diff --git a/package/kernel/ath10k-ct/Makefile b/package/kernel/ath10k-ct/Makefile
index 25ea3376f0..acdaa5a6fc 100644
--- a/package/kernel/ath10k-ct/Makefile
+++ b/package/kernel/ath10k-ct/Makefile
@@ -8,14 +8,14 @@ PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/greearb/ath10k-ct.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2021-09-22
-PKG_SOURCE_VERSION:=e6a7d5b5b834737cd12e357b5efdc2e42d923bf6
-PKG_MIRROR_HASH:=62a1b97089d3561730656ef73beb3cd77231ec636645115cc1bbb3c6c84a6fe3
+PKG_SOURCE_DATE:=2022-05-13
+PKG_SOURCE_VERSION:=f808496fcc6b1f68942914117aebf8b3f8d52bb3
+PKG_MIRROR_HASH:=39527b3408696594eda5579521a9fb798417be4dda73fa08e8b3a8c7b0d3f3d9
 
-# Build the 5.10 ath10k-ct driver version.
+# Build the 5.15 ath10k-ct driver version.
 # Probably this should match as closely as
 # possible to whatever mac80211 backports version is being used.
-CT_KVER="-5.10"
+CT_KVER="-5.15"
 
 PKG_MAINTAINER:=Ben Greear <greearb@candelatech.com>
 PKG_BUILD_PARALLEL:=1
diff --git a/package/kernel/ath10k-ct/patches/201-ath10k-add-LED-and-GPIO-controlling-support-for-various-chipsets.patch b/package/kernel/ath10k-ct/patches/201-ath10k-add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
index 691b504c0f..2cc7c1e678 100644
--- a/package/kernel/ath10k-ct/patches/201-ath10k-add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
+++ b/package/kernel/ath10k-ct/patches/201-ath10k-add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
@@ -66,25 +66,25 @@ v13:
 
 * cleanup includes
 
- ath10k-5.10/Kconfig   |  10 +++
- ath10k-5.10/Makefile  |   1 +
- ath10k-5.10/core.c    |  22 +++++++
- ath10k-5.10/core.h    |   9 ++-
- ath10k-5.10/hw.h      |   1 +
- ath10k-5.10/leds.c    | 103 ++++++++++++++++++++++++++++++
- ath10k-5.10/leds.h    |  45 +++++++++++++
- ath10k-5.10/mac.c     |   1 +
- ath10k-5.10/wmi-ops.h |  32 ++++++++++
- ath10k-5.10/wmi-tlv.c |   2 +
- ath10k-5.10/wmi.c     |  54 ++++++++++++++++
- ath10k-5.10/wmi.h     |  35 ++++++++++
+ ath10k-5.15/Kconfig   |  10 +++
+ ath10k-5.15/Makefile  |   1 +
+ ath10k-5.15/core.c    |  22 +++++++
+ ath10k-5.15/core.h    |   9 ++-
+ ath10k-5.15/hw.h      |   1 +
+ ath10k-5.15/leds.c    | 103 ++++++++++++++++++++++++++++++
+ ath10k-5.15/leds.h    |  45 +++++++++++++
+ ath10k-5.15/mac.c     |   1 +
+ ath10k-5.15/wmi-ops.h |  32 ++++++++++
+ ath10k-5.15/wmi-tlv.c |   2 +
+ ath10k-5.15/wmi.c     |  54 ++++++++++++++++
+ ath10k-5.15/wmi.h     |  35 ++++++++++
  12 files changed, 314 insertions(+), 1 deletion(-)
- create mode 100644 ath10k-5.10/leds.c
- create mode 100644 ath10k-5.10/leds.h
+ create mode 100644 ath10k-5.15/leds.c
+ create mode 100644 ath10k-5.15/leds.h
 
---- a/ath10k-5.10/Kconfig
-+++ b/ath10k-5.10/Kconfig
-@@ -65,6 +65,16 @@ config ATH10K_DEBUGFS
+--- a/ath10k-5.15/Kconfig
++++ b/ath10k-5.15/Kconfig
+@@ -66,6 +66,16 @@ config ATH10K_DEBUGFS
  
  	  If unsure, say Y to make it easier to debug problems.
  
@@ -101,8 +101,8 @@ v13:
  config ATH10K_SPECTRAL
  	bool "Atheros ath10k spectral scan support"
  	depends on ATH10K_DEBUGFS
---- a/ath10k-5.10/Makefile
-+++ b/ath10k-5.10/Makefile
+--- a/ath10k-5.15/Makefile
++++ b/ath10k-5.15/Makefile
 @@ -20,6 +20,7 @@ ath10k_core-$(CONFIG_ATH10K_SPECTRAL) +=
  ath10k_core-$(CONFIG_NL80211_TESTMODE) += testmode.o
  ath10k_core-$(CONFIG_ATH10K_TRACING) += trace.o
@@ -111,9 +111,9 @@ v13:
  ath10k_core-$(CONFIG_MAC80211_DEBUGFS) += debugfs_sta.o
  ath10k_core-$(CONFIG_PM) += wow.o
  ath10k_core-$(CONFIG_ATH10K_CE) += ce.o
---- a/ath10k-5.10/core.c
-+++ b/ath10k-5.10/core.c
-@@ -26,6 +26,7 @@
+--- a/ath10k-5.15/core.c
++++ b/ath10k-5.15/core.c
+@@ -28,6 +28,7 @@
  #include "testmode.h"
  #include "wmi-ops.h"
  #include "coredump.h"
@@ -121,7 +121,7 @@ v13:
  
  /* Disable ath10k-ct DBGLOG output by default */
  unsigned int ath10k_debug_mask = ATH10K_DBG_NO_DBGLOG;
-@@ -68,6 +69,7 @@ static const struct ath10k_hw_params ath
+@@ -70,6 +71,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA988X_2_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca988x hw2.0",
@@ -129,7 +129,7 @@ v13:
  		.patch_load_addr = QCA988X_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -137,6 +139,7 @@ static const struct ath10k_hw_params ath
+@@ -143,6 +145,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9887_1_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9887 hw1.0",
@@ -137,7 +137,7 @@ v13:
  		.patch_load_addr = QCA9887_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -342,6 +345,7 @@ static const struct ath10k_hw_params ath
+@@ -360,6 +363,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA99X0_2_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca99x0 hw2.0",
@@ -145,7 +145,7 @@ v13:
  		.patch_load_addr = QCA99X0_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.otp_exe_param = 0x00000700,
-@@ -382,6 +386,7 @@ static const struct ath10k_hw_params ath
+@@ -402,6 +406,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9984_1_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9984/qca9994 hw1.0",
@@ -153,7 +153,7 @@ v13:
  		.patch_load_addr = QCA9984_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -429,6 +434,7 @@ static const struct ath10k_hw_params ath
+@@ -451,6 +456,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9888_2_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9888 hw2.0",
@@ -161,7 +161,7 @@ v13:
  		.patch_load_addr = QCA9888_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -3705,6 +3711,10 @@ int ath10k_core_start(struct ath10k *ar,
+@@ -3977,6 +3983,10 @@ int ath10k_core_start(struct ath10k *ar,
  			ath10k_wmi_check_apply_board_power_ctl_table(ar);
  	}
  
@@ -172,7 +172,7 @@ v13:
  	return 0;
  
  err_hif_stop:
-@@ -3963,9 +3973,18 @@ static void ath10k_core_register_work(st
+@@ -4238,9 +4248,18 @@ static void ath10k_core_register_work(st
  		goto err_spectral_destroy;
  	}
  
@@ -191,7 +191,7 @@ v13:
  err_spectral_destroy:
  	ath10k_spectral_destroy(ar);
  err_debug_destroy:
-@@ -4025,6 +4044,8 @@ void ath10k_core_unregister(struct ath10
+@@ -4300,6 +4319,8 @@ void ath10k_core_unregister(struct ath10
  	if (!test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags))
  		return;
  
@@ -200,8 +200,8 @@ v13:
  	ath10k_thermal_unregister(ar);
  	/* Stop spectral before unregistering from mac80211 to remove the
  	 * relayfs debugfs file cleanly. Otherwise the parent debugfs tree
---- a/ath10k-5.10/core.h
-+++ b/ath10k-5.10/core.h
+--- a/ath10k-5.15/core.h
++++ b/ath10k-5.15/core.h
 @@ -14,6 +14,7 @@
  #include <linux/pci.h>
  #include <linux/uuid.h>
@@ -210,7 +210,7 @@ v13:
  
  #include "htt.h"
  #include "htc.h"
-@@ -1557,6 +1558,13 @@ struct ath10k {
+@@ -1577,6 +1578,13 @@ struct ath10k {
  	} testmode;
  
  	struct {
@@ -224,8 +224,8 @@ v13:
  		/* protected by data_lock */
  		u32 rx_crc_err_drop;
  		u32 fw_crash_counter;
---- a/ath10k-5.10/hw.h
-+++ b/ath10k-5.10/hw.h
+--- a/ath10k-5.15/hw.h
++++ b/ath10k-5.15/hw.h
 @@ -521,6 +521,7 @@ struct ath10k_hw_params {
  	const char *name;
  	u32 patch_load_addr;
@@ -235,7 +235,7 @@ v13:
  
  	/* Type of hw cycle counter wraparound logic, for more info
 --- /dev/null
-+++ b/ath10k-5.10/leds.c
++++ b/ath10k-5.15/leds.c
 @@ -0,0 +1,103 @@
 +/*
 + * Copyright (c) 2005-2011 Atheros Communications Inc.
@@ -341,7 +341,7 @@ v13:
 +}
 +
 --- /dev/null
-+++ b/ath10k-5.10/leds.h
++++ b/ath10k-5.15/leds.h
 @@ -0,0 +1,41 @@
 +/*
 + * Copyright (c) 2018, The Linux Foundation. All rights reserved.
@@ -384,8 +384,8 @@ v13:
 +
 +#endif
 +#endif /* _LEDS_H_ */
---- a/ath10k-5.10/mac.c
-+++ b/ath10k-5.10/mac.c
+--- a/ath10k-5.15/mac.c
++++ b/ath10k-5.15/mac.c
 @@ -25,6 +25,7 @@
  #include "wmi-tlv.h"
  #include "wmi-ops.h"
@@ -394,8 +394,8 @@ v13:
  
  /*********/
  /* Rates */
---- a/ath10k-5.10/wmi-ops.h
-+++ b/ath10k-5.10/wmi-ops.h
+--- a/ath10k-5.15/wmi-ops.h
++++ b/ath10k-5.15/wmi-ops.h
 @@ -228,7 +228,10 @@ struct wmi_ops {
  			 const struct wmi_bb_timing_cfg_arg *arg);
  	struct sk_buff *(*gen_per_peer_per_tid_cfg)(struct ath10k *ar,
@@ -443,8 +443,8 @@ v13:
  static inline int
  ath10k_wmi_dbglog_cfg(struct ath10k *ar, u64 module_enable, u32 log_level)
  {
---- a/ath10k-5.10/wmi-tlv.c
-+++ b/ath10k-5.10/wmi-tlv.c
+--- a/ath10k-5.15/wmi-tlv.c
++++ b/ath10k-5.15/wmi-tlv.c
 @@ -4594,6 +4594,8 @@ static const struct wmi_ops wmi_tlv_ops
  	.gen_echo = ath10k_wmi_tlv_op_gen_echo,
  	.gen_vdev_spectral_conf = ath10k_wmi_tlv_op_gen_vdev_spectral_conf,
@@ -454,9 +454,9 @@ v13:
  };
  
  static const struct wmi_peer_flags_map wmi_tlv_peer_flags_map = {
---- a/ath10k-5.10/wmi.c
-+++ b/ath10k-5.10/wmi.c
-@@ -8409,6 +8409,49 @@ ath10k_wmi_op_gen_peer_set_param(struct
+--- a/ath10k-5.15/wmi.c
++++ b/ath10k-5.15/wmi.c
+@@ -8413,6 +8413,49 @@ ath10k_wmi_op_gen_peer_set_param(struct
  	return skb;
  }
  
@@ -506,7 +506,7 @@ v13:
  static struct sk_buff *
  ath10k_wmi_op_gen_set_psmode(struct ath10k *ar, u32 vdev_id,
  			     enum wmi_sta_ps_mode psmode)
-@@ -10238,6 +10281,9 @@ static const struct wmi_ops wmi_ops = {
+@@ -10244,6 +10287,9 @@ static const struct wmi_ops wmi_ops = {
  	.fw_stats_fill = ath10k_wmi_main_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
  	.gen_echo = ath10k_wmi_op_gen_echo,
@@ -516,7 +516,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -10308,6 +10354,8 @@ static const struct wmi_ops wmi_10_1_ops
+@@ -10314,6 +10360,8 @@ static const struct wmi_ops wmi_10_1_ops
  	.fw_stats_fill = ath10k_wmi_10x_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
  	.gen_echo = ath10k_wmi_op_gen_echo,
@@ -525,7 +525,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -10387,6 +10435,8 @@ static const struct wmi_ops wmi_10_2_ops
+@@ -10393,6 +10441,8 @@ static const struct wmi_ops wmi_10_2_ops
  	.gen_delba_send = ath10k_wmi_op_gen_delba_send,
  	.fw_stats_fill = ath10k_wmi_10x_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
@@ -534,7 +534,7 @@ v13:
  	/* .gen_pdev_enable_adaptive_cca not implemented */
  };
  
-@@ -10458,6 +10508,8 @@ static const struct wmi_ops wmi_10_2_4_o
+@@ -10464,6 +10514,8 @@ static const struct wmi_ops wmi_10_2_4_o
  		ath10k_wmi_op_gen_pdev_enable_adaptive_cca,
  	.get_vdev_subtype = ath10k_wmi_10_2_4_op_get_vdev_subtype,
  	.gen_bb_timing = ath10k_wmi_10_2_4_op_gen_bb_timing,
@@ -543,7 +543,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -10540,6 +10592,8 @@ static const struct wmi_ops wmi_10_4_ops
+@@ -10546,6 +10598,8 @@ static const struct wmi_ops wmi_10_4_ops
  	.gen_pdev_bss_chan_info_req = ath10k_wmi_10_2_op_gen_pdev_bss_chan_info,
  	.gen_echo = ath10k_wmi_op_gen_echo,
  	.gen_pdev_get_tpc_config = ath10k_wmi_10_2_4_op_gen_pdev_get_tpc_config,
@@ -552,8 +552,8 @@ v13:
  };
  
  int ath10k_wmi_attach(struct ath10k *ar)
---- a/ath10k-5.10/wmi.h
-+++ b/ath10k-5.10/wmi.h
+--- a/ath10k-5.15/wmi.h
++++ b/ath10k-5.15/wmi.h
 @@ -3133,6 +3133,41 @@ enum wmi_10_4_feature_mask {
  
  };
diff --git a/package/kernel/ath10k-ct/patches/202-ath10k-use-tpt-trigger-by-default.patch b/package/kernel/ath10k-ct/patches/202-ath10k-use-tpt-trigger-by-default.patch
index 168c6ab462..fb8468b9c0 100644
--- a/package/kernel/ath10k-ct/patches/202-ath10k-use-tpt-trigger-by-default.patch
+++ b/package/kernel/ath10k-ct/patches/202-ath10k-use-tpt-trigger-by-default.patch
@@ -9,14 +9,14 @@ traffic.
 
 Signed-off-by: Mathias Kresin <dev@kresin.me>
 ---
- ath10k-5.10/core.h | 4 ++++
- ath10k-5.10/leds.c | 4 +---
- ath10k-5.10/mac.c  | 2 +-
+ ath10k-5.15/core.h | 4 ++++
+ ath10k-5.15/leds.c | 4 +---
+ ath10k-5.15/mac.c  | 2 +-
  3 files changed, 6 insertions(+), 4 deletions(-)
 
---- a/ath10k-5.10/core.h
-+++ b/ath10k-5.10/core.h
-@@ -1665,6 +1665,10 @@ struct ath10k {
+--- a/ath10k-5.15/core.h
++++ b/ath10k-5.15/core.h
+@@ -1692,6 +1692,10 @@ struct ath10k {
  	u8 csi_data[4096];
  	u16 csi_data_len;
  
@@ -27,8 +27,8 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
  	/* must be last */
  	u8 drv_priv[] __aligned(sizeof(void *));
  };
---- a/ath10k-5.10/leds.c
-+++ b/ath10k-5.10/leds.c
+--- a/ath10k-5.15/leds.c
++++ b/ath10k-5.15/leds.c
 @@ -81,9 +81,7 @@ int ath10k_leds_register(struct ath10k *
  
  	ar->leds.cdev.name = ar->leds.label;
@@ -40,9 +40,9 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
  
  	ret = led_classdev_register(wiphy_dev(ar->hw->wiphy), &ar->leds.cdev);
  	if (ret)
---- a/ath10k-5.10/mac.c
-+++ b/ath10k-5.10/mac.c
-@@ -11405,7 +11405,7 @@ int ath10k_mac_register(struct ath10k *a
+--- a/ath10k-5.15/mac.c
++++ b/ath10k-5.15/mac.c
+@@ -11544,7 +11544,7 @@ int ath10k_mac_register(struct ath10k *a
  	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
  
  #ifdef CPTCFG_MAC80211_LEDS
diff --git a/package/kernel/ath10k-ct/patches/300-ath10k-ct-Fix-spectral-scan-NULL-pointer.patch b/package/kernel/ath10k-ct/patches/300-ath10k-ct-Fix-spectral-scan-NULL-pointer.patch
new file mode 100644
index 0000000000..a3822a7e49
--- /dev/null
+++ b/package/kernel/ath10k-ct/patches/300-ath10k-ct-Fix-spectral-scan-NULL-pointer.patch
@@ -0,0 +1,32 @@
+From 0d2e335d780bda1432a9ba719c8200f796d27854 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Mon, 29 Nov 2021 12:27:12 +0100
+Subject: [PATCH] ath10k-ct: Fix spectral scan NULL pointer
+
+If spectral scan support is enabled then ath10k-ct will cause a NULL
+pointer due to relay_open() being called with a const callback struct
+which is only supported in kernel 5.11 and later.
+
+So, simply check the kernel version and if 5.11 and newer use the const
+callback struct, otherwise use the regular struct.
+
+Fixes: 553a3ac ("ath10k-ct: use 5.15 version")
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ ath10k-5.15/spectral.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/ath10k-5.15/spectral.c
++++ b/ath10k-5.15/spectral.c
+@@ -497,7 +497,11 @@ static int remove_buf_file_handler(struc
+ 	return 0;
+ }
+ 
++#if LINUX_VERSION_IS_GEQ(5,11,0)
+ static const struct rchan_callbacks rfs_spec_scan_cb = {
++#else
++static struct rchan_callbacks rfs_spec_scan_cb = {
++#endif
+ 	.create_buf_file = create_buf_file_handler,
+ 	.remove_buf_file = remove_buf_file_handler,
+ };
diff --git a/package/kernel/ath10k-ct/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch b/package/kernel/ath10k-ct/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch
index af9c3d455b..d50611b970 100644
--- a/package/kernel/ath10k-ct/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch
+++ b/package/kernel/ath10k-ct/patches/960-0010-ath10k-limit-htt-rx-ring-size.patch
@@ -1,5 +1,5 @@
---- a/ath10k-5.10/htt.h
-+++ b/ath10k-5.10/htt.h
+--- a/ath10k-5.15/htt.h
++++ b/ath10k-5.15/htt.h
 @@ -237,7 +237,11 @@ enum htt_rx_ring_flags {
  };
  
diff --git a/package/kernel/ath10k-ct/patches/960-0011-ath10k-limit-pci-buffer-size.patch b/package/kernel/ath10k-ct/patches/960-0011-ath10k-limit-pci-buffer-size.patch
index 1fc2566f9c..b8c6c35326 100644
--- a/package/kernel/ath10k-ct/patches/960-0011-ath10k-limit-pci-buffer-size.patch
+++ b/package/kernel/ath10k-ct/patches/960-0011-ath10k-limit-pci-buffer-size.patch
@@ -1,5 +1,5 @@
---- a/ath10k-5.10/pci.c
-+++ b/ath10k-5.10/pci.c
+--- a/ath10k-5.15/pci.c
++++ b/ath10k-5.15/pci.c
 @@ -131,7 +131,11 @@ static const struct ce_attr pci_host_ce_
  		.flags = CE_ATTR_FLAGS,
  		.src_nentries = 0,
diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index 8213109319..6d315935f9 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -10,10 +10,10 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=mac80211
 
-PKG_VERSION:=5.10.110-1
-PKG_RELEASE:=1
-PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v5.10.110/
-PKG_HASH:=3d958154080c059adaf26512430fd1a8888d65a2228e5e70e48d028201e148b1
+PKG_VERSION:=5.15.58-1
+PKG_RELEASE:=2
+PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v5.15.58/
+PKG_HASH:=a3c2a2b7bbaf8943c65fd72f4e7d7ad5e205aeae28b26c835f9d8afa0f9810bf
 
 PKG_SOURCE:=backports-$(PKG_VERSION).tar.xz
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/backports-$(PKG_VERSION)
@@ -23,7 +23,6 @@ PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 
 PKG_DRIVERS = \
 	adm8211 \
-	airo \
 	hermes hermes-pci hermes-pcmcia hermes-plx\
 	lib80211 \
 	mac80211-hwsim \
@@ -98,7 +97,7 @@ PKG_CONFIG_DEPENDS += \
 define KernelPackage/cfg80211
   $(call KernelPackage/mac80211/Default)
   TITLE:=cfg80211 - wireless configuration API
-  DEPENDS+= +iw +wireless-regdb
+  DEPENDS+= +iw +iwinfo +wireless-regdb +USE_RFKILL:kmod-rfkill
   ABI_VERSION:=$(PKG_VERSION)-$(PKG_RELEASE)
   FILES:= \
 	$(PKG_BUILD_DIR)/compat/compat.ko \
@@ -127,7 +126,7 @@ define KernelPackage/mac80211
   $(call KernelPackage/mac80211/Default)
   TITLE:=Linux 802.11 Wireless Networking Stack
   # +kmod-crypto-cmac is a runtime only dependency of net/mac80211/aes_cmac.c
-  DEPENDS+= +kmod-cfg80211 +hostapd-common
+  DEPENDS+= +kmod-cfg80211 +kmod-crypto-cmac +kmod-crypto-ccm +kmod-crypto-gcm +hostapd-common
   KCONFIG:=\
 	CONFIG_AVERAGE=y
   FILES:= $(PKG_BUILD_DIR)/net/mac80211/mac80211.ko
@@ -174,18 +173,6 @@ define KernelPackage/adm8211
   AUTOLOAD:=$(call AutoProbe,adm8211)
 endef
 
-define KernelPackage/airo
-  $(call KernelPackage/mac80211/Default)
-  TITLE:=Cisco Aironet driver
-  DEPENDS+=@PCI_SUPPORT +@DRIVER_WEXT_SUPPORT +kmod-cfg80211 @TARGET_x86 @BROKEN
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/cisco/airo.ko
-  AUTOLOAD:=$(call AutoProbe,airo)
-endef
-
-define KernelPackage/airo/description
- Kernel support for Cisco Aironet cards
-endef
-
 define KernelPackage/hermes
   $(call KernelPackage/mac80211/Default)
   TITLE:=Hermes 802.11b chipset support
@@ -265,7 +252,7 @@ endef
 define KernelPackage/mac80211-hwsim
   $(call KernelPackage/mac80211/Default)
   TITLE:=mac80211 HW simulation device
-  DEPENDS+= +kmod-mac80211 +@DRIVER_11AC_SUPPORT +@DRIVER_11N_SUPPORT
+  DEPENDS+= +kmod-mac80211 +@DRIVER_11AX_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11N_SUPPORT
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mac80211_hwsim.ko
   AUTOLOAD:=$(call AutoProbe,mac80211_hwsim)
 endef
@@ -406,8 +393,6 @@ endif
 
 config-$(call config_package,lib80211) += LIB80211 LIB80211_CRYPT_WEP LIB80211_CRYPT_CCMP LIB80211_CRYPT_TKIP
 
-config-$(call config_package,airo) += AIRO
-
 config-$(call config_package,mac80211-hwsim) += MAC80211_HWSIM
 config-$(call config_package,mt7601u) += MT7601U
 config-y += WL_MEDIATEK
@@ -507,9 +492,14 @@ define Build/Patch
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/build,build/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/subsys,subsys/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath,ath/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath5k,ath5k/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath9k,ath9k/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath10k,ath10k/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath11k,ath11k/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/brcm,brcm/)
+	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rtl,rtl/)
 	$(if $(QUILT),touch $(PKG_BUILD_DIR)/.quilt_used)
 endef
 
@@ -517,9 +507,14 @@ define Quilt/Refresh/Package
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/build,build/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/subsys,subsys/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath,ath/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath5k,ath5k/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath9k,ath9k/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath10k,ath10k/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath11k,ath11k/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/brcm,brcm/)
+	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rtl,rtl/)
 endef
 
 define Build/Compile
@@ -545,7 +540,6 @@ endef
 define KernelPackage/cfg80211/install
 	$(INSTALL_DIR) $(1)/lib/wifi $(1)/lib/netifd/wireless
 	$(INSTALL_DATA) ./files/lib/wifi/mac80211.sh $(1)/lib/wifi
-	$(INSTALL_DATA) ./files/lib/netifd/mac80211.sh $(1)/lib/netifd
 	$(INSTALL_BIN) ./files/lib/netifd/wireless/mac80211.sh $(1)/lib/netifd/wireless
 	$(INSTALL_DIR) $(1)/etc/hotplug.d/ieee80211
 	$(INSTALL_DATA) ./files/mac80211.hotplug $(1)/etc/hotplug.d/ieee80211/10-wifi-detect
diff --git a/package/kernel/mac80211/ath.mk b/package/kernel/mac80211/ath.mk
index 70c73eb65d..3e197cc7c9 100644
--- a/package/kernel/mac80211/ath.mk
+++ b/package/kernel/mac80211/ath.mk
@@ -34,7 +34,7 @@ ifdef CONFIG_PACKAGE_MAC80211_TRACING
 	WIL6210_TRACING
 endif
 
-config-$(call config_package,ath) += ATH_CARDS ATH_COMMON ATH_REG_DYNAMIC_USER_REG_HINTS
+config-$(call config_package,ath) += ATH_CARDS ATH_COMMON
 config-$(CONFIG_PACKAGE_ATH_DEBUG) += ATH_DEBUG ATH10K_DEBUG ATH9K_STATION_STATISTICS
 config-$(CONFIG_PACKAGE_ATH_DFS) += ATH9K_DFS_CERTIFIED ATH10K_DFS_CERTIFIED
 config-$(CONFIG_PACKAGE_ATH_SPECTRAL) += ATH9K_COMMON_SPECTRAL ATH10K_SPECTRAL
@@ -45,7 +45,7 @@ config-$(call config_package,owl-loader) += ATH9K_PCI_NO_EEPROM
 config-$(CONFIG_TARGET_ath79) += ATH9K_AHB
 config-$(CONFIG_TARGET_ipq40xx) += ATH10K_AHB
 config-$(CONFIG_PCI) += ATH9K_PCI
-config-$(CONFIG_ATH_USER_REGD) += ATH_USER_REGD
+config-$(CONFIG_ATH_USER_REGD) += ATH_USER_REGD ATH_REG_DYNAMIC_USER_REG_HINTS
 config-$(CONFIG_ATH9K_HWRNG) += ATH9K_HWRNG
 config-$(CONFIG_ATH9K_SUPPORT_PCOEM) += ATH9K_PCOEM
 config-$(CONFIG_ATH9K_TX99) += ATH9K_TX99
@@ -260,7 +260,8 @@ define KernelPackage/ath10k
   FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_core.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_pci.ko
-  AUTOLOAD:=$(call AutoProbe,ath10k_pci)
+  AUTOLOAD:=$(call AutoProbe,ath10k_core ath10k_pci)
+  MODPARAMS.ath10k_core:=frame_mode=2
   VARIANT:=regular
 endef
 
diff --git a/package/kernel/mac80211/broadcom.mk b/package/kernel/mac80211/broadcom.mk
index 0e2db6a749..b82cccf984 100644
--- a/package/kernel/mac80211/broadcom.mk
+++ b/package/kernel/mac80211/broadcom.mk
@@ -209,7 +209,7 @@ config PACKAGE_B43_USE_BCMA
 		default "16,28,29,30" if TARGET_bcm47xx_mips74k
 		default "5,6,7,8,9,10,11,13,15,16,28,29,30"
 		help
-		  This is a comma seperated list of core revision numbers.
+		  This is a comma separated list of core revision numbers.
 
 		  Example (keep files for rev5 only):
 		    5
@@ -224,7 +224,7 @@ config PACKAGE_B43_USE_BCMA
 		default "N,HT" if TARGET_bcm47xx_mips74k
 		default "G,N,LP,HT"
 		help
-		  This is a comma seperated list of PHY types:
+		  This is a comma separated list of PHY types:
 		    A  => A-PHY
 		    AG => Dual A-PHY G-PHY
 		    G  => G-PHY
@@ -451,6 +451,7 @@ define KernelPackage/brcmfmac/config
 		bool "Enable SDIO bus interface support"
 		default y if TARGET_bcm27xx
 		default y if TARGET_rockchip
+		default y if TARGET_imx_cortexa7
 		default y if TARGET_sunxi
 		default n
 		help
diff --git a/package/kernel/mac80211/files/lib/netifd/mac80211.sh b/package/kernel/mac80211/files/lib/netifd/mac80211.sh
deleted file mode 100644
index 92e5c0e395..0000000000
--- a/package/kernel/mac80211/files/lib/netifd/mac80211.sh
+++ /dev/null
@@ -1,36 +0,0 @@
-mac80211_phy_to_path() {
-	local phy="$1"
-
-	[ -x /usr/bin/readlink -a -h /sys/class/ieee80211/${phy} ] || return
-
-	local path="$(readlink -f /sys/class/ieee80211/${phy}/device)"
-	[ -n "$path" ] || return
-
-	path="${path##/sys/devices/}"
-	case "$path" in
-		platform*/pci*) path="${path##platform/}";;
-	esac
-
-	local p
-	local seq=""
-	for p in $(ls /sys/class/ieee80211/$phy/device/ieee80211); do
-		[ "$p" = "$phy" ] && {
-			echo "$path${seq:++$seq}"
-			break
-		}
-
-		seq=$((${seq:-0} + 1))
-	done
-}
-
-mac80211_path_to_phy() {
-	local path="$1"
-
-	local p
-	for p in $(ls /sys/class/ieee80211); do
-		local cur="$(mac80211_phy_to_path "$p")"
-		case "$cur" in
-			*$path) echo "$p"; return;;
-		esac
-	done
-}
diff --git a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
index 8b3a37c81c..591ee3abd5 100644
--- a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
+++ b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 . /lib/netifd/netifd-wireless.sh
 . /lib/netifd/hostapd.sh
-. /lib/netifd/mac80211.sh
+. /lib/functions/system.sh
 
 init_wireless_driver "$@"
 
@@ -29,8 +29,8 @@ drv_mac80211_init_device_config() {
 	config_add_string tx_burst
 	config_add_string distance
 	config_add_int beacon_int chanbw frag rts
-	config_add_int rxantenna txantenna antenna_gain txpower
-	config_add_boolean noscan ht_coex acs_exclude_dfs
+	config_add_int rxantenna txantenna antenna_gain txpower min_tx_power
+	config_add_boolean noscan ht_coex acs_exclude_dfs background_radar
 	config_add_array ht_capab
 	config_add_array channels
 	config_add_array scan_list
@@ -138,13 +138,15 @@ mac80211_hostapd_setup_base() {
 	[ -n "$acs_exclude_dfs" ] && [ "$acs_exclude_dfs" -gt 0 ] &&
 		append base_cfg "acs_exclude_dfs=1" "$N"
 
-	json_get_vars noscan ht_coex vendor_vht
+	json_get_vars noscan ht_coex min_tx_power:0 vendor_vht
 	json_get_values ht_capab_list ht_capab tx_burst
 	json_get_values channel_list channels
 
 	[ "$auto_channel" = 0 ] && [ -z "$channel_list" ] && \
 		channel_list="$channel"
 
+	[ "$min_tx_power" -gt 0 ] && append base_cfg "min_tx_power=$min_tx_power"
+
 	set_default noscan 0
 
 	[ "$noscan" -gt 0 ] && hostapd_noscan=1
@@ -274,6 +276,11 @@ mac80211_hostapd_setup_base() {
 			vht_center_seg0=$idx
 		;;
 	esac
+	[ "$band" = "5g" ] && {
+		json_get_vars background_radar:0
+
+		[ "$background_radar" -eq 1 ] && append base_cfg "enable_background_radar=1" "$N"
+	}
 	[ "$band" = "6g" ] && {
 		op_class=
 		case "$htmode" in
@@ -414,18 +421,20 @@ mac80211_hostapd_setup_base() {
 			he_spr_non_srg_obss_pd_max_offset:1 \
 			he_bss_color
 
-		he_phy_cap=$(iw phy "$phy" info | awk -F "[()]" '/HE PHY Capabilities/ { print $2 }' | head -1)
+		he_phy_cap=$(iw phy "$phy" info | sed -n '/HE Iftypes: AP/,$p' | awk -F "[()]" '/HE PHY Capabilities/ { print $2 }' | head -1)
 		he_phy_cap=${he_phy_cap:2}
-		he_mac_cap=$(iw phy "$phy" info | awk -F "[()]" '/HE MAC Capabilities/ { print $2 }' | head -1)
+		he_mac_cap=$(iw phy "$phy" info | sed -n '/HE Iftypes: AP/,$p' | awk -F "[()]" '/HE MAC Capabilities/ { print $2 }' | head -1)
 		he_mac_cap=${he_mac_cap:2}
 
 		append base_cfg "ieee80211ax=1" "$N"
-		[ -n "$he_bss_color" ] && append base_cfg "he_bss_color=$he_bss_color" "$N"
 		[ "$hwmode" = "a" ] && {
 			append base_cfg "he_oper_chwidth=$vht_oper_chwidth" "$N"
 			append base_cfg "he_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
 		}
 
+		set_default he_bss_color 128
+		append base_cfg "he_bss_color=$he_bss_color" "$N"
+
 		mac80211_add_he_capabilities \
 			he_su_beamformer:${he_phy_cap:6:2}:0x80:$he_su_beamformer \
 			he_su_beamformee:${he_phy_cap:8:2}:0x1:$he_su_beamformee \
@@ -563,7 +572,7 @@ mac80211_generate_mac() {
 find_phy() {
 	[ -n "$phy" -a -d /sys/class/ieee80211/$phy ] && return 0
 	[ -n "$path" ] && {
-		phy="$(mac80211_path_to_phy "$path")"
+		phy="$(iwinfo nl80211 phyname "path=$path")"
 		[ -n "$phy" ] && return 0
 	}
 	[ -n "$macaddr" ] && {
@@ -659,10 +668,12 @@ mac80211_prepare_vif() {
 
 	json_select ..
 
-	[ -n "$macaddr" ] || {
+	if [ -z "$macaddr" ]; then
 		macaddr="$(mac80211_generate_mac $phy)"
 		macidx="$(($macidx + 1))"
-	}
+	elif [ "$macaddr" = 'random' ]; then
+		macaddr="$(macaddr_random)"
+	fi
 
 	json_add_object data
 	json_add_string ifname "$ifname"
diff --git a/package/kernel/mac80211/files/lib/wifi/mac80211.sh b/package/kernel/mac80211/files/lib/wifi/mac80211.sh
index 7e2d41daa2..656a05b1f7 100644
--- a/package/kernel/mac80211/files/lib/wifi/mac80211.sh
+++ b/package/kernel/mac80211/files/lib/wifi/mac80211.sh
@@ -1,5 +1,4 @@
 #!/bin/sh
-. /lib/netifd/mac80211.sh
 
 append DRIVERS "mac80211"
 
@@ -11,7 +10,7 @@ lookup_phy() {
 	local devpath
 	config_get devpath "$device" path
 	[ -n "$devpath" ] && {
-		phy="$(mac80211_path_to_phy "$devpath")"
+		phy="$(iwinfo nl80211 phyname "path=$devpath")"
 		[ -n "$phy" ] && return
 	}
 
@@ -161,7 +160,7 @@ detect_mac80211() {
 
 		get_band_defaults "$dev"
 
-		path="$(mac80211_phy_to_path "$dev")"
+		path="$(iwinfo nl80211 path "$dev")"
 		if [ -n "$path" ]; then
 			dev_id="set wireless.radio${devidx}.path='$path'"
 		else
@@ -175,6 +174,7 @@ detect_mac80211() {
 			set wireless.radio${devidx}.channel=${channel}
 			set wireless.radio${devidx}.band=${mode_band}
 			set wireless.radio${devidx}.htmode=$htmode
+			set wireless.radio${devidx}.country=US
 			set wireless.radio${devidx}.disabled=0
 
 			set wireless.default_radio${devidx}=wifi-iface
@@ -183,6 +183,7 @@ detect_mac80211() {
 			set wireless.default_radio${devidx}.mode=ap
 			set wireless.default_radio${devidx}.ssid=OpenWrt
 			set wireless.default_radio${devidx}.encryption=none
+			set wireless.default_radio${devidx}.iw_qos_map_set=none
 EOF
 		uci -q commit wireless
 
diff --git a/package/kernel/mac80211/intel.mk b/package/kernel/mac80211/intel.mk
index 973b6b1dc9..792397cbf7 100644
--- a/package/kernel/mac80211/intel.mk
+++ b/package/kernel/mac80211/intel.mk
@@ -15,7 +15,7 @@ config-$(call config_package,ipw2200) += IPW2200
 
 define KernelPackage/iwlwifi
   $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT
+  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11AX_SUPPORT
   TITLE:=Intel AGN Wireless support
   FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/iwlwifi.ko \
diff --git a/package/kernel/mac80211/patches/ath/120-owl-loader-compat.patch b/package/kernel/mac80211/patches/ath/120-owl-loader-compat.patch
deleted file mode 100644
index d1d6c9e2e3..0000000000
--- a/package/kernel/mac80211/patches/ath/120-owl-loader-compat.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From: Christian Lamparter <chunkeey@gmail.com>
-Date: Sat, 16 Nov 2019 19:25:24 +0100
-Subject: [PATCH] owl_loader: compatibility patch
-
-This patch includes OpenWrt specific changes that are
-not included in the upstream owl-loader.
-
-This includes a platform data handling changes for ar71xx.
-
-Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
-
---- a/drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c
-+++ b/drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c
-@@ -103,6 +103,7 @@ static void owl_fw_cb(const struct firmw
- {
- 	struct pci_dev *pdev = (struct pci_dev *)context;
- 	struct owl_ctx *ctx = (struct owl_ctx *)pci_get_drvdata(pdev);
-+	struct ath9k_platform_data *pdata = dev_get_platdata(&pdev->dev);
- 	struct pci_bus *bus;
- 
- 	complete(&ctx->eeprom_load);
-@@ -118,6 +119,16 @@ static void owl_fw_cb(const struct firmw
- 		goto release;
- 	}
- 
-+	if (pdata) {
-+		memcpy(pdata->eeprom_data, fw->data, fw->size);
-+
-+		/*
-+		 * eeprom has been successfully loaded - pass the data to ath9k
-+		 * but remove the eeprom_name, so it doesn't try to load it too.
-+		 */
-+		pdata->eeprom_name = NULL;
-+	}
-+
- 	if (ath9k_pci_fixup(pdev, (const u16 *)fw->data, fw->size))
- 		goto release;
- 
-@@ -137,8 +148,14 @@ release:
- static const char *owl_get_eeprom_name(struct pci_dev *pdev)
- {
- 	struct device *dev = &pdev->dev;
-+	struct ath9k_platform_data *pdata;
- 	char *eeprom_name;
- 
-+	/* try the existing platform data first */
-+	pdata = dev_get_platdata(dev);
-+	if (pdata && pdata->eeprom_name)
-+		return pdata->eeprom_name;
-+
- 	dev_dbg(dev, "using auto-generated eeprom filename\n");
- 
- 	eeprom_name = devm_kzalloc(dev, EEPROM_FILENAME_LEN, GFP_KERNEL);
diff --git a/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch b/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
index bf87d3551a..4ea33365d1 100644
--- a/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
+++ b/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
@@ -37,7 +37,7 @@
  	for (band = 0; band < NUM_NL80211_BANDS; band++) {
  		if (!wiphy->bands[band])
  			continue;
-@@ -378,6 +387,9 @@ ath_reg_apply_ir_flags(struct wiphy *wip
+@@ -379,6 +388,9 @@ ath_reg_apply_ir_flags(struct wiphy *wip
  {
  	struct ieee80211_supported_band *sband;
  
@@ -47,7 +47,7 @@
  	sband = wiphy->bands[NL80211_BAND_2GHZ];
  	if (!sband)
  		return;
-@@ -407,6 +419,9 @@ static void ath_reg_apply_radar_flags(st
+@@ -408,6 +420,9 @@ static void ath_reg_apply_radar_flags(st
  	struct ieee80211_channel *ch;
  	unsigned int i;
  
@@ -57,7 +57,7 @@
  	if (!wiphy->bands[NL80211_BAND_5GHZ])
  		return;
  
-@@ -639,6 +654,10 @@ ath_regd_init_wiphy(struct ath_regulator
+@@ -640,6 +655,10 @@ ath_regd_init_wiphy(struct ath_regulator
  	const struct ieee80211_regdomain *regd;
  
  	wiphy->reg_notifier = reg_notifier;
@@ -82,7 +82,7 @@
  	help
 --- a/local-symbols
 +++ b/local-symbols
-@@ -85,6 +85,7 @@ ADM8211=
+@@ -106,6 +106,7 @@ ADM8211=
  ATH_COMMON=
  WLAN_VENDOR_ATH=
  ATH_DEBUG=
diff --git a/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch b/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
index c6dc184e28..02281adf4a 100644
--- a/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
+++ b/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
@@ -1,6 +1,6 @@
 --- a/net/wireless/reg.c
 +++ b/net/wireless/reg.c
-@@ -3252,6 +3252,8 @@ void regulatory_hint_country_ie(struct w
+@@ -3309,6 +3309,8 @@ void regulatory_hint_country_ie(struct w
  	enum environment_cap env = ENVIRON_ANY;
  	struct regulatory_request *request = NULL, *lr;
  
@@ -9,7 +9,7 @@
  	/* IE len must be evenly divisible by 2 */
  	if (country_ie_len & 0x01)
  		return;
-@@ -3503,6 +3505,7 @@ static bool is_wiphy_all_set_reg_flag(en
+@@ -3560,6 +3562,7 @@ static bool is_wiphy_all_set_reg_flag(en
  
  void regulatory_hint_disconnect(void)
  {
diff --git a/package/kernel/mac80211/patches/ath/406-ath_relax_default_regd.patch b/package/kernel/mac80211/patches/ath/406-ath_relax_default_regd.patch
index 35b0f2b76e..ee4e461342 100644
--- a/package/kernel/mac80211/patches/ath/406-ath_relax_default_regd.patch
+++ b/package/kernel/mac80211/patches/ath/406-ath_relax_default_regd.patch
@@ -39,7 +39,7 @@
  bool ath_is_world_regd(struct ath_regulatory *reg)
  {
  	return is_wwr_sku(ath_regd_get_eepromRD(reg));
-@@ -658,6 +666,9 @@ ath_regd_init_wiphy(struct ath_regulator
+@@ -659,6 +667,9 @@ ath_regd_init_wiphy(struct ath_regulator
  	if (IS_ENABLED(CPTCFG_ATH_USER_REGD))
  		return 0;
  
