kernel/mac80211/patches/subsys/385-mac80211-add-ieee80211_set_sar_specs.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From: Carl Huang <cjhuang@codeaurora.org>
-Date: Thu, 3 Dec 2020 05:37:27 -0500
-Subject: [PATCH] mac80211: add ieee80211_set_sar_specs
-
-This change registers ieee80211_set_sar_specs to
-mac80211_config_ops, so cfg80211 can call it.
-
-Signed-off-by: Carl Huang <cjhuang@codeaurora.org>
-Reviewed-by: Brian Norris <briannorris@chromium.org>
-Reviewed-by: Abhishek Kumar <kuabhs@chromium.org>
-Link: https://lore.kernel.org/r/20201203103728.3034-3-cjhuang@codeaurora.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -4207,6 +4207,8 @@ struct ieee80211_ops {
- 				   struct ieee80211_vif *vif);
- 	void (*sta_set_4addr)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 			      struct ieee80211_sta *sta, bool enabled);
-+	int (*set_sar_specs)(struct ieee80211_hw *hw,
-+			     const struct cfg80211_sar_specs *sar);
- 	void (*sta_set_decap_offload)(struct ieee80211_hw *hw,
- 				      struct ieee80211_vif *vif,
- 				      struct ieee80211_sta *sta, bool enabled);
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -4136,6 +4136,17 @@ static int ieee80211_reset_tid_config(st
- 	return ret;
- }
- 
-+static int ieee80211_set_sar_specs(struct wiphy *wiphy,
-+				   struct cfg80211_sar_specs *sar)
-+{
-+	struct ieee80211_local *local = wiphy_priv(wiphy);
-+
-+	if (!local->ops->set_sar_specs)
-+		return -EOPNOTSUPP;
-+
-+	return local->ops->set_sar_specs(&local->hw, sar);
-+}
-+
- const struct cfg80211_ops mac80211_config_ops = {
- 	.add_virtual_intf = ieee80211_add_iface,
- 	.del_virtual_intf = ieee80211_del_iface,
-@@ -4239,4 +4250,5 @@ const struct cfg80211_ops mac80211_confi
- 	.probe_mesh_link = ieee80211_probe_mesh_link,
- 	.set_tid_config = ieee80211_set_tid_config,
- 	.reset_tid_config = ieee80211_reset_tid_config,
-+	.set_sar_specs = ieee80211_set_sar_specs,
- };
diff --git a/package/kernel/mac80211/patches/subsys/386-mac80211-check-per-vif-offload_flags-in-Tx-path.patch b/package/kernel/mac80211/patches/subsys/386-mac80211-check-per-vif-offload_flags-in-Tx-path.patch
deleted file mode 100644
index e011e5333..000000000
--- a/package/kernel/mac80211/patches/subsys/386-mac80211-check-per-vif-offload_flags-in-Tx-path.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Ryder Lee <ryder.lee@mediatek.com>
-Date: Fri, 18 Jun 2021 04:38:59 +0800
-Subject: [PATCH] mac80211: check per vif offload_flags in Tx path
-
-offload_flags has been introduced to indicate encap status of each interface.
-An interface can encap offload at runtime, or if it has some extra limitations
-it can simply override the flags, so it's more flexible to check offload_flags
-in Tx path.
-
-Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
-Link: https://lore.kernel.org/r/177785418cf407808bf3a44760302d0647076990.1623961575.git.ryder.lee@mediatek.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3335,6 +3335,9 @@ static bool ieee80211_amsdu_aggregate(st
- 	if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
- 		return false;
- 
-+	if (sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
-+		return false;
-+
- 	if (skb_is_gso(skb))
- 		return false;
- 
diff --git a/package/kernel/mac80211/patches/subsys/387-nl80211-add-support-for-BSS-coloring.patch b/package/kernel/mac80211/patches/subsys/387-nl80211-add-support-for-BSS-coloring.patch
deleted file mode 100644
index 1b70d85e7..000000000
--- a/package/kernel/mac80211/patches/subsys/387-nl80211-add-support-for-BSS-coloring.patch
+++ /dev/null
@@ -1,485 +0,0 @@
-From: John Crispin <john@phrozen.org>
-Date: Fri, 2 Jul 2021 19:44:07 +0200
-Subject: [PATCH] nl80211: add support for BSS coloring
-
-This patch adds support for BSS color collisions to the wireless subsystem.
-Add the required functionality to nl80211 that will notify about color
-collisions, triggering the color change and notifying when it is completed.
-
-Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Signed-off-by: John Crispin <john@phrozen.org>
-Link: https://lore.kernel.org/r/500b3582aec8fe2c42ef46f3117b148cb7cbceb5.1625247619.git.lorenzo@kernel.org
-[remove unnecessary NULL initialisation]
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -1252,6 +1252,27 @@ struct cfg80211_csa_settings {
- #define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10
- 
- /**
-+ * struct cfg80211_color_change_settings - color change settings
-+ *
-+ * Used for bss color change
-+ *
-+ * @beacon_color_change: beacon data while performing the color countdown
-+ * @counter_offsets_beacon: offsets of the counters within the beacon (tail)
-+ * @counter_offsets_presp: offsets of the counters within the probe response
-+ * @beacon_next: beacon data to be used after the color change
-+ * @count: number of beacons until the color change
-+ * @color: the color used after the change
-+ */
-+struct cfg80211_color_change_settings {
-+	struct cfg80211_beacon_data beacon_color_change;
-+	u16 counter_offset_beacon;
-+	u16 counter_offset_presp;
-+	struct cfg80211_beacon_data beacon_next;
-+	u8 count;
-+	u8 color;
-+};
-+
-+/**
-  * struct iface_combination_params - input parameters for interface combinations
-  *
-  * Used to pass interface combination parameters
-@@ -3979,6 +4000,8 @@ struct mgmt_frame_regs {
-  *	This callback may sleep.
-  * @reset_tid_config: Reset TID specific configuration for the peer, for the
-  *	given TIDs. This callback may sleep.
-+ *
-+ * @color_change: Initiate a color change.
-  */
- struct cfg80211_ops {
- 	int	(*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
-@@ -4309,6 +4332,9 @@ struct cfg80211_ops {
- 				    const u8 *peer, u8 tids);
- 	int	(*set_sar_specs)(struct wiphy *wiphy,
- 				 struct cfg80211_sar_specs *sar);
-+	int	(*color_change)(struct wiphy *wiphy,
-+				struct net_device *dev,
-+				struct cfg80211_color_change_settings *params);
- };
- 
- /*
-@@ -8092,4 +8118,70 @@ void cfg80211_update_owe_info_event(stru
-  */
- void cfg80211_bss_flush(struct wiphy *wiphy);
- 
-+/**
-+ * cfg80211_bss_color_notify - notify about bss color event
-+ * @dev: network device
-+ * @gfp: allocation flags
-+ * @cmd: the actual event we want to notify
-+ * @count: the number of TBTTs until the color change happens
-+ * @color_bitmap: representations of the colors that the local BSS is aware of
-+ */
-+int cfg80211_bss_color_notify(struct net_device *dev, gfp_t gfp,
-+			      enum nl80211_commands cmd, u8 count,
-+			      u64 color_bitmap);
-+
-+/**
-+ * cfg80211_obss_color_collision_notify - notify about bss color collision
-+ * @dev: network device
-+ * @color_bitmap: representations of the colors that the local BSS is aware of
-+ */
-+static inline int cfg80211_obss_color_collision_notify(struct net_device *dev,
-+						       u64 color_bitmap)
-+{
-+	return cfg80211_bss_color_notify(dev, GFP_KERNEL,
-+					 NL80211_CMD_OBSS_COLOR_COLLISION,
-+					 0, color_bitmap);
-+}
-+
-+/**
-+ * cfg80211_color_change_started_notify - notify color change start
-+ * @dev: the device on which the color is switched
-+ * @count: the number of TBTTs until the color change happens
-+ *
-+ * Inform the userspace about the color change that has started.
-+ */
-+static inline int cfg80211_color_change_started_notify(struct net_device *dev,
-+						       u8 count)
-+{
-+	return cfg80211_bss_color_notify(dev, GFP_KERNEL,
-+					 NL80211_CMD_COLOR_CHANGE_STARTED,
-+					 count, 0);
-+}
-+
-+/**
-+ * cfg80211_color_change_aborted_notify - notify color change abort
-+ * @dev: the device on which the color is switched
-+ *
-+ * Inform the userspace about the color change that has aborted.
-+ */
-+static inline int cfg80211_color_change_aborted_notify(struct net_device *dev)
-+{
-+	return cfg80211_bss_color_notify(dev, GFP_KERNEL,
-+					 NL80211_CMD_COLOR_CHANGE_ABORTED,
-+					 0, 0);
-+}
-+
-+/**
-+ * cfg80211_color_change_notify - notify color change completion
-+ * @dev: the device on which the color was switched
-+ *
-+ * Inform the userspace about the color change that has completed.
-+ */
-+static inline int cfg80211_color_change_notify(struct net_device *dev)
-+{
-+	return cfg80211_bss_color_notify(dev, GFP_KERNEL,
-+					 NL80211_CMD_COLOR_CHANGE_COMPLETED,
-+					 0, 0);
-+}
-+
- #endif /* __NET_CFG80211_H */
---- a/include/uapi/linux/nl80211.h
-+++ b/include/uapi/linux/nl80211.h
-@@ -1185,6 +1185,21 @@
-  *	passed using %NL80211_ATTR_SAR_SPEC. %NL80211_ATTR_WIPHY is used to
-  *	specify the wiphy index to be applied to.
-  *
-+ * @NL80211_CMD_OBSS_COLOR_COLLISION: This notification is sent out whenever
-+ *	mac80211/drv detects a bss color collision.
-+ *
-+ * @NL80211_CMD_COLOR_CHANGE_REQUEST: This command is used to indicate that
-+ *	userspace wants to change the BSS color.
-+ *
-+ * @NL80211_CMD_COLOR_CHANGE_STARTED: Notify userland, that a color change has
-+ *	started
-+ *
-+ * @NL80211_CMD_COLOR_CHANGE_ABORTED: Notify userland, that the color change has
-+ *	been aborted
-+ *
-+ * @NL80211_CMD_COLOR_CHANGE_COMPLETED: Notify userland that the color change
-+ *	has completed
-+ *
-  * @NL80211_CMD_MAX: highest used command number
-  * @__NL80211_CMD_AFTER_LAST: internal use
-  */
-@@ -1417,6 +1432,14 @@ enum nl80211_commands {
- 
- 	NL80211_CMD_SET_SAR_SPECS,
- 
-+	NL80211_CMD_OBSS_COLOR_COLLISION,
-+
-+	NL80211_CMD_COLOR_CHANGE_REQUEST,
-+
-+	NL80211_CMD_COLOR_CHANGE_STARTED,
-+	NL80211_CMD_COLOR_CHANGE_ABORTED,
-+	NL80211_CMD_COLOR_CHANGE_COMPLETED,
-+
- 	/* add new commands above here */
- 
- 	/* used to define NL80211_CMD_MAX below */
-@@ -2560,6 +2583,16 @@ enum nl80211_commands {
-  *	disassoc events to indicate that an immediate reconnect to the AP
-  *	is desired.
-  *
-+ * @NL80211_ATTR_OBSS_COLOR_BITMAP: bitmap of the u64 BSS colors for the
-+ *	%NL80211_CMD_OBSS_COLOR_COLLISION event.
-+ *
-+ * @NL80211_ATTR_COLOR_CHANGE_COUNT: u8 attribute specifying the number of TBTT's
-+ *	until the color switch event.
-+ * @NL80211_ATTR_COLOR_CHANGE_COLOR: u8 attribute specifying the color that we are
-+ *	switching to
-+ * @NL80211_ATTR_COLOR_CHANGE_ELEMS: Nested set of attributes containing the IE
-+ *	information for the time while performing a color switch.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3057,6 +3090,12 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_DISABLE_HE,
- 
-+	NL80211_ATTR_OBSS_COLOR_BITMAP,
-+
-+	NL80211_ATTR_COLOR_CHANGE_COUNT,
-+	NL80211_ATTR_COLOR_CHANGE_COLOR,
-+	NL80211_ATTR_COLOR_CHANGE_ELEMS,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -5950,6 +5989,9 @@ enum nl80211_feature_flags {
-  *      frame protection for all management frames exchanged during the
-  *      negotiation and range measurement procedure.
-  *
-+ * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
-+ *	detection and change announcemnts.
-+ *
-  * @NUM_NL80211_EXT_FEATURES: number of extended features.
-  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
-  */
-@@ -6014,6 +6056,7 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_SECURE_LTF,
- 	NL80211_EXT_FEATURE_SECURE_RTT,
- 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
-+	NL80211_EXT_FEATURE_BSS_COLOR,
- 
- 	/* add new features before the definition below */
- 	NUM_NL80211_EXT_FEATURES,
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -753,6 +753,10 @@ static const struct nla_policy nl80211_p
- 				 NL80211_SAE_PWE_BOTH),
- 	[NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
- 	[NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
-+	[NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
-+	[NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
-+	[NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
-+	[NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
- };
- 
- /* policy for the key attributes */
-@@ -14677,6 +14681,106 @@ bad_tid_conf:
- 	return ret;
- }
- 
-+static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
-+{
-+	struct cfg80211_registered_device *rdev = info->user_ptr[0];
-+	struct cfg80211_color_change_settings params = {};
-+	struct net_device *dev = info->user_ptr[1];
-+	struct wireless_dev *wdev = dev->ieee80211_ptr;
-+	struct nlattr **tb;
-+	u16 offset;
-+	int err;
-+
-+	if (!rdev->ops->color_change)
-+		return -EOPNOTSUPP;
-+
-+	if (!wiphy_ext_feature_isset(&rdev->wiphy,
-+				     NL80211_EXT_FEATURE_BSS_COLOR))
-+		return -EOPNOTSUPP;
-+
-+	if (wdev->iftype != NL80211_IFTYPE_AP)
-+		return -EOPNOTSUPP;
-+
-+	if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
-+	    !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
-+	    !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
-+		return -EINVAL;
-+
-+	params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
-+	params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
-+
-+	err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_next);
-+	if (err)
-+		return err;
-+
-+	tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
-+	if (!tb)
-+		return -ENOMEM;
-+
-+	err = nla_parse_nested(tb, NL80211_ATTR_MAX,
-+			       info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
-+			       nl80211_policy, info->extack);
-+	if (err)
-+		goto out;
-+
-+	err = nl80211_parse_beacon(rdev, tb, &params.beacon_color_change);
-+	if (err)
-+		goto out;
-+
-+	if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
-+		err = -EINVAL;
-+		goto out;
-+	}
-+
-+	if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
-+		err = -EINVAL;
-+		goto out;
-+	}
-+
-+	offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
-+	if (offset >= params.beacon_color_change.tail_len) {
-+		err = -EINVAL;
-+		goto out;
-+	}
-+
-+	if (params.beacon_color_change.tail[offset] != params.count) {
-+		err = -EINVAL;
-+		goto out;
-+	}
-+
-+	params.counter_offset_beacon = offset;
-+
-+	if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
-+		if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
-+		    sizeof(u16)) {
-+			err = -EINVAL;
-+			goto out;
-+		}
-+
-+		offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
-+		if (offset >= params.beacon_color_change.probe_resp_len) {
-+			err = -EINVAL;
-+			goto out;
-+		}
-+
-+		if (params.beacon_color_change.probe_resp[offset] !=
-+		    params.count) {
-+			err = -EINVAL;
-+			goto out;
-+		}
-+
-+		params.counter_offset_presp = offset;
-+	}
-+
-+	wdev_lock(wdev);
-+	err = rdev_color_change(rdev, dev, &params);
-+	wdev_unlock(wdev);
-+
-+out:
-+	kfree(tb);
-+	return err;
-+}
-+
- #define NL80211_FLAG_NEED_WIPHY		0x01
- #define NL80211_FLAG_NEED_NETDEV	0x02
- #define NL80211_FLAG_NEED_RTNL		0x04
-@@ -15758,6 +15862,14 @@ static const struct genl_small_ops nl802
- 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
- 				  NL80211_FLAG_NEED_RTNL,
- 	},
-+	{
-+		.cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
-+		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-+		.doit = nl80211_color_change,
-+		.flags = GENL_UNS_ADMIN_PERM,
-+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-+				  NL80211_FLAG_NEED_RTNL,
-+	},
- };
- 
- static struct genl_family nl80211_fam __genl_ro_after_init = {
-@@ -17384,6 +17496,51 @@ void cfg80211_ch_switch_started_notify(s
- }
- EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
- 
-+int cfg80211_bss_color_notify(struct net_device *dev, gfp_t gfp,
-+			      enum nl80211_commands cmd, u8 count,
-+			      u64 color_bitmap)
-+{
-+	struct wireless_dev *wdev = dev->ieee80211_ptr;
-+	struct wiphy *wiphy = wdev->wiphy;
-+	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
-+	struct sk_buff *msg;
-+	void *hdr;
-+
-+	ASSERT_WDEV_LOCK(wdev);
-+
-+	trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
-+
-+	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
-+	if (!msg)
-+		return -ENOMEM;
-+
-+	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
-+	if (!hdr)
-+		goto nla_put_failure;
-+
-+	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
-+		goto nla_put_failure;
-+
-+	if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
-+	    nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
-+		goto nla_put_failure;
-+
-+	if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
-+	    nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
-+			      color_bitmap, NL80211_ATTR_PAD))
-+		goto nla_put_failure;
-+
-+	genlmsg_end(msg, hdr);
-+
-+	return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
-+				       msg, 0, NL80211_MCGRP_MLME, gfp);
-+
-+nla_put_failure:
-+	nlmsg_free(msg);
-+	return -EINVAL;
-+}
-+EXPORT_SYMBOL(cfg80211_bss_color_notify);
-+
- void
- nl80211_radar_notify(struct cfg80211_registered_device *rdev,
- 		     const struct cfg80211_chan_def *chandef,
---- a/net/wireless/rdev-ops.h
-+++ b/net/wireless/rdev-ops.h
-@@ -1368,4 +1368,17 @@ static inline int rdev_set_sar_specs(str
- 	return ret;
- }
- 
-+static inline int rdev_color_change(struct cfg80211_registered_device *rdev,
-+				    struct net_device *dev,
-+				    struct cfg80211_color_change_settings *params)
-+{
-+	int ret;
-+
-+	trace_rdev_color_change(&rdev->wiphy, dev, params);
-+	ret = rdev->ops->color_change(&rdev->wiphy, dev, params);
-+	trace_rdev_return_int(&rdev->wiphy, ret);
-+
-+	return ret;
-+}
-+
- #endif /* __CFG80211_RDEV_OPS */
---- a/net/wireless/trace.h
-+++ b/net/wireless/trace.h
-@@ -3570,6 +3570,52 @@ TRACE_EVENT(rdev_set_sar_specs,
- 		  WIPHY_PR_ARG, __entry->type, __entry->num)
- );
- 
-+TRACE_EVENT(rdev_color_change,
-+	TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
-+		 struct cfg80211_color_change_settings *params),
-+	TP_ARGS(wiphy, netdev, params),
-+	TP_STRUCT__entry(
-+		WIPHY_ENTRY
-+		NETDEV_ENTRY
-+		__field(u8, count)
-+		__field(u16, bcn_ofs)
-+		__field(u16, pres_ofs)
-+	),
-+	TP_fast_assign(
-+		WIPHY_ASSIGN;
-+		NETDEV_ASSIGN;
-+		__entry->count = params->count;
-+		__entry->bcn_ofs = params->counter_offset_beacon;
-+		__entry->pres_ofs = params->counter_offset_presp;
-+	),
-+	TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT
-+		  ", count: %u",
-+		  WIPHY_PR_ARG, NETDEV_PR_ARG,
-+		  __entry->count)
-+);
-+
-+TRACE_EVENT(cfg80211_bss_color_notify,
-+	TP_PROTO(struct net_device *netdev,
-+		 enum nl80211_commands cmd,
-+		 u8 count, u64 color_bitmap),
-+	TP_ARGS(netdev, cmd, count, color_bitmap),
-+	TP_STRUCT__entry(
-+		NETDEV_ENTRY
-+		__field(enum nl80211_bss_scan_width, cmd)
-+		__field(u8, count)
-+		__field(u64, color_bitmap)
-+	),
-+	TP_fast_assign(
-+		NETDEV_ASSIGN;
-+		__entry->cmd = cmd;
-+		__entry->count = count;
-+		__entry->color_bitmap = color_bitmap;
-+	),
-+	TP_printk(NETDEV_PR_FMT ", cmd: %x, count: %u, bitmap: %llx",
-+		  NETDEV_PR_ARG, __entry->cmd, __entry->count,
-+		  __entry->color_bitmap)
-+);
-+
- #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
- 
- #undef TRACE_INCLUDE_PATH
diff --git a/package/kernel/mac80211/patches/subsys/388-mac80211-add-support-for-BSS-color-change.patch b/package/kernel/mac80211/patches/subsys/388-mac80211-add-support-for-BSS-color-change.patch
deleted file mode 100644
index c3e87df29..000000000
--- a/package/kernel/mac80211/patches/subsys/388-mac80211-add-support-for-BSS-color-change.patch
+++ /dev/null
@@ -1,524 +0,0 @@
-From: John Crispin <john@phrozen.org>
-Date: Fri, 2 Jul 2021 19:44:08 +0200
-Subject: [PATCH] mac80211: add support for BSS color change
-
-The color change announcement is very similar to how CSA works where
-we have an IE that includes a counter. When the counter hits 0, the new
-color is applied via an updated beacon.
-
-This patch makes the CSA counter functionality reusable, rather than
-implementing it again. This also allows for future reuse incase support
-for other counter IEs gets added.
-
-Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Signed-off-by: John Crispin <john@phrozen.org>
-Link: https://lore.kernel.org/r/057c1e67b82bee561ea44ce6a45a8462d3da6995.1625247619.git.lorenzo@kernel.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -1710,6 +1710,10 @@ enum ieee80211_offload_flags {
-  *	protected by fq->lock.
-  * @offload_flags: 802.3 -> 802.11 enapsulation offload flags, see
-  *	&enum ieee80211_offload_flags.
-+ * @color_change_active: marks whether a color change is ongoing. Internally it is
-+ *	write-protected by sdata_lock and local->mtx so holding either is fine
-+ *	for read access.
-+ * @color_change_color: the bss color that will be used after the change.
-  */
- struct ieee80211_vif {
- 	enum nl80211_iftype type;
-@@ -1738,6 +1742,9 @@ struct ieee80211_vif {
- 
- 	bool txqs_stopped[IEEE80211_NUM_ACS];
- 
-+	bool color_change_active;
-+	u8 color_change_color;
-+
- 	/* must be last */
- 	u8 drv_priv[] __aligned(sizeof(void *));
- };
-@@ -4982,6 +4989,16 @@ void ieee80211_csa_finish(struct ieee802
- bool ieee80211_beacon_cntdwn_is_complete(struct ieee80211_vif *vif);
- 
- /**
-+ * ieee80211_color_change_finish - notify mac80211 about color change
-+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
-+ *
-+ * After a color change announcement was scheduled and the counter in this
-+ * announcement hits 1, this function must be called by the driver to
-+ * notify mac80211 that the color can be changed
-+ */
-+void ieee80211_color_change_finish(struct ieee80211_vif *vif);
-+
-+/**
-  * ieee80211_proberesp_get - retrieve a Probe Response template
-  * @hw: pointer obtained from ieee80211_alloc_hw().
-  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
-@@ -6726,6 +6743,18 @@ ieee80211_get_unsol_bcast_probe_resp_tmp
- 					  struct ieee80211_vif *vif);
- 
- /**
-+ * ieeee80211_obss_color_collision_notify - notify userland about a BSS color
-+ * collision.
-+ *
-+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
-+ * @color_bitmap: a 64 bit bitmap representing the colors that the local BSS is
-+ *	aware of.
-+ */
-+void
-+ieeee80211_obss_color_collision_notify(struct ieee80211_vif *vif,
-+				       u64 color_bitmap);
-+
-+/**
-  * ieee80211_is_tx_data - check if frame is a data frame
-  *
-  * The function is used to check if a frame is a data frame. Frames with
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -827,9 +827,11 @@ static int ieee80211_set_monitor_channel
- 	return ret;
- }
- 
--static int ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
--				    const u8 *resp, size_t resp_len,
--				    const struct ieee80211_csa_settings *csa)
-+static int
-+ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
-+			 const u8 *resp, size_t resp_len,
-+			 const struct ieee80211_csa_settings *csa,
-+			 const struct ieee80211_color_change_settings *cca)
- {
- 	struct probe_resp *new, *old;
- 
-@@ -849,6 +851,8 @@ static int ieee80211_set_probe_resp(stru
- 		memcpy(new->cntdwn_counter_offsets, csa->counter_offsets_presp,
- 		       csa->n_counter_offsets_presp *
- 		       sizeof(new->cntdwn_counter_offsets[0]));
-+	else if (cca)
-+		new->cntdwn_counter_offsets[0] = cca->counter_offset_presp;
- 
- 	rcu_assign_pointer(sdata->u.ap.probe_resp, new);
- 	if (old)
-@@ -954,7 +958,8 @@ static int ieee80211_set_ftm_responder_p
- 
- static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
- 				   struct cfg80211_beacon_data *params,
--				   const struct ieee80211_csa_settings *csa)
-+				   const struct ieee80211_csa_settings *csa,
-+				   const struct ieee80211_color_change_settings *cca)
- {
- 	struct beacon_data *new, *old;
- 	int new_head_len, new_tail_len;
-@@ -1003,6 +1008,9 @@ static int ieee80211_assign_beacon(struc
- 		memcpy(new->cntdwn_counter_offsets, csa->counter_offsets_beacon,
- 		       csa->n_counter_offsets_beacon *
- 		       sizeof(new->cntdwn_counter_offsets[0]));
-+	} else if (cca) {
-+		new->cntdwn_current_counter = cca->count;
-+		new->cntdwn_counter_offsets[0] = cca->counter_offset_beacon;
- 	}
- 
- 	/* copy in head */
-@@ -1019,7 +1027,7 @@ static int ieee80211_assign_beacon(struc
- 			memcpy(new->tail, old->tail, new_tail_len);
- 
- 	err = ieee80211_set_probe_resp(sdata, params->probe_resp,
--				       params->probe_resp_len, csa);
-+				       params->probe_resp_len, csa, cca);
- 	if (err < 0) {
- 		kfree(new);
- 		return err;
-@@ -1176,7 +1184,7 @@ static int ieee80211_start_ap(struct wip
- 	if (ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL))
- 		sdata->vif.bss_conf.beacon_tx_rate = params->beacon_rate;
- 
--	err = ieee80211_assign_beacon(sdata, &params->beacon, NULL);
-+	err = ieee80211_assign_beacon(sdata, &params->beacon, NULL, NULL);
- 	if (err < 0)
- 		goto error;
- 	changed |= err;
-@@ -1231,17 +1239,17 @@ static int ieee80211_change_beacon(struc
- 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
- 	sdata_assert_lock(sdata);
- 
--	/* don't allow changing the beacon while CSA is in place - offset
-+	/* don't allow changing the beacon while a countdown is in place - offset
- 	 * of channel switch counter may change
- 	 */
--	if (sdata->vif.csa_active)
-+	if (sdata->vif.csa_active || sdata->vif.color_change_active)
- 		return -EBUSY;
- 
- 	old = sdata_dereference(sdata->u.ap.beacon, sdata);
- 	if (!old)
- 		return -ENOENT;
- 
--	err = ieee80211_assign_beacon(sdata, params, NULL);
-+	err = ieee80211_assign_beacon(sdata, params, NULL, NULL);
- 	if (err < 0)
- 		return err;
- 	ieee80211_bss_info_change_notify(sdata, err);
-@@ -3174,7 +3182,7 @@ static int ieee80211_set_after_csa_beaco
- 	switch (sdata->vif.type) {
- 	case NL80211_IFTYPE_AP:
- 		err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon,
--					      NULL);
-+					      NULL, NULL);
- 		kfree(sdata->u.ap.next_beacon);
- 		sdata->u.ap.next_beacon = NULL;
- 
-@@ -3340,7 +3348,7 @@ static int ieee80211_set_csa_beacon(stru
- 		csa.n_counter_offsets_presp = params->n_counter_offsets_presp;
- 		csa.count = params->count;
- 
--		err = ieee80211_assign_beacon(sdata, &params->beacon_csa, &csa);
-+		err = ieee80211_assign_beacon(sdata, &params->beacon_csa, &csa, NULL);
- 		if (err < 0) {
- 			kfree(sdata->u.ap.next_beacon);
- 			return err;
-@@ -3428,6 +3436,15 @@ static int ieee80211_set_csa_beacon(stru
- 	return 0;
- }
- 
-+static void ieee80211_color_change_abort(struct ieee80211_sub_if_data  *sdata)
-+{
-+	sdata->vif.color_change_active = false;
-+	kfree(sdata->u.ap.next_beacon);
-+	sdata->u.ap.next_beacon = NULL;
-+
-+	cfg80211_color_change_aborted_notify(sdata->dev);
-+}
-+
- static int
- __ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
- 			   struct cfg80211_csa_settings *params)
-@@ -3496,6 +3513,10 @@ __ieee80211_channel_switch(struct wiphy
- 		goto out;
- 	}
- 
-+	/* if there is a color change in progress, abort it */
-+	if (sdata->vif.color_change_active)
-+		ieee80211_color_change_abort(sdata);
-+
- 	err = ieee80211_set_csa_beacon(sdata, params, &changed);
- 	if (err) {
- 		ieee80211_vif_unreserve_chanctx(sdata);
-@@ -4147,6 +4168,196 @@ static int ieee80211_set_sar_specs(struc
- 	return local->ops->set_sar_specs(&local->hw, sar);
- }
- 
-+static int
-+ieee80211_set_after_color_change_beacon(struct ieee80211_sub_if_data *sdata,
-+					u32 *changed)
-+{
-+	switch (sdata->vif.type) {
-+	case NL80211_IFTYPE_AP: {
-+		int ret;
-+
-+		ret = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon,
-+					      NULL, NULL);
-+		kfree(sdata->u.ap.next_beacon);
-+		sdata->u.ap.next_beacon = NULL;
-+
-+		if (ret < 0)
-+			return ret;
-+
-+		*changed |= ret;
-+		break;
-+	}
-+	default:
-+		WARN_ON_ONCE(1);
-+		return -EINVAL;
-+	}
-+
-+	return 0;
-+}
-+
-+static int
-+ieee80211_set_color_change_beacon(struct ieee80211_sub_if_data *sdata,
-+				  struct cfg80211_color_change_settings *params,
-+				  u32 *changed)
-+{
-+	struct ieee80211_color_change_settings color_change = {};
-+	int err;
-+
-+	switch (sdata->vif.type) {
-+	case NL80211_IFTYPE_AP:
-+		sdata->u.ap.next_beacon =
-+			cfg80211_beacon_dup(&params->beacon_next);
-+		if (!sdata->u.ap.next_beacon)
-+			return -ENOMEM;
-+
-+		if (params->count <= 1)
-+			break;
-+
-+		color_change.counter_offset_beacon =
-+			params->counter_offset_beacon;
-+		color_change.counter_offset_presp =
-+			params->counter_offset_presp;
-+		color_change.count = params->count;
-+
-+		err = ieee80211_assign_beacon(sdata, &params->beacon_color_change,
-+					      NULL, &color_change);
-+		if (err < 0) {
-+			kfree(sdata->u.ap.next_beacon);
-+			return err;
-+		}
-+		*changed |= err;
-+		break;
-+	default:
-+		return -EOPNOTSUPP;
-+	}
-+
-+	return 0;
-+}
-+
-+static void
-+ieee80211_color_change_bss_config_notify(struct ieee80211_sub_if_data *sdata,
-+					 u8 color, int enable, u32 changed)
-+{
-+	sdata->vif.bss_conf.he_bss_color.color = color;
-+	sdata->vif.bss_conf.he_bss_color.enabled = enable;
-+	changed |= BSS_CHANGED_HE_BSS_COLOR;
-+
-+	ieee80211_bss_info_change_notify(sdata, changed);
-+}
-+
-+static int ieee80211_color_change_finalize(struct ieee80211_sub_if_data *sdata)
-+{
-+	struct ieee80211_local *local = sdata->local;
-+	u32 changed = 0;
-+	int err;
-+
-+	sdata_assert_lock(sdata);
-+	lockdep_assert_held(&local->mtx);
-+
-+	sdata->vif.color_change_active = false;
-+
-+	err = ieee80211_set_after_color_change_beacon(sdata, &changed);
-+	if (err) {
-+		cfg80211_color_change_aborted_notify(sdata->dev);
-+		return err;
-+	}
-+
-+	ieee80211_color_change_bss_config_notify(sdata,
-+						 sdata->vif.color_change_color,
-+						 1, changed);
-+	cfg80211_color_change_notify(sdata->dev);
-+
-+	return 0;
-+}
-+
-+void ieee80211_color_change_finalize_work(struct work_struct *work)
-+{
-+	struct ieee80211_sub_if_data *sdata =
-+		container_of(work, struct ieee80211_sub_if_data,
-+			     color_change_finalize_work);
-+	struct ieee80211_local *local = sdata->local;
-+
-+	sdata_lock(sdata);
-+	mutex_lock(&local->mtx);
-+
-+	/* AP might have been stopped while waiting for the lock. */
-+	if (!sdata->vif.color_change_active)
-+		goto unlock;
-+
-+	if (!ieee80211_sdata_running(sdata))
-+		goto unlock;
-+
-+	ieee80211_color_change_finalize(sdata);
-+
-+unlock:
-+	mutex_unlock(&local->mtx);
-+	sdata_unlock(sdata);
-+}
-+
-+void ieee80211_color_change_finish(struct ieee80211_vif *vif)
-+{
-+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-+
-+	ieee80211_queue_work(&sdata->local->hw,
-+			     &sdata->color_change_finalize_work);
-+}
-+EXPORT_SYMBOL_GPL(ieee80211_color_change_finish);
-+
-+void
-+ieeee80211_obss_color_collision_notify(struct ieee80211_vif *vif,
-+				       u64 color_bitmap)
-+{
-+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-+
-+	if (sdata->vif.color_change_active || sdata->vif.csa_active)
-+		return;
-+
-+	cfg80211_obss_color_collision_notify(sdata->dev, color_bitmap);
-+}
-+EXPORT_SYMBOL_GPL(ieeee80211_obss_color_collision_notify);
-+
-+static int
-+ieee80211_color_change(struct wiphy *wiphy, struct net_device *dev,
-+		       struct cfg80211_color_change_settings *params)
-+{
-+	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-+	struct ieee80211_local *local = sdata->local;
-+	u32 changed = 0;
-+	int err;
-+
-+	sdata_assert_lock(sdata);
-+
-+	mutex_lock(&local->mtx);
-+
-+	/* don't allow another color change if one is already active or if csa
-+	 * is active
-+	 */
-+	if (sdata->vif.color_change_active || sdata->vif.csa_active) {
-+		err = -EBUSY;
-+		goto out;
-+	}
-+
-+	err = ieee80211_set_color_change_beacon(sdata, params, &changed);
-+	if (err)
-+		goto out;
-+
-+	sdata->vif.color_change_active = true;
-+	sdata->vif.color_change_color = params->color;
-+
-+	cfg80211_color_change_started_notify(sdata->dev, params->count);
-+
-+	if (changed)
-+		ieee80211_color_change_bss_config_notify(sdata, 0, 0, changed);
-+	else
-+		/* if the beacon didn't change, we can finalize immediately */
-+		ieee80211_color_change_finalize(sdata);
-+
-+out:
-+	mutex_unlock(&local->mtx);
-+
-+	return err;
-+}
-+
- const struct cfg80211_ops mac80211_config_ops = {
- 	.add_virtual_intf = ieee80211_add_iface,
- 	.del_virtual_intf = ieee80211_del_iface,
-@@ -4251,4 +4462,5 @@ const struct cfg80211_ops mac80211_confi
- 	.set_tid_config = ieee80211_set_tid_config,
- 	.reset_tid_config = ieee80211_reset_tid_config,
- 	.set_sar_specs = ieee80211_set_sar_specs,
-+	.color_change = ieee80211_color_change,
- };
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -248,6 +248,12 @@ struct ieee80211_csa_settings {
- 	u8 count;
- };
- 
-+struct ieee80211_color_change_settings {
-+	u16 counter_offset_beacon;
-+	u16 counter_offset_presp;
-+	u8 count;
-+};
-+
- struct beacon_data {
- 	u8 *head, *tail;
- 	int head_len, tail_len;
-@@ -932,6 +938,8 @@ struct ieee80211_sub_if_data {
- 	bool csa_block_tx; /* write-protected by sdata_lock and local->mtx */
- 	struct cfg80211_chan_def csa_chandef;
- 
-+	struct work_struct color_change_finalize_work;
-+
- 	struct list_head assigned_chanctx_list; /* protected by chanctx_mtx */
- 	struct list_head reserved_chanctx_list; /* protected by chanctx_mtx */
- 
-@@ -1900,6 +1908,9 @@ void ieee80211_csa_finalize_work(struct
- int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
- 			     struct cfg80211_csa_settings *params);
- 
-+/* color change handling */
-+void ieee80211_color_change_finalize_work(struct work_struct *work);
-+
- /* interface handling */
- #define MAC80211_SUPPORTED_FEATURES_TX	(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \
- 					 NETIF_F_HW_CSUM | NETIF_F_SG | \
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -465,6 +465,7 @@ static void ieee80211_do_stop(struct iee
- 	sdata_unlock(sdata);
- 
- 	cancel_work_sync(&sdata->csa_finalize_work);
-+	cancel_work_sync(&sdata->color_change_finalize_work);
- 
- 	cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
- 
-@@ -1639,6 +1640,7 @@ static void ieee80211_setup_sdata(struct
- 	INIT_WORK(&sdata->work, ieee80211_iface_work);
- 	INIT_WORK(&sdata->recalc_smps, ieee80211_recalc_smps_work);
- 	INIT_WORK(&sdata->csa_finalize_work, ieee80211_csa_finalize_work);
-+	INIT_WORK(&sdata->color_change_finalize_work, ieee80211_color_change_finalize_work);
- 	INIT_LIST_HEAD(&sdata->assigned_chanctx_list);
- 	INIT_LIST_HEAD(&sdata->reserved_chanctx_list);
- 
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -4802,11 +4802,11 @@ static int ieee80211_beacon_add_tim(stru
- static void ieee80211_set_beacon_cntdwn(struct ieee80211_sub_if_data *sdata,
- 					struct beacon_data *beacon)
- {
-+	u8 *beacon_data, count, max_count = 1;
- 	struct probe_resp *resp;
--	u8 *beacon_data;
- 	size_t beacon_data_len;
-+	u16 *bcn_offsets;
- 	int i;
--	u8 count = beacon->cntdwn_current_counter;
- 
- 	switch (sdata->vif.type) {
- 	case NL80211_IFTYPE_AP:
-@@ -4826,21 +4826,27 @@ static void ieee80211_set_beacon_cntdwn(
- 	}
- 
- 	rcu_read_lock();
--	for (i = 0; i < IEEE80211_MAX_CNTDWN_COUNTERS_NUM; ++i) {
--		resp = rcu_dereference(sdata->u.ap.probe_resp);
-+	resp = rcu_dereference(sdata->u.ap.probe_resp);
- 
--		if (beacon->cntdwn_counter_offsets[i]) {
--			if (WARN_ON_ONCE(beacon->cntdwn_counter_offsets[i] >=
--					 beacon_data_len)) {
-+	bcn_offsets = beacon->cntdwn_counter_offsets;
-+	count = beacon->cntdwn_current_counter;
-+	if (sdata->vif.csa_active)
-+		max_count = IEEE80211_MAX_CNTDWN_COUNTERS_NUM;
-+
-+	for (i = 0; i < max_count; ++i) {
-+		if (bcn_offsets[i]) {
-+			if (WARN_ON_ONCE(bcn_offsets[i] >= beacon_data_len)) {
- 				rcu_read_unlock();
- 				return;
- 			}
--
--			beacon_data[beacon->cntdwn_counter_offsets[i]] = count;
-+			beacon_data[bcn_offsets[i]] = count;
- 		}
- 
--		if (sdata->vif.type == NL80211_IFTYPE_AP && resp)
--			resp->data[resp->cntdwn_counter_offsets[i]] = count;
-+		if (sdata->vif.type == NL80211_IFTYPE_AP && resp) {
-+			u16 *resp_offsets = resp->cntdwn_counter_offsets;
-+
-+			resp->data[resp_offsets[i]] = count;
-+		}
- 	}
- 	rcu_read_unlock();
- }
-@@ -5050,6 +5056,7 @@ __ieee80211_beacon_get(struct ieee80211_
- 			if (offs) {
- 				offs->tim_offset = beacon->head_len;
- 				offs->tim_length = skb->len - beacon->head_len;
-+				offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
- 
- 				/* for AP the csa offsets are from tail */
- 				csa_off_base = skb->len;
diff --git a/package/kernel/mac80211/patches/subsys/389-ieee80211-add-TWT-element-definitions.patch b/package/kernel/mac80211/patches/subsys/389-ieee80211-add-TWT-element-definitions.patch
deleted file mode 100644
index 369619938..000000000
--- a/package/kernel/mac80211/patches/subsys/389-ieee80211-add-TWT-element-definitions.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Mon, 23 Aug 2021 20:02:38 +0200
-Subject: [PATCH] ieee80211: add TWT element definitions
-
-Introduce TWT definitions and TWT Information element structure
-in ieee80211.h
-
-Tested-by: Peter Chiu <chui-hao.chiu@mediatek.com>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://lore.kernel.org/r/71d8b581fe4b5abc5b92f8d77ac2de3e2f7591b6.1629741512.git.lorenzo@kernel.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/linux/ieee80211.h
-+++ b/include/linux/ieee80211.h
-@@ -1088,6 +1088,48 @@ struct ieee80211_ext {
- 	} u;
- } __packed __aligned(2);
- 
-+#define IEEE80211_TWT_CONTROL_NDP			BIT(0)
-+#define IEEE80211_TWT_CONTROL_RESP_MODE			BIT(1)
-+#define IEEE80211_TWT_CONTROL_NEG_TYPE_BROADCAST	BIT(3)
-+#define IEEE80211_TWT_CONTROL_RX_DISABLED		BIT(4)
-+#define IEEE80211_TWT_CONTROL_WAKE_DUR_UNIT		BIT(5)
-+
-+#define IEEE80211_TWT_REQTYPE_REQUEST			BIT(0)
-+#define IEEE80211_TWT_REQTYPE_SETUP_CMD			GENMASK(3, 1)
-+#define IEEE80211_TWT_REQTYPE_TRIGGER			BIT(4)
-+#define IEEE80211_TWT_REQTYPE_IMPLICIT			BIT(5)
-+#define IEEE80211_TWT_REQTYPE_FLOWTYPE			BIT(6)
-+#define IEEE80211_TWT_REQTYPE_FLOWID			GENMASK(9, 7)
-+#define IEEE80211_TWT_REQTYPE_WAKE_INT_EXP		GENMASK(14, 10)
-+#define IEEE80211_TWT_REQTYPE_PROTECTION		BIT(15)
-+
-+enum ieee80211_twt_setup_cmd {
-+	TWT_SETUP_CMD_REQUEST,
-+	TWT_SETUP_CMD_SUGGEST,
-+	TWT_SETUP_CMD_DEMAND,
-+	TWT_SETUP_CMD_GROUPING,
-+	TWT_SETUP_CMD_ACCEPT,
-+	TWT_SETUP_CMD_ALTERNATE,
-+	TWT_SETUP_CMD_DICTATE,
-+	TWT_SETUP_CMD_REJECT,
-+};
-+
-+struct ieee80211_twt_params {
-+	__le16 req_type;
-+	__le64 twt;
-+	u8 min_twt_dur;
-+	__le16 mantissa;
-+	u8 channel;
-+} __packed;
-+
-+struct ieee80211_twt_setup {
-+	u8 dialog_token;
-+	u8 element_id;
-+	u8 length;
-+	u8 control;
-+	u8 params[];
-+} __packed;
-+
- struct ieee80211_mgmt {
- 	__le16 frame_control;
- 	__le16 duration;
-@@ -1252,6 +1294,10 @@ struct ieee80211_mgmt {
- 					__le16 toa_error;
- 					u8 variable[0];
- 				} __packed ftm;
-+				struct {
-+					u8 action_code;
-+					u8 variable[];
-+				} __packed s1g;
- 			} u;
- 		} __packed action;
- 	} u;
-@@ -2880,6 +2926,7 @@ enum ieee80211_eid {
- 	WLAN_EID_AID_RESPONSE = 211,
- 	WLAN_EID_S1G_BCN_COMPAT = 213,
- 	WLAN_EID_S1G_SHORT_BCN_INTERVAL = 214,
-+	WLAN_EID_S1G_TWT = 216,
- 	WLAN_EID_S1G_CAPABILITIES = 217,
- 	WLAN_EID_VENDOR_SPECIFIC = 221,
- 	WLAN_EID_QOS_PARAMETER = 222,
-@@ -2948,6 +2995,7 @@ enum ieee80211_category {
- 	WLAN_CATEGORY_FST = 18,
- 	WLAN_CATEGORY_UNPROT_DMG = 20,
- 	WLAN_CATEGORY_VHT = 21,
-+	WLAN_CATEGORY_S1G = 22,
- 	WLAN_CATEGORY_VENDOR_SPECIFIC_PROTECTED = 126,
- 	WLAN_CATEGORY_VENDOR_SPECIFIC = 127,
- };
-@@ -3021,6 +3069,20 @@ enum ieee80211_key_len {
- 	WLAN_KEY_LEN_BIP_GMAC_256 = 32,
- };
- 
-+enum ieee80211_s1g_actioncode {
-+	WLAN_S1G_AID_SWITCH_REQUEST,
-+	WLAN_S1G_AID_SWITCH_RESPONSE,
-+	WLAN_S1G_SYNC_CONTROL,
-+	WLAN_S1G_STA_INFO_ANNOUNCE,
-+	WLAN_S1G_EDCA_PARAM_SET,
-+	WLAN_S1G_EL_OPERATION,
-+	WLAN_S1G_TWT_SETUP,
-+	WLAN_S1G_TWT_TEARDOWN,
-+	WLAN_S1G_SECT_GROUP_ID_LIST,
-+	WLAN_S1G_SECT_ID_FEEDBACK,
-+	WLAN_S1G_TWT_INFORMATION = 11,
-+};
-+
- #define IEEE80211_WEP_IV_LEN		4
- #define IEEE80211_WEP_ICV_LEN		4
- #define IEEE80211_CCMP_HDR_LEN		8
diff --git a/package/kernel/mac80211/patches/subsys/390-mac80211-introduce-individual-TWT-support-in-AP-mode.patch b/package/kernel/mac80211/patches/subsys/390-mac80211-introduce-individual-TWT-support-in-AP-mode.patch
deleted file mode 100644
index c32861a78..000000000
--- a/package/kernel/mac80211/patches/subsys/390-mac80211-introduce-individual-TWT-support-in-AP-mode.patch
+++ /dev/null
@@ -1,576 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Mon, 23 Aug 2021 20:02:39 +0200
-Subject: [PATCH] mac80211: introduce individual TWT support in AP mode
-
-Introduce TWT action frames parsing support to mac80211.
-Currently just individual TWT agreement are support in AP mode.
-Whenever the AP receives a TWT action frame from an associated client,
-after performing sanity checks, it will notify the underlay driver with
-requested parameters in order to check if they are supported and if there
-is enough room for a new agreement. The driver is expected to set the
-agreement result and report it to mac80211.
-
-Drivers supporting this have two new callbacks:
- - add_twt_setup (mandatory)
- - twt_teardown_request (optional)
-
-mac80211 will send an action frame reply according to the result
-reported by the driver.
-
-Tested-by: Peter Chiu <chui-hao.chiu@mediatek.com>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://lore.kernel.org/r/257512f2e22ba42b9f2624942a128dd8f141de4b.1629741512.git.lorenzo@kernel.org
-[use le16p_replace_bits(), minor cleanups, use (void *) casts,
- fix to use ieee80211_get_he_iftype_cap() correctly]
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -4219,6 +4219,11 @@ struct ieee80211_ops {
- 	void (*sta_set_decap_offload)(struct ieee80211_hw *hw,
- 				      struct ieee80211_vif *vif,
- 				      struct ieee80211_sta *sta, bool enabled);
-+	void (*add_twt_setup)(struct ieee80211_hw *hw,
-+			      struct ieee80211_sta *sta,
-+			      struct ieee80211_twt_setup *twt);
-+	void (*twt_teardown_request)(struct ieee80211_hw *hw,
-+				     struct ieee80211_sta *sta, u8 flowid);
- };
- 
- /**
---- a/net/mac80211/driver-ops.h
-+++ b/net/mac80211/driver-ops.h
-@@ -1429,4 +1429,40 @@ static inline void drv_sta_set_decap_off
- 	trace_drv_return_void(local);
- }
- 
-+static inline void drv_add_twt_setup(struct ieee80211_local *local,
-+				     struct ieee80211_sub_if_data *sdata,
-+				     struct ieee80211_sta *sta,
-+				     struct ieee80211_twt_setup *twt)
-+{
-+	struct ieee80211_twt_params *twt_agrt;
-+
-+	might_sleep();
-+
-+	if (!check_sdata_in_driver(sdata))
-+		return;
-+
-+	twt_agrt = (void *)twt->params;
-+
-+	trace_drv_add_twt_setup(local, sta, twt, twt_agrt);
-+	local->ops->add_twt_setup(&local->hw, sta, twt);
-+	trace_drv_return_void(local);
-+}
-+
-+static inline void drv_twt_teardown_request(struct ieee80211_local *local,
-+					    struct ieee80211_sub_if_data *sdata,
-+					    struct ieee80211_sta *sta,
-+					    u8 flowid)
-+{
-+	might_sleep();
-+	if (!check_sdata_in_driver(sdata))
-+		return;
-+
-+	if (!local->ops->twt_teardown_request)
-+		return;
-+
-+	trace_drv_twt_teardown_request(local, sta, flowid);
-+	local->ops->twt_teardown_request(&local->hw, sta, flowid);
-+	trace_drv_return_void(local);
-+}
-+
- #endif /* __MAC80211_DRIVER_OPS */
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -954,6 +954,7 @@ struct ieee80211_sub_if_data {
- 
- 	struct work_struct work;
- 	struct sk_buff_head skb_queue;
-+	struct sk_buff_head status_queue;
- 
- 	u8 needed_rx_chains;
- 	enum ieee80211_smps_mode smps_mode;
-@@ -2093,6 +2094,11 @@ ieee80211_he_op_ie_to_bss_conf(struct ie
- 
- /* S1G */
- void ieee80211_s1g_sta_rate_init(struct sta_info *sta);
-+bool ieee80211_s1g_is_twt_setup(struct sk_buff *skb);
-+void ieee80211_s1g_rx_twt_action(struct ieee80211_sub_if_data *sdata,
-+				 struct sk_buff *skb);
-+void ieee80211_s1g_status_twt_action(struct ieee80211_sub_if_data *sdata,
-+				     struct sk_buff *skb);
- 
- /* Spectrum management */
- void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -563,6 +563,7 @@ static void ieee80211_do_stop(struct iee
- 		 */
- 		ieee80211_free_keys(sdata, true);
- 		skb_queue_purge(&sdata->skb_queue);
-+		skb_queue_purge(&sdata->status_queue);
- 	}
- 
- 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-@@ -1070,6 +1071,7 @@ int ieee80211_add_virtual_monitor(struct
- 	}
- 
- 	skb_queue_head_init(&sdata->skb_queue);
-+	skb_queue_head_init(&sdata->status_queue);
- 	INIT_WORK(&sdata->work, ieee80211_iface_work);
- 
- 	return 0;
-@@ -1442,6 +1444,24 @@ static void ieee80211_if_setup_no_queue(
- #endif
- }
- 
-+static void ieee80211_iface_process_status(struct ieee80211_sub_if_data *sdata,
-+					   struct sk_buff *skb)
-+{
-+	struct ieee80211_mgmt *mgmt = (void *)skb->data;
-+
-+	if (ieee80211_is_action(mgmt->frame_control) &&
-+	    mgmt->u.action.category == WLAN_CATEGORY_S1G) {
-+		switch (mgmt->u.action.u.s1g.action_code) {
-+		case WLAN_S1G_TWT_TEARDOWN:
-+		case WLAN_S1G_TWT_SETUP:
-+			ieee80211_s1g_status_twt_action(sdata, skb);
-+			break;
-+		default:
-+			break;
-+		}
-+	}
-+}
-+
- static void ieee80211_iface_work(struct work_struct *work)
- {
- 	struct ieee80211_sub_if_data *sdata =
-@@ -1519,6 +1539,16 @@ static void ieee80211_iface_work(struct
- 				WARN_ON(1);
- 				break;
- 			}
-+		} else if (ieee80211_is_action(mgmt->frame_control) &&
-+			   mgmt->u.action.category == WLAN_CATEGORY_S1G) {
-+			switch (mgmt->u.action.u.s1g.action_code) {
-+			case WLAN_S1G_TWT_TEARDOWN:
-+			case WLAN_S1G_TWT_SETUP:
-+				ieee80211_s1g_rx_twt_action(sdata, skb);
-+				break;
-+			default:
-+				break;
-+			}
- 		} else if (ieee80211_is_ext(mgmt->frame_control)) {
- 			if (sdata->vif.type == NL80211_IFTYPE_STATION)
- 				ieee80211_sta_rx_queued_ext(sdata, skb);
-@@ -1574,6 +1604,12 @@ static void ieee80211_iface_work(struct
- 		kfree_skb(skb);
- 	}
- 
-+	/* process status queue */
-+	while ((skb = skb_dequeue(&sdata->status_queue))) {
-+		ieee80211_iface_process_status(sdata, skb);
-+		kfree_skb(skb);
-+	}
-+
- 	/* then other type-dependent work */
- 	switch (sdata->vif.type) {
- 	case NL80211_IFTYPE_STATION:
-@@ -1637,6 +1673,7 @@ static void ieee80211_setup_sdata(struct
- 	}
- 
- 	skb_queue_head_init(&sdata->skb_queue);
-+	skb_queue_head_init(&sdata->status_queue);
- 	INIT_WORK(&sdata->work, ieee80211_iface_work);
- 	INIT_WORK(&sdata->recalc_smps, ieee80211_recalc_smps_work);
- 	INIT_WORK(&sdata->csa_finalize_work, ieee80211_csa_finalize_work);
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -3210,6 +3210,68 @@ ieee80211_rx_h_mgmt_check(struct ieee802
- 	return RX_CONTINUE;
- }
- 
-+static bool
-+ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
-+{
-+	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)rx->skb->data;
-+	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
-+	struct ieee80211_sub_if_data *sdata = rx->sdata;
-+	const struct ieee80211_sta_he_cap *hecap;
-+	struct ieee80211_supported_band *sband;
-+
-+	/* TWT actions are only supported in AP for the moment */
-+	if (sdata->vif.type != NL80211_IFTYPE_AP)
-+		return false;
-+
-+	if (!rx->local->ops->add_twt_setup)
-+		return false;
-+
-+	sband = rx->local->hw.wiphy->bands[status->band];
-+	hecap = ieee80211_get_he_iftype_cap(sband,
-+					    ieee80211_vif_type_p2p(&sdata->vif));
-+	if (!hecap)
-+		return false;
-+
-+	if (!(hecap->he_cap_elem.mac_cap_info[0] &
-+	      IEEE80211_HE_MAC_CAP0_TWT_RES))
-+		return false;
-+
-+	if (!rx->sta)
-+		return false;
-+
-+	switch (mgmt->u.action.u.s1g.action_code) {
-+	case WLAN_S1G_TWT_SETUP: {
-+		struct ieee80211_twt_setup *twt;
-+
-+		if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +
-+				   1 + /* action code */
-+				   sizeof(struct ieee80211_twt_setup) +
-+				   2 /* TWT req_type agrt */)
-+			break;
-+
-+		twt = (void *)mgmt->u.action.u.s1g.variable;
-+		if (twt->element_id != WLAN_EID_S1G_TWT)
-+			break;
-+
-+		if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +
-+				   4 + /* action code + token + tlv */
-+				   twt->length)
-+			break;
-+
-+		return true; /* queue the frame */
-+	}
-+	case WLAN_S1G_TWT_TEARDOWN:
-+		if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE + 2)
-+			break;
-+
-+		return true; /* queue the frame */
-+	default:
-+		break;
-+	}
-+
-+	return false;
-+}
-+
- static ieee80211_rx_result debug_noinline
- ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
- {
-@@ -3489,6 +3551,17 @@ ieee80211_rx_h_action(struct ieee80211_r
- 		    !mesh_path_sel_is_hwmp(sdata))
- 			break;
- 		goto queue;
-+	case WLAN_CATEGORY_S1G:
-+		switch (mgmt->u.action.u.s1g.action_code) {
-+		case WLAN_S1G_TWT_SETUP:
-+		case WLAN_S1G_TWT_TEARDOWN:
-+			if (ieee80211_process_rx_twt_action(rx))
-+				goto queue;
-+			break;
-+		default:
-+			break;
-+		}
-+		break;
- 	}
- 
- 	return RX_CONTINUE;
---- a/net/mac80211/s1g.c
-+++ b/net/mac80211/s1g.c
-@@ -6,6 +6,7 @@
- #include <linux/ieee80211.h>
- #include <net/mac80211.h>
- #include "ieee80211_i.h"
-+#include "driver-ops.h"
- 
- void ieee80211_s1g_sta_rate_init(struct sta_info *sta)
- {
-@@ -14,3 +15,182 @@ void ieee80211_s1g_sta_rate_init(struct
- 	sta->rx_stats.last_rate =
- 			STA_STATS_FIELD(TYPE, STA_STATS_RATE_TYPE_S1G);
- }
-+
-+bool ieee80211_s1g_is_twt_setup(struct sk_buff *skb)
-+{
-+	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
-+
-+	if (likely(!ieee80211_is_action(mgmt->frame_control)))
-+		return false;
-+
-+	if (likely(mgmt->u.action.category != WLAN_CATEGORY_S1G))
-+		return false;
-+
-+	return mgmt->u.action.u.s1g.action_code == WLAN_S1G_TWT_SETUP;
-+}
-+
-+static void
-+ieee80211_s1g_send_twt_setup(struct ieee80211_sub_if_data *sdata, const u8 *da,
-+			     const u8 *bssid, struct ieee80211_twt_setup *twt)
-+{
-+	int len = IEEE80211_MIN_ACTION_SIZE + 4 + twt->length;
-+	struct ieee80211_local *local = sdata->local;
-+	struct ieee80211_mgmt *mgmt;
-+	struct sk_buff *skb;
-+
-+	skb = dev_alloc_skb(local->hw.extra_tx_headroom + len);
-+	if (!skb)
-+		return;
-+
-+	skb_reserve(skb, local->hw.extra_tx_headroom);
-+	mgmt = skb_put_zero(skb, len);
-+	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-+					  IEEE80211_STYPE_ACTION);
-+	memcpy(mgmt->da, da, ETH_ALEN);
-+	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
-+	memcpy(mgmt->bssid, bssid, ETH_ALEN);
-+
-+	mgmt->u.action.category = WLAN_CATEGORY_S1G;
-+	mgmt->u.action.u.s1g.action_code = WLAN_S1G_TWT_SETUP;
-+	memcpy(mgmt->u.action.u.s1g.variable, twt, 3 + twt->length);
-+
-+	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
-+					IEEE80211_TX_INTFL_MLME_CONN_TX |
-+					IEEE80211_TX_CTL_REQ_TX_STATUS;
-+	ieee80211_tx_skb(sdata, skb);
-+}
-+
-+static void
-+ieee80211_s1g_send_twt_teardown(struct ieee80211_sub_if_data *sdata,
-+				const u8 *da, const u8 *bssid, u8 flowid)
-+{
-+	struct ieee80211_local *local = sdata->local;
-+	struct ieee80211_mgmt *mgmt;
-+	struct sk_buff *skb;
-+	u8 *id;
-+
-+	skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-+			    IEEE80211_MIN_ACTION_SIZE + 2);
-+	if (!skb)
-+		return;
-+
-+	skb_reserve(skb, local->hw.extra_tx_headroom);
-+	mgmt = skb_put_zero(skb, IEEE80211_MIN_ACTION_SIZE + 2);
-+	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-+					  IEEE80211_STYPE_ACTION);
-+	memcpy(mgmt->da, da, ETH_ALEN);
-+	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
-+	memcpy(mgmt->bssid, bssid, ETH_ALEN);
-+
-+	mgmt->u.action.category = WLAN_CATEGORY_S1G;
-+	mgmt->u.action.u.s1g.action_code = WLAN_S1G_TWT_TEARDOWN;
-+	id = (u8 *)mgmt->u.action.u.s1g.variable;
-+	*id = flowid;
-+
-+	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
-+					IEEE80211_TX_CTL_REQ_TX_STATUS;
-+	ieee80211_tx_skb(sdata, skb);
-+}
-+
-+static void
-+ieee80211_s1g_rx_twt_setup(struct ieee80211_sub_if_data *sdata,
-+			   struct sta_info *sta, struct sk_buff *skb)
-+{
-+	struct ieee80211_mgmt *mgmt = (void *)skb->data;
-+	struct ieee80211_twt_setup *twt = (void *)mgmt->u.action.u.s1g.variable;
-+	struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
-+
-+	twt_agrt->req_type &= cpu_to_le16(~IEEE80211_TWT_REQTYPE_REQUEST);
-+
-+	/* broadcast TWT not supported yet */
-+	if (twt->control & IEEE80211_TWT_CONTROL_NEG_TYPE_BROADCAST) {
-+		le16p_replace_bits(&twt_agrt->req_type,
-+				   TWT_SETUP_CMD_REJECT,
-+				   IEEE80211_TWT_REQTYPE_SETUP_CMD);
-+		goto out;
-+	}
-+
-+	drv_add_twt_setup(sdata->local, sdata, &sta->sta, twt);
-+out:
-+	ieee80211_s1g_send_twt_setup(sdata, mgmt->sa, sdata->vif.addr, twt);
-+}
-+
-+static void
-+ieee80211_s1g_rx_twt_teardown(struct ieee80211_sub_if_data *sdata,
-+			      struct sta_info *sta, struct sk_buff *skb)
-+{
-+	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
-+
-+	drv_twt_teardown_request(sdata->local, sdata, &sta->sta,
-+				 mgmt->u.action.u.s1g.variable[0]);
-+}
-+
-+static void
-+ieee80211_s1g_tx_twt_setup_fail(struct ieee80211_sub_if_data *sdata,
-+				struct sta_info *sta, struct sk_buff *skb)
-+{
-+	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
-+	struct ieee80211_twt_setup *twt = (void *)mgmt->u.action.u.s1g.variable;
-+	struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
-+	u8 flowid = le16_get_bits(twt_agrt->req_type,
-+				  IEEE80211_TWT_REQTYPE_FLOWID);
-+
-+	drv_twt_teardown_request(sdata->local, sdata, &sta->sta, flowid);
-+
-+	ieee80211_s1g_send_twt_teardown(sdata, mgmt->sa, sdata->vif.addr,
-+					flowid);
-+}
-+
-+void ieee80211_s1g_rx_twt_action(struct ieee80211_sub_if_data *sdata,
-+				 struct sk_buff *skb)
-+{
-+	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
-+	struct ieee80211_local *local = sdata->local;
-+	struct sta_info *sta;
-+
-+	mutex_lock(&local->sta_mtx);
-+
-+	sta = sta_info_get_bss(sdata, mgmt->sa);
-+	if (!sta)
-+		goto out;
-+
-+	switch (mgmt->u.action.u.s1g.action_code) {
-+	case WLAN_S1G_TWT_SETUP:
-+		ieee80211_s1g_rx_twt_setup(sdata, sta, skb);
-+		break;
-+	case WLAN_S1G_TWT_TEARDOWN:
-+		ieee80211_s1g_rx_twt_teardown(sdata, sta, skb);
-+		break;
-+	default:
-+		break;
-+	}
-+
-+out:
-+	mutex_unlock(&local->sta_mtx);
-+}
-+
-+void ieee80211_s1g_status_twt_action(struct ieee80211_sub_if_data *sdata,
-+				     struct sk_buff *skb)
-+{
-+	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
-+	struct ieee80211_local *local = sdata->local;
-+	struct sta_info *sta;
-+
-+	mutex_lock(&local->sta_mtx);
-+
-+	sta = sta_info_get_bss(sdata, mgmt->da);
-+	if (!sta)
-+		goto out;
-+
-+	switch (mgmt->u.action.u.s1g.action_code) {
-+	case WLAN_S1G_TWT_SETUP:
-+		/* process failed twt setup frames */
-+		ieee80211_s1g_tx_twt_setup_fail(sdata, sta, skb);
-+		break;
-+	default:
-+		break;
-+	}
-+
-+out:
-+	mutex_unlock(&local->sta_mtx);
-+}
---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -705,13 +705,26 @@ static void ieee80211_report_used_skb(st
- 			/* Check to see if packet is a TDLS teardown packet */
- 			if (ieee80211_is_data(hdr->frame_control) &&
- 			    (ieee80211_get_tdls_action(skb, hdr_size) ==
--			     WLAN_TDLS_TEARDOWN))
-+			     WLAN_TDLS_TEARDOWN)) {
- 				ieee80211_tdls_td_tx_handle(local, sdata, skb,
- 							    info->flags);
--			else
-+			} else if (ieee80211_s1g_is_twt_setup(skb)) {
-+				if (!acked) {
-+					struct sk_buff *qskb;
-+
-+					qskb = skb_clone(skb, GFP_ATOMIC);
-+					if (qskb) {
-+						skb_queue_tail(&sdata->status_queue,
-+							       qskb);
-+						ieee80211_queue_work(&local->hw,
-+								     &sdata->work);
-+					}
-+				}
-+			} else {
- 				ieee80211_mgd_conn_tx_status(sdata,
- 							     hdr->frame_control,
- 							     acked);
-+			}
- 		}
- 
- 		rcu_read_unlock();
---- a/net/mac80211/trace.h
-+++ b/net/mac80211/trace.h
-@@ -2804,6 +2804,73 @@ DEFINE_EVENT(sta_flag_evt, drv_sta_set_d
- 	TP_ARGS(local, sdata, sta, enabled)
- );
- 
-+TRACE_EVENT(drv_add_twt_setup,
-+	TP_PROTO(struct ieee80211_local *local,
-+		 struct ieee80211_sta *sta,
-+		 struct ieee80211_twt_setup *twt,
-+		 struct ieee80211_twt_params *twt_agrt),
-+
-+	TP_ARGS(local, sta, twt, twt_agrt),
-+
-+	TP_STRUCT__entry(
-+		LOCAL_ENTRY
-+		STA_ENTRY
-+		__field(u8, dialog_token)
-+		__field(u8, control)
-+		__field(__le16, req_type)
-+		__field(__le64, twt)
-+		__field(u8, duration)
-+		__field(__le16, mantissa)
-+		__field(u8, channel)
-+	),
-+
-+	TP_fast_assign(
-+		LOCAL_ASSIGN;
-+		STA_ASSIGN;
-+		__entry->dialog_token = twt->dialog_token;
-+		__entry->control = twt->control;
-+		__entry->req_type = twt_agrt->req_type;
-+		__entry->twt = twt_agrt->twt;
-+		__entry->duration = twt_agrt->min_twt_dur;
-+		__entry->mantissa = twt_agrt->mantissa;
-+		__entry->channel = twt_agrt->channel;
-+	),
-+
-+	TP_printk(
-+		LOCAL_PR_FMT STA_PR_FMT
-+		" token:%d control:0x%02x req_type:0x%04x"
-+		" twt:%llu duration:%d mantissa:%d channel:%d",
-+		LOCAL_PR_ARG, STA_PR_ARG, __entry->dialog_token,
-+		__entry->control, le16_to_cpu(__entry->req_type),
-+		le64_to_cpu(__entry->twt), __entry->duration,
-+		le16_to_cpu(__entry->mantissa), __entry->channel
-+	)
-+);
-+
-+TRACE_EVENT(drv_twt_teardown_request,
-+	TP_PROTO(struct ieee80211_local *local,
-+		 struct ieee80211_sta *sta, u8 flowid),
-+
-+	TP_ARGS(local, sta, flowid),
-+
-+	TP_STRUCT__entry(
-+		LOCAL_ENTRY
-+		STA_ENTRY
-+		__field(u8, flowid)
-+	),
-+
-+	TP_fast_assign(
-+		LOCAL_ASSIGN;
-+		STA_ASSIGN;
-+		__entry->flowid = flowid;
-+	),
-+
-+	TP_printk(
-+		LOCAL_PR_FMT STA_PR_FMT " flowid:%d",
-+		LOCAL_PR_ARG, STA_PR_ARG, __entry->flowid
-+	)
-+);
-+
- #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
- 
- #undef TRACE_INCLUDE_PATH
diff --git a/package/kernel/mac80211/patches/subsys/391-wireless-align-some-HE-capabilities-with-the-spec.patch b/package/kernel/mac80211/patches/subsys/391-wireless-align-some-HE-capabilities-with-the-spec.patch
deleted file mode 100644
index eb32c4989..000000000
--- a/package/kernel/mac80211/patches/subsys/391-wireless-align-some-HE-capabilities-with-the-spec.patch
+++ /dev/null
@@ -1,196 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Fri, 9 Apr 2021 12:40:17 +0300
-Subject: [PATCH] wireless: align some HE capabilities with the spec
-
-Some names were changed, align that with the spec as of
-802.11ax-D6.1.
-
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Link: https://lore.kernel.org/r/iwlwifi.20210409123755.b1e5fbab0d8c.I3eb6076cb0714ec6aec6b8f9dee613ce4a05d825@changeid
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -3627,7 +3627,7 @@ ath11k_mac_filter_he_cap_mesh(struct iee
- 	    IEEE80211_HE_MAC_CAP4_BQR;
- 	he_cap_elem->mac_cap_info[4] &= ~m;
- 
--	m = IEEE80211_HE_MAC_CAP5_SUBCHAN_SELECVITE_TRANSMISSION |
-+	m = IEEE80211_HE_MAC_CAP5_SUBCHAN_SELECTIVE_TRANSMISSION |
- 	    IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU |
- 	    IEEE80211_HE_MAC_CAP5_PUNCTURED_SOUNDING |
- 	    IEEE80211_HE_MAC_CAP5_HT_VHT_TRIG_FRAME_RX;
-@@ -3637,7 +3637,7 @@ ath11k_mac_filter_he_cap_mesh(struct iee
- 	    IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO;
- 	he_cap_elem->phy_cap_info[2] &= ~m;
- 
--	m = IEEE80211_HE_PHY_CAP3_RX_HE_MU_PPDU_FROM_NON_AP_STA |
-+	m = IEEE80211_HE_PHY_CAP3_RX_PARTIAL_BW_SU_IN_20MHZ_MU |
- 	    IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_MASK |
- 	    IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_MASK;
- 	he_cap_elem->phy_cap_info[3] &= ~m;
-@@ -3649,13 +3649,13 @@ ath11k_mac_filter_he_cap_mesh(struct iee
- 	he_cap_elem->phy_cap_info[5] &= ~m;
- 
- 	m = IEEE80211_HE_PHY_CAP6_CODEBOOK_SIZE_75_MU |
--	    IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMER_FB |
-+	    IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB |
- 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB |
- 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO;
- 	he_cap_elem->phy_cap_info[6] &= ~m;
- 
--	m = IEEE80211_HE_PHY_CAP7_SRP_BASED_SR |
--	    IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_AR |
-+	m = IEEE80211_HE_PHY_CAP7_PSR_BASED_SR |
-+	    IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
- 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ |
- 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ;
- 	he_cap_elem->phy_cap_info[7] &= ~m;
---- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
-@@ -307,8 +307,8 @@ mt7915_set_stream_he_txbf_caps(struct ie
- 	    IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK;
- 	elem->phy_cap_info[5] &= ~c;
- 
--	c = IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMER_FB |
--	    IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMER_FB;
-+	c = IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
-+	    IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB;
- 	elem->phy_cap_info[6] &= ~c;
- 
- 	elem->phy_cap_info[7] &= ~IEEE80211_HE_PHY_CAP7_MAX_NC_MASK;
-@@ -348,8 +348,8 @@ mt7915_set_stream_he_txbf_caps(struct ie
- 	c = (nss - 1) | (max_t(int, mcs->tx_mcs_160, 1) << 3);
- 	elem->phy_cap_info[5] |= c;
- 
--	c = IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMER_FB |
--	    IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMER_FB;
-+	c = IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
-+	    IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB;
- 	elem->phy_cap_info[6] |= c;
- }
- 
-@@ -484,7 +484,7 @@ mt7915_init_he_caps(struct mt7915_phy *p
- 				IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE |
- 				IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT;
- 			he_cap_elem->phy_cap_info[7] |=
--				IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_AR |
-+				IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
- 				IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI;
- 			he_cap_elem->phy_cap_info[8] |=
- 				IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G |
---- a/include/linux/ieee80211.h
-+++ b/include/linux/ieee80211.h
-@@ -2065,7 +2065,7 @@ int ieee80211_get_vht_max_nss(struct iee
- #define IEEE80211_HE_MAC_CAP4_BSRP_BQRP_A_MPDU_AGG		0x01
- #define IEEE80211_HE_MAC_CAP4_QTP				0x02
- #define IEEE80211_HE_MAC_CAP4_BQR				0x04
--#define IEEE80211_HE_MAC_CAP4_SRP_RESP				0x08
-+#define IEEE80211_HE_MAC_CAP4_PSR_RESP				0x08
- #define IEEE80211_HE_MAC_CAP4_NDP_FB_REP			0x10
- #define IEEE80211_HE_MAC_CAP4_OPS				0x20
- #define IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU			0x40
-@@ -2076,7 +2076,7 @@ int ieee80211_get_vht_max_nss(struct iee
- 
- #define IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B40		0x01
- #define IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B41		0x02
--#define IEEE80211_HE_MAC_CAP5_SUBCHAN_SELECVITE_TRANSMISSION	0x04
-+#define IEEE80211_HE_MAC_CAP5_SUBCHAN_SELECTIVE_TRANSMISSION	0x04
- #define IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU			0x08
- #define IEEE80211_HE_MAC_CAP5_OM_CTRL_UL_MU_DATA_DIS_RX		0x10
- #define IEEE80211_HE_MAC_CAP5_HE_DYNAMIC_SM_PS			0x20
-@@ -2134,7 +2134,7 @@ int ieee80211_get_vht_max_nss(struct iee
- #define IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_MASK			0x18
- #define IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1				0x00
- #define IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_2				0x20
--#define IEEE80211_HE_PHY_CAP3_RX_HE_MU_PPDU_FROM_NON_AP_STA		0x40
-+#define IEEE80211_HE_PHY_CAP3_RX_PARTIAL_BW_SU_IN_20MHZ_MU		0x40
- #define IEEE80211_HE_PHY_CAP3_SU_BEAMFORMER				0x80
- 
- #define IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE				0x01
-@@ -2181,15 +2181,15 @@ int ieee80211_get_vht_max_nss(struct iee
- 
- #define IEEE80211_HE_PHY_CAP6_CODEBOOK_SIZE_42_SU			0x01
- #define IEEE80211_HE_PHY_CAP6_CODEBOOK_SIZE_75_MU			0x02
--#define IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMER_FB			0x04
--#define IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMER_FB			0x08
-+#define IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB			0x04
-+#define IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB		0x08
- #define IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB				0x10
- #define IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE			0x20
- #define IEEE80211_HE_PHY_CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO		0x40
- #define IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT			0x80
- 
--#define IEEE80211_HE_PHY_CAP7_SRP_BASED_SR				0x01
--#define IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_AR			0x02
-+#define IEEE80211_HE_PHY_CAP7_PSR_BASED_SR				0x01
-+#define IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP			0x02
- #define IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI		0x04
- #define IEEE80211_HE_PHY_CAP7_MAX_NC_1					0x08
- #define IEEE80211_HE_PHY_CAP7_MAX_NC_2					0x10
---- a/net/mac80211/debugfs_sta.c
-+++ b/net/mac80211/debugfs_sta.c
-@@ -732,15 +732,15 @@ static ssize_t sta_he_capa_read(struct f
- 	PFLAG(MAC, 4, BSRP_BQRP_A_MPDU_AGG, "BSRP-BQRP-A-MPDU-AGG");
- 	PFLAG(MAC, 4, QTP, "QTP");
- 	PFLAG(MAC, 4, BQR, "BQR");
--	PFLAG(MAC, 4, SRP_RESP, "SRP-RESP");
-+	PFLAG(MAC, 4, PSR_RESP, "PSR-RESP");
- 	PFLAG(MAC, 4, NDP_FB_REP, "NDP-FB-REP");
- 	PFLAG(MAC, 4, OPS, "OPS");
- 	PFLAG(MAC, 4, AMDSU_IN_AMPDU, "AMSDU-IN-AMPDU");
- 
- 	PRINT("MULTI-TID-AGG-TX-QOS-%d", ((cap[5] << 1) | (cap[4] >> 7)) & 0x7);
- 
--	PFLAG(MAC, 5, SUBCHAN_SELECVITE_TRANSMISSION,
--	      "SUBCHAN-SELECVITE-TRANSMISSION");
-+	PFLAG(MAC, 5, SUBCHAN_SELECTIVE_TRANSMISSION,
-+	      "SUBCHAN-SELECTIVE-TRANSMISSION");
- 	PFLAG(MAC, 5, UL_2x996_TONE_RU, "UL-2x996-TONE-RU");
- 	PFLAG(MAC, 5, OM_CTRL_UL_MU_DATA_DIS_RX, "OM-CTRL-UL-MU-DATA-DIS-RX");
- 	PFLAG(MAC, 5, HE_DYNAMIC_SM_PS, "HE-DYNAMIC-SM-PS");
-@@ -832,8 +832,8 @@ static ssize_t sta_he_capa_read(struct f
- 
- 	PFLAG(PHY, 3, DCM_MAX_RX_NSS_1, "DCM-MAX-RX-NSS-1");
- 	PFLAG(PHY, 3, DCM_MAX_RX_NSS_2, "DCM-MAX-RX-NSS-2");
--	PFLAG(PHY, 3, RX_HE_MU_PPDU_FROM_NON_AP_STA,
--	      "RX-HE-MU-PPDU-FROM-NON-AP-STA");
-+	PFLAG(PHY, 3, RX_PARTIAL_BW_SU_IN_20MHZ_MU,
-+	      "RX-PARTIAL-BW-SU-IN-20MHZ-MU");
- 	PFLAG(PHY, 3, SU_BEAMFORMER, "SU-BEAMFORMER");
- 
- 	PFLAG(PHY, 4, SU_BEAMFORMEE, "SU-BEAMFORMEE");
-@@ -853,16 +853,17 @@ static ssize_t sta_he_capa_read(struct f
- 
- 	PFLAG(PHY, 6, CODEBOOK_SIZE_42_SU, "CODEBOOK-SIZE-42-SU");
- 	PFLAG(PHY, 6, CODEBOOK_SIZE_75_MU, "CODEBOOK-SIZE-75-MU");
--	PFLAG(PHY, 6, TRIG_SU_BEAMFORMER_FB, "TRIG-SU-BEAMFORMER-FB");
--	PFLAG(PHY, 6, TRIG_MU_BEAMFORMER_FB, "TRIG-MU-BEAMFORMER-FB");
-+	PFLAG(PHY, 6, TRIG_SU_BEAMFORMING_FB, "TRIG-SU-BEAMFORMING-FB");
-+	PFLAG(PHY, 6, TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
-+	      "MU-BEAMFORMING-PARTIAL-BW-FB");
- 	PFLAG(PHY, 6, TRIG_CQI_FB, "TRIG-CQI-FB");
- 	PFLAG(PHY, 6, PARTIAL_BW_EXT_RANGE, "PARTIAL-BW-EXT-RANGE");
- 	PFLAG(PHY, 6, PARTIAL_BANDWIDTH_DL_MUMIMO,
- 	      "PARTIAL-BANDWIDTH-DL-MUMIMO");
- 	PFLAG(PHY, 6, PPE_THRESHOLD_PRESENT, "PPE-THRESHOLD-PRESENT");
- 
--	PFLAG(PHY, 7, SRP_BASED_SR, "SRP-BASED-SR");
--	PFLAG(PHY, 7, POWER_BOOST_FACTOR_AR, "POWER-BOOST-FACTOR-AR");
-+	PFLAG(PHY, 7, PSR_BASED_SR, "PSR-BASED-SR");
-+	PFLAG(PHY, 7, POWER_BOOST_FACTOR_SUPP, "POWER-BOOST-FACTOR-SUPP");
- 	PFLAG(PHY, 7, HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
- 	      "HE-SU-MU-PPDU-4XLTF-AND-08-US-GI");
- 	PFLAG_RANGE(PHY, 7, MAX_NC, 0, 1, 1, "MAX-NC-%d");
---- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
-+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
-@@ -631,7 +631,7 @@ static struct ieee80211_sband_iftype_dat
- 				.phy_cap_info[6] =
- 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
- 				.phy_cap_info[7] =
--					IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_AR |
-+					IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
- 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI |
- 					IEEE80211_HE_PHY_CAP7_MAX_NC_1,
- 				.phy_cap_info[8] =
diff --git a/package/kernel/mac80211/patches/subsys/392-wireless-fix-spelling-of-A-MSDU-in-HE-capabilities.patch b/package/kernel/mac80211/patches/subsys/392-wireless-fix-spelling-of-A-MSDU-in-HE-capabilities.patch
deleted file mode 100644
index 0bd01126f..000000000
--- a/package/kernel/mac80211/patches/subsys/392-wireless-fix-spelling-of-A-MSDU-in-HE-capabilities.patch
+++ /dev/null
@@ -1,113 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Fri, 9 Apr 2021 12:40:24 +0300
-Subject: [PATCH] wireless: fix spelling of A-MSDU in HE capabilities
-
-In the HE capabilities, spell A-MSDU correctly, not "A-MDSU".
-
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Link: https://lore.kernel.org/r/iwlwifi.20210409123755.9e6ff1af1181.If6868bc6902ccd9a95c74c78f716c4b41473ef14@changeid
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
-+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
-@@ -598,7 +598,7 @@ static struct ieee80211_sband_iftype_dat
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
- 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
- 				.mac_cap_info[4] =
--					IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU |
-+					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU |
- 					IEEE80211_HE_MAC_CAP4_MULTI_TID_AGG_TX_QOS_B39,
- 				.mac_cap_info[5] =
- 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B40 |
-@@ -682,7 +682,7 @@ static struct ieee80211_sband_iftype_dat
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
- 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
- 				.mac_cap_info[4] =
--					IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
-+					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.mac_cap_info[5] =
- 					IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU,
- 				.phy_cap_info[0] =
---- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
-@@ -427,7 +427,7 @@ mt7915_init_he_caps(struct mt7915_phy *p
- 			IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
- 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_RESERVED;
- 		he_cap_elem->mac_cap_info[4] =
--			IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU;
-+			IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU;
- 
- 		if (band == NL80211_BAND_2GHZ)
- 			he_cap_elem->phy_cap_info[0] =
---- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
-@@ -1353,7 +1353,7 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *sk
- 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
- 		cap |= STA_REC_HE_CAP_OM;
- 
--	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU)
-+	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
- 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
- 
- 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
---- a/include/linux/ieee80211.h
-+++ b/include/linux/ieee80211.h
-@@ -2068,7 +2068,7 @@ int ieee80211_get_vht_max_nss(struct iee
- #define IEEE80211_HE_MAC_CAP4_PSR_RESP				0x08
- #define IEEE80211_HE_MAC_CAP4_NDP_FB_REP			0x10
- #define IEEE80211_HE_MAC_CAP4_OPS				0x20
--#define IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU			0x40
-+#define IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU			0x40
- /* Multi TID agg TX is split between byte #4 and #5
-  * The value is a combination of B39,B40,B41
-  */
---- a/net/mac80211/debugfs_sta.c
-+++ b/net/mac80211/debugfs_sta.c
-@@ -735,7 +735,7 @@ static ssize_t sta_he_capa_read(struct f
- 	PFLAG(MAC, 4, PSR_RESP, "PSR-RESP");
- 	PFLAG(MAC, 4, NDP_FB_REP, "NDP-FB-REP");
- 	PFLAG(MAC, 4, OPS, "OPS");
--	PFLAG(MAC, 4, AMDSU_IN_AMPDU, "AMSDU-IN-AMPDU");
-+	PFLAG(MAC, 4, AMSDU_IN_AMPDU, "AMSDU-IN-AMPDU");
- 
- 	PRINT("MULTI-TID-AGG-TX-QOS-%d", ((cap[5] << 1) | (cap[4] >> 7)) & 0x7);
- 
---- a/drivers/net/wireless/mac80211_hwsim.c
-+++ b/drivers/net/wireless/mac80211_hwsim.c
-@@ -2748,7 +2748,7 @@ static const struct ieee80211_sband_ifty
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
- 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
--				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
-+				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.phy_cap_info[1] =
- 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
- 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
-@@ -2792,7 +2792,7 @@ static const struct ieee80211_sband_ifty
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
- 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
--				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
-+				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.phy_cap_info[1] =
- 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
- 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
-@@ -2838,7 +2838,7 @@ static const struct ieee80211_sband_ifty
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
- 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
--				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
-+				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.phy_cap_info[0] =
- 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
- 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
-@@ -2886,7 +2886,7 @@ static const struct ieee80211_sband_ifty
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
- 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
--				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
-+				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.phy_cap_info[0] =
- 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
- 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
diff --git a/package/kernel/mac80211/patches/subsys/393-wireless-align-HE-capabilities-A-MPDU-Length-Exponen.patch b/package/kernel/mac80211/patches/subsys/393-wireless-align-HE-capabilities-A-MPDU-Length-Exponen.patch
deleted file mode 100644
index 42b71df9d..000000000
--- a/package/kernel/mac80211/patches/subsys/393-wireless-align-HE-capabilities-A-MPDU-Length-Exponen.patch
+++ /dev/null
@@ -1,148 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Fri, 9 Apr 2021 12:40:20 +0300
-Subject: [PATCH] wireless: align HE capabilities A-MPDU Length Exponent
- Extension
-
-The A-MPDU length exponent extension is defined differently in
-802.11ax D6.1, align with that.
-
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Link: https://lore.kernel.org/r/iwlwifi.20210409123755.c2a257d3e2df.I3455245d388c52c61dace7e7958dbed7e807cfb6@changeid
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -1290,9 +1290,8 @@ static void ath11k_peer_assoc_h_he(struc
- 	 * request, then use MAX_AMPDU_LEN_FACTOR as 16 to calculate max_ampdu
- 	 * length.
- 	 */
--	ampdu_factor = (he_cap->he_cap_elem.mac_cap_info[3] &
--			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK) >>
--			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_SHIFT;
-+	ampdu_factor = u8_get_bits(he_cap->he_cap_elem.mac_cap_info[3],
-+				   IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK);
- 
- 	if (ampdu_factor) {
- 		if (sta->vht_cap.vht_supported)
---- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
-+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
-@@ -596,7 +596,7 @@ static struct ieee80211_sband_iftype_dat
- 					IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP,
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
--					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
-+					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2,
- 				.mac_cap_info[4] =
- 					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU |
- 					IEEE80211_HE_MAC_CAP4_MULTI_TID_AGG_TX_QOS_B39,
-@@ -680,7 +680,7 @@ static struct ieee80211_sband_iftype_dat
- 					IEEE80211_HE_MAC_CAP2_BSR,
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
--					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
-+					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2,
- 				.mac_cap_info[4] =
- 					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.mac_cap_info[5] =
---- a/drivers/net/wireless/mac80211_hwsim.c
-+++ b/drivers/net/wireless/mac80211_hwsim.c
-@@ -2747,7 +2747,7 @@ static const struct ieee80211_sband_ifty
- 					IEEE80211_HE_MAC_CAP2_ACK_EN,
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
--					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
-+					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
- 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.phy_cap_info[1] =
- 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
-@@ -2791,7 +2791,7 @@ static const struct ieee80211_sband_ifty
- 					IEEE80211_HE_MAC_CAP2_ACK_EN,
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
--					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
-+					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
- 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.phy_cap_info[1] =
- 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
-@@ -2837,7 +2837,7 @@ static const struct ieee80211_sband_ifty
- 					IEEE80211_HE_MAC_CAP2_ACK_EN,
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
--					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
-+					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
- 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.phy_cap_info[0] =
- 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
-@@ -2885,7 +2885,7 @@ static const struct ieee80211_sband_ifty
- 					IEEE80211_HE_MAC_CAP2_ACK_EN,
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
--					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
-+					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
- 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.phy_cap_info[0] =
- 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
---- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
-@@ -425,7 +425,7 @@ mt7915_init_he_caps(struct mt7915_phy *p
- 			IEEE80211_HE_MAC_CAP0_HTC_HE;
- 		he_cap_elem->mac_cap_info[3] =
- 			IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
--			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_RESERVED;
-+			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3;
- 		he_cap_elem->mac_cap_info[4] =
- 			IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU;
- 
---- a/include/linux/ieee80211.h
-+++ b/include/linux/ieee80211.h
-@@ -2051,17 +2051,15 @@ int ieee80211_get_vht_max_nss(struct iee
-  * A-MDPU Length Exponent field in the HT capabilities, VHT capabilities and the
-  * same field in the HE capabilities.
-  */
--#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_USE_VHT	0x00
--#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_1		0x08
--#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2		0x10
--#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_RESERVED	0x18
-+#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_0		0x00
-+#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_1		0x08
-+#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2		0x10
-+#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3		0x18
- #define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK		0x18
- #define IEEE80211_HE_MAC_CAP3_AMSDU_FRAG			0x20
- #define IEEE80211_HE_MAC_CAP3_FLEX_TWT_SCHED			0x40
- #define IEEE80211_HE_MAC_CAP3_RX_CTRL_FRAME_TO_MULTIBSS		0x80
- 
--#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_SHIFT		3
--
- #define IEEE80211_HE_MAC_CAP4_BSRP_BQRP_A_MPDU_AGG		0x01
- #define IEEE80211_HE_MAC_CAP4_QTP				0x02
- #define IEEE80211_HE_MAC_CAP4_BQR				0x04
---- a/net/mac80211/debugfs_sta.c
-+++ b/net/mac80211/debugfs_sta.c
-@@ -711,17 +711,17 @@ static ssize_t sta_he_capa_read(struct f
- 	PFLAG(MAC, 3, OFDMA_RA, "OFDMA-RA");
- 
- 	switch (cap[3] & IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK) {
--	case IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_USE_VHT:
--		PRINT("MAX-AMPDU-LEN-EXP-USE-VHT");
-+	case IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_0:
-+		PRINT("MAX-AMPDU-LEN-EXP-USE-EXT-0");
- 		break;
--	case IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_1:
--		PRINT("MAX-AMPDU-LEN-EXP-VHT-1");
-+	case IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_1:
-+		PRINT("MAX-AMPDU-LEN-EXP-VHT-EXT-1");
- 		break;
--	case IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2:
--		PRINT("MAX-AMPDU-LEN-EXP-VHT-2");
-+	case IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2:
-+		PRINT("MAX-AMPDU-LEN-EXP-VHT-EXT-2");
- 		break;
--	case IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_RESERVED:
--		PRINT("MAX-AMPDU-LEN-EXP-RESERVED");
-+	case IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3:
-+		PRINT("MAX-AMPDU-LEN-EXP-VHT-EXT-3");
- 		break;
- 	}
- 
diff --git a/package/kernel/mac80211/patches/subsys/394-mac80211-fix-rate-control-for-retransmitted-frames.patch b/package/kernel/mac80211/patches/subsys/394-mac80211-fix-rate-control-for-retransmitted-frames.patch
deleted file mode 100644
index cd91a925f..000000000
--- a/package/kernel/mac80211/patches/subsys/394-mac80211-fix-rate-control-for-retransmitted-frames.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Mon, 22 Nov 2021 21:39:38 +0100
-Subject: [PATCH] mac80211: fix rate control for retransmitted frames
-
-Since retransmission clears info->control, rate control needs to be called
-again, otherwise the driver might crash due to invalid rates.
-
-Cc: stable@vger.kernel.org # 5.14+
-Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
-Reported-by: Robert W <rwbugreport@lost-in-the-void.net>
-Fixes: 03c3911d2d67 ("mac80211: call ieee80211_tx_h_rate_ctrl() when dequeue")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1835,15 +1835,15 @@ static int invoke_tx_handlers_late(struc
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
- 	ieee80211_tx_result res = TX_CONTINUE;
- 
-+	if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
-+		CALL_TXH(ieee80211_tx_h_rate_ctrl);
-+
- 	if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) {
- 		__skb_queue_tail(&tx->skbs, tx->skb);
- 		tx->skb = NULL;
- 		goto txh_done;
- 	}
- 
--	if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
--		CALL_TXH(ieee80211_tx_h_rate_ctrl);
--
- 	CALL_TXH(ieee80211_tx_h_michael_mic_add);
- 	CALL_TXH(ieee80211_tx_h_sequence);
- 	CALL_TXH(ieee80211_tx_h_fragment);
diff --git a/package/kernel/mac80211/patches/subsys/395-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch b/package/kernel/mac80211/patches/subsys/395-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch
deleted file mode 100644
index 1c940d3db..000000000
--- a/package/kernel/mac80211/patches/subsys/395-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 14 Dec 2021 17:53:12 +0100
-Subject: [PATCH] mac80211: use coarse boottime for airtime fairness code
-
-The time values used by the airtime fairness code only need to be accurate
-enough to cover station activity detection.
-Using ktime_get_coarse_boottime_ns instead of ktime_get_boottime_ns will
-drop the accuracy down to jiffies intervals, but at the same time saves
-a lot of CPU cycles in a hot path
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3834,7 +3834,7 @@ struct ieee80211_txq *ieee80211_next_txq
- {
- 	struct ieee80211_local *local = hw_to_local(hw);
- 	struct airtime_sched_info *air_sched;
--	u64 now = ktime_get_boottime_ns();
-+	u64 now = ktime_get_coarse_boottime_ns();
- 	struct ieee80211_txq *ret = NULL;
- 	struct airtime_info *air_info;
- 	struct txq_info *txqi = NULL;
-@@ -3961,7 +3961,7 @@ void ieee80211_update_airtime_weight(str
- 	u64 weight_sum = 0;
- 
- 	if (unlikely(!now))
--		now = ktime_get_boottime_ns();
-+		now = ktime_get_coarse_boottime_ns();
- 
- 	lockdep_assert_held(&air_sched->lock);
- 
-@@ -3987,7 +3987,7 @@ void ieee80211_schedule_txq(struct ieee8
- 	struct ieee80211_local *local = hw_to_local(hw);
- 	struct txq_info *txqi = to_txq_info(txq);
- 	struct airtime_sched_info *air_sched;
--	u64 now = ktime_get_boottime_ns();
-+	u64 now = ktime_get_coarse_boottime_ns();
- 	struct airtime_info *air_info;
- 	u8 ac = txq->ac;
- 	bool was_active;
-@@ -4045,7 +4045,7 @@ static void __ieee80211_unschedule_txq(s
- 
- 	if (!purge)
- 		airtime_set_active(air_sched, air_info,
--				   ktime_get_boottime_ns());
-+				   ktime_get_coarse_boottime_ns());
- 
- 	rb_erase_cached(&txqi->schedule_order,
- 			&air_sched->active_txqs);
-@@ -4133,7 +4133,7 @@ bool ieee80211_txq_may_transmit(struct i
- 	if (RB_EMPTY_NODE(&txqi->schedule_order))
- 		goto out;
- 
--	now = ktime_get_boottime_ns();
-+	now = ktime_get_coarse_boottime_ns();
- 
- 	/* Like in ieee80211_next_txq(), make sure the first station in the
- 	 * scheduling order is eligible for transmission to avoid starvation.
diff --git a/package/kernel/mac80211/patches/subsys/400-allow-ibss-mixed.patch b/package/kernel/mac80211/patches/subsys/400-allow-ibss-mixed.patch
index 974595e11..c38fa13f0 100644
--- a/package/kernel/mac80211/patches/subsys/400-allow-ibss-mixed.patch
+++ b/package/kernel/mac80211/patches/subsys/400-allow-ibss-mixed.patch
@@ -1,11 +1,22 @@
-ath10k-ct starting with version 5.2 allows the combination of 
-NL80211_IFTYPE_ADHOC and beacon_int_min_gcd in ath10k_10x_ct_if_comb 
-which triggers this warning. Ben told me that this is not a big problem 
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Mon, 24 Feb 2020 00:00:00 +0100
+Subject: [PATCH] mac80211: Allow IBSS mode and different beacon intervals
+
+ath10k-ct supports the combination to select IBSS (ADHOC) mode and
+different beacon intervals together. mac80211 does not like this
+combination, but Ben says this is ok, so remove this check.
+
+ath10k-ct starting with version 5.2 allows the combination of
+NL80211_IFTYPE_ADHOC and beacon_int_min_gcd in ath10k_10x_ct_if_comb
+which triggers this warning. Ben told me that this is not a big problem
 and we should ignore this.
+---
+ net/wireless/core.c | 15 ---------------
+ 1 file changed, 15 deletions(-)
 