diff --git a/package/kernel/mac80211/patches/ath/550-ath9k-disable-bands-via-dt.patch b/package/kernel/mac80211/patches/ath/550-ath9k-disable-bands-via-dt.patch
deleted file mode 100644
index 7d3a334c42..0000000000
--- a/package/kernel/mac80211/patches/ath/550-ath9k-disable-bands-via-dt.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- a/drivers/net/wireless/ath/ath9k/init.c
-+++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -627,6 +627,12 @@ static int ath9k_of_init(struct ath_soft
- 
- 	ath_dbg(common, CONFIG, "parsing configuration from OF node\n");
- 
-+	if (of_property_read_bool(np, "qca,disable-2ghz"))
-+		ah->disable_2ghz = true;
-+
-+	if (of_property_read_bool(np, "qca,disable-5ghz"))
-+		ah->disable_5ghz = true;
-+
- 	if (of_property_read_bool(np, "qca,no-eeprom")) {
- 		/* ath9k-eeprom-<bus>-<id>.bin */
- 		scnprintf(eeprom_name, sizeof(eeprom_name),
diff --git a/package/kernel/mac80211/patches/ath/580-ath9k_ar9561_fix_bias_level.patch b/package/kernel/mac80211/patches/ath/580-ath9k_ar9561_fix_bias_level.patch
deleted file mode 100644
index e4c2e1cd02..0000000000
--- a/package/kernel/mac80211/patches/ath/580-ath9k_ar9561_fix_bias_level.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 4509e523dba46f789377cfec6f20579adf743416 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Thibaut=20VAR=C3=88NE?= <hacks+kernel@slashdirt.org>
-Date: Sun, 17 Apr 2022 11:31:35 +0200
-Subject: [PATCH v2] ath9k: fix QCA9561 PA bias level
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This patch fixes an invalid TX PA DC bias level on QCA9561, which
-results in a very low output power and very low throughput as devices
-are further away from the AP (compared to other 2.4GHz APs).
-
-This patch was suggested by Felix Fietkau, who noted[1]:
-"The value written to that register is wrong, because while the mask
-definition AR_CH0_TOP2_XPABIASLVL uses a different value for 9561, the
-shift definition AR_CH0_TOP2_XPABIASLVL_S is hardcoded to 12, which is
-wrong for 9561."
-
-In real life testing, without this patch the 2.4GHz throughput on
-Yuncore XD3200 is around 10Mbps sitting next to the AP, and closer to
-practical maximum with the patch applied.
-
-[1] https://lore.kernel.org/all/91c58969-c60e-2f41-00ac-737786d435ae@nbd.name
-
-Signed-off-by: Thibaut VARÈNE <hacks+kernel@slashdirt.org>
----
-v2: Adjust #define per Felix's suggestion
----
- drivers/net/wireless/ath/ath9k/ar9003_phy.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
-index a171dbb29..ad949eb02 100644
---- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
-@@ -720,7 +720,7 @@
- #define AR_CH0_TOP2		(AR_SREV_9300(ah) ? 0x1628c : \
- 					(AR_SREV_9462(ah) ? 0x16290 : 0x16284))
- #define AR_CH0_TOP2_XPABIASLVL		(AR_SREV_9561(ah) ? 0x1e00 : 0xf000)
--#define AR_CH0_TOP2_XPABIASLVL_S	12
-+#define AR_CH0_TOP2_XPABIASLVL_S	(AR_SREV_9561(ah) ? 9 : 12)
- 
- #define AR_CH0_XTAL		(AR_SREV_9300(ah) ? 0x16294 : \
- 				 ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16298 : \
--- 
-2.30.2
-
diff --git a/package/kernel/mac80211/patches/ath/922-ath10k-increase-rx-buffer-size-to-2048.patch b/package/kernel/mac80211/patches/ath/922-ath10k-increase-rx-buffer-size-to-2048.patch
deleted file mode 100644
index 8f7a60eec8..0000000000
--- a/package/kernel/mac80211/patches/ath/922-ath10k-increase-rx-buffer-size-to-2048.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From: Linus Lüssing <ll@simonwunderlich.de>
-Date: Wed, 5 Feb 2020 20:10:43 +0100
-Subject: ath10k: increase rx buffer size to 2048
-
-Before, only frames with a maximum size of 1528 bytes could be
-transmitted between two 802.11s nodes.
-
-For batman-adv for instance, which adds its own header to each frame,
-we typically need an MTU of at least 1532 bytes to be able to transmit
-without fragmentation.
-
-This patch now increases the maxmimum frame size from 1528 to 1656
-bytes.
-
-Tested with two ath10k devices in 802.11s mode, as well as with
-batman-adv on top of 802.11s with forwarding disabled.
-
-Fix originally found and developed by Ben Greear.
-
-Link: https://github.com/greearb/ath10k-ct/issues/89
-Link: https://github.com/greearb/ath10k-ct/commit/9e5ab25027e0971fa24ccf93373324c08c4e992d
-Cc: Ben Greear <greearb@candelatech.com>
-Signed-off-by: Linus Lüssing <ll@simonwunderlich.de>
-
-Forwarded: https://patchwork.kernel.org/patch/11367055/
-
---- a/drivers/net/wireless/ath/ath10k/htt.h
-+++ b/drivers/net/wireless/ath/ath10k/htt.h
-@@ -2243,7 +2243,7 @@ struct htt_rx_chan_info {
-  * Should be: sizeof(struct htt_host_rx_desc) + max rx MSDU size,
-  * rounded up to a cache line size.
-  */
--#define HTT_RX_BUF_SIZE 1920
-+#define HTT_RX_BUF_SIZE 2048
- #define HTT_RX_MSDU_SIZE (HTT_RX_BUF_SIZE - (int)sizeof(struct htt_rx_desc))
- 
- /* Refill a bunch of RX buffers for each refill round so that FW/HW can handle
diff --git a/package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch b/package/kernel/mac80211/patches/ath10k/080-ath10k_thermal_config.patch
similarity index 97%
rename from package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch
rename to package/kernel/mac80211/patches/ath10k/080-ath10k_thermal_config.patch
index de6f9d9bb0..d9a3cd534c 100644
--- a/package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch
+++ b/package/kernel/mac80211/patches/ath10k/080-ath10k_thermal_config.patch
@@ -37,7 +37,7 @@
  void ath10k_thermal_event_temperature(struct ath10k *ar, int temperature);
 --- a/local-symbols
 +++ b/local-symbols
-@@ -142,6 +142,7 @@ ATH10K_SNOC=
+@@ -165,6 +165,7 @@ ATH10K_SNOC=
  ATH10K_DEBUG=
  ATH10K_DEBUGFS=
  ATH10K_SPECTRAL=
diff --git a/package/kernel/mac80211/patches/ath10k/081-01-ath10k-improve-tx-status-reporting.patch b/package/kernel/mac80211/patches/ath10k/081-01-ath10k-improve-tx-status-reporting.patch
new file mode 100644
index 0000000000..c024850918
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath10k/081-01-ath10k-improve-tx-status-reporting.patch
@@ -0,0 +1,69 @@
+From 2587d5198aa5adcbd8896aae4a2404dc13d48637 Mon Sep 17 00:00:00 2001
+From: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Date: Wed, 18 May 2022 10:27:26 +0300
+Subject: ath10k: improve tx status reporting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We use ieee80211_tx_status() to report each completed tx frame.
+Internally, this function calls sta_info_get_by_addrs(), what has a
+couple of drawbacks:
+1. additional station lookup causes a performance degradation;
+2. mac80211 can not properly account Ethernet encapsulated frames due
+   to the inability to properly determine the destination (station) MAC
+   address since ieee80211_tx_status() assumes the frame has a 802.11
+   header.
+
+The latter is especially destructive if we want to use hardware frames
+encapsulation.
+
+To fix both of these issues, replace ieee80211_tx_status() with
+ieee80211_tx_status_ext() call and feed it station pointer from the tx
+queue associated with the transmitted frame.
+
+Tested-on: QCA9888 hw2.0 PCI 10.4-3.9.0.2-00131
+Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00157-QCARMSWPZ-1
+
+Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Tested-by: Oldřich Jedlička <oldium.pro@gmail.com> # TP-Link Archer C7 v4 & v5 (QCA9563 + QCA9880)
+Tested-by: Edward Matijevic <motolav@gmail.com> # TP-Link Archer C2600 (IPQ8064 + QCA9980 10.4.1.00030-1)
+Tested-by: Edward Matijevic <motolav@gmail.com> # QCA9377 PCI in Sta mode
+Tested-by: Zhijun You <hujy652@gmail.com> # NETGEAR R7800 (QCA9984 10.4-3.9.0.2-00159)
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220516032519.29831-2-ryazanov.s.a@gmail.com
+---
+ drivers/net/wireless/ath/ath10k/txrx.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath10k/txrx.c
++++ b/drivers/net/wireless/ath/ath10k/txrx.c
+@@ -43,6 +43,7 @@ out:
+ int ath10k_txrx_tx_unref(struct ath10k_htt *htt,
+ 			 const struct htt_tx_done *tx_done)
+ {
++	struct ieee80211_tx_status status;
+ 	struct ath10k *ar = htt->ar;
+ 	struct device *dev = ar->dev;
+ 	struct ieee80211_tx_info *info;
+@@ -128,7 +129,19 @@ int ath10k_txrx_tx_unref(struct ath10k_h
+ 		info->status.is_valid_ack_signal = true;
+ 	}
+ 
+-	ieee80211_tx_status(htt->ar->hw, msdu);
++	memset(&status, 0, sizeof(status));
++	status.skb = msdu;
++	status.info = info;
++
++	rcu_read_lock();
++
++	if (txq)
++		status.sta = txq->sta;
++
++	ieee80211_tx_status_ext(htt->ar->hw, &status);
++
++	rcu_read_unlock();
++
+ 	/* we do not own the msdu anymore */
+ 
+ 	return 0;
diff --git a/package/kernel/mac80211/patches/ath10k/081-02-ath10k-turn-rawmode-into-frame-mode.patch b/package/kernel/mac80211/patches/ath10k/081-02-ath10k-turn-rawmode-into-frame-mode.patch
new file mode 100644
index 0000000000..e672815522
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath10k/081-02-ath10k-turn-rawmode-into-frame-mode.patch
@@ -0,0 +1,74 @@
+From a09740548275a74b897654b3aca5af589289b57a Mon Sep 17 00:00:00 2001
+From: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Date: Mon, 16 May 2022 13:26:00 +0300
+Subject: ath10k: turn rawmode into frame_mode
+
+Turn boolean rawmode module param into integer frame_mode param that
+contains value from ath10k_hw_txrx_mode enum. As earlier the default
+param value is non-RAW (native Wi-Fi) encapsulation. The param name
+is selected to be consistent with the similar ath11k param.
+
+This is a preparation step for upcoming encapsulation offloading
+support.
+
+Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220516032519.29831-4-ryazanov.s.a@gmail.com
+---
+ drivers/net/wireless/ath/ath10k/core.c | 11 +++++++----
+ drivers/net/wireless/ath/ath10k/core.h |  1 +
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -32,9 +32,11 @@ EXPORT_SYMBOL(ath10k_debug_mask);
+ static unsigned int ath10k_cryptmode_param;
+ static bool uart_print;
+ static bool skip_otp;
+-static bool rawmode;
+ static bool fw_diag_log;
+ 
++/* frame mode values are mapped as per enum ath10k_hw_txrx_mode */
++unsigned int ath10k_frame_mode = ATH10K_HW_TXRX_NATIVE_WIFI;
++
+ unsigned long ath10k_coredump_mask = BIT(ATH10K_FW_CRASH_DUMP_REGISTERS) |
+ 				     BIT(ATH10K_FW_CRASH_DUMP_CE_DATA);
+ 
+@@ -43,15 +45,16 @@ module_param_named(debug_mask, ath10k_de
+ module_param_named(cryptmode, ath10k_cryptmode_param, uint, 0644);
+ module_param(uart_print, bool, 0644);
+ module_param(skip_otp, bool, 0644);
+-module_param(rawmode, bool, 0644);
+ module_param(fw_diag_log, bool, 0644);
++module_param_named(frame_mode, ath10k_frame_mode, uint, 0644);
+ module_param_named(coredump_mask, ath10k_coredump_mask, ulong, 0444);
+ 
+ MODULE_PARM_DESC(debug_mask, "Debugging mask");
+ MODULE_PARM_DESC(uart_print, "Uart target debugging");
+ MODULE_PARM_DESC(skip_otp, "Skip otp failure for calibration in testmode");
+ MODULE_PARM_DESC(cryptmode, "Crypto mode: 0-hardware, 1-software");
+-MODULE_PARM_DESC(rawmode, "Use raw 802.11 frame datapath");
++MODULE_PARM_DESC(frame_mode,
++		 "Datapath frame mode (0: raw, 1: native wifi (default))");
+ MODULE_PARM_DESC(coredump_mask, "Bitfield of what to include in firmware crash file");
+ MODULE_PARM_DESC(fw_diag_log, "Diag based fw log debugging");
+ 
+@@ -2487,7 +2490,7 @@ static int ath10k_core_init_firmware_fea
+ 	ar->htt.max_num_amsdu = ATH10K_HTT_MAX_NUM_AMSDU_DEFAULT;
+ 	ar->htt.max_num_ampdu = ATH10K_HTT_MAX_NUM_AMPDU_DEFAULT;
+ 
+-	if (rawmode) {
++	if (ath10k_frame_mode == ATH10K_HW_TXRX_RAW) {
+ 		if (!test_bit(ATH10K_FW_FEATURE_RAW_MODE_SUPPORT,
+ 			      fw_file->fw_features)) {
+ 			ath10k_err(ar, "rawmode = 1 requires support from firmware");
+--- a/drivers/net/wireless/ath/ath10k/core.h
++++ b/drivers/net/wireless/ath/ath10k/core.h
+@@ -1311,6 +1311,7 @@ static inline bool ath10k_peer_stats_ena
+ 	return false;
+ }
+ 
++extern unsigned int ath10k_frame_mode;
+ extern unsigned long ath10k_coredump_mask;
+ 
+ void ath10k_core_napi_sync_disable(struct ath10k *ar);
diff --git a/package/kernel/mac80211/patches/ath10k/081-03-ath10k-htt-tx-do-not-interpret-Eth-frames-as-WiFi.patch b/package/kernel/mac80211/patches/ath10k/081-03-ath10k-htt-tx-do-not-interpret-Eth-frames-as-WiFi.patch
new file mode 100644
index 0000000000..a669c77fe2
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath10k/081-03-ath10k-htt-tx-do-not-interpret-Eth-frames-as-WiFi.patch
@@ -0,0 +1,163 @@
+From 70f119fb82af7f7417dc659faf02c91e1f853739 Mon Sep 17 00:00:00 2001
+From: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Date: Mon, 16 May 2022 13:26:00 +0300
+Subject: ath10k: htt_tx: do not interpret Eth frames as WiFi
+
+The xmit path for the Ethernet encapsulated frames become more or less
+usable since d740d8fd2439 ("ath10k: unify tx mode and dispatch"). This
+change reorganize the xmit path in a manageable way to properly support
+various tx modes, but misses that the Ethernet encapsulated frame is a
+special case. We do not have an IEEE 802.11 header at the begining of
+them. But the HTT Tx handler still interprets first bytes of each frame
+as an IEEE 802.11 Frame Control field.
+
+Than this code was copied by e62ee5c381c5 ("ath10k: Add support for
+htt_data_tx_desc_64 descriptor") and a2097d6444c3 ("ath10k: htt: High
+latency TX support") to another handlers. In fact the issue in the high
+latency (HL) handler was introduced by 83ac260151e7 ("ath10k: add mic
+bytes for pmf management packet").
+
+Ethernet encapsulated frame tx mode stay unused until 75d85fd9993c
+("ath10k: introduce basic tdls functionality") started using it for TDLS
+frames to avoid key selection issue in some firmwares.
+
+Trying to interpret the begining of an Ethernet encapsulated frame as an
+IEEE 802.11 header was not hurt us noticeably since we need to meet two
+conditions: (1) xmit should be performed towards a TDLS peer, and (2)
+the TDLS peer should have a specific OUI part of its MAC address. Looks
+like that the rareness in TDLS communications of OUIs that can be
+interpreted as an 802.11 management frame saves users from facing this
+issue earlier.
+
+Improve Ethernet tx mode support in the HTT Tx handler by avoiding
+interpreting its first bytes as an IEEE 802.11 header. While at it, make
+the ieee80211_hdr variable local to the code block that is guarded by
+!is_eth check. In this way, we clarify in which cases a frame can be
+interpreted as IEEE 802.11, and saves us from similar issues in the
+future.
+
+Credits: this change as part of xmit encapsulation offloading support
+was originally made by QCA and then submitted for inclusion by John
+Crispin [1]. But the whole work was not accepted due to the lack of a
+part for 64-bits descriptors [2]. Zhijun You then pointed this out to me
+in a reply to my initial RFC patch series. And I made this slightly
+reworked version that covered all the HTT Tx handler variants.
+
+1. https://lore.kernel.org/all/20191216092207.31032-1-john@phrozen.org/
+2. https://patchwork.kernel.org/project/linux-wireless/patch/20191216092207.31032-1-john@phrozen.org/
+
+Reported-by: Zhijun You <hujy652@gmail.com>
+Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220516032519.29831-3-ryazanov.s.a@gmail.com
+---
+ drivers/net/wireless/ath/ath10k/htt_tx.c | 61 ++++++++++++++++++--------------
+ 1 file changed, 35 insertions(+), 26 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
+@@ -1295,7 +1295,6 @@ static int ath10k_htt_tx_hl(struct ath10
+ 	struct ath10k *ar = htt->ar;
+ 	int res, data_len;
+ 	struct htt_cmd_hdr *cmd_hdr;
+-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
+ 	struct htt_data_tx_desc *tx_desc;
+ 	struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(msdu);
+ 	struct sk_buff *tmp_skb;
+@@ -1306,11 +1305,15 @@ static int ath10k_htt_tx_hl(struct ath10
+ 	u16 flags1 = 0;
+ 	u16 msdu_id = 0;
+ 
+-	if ((ieee80211_is_action(hdr->frame_control) ||
+-	     ieee80211_is_deauth(hdr->frame_control) ||
+-	     ieee80211_is_disassoc(hdr->frame_control)) &&
+-	     ieee80211_has_protected(hdr->frame_control)) {
+-		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
++	if (!is_eth) {
++		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
++
++		if ((ieee80211_is_action(hdr->frame_control) ||
++		     ieee80211_is_deauth(hdr->frame_control) ||
++		     ieee80211_is_disassoc(hdr->frame_control)) &&
++		     ieee80211_has_protected(hdr->frame_control)) {
++			skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
++		}
+ 	}
+ 
+ 	data_len = msdu->len;
+@@ -1407,7 +1410,6 @@ static int ath10k_htt_tx_32(struct ath10
+ {
+ 	struct ath10k *ar = htt->ar;
+ 	struct device *dev = ar->dev;
+-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(msdu);
+ 	struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(msdu);
+ 	struct ath10k_hif_sg_item sg_items[2];
+@@ -1439,15 +1441,19 @@ static int ath10k_htt_tx_32(struct ath10
+ 	txbuf_paddr = htt->txbuf.paddr +
+ 		      (sizeof(struct ath10k_htt_txbuf_32) * msdu_id);
+ 
+-	if ((ieee80211_is_action(hdr->frame_control) ||
+-	     ieee80211_is_deauth(hdr->frame_control) ||
+-	     ieee80211_is_disassoc(hdr->frame_control)) &&
+-	     ieee80211_has_protected(hdr->frame_control)) {
+-		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
+-	} else if (!(skb_cb->flags & ATH10K_SKB_F_NO_HWCRYPT) &&
+-		   txmode == ATH10K_HW_TXRX_RAW &&
+-		   ieee80211_has_protected(hdr->frame_control)) {
+-		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
++	if (!is_eth) {
++		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
++
++		if ((ieee80211_is_action(hdr->frame_control) ||
++		     ieee80211_is_deauth(hdr->frame_control) ||
++		     ieee80211_is_disassoc(hdr->frame_control)) &&
++		     ieee80211_has_protected(hdr->frame_control)) {
++			skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
++		} else if (!(skb_cb->flags & ATH10K_SKB_F_NO_HWCRYPT) &&
++			   txmode == ATH10K_HW_TXRX_RAW &&
++			   ieee80211_has_protected(hdr->frame_control)) {
++			skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
++		}
+ 	}
+ 
+ 	skb_cb->paddr = dma_map_single(dev, msdu->data, msdu->len,
+@@ -1609,7 +1615,6 @@ static int ath10k_htt_tx_64(struct ath10
+ {
+ 	struct ath10k *ar = htt->ar;
+ 	struct device *dev = ar->dev;
+-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(msdu);
+ 	struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(msdu);
+ 	struct ath10k_hif_sg_item sg_items[2];
+@@ -1641,15 +1646,19 @@ static int ath10k_htt_tx_64(struct ath10
+ 	txbuf_paddr = htt->txbuf.paddr +
+ 		      (sizeof(struct ath10k_htt_txbuf_64) * msdu_id);
+ 
+-	if ((ieee80211_is_action(hdr->frame_control) ||
+-	     ieee80211_is_deauth(hdr->frame_control) ||
+-	     ieee80211_is_disassoc(hdr->frame_control)) &&
+-	     ieee80211_has_protected(hdr->frame_control)) {
+-		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
+-	} else if (!(skb_cb->flags & ATH10K_SKB_F_NO_HWCRYPT) &&
+-		   txmode == ATH10K_HW_TXRX_RAW &&
+-		   ieee80211_has_protected(hdr->frame_control)) {
+-		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
++	if (!is_eth) {
++		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
++
++		if ((ieee80211_is_action(hdr->frame_control) ||
++		     ieee80211_is_deauth(hdr->frame_control) ||
++		     ieee80211_is_disassoc(hdr->frame_control)) &&
++		     ieee80211_has_protected(hdr->frame_control)) {
++			skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
++		} else if (!(skb_cb->flags & ATH10K_SKB_F_NO_HWCRYPT) &&
++			   txmode == ATH10K_HW_TXRX_RAW &&
++			   ieee80211_has_protected(hdr->frame_control)) {
++			skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
++		}
+ 	}
+ 
+ 	skb_cb->paddr = dma_map_single(dev, msdu->data, msdu->len,
diff --git a/package/kernel/mac80211/patches/ath10k/081-04-ath10k-add-encapsulation-offloading-support.patch b/package/kernel/mac80211/patches/ath10k/081-04-ath10k-add-encapsulation-offloading-support.patch
new file mode 100644
index 0000000000..abca7aac9e
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath10k/081-04-ath10k-add-encapsulation-offloading-support.patch
@@ -0,0 +1,194 @@
+From af6d8265c47e46881b80c6b073f53c8c4af52d28 Mon Sep 17 00:00:00 2001
+From: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Date: Mon, 16 May 2022 13:26:00 +0300
+Subject: ath10k: add encapsulation offloading support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Frame encapsulation from Ethernet into the IEEE 802.11 frame format
+takes a considerable host CPU time on the xmit path. The firmware is
+able to do this operation for us, so enable encapsulation offloading for
+AP and Sta interface types to improve overall system performance.
+
+The driver is almost ready for encapsulation offloading support. There
+are only a few places where the driver assumes the frame format is IEEE
+802.11 that need to be fixed.
+
+Encapsulation offloading is currently disabled by default and the driver
+utilizes mac80211 encapsulation support. To activate offloading, the
+frame_mode=2 parameter should be passed during module loading.
+
+On a QCA9563+QCA9888-based access point in bridged mode, encapsulation
+offloading increases TCP 16-streams DL throughput from 365 to 396 mbps
+(+8%) and UDP DL throughput from 436 to 483 mbps (+11%).
+
+Tested-on: QCA9888 hw2.0 PCI 10.4-3.9.0.2-00131
+Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00157-QCARMSWPZ-1
+Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Tested-by: Oldřich Jedlička <oldium.pro@gmail.com> # TP-Link Archer C7 v4 & v5 (QCA9563 + QCA9880)
+Tested-by: Edward Matijevic <motolav@gmail.com> # TP-Link Archer C2600 (IPQ8064 + QCA9980 10.4.1.00030-1)
+Tested-by: Edward Matijevic <motolav@gmail.com> # QCA9377 PCI in Sta mode
+Tested-by: Zhijun You <hujy652@gmail.com> # NETGEAR R7800 (QCA9984 10.4-3.9.0.2-00159)
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220516032519.29831-5-ryazanov.s.a@gmail.com
+---
+ drivers/net/wireless/ath/ath10k/core.c |  2 +-
+ drivers/net/wireless/ath/ath10k/mac.c  | 67 +++++++++++++++++++++++++++-------
+ 2 files changed, 55 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -54,7 +54,7 @@ MODULE_PARM_DESC(uart_print, "Uart targe
+ MODULE_PARM_DESC(skip_otp, "Skip otp failure for calibration in testmode");
+ MODULE_PARM_DESC(cryptmode, "Crypto mode: 0-hardware, 1-software");
+ MODULE_PARM_DESC(frame_mode,
+-		 "Datapath frame mode (0: raw, 1: native wifi (default))");
++		 "Datapath frame mode (0: raw, 1: native wifi (default), 2: ethernet)");
+ MODULE_PARM_DESC(coredump_mask, "Bitfield of what to include in firmware crash file");
+ MODULE_PARM_DESC(fw_diag_log, "Diag based fw log debugging");
+ 
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -3710,6 +3710,9 @@ ath10k_mac_tx_h_get_txmode(struct ath10k
+ 	const struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(skb);
+ 	__le16 fc = hdr->frame_control;
+ 
++	if (IEEE80211_SKB_CB(skb)->flags & IEEE80211_TX_CTL_HW_80211_ENCAP)
++		return ATH10K_HW_TXRX_ETHERNET;
++
+ 	if (!vif || vif->type == NL80211_IFTYPE_MONITOR)
+ 		return ATH10K_HW_TXRX_RAW;
+ 
+@@ -3870,6 +3873,12 @@ static void ath10k_mac_tx_h_fill_cb(stru
+ 	bool noack = false;
+ 
+ 	cb->flags = 0;
++
++	if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
++		cb->flags |= ATH10K_SKB_F_QOS;	/* Assume data frames are QoS */
++		goto finish_cb_fill;
++	}
++
+ 	if (!ath10k_tx_h_use_hwcrypto(vif, skb))
+ 		cb->flags |= ATH10K_SKB_F_NO_HWCRYPT;
+ 
+@@ -3908,6 +3917,7 @@ static void ath10k_mac_tx_h_fill_cb(stru
+ 		cb->flags |= ATH10K_SKB_F_RAW_TX;
+ 	}
+ 
++finish_cb_fill:
+ 	cb->vif = vif;
+ 	cb->txq = txq;
+ 	cb->airtime_est = airtime;
+@@ -4031,7 +4041,11 @@ static int ath10k_mac_tx(struct ath10k *
+ 		ath10k_tx_h_seq_no(vif, skb);
+ 		break;
+ 	case ATH10K_HW_TXRX_ETHERNET:
+-		ath10k_tx_h_8023(skb);
++		/* Convert 802.11->802.3 header only if the frame was erlier
++		 * encapsulated to 802.11 by mac80211. Otherwise pass it as is.
++		 */
++		if (!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP))
++			ath10k_tx_h_8023(skb);
+ 		break;
+ 	case ATH10K_HW_TXRX_RAW:
+ 		if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags) &&
+@@ -4643,12 +4657,10 @@ static void ath10k_mac_op_tx(struct ieee
+ 	struct ieee80211_vif *vif = info->control.vif;
+ 	struct ieee80211_sta *sta = control->sta;
+ 	struct ieee80211_txq *txq = NULL;
+-	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 	enum ath10k_hw_txrx_mode txmode;
+ 	enum ath10k_mac_tx_path txpath;
+ 	bool is_htt;
+ 	bool is_mgmt;
+-	bool is_presp;
+ 	int ret;
+ 	u16 airtime;
+ 
+@@ -4662,8 +4674,14 @@ static void ath10k_mac_op_tx(struct ieee
+ 	is_mgmt = (txpath == ATH10K_MAC_TX_HTT_MGMT);
+ 
+ 	if (is_htt) {
++		bool is_presp = false;
++
+ 		spin_lock_bh(&ar->htt.tx_lock);
+-		is_presp = ieee80211_is_probe_resp(hdr->frame_control);
++		if (!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP)) {
++			struct ieee80211_hdr *hdr = (void *)skb->data;
++
++			is_presp = ieee80211_is_probe_resp(hdr->frame_control);
++		}
+ 
+ 		ret = ath10k_htt_tx_inc_pending(htt);
+ 		if (ret) {
+@@ -5463,6 +5481,30 @@ static int ath10k_mac_set_txbf_conf(stru
+ 					 ar->wmi.vdev_param->txbf, value);
+ }
+ 
++static void ath10k_update_vif_offload(struct ieee80211_hw *hw,
++				      struct ieee80211_vif *vif)
++{
++	struct ath10k_vif *arvif = (void *)vif->drv_priv;
++	struct ath10k *ar = hw->priv;
++	u32 vdev_param;
++	int ret;
++
++	if (ath10k_frame_mode != ATH10K_HW_TXRX_ETHERNET ||
++	    ar->wmi.vdev_param->tx_encap_type == WMI_VDEV_PARAM_UNSUPPORTED ||
++	     (vif->type != NL80211_IFTYPE_STATION &&
++	      vif->type != NL80211_IFTYPE_AP))
++		vif->offload_flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
++
++	vdev_param = ar->wmi.vdev_param->tx_encap_type;
++	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
++					ATH10K_HW_TXRX_NATIVE_WIFI);
++	/* 10.X firmware does not support this VDEV parameter. Do not warn */
++	if (ret && ret != -EOPNOTSUPP) {
++		ath10k_warn(ar, "failed to set vdev %i TX encapsulation: %d\n",
++			    arvif->vdev_id, ret);
++	}
++}
++
+ /*
+  * TODO:
+  * Figure out how to handle WMI_VDEV_SUBTYPE_P2P_DEVICE,
+@@ -5672,15 +5714,7 @@ static int ath10k_add_interface(struct i
+ 
+ 	arvif->def_wep_key_idx = -1;
+ 
+-	vdev_param = ar->wmi.vdev_param->tx_encap_type;
+-	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
+-					ATH10K_HW_TXRX_NATIVE_WIFI);
+-	/* 10.X firmware does not support this VDEV parameter. Do not warn */
+-	if (ret && ret != -EOPNOTSUPP) {
+-		ath10k_warn(ar, "failed to set vdev %i TX encapsulation: %d\n",
+-			    arvif->vdev_id, ret);
+-		goto err_vdev_delete;
+-	}
++	ath10k_update_vif_offload(hw, vif);
+ 
+ 	/* Configuring number of spatial stream for monitor interface is causing
+ 	 * target assert in qca9888 and qca6174.
+@@ -9368,6 +9402,7 @@ static const struct ieee80211_ops ath10k
+ 	.stop				= ath10k_stop,
+ 	.config				= ath10k_config,
+ 	.add_interface			= ath10k_add_interface,
++	.update_vif_offload		= ath10k_update_vif_offload,
+ 	.remove_interface		= ath10k_remove_interface,
+ 	.configure_filter		= ath10k_configure_filter,
+ 	.bss_info_changed		= ath10k_bss_info_changed,
+@@ -10037,6 +10072,12 @@ int ath10k_mac_register(struct ath10k *a
+ 	if (test_bit(WMI_SERVICE_TDLS_UAPSD_BUFFER_STA, ar->wmi.svc_map))
+ 		ieee80211_hw_set(ar->hw, SUPPORTS_TDLS_BUFFER_STA);
+ 
++	if (ath10k_frame_mode == ATH10K_HW_TXRX_ETHERNET) {
++		if (ar->wmi.vdev_param->tx_encap_type !=
++		    WMI_VDEV_PARAM_UNSUPPORTED)
++			ieee80211_hw_set(ar->hw, SUPPORTS_TX_ENCAP_OFFLOAD);
++	}
++
+ 	ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+ 	ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
+ 	ar->hw->wiphy->max_remain_on_channel_duration = 5000;
diff --git a/package/kernel/mac80211/patches/ath10k/100-ath10k-support-bus-and-device-specific-API-1-BDF-sel.patch b/package/kernel/mac80211/patches/ath10k/100-ath10k-support-bus-and-device-specific-API-1-BDF-sel.patch
new file mode 100644
index 0000000000..7ef418e506
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath10k/100-ath10k-support-bus-and-device-specific-API-1-BDF-sel.patch
@@ -0,0 +1,65 @@
+From f2a7064a78b22f2b68b9fcbc8a6f4c5e61c5ba64 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sun, 10 Oct 2021 00:17:11 +0200
+Subject: [PATCH] ath10k: support bus and device specific API 1 BDF selection
+
+Some ath10k IPQ40xx devices like the MikroTik hAP ac2 and ac3 require the
+BDF-s to be extracted from the device storage instead of shipping packaged
+API 2 BDF-s.
+
+This is required as MikroTik has started shipping boards that require BDF-s
+to be updated, as otherwise their WLAN performance really suffers.
+This is however impossible as the devices that require this are release
+under the same revision and its not possible to differentiate them from
+devices using the older BDF-s.
+
+In OpenWrt we are extracting the calibration data during runtime and we are
+able to extract the BDF-s in the same manner, however we cannot package the
+BDF-s to API 2 format on the fly and can only use API 1 to provide BDF-s on
+the fly.
+This is an issue as the ath10k driver explicitly looks only for the
+board.bin file and not for something like board-bus-device.bin like it does
+for pre-cal data.
+Due to this we have no way of providing correct BDF-s on the fly, so lets
+extend the ath10k driver to first look for BDF-s in the
+board-bus-device.bin format, for example: board-ahb-a800000.wifi.bin
+If that fails, look for the default board file name as defined previously.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20211009221711.2315352-1-robimarko@gmail.com
+---
+ drivers/net/wireless/ath/ath10k/core.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -1202,6 +1202,7 @@ success:
+ static int ath10k_core_fetch_board_data_api_1(struct ath10k *ar, int bd_ie_type)
+ {
+ 	const struct firmware *fw;
++	char boardname[100];
+ 
+ 	if (bd_ie_type == ATH10K_BD_IE_BOARD) {
+ 		if (!ar->hw_params.fw.board) {
+@@ -1209,9 +1210,19 @@ static int ath10k_core_fetch_board_data_
+ 			return -EINVAL;
+ 		}
+ 
++		scnprintf(boardname, sizeof(boardname), "board-%s-%s.bin",
++			  ath10k_bus_str(ar->hif.bus), dev_name(ar->dev));
++
+ 		ar->normal_mode_fw.board = ath10k_fetch_fw_file(ar,
+ 								ar->hw_params.fw.dir,
+-								ar->hw_params.fw.board);
++								boardname);
++		if (IS_ERR(ar->normal_mode_fw.board)) {
++			fw = ath10k_fetch_fw_file(ar,
++						  ar->hw_params.fw.dir,
++						  ar->hw_params.fw.board);
++			ar->normal_mode_fw.board = fw;
++		}
++
+ 		if (IS_ERR(ar->normal_mode_fw.board))
+ 			return PTR_ERR(ar->normal_mode_fw.board);
+ 
diff --git a/package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
similarity index 94%
rename from package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch
rename to package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
index 2b8fe7816f..e47fb012fa 100644
--- a/package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
@@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
 
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -3206,6 +3206,16 @@ int ath10k_core_register(struct ath10k *
+@@ -3443,6 +3443,16 @@ int ath10k_core_register(struct ath10k *
  
  	queue_work(ar->workqueue, &ar->register_work);
  
diff --git a/package/kernel/mac80211/patches/ath/930-ath10k_add_tpt_led_trigger.patch b/package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch
similarity index 89%
rename from package/kernel/mac80211/patches/ath/930-ath10k_add_tpt_led_trigger.patch
rename to package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch
index 41022b873a..9dfde4385e 100644
--- a/package/kernel/mac80211/patches/ath/930-ath10k_add_tpt_led_trigger.patch
+++ b/package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -9732,6 +9732,21 @@ static int ath10k_mac_init_rd(struct ath
+@@ -9894,6 +9894,21 @@ static int ath10k_mac_init_rd(struct ath
  	return 0;
  }
  
@@ -22,7 +22,7 @@
  int ath10k_mac_register(struct ath10k *ar)
  {
  	static const u32 cipher_suites[] = {
-@@ -10081,6 +10096,12 @@ int ath10k_mac_register(struct ath10k *a
+@@ -10252,6 +10267,12 @@ int ath10k_mac_register(struct ath10k *a
  
  	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
  
diff --git a/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch b/package/kernel/mac80211/patches/ath10k/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
similarity index 96%
rename from package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
rename to package/kernel/mac80211/patches/ath10k/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
index d8c8a8abc0..47b52416ab 100644
--- a/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
+++ b/package/kernel/mac80211/patches/ath10k/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
@@ -85,7 +85,7 @@ v13:
  create mode 100644 drivers/net/wireless/ath/ath10k/leds.h
 --- a/drivers/net/wireless/ath/ath10k/Kconfig
 +++ b/drivers/net/wireless/ath/ath10k/Kconfig
-@@ -70,6 +70,16 @@ config ATH10K_DEBUGFS
+@@ -71,6 +71,16 @@ config ATH10K_DEBUGFS
  
  	  If unsure, say Y to make it easier to debug problems.
  
@@ -114,7 +114,7 @@ v13:
  ath10k_core-$(CONFIG_DEV_COREDUMP) += coredump.o
 --- a/local-symbols
 +++ b/local-symbols
-@@ -145,6 +145,7 @@ ATH10K_DEBUG=
+@@ -166,6 +166,7 @@ ATH10K_DEBUG=
  ATH10K_DEBUGFS=
  ATH10K_SPECTRAL=
  ATH10K_THERMAL=
@@ -124,7 +124,7 @@ v13:
  WCN36XX=
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -25,6 +25,7 @@
+@@ -26,6 +26,7 @@
  #include "testmode.h"
  #include "wmi-ops.h"
  #include "coredump.h"
@@ -132,7 +132,7 @@ v13:
  
  unsigned int ath10k_debug_mask;
  EXPORT_SYMBOL(ath10k_debug_mask);
-@@ -61,6 +62,7 @@ static const struct ath10k_hw_params ath
+@@ -65,6 +66,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA988X_2_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca988x hw2.0",
@@ -140,7 +140,7 @@ v13:
  		.patch_load_addr = QCA988X_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -132,6 +134,7 @@ static const struct ath10k_hw_params ath
+@@ -138,6 +140,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9887_1_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9887 hw1.0",
@@ -148,7 +148,7 @@ v13:
  		.patch_load_addr = QCA9887_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -343,6 +346,7 @@ static const struct ath10k_hw_params ath
+@@ -355,6 +358,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA99X0_2_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca99x0 hw2.0",
@@ -156,7 +156,7 @@ v13:
  		.patch_load_addr = QCA99X0_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.otp_exe_param = 0x00000700,
-@@ -384,6 +388,7 @@ static const struct ath10k_hw_params ath
+@@ -397,6 +401,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9984_1_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9984/qca9994 hw1.0",
@@ -164,7 +164,7 @@ v13:
  		.patch_load_addr = QCA9984_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -432,6 +437,7 @@ static const struct ath10k_hw_params ath
+@@ -446,6 +451,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9888_2_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9888 hw2.0",
@@ -172,7 +172,7 @@ v13:
  		.patch_load_addr = QCA9888_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -2921,6 +2927,10 @@ int ath10k_core_start(struct ath10k *ar,
+@@ -3158,6 +3164,10 @@ int ath10k_core_start(struct ath10k *ar,
  		goto err_hif_stop;
  	}
  
@@ -183,7 +183,7 @@ v13:
  	return 0;
  
  err_hif_stop:
-@@ -3179,9 +3189,18 @@ static void ath10k_core_register_work(st
+@@ -3416,9 +3426,18 @@ static void ath10k_core_register_work(st
  		goto err_spectral_destroy;
  	}
  
@@ -202,7 +202,7 @@ v13:
  err_spectral_destroy:
  	ath10k_spectral_destroy(ar);
  err_debug_destroy:
-@@ -3227,6 +3246,8 @@ void ath10k_core_unregister(struct ath10
+@@ -3464,6 +3483,8 @@ void ath10k_core_unregister(struct ath10
  	if (!test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags))
  		return;
  
@@ -221,7 +221,7 @@ v13:
  
  #include "htt.h"
  #include "htc.h"
-@@ -1237,6 +1238,13 @@ struct ath10k {
+@@ -1256,6 +1257,13 @@ struct ath10k {
  	} testmode;
  
  	struct {
diff --git a/package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch b/package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch
similarity index 92%
rename from package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch
rename to package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch
index 5781f9c7ad..842853ddf4 100644
--- a/package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch
+++ b/package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch
@@ -16,9 +16,9 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
 
 --- a/drivers/net/wireless/ath/ath10k/core.h
 +++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -1290,6 +1290,10 @@ struct ath10k {
- 	bool coex_support;
- 	int coex_gpio_pin;
+@@ -1312,6 +1312,10 @@ struct ath10k {
+ 	s32 tx_power_2g_limit;
+ 	s32 tx_power_5g_limit;
  
 +#ifdef CPTCFG_MAC80211_LEDS
 +	const char *led_default_trigger;
@@ -42,7 +42,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
  	if (ret)
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -10098,7 +10098,7 @@ int ath10k_mac_register(struct ath10k *a
+@@ -10269,7 +10269,7 @@ int ath10k_mac_register(struct ath10k *a
  	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
  
  #ifdef CPTCFG_MAC80211_LEDS
diff --git a/package/kernel/mac80211/patches/ath/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch b/package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
similarity index 93%
rename from package/kernel/mac80211/patches/ath/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
rename to package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
index 1f19765891..a45addf119 100644
--- a/package/kernel/mac80211/patches/ath/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
+++ b/package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
@@ -28,7 +28,7 @@ Forwarded: no
 
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -1010,6 +1010,40 @@ static inline int ath10k_vdev_setup_sync
+@@ -1021,6 +1021,40 @@ static inline int ath10k_vdev_setup_sync
  	return ar->last_wmi_vdev_start_status;
  }
  
@@ -69,7 +69,7 @@ Forwarded: no
  static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
  {
  	struct cfg80211_chan_def *chandef = NULL;
-@@ -1042,7 +1076,8 @@ static int ath10k_monitor_vdev_start(str
+@@ -1053,7 +1087,8 @@ static int ath10k_monitor_vdev_start(str
  	arg.channel.min_power = 0;
  	arg.channel.max_power = channel->max_power * 2;
  	arg.channel.max_reg_power = channel->max_reg_power * 2;
@@ -79,7 +79,7 @@ Forwarded: no
  
  	reinit_completion(&ar->vdev_setup_done);
  	reinit_completion(&ar->vdev_delete_done);
-@@ -1488,7 +1523,8 @@ static int ath10k_vdev_start_restart(str
+@@ -1499,7 +1534,8 @@ static int ath10k_vdev_start_restart(str
  	arg.channel.min_power = 0;
  	arg.channel.max_power = chandef->chan->max_power * 2;
  	arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
@@ -89,7 +89,7 @@ Forwarded: no
  
  	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
  		arg.ssid = arvif->u.ap.ssid;
-@@ -3259,7 +3295,8 @@ static int ath10k_update_channel_list(st
+@@ -3427,7 +3463,8 @@ static int ath10k_update_channel_list(st
  			ch->min_power = 0;
  			ch->max_power = channel->max_power * 2;
  			ch->max_reg_power = channel->max_reg_power * 2;
diff --git a/package/kernel/mac80211/patches/ath/983-ath10k-allow-vht-on-2g.patch b/package/kernel/mac80211/patches/ath10k/983-ath10k-allow-vht-on-2g.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/983-ath10k-allow-vht-on-2g.patch
rename to package/kernel/mac80211/patches/ath10k/983-ath10k-allow-vht-on-2g.patch
diff --git a/package/kernel/mac80211/patches/ath/990-ath10k-small-buffers.patch b/package/kernel/mac80211/patches/ath10k/990-ath10k-small-buffers.patch
similarity index 97%
rename from package/kernel/mac80211/patches/ath/990-ath10k-small-buffers.patch
rename to package/kernel/mac80211/patches/ath10k/990-ath10k-small-buffers.patch
index d065a8b8ca..2f560c70a0 100644
--- a/package/kernel/mac80211/patches/ath/990-ath10k-small-buffers.patch
+++ b/package/kernel/mac80211/patches/ath10k/990-ath10k-small-buffers.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/htt.h
 +++ b/drivers/net/wireless/ath/ath10k/htt.h
-@@ -236,7 +236,11 @@ enum htt_rx_ring_flags {
+@@ -235,7 +235,11 @@ enum htt_rx_ring_flags {
  };
  
  #define HTT_RX_RING_SIZE_MIN 128
diff --git a/package/kernel/mac80211/patches/ath/201-ath5k-WAR-for-AR71xx-PCI-bug.patch b/package/kernel/mac80211/patches/ath5k/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
rename to package/kernel/mac80211/patches/ath5k/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
diff --git a/package/kernel/mac80211/patches/ath/411-ath5k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/ath5k/411-ath5k_allow_adhoc_and_ap.patch
similarity index 89%
rename from package/kernel/mac80211/patches/ath/411-ath5k_allow_adhoc_and_ap.patch
rename to package/kernel/mac80211/patches/ath5k/411-ath5k_allow_adhoc_and_ap.patch
index 9dbe047c9a..35ed6ea555 100644
--- a/package/kernel/mac80211/patches/ath/411-ath5k_allow_adhoc_and_ap.patch
+++ b/package/kernel/mac80211/patches/ath5k/411-ath5k_allow_adhoc_and_ap.patch
@@ -18,7 +18,7 @@
  		goto end;
 --- a/drivers/net/wireless/ath/ath5k/base.c
 +++ b/drivers/net/wireless/ath/ath5k/base.c
-@@ -1964,7 +1964,7 @@ ath5k_beacon_send(struct ath5k_hw *ah)
+@@ -1963,7 +1963,7 @@ ath5k_beacon_send(struct ath5k_hw *ah)
  	}
  
  	if ((ah->opmode == NL80211_IFTYPE_AP && ah->num_ap_vifs +
@@ -27,7 +27,7 @@
  			ah->opmode == NL80211_IFTYPE_MESH_POINT) {
  		u64 tsf = ath5k_hw_get_tsf64(ah);
  		u32 tsftu = TSF_TO_TU(tsf);
-@@ -2050,7 +2050,7 @@ ath5k_beacon_update_timers(struct ath5k_
+@@ -2049,7 +2049,7 @@ ath5k_beacon_update_timers(struct ath5k_
  
  	intval = ah->bintval & AR5K_BEACON_PERIOD;
  	if (ah->opmode == NL80211_IFTYPE_AP && ah->num_ap_vifs
@@ -36,7 +36,7 @@
  		intval /= ATH_BCBUF;	/* staggered multi-bss beacons */
  		if (intval < 15)
  			ATH5K_WARN(ah, "intval %u is too low, min 15\n",
-@@ -2516,6 +2516,7 @@ static const struct ieee80211_iface_limi
+@@ -2515,6 +2515,7 @@ static const struct ieee80211_iface_limi
  				 BIT(NL80211_IFTYPE_MESH_POINT) |
  #endif
  				 BIT(NL80211_IFTYPE_AP) },
diff --git a/package/kernel/mac80211/patches/ath/420-ath5k_disable_fast_cc.patch b/package/kernel/mac80211/patches/ath5k/420-ath5k_disable_fast_cc.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/420-ath5k_disable_fast_cc.patch
rename to package/kernel/mac80211/patches/ath5k/420-ath5k_disable_fast_cc.patch
diff --git a/package/kernel/mac80211/patches/ath/430-add_ath5k_platform.patch b/package/kernel/mac80211/patches/ath5k/430-add_ath5k_platform.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/430-add_ath5k_platform.patch
rename to package/kernel/mac80211/patches/ath5k/430-add_ath5k_platform.patch
diff --git a/package/kernel/mac80211/patches/ath/432-ath5k_add_pciids.patch b/package/kernel/mac80211/patches/ath5k/432-ath5k_add_pciids.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/432-ath5k_add_pciids.patch
rename to package/kernel/mac80211/patches/ath5k/432-ath5k_add_pciids.patch
diff --git a/package/kernel/mac80211/patches/ath/440-ath5k_channel_bw_debugfs.patch b/package/kernel/mac80211/patches/ath5k/440-ath5k_channel_bw_debugfs.patch
similarity index 98%
rename from package/kernel/mac80211/patches/ath/440-ath5k_channel_bw_debugfs.patch
rename to package/kernel/mac80211/patches/ath5k/440-ath5k_channel_bw_debugfs.patch
index 92fb90c165..a63f0c881b 100644
--- a/package/kernel/mac80211/patches/ath/440-ath5k_channel_bw_debugfs.patch
+++ b/package/kernel/mac80211/patches/ath5k/440-ath5k_channel_bw_debugfs.patch
@@ -130,7 +130,7 @@ drivers/net/wireless/ath/ath5k/debug.c |   86 ++++++++++++++++++++++++++++++++
  	/* Antenna Control */
 --- a/drivers/net/wireless/ath/ath5k/base.c
 +++ b/drivers/net/wireless/ath/ath5k/base.c
-@@ -466,6 +466,9 @@ ath5k_chan_set(struct ath5k_hw *ah, stru
+@@ -465,6 +465,9 @@ ath5k_chan_set(struct ath5k_hw *ah, stru
  		return -EINVAL;
  	}
  
diff --git a/package/kernel/mac80211/patches/ath9k/040-ath9k-support-DT-ieee80211-freq-limit-property-to-li.patch b/package/kernel/mac80211/patches/ath9k/040-ath9k-support-DT-ieee80211-freq-limit-property-to-li.patch
new file mode 100644
index 0000000000..7d44681760
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath9k/040-ath9k-support-DT-ieee80211-freq-limit-property-to-li.patch
@@ -0,0 +1,28 @@
+From 03469e79fee9e8e908dae3bd1a80bcd9a66f2a88 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Mon, 11 Oct 2021 18:18:00 +0300
+Subject: ath9k: support DT ieee80211-freq-limit property to limit channels
+
+The common DT property can be used to limit the available channels
+but ath9k has to manually call wiphy_read_of_freq_limits().
+
+I would have put this into ath9k_of_init(). But it didn't work there.
+The reason is that in ath9k_of_init() the channels and bands are not yet
+registered in the wiphy struct. So there isn't any channel to flag as
+disabled.
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20211009212847.1781986-1-chunkeey@gmail.com
+---
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -1038,6 +1038,8 @@ int ath9k_init_device(u16 devid, struct
+ 		ARRAY_SIZE(ath9k_tpt_blink));
+ #endif
+ 
++	wiphy_read_of_freq_limits(hw->wiphy);
++
+ 	/* Register with mac80211 */
+ 	error = ieee80211_register_hw(hw);
+ 	if (error)
diff --git a/package/kernel/mac80211/patches/ath/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch b/package/kernel/mac80211/patches/ath9k/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
similarity index 89%
rename from package/kernel/mac80211/patches/ath/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
rename to package/kernel/mac80211/patches/ath9k/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
index d648a3a3e5..3a0171d4a2 100644
--- a/package/kernel/mac80211/patches/ath/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
+++ b/package/kernel/mac80211/patches/ath9k/350-ath9k_hw-reset-AHB-WMAC-interface-on-AR91xx.patch
@@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1435,8 +1435,12 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1434,8 +1434,12 @@ static bool ath9k_hw_set_reset(struct at
  	if (!AR_SREV_9100(ah))
  		REG_WRITE(ah, AR_RC, 0);
  
diff --git a/package/kernel/mac80211/patches/ath/351-ath9k_hw-issue-external-reset-for-QCA955x.patch b/package/kernel/mac80211/patches/ath9k/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
similarity index 95%
rename from package/kernel/mac80211/patches/ath/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
rename to package/kernel/mac80211/patches/ath9k/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
index 5f265b84c2..53b7ba08bc 100644
--- a/package/kernel/mac80211/patches/ath/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
+++ b/package/kernel/mac80211/patches/ath9k/351-ath9k_hw-issue-external-reset-for-QCA955x.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1312,39 +1312,56 @@ void ath9k_hw_get_delta_slope_vals(struc
+@@ -1311,39 +1311,56 @@ void ath9k_hw_get_delta_slope_vals(struc
  	*coef_exponent = coef_exp - 16;
  }
  
@@ -94,7 +94,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	return true;
  }
  
-@@ -1397,24 +1414,24 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1396,24 +1413,24 @@ static bool ath9k_hw_set_reset(struct at
  			rst_flags |= AR_RTC_RC_MAC_COLD;
  	}
  
diff --git a/package/kernel/mac80211/patches/ath/354-ath9k-force-rx_clear-when-disabling-rx.patch b/package/kernel/mac80211/patches/ath9k/354-ath9k-force-rx_clear-when-disabling-rx.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/354-ath9k-force-rx_clear-when-disabling-rx.patch
rename to package/kernel/mac80211/patches/ath9k/354-ath9k-force-rx_clear-when-disabling-rx.patch
diff --git a/package/kernel/mac80211/patches/ath/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch b/package/kernel/mac80211/patches/ath9k/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
similarity index 89%
rename from package/kernel/mac80211/patches/ath/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
rename to package/kernel/mac80211/patches/ath9k/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
index 406d03e2fe..385eea0116 100644
--- a/package/kernel/mac80211/patches/ath/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
+++ b/package/kernel/mac80211/patches/ath9k/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
@@ -8,7 +8,7 @@ This reverts commit 71f5137bf010c6faffab50c0ec15374c59c4a411.
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2979,7 +2979,8 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2977,7 +2977,8 @@ void ath9k_hw_apply_txpower(struct ath_h
  {
  	struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
  	struct ieee80211_channel *channel;
@@ -18,7 +18,7 @@ This reverts commit 71f5137bf010c6faffab50c0ec15374c59c4a411.
  	u16 ctl = NO_CTL;
  
  	if (!chan)
-@@ -2991,9 +2992,14 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2989,9 +2990,14 @@ void ath9k_hw_apply_txpower(struct ath_h
  	channel = chan->chan;
  	chan_pwr = min_t(int, channel->max_power * 2, MAX_COMBINED_POWER);
  	new_pwr = min_t(int, chan_pwr, reg->power_limit);
diff --git a/package/kernel/mac80211/patches/ath/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch b/package/kernel/mac80211/patches/ath9k/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
similarity index 91%
rename from package/kernel/mac80211/patches/ath/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
rename to package/kernel/mac80211/patches/ath9k/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
index 12cbd27e1a..0c3edc1260 100644
--- a/package/kernel/mac80211/patches/ath/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
+++ b/package/kernel/mac80211/patches/ath9k/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
@@ -11,7 +11,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2998,6 +2998,10 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2996,6 +2996,10 @@ void ath9k_hw_apply_txpower(struct ath_h
  	if (ant_gain > max_gain)
  		ant_reduction = ant_gain - max_gain;
  
diff --git a/package/kernel/mac80211/patches/ath/401-ath9k_blink_default.patch b/package/kernel/mac80211/patches/ath9k/401-ath9k_blink_default.patch
similarity index 88%
rename from package/kernel/mac80211/patches/ath/401-ath9k_blink_default.patch
rename to package/kernel/mac80211/patches/ath9k/401-ath9k_blink_default.patch
index 3eb57bb1cf..7405e594fe 100644
--- a/package/kernel/mac80211/patches/ath/401-ath9k_blink_default.patch
+++ b/package/kernel/mac80211/patches/ath9k/401-ath9k_blink_default.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -48,7 +48,7 @@ int ath9k_modparam_nohwcrypt;
+@@ -47,7 +47,7 @@ int ath9k_modparam_nohwcrypt;
  module_param_named(nohwcrypt, ath9k_modparam_nohwcrypt, int, 0444);
  MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption");
  
diff --git a/package/kernel/mac80211/patches/ath/410-ath9k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/ath9k/410-ath9k_allow_adhoc_and_ap.patch
similarity index 73%
rename from package/kernel/mac80211/patches/ath/410-ath9k_allow_adhoc_and_ap.patch
rename to package/kernel/mac80211/patches/ath9k/410-ath9k_allow_adhoc_and_ap.patch
index 17dd8f6597..b355e8372f 100644
--- a/package/kernel/mac80211/patches/ath/410-ath9k_allow_adhoc_and_ap.patch
+++ b/package/kernel/mac80211/patches/ath9k/410-ath9k_allow_adhoc_and_ap.patch
@@ -1,10 +1,10 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -830,6 +830,7 @@ static const struct ieee80211_iface_limi
+@@ -826,6 +826,7 @@ static const struct ieee80211_iface_limi
  				 BIT(NL80211_IFTYPE_AP) },
  	{ .max = 1,	.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
  				 BIT(NL80211_IFTYPE_P2P_GO) },
 +	{ .max = 1,	.types = BIT(NL80211_IFTYPE_ADHOC) },
  };
  
- #ifdef CPTCFG_WIRELESS_WDS
+ #ifdef CPTCFG_ATH9K_CHANNEL_CONTEXT
diff --git a/package/kernel/mac80211/patches/ath/450-ath9k-enabled-MFP-capability-unconditionally.patch b/package/kernel/mac80211/patches/ath9k/450-ath9k-enabled-MFP-capability-unconditionally.patch
similarity index 90%
rename from package/kernel/mac80211/patches/ath/450-ath9k-enabled-MFP-capability-unconditionally.patch
rename to package/kernel/mac80211/patches/ath9k/450-ath9k-enabled-MFP-capability-unconditionally.patch
index ea94b52385..284c88ff49 100644
--- a/package/kernel/mac80211/patches/ath/450-ath9k-enabled-MFP-capability-unconditionally.patch
+++ b/package/kernel/mac80211/patches/ath9k/450-ath9k-enabled-MFP-capability-unconditionally.patch
@@ -14,7 +14,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -927,6 +927,7 @@ static void ath9k_set_hw_capab(struct at
+@@ -907,6 +907,7 @@ static void ath9k_set_hw_capab(struct at
  	ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
  	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
  	ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
@@ -22,7 +22,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  
  	if (ath9k_ps_enable)
  		ieee80211_hw_set(hw, SUPPORTS_PS);
-@@ -939,9 +940,6 @@ static void ath9k_set_hw_capab(struct at
+@@ -919,9 +920,6 @@ static void ath9k_set_hw_capab(struct at
  				IEEE80211_RADIOTAP_MCS_HAVE_STBC;
  	}
  
diff --git a/package/kernel/mac80211/patches/ath/500-ath9k_eeprom_debugfs.patch b/package/kernel/mac80211/patches/ath9k/500-ath9k_eeprom_debugfs.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/500-ath9k_eeprom_debugfs.patch
rename to package/kernel/mac80211/patches/ath9k/500-ath9k_eeprom_debugfs.patch
diff --git a/package/kernel/mac80211/patches/ath/501-ath9k_ahb_init.patch b/package/kernel/mac80211/patches/ath9k/501-ath9k_ahb_init.patch
similarity index 91%
rename from package/kernel/mac80211/patches/ath/501-ath9k_ahb_init.patch
rename to package/kernel/mac80211/patches/ath9k/501-ath9k_ahb_init.patch
index b9c784eb25..6ab7972b55 100644
--- a/package/kernel/mac80211/patches/ath/501-ath9k_ahb_init.patch
+++ b/package/kernel/mac80211/patches/ath9k/501-ath9k_ahb_init.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1143,25 +1143,25 @@ static int __init ath9k_init(void)
+@@ -1122,25 +1122,25 @@ static int __init ath9k_init(void)
  {
  	int error;
  
diff --git a/package/kernel/mac80211/patches/ath/510-ath9k_intr_mitigation_tweak.patch b/package/kernel/mac80211/patches/ath9k/510-ath9k_intr_mitigation_tweak.patch
similarity index 87%
rename from package/kernel/mac80211/patches/ath/510-ath9k_intr_mitigation_tweak.patch
rename to package/kernel/mac80211/patches/ath9k/510-ath9k_intr_mitigation_tweak.patch
index 75b48b480e..fda050a8f2 100644
--- a/package/kernel/mac80211/patches/ath/510-ath9k_intr_mitigation_tweak.patch
+++ b/package/kernel/mac80211/patches/ath9k/510-ath9k_intr_mitigation_tweak.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -403,13 +403,8 @@ static void ath9k_hw_init_config(struct
+@@ -402,13 +402,8 @@ static void ath9k_hw_init_config(struct
  
  	ah->config.rx_intr_mitigation = true;
  
diff --git a/package/kernel/mac80211/patches/ath/511-ath9k_reduce_rxbuf.patch b/package/kernel/mac80211/patches/ath9k/511-ath9k_reduce_rxbuf.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/511-ath9k_reduce_rxbuf.patch
rename to package/kernel/mac80211/patches/ath9k/511-ath9k_reduce_rxbuf.patch
diff --git a/package/kernel/mac80211/patches/ath/512-ath9k_channelbw_debugfs.patch b/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/512-ath9k_channelbw_debugfs.patch
rename to package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch
diff --git a/package/kernel/mac80211/patches/ath/513-ath9k_add_pci_ids.patch b/package/kernel/mac80211/patches/ath9k/513-ath9k_add_pci_ids.patch
similarity index 93%
rename from package/kernel/mac80211/patches/ath/513-ath9k_add_pci_ids.patch
rename to package/kernel/mac80211/patches/ath9k/513-ath9k_add_pci_ids.patch
index 113c35625f..a085e3a1fb 100644
--- a/package/kernel/mac80211/patches/ath/513-ath9k_add_pci_ids.patch
+++ b/package/kernel/mac80211/patches/ath9k/513-ath9k_add_pci_ids.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -663,6 +663,7 @@ int ath9k_hw_init(struct ath_hw *ah)
+@@ -662,6 +662,7 @@ int ath9k_hw_init(struct ath_hw *ah)
  
  	/* These are all the AR5008/AR9001/AR9002/AR9003 hardware family of chipsets */
  	switch (ah->hw_version.devid) {
diff --git a/package/kernel/mac80211/patches/ath/530-ath9k_extra_leds.patch b/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
similarity index 96%
rename from package/kernel/mac80211/patches/ath/530-ath9k_extra_leds.patch
rename to package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
index 5fd5c73a2f..c161237827 100644
--- a/package/kernel/mac80211/patches/ath/530-ath9k_extra_leds.patch
+++ b/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -844,6 +844,9 @@ static inline int ath9k_dump_btcoex(stru
+@@ -843,6 +843,9 @@ static inline int ath9k_dump_btcoex(stru
  #ifdef CPTCFG_MAC80211_LEDS
  void ath_init_leds(struct ath_softc *sc);
  void ath_deinit_leds(struct ath_softc *sc);
@@ -10,7 +10,7 @@
  #else
  static inline void ath_init_leds(struct ath_softc *sc)
  {
-@@ -980,6 +983,13 @@ void ath_ant_comb_scan(struct ath_softc
+@@ -979,6 +982,13 @@ void ath_ant_comb_scan(struct ath_softc
  
  #define ATH9K_NUM_CHANCTX  2 /* supports 2 operating channels */
  
@@ -24,7 +24,7 @@
  struct ath_softc {
  	struct ieee80211_hw *hw;
  	struct device *dev;
-@@ -1033,9 +1043,8 @@ struct ath_softc {
+@@ -1032,9 +1042,8 @@ struct ath_softc {
  	spinlock_t chan_lock;
  