 --- a/net/wireless/core.c
 +++ b/net/wireless/core.c
-@@ -615,21 +615,6 @@ static int wiphy_verify_combinations(str
+@@ -614,21 +614,6 @@ static int wiphy_verify_combinations(str
  				    c->limits[j].max > 1))
  				return -EINVAL;
  
diff --git a/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch
index 6f13f6420..4a3984fb4 100644
--- a/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch
+++ b/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch
@@ -1,24 +1,24 @@
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -3814,6 +3814,7 @@ struct mgmt_frame_regs {
+@@ -4081,6 +4081,7 @@ struct mgmt_frame_regs {
   *	(as advertised by the nl80211 feature flag.)
   * @get_tx_power: store the current TX power into the dbm variable;
   *	return 0 if successful
 + * @set_antenna_gain: set antenna gain to reduce maximum tx power if necessary
   *
-  * @set_wds_peer: set the WDS peer for a WDS interface
-  *
-@@ -4138,6 +4139,7 @@ struct cfg80211_ops {
+  * @rfkill_poll: polls the hw rfkill line, use cfg80211 reporting
+  *	functions to adjust rfkill hw state
+@@ -4431,6 +4432,7 @@ struct cfg80211_ops {
  				enum nl80211_tx_power_setting type, int mbm);
  	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
  				int *dbm);
 +	int	(*set_antenna_gain)(struct wiphy *wiphy, int dbi);
  
- 	int	(*set_wds_peer)(struct wiphy *wiphy, struct net_device *dev,
- 				const u8 *addr);
+ 	void	(*rfkill_poll)(struct wiphy *wiphy);
+ 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1561,6 +1561,7 @@ enum ieee80211_smps_mode {
+@@ -1677,6 +1677,7 @@ enum ieee80211_smps_mode {
   *
   * @power_level: requested transmit power (in dBm), backward compatibility
   *	value only that is set to the minimum of all interfaces
@@ -26,7 +26,7 @@
   *
   * @chandef: the channel definition to tune to
   * @radar_enabled: whether radar detection is enabled
-@@ -1581,6 +1582,7 @@ enum ieee80211_smps_mode {
+@@ -1697,6 +1698,7 @@ enum ieee80211_smps_mode {
  struct ieee80211_conf {
  	u32 flags;
  	int power_level, dynamic_ps_timeout;
@@ -36,19 +36,19 @@
  	u8 ps_dtim_period;
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -2593,6 +2593,9 @@ enum nl80211_commands {
-  * @NL80211_ATTR_COLOR_CHANGE_ELEMS: Nested set of attributes containing the IE
-  *	information for the time while performing a color switch.
-  *
+@@ -2749,6 +2749,9 @@ enum nl80211_commands {
+  *	When used with %NL80211_CMD_FRAME_TX_STATUS, indicates the ack RX
+  *	timestamp. When used with %NL80211_CMD_FRAME RX notification, indicates
+  *	the incoming frame RX timestamp.
 + * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
 + *	transmit power to stay within regulatory limits. u32, dBi.
 + *
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
   * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3096,6 +3099,8 @@ enum nl80211_attrs {
- 	NL80211_ATTR_COLOR_CHANGE_COLOR,
- 	NL80211_ATTR_COLOR_CHANGE_ELEMS,
+@@ -3277,6 +3280,8 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_TX_HW_TIMESTAMP,
+ 	NL80211_ATTR_RX_HW_TIMESTAMP,
  
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
 +
@@ -57,7 +57,7 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2769,6 +2769,19 @@ static int ieee80211_get_tx_power(struct
+@@ -3046,6 +3046,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -74,20 +74,20 @@
 +	return 0;
 +}
 +
- static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
- 				  const u8 *addr)
+ static void ieee80211_rfkill_poll(struct wiphy *wiphy)
  {
-@@ -4413,6 +4426,7 @@ const struct cfg80211_ops mac80211_confi
+ 	struct ieee80211_local *local = wiphy_priv(wiphy);
+@@ -4956,6 +4969,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
 +	.set_antenna_gain = ieee80211_set_antenna_gain,
- 	.set_wds_peer = ieee80211_set_wds_peer,
  	.rfkill_poll = ieee80211_rfkill_poll,
  	CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
+ 	CFG80211_TESTMODE_DUMP(ieee80211_testmode_dump)
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1435,6 +1435,7 @@ struct ieee80211_local {
+@@ -1542,6 +1542,7 @@ struct ieee80211_local {
  	int dynamic_ps_forced_timeout;
  
  	int user_power_level; /* in dBm, for all interfaces */
@@ -119,7 +119,7 @@
  	if (local->hw.conf.power_level != power) {
  		changed |= IEEE80211_CONF_CHANGE_POWER;
  		local->hw.conf.power_level = power;
-@@ -665,6 +671,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -762,6 +768,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  					 IEEE80211_RADIOTAP_MCS_HAVE_BW;
  	local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
  					 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
@@ -129,32 +129,34 @@
  	local->hw.max_mtu = IEEE80211_MAX_DATA_LEN;
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -757,6 +757,7 @@ static const struct nla_policy nl80211_p
- 	[NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
- 	[NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
- 	[NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
+@@ -799,6 +799,7 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
+ 	[NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
+ 	[NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
 +	[NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
  };
  
  /* policy for the key attributes */
-@@ -3322,6 +3323,20 @@ static int nl80211_set_wiphy(struct sk_b
+@@ -3511,6 +3512,22 @@ static int nl80211_set_wiphy(struct sk_b
  		if (result)
- 			return result;
+ 			goto out;
  	}
 +
 +	if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_GAIN]) {
 +		int idx, dbi = 0;
 +
-+		if (!rdev->ops->set_antenna_gain)
-+			return -EOPNOTSUPP;
++		if (!rdev->ops->set_antenna_gain) {
++			result = -EOPNOTSUPP;
++			goto out;
++		}
 +
 +		idx = NL80211_ATTR_WIPHY_ANTENNA_GAIN;
 +		dbi = nla_get_u32(info->attrs[idx]);
 +
 +		result = rdev->ops->set_antenna_gain(&rdev->wiphy, dbi);
 +		if (result)
-+			return result;
++			goto out;
 +	}
  
- 	if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
- 	    info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
+ 	if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
+ 		struct wireless_dev *txp_wdev = wdev;
diff --git a/package/kernel/mac80211/patches/subsys/600-mac80211-allow-vht-on-2g.patch b/package/kernel/mac80211/patches/subsys/600-mac80211-allow-vht-on-2g.patch
deleted file mode 100644
index da9fcd218..000000000
--- a/package/kernel/mac80211/patches/subsys/600-mac80211-allow-vht-on-2g.patch
+++ /dev/null
@@ -1,36 +0,0 @@
---- a/net/mac80211/vht.c
-+++ b/net/mac80211/vht.c
-@@ -135,7 +135,8 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(stru
- 	have_80mhz = false;
- 	for (i = 0; i < sband->n_channels; i++) {
- 		if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
--						IEEE80211_CHAN_NO_80MHZ))
-+						IEEE80211_CHAN_NO_80MHZ) &&
-+						(sband->band != NL80211_BAND_2GHZ))
- 			continue;
- 
- 		have_80mhz = true;
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -1769,7 +1769,8 @@ static int ieee80211_build_preq_ies_band
- 	/* Check if any channel in this sband supports at least 80 MHz */
- 	for (i = 0; i < sband->n_channels; i++) {
- 		if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
--						IEEE80211_CHAN_NO_80MHZ))
-+						IEEE80211_CHAN_NO_80MHZ) &&
-+						(sband->band != NL80211_BAND_2GHZ))
- 			continue;
- 
- 		have_80mhz = true;
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -4824,7 +4824,8 @@ static int ieee80211_prep_channel(struct
- 	have_80mhz = false;
- 	for (i = 0; i < sband->n_channels; i++) {
- 		if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
--						IEEE80211_CHAN_NO_80MHZ))
-+						IEEE80211_CHAN_NO_80MHZ) &&
-+						(sband->band != NL80211_BAND_2GHZ))
- 			continue;
- 
- 		have_80mhz = true;
diff --git a/package/kernel/mac80211/patches/subsys/782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch b/package/kernel/mac80211/patches/subsys/782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch
new file mode 100644
index 000000000..26af6a2fb
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch
@@ -0,0 +1,29 @@
+--- a/backport-include/linux/of_net.h
++++ /dev/null
+@@ -1,26 +0,0 @@
+-#ifndef _BP_OF_NET_H
+-#define _BP_OF_NET_H
+-#include_next <linux/of_net.h>
+-#include <linux/version.h>
+-#include <linux/etherdevice.h>
+-
+-/* The behavior of of_get_mac_address() changed in kernel 5.2, it now
+- * returns an error code and not NULL in case of an error.
+- */
+-#if LINUX_VERSION_IS_LESS(5,13,0)
+-static inline int backport_of_get_mac_address(struct device_node *np, u8 *mac_out)
+-{
+-	const void *mac = of_get_mac_address(np);
+-
+-	if (!mac)
+-		return -ENODEV;
+-	if (IS_ERR(mac))
+-		return PTR_ERR(mac);
+-	ether_addr_copy(mac_out, mac);
+-	
+-	return 0;
+-}
+-#define of_get_mac_address LINUX_BACKPORT(of_get_mac_address)
+-#endif /* < 5.2 */
+-
+-#endif /* _BP_OF_NET_H */
diff --git a/package/kernel/mac80211/ralink.mk b/package/kernel/mac80211/ralink.mk
index 7bbdc1c22..83d208ee1 100644
--- a/package/kernel/mac80211/ralink.mk
+++ b/package/kernel/mac80211/ralink.mk
@@ -1,8 +1,6 @@
 PKG_DRIVERS += \
 	rt2x00-lib rt2x00-pci rt2x00-usb rt2x00-mmio \
-	rt2400-pci rt2500-pci rt2500-usb \
-	rt2800-lib rt2800-mmio rt2800-pci rt2800-soc rt2800-usb \
-	rt61-pci rt73-usb
+	rt2800-lib rt2800-mmio rt2800-pci rt2800-soc rt2800-usb
 
 PKG_CONFIG_DEPENDS += \
 	CONFIG_PACKAGE_RT2X00_LIB_DEBUGFS \
@@ -90,36 +88,12 @@ endef
 
 define KernelPackage/rt2800-lib
 $(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-lib-crc-ccitt +@DRIVER_11N_SUPPORT
+  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT||TARGET_ramips) +kmod-rt2x00-lib +kmod-lib-crc-ccitt
   HIDDEN:=1
   TITLE+= (rt2800 LIB)
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2800lib.ko
 endef
 
-define KernelPackage/rt2400-pci
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-eeprom-93cx6
-  TITLE+= (RT2400 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2400pci.ko
-  AUTOLOAD:=$(call AutoProbe,rt2400pci)
-endef
-
-define KernelPackage/rt2500-pci
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-eeprom-93cx6
-  TITLE+= (RT2500 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2500pci.ko
-  AUTOLOAD:=$(call AutoProbe,rt2500pci)
-endef
-
-define KernelPackage/rt2500-usb
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb
-  TITLE+= (RT2500 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt2500usb.ko
-  AUTOLOAD:=$(call AutoProbe,rt2500usb)
-endef
-
 define KernelPackage/rt2800-mmio
 $(call KernelPackage/rt2x00/Default)
   TITLE += (RT28xx/RT3xxx MMIO)
@@ -155,18 +129,3 @@ $(call KernelPackage/rt2x00/Default)
 endef
 
 
-define KernelPackage/rt61-pci
-$(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @PCI_SUPPORT +kmod-rt2x00-pci +kmod-eeprom-93cx6 +kmod-lib-crc-itu-t +rt61-pci-firmware
-  TITLE+= (RT2x61 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt61pci.ko
-  AUTOLOAD:=$(call AutoProbe,rt61pci)
-endef
-
-define KernelPackage/rt73-usb
-  $(call KernelPackage/rt2x00/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-rt2x00-usb +kmod-lib-crc-itu-t +rt73-usb-firmware
-  TITLE+= (RT73 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ralink/rt2x00/rt73usb.ko
-  AUTOLOAD:=$(call AutoProbe,rt73usb)
-endef
diff --git a/package/kernel/mac80211/realtek.mk b/package/kernel/mac80211/realtek.mk
index 75cb94d7b..9c1435832 100644
--- a/package/kernel/mac80211/realtek.mk
+++ b/package/kernel/mac80211/realtek.mk
@@ -1,12 +1,8 @@
 PKG_DRIVERS += \
-	rtl8180 rtl8187 \
 	rtlwifi rtlwifi-pci rtlwifi-btcoexist rtlwifi-usb rtl8192c-common \
 	rtl8192ce rtl8192se rtl8192de rtl8192cu rtl8723bs rtl8821ae \
 	rtl8xxxu rtw88
 
-config-$(call config_package,rtl8180) += RTL8180
-config-$(call config_package,rtl8187) += RTL8187
-
 config-$(call config_package,rtlwifi) += RTL_CARDS RTLWIFI
 config-$(call config_package,rtlwifi-pci) += RTLWIFI_PCI
 config-$(call config_package,rtlwifi-btcoexist) += RTLBTCOEXIST
@@ -27,29 +23,8 @@ config-y += STAGING
 
 config-$(call config_package,rtw88) += RTW88 RTW88_CORE RTW88_PCI
 config-y += RTW88_8822BE RTW88_8822CE RTW88_8723DE
-
-define KernelPackage/rtl818x/Default
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek Drivers for RTL818x devices
-  URL:=https://wireless.wiki.kernel.org/en/users/drivers/rtl8187
-  DEPENDS+= +kmod-eeprom-93cx6 +kmod-mac80211
-endef
-
-define KernelPackage/rtl8180
-  $(call KernelPackage/rtl818x/Default)
-  DEPENDS+= @PCI_SUPPORT
-  TITLE+= (RTL8180 PCI)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl818x/rtl8180/rtl818x_pci.ko
-  AUTOLOAD:=$(call AutoProbe,rtl818x_pci)
-endef
-
-define KernelPackage/rtl8187
-$(call KernelPackage/rtl818x/Default)
-  DEPENDS+= @USB_SUPPORT +kmod-usb-core
-  TITLE+= (RTL8187 USB)
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8187.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8187)
-endef
+config-$(CONFIG_PACKAGE_RTW88_DEBUG) += RTW88_DEBUG
+config-$(CONFIG_PACKAGE_RTW88_DEBUGFS) += RTW88_DEBUGFS
 
 define KernelPackage/rtlwifi/config
 	config PACKAGE_RTLWIFI_DEBUG
@@ -63,7 +38,7 @@ endef
 define KernelPackage/rtlwifi
   $(call KernelPackage/mac80211/Default)
   TITLE:=Realtek common driver part
-  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211 +@DRIVER_11N_SUPPORT
+  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtlwifi/rtlwifi.ko
   HIDDEN:=1
 endef
@@ -175,10 +150,26 @@ define KernelPackage/rtl8xxxu/description
   Please report your results!
 endef
 
+define KernelPackage/rtw88/config
+	config PACKAGE_RTW88_DEBUG
+		bool "Realtek wireless debugging (rtw88)"
+		depends on PACKAGE_kmod-rtw88
+		help
+		  Enable debugging output for rtw88 devices
+
+	config PACKAGE_RTW88_DEBUGFS
+		bool "Enable rtw88 debugfS support"
+		select KERNEL_DEBUG_FS
+		depends on PACKAGE_kmod-rtw88
+		help
+		  Select this to see extensive information about
+		  the internal state of rtw88 in debugfs.
+endef
+
 define KernelPackage/rtw88
   $(call KernelPackage/mac80211/Default)
   TITLE:=Realtek RTL8822BE/RTL8822CE/RTL8723DE
-  DEPENDS+= @(PCI_SUPPORT) +kmod-mac80211 +@DRIVER_11AC_SUPPORT +@DRIVER_11N_SUPPORT
+  DEPENDS+= @(PCI_SUPPORT) +kmod-mac80211 +@DRIVER_11AC_SUPPORT
   FILES:=\
 	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8822be.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8822b.ko \
diff --git a/package/kernel/rtl8821cu/Makefile b/package/kernel/rtl8821cu/Makefile
deleted file mode 100644
index a9d97f0d3..000000000
--- a/package/kernel/rtl8821cu/Makefile
+++ /dev/null
@@ -1,82 +0,0 @@
-# SPDX-License-Identifier: GPL-3.0-only
-#
-# Copyright (C) 2021-2022 ImmortalWrt.org
-
-include $(TOPDIR)/rules.mk
-
-PKG_NAME:=rtl8821cu
-PKG_RELEASE:=$(AUTORELEASE)
-
-PKG_SOURCE_URL:=https://github.com/brektrou/rtl8821CU.git
-PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2020-12-19
-PKG_SOURCE_VERSION:=428a0820487418ec69c0edb91726d1cf19763b1e
-PKG_MIRROR_HASH:=77958d3bff8b0145504a10959765be0e3743b9c4880a5173d156238c2c569a56
-
-PKG_LICENSE:=GPL-2.0
-PKG_LICENSE_FILES:=LICENSE
-PKG_MAINTAINTER:=Tianling Shen <cnsztl@immortalwrt.org>
-
-PKG_BUILD_PARALLEL:=1
-
-STAMP_CONFIGURED_DEPENDS := $(STAGING_DIR)/usr/include/mac80211-backport/backport/autoconf.h
-
-include $(INCLUDE_DIR)/kernel.mk
-include $(INCLUDE_DIR)/package.mk
-
-define KernelPackage/rtl8821cu
-  SUBMENU:=Wireless Drivers
-  TITLE:=Realtek RTL8811CU/RTL8821CU support
-  DEPENDS:=+kmod-cfg80211 +kmod-usb-core +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT
-  FILES:=$(PKG_BUILD_DIR)/rtl8821cu.ko
-  AUTOLOAD:=$(call AutoProbe,rtl8821cu)
-  PROVIDES:=kmod-rtl8821cu
-endef
-
-NOSTDINC_FLAGS = \
-	-I$(PKG_BUILD_DIR) \
-	-I$(PKG_BUILD_DIR)/include \
-	-I$(STAGING_DIR)/usr/include/mac80211-backport \
-	-I$(STAGING_DIR)/usr/include/mac80211-backport/uapi \
-	-I$(STAGING_DIR)/usr/include/mac80211 \
-	-I$(STAGING_DIR)/usr/include/mac80211/uapi \
-	-include backport/autoconf.h \
-	-include backport/backport.h
-
-EXTRA_KCONFIG:= \
-	CONFIG_RTL8821CU=m \
-	USER_MODULE_NAME=rtl8821cu
-
-ifeq ($(ARCH),aarch64)
-	EXTRA_KCONFIG += CONFIG_MP_VHT_HW_TX_MODE=n
-endif
-
-EXTRA_CFLAGS:= \
-	-DRTW_SINGLE_WIPHY \
-	-DRTW_USE_CFG80211_STA_EVENT \
-	-DCONFIG_IOCTL_CFG80211 \
-	-DCONFIG_CONCURRENT_MODE \
-	-DBUILD_OPENWRT
-
-ifeq ($(ARCH),arm)
-	EXTRA_CFLAGS += -mfloat-abi=softfp
-endif
-
-ifeq ($(BOARD),x86)
-	EXTRA_CFLAGS += -mhard-float
-endif
-
-MAKE_OPTS:= \
-	$(KERNEL_MAKE_FLAGS) \
-	M="$(PKG_BUILD_DIR)" \
-	NOSTDINC_FLAGS="$(NOSTDINC_FLAGS)" \
-	USER_EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
-	$(EXTRA_KCONFIG)
-
-define Build/Compile
-	+$(MAKE) $(PKG_JOBS) -C "$(LINUX_DIR)" \
-		$(MAKE_OPTS) \
-		modules
-endef
-
-$(eval $(call KernelPackage,rtl8821cu))
diff --git a/package/kernel/rtl8821cu/patches/001-use-kernel-byteorder.patch b/package/kernel/rtl8821cu/patches/001-use-kernel-byteorder.patch
deleted file mode 100644
index e75a27833..000000000
--- a/package/kernel/rtl8821cu/patches/001-use-kernel-byteorder.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-Fix compile problem when rtw_byteorder.h and asm/byteorder.h gets 
-included in addition for example indirectly, do not use realtek own copy 
-of the byteorder headers.
-
---- a/include/drv_types.h
-+++ b/include/drv_types.h
-@@ -25,7 +25,7 @@
- #include <drv_conf.h>
- #include <basic_types.h>
- #include <osdep_service.h>
--#include <rtw_byteorder.h>
-+#include <asm/byteorder.h>
- #include <wlan_bssdef.h>
- #include <wifi.h>
- #include <ieee80211.h>
diff --git a/package/kernel/rtl8821cu/patches/010-remove-extra-cflags.patch b/package/kernel/rtl8821cu/patches/010-remove-extra-cflags.patch
deleted file mode 100644
index bc753af41..000000000
--- a/package/kernel/rtl8821cu/patches/010-remove-extra-cflags.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/Makefile
-+++ b/Makefile
-@@ -2103,8 +2103,6 @@ ifeq ($(ARCH), i386)
- EXTRA_CFLAGS += -mhard-float
- else ifeq ($(ARCH), x86_64)
- EXTRA_CFLAGS += -mhard-float
--else ifeq ($(ARCH), arm)
--EXTRA_CFLAGS += -mfloat-abi=hard
- endif
- 
- ifeq ($(CONFIG_MULTIDRV), y)
diff --git a/package/kernel/rtl8821cu/patches/020-remove-repeat-flies.patch b/package/kernel/rtl8821cu/patches/020-remove-repeat-flies.patch
deleted file mode 100644
index 76baf2a24..000000000
--- a/package/kernel/rtl8821cu/patches/020-remove-repeat-flies.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 9b2b0ec1bc2d31ddf93ed74d63fdfa6044e329a4 Mon Sep 17 00:00:00 2001
-From: Ben Greear <greearb@candelatech.com>
-Date: Fri, 9 Nov 2018 16:21:43 -0800
-Subject: [PATCH] Fix build against openwrt backports tree.
-
-Like breaks builds elsewhere, can fix it up later.
-
-Signed-off-by: Ben Greear <greearb@candelatech.com>
----
- include/drv_conf.h                            |  4 +++-
- .../{wireless.h => old_unused_rtl_wireless.h} |  0
- include/{autoconf.h => rtl_autoconf.h}        |  0
- 3 files changed, 3 insertions(+), 1 deletions(-)
- rename include/linux/{wireless.h => old_unused_rtl_wireless.h} (100%)
- rename include/{autoconf.h => rtl_autoconf.h} (100%)
-
-diff --git a/include/drv_conf.h b/include/drv_conf.h
-index 0d20a7e..f0a9f88 100644
---- a/include/drv_conf.h
-+++ b/include/drv_conf.h
-@@ -14,7 +14,9 @@
-  *****************************************************************************/
- #ifndef __DRV_CONF_H__
- #define __DRV_CONF_H__
--#include "autoconf.h"
-+
-+#include <generated/autoconf.h>
-+#include "rtl_autoconf.h"
- #include "hal_ic_cfg.h"
- 
- #if defined(PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
-diff --git a/include/linux/wireless.h b/include/linux/old_unused_rtl_wireless.h
-similarity index 100%
-rename from include/linux/wireless.h
-rename to include/linux/old_unused_rtl_wireless.h
-diff --git a/include/autoconf.h b/include/rtl_autoconf.h
-similarity index 100%
-rename from include/autoconf.h
-rename to include/rtl_autoconf.h
diff --git a/package/kernel/rtl8821cu/patches/030-change-value-of-vht-enable.patch b/package/kernel/rtl8821cu/patches/030-change-value-of-vht-enable.patch
deleted file mode 100644
index 34dcd8e4d..000000000
--- a/package/kernel/rtl8821cu/patches/030-change-value-of-vht-enable.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/os_dep/linux/os_intfs.c
-+++ b/os_dep/linux/os_intfs.c
-@@ -238,7 +238,7 @@
- #endif /* CONFIG_80211N_HT */
- 
- #ifdef CONFIG_80211AC_VHT
--int rtw_vht_enable = 1; /* 0:disable, 1:enable, 2:force auto enable */
-+int rtw_vht_enable = 2; /* 0:disable, 1:enable, 2:force auto enable */
- module_param(rtw_vht_enable, int, 0644);
- 
- int rtw_ampdu_factor = 7;
diff --git a/package/kernel/rtl8821cu/patches/040-wireless-5.8.patch b/package/kernel/rtl8821cu/patches/040-wireless-5.8.patch
deleted file mode 100644
index 2453c61ff..000000000
--- a/package/kernel/rtl8821cu/patches/040-wireless-5.8.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-diff --git a/os_dep/linux/ioctl_cfg80211.c b/os_dep/linux/ioctl_cfg80211.c
-index d9c81c9..3e7e27a 100755
---- a/os_dep/linux/ioctl_cfg80211.c
-+++ b/os_dep/linux/ioctl_cfg80211.c
-@@ -7149,7 +7149,7 @@ static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy,
- #else
- 	struct net_device *ndev,
- #endif
--#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,8,0))
-+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,8,0)) || defined(BUILD_OPENWRT)
- 	struct mgmt_frame_regs *upd)
- #else
- 	u16 frame_type, bool reg)
-@@ -7178,7 +7178,7 @@ static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy,
- 	/* Wait QC Verify */
- 	return;
- 
--#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,8,0))
-+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,8,0)) || defined(BUILD_OPENWRT)
- 	SET_CFG80211_REPORT_MGMT(pwdev_priv, IEEE80211_STYPE_PROBE_REQ, upd->interface_stypes & BIT(IEEE80211_STYPE_PROBE_REQ >> 4));
- #else
- 	switch (frame_type) {
-@@ -9467,7 +9467,7 @@ static struct cfg80211_ops rtw_cfg80211_ops = {
- 
- #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)) || defined(COMPAT_KERNEL_RELEASE)
- 	.mgmt_tx = cfg80211_rtw_mgmt_tx,
--#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,8,0))
-+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,8,0)) || defined(BUILD_OPENWRT)
- 	.update_mgmt_frame_registrations = cfg80211_rtw_mgmt_frame_register,
- #else
- 	.mgmt_frame_register = cfg80211_rtw_mgmt_frame_register,
-diff --git a/os_dep/linux/os_intfs.c b/os_dep/linux/os_intfs.c
-index 257c581..f97fa24 100755
---- a/os_dep/linux/os_intfs.c
-+++ b/os_dep/linux/os_intfs.c
-@@ -1302,6 +1302,14 @@ unsigned int rtw_classify8021d(struct sk_buff *skb)
- }
- 
- 
-+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,19,0))
-+static u16 rtw_select_queue(struct net_device *dev, struct sk_buff *skb
-+    , struct net_device *sb_dev
-+    #if (LINUX_VERSION_CODE < KERNEL_VERSION(5,2,0))
-+    , select_queue_fallback_t fallback
-+    #endif
-+)
-+#else
- static u16 rtw_select_queue(struct net_device *dev, struct sk_buff *skb
- #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0)
- 	, void *accel_priv
-@@ -1310,6 +1318,7 @@ static u16 rtw_select_queue(struct net_device *dev, struct sk_buff *skb
- 	#endif
- #endif
- )
-+#endif
- {
- 	_adapter	*padapter = rtw_netdev_priv(dev);
- 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
diff --git a/package/network/services/hostapd/Config.in b/package/network/services/hostapd/Config.in
index 8f28eb2bd..87ad7e093 100644
--- a/package/network/services/hostapd/Config.in
+++ b/package/network/services/hostapd/Config.in
@@ -73,11 +73,6 @@ config WPA_WOLFSSL
 	select WOLFSSL_HAS_SESSION_TICKET
 	select WOLFSSL_HAS_WPAS
 
-config DRIVER_WEXT_SUPPORT
-	bool
-	select KERNEL_WIRELESS_EXT
-	default n
-
 config DRIVER_11AC_SUPPORT
 	bool
 	default n
diff --git a/package/network/services/hostapd/Makefile b/package/network/services/hostapd/Makefile
index fcf853ba7..dc2967048 100644
--- a/package/network/services/hostapd/Makefile
+++ b/package/network/services/hostapd/Makefile
@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hostapd
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=1.2
 
 PKG_SOURCE_URL:=http://w1.fi/hostap.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2022-07-29
-PKG_SOURCE_VERSION:=b704dc72ef824dfdd96674b90179b274d1d38105
-PKG_MIRROR_HASH:=6c9dd359ef5a4595b6576e07928566d6864957c4af6466d641d6c3f7717f4689
+PKG_SOURCE_DATE:=2023-03-29
+PKG_SOURCE_VERSION:=bb945b98fefc64887dffb40773a19d77585cee42
+PKG_MIRROR_HASH:=1da8a39c7c81ce257994874402a86d00080a6145b5eb5c5fc44b2fae1853fe8d
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=BSD-3-Clause
@@ -27,7 +27,6 @@ PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_hostapd-basic \
 	CONFIG_PACKAGE_hostapd-mini \
 	CONFIG_WPA_RFKILL_SUPPORT \
-	CONFIG_DRIVER_WEXT_SUPPORT \
 	CONFIG_DRIVER_11AC_SUPPORT \
 	CONFIG_DRIVER_11AX_SUPPORT \
 	CONFIG_WPA_ENABLE_WEP
@@ -87,7 +86,6 @@ DRIVER_MAKEOPTS= \
 	CONFIG_DRIVER_NL80211=$(CONFIG_PACKAGE_kmod-cfg80211) \
 	CONFIG_IEEE80211AC=$(HOSTAPD_IEEE80211AC) \
 	CONFIG_IEEE80211AX=$(HOSTAPD_IEEE80211AX) \
-	CONFIG_DRIVER_WEXT=$(CONFIG_DRIVER_WEXT_SUPPORT) \
 	CONFIG_MBO=$(CONFIG_WPA_MBO_SUPPORT)
 
 ifeq ($(SSL_VARIANT),openssl)
diff --git a/package/network/services/hostapd/README.md b/package/network/services/hostapd/README.md
new file mode 100644
index 000000000..215086330
--- /dev/null
+++ b/package/network/services/hostapd/README.md
@@ -0,0 +1,419 @@
+# UBUS methods - hostapd
+
+## bss_mgmt_enable
+Enable 802.11k/v features.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| neighbor_report | bool | no | enable 802.11k neighbor reports |
+| beacon_report | bool | no | enable 802.11k beacon reports |
+| link_measurements | bool | no | enable 802.11k link measurements |
+| bss_transition | bool | no | enable 802.11v BSS transition support |
+
+### example
+`ubus call hostapd.wl5-fb bss_mgmt_enable '{ "neighbor_report": true, "beacon_report": true, "link_measurements": true, "bss_transition": true
+}'`
+
+
+## bss_transition_request
+Initiate an 802.11v transition request.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| addr | string | yes | client MAC address |
+| disassociation_imminent | bool | no | set Disassociation Imminent bit |
+| disassociation_timer | int32 | no | disassociate client if it doesn't roam after this time |
+| validity_period | int32 | no | validity of the BSS Transition Candiate List |
+| neighbors | array | no | BSS Transition Candidate List |
+| abridged | bool | no | prefer APs in the BSS Transition Candidate List |
+| dialog_token | int32 | no | identifier for the request/report transaction |
+| mbo_reason | int32 | no | MBO Transition Reason Code Attribute |
+| cell_pref | int32 | no | MBO Cellular Data Connection Preference Attribute |
+| reassoc_delay | int32 | no | MBO Re-association retry delay |
+
+### example
+`ubus call hostapd.wl5-fb bss_transition_request '{ "addr": "68:2F:67:8B:98:ED", "disassociation_imminent": false, "disassociation_timer": 0, "validity_period": 30, "neighbors": ["b6a7b9cbeebabf5900008064090603026a00"], "abridged": 1 }'`
+
+
+## config_add
+Dynamically load a BSS configuration from a file. This is used by netifd's mac80211 support script to configure BSSes on multiple PHYs in a single hostapd instance.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| iface | string | yes | WiFi interface name |
+| config | string | yes | path to hostapd config file |
+
+
+## config_remove
+Dynamically remove a BSS configuration.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| iface | string | yes | WiFi interface name |
+
+
+## del_client
+Kick a client off the network.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| addr | string | yes | client MAC address |
+| reason | int32 | no | 802.11 reason code |
+| deauth | bool | no | deauthenticates client instead of disassociating |
+| ban_time | int32 | no | ban client for N milliseconds |
+
+### example
+`ubus call hostapd.wl5-fb del_client '{ "addr": "68:2f:67:8b:98:ed", "reason": 5, "deauth": true, "ban_time": 10000 }'`
+
+
+## get_clients
+Show associated clients.
+
+### example
+`ubus call hostapd.wl5-fb get_clients`
+
+### output
+```json
+{
+        "freq": 5260,
+        "clients": {
+                "68:2f:67:8b:98:ed": {
+                        "auth": true,
+                        "assoc": true,
+                        "authorized": true,
+                        "preauth": false,
+                        "wds": false,
+                        "wmm": true,
+                        "ht": true,
+                        "vht": true,
+                        "he": false,
+                        "wps": false,
+                        "mfp": true,
+                        "rrm": [
+                                0,
+                                0,
+                                0,
+                                0,
+                                0
+                        ],
+                        "extended_capabilities": [
+                                0,
+                                0,
+                                0,
+                                0,
+                                0,
+                                0,
+                                0,
+                                64
+                        ],
+                        "aid": 3,
+                        "signature": "wifi4|probe:0,1,45,127,107,191,221(0017f2,10),221(001018,2),htcap:006f,htagg:1b,htmcs:0000ffff,vhtcap:0f825832,vhtrxmcs:0000ffea,vhttxmcs:0000ffea,extcap:0000008000000040|assoc:0,1,33,36,48,45,127,191,221(0017f2,10),221(001018,2),221(0050f2,2),htcap:006f,htagg:1b,htmcs:0000ffff,vhtcap:0f825832,vhtrxmcs:0000ffea,vhttxmcs:0000ffea,txpow:14f9,extcap:0000000000000040",
+                        "bytes": {
+                                "rx": 1933667,
+                                "tx": 746805
+                        },
+                        "airtime": {
+                                "rx": 208863,
+                                "tx": 9037883
+                        },
+                        "packets": {
+                                "rx": 3587,
+                                "tx": 2185
+                        },
+                        "rate": {
+                                "rx": 866700,
+                                "tx": 866700
+                        },
+                        "signal": -50,
+                        "capabilities": {
+                                "vht": {
+                                        "su_beamformee": true,
+                                        "mu_beamformee": false,
+                                        "mcs_map": {
+                                                "rx": {
+                                                        "1ss": 9,
+                                                        "2ss": 9,
+                                                        "3ss": 9,
+                                                        "4ss": -1,
+                                                        "5ss": -1,
+                                                        "6ss": -1,
+                                                        "7ss": -1,
+                                                        "8ss": -1
+                                                },
+                                                "tx": {
+                                                        "1ss": 9,
+                                                        "2ss": 9,
+                                                        "3ss": 9,
+                                                        "4ss": -1,
+                                                        "5ss": -1,
+                                                        "6ss": -1,
+                                                        "7ss": -1,
+                                                        "8ss": -1
+                                                }
+                                        }
+                                }
+                        }
+                }
+        }
+}
+```
+
+
+## get_features
+Show HT/VHT support.
+
+### example
+`ubus call hostapd.wl5-fb get_features`
+
+### output
+```json
+{
+        "ht_supported": true,
+        "vht_supported": true
+}
+```
+
+
+## get_status
+Get BSS status.
+
+### example
+`ubus call hostapd.wl5-fb get_status`
+
+### output
+```json
+{
+        "status": "ENABLED",
+        "bssid": "b6:a7:b9:cb:ee:bc",
+        "ssid": "fb",
+        "freq": 5260,
+        "channel": 52,
+        "op_class": 128,
+        "beacon_interval": 100,
+        "phy": "wl5-lan",
+        "rrm": {
+                "neighbor_report_tx": 0
+        },
+        "wnm": {
+                "bss_transition_query_rx": 0,
+                "bss_transition_request_tx": 0,
+                "bss_transition_response_rx": 0
+        },
+        "airtime": {
+                "time": 259561738,
+                "time_busy": 2844249,
+                "utilization": 0
+        },
+        "dfs": {
+                "cac_seconds": 60,
+                "cac_active": false,
+                "cac_seconds_left": 0
+        }
+}
+```
+
+
+## link_measurement_req
+Initiate an 802.11k Link Measurement Request.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| addr | string | yes | client MAC address |
+| tx-power-used | int32 | no | transmit power used to transmit the Link Measurement Request frame |
+| tx-power-max | int32 | no | upper limit of transmit power to be used by the client |
+
+
+## list_bans
+List banned clients.
+
+### example
+`ubus call hostapd.wl5-fb list_bans`
+
+### output
+```json
+{
+        "clients": [
+                "68:2f:67:8b:98:ed"
+        ]
+}
+```
+
+
+## notify_response
+When enabled, hostapd will send a ubus notification and wait for a response before responding to various requests. This is used by e.g. usteer to make it possible to ignore probe requests.
+
+:warning: enabling this will cause hostapd to stop responding to probe requests unless a ubus subscriber responds to the ubus notifications.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| notify_response | int32 | yes | disable (0) or enable (!0) |
+
+### example
+`ubus call hostapd.wl5-fb notify_response '{ "notify_response": 1 }'`
+
+## reload
+Reload BSS configuration.
+
+:warning: this can cause problems for certain configurations:
+
+```
+Mon May 16 16:09:08 2022 daemon.warn hostapd: Failed to check if DFS is required; ret=-1
+Mon May 16 16:09:08 2022 daemon.warn hostapd: Failed to check if DFS is required; ret=-1
+Mon May 16 16:09:08 2022 daemon.err hostapd: Wrong coupling between HT and VHT/HE channel setting
+```
+
+### example
+`ubus call hostapd.wl5-fb reload`
+
+
+## rrm_beacon_req
+Send a Beacon Measurement Request to a client.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| addr | string | yes | client MAC address |
+| op_class | int32 | yes | the Regulatory Class for which this Measurement Request applies |
+| channel | int32 | yes | channel to measure |
+| duration | int32 | yes | compile Beacon Measurement Report after N TU |
+| mode | int32 | yes | mode to be used for measurement (0: passive, 1: active, 2: beacon table) |
+| bssid | string | no | filter BSSes in Beacon Measurement Report by BSSID |
+| ssid | string | no | filter BSSes in Beacon Measurement Report by SSID|
+
+
+## rrm_nr_get_own
+Show Neighbor Report Element for this BSS.
+
+### example
+`ubus call hostapd.wl5-fb rrm_nr_get_own`
+
+### output
+```json
+{
+        "value": [
+                "b6:a7:b9:cb:ee:bc",
+                "fb",
+                "b6a7b9cbeebcaf5900008095090603029b00"
+        ]
+}
+```
+
+
+## rrm_nr_list
+Show Neighbor Report Elements for other BSSes in this ESS.
+
+### example
+`ubus call hostapd.wl5-fb rrm_nr_list`
+
+### output
+```json
+{
+        "list": [
+                [
+                        "b6:a7:b9:cb:ee:ba",
+                        "fb",
+                        "b6a7b9cbeebabf5900008064090603026a00"
+                ]
+        ]
+}
+```
+
+## rrm_nr_set
+Set the Neighbor Report Elements. An element for the node on which this command is executed will always be added.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| list | array | yes | array of Neighbor Report Elements in the format of the rrm_nr_list output |
+
+### example
+`ubus call hostapd.wl5-fb rrm_nr_set '{ "list": [ [ "b6:a7:b9:cb:ee:ba", "fb", "b6a7b9cbeebabf5900008064090603026a00" ] ] }'`
+
+
+## set_vendor_elements
+Configure Vendor-specific Information Elements for BSS.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| vendor_elements | string | yes | Vendor-specific Information Elements as hex string |
+
+### example
+`ubus call hostapd.wl5-fb set_vendor_elements '{ "vendor_elements": "dd054857dd6662" }'`
+
+
+## switch_chan
+Initiate a channel switch.
+
+:warning: trying to switch to the channel that is currently in use will fail: `Command failed: Operation not supported`
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| freq | int32 | yes | frequency in MHz to switch to |
+| bcn_count | int32 | no | count in Beacon frames (TBTT) to perform the switch |
+| center_freq1 | int32 | no | segment 0 center frequency in MHz (valid for HT and VHT) |
+| center_freq2 | int32 | no | segment 1 center frequency in MHz (valid only for 80 MHz channel width and an 80+80 channel) |
+| bandwidth | int32 | no | channel width to use |
+| sec_channel_offset| int32 | no | secondary channel offset for HT40 (0 = disabled, 1 = HT40+, -1 = HT40-) |
+| ht | bool | no | enable 802.11n |
+| vht | bool | no | enable 802.11ac |
+| he | bool | no | enable 802.11ax |
+| block_tx | bool | no | block transmission during CSA period |
+| csa_force | bool | no | restart the interface in case the CSA fails |
+
+## example
+`ubus call hostapd.wl5-fb switch_chan '{ "freq": 5180, "bcn_count": 10, "center_freq1": 5210, "bandwidth": 80, "he": 1, "block_tx": 1, "csa_force": 0 }'`
+
+
+## update_airtime
+Set dynamic airtime weight for client.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| sta | string | yes | client MAC address |
+| weight | int32 | yes | airtime weight |
+
+
+## update_beacon
+Force beacon frame content to be updated and to start beaconing on an interface that uses start_disabled=1.
+
+### example
+`ubus call hostapd.wl5-fb update_beacon`
+
+
+## wps_status
+Get WPS status for BSS.
+
+### example
+`ubus call hostapd.wl5-fb wps_status`
+
+### output
+```json
+{
+        "pbc_status": "Disabled",
+        "last_wps_result": "None"
+}
+```
+
+
+## wps_cancel
+Cancel WPS Push Button Configuration.
+
+### example
+`ubus call hostapd.wl5-fb wps_cancel`
+
+
+## wps_start
+Start WPS Push Button Configuration.
+
+### example
+`ubus call hostapd.wl5-fb wps_start`
diff --git a/package/network/services/hostapd/files/hostapd.sh b/package/network/services/hostapd/files/hostapd.sh
index a714356e0..28bd21062 100644
--- a/package/network/services/hostapd/files/hostapd.sh
+++ b/package/network/services/hostapd/files/hostapd.sh
@@ -116,7 +116,6 @@ hostapd_common_add_device_config() {
 	config_add_int rssi_reject_assoc_rssi
 	config_add_int rssi_ignore_probe_request
 	config_add_int maxassoc
-	config_add_boolean vendor_vht
 
 	config_add_string acs_chan_bias
 	config_add_array hostapd_options
@@ -134,8 +133,7 @@ hostapd_prepare_device_config() {
 
 	json_get_vars country country3 country_ie beacon_int:100 doth require_mode legacy_rates \
 		acs_chan_bias local_pwr_constraint spectrum_mgmt_required airtime_mode cell_density \
-		rts_threshold beacon_rate rssi_reject_assoc_rssi rssi_ignore_probe_request maxassoc \
-		vendor_vht
+		rts_threshold beacon_rate rssi_reject_assoc_rssi rssi_ignore_probe_request maxassoc
 
 	hostapd_set_log_options base_cfg
 
@@ -204,7 +202,6 @@ hostapd_prepare_device_config() {
 				set_default rate_list "24000 36000 48000 54000"
 				set_default basic_rate_list "24000"
 			fi
-			[ -n "$vendor_vht" ] && append base_cfg "vendor_vht=$vendor_vht" "$N"
 		;;
 		a)
 			if [ "$cell_density" -eq 1 ]; then
diff --git a/package/network/services/hostapd/files/wpa_supplicant-basic.config b/package/network/services/hostapd/files/wpa_supplicant-basic.config
index 6abd8e233..944b4d928 100644
--- a/package/network/services/hostapd/files/wpa_supplicant-basic.config
+++ b/package/network/services/hostapd/files/wpa_supplicant-basic.config
@@ -26,7 +26,7 @@
 # replacement for WEXT and its use allows wpa_supplicant to properly control
 # the driver to improve existing functionality like roaming and to support new
 # functionality.
-CONFIG_DRIVER_WEXT=y
+#CONFIG_DRIVER_WEXT=y
 
 # Driver interface for Linux drivers using the nl80211 kernel interface
 CONFIG_DRIVER_NL80211=y
diff --git a/package/network/services/hostapd/files/wpa_supplicant-full.config b/package/network/services/hostapd/files/wpa_supplicant-full.config
index d24fbbb01..b39dabca0 100644
--- a/package/network/services/hostapd/files/wpa_supplicant-full.config
+++ b/package/network/services/hostapd/files/wpa_supplicant-full.config
@@ -26,7 +26,7 @@
 # replacement for WEXT and its use allows wpa_supplicant to properly control
 # the driver to improve existing functionality like roaming and to support new
 # functionality.
-CONFIG_DRIVER_WEXT=y
+#CONFIG_DRIVER_WEXT=y
 
 # Driver interface for Linux drivers using the nl80211 kernel interface
 CONFIG_DRIVER_NL80211=y
diff --git a/package/network/services/hostapd/files/wpa_supplicant-mini.config b/package/network/services/hostapd/files/wpa_supplicant-mini.config
index 9eb1111e5..2a3f8fb69 100644
--- a/package/network/services/hostapd/files/wpa_supplicant-mini.config
+++ b/package/network/services/hostapd/files/wpa_supplicant-mini.config
@@ -26,7 +26,7 @@
 # replacement for WEXT and its use allows wpa_supplicant to properly control
 # the driver to improve existing functionality like roaming and to support new
 # functionality.
-CONFIG_DRIVER_WEXT=y
+#CONFIG_DRIVER_WEXT=y
 
 # Driver interface for Linux drivers using the nl80211 kernel interface
 CONFIG_DRIVER_NL80211=y
diff --git a/package/network/services/hostapd/files/wpa_supplicant-p2p.config b/package/network/services/hostapd/files/wpa_supplicant-p2p.config
index 0dcc88e64..7f5140622 100644
--- a/package/network/services/hostapd/files/wpa_supplicant-p2p.config
+++ b/package/network/services/hostapd/files/wpa_supplicant-p2p.config
@@ -26,7 +26,7 @@
 # replacement for WEXT and its use allows wpa_supplicant to properly control
 # the driver to improve existing functionality like roaming and to support new
 # functionality.
-CONFIG_DRIVER_WEXT=y
+#CONFIG_DRIVER_WEXT=y
 
 # Driver interface for Linux drivers using the nl80211 kernel interface
 CONFIG_DRIVER_NL80211=y
diff --git a/package/network/services/hostapd/patches/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch b/package/network/services/hostapd/patches/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch
index 6bc48abfb..761fe368c 100644
--- a/package/network/services/hostapd/patches/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch
+++ b/package/network/services/hostapd/patches/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch
@@ -14,7 +14,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
 
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2436,7 +2436,7 @@ static int drv_supports_vht(struct wpa_s
+@@ -2621,7 +2621,7 @@ static int drv_supports_vht(struct wpa_s
  }
  
  
@@ -23,7 +23,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  {
  	int i;
  
-@@ -2445,7 +2445,10 @@ static bool ibss_mesh_is_80mhz_avail(int
+@@ -2630,7 +2630,10 @@ static bool ibss_mesh_is_80mhz_avail(int
  
  		chan = hw_get_channel_chan(mode, i, NULL);
  		if (!chan ||
@@ -35,16 +35,16 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  			return false;
  	}
  
-@@ -2474,6 +2477,8 @@ void ibss_mesh_setup_freq(struct wpa_sup
- 	int chwidth, seg0, seg1;
- 	u32 vht_caps = 0;
- 	bool is_24ghz, is_6ghz;
-+	bool dfs_enabled = wpa_s->conf->country[0] &&
-+			   (wpa_s->drv_flags & WPA_DRIVER_FLAGS_RADAR);
- 
- 	freq->freq = ssid->frequency;
- 
-@@ -2570,8 +2575,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2757,7 +2760,7 @@ static void ibss_mesh_select_40mhz(struc
+ 				   const struct wpa_ssid *ssid,
+ 				   struct hostapd_hw_modes *mode,
+ 				   struct hostapd_freq_params *freq,
+-				   int obss_scan) {
++				   int obss_scan, bool dfs_enabled) {
+ 	int chan_idx;
+ 	struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
+ 	int i, res;
+@@ -2781,8 +2784,11 @@ static void ibss_mesh_select_40mhz(struc
  		return;
  
  	/* Check primary channel flags */
@@ -55,9 +55,9 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
 +		if (!dfs_enabled)
 +			return;
  
- 	freq->channel = pri_chan->chan;
- 
-@@ -2604,8 +2612,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ #ifdef CONFIG_HT_OVERRIDES
+ 	if (ssid->disable_ht40)
+@@ -2808,8 +2814,11 @@ static void ibss_mesh_select_40mhz(struc
  		return;
  
  	/* Check secondary channel flags */
@@ -70,25 +70,34 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  
  	if (ht40 == -1) {
  		if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
-@@ -2694,7 +2705,7 @@ skip_to_6ghz:
- 		return;
+@@ -2863,7 +2872,7 @@ static bool ibss_mesh_select_80_160mhz(s
+ 				       const struct wpa_ssid *ssid,
+ 				       struct hostapd_hw_modes *mode,
+ 				       struct hostapd_freq_params *freq,
+-				       int ieee80211_mode, bool is_6ghz) {
++				       int ieee80211_mode, bool is_6ghz, bool dfs_enabled) {
+ 	static const int bw80[] = {
+ 		5180, 5260, 5500, 5580, 5660, 5745, 5825,
+ 		5955, 6035, 6115, 6195, 6275, 6355, 6435,
+@@ -2908,7 +2917,7 @@ static bool ibss_mesh_select_80_160mhz(s
+ 		goto skip_80mhz;
  
- 	/* Back to HT configuration if channel not usable */
+ 	/* Use 40 MHz if channel not usable */
 -	if (!ibss_mesh_is_80mhz_avail(channel, mode))
 +	if (!ibss_mesh_is_80mhz_avail(channel, mode, dfs_enabled))
- 		return;
+ 		goto skip_80mhz;
  
  	chwidth = CONF_OPER_CHWIDTH_80MHZ;
-@@ -2708,7 +2719,7 @@ skip_to_6ghz:
- 		 * above; check the remaining four 20 MHz channels for the total
- 		 * of 160 MHz bandwidth.
- 		 */
--		if (!ibss_mesh_is_80mhz_avail(channel + 16, mode))
-+		if (!ibss_mesh_is_80mhz_avail(channel + 16, mode, dfs_enabled))
- 			return;
- 
+@@ -2922,7 +2931,7 @@ static bool ibss_mesh_select_80_160mhz(s
+ 	if ((mode->he_capab[ieee80211_mode].phy_cap[
+ 		     HE_PHYCAP_CHANNEL_WIDTH_SET_IDX] &
+ 	     HE_PHYCAP_CHANNEL_WIDTH_SET_160MHZ_IN_5G) && is_6ghz &&
+-	    ibss_mesh_is_80mhz_avail(channel + 16, mode)) {
++	    ibss_mesh_is_80mhz_avail(channel + 16, mode, dfs_enabled)) {
  		for (j = 0; j < ARRAY_SIZE(bw160); j++) {
-@@ -2738,10 +2749,12 @@ skip_to_6ghz:
+ 			if (freq->freq == bw160[j]) {
+ 				chwidth = CONF_OPER_CHWIDTH_160MHZ;
+@@ -2950,10 +2959,12 @@ static bool ibss_mesh_select_80_160mhz(s
  				if (!chan)
  					continue;
  
@@ -104,3 +113,23 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  
  				/* Found a suitable second segment for 80+80 */
  				chwidth = CONF_OPER_CHWIDTH_80P80MHZ;
+@@ -3008,6 +3019,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ 	int i, obss_scan = 1;
+ 	u8 channel;
+ 	bool is_6ghz;
++	bool dfs_enabled = wpa_s->conf->country[0] && (wpa_s->drv_flags & WPA_DRIVER_FLAGS_RADAR);
+ 
+ 	freq->freq = ssid->frequency;
+ 
+@@ -3053,9 +3065,9 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ 	freq->channel = channel;
+ 	/* Setup higher BW only for 5 GHz */
+ 	if (mode->mode == HOSTAPD_MODE_IEEE80211A) {
+-		ibss_mesh_select_40mhz(wpa_s, ssid, mode, freq, obss_scan);
++		ibss_mesh_select_40mhz(wpa_s, ssid, mode, freq, obss_scan, dfs_enabled);
+ 		if (!ibss_mesh_select_80_160mhz(wpa_s, ssid, mode, freq,
+-						ieee80211_mode, is_6ghz))
++						ieee80211_mode, is_6ghz, dfs_enabled))
+ 			freq->he_enabled = freq->vht_enabled = false;
+ 	}
+ 
diff --git a/package/network/services/hostapd/patches/011-mesh-use-deterministic-channel-on-channel-switch.patch b/package/network/services/hostapd/patches/011-mesh-use-deterministic-channel-on-channel-switch.patch
index 32a447914..20a8bee07 100644
--- a/package/network/services/hostapd/patches/011-mesh-use-deterministic-channel-on-channel-switch.patch
+++ b/package/network/services/hostapd/patches/011-mesh-use-deterministic-channel-on-channel-switch.patch
@@ -29,7 +29,7 @@ Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
  
  
  enum dfs_channel_type {
-@@ -515,9 +516,14 @@ dfs_get_valid_channel(struct hostapd_ifa
+@@ -521,9 +522,14 @@ dfs_get_valid_channel(struct hostapd_ifa
  	int num_available_chandefs;
  	int chan_idx, chan_idx2;
  	int sec_chan_idx_80p80 = -1;
@@ -44,7 +44,7 @@ Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
  	wpa_printf(MSG_DEBUG, "DFS: Selecting random channel");
  	*secondary_channel = 0;
  	*oper_centr_freq_seg0_idx = 0;
-@@ -537,8 +543,20 @@ dfs_get_valid_channel(struct hostapd_ifa
+@@ -543,8 +549,20 @@ dfs_get_valid_channel(struct hostapd_ifa
  	if (num_available_chandefs == 0)
  		return NULL;
  