  #ifdef CPTCFG_MAC80211_LEDS
@@ -181,7 +181,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1055,7 +1055,7 @@ int ath9k_init_device(u16 devid, struct
+@@ -1032,7 +1032,7 @@ int ath9k_init_device(u16 devid, struct
  
  #ifdef CPTCFG_MAC80211_LEDS
  	/* must be initialized before ieee80211_register_hw */
diff --git a/package/kernel/mac80211/patches/ath/531-ath9k_extra_platform_leds.patch b/package/kernel/mac80211/patches/ath9k/531-ath9k_extra_platform_leds.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/531-ath9k_extra_platform_leds.patch
rename to package/kernel/mac80211/patches/ath9k/531-ath9k_extra_platform_leds.patch
diff --git a/package/kernel/mac80211/patches/ath/540-ath9k_reduce_ani_interval.patch b/package/kernel/mac80211/patches/ath9k/540-ath9k_reduce_ani_interval.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/540-ath9k_reduce_ani_interval.patch
rename to package/kernel/mac80211/patches/ath9k/540-ath9k_reduce_ani_interval.patch
diff --git a/package/kernel/mac80211/patches/ath/542-ath9k_debugfs_diag.patch b/package/kernel/mac80211/patches/ath9k/542-ath9k_debugfs_diag.patch
similarity index 96%
rename from package/kernel/mac80211/patches/ath/542-ath9k_debugfs_diag.patch
rename to package/kernel/mac80211/patches/ath9k/542-ath9k_debugfs_diag.patch
index 76f9846fa4..5b64f560fd 100644
--- a/package/kernel/mac80211/patches/ath/542-ath9k_debugfs_diag.patch
+++ b/package/kernel/mac80211/patches/ath9k/542-ath9k_debugfs_diag.patch
@@ -94,7 +94,7 @@
  struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1882,6 +1882,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
+@@ -1881,6 +1881,20 @@ u32 ath9k_hw_get_tsf_offset(struct times
  }
  EXPORT_SYMBOL(ath9k_hw_get_tsf_offset);
  
@@ -115,7 +115,7 @@
  int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
  		   struct ath9k_hw_cal_data *caldata, bool fastcc)
  {
-@@ -2090,6 +2104,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2089,6 +2103,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		ar9003_hw_disable_phy_restart(ah);
  
  	ath9k_hw_apply_gpio_override(ah);
diff --git a/package/kernel/mac80211/patches/ath/543-ath9k_entropy_from_adc.patch b/package/kernel/mac80211/patches/ath9k/543-ath9k_entropy_from_adc.patch
similarity index 94%
rename from package/kernel/mac80211/patches/ath/543-ath9k_entropy_from_adc.patch
rename to package/kernel/mac80211/patches/ath9k/543-ath9k_entropy_from_adc.patch
index 0d938a3730..ef4e659870 100644
--- a/package/kernel/mac80211/patches/ath/543-ath9k_entropy_from_adc.patch
+++ b/package/kernel/mac80211/patches/ath9k/543-ath9k_entropy_from_adc.patch
@@ -55,7 +55,7 @@
  	ops->spectral_scan_config = ar9003_hw_spectral_scan_config;
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -818,7 +818,8 @@ static void ath9k_init_txpower_limits(st
+@@ -814,7 +814,8 @@ static void ath9k_init_txpower_limits(st
  	if (ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
  		ath9k_init_band_txpower(sc, NL80211_BAND_5GHZ);
  
@@ -65,7 +65,7 @@
  }
  
  static const struct ieee80211_iface_limit if_limits[] = {
-@@ -1015,6 +1016,18 @@ static void ath9k_set_hw_capab(struct at
+@@ -992,6 +993,18 @@ static void ath9k_set_hw_capab(struct at
  	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);
  }
  
@@ -84,9 +84,9 @@
  int ath9k_init_device(u16 devid, struct ath_softc *sc,
  		    const struct ath_bus_ops *bus_ops)
  {
-@@ -1060,6 +1073,8 @@ int ath9k_init_device(u16 devid, struct
- 		ARRAY_SIZE(ath9k_tpt_blink));
- #endif
+@@ -1039,6 +1052,8 @@ int ath9k_init_device(u16 devid, struct
+ 
+ 	wiphy_read_of_freq_limits(hw->wiphy);
  
 +	ath_get_initial_entropy(sc);
 +
@@ -110,7 +110,7 @@
  static inline void ath9k_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-@@ -1349,9 +1349,30 @@ void ar5008_hw_init_rate_txpower(struct
+@@ -1340,9 +1340,30 @@ void ar5008_hw_init_rate_txpower(struct
  	}
  }
  
@@ -141,7 +141,7 @@
  	static const u32 ar5416_cca_regs[6] = {
  		AR_PHY_CCA,
  		AR_PHY_CH1_CCA,
-@@ -1366,6 +1387,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
+@@ -1357,6 +1378,8 @@ int ar5008_hw_attach_phy_ops(struct ath_
  	if (ret)
  	    return ret;
  
diff --git a/package/kernel/mac80211/patches/ath/544-ath9k-ar933x-usb-hang-workaround.patch b/package/kernel/mac80211/patches/ath9k/544-ath9k-ar933x-usb-hang-workaround.patch
similarity index 84%
rename from package/kernel/mac80211/patches/ath/544-ath9k-ar933x-usb-hang-workaround.patch
rename to package/kernel/mac80211/patches/ath9k/544-ath9k-ar933x-usb-hang-workaround.patch
index 2d2b837072..23a81864fa 100644
--- a/package/kernel/mac80211/patches/ath/544-ath9k-ar933x-usb-hang-workaround.patch
+++ b/package/kernel/mac80211/patches/ath9k/544-ath9k-ar933x-usb-hang-workaround.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -248,6 +248,19 @@ void ath9k_hw_get_channel_centers(struct
+@@ -247,6 +247,19 @@ void ath9k_hw_get_channel_centers(struct
  		centers->synth_center + (extoff * HT40_CHANNEL_CENTER_SHIFT);
  }
  
@@ -20,7 +20,7 @@
  /******************/
  /* Chip Revisions */
  /******************/
-@@ -1455,6 +1468,9 @@ static bool ath9k_hw_set_reset(struct at
+@@ -1454,6 +1467,9 @@ static bool ath9k_hw_set_reset(struct at
  		udelay(50);
  	}
  
@@ -30,7 +30,7 @@
  	return true;
  }
  
-@@ -1554,6 +1570,9 @@ static bool ath9k_hw_chip_reset(struct a
+@@ -1553,6 +1569,9 @@ static bool ath9k_hw_chip_reset(struct a
  		ar9003_hw_internal_regulator_apply(ah);
  	ath9k_hw_init_pll(ah, chan);
  
@@ -40,7 +40,7 @@
  	return true;
  }
  
-@@ -1860,8 +1879,14 @@ static int ath9k_hw_do_fastcc(struct ath
+@@ -1859,8 +1878,14 @@ static int ath9k_hw_do_fastcc(struct ath
  	if (AR_SREV_9271(ah))
  		ar9002_hw_load_ani_reg(ah, chan);
  
@@ -55,7 +55,7 @@
  	return -EINVAL;
  }
  
-@@ -2115,6 +2140,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2114,6 +2139,9 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		ath9k_hw_set_radar_params(ah);
  	}
  
diff --git a/package/kernel/mac80211/patches/ath/545-ath9k_ani_ws_detect.patch b/package/kernel/mac80211/patches/ath9k/545-ath9k_ani_ws_detect.patch
similarity index 98%
rename from package/kernel/mac80211/patches/ath/545-ath9k_ani_ws_detect.patch
rename to package/kernel/mac80211/patches/ath9k/545-ath9k_ani_ws_detect.patch
index 466767adb9..854bb3659a 100644
--- a/package/kernel/mac80211/patches/ath/545-ath9k_ani_ws_detect.patch
+++ b/package/kernel/mac80211/patches/ath9k/545-ath9k_ani_ws_detect.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
-@@ -978,55 +978,6 @@ static bool ar5008_hw_ani_control_new(st
+@@ -969,55 +969,6 @@ static bool ar5008_hw_ani_control_new(st
  		 * on == 0 means more noise imm
  		 */
  		u32 on = param ? 1 : 0;
diff --git a/package/kernel/mac80211/patches/ath/547-ath9k_led_defstate_fix.patch b/package/kernel/mac80211/patches/ath9k/547-ath9k_led_defstate_fix.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath/547-ath9k_led_defstate_fix.patch
rename to package/kernel/mac80211/patches/ath9k/547-ath9k_led_defstate_fix.patch
diff --git a/package/kernel/mac80211/patches/ath/548-ath9k_enable_gpio_chip.patch b/package/kernel/mac80211/patches/ath9k/548-ath9k_enable_gpio_chip.patch
similarity index 98%
rename from package/kernel/mac80211/patches/ath/548-ath9k_enable_gpio_chip.patch
rename to package/kernel/mac80211/patches/ath9k/548-ath9k_enable_gpio_chip.patch
index 88198a4562..78206d2860 100644
--- a/package/kernel/mac80211/patches/ath/548-ath9k_enable_gpio_chip.patch
+++ b/package/kernel/mac80211/patches/ath9k/548-ath9k_enable_gpio_chip.patch
@@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  #include "common.h"
  #include "debug.h"
-@@ -990,6 +991,14 @@ struct ath_led {
+@@ -989,6 +990,14 @@ struct ath_led {
  	struct led_classdev cdev;
  };
  
@@ -33,7 +33,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  struct ath_softc {
  	struct ieee80211_hw *hw;
  	struct device *dev;
-@@ -1045,6 +1054,9 @@ struct ath_softc {
+@@ -1044,6 +1053,9 @@ struct ath_softc {
  #ifdef CPTCFG_MAC80211_LEDS
  	const char *led_default_trigger;
  	struct list_head leds;
diff --git a/package/kernel/mac80211/patches/ath/549-ath9k_enable_gpio_buttons.patch b/package/kernel/mac80211/patches/ath9k/549-ath9k_enable_gpio_buttons.patch
similarity index 98%
rename from package/kernel/mac80211/patches/ath/549-ath9k_enable_gpio_buttons.patch
rename to package/kernel/mac80211/patches/ath9k/549-ath9k_enable_gpio_buttons.patch
index 83076b8ae4..716e09f351 100644
--- a/package/kernel/mac80211/patches/ath/549-ath9k_enable_gpio_buttons.patch
+++ b/package/kernel/mac80211/patches/ath9k/549-ath9k_enable_gpio_buttons.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 ---
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -1056,6 +1056,7 @@ struct ath_softc {
+@@ -1055,6 +1055,7 @@ struct ath_softc {
  	struct list_head leds;
  #ifdef CONFIG_GPIOLIB
  	struct ath9k_gpio_chip *gpiochip;
diff --git a/package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch b/package/kernel/mac80211/patches/ath9k/551-ath9k_ubnt_uap_plus_hsr.patch
similarity index 99%
rename from package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch
rename to package/kernel/mac80211/patches/ath9k/551-ath9k_ubnt_uap_plus_hsr.patch
index e9cf00769d..6b5c0dc514 100644
--- a/package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch
+++ b/package/kernel/mac80211/patches/ath9k/551-ath9k_ubnt_uap_plus_hsr.patch
@@ -371,7 +371,7 @@
  
 --- a/local-symbols
 +++ b/local-symbols
-@@ -112,6 +112,7 @@ ATH9K_WOW=
+@@ -133,6 +133,7 @@ ATH9K_WOW=
  ATH9K_RFKILL=
  ATH9K_CHANNEL_CONTEXT=
  ATH9K_PCOEM=
diff --git a/package/kernel/mac80211/patches/ath/552-ahb_of.patch b/package/kernel/mac80211/patches/ath9k/552-ath9k-ahb_of.patch
similarity index 93%
rename from package/kernel/mac80211/patches/ath/552-ahb_of.patch
rename to package/kernel/mac80211/patches/ath9k/552-ath9k-ahb_of.patch
index 8fd6e4409b..7ce8bc5b82 100644
--- a/package/kernel/mac80211/patches/ath/552-ahb_of.patch
+++ b/package/kernel/mac80211/patches/ath9k/552-ath9k-ahb_of.patch
@@ -16,7 +16,7 @@
  
  static const struct platform_device_id ath9k_platform_id_table[] = {
  	{
-@@ -69,6 +77,242 @@ static const struct ath_bus_ops ath_ahb_
+@@ -69,6 +77,236 @@ static const struct ath_bus_ops ath_ahb_
  	.eeprom_read = ath_ahb_eeprom_read,
  };
  
@@ -218,12 +218,6 @@
 +	else
 +		pdata->led_pin = -1;
 +
-+	if (of_property_read_bool(pdev->dev.of_node, "qca,disable-2ghz"))
-+		pdata->disable_2ghz = true;
-+
-+	if (of_property_read_bool(pdev->dev.of_node, "qca,disable-5ghz"))
-+		pdata->disable_5ghz = true;
-+
 +	if (of_property_read_bool(pdev->dev.of_node, "qca,tx-gain-buffalo"))
 +		pdata->tx_gain_buffalo = true;
 +
@@ -259,7 +253,7 @@
  static int ath_ahb_probe(struct platform_device *pdev)
  {
  	void __iomem *mem;
-@@ -80,6 +324,17 @@ static int ath_ahb_probe(struct platform
+@@ -80,6 +318,17 @@ static int ath_ahb_probe(struct platform
  	int ret = 0;
  	struct ath_hw *ah;
  	char hw_name[64];
@@ -277,7 +271,7 @@
  
  	if (!dev_get_platdata(&pdev->dev)) {
  		dev_err(&pdev->dev, "no platform data specified\n");
-@@ -122,13 +377,16 @@ static int ath_ahb_probe(struct platform
+@@ -122,13 +371,16 @@ static int ath_ahb_probe(struct platform
  	sc->mem = mem;
  	sc->irq = irq;
  
@@ -295,7 +289,7 @@
  	if (ret) {
  		dev_err(&pdev->dev, "failed to initialize device\n");
  		goto err_irq;
-@@ -159,6 +417,9 @@ static int ath_ahb_remove(struct platfor
+@@ -159,6 +411,9 @@ static int ath_ahb_remove(struct platfor
  		free_irq(sc->irq, sc);
  		ieee80211_free_hw(sc->hw);
  	}
@@ -305,7 +299,7 @@
  
  	return 0;
  }
-@@ -168,6 +429,9 @@ static struct platform_driver ath_ahb_dr
+@@ -168,6 +423,9 @@ static struct platform_driver ath_ahb_dr
  	.remove     = ath_ahb_remove,
  	.driver		= {
  		.name	= "ath9k",
@@ -325,7 +319,7 @@
  
  #include "common.h"
  #include "debug.h"
-@@ -1012,6 +1013,9 @@ struct ath_softc {
+@@ -1011,6 +1012,9 @@ struct ath_softc {
  	struct ath_hw *sc_ah;
  	void __iomem *mem;
  	int irq;
diff --git a/package/kernel/mac80211/patches/ath/553-ath9k_of_gpio_mask.patch b/package/kernel/mac80211/patches/ath9k/553-ath9k_of_gpio_mask.patch
similarity index 80%
rename from package/kernel/mac80211/patches/ath/553-ath9k_of_gpio_mask.patch
rename to package/kernel/mac80211/patches/ath9k/553-ath9k_of_gpio_mask.patch
index 8e0041e3ef..80e0dc4c5e 100644
--- a/package/kernel/mac80211/patches/ath/553-ath9k_of_gpio_mask.patch
+++ b/package/kernel/mac80211/patches/ath9k/553-ath9k_of_gpio_mask.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -654,6 +654,12 @@ static int ath9k_of_init(struct ath_soft
+@@ -644,6 +644,12 @@ static int ath9k_of_init(struct ath_soft
  	return 0;
  }
  
@@ -13,7 +13,7 @@
  static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
  			    const struct ath_bus_ops *bus_ops)
  {
-@@ -757,6 +763,9 @@ static int ath9k_init_softc(u16 devid, s
+@@ -747,6 +753,9 @@ static int ath9k_init_softc(u16 devid, s
  	if (ret)
  		goto err_hw;
  
diff --git a/package/kernel/mac80211/patches/brcm/001-brcmfmac-allow-setting-wlan-MAC-address-using-device.patch b/package/kernel/mac80211/patches/brcm/001-brcmfmac-allow-setting-wlan-MAC-address-using-device.patch
new file mode 100644
index 0000000000..03d9f8ecd8
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/001-brcmfmac-allow-setting-wlan-MAC-address-using-device.patch
@@ -0,0 +1,103 @@
+From 716c220b4d990a4fe7800d0685ca69dee99e4e8f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pavel=20L=C3=B6bl?= <pavel@loebl.cz>
+Date: Fri, 6 May 2022 06:42:46 +0200
+Subject: [PATCH] brcmfmac: allow setting wlan MAC address using device tree
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This allows firmware to provide MAC address using device tree. Like in
+case there is no MAC burned in wlan NVRAM.
+
+Signed-off-by: Pavel Löbl <pavel@loebl.cz>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20220506044246.67146-1-pavel@loebl.cz
+---
+ .../broadcom/brcm80211/brcmfmac/common.c      | 23 ++++++++++++++-----
+ .../broadcom/brcm80211/brcmfmac/common.h      |  1 +
+ .../broadcom/brcm80211/brcmfmac/core.c        |  4 +++-
+ .../wireless/broadcom/brcm80211/brcmfmac/of.c |  3 +++
+ 4 files changed, 24 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -202,13 +202,24 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	char *ptr;
+ 	s32 err;
+ 
+-	/* retreive mac address */
+-	err = brcmf_fil_iovar_data_get(ifp, "cur_etheraddr", ifp->mac_addr,
+-				       sizeof(ifp->mac_addr));
+-	if (err < 0) {
+-		bphy_err(drvr, "Retrieving cur_etheraddr failed, %d\n", err);
+-		goto done;
++	if (is_valid_ether_addr(ifp->mac_addr)) {
++		/* set mac address */
++		err = brcmf_fil_iovar_data_set(ifp, "cur_etheraddr", ifp->mac_addr,
++					       ETH_ALEN);
++		if (err < 0) {
++			bphy_err(ifp->drvr, "Setting cur_etheraddr failed, %d\n", err);
++			goto done;
++		}
++	} else {
++		/* retrieve mac address */
++		err = brcmf_fil_iovar_data_get(ifp, "cur_etheraddr", ifp->mac_addr,
++					       sizeof(ifp->mac_addr));
++		if (err < 0) {
++			bphy_err(drvr, "Retrieving cur_etheraddr failed, %d\n", err);
++			goto done;
++		}
+ 	}
++
+ 	memcpy(ifp->drvr->mac, ifp->mac_addr, sizeof(ifp->drvr->mac));
+ 	memcpy(ifp->drvr->wiphy->perm_addr, ifp->drvr->mac, ETH_ALEN);
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
+@@ -50,6 +50,7 @@ struct brcmf_mp_device {
+ 	bool		ignore_probe_fail;
+ 	struct brcmfmac_pd_cc *country_codes;
+ 	const char	*board_type;
++	unsigned char	mac[ETH_ALEN];
+ 	union {
+ 		struct brcmfmac_sdio_pd sdio;
+ 	} bus;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -7,6 +7,7 @@
+ #include <linux/etherdevice.h>
+ #include <linux/module.h>
+ #include <linux/inetdevice.h>
++#include <linux/property.h>
+ #include <net/cfg80211.h>
+ #include <net/rtnetlink.h>
+ #include <net/addrconf.h>
+@@ -1226,7 +1227,8 @@ static int brcmf_bus_started(struct brcm
+ 	brcmf_dbg(TRACE, "\n");
+ 
+ 	/* add primary networking interface */
+-	ifp = brcmf_add_if(drvr, 0, 0, false, "wlan%d", NULL);
++	ifp = brcmf_add_if(drvr, 0, 0, false, "wlan%d",
++			   is_valid_ether_addr(drvr->settings->mac) ? drvr->settings->mac : NULL);
+ 	if (IS_ERR(ifp))
+ 		return PTR_ERR(ifp);
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
+@@ -5,6 +5,7 @@
+ #include <linux/init.h>
+ #include <linux/of.h>
+ #include <linux/of_irq.h>
++#include <linux/of_net.h>
+ 
+ #include <defs.h>
+ #include "debug.h"
+@@ -97,6 +98,8 @@ void brcmf_of_probe(struct device *dev,
+ 	if (err)
+ 		brcmf_err("failed to get OF country code map (err=%d)\n", err);
+ 
++	of_get_mac_address(np, settings->mac);
++
+ 	if (bus_type != BRCMF_BUSTYPE_SDIO)
+ 		return;
+ 
diff --git a/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch b/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
index 52ae7a8eba..5dc04ecc88 100644
--- a/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
+++ b/package/kernel/mac80211/patches/brcm/812-b43-add-antenna-control.patch
@@ -42,7 +42,7 @@
  
  	if (wl->radio_enabled != phy->radio_on) {
  		if (wl->radio_enabled) {
-@@ -5176,6 +5173,47 @@ static int b43_op_get_survey(struct ieee
+@@ -5175,6 +5172,47 @@ static int b43_op_get_survey(struct ieee
  	return 0;
  }
  
@@ -90,7 +90,7 @@
  static const struct ieee80211_ops b43_hw_ops = {
  	.tx			= b43_op_tx,
  	.conf_tx		= b43_op_conf_tx,
-@@ -5197,6 +5235,8 @@ static const struct ieee80211_ops b43_hw
+@@ -5196,6 +5234,8 @@ static const struct ieee80211_ops b43_hw
  	.sw_scan_complete	= b43_op_sw_scan_complete_notifier,
  	.get_survey		= b43_op_get_survey,
  	.rfkill_poll		= b43_rfkill_poll,
@@ -99,7 +99,7 @@
  };
  
  /* Hard-reset the chip. Do not call this directly.
-@@ -5498,6 +5538,8 @@ static int b43_one_core_attach(struct b4
+@@ -5497,6 +5537,8 @@ static int b43_one_core_attach(struct b4
  	if (!wldev)
  		goto out;
  
@@ -108,7 +108,7 @@
  	wldev->use_pio = b43_modparam_pio;
  	wldev->dev = dev;
  	wldev->wl = wl;
-@@ -5592,6 +5634,9 @@ static struct b43_wl *b43_wireless_init(
+@@ -5588,6 +5630,9 @@ static struct b43_wl *b43_wireless_init(
  
  	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
  
diff --git a/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch b/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch
index 4f72e62948..7b9512f741 100644
--- a/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch
+++ b/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch
@@ -13,15 +13,15 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -433,6 +433,7 @@ struct brcmf_fw {
+@@ -431,6 +431,7 @@ struct brcmf_fw {
  	struct brcmf_fw_request *req;
  	u32 curpos;
  	void (*done)(struct device *dev, int err, struct brcmf_fw_request *req);
 +	struct completion *completion;
  };
  
- static void brcmf_fw_request_done(const struct firmware *fw, void *ctx);
-@@ -640,6 +641,8 @@ static void brcmf_fw_request_done(const
+ #ifdef CONFIG_EFI
+@@ -655,6 +656,8 @@ static void brcmf_fw_request_done(const
  		fwctx->req = NULL;
  	}
  	fwctx->done(fwctx->dev, ret, fwctx->req);
@@ -30,16 +30,16 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
  	kfree(fwctx);
  }
  
-@@ -664,6 +667,8 @@ int brcmf_fw_get_firmwares(struct device
+@@ -695,6 +698,8 @@ int brcmf_fw_get_firmwares(struct device
  {
  	struct brcmf_fw_item *first = &req->items[0];
  	struct brcmf_fw *fwctx;
 +	struct completion completion;
 +	unsigned long time_left;
+ 	char *alt_path = NULL;
  	int ret;
  
- 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
-@@ -680,6 +685,9 @@ int brcmf_fw_get_firmwares(struct device
+@@ -712,6 +717,9 @@ int brcmf_fw_get_firmwares(struct device
  	fwctx->dev = dev;
  	fwctx->req = req;
  	fwctx->done = fw_cb;
@@ -47,9 +47,9 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 +	init_completion(&completion);
 +	fwctx->completion = &completion;
  
- 	ret = request_firmware_nowait(THIS_MODULE, true, first->path,
- 				      fwctx->dev, GFP_KERNEL, fwctx,
-@@ -687,6 +695,12 @@ int brcmf_fw_get_firmwares(struct device
+ 	/* First try alternative board-specific path if any */
+ 	if (fwctx->req->board_type)
+@@ -730,6 +738,12 @@ int brcmf_fw_get_firmwares(struct device
  	if (ret < 0)
  		brcmf_fw_request_done(NULL, fwctx);
  
diff --git a/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch b/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
index 774656f1fd..88465f256b 100644
--- a/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
+++ b/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
@@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2961,6 +2961,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+@@ -2974,6 +2974,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
  	 * preference in cfg struct to apply this to
  	 * FW later while initializing the dongle
  	 */
diff --git a/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch b/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
index 9658bda1c1..1ddc78f7ca 100644
--- a/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
+++ b/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
@@ -12,9 +12,9 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
-@@ -12,6 +12,36 @@
- #include "common.h"
- #include "of.h"
+@@ -59,6 +59,36 @@ static int brcmf_of_get_country_codes(st
+ 	return 0;
+ }
  
 +/* TODO: FIXME: Use DT */
 +static void brcmf_of_probe_cc(struct device *dev,
@@ -49,12 +49,12 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,
  		    struct brcmf_mp_device *settings)
  {
-@@ -43,6 +73,8 @@ void brcmf_of_probe(struct device *dev,
+@@ -91,6 +121,8 @@ void brcmf_of_probe(struct device *dev,
  		of_node_put(root);
  	}
  
 +	brcmf_of_probe_cc(dev, settings);
 +
- 	if (!np || bus_type != BRCMF_BUSTYPE_SDIO ||
- 	    !of_device_is_compatible(np, "brcm,bcm4329-fmac"))
+ 	if (!np || !of_device_is_compatible(np, "brcm,bcm4329-fmac"))
  		return;
+ 
diff --git a/package/kernel/mac80211/patches/brcm/865-brcmfmac-Read-alternative-firmware-names-from-DT.patch b/package/kernel/mac80211/patches/brcm/865-brcmfmac-Read-alternative-firmware-names-from-DT.patch
new file mode 100644
index 0000000000..8adb8c42a1
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/865-brcmfmac-Read-alternative-firmware-names-from-DT.patch
@@ -0,0 +1,196 @@
+From 4e32024cbb14230af3048e249e84f8c2b25ce45a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 28 Oct 2021 15:03:16 +0100
+Subject: [PATCH] brcmfmac: Read alternative firmware names from DT
+
+Add the ability to load the names of alternative firmwares from the
+Device Tree node. This permits separate firmwares for 43436s and 43438
+and allows downstream firmwares to coexist with upstream.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/of.c | 36 ++++++++++++++
+ .../wireless/broadcom/brcm80211/brcmfmac/of.h |  7 +++
+ .../broadcom/brcm80211/brcmfmac/sdio.c        | 47 +++++++++++++++++--
+ 3 files changed, 87 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
+@@ -11,6 +11,7 @@
+ #include "debug.h"
+ #include "core.h"
+ #include "common.h"
++#include "firmware.h"
+ #include "of.h"
+ 
+ static int brcmf_of_get_country_codes(struct device *dev,
+@@ -153,3 +154,38 @@ void brcmf_of_probe(struct device *dev,
+ 	sdio->oob_irq_nr = irq;
+ 	sdio->oob_irq_flags = irqf;
+ }
++
++struct brcmf_firmware_mapping *
++brcmf_of_fwnames(struct device *dev, u32 *fwname_count)
++{
++	struct device_node *np = dev->of_node;
++	struct brcmf_firmware_mapping *fwnames;
++	struct device_node *map_np, *fw_np;
++	int of_count;
++	int count = 0;
++
++	map_np = of_get_child_by_name(np, "firmwares");
++	of_count = of_get_child_count(map_np);
++	if (!of_count)
++		return NULL;
++
++	fwnames = devm_kcalloc(dev, of_count,
++			       sizeof(struct brcmf_firmware_mapping),
++			       GFP_KERNEL);
++
++	for_each_child_of_node(map_np, fw_np)
++	{
++		struct brcmf_firmware_mapping *cur = &fwnames[count];
++
++		if (of_property_read_u32(fw_np, "chipid", &cur->chipid) ||
++		    of_property_read_u32(fw_np, "revmask", &cur->revmask))
++			continue;
++		cur->fw_base = of_get_property(fw_np, "fw_base", NULL);
++		if (cur->fw_base)
++			count++;
++	}
++
++	*fwname_count = count;
++
++	return count ? fwnames : NULL;
++}
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h
+@@ -5,9 +5,16 @@
+ #ifdef CONFIG_OF
+ void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,
+ 		    struct brcmf_mp_device *settings);
++struct brcmf_firmware_mapping *
++brcmf_of_fwnames(struct device *dev, u32 *map_count);
+ #else
+ static void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,
+ 			   struct brcmf_mp_device *settings)
+ {
+ }
++static struct brcmf_firmware_mapping *
++brcmf_of_fwnames(struct device *dev, u32 *map_count)
++{
++	return NULL;
++}
+ #endif /* CONFIG_OF */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -35,6 +35,7 @@
+ #include "core.h"
+ #include "common.h"
+ #include "bcdc.h"
++#include "of.h"
+ 
+ #define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2500)
+ #define CTL_DONE_TIMEOUT	msecs_to_jiffies(2500)
+@@ -633,7 +634,7 @@ MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "b
+ /* per-board firmware binaries */
+ MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "brcmfmac*-sdio.*.bin");
+ 
+-static const struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
++static const struct brcmf_firmware_mapping sdio_fwnames[] = {
+ 	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
+ 	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x0000001F, 43241B0),
+ 	BRCMF_FW_ENTRY(BRCM_CC_43241_CHIP_ID, 0x00000020, 43241B4),
+@@ -659,6 +660,9 @@ static const struct brcmf_firmware_mappi
+ 	BRCMF_FW_ENTRY(CY_CC_43752_CHIP_ID, 0xFFFFFFFF, 43752)
+ };
+ 
++static const struct brcmf_firmware_mapping *brcmf_sdio_fwnames = sdio_fwnames;
++static u32 brcmf_sdio_fwnames_count = ARRAY_SIZE(sdio_fwnames);
++
+ #define TXCTL_CREDITS	2
+ 
+ static void pkt_align(struct sk_buff *p, int len, int align)
+@@ -4140,7 +4144,7 @@ int brcmf_sdio_get_fwname(struct device
+ 
+ 	fwreq = brcmf_fw_alloc_request(bus_if->chip, bus_if->chiprev,
+ 				       brcmf_sdio_fwnames,
+-				       ARRAY_SIZE(brcmf_sdio_fwnames),
++				       brcmf_sdio_fwnames_count,
+ 				       fwnames, ARRAY_SIZE(fwnames));
+ 	if (!fwreq)
+ 		return -ENOMEM;
+@@ -4196,6 +4200,9 @@ static const struct brcmf_bus_ops brcmf_
+ #define BRCMF_SDIO_FW_CODE	0
+ #define BRCMF_SDIO_FW_NVRAM	1
+ 
++static struct brcmf_fw_request *
++brcmf_sdio_prepare_fw_request(struct brcmf_sdio *bus);
++
+ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+ 					 struct brcmf_fw_request *fwreq)
+ {
+@@ -4211,6 +4218,22 @@ static void brcmf_sdio_firmware_callback
+ 
+ 	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
+ 
++	if (err && brcmf_sdio_fwnames != sdio_fwnames) {
++		/* Try again with the standard firmware names */
++		brcmf_sdio_fwnames = sdio_fwnames;
++		brcmf_sdio_fwnames_count = ARRAY_SIZE(sdio_fwnames);
++		kfree(fwreq);
++		fwreq = brcmf_sdio_prepare_fw_request(bus);
++		if (!fwreq) {
++			err = -ENOMEM;
++			goto fail;
++		}
++		err = brcmf_fw_get_firmwares(dev, fwreq,
++					     brcmf_sdio_firmware_callback);
++		if (!err)
++			return;
++	}
++
+ 	if (err)
+ 		goto fail;
+ 
+@@ -4419,7 +4442,7 @@ brcmf_sdio_prepare_fw_request(struct brc
+ 
+ 	fwreq = brcmf_fw_alloc_request(bus->ci->chip, bus->ci->chiprev,
+ 				       brcmf_sdio_fwnames,
+-				       ARRAY_SIZE(brcmf_sdio_fwnames),
++				       brcmf_sdio_fwnames_count,
+ 				       fwnames, ARRAY_SIZE(fwnames));
+ 	if (!fwreq)
+ 		return NULL;
+@@ -4437,6 +4460,9 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	struct brcmf_sdio *bus;
+ 	struct workqueue_struct *wq;
+ 	struct brcmf_fw_request *fwreq;
++	struct brcmf_firmware_mapping *of_fwnames, *fwnames = NULL;
++	const int fwname_size = sizeof(struct brcmf_firmware_mapping);
++	u32 of_fw_count;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+@@ -4519,6 +4545,21 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 
+ 	brcmf_dbg(INFO, "completed!!\n");
+ 
++	of_fwnames = brcmf_of_fwnames(sdiodev->dev, &of_fw_count);
++	if (of_fwnames)
++		fwnames = devm_kcalloc(sdiodev->dev,
++				       of_fw_count + brcmf_sdio_fwnames_count,
++				       fwname_size, GFP_KERNEL);
++
++	if (fwnames) {
++		/* The array is scanned in order, so overrides come first */
++		memcpy(fwnames, of_fwnames, of_fw_count * fwname_size);
++		memcpy(fwnames + of_fw_count, sdio_fwnames,
++		       brcmf_sdio_fwnames_count * fwname_size);
++		brcmf_sdio_fwnames = fwnames;
++		brcmf_sdio_fwnames_count += of_fw_count;
++	}
++
+ 	fwreq = brcmf_sdio_prepare_fw_request(bus);
+ 	if (!fwreq) {
+ 		ret = -ENOMEM;
diff --git a/package/kernel/mac80211/patches/brcm/998-survey.patch b/package/kernel/mac80211/patches/brcm/998-survey.patch
index 25a12c783e..d194e25177 100644
--- a/package/kernel/mac80211/patches/brcm/998-survey.patch
+++ b/package/kernel/mac80211/patches/brcm/998-survey.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2913,6 +2913,63 @@ done:
+@@ -2921,6 +2921,63 @@ done:
  }
  
  static int
@@ -64,7 +64,7 @@
  brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
  			    int idx, u8 *mac, struct station_info *sinfo)
  {
-@@ -3008,6 +3065,7 @@ static s32 brcmf_inform_single_bss(struc
+@@ -3021,6 +3078,7 @@ static s32 brcmf_inform_single_bss(struc
  	struct brcmu_chan ch;
  	u16 channel;
  	u32 freq;
@@ -72,7 +72,7 @@
  	u16 notify_capability;
  	u16 notify_interval;
  	u8 *notify_ie;
-@@ -3032,6 +3090,17 @@ static s32 brcmf_inform_single_bss(struc
+@@ -3045,6 +3103,17 @@ static s32 brcmf_inform_single_bss(struc
  		band = NL80211_BAND_5GHZ;
  
  	freq = ieee80211_channel_to_frequency(channel, band);
@@ -90,7 +90,7 @@
  	bss_data.chan = ieee80211_get_channel(wiphy, freq);
  	bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
  	bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
-@@ -5518,6 +5587,7 @@ static struct cfg80211_ops brcmf_cfg8021
+@@ -5573,6 +5642,7 @@ static struct cfg80211_ops brcmf_cfg8021
  	.leave_ibss = brcmf_cfg80211_leave_ibss,
  	.get_station = brcmf_cfg80211_get_station,
  	.dump_station = brcmf_cfg80211_dump_station,
@@ -100,7 +100,7 @@
  	.add_key = brcmf_cfg80211_add_key,
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1356,6 +1356,8 @@ int brcmf_attach(struct device *dev)
+@@ -1363,6 +1363,8 @@ int brcmf_attach(struct device *dev)
  
  	/* Link to bus module */
  	drvr->hdrlen = 0;
@@ -109,7 +109,7 @@
  
  	/* Attach and link in the protocol */
  	ret = brcmf_proto_attach(drvr);
-@@ -1438,6 +1440,12 @@ void brcmf_detach(struct device *dev)
+@@ -1445,6 +1447,12 @@ void brcmf_detach(struct device *dev)
  	if (drvr == NULL)
  		return;
  
diff --git a/package/kernel/mac80211/patches/build/003-remove_bogus_modparams.patch b/package/kernel/mac80211/patches/build/003-remove_bogus_modparams.patch
index 8fa465a7e1..aa26c8cb2a 100644
--- a/package/kernel/mac80211/patches/build/003-remove_bogus_modparams.patch
+++ b/package/kernel/mac80211/patches/build/003-remove_bogus_modparams.patch
@@ -1,6 +1,6 @@
 --- a/compat/main.c
 +++ b/compat/main.c
-@@ -20,31 +20,6 @@ MODULE_LICENSE("GPL");
+@@ -19,31 +19,6 @@ MODULE_LICENSE("GPL");
  #error "You need a CPTCFG_VERSION"
  #endif
  
diff --git a/package/kernel/mac80211/patches/build/004-kconfig_backport_fix.patch b/package/kernel/mac80211/patches/build/004-kconfig_backport_fix.patch
deleted file mode 100644
index 2c9572ec93..0000000000
--- a/package/kernel/mac80211/patches/build/004-kconfig_backport_fix.patch
+++ /dev/null
@@ -1,28 +0,0 @@
---- a/backport-include/linux/kconfig.h
-+++ b/backport-include/linux/kconfig.h
-@@ -5,6 +5,8 @@
- #include_next <linux/kconfig.h>
- #endif
- 
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3,4,0)
-+
- #ifndef __ARG_PLACEHOLDER_1
- #define __ARG_PLACEHOLDER_1 0,
- #define config_enabled(cfg) _config_enabled(cfg)
-@@ -16,6 +18,7 @@
-  * 3.1 - 3.3 had a broken version of this, so undef
-  * (they didn't have __ARG_PLACEHOLDER_1)
-  */
-+
- #undef IS_ENABLED
- #define IS_ENABLED(option) \
-         (config_enabled(option) || config_enabled(option##_MODULE))
-@@ -31,6 +34,8 @@
- #undef IS_BUILTIN
- #define IS_BUILTIN(option) config_enabled(option)
- 
-+#endif
-+
- #ifndef IS_REACHABLE
- /*
-  * IS_REACHABLE(CONFIG_FOO) evaluates to 1 if the currently compiled
diff --git a/package/kernel/mac80211/patches/build/010-disable_rfkill.patch b/package/kernel/mac80211/patches/build/010-disable_rfkill.patch
deleted file mode 100644
index d5253063ce..0000000000
--- a/package/kernel/mac80211/patches/build/010-disable_rfkill.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- a/backport-include/linux/rfkill.h
-+++ b/backport-include/linux/rfkill.h
-@@ -2,6 +2,12 @@
- #define __COMPAT_RFKILL_H
- #include <linux/version.h>
- 
-+#undef CONFIG_RFKILL
-+#undef CONFIG_RFKILL_FULL
-+#undef CONFIG_RFKILL_LEDS
-+#undef CONFIG_RFKILL_MODULE
-+#undef CONFIG_RFKILL_FULL_MODULE
-+
- #if LINUX_VERSION_IS_GEQ(3,10,0)
- #include_next <linux/rfkill.h>
- #else
diff --git a/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch b/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch
index ff2ce2071f..089ff2117b 100644
--- a/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch
+++ b/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch
@@ -1,9 +1,9 @@
 --- a/local-symbols
 +++ b/local-symbols
-@@ -437,43 +437,6 @@ USB_SIERRA_NET=
- USB_VL600=
+@@ -451,43 +451,6 @@ USB_VL600=
  USB_NET_CH9200=
  USB_NET_AQC111=
+ USB_RTL8153_ECM=
 -SSB_POSSIBLE=
 -SSB=
 -SSB_SPROM=
@@ -192,10 +192,10 @@
  	select BRCMUTIL
 --- a/Kconfig.local
 +++ b/Kconfig.local
-@@ -1315,117 +1315,6 @@ config BACKPORTED_USB_NET_CH9200
- config BACKPORTED_USB_NET_AQC111
+@@ -1357,117 +1357,6 @@ config BACKPORTED_USB_NET_AQC111
+ config BACKPORTED_USB_RTL8153_ECM
  	tristate
- 	default USB_NET_AQC111
+ 	default USB_RTL8153_ECM
 -config BACKPORTED_SSB_POSSIBLE
 -	tristate
 -	default SSB_POSSIBLE
@@ -312,7 +312,7 @@
  	default USB_ACM
 --- a/Kconfig.sources
 +++ b/Kconfig.sources
-@@ -7,9 +7,6 @@ source "$BACKPORT_DIR/net/mac80211/Kconf
+@@ -10,9 +10,6 @@ source "$BACKPORT_DIR/drivers/soc/qcom/K
  source "$BACKPORT_DIR/drivers/net/wireless/Kconfig"
  source "$BACKPORT_DIR/drivers/net/usb/Kconfig"
  
@@ -324,9 +324,9 @@
  source "$BACKPORT_DIR/drivers/staging/Kconfig"
 --- a/Makefile.kernel
 +++ b/Makefile.kernel
-@@ -40,8 +40,6 @@ obj-y += compat/
- obj-$(CPTCFG_CFG80211) += net/wireless/
- obj-$(CPTCFG_MAC80211) += net/mac80211/
+@@ -43,8 +43,6 @@ obj-$(CPTCFG_QRTR) += net/qrtr/
+ obj-$(CPTCFG_QCOM_QMI_HELPERS) += drivers/soc/qcom/
+ obj-$(CPTCFG_MHI_BUS) += drivers/bus/mhi/
  obj-$(CPTCFG_WLAN) += drivers/net/wireless/
 -obj-$(CPTCFG_SSB) += drivers/ssb/
 -obj-$(CPTCFG_BCMA) += drivers/bcma/
diff --git a/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch b/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
index d358cfe367..140949f9a8 100644
--- a/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
+++ b/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/mwl8k.c
 +++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -5695,6 +5695,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
+@@ -5699,6 +5699,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
  MODULE_FIRMWARE(MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API));
  
  static const struct pci_device_id mwl8k_pci_id_table[] = {
diff --git a/package/kernel/mac80211/patches/mwl/900-mwifiex-increase-the-global-limit-up-to-4-SSID.patch b/package/kernel/mac80211/patches/mwl/900-mwifiex-increase-the-global-limit-up-to-4-SSID.patch
new file mode 100644
index 0000000000..4115eeccbb
--- /dev/null
+++ b/package/kernel/mac80211/patches/mwl/900-mwifiex-increase-the-global-limit-up-to-4-SSID.patch
@@ -0,0 +1,41 @@
+From ef8098cd6cb8b5989afef2e8461fe6ba9570a854 Mon Sep 17 00:00:00 2001
+From: Josef Schlehofer <pepe.schlehofer@gmail.com>
+Date: Wed, 24 Nov 2021 12:47:40 +0100
+Subject: [PATCH] mwifiex: increase the global limit up to 4 SSID
+
+Firmware for SDIO (88W8997), which is used in Turris MOX SDIO addon [1],
+allows up to 4 SSID. Unfortunately, driver (even in mainline kernel)
+has a global limit for all Marvell cards up to 3 SSID.
+
+Pali Rohár tested this patch and verified that the SDIO Wi-Fi addon works
+with the 4 SSID. So, let's increase the global limit from 3 to 4.
+
+Ideally, this patch should be done differently before sending
+it to Linux kernel. It means that limit definition should be moved to
+the card-specific structure.
+
+[1] https://docs.turris.cz/hw/mox/addons/#wi-fi-sdio
+---
+ drivers/net/wireless/marvell/mwifiex/decl.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/decl.h
++++ b/drivers/net/wireless/marvell/mwifiex/decl.h
+@@ -30,7 +30,7 @@
+ #include <net/cfg80211.h>
+ 
+ #define MWIFIEX_BSS_COEX_COUNT	     2
+-#define MWIFIEX_MAX_BSS_NUM         (3)
++#define MWIFIEX_MAX_BSS_NUM         (4)
+ 
+ #define MWIFIEX_DMA_ALIGN_SZ	    64
+ #define MWIFIEX_RX_HEADROOM	    64
+@@ -112,7 +112,7 @@
+ #define MWIFIEX_RATE_INDEX_OFDM0   4
+ 
+ #define MWIFIEX_MAX_STA_NUM		3
+-#define MWIFIEX_MAX_UAP_NUM		3
++#define MWIFIEX_MAX_UAP_NUM		4
+ #define MWIFIEX_MAX_P2P_NUM		3
+ 
+ #define MWIFIEX_A_BAND_START_FREQ	5000
diff --git a/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
index a35cf1875a..96b1ce77e9 100644
--- a/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/mwl8k.c
 +++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -6280,6 +6280,8 @@ static int mwl8k_probe(struct pci_dev *p
+@@ -6285,6 +6285,8 @@ static int mwl8k_probe(struct pci_dev *p
  
  	priv->running_bsses = 0;
  
@@ -9,7 +9,7 @@
  	return rc;
  
  err_stop_firmware:
-@@ -6313,8 +6315,6 @@ static void mwl8k_remove(struct pci_dev
+@@ -6318,8 +6320,6 @@ static void mwl8k_remove(struct pci_dev
  		return;
  	priv = hw->priv;
  
diff --git a/package/kernel/mac80211/patches/mwl/950-mwifiex-Print-stringified-name-of-command-in-error-l.patch b/package/kernel/mac80211/patches/mwl/950-mwifiex-Print-stringified-name-of-command-in-error-l.patch
new file mode 100644
index 0000000000..8fa3924e60
--- /dev/null
+++ b/package/kernel/mac80211/patches/mwl/950-mwifiex-Print-stringified-name-of-command-in-error-l.patch
@@ -0,0 +1,189 @@
+From f7252b1b5755150535af226e806594bbefd45e0f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Sun, 26 Sep 2021 14:39:44 +0200
+Subject: [PATCH] mwifiex: Print stringified name of command in error log
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Failed hex command number in error log is hard to understand.
+So add also more human readable stringified command name into error log.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/cmdevt.c | 96 +++++++++++++++++--
+ drivers/net/wireless/marvell/mwifiex/main.h   |  2 +
+ .../wireless/marvell/mwifiex/sta_cmdresp.c    |  5 +-
+ .../net/wireless/marvell/mwifiex/uap_cmd.c    |  3 +-
+ 4 files changed, 95 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c
++++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c
+@@ -28,6 +28,85 @@
+ 
+ static void mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter);
+ 
++const char *
++mwifiex_cmd_to_str(u16 command)
++{
++	switch (command) {
++	case HostCmd_CMD_GET_HW_SPEC:			return "GET_HW_SPEC";
++	case HostCmd_CMD_802_11_SCAN:			return "SCAN";
++	case HostCmd_CMD_802_11_GET_LOG:		return "GET_LOG";
++	case HostCmd_CMD_MAC_MULTICAST_ADR:		return "MAC_MULTICAST_ADR";
++	case HostCmd_CMD_802_11_EEPROM_ACCESS:		return "EEPROM_ACCESS";
++	case HostCmd_CMD_802_11_ASSOCIATE:		return "ASSOCIATE";
++	case HostCmd_CMD_802_11_SNMP_MIB:		return "SNMP_MIB";
++	case HostCmd_CMD_MAC_REG_ACCESS:		return "MAC_REG_ACCESS";
++	case HostCmd_CMD_BBP_REG_ACCESS:		return "BBP_REG_ACCESS";
++	case HostCmd_CMD_RF_REG_ACCESS:			return "RF_REG_ACCESS";
++	case HostCmd_CMD_PMIC_REG_ACCESS:		return "PMIC_REG_ACCESS";
++	case HostCmd_CMD_RF_TX_PWR:			return "RF_TX_PWR";
++	case HostCmd_CMD_RF_ANTENNA:			return "RF_ANTENNA";
++	case HostCmd_CMD_802_11_DEAUTHENTICATE:		return "DEAUTHENTICATE";
++	case HostCmd_CMD_MAC_CONTROL:			return "MAC_CONTROL";
++	case HostCmd_CMD_802_11_AD_HOC_START:		return "AD_HOC_START";
++	case HostCmd_CMD_802_11_AD_HOC_JOIN:		return "AD_HOC_JOIN";
++	case HostCmd_CMD_802_11_AD_HOC_STOP:		return "AD_HOC_STOP";
++	case HostCmd_CMD_802_11_MAC_ADDRESS:		return "MAC_ADDRESS";
++	case HostCmd_CMD_802_11D_DOMAIN_INFO:		return "DOMAIN_INFO";
++	case HostCmd_CMD_802_11_KEY_MATERIAL:		return "KEY_MATERIAL";
++	case HostCmd_CMD_802_11_BG_SCAN_CONFIG:		return "BG_SCAN_CONFIG";
++	case HostCmd_CMD_802_11_BG_SCAN_QUERY:		return "BG_SCAN_QUERY";
++	case HostCmd_CMD_WMM_GET_STATUS:		return "WMM_GET_STATUS";
++	case HostCmd_CMD_802_11_SUBSCRIBE_EVENT:	return "SUBSCRIBE_EVENT";
++	case HostCmd_CMD_802_11_TX_RATE_QUERY:		return "TX_RATE_QUERY";
++	case HostCmd_CMD_802_11_IBSS_COALESCING_STATUS:	return "IBSS_COALESCING_STATUS";
++	case HostCmd_CMD_MEM_ACCESS:			return "MEM_ACCESS";
++	case HostCmd_CMD_CFG_DATA:			return "CFG_DATA";
++	case HostCmd_CMD_VERSION_EXT:			return "VERSION_EXT";
++	case HostCmd_CMD_MEF_CFG:			return "MEF_CFG";
++	case HostCmd_CMD_RSSI_INFO:			return "RSSI_INFO";
++	case HostCmd_CMD_FUNC_INIT:			return "FUNC_INIT";
++	case HostCmd_CMD_FUNC_SHUTDOWN:			return "FUNC_SHUTDOWN";
++	case HOST_CMD_APCMD_SYS_RESET:			return "SYS_RESET";
++	case HostCmd_CMD_UAP_SYS_CONFIG:		return "UAP_SYS_CONFIG";
++	case HostCmd_CMD_UAP_BSS_START:			return "UAP_BSS_START";
++	case HostCmd_CMD_UAP_BSS_STOP:			return "UAP_BSS_STOP";
++	case HOST_CMD_APCMD_STA_LIST:			return "STA_LIST";
++	case HostCmd_CMD_UAP_STA_DEAUTH:		return "UAP_STA_DEAUTH";
++	case HostCmd_CMD_11N_CFG:			return "11N_CFG";
++	case HostCmd_CMD_11N_ADDBA_REQ:			return "ADDBA_REQ";
++	case HostCmd_CMD_11N_ADDBA_RSP:			return "ADDBA_RSP";
++	case HostCmd_CMD_11N_DELBA:			return "DELBA";
++	case HostCmd_CMD_RECONFIGURE_TX_BUFF:		return "RECONFIGURE_TX_BUFF";
++	case HostCmd_CMD_CHAN_REPORT_REQUEST:		return "CHAN_REPORT_REQUEST";
++	case HostCmd_CMD_AMSDU_AGGR_CTRL:		return "AMSDU_AGGR_CTRL";
++	case HostCmd_CMD_TXPWR_CFG:			return "TXPWR_CFG";
++	case HostCmd_CMD_TX_RATE_CFG:			return "TX_RATE_CFG";
++	case HostCmd_CMD_ROBUST_COEX:			return "ROBUST_COEX";
++	case HostCmd_CMD_802_11_PS_MODE_ENH:		return "PS_MODE_ENH";
++	case HostCmd_CMD_802_11_HS_CFG_ENH:		return "HS_CFG_ENH";
++	case HostCmd_CMD_P2P_MODE_CFG:			return "P2P_MODE_CFG";
++	case HostCmd_CMD_CAU_REG_ACCESS:		return "CAU_REG_ACCESS";
++	case HostCmd_CMD_SET_BSS_MODE:			return "SET_BSS_MODE";
++	case HostCmd_CMD_PCIE_DESC_DETAILS:		return "PCIE_DESC_DETAILS";
++	case HostCmd_CMD_802_11_SCAN_EXT:		return "SCAN_EXT";
++	case HostCmd_CMD_COALESCE_CFG:			return "COALESCE_CFG";
++	case HostCmd_CMD_MGMT_FRAME_REG:		return "MGMT_FRAME_REG";
++	case HostCmd_CMD_REMAIN_ON_CHAN:		return "REMAIN_ON_CHAN";
++	case HostCmd_CMD_GTK_REKEY_OFFLOAD_CFG:		return "GTK_REKEY_OFFLOAD_CFG";
++	case HostCmd_CMD_11AC_CFG:			return "11AC_CFG";
++	case HostCmd_CMD_HS_WAKEUP_REASON:		return "HS_WAKEUP_REASON";
++	case HostCmd_CMD_TDLS_CONFIG:			return "TDLS_CONFIG";
++	case HostCmd_CMD_MC_POLICY:			return "MC_POLICY";
++	case HostCmd_CMD_TDLS_OPER:			return "TDLS_OPER";
++	case HostCmd_CMD_FW_DUMP_EVENT:			return "FW_DUMP_EVENT";
++	case HostCmd_CMD_SDIO_SP_RX_AGGR_CFG:		return "SDIO_SP_RX_AGGR_CFG";
++	case HostCmd_CMD_STA_CONFIGURE:			return "STA_CONFIGURE";
++	case HostCmd_CMD_CHAN_REGION_CFG:		return "CHAN_REGION_CFG";
++	case HostCmd_CMD_PACKET_AGGR_CTRL:		return "PACKET_AGGR_CTRL";
++	default:					return "UNKNOWN";
++	}
++}
++
+ /*
+  * This function initializes a command node.
+  *
+@@ -205,8 +284,8 @@ static int mwifiex_dnld_cmd_to_fw(struct
+ 	    cmd_code != HostCmd_CMD_FUNC_SHUTDOWN &&
+ 	    cmd_code != HostCmd_CMD_FUNC_INIT) {
+ 		mwifiex_dbg(adapter, ERROR,
+-			    "DNLD_CMD: FW in reset state, ignore cmd %#x\n",
+-			cmd_code);
++			    "DNLD_CMD: FW in reset state, ignore cmd %s (%#x)\n",
++			    mwifiex_cmd_to_str(cmd_code), cmd_code);
+ 		mwifiex_recycle_cmd_node(adapter, cmd_node);
+ 		queue_work(adapter->workqueue, &adapter->main_work);
+ 		return -1;
+@@ -660,8 +739,8 @@ int mwifiex_send_cmd(struct mwifiex_priv
+ 	/* Return error, since the command preparation failed */
+ 	if (ret) {
+ 		mwifiex_dbg(adapter, ERROR,
+-			    "PREP_CMD: cmd %#x preparation failed\n",
+-			cmd_no);
++			    "PREP_CMD: cmd %s (%#x) preparation failed\n",
++			    mwifiex_cmd_to_str(cmd_no), cmd_no);
+ 		mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
+ 		return -1;
+ 	}
+@@ -900,8 +979,9 @@ int mwifiex_process_cmdresp(struct mwifi
+ 	if (adapter->hw_status == MWIFIEX_HW_STATUS_INITIALIZING) {
+ 		if (ret) {
+ 			mwifiex_dbg(adapter, ERROR,
+-				    "%s: cmd %#x failed during\t"
+-				    "initialization\n", __func__, cmdresp_no);
++				    "%s: cmd %s (%#x) failed during\t"
++				    "initialization\n", __func__,
++				    mwifiex_cmd_to_str(cmdresp_no), cmdresp_no);
+ 			mwifiex_init_fw_complete(adapter);
+ 			return -1;
+ 		} else if (adapter->last_init_cmd == cmdresp_no)
+@@ -1264,8 +1344,8 @@ mwifiex_process_sleep_confirm_resp(struc
+ 
+ 	if (command != HostCmd_CMD_802_11_PS_MODE_ENH) {
+ 		mwifiex_dbg(adapter, ERROR,
+-			    "%s: rcvd unexpected resp for cmd %#x, result = %x\n",
+-			    __func__, command, result);
++			    "%s: rcvd unexpected resp for cmd %s (%#x), result = %x\n",
++			    __func__, mwifiex_cmd_to_str(command), command, result);
+ 		return;
+ 	}
+ 
+--- a/drivers/net/wireless/marvell/mwifiex/main.h
++++ b/drivers/net/wireless/marvell/mwifiex/main.h
+@@ -1106,6 +1106,8 @@ void mwifiex_cancel_all_pending_cmd(stru
+ void mwifiex_cancel_pending_scan_cmd(struct mwifiex_adapter *adapter);
+ void mwifiex_cancel_scan(struct mwifiex_adapter *adapter);
+ 
++const char *mwifiex_cmd_to_str(u16 command);
++
+ void mwifiex_recycle_cmd_node(struct mwifiex_adapter *adapter,
+ 			      struct cmd_ctrl_node *cmd_node);
+ 
+--- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+@@ -48,8 +48,9 @@ mwifiex_process_cmdresp_error(struct mwi
+ 	struct host_cmd_ds_802_11_ps_mode_enh *pm;
+ 
+ 	mwifiex_dbg(adapter, ERROR,
+-		    "CMD_RESP: cmd %#x error, result=%#x\n",
+-		    resp->command, resp->result);
++		    "CMD_RESP: cmd %s (%#x) error, result=%#x\n",
++		    mwifiex_cmd_to_str(le16_to_cpu(resp->command)),
++		    le16_to_cpu(resp->command), le16_to_cpu(resp->result));
+ 
+ 	if (adapter->curr_cmd->wait_q_enabled)
+ 		adapter->cmd_wait_q.status = -1;
+--- a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
++++ b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
+@@ -806,7 +806,8 @@ int mwifiex_uap_prepare_cmd(struct mwifi
+ 		break;
+ 	default:
+ 		mwifiex_dbg(priv->adapter, ERROR,
+-			    "PREP_CMD: unknown cmd %#x\n", cmd_no);
++			    "PREP_CMD: unknown cmd (%s) %#x\n",
++			    mwifiex_cmd_to_str(cmd_no), cmd_no);
+ 		return -1;
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/rt2x00/002-rt2x00-define-RF5592-in-init_eeprom-routine.patch b/package/kernel/mac80211/patches/rt2x00/002-rt2x00-define-RF5592-in-init_eeprom-routine.patch
index a50a195285..96eeb37dc6 100644
--- a/package/kernel/mac80211/patches/rt2x00/002-rt2x00-define-RF5592-in-init_eeprom-routine.patch
+++ b/package/kernel/mac80211/patches/rt2x00/002-rt2x00-define-RF5592-in-init_eeprom-routine.patch
@@ -40,7 +40,7 @@ Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -9416,6 +9416,8 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9435,6 +9435,8 @@ static int rt2800_init_eeprom(struct rt2
  		rf = RF3853;
  	else if (rt2x00_rt(rt2x00dev, RT5350))
  		rf = RF5350;
diff --git a/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch b/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
index e74d9a9aa0..bd33b2efbd 100644
--- a/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
+++ b/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
@@ -1,6 +1,6 @@
 --- a/local-symbols
 +++ b/local-symbols
-@@ -332,6 +332,7 @@ RT2X00_LIB_FIRMWARE=
+@@ -345,6 +345,7 @@ RT2X00_LIB_FIRMWARE=
  RT2X00_LIB_CRYPTO=
  RT2X00_LIB_LEDS=
  RT2X00_LIB_DEBUGFS=
@@ -105,7 +105,7 @@
  	.drv_init_registers	= rt2800mmio_init_registers,
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -694,6 +694,7 @@ enum rt2x00_capability_flags {
+@@ -703,6 +703,7 @@ enum rt2x00_capability_flags {
  	REQUIRE_HT_TX_DESC,
  	REQUIRE_PS_AUTOWAKE,
  	REQUIRE_DELAYED_RFKILL,
@@ -113,7 +113,7 @@
  