@@ -68,7 +68,7 @@ Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
  	if (!chan) {
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -9948,6 +9948,10 @@ static int nl80211_switch_channel(void *
+@@ -10739,6 +10739,10 @@ static int nl80211_switch_channel(void *
  	if (ret)
  		goto error;
  
diff --git a/package/network/services/hostapd/patches/021-fix-sta-add-after-previous-connection.patch b/package/network/services/hostapd/patches/021-fix-sta-add-after-previous-connection.patch
index 80b23bdfc..827e122ba 100644
--- a/package/network/services/hostapd/patches/021-fix-sta-add-after-previous-connection.patch
+++ b/package/network/services/hostapd/patches/021-fix-sta-add-after-previous-connection.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
-@@ -4963,6 +4963,13 @@ static int add_associated_sta(struct hos
+@@ -4168,6 +4168,13 @@ static int add_associated_sta(struct hos
  	 * drivers to accept the STA parameter configuration. Since this is
  	 * after a new FT-over-DS exchange, a new TK has been derived, so key
  	 * reinstallation is not a concern for this case.
@@ -14,7 +14,7 @@
  	 */
  	wpa_printf(MSG_DEBUG, "Add associated STA " MACSTR
  		   " (added_unassoc=%d auth_alg=%u ft_over_ds=%u reassoc=%d authorized=%d ft_tk=%d fils_tk=%d)",
-@@ -4976,7 +4983,8 @@ static int add_associated_sta(struct hos
+@@ -4181,7 +4188,8 @@ static int add_associated_sta(struct hos
  	    (!(sta->flags & WLAN_STA_AUTHORIZED) ||
  	     (reassoc && sta->ft_over_ds && sta->auth_alg == WLAN_AUTH_FT) ||
  	     (!wpa_auth_sta_ft_tk_already_set(sta->wpa_sm) &&
diff --git a/package/network/services/hostapd/patches/022-hostapd-fix-use-of-uninitialized-stack-variables.patch b/package/network/services/hostapd/patches/022-hostapd-fix-use-of-uninitialized-stack-variables.patch
index 25801da33..f4f56f510 100644
--- a/package/network/services/hostapd/patches/022-hostapd-fix-use-of-uninitialized-stack-variables.patch
+++ b/package/network/services/hostapd/patches/022-hostapd-fix-use-of-uninitialized-stack-variables.patch
@@ -14,7 +14,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -3453,7 +3453,7 @@ static int hostapd_change_config_freq(st
+@@ -3562,7 +3562,7 @@ static int hostapd_change_config_freq(st
  				      struct hostapd_freq_params *old_params)
  {
  	int channel;
diff --git a/package/network/services/hostapd/patches/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch b/package/network/services/hostapd/patches/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch
index 988fbbc6f..c02d4b497 100644
--- a/package/network/services/hostapd/patches/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch
+++ b/package/network/services/hostapd/patches/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch
@@ -20,7 +20,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #include <linux/rtnetlink.h>
  #include <netpacket/packet.h>
  #include <linux/errqueue.h>
-@@ -5344,26 +5341,29 @@ fail:
+@@ -5590,26 +5587,29 @@ fail:
  
  static void rtnl_neigh_delete_fdb_entry(struct i802_bss *bss, const u8 *addr)
  {
@@ -64,7 +64,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (err < 0) {
  		wpa_printf(MSG_DEBUG, "nl80211: bridge FDB entry delete for "
  			   MACSTR " ifindex=%d failed: %s", MAC2STR(addr),
-@@ -5373,9 +5373,8 @@ static void rtnl_neigh_delete_fdb_entry(
+@@ -5619,9 +5619,8 @@ static void rtnl_neigh_delete_fdb_entry(
  			   MACSTR, MAC2STR(addr));
  	}
  
@@ -76,7 +76,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  
-@@ -7763,7 +7762,6 @@ static void *i802_init(struct hostapd_da
+@@ -8275,7 +8274,6 @@ static void *i802_init(struct hostapd_da
  	    (params->num_bridge == 0 || !params->bridge[0]))
  		add_ifidx(drv, br_ifindex, drv->ifindex);
  
@@ -84,7 +84,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (bss->added_if_into_bridge || bss->already_in_bridge) {
  		int err;
  
-@@ -7780,7 +7778,6 @@ static void *i802_init(struct hostapd_da
+@@ -8292,7 +8290,6 @@ static void *i802_init(struct hostapd_da
  			goto failed;
  		}
  	}
@@ -92,7 +92,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (drv->capa.flags2 & WPA_DRIVER_FLAGS2_CONTROL_PORT_RX) {
  		wpa_printf(MSG_DEBUG,
-@@ -10813,13 +10810,14 @@ static int wpa_driver_br_add_ip_neigh(vo
+@@ -11605,13 +11602,14 @@ static int wpa_driver_br_add_ip_neigh(vo
  				      const u8 *ipaddr, int prefixlen,
  				      const u8 *addr)
  {
@@ -112,7 +112,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	int res;
  
  	if (!ipaddr || prefixlen == 0 || !addr)
-@@ -10838,85 +10836,66 @@ static int wpa_driver_br_add_ip_neigh(vo
+@@ -11630,85 +11628,66 @@ static int wpa_driver_br_add_ip_neigh(vo
  	}
  
  	if (version == 4) {
@@ -220,7 +220,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		addrsize = 16;
  	} else {
  		return -EINVAL;
-@@ -10934,41 +10913,30 @@ static int wpa_driver_br_delete_ip_neigh
+@@ -11726,41 +11705,30 @@ static int wpa_driver_br_delete_ip_neigh
  		return -1;
  	}
  
diff --git a/package/network/services/hostapd/patches/040-mesh-allow-processing-authentication-frames-in-block.patch b/package/network/services/hostapd/patches/040-mesh-allow-processing-authentication-frames-in-block.patch
index 6b34cd435..179d47ecc 100644
--- a/package/network/services/hostapd/patches/040-mesh-allow-processing-authentication-frames-in-block.patch
+++ b/package/network/services/hostapd/patches/040-mesh-allow-processing-authentication-frames-in-block.patch
@@ -16,7 +16,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
-@@ -3781,15 +3781,6 @@ static void handle_auth(struct hostapd_d
+@@ -2948,15 +2948,6 @@ static void handle_auth(struct hostapd_d
  				       seq_ctrl);
  			return;
  		}
diff --git a/package/network/services/hostapd/patches/050-build_fix.patch b/package/network/services/hostapd/patches/050-build_fix.patch
index c9268f59e..8680b07c6 100644
--- a/package/network/services/hostapd/patches/050-build_fix.patch
+++ b/package/network/services/hostapd/patches/050-build_fix.patch
@@ -10,7 +10,7 @@
  CFLAGS += -DCONFIG_FILS_SK_PFS
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -320,6 +320,7 @@ endif
+@@ -331,6 +331,7 @@ endif
  ifdef CONFIG_FILS
  CFLAGS += -DCONFIG_FILS
  NEED_SHA384=y
diff --git a/package/network/services/hostapd/patches/110-mbedtls-TLS-crypto-option-initial-port.patch b/package/network/services/hostapd/patches/110-mbedtls-TLS-crypto-option-initial-port.patch
index 01af14b71..22107944d 100644
--- a/package/network/services/hostapd/patches/110-mbedtls-TLS-crypto-option-initial-port.patch
+++ b/package/network/services/hostapd/patches/110-mbedtls-TLS-crypto-option-initial-port.patch
@@ -273,7 +273,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  
  ifdef CONFIG_RADIUS_SERVER
  CFLAGS += -DRADIUS_SERVER
-@@ -1327,7 +1412,9 @@ NOBJS += ../src/utils/trace.o
+@@ -1329,7 +1414,9 @@ NOBJS += ../src/utils/trace.o
  endif
  
  HOBJS += hlr_auc_gw.o ../src/utils/common.o ../src/utils/wpa_debug.o ../src/utils/os_$(CONFIG_OS).o ../src/utils/wpabuf.o ../src/crypto/milenage.o
@@ -283,7 +283,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  ifdef CONFIG_INTERNAL_AES
  HOBJS += ../src/crypto/aes-internal.o
  HOBJS += ../src/crypto/aes-internal-enc.o
-@@ -1350,13 +1437,17 @@ SOBJS += ../src/common/sae.o
+@@ -1352,13 +1439,17 @@ SOBJS += ../src/common/sae.o
  SOBJS += ../src/common/sae_pk.o
  SOBJS += ../src/common/dragonfly.o
  SOBJS += $(AESOBJS)
@@ -7765,7 +7765,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  CONFIG_SIM_SIMULATOR=y
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -1149,6 +1149,29 @@ endif
+@@ -1163,6 +1163,29 @@ endif
  CFLAGS += -DTLS_DEFAULT_CIPHERS=\"$(CONFIG_TLS_DEFAULT_CIPHERS)\"
  endif
  
@@ -7795,7 +7795,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  ifeq ($(CONFIG_TLS), gnutls)
  ifndef CONFIG_CRYPTO
  # default to libgcrypt
-@@ -1341,9 +1364,11 @@ endif
+@@ -1355,9 +1378,11 @@ endif
  
  ifneq ($(CONFIG_TLS), openssl)
  ifneq ($(CONFIG_TLS), wolfssl)
@@ -7807,7 +7807,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  ifdef CONFIG_OPENSSL_INTERNAL_AES_WRAP
  # Seems to be needed at least with BoringSSL
  NEED_INTERNAL_AES_WRAP=y
-@@ -1357,9 +1382,11 @@ endif
+@@ -1371,9 +1396,11 @@ endif
  
  ifdef NEED_INTERNAL_AES_WRAP
  ifneq ($(CONFIG_TLS), linux)
@@ -7819,7 +7819,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  ifdef NEED_AES_EAX
  AESOBJS += ../src/crypto/aes-eax.o
  NEED_AES_CTR=y
-@@ -1369,35 +1396,45 @@ AESOBJS += ../src/crypto/aes-siv.o
+@@ -1383,35 +1410,45 @@ AESOBJS += ../src/crypto/aes-siv.o
  NEED_AES_CTR=y
  endif
  ifdef NEED_AES_CTR
@@ -7865,7 +7865,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  ifdef NEED_AES_ENC
  ifdef CONFIG_INTERNAL_AES
  AESOBJS += ../src/crypto/aes-internal-enc.o
-@@ -1412,12 +1449,16 @@ ifneq ($(CONFIG_TLS), openssl)
+@@ -1426,12 +1463,16 @@ ifneq ($(CONFIG_TLS), openssl)
  ifneq ($(CONFIG_TLS), linux)
  ifneq ($(CONFIG_TLS), gnutls)
  ifneq ($(CONFIG_TLS), wolfssl)
@@ -7882,7 +7882,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  ifdef CONFIG_INTERNAL_SHA1
  SHA1OBJS += ../src/crypto/sha1-internal.o
  ifdef NEED_FIPS186_2_PRF
-@@ -1429,29 +1470,37 @@ CFLAGS += -DCONFIG_NO_PBKDF2
+@@ -1443,29 +1484,37 @@ CFLAGS += -DCONFIG_NO_PBKDF2
  else
  ifneq ($(CONFIG_TLS), openssl)
  ifneq ($(CONFIG_TLS), wolfssl)
@@ -7920,7 +7920,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  ifdef NEED_MD5
  ifdef CONFIG_INTERNAL_MD5
  MD5OBJS += ../src/crypto/md5-internal.o
-@@ -1506,12 +1555,17 @@ ifneq ($(CONFIG_TLS), openssl)
+@@ -1520,12 +1569,17 @@ ifneq ($(CONFIG_TLS), openssl)
  ifneq ($(CONFIG_TLS), linux)
  ifneq ($(CONFIG_TLS), gnutls)
  ifneq ($(CONFIG_TLS), wolfssl)
@@ -7938,7 +7938,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  ifdef CONFIG_INTERNAL_SHA256
  SHA256OBJS += ../src/crypto/sha256-internal.o
  endif
-@@ -1524,50 +1578,68 @@ CFLAGS += -DCONFIG_INTERNAL_SHA512
+@@ -1538,50 +1592,68 @@ CFLAGS += -DCONFIG_INTERNAL_SHA512
  SHA256OBJS += ../src/crypto/sha512-internal.o
  endif
  ifdef NEED_TLS_PRF_SHA256
@@ -8007,7 +8007,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  
  ifdef NEED_ASN1
  OBJS += ../src/tls/asn1.o
-@@ -1742,10 +1814,12 @@ ifdef CONFIG_FIPS
+@@ -1756,10 +1828,12 @@ ifdef CONFIG_FIPS
  CFLAGS += -DCONFIG_FIPS
  ifneq ($(CONFIG_TLS), openssl)
  ifneq ($(CONFIG_TLS), wolfssl)
diff --git a/package/network/services/hostapd/patches/120-mbedtls-fips186_2_prf.patch b/package/network/services/hostapd/patches/120-mbedtls-fips186_2_prf.patch
index a0d287086..a48725264 100644
--- a/package/network/services/hostapd/patches/120-mbedtls-fips186_2_prf.patch
+++ b/package/network/services/hostapd/patches/120-mbedtls-fips186_2_prf.patch
@@ -101,7 +101,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -1160,10 +1160,6 @@ endif
+@@ -1174,10 +1174,6 @@ endif
  OBJS += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
  OBJS_p += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
  OBJS_priv += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
diff --git a/package/network/services/hostapd/patches/140-tests-Makefile-make-run-tests-with-CONFIG_TLS.patch b/package/network/services/hostapd/patches/140-tests-Makefile-make-run-tests-with-CONFIG_TLS.patch
index 9e9e88c1e..148c268f9 100644
--- a/package/network/services/hostapd/patches/140-tests-Makefile-make-run-tests-with-CONFIG_TLS.patch
+++ b/package/network/services/hostapd/patches/140-tests-Makefile-make-run-tests-with-CONFIG_TLS.patch
@@ -727,7 +727,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  
  def check_ec_support(dev):
      tls = dev.request("GET tls_library")
-@@ -1625,7 +1668,7 @@ def test_ap_wpa2_eap_ttls_pap_subject_ma
+@@ -1595,7 +1638,7 @@ def test_ap_wpa2_eap_ttls_pap_subject_ma
      eap_connect(dev[0], hapd, "TTLS", "pap user",
                  anonymous_identity="ttls", password="password",
                  ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
@@ -736,7 +736,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
                  altsubject_match="EMAIL:noone@example.com;DNS:server.w1.fi;URI:http://example.com/")
      eap_reauth(dev[0], "TTLS")
  
-@@ -2860,6 +2903,7 @@ def test_ap_wpa2_eap_tls_neg_domain_matc
+@@ -2830,6 +2873,7 @@ def test_ap_wpa2_eap_tls_neg_domain_matc
  
  def test_ap_wpa2_eap_tls_neg_subject_match(dev, apdev):
      """WPA2-Enterprise negative test - subject mismatch"""
@@ -744,7 +744,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
      hostapd.add_ap(apdev[0], params)
      dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
-@@ -2920,6 +2964,7 @@ def test_ap_wpa2_eap_tls_neg_subject_mat
+@@ -2890,6 +2934,7 @@ def test_ap_wpa2_eap_tls_neg_subject_mat
  
  def test_ap_wpa2_eap_tls_neg_altsubject_match(dev, apdev):
      """WPA2-Enterprise negative test - altsubject mismatch"""
@@ -752,7 +752,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
      hostapd.add_ap(apdev[0], params)
  
-@@ -3460,7 +3505,7 @@ def test_ap_wpa2_eap_ikev2_oom(dev, apde
+@@ -3430,7 +3475,7 @@ def test_ap_wpa2_eap_ikev2_oom(dev, apde
              dev[0].request("REMOVE_NETWORK all")
  
      tls = dev[0].request("GET tls_library")
@@ -761,7 +761,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
          tests = [(1, "os_get_random;dh_init")]
      else:
          tests = [(1, "crypto_dh_init;dh_init")]
-@@ -4774,7 +4819,7 @@ def test_ap_wpa2_eap_tls_intermediate_ca
+@@ -4744,7 +4789,7 @@ def test_ap_wpa2_eap_tls_intermediate_ca
      params["private_key"] = "auth_serv/iCA-server/server.key"
      hostapd.add_ap(apdev[0], params)
      tls = dev[0].request("GET tls_library")
@@ -770,7 +770,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
          ca_cert = "auth_serv/iCA-user/ca-and-root.pem"
          client_cert = "auth_serv/iCA-user/user_and_ica.pem"
      else:
-@@ -4840,6 +4885,7 @@ def test_ap_wpa2_eap_tls_intermediate_ca
+@@ -4810,6 +4855,7 @@ def test_ap_wpa2_eap_tls_intermediate_ca
      run_ap_wpa2_eap_tls_intermediate_ca_ocsp(dev, apdev, params, "-sha1")
  
  def run_ap_wpa2_eap_tls_intermediate_ca_ocsp(dev, apdev, params, md):
@@ -778,7 +778,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      params = int_eap_server_params()
      params["ca_cert"] = "auth_serv/iCA-server/ca-and-root.pem"
      params["server_cert"] = "auth_serv/iCA-server/server.pem"
-@@ -4849,7 +4895,7 @@ def run_ap_wpa2_eap_tls_intermediate_ca_
+@@ -4819,7 +4865,7 @@ def run_ap_wpa2_eap_tls_intermediate_ca_
      try:
          hostapd.add_ap(apdev[0], params)
          tls = dev[0].request("GET tls_library")
@@ -787,7 +787,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
              ca_cert = "auth_serv/iCA-user/ca-and-root.pem"
              client_cert = "auth_serv/iCA-user/user_and_ica.pem"
          else:
-@@ -4885,7 +4931,7 @@ def run_ap_wpa2_eap_tls_intermediate_ca_
+@@ -4855,7 +4901,7 @@ def run_ap_wpa2_eap_tls_intermediate_ca_
      try:
          hostapd.add_ap(apdev[0], params)
          tls = dev[0].request("GET tls_library")
@@ -796,7 +796,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
              ca_cert = "auth_serv/iCA-user/ca-and-root.pem"
              client_cert = "auth_serv/iCA-user/user_and_ica.pem"
          else:
-@@ -4935,7 +4981,7 @@ def test_ap_wpa2_eap_tls_intermediate_ca
+@@ -4905,7 +4951,7 @@ def test_ap_wpa2_eap_tls_intermediate_ca
      try:
          hostapd.add_ap(apdev[0], params)
          tls = dev[0].request("GET tls_library")
@@ -805,7 +805,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
              ca_cert = "auth_serv/iCA-user/ca-and-root.pem"
              client_cert = "auth_serv/iCA-user/user_and_ica.pem"
          else:
-@@ -5002,7 +5048,7 @@ def test_ap_wpa2_eap_tls_intermediate_ca
+@@ -4972,7 +5018,7 @@ def test_ap_wpa2_eap_tls_intermediate_ca
  
          hostapd.add_ap(apdev[0], params)
          tls = dev[0].request("GET tls_library")
@@ -814,7 +814,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
              ca_cert = "auth_serv/iCA-user/ca-and-root.pem"
              client_cert = "auth_serv/iCA-user/user_and_ica.pem"
          else:
-@@ -5260,6 +5306,7 @@ def test_ap_wpa2_eap_ttls_server_cert_ek
+@@ -5230,6 +5276,7 @@ def test_ap_wpa2_eap_ttls_server_cert_ek
  
  def test_ap_wpa2_eap_ttls_server_pkcs12(dev, apdev):
      """WPA2-Enterprise using EAP-TTLS and server PKCS#12 file"""
@@ -822,7 +822,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      skip_with_fips(dev[0])
      params = int_eap_server_params()
      del params["server_cert"]
-@@ -5272,6 +5319,7 @@ def test_ap_wpa2_eap_ttls_server_pkcs12(
+@@ -5242,6 +5289,7 @@ def test_ap_wpa2_eap_ttls_server_pkcs12(
  
  def test_ap_wpa2_eap_ttls_server_pkcs12_extra(dev, apdev):
      """EAP-TTLS and server PKCS#12 file with extra certs"""
@@ -830,7 +830,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      skip_with_fips(dev[0])
      params = int_eap_server_params()
      del params["server_cert"]
-@@ -5294,6 +5342,7 @@ def test_ap_wpa2_eap_ttls_dh_params_serv
+@@ -5264,6 +5312,7 @@ def test_ap_wpa2_eap_ttls_dh_params_serv
  
  def test_ap_wpa2_eap_ttls_dh_params_dsa_server(dev, apdev):
      """WPA2-Enterprise using EAP-TTLS and alternative server dhparams (DSA)"""
@@ -838,7 +838,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      params = int_eap_server_params()
      params["dh_file"] = "auth_serv/dsaparam.pem"
      hapd = hostapd.add_ap(apdev[0], params)
-@@ -5605,8 +5654,8 @@ def test_ap_wpa2_eap_non_ascii_identity2
+@@ -5575,8 +5624,8 @@ def test_ap_wpa2_eap_non_ascii_identity2
  def test_openssl_cipher_suite_config_wpas(dev, apdev):
      """OpenSSL cipher suite configuration on wpa_supplicant"""
      tls = dev[0].request("GET tls_library")
@@ -849,7 +849,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
      hapd = hostapd.add_ap(apdev[0], params)
      eap_connect(dev[0], hapd, "TTLS", "pap user",
-@@ -5632,14 +5681,14 @@ def test_openssl_cipher_suite_config_wpa
+@@ -5602,14 +5651,14 @@ def test_openssl_cipher_suite_config_wpa
  def test_openssl_cipher_suite_config_hapd(dev, apdev):
      """OpenSSL cipher suite configuration on hostapd"""
      tls = dev[0].request("GET tls_library")
@@ -868,7 +868,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      eap_connect(dev[0], hapd, "TTLS", "pap user",
                  anonymous_identity="ttls", password="password",
                  ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
-@@ -6081,13 +6130,17 @@ def test_ap_wpa2_eap_tls_versions(dev, a
+@@ -6051,13 +6100,17 @@ def test_ap_wpa2_eap_tls_versions(dev, a
              check_tls_ver(dev[0], hapd,
                            "tls_disable_tlsv1_0=1 tls_disable_tlsv1_1=1",
                            "TLSv1.2")
@@ -891,7 +891,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      if "run=OpenSSL 1.1.1" in tls or "run=OpenSSL 3.0" in tls:
          check_tls_ver(dev[0], hapd,
                        "tls_disable_tlsv1_0=1 tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1 tls_disable_tlsv1_3=0", "TLSv1.3")
-@@ -6109,6 +6162,11 @@ def test_ap_wpa2_eap_tls_versions_server
+@@ -6079,6 +6132,11 @@ def test_ap_wpa2_eap_tls_versions_server
      tests = [("TLSv1", "[ENABLE-TLSv1.0][DISABLE-TLSv1.1][DISABLE-TLSv1.2][DISABLE-TLSv1.3]"),
               ("TLSv1.1", "[ENABLE-TLSv1.0][ENABLE-TLSv1.1][DISABLE-TLSv1.2][DISABLE-TLSv1.3]"),
               ("TLSv1.2", "[ENABLE-TLSv1.0][ENABLE-TLSv1.1][ENABLE-TLSv1.2][DISABLE-TLSv1.3]")]
@@ -903,7 +903,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      for exp, flags in tests:
          hapd.disable()
          hapd.set("tls_flags", flags)
-@@ -7145,6 +7203,7 @@ def test_ap_wpa2_eap_assoc_rsn(dev, apde
+@@ -7115,6 +7173,7 @@ def test_ap_wpa2_eap_assoc_rsn(dev, apde
  def test_eap_tls_ext_cert_check(dev, apdev):
      """EAP-TLS and external server certification validation"""
      # With internal server certificate chain validation
@@ -911,7 +911,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
                          identity="tls user",
                          ca_cert="auth_serv/ca.pem",
-@@ -7157,6 +7216,7 @@ def test_eap_tls_ext_cert_check(dev, apd
+@@ -7127,6 +7186,7 @@ def test_eap_tls_ext_cert_check(dev, apd
  def test_eap_ttls_ext_cert_check(dev, apdev):
      """EAP-TTLS and external server certification validation"""
      # Without internal server certificate chain validation
@@ -919,7 +919,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
                          identity="pap user", anonymous_identity="ttls",
                          password="password", phase2="auth=PAP",
-@@ -7167,6 +7227,7 @@ def test_eap_ttls_ext_cert_check(dev, ap
+@@ -7137,6 +7197,7 @@ def test_eap_ttls_ext_cert_check(dev, ap
  def test_eap_peap_ext_cert_check(dev, apdev):
      """EAP-PEAP and external server certification validation"""
      # With internal server certificate chain validation
@@ -927,7 +927,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PEAP",
                          identity="user", anonymous_identity="peap",
                          ca_cert="auth_serv/ca.pem",
-@@ -7177,6 +7238,7 @@ def test_eap_peap_ext_cert_check(dev, ap
+@@ -7147,6 +7208,7 @@ def test_eap_peap_ext_cert_check(dev, ap
  
  def test_eap_fast_ext_cert_check(dev, apdev):
      """EAP-FAST and external server certification validation"""
@@ -935,7 +935,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      check_eap_capa(dev[0], "FAST")
      # With internal server certificate chain validation
      dev[0].request("SET blob fast_pac_auth_ext ")
-@@ -7191,10 +7253,6 @@ def test_eap_fast_ext_cert_check(dev, ap
+@@ -7161,10 +7223,6 @@ def test_eap_fast_ext_cert_check(dev, ap
      run_ext_cert_check(dev, apdev, id)
  
  def run_ext_cert_check(dev, apdev, net_id):
@@ -948,7 +948,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  
 --- a/tests/hwsim/test_ap_ft.py
 +++ b/tests/hwsim/test_ap_ft.py
-@@ -2347,11 +2347,11 @@ def test_ap_ft_ap_oom5(dev, apdev):
+@@ -2471,11 +2471,11 @@ def test_ap_ft_ap_oom5(dev, apdev):
          # This will fail to roam
          dev[0].roam(bssid1, check_bssid=False)
  
@@ -992,7 +992,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
              raise HwsimSkip("Crypto library does not support Brainpool curves: " + tls)
      capa = dev.request("GET_CAPABILITY dpp")
      ver = 1
-@@ -3621,6 +3622,9 @@ def test_dpp_proto_auth_req_no_i_proto_k
+@@ -3892,6 +3893,9 @@ def test_dpp_proto_auth_req_no_i_proto_k
  
  def test_dpp_proto_auth_req_invalid_i_proto_key(dev, apdev):
      """DPP protocol testing - invalid I-proto key in Auth Req"""
@@ -1002,7 +1002,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      run_dpp_proto_auth_req_missing(dev, 66, "Invalid Initiator Protocol Key")
  
  def test_dpp_proto_auth_req_no_i_nonce(dev, apdev):
-@@ -3716,7 +3720,12 @@ def test_dpp_proto_auth_resp_no_r_proto_
+@@ -3987,7 +3991,12 @@ def test_dpp_proto_auth_resp_no_r_proto_
  
  def test_dpp_proto_auth_resp_invalid_r_proto_key(dev, apdev):
      """DPP protocol testing - invalid R-Proto Key in Auth Resp"""
@@ -1016,7 +1016,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  
  def test_dpp_proto_auth_resp_no_r_nonce(dev, apdev):
      """DPP protocol testing - no R-nonce in Auth Resp"""
-@@ -4078,11 +4087,17 @@ def test_dpp_proto_pkex_exchange_resp_in
+@@ -4349,11 +4358,17 @@ def test_dpp_proto_pkex_exchange_resp_in
  
  def test_dpp_proto_pkex_cr_req_invalid_bootstrap_key(dev, apdev):
      """DPP protocol testing - invalid Bootstrap Key in PKEX Commit-Reveal Request"""
@@ -1106,7 +1106,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
                  raise HwsimSkip("EC group not supported")
 --- a/tests/hwsim/test_pmksa_cache.py
 +++ b/tests/hwsim/test_pmksa_cache.py
-@@ -954,7 +954,7 @@ def test_pmksa_cache_preauth_wpas_oom(de
+@@ -955,7 +955,7 @@ def test_pmksa_cache_preauth_wpas_oom(de
      eap_connect(dev[0], hapd, "PAX", "pax.user@example.com",
                  password_hex="0123456789abcdef0123456789abcdef",
                  bssid=apdev[0]['bssid'])
@@ -1115,7 +1115,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
          with alloc_fail(dev[0], i, "rsn_preauth_init"):
              res = dev[0].request("PREAUTH f2:11:22:33:44:55").strip()
              logger.info("Iteration %d - PREAUTH command results: %s" % (i, res))
-@@ -962,7 +962,7 @@ def test_pmksa_cache_preauth_wpas_oom(de
+@@ -963,7 +963,7 @@ def test_pmksa_cache_preauth_wpas_oom(de
                  state = dev[0].request('GET_ALLOC_FAIL')
                  if state.startswith('0:'):
                      break
@@ -1138,7 +1138,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      heavy_groups = [14, 15, 16]
      suitable_groups = [15, 16, 17, 18, 19, 20, 21]
      groups = [str(g) for g in sae_groups]
-@@ -2122,6 +2127,8 @@ def run_sae_pwe_group(dev, apdev, group)
+@@ -2188,6 +2193,8 @@ def run_sae_pwe_group(dev, apdev, group)
              logger.info("Add Brainpool EC groups since OpenSSL is new enough")
          elif tls.startswith("wolfSSL"):
              logger.info("Make sure Brainpool EC groups were enabled when compiling wolfSSL")
@@ -1149,7 +1149,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      start_sae_pwe_ap(apdev[0], group, 2)
 --- a/tests/hwsim/test_suite_b.py
 +++ b/tests/hwsim/test_suite_b.py
-@@ -26,6 +26,8 @@ def check_suite_b_tls_lib(dev, dhe=False
+@@ -27,6 +27,8 @@ def check_suite_b_tls_lib(dev, dhe=False
          return
      if tls.startswith("wolfSSL"):
          return
@@ -1158,7 +1158,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
      if not tls.startswith("OpenSSL"):
          raise HwsimSkip("TLS library not supported for Suite B: " + tls)
      supported = False
-@@ -499,6 +501,7 @@ def test_suite_b_192_rsa_insufficient_dh
+@@ -520,6 +522,7 @@ def test_suite_b_192_rsa_insufficient_dh
  
      dev[0].connect("test-suite-b", key_mgmt="WPA-EAP-SUITE-B-192",
                     ieee80211w="2",
@@ -1168,7 +1168,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
                     ca_cert="auth_serv/rsa3072-ca.pem",
 --- a/tests/hwsim/test_wpas_ctrl.py
 +++ b/tests/hwsim/test_wpas_ctrl.py
-@@ -1834,7 +1834,7 @@ def _test_wpas_ctrl_oom(dev):
+@@ -1842,7 +1842,7 @@ def _test_wpas_ctrl_oom(dev):
      tls = dev[0].request("GET tls_library")
      if not tls.startswith("internal"):
          tests.append(('NFC_GET_HANDOVER_SEL NDEF P2P-CR-TAG', 'FAIL',
@@ -1179,7 +1179,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
              res = dev[0].request(cmd)
 --- a/tests/hwsim/utils.py
 +++ b/tests/hwsim/utils.py
-@@ -135,7 +135,13 @@ def check_fils_sk_pfs_capa(dev):
+@@ -141,7 +141,13 @@ def check_imsi_privacy_support(dev):
  
  def check_tls_tod(dev):
      tls = dev.request("GET tls_library")
@@ -1308,7 +1308,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  		if (need_more_data) {
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -1108,6 +1108,7 @@ CFLAGS += -DCONFIG_TLSV12
+@@ -1122,6 +1122,7 @@ CFLAGS += -DCONFIG_TLSV12
  endif
  
  ifeq ($(CONFIG_TLS), wolfssl)
@@ -1316,7 +1316,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  ifdef TLS_FUNCS
  CFLAGS += -DWOLFSSL_DER_LOAD
  OBJS += ../src/crypto/tls_wolfssl.o
-@@ -1123,6 +1124,7 @@ LIBS_p += -lwolfssl -lm
+@@ -1137,6 +1138,7 @@ LIBS_p += -lwolfssl -lm
  endif
  
  ifeq ($(CONFIG_TLS), openssl)
@@ -1324,7 +1324,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  CFLAGS += -DCRYPTO_RSA_OAEP_SHA256
  ifdef TLS_FUNCS
  CFLAGS += -DEAP_TLS_OPENSSL
-@@ -1150,6 +1152,7 @@ CFLAGS += -DTLS_DEFAULT_CIPHERS=\"$(CONF
+@@ -1164,6 +1166,7 @@ CFLAGS += -DTLS_DEFAULT_CIPHERS=\"$(CONF
  endif
  
  ifeq ($(CONFIG_TLS), mbedtls)
@@ -1332,7 +1332,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  ifndef CONFIG_CRYPTO
  CONFIG_CRYPTO=mbedtls
  endif
-@@ -1169,6 +1172,7 @@ endif
+@@ -1183,6 +1186,7 @@ endif
  endif
  
  ifeq ($(CONFIG_TLS), gnutls)
@@ -1340,7 +1340,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  ifndef CONFIG_CRYPTO
  # default to libgcrypt
  CONFIG_CRYPTO=gnutls
-@@ -1199,6 +1203,7 @@ endif
+@@ -1213,6 +1217,7 @@ endif
  endif
  
  ifeq ($(CONFIG_TLS), internal)
@@ -1348,7 +1348,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  ifndef CONFIG_CRYPTO
  CONFIG_CRYPTO=internal
  endif
-@@ -1279,6 +1284,7 @@ endif
+@@ -1293,6 +1298,7 @@ endif
  endif
  
  ifeq ($(CONFIG_TLS), linux)
diff --git a/package/network/services/hostapd/patches/150-add-NULL-checks-encountered-during-tests-hwsim.patch b/package/network/services/hostapd/patches/150-add-NULL-checks-encountered-during-tests-hwsim.patch
index 361f72614..c8c3ff33f 100644
--- a/package/network/services/hostapd/patches/150-add-NULL-checks-encountered-during-tests-hwsim.patch
+++ b/package/network/services/hostapd/patches/150-add-NULL-checks-encountered-during-tests-hwsim.patch
@@ -14,7 +14,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
 
 --- a/src/common/dpp_crypto.c
 +++ b/src/common/dpp_crypto.c
-@@ -248,6 +248,12 @@ struct crypto_ec_key * dpp_set_pubkey_po
+@@ -269,6 +269,12 @@ int dpp_get_pubkey_hash(struct crypto_ec
  
  struct crypto_ec_key * dpp_gen_keypair(const struct dpp_curve_params *curve)
  {
diff --git a/package/network/services/hostapd/patches/160-dpp_pkex-EC-point-mul-w-value-prime.patch b/package/network/services/hostapd/patches/160-dpp_pkex-EC-point-mul-w-value-prime.patch
index 56ae8d0b8..db4fcfe23 100644
--- a/package/network/services/hostapd/patches/160-dpp_pkex-EC-point-mul-w-value-prime.patch
+++ b/package/network/services/hostapd/patches/160-dpp_pkex-EC-point-mul-w-value-prime.patch
@@ -13,7 +13,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
 
 --- a/src/common/dpp_crypto.c
 +++ b/src/common/dpp_crypto.c
-@@ -1567,7 +1567,9 @@ dpp_pkex_derive_Qr(const struct dpp_curv
+@@ -1588,7 +1588,9 @@ dpp_pkex_derive_Qr(const struct dpp_curv
  	Pr = crypto_ec_key_get_public_key(Pr_key);
  	Qr = crypto_ec_point_init(ec);
  	hash_bn = crypto_bignum_init_set(hash, curve->hash_len);
diff --git a/package/network/services/hostapd/patches/170-DPP-fix-memleak-of-intro.peer_key.patch b/package/network/services/hostapd/patches/170-DPP-fix-memleak-of-intro.peer_key.patch
deleted file mode 100644
index 157347d6d..000000000
--- a/package/network/services/hostapd/patches/170-DPP-fix-memleak-of-intro.peer_key.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 639bb1bb912029ec4ff110c3ed807b62f583d6bf Mon Sep 17 00:00:00 2001
-From: Glenn Strauss <gstrauss@gluelogic.com>
-Date: Sun, 9 Oct 2022 04:02:44 -0400
-Subject: [PATCH 7/7] DPP: fix memleak of intro.peer_key
-
-fix memleak of intro.peer_key in wpas_dpp_rx_peer_disc_resp()
-
-Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
----
- wpa_supplicant/dpp_supplicant.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
---- a/wpa_supplicant/dpp_supplicant.c
-+++ b/wpa_supplicant/dpp_supplicant.c
-@@ -2610,6 +2610,8 @@ static void wpas_dpp_rx_peer_disc_resp(s
- 		return;
- 	}
- 
-+	os_memset(&intro, 0, sizeof(intro));
-+
- 	trans_id = dpp_get_attr(buf, len, DPP_ATTR_TRANSACTION_ID,
- 			       &trans_id_len);
- 	if (!trans_id || trans_id_len != 1) {
-@@ -2720,7 +2722,7 @@ static void wpas_dpp_rx_peer_disc_resp(s
- 		wpa_supplicant_req_scan(wpa_s, 0, 0);
- 	}
- fail:
--	os_memset(&intro, 0, sizeof(intro));
-+	dpp_peer_intro_deinit(&intro);
- }
- 
- 
diff --git a/package/network/services/hostapd/patches/170-wpa_supplicant-fix-compiling-without-IEEE8021X_EAPOL.patch b/package/network/services/hostapd/patches/170-wpa_supplicant-fix-compiling-without-IEEE8021X_EAPOL.patch
new file mode 100644
index 000000000..7724f1ae8
--- /dev/null
+++ b/package/network/services/hostapd/patches/170-wpa_supplicant-fix-compiling-without-IEEE8021X_EAPOL.patch
@@ -0,0 +1,41 @@
+From c85ce84d942e1eabde33e120b18e5b1f1637b76e Mon Sep 17 00:00:00 2001
+From: Nick Hainke <vincent@systemli.org>
+Date: Tue, 14 Mar 2023 21:40:53 +0100
+Subject: [PATCH] wpa_supplicant: fix compiling without IEEE8021X_EAPOL
+
+If IEEE8021X_EAPOL is not defined wpa_supplicant will not compile with
+following error:
+
+  events.c: In function 'wpa_supplicant_connect':
+  events.c:1827:14: warning: implicit declaration of function 'eap_is_wps_pbc_enrollee' [-Wimplicit-function-declaration]
+   1827 |         if ((eap_is_wps_pbc_enrollee(&ssid->eap) &&
+        |              ^~~~~~~~~~~~~~~~~~~~~~~
+  events.c:1827:43: error: 'struct wpa_ssid' has no member named 'eap'
+   1827 |         if ((eap_is_wps_pbc_enrollee(&ssid->eap) &&
+        |                                           ^~
+
+Adding ifdef statements around the calling function fixes the issue.
+
+Signed-off-by: Nick Hainke <vincent@systemli.org>
+---
+ wpa_supplicant/events.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/wpa_supplicant/events.c
++++ b/wpa_supplicant/events.c
+@@ -1824,6 +1824,7 @@ int wpa_supplicant_connect(struct wpa_su
+ 			   struct wpa_bss *selected,
+ 			   struct wpa_ssid *ssid)
+ {
++#ifdef IEEE8021X_EAPOL
+ 	if ((eap_is_wps_pbc_enrollee(&ssid->eap) &&
+ 	     wpas_wps_partner_link_overlap_detect(wpa_s)) ||
+ 	    wpas_wps_scan_pbc_overlap(wpa_s, selected, ssid)) {
+@@ -1846,6 +1847,7 @@ int wpa_supplicant_connect(struct wpa_su
+ #endif /* CONFIG_WPS */
+ 		return -1;
+ 	}
++#endif /* IEEE8021X_EAPOL */
+ 
+ 	wpa_msg(wpa_s, MSG_DEBUG,
+ 		"Considering connect request: reassociate: %d  selected: "
diff --git a/package/network/services/hostapd/patches/200-multicall.patch b/package/network/services/hostapd/patches/200-multicall.patch
index 0db8caa20..f12aeb0ca 100644
--- a/package/network/services/hostapd/patches/200-multicall.patch
+++ b/package/network/services/hostapd/patches/200-multicall.patch
@@ -36,7 +36,7 @@
  LIBS += $(DRV_AP_LIBS)
  
  ifdef CONFIG_L2_PACKET
-@@ -1378,6 +1384,12 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
+@@ -1380,6 +1386,12 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
  _OBJS_VAR := OBJS
  include ../src/objs.mk
  