  	/*
  	 * Capabilities
-@@ -970,6 +971,11 @@ struct rt2x00_dev {
+@@ -980,6 +981,11 @@ struct rt2x00_dev {
  	const struct firmware *fw;
  
  	/*
@@ -127,7 +127,7 @@
  	DECLARE_KFIFO_PTR(txstatus_fifo, u32);
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1406,6 +1406,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+@@ -1401,6 +1401,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
  	INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
  	INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
  
@@ -138,7 +138,7 @@
  	/*
  	 * Let the driver probe the device to detect the capabilities.
  	 */
-@@ -1549,6 +1553,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
+@@ -1541,6 +1545,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
  	 * Free the driver data.
  	 */
  	kfree(rt2x00dev->drv_data);
diff --git a/package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch b/package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch
index 6a8e594d5e..ffee2189d2 100644
--- a/package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch
+++ b/package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch
@@ -12,7 +12,7 @@
  #endif /* _RT2X00_PLATFORM_H */
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1012,6 +1012,22 @@ static int rt2x00lib_probe_hw_modes(stru
+@@ -1007,6 +1007,22 @@ static int rt2x00lib_probe_hw_modes(stru
  	unsigned int num_rates;
  	unsigned int i;
  
@@ -37,7 +37,7 @@
  		num_rates += 4;
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -399,6 +399,7 @@ struct hw_mode_spec {
+@@ -408,6 +408,7 @@ struct hw_mode_spec {
  	unsigned int supported_bands;
  #define SUPPORT_BAND_2GHZ	0x00000001
  #define SUPPORT_BAND_5GHZ	0x00000002
diff --git a/package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch b/package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch
index b5b2c61037..37553bb80a 100644
--- a/package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch
+++ b/package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch
@@ -1,19 +1,18 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -990,8 +990,13 @@ static void rt2x00lib_rate(struct ieee80
+@@ -989,6 +989,12 @@ static void rt2x00lib_rate(struct ieee80
  
  void rt2x00lib_set_mac_address(struct rt2x00_dev *rt2x00dev, u8 *eeprom_mac_addr)
  {
 +	struct rt2x00_platform_data *pdata;
- 	const char *mac_addr;
- 
++
 +	pdata = rt2x00dev->dev->platform_data;
 +	if (pdata && pdata->mac_address)
 +		ether_addr_copy(eeprom_mac_addr, pdata->mac_address);
 +
- 	mac_addr = of_get_mac_address(rt2x00dev->dev->of_node);
- 	if (!IS_ERR(mac_addr))
- 		ether_addr_copy(eeprom_mac_addr, mac_addr);
+ 	of_get_mac_address(rt2x00dev->dev->of_node, eeprom_mac_addr);
+ 
+ 	if (!is_valid_ether_addr(eeprom_mac_addr)) {
 --- a/include/linux/rt2x00_platform.h
 +++ b/include/linux/rt2x00_platform.h
 @@ -14,6 +14,7 @@
diff --git a/package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch b/package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch
index ff8b2c947b..6211809c0a 100644
--- a/package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch
+++ b/package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1016,6 +1016,16 @@ static int rt2x00lib_probe_hw_modes(stru
+@@ -1012,6 +1012,16 @@ static int rt2x00lib_probe_hw_modes(stru
  	struct ieee80211_rate *rates;
  	unsigned int num_rates;
  	unsigned int i;
diff --git a/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch b/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
index 039c6f6afc..d78b76d7f5 100644
--- a/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
+++ b/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
@@ -8,7 +8,7 @@
  
  #include "rt2x00.h"
  #include "rt2800lib.h"
-@@ -9530,6 +9531,17 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9549,6 +9550,17 @@ static int rt2800_init_eeprom(struct rt2
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_assoc, LED_TYPE_ASSOC);
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_qual, LED_TYPE_QUALITY);
  
diff --git a/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch b/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
index 88d6dd559b..0da9356e0c 100644
--- a/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
+++ b/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1344,7 +1344,7 @@ static inline void rt2x00lib_set_if_comb
+@@ -1340,7 +1340,7 @@ static inline void rt2x00lib_set_if_comb
  	 */
  	if_limit = &rt2x00dev->if_limits_ap;
  	if_limit->max = rt2x00dev->ops->max_ap_intf;
diff --git a/package/kernel/mac80211/patches/rt2x00/612-rt2x00-led-tpt-trigger-support.patch b/package/kernel/mac80211/patches/rt2x00/612-rt2x00-led-tpt-trigger-support.patch
index fca1fb2cd4..6e6564f870 100644
--- a/package/kernel/mac80211/patches/rt2x00/612-rt2x00-led-tpt-trigger-support.patch
+++ b/package/kernel/mac80211/patches/rt2x00/612-rt2x00-led-tpt-trigger-support.patch
@@ -11,7 +11,7 @@ Tested-by: Christoph Krapp <achterin@googlemail.com>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1129,6 +1129,19 @@ static void rt2x00lib_remove_hw(struct r
+@@ -1125,6 +1125,19 @@ static void rt2x00lib_remove_hw(struct r
  	kfree(rt2x00dev->spec.channels_info);
  }
  
@@ -31,7 +31,7 @@ Tested-by: Christoph Krapp <achterin@googlemail.com>
  static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
  {
  	struct hw_mode_spec *spec = &rt2x00dev->spec;
-@@ -1210,6 +1223,10 @@ static int rt2x00lib_probe_hw(struct rt2
+@@ -1206,6 +1219,10 @@ static int rt2x00lib_probe_hw(struct rt2
  
  #undef RT2X00_TASKLET_INIT
  
diff --git a/package/kernel/mac80211/patches/rt2x00/650-rt2x00-add-support-for-external-PA-on-MT7620.patch b/package/kernel/mac80211/patches/rt2x00/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
index 20452cd8a7..8814c02532 100644
--- a/package/kernel/mac80211/patches/rt2x00/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
+++ b/package/kernel/mac80211/patches/rt2x00/650-rt2x00-add-support-for-external-PA-on-MT7620.patch
@@ -30,7 +30,7 @@ Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
   * EEPROM LNA
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -4356,6 +4356,45 @@ static void rt2800_config_channel(struct
+@@ -4369,6 +4369,45 @@ static void rt2800_config_channel(struct
  		rt2800_iq_calibrate(rt2x00dev, rf->channel);
  	}
  
@@ -76,7 +76,7 @@ Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
  	bbp = rt2800_bbp_read(rt2x00dev, 4);
  	rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * conf_is_ht40(conf));
  	rt2800_bbp_write(rt2x00dev, 4, bbp);
-@@ -9559,7 +9598,8 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9578,7 +9617,8 @@ static int rt2800_init_eeprom(struct rt2
  	 */
  	eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1);
  
@@ -86,7 +86,7 @@ Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
  		if (rt2x00_get_field16(eeprom,
  		    EEPROM_NIC_CONF1_EXTERNAL_TX0_PA_3352))
  		    __set_bit(CAPABILITY_EXTERNAL_PA_TX0,
-@@ -9570,6 +9610,18 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9589,6 +9629,18 @@ static int rt2800_init_eeprom(struct rt2
  			      &rt2x00dev->cap_flags);
  	}
  
diff --git a/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch b/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch
index 6be847478e..b798dcc6d8 100644
--- a/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch
+++ b/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8419,6 +8419,56 @@ static void rt2800_init_rfcsr_5592(struc
+@@ -8438,6 +8438,56 @@ static void rt2800_init_rfcsr_5592(struc
  	rt2800_led_open_drain_enable(rt2x00dev);
  }
  
@@ -57,7 +57,7 @@
  static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
  				       bool set_bw, bool is_ht40)
  {
-@@ -9026,6 +9076,7 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -9045,6 +9095,7 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
  	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
  
diff --git a/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch b/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch
index 3ed0ff7ef5..cf21c39a6c 100644
--- a/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch
+++ b/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8469,6 +8469,155 @@ static void rt2800_rf_self_txdc_cal(stru
+@@ -8488,6 +8488,155 @@ static void rt2800_rf_self_txdc_cal(stru
  	rt2x00_info(rt2x00dev, "RF Tx self calibration end\n");
  }
  
@@ -156,7 +156,7 @@
  static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
  				       bool set_bw, bool is_ht40)
  {
-@@ -9076,6 +9225,7 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -9095,6 +9244,7 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
  	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
  
diff --git a/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch b/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch
index 77be986d18..1f8684b0bf 100644
--- a/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch
+++ b/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8618,6 +8618,70 @@ static void rt2800_r_calibration(struct
+@@ -8637,6 +8637,70 @@ static void rt2800_r_calibration(struct
  	rt2800_register_write(rt2x00dev, PWR_PIN_CFG, MAC_PWR_PIN_CFG);
  }
  
@@ -71,7 +71,7 @@
  static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
  				       bool set_bw, bool is_ht40)
  {
-@@ -9227,6 +9291,7 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -9246,6 +9310,7 @@ static void rt2800_init_rfcsr_6352(struc
  
  	rt2800_r_calibration(rt2x00dev);
  	rt2800_rf_self_txdc_cal(rt2x00dev);
diff --git a/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch b/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch
index 7352ad036c..98f2e245ce 100644
--- a/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch
+++ b/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8682,6 +8682,384 @@ static void rt2800_rxdcoc_calibration(st
+@@ -8701,6 +8701,384 @@ static void rt2800_rxdcoc_calibration(st
  	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, saverfb0r2);
  }
  
@@ -385,7 +385,7 @@
  static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
  				       bool set_bw, bool is_ht40)
  {
-@@ -9294,6 +9672,7 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -9313,6 +9691,7 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rxdcoc_calibration(rt2x00dev);
  	rt2800_bw_filter_calibration(rt2x00dev, true);
  	rt2800_bw_filter_calibration(rt2x00dev, false);
diff --git a/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch b/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch
index fe0961baa7..6a685f80ab 100644
--- a/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch
+++ b/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -9060,6 +9060,943 @@ restore_value:
+@@ -9079,6 +9079,943 @@ restore_value:
  	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
  }
  
@@ -944,7 +944,7 @@
  static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
  				       bool set_bw, bool is_ht40)
  {
-@@ -9672,6 +10609,7 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -9691,6 +10628,7 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rxdcoc_calibration(rt2x00dev);
  	rt2800_bw_filter_calibration(rt2x00dev, true);
  	rt2800_bw_filter_calibration(rt2x00dev, false);
diff --git a/package/kernel/mac80211/patches/rt2x00/991-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch b/package/kernel/mac80211/patches/rt2x00/991-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch
index 3de00b2267..40b20ec594 100644
--- a/package/kernel/mac80211/patches/rt2x00/991-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch
+++ b/package/kernel/mac80211/patches/rt2x00/991-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch
@@ -14,7 +14,7 @@
   */
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -3685,14 +3685,16 @@ static void rt2800_config_channel_rf7620
+@@ -3698,14 +3698,16 @@ static void rt2800_config_channel_rf7620
  	rt2x00_set_field8(&rfcsr, RFCSR19_K, rf->rf4);
  	rt2800_rfcsr_write(rt2x00dev, 19, rfcsr);
  
@@ -39,7 +39,7 @@
  
  	rfcsr = rt2800_rfcsr_read(rt2x00dev, 1);
  	rt2x00_set_field8(&rfcsr, RFCSR1_TX2_EN_MT7620,
-@@ -3726,18 +3728,23 @@ static void rt2800_config_channel_rf7620
+@@ -3739,18 +3741,23 @@ static void rt2800_config_channel_rf7620
  		rt2800_rfcsr_write_dccal(rt2x00dev, 59, 0x20);
  	}
  
@@ -73,7 +73,7 @@
  
  	if (!test_bit(DEVICE_STATE_SCANNING, &rt2x00dev->flags)) {
  		if (conf_is_ht40(conf)) {
-@@ -3837,25 +3844,29 @@ static void rt2800_config_alc(struct rt2
+@@ -3850,25 +3857,29 @@ static void rt2800_config_alc(struct rt2
  	if (i == 10000)
  		rt2x00_warn(rt2x00dev, "Wait MAC Status to MAX !!!\n");
  
@@ -121,7 +121,7 @@
  	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, mac_sys_ctrl);
  
  	rt2800_vco_calibration(rt2x00dev);
-@@ -5887,18 +5898,33 @@ static int rt2800_init_registers(struct
+@@ -5906,18 +5917,33 @@ static int rt2800_init_registers(struct
  	} else if (rt2x00_rt(rt2x00dev, RT5350)) {
  		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
  	} else if (rt2x00_rt(rt2x00dev, RT6352)) {
@@ -167,7 +167,7 @@
  		reg = rt2800_register_read(rt2x00dev, TX_ALC_CFG_1);
  		rt2x00_set_field32(&reg, TX_ALC_CFG_1_ROS_BUSY_EN, 0);
  		rt2800_register_write(rt2x00dev, TX_ALC_CFG_1, reg);
-@@ -7042,14 +7068,16 @@ static void rt2800_init_bbp_6352(struct
+@@ -7061,14 +7087,16 @@ static void rt2800_init_bbp_6352(struct
  	rt2800_bbp_write(rt2x00dev, 188, 0x00);
  	rt2800_bbp_write(rt2x00dev, 189, 0x00);
  
@@ -192,7 +192,7 @@
  
  	/* BBP for G band GLRT function (BBP_128 ~ BBP_221) */
  	rt2800_bbp_glrt_write(rt2x00dev, 0, 0x00);
-@@ -10388,31 +10416,36 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10407,31 +10435,36 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write(rt2x00dev, 42, 0x5B);
  	rt2800_rfcsr_write(rt2x00dev, 43, 0x00);
  
@@ -254,7 +254,7 @@
  
  	/* Initialize RF channel register to default value */
  	rt2800_rfcsr_write_chanreg(rt2x00dev, 0, 0x03);
-@@ -10478,63 +10511,71 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10497,63 +10530,71 @@ static void rt2800_init_rfcsr_6352(struc
  
  	rt2800_rfcsr_write_bank(rt2x00dev, 6, 45, 0xC5);
  
@@ -383,7 +383,7 @@
  
  	/* Initialize RF DC calibration register to default value */
  	rt2800_rfcsr_write_dccal(rt2x00dev, 0, 0x47);
-@@ -10597,12 +10638,17 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10616,12 +10657,17 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write_dccal(rt2x00dev, 62, 0x00);
  	rt2800_rfcsr_write_dccal(rt2x00dev, 63, 0x00);
  
diff --git a/package/kernel/mac80211/patches/rt2x00/992-rt2x00-save-survey-for-every-channel-visited.patch b/package/kernel/mac80211/patches/rt2x00/992-rt2x00-save-survey-for-every-channel-visited.patch
deleted file mode 100644
index 31a7baeee7..0000000000
--- a/package/kernel/mac80211/patches/rt2x00/992-rt2x00-save-survey-for-every-channel-visited.patch
+++ /dev/null
@@ -1,183 +0,0 @@
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -1238,6 +1238,8 @@ void rt2800_watchdog(struct rt2x00_dev *
- 	if (test_bit(DEVICE_STATE_SCANNING, &rt2x00dev->flags))
- 		return;
- 
-+	rt2800_update_survey(rt2x00dev);
-+
- 	queue_for_each(rt2x00dev, queue) {
- 		switch (queue->qid) {
- 		case QID_AC_VO:
-@@ -1274,6 +1276,18 @@ void rt2800_watchdog(struct rt2x00_dev *
- }
- EXPORT_SYMBOL_GPL(rt2800_watchdog);
- 
-+void rt2800_update_survey(struct rt2x00_dev *rt2x00dev)
-+{
-+	struct ieee80211_channel *chan = rt2x00dev->hw->conf.chandef.chan;
-+	struct rt2x00_chan_survey *chan_survey =
-+		   &rt2x00dev->chan_survey[chan->hw_value];
-+
-+	chan_survey->time_idle += rt2800_register_read(rt2x00dev, CH_IDLE_STA);
-+	chan_survey->time_busy += rt2800_register_read(rt2x00dev, CH_BUSY_STA);
-+	chan_survey->time_ext_busy += rt2800_register_read(rt2x00dev, CH_BUSY_STA_SEC);
-+}
-+EXPORT_SYMBOL_GPL(rt2800_update_survey);
-+
- static unsigned int rt2800_hw_beacon_base(struct rt2x00_dev *rt2x00dev,
- 					  unsigned int index)
- {
-@@ -12199,26 +12213,30 @@ int rt2800_get_survey(struct ieee80211_h
- {
- 	struct rt2x00_dev *rt2x00dev = hw->priv;
- 	struct ieee80211_conf *conf = &hw->conf;
--	u32 idle, busy, busy_ext;
-+	struct rt2x00_chan_survey *chan_survey =
-+		   &rt2x00dev->chan_survey[idx];
-+	enum nl80211_band band = NL80211_BAND_2GHZ;
- 
--	if (idx != 0)
-+	if (idx >= rt2x00dev->bands[band].n_channels) {
-+		idx -= rt2x00dev->bands[band].n_channels;
-+		band = NL80211_BAND_5GHZ;
-+	}
-+
-+	if (idx >= rt2x00dev->bands[band].n_channels)
- 		return -ENOENT;
- 
--	survey->channel = conf->chandef.chan;
-+	if (idx == 0)
-+		rt2800_update_survey(rt2x00dev);
- 
--	idle = rt2800_register_read(rt2x00dev, CH_IDLE_STA);
--	busy = rt2800_register_read(rt2x00dev, CH_BUSY_STA);
--	busy_ext = rt2800_register_read(rt2x00dev, CH_BUSY_STA_SEC);
--
--	if (idle || busy) {
--		survey->filled = SURVEY_INFO_TIME |
--				 SURVEY_INFO_TIME_BUSY |
--				 SURVEY_INFO_TIME_EXT_BUSY;
--
--		survey->time = (idle + busy) / 1000;
--		survey->time_busy = busy / 1000;
--		survey->time_ext_busy = busy_ext / 1000;
--	}
-+	survey->channel = &rt2x00dev->bands[band].channels[idx];
-+
-+	survey->filled = SURVEY_INFO_TIME |
-+			 SURVEY_INFO_TIME_BUSY |
-+			 SURVEY_INFO_TIME_EXT_BUSY;
-+
-+	survey->time = div_u64(chan_survey->time_idle + chan_survey->time_busy, 1000);
-+	survey->time_busy = div_u64(chan_survey->time_busy, 1000);
-+	survey->time_ext_busy = div_u64(chan_survey->time_ext_busy, 1000);
- 
- 	if (!(hw->conf.flags & IEEE80211_CONF_OFFCHANNEL))
- 		survey->filled |= SURVEY_INFO_IN_USE;
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-@@ -243,6 +243,7 @@ bool rt2800_txstatus_timeout(struct rt2x
- bool rt2800_txstatus_pending(struct rt2x00_dev *rt2x00dev);
- 
- void rt2800_watchdog(struct rt2x00_dev *rt2x00dev);
-+void rt2800_update_survey(struct rt2x00_dev *rt2x00dev);
- 
- void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc);
- void rt2800_clear_beacon(struct queue_entry *entry);
---- a/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
-@@ -360,6 +360,7 @@ static const struct rt2x00lib_ops rt2800
- 	.gain_calibration	= rt2800_gain_calibration,
- 	.vco_calibration	= rt2800_vco_calibration,
- 	.watchdog		= rt2800_watchdog,
-+	.update_survey		= rt2800_update_survey,
- 	.start_queue		= rt2800mmio_start_queue,
- 	.kick_queue		= rt2800mmio_kick_queue,
- 	.stop_queue		= rt2800mmio_stop_queue,
---- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
-@@ -214,6 +214,7 @@ static const struct rt2x00lib_ops rt2800
- 	.gain_calibration	= rt2800_gain_calibration,
- 	.vco_calibration	= rt2800_vco_calibration,
- 	.watchdog		= rt2800_watchdog,
-+	.update_survey		= rt2800_update_survey,
- 	.start_queue		= rt2800mmio_start_queue,
- 	.kick_queue		= rt2800mmio_kick_queue,
- 	.stop_queue		= rt2800mmio_stop_queue,
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -183,6 +183,15 @@ struct rf_channel {
- };
- 
- /*
-+ * Information structure for channel survey.
-+ */
-+struct rt2x00_chan_survey {
-+	u64 time_idle;
-+	u64 time_busy;
-+	u64 time_ext_busy;
-+};
-+
-+/*
-  * Channel information structure
-  */
- struct channel_info {
-@@ -567,6 +576,7 @@ struct rt2x00lib_ops {
- 	 * Data queue handlers.
- 	 */
- 	void (*watchdog) (struct rt2x00_dev *rt2x00dev);
-+	void (*update_survey) (struct rt2x00_dev *rt2x00dev);
- 	void (*start_queue) (struct data_queue *queue);
- 	void (*kick_queue) (struct data_queue *queue);
- 	void (*stop_queue) (struct data_queue *queue);
-@@ -755,6 +765,7 @@ struct rt2x00_dev {
- 	 */
- 	struct ieee80211_hw *hw;
- 	struct ieee80211_supported_band bands[NUM_NL80211_BANDS];
-+	struct rt2x00_chan_survey *chan_survey;
- 	enum nl80211_band curr_band;
- 	int curr_freq;
- 
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1057,6 +1057,12 @@ static int rt2x00lib_probe_hw_modes(stru
- 	if (!rates)
- 		goto exit_free_channels;
- 
-+	rt2x00dev->chan_survey =
-+		kcalloc(spec->num_channels, sizeof(struct rt2x00_chan_survey),
-+			GFP_KERNEL);
-+	if (!rt2x00dev->chan_survey)
-+		goto exit_free_rates;
-+
- 	/*
- 	 * Initialize Rate list.
- 	 */
-@@ -1108,6 +1114,8 @@ static int rt2x00lib_probe_hw_modes(stru
- 
- 	return 0;
- 
-+ exit_free_rates:
-+	kfree(rates);
-  exit_free_channels:
- 	kfree(channels);
- 	rt2x00_err(rt2x00dev, "Allocation ieee80211 modes failed\n");
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
-@@ -317,6 +317,15 @@ int rt2x00mac_config(struct ieee80211_hw
- 		return 0;
- 
- 	/*
-+	 * To provide correct survey data for survey-based ACS algorithm
-+	 * we have to save survey data for current channel before switching.
-+	 */
-+	if (rt2x00dev->ops->lib->update_survey &&
-+	    (changed & IEEE80211_CONF_CHANGE_CHANNEL)) {
-+		rt2x00dev->ops->lib->update_survey(rt2x00dev);
-+	}
-+
-+	/*
- 	 * Some configuration parameters (e.g. channel and antenna values) can
- 	 * only be set when the radio is enabled, but do require the RX to
- 	 * be off. During this period we should keep link tuning enabled,
diff --git a/package/kernel/mac80211/patches/rtl/002-v5.13-rtlwifi-implement-set_tim-by-update-beacon-content.patch b/package/kernel/mac80211/patches/rtl/002-v5.13-rtlwifi-implement-set_tim-by-update-beacon-content.patch
deleted file mode 100644
index 3daf65e967..0000000000
--- a/package/kernel/mac80211/patches/rtl/002-v5.13-rtlwifi-implement-set_tim-by-update-beacon-content.patch
+++ /dev/null
@@ -1,118 +0,0 @@
-Date: Mon, 19 Apr 2021 14:59:56 +0800
-From: Ping-Ke Shih <pkshih@realtek.com>
-To: <kvalo@codeaurora.org>
-CC: <linux-wireless@vger.kernel.org>, <mail@maciej.szmigiero.name>,
-        <Larry.Finger@lwfinger.net>
-Subject: [PATCH] rtlwifi: implement set_tim by update beacon content
-
-Once beacon content is changed, we update the content to wifi card by
-send_beacon_frame(). Then, STA with PS can wake up properly to receive its
-packets.
-
-Since we update beacon content to PCI wifi devices every beacon interval,
-the only one usb device, 8192CU, needs to update beacon content when
-mac80211 calling set_tim.
-
-Reported-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
-Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
-Tested-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
----
- drivers/net/wireless/realtek/rtlwifi/core.c | 32 +++++++++++++++++++++
- drivers/net/wireless/realtek/rtlwifi/core.h |  1 +
- drivers/net/wireless/realtek/rtlwifi/usb.c  |  3 ++
- drivers/net/wireless/realtek/rtlwifi/wifi.h |  1 +
- 4 files changed, 37 insertions(+)
-
---- a/drivers/net/wireless/realtek/rtlwifi/core.c
-+++ b/drivers/net/wireless/realtek/rtlwifi/core.c
-@@ -1018,6 +1018,25 @@ static void send_beacon_frame(struct iee
- 	}
- }
- 
-+void rtl_update_beacon_work_callback(struct work_struct *work)
-+{
-+	struct rtl_works *rtlworks =
-+	    container_of(work, struct rtl_works, update_beacon_work);
-+	struct ieee80211_hw *hw = rtlworks->hw;
-+	struct rtl_priv *rtlpriv = rtl_priv(hw);
-+	struct ieee80211_vif *vif = rtlpriv->mac80211.vif;
-+
-+	if (!vif) {
-+		WARN_ONCE(true, "no vif to update beacon\n");
-+		return;
-+	}
-+
-+	mutex_lock(&rtlpriv->locks.conf_mutex);
-+	send_beacon_frame(hw, vif);
-+	mutex_unlock(&rtlpriv->locks.conf_mutex);
-+}
-+EXPORT_SYMBOL_GPL(rtl_update_beacon_work_callback);
-+
- static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
- 				    struct ieee80211_vif *vif,
- 				    struct ieee80211_bss_conf *bss_conf,
-@@ -1747,6 +1766,18 @@ static void rtl_op_flush(struct ieee8021
- 		rtlpriv->intf_ops->flush(hw, queues, drop);
- }
- 
-+static int rtl_op_set_tim(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
-+			  bool set)
-+{
-+	struct rtl_priv *rtlpriv = rtl_priv(hw);
-+	struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-+
-+	if (rtlhal->hw_type == HARDWARE_TYPE_RTL8192CU)
-+		schedule_work(&rtlpriv->works.update_beacon_work);
-+
-+	return 0;
-+}
-+
- /*	Description:
-  *		This routine deals with the Power Configuration CMD
-  *		 parsing for RTL8723/RTL8188E Series IC.
-@@ -1903,6 +1934,7 @@ const struct ieee80211_ops rtl_ops = {
- 	.sta_add = rtl_op_sta_add,
- 	.sta_remove = rtl_op_sta_remove,
- 	.flush = rtl_op_flush,
-+	.set_tim = rtl_op_set_tim,
- };
- EXPORT_SYMBOL_GPL(rtl_ops);
- 
---- a/drivers/net/wireless/realtek/rtlwifi/core.h
-+++ b/drivers/net/wireless/realtek/rtlwifi/core.h
-@@ -60,5 +60,6 @@ void rtl_bb_delay(struct ieee80211_hw *h
- bool rtl_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb);
- bool rtl_btc_status_false(void);
- void rtl_dm_diginit(struct ieee80211_hw *hw, u32 cur_igval);
-+void rtl_update_beacon_work_callback(struct work_struct *work);
- 
- #endif
---- a/drivers/net/wireless/realtek/rtlwifi/usb.c
-+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
-@@ -807,6 +807,7 @@ static void rtl_usb_stop(struct ieee8021
- 
- 	tasklet_kill(&rtlusb->rx_work_tasklet);
- 	cancel_work_sync(&rtlpriv->works.lps_change_work);
-+	cancel_work_sync(&rtlpriv->works.update_beacon_work);
- 
- 	flush_workqueue(rtlpriv->works.rtl_wq);
- 
-@@ -1033,6 +1034,8 @@ int rtl_usb_probe(struct usb_interface *
- 		  rtl_fill_h2c_cmd_work_callback);
- 	INIT_WORK(&rtlpriv->works.lps_change_work,
- 		  rtl_lps_change_work_callback);
-+	INIT_WORK(&rtlpriv->works.update_beacon_work,
-+		  rtl_update_beacon_work_callback);
- 
- 	rtlpriv->usb_data_index = 0;
- 	init_completion(&rtlpriv->firmware_loading_complete);
---- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
-+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
-@@ -2487,6 +2487,7 @@ struct rtl_works {
- 
- 	struct work_struct lps_change_work;
- 	struct work_struct fill_h2c_cmd;
-+	struct work_struct update_beacon_work;
- };
- 
- struct rtl_debug {
diff --git a/package/kernel/mac80211/patches/subsys/010-sync-nl80211_h.patch b/package/kernel/mac80211/patches/subsys/010-sync-nl80211_h.patch
deleted file mode 100644
index e1f66ac1c3..0000000000
--- a/package/kernel/mac80211/patches/subsys/010-sync-nl80211_h.patch
+++ /dev/null
@@ -1,297 +0,0 @@
---- a/include/uapi/linux/nl80211.h
-+++ b/include/uapi/linux/nl80211.h
-@@ -655,6 +655,9 @@
-  *	When a security association was established on an 802.1X network using
-  *	fast transition, this event should be followed by an
-  *	%NL80211_CMD_PORT_AUTHORIZED event.
-+ *	Following a %NL80211_CMD_ROAM event userspace can issue
-+ *	%NL80211_CMD_GET_SCAN in order to obtain the scan information for the
-+ *	new BSS the card/driver roamed to.
-  * @NL80211_CMD_DISCONNECT: drop a given connection; also used to notify
-  *	userspace that a connection was dropped by the AP or due to other
-  *	reasons, for this the %NL80211_ATTR_DISCONNECTED_BY_AP and
-@@ -757,7 +760,8 @@
-  *	of any other interfaces, and other interfaces will again take
-  *	precedence when they are used.
-  *
-- * @NL80211_CMD_SET_WDS_PEER: Set the MAC address of the peer on a WDS interface.
-+ * @NL80211_CMD_SET_WDS_PEER: Set the MAC address of the peer on a WDS interface
-+ *	(no longer supported).
-  *
-  * @NL80211_CMD_SET_MULTICAST_TO_UNICAST: Configure if this AP should perform
-  *	multicast to unicast conversion. When enabled, all multicast packets
-@@ -1177,6 +1181,10 @@
-  *	includes the contents of the frame. %NL80211_ATTR_ACK flag is included
-  *	if the recipient acknowledged the frame.
-  *
-+ * @NL80211_CMD_SET_SAR_SPECS: SAR power limitation configuration is
-+ *	passed using %NL80211_ATTR_SAR_SPEC. %NL80211_ATTR_WIPHY is used to
-+ *	specify the wiphy index to be applied to.
-+ *
-  * @NL80211_CMD_MAX: highest used command number
-  * @__NL80211_CMD_AFTER_LAST: internal use
-  */
-@@ -1407,6 +1415,8 @@ enum nl80211_commands {
- 
- 	NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS,
- 
-+	NL80211_CMD_SET_SAR_SPECS,
-+
- 	/* add new commands above here */
- 
- 	/* used to define NL80211_CMD_MAX below */
-@@ -1750,8 +1760,9 @@ enum nl80211_commands {
-  *	specify just a single bitrate, which is to be used for the beacon.
-  *	The driver must also specify support for this with the extended
-  *	features NL80211_EXT_FEATURE_BEACON_RATE_LEGACY,
-- *	NL80211_EXT_FEATURE_BEACON_RATE_HT and
-- *	NL80211_EXT_FEATURE_BEACON_RATE_VHT.
-+ *	NL80211_EXT_FEATURE_BEACON_RATE_HT,
-+ *	NL80211_EXT_FEATURE_BEACON_RATE_VHT and
-+ *	NL80211_EXT_FEATURE_BEACON_RATE_HE.
-  *
-  * @NL80211_ATTR_FRAME_MATCH: A binary attribute which typically must contain
-  *	at least one byte, currently used with @NL80211_CMD_REGISTER_FRAME.
-@@ -1955,8 +1966,15 @@ enum nl80211_commands {
-  * @NL80211_ATTR_PROBE_RESP: Probe Response template data. Contains the entire
-  *	probe-response frame. The DA field in the 802.11 header is zero-ed out,
-  *	to be filled by the FW.
-- * @NL80211_ATTR_DISABLE_HT:  Force HT capable interfaces to disable
-- *      this feature.  Currently, only supported in mac80211 drivers.
-+ * @NL80211_ATTR_DISABLE_HT: Force HT capable interfaces to disable
-+ *      this feature during association. This is a flag attribute.
-+ *	Currently only supported in mac80211 drivers.
-+ * @NL80211_ATTR_DISABLE_VHT: Force VHT capable interfaces to disable
-+ *      this feature during association. This is a flag attribute.
-+ *	Currently only supported in mac80211 drivers.
-+ * @NL80211_ATTR_DISABLE_HE: Force HE capable interfaces to disable
-+ *      this feature during association. This is a flag attribute.
-+ *	Currently only supported in mac80211 drivers.
-  * @NL80211_ATTR_HT_CAPABILITY_MASK: Specify which bits of the
-  *      ATTR_HT_CAPABILITY to which attention should be paid.
-  *      Currently, only mac80211 NICs support this feature.
-@@ -2077,7 +2095,8 @@ enum nl80211_commands {
-  *	until the channel switch event.
-  * @NL80211_ATTR_CH_SWITCH_BLOCK_TX: flag attribute specifying that transmission
-  *	must be blocked on the current channel (before the channel switch
-- *	operation).
-+ *	operation). Also included in the channel switch started event if quiet
-+ *	was requested by the AP.
-  * @NL80211_ATTR_CSA_IES: Nested set of attributes containing the IE information
-  *	for the time while performing a channel switch.
-  * @NL80211_ATTR_CNTDWN_OFFS_BEACON: An array of offsets (u16) to the channel
-@@ -2527,6 +2546,20 @@ enum nl80211_commands {
-  *	override mask. Used with NL80211_ATTR_S1G_CAPABILITY in
-  *	NL80211_CMD_ASSOCIATE or NL80211_CMD_CONNECT.
-  *
-+ * @NL80211_ATTR_SAE_PWE: Indicates the mechanism(s) allowed for SAE PWE
-+ *	derivation in WPA3-Personal networks which are using SAE authentication.
-+ *	This is a u8 attribute that encapsulates one of the values from
-+ *	&enum nl80211_sae_pwe_mechanism.
-+ *
-+ * @NL80211_ATTR_SAR_SPEC: SAR power limitation specification when
-+ *	used with %NL80211_CMD_SET_SAR_SPECS. The message contains fields
-+ *	of %nl80211_sar_attrs which specifies the sar type and related
-+ *	sar specs. Sar specs contains array of %nl80211_sar_specs_attrs.
-+ *
-+ * @NL80211_ATTR_RECONNECT_REQUESTED: flag attribute, used with deauth and
-+ *	disassoc events to indicate that an immediate reconnect to the AP
-+ *	is desired.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3016,6 +3049,14 @@ enum nl80211_attrs {
- 	NL80211_ATTR_S1G_CAPABILITY,
- 	NL80211_ATTR_S1G_CAPABILITY_MASK,
- 
-+	NL80211_ATTR_SAE_PWE,
-+
-+	NL80211_ATTR_RECONNECT_REQUESTED,
-+
-+	NL80211_ATTR_SAR_SPEC,
-+
-+	NL80211_ATTR_DISABLE_HE,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -5896,6 +5937,19 @@ enum nl80211_feature_flags {
-  * @NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP: Driver/device supports
-  *	unsolicited broadcast probe response transmission
-  *
-+ * @NL80211_EXT_FEATURE_BEACON_RATE_HE: Driver supports beacon rate
-+ *	configuration (AP/mesh) with HE rates.
-+ *
-+ * @NL80211_EXT_FEATURE_SECURE_LTF: Device supports secure LTF measurement
-+ *      exchange protocol.
-+ *
-+ * @NL80211_EXT_FEATURE_SECURE_RTT: Device supports secure RTT measurement
-+ *      exchange protocol.
-+ *
-+ * @NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE: Device supports management
-+ *      frame protection for all management frames exchanged during the
-+ *      negotiation and range measurement procedure.
-+ *
-  * @NUM_NL80211_EXT_FEATURES: number of extended features.
-  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
-  */
-@@ -5956,6 +6010,10 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_SAE_OFFLOAD_AP,
- 	NL80211_EXT_FEATURE_FILS_DISCOVERY,
- 	NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP,
-+	NL80211_EXT_FEATURE_BEACON_RATE_HE,
-+	NL80211_EXT_FEATURE_SECURE_LTF,
-+	NL80211_EXT_FEATURE_SECURE_RTT,
-+	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
- 
- 	/* add new features before the definition below */
- 	NUM_NL80211_EXT_FEATURES,
-@@ -6253,11 +6311,13 @@ struct nl80211_vendor_cmd_info {
-  * @NL80211_TDLS_PEER_HT: TDLS peer is HT capable.
-  * @NL80211_TDLS_PEER_VHT: TDLS peer is VHT capable.
-  * @NL80211_TDLS_PEER_WMM: TDLS peer is WMM capable.
-+ * @NL80211_TDLS_PEER_HE: TDLS peer is HE capable.
-  */
- enum nl80211_tdls_peer_capability {
- 	NL80211_TDLS_PEER_HT = 1<<0,
- 	NL80211_TDLS_PEER_VHT = 1<<1,
- 	NL80211_TDLS_PEER_WMM = 1<<2,
-+	NL80211_TDLS_PEER_HE = 1<<3,
- };
- 
- /**
-@@ -6849,6 +6909,9 @@ enum nl80211_peer_measurement_ftm_capa {
-  *      if neither %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED nor
-  *	%NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set, EDCA based
-  *	ranging will be used.
-+ * @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK: negotiate for LMR feedback. Only
-+ *	valid if either %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED or
-+ *	%NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
-  *
-  * @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal
-  * @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number
-@@ -6867,6 +6930,7 @@ enum nl80211_peer_measurement_ftm_req {
- 	NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC,
- 	NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED,
- 	NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED,
-+	NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK,
- 
- 	/* keep last */
- 	NUM_NL80211_PMSR_FTM_REQ_ATTR,
-@@ -7124,4 +7188,115 @@ enum nl80211_unsol_bcast_probe_resp_attr
- 	NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX =
- 		__NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_LAST - 1
- };
-+
-+/**
-+ * enum nl80211_sae_pwe_mechanism - The mechanism(s) allowed for SAE PWE
-+ *	derivation. Applicable only when WPA3-Personal SAE authentication is
-+ *	used.
-+ *
-+ * @NL80211_SAE_PWE_UNSPECIFIED: not specified, used internally to indicate that
-+ *	attribute is not present from userspace.
-+ * @NL80211_SAE_PWE_HUNT_AND_PECK: hunting-and-pecking loop only
-+ * @NL80211_SAE_PWE_HASH_TO_ELEMENT: hash-to-element only
-+ * @NL80211_SAE_PWE_BOTH: both hunting-and-pecking loop and hash-to-element
-+ *	can be used.
-+ */
-+enum nl80211_sae_pwe_mechanism {
-+	NL80211_SAE_PWE_UNSPECIFIED,
-+	NL80211_SAE_PWE_HUNT_AND_PECK,
-+	NL80211_SAE_PWE_HASH_TO_ELEMENT,
-+	NL80211_SAE_PWE_BOTH,
-+};
-+
-+/**
-+ * enum nl80211_sar_type - type of SAR specs
-+ *
-+ * @NL80211_SAR_TYPE_POWER: power limitation specified in 0.25dBm unit
-+ *
-+ */
-+enum nl80211_sar_type {
-+	NL80211_SAR_TYPE_POWER,
-+
-+	/* add new type here */
-+
-+	/* Keep last */
-+	NUM_NL80211_SAR_TYPE,
-+};
-+
-+/**
-+ * enum nl80211_sar_attrs - Attributes for SAR spec
-+ *
-+ * @NL80211_SAR_ATTR_TYPE: the SAR type as defined in &enum nl80211_sar_type.
-+ *
-+ * @NL80211_SAR_ATTR_SPECS: Nested array of SAR power
-+ *	limit specifications. Each specification contains a set
-+ *	of %nl80211_sar_specs_attrs.
-+ *
-+ *	For SET operation, it contains array of %NL80211_SAR_ATTR_SPECS_POWER
-+ *	and %NL80211_SAR_ATTR_SPECS_RANGE_INDEX.
-+ *
-+ *	For sar_capa dump, it contains array of
-+ *	%NL80211_SAR_ATTR_SPECS_START_FREQ
-+ *	and %NL80211_SAR_ATTR_SPECS_END_FREQ.
-+ *
-+ * @__NL80211_SAR_ATTR_LAST: Internal
-+ * @NL80211_SAR_ATTR_MAX: highest sar attribute
-+ *
-+ * These attributes are used with %NL80211_CMD_SET_SAR_SPEC
-+ */
-+enum nl80211_sar_attrs {
-+	__NL80211_SAR_ATTR_INVALID,
-+
-+	NL80211_SAR_ATTR_TYPE,
-+	NL80211_SAR_ATTR_SPECS,
-+
-+	__NL80211_SAR_ATTR_LAST,
-+	NL80211_SAR_ATTR_MAX = __NL80211_SAR_ATTR_LAST - 1,
-+};
-+
-+/**
-+ * enum nl80211_sar_specs_attrs - Attributes for SAR power limit specs
-+ *
-+ * @NL80211_SAR_ATTR_SPECS_POWER: Required (s32)value to specify the actual
-+ *	power limit value in units of 0.25 dBm if type is
-+ *	NL80211_SAR_TYPE_POWER. (i.e., a value of 44 represents 11 dBm).
-+ *	0 means userspace doesn't have SAR limitation on this associated range.
-+ *
-+ * @NL80211_SAR_ATTR_SPECS_RANGE_INDEX: Required (u32) value to specify the
-+ *	index of exported freq range table and the associated power limitation
-+ *	is applied to this range.
-+ *
-+ *	Userspace isn't required to set all the ranges advertised by WLAN driver,
-+ *	and userspace can skip some certain ranges. These skipped ranges don't
-+ *	have SAR limitations, and they are same as setting the
-+ *	%NL80211_SAR_ATTR_SPECS_POWER to any unreasonable high value because any
-+ *	value higher than regulatory allowed value just means SAR power
-+ *	limitation is removed, but it's required to set at least one range.
-+ *	It's not allowed to set duplicated range in one SET operation.
-+ *
-+ *	Every SET operation overwrites previous SET operation.
-+ *
-+ * @NL80211_SAR_ATTR_SPECS_START_FREQ: Required (u32) value to specify the start
-+ *	frequency of this range edge when registering SAR capability to wiphy.
-+ *	It's not a channel center frequency. The unit is kHz.
-+ *
-+ * @NL80211_SAR_ATTR_SPECS_END_FREQ: Required (u32) value to specify the end
-+ *	frequency of this range edge when registering SAR capability to wiphy.
-+ *	It's not a channel center frequency. The unit is kHz.
-+ *
-+ * @__NL80211_SAR_ATTR_SPECS_LAST: Internal
-+ * @NL80211_SAR_ATTR_SPECS_MAX: highest sar specs attribute
-+ */
-+enum nl80211_sar_specs_attrs {
-+	__NL80211_SAR_ATTR_SPECS_INVALID,
-+
-+	NL80211_SAR_ATTR_SPECS_POWER,
-+	NL80211_SAR_ATTR_SPECS_RANGE_INDEX,
-+	NL80211_SAR_ATTR_SPECS_START_FREQ,
-+	NL80211_SAR_ATTR_SPECS_END_FREQ,
-+
-+	__NL80211_SAR_ATTR_SPECS_LAST,
-+	NL80211_SAR_ATTR_SPECS_MAX = __NL80211_SAR_ATTR_SPECS_LAST - 1,
-+};
-+
- #endif /* __LINUX_NL80211_H */
diff --git a/package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch b/package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch
deleted file mode 100644
index a03b060918..0000000000
--- a/package/kernel/mac80211/patches/subsys/100-remove-cryptoapi-dependencies.patch
+++ /dev/null
@@ -1,699 +0,0 @@
---- a/net/mac80211/Makefile
-+++ b/net/mac80211/Makefile
-@@ -7,7 +7,6 @@ mac80211-y := \
- 	driver-ops.o \
- 	sta_info.o \
- 	wep.o \
--	aead_api.o \
- 	wpa.o \
- 	scan.o offchannel.o \
- 	ht.o agg-tx.o agg-rx.o \
-@@ -19,8 +18,8 @@ mac80211-y := \
- 	rate.o \
- 	michael.o \
- 	tkip.o \
-+	aes_ccm.o \
- 	aes_cmac.o \
--	aes_gmac.o \
- 	fils_aead.o \
- 	cfg.o \
- 	ethtool.o \
---- a/net/mac80211/aead_api.c
-+++ /dev/null
-@@ -1,113 +0,0 @@
--// SPDX-License-Identifier: GPL-2.0-only
--/*
-- * Copyright 2003-2004, Instant802 Networks, Inc.
-- * Copyright 2005-2006, Devicescape Software, Inc.
-- * Copyright 2014-2015, Qualcomm Atheros, Inc.
-- *
-- * Rewrite: Copyright (C) 2013 Linaro Ltd <ard.biesheuvel@linaro.org>
-- */
--
--#include <linux/kernel.h>
--#include <linux/types.h>
--#include <linux/err.h>
--#include <linux/scatterlist.h>
--#include <crypto/aead.h>
--
--#include "aead_api.h"
--
--int aead_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad, size_t aad_len,
--		 u8 *data, size_t data_len, u8 *mic)
--{
--	size_t mic_len = crypto_aead_authsize(tfm);
--	struct scatterlist sg[3];
--	struct aead_request *aead_req;
--	int reqsize = sizeof(*aead_req) + crypto_aead_reqsize(tfm);
--	u8 *__aad;
--	int ret;
--
--	aead_req = kzalloc(reqsize + aad_len, GFP_ATOMIC);
--	if (!aead_req)
--		return -ENOMEM;
--
--	__aad = (u8 *)aead_req + reqsize;
--	memcpy(__aad, aad, aad_len);
--
--	sg_init_table(sg, 3);
--	sg_set_buf(&sg[0], __aad, aad_len);
--	sg_set_buf(&sg[1], data, data_len);
--	sg_set_buf(&sg[2], mic, mic_len);
--
--	aead_request_set_tfm(aead_req, tfm);
--	aead_request_set_crypt(aead_req, sg, sg, data_len, b_0);
--	aead_request_set_ad(aead_req, sg[0].length);
--
--	ret = crypto_aead_encrypt(aead_req);
--	kfree_sensitive(aead_req);
--
--	return ret;
--}
--
--int aead_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad, size_t aad_len,
--		 u8 *data, size_t data_len, u8 *mic)
--{
--	size_t mic_len = crypto_aead_authsize(tfm);
--	struct scatterlist sg[3];
--	struct aead_request *aead_req;
--	int reqsize = sizeof(*aead_req) + crypto_aead_reqsize(tfm);
--	u8 *__aad;
--	int err;
--
--	if (data_len == 0)
--		return -EINVAL;
--
--	aead_req = kzalloc(reqsize + aad_len, GFP_ATOMIC);
--	if (!aead_req)
--		return -ENOMEM;
--
--	__aad = (u8 *)aead_req + reqsize;
--	memcpy(__aad, aad, aad_len);
--
--	sg_init_table(sg, 3);
--	sg_set_buf(&sg[0], __aad, aad_len);
--	sg_set_buf(&sg[1], data, data_len);
--	sg_set_buf(&sg[2], mic, mic_len);
--
--	aead_request_set_tfm(aead_req, tfm);
--	aead_request_set_crypt(aead_req, sg, sg, data_len + mic_len, b_0);
--	aead_request_set_ad(aead_req, sg[0].length);
--
--	err = crypto_aead_decrypt(aead_req);
--	kfree_sensitive(aead_req);
--
--	return err;
--}
--
--struct crypto_aead *
--aead_key_setup_encrypt(const char *alg, const u8 key[],
--		       size_t key_len, size_t mic_len)
--{
--	struct crypto_aead *tfm;
--	int err;
--
--	tfm = crypto_alloc_aead(alg, 0, CRYPTO_ALG_ASYNC);
--	if (IS_ERR(tfm))
--		return tfm;
--
--	err = crypto_aead_setkey(tfm, key, key_len);
--	if (err)
--		goto free_aead;
--	err = crypto_aead_setauthsize(tfm, mic_len);
--	if (err)
--		goto free_aead;
--
--	return tfm;
--
--free_aead:
--	crypto_free_aead(tfm);
--	return ERR_PTR(err);
--}
--
--void aead_key_free(struct crypto_aead *tfm)
--{
--	crypto_free_aead(tfm);
--}
---- a/net/mac80211/aead_api.h
-+++ /dev/null
-@@ -1,23 +0,0 @@
--/* SPDX-License-Identifier: GPL-2.0-only */
--
--#ifndef _AEAD_API_H
--#define _AEAD_API_H
--
--#include <crypto/aead.h>
--#include <linux/crypto.h>
--
--struct crypto_aead *
--aead_key_setup_encrypt(const char *alg, const u8 key[],
--		       size_t key_len, size_t mic_len);
--
--int aead_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
--		 size_t aad_len, u8 *data,
--		 size_t data_len, u8 *mic);
--
--int aead_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
--		 size_t aad_len, u8 *data,
--		 size_t data_len, u8 *mic);
--
--void aead_key_free(struct crypto_aead *tfm);
--
--#endif /* _AEAD_API_H */
---- a/net/mac80211/aes_ccm.h
-+++ b/net/mac80211/aes_ccm.h
-@@ -7,39 +7,17 @@
- #ifndef AES_CCM_H
- #define AES_CCM_H
- 
--#include "aead_api.h"
-+#include <linux/crypto.h>
- 
--#define CCM_AAD_LEN	32
--
--static inline struct crypto_aead *
--ieee80211_aes_key_setup_encrypt(const u8 key[], size_t key_len, size_t mic_len)
--{
--	return aead_key_setup_encrypt("ccm(aes)", key, key_len, mic_len);
--}
--
--static inline int
--ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm,
--			  u8 *b_0, u8 *aad, u8 *data,
--			  size_t data_len, u8 *mic)
--{
--	return aead_encrypt(tfm, b_0, aad + 2,
--			    be16_to_cpup((__be16 *)aad),
--			    data, data_len, mic);
--}
--
--static inline int
--ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm,
--			  u8 *b_0, u8 *aad, u8 *data,
--			  size_t data_len, u8 *mic)
--{
--	return aead_decrypt(tfm, b_0, aad + 2,
--			    be16_to_cpup((__be16 *)aad),
--			    data, data_len, mic);
--}
--
--static inline void ieee80211_aes_key_free(struct crypto_aead *tfm)
--{
--	return aead_key_free(tfm);
--}
-+struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[],
-+						      size_t key_len,
-+						      size_t mic_len);
-+void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
-+			       u8 *data, size_t data_len, u8 *mic,
-+			       size_t mic_len);
-+int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
-+			      u8 *data, size_t data_len, u8 *mic,
-+			      size_t mic_len);
-+void ieee80211_aes_key_free(struct crypto_cipher *tfm);
- 
- #endif /* AES_CCM_H */
---- /dev/null
-+++ b/net/mac80211/aes_gcm.c
-@@ -0,0 +1,109 @@
-+/*
-+ * Copyright 2014-2015, Qualcomm Atheros, Inc.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation.
-+ */
-+
-+#include <linux/kernel.h>
-+#include <linux/types.h>
-+#include <linux/err.h>
-+#include <crypto/aead.h>
-+
-+#include <net/mac80211.h>
-+#include "key.h"
-+#include "aes_gcm.h"
-+
-+int ieee80211_aes_gcm_encrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
-+			      u8 *data, size_t data_len, u8 *mic)
-+{
-+	struct scatterlist sg[3];
-+	struct aead_request *aead_req;
-+	int reqsize = sizeof(*aead_req) + crypto_aead_reqsize(tfm);
-+	u8 *__aad;
-+
-+	aead_req = kzalloc(reqsize + GCM_AAD_LEN, GFP_ATOMIC);
-+	if (!aead_req)
-+		return -ENOMEM;
-+
-+	__aad = (u8 *)aead_req + reqsize;
-+	memcpy(__aad, aad, GCM_AAD_LEN);
-+
-+	sg_init_table(sg, 3);
-+	sg_set_buf(&sg[0], &__aad[2], be16_to_cpup((__be16 *)__aad));
-+	sg_set_buf(&sg[1], data, data_len);
-+	sg_set_buf(&sg[2], mic, IEEE80211_GCMP_MIC_LEN);
-+
-+	aead_request_set_tfm(aead_req, tfm);
-+	aead_request_set_crypt(aead_req, sg, sg, data_len, j_0);
-+	aead_request_set_ad(aead_req, sg[0].length);
-+
-+	crypto_aead_encrypt(aead_req);
-+	kzfree(aead_req);
-+	return 0;
-+}
-+
-+int ieee80211_aes_gcm_decrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
-+			      u8 *data, size_t data_len, u8 *mic)
-+{
-+	struct scatterlist sg[3];
-+	struct aead_request *aead_req;
-+	int reqsize = sizeof(*aead_req) + crypto_aead_reqsize(tfm);
-+	u8 *__aad;
-+	int err;
-+
-+	if (data_len == 0)
-+		return -EINVAL;
-+
-+	aead_req = kzalloc(reqsize + GCM_AAD_LEN, GFP_ATOMIC);
-+	if (!aead_req)
-+		return -ENOMEM;
-+
-+	__aad = (u8 *)aead_req + reqsize;
-+	memcpy(__aad, aad, GCM_AAD_LEN);
-+
-+	sg_init_table(sg, 3);
-+	sg_set_buf(&sg[0], &__aad[2], be16_to_cpup((__be16 *)__aad));
-+	sg_set_buf(&sg[1], data, data_len);
-+	sg_set_buf(&sg[2], mic, IEEE80211_GCMP_MIC_LEN);
-+
-+	aead_request_set_tfm(aead_req, tfm);
-+	aead_request_set_crypt(aead_req, sg, sg,
-+			       data_len + IEEE80211_GCMP_MIC_LEN, j_0);
-+	aead_request_set_ad(aead_req, sg[0].length);
-+
-+	err = crypto_aead_decrypt(aead_req);
-+	kzfree(aead_req);
-+
-+	return err;
-+}
-+
-+struct crypto_aead *ieee80211_aes_gcm_key_setup_encrypt(const u8 key[],
-+							size_t key_len)
-+{
-+	struct crypto_aead *tfm;
-+	int err;
-+
-+	tfm = crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC);
-+	if (IS_ERR(tfm))
-+		return tfm;
-+
-+	err = crypto_aead_setkey(tfm, key, key_len);
-+	if (err)
-+		goto free_aead;
-+	err = crypto_aead_setauthsize(tfm, IEEE80211_GCMP_MIC_LEN);
-+	if (err)
-+		goto free_aead;
-+
-+	return tfm;
-+
-+free_aead:
-+	crypto_free_aead(tfm);
-+	return ERR_PTR(err);
-+}
-+
-+void ieee80211_aes_gcm_key_free(struct crypto_aead *tfm)
-+{
-+	crypto_free_aead(tfm);
-+}
---- a/net/mac80211/aes_gcm.h
-+++ b/net/mac80211/aes_gcm.h
-@@ -6,38 +6,30 @@
- #ifndef AES_GCM_H
- #define AES_GCM_H
- 
--#include "aead_api.h"
-+#include <linux/crypto.h>
- 
--#define GCM_AAD_LEN	32
--
--static inline int ieee80211_aes_gcm_encrypt(struct crypto_aead *tfm,
--					    u8 *j_0, u8 *aad,  u8 *data,
--					    size_t data_len, u8 *mic)
-+static inline void
-+ieee80211_aes_gcm_encrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
-+			  u8 *data, size_t data_len, u8 *mic)
- {
--	return aead_encrypt(tfm, j_0, aad + 2,
--			    be16_to_cpup((__be16 *)aad),
--			    data, data_len, mic);
- }
- 
--static inline int ieee80211_aes_gcm_decrypt(struct crypto_aead *tfm,
--					    u8 *j_0, u8 *aad, u8 *data,
--					    size_t data_len, u8 *mic)
-+static inline int
-+ieee80211_aes_gcm_decrypt(struct crypto_aead *tfm, u8 *j_0, u8 *aad,
-+			  u8 *data, size_t data_len, u8 *mic)
- {
--	return aead_decrypt(tfm, j_0, aad + 2,
--			    be16_to_cpup((__be16 *)aad),
--			    data, data_len, mic);
-+    return -EOPNOTSUPP;
- }
- 
- static inline struct crypto_aead *
- ieee80211_aes_gcm_key_setup_encrypt(const u8 key[], size_t key_len)
- {
--	return aead_key_setup_encrypt("gcm(aes)", key,
--				      key_len, IEEE80211_GCMP_MIC_LEN);
-+    return NULL;
- }
- 
--static inline void ieee80211_aes_gcm_key_free(struct crypto_aead *tfm)
-+static inline void
-+ieee80211_aes_gcm_key_free(struct crypto_aead *tfm)
- {
--	return aead_key_free(tfm);
- }
- 
- #endif /* AES_GCM_H */
---- a/net/mac80211/wpa.c
-+++ b/net/mac80211/wpa.c
-@@ -312,7 +312,8 @@ ieee80211_crypto_tkip_decrypt(struct iee
- }
- 
- 
--static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad)
-+static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad,
-+				u16 data_len)
- {
- 	__le16 mask_fc;
- 	int a4_included, mgmt;
-@@ -342,14 +343,8 @@ static void ccmp_special_blocks(struct s
- 	else
- 		qos_tid = 0;
- 
--	/* In CCM, the initial vectors (IV) used for CTR mode encryption and CBC
--	 * mode authentication are not allowed to collide, yet both are derived
--	 * from this vector b_0. We only set L := 1 here to indicate that the
--	 * data size can be represented in (L+1) bytes. The CCM layer will take
--	 * care of storing the data length in the top (L+1) bytes and setting
--	 * and clearing the other bits as is required to derive the two IVs.
--	 */
--	b_0[0] = 0x1;
-+	/* First block, b_0 */
-+	b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
- 
- 	/* Nonce: Nonce Flags | A2 | PN
- 	 * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
-@@ -357,6 +352,8 @@ static void ccmp_special_blocks(struct s
- 	b_0[1] = qos_tid | (mgmt << 4);
- 	memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
- 	memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
-+	/* l(m) */
-+	put_unaligned_be16(data_len, &b_0[14]);
- 
- 	/* AAD (extra authenticate-only data) / masked 802.11 header
- 	 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
-@@ -413,7 +410,7 @@ static int ccmp_encrypt_skb(struct ieee8
- 	u8 *pos;
- 	u8 pn[6];
- 	u64 pn64;
--	u8 aad[CCM_AAD_LEN];
-+	u8 aad[2 * AES_BLOCK_SIZE];
- 	u8 b_0[AES_BLOCK_SIZE];
- 
- 	if (info->control.hw_key &&
-@@ -468,9 +465,11 @@ static int ccmp_encrypt_skb(struct ieee8
- 		return 0;
- 
- 	pos += IEEE80211_CCMP_HDR_LEN;
--	ccmp_special_blocks(skb, pn, b_0, aad);
--	return ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
--					 skb_put(skb, mic_len));
-+	ccmp_special_blocks(skb, pn, b_0, aad, len);
-+	ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
-+				  skb_put(skb, mic_len), mic_len);
-+
-+	return 0;
- }
- 
- 
-@@ -546,13 +545,13 @@ ieee80211_crypto_ccmp_decrypt(struct iee
- 			u8 aad[2 * AES_BLOCK_SIZE];
- 			u8 b_0[AES_BLOCK_SIZE];
- 			/* hardware didn't decrypt/verify MIC */
--			ccmp_special_blocks(skb, pn, b_0, aad);
-+			ccmp_special_blocks(skb, pn, b_0, aad, data_len);
- 
- 			if (ieee80211_aes_ccm_decrypt(
- 				    key->u.ccmp.tfm, b_0, aad,
- 				    skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN,
- 				    data_len,
--				    skb->data + skb->len - mic_len))
-+				    skb->data + skb->len - mic_len, mic_len))
- 				return RX_DROP_UNUSABLE;
- 		}
- 
-@@ -649,7 +648,7 @@ static int gcmp_encrypt_skb(struct ieee8
- 	u8 *pos;
- 	u8 pn[6];
- 	u64 pn64;
--	u8 aad[GCM_AAD_LEN];
-+	u8 aad[2 * AES_BLOCK_SIZE];
- 	u8 j_0[AES_BLOCK_SIZE];
- 
- 	if (info->control.hw_key &&
-@@ -706,8 +705,10 @@ static int gcmp_encrypt_skb(struct ieee8
- 
- 	pos += IEEE80211_GCMP_HDR_LEN;
- 	gcmp_special_blocks(skb, pn, j_0, aad);
--	return ieee80211_aes_gcm_encrypt(key->u.gcmp.tfm, j_0, aad, pos, len,
--					 skb_put(skb, IEEE80211_GCMP_MIC_LEN));
-+	ieee80211_aes_gcm_encrypt(key->u.gcmp.tfm, j_0, aad, pos, len,
-+				  skb_put(skb, IEEE80211_GCMP_MIC_LEN));
-+
-+	return 0;
- }
- 
- ieee80211_tx_result
-@@ -1139,9 +1140,9 @@ ieee80211_crypto_aes_gmac_encrypt(struct
- 	struct ieee80211_key *key = tx->key;
- 	struct ieee80211_mmie_16 *mmie;
- 	struct ieee80211_hdr *hdr;
--	u8 aad[GMAC_AAD_LEN];
-+	u8 aad[20];
- 	u64 pn64;
--	u8 nonce[GMAC_NONCE_LEN];
-+	u8 nonce[12];
- 
- 	if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
- 		return TX_DROP;
-@@ -1187,7 +1188,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct
- 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
- 	struct ieee80211_key *key = rx->key;
- 	struct ieee80211_mmie_16 *mmie;
--	u8 aad[GMAC_AAD_LEN], *mic, ipn[6], nonce[GMAC_NONCE_LEN];
-+	u8 aad[20], *mic, ipn[6], nonce[12];
- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
- 
- 	if (!ieee80211_is_mgmt(hdr->frame_control))
---- /dev/null
-+++ b/net/mac80211/aes_ccm.c
-@@ -0,0 +1,144 @@
-+/*
-+ * Copyright 2003-2004, Instant802 Networks, Inc.
-+ * Copyright 2005-2006, Devicescape Software, Inc.
-+ *
-+ * Rewrite: Copyright (C) 2013 Linaro Ltd <ard.biesheuvel@linaro.org>
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation.
-+ */
-+
-+#include <linux/kernel.h>
-+#include <linux/types.h>
-+#include <linux/err.h>
-+#include <crypto/aead.h>
-+#include <crypto/aes.h>
-+
-+#include <net/mac80211.h>
-+#include "key.h"
-+#include "aes_ccm.h"
-+
-+static void aes_ccm_prepare(struct crypto_cipher *tfm, u8 *b_0, u8 *aad, u8 *s_0,
-+			    u8 *a, u8 *b)
-+{
-+	int i;
-+
-+	crypto_cipher_encrypt_one(tfm, b, b_0);
-+
-+	/* Extra Authenticate-only data (always two AES blocks) */
-+	for (i = 0; i < AES_BLOCK_SIZE; i++)
-+		aad[i] ^= b[i];
-+	crypto_cipher_encrypt_one(tfm, b, aad);
-+
-+	aad += AES_BLOCK_SIZE;
-+
-+	for (i = 0; i < AES_BLOCK_SIZE; i++)
-+		aad[i] ^= b[i];
-+	crypto_cipher_encrypt_one(tfm, a, aad);
-+
-+	/* Mask out bits from auth-only-b_0 */
-+	b_0[0] &= 0x07;
-+
-+	/* S_0 is used to encrypt T (= MIC) */
-+	b_0[14] = 0;
-+	b_0[15] = 0;
-+	crypto_cipher_encrypt_one(tfm, s_0, b_0);
-+}
-+
-+
-+void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
-+			       u8 *data, size_t data_len, u8 *mic,
-+			       size_t mic_len)
-+{
-+	int i, j, last_len, num_blocks;
-+	u8 b[AES_BLOCK_SIZE];
-+	u8 s_0[AES_BLOCK_SIZE];
-+	u8 e[AES_BLOCK_SIZE];
-+	u8 *pos, *cpos;
-+
-+	num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
-+	last_len = data_len % AES_BLOCK_SIZE;
-+	aes_ccm_prepare(tfm, b_0, aad, s_0, b, b);
-+
-+	/* Process payload blocks */
-+	pos = data;
-+	cpos = data;
-+	for (j = 1; j <= num_blocks; j++) {
-+		int blen = (j == num_blocks && last_len) ?
-+			last_len : AES_BLOCK_SIZE;
-+
-+		/* Authentication followed by encryption */
-+		for (i = 0; i < blen; i++)
-+			b[i] ^= pos[i];
-+		crypto_cipher_encrypt_one(tfm, b, b);
-+
-+		b_0[14] = (j >> 8) & 0xff;
-+		b_0[15] = j & 0xff;
-+		crypto_cipher_encrypt_one(tfm, e, b_0);
-+		for (i = 0; i < blen; i++)
-+			*cpos++ = *pos++ ^ e[i];
-+	}
-+
-+	for (i = 0; i < mic_len; i++)
-+		mic[i] = b[i] ^ s_0[i];
-+}
-+
-+int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
-+			      u8 *data, size_t data_len, u8 *mic,
-+			      size_t mic_len)
-+{
-+	int i, j, last_len, num_blocks;
-+	u8 *pos, *cpos;
-+	u8 a[AES_BLOCK_SIZE];
-+	u8 b[AES_BLOCK_SIZE];
-+	u8 s_0[AES_BLOCK_SIZE];
-+
-+	num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
-+	last_len = data_len % AES_BLOCK_SIZE;
-+	aes_ccm_prepare(tfm, b_0, aad, s_0, a, b);
-+
-+	/* Process payload blocks */
-+	cpos = data;
-+	pos = data;
-+	for (j = 1; j <= num_blocks; j++) {
-+		int blen = (j == num_blocks && last_len) ?
-+			last_len : AES_BLOCK_SIZE;
-+
-+		/* Decryption followed by authentication */
-+		b_0[14] = (j >> 8) & 0xff;
-+		b_0[15] = j & 0xff;
-+		crypto_cipher_encrypt_one(tfm, b, b_0);
-+		for (i = 0; i < blen; i++) {
-+			*pos = *cpos++ ^ b[i];
-+			a[i] ^= *pos++;
-+		}
-+		crypto_cipher_encrypt_one(tfm, a, a);
-+	}
-+
-+	for (i = 0; i < mic_len; i++) {
-+		if ((mic[i] ^ s_0[i]) != a[i])
-+			return -1;
-+	}
-+
-+	return 0;
-+}
-+
-+struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[],
-+						      size_t key_len,
-+						      size_t mic_len)
-+{
-+	struct crypto_cipher *tfm;
-+
-+	tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
-+	if (!IS_ERR(tfm))
-+		crypto_cipher_setkey(tfm, key, key_len);
-+
-+	return tfm;
-+}
-+
-+
-+void ieee80211_aes_key_free(struct crypto_cipher *tfm)
-+{
-+	crypto_free_cipher(tfm);
-+}
---- a/net/mac80211/Kconfig
-+++ b/net/mac80211/Kconfig
-@@ -6,8 +6,6 @@ config MAC80211
- 	depends on CRYPTO
- 	select BPAUTO_CRYPTO_LIB_ARC4
- 	depends on CRYPTO_AES
--	depends on CRYPTO_CCM
--	depends on CRYPTO_GCM
- 	depends on CRYPTO_CMAC
- 	depends on CRC32
- 	help
---- a/net/mac80211/aes_gmac.h
-+++ b/net/mac80211/aes_gmac.h
-@@ -12,10 +12,22 @@
- #define GMAC_MIC_LEN	16
- #define GMAC_NONCE_LEN	12
- 
--struct crypto_aead *ieee80211_aes_gmac_key_setup(const u8 key[],
--						 size_t key_len);
--int ieee80211_aes_gmac(struct crypto_aead *tfm, const u8 *aad, u8 *nonce,
--		       const u8 *data, size_t data_len, u8 *mic);
--void ieee80211_aes_gmac_key_free(struct crypto_aead *tfm);
-+static inline struct crypto_aead *
-+ieee80211_aes_gmac_key_setup(const u8 key[], size_t key_len)
-+{
-+	return NULL;
-+}
-+
-+static inline int
-+ieee80211_aes_gmac(struct crypto_aead *tfm, const u8 *aad, u8 *nonce,
-+		   const u8 *data, size_t data_len, u8 *mic)
-+{
-+	return -EOPNOTSUPP;
-+}
-+
-+static inline void
-+ieee80211_aes_gmac_key_free(struct crypto_aead *tfm)
-+{
-+}
- 
- #endif /* AES_GMAC_H */
---- a/net/mac80211/key.h
-+++ b/net/mac80211/key.h
-@@ -89,7 +89,7 @@ struct ieee80211_key {
- 			 * Management frames.
- 			 */
- 			u8 rx_pn[IEEE80211_NUM_TIDS + 1][IEEE80211_CCMP_PN_LEN];
--			struct crypto_aead *tfm;
-+			struct crypto_cipher *tfm;
- 			u32 replays; /* dot11RSNAStatsCCMPReplays */
- 		} ccmp;
- 		struct {
diff --git a/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
index 45cd0e3dc0..5307fd355c 100644
--- a/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
+++ b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
@@ -2,7 +2,7 @@ Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnects
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1310,7 +1310,6 @@ static int ieee80211_stop_ap(struct wiph
+@@ -1319,7 +1319,6 @@ static int ieee80211_stop_ap(struct wiph
  	sdata->vif.bss_conf.ftmr_params = NULL;
  
  	__sta_info_flush(sdata, true);
diff --git a/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch b/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
index 172e5b04fd..ffd8807ccc 100644
--- a/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
+++ b/package/kernel/mac80211/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
@@ -1,6 +1,6 @@
 --- a/net/wireless/sysfs.c
 +++ b/net/wireless/sysfs.c
-@@ -23,18 +23,35 @@ static inline struct cfg80211_registered
+@@ -24,18 +24,35 @@ static inline struct cfg80211_registered
  	return container_of(dev, struct cfg80211_registered_device, wiphy.dev);
  }
  
diff --git a/package/kernel/mac80211/patches/subsys/130-disable-fils.patch b/package/kernel/mac80211/patches/subsys/130-disable-fils.patch
deleted file mode 100644
index 9c6e971f9d..0000000000
--- a/package/kernel/mac80211/patches/subsys/130-disable-fils.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-Disable FILS support, since it pulls in crypto hash support
-
---- a/net/mac80211/fils_aead.h
-+++ b/net/mac80211/fils_aead.h
-@@ -7,7 +7,7 @@
- #ifndef FILS_AEAD_H
- #define FILS_AEAD_H
- 
--#if LINUX_VERSION_IS_GEQ(4,3,0)
-+#if 0 /* LINUX_VERSION_IS_GEQ(4,3,0) */
- int fils_encrypt_assoc_req(struct sk_buff *skb,
- 			   struct ieee80211_mgd_assoc_data *assoc_data);
- int fils_decrypt_assoc_resp(struct ieee80211_sub_if_data *sdata,
---- a/net/mac80211/fils_aead.c
-+++ b/net/mac80211/fils_aead.c
-@@ -1,4 +1,4 @@
--#if LINUX_VERSION_IS_GEQ(4,3,0)
-+#if 0 /* LINUX_VERSION_IS_GEQ(4,3,0) */
- // SPDX-License-Identifier: GPL-2.0-only
- /*
-  * FILS AEAD for (Re)Association Request/Response frames
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -591,7 +591,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
- 			   NL80211_FEATURE_MAC_ON_CREATE |
- 			   NL80211_FEATURE_USERSPACE_MPM |
- 			   NL80211_FEATURE_FULL_AP_CLIENT_STATE;
--#if LINUX_VERSION_IS_GEQ(4,3,0)
-+#if 0 /* LINUX_VERSION_IS_GEQ(4,3,0) */
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_STA);
- #endif
- 	wiphy_ext_feature_set(wiphy,
diff --git a/package/kernel/mac80211/patches/subsys/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch b/package/kernel/mac80211/patches/subsys/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
deleted file mode 100644
index c3bf7ccc7a..0000000000
--- a/package/kernel/mac80211/patches/subsys/131-Revert-mac80211-aes-cmac-switch-to-shash-CMAC-driver.patch
+++ /dev/null
@@ -1,230 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 7 Oct 2017 09:37:28 +0200
-Subject: [PATCH] Revert "mac80211: aes-cmac: switch to shash CMAC
- driver"
-
-This reverts commit 26717828b75dd5c46e97f7f4a9b937d038bb2852.
-Reduces mac80211 dependencies for LEDE
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/aes_cmac.c
-+++ b/net/mac80211/aes_cmac.c
-@@ -19,67 +19,151 @@
- #define CMAC_TLEN_256 16 /* CMAC TLen = 128 bits (16 octets) */
- #define AAD_LEN 20
- 
--static const u8 zero[CMAC_TLEN_256];
- 
--void ieee80211_aes_cmac(struct crypto_shash *tfm, const u8 *aad,
-+void gf_mulx(u8 *pad)
-+{
-+	int i, carry;
-+
-+	carry = pad[0] & 0x80;
-+	for (i = 0; i < AES_BLOCK_SIZE - 1; i++)
-+		pad[i] = (pad[i] << 1) | (pad[i + 1] >> 7);
-+	pad[AES_BLOCK_SIZE - 1] <<= 1;
-+	if (carry)
-+		pad[AES_BLOCK_SIZE - 1] ^= 0x87;
-+}
-+
-+void aes_cmac_vector(struct crypto_cipher *tfm, size_t num_elem,
-+		     const u8 *addr[], const size_t *len, u8 *mac,
-+		     size_t mac_len)
-+{
-+	u8 cbc[AES_BLOCK_SIZE], pad[AES_BLOCK_SIZE];
-+	const u8 *pos, *end;
-+	size_t i, e, left, total_len;
-+
-+	memset(cbc, 0, AES_BLOCK_SIZE);
-+
-+	total_len = 0;
-+	for (e = 0; e < num_elem; e++)
-+		total_len += len[e];
-+	left = total_len;
-+
-+	e = 0;
-+	pos = addr[0];
-+	end = pos + len[0];
-+
-+	while (left >= AES_BLOCK_SIZE) {
-+		for (i = 0; i < AES_BLOCK_SIZE; i++) {
-+			cbc[i] ^= *pos++;
-+			if (pos >= end) {
-+				e++;
-+				pos = addr[e];
-+				end = pos + len[e];
-+			}
-+		}
-+		if (left > AES_BLOCK_SIZE)
-+			crypto_cipher_encrypt_one(tfm, cbc, cbc);
-+		left -= AES_BLOCK_SIZE;
-+	}
-+
-+	memset(pad, 0, AES_BLOCK_SIZE);
-+	crypto_cipher_encrypt_one(tfm, pad, pad);
-+	gf_mulx(pad);
-+
-+	if (left || total_len == 0) {
-+		for (i = 0; i < left; i++) {
-+			cbc[i] ^= *pos++;
-+			if (pos >= end) {
-+				e++;
-+				pos = addr[e];
-+				end = pos + len[e];
-+			}
-+		}
-+		cbc[left] ^= 0x80;
-+		gf_mulx(pad);
-+	}
-+
-+	for (i = 0; i < AES_BLOCK_SIZE; i++)
-+		pad[i] ^= cbc[i];
-+	crypto_cipher_encrypt_one(tfm, pad, pad);
-+	memcpy(mac, pad, mac_len);
-+}
-+
-+
-+void ieee80211_aes_cmac(struct crypto_cipher *tfm, const u8 *aad,
- 			const u8 *data, size_t data_len, u8 *mic)
- {
--	SHASH_DESC_ON_STACK(desc, tfm);
--	u8 out[AES_BLOCK_SIZE];
-+	const u8 *addr[4];
-+	size_t len[4];
-+	u8 zero[CMAC_TLEN];
- 	const __le16 *fc;
- 
--	desc->tfm = tfm;
--
--	crypto_shash_init(desc);
--	crypto_shash_update(desc, aad, AAD_LEN);
-+	memset(zero, 0, CMAC_TLEN);
-+	addr[0] = aad;
-+	len[0] = AAD_LEN;
- 	fc = (const __le16 *)aad;
- 	if (ieee80211_is_beacon(*fc)) {
- 		/* mask Timestamp field to zero */
--		crypto_shash_update(desc, zero, 8);
--		crypto_shash_update(desc, data + 8, data_len - 8 - CMAC_TLEN);
-+		addr[1] = zero;
-+		len[1] = 8;
-+		addr[2] = data + 8;
-+		len[2] = data_len - 8 - CMAC_TLEN;
-+		addr[3] = zero;
-+		len[3] = CMAC_TLEN;
-+		aes_cmac_vector(tfm, 4, addr, len, mic, CMAC_TLEN);
- 	} else {
--		crypto_shash_update(desc, data, data_len - CMAC_TLEN);
-+		addr[1] = data;
-+		len[1] = data_len - CMAC_TLEN;
-+		addr[2] = zero;
-+		len[2] = CMAC_TLEN;
-+		aes_cmac_vector(tfm, 3, addr, len, mic, CMAC_TLEN);
- 	}
--	crypto_shash_finup(desc, zero, CMAC_TLEN, out);
--
--	memcpy(mic, out, CMAC_TLEN);
- }
- 
--void ieee80211_aes_cmac_256(struct crypto_shash *tfm, const u8 *aad,
-+void ieee80211_aes_cmac_256(struct crypto_cipher *tfm, const u8 *aad,
- 			    const u8 *data, size_t data_len, u8 *mic)
- {
--	SHASH_DESC_ON_STACK(desc, tfm);
-+	const u8 *addr[4];
-+	size_t len[4];
-+	u8 zero[CMAC_TLEN_256];
- 	const __le16 *fc;
- 
--	desc->tfm = tfm;
--
--	crypto_shash_init(desc);
--	crypto_shash_update(desc, aad, AAD_LEN);
-+	memset(zero, 0, CMAC_TLEN_256);
-+	addr[0] = aad;
-+	len[0] = AAD_LEN;
-+	addr[1] = data;
- 	fc = (const __le16 *)aad;
- 	if (ieee80211_is_beacon(*fc)) {
- 		/* mask Timestamp field to zero */
--		crypto_shash_update(desc, zero, 8);
--		crypto_shash_update(desc, data + 8,
--				    data_len - 8 - CMAC_TLEN_256);
-+		addr[1] = zero;
-+		len[1] = 8;
-+		addr[2] = data + 8;
-+		len[2] = data_len - 8 - CMAC_TLEN_256;
-+		addr[3] = zero;
-+		len[3] = CMAC_TLEN_256;
-+		aes_cmac_vector(tfm, 4, addr, len, mic, CMAC_TLEN_256);
- 	} else {
--		crypto_shash_update(desc, data, data_len - CMAC_TLEN_256);
-+		addr[1] = data;
-+		len[1] = data_len - CMAC_TLEN_256;
-+		addr[2] = zero;
-+		len[2] = CMAC_TLEN_256;
-+		aes_cmac_vector(tfm, 3, addr, len, mic, CMAC_TLEN_256);
- 	}
--	crypto_shash_finup(desc, zero, CMAC_TLEN_256, mic);
- }
- 
--struct crypto_shash *ieee80211_aes_cmac_key_setup(const u8 key[],
--						  size_t key_len)
-+struct crypto_cipher *ieee80211_aes_cmac_key_setup(const u8 key[],
-+						   size_t key_len)
- {
--	struct crypto_shash *tfm;
-+	struct crypto_cipher *tfm;
- 
--	tfm = crypto_alloc_shash("cmac(aes)", 0, 0);
-+	tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
- 	if (!IS_ERR(tfm))
--		crypto_shash_setkey(tfm, key, key_len);
-+		crypto_cipher_setkey(tfm, key, key_len);
- 
- 	return tfm;
- }
- 
--void ieee80211_aes_cmac_key_free(struct crypto_shash *tfm)
-+
-+void ieee80211_aes_cmac_key_free(struct crypto_cipher *tfm)
- {
--	crypto_free_shash(tfm);
-+	crypto_free_cipher(tfm);
- }
---- a/net/mac80211/aes_cmac.h
-+++ b/net/mac80211/aes_cmac.h
-@@ -7,14 +7,13 @@
- #define AES_CMAC_H
- 
- #include <linux/crypto.h>
--#include <crypto/hash.h>
- 
--struct crypto_shash *ieee80211_aes_cmac_key_setup(const u8 key[],
--						  size_t key_len);
--void ieee80211_aes_cmac(struct crypto_shash *tfm, const u8 *aad,
-+struct crypto_cipher *ieee80211_aes_cmac_key_setup(const u8 key[],
-+						   size_t key_len);
-+void ieee80211_aes_cmac(struct crypto_cipher *tfm, const u8 *aad,
- 			const u8 *data, size_t data_len, u8 *mic);
--void ieee80211_aes_cmac_256(struct crypto_shash *tfm, const u8 *aad,
-+void ieee80211_aes_cmac_256(struct crypto_cipher *tfm, const u8 *aad,
- 			    const u8 *data, size_t data_len, u8 *mic);
--void ieee80211_aes_cmac_key_free(struct crypto_shash *tfm);
-+void ieee80211_aes_cmac_key_free(struct crypto_cipher *tfm);
- 
- #endif /* AES_CMAC_H */
---- a/net/mac80211/key.h
-+++ b/net/mac80211/key.h
-@@ -94,7 +94,7 @@ struct ieee80211_key {
- 		} ccmp;
- 		struct {
- 			u8 rx_pn[IEEE80211_CMAC_PN_LEN];
--			struct crypto_shash *tfm;
-+			struct crypto_cipher *tfm;
- 			u32 replays; /* dot11RSNAStatsCMACReplays */
- 			u32 icverrors; /* dot11RSNAStatsCMACICVErrors */
- 		} aes_cmac;
diff --git a/package/kernel/mac80211/patches/subsys/132-mac80211-remove-cmac-dependency.patch b/package/kernel/mac80211/patches/subsys/132-mac80211-remove-cmac-dependency.patch
deleted file mode 100644
index df67d2f101..0000000000
--- a/package/kernel/mac80211/patches/subsys/132-mac80211-remove-cmac-dependency.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/net/mac80211/Kconfig
-+++ b/net/mac80211/Kconfig
-@@ -6,7 +6,6 @@ config MAC80211
- 	depends on CRYPTO
- 	select BPAUTO_CRYPTO_LIB_ARC4
- 	depends on CRYPTO_AES
--	depends on CRYPTO_CMAC
- 	depends on CRC32
- 	help
- 	  This option enables the hardware independent IEEE 802.11
diff --git a/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch b/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch
index 8d086625e4..2dc6ab3601 100644
--- a/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch
+++ b/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -321,7 +321,7 @@ void ieee80211_restart_hw(struct ieee802
+@@ -337,7 +337,7 @@ void ieee80211_restart_hw(struct ieee802
  }
  EXPORT_SYMBOL(ieee80211_restart_hw);
  
@@ -9,7 +9,7 @@
  static int ieee80211_ifa_changed(struct notifier_block *nb,
  				 unsigned long data, void *arg)
  {
-@@ -380,7 +380,7 @@ static int ieee80211_ifa_changed(struct
+@@ -396,7 +396,7 @@ static int ieee80211_ifa_changed(struct
  }
  #endif
  
@@ -18,8 +18,8 @@
  static int ieee80211_ifa6_changed(struct notifier_block *nb,
  				  unsigned long data, void *arg)
  {
-@@ -1315,14 +1315,14 @@ int ieee80211_register_hw(struct ieee802
- 
+@@ -1321,14 +1321,14 @@ int ieee80211_register_hw(struct ieee802
+ 	wiphy_unlock(hw->wiphy);
  	rtnl_unlock();
  
 -#ifdef CONFIG_INET
@@ -35,7 +35,7 @@
  	local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
  	result = register_inet6addr_notifier(&local->ifa6_notifier);
  	if (result)
-@@ -1331,13 +1331,13 @@ int ieee80211_register_hw(struct ieee802
+@@ -1337,13 +1337,13 @@ int ieee80211_register_hw(struct ieee802
  
  	return 0;
  
@@ -52,7 +52,7 @@
   fail_ifa:
  #endif
  	wiphy_unregister(local->hw.wiphy);
-@@ -1365,10 +1365,10 @@ void ieee80211_unregister_hw(struct ieee
+@@ -1371,10 +1371,10 @@ void ieee80211_unregister_hw(struct ieee
  	tasklet_kill(&local->tx_pending_tasklet);
  	tasklet_kill(&local->tasklet);
  
diff --git a/package/kernel/mac80211/patches/subsys/210-ap_scan.patch b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
index f8c3821c51..0c06829ce4 100644
--- a/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
+++ b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2463,7 +2463,7 @@ static int ieee80211_scan(struct wiphy *
+@@ -2497,7 +2497,7 @@ static int ieee80211_scan(struct wiphy *
  		 * the  frames sent while scanning on other channel will be
  		 * lost)
  		 */
diff --git a/package/kernel/mac80211/patches/subsys/300-cfg80211-support-immediate-reconnect-request-hint.patch b/package/kernel/mac80211/patches/subsys/300-cfg80211-support-immediate-reconnect-request-hint.patch
deleted file mode 100644
index e0052eb6a0..0000000000
--- a/package/kernel/mac80211/patches/subsys/300-cfg80211-support-immediate-reconnect-request-hint.patch
+++ /dev/null
@@ -1,279 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Sun, 6 Dec 2020 14:54:42 +0200
-Subject: [PATCH] cfg80211: support immediate reconnect request hint
-
-There are cases where it's necessary to disconnect, but an
-immediate reconnection is desired. Support a hint to userspace
-that this is the case, by including a new attribute in the
-deauth or disassoc event.
-
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Link: https://lore.kernel.org/r/iwlwifi.20201206145305.58d33941fb9d.I0e7168c205c7949529c8e3b86f3c9b12c01a7017@changeid
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -6408,13 +6408,15 @@ void cfg80211_abandon_assoc(struct net_d
-  * @dev: network device
-  * @buf: 802.11 frame (header + body)
-  * @len: length of the frame data
-+ * @reconnect: immediate reconnect is desired (include the nl80211 attribute)
-  *
-  * This function is called whenever deauthentication has been processed in
-  * station mode. This includes both received deauthentication frames and
-  * locally generated ones. This function may sleep. The caller must hold the
-  * corresponding wdev's mutex.
-  */
--void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len);
-+void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len,
-+			   bool reconnect);
- 
- /**
-  * cfg80211_rx_unprot_mlme_mgmt - notification of unprotected mlme mgmt frame
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -2733,7 +2733,7 @@ static void ieee80211_report_disconnect(
- 	};
- 
- 	if (tx)
--		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len);
-+		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len, false);
- 	else
- 		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);
- 
-@@ -4734,7 +4734,8 @@ void ieee80211_mgd_quiesce(struct ieee80
- 		if (ifmgd->auth_data)
- 			ieee80211_destroy_auth_data(sdata, false);
- 		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
--				      IEEE80211_DEAUTH_FRAME_LEN);
-+				      IEEE80211_DEAUTH_FRAME_LEN,
-+				      false);
- 	}
- 
- 	/* This is a bit of a hack - we should find a better and more generic
---- a/net/wireless/mlme.c
-+++ b/net/wireless/mlme.c
-@@ -4,7 +4,7 @@
-  *
-  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
-  * Copyright (c) 2015		Intel Deutschland GmbH
-- * Copyright (C) 2019 Intel Corporation
-+ * Copyright (C) 2019-2020 Intel Corporation
-  */
- 
- #include <linux/kernel.h>
-@@ -81,7 +81,8 @@ static void cfg80211_process_auth(struct
- }
- 
- static void cfg80211_process_deauth(struct wireless_dev *wdev,
--				    const u8 *buf, size_t len)
-+				    const u8 *buf, size_t len,
-+				    bool reconnect)
- {
- 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
- 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
-@@ -89,7 +90,7 @@ static void cfg80211_process_deauth(stru
- 	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
- 	bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
- 
--	nl80211_send_deauth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
-+	nl80211_send_deauth(rdev, wdev->netdev, buf, len, reconnect, GFP_KERNEL);
- 
- 	if (!wdev->current_bss ||
- 	    !ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
-@@ -100,7 +101,8 @@ static void cfg80211_process_deauth(stru
- }
- 
- static void cfg80211_process_disassoc(struct wireless_dev *wdev,
--				      const u8 *buf, size_t len)
-+				      const u8 *buf, size_t len,
-+				      bool reconnect)
- {
- 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
- 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
-@@ -108,7 +110,8 @@ static void cfg80211_process_disassoc(st
- 	u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
- 	bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
- 
--	nl80211_send_disassoc(rdev, wdev->netdev, buf, len, GFP_KERNEL);
-+	nl80211_send_disassoc(rdev, wdev->netdev, buf, len, reconnect,
-+			      GFP_KERNEL);
- 
- 	if (WARN_ON(!wdev->current_bss ||
- 		    !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
-@@ -133,9 +136,9 @@ void cfg80211_rx_mlme_mgmt(struct net_de
- 	if (ieee80211_is_auth(mgmt->frame_control))
- 		cfg80211_process_auth(wdev, buf, len);
- 	else if (ieee80211_is_deauth(mgmt->frame_control))
--		cfg80211_process_deauth(wdev, buf, len);
-+		cfg80211_process_deauth(wdev, buf, len, false);
- 	else if (ieee80211_is_disassoc(mgmt->frame_control))
--		cfg80211_process_disassoc(wdev, buf, len);
-+		cfg80211_process_disassoc(wdev, buf, len, false);
- }
- EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt);
- 
-@@ -180,22 +183,23 @@ void cfg80211_abandon_assoc(struct net_d
- }
- EXPORT_SYMBOL(cfg80211_abandon_assoc);
- 
--void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
-+void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len,
-+			   bool reconnect)
- {
- 	struct wireless_dev *wdev = dev->ieee80211_ptr;
- 	struct ieee80211_mgmt *mgmt = (void *)buf;
- 
- 	ASSERT_WDEV_LOCK(wdev);
- 
--	trace_cfg80211_tx_mlme_mgmt(dev, buf, len);
-+	trace_cfg80211_tx_mlme_mgmt(dev, buf, len, reconnect);
- 
- 	if (WARN_ON(len < 2))
- 		return;
- 
- 	if (ieee80211_is_deauth(mgmt->frame_control))
--		cfg80211_process_deauth(wdev, buf, len);
-+		cfg80211_process_deauth(wdev, buf, len, reconnect);
- 	else
--		cfg80211_process_disassoc(wdev, buf, len);
-+		cfg80211_process_disassoc(wdev, buf, len, reconnect);
- }
- EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt);
- 
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -736,6 +736,7 @@ static const struct nla_policy nl80211_p
- 		NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
- 	[NL80211_ATTR_S1G_CAPABILITY_MASK] =
- 		NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
-+	[NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
- };
- 
- /* policy for the key attributes */
-@@ -15914,7 +15915,7 @@ static void nl80211_send_mlme_event(stru
- 				    const u8 *buf, size_t len,
- 				    enum nl80211_commands cmd, gfp_t gfp,
- 				    int uapsd_queues, const u8 *req_ies,
--				    size_t req_ies_len)
-+				    size_t req_ies_len, bool reconnect)
- {
- 	struct sk_buff *msg;
- 	void *hdr;
-@@ -15936,6 +15937,9 @@ static void nl80211_send_mlme_event(stru
- 	     nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
- 		goto nla_put_failure;
- 
-+	if (reconnect && nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
-+		goto nla_put_failure;
-+
- 	if (uapsd_queues >= 0) {
- 		struct nlattr *nla_wmm =
- 			nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
-@@ -15964,7 +15968,8 @@ void nl80211_send_rx_auth(struct cfg8021
- 			  size_t len, gfp_t gfp)
- {
- 	nl80211_send_mlme_event(rdev, netdev, buf, len,
--				NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0);
-+				NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0,
-+				false);
- }
- 
- void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
-@@ -15974,23 +15979,25 @@ void nl80211_send_rx_assoc(struct cfg802
- {
- 	nl80211_send_mlme_event(rdev, netdev, buf, len,
- 				NL80211_CMD_ASSOCIATE, gfp, uapsd_queues,
--				req_ies, req_ies_len);
-+				req_ies, req_ies_len, false);
- }
- 
- void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
- 			 struct net_device *netdev, const u8 *buf,
--			 size_t len, gfp_t gfp)
-+			 size_t len, bool reconnect, gfp_t gfp)
- {
- 	nl80211_send_mlme_event(rdev, netdev, buf, len,
--				NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0);
-+				NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0,
-+				reconnect);
- }
- 
- void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
- 			   struct net_device *netdev, const u8 *buf,
--			   size_t len, gfp_t gfp)
-+			   size_t len, bool reconnect, gfp_t gfp)
- {
- 	nl80211_send_mlme_event(rdev, netdev, buf, len,
--				NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0);
-+				NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0,
-+				reconnect);
- }
- 
- void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
-@@ -16021,7 +16028,7 @@ void cfg80211_rx_unprot_mlme_mgmt(struct
- 
- 	trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
- 	nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
--				NULL, 0);
-+				NULL, 0, false);
- }
- EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
- 
---- a/net/wireless/nl80211.h
-+++ b/net/wireless/nl80211.h
-@@ -1,7 +1,7 @@
- /* SPDX-License-Identifier: GPL-2.0 */
- /*
-  * Portions of this file
-- * Copyright (C) 2018 Intel Corporation
-+ * Copyright (C) 2018, 2020 Intel Corporation
-  */
- #ifndef __NET_WIRELESS_NL80211_H
- #define __NET_WIRELESS_NL80211_H
-@@ -69,10 +69,12 @@ void nl80211_send_rx_assoc(struct cfg802
- 			   const u8 *req_ies, size_t req_ies_len);
- void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
- 			 struct net_device *netdev,
--			 const u8 *buf, size_t len, gfp_t gfp);
-+			 const u8 *buf, size_t len,
-+			 bool reconnect, gfp_t gfp);
- void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
- 			   struct net_device *netdev,
--			   const u8 *buf, size_t len, gfp_t gfp);
-+			   const u8 *buf, size_t len,
-+			   bool reconnect, gfp_t gfp);
- void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
- 			       struct net_device *netdev,
- 			       const u8 *addr, gfp_t gfp);
---- a/net/wireless/trace.h
-+++ b/net/wireless/trace.h
-@@ -2684,19 +2684,23 @@ DEFINE_EVENT(netdev_frame_event, cfg8021
- );
- 
- TRACE_EVENT(cfg80211_tx_mlme_mgmt,
--	TP_PROTO(struct net_device *netdev, const u8 *buf, int len),
--	TP_ARGS(netdev, buf, len),
-+	TP_PROTO(struct net_device *netdev, const u8 *buf, int len,
-+		 bool reconnect),
-+	TP_ARGS(netdev, buf, len, reconnect),
- 	TP_STRUCT__entry(
- 		NETDEV_ENTRY
- 		__dynamic_array(u8, frame, len)
-+		__field(int, reconnect)
- 	),
- 	TP_fast_assign(
- 		NETDEV_ASSIGN;
- 		memcpy(__get_dynamic_array(frame), buf, len);
-+		__entry->reconnect = reconnect;
- 	),
--	TP_printk(NETDEV_PR_FMT ", ftype:0x%.2x",
-+	TP_printk(NETDEV_PR_FMT ", ftype:0x%.2x reconnect:%d",
- 		  NETDEV_PR_ARG,
--		  le16_to_cpup((__le16 *)__get_dynamic_array(frame)))
-+		  le16_to_cpup((__le16 *)__get_dynamic_array(frame)),
-+		  __entry->reconnect)
- );
- 
- DECLARE_EVENT_CLASS(netdev_mac_evt,
diff --git a/package/kernel/mac80211/patches/subsys/304-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch b/package/kernel/mac80211/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
similarity index 100%
rename from package/kernel/mac80211/patches/subsys/304-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
rename to package/kernel/mac80211/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
diff --git a/package/kernel/mac80211/patches/subsys/301-mac80211-support-driver-based-disconnect-with-reconn.patch b/package/kernel/mac80211/patches/subsys/301-mac80211-support-driver-based-disconnect-with-reconn.patch
deleted file mode 100644
index 164ee972ac..0000000000
--- a/package/kernel/mac80211/patches/subsys/301-mac80211-support-driver-based-disconnect-with-reconn.patch
+++ /dev/null
@@ -1,271 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Sun, 6 Dec 2020 14:54:43 +0200
-Subject: [PATCH] mac80211: support driver-based disconnect with reconnect hint
-
-Support the driver indicating that a disconnection needs
-to be performed, and pass through the reconnect hint in
-this case.
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Link: https://lore.kernel.org/r/iwlwifi.20201206145305.5c8dab7a22a0.I58459fdf6968b16c90cab9c574f0f04ca22b0c79@changeid
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -5885,6 +5885,17 @@ void ieee80211_beacon_loss(struct ieee80
- void ieee80211_connection_loss(struct ieee80211_vif *vif);
- 
- /**
-+ * ieee80211_disconnect - request disconnection
-+ *
-+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
-+ * @reconnect: immediate reconnect is desired
-+ *
-+ * Request disconnection from the current network and, if enabled, send a
-+ * hint to the higher layers that immediate reconnect is desired.
-+ */
-+void ieee80211_disconnect(struct ieee80211_vif *vif, bool reconnect);
-+
-+/**
-  * ieee80211_resume_disconnect - disconnect from AP after resume
-  *
-  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -450,7 +450,9 @@ struct ieee80211_if_managed {
- 	unsigned long probe_timeout;
- 	int probe_send_count;
- 	bool nullfunc_failed;
--	bool connection_loss;
-+	u8 connection_loss:1,
-+	   driver_disconnect:1,
-+	   reconnect:1;
- 
- 	struct cfg80211_bss *associated;
- 	struct ieee80211_mgd_auth_data *auth_data;
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -2724,7 +2724,7 @@ EXPORT_SYMBOL(ieee80211_ap_probereq_get)
- 
- static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
- 					const u8 *buf, size_t len, bool tx,
--					u16 reason)
-+					u16 reason, bool reconnect)
- {
- 	struct ieee80211_event event = {
- 		.type = MLME_EVENT,
-@@ -2733,7 +2733,7 @@ static void ieee80211_report_disconnect(
- 	};
- 
- 	if (tx)
--		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len, false);
-+		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len, reconnect);
- 	else
- 		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);
- 
-@@ -2755,13 +2755,18 @@ static void __ieee80211_disconnect(struc
- 
- 	tx = !sdata->csa_block_tx;
- 
--	/* AP is probably out of range (or not reachable for another reason) so
--	 * remove the bss struct for that AP.
--	 */
--	cfg80211_unlink_bss(local->hw.wiphy, ifmgd->associated);
-+	if (!ifmgd->driver_disconnect) {
-+		/*
-+		 * AP is probably out of range (or not reachable for another
-+		 * reason) so remove the bss struct for that AP.
-+		 */
-+		cfg80211_unlink_bss(local->hw.wiphy, ifmgd->associated);
-+	}
- 
- 	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
--			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
-+			       ifmgd->driver_disconnect ?
-+					WLAN_REASON_DEAUTH_LEAVING :
-+					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
- 			       tx, frame_buf);
- 	mutex_lock(&local->mtx);
- 	sdata->vif.csa_active = false;
-@@ -2774,7 +2779,9 @@ static void __ieee80211_disconnect(struc
- 	mutex_unlock(&local->mtx);
- 
- 	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
--				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
-+				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
-+				    ifmgd->reconnect);
-+	ifmgd->reconnect = false;
- 
- 	sdata_unlock(sdata);
- }
-@@ -2793,6 +2800,13 @@ static void ieee80211_beacon_connection_
- 		sdata_info(sdata, "Connection to AP %pM lost\n",
- 			   ifmgd->bssid);
- 		__ieee80211_disconnect(sdata);
-+		ifmgd->connection_loss = false;
-+	} else if (ifmgd->driver_disconnect) {
-+		sdata_info(sdata,
-+			   "Driver requested disconnection from AP %pM\n",
-+			   ifmgd->bssid);
-+		__ieee80211_disconnect(sdata);
-+		ifmgd->driver_disconnect = false;
- 	} else {
- 		ieee80211_mgd_probe_ap(sdata, true);
- 	}
-@@ -2831,6 +2845,21 @@ void ieee80211_connection_loss(struct ie
- }
- EXPORT_SYMBOL(ieee80211_connection_loss);
- 
-+void ieee80211_disconnect(struct ieee80211_vif *vif, bool reconnect)
-+{
-+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-+	struct ieee80211_hw *hw = &sdata->local->hw;
-+
-+	trace_api_disconnect(sdata, reconnect);
-+
-+	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
-+		return;
-+
-+	sdata->u.mgd.driver_disconnect = true;
-+	sdata->u.mgd.reconnect = reconnect;
-+	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
-+}
-+EXPORT_SYMBOL(ieee80211_disconnect);
- 
- static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
- 					bool assoc)
-@@ -3141,7 +3170,7 @@ static void ieee80211_rx_mgmt_deauth(str
- 		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
- 
- 		ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
--					    reason_code);
-+					    reason_code, false);
- 		return;
- 	}
- 
-@@ -3190,7 +3219,8 @@ static void ieee80211_rx_mgmt_disassoc(s
- 
- 	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
- 
--	ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code);
-+	ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code,
-+				    false);
- }
- 
- static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
-@@ -4214,7 +4244,8 @@ static void ieee80211_rx_mgmt_beacon(str
- 				       true, deauth_buf);
- 		ieee80211_report_disconnect(sdata, deauth_buf,
- 					    sizeof(deauth_buf), true,
--					    WLAN_REASON_DEAUTH_LEAVING);
-+					    WLAN_REASON_DEAUTH_LEAVING,
-+					    false);
- 		return;
- 	}
- 
-@@ -4359,7 +4390,7 @@ static void ieee80211_sta_connection_los
- 			       tx, frame_buf);
- 
- 	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
--				    reason);
-+				    reason, false);
- }
- 
- static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
-@@ -5449,7 +5480,8 @@ int ieee80211_mgd_auth(struct ieee80211_
- 
- 		ieee80211_report_disconnect(sdata, frame_buf,
- 					    sizeof(frame_buf), true,
--					    WLAN_REASON_UNSPECIFIED);
-+					    WLAN_REASON_UNSPECIFIED,
-+					    false);
- 	}
- 
- 	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
-@@ -5521,7 +5553,8 @@ int ieee80211_mgd_assoc(struct ieee80211
- 
- 		ieee80211_report_disconnect(sdata, frame_buf,
- 					    sizeof(frame_buf), true,
--					    WLAN_REASON_UNSPECIFIED);
-+					    WLAN_REASON_UNSPECIFIED,
-+					    false);
- 	}
- 
- 	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
-@@ -5824,7 +5857,7 @@ int ieee80211_mgd_deauth(struct ieee8021
- 		ieee80211_destroy_auth_data(sdata, false);
- 		ieee80211_report_disconnect(sdata, frame_buf,
- 					    sizeof(frame_buf), true,
--					    req->reason_code);
-+					    req->reason_code, false);
- 
- 		return 0;
- 	}
-@@ -5844,7 +5877,7 @@ int ieee80211_mgd_deauth(struct ieee8021
- 		ieee80211_destroy_assoc_data(sdata, false, true);
- 		ieee80211_report_disconnect(sdata, frame_buf,
- 					    sizeof(frame_buf), true,
--					    req->reason_code);
-+					    req->reason_code, false);
- 		return 0;
- 	}
- 
-@@ -5859,7 +5892,7 @@ int ieee80211_mgd_deauth(struct ieee8021
- 				       req->reason_code, tx, frame_buf);
- 		ieee80211_report_disconnect(sdata, frame_buf,
- 					    sizeof(frame_buf), true,
--					    req->reason_code);
-+					    req->reason_code, false);
- 		return 0;
- 	}
- 
-@@ -5892,7 +5925,7 @@ int ieee80211_mgd_disassoc(struct ieee80
- 			       frame_buf);
- 
- 	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
--				    req->reason_code);
-+				    req->reason_code, false);
- 
- 	return 0;
- }
---- a/net/mac80211/trace.h
-+++ b/net/mac80211/trace.h
-@@ -2,7 +2,7 @@
- /*
- * Portions of this file
- * Copyright(c) 2016-2017 Intel Deutschland GmbH
--* Copyright (C) 2018 - 2019 Intel Corporation
-+* Copyright (C) 2018 - 2020 Intel Corporation
- */
- 
- #if !defined(__MAC80211_DRIVER_TRACE) || defined(TRACE_HEADER_MULTI_READ)
-@@ -2086,6 +2086,27 @@ TRACE_EVENT(api_connection_loss,
- 	)
- );
- 
-+TRACE_EVENT(api_disconnect,
-+	TP_PROTO(struct ieee80211_sub_if_data *sdata, bool reconnect),
-+
-+	TP_ARGS(sdata, reconnect),
-+
-+	TP_STRUCT__entry(
-+		VIF_ENTRY
-+		__field(int, reconnect)
-+	),
-+
-+	TP_fast_assign(
-+		VIF_ASSIGN;
-+		__entry->reconnect = reconnect;
-+	),
-+
-+	TP_printk(
-+		VIF_PR_FMT " reconnect:%d",
-+		VIF_PR_ARG, __entry->reconnect
-+	)
-+);
-+
- TRACE_EVENT(api_cqm_rssi_notify,
- 	TP_PROTO(struct ieee80211_sub_if_data *sdata,
- 		 enum nl80211_cqm_rssi_threshold_event rssi_event,
diff --git a/package/kernel/mac80211/patches/subsys/302-cfg80211-Add-support-to-configure-SAE-PWE-value-to-d.patch b/package/kernel/mac80211/patches/subsys/302-cfg80211-Add-support-to-configure-SAE-PWE-value-to-d.patch
deleted file mode 100644
index da88d1413d..0000000000
--- a/package/kernel/mac80211/patches/subsys/302-cfg80211-Add-support-to-configure-SAE-PWE-value-to-d.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From: Rohan Dutta <drohan@codeaurora.org>
-Date: Tue, 27 Oct 2020 12:09:10 +0200
-Subject: [PATCH] cfg80211: Add support to configure SAE PWE value to drivers
-
-Add support to configure SAE PWE preference from userspace to drivers in
-both AP and STA modes. This is needed for cases where the driver takes
-care of Authentication frame processing (SME in the driver) so that
-correct enforcement of the acceptable PWE derivation mechanism can be
-performed.
-
-The userspace applications can pass the sae_pwe value using the
-NL80211_ATTR_SAE_PWE attribute in the NL80211_CMD_CONNECT and
-NL80211_CMD_START_AP commands to the driver. This allows selection
-between the hunting-and-pecking loop and hash-to-element options for PWE
-derivation. For backwards compatibility, this new attribute is optional
-and if not included, the driver is notified of the value being
-unspecified.
-
-Signed-off-by: Rohan Dutta <drohan@codeaurora.org>
-Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
-Link: https://lore.kernel.org/r/20201027100910.22283-1-jouni@codeaurora.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -1009,6 +1009,14 @@ struct survey_info {
-  * @sae_pwd: password for SAE authentication (for devices supporting SAE
-  *	offload)
-  * @sae_pwd_len: length of SAE password (for devices supporting SAE offload)
-+ * @sae_pwe: The mechanisms allowed for SAE PWE derivation
-+ *	NL80211_SAE_PWE_UNSPECIFIED: Not-specified, used to indicate userspace
-+ *		did not specify any preference. The driver should follow its
-+ *		internal policy in such a scenario.
-+ *	NL80211_SAE_PWE_HUNT_AND_PECK: Allow hunting-and-pecking loop only
-+ *	NL80211_SAE_PWE_HASH_TO_ELEMENT: Allow hash-to-element only
-+ *	NL80211_SAE_PWE_BOTH: Allow either hunting-and-pecking loop
-+ *		or hash-to-element
-  */
- struct cfg80211_crypto_settings {
- 	u32 wpa_versions;
-@@ -1027,6 +1035,7 @@ struct cfg80211_crypto_settings {
- 	const u8 *psk;
- 	const u8 *sae_pwd;
- 	u8 sae_pwd_len;
-+	enum nl80211_sae_pwe_mechanism sae_pwe;
- };
- 
- /**
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -736,6 +736,9 @@ static const struct nla_policy nl80211_p
- 		NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
- 	[NL80211_ATTR_S1G_CAPABILITY_MASK] =
- 		NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
-+	[NL80211_ATTR_SAE_PWE] =
-+		NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
-+				 NL80211_SAE_PWE_BOTH),
- 	[NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
- };
- 
-@@ -9763,6 +9766,12 @@ static int nl80211_crypto_settings(struc
- 			nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
- 	}
- 
-+	if (info->attrs[NL80211_ATTR_SAE_PWE])
-+		settings->sae_pwe =
-+			nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]);
-+	else
-+		settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED;
-+
- 	return 0;
- }
- 
diff --git a/package/kernel/mac80211/patches/subsys/306-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch b/package/kernel/mac80211/patches/subsys/303-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch
similarity index 97%
rename from package/kernel/mac80211/patches/subsys/306-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch
rename to package/kernel/mac80211/patches/subsys/303-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch
index f58d2eb4cb..1ceb2be25c 100644
--- a/package/kernel/mac80211/patches/subsys/306-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch
+++ b/package/kernel/mac80211/patches/subsys/303-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch
@@ -52,7 +52,7 @@ Signed-off-by: Xing Song <xing.song@mediatek.com>
 