@@ -49,7 +49,7 @@
  hostapd: $(OBJS)
  	$(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
  	@$(E) "  LD " $@
-@@ -1458,6 +1470,12 @@ include ../src/objs.mk
+@@ -1460,6 +1472,12 @@ include ../src/objs.mk
  _OBJS_VAR := SOBJS
  include ../src/objs.mk
  
@@ -71,8 +71,8 @@
 +-include $(if $(MULTICALL),../hostapd/.config)
  include ../src/build.rules
  
- ifdef CONFIG_BUILD_WPA_CLIENT_SO
-@@ -371,7 +372,9 @@ endif
+ ifdef CONFIG_BUILD_PASN_SO
+@@ -382,7 +383,9 @@ endif
  ifdef CONFIG_IBSS_RSN
  NEED_RSN_AUTHENTICATOR=y
  CFLAGS += -DCONFIG_IBSS_RSN
@@ -82,7 +82,7 @@
  OBJS += ibss_rsn.o
  endif
  
-@@ -912,6 +915,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
+@@ -924,6 +927,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
  CFLAGS += -DCONFIG_DYNAMIC_EAP_METHODS
  LIBS += -ldl -rdynamic
  endif
@@ -93,7 +93,7 @@
  endif
  
  ifdef CONFIG_AP
-@@ -919,9 +926,11 @@ NEED_EAP_COMMON=y
+@@ -931,9 +938,11 @@ NEED_EAP_COMMON=y
  NEED_RSN_AUTHENTICATOR=y
  CFLAGS += -DCONFIG_AP
  OBJS += ap.o
@@ -105,7 +105,7 @@
  OBJS += ../src/ap/hostapd.o
  OBJS += ../src/ap/wpa_auth_glue.o
  OBJS += ../src/ap/utils.o
-@@ -1008,6 +1017,12 @@ endif
+@@ -1022,6 +1031,12 @@ endif
  ifdef CONFIG_HS20
  OBJS += ../src/ap/hs20.o
  endif
@@ -118,7 +118,7 @@
  endif
  
  ifdef CONFIG_MBO
-@@ -1016,7 +1031,9 @@ CFLAGS += -DCONFIG_MBO
+@@ -1030,7 +1045,9 @@ CFLAGS += -DCONFIG_MBO
  endif
  
  ifdef NEED_RSN_AUTHENTICATOR
@@ -128,7 +128,7 @@
  NEED_AES_WRAP=y
  OBJS += ../src/ap/wpa_auth.o
  OBJS += ../src/ap/wpa_auth_ie.o
-@@ -1996,6 +2013,12 @@ wpa_priv: $(BCHECK) $(OBJS_priv)
+@@ -2010,6 +2027,12 @@ wpa_priv: $(BCHECK) $(OBJS_priv)
  
  _OBJS_VAR := OBJS
  include ../src/objs.mk
@@ -141,7 +141,7 @@
  wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs)
  	$(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
  	@$(E) "  LD " $@
-@@ -2128,6 +2151,12 @@ eap_gpsk.so: $(SRC_EAP_GPSK)
+@@ -2142,6 +2165,12 @@ eap_gpsk.so: $(SRC_EAP_GPSK)
  	$(Q)sed -e 's|\@BINDIR\@|$(BINDIR)|g' $< >$@
  	@$(E) "  sed" $<
  
@@ -156,7 +156,7 @@
  wpa_cli.exe: wpa_cli
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -6171,8 +6171,8 @@ union wpa_event_data {
+@@ -6544,8 +6544,8 @@ union wpa_event_data {
   * Driver wrapper code should call this function whenever an event is received
   * from the driver.
   */
@@ -167,7 +167,7 @@
  
  /**
   * wpa_supplicant_event_global - Report a driver event for wpa_supplicant
-@@ -6184,7 +6184,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -6557,7 +6557,7 @@ void wpa_supplicant_event(void *ctx, enu
   * Same as wpa_supplicant_event(), but we search for the interface in
   * wpa_global.
   */
@@ -178,7 +178,7 @@
  /*
 --- a/src/ap/drv_callbacks.c
 +++ b/src/ap/drv_callbacks.c
-@@ -1872,8 +1872,8 @@ err:
+@@ -1887,8 +1887,8 @@ err:
  #endif /* CONFIG_OWE */
  
  
@@ -189,7 +189,7 @@
  {
  	struct hostapd_data *hapd = ctx;
  #ifndef CONFIG_NO_STDOUT_DEBUG
-@@ -2145,7 +2145,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -2161,7 +2161,7 @@ void wpa_supplicant_event(void *ctx, enu
  }
  
  
@@ -200,7 +200,7 @@
  	struct hapd_interfaces *interfaces = ctx;
 --- a/wpa_supplicant/wpa_priv.c
 +++ b/wpa_supplicant/wpa_priv.c
-@@ -1038,8 +1038,8 @@ static void wpa_priv_send_ft_response(st
+@@ -1039,8 +1039,8 @@ static void wpa_priv_send_ft_response(st
  }
  
  
@@ -211,7 +211,7 @@
  {
  	struct wpa_priv_interface *iface = ctx;
  
-@@ -1102,7 +1102,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -1103,7 +1103,7 @@ void wpa_supplicant_event(void *ctx, enu
  }
  
  
@@ -220,7 +220,7 @@
  				 union wpa_event_data *data)
  {
  	struct wpa_priv_global *global = ctx;
-@@ -1216,6 +1216,8 @@ int main(int argc, char *argv[])
+@@ -1217,6 +1217,8 @@ int main(int argc, char *argv[])
  	if (os_program_init())
  		return -1;
  
@@ -231,7 +231,7 @@
  	os_memset(&global, 0, sizeof(global));
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -4953,8 +4953,8 @@ static void wpas_event_unprot_beacon(str
+@@ -5237,8 +5237,8 @@ static void wpas_event_unprot_beacon(str
  }
  
  
@@ -242,7 +242,7 @@
  {
  	struct wpa_supplicant *wpa_s = ctx;
  	int resched;
-@@ -5813,7 +5813,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -6149,7 +6149,7 @@ void wpa_supplicant_event(void *ctx, enu
  }
  
  
@@ -253,7 +253,7 @@
  	struct wpa_supplicant *wpa_s;
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -7087,7 +7087,6 @@ struct wpa_interface * wpa_supplicant_ma
+@@ -7408,7 +7408,6 @@ struct wpa_interface * wpa_supplicant_ma
  	return NULL;
  }
  
@@ -261,7 +261,7 @@
  /**
   * wpa_supplicant_match_existing - Match existing interfaces
   * @global: Pointer to global data from wpa_supplicant_init()
-@@ -7122,6 +7121,11 @@ static int wpa_supplicant_match_existing
+@@ -7443,6 +7442,11 @@ static int wpa_supplicant_match_existing
  
  #endif /* CONFIG_MATCH_IFACE */
  
@@ -273,7 +273,7 @@
  
  /**
   * wpa_supplicant_add_iface - Add a new network interface
-@@ -7378,6 +7382,8 @@ struct wpa_global * wpa_supplicant_init(
+@@ -7699,6 +7703,8 @@ struct wpa_global * wpa_supplicant_init(
  #ifndef CONFIG_NO_WPA_MSG
  	wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
  #endif /* CONFIG_NO_WPA_MSG */
@@ -284,7 +284,7 @@
  		wpa_debug_open_file(params->wpa_debug_file_path);
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -591,6 +591,11 @@ fail:
+@@ -595,6 +595,11 @@ fail:
  	return -1;
  }
  
@@ -296,7 +296,7 @@
  
  #ifdef CONFIG_WPS
  static int gen_uuid(const char *txt_addr)
-@@ -684,6 +689,8 @@ int main(int argc, char *argv[])
+@@ -688,6 +693,8 @@ int main(int argc, char *argv[])
  		return -1;
  #endif /* CONFIG_DPP */
  
diff --git a/package/network/services/hostapd/patches/300-noscan.patch b/package/network/services/hostapd/patches/300-noscan.patch
index a0e00c4d5..91e1aaad8 100644
--- a/package/network/services/hostapd/patches/300-noscan.patch
+++ b/package/network/services/hostapd/patches/300-noscan.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -3439,6 +3439,10 @@ static int hostapd_config_fill(struct ho
+@@ -3446,6 +3446,10 @@ static int hostapd_config_fill(struct ho
  		if (bss->ocv && !bss->ieee80211w)
  			bss->ieee80211w = 1;
  #endif /* CONFIG_OCV */
@@ -13,7 +13,7 @@
  	} else if (os_strcmp(buf, "ht_capab") == 0) {
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -1043,6 +1043,8 @@ struct hostapd_config {
+@@ -1061,6 +1061,8 @@ struct hostapd_config {
  
  	int ht_op_mode_fixed;
  	u16 ht_capab;
diff --git a/package/network/services/hostapd/patches/301-mesh-noscan.patch b/package/network/services/hostapd/patches/301-mesh-noscan.patch
index 998540198..8a1bdaa18 100644
--- a/package/network/services/hostapd/patches/301-mesh-noscan.patch
+++ b/package/network/services/hostapd/patches/301-mesh-noscan.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/config.c
 +++ b/wpa_supplicant/config.c
-@@ -2555,6 +2555,7 @@ static const struct parse_data ssid_fiel
+@@ -2599,6 +2599,7 @@ static const struct parse_data ssid_fiel
  #else /* CONFIG_MESH */
  	{ INT_RANGE(mode, 0, 4) },
  #endif /* CONFIG_MESH */
@@ -10,7 +10,7 @@
  	{ STR(id_str) },
 --- a/wpa_supplicant/config_file.c
 +++ b/wpa_supplicant/config_file.c
-@@ -766,6 +766,7 @@ static void wpa_config_write_network(FIL
+@@ -775,6 +775,7 @@ static void wpa_config_write_network(FIL
  #endif /* IEEE8021X_EAPOL */
  	INT(mode);
  	INT(no_auto_peer);
@@ -31,36 +31,36 @@
  		/*
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2463,7 +2463,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2693,7 +2693,7 @@ static bool ibss_mesh_can_use_vht(struct
+ 				  const struct wpa_ssid *ssid,
+ 				  struct hostapd_hw_modes *mode)
+ {
+-	if (mode->mode != HOSTAPD_MODE_IEEE80211A)
++	if (mode->mode != HOSTAPD_MODE_IEEE80211A && !(ssid->noscan))
+ 		return false;
+ 
+ 	if (!drv_supports_vht(wpa_s, ssid))
+@@ -2766,7 +2766,7 @@ static void ibss_mesh_select_40mhz(struc
+ 	int i, res;
+ 	unsigned int j;
+ 	static const int ht40plus[] = {
+-		36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157, 165, 173,
++		1, 2, 3, 4, 5, 6, 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157, 165, 173,
+ 		184, 192
+ 	};
+ 	int ht40 = -1;
+@@ -3016,7 +3016,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
  	int ieee80211_mode = wpas_mode_to_ieee80211_mode(ssid->mode);
  	enum hostapd_hw_mode hw_mode;
  	struct hostapd_hw_modes *mode = NULL;
--	int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
-+	int ht40plus[] = { 1, 2, 3, 4, 5, 6, 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
- 			   184, 192 };
- 	int bw80[] = { 5180, 5260, 5500, 5580, 5660, 5745, 5955,
- 		       6035, 6115, 6195, 6275, 6355, 6435, 6515,
-@@ -2471,7 +2471,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
- 	int bw160[] = { 5955, 6115, 6275, 6435, 6595, 6755, 6915 };
- 	struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
+-	int i, obss_scan = 1;
++	int i, obss_scan = !(ssid->noscan);
  	u8 channel;
--	int i, chan_idx, ht40 = -1, res, obss_scan = 1;
-+	int i, chan_idx, ht40 = -1, res, obss_scan = !(ssid->noscan);
- 	unsigned int j, k;
- 	struct hostapd_freq_params vht_freq;
- 	int chwidth, seg0, seg1;
-@@ -2562,7 +2562,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
- #endif /* CONFIG_HE_OVERRIDES */
- 
- 	/* Setup higher BW only for 5 GHz */
--	if (mode->mode != HOSTAPD_MODE_IEEE80211A)
-+	if (mode->mode != HOSTAPD_MODE_IEEE80211A && !(ssid->noscan))
- 		return;
- 
- 	for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
+ 	bool is_6ghz;
+ 	bool dfs_enabled = wpa_s->conf->country[0] && (wpa_s->drv_flags & WPA_DRIVER_FLAGS_RADAR);
 --- a/wpa_supplicant/config_ssid.h
 +++ b/wpa_supplicant/config_ssid.h
-@@ -981,6 +981,8 @@ struct wpa_ssid {
+@@ -1035,6 +1035,8 @@ struct wpa_ssid {
  	 */
  	int no_auto_peer;
  
diff --git a/package/network/services/hostapd/patches/310-rescan_immediately.patch b/package/network/services/hostapd/patches/310-rescan_immediately.patch
index 2c2541947..033f76309 100644
--- a/package/network/services/hostapd/patches/310-rescan_immediately.patch
+++ b/package/network/services/hostapd/patches/310-rescan_immediately.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -5419,7 +5419,7 @@ wpa_supplicant_alloc(struct wpa_supplica
+@@ -5713,7 +5713,7 @@ wpa_supplicant_alloc(struct wpa_supplica
  	if (wpa_s == NULL)
  		return NULL;
  	wpa_s->scan_req = INITIAL_SCAN_REQ;
diff --git a/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch b/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch
index 8218a439a..93a03a6db 100644
--- a/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch
+++ b/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch
@@ -1,6 +1,6 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -5022,7 +5022,7 @@ static int nl80211_set_channel(struct i8
+@@ -5224,7 +5224,7 @@ static int nl80211_set_channel(struct i8
  		   freq->he_enabled, freq->eht_enabled, freq->bandwidth,
  		   freq->center_freq1, freq->center_freq2);
  
diff --git a/package/network/services/hostapd/patches/340-reload_freq_change.patch b/package/network/services/hostapd/patches/340-reload_freq_change.patch
index b59107463..9a468079d 100644
--- a/package/network/services/hostapd/patches/340-reload_freq_change.patch
+++ b/package/network/services/hostapd/patches/340-reload_freq_change.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -119,6 +119,29 @@ static void hostapd_reload_bss(struct ho
+@@ -142,6 +142,29 @@ static void hostapd_reload_bss(struct ho
  #endif /* CONFIG_NO_RADIUS */
  
  	ssid = &hapd->conf->ssid;
@@ -30,7 +30,7 @@
  	if (!ssid->wpa_psk_set && ssid->wpa_psk && !ssid->wpa_psk->next &&
  	    ssid->wpa_passphrase_set && ssid->wpa_passphrase) {
  		/*
-@@ -220,6 +243,7 @@ int hostapd_reload_config(struct hostapd
+@@ -250,6 +273,7 @@ int hostapd_reload_config(struct hostapd
  	struct hostapd_data *hapd = iface->bss[0];
  	struct hostapd_config *newconf, *oldconf;
  	size_t j;
@@ -38,7 +38,7 @@
  
  	if (iface->config_fname == NULL) {
  		/* Only in-memory config in use - assume it has been updated */
-@@ -270,24 +294,20 @@ int hostapd_reload_config(struct hostapd
+@@ -300,6 +324,17 @@ int hostapd_reload_config(struct hostapd
  	}
  	iface->conf = newconf;
  
@@ -55,6 +55,10 @@
 +
  	for (j = 0; j < iface->num_bss; j++) {
  		hapd = iface->bss[j];
+ 		if (!hapd->conf->config_id || !newconf->bss[j]->config_id ||
+@@ -307,21 +342,6 @@ int hostapd_reload_config(struct hostapd
+ 			      newconf->bss[j]->config_id) != 0)
+ 			hostapd_clear_old_bss(hapd);
  		hapd->iconf = newconf;
 -		hapd->iconf->channel = oldconf->channel;
 -		hapd->iconf->acs = oldconf->acs;
diff --git a/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch b/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch
index 29a3799b5..878445287 100644
--- a/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch
+++ b/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/ap.c
 +++ b/wpa_supplicant/ap.c
-@@ -1803,15 +1803,35 @@ int ap_switch_channel(struct wpa_supplic
+@@ -1825,15 +1825,35 @@ int ap_switch_channel(struct wpa_supplic
  
  
  #ifdef CONFIG_CTRL_IFACE
diff --git a/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch b/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch
index a88b63e91..a943395b5 100644
--- a/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch
+++ b/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch
@@ -1,34 +1,35 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -2938,11 +2938,11 @@ static int wpa_driver_nl80211_del_beacon
- 	struct wpa_driver_nl80211_data *drv = bss->drv;
+@@ -3006,12 +3006,12 @@ static int wpa_driver_nl80211_del_beacon
+ 		return 0;
  
  	wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
 -		   drv->ifindex);
 +		   bss->ifindex);
- 	bss->beacon_set = 0;
- 	bss->freq = 0;
+ 	link->beacon_set = 0;
+ 	link->freq = 0;
+ 
  	nl80211_put_wiphy_data_ap(bss);
 -	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_DEL_BEACON);
 +	msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_BEACON);
- 	return send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
- }
+ 	if (!msg)
+ 		return -ENOBUFS;
  
-@@ -5661,7 +5661,7 @@ static void nl80211_teardown_ap(struct i
+@@ -5907,7 +5907,7 @@ static void nl80211_teardown_ap(struct i
  		nl80211_mgmt_unsubscribe(bss, "AP teardown");
  
  	nl80211_put_wiphy_data_ap(bss);
--	bss->beacon_set = 0;
-+	wpa_driver_nl80211_del_beacon(bss);
+-	bss->flink->beacon_set = 0;
++	wpa_driver_nl80211_del_beacon_all(bss);
  }
  
  
-@@ -8120,8 +8120,6 @@ static int wpa_driver_nl80211_if_remove(
+@@ -8642,8 +8642,6 @@ static int wpa_driver_nl80211_if_remove(
  	} else {
  		wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
  		nl80211_teardown_ap(bss);
 -		if (!bss->added_if && !drv->first_bss->next)
--			wpa_driver_nl80211_del_beacon(bss);
+-			wpa_driver_nl80211_del_beacon_all(bss);
  		nl80211_destroy_bss(bss);
  		if (!bss->added_if)
  			i802_set_iface_flags(bss, 0);
diff --git a/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch b/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch
index 7699541fd..e9f46ce9d 100644
--- a/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch
+++ b/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -67,6 +67,7 @@
+@@ -68,6 +68,7 @@
  #include "fst/fst_ctrl_iface.h"
  #include "config_file.h"
  #include "ctrl_iface.h"
@@ -8,7 +8,7 @@
  
  
  #define HOSTAPD_CLI_DUP_VALUE_MAX_LEN 256
-@@ -82,6 +83,7 @@ static void hostapd_ctrl_iface_send(stru
+@@ -83,6 +84,7 @@ static void hostapd_ctrl_iface_send(stru
  				    enum wpa_msg_type type,
  				    const char *buf, size_t len);
  
@@ -16,7 +16,7 @@
  
  static int hostapd_ctrl_iface_attach(struct hostapd_data *hapd,
  				     struct sockaddr_storage *from,
-@@ -133,6 +135,61 @@ static int hostapd_ctrl_iface_new_sta(st
+@@ -134,6 +136,61 @@ static int hostapd_ctrl_iface_new_sta(st
  	return 0;
  }
  
@@ -78,7 +78,7 @@
  
  #ifdef NEED_AP_MLME
  static int hostapd_ctrl_iface_sa_query(struct hostapd_data *hapd,
-@@ -3449,6 +3506,8 @@ static int hostapd_ctrl_iface_receive_pr
+@@ -3529,6 +3586,8 @@ static int hostapd_ctrl_iface_receive_pr
  	} else if (os_strncmp(buf, "VENDOR ", 7) == 0) {
  		reply_len = hostapd_ctrl_iface_vendor(hapd, buf + 7, reply,
  						      reply_size);
@@ -89,7 +89,7 @@
  #ifdef RADIUS_SERVER
 --- a/src/ap/ctrl_iface_ap.c
 +++ b/src/ap/ctrl_iface_ap.c
-@@ -945,7 +945,13 @@ int hostapd_parse_csa_settings(const cha
+@@ -1008,7 +1008,13 @@ int hostapd_parse_csa_settings(const cha
  
  int hostapd_ctrl_iface_stop_ap(struct hostapd_data *hapd)
  {
diff --git a/package/network/services/hostapd/patches/370-ap_sta_support.patch b/package/network/services/hostapd/patches/370-ap_sta_support.patch
index 6faaffcf7..24064839f 100644
--- a/package/network/services/hostapd/patches/370-ap_sta_support.patch
+++ b/package/network/services/hostapd/patches/370-ap_sta_support.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -115,6 +115,8 @@ OBJS_c += ../src/utils/common.o
+@@ -126,6 +126,8 @@ OBJS_c += ../src/utils/common.o
  OBJS_c += ../src/common/cli.o
  OBJS += wmm_ac.o
  
@@ -19,7 +19,7 @@
  #include "drivers/driver.h"
  #include "eap_peer/eap.h"
  #include "wpa_supplicant_i.h"
-@@ -282,6 +283,10 @@ void calculate_update_time(const struct
+@@ -283,6 +284,10 @@ void calculate_update_time(const struct
  static void wpa_bss_copy_res(struct wpa_bss *dst, struct wpa_scan_res *src,
  			     struct os_reltime *fetch_time)
  {
@@ -30,7 +30,7 @@
  	dst->flags = src->flags;
  	os_memcpy(dst->bssid, src->bssid, ETH_ALEN);
  	dst->freq = src->freq;
-@@ -295,6 +300,15 @@ static void wpa_bss_copy_res(struct wpa_
+@@ -296,6 +301,15 @@ static void wpa_bss_copy_res(struct wpa_
  	dst->est_throughput = src->est_throughput;
  	dst->snr = src->snr;
  
@@ -154,7 +154,7 @@
  
  #ifdef CONFIG_WEP
  /* Configure default/group WEP keys for static WEP */
-@@ -1016,6 +1064,8 @@ void wpa_supplicant_set_state(struct wpa
+@@ -1026,6 +1074,8 @@ void wpa_supplicant_set_state(struct wpa
  
  		sme_sched_obss_scan(wpa_s, 1);
  
@@ -163,7 +163,7 @@
  #if defined(CONFIG_FILS) && defined(IEEE8021X_EAPOL)
  		if (!fils_hlp_sent && ssid && ssid->eap.erp)
  			update_fils_connect_params = true;
-@@ -1026,6 +1076,8 @@ void wpa_supplicant_set_state(struct wpa
+@@ -1036,6 +1086,8 @@ void wpa_supplicant_set_state(struct wpa
  #endif /* CONFIG_OWE */
  	} else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
  		   state == WPA_ASSOCIATED) {
@@ -172,7 +172,7 @@
  		wpa_s->new_connection = 1;
  		wpa_drv_set_operstate(wpa_s, 0);
  #ifndef IEEE8021X_EAPOL
-@@ -2335,6 +2387,8 @@ void wpa_supplicant_associate(struct wpa
+@@ -2520,6 +2572,8 @@ void wpa_supplicant_associate(struct wpa
  			return;
  		}
  		wpa_s->current_bss = bss;
@@ -181,7 +181,7 @@
  #else /* CONFIG_MESH */
  		wpa_msg(wpa_s, MSG_ERROR,
  			"mesh mode support not included in the build");
-@@ -6693,6 +6747,16 @@ static int wpa_supplicant_init_iface(str
+@@ -7010,6 +7064,16 @@ static int wpa_supplicant_init_iface(str
  			   sizeof(wpa_s->bridge_ifname));
  	}
  
@@ -198,7 +198,7 @@
  	/* RSNA Supplicant Key Management - INITIALIZE */
  	eapol_sm_notify_portEnabled(wpa_s->eapol, false);
  	eapol_sm_notify_portValid(wpa_s->eapol, false);
-@@ -7031,6 +7095,11 @@ static void wpa_supplicant_deinit_iface(
+@@ -7352,6 +7416,11 @@ static void wpa_supplicant_deinit_iface(
  	if (terminate)
  		wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
  
@@ -212,7 +212,7 @@
  
 --- a/wpa_supplicant/wpa_supplicant_i.h
 +++ b/wpa_supplicant/wpa_supplicant_i.h
-@@ -105,6 +105,11 @@ struct wpa_interface {
+@@ -106,6 +106,11 @@ struct wpa_interface {
  	const char *ifname;
  
  	/**
@@ -224,7 +224,7 @@
  	 * bridge_ifname - Optional bridge interface name
  	 *
  	 * If the driver interface (ifname) is included in a Linux bridge
-@@ -717,6 +722,8 @@ struct wpa_supplicant {
+@@ -665,6 +670,8 @@ struct wpa_supplicant {
  #endif /* CONFIG_CTRL_IFACE_BINDER */
  	char bridge_ifname[16];
  
@@ -235,7 +235,7 @@
  
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -2641,6 +2641,12 @@ static int hostapd_ctrl_iface_chan_switc
+@@ -2716,6 +2716,12 @@ static int hostapd_ctrl_iface_chan_switc
  		return 0;
  	}
  
@@ -250,7 +250,7 @@
  		/* Save CHAN_SWITCH VHT, HE, and EHT config */
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
-@@ -1903,11 +1903,6 @@ static int __ieee802_11_set_beacon(struc
+@@ -2052,11 +2052,6 @@ static int __ieee802_11_set_beacon(struc
  		return -1;
  	}
  
@@ -264,7 +264,7 @@
  	if (ieee802_11_build_ap_params(hapd, &params) < 0)
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -4953,6 +4953,60 @@ static void wpas_event_unprot_beacon(str
+@@ -5237,6 +5237,60 @@ static void wpas_event_unprot_beacon(str
  }
  
  
@@ -325,7 +325,7 @@
  void supplicant_event(void *ctx, enum wpa_event_type event,
  		      union wpa_event_data *data)
  {
-@@ -5268,8 +5322,10 @@ void supplicant_event(void *ctx, enum wp
+@@ -5586,8 +5640,10 @@ void supplicant_event(void *ctx, enum wp
  			channel_width_to_string(data->ch_switch.ch_width),
  			data->ch_switch.cf1,
  			data->ch_switch.cf2);
@@ -339,7 +339,7 @@
  		wpa_s->current_ssid->frequency = data->ch_switch.freq;
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -5968,6 +5968,7 @@ union wpa_event_data {
+@@ -6324,6 +6324,7 @@ union wpa_event_data {
  
  	/**
  	 * struct ch_switch
@@ -347,8 +347,8 @@
  	 * @freq: Frequency of new channel in MHz
  	 * @ht_enabled: Whether this is an HT channel
  	 * @ch_offset: Secondary channel offset
-@@ -5976,6 +5977,7 @@ union wpa_event_data {
- 	 * @cf2: Center frequency 2
+@@ -6334,6 +6335,7 @@ union wpa_event_data {
+ 	 * @punct_bitmap: Puncturing bitmap
  	 */
  	struct ch_switch {
 +		int count;
@@ -357,16 +357,15 @@
  		int ch_offset;
 --- a/src/drivers/driver_nl80211_event.c
 +++ b/src/drivers/driver_nl80211_event.c
-@@ -694,7 +694,7 @@ static void mlme_event_ch_switch(struct
- 				 struct nlattr *ifindex, struct nlattr *freq,
- 				 struct nlattr *type, struct nlattr *bw,
- 				 struct nlattr *cf1, struct nlattr *cf2,
--				 int finished)
-+				 struct nlattr *count, int finished)
+@@ -997,6 +997,7 @@ static void mlme_event_ch_switch(struct
+ 				 struct nlattr *bw, struct nlattr *cf1,
+ 				 struct nlattr *cf2,
+ 				 struct nlattr *punct_bitmap,
++				 struct nlattr *count,
+ 				 int finished)
  {
  	struct i802_bss *bss;
- 	union wpa_event_data data;
-@@ -755,6 +755,8 @@ static void mlme_event_ch_switch(struct
+@@ -1060,6 +1061,8 @@ static void mlme_event_ch_switch(struct
  		data.ch_switch.cf1 = nla_get_u32(cf1);
  	if (cf2)
  		data.ch_switch.cf2 = nla_get_u32(cf2);
@@ -374,19 +373,19 @@
 +		data.ch_switch.count = nla_get_u32(count);
  
  	if (finished)
- 		bss->freq = data.ch_switch.freq;
-@@ -3113,6 +3115,7 @@ static void do_process_drv_event(struct
- 				     tb[NL80211_ATTR_CHANNEL_WIDTH],
+ 		bss->flink->freq = data.ch_switch.freq;
+@@ -3604,6 +3607,7 @@ static void do_process_drv_event(struct
  				     tb[NL80211_ATTR_CENTER_FREQ1],
  				     tb[NL80211_ATTR_CENTER_FREQ2],
+ 				     tb[NL80211_ATTR_PUNCT_BITMAP],
 +				     tb[NL80211_ATTR_CH_SWITCH_COUNT],
  				     0);
  		break;
  	case NL80211_CMD_CH_SWITCH_NOTIFY:
-@@ -3123,6 +3126,7 @@ static void do_process_drv_event(struct
- 				     tb[NL80211_ATTR_CHANNEL_WIDTH],
+@@ -3616,6 +3620,7 @@ static void do_process_drv_event(struct
  				     tb[NL80211_ATTR_CENTER_FREQ1],
  				     tb[NL80211_ATTR_CENTER_FREQ2],
+ 				     tb[NL80211_ATTR_PUNCT_BITMAP],
 +				     NULL,
  				     1);
  		break;
diff --git a/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch b/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch
index 1f78c42de..b886ab749 100644
--- a/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch
+++ b/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch
@@ -12,7 +12,7 @@
  else
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -3265,6 +3265,7 @@ static int hostapd_ctrl_iface_receive_pr
+@@ -3342,6 +3342,7 @@ static int hostapd_ctrl_iface_receive_pr
  						      reply_size);
  	} else if (os_strcmp(buf, "STATUS-DRIVER") == 0) {
  		reply_len = hostapd_drv_status(hapd, reply, reply_size);
@@ -20,7 +20,7 @@
  	} else if (os_strcmp(buf, "MIB") == 0) {
  		reply_len = ieee802_11_get_mib(hapd, reply, reply_size);
  		if (reply_len >= 0) {
-@@ -3306,6 +3307,7 @@ static int hostapd_ctrl_iface_receive_pr
+@@ -3383,6 +3384,7 @@ static int hostapd_ctrl_iface_receive_pr
  	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
  		reply_len = hostapd_ctrl_iface_sta_next(hapd, buf + 9, reply,
  							reply_size);
@@ -30,7 +30,7 @@
  			reply_len = -1;
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -973,6 +973,9 @@ ifdef CONFIG_FILS
+@@ -985,6 +985,9 @@ ifdef CONFIG_FILS
  OBJS += ../src/ap/fils_hlp.o
  endif
  ifdef CONFIG_CTRL_IFACE
@@ -42,7 +42,7 @@
  
 --- a/wpa_supplicant/ctrl_iface.c
 +++ b/wpa_supplicant/ctrl_iface.c
-@@ -2325,7 +2325,7 @@ static int wpa_supplicant_ctrl_iface_sta
+@@ -2326,7 +2326,7 @@ static int wpa_supplicant_ctrl_iface_sta
  			pos += ret;
  		}
  
@@ -51,7 +51,7 @@
  		if (wpa_s->ap_iface) {
  			pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos,
  							    end - pos,
-@@ -11565,6 +11565,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -11964,6 +11964,7 @@ char * wpa_supplicant_ctrl_iface_process
  			reply_len = -1;
  	} else if (os_strncmp(buf, "NOTE ", 5) == 0) {
  		wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
@@ -59,7 +59,7 @@
  	} else if (os_strcmp(buf, "MIB") == 0) {
  		reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
  		if (reply_len >= 0) {
-@@ -11577,6 +11578,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -11976,6 +11977,7 @@ char * wpa_supplicant_ctrl_iface_process
  				reply_size - reply_len);
  #endif /* CONFIG_MACSEC */
  		}
@@ -67,7 +67,7 @@
  	} else if (os_strncmp(buf, "STATUS", 6) == 0) {
  		reply_len = wpa_supplicant_ctrl_iface_status(
  			wpa_s, buf + 6, reply, reply_size);
-@@ -12065,6 +12067,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -12464,6 +12466,7 @@ char * wpa_supplicant_ctrl_iface_process
  		reply_len = wpa_supplicant_ctrl_iface_bss(
  			wpa_s, buf + 4, reply, reply_size);
  #ifdef CONFIG_AP
@@ -75,7 +75,7 @@
  	} else if (os_strcmp(buf, "STA-FIRST") == 0) {
  		reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
  	} else if (os_strncmp(buf, "STA ", 4) == 0) {
-@@ -12073,12 +12076,15 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -12472,12 +12475,15 @@ char * wpa_supplicant_ctrl_iface_process
  	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
  		reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
  						   reply_size);
@@ -93,15 +93,61 @@
  			reply_len = -1;
 --- a/src/ap/ctrl_iface_ap.c
 +++ b/src/ap/ctrl_iface_ap.c
-@@ -26,6 +26,7 @@
+@@ -26,6 +26,26 @@
  #include "taxonomy.h"
  #include "wnm_ap.h"
  
++static const char * hw_mode_str(enum hostapd_hw_mode mode)
++{
++	switch (mode) {
++	case HOSTAPD_MODE_IEEE80211B:
++		return "b";
++	case HOSTAPD_MODE_IEEE80211G:
++		return "g";
++	case HOSTAPD_MODE_IEEE80211A:
++		return "a";
++	case HOSTAPD_MODE_IEEE80211AD:
++		return "ad";
++	case HOSTAPD_MODE_IEEE80211ANY:
++		return "any";
++	case NUM_HOSTAPD_MODES:
++		return "invalid";
++	}
++	return "unknown";
++}
++
 +#ifdef CONFIG_CTRL_IFACE_MIB
  
  static size_t hostapd_write_ht_mcs_bitmask(char *buf, size_t buflen,
  					   size_t curr_len, const u8 *mcs_set)
-@@ -460,6 +461,7 @@ int hostapd_ctrl_iface_sta_next(struct h
+@@ -212,26 +232,6 @@ static const char * timeout_next_str(int
+ }
+ 
+ 
+-static const char * hw_mode_str(enum hostapd_hw_mode mode)
+-{
+-	switch (mode) {
+-	case HOSTAPD_MODE_IEEE80211B:
+-		return "b";
+-	case HOSTAPD_MODE_IEEE80211G:
+-		return "g";
+-	case HOSTAPD_MODE_IEEE80211A:
+-		return "a";
+-	case HOSTAPD_MODE_IEEE80211AD:
+-		return "ad";
+-	case HOSTAPD_MODE_IEEE80211ANY:
+-		return "any";
+-	case NUM_HOSTAPD_MODES:
+-		return "invalid";
+-	}
+-	return "unknown";
+-}
+-
+-
+ static int hostapd_ctrl_iface_sta_mib(struct hostapd_data *hapd,
+ 				      struct sta_info *sta,
+ 				      char *buf, size_t buflen)
+@@ -493,6 +493,7 @@ int hostapd_ctrl_iface_sta_next(struct h
  	return hostapd_ctrl_iface_sta_mib(hapd, sta->next, buf, buflen);
  }
  
@@ -109,7 +155,7 @@
  
  #ifdef CONFIG_P2P_MANAGER
  static int p2p_manager_disconnect(struct hostapd_data *hapd, u16 stype,
-@@ -832,12 +834,12 @@ int hostapd_ctrl_iface_status(struct hos
+@@ -884,12 +885,12 @@ int hostapd_ctrl_iface_status(struct hos
  			return len;
  		len += ret;
  	}
@@ -126,7 +172,7 @@
  		if (os_snprintf_error(buflen - len, ret))
 --- a/src/ap/ieee802_1x.c
 +++ b/src/ap/ieee802_1x.c
-@@ -2740,6 +2740,7 @@ static const char * bool_txt(bool val)
+@@ -2753,6 +2753,7 @@ static const char * bool_txt(bool val)
  	return val ? "TRUE" : "FALSE";
  }
  
@@ -134,7 +180,7 @@
  
  int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
  {
-@@ -2926,6 +2927,7 @@ int ieee802_1x_get_mib_sta(struct hostap
+@@ -2939,6 +2940,7 @@ int ieee802_1x_get_mib_sta(struct hostap
  	return len;
  }
  
@@ -144,7 +190,7 @@
  static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx)
 --- a/src/ap/wpa_auth.c
 +++ b/src/ap/wpa_auth.c
-@@ -4559,6 +4559,7 @@ static const char * wpa_bool_txt(int val
+@@ -4786,6 +4786,7 @@ static const char * wpa_bool_txt(int val
  	return val ? "TRUE" : "FALSE";
  }
  
@@ -152,7 +198,7 @@
  
  #define RSN_SUITE "%02x-%02x-%02x-%d"
  #define RSN_SUITE_ARG(s) \
-@@ -4709,7 +4710,7 @@ int wpa_get_mib_sta(struct wpa_state_mac
+@@ -4938,7 +4939,7 @@ int wpa_get_mib_sta(struct wpa_state_mac
  
  	return len;
  }
@@ -163,7 +209,7 @@
  {
 --- a/src/rsn_supp/wpa.c
 +++ b/src/rsn_supp/wpa.c
-@@ -2802,6 +2802,8 @@ static u32 wpa_key_mgmt_suite(struct wpa
+@@ -3834,6 +3834,8 @@ static u32 wpa_key_mgmt_suite(struct wpa
  }
  
  
@@ -172,7 +218,7 @@
  #define RSN_SUITE "%02x-%02x-%02x-%d"
  #define RSN_SUITE_ARG(s) \
  ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
-@@ -2883,6 +2885,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch
+@@ -3915,6 +3917,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch
  
  	return (int) len;
  }
@@ -182,7 +228,7 @@
  
 --- a/wpa_supplicant/ap.c
 +++ b/wpa_supplicant/ap.c
-@@ -1477,7 +1477,7 @@ int wpas_ap_wps_nfc_report_handover(stru
+@@ -1499,7 +1499,7 @@ int wpas_ap_wps_nfc_report_handover(stru
  #endif /* CONFIG_WPS */
  
  
diff --git a/package/network/services/hostapd/patches/381-hostapd_cli_UNKNOWN-COMMAND.patch b/package/network/services/hostapd/patches/381-hostapd_cli_UNKNOWN-COMMAND.patch
index d2414faf0..e9083f6ec 100644
--- a/package/network/services/hostapd/patches/381-hostapd_cli_UNKNOWN-COMMAND.patch
+++ b/package/network/services/hostapd/patches/381-hostapd_cli_UNKNOWN-COMMAND.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
-@@ -744,7 +744,7 @@ static int wpa_ctrl_command_sta(struct w
+@@ -757,7 +757,7 @@ static int wpa_ctrl_command_sta(struct w
  	}
  
  	buf[len] = '\0';
diff --git a/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch b/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch
index bf481c3ba..40c39ff29 100644
--- a/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch
+++ b/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch
@@ -1,6 +1,6 @@
 --- a/src/common/wpa_common.c
 +++ b/src/common/wpa_common.c
-@@ -2529,6 +2529,31 @@ u32 wpa_akm_to_suite(int akm)
+@@ -2719,6 +2719,31 @@ u32 wpa_akm_to_suite(int akm)
  }
  
  
@@ -32,7 +32,7 @@
  int wpa_compare_rsn_ie(int ft_initial_assoc,
  		       const u8 *ie1, size_t ie1len,
  		       const u8 *ie2, size_t ie2len)
-@@ -2536,8 +2561,19 @@ int wpa_compare_rsn_ie(int ft_initial_as
+@@ -2726,8 +2751,19 @@ int wpa_compare_rsn_ie(int ft_initial_as
  	if (ie1 == NULL || ie2 == NULL)
  		return -1;
  
diff --git a/package/network/services/hostapd/patches/410-limit_debug_messages.patch b/package/network/services/hostapd/patches/410-limit_debug_messages.patch
index d2713fc29..48a558920 100644
--- a/package/network/services/hostapd/patches/410-limit_debug_messages.patch
+++ b/package/network/services/hostapd/patches/410-limit_debug_messages.patch
@@ -60,7 +60,7 @@
  #ifdef CONFIG_DEBUG_FILE
  static char *last_path = NULL;
  #endif /* CONFIG_DEBUG_FILE */
-@@ -636,7 +610,7 @@ void wpa_msg_register_ifname_cb(wpa_msg_
+@@ -644,7 +618,7 @@ void wpa_msg_register_ifname_cb(wpa_msg_
  }
  
  
@@ -69,7 +69,7 @@
  {
  	va_list ap;
  	char *buf;
-@@ -674,7 +648,7 @@ void wpa_msg(void *ctx, int level, const
+@@ -682,7 +656,7 @@ void wpa_msg(void *ctx, int level, const
  }
  
  
@@ -80,9 +80,9 @@
  	char *buf;
 --- a/src/utils/wpa_debug.h
 +++ b/src/utils/wpa_debug.h
-@@ -50,6 +50,17 @@ int wpa_debug_reopen_file(void);
- void wpa_debug_close_file(void);
+@@ -51,6 +51,17 @@ void wpa_debug_close_file(void);
  void wpa_debug_setup_stdout(void);
+ void wpa_debug_stop_log(void);
  
 +/* internal */
 +void _wpa_hexdump(int level, const char *title, const u8 *buf,
@@ -98,7 +98,7 @@
  /**
   * wpa_debug_printf_timestamp - Print timestamp for debug output
   *
-@@ -70,9 +81,15 @@ void wpa_debug_print_timestamp(void);
+@@ -71,9 +82,15 @@ void wpa_debug_print_timestamp(void);
   *
   * Note: New line '\n' is added to the end of the text when printing to stdout.
   */
@@ -115,7 +115,7 @@
  /**
   * wpa_hexdump - conditional hex dump
   * @level: priority level (MSG_*) of the message
-@@ -84,7 +101,13 @@ PRINTF_FORMAT(2, 3);
+@@ -85,7 +102,13 @@ PRINTF_FORMAT(2, 3);
   * output may be directed to stdout, stderr, and/or syslog based on
   * configuration. The contents of buf is printed out has hex dump.
   */
@@ -130,7 +130,7 @@
  
  static inline void wpa_hexdump_buf(int level, const char *title,
  				   const struct wpabuf *buf)
-@@ -106,7 +129,13 @@ static inline void wpa_hexdump_buf(int l
+@@ -107,7 +130,13 @@ static inline void wpa_hexdump_buf(int l
   * like wpa_hexdump(), but by default, does not include secret keys (passwords,
   * etc.) in debug output.
   */
@@ -145,7 +145,7 @@
  
  static inline void wpa_hexdump_buf_key(int level, const char *title,
  				       const struct wpabuf *buf)
-@@ -128,8 +157,14 @@ static inline void wpa_hexdump_buf_key(i
+@@ -129,8 +158,14 @@ static inline void wpa_hexdump_buf_key(i
   * the hex numbers and ASCII characters (for printable range) are shown. 16
   * bytes per line will be shown.
   */
@@ -162,7 +162,7 @@
  
  /**
   * wpa_hexdump_ascii_key - conditional hex dump, hide keys
-@@ -145,8 +180,14 @@ void wpa_hexdump_ascii(int level, const
+@@ -146,8 +181,14 @@ void wpa_hexdump_ascii(int level, const
   * bytes per line will be shown. This works like wpa_hexdump_ascii(), but by
   * default, does not include secret keys (passwords, etc.) in debug output.
   */
@@ -179,7 +179,7 @@
  
  /*
   * wpa_dbg() behaves like wpa_msg(), but it can be removed from build to reduce
-@@ -183,7 +224,12 @@ void wpa_hexdump_ascii_key(int level, co
+@@ -184,7 +225,12 @@ void wpa_hexdump_ascii_key(int level, co
   *
   * Note: New line '\n' is added to the end of the text when printing to stdout.
   */
@@ -193,7 +193,7 @@
  
  /**
   * wpa_msg_ctrl - Conditional printf for ctrl_iface monitors
-@@ -197,8 +243,13 @@ void wpa_msg(void *ctx, int level, const
+@@ -198,8 +244,13 @@ void wpa_msg(void *ctx, int level, const
   * attached ctrl_iface monitors. In other words, it can be used for frequent
   * events that do not need to be sent to syslog.
   */
diff --git a/package/network/services/hostapd/patches/420-indicate-features.patch b/package/network/services/hostapd/patches/420-indicate-features.patch
index 12edb6bac..356d5f8c6 100644
--- a/package/network/services/hostapd/patches/420-indicate-features.patch
+++ b/package/network/services/hostapd/patches/420-indicate-features.patch
@@ -9,7 +9,7 @@
  
  struct hapd_global {
  	void **drv_priv;
-@@ -692,7 +692,7 @@ int main(int argc, char *argv[])
+@@ -696,7 +696,7 @@ int main(int argc, char *argv[])
  	wpa_supplicant_event = hostapd_wpa_event;
  	wpa_supplicant_event_global = hostapd_wpa_event_global;
  	for (;;) {
@@ -18,7 +18,7 @@
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -729,6 +729,8 @@ int main(int argc, char *argv[])
+@@ -733,6 +733,8 @@ int main(int argc, char *argv[])
  			break;
  #endif /* CONFIG_DEBUG_LINUX_TRACING */
  		case 'v':
diff --git a/package/network/services/hostapd/patches/430-hostapd_cli_ifdef.patch b/package/network/services/hostapd/patches/430-hostapd_cli_ifdef.patch
index e52420953..a21f0bf7c 100644
--- a/package/network/services/hostapd/patches/430-hostapd_cli_ifdef.patch
+++ b/package/network/services/hostapd/patches/430-hostapd_cli_ifdef.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
-@@ -388,7 +388,6 @@ static int hostapd_cli_cmd_disassociate(
+@@ -401,7 +401,6 @@ static int hostapd_cli_cmd_disassociate(
  }
  
  
@@ -8,7 +8,7 @@
  static int hostapd_cli_cmd_signature(struct wpa_ctrl *ctrl, int argc,
  				     char *argv[])
  {
-@@ -401,7 +400,6 @@ static int hostapd_cli_cmd_signature(str
+@@ -414,7 +413,6 @@ static int hostapd_cli_cmd_signature(str
  	os_snprintf(buf, sizeof(buf), "SIGNATURE %s", argv[0]);
  	return wpa_ctrl_command(ctrl, buf);
  }
@@ -16,7 +16,7 @@
  
  
  static int hostapd_cli_cmd_sa_query(struct wpa_ctrl *ctrl, int argc,
-@@ -418,7 +416,6 @@ static int hostapd_cli_cmd_sa_query(stru
+@@ -431,7 +429,6 @@ static int hostapd_cli_cmd_sa_query(stru
  }
  
  
@@ -24,7 +24,7 @@
  static int hostapd_cli_cmd_wps_pin(struct wpa_ctrl *ctrl, int argc,
  				   char *argv[])
  {
-@@ -644,7 +641,6 @@ static int hostapd_cli_cmd_wps_config(st
+@@ -657,7 +654,6 @@ static int hostapd_cli_cmd_wps_config(st
  			 ssid_hex, argv[1]);
  	return wpa_ctrl_command(ctrl, buf);
  }
@@ -32,7 +32,7 @@
  
  
  static int hostapd_cli_cmd_disassoc_imminent(struct wpa_ctrl *ctrl, int argc,
-@@ -1588,13 +1584,10 @@ static const struct hostapd_cli_cmd host
+@@ -1610,13 +1606,10 @@ static const struct hostapd_cli_cmd host
  	{ "disassociate", hostapd_cli_cmd_disassociate,
  	  hostapd_complete_stations,
  	  "<addr> = disassociate a station" },
@@ -46,7 +46,7 @@
  	{ "wps_pin", hostapd_cli_cmd_wps_pin, NULL,
  	  "<uuid> <pin> [timeout] [addr] = add WPS Enrollee PIN" },
  	{ "wps_check_pin", hostapd_cli_cmd_wps_check_pin, NULL,
-@@ -1619,7 +1612,6 @@ static const struct hostapd_cli_cmd host
+@@ -1641,7 +1634,6 @@ static const struct hostapd_cli_cmd host
  	  "<SSID> <auth> <encr> <key> = configure AP" },
  	{ "wps_get_status", hostapd_cli_cmd_wps_get_status, NULL,
  	  "= show current WPS status" },
diff --git a/package/network/services/hostapd/patches/432-missing-typedef.patch b/package/network/services/hostapd/patches/432-missing-typedef.patch
deleted file mode 100644
index 7a100f1a0..000000000
--- a/package/network/services/hostapd/patches/432-missing-typedef.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/src/drivers/linux_wext.h
-+++ b/src/drivers/linux_wext.h
-@@ -26,6 +26,7 @@ typedef int32_t __s32;
- typedef uint16_t __u16;
- typedef int16_t __s16;
- typedef uint8_t __u8;
-+typedef int8_t __s8;
- #ifndef __user
- #define __user
- #endif /* __user */
diff --git a/package/network/services/hostapd/patches/450-scan_wait.patch b/package/network/services/hostapd/patches/450-scan_wait.patch
index ac874ad66..e265d1ac7 100644
--- a/package/network/services/hostapd/patches/450-scan_wait.patch
+++ b/package/network/services/hostapd/patches/450-scan_wait.patch
@@ -33,7 +33,7 @@
  	/* Initialize the driver interface */
  	if (!(b[0] | b[1] | b[2] | b[3] | b[4] | b[5]))
  		b = NULL;
-@@ -404,8 +416,6 @@ static void hostapd_global_deinit(const
+@@ -407,8 +419,6 @@ static void hostapd_global_deinit(const
  #endif /* CONFIG_NATIVE_WINDOWS */
  
  	eap_server_unregister_methods();
@@ -42,7 +42,7 @@
  }
  
  
-@@ -431,18 +441,6 @@ static int hostapd_global_run(struct hap
+@@ -434,18 +444,6 @@ static int hostapd_global_run(struct hap
  	}
  #endif /* EAP_SERVER_TNC */
  
@@ -61,7 +61,7 @@
  	eloop_run();
  
  	return 0;
-@@ -645,8 +643,7 @@ int main(int argc, char *argv[])
+@@ -649,8 +647,7 @@ int main(int argc, char *argv[])
  	struct hapd_interfaces interfaces;
  	int ret = 1;
  	size_t i, j;
diff --git a/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch b/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
index 38ff66317..809877745 100644
--- a/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
+++ b/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
@@ -22,7 +22,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  #include "common/defs.h"
  #include "common/ieee802_11_defs.h"
  #include "common/wpa_common.h"
-@@ -894,6 +895,9 @@ struct wpa_driver_associate_params {
+@@ -936,6 +937,9 @@ struct wpa_driver_associate_params {
  	 * responsible for selecting with which BSS to associate. */
  	const u8 *bssid;
  
@@ -42,7 +42,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  #include "config.h"
  
  
-@@ -2345,6 +2346,97 @@ static char * wpa_config_write_peerkey(c
+@@ -2389,6 +2390,97 @@ static char * wpa_config_write_mac_value
  #endif /* NO_CONFIG_WRITE */
  
  
@@ -140,7 +140,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  /* Helper macros for network block parser */
  
  #ifdef OFFSET
-@@ -2629,6 +2721,8 @@ static const struct parse_data ssid_fiel
+@@ -2673,6 +2765,8 @@ static const struct parse_data ssid_fiel
  	{ INT(ap_max_inactivity) },
  	{ INT(dtim_period) },
  	{ INT(beacon_int) },
@@ -162,7 +162,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  
  
  #define DEFAULT_EAP_WORKAROUND ((unsigned int) -1)
-@@ -846,6 +848,9 @@ struct wpa_ssid {
+@@ -879,6 +881,9 @@ struct wpa_ssid {
  	 */
  	void *parent_cred;
  
@@ -174,7 +174,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  	 * macsec_policy - Determines the policy for MACsec secure session
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -3899,6 +3899,12 @@ static void wpas_start_assoc_cb(struct w
+@@ -4177,6 +4177,12 @@ static void wpas_start_assoc_cb(struct w
  			params.beacon_int = ssid->beacon_int;
  		else
  			params.beacon_int = wpa_s->conf->beacon_int;
diff --git a/package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch b/package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch
deleted file mode 100644
index 65d67b8b0..000000000
--- a/package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From ffc4445958a3ed4064f2e1bf73fa478a61c5cf7b Mon Sep 17 00:00:00 2001
-From: Antonio Quartulli <ordex@autistici.org>
-Date: Sun, 3 Jun 2012 18:42:25 +0200
-Subject: [PATCHv2 602/602] driver_nl80211: use new parameters during ibss join
-
-Signed-hostap: Antonio Quartulli <ordex@autistici.org>
----
- src/drivers/driver_nl80211.c |   33 ++++++++++++++++++++++++++++++++-
- 1 file changed, 32 insertions(+), 1 deletion(-)
-
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -6005,7 +6005,7 @@ static int wpa_driver_nl80211_ibss(struc
- 				   struct wpa_driver_associate_params *params)
- {
- 	struct nl_msg *msg;
--	int ret = -1;
-+	int ret = -1, i;
- 	int count = 0;
- 
- 	wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
-@@ -6032,6 +6032,37 @@ retry:
- 	    nl80211_put_beacon_int(msg, params->beacon_int))
- 		goto fail;
- 
-+	if (params->fixed_freq) {
-+		wpa_printf(MSG_DEBUG, "  * fixed_freq");
-+		nla_put_flag(msg, NL80211_ATTR_FREQ_FIXED);
-+	}
-+
-+	if (params->beacon_int > 0) {
-+		wpa_printf(MSG_DEBUG, "  * beacon_int=%d",
-+			   params->beacon_int);
-+		nla_put_u32(msg, NL80211_ATTR_BEACON_INTERVAL,
-+			    params->beacon_int);
-+	}
-+
-+	if (params->rates[0] > 0) {
-+		wpa_printf(MSG_DEBUG, "  * basic_rates:");
-+		i = 0;
-+		while (i < NL80211_MAX_SUPP_RATES &&
-+		       params->rates[i] > 0) {
-+			wpa_printf(MSG_DEBUG, "    %.1f",
-+				   (double)params->rates[i] / 2);
-+			i++;
-+		}
-+		nla_put(msg, NL80211_ATTR_BSS_BASIC_RATES, i,
-+			params->rates);
-+	}
-+
-+	if (params->mcast_rate > 0) {
-+		wpa_printf(MSG_DEBUG, "  * mcast_rate=%.1f",
-+			   (double)params->mcast_rate / 10);
-+		nla_put_u32(msg, NL80211_ATTR_MCAST_RATE, params->mcast_rate);
-+	}
-+
- 	ret = nl80211_set_conn_keys(params, msg);
- 	if (ret)
- 		goto fail;
diff --git a/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch b/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch
index 5dc19fede..e738ea131 100644
--- a/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch
+++ b/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch
@@ -19,7 +19,7 @@ Tested-by: Simon Wunderlich <simon.wunderlich@openmesh.com>
 
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -1661,6 +1661,7 @@ struct wpa_driver_mesh_join_params {
+@@ -1768,6 +1768,7 @@ struct wpa_driver_mesh_join_params {
  #define WPA_DRIVER_MESH_FLAG_AMPE	0x00000008
  	unsigned int flags;
  	bool handle_dfs;
@@ -29,7 +29,7 @@ Tested-by: Simon Wunderlich <simon.wunderlich@openmesh.com>
  struct wpa_driver_set_key_params {
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -10627,6 +10627,18 @@ static int nl80211_put_mesh_id(struct nl
+@@ -11388,6 +11388,18 @@ static int nl80211_put_mesh_id(struct nl
  }
  
  
@@ -48,7 +48,7 @@ Tested-by: Simon Wunderlich <simon.wunderlich@openmesh.com>
  static int nl80211_put_mesh_config(struct nl_msg *msg,
  				   struct wpa_driver_mesh_bss_params *params)
  {
-@@ -10688,6 +10700,7 @@ static int nl80211_join_mesh(struct i802
+@@ -11449,6 +11461,7 @@ static int nl80211_join_mesh(struct i802
  	    nl80211_put_basic_rates(msg, params->basic_rates) ||
  	    nl80211_put_mesh_id(msg, params->meshid, params->meshid_len) ||
  	    nl80211_put_beacon_int(msg, params->beacon_int) ||
diff --git a/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch b/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch
index 48086ea0e..73ccc65ad 100644
--- a/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch
+++ b/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch
@@ -1,19 +1,13 @@
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2539,11 +2539,13 @@ void ibss_mesh_setup_freq(struct wpa_sup
- 	for (j = 0; j < wpa_s->last_scan_res_used; j++) {
- 		struct wpa_bss *bss = wpa_s->last_scan_res[j];
+@@ -3077,6 +3077,10 @@ void ibss_mesh_setup_freq(struct wpa_sup
  
--		if (ssid->mode != WPAS_MODE_IBSS)
-+		/* Don't adjust control freq in case of fixed_freq */
-+		if (ssid->fixed_freq) {
-+			obss_scan = 0;
- 			break;
-+		}
+ 	freq->freq = ssid->frequency;
  
--		/* Don't adjust control freq in case of fixed_freq */
--		if (ssid->fixed_freq)
-+		if (ssid->mode != WPAS_MODE_IBSS)
- 			break;
++	if (ssid->fixed_freq) {
++		obss_scan = 0;
++	}
++
+ 	if (ssid->mode == WPAS_MODE_IBSS && !ssid->fixed_freq) {
+ 		struct wpa_bss *bss = ibss_find_existing_bss(wpa_s, ssid);
  
- 		if (!bss_is_ibss(bss))
diff --git a/package/network/services/hostapd/patches/465-hostapd-config-support-random-BSS-color.patch b/package/network/services/hostapd/patches/465-hostapd-config-support-random-BSS-color.patch
index 6810b797c..ada77853f 100644
--- a/package/network/services/hostapd/patches/465-hostapd-config-support-random-BSS-color.patch
+++ b/package/network/services/hostapd/patches/465-hostapd-config-support-random-BSS-color.patch
@@ -13,7 +13,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -3489,6 +3489,8 @@ static int hostapd_config_fill(struct ho
+@@ -3498,6 +3498,8 @@ static int hostapd_config_fill(struct ho
  	} else if (os_strcmp(buf, "he_bss_color") == 0) {
  		conf->he_op.he_bss_color = atoi(pos) & 0x3f;
  		conf->he_op.he_bss_color_disabled = 0;
diff --git a/package/network/services/hostapd/patches/470-survey_data_fallback.patch b/package/network/services/hostapd/patches/470-survey_data_fallback.patch
index 359b5f3ef..79ab48c5c 100644
--- a/package/network/services/hostapd/patches/470-survey_data_fallback.patch
+++ b/package/network/services/hostapd/patches/470-survey_data_fallback.patch
@@ -1,24 +1,29 @@
 --- a/src/ap/acs.c
 +++ b/src/ap/acs.c
-@@ -420,20 +420,19 @@ static int acs_usable_bw160_chan(const s
+@@ -455,17 +455,17 @@ static int acs_get_bw_center_chan(int fr
  static int acs_survey_is_sufficient(struct freq_survey *survey)
  {
  	if (!(survey->filled & SURVEY_HAS_NF)) {
 +		survey->nf = -95;
- 		wpa_printf(MSG_INFO, "ACS: Survey is missing noise floor");
+ 		wpa_printf(MSG_INFO,
+ 			   "ACS: Survey for freq %d is missing noise floor",
+ 			   survey->freq);
 -		return 0;
  	}
  
  	if (!(survey->filled & SURVEY_HAS_CHAN_TIME)) {
 +		survey->channel_time = 0;
- 		wpa_printf(MSG_INFO, "ACS: Survey is missing channel time");
+ 		wpa_printf(MSG_INFO,
+ 			   "ACS: Survey for freq %d is missing channel time",
+ 			   survey->freq);
 -		return 0;
  	}
  
  	if (!(survey->filled & SURVEY_HAS_CHAN_TIME_BUSY) &&
- 	    !(survey->filled & SURVEY_HAS_CHAN_TIME_RX)) {
+@@ -473,7 +473,6 @@ static int acs_survey_is_sufficient(stru
  		wpa_printf(MSG_INFO,
- 			   "ACS: Survey is missing RX and busy time (at least one is required)");
+ 			   "ACS: Survey for freq %d is missing RX and busy time (at least one is required)",
+ 			   survey->freq);
 -		return 0;
  	}
  
diff --git a/package/network/services/hostapd/patches/500-lto-jobserver-support.patch b/package/network/services/hostapd/patches/500-lto-jobserver-support.patch
index 1a0ce1256..046da42ab 100644
--- a/package/network/services/hostapd/patches/500-lto-jobserver-support.patch
+++ b/package/network/services/hostapd/patches/500-lto-jobserver-support.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/Makefile
 +++ b/hostapd/Makefile
-@@ -1394,7 +1394,7 @@ hostapd_multi.a: $(BCHECK) $(OBJS)
+@@ -1396,7 +1396,7 @@ hostapd_multi.a: $(BCHECK) $(OBJS)
  	@$(AR) cr $@ hostapd_multi.o $(OBJS)
  
  hostapd: $(OBJS)
@@ -9,7 +9,7 @@
  	@$(E) "  LD " $@
  
  ifdef CONFIG_WPA_TRACE
-@@ -1405,7 +1405,7 @@ _OBJS_VAR := OBJS_c
+@@ -1407,7 +1407,7 @@ _OBJS_VAR := OBJS_c
  include ../src/objs.mk
  
  hostapd_cli: $(OBJS_c)
@@ -20,7 +20,7 @@
  NOBJS = nt_password_hash.o ../src/crypto/ms_funcs.o $(SHA1OBJS)
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -2025,31 +2025,31 @@ wpa_supplicant_multi.a: .config $(BCHECK
+@@ -2039,31 +2039,31 @@ wpa_supplicant_multi.a: .config $(BCHECK
  	@$(AR) cr $@ wpa_supplicant_multi.o $(OBJS)
  
  wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs)
diff --git a/package/network/services/hostapd/patches/590-rrm-wnm-statistics.patch b/package/network/services/hostapd/patches/590-rrm-wnm-statistics.patch
index 98b8820cd..a6f43171c 100644
--- a/package/network/services/hostapd/patches/590-rrm-wnm-statistics.patch
+++ b/package/network/services/hostapd/patches/590-rrm-wnm-statistics.patch
@@ -42,9 +42,9 @@
  	wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
  		   MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
  		   "validity_interval=%u",
-@@ -659,10 +660,12 @@ int ieee802_11_rx_wnm_action_ap(struct h
- 
- 	switch (action) {
+@@ -790,10 +791,12 @@ int ieee802_11_rx_wnm_action_ap(struct h
+ 					       plen);
+ 		return 0;
  	case WNM_BSS_TRANS_MGMT_QUERY:
 +		hapd->openwrt_stats.wnm.bss_transition_query_rx++;
  		ieee802_11_rx_bss_trans_mgmt_query(hapd, mgmt->sa, payload,
@@ -55,7 +55,7 @@
  		ieee802_11_rx_bss_trans_mgmt_resp(hapd, mgmt->sa, payload,
  						  plen);
  		return 0;
-@@ -709,6 +712,7 @@ int wnm_send_disassoc_imminent(struct ho
+@@ -840,6 +843,7 @@ int wnm_send_disassoc_imminent(struct ho
  
  	pos = mgmt->u.action.u.bss_tm_req.variable;
  
@@ -63,7 +63,7 @@
  	wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request frame to indicate imminent disassociation (disassoc_timer=%d) to "
  		   MACSTR, disassoc_timer, MAC2STR(sta->addr));
  	if (hostapd_drv_send_mlme(hapd, buf, pos - buf, 0, NULL, 0, 0) < 0) {
-@@ -790,6 +794,7 @@ int wnm_send_ess_disassoc_imminent(struc
+@@ -921,6 +925,7 @@ int wnm_send_ess_disassoc_imminent(struc
  		return -1;
  	}
  
@@ -71,7 +71,7 @@
  	if (disassoc_timer) {
  		/* send disassociation frame after time-out */
  		set_disassoc_timer(hapd, sta, disassoc_timer);
-@@ -870,6 +875,7 @@ int wnm_send_bss_tm_req(struct hostapd_d
+@@ -1001,6 +1006,7 @@ int wnm_send_bss_tm_req(struct hostapd_d
  	}
  	os_free(buf);
  
diff --git a/package/network/services/hostapd/patches/600-ubus_support.patch b/package/network/services/hostapd/patches/600-ubus_support.patch
index 521e7df82..aa68079fb 100644
--- a/package/network/services/hostapd/patches/600-ubus_support.patch
+++ b/package/network/services/hostapd/patches/600-ubus_support.patch
@@ -39,7 +39,7 @@
  	int interface_added; /* virtual interface added for this BSS */
  	unsigned int started:1;
  	unsigned int disabled:1;
-@@ -673,6 +675,7 @@ hostapd_alloc_bss_data(struct hostapd_if
+@@ -682,6 +684,7 @@ hostapd_alloc_bss_data(struct hostapd_if
  		       struct hostapd_bss_config *bss);
  int hostapd_setup_interface(struct hostapd_iface *iface);
  int hostapd_setup_interface_complete(struct hostapd_iface *iface, int err);
@@ -49,7 +49,7 @@
  struct hostapd_iface * hostapd_alloc_iface(void);
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -401,6 +401,7 @@ void hostapd_free_hapd_data(struct hosta
+@@ -435,6 +435,7 @@ void hostapd_free_hapd_data(struct hosta
  	hapd->beacon_set_done = 0;
  
  	wpa_printf(MSG_DEBUG, "%s(%s)", __func__, hapd->conf->iface);
@@ -57,7 +57,7 @@
  	accounting_deinit(hapd);
  	hostapd_deinit_wpa(hapd);
  	vlan_deinit(hapd);
-@@ -1431,6 +1432,8 @@ static int hostapd_setup_bss(struct host
+@@ -1185,6 +1186,8 @@ static int hostapd_start_beacon(struct h
  	if (hapd->driver && hapd->driver->set_operstate)
  		hapd->driver->set_operstate(hapd->drv_priv, 1);
  
@@ -66,7 +66,7 @@
  	return 0;
  }
  
-@@ -2050,6 +2053,7 @@ static int hostapd_setup_interface_compl
+@@ -2126,6 +2129,7 @@ static int hostapd_setup_interface_compl
  	if (err)
  		goto fail;
  
@@ -74,7 +74,7 @@
  	wpa_printf(MSG_DEBUG, "Completing interface initialization");
  	if (iface->freq) {
  #ifdef NEED_AP_MLME
-@@ -2248,6 +2252,7 @@ dfs_offload:
+@@ -2342,6 +2346,7 @@ dfs_offload:
  
  fail:
  	wpa_printf(MSG_ERROR, "Interface initialization failed");
@@ -82,7 +82,7 @@
  	hostapd_set_state(iface, HAPD_IFACE_DISABLED);
  	wpa_msg(hapd->msg_ctx, MSG_INFO, AP_EVENT_DISABLED);
  #ifdef CONFIG_FST
-@@ -2723,6 +2728,7 @@ void hostapd_interface_deinit_free(struc
+@@ -2817,6 +2822,7 @@ void hostapd_interface_deinit_free(struc
  		   (unsigned int) iface->conf->num_bss);
  	driver = iface->bss[0]->driver;
  	drv_priv = iface->bss[0]->drv_priv;
@@ -92,7 +92,7 @@
  		   __func__, driver, drv_priv);
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
-@@ -3573,13 +3573,18 @@ static void handle_auth(struct hostapd_d
+@@ -2740,13 +2740,18 @@ static void handle_auth(struct hostapd_d
  	u16 auth_alg, auth_transaction, status_code;
  	u16 resp = WLAN_STATUS_SUCCESS;
  	struct sta_info *sta = NULL;
@@ -112,7 +112,7 @@
  
  	if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
  		wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
-@@ -3747,6 +3752,13 @@ static void handle_auth(struct hostapd_d
+@@ -2914,6 +2919,13 @@ static void handle_auth(struct hostapd_d
  		resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
  		goto fail;
  	}
@@ -126,7 +126,7 @@
  	if (res == HOSTAPD_ACL_PENDING)
  		return;
  
-@@ -5488,7 +5500,7 @@ static void handle_assoc(struct hostapd_
+@@ -4695,7 +4707,7 @@ static void handle_assoc(struct hostapd_
  	int resp = WLAN_STATUS_SUCCESS;
  	u16 reply_res = WLAN_STATUS_UNSPECIFIED_FAILURE;
  	const u8 *pos;
@@ -135,7 +135,7 @@
  	struct sta_info *sta;
  	u8 *tmp = NULL;
  #ifdef CONFIG_FILS
-@@ -5701,6 +5713,11 @@ static void handle_assoc(struct hostapd_
+@@ -4908,6 +4920,11 @@ static void handle_assoc(struct hostapd_
  		left = res;
  	}
  #endif /* CONFIG_FILS */
@@ -147,7 +147,7 @@
  
  	/* followed by SSID and Supported rates; and HT capabilities if 802.11n
  	 * is used */
-@@ -5799,6 +5816,13 @@ static void handle_assoc(struct hostapd_
+@@ -5006,6 +5023,13 @@ static void handle_assoc(struct hostapd_
  	}
  #endif /* CONFIG_FILS */
  
@@ -161,7 +161,7 @@
   fail:
  
  	/*
-@@ -5892,6 +5916,7 @@ static void handle_disassoc(struct hosta
+@@ -5099,6 +5123,7 @@ static void handle_disassoc(struct hosta
  	wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
  		   MAC2STR(mgmt->sa),
  		   le_to_host16(mgmt->u.disassoc.reason_code));
@@ -169,7 +169,7 @@
  
  	sta = ap_get_sta(hapd, mgmt->sa);
  	if (sta == NULL) {
-@@ -5961,6 +5986,8 @@ static void handle_deauth(struct hostapd
+@@ -5168,6 +5193,8 @@ static void handle_deauth(struct hostapd
  	/* Clear the PTKSA cache entries for PASN */
  	ptksa_cache_flush(hapd->ptksa, mgmt->sa, WPA_CIPHER_NONE);
  
@@ -180,7 +180,7 @@
  		wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
-@@ -919,6 +919,12 @@ void handle_probe_req(struct hostapd_dat
+@@ -1006,6 +1006,12 @@ void handle_probe_req(struct hostapd_dat
  	u16 csa_offs[2];
  	size_t csa_offs_len;
  	struct radius_sta rad_info;
@@ -193,7 +193,7 @@
  
  	if (hapd->iconf->rssi_ignore_probe_request && ssi_signal &&
  	    ssi_signal < hapd->iconf->rssi_ignore_probe_request)
-@@ -1105,6 +1111,12 @@ void handle_probe_req(struct hostapd_dat
+@@ -1192,6 +1198,12 @@ void handle_probe_req(struct hostapd_dat
  	}
  #endif /* CONFIG_P2P */
  
@@ -250,7 +250,7 @@
  		ap_free_sta(hapd, sta);
  		break;
  	}
-@@ -1298,12 +1300,25 @@ void ap_sta_set_authorized(struct hostap
+@@ -1305,15 +1307,28 @@ void ap_sta_set_authorized(struct hostap
  					sta->addr, authorized, dev_addr);
  
  	if (authorized) {
@@ -265,18 +265,21 @@
 +			[WLAN_AUTH_PASN] = "pasn",
 +		};
 +		const char *auth_alg = NULL;
+ 		const u8 *dpp_pkhash;
  		const char *keyid;
+ 		char dpp_pkhash_buf[100];
  		char keyid_buf[100];
  		char ip_addr[100];
 +		char alg_buf[100];
  
+ 		dpp_pkhash_buf[0] = '\0';
  		keyid_buf[0] = '\0';
  		ip_addr[0] = '\0';
 +		alg_buf[0] = '\0';
  #ifdef CONFIG_P2P
  		if (wpa_auth_get_ip_addr(sta->wpa_sm, ip_addr_buf) == 0) {
  			os_snprintf(ip_addr, sizeof(ip_addr),
-@@ -1313,22 +1328,31 @@ void ap_sta_set_authorized(struct hostap
+@@ -1323,6 +1338,13 @@ void ap_sta_set_authorized(struct hostap
  		}
  #endif /* CONFIG_P2P */
  
@@ -285,27 +288,29 @@
 +
 +		if (auth_alg)
 +			os_snprintf(alg_buf, sizeof(alg_buf),
-+				    " auth_alg=%s", auth_alg);
++				" auth_alg=%s", auth_alg);
 +
  		keyid = ap_sta_wpa_get_keyid(hapd, sta);
  		if (keyid) {
  			os_snprintf(keyid_buf, sizeof(keyid_buf),
- 				    " keyid=%s", keyid);
+@@ -1341,17 +1363,19 @@ void ap_sta_set_authorized(struct hostap
+ 					 dpp_pkhash, SHA256_MAC_LEN);
  		}
  
--		wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_CONNECTED "%s%s%s",
--			buf, ip_addr, keyid_buf);
+-		wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_CONNECTED "%s%s%s%s",
+-			buf, ip_addr, keyid_buf, dpp_pkhash_buf);
 +		hostapd_ubus_notify_authorized(hapd, sta, auth_alg);
-+		wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_CONNECTED "%s%s%s%s",
-+			buf, ip_addr, keyid_buf, alg_buf);
++		wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_CONNECTED "%s%s%s%s%s",
++			buf, ip_addr, keyid_buf, dpp_pkhash_buf, alg_buf);
  
  		if (hapd->msg_ctx_parent &&
  		    hapd->msg_ctx_parent != hapd->msg_ctx)
  			wpa_msg_no_global(hapd->msg_ctx_parent, MSG_INFO,
--					  AP_STA_CONNECTED "%s%s%s",
--					  buf, ip_addr, keyid_buf);
-+					  AP_STA_CONNECTED "%s%s%s%s",
-+					  buf, ip_addr, keyid_buf, alg_buf);
+-					  AP_STA_CONNECTED "%s%s%s%s",
++					  AP_STA_CONNECTED "%s%s%s%s%s",
+ 					  buf, ip_addr, keyid_buf,
+-					  dpp_pkhash_buf);
++					  dpp_pkhash_buf, alg_buf);
  	} else {
  		wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED "%s", buf);
 +		hostapd_ubus_notify(hapd, "disassoc", sta->addr);
@@ -314,7 +319,7 @@
  		    hapd->msg_ctx_parent != hapd->msg_ctx)
 --- a/src/ap/wpa_auth_glue.c
 +++ b/src/ap/wpa_auth_glue.c
-@@ -268,6 +268,7 @@ static void hostapd_wpa_auth_psk_failure
+@@ -269,6 +269,7 @@ static void hostapd_wpa_auth_psk_failure
  	struct hostapd_data *hapd = ctx;
  	wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_POSSIBLE_PSK_MISMATCH MACSTR,
  		MAC2STR(addr));
@@ -324,7 +329,7 @@
  