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -2941,6 +2941,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+@@ -2948,6 +2948,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
  	if (!fwd_skb)
  		goto out;
  
diff --git a/package/kernel/mac80211/patches/subsys/395-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch b/package/kernel/mac80211/patches/subsys/306-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch
similarity index 84%
rename from package/kernel/mac80211/patches/subsys/395-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch
rename to package/kernel/mac80211/patches/subsys/306-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch
index 1c940d3db2..c43cd3acb9 100644
--- a/package/kernel/mac80211/patches/subsys/395-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch
+++ b/package/kernel/mac80211/patches/subsys/306-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch
@@ -13,7 +13,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -3834,7 +3834,7 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -3820,7 +3820,7 @@ struct ieee80211_txq *ieee80211_next_txq
  {
  	struct ieee80211_local *local = hw_to_local(hw);
  	struct airtime_sched_info *air_sched;
@@ -22,7 +22,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	struct ieee80211_txq *ret = NULL;
  	struct airtime_info *air_info;
  	struct txq_info *txqi = NULL;
-@@ -3961,7 +3961,7 @@ void ieee80211_update_airtime_weight(str
+@@ -3947,7 +3947,7 @@ void ieee80211_update_airtime_weight(str
  	u64 weight_sum = 0;
  
  	if (unlikely(!now))
@@ -31,7 +31,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	lockdep_assert_held(&air_sched->lock);
  
-@@ -3987,7 +3987,7 @@ void ieee80211_schedule_txq(struct ieee8
+@@ -3973,7 +3973,7 @@ void ieee80211_schedule_txq(struct ieee8
  	struct ieee80211_local *local = hw_to_local(hw);
  	struct txq_info *txqi = to_txq_info(txq);
  	struct airtime_sched_info *air_sched;
@@ -40,7 +40,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	struct airtime_info *air_info;
  	u8 ac = txq->ac;
  	bool was_active;
-@@ -4045,7 +4045,7 @@ static void __ieee80211_unschedule_txq(s
+@@ -4031,7 +4031,7 @@ static void __ieee80211_unschedule_txq(s
  
  	if (!purge)
  		airtime_set_active(air_sched, air_info,
@@ -49,7 +49,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	rb_erase_cached(&txqi->schedule_order,
  			&air_sched->active_txqs);
-@@ -4133,7 +4133,7 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4119,7 +4119,7 @@ bool ieee80211_txq_may_transmit(struct i
  	if (RB_EMPTY_NODE(&txqi->schedule_order))
  		goto out;
  
diff --git a/package/kernel/mac80211/patches/subsys/307-mac80211_hwsim-make-6-GHz-channels-usable.patch b/package/kernel/mac80211/patches/subsys/307-mac80211_hwsim-make-6-GHz-channels-usable.patch
new file mode 100644
index 0000000000..fba0912e80
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/307-mac80211_hwsim-make-6-GHz-channels-usable.patch
@@ -0,0 +1,74 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 24 May 2021 11:46:09 +0200
+Subject: [PATCH] mac80211_hwsim: make 6 GHz channels usable
+
+The previous commit that claimed to add 6 GHz channels didn't actually make
+them usable, since the 6 GHz band was not registered with mac80211.
+
+Fixes: 28881922abd7 ("mac80211_hwsim: add 6GHz channels")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3004,15 +3004,19 @@ static void mac80211_hwsim_he_capab(stru
+ {
+ 	u16 n_iftype_data;
+ 
+-	if (sband->band == NL80211_BAND_2GHZ) {
++	switch (sband->band) {
++	case NL80211_BAND_2GHZ:
+ 		n_iftype_data = ARRAY_SIZE(he_capa_2ghz);
+ 		sband->iftype_data =
+ 			(struct ieee80211_sband_iftype_data *)he_capa_2ghz;
+-	} else if (sband->band == NL80211_BAND_5GHZ) {
++		break;
++	case NL80211_BAND_5GHZ:
++	case NL80211_BAND_6GHZ:
+ 		n_iftype_data = ARRAY_SIZE(he_capa_5ghz);
+ 		sband->iftype_data =
+ 			(struct ieee80211_sband_iftype_data *)he_capa_5ghz;
+-	} else {
++		break;
++	default:
+ 		return;
+ 	}
+ 
+@@ -3302,6 +3306,12 @@ static int mac80211_hwsim_new_radio(stru
+ 			sband->vht_cap.vht_mcs.tx_mcs_map =
+ 				sband->vht_cap.vht_mcs.rx_mcs_map;
+ 			break;
++		case NL80211_BAND_6GHZ:
++			sband->channels = data->channels_6ghz;
++			sband->n_channels = ARRAY_SIZE(hwsim_channels_6ghz);
++			sband->bitrates = data->rates + 4;
++			sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
++			break;
+ 		case NL80211_BAND_S1GHZ:
+ 			memcpy(&sband->s1g_cap, &hwsim_s1g_cap,
+ 			       sizeof(sband->s1g_cap));
+@@ -3312,6 +3322,13 @@ static int mac80211_hwsim_new_radio(stru
+ 			continue;
+ 		}
+ 
++		mac80211_hwsim_he_capab(sband);
++
++		hw->wiphy->bands[band] = sband;
++
++		if (band == NL80211_BAND_6GHZ)
++			continue;
++
+ 		sband->ht_cap.ht_supported = true;
+ 		sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+ 				    IEEE80211_HT_CAP_GRN_FLD |
+@@ -3325,10 +3342,6 @@ static int mac80211_hwsim_new_radio(stru
+ 		sband->ht_cap.mcs.rx_mask[0] = 0xff;
+ 		sband->ht_cap.mcs.rx_mask[1] = 0xff;
+ 		sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+-
+-		mac80211_hwsim_he_capab(sband);
+-
+-		hw->wiphy->bands[band] = sband;
+ 	}
+ 
+ 	/* By default all radios belong to the first group */
diff --git a/package/kernel/mac80211/patches/subsys/308-mac80211-add-support-for-.ndo_fill_forward_path.patch b/package/kernel/mac80211/patches/subsys/308-mac80211-add-support-for-.ndo_fill_forward_path.patch
new file mode 100644
index 0000000000..4b9d874cfe
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/308-mac80211-add-support-for-.ndo_fill_forward_path.patch
@@ -0,0 +1,178 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 12 Nov 2021 12:22:23 +0100
+Subject: [PATCH] mac80211: add support for .ndo_fill_forward_path
+
+This allows drivers to provide a destination device + info for flow offload
+Only supported in combination with 802.3 encap offload
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Tested-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/20211112112223.1209-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -3937,6 +3937,8 @@ struct ieee80211_prep_tx_info {
+  *	twt structure.
+  * @twt_teardown_request: Update the hw with TWT teardown request received
+  *	from the peer.
++ * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
++ *	resolve a path for hardware flow offloading
+  */
+ struct ieee80211_ops {
+ 	void (*tx)(struct ieee80211_hw *hw,
+@@ -4265,6 +4267,13 @@ struct ieee80211_ops {
+ 			      struct ieee80211_twt_setup *twt);
+ 	void (*twt_teardown_request)(struct ieee80211_hw *hw,
+ 				     struct ieee80211_sta *sta, u8 flowid);
++#if LINUX_VERSION_IS_GEQ(5,10,0)
++	int (*net_fill_forward_path)(struct ieee80211_hw *hw,
++				     struct ieee80211_vif *vif,
++				     struct ieee80211_sta *sta,
++				     struct net_device_path_ctx *ctx,
++				     struct net_device_path *path);
++#endif
+ };
+ 
+ /**
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1486,4 +1486,28 @@ static inline void drv_twt_teardown_requ
+ 	trace_drv_return_void(local);
+ }
+ 
++#if LINUX_VERSION_IS_GEQ(5,10,0)
++static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
++					    struct ieee80211_sub_if_data *sdata,
++					    struct ieee80211_sta *sta,
++					    struct net_device_path_ctx *ctx,
++					    struct net_device_path *path)
++{
++	int ret = -EOPNOTSUPP;
++
++	sdata = get_bss_sdata(sdata);
++	if (!check_sdata_in_driver(sdata))
++		return -EIO;
++
++	trace_drv_net_fill_forward_path(local, sdata, sta);
++	if (local->ops->net_fill_forward_path)
++		ret = local->ops->net_fill_forward_path(&local->hw,
++							&sdata->vif, sta,
++							ctx, path);
++	trace_drv_return_int(local, ret);
++
++	return ret;
++}
++#endif
++
+ #endif /* __MAC80211_DRIVER_OPS */
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1490,7 +1490,7 @@ struct ieee80211_local {
+ };
+ 
+ static inline struct ieee80211_sub_if_data *
+-IEEE80211_DEV_TO_SUB_IF(struct net_device *dev)
++IEEE80211_DEV_TO_SUB_IF(const struct net_device *dev)
+ {
+ 	return netdev_priv(dev);
+ }
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -822,6 +822,66 @@ static const struct net_device_ops ieee8
+ 
+ };
+ 
++#if LINUX_VERSION_IS_GEQ(5,10,0)
++static int ieee80211_netdev_fill_forward_path(struct net_device_path_ctx *ctx,
++					      struct net_device_path *path)
++{
++	struct ieee80211_sub_if_data *sdata;
++	struct ieee80211_local *local;
++	struct sta_info *sta;
++	int ret = -ENOENT;
++
++	sdata = IEEE80211_DEV_TO_SUB_IF(ctx->dev);
++	local = sdata->local;
++
++	if (!local->ops->net_fill_forward_path)
++		return -EOPNOTSUPP;
++
++	rcu_read_lock();
++	switch (sdata->vif.type) {
++	case NL80211_IFTYPE_AP_VLAN:
++		sta = rcu_dereference(sdata->u.vlan.sta);
++		if (sta)
++			break;
++		if (sdata->wdev.use_4addr)
++			goto out;
++		if (is_multicast_ether_addr(ctx->daddr))
++			goto out;
++		sta = sta_info_get_bss(sdata, ctx->daddr);
++		break;
++	case NL80211_IFTYPE_AP:
++		if (is_multicast_ether_addr(ctx->daddr))
++			goto out;
++		sta = sta_info_get(sdata, ctx->daddr);
++		break;
++	case NL80211_IFTYPE_STATION:
++		if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) {
++			sta = sta_info_get(sdata, ctx->daddr);
++			if (sta && test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
++				if (!test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH))
++					goto out;
++
++				break;
++			}
++		}
++
++		sta = sta_info_get(sdata, sdata->u.mgd.bssid);
++		break;
++	default:
++		goto out;
++	}
++
++	if (!sta)
++		goto out;
++
++	ret = drv_net_fill_forward_path(local, sdata, &sta->sta, ctx, path);
++out:
++	rcu_read_unlock();
++
++	return ret;
++}
++#endif
++
+ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+ #if LINUX_VERSION_IS_LESS(4,10,0)
+ 	.ndo_change_mtu = __change_mtu,
+@@ -839,7 +899,9 @@ static const struct net_device_ops ieee8
+ #else
+ 	.ndo_get_stats64 = bp_ieee80211_get_stats64,
+ #endif
+-
++#if LINUX_VERSION_IS_GEQ(5,10,0)
++	.ndo_fill_forward_path = ieee80211_netdev_fill_forward_path,
++#endif
+ };
+ 
+ static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -2892,6 +2892,15 @@ TRACE_EVENT(drv_twt_teardown_request,
+ 	)
+ );
+ 
++#if LINUX_VERSION_IS_GEQ(5,10,0)
++DEFINE_EVENT(sta_event, drv_net_fill_forward_path,
++	TP_PROTO(struct ieee80211_local *local,
++		 struct ieee80211_sub_if_data *sdata,
++		 struct ieee80211_sta *sta),
++	TP_ARGS(local, sdata, sta)
++);
++#endif
++
+ #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
+ 
+ #undef TRACE_INCLUDE_PATH
diff --git a/package/kernel/mac80211/patches/subsys/353-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch b/package/kernel/mac80211/patches/subsys/309-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
similarity index 100%
rename from package/kernel/mac80211/patches/subsys/353-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
rename to package/kernel/mac80211/patches/subsys/309-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
diff --git a/package/kernel/mac80211/patches/subsys/354-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch b/package/kernel/mac80211/patches/subsys/310-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
similarity index 94%
rename from package/kernel/mac80211/patches/subsys/354-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
rename to package/kernel/mac80211/patches/subsys/310-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
index 16bcbc2ef9..3be43b8782 100644
--- a/package/kernel/mac80211/patches/subsys/354-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
+++ b/package/kernel/mac80211/patches/subsys/310-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
@@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/rc80211_minstrel_ht.c
 +++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -700,7 +700,8 @@ minstrel_ht_calc_rate_stats(struct minst
+@@ -703,7 +703,8 @@ minstrel_ht_calc_rate_stats(struct minst
  	unsigned int cur_prob;
  
  	if (unlikely(mrs->attempts > 0)) {
diff --git a/package/kernel/mac80211/patches/subsys/310-net-fq_impl-bulk-free-packets-from-a-flow-on-overmem.patch b/package/kernel/mac80211/patches/subsys/310-net-fq_impl-bulk-free-packets-from-a-flow-on-overmem.patch
deleted file mode 100644
index 05a888006e..0000000000
--- a/package/kernel/mac80211/patches/subsys/310-net-fq_impl-bulk-free-packets-from-a-flow-on-overmem.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 25 Nov 2020 18:03:46 +0100
-Subject: [PATCH] net/fq_impl: bulk-free packets from a flow on overmemory
-
-This is similar to what sch_fq_codel does. It also amortizes the worst
-case cost of a follow-up patch that changes the selection of the biggest
-flow for dropping packets
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/include/net/fq_impl.h
-+++ b/include/net/fq_impl.h
-@@ -11,17 +11,25 @@
- 
- /* functions that are embedded into includer */
- 
-+
-+static void
-+__fq_adjust_removal(struct fq *fq, struct fq_flow *flow, unsigned int packets,
-+		    unsigned int bytes, unsigned int truesize)
-+{
-+	struct fq_tin *tin = flow->tin;
-+
-+	tin->backlog_bytes -= bytes;
-+	tin->backlog_packets -= packets;
-+	flow->backlog -= bytes;
-+	fq->backlog -= packets;
-+	fq->memory_usage -= truesize;
-+}
-+
- static void fq_adjust_removal(struct fq *fq,
- 			      struct fq_flow *flow,
- 			      struct sk_buff *skb)
- {
--	struct fq_tin *tin = flow->tin;
--
--	tin->backlog_bytes -= skb->len;
--	tin->backlog_packets--;
--	flow->backlog -= skb->len;
--	fq->backlog--;
--	fq->memory_usage -= skb->truesize;
-+	__fq_adjust_removal(fq, flow, 1, skb->len, skb->truesize);
- }
- 
- static void fq_rejigger_backlog(struct fq *fq, struct fq_flow *flow)
-@@ -59,6 +67,34 @@ static struct sk_buff *fq_flow_dequeue(s
- 	return skb;
- }
- 
-+static int fq_flow_drop(struct fq *fq, struct fq_flow *flow,
-+			fq_skb_free_t free_func)
-+{
-+	unsigned int packets = 0, bytes = 0, truesize = 0;
-+	struct fq_tin *tin = flow->tin;
-+	struct sk_buff *skb;
-+	int pending;
-+
-+	lockdep_assert_held(&fq->lock);
-+
-+	pending = min_t(int, 32, skb_queue_len(&flow->queue) / 2);
-+	do {
-+		skb = __skb_dequeue(&flow->queue);
-+		if (!skb)
-+			break;
-+
-+		packets++;
-+		bytes += skb->len;
-+		truesize += skb->truesize;
-+		free_func(fq, tin, flow, skb);
-+	} while (packets < pending);
-+
-+	__fq_adjust_removal(fq, flow, packets, bytes, truesize);
-+	fq_rejigger_backlog(fq, flow);
-+
-+	return packets;
-+}
-+
- static struct sk_buff *fq_tin_dequeue(struct fq *fq,
- 				      struct fq_tin *tin,
- 				      fq_tin_dequeue_t dequeue_func)
-@@ -190,12 +226,9 @@ static void fq_tin_enqueue(struct fq *fq
- 		if (!flow)
- 			return;
- 
--		skb = fq_flow_dequeue(fq, flow);
--		if (!skb)
-+		if (!fq_flow_drop(fq, flow, free_func))
- 			return;
- 
--		free_func(fq, flow->tin, flow, skb);
--
- 		flow->tin->overlimit++;
- 		fq->overlimit++;
- 		if (oom) {
diff --git a/package/kernel/mac80211/patches/subsys/355-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch b/package/kernel/mac80211/patches/subsys/311-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
similarity index 90%
rename from package/kernel/mac80211/patches/subsys/355-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
rename to package/kernel/mac80211/patches/subsys/311-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
index aec2e07781..13bed48ec6 100644
--- a/package/kernel/mac80211/patches/subsys/355-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
+++ b/package/kernel/mac80211/patches/subsys/311-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
@@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/rc80211_minstrel_ht.c
 +++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -511,6 +511,14 @@ minstrel_ht_set_best_prob_rate(struct mi
+@@ -514,6 +514,14 @@ minstrel_ht_set_best_prob_rate(struct mi
  	int cur_tp_avg, cur_group, cur_idx;
  	int max_gpr_group, max_gpr_idx;
  	int max_gpr_tp_avg, max_gpr_prob;
@@ -33,7 +33,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	cur_group = MI_RATE_GROUP(index);
  	cur_idx = MI_RATE_IDX(index);
-@@ -532,11 +540,6 @@ minstrel_ht_set_best_prob_rate(struct mi
+@@ -535,11 +543,6 @@ minstrel_ht_set_best_prob_rate(struct mi
  	    !minstrel_ht_is_legacy_group(max_tp_group))
  		return;
  
@@ -45,7 +45,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	max_gpr_group = MI_RATE_GROUP(mg->max_group_prob_rate);
  	max_gpr_idx = MI_RATE_IDX(mg->max_group_prob_rate);
  	max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_avg;
-@@ -594,40 +597,6 @@ minstrel_ht_assign_best_tp_rates(struct
+@@ -597,40 +600,6 @@ minstrel_ht_assign_best_tp_rates(struct
  
  }
  
@@ -86,7 +86,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static u16
  __minstrel_ht_get_sample_rate(struct minstrel_ht_sta *mi,
  			      enum minstrel_sample_type type)
-@@ -1111,8 +1080,6 @@ minstrel_ht_update_stats(struct minstrel
+@@ -1110,8 +1079,6 @@ minstrel_ht_update_stats(struct minstrel
  
  	mi->max_prob_rate = tmp_max_prob_rate;
  
@@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	minstrel_ht_refill_sample_rates(mi);
  
  #ifdef CPTCFG_MAC80211_DEBUGFS
-@@ -1157,7 +1124,7 @@ minstrel_ht_txstat_valid(struct minstrel
+@@ -1156,7 +1123,7 @@ minstrel_ht_txstat_valid(struct minstrel
  }
  
  static void
@@ -104,7 +104,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  {
  	int group, orig_group;
  
-@@ -1172,11 +1139,7 @@ minstrel_downgrade_rate(struct minstrel_
+@@ -1171,11 +1138,7 @@ minstrel_downgrade_rate(struct minstrel_
  		    minstrel_mcs_groups[orig_group].streams)
  			continue;
  