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -183,6 +183,12 @@ ifdef CONFIG_EAPOL_TEST
+@@ -194,6 +194,12 @@ ifdef CONFIG_EAPOL_TEST
  CFLAGS += -Werror -DEAPOL_TEST
  endif
  
@@ -337,7 +342,7 @@
  ifdef CONFIG_CODE_COVERAGE
  CFLAGS += -O0 -fprofile-arcs -ftest-coverage
  LIBS += -lgcov
-@@ -977,6 +983,9 @@ ifdef CONFIG_CTRL_IFACE_MIB
+@@ -989,6 +995,9 @@ ifdef CONFIG_CTRL_IFACE_MIB
  CFLAGS += -DCONFIG_CTRL_IFACE_MIB
  endif
  OBJS += ../src/ap/ctrl_iface_ap.o
@@ -349,7 +354,7 @@
  CFLAGS += -DEAP_SERVER -DEAP_SERVER_IDENTITY
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -7285,6 +7285,8 @@ struct wpa_supplicant * wpa_supplicant_a
+@@ -7608,6 +7608,8 @@ struct wpa_supplicant * wpa_supplicant_a
  	}
  #endif /* CONFIG_P2P */
  
@@ -358,7 +363,7 @@
  	return wpa_s;
  }
  
-@@ -7311,6 +7313,8 @@ int wpa_supplicant_remove_iface(struct w
+@@ -7634,6 +7636,8 @@ int wpa_supplicant_remove_iface(struct w
  	struct wpa_supplicant *parent = wpa_s->parent;
  #endif /* CONFIG_MESH */
  
@@ -367,7 +372,7 @@
  	/* Remove interface from the global list of interfaces */
  	prev = global->ifaces;
  	if (prev == wpa_s) {
-@@ -7614,8 +7618,12 @@ int wpa_supplicant_run(struct wpa_global
+@@ -7980,8 +7984,12 @@ int wpa_supplicant_run(struct wpa_global
  	eloop_register_signal_terminate(wpa_supplicant_terminate, global);
  	eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
  
@@ -382,15 +387,15 @@
  
 --- a/wpa_supplicant/wpa_supplicant_i.h
 +++ b/wpa_supplicant/wpa_supplicant_i.h
-@@ -20,6 +20,7 @@
- #include "wps/wps_defs.h"
+@@ -21,6 +21,7 @@
  #include "config_ssid.h"
  #include "wmm_ac.h"
+ #include "pasn/pasn_common.h"
 +#include "ubus.h"
  
  extern const char *const wpa_supplicant_version;
  extern const char *const wpa_supplicant_license;
-@@ -323,6 +324,8 @@ struct wpa_global {
+@@ -324,6 +325,8 @@ struct wpa_global {
  #endif /* CONFIG_WIFI_DISPLAY */
  
  	struct psk_list_entry *add_psk; /* From group formation */
@@ -399,7 +404,7 @@
  };
  
  
-@@ -707,6 +710,7 @@ struct wpa_supplicant {
+@@ -655,6 +658,7 @@ struct wpa_supplicant {
  	unsigned char own_addr[ETH_ALEN];
  	unsigned char perm_addr[ETH_ALEN];
  	char ifname[100];
@@ -417,7 +422,7 @@
  
  
  #ifndef WPS_PIN_SCAN_IGNORE_SEL_REG
-@@ -391,6 +392,8 @@ static int wpa_supplicant_wps_cred(void
+@@ -402,6 +403,8 @@ static int wpa_supplicant_wps_cred(void
  	wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute",
  			cred->cred_attr, cred->cred_attr_len);
  
@@ -428,7 +433,7 @@
  
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -897,6 +897,7 @@ int main(int argc, char *argv[])
+@@ -901,6 +901,7 @@ int main(int argc, char *argv[])
  	}
  
  	hostapd_global_ctrl_iface_init(&interfaces);
@@ -436,7 +441,7 @@
  
  	if (hostapd_global_run(&interfaces, daemonize, pid_file)) {
  		wpa_printf(MSG_ERROR, "Failed to start eloop");
-@@ -906,6 +907,7 @@ int main(int argc, char *argv[])
+@@ -910,6 +911,7 @@ int main(int argc, char *argv[])
  	ret = 0;
  
   out:
@@ -527,7 +532,7 @@
  
 --- a/src/ap/dfs.c
 +++ b/src/ap/dfs.c
-@@ -1203,6 +1203,8 @@ int hostapd_dfs_pre_cac_expired(struct h
+@@ -1211,6 +1211,8 @@ int hostapd_dfs_pre_cac_expired(struct h
  		"freq=%d ht_enabled=%d chan_offset=%d chan_width=%d cf1=%d cf2=%d",
  		freq, ht_enabled, chan_offset, chan_width, cf1, cf2);
  
@@ -569,7 +574,7 @@
  	}
 --- a/src/ap/sta_info.h
 +++ b/src/ap/sta_info.h
-@@ -328,6 +328,7 @@ struct sta_info {
+@@ -293,6 +293,7 @@ struct sta_info {
  #endif /* CONFIG_TESTING_OPTIONS */
  #ifdef CONFIG_AIRTIME_POLICY
  	unsigned int airtime_weight;
diff --git a/package/network/services/hostapd/patches/700-wifi-reload.patch b/package/network/services/hostapd/patches/700-wifi-reload.patch
index 174127df6..5ac7f711a 100644
--- a/package/network/services/hostapd/patches/700-wifi-reload.patch
+++ b/package/network/services/hostapd/patches/700-wifi-reload.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -2416,6 +2416,8 @@ static int hostapd_config_fill(struct ho
+@@ -2418,6 +2418,8 @@ static int hostapd_config_fill(struct ho
  		bss->isolate = atoi(pos);
  	} else if (os_strcmp(buf, "ap_max_inactivity") == 0) {
  		bss->ap_max_inactivity = atoi(pos);
@@ -8,8 +8,8 @@
 +		bss->config_id = os_strdup(pos);
  	} else if (os_strcmp(buf, "skip_inactivity_poll") == 0) {
  		bss->skip_inactivity_poll = atoi(pos);
- 	} else if (os_strcmp(buf, "country_code") == 0) {
-@@ -3121,6 +3123,8 @@ static int hostapd_config_fill(struct ho
+ 	} else if (os_strcmp(buf, "config_id") == 0) {
+@@ -3128,6 +3130,8 @@ static int hostapd_config_fill(struct ho
  		}
  	} else if (os_strcmp(buf, "acs_exclude_dfs") == 0) {
  		conf->acs_exclude_dfs = atoi(pos);
@@ -20,15 +20,7 @@
  	} else if (os_strcmp(buf, "channel") == 0) {
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
-@@ -796,6 +796,7 @@ void hostapd_config_free_bss(struct host
- 	os_free(conf->radius_req_attr_sqlite);
- 	os_free(conf->rsn_preauth_interfaces);
- 	os_free(conf->ctrl_interface);
-+	os_free(conf->config_id);
- 	os_free(conf->ca_cert);
- 	os_free(conf->server_cert);
- 	os_free(conf->server_cert2);
-@@ -995,6 +996,7 @@ void hostapd_config_free(struct hostapd_
+@@ -997,6 +997,7 @@ void hostapd_config_free(struct hostapd_
  
  	for (i = 0; i < conf->num_bss; i++)
  		hostapd_config_free_bss(conf->bss[i]);
@@ -38,16 +30,7 @@
  	os_free(conf->basic_rates);
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -285,6 +285,8 @@ struct hostapd_bss_config {
- 	char vlan_bridge[IFNAMSIZ + 1];
- 	char wds_bridge[IFNAMSIZ + 1];
- 
-+	char *config_id;
-+
- 	enum hostapd_logger_level logger_syslog_level, logger_stdout_level;
- 
- 	unsigned int logger_syslog; /* module bitfield */
-@@ -969,6 +971,7 @@ struct eht_phy_capabilities_info {
+@@ -987,6 +987,7 @@ struct eht_phy_capabilities_info {
  struct hostapd_config {
  	struct hostapd_bss_config **bss, *last_bss;
  	size_t num_bss;
@@ -57,7 +40,7 @@
  	int rts_threshold;
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -224,6 +224,10 @@ static int hostapd_iface_conf_changed(st
+@@ -254,6 +254,10 @@ static int hostapd_iface_conf_changed(st
  {
  	size_t i;
  
@@ -68,7 +51,7 @@
  	if (newconf->num_bss != oldconf->num_bss)
  		return 1;
  
-@@ -237,7 +241,7 @@ static int hostapd_iface_conf_changed(st
+@@ -267,7 +271,7 @@ static int hostapd_iface_conf_changed(st
  }
  
  
@@ -77,26 +60,17 @@
  {
  	struct hapd_interfaces *interfaces = iface->interfaces;
  	struct hostapd_data *hapd = iface->bss[0];
-@@ -260,13 +264,16 @@ int hostapd_reload_config(struct hostapd
- 	if (newconf == NULL)
- 		return -1;
- 
--	hostapd_clear_old(iface);
--
- 	oldconf = hapd->iconf;
- 	if (hostapd_iface_conf_changed(newconf, oldconf)) {
+@@ -295,6 +299,9 @@ int hostapd_reload_config(struct hostapd
  		char *fname;
  		int res;
  
 +		if (reconf)
 +			return -1;
 +
-+		hostapd_clear_old(iface);
-+
+ 		hostapd_clear_old(iface);
+ 
  		wpa_printf(MSG_DEBUG,
- 			   "Configuration changes include interface/BSS modification - force full disable+enable sequence");
- 		fname = os_strdup(iface->config_fname);
-@@ -291,6 +298,24 @@ int hostapd_reload_config(struct hostapd
+@@ -321,6 +328,24 @@ int hostapd_reload_config(struct hostapd
  			wpa_printf(MSG_ERROR,
  				   "Failed to enable interface on config reload");
  		return res;
@@ -121,7 +95,7 @@
  	}
  	iface->conf = newconf;
  
-@@ -307,6 +332,12 @@ int hostapd_reload_config(struct hostapd
+@@ -337,6 +362,12 @@ int hostapd_reload_config(struct hostapd
  
  	for (j = 0; j < iface->num_bss; j++) {
  		hapd = iface->bss[j];
@@ -131,10 +105,10 @@
 +		}
 +		if (newconf->bss[j]->config_id)
 +			hapd->config_id = strdup(newconf->bss[j]->config_id);
- 		hapd->iconf = newconf;
- 		hapd->conf = newconf->bss[j];
- 		hostapd_reload_bss(hapd);
-@@ -2420,6 +2451,10 @@ hostapd_alloc_bss_data(struct hostapd_if
+ 		if (!hapd->conf->config_id || !newconf->bss[j]->config_id ||
+ 		    os_strcmp(hapd->conf->config_id,
+ 			      newconf->bss[j]->config_id) != 0)
+@@ -2514,6 +2545,10 @@ hostapd_alloc_bss_data(struct hostapd_if
  	hapd->iconf = conf;
  	hapd->conf = bss;
  	hapd->iface = hapd_iface;
@@ -164,7 +138,7 @@
  	int interface_added; /* virtual interface added for this BSS */
  	unsigned int started:1;
  	unsigned int disabled:1;
-@@ -667,7 +668,7 @@ struct hostapd_iface {
+@@ -676,7 +677,7 @@ struct hostapd_iface {
  int hostapd_for_each_interface(struct hapd_interfaces *interfaces,
  			       int (*cb)(struct hostapd_iface *iface,
  					 void *ctx), void *ctx);
@@ -175,19 +149,19 @@
  hostapd_alloc_bss_data(struct hostapd_iface *hapd_iface,
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -4852,6 +4852,9 @@ static int wpa_driver_nl80211_set_ap(voi
+@@ -5054,6 +5054,9 @@ static int wpa_driver_nl80211_set_ap(voi
  	if (ret) {
  		wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
  			   ret, strerror(-ret));
-+		if (!bss->beacon_set)
++		if (!bss->flink->beacon_set)
 +			ret = 0;
-+		bss->beacon_set = 0;
++		bss->flink->beacon_set = 0;
  	} else {
- 		bss->beacon_set = 1;
+ 		bss->flink->beacon_set = 1;
  		nl80211_set_bss(bss, params->cts_protect, params->preamble,
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -186,7 +186,7 @@ static int hostapd_ctrl_iface_update(str
+@@ -187,7 +187,7 @@ static int hostapd_ctrl_iface_update(str
  	iface->interfaces->config_read_cb = hostapd_ctrl_iface_config_read;
  	reload_opts = txt;
  
@@ -198,7 +172,7 @@
  }
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -317,7 +317,7 @@ static void handle_term(int sig, void *s
+@@ -320,7 +320,7 @@ static void handle_term(int sig, void *s
  
  static int handle_reload_iface(struct hostapd_iface *iface, void *ctx)
  {
diff --git a/package/network/services/hostapd/patches/710-vlan_no_bridge.patch b/package/network/services/hostapd/patches/710-vlan_no_bridge.patch
index b06ef8f68..f625f4bda 100644
--- a/package/network/services/hostapd/patches/710-vlan_no_bridge.patch
+++ b/package/network/services/hostapd/patches/710-vlan_no_bridge.patch
@@ -30,7 +30,7 @@
  
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -3346,6 +3346,8 @@ static int hostapd_config_fill(struct ho
+@@ -3353,6 +3353,8 @@ static int hostapd_config_fill(struct ho
  #ifndef CONFIG_NO_VLAN
  	} else if (os_strcmp(buf, "dynamic_vlan") == 0) {
  		bss->ssid.dynamic_vlan = atoi(pos);
diff --git a/package/network/services/hostapd/patches/711-wds_bridge_force.patch b/package/network/services/hostapd/patches/711-wds_bridge_force.patch
index 169807c61..e04ae6253 100644
--- a/package/network/services/hostapd/patches/711-wds_bridge_force.patch
+++ b/package/network/services/hostapd/patches/711-wds_bridge_force.patch
@@ -6,12 +6,12 @@
  		os_strlcpy(bss->bridge, pos, sizeof(bss->bridge));
 +		if (!bss->wds_bridge[0])
 +			os_strlcpy(bss->wds_bridge, pos, sizeof(bss->wds_bridge));
+ 	} else if (os_strcmp(buf, "bridge_hairpin") == 0) {
+ 		bss->bridge_hairpin = atoi(pos);
  	} else if (os_strcmp(buf, "vlan_bridge") == 0) {
- 		os_strlcpy(bss->vlan_bridge, pos, sizeof(bss->vlan_bridge));
- 	} else if (os_strcmp(buf, "wds_bridge") == 0) {
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
-@@ -340,8 +340,6 @@ int hostapd_set_wds_sta(struct hostapd_d
+@@ -348,8 +348,6 @@ int hostapd_set_wds_sta(struct hostapd_d
  		return -1;
  	if (hapd->conf->wds_bridge[0])
  		bridge = hapd->conf->wds_bridge;
diff --git a/package/network/services/hostapd/patches/720-iface_max_num_sta.patch b/package/network/services/hostapd/patches/720-iface_max_num_sta.patch
index ed76d22dd..a06f141c8 100644
--- a/package/network/services/hostapd/patches/720-iface_max_num_sta.patch
+++ b/package/network/services/hostapd/patches/720-iface_max_num_sta.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -2841,6 +2841,14 @@ static int hostapd_config_fill(struct ho
+@@ -2848,6 +2848,14 @@ static int hostapd_config_fill(struct ho
  				   line, bss->max_num_sta, MAX_STA_COUNT);
  			return 1;
  		}
@@ -17,7 +17,7 @@
  	} else if (os_strcmp(buf, "extended_key_id") == 0) {
 --- a/src/ap/hostapd.h
 +++ b/src/ap/hostapd.h
-@@ -711,6 +711,7 @@ void hostapd_cleanup_cs_params(struct ho
+@@ -721,6 +721,7 @@ void hostapd_cleanup_cs_params(struct ho
  void hostapd_periodic_iface(struct hostapd_iface *iface);
  int hostapd_owe_trans_get_info(struct hostapd_data *hapd);
  void hostapd_ocv_check_csa_sa_query(void *eloop_ctx, void *timeout_ctx);
@@ -27,7 +27,7 @@
  void hostapd_cleanup_cca_params(struct hostapd_data *hapd);
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -241,6 +241,30 @@ static int hostapd_iface_conf_changed(st
+@@ -271,6 +271,30 @@ static int hostapd_iface_conf_changed(st
  }
  
  
@@ -60,7 +60,7 @@
  	struct hapd_interfaces *interfaces = iface->interfaces;
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
-@@ -1135,7 +1135,7 @@ void handle_probe_req(struct hostapd_dat
+@@ -1222,7 +1222,7 @@ void handle_probe_req(struct hostapd_dat
  	if (hapd->conf->no_probe_resp_if_max_sta &&
  	    is_multicast_ether_addr(mgmt->da) &&
  	    is_multicast_ether_addr(mgmt->bssid) &&
@@ -71,7 +71,7 @@
  			   " since no room for additional STA",
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -1010,6 +1010,8 @@ struct hostapd_config {
+@@ -1026,6 +1026,8 @@ struct hostapd_config {
  	unsigned int track_sta_max_num;
  	unsigned int track_sta_max_age;
  
diff --git a/package/network/services/hostapd/patches/730-ft_iface.patch b/package/network/services/hostapd/patches/730-ft_iface.patch
index d9a4f15f0..1826c9762 100644
--- a/package/network/services/hostapd/patches/730-ft_iface.patch
+++ b/package/network/services/hostapd/patches/730-ft_iface.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -3000,6 +3000,8 @@ static int hostapd_config_fill(struct ho
+@@ -3007,6 +3007,8 @@ static int hostapd_config_fill(struct ho
  		wpa_printf(MSG_INFO,
  			   "Line %d: Obsolete peerkey parameter ignored", line);
  #ifdef CONFIG_IEEE80211R_AP
@@ -18,10 +18,10 @@
 +	char ft_iface[IFNAMSIZ + 1];
  	char vlan_bridge[IFNAMSIZ + 1];
  	char wds_bridge[IFNAMSIZ + 1];
- 
+ 	int bridge_hairpin; /* hairpin_mode on bridge members */
 --- a/src/ap/wpa_auth_glue.c
 +++ b/src/ap/wpa_auth_glue.c
-@@ -1595,8 +1595,12 @@ int hostapd_setup_wpa(struct hostapd_dat
+@@ -1616,8 +1616,12 @@ int hostapd_setup_wpa(struct hostapd_dat
  	    wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt)) {
  		const char *ft_iface;
  
diff --git a/package/network/services/hostapd/patches/740-snoop_iface.patch b/package/network/services/hostapd/patches/740-snoop_iface.patch
index 608f15a25..a11664473 100644
--- a/package/network/services/hostapd/patches/740-snoop_iface.patch
+++ b/package/network/services/hostapd/patches/740-snoop_iface.patch
@@ -7,7 +7,7 @@
 +	char snoop_iface[IFNAMSIZ + 1];
  	char vlan_bridge[IFNAMSIZ + 1];
  	char wds_bridge[IFNAMSIZ + 1];
- 
+ 	int bridge_hairpin; /* hairpin_mode on bridge members */
 --- a/src/ap/x_snoop.c
 +++ b/src/ap/x_snoop.c
 @@ -33,14 +33,16 @@ int x_snoop_init(struct hostapd_data *ha
@@ -55,10 +55,10 @@
  			   "x_snoop: Failed to initialize L2 packet processing %s",
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -2318,6 +2318,8 @@ static int hostapd_config_fill(struct ho
- 		os_strlcpy(bss->bridge, pos, sizeof(bss->bridge));
- 		if (!bss->wds_bridge[0])
+@@ -2320,6 +2320,8 @@ static int hostapd_config_fill(struct ho
  			os_strlcpy(bss->wds_bridge, pos, sizeof(bss->wds_bridge));
+ 	} else if (os_strcmp(buf, "bridge_hairpin") == 0) {
+ 		bss->bridge_hairpin = atoi(pos);
 +	} else if (os_strcmp(buf, "snoop_iface") == 0) {
 +		os_strlcpy(bss->snoop_iface, pos, sizeof(bss->snoop_iface));
  	} else if (os_strcmp(buf, "vlan_bridge") == 0) {
diff --git a/package/network/services/hostapd/patches/750-qos_map_set_without_interworking.patch b/package/network/services/hostapd/patches/750-qos_map_set_without_interworking.patch
index 479d56155..c3a77bc65 100644
--- a/package/network/services/hostapd/patches/750-qos_map_set_without_interworking.patch
+++ b/package/network/services/hostapd/patches/750-qos_map_set_without_interworking.patch
@@ -18,7 +18,7 @@
  
  #ifdef CONFIG_HS20
  static int hs20_parse_conn_capab(struct hostapd_bss_config *bss, char *buf,
-@@ -4046,10 +4046,10 @@ static int hostapd_config_fill(struct ho
+@@ -4064,10 +4064,10 @@ static int hostapd_config_fill(struct ho
  		bss->gas_frag_limit = val;
  	} else if (os_strcmp(buf, "gas_comeback_delay") == 0) {
  		bss->gas_comeback_delay = atoi(pos);
@@ -32,7 +32,7 @@
  		os_free(bss->dump_msk_file);
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -1424,6 +1424,7 @@ static int hostapd_setup_bss(struct host
+@@ -1499,6 +1499,7 @@ static int hostapd_setup_bss(struct host
  		wpa_printf(MSG_ERROR, "GAS server initialization failed");
  		return -1;
  	}
@@ -40,7 +40,7 @@
  
  	if (conf->qos_map_set_len &&
  	    hostapd_drv_set_qos_map(hapd, conf->qos_map_set,
-@@ -1431,7 +1432,6 @@ static int hostapd_setup_bss(struct host
+@@ -1506,7 +1507,6 @@ static int hostapd_setup_bss(struct host
  		wpa_printf(MSG_ERROR, "Failed to initialize QoS Map");
  		return -1;
  	}
@@ -50,7 +50,7 @@
  		wpa_printf(MSG_ERROR, "BSS Load initialization failed");
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -2586,8 +2586,6 @@ void wnm_bss_keep_alive_deinit(struct wp
+@@ -2672,8 +2672,6 @@ void wnm_bss_keep_alive_deinit(struct wp
  }
  
  
@@ -59,16 +59,16 @@
  static int wpas_qos_map_set(struct wpa_supplicant *wpa_s, const u8 *qos_map,
  			    size_t len)
  {
-@@ -2620,8 +2618,6 @@ static void interworking_process_assoc_r
+@@ -2706,8 +2704,6 @@ static void interworking_process_assoc_r
  	}
  }
  
 -#endif /* CONFIG_INTERWORKING */
 -
  
- static void multi_ap_process_assoc_resp(struct wpa_supplicant *wpa_s,
- 					const u8 *ies, size_t ies_len)
-@@ -2954,10 +2950,8 @@ static int wpa_supplicant_event_associnf
+ static void wpa_supplicant_set_4addr_mode(struct wpa_supplicant *wpa_s)
+ {
+@@ -3087,10 +3083,8 @@ static int wpa_supplicant_event_associnf
  		wnm_process_assoc_resp(wpa_s, data->assoc_info.resp_ies,
  				       data->assoc_info.resp_ies_len);
  #endif /* CONFIG_WNM */
@@ -81,7 +81,7 @@
  			   data->assoc_info.resp_ies_len, WLAN_EID_VHT_CAP))
 --- a/src/ap/ieee802_11_shared.c
 +++ b/src/ap/ieee802_11_shared.c
-@@ -1100,13 +1100,11 @@ u8 * hostapd_eid_rsnxe(struct hostapd_da
+@@ -1116,13 +1116,11 @@ u8 * hostapd_eid_rsnxe(struct hostapd_da
  u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
  		    const u8 *ext_capab_ie, size_t ext_capab_ie_len)
  {
diff --git a/package/network/services/hostapd/patches/751-qos_map_ignore_when_unsupported.patch b/package/network/services/hostapd/patches/751-qos_map_ignore_when_unsupported.patch
index d90a27523..1fc4e8a77 100644
--- a/package/network/services/hostapd/patches/751-qos_map_ignore_when_unsupported.patch
+++ b/package/network/services/hostapd/patches/751-qos_map_ignore_when_unsupported.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
-@@ -864,7 +864,8 @@ int hostapd_start_dfs_cac(struct hostapd
+@@ -874,7 +874,8 @@ int hostapd_start_dfs_cac(struct hostapd
  int hostapd_drv_set_qos_map(struct hostapd_data *hapd,
  			    const u8 *qos_map_set, u8 qos_map_set_len)
  {
diff --git a/package/network/services/hostapd/patches/760-dynamic_own_ip.patch b/package/network/services/hostapd/patches/760-dynamic_own_ip.patch
index 3d2b59e8c..2f5015892 100644
--- a/package/network/services/hostapd/patches/760-dynamic_own_ip.patch
+++ b/package/network/services/hostapd/patches/760-dynamic_own_ip.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -311,6 +311,7 @@ struct hostapd_bss_config {
+@@ -310,6 +310,7 @@ struct hostapd_bss_config {
  	unsigned int eap_sim_db_timeout;
  	int eap_server_erp; /* Whether ERP is enabled on internal EAP server */
  	struct hostapd_ip_addr own_ip_addr;
@@ -98,7 +98,7 @@
  	    hapd->conf->own_ip_addr.af == AF_INET &&
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -2681,6 +2681,8 @@ static int hostapd_config_fill(struct ho
+@@ -2688,6 +2688,8 @@ static int hostapd_config_fill(struct ho
  	} else if (os_strcmp(buf, "iapp_interface") == 0) {
  		wpa_printf(MSG_INFO, "DEPRECATED: iapp_interface not used");
  #endif /* CONFIG_IAPP */
diff --git a/package/network/services/hostapd/patches/761-shared_das_port.patch b/package/network/services/hostapd/patches/761-shared_das_port.patch
index 7516b7349..59c2a9679 100644
--- a/package/network/services/hostapd/patches/761-shared_das_port.patch
+++ b/package/network/services/hostapd/patches/761-shared_das_port.patch
@@ -10,7 +10,7 @@
  	unsigned int time_window;
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -1367,6 +1367,7 @@ static int hostapd_setup_bss(struct host
+@@ -1442,6 +1442,7 @@ static int hostapd_setup_bss(struct host
  		struct radius_das_conf das_conf;
  		os_memset(&das_conf, 0, sizeof(das_conf));
  		das_conf.port = conf->radius_das_port;
diff --git a/package/network/services/hostapd/patches/800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch b/package/network/services/hostapd/patches/800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch
deleted file mode 100644
index 1d9e9564e..000000000
--- a/package/network/services/hostapd/patches/800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 37528a5205cb0b9e2238b7d97fb2ff5457448f1c Mon Sep 17 00:00:00 2001
-From: David Bauer <mail@david-bauer.net>
-Date: Thu, 8 Sep 2022 01:45:41 +0200
-Subject: [PATCH] acs: don't select indoor channel on outdoor operation
-
-Don't select channels designated for exclusive-indoor use when the
-country3 element is set on outdoor operation.
-
-Signed-off-by: David Bauer <mail@david-bauer.net>
----
- src/ap/acs.c | 9 +++++++++
- src/ap/dfs.c | 3 +++
- 2 files changed, 12 insertions(+)
-
---- a/src/ap/acs.c
-+++ b/src/ap/acs.c
-@@ -552,6 +552,9 @@ static void acs_survey_mode_interference
- 		if (chan->max_tx_power < iface->conf->min_tx_power)
- 			continue;
- 
-+		if (chan->flag & HOSTAPD_CHAN_INDOOR_ONLY && iface->conf->country[2] == 0x4f)
-+			continue;
-+
- 		wpa_printf(MSG_DEBUG, "ACS: Survey analysis for channel %d (%d MHz)",
- 			   chan->chan, chan->freq);
- 
-@@ -686,6 +689,9 @@ acs_find_ideal_chan_mode(struct hostapd_
- 		if (chan->max_tx_power < iface->conf->min_tx_power)
- 			continue;
- 
-+		if (chan->flag & HOSTAPD_CHAN_INDOOR_ONLY && iface->conf->country[2] == 0x4f)
-+			continue;
-+
- 		if (!chan_bw_allowed(chan, bw, 1, 1)) {
- 			wpa_printf(MSG_DEBUG,
- 				   "ACS: Channel %d: BW %u is not supported",
-@@ -1067,6 +1073,9 @@ static int * acs_request_scan_add_freqs(
- 		if (chan->max_tx_power < iface->conf->min_tx_power)
- 			continue;
- 
-+		if (chan->flag & HOSTAPD_CHAN_INDOOR_ONLY && iface->conf->country[2] == 0x4f)
-+			continue;
-+
- 		*freq++ = chan->freq;
- 	}
- 
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -282,6 +282,9 @@ static int dfs_find_channel(struct hosta
- 		if (chan->max_tx_power < iface->conf->min_tx_power)
- 			continue;
- 
-+		if (chan->flag & HOSTAPD_CHAN_INDOOR_ONLY && iface->conf->country[2] == 0x4f)
-+			continue;
-+
- 		if (ret_chan && idx == channel_idx) {
- 			wpa_printf(MSG_DEBUG, "Selected channel %d (%d)",
- 				   chan->freq, chan->chan);
diff --git a/package/network/services/hostapd/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch b/package/network/services/hostapd/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
index e78a4ef5c..51690def0 100644
--- a/package/network/services/hostapd/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
+++ b/package/network/services/hostapd/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
@@ -13,7 +13,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/wpa_supplicant/ctrl_iface.c
 +++ b/wpa_supplicant/ctrl_iface.c
-@@ -12241,7 +12241,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -12640,7 +12640,7 @@ char * wpa_supplicant_ctrl_iface_process
  		if (wpas_ctrl_iface_coloc_intf_report(wpa_s, buf + 18))
  			reply_len = -1;
  #endif /* CONFIG_WNM */
@@ -22,7 +22,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  	} else if (os_strncmp(buf, "DISASSOC_IMMINENT ", 18) == 0) {
  		if (ap_ctrl_iface_disassoc_imminent(wpa_s, buf + 18))
  			reply_len = -1;
-@@ -12251,7 +12251,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -12650,7 +12650,7 @@ char * wpa_supplicant_ctrl_iface_process
  	} else if (os_strncmp(buf, "BSS_TM_REQ ", 11) == 0) {
  		if (ap_ctrl_iface_bss_tm_req(wpa_s, buf + 11))
  			reply_len = -1;
diff --git a/package/network/services/hostapd/patches/992-openssl-include-rsa.patch b/package/network/services/hostapd/patches/992-openssl-include-rsa.patch
deleted file mode 100644
index 581ae9f67..000000000
--- a/package/network/services/hostapd/patches/992-openssl-include-rsa.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From f374d52079111a4340acb6df835f45ac6b5f3f60 Mon Sep 17 00:00:00 2001
-From: Andre Heider <a.heider@gmail.com>
-Date: Wed, 22 Jun 2022 14:13:55 +0200
-Subject: OpenSSL: Include rsa.h for all OpenSSL versions
-
-This fixes the build with OpenSSL 1.1.1:
-../src/crypto/crypto_openssl.c: In function 'crypto_rsa_oaep_sha256_decrypt':
-../src/crypto/crypto_openssl.c:4404:49: error: 'RSA_PKCS1_OAEP_PADDING' undeclared (first use in this function)
-
-Signed-off-by: Andre Heider <a.heider@gmail.com>
----
- src/crypto/crypto_openssl.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/src/crypto/crypto_openssl.c
-+++ b/src/crypto/crypto_openssl.c
-@@ -16,6 +16,7 @@
- #include <openssl/dh.h>
- #include <openssl/hmac.h>
- #include <openssl/rand.h>
-+#include <openssl/rsa.h>
- #include <openssl/pem.h>
- #ifdef CONFIG_ECC
- #include <openssl/ec.h>
-@@ -25,7 +26,6 @@
- #include <openssl/provider.h>
- #include <openssl/core_names.h>
- #include <openssl/param_build.h>
--#include <openssl/rsa.h>
- #include <openssl/encoder.h>
- #include <openssl/decoder.h>
- #else /* OpenSSL version >= 3.0 */
diff --git a/target/linux/rockchip/Makefile b/target/linux/rockchip/Makefile
index ed16333b3..9d19177dd 100644
--- a/target/linux/rockchip/Makefile
+++ b/target/linux/rockchip/Makefile
@@ -7,8 +7,8 @@ BOARDNAME:=Rockchip
 FEATURES:=ext4 audio usb usbgadget display gpio fpu pci pcie rootfs-part boot-part squashfs
 SUBTARGETS:=armv8
 
-KERNEL_PATCHVER=5.4
-KERNEL_TESTING_PATCHVER=6.1
+KERNEL_PATCHVER=6.1
+KERNEL_TESTING_PATCHVER=5.4
 
 define Target/Description
 	Build firmware image for Rockchip SoC devices.
diff --git a/target/linux/rockchip/image/armv8.mk b/target/linux/rockchip/image/armv8.mk
index 21e0f9294..ea79830bc 100644
--- a/target/linux/rockchip/image/armv8.mk
+++ b/target/linux/rockchip/image/armv8.mk
@@ -33,7 +33,7 @@ define Device/embedfire_lubancat1
   IMAGE/sysupgrade.img.gz := boot-common | boot-script rk356x | pine64-img | gzip | append-metadata
   DEVICE_PACKAGES := kmod-r8125
 endef
-#TARGET_DEVICES += embedfire_lubancat1
+TARGET_DEVICES += embedfire_lubancat1
 
 define Device/embedfire_lubancat1n
   DEVICE_VENDOR := EmbedFire
@@ -43,7 +43,7 @@ define Device/embedfire_lubancat1n
   IMAGE/sysupgrade.img.gz := boot-common | boot-script rk356x | pine64-img | gzip | append-metadata
   DEVICE_PACKAGES := kmod-r8169 -urngd kmod-ata-ahci
 endef
-#TARGET_DEVICES += embedfire_lubancat1n
+TARGET_DEVICES += embedfire_lubancat1n
 
 define Device/embedfire_lubancat2
   DEVICE_VENDOR := EmbedFire
@@ -53,7 +53,7 @@ define Device/embedfire_lubancat2
   IMAGE/sysupgrade.img.gz := boot-common | boot-script rk356x | pine64-img | gzip | append-metadata
   DEVICE_PACKAGES := kmod-ata-ahci kmod-ata-ahci-platform kmod-ata-core kmod-ata-ahci kmod-ata-ahci-platform kmod-ata-core
 endef
-#TARGET_DEVICES += embedfire_lubancat2
+TARGET_DEVICES += embedfire_lubancat2
 
 define Device/embedfire_lubancat2n
   DEVICE_VENDOR := EmbedFire
@@ -63,7 +63,7 @@ define Device/embedfire_lubancat2n
   IMAGE/sysupgrade.img.gz := boot-common | boot-script rk356x | pine64-img | gzip | append-metadata
   DEVICE_PACKAGES := kmod-r8125 kmod-ata-ahci kmod-ata-ahci-platform kmod-ata-core
 endef
-#TARGET_DEVICES += embedfire_lubancat2n
+TARGET_DEVICES += embedfire_lubancat2n
 
 define Device/hinlink_common
   DEVICE_VENDOR := HINLINK
@@ -77,14 +77,14 @@ $(call Device/hinlink_common)
   DEVICE_MODEL := OPC-H66K
   SOC := rk3568
 endef
-#TARGET_DEVICES += hinlink_opc-h66k
+TARGET_DEVICES += hinlink_opc-h66k
 
 define Device/hinlink_opc-h68k
 $(call Device/hinlink_common)
   DEVICE_MODEL := OPC-H68K
   SOC := rk3568
 endef
-#TARGET_DEVICES += hinlink_opc-h68k
+TARGET_DEVICES += hinlink_opc-h68k
 
 define Device/hinlink_opc-h69k
 $(call Device/hinlink_common)
@@ -92,7 +92,7 @@ $(call Device/hinlink_common)
   SOC := rk3568
   DEVICE_PACKAGES += kmod-usb-serial-option uqmi
 endef
-#TARGET_DEVICES += hinlink_opc-h69k
+TARGET_DEVICES += hinlink_opc-h69k
 
 define Device/friendlyarm_nanopi-r2c
   DEVICE_VENDOR := FriendlyARM
@@ -142,7 +142,7 @@ define Device/friendlyarm_nanopi-r5s
   IMAGE/sysupgrade.img.gz := boot-common | boot-script rk356x | pine64-img | gzip | append-metadata
   DEVICE_PACKAGES := kmod-r8125 kmod-nvme kmod-scsi-core
 endef
-#TARGET_DEVICES += friendlyarm_nanopi-r5s
+TARGET_DEVICES += friendlyarm_nanopi-r5s
 
 define Device/friendlyarm_nanopi-r5c
   DEVICE_VENDOR := FriendlyARM
@@ -152,4 +152,4 @@ define Device/friendlyarm_nanopi-r5c
   IMAGE/sysupgrade.img.gz := boot-common | boot-script rk356x | pine64-img | gzip | append-metadata
   DEVICE_PACKAGES := kmod-r8125
 endef
-#TARGET_DEVICES += friendlyarm_nanopi-r5c
+TARGET_DEVICES += friendlyarm_nanopi-r5c