@@ -117,7 +117,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}
  }
  
-@@ -1210,7 +1173,7 @@ minstrel_ht_tx_status(void *priv, struct
+@@ -1186,7 +1149,7 @@ minstrel_ht_tx_status(void *priv, struct
  	struct ieee80211_tx_info *info = st->info;
  	struct minstrel_ht_sta *mi = priv_sta;
  	struct ieee80211_tx_rate *ar = info->status.rates;
@@ -126,7 +126,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	struct minstrel_priv *mp = priv;
  	u32 update_interval = mp->update_interval;
  	bool last, update = false;
-@@ -1256,18 +1219,13 @@ minstrel_ht_tx_status(void *priv, struct
+@@ -1236,18 +1199,13 @@ minstrel_ht_tx_status(void *priv, struct
  		/*
  		 * check for sudden death of spatial multiplexing,
  		 * downgrade to a lower number of streams if necessary.
diff --git a/package/kernel/mac80211/patches/subsys/311-net-fq_impl-drop-get_default_func-move-default-flow-.patch b/package/kernel/mac80211/patches/subsys/311-net-fq_impl-drop-get_default_func-move-default-flow-.patch
deleted file mode 100644
index 9ff376a022..0000000000
--- a/package/kernel/mac80211/patches/subsys/311-net-fq_impl-drop-get_default_func-move-default-flow-.patch
+++ /dev/null
@@ -1,144 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 25 Nov 2020 18:09:10 +0100
-Subject: [PATCH] net/fq_impl: drop get_default_func, move default flow to
- fq_tin
-
-Simplifies the code and prepares for a rework of scanning for flows on
-overmemory drop.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/include/net/fq.h
-+++ b/include/net/fq.h
-@@ -47,6 +47,7 @@ struct fq_flow {
- struct fq_tin {
- 	struct list_head new_flows;
- 	struct list_head old_flows;
-+	struct fq_flow default_flow;
- 	u32 backlog_bytes;
- 	u32 backlog_packets;
- 	u32 overlimit;
---- a/include/net/fq_impl.h
-+++ b/include/net/fq_impl.h
-@@ -151,8 +151,7 @@ static u32 fq_flow_idx(struct fq *fq, st
- 
- static struct fq_flow *fq_flow_classify(struct fq *fq,
- 					struct fq_tin *tin, u32 idx,
--					struct sk_buff *skb,
--					fq_flow_get_default_t get_default_func)
-+					struct sk_buff *skb)
- {
- 	struct fq_flow *flow;
- 
-@@ -160,7 +159,7 @@ static struct fq_flow *fq_flow_classify(
- 
- 	flow = &fq->flows[idx];
- 	if (flow->tin && flow->tin != tin) {
--		flow = get_default_func(fq, tin, idx, skb);
-+		flow = &tin->default_flow;
- 		tin->collisions++;
- 		fq->collisions++;
- 	}
-@@ -192,15 +191,14 @@ static void fq_recalc_backlog(struct fq
- static void fq_tin_enqueue(struct fq *fq,
- 			   struct fq_tin *tin, u32 idx,
- 			   struct sk_buff *skb,
--			   fq_skb_free_t free_func,
--			   fq_flow_get_default_t get_default_func)
-+			   fq_skb_free_t free_func)
- {
- 	struct fq_flow *flow;
- 	bool oom;
- 
- 	lockdep_assert_held(&fq->lock);
- 
--	flow = fq_flow_classify(fq, tin, idx, skb, get_default_func);
-+	flow = fq_flow_classify(fq, tin, idx, skb);
- 
- 	flow->tin = tin;
- 	flow->backlog += skb->len;
-@@ -331,6 +329,7 @@ static void fq_tin_init(struct fq_tin *t
- {
- 	INIT_LIST_HEAD(&tin->new_flows);
- 	INIT_LIST_HEAD(&tin->old_flows);
-+	fq_flow_init(&tin->default_flow);
- }
- 
- static int fq_init(struct fq *fq, int flows_cnt)
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -846,7 +846,6 @@ enum txq_info_flags {
-  */
- struct txq_info {
- 	struct fq_tin tin;
--	struct fq_flow def_flow;
- 	struct codel_vars def_cvars;
- 	struct codel_stats cstats;
- 	struct sk_buff_head frags;
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1322,7 +1322,7 @@ static struct sk_buff *codel_dequeue_fun
- 	fq = &local->fq;
- 
- 	if (cvars == &txqi->def_cvars)
--		flow = &txqi->def_flow;
-+		flow = &txqi->tin.default_flow;
- 	else
- 		flow = &fq->flows[cvars - local->cvars];
- 
-@@ -1365,7 +1365,7 @@ static struct sk_buff *fq_tin_dequeue_fu
- 		cparams = &local->cparams;
- 	}
- 
--	if (flow == &txqi->def_flow)
-+	if (flow == &tin->default_flow)
- 		cvars = &txqi->def_cvars;
- 	else
- 		cvars = &local->cvars[flow - fq->flows];
-@@ -1392,17 +1392,6 @@ static void fq_skb_free_func(struct fq *
- 	ieee80211_free_txskb(&local->hw, skb);
- }
- 
--static struct fq_flow *fq_flow_get_default_func(struct fq *fq,
--						struct fq_tin *tin,
--						int idx,
--						struct sk_buff *skb)
--{
--	struct txq_info *txqi;
--
--	txqi = container_of(tin, struct txq_info, tin);
--	return &txqi->def_flow;
--}
--
- static void ieee80211_txq_enqueue(struct ieee80211_local *local,
- 				  struct txq_info *txqi,
- 				  struct sk_buff *skb)
-@@ -1415,8 +1404,7 @@ static void ieee80211_txq_enqueue(struct
- 
- 	spin_lock_bh(&fq->lock);
- 	fq_tin_enqueue(fq, tin, flow_idx, skb,
--		       fq_skb_free_func,
--		       fq_flow_get_default_func);
-+		       fq_skb_free_func);
- 	spin_unlock_bh(&fq->lock);
- }
- 
-@@ -1459,7 +1447,6 @@ void ieee80211_txq_init(struct ieee80211
- 			struct txq_info *txqi, int tid)
- {
- 	fq_tin_init(&txqi->tin);
--	fq_flow_init(&txqi->def_flow);
- 	codel_vars_init(&txqi->def_cvars);
- 	codel_stats_init(&txqi->cstats);
- 	__skb_queue_head_init(&txqi->frags);
-@@ -3336,8 +3323,7 @@ static bool ieee80211_amsdu_aggregate(st
- 	 */
- 
- 	tin = &txqi->tin;
--	flow = fq_flow_classify(fq, tin, flow_idx, skb,
--				fq_flow_get_default_func);
-+	flow = fq_flow_classify(fq, tin, flow_idx, skb);
- 	head = skb_peek_tail(&flow->queue);
- 	if (!head || skb_is_gso(head))
- 		goto out;
diff --git a/package/kernel/mac80211/patches/subsys/312-mac80211-split-beacon-retrieval-functions.patch b/package/kernel/mac80211/patches/subsys/312-mac80211-split-beacon-retrieval-functions.patch
new file mode 100644
index 0000000000..18b1951f6e
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/312-mac80211-split-beacon-retrieval-functions.patch
@@ -0,0 +1,262 @@
+From: Aloka Dixit <alokad@codeaurora.org>
+Date: Tue, 5 Oct 2021 21:09:36 -0700
+Subject: [PATCH] mac80211: split beacon retrieval functions
+
+Split __ieee80211_beacon_get() into a separate function for AP mode
+ieee80211_beacon_get_ap().
+Also, move the code common to all modes (AP, adhoc and mesh) to
+a separate function ieee80211_beacon_get_finish().
+
+Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
+Link: https://lore.kernel.org/r/20211006040938.9531-2-alokad@codeaurora.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4987,6 +4987,115 @@ static int ieee80211_beacon_protect(stru
+ 	return 0;
+ }
+ 
++static void
++ieee80211_beacon_get_finish(struct ieee80211_hw *hw,
++			    struct ieee80211_vif *vif,
++			    struct ieee80211_mutable_offsets *offs,
++			    struct beacon_data *beacon,
++			    struct sk_buff *skb,
++			    struct ieee80211_chanctx_conf *chanctx_conf,
++			    u16 csa_off_base)
++{
++	struct ieee80211_local *local = hw_to_local(hw);
++	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
++	struct ieee80211_tx_info *info;
++	enum nl80211_band band;
++	struct ieee80211_tx_rate_control txrc;
++
++	/* CSA offsets */
++	if (offs && beacon) {
++		u16 i;
++
++		for (i = 0; i < IEEE80211_MAX_CNTDWN_COUNTERS_NUM; i++) {
++			u16 csa_off = beacon->cntdwn_counter_offsets[i];
++
++			if (!csa_off)
++				continue;
++
++			offs->cntdwn_counter_offs[i] = csa_off_base + csa_off;
++		}
++	}
++
++	band = chanctx_conf->def.chan->band;
++	info = IEEE80211_SKB_CB(skb);
++	info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
++	info->flags |= IEEE80211_TX_CTL_NO_ACK;
++	info->band = band;
++
++	memset(&txrc, 0, sizeof(txrc));
++	txrc.hw = hw;
++	txrc.sband = local->hw.wiphy->bands[band];
++	txrc.bss_conf = &sdata->vif.bss_conf;
++	txrc.skb = skb;
++	txrc.reported_rate.idx = -1;
++	if (sdata->beacon_rate_set && sdata->beacon_rateidx_mask[band])
++		txrc.rate_idx_mask = sdata->beacon_rateidx_mask[band];
++	else
++		txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
++	txrc.bss = true;
++	rate_control_get_rate(sdata, NULL, &txrc);
++
++	info->control.vif = vif;
++	info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT |
++		       IEEE80211_TX_CTL_ASSIGN_SEQ |
++		       IEEE80211_TX_CTL_FIRST_FRAGMENT;
++}
++
++static struct sk_buff *
++ieee80211_beacon_get_ap(struct ieee80211_hw *hw,
++			struct ieee80211_vif *vif,
++			struct ieee80211_mutable_offsets *offs,
++			bool is_template,
++			struct beacon_data *beacon,
++			struct ieee80211_chanctx_conf *chanctx_conf)
++{
++	struct ieee80211_local *local = hw_to_local(hw);
++	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
++	struct ieee80211_if_ap *ap = &sdata->u.ap;
++	struct sk_buff *skb = NULL;
++	u16 csa_off_base = 0;
++
++	if (beacon->cntdwn_counter_offsets[0]) {
++		if (!is_template)
++			ieee80211_beacon_update_cntdwn(vif);
++
++		ieee80211_set_beacon_cntdwn(sdata, beacon);
++	}
++
++	/* headroom, head length,
++	 * tail length and maximum TIM length
++	 */
++	skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
++			    beacon->tail_len + 256 +
++			    local->hw.extra_beacon_tailroom);
++	if (!skb)
++		return NULL;
++
++	skb_reserve(skb, local->tx_headroom);
++	skb_put_data(skb, beacon->head, beacon->head_len);
++
++	ieee80211_beacon_add_tim(sdata, &ap->ps, skb, is_template);
++
++	if (offs) {
++		offs->tim_offset = beacon->head_len;
++		offs->tim_length = skb->len - beacon->head_len;
++		offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
++
++		/* for AP the csa offsets are from tail */
++		csa_off_base = skb->len;
++	}
++
++	if (beacon->tail)
++		skb_put_data(skb, beacon->tail, beacon->tail_len);
++
++	if (ieee80211_beacon_protect(skb, local, sdata) < 0)
++		return NULL;
++
++	ieee80211_beacon_get_finish(hw, vif, offs, beacon, skb, chanctx_conf,
++				    csa_off_base);
++	return skb;
++}
++
+ static struct sk_buff *
+ __ieee80211_beacon_get(struct ieee80211_hw *hw,
+ 		       struct ieee80211_vif *vif,
+@@ -4996,12 +5105,8 @@ __ieee80211_beacon_get(struct ieee80211_
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct beacon_data *beacon = NULL;
+ 	struct sk_buff *skb = NULL;
+-	struct ieee80211_tx_info *info;
+ 	struct ieee80211_sub_if_data *sdata = NULL;
+-	enum nl80211_band band;
+-	struct ieee80211_tx_rate_control txrc;
+ 	struct ieee80211_chanctx_conf *chanctx_conf;
+-	int csa_off_base = 0;
+ 
+ 	rcu_read_lock();
+ 
+@@ -5018,48 +5123,11 @@ __ieee80211_beacon_get(struct ieee80211_
+ 		struct ieee80211_if_ap *ap = &sdata->u.ap;
+ 
+ 		beacon = rcu_dereference(ap->beacon);
+-		if (beacon) {
+-			if (beacon->cntdwn_counter_offsets[0]) {
+-				if (!is_template)
+-					ieee80211_beacon_update_cntdwn(vif);
+-
+-				ieee80211_set_beacon_cntdwn(sdata, beacon);
+-			}
+-
+-			/*
+-			 * headroom, head length,
+-			 * tail length and maximum TIM length
+-			 */
+-			skb = dev_alloc_skb(local->tx_headroom +
+-					    beacon->head_len +
+-					    beacon->tail_len + 256 +
+-					    local->hw.extra_beacon_tailroom);
+-			if (!skb)
+-				goto out;
+-
+-			skb_reserve(skb, local->tx_headroom);
+-			skb_put_data(skb, beacon->head, beacon->head_len);
+-
+-			ieee80211_beacon_add_tim(sdata, &ap->ps, skb,
+-						 is_template);
+-
+-			if (offs) {
+-				offs->tim_offset = beacon->head_len;
+-				offs->tim_length = skb->len - beacon->head_len;
+-				offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
+-
+-				/* for AP the csa offsets are from tail */
+-				csa_off_base = skb->len;
+-			}
+-
+-			if (beacon->tail)
+-				skb_put_data(skb, beacon->tail,
+-					     beacon->tail_len);
+-
+-			if (ieee80211_beacon_protect(skb, local, sdata) < 0)
+-				goto out;
+-		} else
++		if (!beacon)
+ 			goto out;
++
++		skb = ieee80211_beacon_get_ap(hw, vif, offs, is_template,
++					      beacon, chanctx_conf);
+ 	} else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+ 		struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+ 		struct ieee80211_hdr *hdr;
+@@ -5085,6 +5153,9 @@ __ieee80211_beacon_get(struct ieee80211_
+ 		hdr = (struct ieee80211_hdr *) skb->data;
+ 		hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+ 						 IEEE80211_STYPE_BEACON);
++
++		ieee80211_beacon_get_finish(hw, vif, offs, beacon, skb,
++					    chanctx_conf, 0);
+ 	} else if (ieee80211_vif_is_mesh(&sdata->vif)) {
+ 		struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+ 
+@@ -5124,51 +5195,13 @@ __ieee80211_beacon_get(struct ieee80211_
+ 		}
+ 
+ 		skb_put_data(skb, beacon->tail, beacon->tail_len);
++		ieee80211_beacon_get_finish(hw, vif, offs, beacon, skb,
++					    chanctx_conf, 0);
+ 	} else {
+ 		WARN_ON(1);
+ 		goto out;
+ 	}
+ 
+-	/* CSA offsets */
+-	if (offs && beacon) {
+-		int i;
+-
+-		for (i = 0; i < IEEE80211_MAX_CNTDWN_COUNTERS_NUM; i++) {
+-			u16 csa_off = beacon->cntdwn_counter_offsets[i];
+-
+-			if (!csa_off)
+-				continue;
+-
+-			offs->cntdwn_counter_offs[i] = csa_off_base + csa_off;
+-		}
+-	}
+-
+-	band = chanctx_conf->def.chan->band;
+-
+-	info = IEEE80211_SKB_CB(skb);
+-
+-	info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+-	info->flags |= IEEE80211_TX_CTL_NO_ACK;
+-	info->band = band;
+-
+-	memset(&txrc, 0, sizeof(txrc));
+-	txrc.hw = hw;
+-	txrc.sband = local->hw.wiphy->bands[band];
+-	txrc.bss_conf = &sdata->vif.bss_conf;
+-	txrc.skb = skb;
+-	txrc.reported_rate.idx = -1;
+-	if (sdata->beacon_rate_set && sdata->beacon_rateidx_mask[band])
+-		txrc.rate_idx_mask = sdata->beacon_rateidx_mask[band];
+-	else
+-		txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
+-	txrc.bss = true;
+-	rate_control_get_rate(sdata, NULL, &txrc);
+-
+-	info->control.vif = vif;
+-
+-	info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT |
+-			IEEE80211_TX_CTL_ASSIGN_SEQ |
+-			IEEE80211_TX_CTL_FIRST_FRAGMENT;
+  out:
+ 	rcu_read_unlock();
+ 	return skb;
diff --git a/package/kernel/mac80211/patches/subsys/312-net-fq_impl-do-not-maintain-a-backlog-sorted-list-of.patch b/package/kernel/mac80211/patches/subsys/312-net-fq_impl-do-not-maintain-a-backlog-sorted-list-of.patch
deleted file mode 100644
index 1d7bbee400..0000000000
--- a/package/kernel/mac80211/patches/subsys/312-net-fq_impl-do-not-maintain-a-backlog-sorted-list-of.patch
+++ /dev/null
@@ -1,317 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 25 Nov 2020 18:10:34 +0100
-Subject: [PATCH] net/fq_impl: do not maintain a backlog-sorted list of
- flows
-
-A sorted flow list is only needed to drop packets in the biggest flow when
-hitting the overmemory condition.
-By scanning flows only when needed, we can avoid paying the cost of
-maintaining the list under normal conditions
-In order to avoid scanning lots of empty flows and touching too many cold
-cache lines, a bitmap of flows with backlog is maintained
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/include/net/fq.h
-+++ b/include/net/fq.h
-@@ -19,8 +19,6 @@ struct fq_tin;
-  * @flowchain: can be linked to fq_tin's new_flows or old_flows. Used for DRR++
-  *	(deficit round robin) based round robin queuing similar to the one
-  *	found in net/sched/sch_fq_codel.c
-- * @backlogchain: can be linked to other fq_flow and fq. Used to keep track of
-- *	fat flows and efficient head-dropping if packet limit is reached
-  * @queue: sk_buff queue to hold packets
-  * @backlog: number of bytes pending in the queue. The number of packets can be
-  *	found in @queue.qlen
-@@ -29,7 +27,6 @@ struct fq_tin;
- struct fq_flow {
- 	struct fq_tin *tin;
- 	struct list_head flowchain;
--	struct list_head backlogchain;
- 	struct sk_buff_head queue;
- 	u32 backlog;
- 	int deficit;
-@@ -47,6 +44,7 @@ struct fq_flow {
- struct fq_tin {
- 	struct list_head new_flows;
- 	struct list_head old_flows;
-+	struct list_head tin_list;
- 	struct fq_flow default_flow;
- 	u32 backlog_bytes;
- 	u32 backlog_packets;
-@@ -60,14 +58,14 @@ struct fq_tin {
- /**
-  * struct fq - main container for fair queuing purposes
-  *
-- * @backlogs: linked to fq_flows. Used to maintain fat flows for efficient
-- *	head-dropping when @backlog reaches @limit
-  * @limit: max number of packets that can be queued across all flows
-  * @backlog: number of packets queued across all flows
-  */
- struct fq {
- 	struct fq_flow *flows;
--	struct list_head backlogs;
-+	unsigned long *flows_bitmap;
-+
-+	struct list_head tin_backlog;
- 	spinlock_t lock;
- 	u32 flows_cnt;
- 	u32 limit;
---- a/include/net/fq_impl.h
-+++ b/include/net/fq_impl.h
-@@ -17,12 +17,24 @@ __fq_adjust_removal(struct fq *fq, struc
- 		    unsigned int bytes, unsigned int truesize)
- {
- 	struct fq_tin *tin = flow->tin;
-+	int idx;
- 
- 	tin->backlog_bytes -= bytes;
- 	tin->backlog_packets -= packets;
- 	flow->backlog -= bytes;
- 	fq->backlog -= packets;
- 	fq->memory_usage -= truesize;
-+
-+	if (flow->backlog)
-+		return;
-+
-+	if (flow == &tin->default_flow) {
-+		list_del_init(&tin->tin_list);
-+		return;
-+	}
-+
-+	idx = flow - fq->flows;
-+	__clear_bit(idx, fq->flows_bitmap);
- }
- 
- static void fq_adjust_removal(struct fq *fq,
-@@ -32,24 +44,6 @@ static void fq_adjust_removal(struct fq
- 	__fq_adjust_removal(fq, flow, 1, skb->len, skb->truesize);
- }
- 
--static void fq_rejigger_backlog(struct fq *fq, struct fq_flow *flow)
--{
--	struct fq_flow *i;
--
--	if (flow->backlog == 0) {
--		list_del_init(&flow->backlogchain);
--	} else {
--		i = flow;
--
--		list_for_each_entry_continue(i, &fq->backlogs, backlogchain)
--			if (i->backlog < flow->backlog)
--				break;
--
--		list_move_tail(&flow->backlogchain,
--			       &i->backlogchain);
--	}
--}
--
- static struct sk_buff *fq_flow_dequeue(struct fq *fq,
- 				       struct fq_flow *flow)
- {
-@@ -62,7 +56,6 @@ static struct sk_buff *fq_flow_dequeue(s
- 		return NULL;
- 
- 	fq_adjust_removal(fq, flow, skb);
--	fq_rejigger_backlog(fq, flow);
- 
- 	return skb;
- }
-@@ -90,7 +83,6 @@ static int fq_flow_drop(struct fq *fq, s
- 	} while (packets < pending);
- 
- 	__fq_adjust_removal(fq, flow, packets, bytes, truesize);
--	fq_rejigger_backlog(fq, flow);
- 
- 	return packets;
- }
-@@ -170,22 +162,36 @@ static struct fq_flow *fq_flow_classify(
- 	return flow;
- }
- 
--static void fq_recalc_backlog(struct fq *fq,
--			      struct fq_tin *tin,
--			      struct fq_flow *flow)
--{
--	struct fq_flow *i;
--
--	if (list_empty(&flow->backlogchain))
--		list_add_tail(&flow->backlogchain, &fq->backlogs);
--
--	i = flow;
--	list_for_each_entry_continue_reverse(i, &fq->backlogs,
--					     backlogchain)
--		if (i->backlog > flow->backlog)
--			break;
-+static struct fq_flow *fq_find_fattest_flow(struct fq *fq)
-+{
-+	struct fq_tin *tin;
-+	struct fq_flow *flow = NULL;
-+	u32 len = 0;
-+	int i;
-+
-+	for_each_set_bit(i, fq->flows_bitmap, fq->flows_cnt) {
-+		struct fq_flow *cur = &fq->flows[i];
-+		unsigned int cur_len;
-+
-+		cur_len = cur->backlog;
-+		if (cur_len <= len)
-+			continue;
-+
-+		flow = cur;
-+		len = cur_len;
-+	}
- 
--	list_move(&flow->backlogchain, &i->backlogchain);
-+	list_for_each_entry(tin, &fq->tin_backlog, tin_list) {
-+		unsigned int cur_len = tin->default_flow.backlog;
-+
-+		if (cur_len <= len)
-+			continue;
-+
-+		flow = &tin->default_flow;
-+		len = cur_len;
-+	}
-+
-+	return flow;
- }
- 
- static void fq_tin_enqueue(struct fq *fq,
-@@ -200,6 +206,13 @@ static void fq_tin_enqueue(struct fq *fq
- 
- 	flow = fq_flow_classify(fq, tin, idx, skb);
- 
-+	if (!flow->backlog) {
-+		if (flow != &tin->default_flow)
-+			__set_bit(idx, fq->flows_bitmap);
-+		else if (list_empty(&tin->tin_list))
-+			list_add(&tin->tin_list, &fq->tin_backlog);
-+	}
-+
- 	flow->tin = tin;
- 	flow->backlog += skb->len;
- 	tin->backlog_bytes += skb->len;
-@@ -207,8 +220,6 @@ static void fq_tin_enqueue(struct fq *fq
- 	fq->memory_usage += skb->truesize;
- 	fq->backlog++;
- 
--	fq_recalc_backlog(fq, tin, flow);
--
- 	if (list_empty(&flow->flowchain)) {
- 		flow->deficit = fq->quantum;
- 		list_add_tail(&flow->flowchain,
-@@ -218,9 +229,7 @@ static void fq_tin_enqueue(struct fq *fq
- 	__skb_queue_tail(&flow->queue, skb);
- 	oom = (fq->memory_usage > fq->memory_limit);
- 	while (fq->backlog > fq->limit || oom) {
--		flow = list_first_entry_or_null(&fq->backlogs,
--						struct fq_flow,
--						backlogchain);
-+		flow = fq_find_fattest_flow(fq);
- 		if (!flow)
- 			return;
- 
-@@ -255,8 +264,6 @@ static void fq_flow_filter(struct fq *fq
- 		fq_adjust_removal(fq, flow, skb);
- 		free_func(fq, tin, flow, skb);
- 	}
--
--	fq_rejigger_backlog(fq, flow);
- }
- 
- static void fq_tin_filter(struct fq *fq,
-@@ -279,16 +286,18 @@ static void fq_flow_reset(struct fq *fq,
- 			  struct fq_flow *flow,
- 			  fq_skb_free_t free_func)
- {
-+	struct fq_tin *tin = flow->tin;
- 	struct sk_buff *skb;
- 
- 	while ((skb = fq_flow_dequeue(fq, flow)))
--		free_func(fq, flow->tin, flow, skb);
-+		free_func(fq, tin, flow, skb);
- 
--	if (!list_empty(&flow->flowchain))
-+	if (!list_empty(&flow->flowchain)) {
- 		list_del_init(&flow->flowchain);
--
--	if (!list_empty(&flow->backlogchain))
--		list_del_init(&flow->backlogchain);
-+		if (list_empty(&tin->new_flows) &&
-+		    list_empty(&tin->old_flows))
-+			list_del_init(&tin->tin_list);
-+	}
- 
- 	flow->tin = NULL;
- 
-@@ -314,6 +323,7 @@ static void fq_tin_reset(struct fq *fq,
- 		fq_flow_reset(fq, flow, free_func);
- 	}
- 
-+	WARN_ON_ONCE(!list_empty(&tin->tin_list));
- 	WARN_ON_ONCE(tin->backlog_bytes);
- 	WARN_ON_ONCE(tin->backlog_packets);
- }
-@@ -321,7 +331,6 @@ static void fq_tin_reset(struct fq *fq,
- static void fq_flow_init(struct fq_flow *flow)
- {
- 	INIT_LIST_HEAD(&flow->flowchain);
--	INIT_LIST_HEAD(&flow->backlogchain);
- 	__skb_queue_head_init(&flow->queue);
- }
- 
-@@ -329,6 +338,7 @@ static void fq_tin_init(struct fq_tin *t
- {
- 	INIT_LIST_HEAD(&tin->new_flows);
- 	INIT_LIST_HEAD(&tin->old_flows);
-+	INIT_LIST_HEAD(&tin->tin_list);
- 	fq_flow_init(&tin->default_flow);
- }
- 
-@@ -337,8 +347,8 @@ static int fq_init(struct fq *fq, int fl
- 	int i;
- 
- 	memset(fq, 0, sizeof(fq[0]));
--	INIT_LIST_HEAD(&fq->backlogs);
- 	spin_lock_init(&fq->lock);
-+	INIT_LIST_HEAD(&fq->tin_backlog);
- 	fq->flows_cnt = max_t(u32, flows_cnt, 1);
- 	fq->quantum = 300;
- 	fq->limit = 8192;
-@@ -348,6 +358,14 @@ static int fq_init(struct fq *fq, int fl
- 	if (!fq->flows)
- 		return -ENOMEM;
- 
-+	fq->flows_bitmap = kcalloc(BITS_TO_LONGS(fq->flows_cnt), sizeof(long),
-+				   GFP_KERNEL);
-+	if (!fq->flows_bitmap) {
-+		kvfree(fq->flows);
-+		fq->flows = NULL;
-+		return -ENOMEM;
-+	}
-+
- 	for (i = 0; i < fq->flows_cnt; i++)
- 		fq_flow_init(&fq->flows[i]);
- 
-@@ -364,6 +382,9 @@ static void fq_reset(struct fq *fq,
- 
- 	kvfree(fq->flows);
- 	fq->flows = NULL;
-+
-+	kfree(fq->flows_bitmap);
-+	fq->flows_bitmap = NULL;
- }
- 
- #endif
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3398,8 +3398,6 @@ out_recalc:
- 	if (head->len != orig_len) {
- 		flow->backlog += head->len - orig_len;
- 		tin->backlog_bytes += head->len - orig_len;
--
--		fq_recalc_backlog(fq, tin, flow);
- 	}
- out:
- 	spin_unlock_bh(&fq->lock);
diff --git a/package/kernel/mac80211/patches/subsys/313-nl80211-MBSSID-and-EMA-support-in-AP-mode.patch b/package/kernel/mac80211/patches/subsys/313-nl80211-MBSSID-and-EMA-support-in-AP-mode.patch
new file mode 100644
index 0000000000..429886d701
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/313-nl80211-MBSSID-and-EMA-support-in-AP-mode.patch
@@ -0,0 +1,493 @@
+From: John Crispin <john@phrozen.org>
+Date: Wed, 15 Sep 2021 19:54:34 -0700
+Subject: [PATCH] nl80211: MBSSID and EMA support in AP mode
+
+Add new attributes to configure support for multiple BSSID
+and advanced multi-BSSID advertisements (EMA) in AP mode.
+
+- NL80211_ATTR_MBSSID_CONFIG used for per interface configuration.
+- NL80211_ATTR_MBSSID_ELEMS used to MBSSID elements for beacons.
+
+Memory for the elements is allocated dynamically. This change frees
+the memory in existing functions which call nl80211_parse_beacon(),
+a comment is added to indicate the new references to do the same.
+
+Signed-off-by: John Crispin <john@phrozen.org>
+Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
+Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
+Link: https://lore.kernel.org/r/20210916025437.29138-2-alokad@codeaurora.org
+[don't leave ERR_PTR hanging around]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -1046,6 +1046,36 @@ struct cfg80211_crypto_settings {
+ };
+ 
+ /**
++ * struct cfg80211_mbssid_config - AP settings for multi bssid
++ *
++ * @tx_wdev: pointer to the transmitted interface in the MBSSID set
++ * @index: index of this AP in the multi bssid group.
++ * @ema: set to true if the beacons should be sent out in EMA mode.
++ */
++struct cfg80211_mbssid_config {
++	struct wireless_dev *tx_wdev;
++	u8 index;
++	bool ema;
++};
++
++/**
++ * struct cfg80211_mbssid_elems - Multiple BSSID elements
++ *
++ * @cnt: Number of elements in array %elems.
++ *
++ * @elem: Array of multiple BSSID element(s) to be added into Beacon frames.
++ * @elem.data: Data for multiple BSSID elements.
++ * @elem.len: Length of data.
++ */
++struct cfg80211_mbssid_elems {
++	u8 cnt;
++	struct {
++		const u8 *data;
++		size_t len;
++	} elem[];
++};
++
++/**
+  * struct cfg80211_beacon_data - beacon data
+  * @head: head portion of beacon (before TIM IE)
+  *	or %NULL if not changed
+@@ -1063,6 +1093,7 @@ struct cfg80211_crypto_settings {
+  * @assocresp_ies_len: length of assocresp_ies in octets
+  * @probe_resp_len: length of probe response template (@probe_resp)
+  * @probe_resp: probe response template (AP mode only)
++ * @mbssid_ies: multiple BSSID elements
+  * @ftm_responder: enable FTM responder functionality; -1 for no change
+  *	(which also implies no change in LCI/civic location data)
+  * @lci: Measurement Report element content, starting with Measurement Token
+@@ -1080,6 +1111,7 @@ struct cfg80211_beacon_data {
+ 	const u8 *probe_resp;
+ 	const u8 *lci;
+ 	const u8 *civicloc;
++	struct cfg80211_mbssid_elems *mbssid_ies;
+ 	s8 ftm_responder;
+ 
+ 	size_t head_len, tail_len;
+@@ -1194,6 +1226,7 @@ enum cfg80211_ap_settings_flags {
+  * @he_oper: HE operation IE (or %NULL if HE isn't enabled)
+  * @fils_discovery: FILS discovery transmission parameters
+  * @unsol_bcast_probe_resp: Unsolicited broadcast probe response parameters
++ * @mbssid_config: AP settings for multiple bssid
+  */
+ struct cfg80211_ap_settings {
+ 	struct cfg80211_chan_def chandef;
+@@ -1226,6 +1259,7 @@ struct cfg80211_ap_settings {
+ 	struct cfg80211_he_bss_color he_bss_color;
+ 	struct cfg80211_fils_discovery fils_discovery;
+ 	struct cfg80211_unsol_bcast_probe_resp unsol_bcast_probe_resp;
++	struct cfg80211_mbssid_config mbssid_config;
+ };
+ 
+ /**
+@@ -4986,6 +5020,13 @@ struct wiphy_iftype_akm_suites {
+  *	%NL80211_TID_CONFIG_ATTR_RETRY_LONG attributes
+  * @sar_capa: SAR control capabilities
+  * @rfkill: a pointer to the rfkill structure
++ *
++ * @mbssid_max_interfaces: maximum number of interfaces supported by the driver
++ *	in a multiple BSSID set. This field must be set to a non-zero value
++ *	by the driver to advertise MBSSID support.
++ * @mbssid_max_ema_profile_periodicity: maximum profile periodicity supported by
++ *	the driver. Setting this field to a non-zero value indicates that the
++ *	driver supports enhanced multi-BSSID advertisements (EMA AP).
+  */
+ struct wiphy {
+ 	struct mutex mtx;
+@@ -5133,6 +5174,9 @@ struct wiphy {
+ 
+ 	struct rfkill *rfkill;
+ 
++	u8 mbssid_max_interfaces;
++	u8 ema_max_profile_periodicity;
++
+ 	char priv[] __aligned(NETDEV_ALIGN);
+ };
+ 
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -337,7 +337,10 @@
+  * @NL80211_CMD_DEL_INTERFACE: Virtual interface was deleted, has attributes
+  *	%NL80211_ATTR_IFINDEX and %NL80211_ATTR_WIPHY. Can also be sent from
+  *	userspace to request deletion of a virtual interface, then requires
+- *	attribute %NL80211_ATTR_IFINDEX.
++ *	attribute %NL80211_ATTR_IFINDEX. If multiple BSSID advertisements are
++ *	enabled using %NL80211_ATTR_MBSSID_CONFIG, %NL80211_ATTR_MBSSID_ELEMS,
++ *	and if this command is used for the transmitting interface, then all
++ *	the non-transmitting interfaces are deleted as well.
+  *
+  * @NL80211_CMD_GET_KEY: Get sequence counter information for a key specified
+  *	by %NL80211_ATTR_KEY_IDX and/or %NL80211_ATTR_MAC.
+@@ -2593,6 +2596,18 @@ enum nl80211_commands {
+  * @NL80211_ATTR_COLOR_CHANGE_ELEMS: Nested set of attributes containing the IE
+  *	information for the time while performing a color switch.
+  *
++ * @NL80211_ATTR_MBSSID_CONFIG: Nested attribute for multiple BSSID
++ *	advertisements (MBSSID) parameters in AP mode.
++ *	Kernel uses this attribute to indicate the driver's support for MBSSID
++ *	and enhanced multi-BSSID advertisements (EMA AP) to the userspace.
++ *	Userspace should use this attribute to configure per interface MBSSID
++ *	parameters.
++ *	See &enum nl80211_mbssid_config_attributes for details.
++ *
++ * @NL80211_ATTR_MBSSID_ELEMS: Nested parameter to pass multiple BSSID elements.
++ *	Mandatory parameter for the transmitting interface to enable MBSSID.
++ *	Optional for the non-transmitting interfaces.
++ *
+  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
+  * @NL80211_ATTR_MAX: highest attribute number currently defined
+  * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -3096,6 +3111,9 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_COLOR_CHANGE_COLOR,
+ 	NL80211_ATTR_COLOR_CHANGE_ELEMS,
+ 
++	NL80211_ATTR_MBSSID_CONFIG,
++	NL80211_ATTR_MBSSID_ELEMS,
++
+ 	/* add attributes here, update the policy in nl80211.c */
+ 
+ 	__NL80211_ATTR_AFTER_LAST,
+@@ -7349,4 +7367,60 @@ enum nl80211_sar_specs_attrs {
+ 	NL80211_SAR_ATTR_SPECS_MAX = __NL80211_SAR_ATTR_SPECS_LAST - 1,
+ };
+ 
++/**
++ * enum nl80211_mbssid_config_attributes - multiple BSSID (MBSSID) and enhanced
++ * multi-BSSID advertisements (EMA) in AP mode.
++ * Kernel uses some of these attributes to advertise driver's support for
++ * MBSSID and EMA.
++ * Remaining attributes should be used by the userspace to configure the
++ * features.
++ *
++ * @__NL80211_MBSSID_CONFIG_ATTR_INVALID: Invalid
++ *
++ * @NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES: Used by the kernel to advertise
++ *	the maximum number of MBSSID interfaces supported by the driver.
++ *	Driver should indicate MBSSID support by setting
++ *	wiphy->mbssid_max_interfaces to a value more than or equal to 2.
++ *
++ * @NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY: Used by the kernel
++ *	to advertise the maximum profile periodicity supported by the driver
++ *	if EMA is enabled. Driver should indicate EMA support to the userspace
++ *	by setting wiphy->mbssid_max_ema_profile_periodicity to
++ *	a non-zero value.
++ *
++ * @NL80211_MBSSID_CONFIG_ATTR_INDEX: Mandatory parameter to pass the index of
++ *	this BSS (u8) in the multiple BSSID set.
++ *	Value must be set to 0 for the transmitting interface and non-zero for
++ *	all non-transmitting interfaces. The userspace will be responsible
++ *	for using unique indices for the interfaces.
++ *	Range: 0 to wiphy->mbssid_max_interfaces-1.
++ *
++ * @NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX: Mandatory parameter for
++ *	a non-transmitted profile which provides the interface index (u32) of
++ *	the transmitted profile. The value must match one of the interface
++ *	indices advertised by the kernel. Optional if the interface being set up
++ *	is the transmitting one, however, if provided then the value must match
++ *	the interface index of the same.
++ *
++ * @NL80211_MBSSID_CONFIG_ATTR_EMA: Flag used to enable EMA AP feature.
++ *	Setting this flag is permitted only if the driver advertises EMA support
++ *	by setting wiphy->mbssid_max_ema_profile_periodicity to non-zero.
++ *
++ * @__NL80211_MBSSID_CONFIG_ATTR_LAST: Internal
++ * @NL80211_MBSSID_CONFIG_ATTR_MAX: highest attribute
++ */
++enum nl80211_mbssid_config_attributes {
++	__NL80211_MBSSID_CONFIG_ATTR_INVALID,
++
++	NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
++	NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
++	NL80211_MBSSID_CONFIG_ATTR_INDEX,
++	NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX,
++	NL80211_MBSSID_CONFIG_ATTR_EMA,
++
++	/* keep last */
++	__NL80211_MBSSID_CONFIG_ATTR_LAST,
++	NL80211_MBSSID_CONFIG_ATTR_MAX = __NL80211_MBSSID_CONFIG_ATTR_LAST - 1,
++};
++
+ #endif /* __LINUX_NL80211_H */
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -442,6 +442,16 @@ sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
+ 	[NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
+ };
+ 
++static const struct nla_policy
++nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
++	[NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
++	[NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
++						NLA_POLICY_MIN(NLA_U8, 1),
++	[NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
++	[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
++	[NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
++};
++
+ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ 	[0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
+ 	[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
+@@ -788,6 +798,9 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
+ 	[NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
+ 	[NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
++	[NL80211_ATTR_MBSSID_CONFIG] =
++			NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
++	[NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
+ };
+ 
+ /* policy for the key attributes */
+@@ -2236,6 +2249,35 @@ fail:
+ 	return -ENOBUFS;
+ }
+ 
++static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
++{
++	struct nlattr *config;
++
++	if (!wiphy->mbssid_max_interfaces)
++		return 0;
++
++	config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
++	if (!config)
++		return -ENOBUFS;
++
++	if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
++		       wiphy->mbssid_max_interfaces))
++		goto fail;
++
++	if (wiphy->ema_max_profile_periodicity &&
++	    nla_put_u8(msg,
++		       NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
++		       wiphy->ema_max_profile_periodicity))
++		goto fail;
++
++	nla_nest_end(msg, config);
++	return 0;
++
++fail:
++	nla_nest_cancel(msg, config);
++	return -ENOBUFS;
++}
++
+ struct nl80211_dump_wiphy_state {
+ 	s64 filter_wiphy;
+ 	long start;
+@@ -2821,6 +2863,9 @@ static int nl80211_send_wiphy(struct cfg
+ 		if (nl80211_put_sar_specs(rdev, msg))
+ 			goto nla_put_failure;
+ 
++		if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
++			goto nla_put_failure;
++
+ 		/* done */
+ 		state->split_start = 0;
+ 		break;
+@@ -5020,6 +5065,96 @@ static int validate_beacon_tx_rate(struc
+ 	return 0;
+ }
+ 
++static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
++				       struct net_device *dev,
++				       struct nlattr *attrs,
++				       struct cfg80211_mbssid_config *config,
++				       u8 num_elems)
++{
++	struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
++
++	if (!wiphy->mbssid_max_interfaces)
++		return -EOPNOTSUPP;
++
++	if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
++			     NULL) ||
++	    !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
++		return -EINVAL;
++
++	config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
++	if (config->ema) {
++		if (!wiphy->ema_max_profile_periodicity)
++			return -EOPNOTSUPP;
++
++		if (num_elems > wiphy->ema_max_profile_periodicity)
++			return -EINVAL;
++	}
++
++	config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
++	if (config->index >= wiphy->mbssid_max_interfaces ||
++	    (!config->index && !num_elems))
++		return -EINVAL;
++
++	if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
++		u32 tx_ifindex =
++			nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
++
++		if ((!config->index && tx_ifindex != dev->ifindex) ||
++		    (config->index && tx_ifindex == dev->ifindex))
++			return -EINVAL;
++
++		if (tx_ifindex != dev->ifindex) {
++			struct net_device *tx_netdev =
++				dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
++
++			if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
++			    tx_netdev->ieee80211_ptr->wiphy != wiphy ||
++			    tx_netdev->ieee80211_ptr->iftype !=
++							NL80211_IFTYPE_AP) {
++				dev_put(tx_netdev);
++				return -EINVAL;
++			}
++
++			config->tx_wdev = tx_netdev->ieee80211_ptr;
++		} else {
++			config->tx_wdev = dev->ieee80211_ptr;
++		}
++	} else if (!config->index) {
++		config->tx_wdev = dev->ieee80211_ptr;
++	} else {
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static struct cfg80211_mbssid_elems *
++nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
++{
++	struct nlattr *nl_elems;
++	struct cfg80211_mbssid_elems *elems;
++	int rem_elems;
++	u8 i = 0, num_elems = 0;
++
++	if (!wiphy->mbssid_max_interfaces)
++		return ERR_PTR(-EINVAL);
++
++	nla_for_each_nested(nl_elems, attrs, rem_elems)
++		num_elems++;
++
++	elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
++	if (!elems)
++		return ERR_PTR(-ENOMEM);
++
++	nla_for_each_nested(nl_elems, attrs, rem_elems) {
++		elems->elem[i].data = nla_data(nl_elems);
++		elems->elem[i].len = nla_len(nl_elems);
++		i++;
++	}
++	elems->cnt = num_elems;
++	return elems;
++}
++
+ static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
+ 				struct nlattr *attrs[],
+ 				struct cfg80211_beacon_data *bcn)
+@@ -5100,6 +5235,17 @@ static int nl80211_parse_beacon(struct c
+ 		bcn->ftm_responder = -1;
+ 	}
+ 
++	if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
++		struct cfg80211_mbssid_elems *mbssid =
++			nl80211_parse_mbssid_elems(&rdev->wiphy,
++						   attrs[NL80211_ATTR_MBSSID_ELEMS]);
++
++		if (IS_ERR(mbssid))
++			return PTR_ERR(mbssid);
++
++		bcn->mbssid_ies = mbssid;
++	}
++
+ 	return 0;
+ }
+ 
+@@ -5556,6 +5702,17 @@ static int nl80211_start_ap(struct sk_bu
+ 			goto out;
+ 	}
+ 
++	if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
++		err = nl80211_parse_mbssid_config(&rdev->wiphy, dev,
++						  info->attrs[NL80211_ATTR_MBSSID_CONFIG],
++						  &params.mbssid_config,
++						  params.beacon.mbssid_ies ?
++							params.beacon.mbssid_ies->cnt :
++							0);
++		if (err)
++			goto out;
++	}
++
+ 	nl80211_calculate_ap_params(&params);
+ 
+ 	if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
+@@ -5577,6 +5734,11 @@ static int nl80211_start_ap(struct sk_bu
+ 
+ out:
+ 	kfree(params.acl);
++	kfree(params.beacon.mbssid_ies);
++	if (params.mbssid_config.tx_wdev &&
++	    params.mbssid_config.tx_wdev->netdev &&
++	    params.mbssid_config.tx_wdev->netdev != dev)
++		dev_put(params.mbssid_config.tx_wdev->netdev);
+ 
+ 	return err;
+ }
+@@ -5601,12 +5763,14 @@ static int nl80211_set_beacon(struct sk_
+ 
+ 	err = nl80211_parse_beacon(rdev, info->attrs, &params);
+ 	if (err)
+-		return err;
++		goto out;
+ 
+ 	wdev_lock(wdev);
+ 	err = rdev_change_beacon(rdev, dev, &params);
+ 	wdev_unlock(wdev);
+ 
++out:
++	kfree(params.mbssid_ies);
+ 	return err;
+ }
+ 
+@@ -9283,12 +9447,14 @@ static int nl80211_channel_switch(struct
+ 
+ 	err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
+ 	if (err)
+-		return err;
++		goto free;
+ 
+ 	csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
+ 			    GFP_KERNEL);
+-	if (!csa_attrs)
+-		return -ENOMEM;
++	if (!csa_attrs) {
++		err = -ENOMEM;
++		goto free;
++	}
+ 
+ 	err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
+ 					  info->attrs[NL80211_ATTR_CSA_IES],
+@@ -9407,6 +9573,8 @@ skip_beacons:
+ 	wdev_unlock(wdev);
+ 
+ free:
++	kfree(params.beacon_after.mbssid_ies);
++	kfree(params.beacon_csa.mbssid_ies);
+ 	kfree(csa_attrs);
+ 	return err;
+ }
+@@ -14959,6 +15127,8 @@ static int nl80211_color_change(struct s
+ 	wdev_unlock(wdev);
+ 
+ out:
++	kfree(params.beacon_next.mbssid_ies);
++	kfree(params.beacon_color_change.mbssid_ies);
+ 	kfree(tb);
+ 	return err;
+ }
diff --git a/package/kernel/mac80211/patches/subsys/314-cfg80211-implement-APIs-for-dedicated-radar-detectio.patch b/package/kernel/mac80211/patches/subsys/314-cfg80211-implement-APIs-for-dedicated-radar-detectio.patch
new file mode 100644
index 0000000000..2038ee69db
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/314-cfg80211-implement-APIs-for-dedicated-radar-detectio.patch
@@ -0,0 +1,378 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 23 Oct 2021 11:10:50 +0200
+Subject: [PATCH] cfg80211: implement APIs for dedicated radar detection HW
+
+If a dedicated (off-channel) radar detection hardware (chain)
+is available in the hardware/driver, allow this to be used by
+calling the NL80211_CMD_RADAR_DETECT command with a new flag
+attribute requesting off-channel radar detection is used.
+
+Offchannel CAC (channel availability check) avoids the CAC
+downtime when switching to a radar channel or when turning on
+the AP.
+
+Drivers advertise support for this using the new feature flag
+NL80211_EXT_FEATURE_RADAR_OFFCHAN.
+
+Tested-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/7468e291ef5d05d692c1738d25b8f778d8ea5c3f.1634979655.git.lorenzo@kernel.org
+Link: https://lore.kernel.org/r/1e60e60fef00e14401adae81c3d49f3e5f307537.1634979655.git.lorenzo@kernel.org
+Link: https://lore.kernel.org/r/85fa50f57fc3adb2934c8d9ca0be30394de6b7e8.1634979655.git.lorenzo@kernel.org
+Link: https://lore.kernel.org/r/4b6c08671ad59aae0ac46fc94c02f31b1610eb72.1634979655.git.lorenzo@kernel.org
+Link: https://lore.kernel.org/r/241849ccaf2c228873c6f8495bf87b19159ba458.1634979655.git.lorenzo@kernel.org
+[remove offchan_mutex, fix cfg80211_stop_offchan_radar_detection(),
+ remove gfp_t argument, fix documentation, fix tracing]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4057,6 +4057,15 @@ struct mgmt_frame_regs {
+  * @set_sar_specs: Update the SAR (TX power) settings.
+  *
+  * @color_change: Initiate a color change.
++ *
++ * @set_radar_offchan: Configure dedicated offchannel chain available for
++ *	radar/CAC detection on some hw. This chain can't be used to transmit
++ *	or receive frames and it is bounded to a running wdev.
++ *	Offchannel radar/CAC detection allows to avoid the CAC downtime
++ *	switching to a different channel during CAC detection on the selected
++ *	radar channel.
++ *	The caller is expected to set chandef pointer to NULL in order to
++ *	disable offchannel CAC/radar detection.
+  */
+ struct cfg80211_ops {
+ 	int	(*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
+@@ -4387,6 +4396,8 @@ struct cfg80211_ops {
+ 	int	(*color_change)(struct wiphy *wiphy,
+ 				struct net_device *dev,
+ 				struct cfg80211_color_change_settings *params);
++	int	(*set_radar_offchan)(struct wiphy *wiphy,
++				     struct cfg80211_chan_def *chandef);
+ };
+ 
+ /*
+@@ -7608,6 +7619,20 @@ void cfg80211_cac_event(struct net_devic
+ 			const struct cfg80211_chan_def *chandef,
+ 			enum nl80211_radar_event event, gfp_t gfp);
+ 
++/**
++ * cfg80211_offchan_cac_event - Channel Availability Check (CAC) offchan event
++ * @wiphy: the wiphy
++ * @chandef: chandef for the current channel
++ * @event: type of event
++ *
++ * This function is called when a Channel Availability Check (CAC) is finished,
++ * started or aborted by a offchannel dedicated chain.
++ *
++ * Note that this acquires the wiphy lock.
++ */
++void cfg80211_offchan_cac_event(struct wiphy *wiphy,
++				const struct cfg80211_chan_def *chandef,
++				enum nl80211_radar_event event);
+ 
+ /**
+  * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -2608,6 +2608,13 @@ enum nl80211_commands {
+  *	Mandatory parameter for the transmitting interface to enable MBSSID.
+  *	Optional for the non-transmitting interfaces.
+  *
++ * @NL80211_ATTR_RADAR_OFFCHAN: Configure dedicated offchannel chain available for
++ *	radar/CAC detection on some hw. This chain can't be used to transmit
++ *	or receive frames and it is bounded to a running wdev.
++ *	Offchannel radar/CAC detection allows to avoid the CAC downtime
++ *	switching on a different channel during CAC detection on the selected
++ *	radar channel.
++ *
+  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
+  * @NL80211_ATTR_MAX: highest attribute number currently defined
+  * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -3114,6 +3121,8 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_MBSSID_CONFIG,
+ 	NL80211_ATTR_MBSSID_ELEMS,
+ 
++	NL80211_ATTR_RADAR_OFFCHAN,
++
+ 	/* add attributes here, update the policy in nl80211.c */
+ 
+ 	__NL80211_ATTR_AFTER_LAST,
+@@ -6013,6 +6022,9 @@ enum nl80211_feature_flags {
+  * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
+  *	detection and change announcemnts.
+  *
++ * @NL80211_EXT_FEATURE_RADAR_OFFCHAN: Device supports offchannel radar/CAC
++ *	detection.
++ *
+  * @NUM_NL80211_EXT_FEATURES: number of extended features.
+  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
+  */
+@@ -6078,6 +6090,7 @@ enum nl80211_ext_feature_index {
+ 	NL80211_EXT_FEATURE_SECURE_RTT,
+ 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
+ 	NL80211_EXT_FEATURE_BSS_COLOR,
++	NL80211_EXT_FEATURE_RADAR_OFFCHAN,
+ 
+ 	/* add new features before the definition below */
+ 	NUM_NL80211_EXT_FEATURES,
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -543,6 +543,7 @@ use_default_name:
+ 	INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work);
+ 	INIT_WORK(&rdev->conn_work, cfg80211_conn_work);
+ 	INIT_WORK(&rdev->event_work, cfg80211_event_work);
++	INIT_DELAYED_WORK(&rdev->offchan_cac_work, cfg80211_offchan_cac_work);
+ 
+ 	init_waitqueue_head(&rdev->dev_wait);
+ 
+@@ -1205,6 +1206,8 @@ void __cfg80211_leave(struct cfg80211_re
+ 
+ 	cfg80211_pmsr_wdev_down(wdev);
+ 
++	cfg80211_stop_offchan_radar_detection(wdev);
++
+ 	switch (wdev->iftype) {
+ 	case NL80211_IFTYPE_ADHOC:
+ 		__cfg80211_leave_ibss(rdev, dev, true);
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -84,6 +84,10 @@ struct cfg80211_registered_device {
+ 
+ 	struct delayed_work dfs_update_channels_wk;
+ 
++	struct wireless_dev *offchan_radar_wdev;
++	struct cfg80211_chan_def offchan_radar_chandef;
++	struct delayed_work offchan_cac_work;
++
+ 	/* netlink port which started critical protocol (0 means not started) */
+ 	u32 crit_proto_nlportid;
+ 
+@@ -491,6 +495,15 @@ cfg80211_chandef_dfs_cac_time(struct wip
+ 
+ void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev);
+ 
++int
++cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
++				       struct wireless_dev *wdev,
++				       struct cfg80211_chan_def *chandef);
++
++void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev);
++
++void cfg80211_offchan_cac_work(struct work_struct *work);
++
+ bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
+ 				  struct ieee80211_channel *chan);
+ 
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -970,3 +970,116 @@ void cfg80211_cac_event(struct net_devic
+ 	nl80211_radar_notify(rdev, chandef, event, netdev, gfp);
+ }
+ EXPORT_SYMBOL(cfg80211_cac_event);
++
++void cfg80211_offchan_cac_work(struct work_struct *work)
++{
++	struct delayed_work *delayed_work = to_delayed_work(work);
++	struct cfg80211_registered_device *rdev;
++
++	rdev = container_of(delayed_work, struct cfg80211_registered_device,
++			    offchan_cac_work);
++	cfg80211_offchan_cac_event(&rdev->wiphy, &rdev->offchan_radar_chandef,
++				   NL80211_RADAR_CAC_FINISHED);
++}
++
++static void
++__cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
++			     struct wireless_dev *wdev,
++			     const struct cfg80211_chan_def *chandef,
++			     enum nl80211_radar_event event)
++{
++	struct wiphy *wiphy = &rdev->wiphy;
++	struct net_device *netdev;
++
++	lockdep_assert_wiphy(&rdev->wiphy);
++
++	if (event != NL80211_RADAR_CAC_STARTED && !rdev->offchan_radar_wdev)
++		return;
++
++	switch (event) {
++	case NL80211_RADAR_CAC_FINISHED:
++		cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
++		memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef));
++		queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
++		cfg80211_sched_dfs_chan_update(rdev);
++		wdev = rdev->offchan_radar_wdev;
++		rdev->offchan_radar_wdev = NULL;
++		break;
++	case NL80211_RADAR_CAC_ABORTED:
++		cancel_delayed_work(&rdev->offchan_cac_work);
++		wdev = rdev->offchan_radar_wdev;
++		rdev->offchan_radar_wdev = NULL;
++		break;
++	case NL80211_RADAR_CAC_STARTED:
++		WARN_ON(!wdev);
++		rdev->offchan_radar_wdev = wdev;
++		break;
++	default:
++		return;
++	}
++
++	netdev = wdev ? wdev->netdev : NULL;
++	nl80211_radar_notify(rdev, chandef, event, netdev, GFP_KERNEL);
++}
++
++void cfg80211_offchan_cac_event(struct wiphy *wiphy,
++				const struct cfg80211_chan_def *chandef,
++				enum nl80211_radar_event event)
++{
++	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
++
++	wiphy_lock(wiphy);
++	__cfg80211_offchan_cac_event(rdev, NULL, chandef, event);
++	wiphy_unlock(wiphy);
++}
++EXPORT_SYMBOL(cfg80211_offchan_cac_event);
++
++int
++cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
++				       struct wireless_dev *wdev,
++				       struct cfg80211_chan_def *chandef)
++{
++	unsigned int cac_time_ms;
++	int err;
++
++	lockdep_assert_wiphy(&rdev->wiphy);
++
++	if (!wiphy_ext_feature_isset(&rdev->wiphy,
++				     NL80211_EXT_FEATURE_RADAR_OFFCHAN))
++		return -EOPNOTSUPP;
++
++	if (rdev->offchan_radar_wdev)
++		return -EBUSY;
++
++	err = rdev_set_radar_offchan(rdev, chandef);
++	if (err)
++		return err;
++
++	cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, chandef);
++	if (!cac_time_ms)
++		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
++
++	rdev->offchan_radar_chandef = *chandef;
++	__cfg80211_offchan_cac_event(rdev, wdev, chandef,
++				     NL80211_RADAR_CAC_STARTED);
++	queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_work,
++			   msecs_to_jiffies(cac_time_ms));
++
++	return 0;
++}
++
++void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev)
++{
++	struct wiphy *wiphy = wdev->wiphy;
++	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
++
++	lockdep_assert_wiphy(wiphy);
++
++	if (wdev != rdev->offchan_radar_wdev)
++		return;
++
++	rdev_set_radar_offchan(rdev, NULL);
++
++	__cfg80211_offchan_cac_event(rdev, NULL, NULL,
++				     NL80211_RADAR_CAC_ABORTED);
++}
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -801,6 +801,7 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_MBSSID_CONFIG] =
+ 			NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
+ 	[NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
++	[NL80211_ATTR_RADAR_OFFCHAN] = { .type = NLA_FLAG },
+ };
+ 
+ /* policy for the key attributes */
+@@ -9287,12 +9288,6 @@ static int nl80211_start_radar_detection
+ 	if (err)
+ 		return err;
+ 
+-	if (netif_carrier_ok(dev))
+-		return -EBUSY;
+-
+-	if (wdev->cac_started)
+-		return -EBUSY;
+-
+ 	err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
+ 	if (err < 0)
+ 		return err;
+@@ -9303,6 +9298,16 @@ static int nl80211_start_radar_detection
+ 	if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
+ 		return -EINVAL;
+ 
++	if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_OFFCHAN]))
++		return cfg80211_start_offchan_radar_detection(rdev, wdev,
++							      &chandef);
++
++	if (netif_carrier_ok(dev))
++		return -EBUSY;
++
++	if (wdev->cac_started)
++		return -EBUSY;
++
+ 	/* CAC start is offloaded to HW and can't be started manually */
+ 	if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
+ 		return -EOPNOTSUPP;
+--- a/net/wireless/rdev-ops.h
++++ b/net/wireless/rdev-ops.h
+@@ -1381,4 +1381,21 @@ static inline int rdev_color_change(stru
+ 	return ret;
+ }
+ 
++static inline int
++rdev_set_radar_offchan(struct cfg80211_registered_device *rdev,
++		       struct cfg80211_chan_def *chandef)
++{
++	struct wiphy *wiphy = &rdev->wiphy;
++	int ret;
++
++	if (!rdev->ops->set_radar_offchan)
++		return -EOPNOTSUPP;
++
++	trace_rdev_set_radar_offchan(wiphy, chandef);
++	ret = rdev->ops->set_radar_offchan(wiphy, chandef);
++	trace_rdev_return_int(wiphy, ret);
++
++	return ret;
++}
++
+ #endif /* __CFG80211_RDEV_OPS */
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -3643,6 +3643,25 @@ TRACE_EVENT(cfg80211_bss_color_notify,
+ 		  __entry->color_bitmap)
+ );
+ 
++TRACE_EVENT(rdev_set_radar_offchan,
++	TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
++
++	TP_ARGS(wiphy, chandef),
++
++	TP_STRUCT__entry(
++		WIPHY_ENTRY
++		CHAN_DEF_ENTRY
++	),
++
++	TP_fast_assign(
++		WIPHY_ASSIGN;
++		CHAN_DEF_ASSIGN(chandef)
++	),
++
++	TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
++		  WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
++);
++
+ #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
+ 
+ #undef TRACE_INCLUDE_PATH
diff --git a/package/kernel/mac80211/patches/subsys/315-cfg80211-move-offchan_cac_event-to-a-dedicated-work.patch b/package/kernel/mac80211/patches/subsys/315-cfg80211-move-offchan_cac_event-to-a-dedicated-work.patch
new file mode 100644
index 0000000000..b1a1d2c894
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/315-cfg80211-move-offchan_cac_event-to-a-dedicated-work.patch
@@ -0,0 +1,183 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 27 Oct 2021 11:03:42 +0200
+Subject: [PATCH] cfg80211: move offchan_cac_event to a dedicated work
+
+In order to make cfg80211_offchan_cac_abort() (renamed from
+cfg80211_offchan_cac_event) callable in other contexts and
+without so much locking restrictions, make it trigger a new
+work instead of operating directly.
+
+Do some other renames while at it to clarify.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/6145c3d0f30400a568023f67981981d24c7c6133.1635325205.git.lorenzo@kernel.org
+[rewrite commit log]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -7620,19 +7620,13 @@ void cfg80211_cac_event(struct net_devic
+ 			enum nl80211_radar_event event, gfp_t gfp);
+ 
+ /**
+- * cfg80211_offchan_cac_event - Channel Availability Check (CAC) offchan event
++ * cfg80211_offchan_cac_abort - Channel Availability Check offchan abort event
+  * @wiphy: the wiphy
+- * @chandef: chandef for the current channel
+- * @event: type of event
+  *
+- * This function is called when a Channel Availability Check (CAC) is finished,
+- * started or aborted by a offchannel dedicated chain.
+- *
+- * Note that this acquires the wiphy lock.
++ * This function is called by the driver when a Channel Availability Check
++ * (CAC) is aborted by a offchannel dedicated chain.
+  */
+-void cfg80211_offchan_cac_event(struct wiphy *wiphy,
+-				const struct cfg80211_chan_def *chandef,
+-				enum nl80211_radar_event event);
++void cfg80211_offchan_cac_abort(struct wiphy *wiphy);
+ 
+ /**
+  * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -543,7 +543,9 @@ use_default_name:
+ 	INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work);
+ 	INIT_WORK(&rdev->conn_work, cfg80211_conn_work);
+ 	INIT_WORK(&rdev->event_work, cfg80211_event_work);
+-	INIT_DELAYED_WORK(&rdev->offchan_cac_work, cfg80211_offchan_cac_work);
++	INIT_WORK(&rdev->offchan_cac_abort_wk, cfg80211_offchan_cac_abort_wk);
++	INIT_DELAYED_WORK(&rdev->offchan_cac_done_wk,
++			  cfg80211_offchan_cac_done_wk);
+ 
+ 	init_waitqueue_head(&rdev->dev_wait);
+ 
+@@ -1053,11 +1055,13 @@ void wiphy_unregister(struct wiphy *wiph
+ 	cancel_work_sync(&rdev->conn_work);
+ 	flush_work(&rdev->event_work);
+ 	cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
++	cancel_delayed_work_sync(&rdev->offchan_cac_done_wk);
+ 	flush_work(&rdev->destroy_work);
+ 	flush_work(&rdev->sched_scan_stop_wk);
+ 	flush_work(&rdev->propagate_radar_detect_wk);
+ 	flush_work(&rdev->propagate_cac_done_wk);
+ 	flush_work(&rdev->mgmt_registrations_update_wk);
++	flush_work(&rdev->offchan_cac_abort_wk);
+ 
+ #ifdef CONFIG_PM
+ 	if (rdev->wiphy.wowlan_config && rdev->ops->set_wakeup)
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -86,7 +86,8 @@ struct cfg80211_registered_device {
+ 
+ 	struct wireless_dev *offchan_radar_wdev;
+ 	struct cfg80211_chan_def offchan_radar_chandef;
+-	struct delayed_work offchan_cac_work;
++	struct delayed_work offchan_cac_done_wk;
++	struct work_struct offchan_cac_abort_wk;
+ 
+ 	/* netlink port which started critical protocol (0 means not started) */
+ 	u32 crit_proto_nlportid;
+@@ -502,7 +503,9 @@ cfg80211_start_offchan_radar_detection(s
+ 
+ void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev);
+ 
+-void cfg80211_offchan_cac_work(struct work_struct *work);
++void cfg80211_offchan_cac_done_wk(struct work_struct *work);
++
++void cfg80211_offchan_cac_abort_wk(struct work_struct *work);
+ 
+ bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
+ 				  struct ieee80211_channel *chan);
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -971,17 +971,6 @@ void cfg80211_cac_event(struct net_devic
+ }
+ EXPORT_SYMBOL(cfg80211_cac_event);
+ 
+-void cfg80211_offchan_cac_work(struct work_struct *work)
+-{
+-	struct delayed_work *delayed_work = to_delayed_work(work);
+-	struct cfg80211_registered_device *rdev;
+-
+-	rdev = container_of(delayed_work, struct cfg80211_registered_device,
+-			    offchan_cac_work);
+-	cfg80211_offchan_cac_event(&rdev->wiphy, &rdev->offchan_radar_chandef,
+-				   NL80211_RADAR_CAC_FINISHED);
+-}
+-
+ static void
+ __cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
+ 			     struct wireless_dev *wdev,
+@@ -1006,7 +995,7 @@ __cfg80211_offchan_cac_event(struct cfg8
+ 		rdev->offchan_radar_wdev = NULL;
+ 		break;
+ 	case NL80211_RADAR_CAC_ABORTED:
+-		cancel_delayed_work(&rdev->offchan_cac_work);
++		cancel_delayed_work(&rdev->offchan_cac_done_wk);
+ 		wdev = rdev->offchan_radar_wdev;
+ 		rdev->offchan_radar_wdev = NULL;
+ 		break;
+@@ -1022,17 +1011,44 @@ __cfg80211_offchan_cac_event(struct cfg8
+ 	nl80211_radar_notify(rdev, chandef, event, netdev, GFP_KERNEL);
+ }
+ 
+-void cfg80211_offchan_cac_event(struct wiphy *wiphy,
+-				const struct cfg80211_chan_def *chandef,
+-				enum nl80211_radar_event event)
++static void
++cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
++			   const struct cfg80211_chan_def *chandef,
++			   enum nl80211_radar_event event)
++{
++	wiphy_lock(&rdev->wiphy);
++	__cfg80211_offchan_cac_event(rdev, NULL, chandef, event);
++	wiphy_unlock(&rdev->wiphy);
++}
++
++void cfg80211_offchan_cac_done_wk(struct work_struct *work)
++{
++	struct delayed_work *delayed_work = to_delayed_work(work);
++	struct cfg80211_registered_device *rdev;
++
++	rdev = container_of(delayed_work, struct cfg80211_registered_device,
++			    offchan_cac_done_wk);
++	cfg80211_offchan_cac_event(rdev, &rdev->offchan_radar_chandef,
++				   NL80211_RADAR_CAC_FINISHED);
++}
++
++void cfg80211_offchan_cac_abort_wk(struct work_struct *work)
++{
++	struct cfg80211_registered_device *rdev;
++
++	rdev = container_of(work, struct cfg80211_registered_device,
++			    offchan_cac_abort_wk);
++	cfg80211_offchan_cac_event(rdev, &rdev->offchan_radar_chandef,
++				   NL80211_RADAR_CAC_ABORTED);
++}
++
++void cfg80211_offchan_cac_abort(struct wiphy *wiphy)
+ {
+ 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+ 
+-	wiphy_lock(wiphy);
+-	__cfg80211_offchan_cac_event(rdev, NULL, chandef, event);
+-	wiphy_unlock(wiphy);
++	queue_work(cfg80211_wq, &rdev->offchan_cac_abort_wk);
+ }
+-EXPORT_SYMBOL(cfg80211_offchan_cac_event);
++EXPORT_SYMBOL(cfg80211_offchan_cac_abort);
+ 
+ int
+ cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
+@@ -1062,7 +1078,7 @@ cfg80211_start_offchan_radar_detection(s
+ 	rdev->offchan_radar_chandef = *chandef;
+ 	__cfg80211_offchan_cac_event(rdev, wdev, chandef,
+ 				     NL80211_RADAR_CAC_STARTED);
+-	queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_work,
++	queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_done_wk,
+ 			   msecs_to_jiffies(cac_time_ms));
+ 
+ 	return 0;
diff --git a/package/kernel/mac80211/patches/subsys/315-mac80211-add-rx-decapsulation-offload-support.patch b/package/kernel/mac80211/patches/subsys/315-mac80211-add-rx-decapsulation-offload-support.patch
deleted file mode 100644
index d2ba140e6f..0000000000
--- a/package/kernel/mac80211/patches/subsys/315-mac80211-add-rx-decapsulation-offload-support.patch
+++ /dev/null
@@ -1,570 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 16 Dec 2020 21:34:03 +0100
-Subject: [PATCH] mac80211: add rx decapsulation offload support
-
-This allows drivers to pass 802.3 frames to mac80211, with some restrictions:
-
-- the skb must be passed with a valid sta
-- fast-rx needs to be active for the sta
-- monitor mode needs to be disabled
-
-mac80211 will tell the driver when it is safe to enable rx decap offload for
-a particular station.
-
-In order to implement support, a driver must:
-
-- call ieee80211_hw_set(hw, SUPPORTS_RX_DECAP_OFFLOAD)
-- implement ops->sta_set_decap_offload
-- mark 802.3 frames with RX_FLAG_8023
-
-If it doesn't want to enable offload for some vif types, it can mask out
-IEEE80211_OFFLOAD_DECAP_ENABLED in vif->offload_flags from within the
-.add_interface or .update_vif_offload driver ops
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -1297,6 +1297,8 @@ ieee80211_tx_info_clear_status(struct ie
-  *	the "0-length PSDU" field included there.  The value for it is
-  *	in &struct ieee80211_rx_status.  Note that if this value isn't
-  *	known the frame shouldn't be reported.
-+ * @RX_FLAG_8023: the frame has an 802.3 header (decap offload performed by
-+ *	hardware or driver)
-  */
- enum mac80211_rx_flags {
- 	RX_FLAG_MMIC_ERROR		= BIT(0),
-@@ -1329,6 +1331,7 @@ enum mac80211_rx_flags {
- 	RX_FLAG_RADIOTAP_HE_MU		= BIT(27),
- 	RX_FLAG_RADIOTAP_LSIG		= BIT(28),
- 	RX_FLAG_NO_PSDU			= BIT(29),
-+	RX_FLAG_8023			= BIT(30),
- };
- 
- /**
-@@ -1650,11 +1653,15 @@ enum ieee80211_vif_flags {
-  *	The driver supports sending frames passed as 802.3 frames by mac80211.
-  *	It must also support sending 802.11 packets for the same interface.
-  * @IEEE80211_OFFLOAD_ENCAP_4ADDR: support 4-address mode encapsulation offload
-+ * @IEEE80211_OFFLOAD_DECAP_ENABLED: rx encapsulation offload is enabled
-+ *	The driver supports passing received 802.11 frames as 802.3 frames to
-+ *	mac80211.
-  */
- 
- enum ieee80211_offload_flags {
- 	IEEE80211_OFFLOAD_ENCAP_ENABLED		= BIT(0),
- 	IEEE80211_OFFLOAD_ENCAP_4ADDR		= BIT(1),
-+	IEEE80211_OFFLOAD_DECAP_ENABLED		= BIT(2),
- };
- 
- /**
-@@ -2390,6 +2397,9 @@ struct ieee80211_txq {
-  * @IEEE80211_HW_SUPPORTS_TX_ENCAP_OFFLOAD: Hardware supports tx encapsulation
-  *	offload
-  *
-+ * @IEEE80211_HW_SUPPORTS_RX_DECAP_OFFLOAD: Hardware supports rx decapsulation
-+ *	offload
-+ *
-  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
-  */
- enum ieee80211_hw_flags {
-@@ -2443,6 +2453,7 @@ enum ieee80211_hw_flags {
- 	IEEE80211_HW_SUPPORTS_ONLY_HE_MULTI_BSSID,
- 	IEEE80211_HW_AMPDU_KEYBORDER_SUPPORT,
- 	IEEE80211_HW_SUPPORTS_TX_ENCAP_OFFLOAD,
-+	IEEE80211_HW_SUPPORTS_RX_DECAP_OFFLOAD,
- 
- 	/* keep last, obviously */
- 	NUM_IEEE80211_HW_FLAGS
-@@ -4196,6 +4207,9 @@ struct ieee80211_ops {
- 				   struct ieee80211_vif *vif);
- 	void (*sta_set_4addr)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 			      struct ieee80211_sta *sta, bool enabled);
-+	void (*sta_set_decap_offload)(struct ieee80211_hw *hw,
-+				      struct ieee80211_vif *vif,
-+				      struct ieee80211_sta *sta, bool enabled);
- };
- 
- /**
---- a/net/mac80211/debugfs.c
-+++ b/net/mac80211/debugfs.c
-@@ -405,6 +405,7 @@ static const char *hw_flag_names[] = {
- 	FLAG(SUPPORTS_ONLY_HE_MULTI_BSSID),
- 	FLAG(AMPDU_KEYBORDER_SUPPORT),
- 	FLAG(SUPPORTS_TX_ENCAP_OFFLOAD),
-+	FLAG(SUPPORTS_RX_DECAP_OFFLOAD),
- #undef FLAG
- };
- 
---- a/net/mac80211/debugfs_sta.c
-+++ b/net/mac80211/debugfs_sta.c
-@@ -79,6 +79,7 @@ static const char * const sta_flag_names
- 	FLAG(MPSP_RECIPIENT),
- 	FLAG(PS_DELIVER),
- 	FLAG(USES_ENCRYPTION),
-+	FLAG(DECAP_OFFLOAD),
- #undef FLAG
- };
- 
---- a/net/mac80211/driver-ops.h
-+++ b/net/mac80211/driver-ops.h
-@@ -1416,4 +1416,20 @@ static inline void drv_sta_set_4addr(str
- 	trace_drv_return_void(local);
- }
- 
-+static inline void drv_sta_set_decap_offload(struct ieee80211_local *local,
-+					     struct ieee80211_sub_if_data *sdata,
-+					     struct ieee80211_sta *sta,
-+					     bool enabled)
-+{
-+	sdata = get_bss_sdata(sdata);
-+	if (!check_sdata_in_driver(sdata))
-+		return;
-+
-+	trace_drv_sta_set_decap_offload(local, sdata, sta, enabled);
-+	if (local->ops->sta_set_decap_offload)
-+		local->ops->sta_set_decap_offload(&local->hw, &sdata->vif, sta,
-+						  enabled);
-+	trace_drv_return_void(local);
-+}
-+
- #endif /* __MAC80211_DRIVER_OPS */
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -856,7 +856,7 @@ static const struct net_device_ops ieee8
- 
- };
- 
--static bool ieee80211_iftype_supports_encap_offload(enum nl80211_iftype iftype)
-+static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
- {
- 	switch (iftype) {
- 	/* P2P GO and client are mapped to AP/STATION types */
-@@ -876,7 +876,7 @@ static bool ieee80211_set_sdata_offload_
- 	flags = sdata->vif.offload_flags;
- 
- 	if (ieee80211_hw_check(&local->hw, SUPPORTS_TX_ENCAP_OFFLOAD) &&
--	    ieee80211_iftype_supports_encap_offload(sdata->vif.type)) {
-+	    ieee80211_iftype_supports_hdr_offload(sdata->vif.type)) {
- 		flags |= IEEE80211_OFFLOAD_ENCAP_ENABLED;
- 
- 		if (!ieee80211_hw_check(&local->hw, SUPPORTS_TX_FRAG) &&
-@@ -889,10 +889,21 @@ static bool ieee80211_set_sdata_offload_
- 		flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
- 	}
- 
-+	if (ieee80211_hw_check(&local->hw, SUPPORTS_RX_DECAP_OFFLOAD) &&
-+	    ieee80211_iftype_supports_hdr_offload(sdata->vif.type)) {
-+		flags |= IEEE80211_OFFLOAD_DECAP_ENABLED;
-+
-+		if (local->monitors)
-+			flags &= ~IEEE80211_OFFLOAD_DECAP_ENABLED;
-+	} else {
-+		flags &= ~IEEE80211_OFFLOAD_DECAP_ENABLED;
-+	}
-+
- 	if (sdata->vif.offload_flags == flags)
- 		return false;
- 
- 	sdata->vif.offload_flags = flags;
-+	ieee80211_check_fast_rx_iface(sdata);
- 	return true;
- }
- 
-@@ -910,7 +921,7 @@ static void ieee80211_set_vif_encap_ops(
- 	}
- 
- 	if (!ieee80211_hw_check(&local->hw, SUPPORTS_TX_ENCAP_OFFLOAD) ||
--	    !ieee80211_iftype_supports_encap_offload(bss->vif.type))
-+	    !ieee80211_iftype_supports_hdr_offload(bss->vif.type))
- 		return;
- 
- 	enabled = bss->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED;
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -4198,7 +4198,9 @@ void ieee80211_check_fast_rx(struct sta_
- 		.vif_type = sdata->vif.type,
- 		.control_port_protocol = sdata->control_port_protocol,
- 	}, *old, *new = NULL;
-+	bool set_offload = false;
- 	bool assign = false;
-+	bool offload;
- 
- 	/* use sparse to check that we don't return without updating */
- 	__acquire(check_fast_rx);
-@@ -4311,6 +4313,17 @@ void ieee80211_check_fast_rx(struct sta_
- 	if (assign)
- 		new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);
- 
-+	offload = assign &&
-+		  (sdata->vif.offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED);
-+
-+	if (offload)
-+		set_offload = !test_and_set_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
-+	else
-+		set_offload = test_and_clear_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
-+
-+	if (set_offload)
-+		drv_sta_set_decap_offload(local, sdata, &sta->sta, assign);
-+
- 	spin_lock_bh(&sta->lock);
- 	old = rcu_dereference_protected(sta->fast_rx, true);
- 	rcu_assign_pointer(sta->fast_rx, new);
-@@ -4357,6 +4370,108 @@ void ieee80211_check_fast_rx_iface(struc
- 	mutex_unlock(&local->sta_mtx);
- }
- 
-+static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
-+			      struct ieee80211_fast_rx *fast_rx,
-+			      int orig_len)
-+{
-+	struct ieee80211_sta_rx_stats *stats;
-+	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
-+	struct sta_info *sta = rx->sta;
-+	struct sk_buff *skb = rx->skb;
-+	void *sa = skb->data + ETH_ALEN;
-+	void *da = skb->data;
-+
-+	stats = &sta->rx_stats;
-+	if (fast_rx->uses_rss)
-+		stats = this_cpu_ptr(sta->pcpu_rx_stats);
-+
-+	/* statistics part of ieee80211_rx_h_sta_process() */
-+	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
-+		stats->last_signal = status->signal;
-+		if (!fast_rx->uses_rss)
-+			ewma_signal_add(&sta->rx_stats_avg.signal,
-+					-status->signal);
-+	}
-+
-+	if (status->chains) {
-+		int i;
-+
-+		stats->chains = status->chains;
-+		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
-+			int signal = status->chain_signal[i];
-+
-+			if (!(status->chains & BIT(i)))
-+				continue;
-+
-+			stats->chain_signal_last[i] = signal;
-+			if (!fast_rx->uses_rss)
-+				ewma_signal_add(&sta->rx_stats_avg.chain_signal[i],
-+						-signal);
-+		}
-+	}
-+	/* end of statistics */
-+
-+	stats->last_rx = jiffies;
-+	stats->last_rate = sta_stats_encode_rate(status);
-+
-+	stats->fragments++;
-+	stats->packets++;
-+
-+	skb->dev = fast_rx->dev;
-+
-+	ieee80211_rx_stats(fast_rx->dev, skb->len);
-+
-+	/* The seqno index has the same property as needed
-+	 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
-+	 * for non-QoS-data frames. Here we know it's a data
-+	 * frame, so count MSDUs.
-+	 */
-+	u64_stats_update_begin(&stats->syncp);
-+	stats->msdu[rx->seqno_idx]++;
-+	stats->bytes += orig_len;
-+	u64_stats_update_end(&stats->syncp);
-+
-+	if (fast_rx->internal_forward) {
-+		struct sk_buff *xmit_skb = NULL;
-+		if (is_multicast_ether_addr(da)) {
-+			xmit_skb = skb_copy(skb, GFP_ATOMIC);
-+		} else if (!ether_addr_equal(da, sa) &&
-+			   sta_info_get(rx->sdata, da)) {
-+			xmit_skb = skb;
-+			skb = NULL;
-+		}
-+
-+		if (xmit_skb) {
-+			/*
-+			 * Send to wireless media and increase priority by 256
-+			 * to keep the received priority instead of
-+			 * reclassifying the frame (see cfg80211_classify8021d).
-+			 */
-+			xmit_skb->priority += 256;
-+			xmit_skb->protocol = htons(ETH_P_802_3);
-+			skb_reset_network_header(xmit_skb);
-+			skb_reset_mac_header(xmit_skb);
-+			dev_queue_xmit(xmit_skb);
-+		}
-+
-+		if (!skb)
-+			return;
-+	}
-+
-+	/* deliver to local stack */
-+	skb->protocol = eth_type_trans(skb, fast_rx->dev);
-+	memset(skb->cb, 0, sizeof(skb->cb));
-+	if (rx->list)
-+#if LINUX_VERSION_IS_GEQ(4,19,0)
-+		list_add_tail(&skb->list, rx->list);
-+#else
-+		__skb_queue_tail(rx->list, skb);
-+#endif
-+	else
-+		netif_receive_skb(skb);
-+
-+}
-+
- static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
- 				     struct ieee80211_fast_rx *fast_rx)
- {
-@@ -4377,9 +4492,6 @@ static bool ieee80211_invoke_fast_rx(str
- 	} addrs __aligned(2);
- 	struct ieee80211_sta_rx_stats *stats = &sta->rx_stats;
- 
--	if (fast_rx->uses_rss)
--		stats = this_cpu_ptr(sta->pcpu_rx_stats);
--
- 	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
- 	 * to a common data structure; drivers can implement that per queue
- 	 * but we don't have that information in mac80211
-@@ -4453,32 +4565,6 @@ static bool ieee80211_invoke_fast_rx(str
- 	    pskb_trim(skb, skb->len - fast_rx->icv_len))
- 		goto drop;
- 
--	/* statistics part of ieee80211_rx_h_sta_process() */
--	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
--		stats->last_signal = status->signal;
--		if (!fast_rx->uses_rss)
--			ewma_signal_add(&sta->rx_stats_avg.signal,
--					-status->signal);
--	}
--
--	if (status->chains) {
--		int i;
--
--		stats->chains = status->chains;
--		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
--			int signal = status->chain_signal[i];
--
--			if (!(status->chains & BIT(i)))
--				continue;
--
--			stats->chain_signal_last[i] = signal;
--			if (!fast_rx->uses_rss)
--				ewma_signal_add(&sta->rx_stats_avg.chain_signal[i],
--						-signal);
--		}
--	}
--	/* end of statistics */
--
- 	if (rx->key && !ieee80211_has_protected(hdr->frame_control))
- 		goto drop;
- 
-@@ -4490,12 +4576,6 @@ static bool ieee80211_invoke_fast_rx(str
- 		return true;
- 	}
- 
--	stats->last_rx = jiffies;
--	stats->last_rate = sta_stats_encode_rate(status);
--
--	stats->fragments++;
--	stats->packets++;
--
- 	/* do the header conversion - first grab the addresses */
- 	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
- 	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
-@@ -4504,62 +4584,14 @@ static bool ieee80211_invoke_fast_rx(str
- 	/* push the addresses in front */
- 	memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
- 
--	skb->dev = fast_rx->dev;
--
--	ieee80211_rx_stats(fast_rx->dev, skb->len);
--
--	/* The seqno index has the same property as needed
--	 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
--	 * for non-QoS-data frames. Here we know it's a data
--	 * frame, so count MSDUs.
--	 */
--	u64_stats_update_begin(&stats->syncp);
--	stats->msdu[rx->seqno_idx]++;
--	stats->bytes += orig_len;
--	u64_stats_update_end(&stats->syncp);
--
--	if (fast_rx->internal_forward) {
--		struct sk_buff *xmit_skb = NULL;
--		if (is_multicast_ether_addr(addrs.da)) {
--			xmit_skb = skb_copy(skb, GFP_ATOMIC);
--		} else if (!ether_addr_equal(addrs.da, addrs.sa) &&
--			   sta_info_get(rx->sdata, addrs.da)) {
--			xmit_skb = skb;
--			skb = NULL;
--		}
--
--		if (xmit_skb) {
--			/*
--			 * Send to wireless media and increase priority by 256
--			 * to keep the received priority instead of
--			 * reclassifying the frame (see cfg80211_classify8021d).
--			 */
--			xmit_skb->priority += 256;
--			xmit_skb->protocol = htons(ETH_P_802_3);
--			skb_reset_network_header(xmit_skb);
--			skb_reset_mac_header(xmit_skb);
--			dev_queue_xmit(xmit_skb);
--		}
--
--		if (!skb)
--			return true;
--	}
--
--	/* deliver to local stack */
--	skb->protocol = eth_type_trans(skb, fast_rx->dev);
--	memset(skb->cb, 0, sizeof(skb->cb));
--	if (rx->list)
--#if LINUX_VERSION_IS_GEQ(4,19,0)
--		list_add_tail(&skb->list, rx->list);
--#else
--		__skb_queue_tail(rx->list, skb);
--#endif
--	else
--		netif_receive_skb(skb);
-+	ieee80211_rx_8023(rx, fast_rx, orig_len);
- 
- 	return true;
-  drop:
- 	dev_kfree_skb(skb);
-+	if (fast_rx->uses_rss)
-+		stats = this_cpu_ptr(sta->pcpu_rx_stats);
-+
- 	stats->dropped++;
- 	return true;
- }
-@@ -4613,6 +4645,47 @@ static bool ieee80211_prepare_and_rx_han
- 	return true;
- }
- 
-+static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw,
-+				       struct ieee80211_sta *pubsta,
-+				       struct sk_buff *skb,
-+#if LINUX_VERSION_IS_GEQ(4,19,0)
-+				       struct list_head *list)
-+#else
-+				       struct sk_buff_head *list)
-+#endif
-+{
-+	struct ieee80211_local *local = hw_to_local(hw);
-+	struct ieee80211_fast_rx *fast_rx;
-+	struct ieee80211_rx_data rx;
-+
-+	memset(&rx, 0, sizeof(rx));
-+	rx.skb = skb;
-+	rx.local = local;
-+	rx.list = list;
-+
-+	I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
-+
-+	/* drop frame if too short for header */
-+	if (skb->len < sizeof(struct ethhdr))
-+		goto drop;
-+
-+	if (!pubsta)
-+		goto drop;
-+
-+	rx.sta = container_of(pubsta, struct sta_info, sta);
-+	rx.sdata = rx.sta->sdata;
-+
-+	fast_rx = rcu_dereference(rx.sta->fast_rx);
-+	if (!fast_rx)
-+		goto drop;
-+
-+	ieee80211_rx_8023(&rx, fast_rx, skb->len);
-+	return;
-+
-+drop:
-+	dev_kfree_skb(skb);
-+}
-+
- /*
-  * This is the actual Rx frames handler. as it belongs to Rx path it must
-  * be called with rcu_read_lock protection.
-@@ -4850,15 +4923,20 @@ void ieee80211_rx_list(struct ieee80211_
- 	 * if it was previously present.
- 	 * Also, frames with less than 16 bytes are dropped.
- 	 */
--	skb = ieee80211_rx_monitor(local, skb, rate);
--	if (!skb)
--		return;
-+	if (!(status->flag & RX_FLAG_8023)) {
-+		skb = ieee80211_rx_monitor(local, skb, rate);
-+		if (!skb)
-+			return;
-+	}
- 
- 	ieee80211_tpt_led_trig_rx(local,
- 			((struct ieee80211_hdr *)skb->data)->frame_control,
- 			skb->len);
- 
--	__ieee80211_rx_handle_packet(hw, pubsta, skb, list);
-+	if (status->flag & RX_FLAG_8023)
-+		__ieee80211_rx_handle_8023(hw, pubsta, skb, list);
-+	else
-+		__ieee80211_rx_handle_packet(hw, pubsta, skb, list);
- 
- 	return;
-  drop:
---- a/net/mac80211/sta_info.h
-+++ b/net/mac80211/sta_info.h
-@@ -71,6 +71,7 @@
-  *	until pending frames are delivered
-  * @WLAN_STA_USES_ENCRYPTION: This station was configured for encryption,
-  *	so drop all packets without a key later.
-+ * @WLAN_STA_DECAP_OFFLOAD: This station uses rx decap offload
-  *
-  * @NUM_WLAN_STA_FLAGS: number of defined flags
-  */
-@@ -102,6 +103,7 @@ enum ieee80211_sta_info_flags {
- 	WLAN_STA_MPSP_RECIPIENT,
- 	WLAN_STA_PS_DELIVER,
- 	WLAN_STA_USES_ENCRYPTION,
-+	WLAN_STA_DECAP_OFFLOAD,
- 
- 	NUM_WLAN_STA_FLAGS,
- };
---- a/net/mac80211/trace.h
-+++ b/net/mac80211/trace.h
-@@ -2761,7 +2761,7 @@ DEFINE_EVENT(local_sdata_addr_evt, drv_u
- 	TP_ARGS(local, sdata)
- );
- 
--TRACE_EVENT(drv_sta_set_4addr,
-+DECLARE_EVENT_CLASS(sta_flag_evt,
- 	TP_PROTO(struct ieee80211_local *local,
- 		 struct ieee80211_sub_if_data *sdata,
- 		 struct ieee80211_sta *sta, bool enabled),
-@@ -2788,6 +2788,22 @@ TRACE_EVENT(drv_sta_set_4addr,
- 	)
- );
- 
-+DEFINE_EVENT(sta_flag_evt, drv_sta_set_4addr,
-+	TP_PROTO(struct ieee80211_local *local,
-+		 struct ieee80211_sub_if_data *sdata,
-+		 struct ieee80211_sta *sta, bool enabled),
-+
-+	TP_ARGS(local, sdata, sta, enabled)
-+);
-+
-+DEFINE_EVENT(sta_flag_evt, drv_sta_set_decap_offload,
-+	TP_PROTO(struct ieee80211_local *local,
-+		 struct ieee80211_sub_if_data *sdata,
-+		 struct ieee80211_sta *sta, bool enabled),
-+
-+	TP_ARGS(local, sdata, sta, enabled)
-+);
-+
- #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
- 
- #undef TRACE_INCLUDE_PATH
diff --git a/package/kernel/mac80211/patches/subsys/316-cfg80211-fix-possible-NULL-pointer-dereference-in-cf.patch b/package/kernel/mac80211/patches/subsys/316-cfg80211-fix-possible-NULL-pointer-dereference-in-cf.patch
new file mode 100644
index 0000000000..362bb885d7
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/316-cfg80211-fix-possible-NULL-pointer-dereference-in-cf.patch
@@ -0,0 +1,99 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 3 Nov 2021 18:02:35 +0100
+Subject: [PATCH] cfg80211: fix possible NULL pointer dereference in
+ cfg80211_stop_offchan_radar_detection
+
+Fix the following NULL pointer dereference in
+cfg80211_stop_offchan_radar_detection routine that occurs when hostapd
+is stopped during the CAC on offchannel chain:
+
+Sat Jan  1 0[  779.567851]   ESR = 0x96000005
+0:12:50 2000 dae[  779.572346]   EC = 0x25: DABT (current EL), IL = 32 bits
+mon.debug hostap[  779.578984]   SET = 0, FnV = 0
+d: hostapd_inter[  779.583445]   EA = 0, S1PTW = 0
+face_deinit_free[  779.587936] Data abort info:
+: num_bss=1 conf[  779.592224]   ISV = 0, ISS = 0x00000005
+->num_bss=1
+Sat[  779.597403]   CM = 0, WnR = 0
+ Jan  1 00:12:50[  779.601749] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000418b2000
+ 2000 daemon.deb[  779.609601] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
+ug hostapd: host[  779.619657] Internal error: Oops: 96000005 [#1] SMP
+[  779.770810] CPU: 0 PID: 2202 Comm: hostapd Not tainted 5.10.75 #0
+[  779.776892] Hardware name: MediaTek MT7622 RFB1 board (DT)
+[  779.782370] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)
+[  779.788384] pc : cfg80211_chandef_valid+0x10/0x490 [cfg80211]
+[  779.794128] lr : cfg80211_check_station_change+0x3190/0x3950 [cfg80211]
+[  779.800731] sp : ffffffc01204b7e0
+[  779.804036] x29: ffffffc01204b7e0 x28: ffffff80039bdc00
+[  779.809340] x27: 0000000000000000 x26: ffffffc008cb3050
+[  779.814644] x25: 0000000000000000 x24: 0000000000000002
+[  779.819948] x23: ffffff8002630000 x22: ffffff8003e748d0
+[  779.825252] x21: 0000000000000cc0 x20: ffffff8003da4a00
+[  779.830556] x19: 0000000000000000 x18: ffffff8001bf7ce0
+[  779.835860] x17: 00000000ffffffff x16: 0000000000000000
+[  779.841164] x15: 0000000040d59200 x14: 00000000000019c0
+[  779.846467] x13: 00000000000001c8 x12: 000636b9e9dab1c6
+[  779.851771] x11: 0000000000000141 x10: 0000000000000820
+[  779.857076] x9 : 0000000000000000 x8 : ffffff8003d7d038
+[  779.862380] x7 : 0000000000000000 x6 : ffffff8003d7d038
+[  779.867683] x5 : 0000000000000e90 x4 : 0000000000000038
+[  779.872987] x3 : 0000000000000002 x2 : 0000000000000004
+[  779.878291] x1 : 0000000000000000 x0 : 0000000000000000
+[  779.883594] Call trace:
+[  779.886039]  cfg80211_chandef_valid+0x10/0x490 [cfg80211]
+[  779.891434]  cfg80211_check_station_change+0x3190/0x3950 [cfg80211]
+[  779.897697]  nl80211_radar_notify+0x138/0x19c [cfg80211]
+[  779.903005]  cfg80211_stop_offchan_radar_detection+0x7c/0x8c [cfg80211]
+[  779.909616]  __cfg80211_leave+0x2c/0x190 [cfg80211]
+[  779.914490]  cfg80211_register_netdevice+0x1c0/0x6d0 [cfg80211]
+[  779.920404]  raw_notifier_call_chain+0x50/0x70
+[  779.924841]  call_netdevice_notifiers_info+0x54/0xa0
+[  779.929796]  __dev_close_many+0x40/0x100
+[  779.933712]  __dev_change_flags+0x98/0x190
+[  779.937800]  dev_change_flags+0x20/0x60
+[  779.941628]  devinet_ioctl+0x534/0x6d0
+[  779.945370]  inet_ioctl+0x1bc/0x230
+[  779.948849]  sock_do_ioctl+0x44/0x200
+[  779.952502]  sock_ioctl+0x268/0x4c0
+[  779.955985]  __arm64_sys_ioctl+0xac/0xd0
+[  779.959900]  el0_svc_common.constprop.0+0x60/0x110
+[  779.964682]  do_el0_svc+0x1c/0x24
+[  779.967990]  el0_svc+0x10/0x1c
+[  779.971036]  el0_sync_handler+0x9c/0x120
+[  779.974950]  el0_sync+0x148/0x180
+[  779.978259] Code: a9bc7bfd 910003fd a90153f3 aa0003f3 (f9400000)
+[  779.984344] ---[ end trace 0e67b4f5d6cdeec7 ]---
+[  779.996400] Kernel panic - not syncing: Oops: Fatal exception
+[  780.002139] SMP: stopping secondary CPUs
+[  780.006057] Kernel Offset: disabled
+[  780.009537] CPU features: 0x0000002,04002004
+[  780.013796] Memory Limit: none
+
+Fixes: b8f5facf286b ("cfg80211: implement APIs for dedicated radar detection HW")
+Reported-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Tested-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/c2e34c065bf8839c5ffa45498ae154021a72a520.1635958796.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -982,6 +982,9 @@ __cfg80211_offchan_cac_event(struct cfg8
+ 
+ 	lockdep_assert_wiphy(&rdev->wiphy);
+ 
++	if (!cfg80211_chandef_valid(chandef))
++		return;
++
+ 	if (event != NL80211_RADAR_CAC_STARTED && !rdev->offchan_radar_wdev)
+ 		return;
+ 
+@@ -1096,6 +1099,6 @@ void cfg80211_stop_offchan_radar_detecti
+ 
+ 	rdev_set_radar_offchan(rdev, NULL);
+ 
+-	__cfg80211_offchan_cac_event(rdev, NULL, NULL,
++	__cfg80211_offchan_cac_event(rdev, wdev, &rdev->offchan_radar_chandef,
+ 				     NL80211_RADAR_CAC_ABORTED);
+ }
diff --git a/package/kernel/mac80211/patches/subsys/316-mac80211-enable-QoS-support-for-nl80211-ctrl-port.patch b/package/kernel/mac80211/patches/subsys/316-mac80211-enable-QoS-support-for-nl80211-ctrl-port.patch
deleted file mode 100644
index 91987ed759..0000000000
--- a/package/kernel/mac80211/patches/subsys/316-mac80211-enable-QoS-support-for-nl80211-ctrl-port.patch
+++ /dev/null
@@ -1,116 +0,0 @@
-From: Markus Theil <markus.theil@tu-ilmenau.de>
-Date: Sat, 6 Feb 2021 12:51:12 +0100
-Subject: [PATCH] mac80211: enable QoS support for nl80211 ctrl port
-
-This patch unifies sending control port frames
-over nl80211 and AF_PACKET sockets a little more.
-
-Before this patch, EAPOL frames got QoS prioritization
-only when using AF_PACKET sockets.
-
-__ieee80211_select_queue only selects a QoS-enabled queue
-for control port frames, when the control port protocol
-is set correctly on the skb. For the AF_PACKET path this
-works, but the nl80211 path used ETH_P_802_3.
-
-Another check for injected frames in wme.c then prevented
-the QoS TID to be copied in the frame.
-
-In order to fix this, get rid of the frame injection marking
-for nl80211 ctrl port and set the correct ethernet protocol.
-
-Please note:
-An erlier version of this path tried to prevent
-frame aggregation for control port frames in order to speed up
-the initial connection setup a little. This seemed to cause
-issues on my older Intel dvm-based hardware, and was therefore
-removed again. Future commits which try to reintroduce this
-have to check carefully how hw behaves with aggregated and
-non-aggregated traffic for the same TID.
-My NIC: Intel(R) Centrino(R) Ultimate-N 6300 AGN, REV=0x74
-
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
-Link: https://lore.kernel.org/r/20210206115112.567881-1-markus.theil@tu-ilmenau.de
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -628,16 +628,12 @@ static void ieee80211_report_ack_skb(str
- 		u64 cookie = IEEE80211_SKB_CB(skb)->ack.cookie;
- 		struct ieee80211_sub_if_data *sdata;
- 		struct ieee80211_hdr *hdr = (void *)skb->data;
--		__be16 ethertype = 0;
--
--		if (skb->len >= ETH_HLEN && skb->protocol == cpu_to_be16(ETH_P_802_3))
--			skb_copy_bits(skb, 2 * ETH_ALEN, &ethertype, ETH_TLEN);
- 
- 		rcu_read_lock();
- 		sdata = ieee80211_sdata_from_skb(local, skb);
- 		if (sdata) {
--			if (ethertype == sdata->control_port_protocol ||
--			    ethertype == cpu_to_be16(ETH_P_PREAUTH))
-+			if (skb->protocol == sdata->control_port_protocol ||
-+			    skb->protocol == cpu_to_be16(ETH_P_PREAUTH))
- 				cfg80211_control_port_tx_status(&sdata->wdev,
- 								cookie,
- 								skb->data,
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1195,9 +1195,7 @@ ieee80211_tx_prepare(struct ieee80211_su
- 			tx->sta = rcu_dereference(sdata->u.vlan.sta);
- 			if (!tx->sta && sdata->wdev.use_4addr)
- 				return TX_DROP;
--		} else if (info->flags & (IEEE80211_TX_INTFL_NL80211_FRAME_TX |
--					  IEEE80211_TX_CTL_INJECTED) ||
--			   tx->sdata->control_port_protocol == tx->skb->protocol) {
-+		} else if (tx->sdata->control_port_protocol == tx->skb->protocol) {
- 			tx->sta = sta_info_get_bss(sdata, hdr->addr1);
- 		}
- 		if (!tx->sta && !is_multicast_ether_addr(hdr->addr1))
-@@ -5455,6 +5453,7 @@ int ieee80211_tx_control_port(struct wip
- {
- 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
- 	struct ieee80211_local *local = sdata->local;
-+	struct sta_info *sta;
- 	struct sk_buff *skb;
- 	struct ethhdr *ehdr;
- 	u32 ctrl_flags = 0;
-@@ -5477,8 +5476,7 @@ int ieee80211_tx_control_port(struct wip
- 	if (cookie)
- 		ctrl_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
- 
--	flags |= IEEE80211_TX_INTFL_NL80211_FRAME_TX |
--		 IEEE80211_TX_CTL_INJECTED;
-+	flags |= IEEE80211_TX_INTFL_NL80211_FRAME_TX;
- 
- 	skb = dev_alloc_skb(local->hw.extra_tx_headroom +
- 			    sizeof(struct ethhdr) + len);
-@@ -5495,10 +5493,25 @@ int ieee80211_tx_control_port(struct wip
- 	ehdr->h_proto = proto;
- 
- 	skb->dev = dev;
--	skb->protocol = htons(ETH_P_802_3);
-+	skb->protocol = proto;
- 	skb_reset_network_header(skb);
- 	skb_reset_mac_header(skb);
- 
-+	/* update QoS header to prioritize control port frames if possible,
-+	 * priorization also happens for control port frames send over
-+	 * AF_PACKET
-+	 */
-+	rcu_read_lock();
-+
-+	if (ieee80211_lookup_ra_sta(sdata, skb, &sta) == 0 && !IS_ERR(sta)) {
-+		u16 queue = __ieee80211_select_queue(sdata, sta, skb);
-+
-+		skb_set_queue_mapping(skb, queue);
-+		skb_get_hash(skb);
-+	}
-+
-+	rcu_read_unlock();
-+
- 	/* mutex lock is only needed for incrementing the cookie counter */
- 	mutex_lock(&local->mtx);
- 
diff --git a/package/kernel/mac80211/patches/subsys/317-cfg80211-schedule-offchan_cac_abort_wk-in-cfg80211_r.patch b/package/kernel/mac80211/patches/subsys/317-cfg80211-schedule-offchan_cac_abort_wk-in-cfg80211_r.patch
new file mode 100644
index 0000000000..df7afefb34
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/317-cfg80211-schedule-offchan_cac_abort_wk-in-cfg80211_r.patch
@@ -0,0 +1,136 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 16 Nov 2021 12:41:52 +0100
+Subject: [PATCH] cfg80211: schedule offchan_cac_abort_wk in
+ cfg80211_radar_event
+
+If necessary schedule offchan_cac_abort_wk work in cfg80211_radar_event
+routine adding offchan parameter to cfg80211_radar_event signature.
+Rename cfg80211_radar_event in __cfg80211_radar_event and introduce
+the two following inline helpers:
+- cfg80211_radar_event
+- cfg80211_offchan_radar_event
+Doing so the drv will not need to run cfg80211_offchan_cac_abort() after
+radar detection on the offchannel chain.
+
+Tested-by: Owen Peng <owen.peng@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/3ff583e021e3343a3ced54a7b09b5e184d1880dc.1637062727.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -7580,15 +7580,33 @@ void cfg80211_cqm_txe_notify(struct net_
+ void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp);
+ 
+ /**
+- * cfg80211_radar_event - radar detection event
++ * __cfg80211_radar_event - radar detection event
+  * @wiphy: the wiphy
+  * @chandef: chandef for the current channel
++ * @offchan: the radar has been detected on the offchannel chain
+  * @gfp: context flags
+  *
+  * This function is called when a radar is detected on the current chanenl.
+  */
+-void cfg80211_radar_event(struct wiphy *wiphy,
+-			  struct cfg80211_chan_def *chandef, gfp_t gfp);
++void __cfg80211_radar_event(struct wiphy *wiphy,
++			    struct cfg80211_chan_def *chandef,
++			    bool offchan, gfp_t gfp);
++
++static inline void
++cfg80211_radar_event(struct wiphy *wiphy,
++		     struct cfg80211_chan_def *chandef,
++		     gfp_t gfp)
++{
++	__cfg80211_radar_event(wiphy, chandef, false, gfp);
++}
++
++static inline void
++cfg80211_offchan_radar_event(struct wiphy *wiphy,
++			     struct cfg80211_chan_def *chandef,
++			     gfp_t gfp)
++{
++	__cfg80211_radar_event(wiphy, chandef, true, gfp);
++}
+ 
+ /**
+  * cfg80211_sta_opmode_change_notify - STA's ht/vht operation mode change event
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -905,13 +905,13 @@ void cfg80211_dfs_channels_update_work(s
+ }
+ 
+ 
+-void cfg80211_radar_event(struct wiphy *wiphy,
+-			  struct cfg80211_chan_def *chandef,
+-			  gfp_t gfp)
++void __cfg80211_radar_event(struct wiphy *wiphy,
++			    struct cfg80211_chan_def *chandef,
++			    bool offchan, gfp_t gfp)
+ {
+ 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+ 
+-	trace_cfg80211_radar_event(wiphy, chandef);
++	trace_cfg80211_radar_event(wiphy, chandef, offchan);
+ 
+ 	/* only set the chandef supplied channel to unavailable, in
+ 	 * case the radar is detected on only one of multiple channels
+@@ -919,6 +919,9 @@ void cfg80211_radar_event(struct wiphy *
+ 	 */
+ 	cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
+ 
++	if (offchan)
++		queue_work(cfg80211_wq, &rdev->offchan_cac_abort_wk);
++
+ 	cfg80211_sched_dfs_chan_update(rdev);
+ 
+ 	nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
+@@ -926,7 +929,7 @@ void cfg80211_radar_event(struct wiphy *
+ 	memcpy(&rdev->radar_chandef, chandef, sizeof(struct cfg80211_chan_def));
+ 	queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
+ }
+-EXPORT_SYMBOL(cfg80211_radar_event);
++EXPORT_SYMBOL(__cfg80211_radar_event);
+ 
+ void cfg80211_cac_event(struct net_device *netdev,
+ 			const struct cfg80211_chan_def *chandef,
+@@ -998,7 +1001,8 @@ __cfg80211_offchan_cac_event(struct cfg8
+ 		rdev->offchan_radar_wdev = NULL;
+ 		break;
+ 	case NL80211_RADAR_CAC_ABORTED:
+-		cancel_delayed_work(&rdev->offchan_cac_done_wk);
++		if (!cancel_delayed_work(&rdev->offchan_cac_done_wk))
++			return;
+ 		wdev = rdev->offchan_radar_wdev;
+ 		rdev->offchan_radar_wdev = NULL;
+ 		break;
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -3022,18 +3022,21 @@ TRACE_EVENT(cfg80211_ch_switch_started_n
+ );
+ 
+ TRACE_EVENT(cfg80211_radar_event,
+-	TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
+-	TP_ARGS(wiphy, chandef),
++	TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef,
++		 bool offchan),
++	TP_ARGS(wiphy, chandef, offchan),
+ 	TP_STRUCT__entry(
+ 		WIPHY_ENTRY
+ 		CHAN_DEF_ENTRY
++		__field(bool, offchan)
+ 	),
+ 	TP_fast_assign(
+ 		WIPHY_ASSIGN;
+ 		CHAN_DEF_ASSIGN(chandef);
++		__entry->offchan = offchan;
+ 	),
+-	TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
+-		  WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
++	TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT ", offchan %d",
++		  WIPHY_PR_ARG, CHAN_DEF_PR_ARG, __entry->offchan)
+ );
+ 
+ TRACE_EVENT(cfg80211_cac_event,
diff --git a/package/kernel/mac80211/patches/subsys/318-cfg80211-allow-continuous-radar-monitoring-on-offcha.patch b/package/kernel/mac80211/patches/subsys/318-cfg80211-allow-continuous-radar-monitoring-on-offcha.patch
new file mode 100644
index 0000000000..a1b6e3c80d
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/318-cfg80211-allow-continuous-radar-monitoring-on-offcha.patch
@@ -0,0 +1,220 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 16 Nov 2021 15:03:36 +0100
+Subject: [PATCH] cfg80211: allow continuous radar monitoring on offchannel
+ chain
+
+Allow continuous radar detection on the offchannel chain in order
+to switch to the monitored channel whenever the underlying driver
+reports a radar pattern on the main channel.
+
+Tested-by: Owen Peng <owen.peng@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/d46217310a49b14ff0e9c002f0a6e0547d70fd2c.1637071350.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/chan.c
++++ b/net/wireless/chan.c
+@@ -712,6 +712,19 @@ static bool cfg80211_is_wiphy_oper_chan(
+ 	return false;
+ }
+ 
++static bool
++cfg80211_offchan_chain_is_active(struct cfg80211_registered_device *rdev,
++				 struct ieee80211_channel *channel)
++{
++	if (!rdev->offchan_radar_wdev)
++		return false;
++
++	if (!cfg80211_chandef_valid(&rdev->offchan_radar_chandef))
++		return false;
++
++	return cfg80211_is_sub_chan(&rdev->offchan_radar_chandef, channel);
++}
++
+ bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
+ 				  struct ieee80211_channel *chan)
+ {
+@@ -728,6 +741,9 @@ bool cfg80211_any_wiphy_oper_chan(struct
+ 
+ 		if (cfg80211_is_wiphy_oper_chan(&rdev->wiphy, chan))
+ 			return true;
++
++		if (cfg80211_offchan_chain_is_active(rdev, chan))
++			return true;
+ 	}
+ 
+ 	return false;
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -988,7 +988,7 @@ __cfg80211_offchan_cac_event(struct cfg8
+ 	if (!cfg80211_chandef_valid(chandef))
+ 		return;
+ 
+-	if (event != NL80211_RADAR_CAC_STARTED && !rdev->offchan_radar_wdev)
++	if (!rdev->offchan_radar_wdev)
+ 		return;
+ 
+ 	switch (event) {
+@@ -998,17 +998,13 @@ __cfg80211_offchan_cac_event(struct cfg8
+ 		queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
+ 		cfg80211_sched_dfs_chan_update(rdev);
+ 		wdev = rdev->offchan_radar_wdev;
+-		rdev->offchan_radar_wdev = NULL;
+ 		break;
+ 	case NL80211_RADAR_CAC_ABORTED:
+ 		if (!cancel_delayed_work(&rdev->offchan_cac_done_wk))
+ 			return;
+ 		wdev = rdev->offchan_radar_wdev;
+-		rdev->offchan_radar_wdev = NULL;
+ 		break;
+ 	case NL80211_RADAR_CAC_STARTED:
+-		WARN_ON(!wdev);
+-		rdev->offchan_radar_wdev = wdev;
+ 		break;
+ 	default:
+ 		return;
+@@ -1024,7 +1020,8 @@ cfg80211_offchan_cac_event(struct cfg802
+ 			   enum nl80211_radar_event event)
+ {
+ 	wiphy_lock(&rdev->wiphy);
+-	__cfg80211_offchan_cac_event(rdev, NULL, chandef, event);
++	__cfg80211_offchan_cac_event(rdev, rdev->offchan_radar_wdev,
++				     chandef, event);
+ 	wiphy_unlock(&rdev->wiphy);
+ }
+ 
+@@ -1071,7 +1068,13 @@ cfg80211_start_offchan_radar_detection(s
+ 				     NL80211_EXT_FEATURE_RADAR_OFFCHAN))
+ 		return -EOPNOTSUPP;
+ 
+-	if (rdev->offchan_radar_wdev)
++	/* Offchannel chain already locked by another wdev */
++	if (rdev->offchan_radar_wdev && rdev->offchan_radar_wdev != wdev)
++		return -EBUSY;
++
++	/* CAC already in progress on the offchannel chain */
++	if (rdev->offchan_radar_wdev == wdev &&
++	    delayed_work_pending(&rdev->offchan_cac_done_wk))
+ 		return -EBUSY;
+ 
+ 	err = rdev_set_radar_offchan(rdev, chandef);
+@@ -1083,6 +1086,8 @@ cfg80211_start_offchan_radar_detection(s
+ 		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
+ 
+ 	rdev->offchan_radar_chandef = *chandef;
++	rdev->offchan_radar_wdev = wdev; /* Get offchain ownership */
++
+ 	__cfg80211_offchan_cac_event(rdev, wdev, chandef,
+ 				     NL80211_RADAR_CAC_STARTED);
+ 	queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_done_wk,
+@@ -1102,6 +1107,7 @@ void cfg80211_stop_offchan_radar_detecti
+ 		return;
+ 
+ 	rdev_set_radar_offchan(rdev, NULL);
++	rdev->offchan_radar_wdev = NULL; /* Release offchain ownership */
+ 
+ 	__cfg80211_offchan_cac_event(rdev, wdev, &rdev->offchan_radar_chandef,
+ 				     NL80211_RADAR_CAC_ABORTED);
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -9278,42 +9278,60 @@ static int nl80211_start_radar_detection
+ 	struct cfg80211_chan_def chandef;
+ 	enum nl80211_dfs_regions dfs_region;
+ 	unsigned int cac_time_ms;
+-	int err;
++	int err = -EINVAL;
++
++	flush_delayed_work(&rdev->dfs_update_channels_wk);
++
++	wiphy_lock(wiphy);
+ 
+ 	dfs_region = reg_get_dfs_region(wiphy);
+ 	if (dfs_region == NL80211_DFS_UNSET)
+-		return -EINVAL;
++		goto unlock;
+ 
+ 	err = nl80211_parse_chandef(rdev, info, &chandef);
+ 	if (err)
+-		return err;
++		goto unlock;
+ 
+ 	err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
+ 	if (err < 0)
+-		return err;
++		goto unlock;
+ 
+-	if (err == 0)
+-		return -EINVAL;
++	if (err == 0) {
++		err = -EINVAL;
++		goto unlock;
++	}
+ 
+-	if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
+-		return -EINVAL;
++	if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) {
++		err = -EINVAL;
++		goto unlock;
++	}
+ 
+-	if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_OFFCHAN]))
+-		return cfg80211_start_offchan_radar_detection(rdev, wdev,
+-							      &chandef);
++	if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_OFFCHAN])) {
++		err = cfg80211_start_offchan_radar_detection(rdev, wdev,
++							     &chandef);
++		goto unlock;
++	}
+ 
+-	if (netif_carrier_ok(dev))
+-		return -EBUSY;
++	if (netif_carrier_ok(dev)) {
++		err = -EBUSY;
++		goto unlock;
++	}
+ 
+-	if (wdev->cac_started)
+-		return -EBUSY;
++	if (wdev->cac_started) {
++		err = -EBUSY;
++		goto unlock;
++	}
+ 
+ 	/* CAC start is offloaded to HW and can't be started manually */
+-	if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
+-		return -EOPNOTSUPP;
++	if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) {
++		err = -EOPNOTSUPP;
++		goto unlock;
++	}
+ 
+-	if (!rdev->ops->start_radar_detection)
+-		return -EOPNOTSUPP;
++	if (!rdev->ops->start_radar_detection) {
++		err = -EOPNOTSUPP;
++		goto unlock;
++	}
+ 
+ 	cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
+ 	if (WARN_ON(!cac_time_ms))
+@@ -9326,6 +9344,9 @@ static int nl80211_start_radar_detection
+ 		wdev->cac_start_time = jiffies;
+ 		wdev->cac_time_ms = cac_time_ms;
+ 	}
++unlock:
++	wiphy_unlock(wiphy);
++
+ 	return err;
+ }
+ 
+@@ -15961,7 +15982,8 @@ static const struct genl_small_ops nl802
+ 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ 		.doit = nl80211_start_radar_detection,
+ 		.flags = GENL_UNS_ADMIN_PERM,
+-		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
++		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
++				  NL80211_FLAG_NO_WIPHY_MTX,
+ 	},
+ 	{
+ 		.cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
diff --git a/package/kernel/mac80211/patches/subsys/319-mac80211-introduce-set_radar_offchan-callback.patch b/package/kernel/mac80211/patches/subsys/319-mac80211-introduce-set_radar_offchan-callback.patch
new file mode 100644
index 0000000000..eb80afbccb
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/319-mac80211-introduce-set_radar_offchan-callback.patch
@@ -0,0 +1,67 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 23 Oct 2021 11:10:51 +0200
+Subject: [PATCH] mac80211: introduce set_radar_offchan callback
+
+Similar to cfg80211, introduce set_radar_offchan callback in mac80211_ops
+in order to configure a dedicated offchannel chain available on some hw
+(e.g. mt7915) to perform offchannel CAC detection and avoid tx/rx downtime.
+
+Tested-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/201110606d4f3a7dfdf31440e351f2e2c375d4f0.1634979655.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -3937,6 +3937,14 @@ struct ieee80211_prep_tx_info {
+  *	twt structure.
+  * @twt_teardown_request: Update the hw with TWT teardown request received
+  *	from the peer.
++ * @set_radar_offchan: Configure dedicated offchannel chain available for
++ *	radar/CAC detection on some hw. This chain can't be used to transmit
++ *	or receive frames and it is bounded to a running wdev.
++ *	Offchannel radar/CAC detection allows to avoid the CAC downtime
++ *	switching to a different channel during CAC detection on the selected
++ *	radar channel.
++ *	The caller is expected to set chandef pointer to NULL in order to
++ *	disable offchannel CAC/radar detection.
+  * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
+  *	resolve a path for hardware flow offloading
+  */
+@@ -4267,6 +4275,8 @@ struct ieee80211_ops {
+ 			      struct ieee80211_twt_setup *twt);
+ 	void (*twt_teardown_request)(struct ieee80211_hw *hw,
+ 				     struct ieee80211_sta *sta, u8 flowid);
++	int (*set_radar_offchan)(struct ieee80211_hw *hw,
++				 struct cfg80211_chan_def *chandef);
+ #if LINUX_VERSION_IS_GEQ(5,10,0)
+ 	int (*net_fill_forward_path)(struct ieee80211_hw *hw,
+ 				     struct ieee80211_vif *vif,
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4344,6 +4344,18 @@ out:
+ 	return err;
+ }
+ 
++static int
++ieee80211_set_radar_offchan(struct wiphy *wiphy,
++			    struct cfg80211_chan_def *chandef)
++{
++	struct ieee80211_local *local = wiphy_priv(wiphy);
++
++	if (!local->ops->set_radar_offchan)
++		return -EOPNOTSUPP;
++
++	return local->ops->set_radar_offchan(&local->hw, chandef);
++}
++
+ const struct cfg80211_ops mac80211_config_ops = {
+ 	.add_virtual_intf = ieee80211_add_iface,
+ 	.del_virtual_intf = ieee80211_del_iface,
+@@ -4448,4 +4460,5 @@ const struct cfg80211_ops mac80211_confi
+ 	.reset_tid_config = ieee80211_reset_tid_config,
+ 	.set_sar_specs = ieee80211_set_sar_specs,
+ 	.color_change = ieee80211_color_change,
++	.set_radar_offchan = ieee80211_set_radar_offchan,
+ };
diff --git a/package/kernel/mac80211/patches/subsys/320-cfg80211-rename-offchannel_chain-structs-to-backgrou.patch b/package/kernel/mac80211/patches/subsys/320-cfg80211-rename-offchannel_chain-structs-to-backgrou.patch
new file mode 100644
index 0000000000..483b87cd88
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/320-cfg80211-rename-offchannel_chain-structs-to-backgrou.patch
@@ -0,0 +1,532 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 29 Nov 2021 14:11:24 +0100
+Subject: [PATCH] cfg80211: rename offchannel_chain structs to background_chain
+ to avoid confusion with ETSI standard
+
+ETSI standard defines "Offchannel CAC" as:
+"Off-Channel CAC is performed by a number of non-continuous checks
+spread over a period in time. This period, which is required to
+determine the presence of radar signals, is defined as the Off-Channel
+CAC Time..
+Minimum Off-Channel CAC Time 6 minutes and Maximum Off-Channel CAC Time
+4 hours..".
+mac80211 implementation refers to a dedicated hw chain used for continuous
+radar monitoring. Rename offchannel_* references to background_* in
+order to avoid confusion with ETSI standard.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/4204cc1d648d76b44557981713231e030a3bd991.1638190762.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4058,14 +4058,14 @@ struct mgmt_frame_regs {
+  *
+  * @color_change: Initiate a color change.
+  *
+- * @set_radar_offchan: Configure dedicated offchannel chain available for
++ * @set_radar_background: Configure dedicated offchannel chain available for
+  *	radar/CAC detection on some hw. This chain can't be used to transmit
+  *	or receive frames and it is bounded to a running wdev.
+- *	Offchannel radar/CAC detection allows to avoid the CAC downtime
++ *	Background radar/CAC detection allows to avoid the CAC downtime
+  *	switching to a different channel during CAC detection on the selected
+  *	radar channel.
+  *	The caller is expected to set chandef pointer to NULL in order to
+- *	disable offchannel CAC/radar detection.
++ *	disable background CAC/radar detection.
+  */
+ struct cfg80211_ops {
+ 	int	(*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
+@@ -4396,8 +4396,8 @@ struct cfg80211_ops {
+ 	int	(*color_change)(struct wiphy *wiphy,
+ 				struct net_device *dev,
+ 				struct cfg80211_color_change_settings *params);
+-	int	(*set_radar_offchan)(struct wiphy *wiphy,
+-				     struct cfg80211_chan_def *chandef);
++	int	(*set_radar_background)(struct wiphy *wiphy,
++					struct cfg80211_chan_def *chandef);
+ };
+ 
+ /*
+@@ -7601,9 +7601,9 @@ cfg80211_radar_event(struct wiphy *wiphy
+ }
+ 
+ static inline void
+-cfg80211_offchan_radar_event(struct wiphy *wiphy,
+-			     struct cfg80211_chan_def *chandef,
+-			     gfp_t gfp)
++cfg80211_background_radar_event(struct wiphy *wiphy,
++				struct cfg80211_chan_def *chandef,
++				gfp_t gfp)
+ {
+ 	__cfg80211_radar_event(wiphy, chandef, true, gfp);
+ }
+@@ -7638,13 +7638,13 @@ void cfg80211_cac_event(struct net_devic
+ 			enum nl80211_radar_event event, gfp_t gfp);
+ 
+ /**
+- * cfg80211_offchan_cac_abort - Channel Availability Check offchan abort event
++ * cfg80211_background_cac_abort - Channel Availability Check offchan abort event
+  * @wiphy: the wiphy
+  *
+  * This function is called by the driver when a Channel Availability Check
+  * (CAC) is aborted by a offchannel dedicated chain.
+  */
+-void cfg80211_offchan_cac_abort(struct wiphy *wiphy);
++void cfg80211_background_cac_abort(struct wiphy *wiphy);
+ 
+ /**
+  * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -3937,14 +3937,14 @@ struct ieee80211_prep_tx_info {
+  *	twt structure.
+  * @twt_teardown_request: Update the hw with TWT teardown request received
+  *	from the peer.
+- * @set_radar_offchan: Configure dedicated offchannel chain available for
++ * @set_radar_background: Configure dedicated offchannel chain available for
+  *	radar/CAC detection on some hw. This chain can't be used to transmit
+  *	or receive frames and it is bounded to a running wdev.
+- *	Offchannel radar/CAC detection allows to avoid the CAC downtime
++ *	Background radar/CAC detection allows to avoid the CAC downtime
+  *	switching to a different channel during CAC detection on the selected
+  *	radar channel.
+  *	The caller is expected to set chandef pointer to NULL in order to
+- *	disable offchannel CAC/radar detection.
++ *	disable background CAC/radar detection.
+  * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
+  *	resolve a path for hardware flow offloading
+  */
+@@ -4275,8 +4275,8 @@ struct ieee80211_ops {
+ 			      struct ieee80211_twt_setup *twt);
+ 	void (*twt_teardown_request)(struct ieee80211_hw *hw,
+ 				     struct ieee80211_sta *sta, u8 flowid);
+-	int (*set_radar_offchan)(struct ieee80211_hw *hw,
+-				 struct cfg80211_chan_def *chandef);
++	int (*set_radar_background)(struct ieee80211_hw *hw,
++				    struct cfg80211_chan_def *chandef);
+ #if LINUX_VERSION_IS_GEQ(5,10,0)
+ 	int (*net_fill_forward_path)(struct ieee80211_hw *hw,
+ 				     struct ieee80211_vif *vif,
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -2608,10 +2608,10 @@ enum nl80211_commands {
+  *	Mandatory parameter for the transmitting interface to enable MBSSID.
+  *	Optional for the non-transmitting interfaces.
+  *
+- * @NL80211_ATTR_RADAR_OFFCHAN: Configure dedicated offchannel chain available for
+- *	radar/CAC detection on some hw. This chain can't be used to transmit
+- *	or receive frames and it is bounded to a running wdev.
+- *	Offchannel radar/CAC detection allows to avoid the CAC downtime
++ * @NL80211_ATTR_RADAR_BACKGROUND: Configure dedicated offchannel chain
++ *	available for radar/CAC detection on some hw. This chain can't be used
++ *	to transmit or receive frames and it is bounded to a running wdev.
++ *	Background radar/CAC detection allows to avoid the CAC downtime
+  *	switching on a different channel during CAC detection on the selected
+  *	radar channel.
+  *
+@@ -3121,7 +3121,7 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_MBSSID_CONFIG,
+ 	NL80211_ATTR_MBSSID_ELEMS,
+ 
+-	NL80211_ATTR_RADAR_OFFCHAN,
++	NL80211_ATTR_RADAR_BACKGROUND,
+ 
+ 	/* add attributes here, update the policy in nl80211.c */
+ 
+@@ -6022,7 +6022,7 @@ enum nl80211_feature_flags {
+  * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
+  *	detection and change announcemnts.
+  *
+- * @NL80211_EXT_FEATURE_RADAR_OFFCHAN: Device supports offchannel radar/CAC
++ * @NL80211_EXT_FEATURE_RADAR_BACKGROUND: Device supports background radar/CAC
+  *	detection.
+  *
+  * @NUM_NL80211_EXT_FEATURES: number of extended features.
+@@ -6090,7 +6090,7 @@ enum nl80211_ext_feature_index {
+ 	NL80211_EXT_FEATURE_SECURE_RTT,
+ 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
+ 	NL80211_EXT_FEATURE_BSS_COLOR,
+-	NL80211_EXT_FEATURE_RADAR_OFFCHAN,
++	NL80211_EXT_FEATURE_RADAR_BACKGROUND,
+ 
+ 	/* add new features before the definition below */
+ 	NUM_NL80211_EXT_FEATURES,
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4345,15 +4345,15 @@ out:
+ }
+ 
+ static int
+-ieee80211_set_radar_offchan(struct wiphy *wiphy,
+-			    struct cfg80211_chan_def *chandef)
++ieee80211_set_radar_background(struct wiphy *wiphy,
++			       struct cfg80211_chan_def *chandef)
+ {
+ 	struct ieee80211_local *local = wiphy_priv(wiphy);
+ 
+-	if (!local->ops->set_radar_offchan)
++	if (!local->ops->set_radar_background)
+ 		return -EOPNOTSUPP;
+ 
+-	return local->ops->set_radar_offchan(&local->hw, chandef);
++	return local->ops->set_radar_background(&local->hw, chandef);
+ }
+ 
+ const struct cfg80211_ops mac80211_config_ops = {
+@@ -4460,5 +4460,5 @@ const struct cfg80211_ops mac80211_confi
+ 	.reset_tid_config = ieee80211_reset_tid_config,
+ 	.set_sar_specs = ieee80211_set_sar_specs,
+ 	.color_change = ieee80211_color_change,
+-	.set_radar_offchan = ieee80211_set_radar_offchan,
++	.set_radar_background = ieee80211_set_radar_background,
+ };
+--- a/net/wireless/chan.c
++++ b/net/wireless/chan.c
+@@ -716,13 +716,13 @@ static bool
+ cfg80211_offchan_chain_is_active(struct cfg80211_registered_device *rdev,
+ 				 struct ieee80211_channel *channel)
+ {
+-	if (!rdev->offchan_radar_wdev)
++	if (!rdev->background_radar_wdev)
+ 		return false;
+ 
+-	if (!cfg80211_chandef_valid(&rdev->offchan_radar_chandef))
++	if (!cfg80211_chandef_valid(&rdev->background_radar_chandef))
+ 		return false;
+ 
+-	return cfg80211_is_sub_chan(&rdev->offchan_radar_chandef, channel);
++	return cfg80211_is_sub_chan(&rdev->background_radar_chandef, channel);
+ }
+ 
+ bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -543,9 +543,10 @@ use_default_name:
+ 	INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work);
+ 	INIT_WORK(&rdev->conn_work, cfg80211_conn_work);
+ 	INIT_WORK(&rdev->event_work, cfg80211_event_work);
+-	INIT_WORK(&rdev->offchan_cac_abort_wk, cfg80211_offchan_cac_abort_wk);
+-	INIT_DELAYED_WORK(&rdev->offchan_cac_done_wk,
+-			  cfg80211_offchan_cac_done_wk);
++	INIT_WORK(&rdev->background_cac_abort_wk,
++		  cfg80211_background_cac_abort_wk);
++	INIT_DELAYED_WORK(&rdev->background_cac_done_wk,
++			  cfg80211_background_cac_done_wk);
+ 
+ 	init_waitqueue_head(&rdev->dev_wait);
+ 
+@@ -1055,13 +1056,13 @@ void wiphy_unregister(struct wiphy *wiph
+ 	cancel_work_sync(&rdev->conn_work);
+ 	flush_work(&rdev->event_work);
+ 	cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
+-	cancel_delayed_work_sync(&rdev->offchan_cac_done_wk);
++	cancel_delayed_work_sync(&rdev->background_cac_done_wk);
+ 	flush_work(&rdev->destroy_work);
+ 	flush_work(&rdev->sched_scan_stop_wk);
+ 	flush_work(&rdev->propagate_radar_detect_wk);
+ 	flush_work(&rdev->propagate_cac_done_wk);
+ 	flush_work(&rdev->mgmt_registrations_update_wk);
+-	flush_work(&rdev->offchan_cac_abort_wk);
++	flush_work(&rdev->background_cac_abort_wk);
+ 
+ #ifdef CONFIG_PM
+ 	if (rdev->wiphy.wowlan_config && rdev->ops->set_wakeup)
+@@ -1210,7 +1211,7 @@ void __cfg80211_leave(struct cfg80211_re
+ 
+ 	cfg80211_pmsr_wdev_down(wdev);
+ 
+-	cfg80211_stop_offchan_radar_detection(wdev);
++	cfg80211_stop_background_radar_detection(wdev);
+ 
+ 	switch (wdev->iftype) {
+ 	case NL80211_IFTYPE_ADHOC:
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -84,10 +84,10 @@ struct cfg80211_registered_device {
+ 
+ 	struct delayed_work dfs_update_channels_wk;
+ 
+-	struct wireless_dev *offchan_radar_wdev;
+-	struct cfg80211_chan_def offchan_radar_chandef;
+-	struct delayed_work offchan_cac_done_wk;
+-	struct work_struct offchan_cac_abort_wk;
++	struct wireless_dev *background_radar_wdev;
++	struct cfg80211_chan_def background_radar_chandef;
++	struct delayed_work background_cac_done_wk;
++	struct work_struct background_cac_abort_wk;
+ 
+ 	/* netlink port which started critical protocol (0 means not started) */
+ 	u32 crit_proto_nlportid;
+@@ -497,15 +497,15 @@ cfg80211_chandef_dfs_cac_time(struct wip
+ void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev);
+ 
+ int
+-cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
+-				       struct wireless_dev *wdev,
+-				       struct cfg80211_chan_def *chandef);
++cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rdev,
++					  struct wireless_dev *wdev,
++					  struct cfg80211_chan_def *chandef);
+ 
+-void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev);
++void cfg80211_stop_background_radar_detection(struct wireless_dev *wdev);
+ 
+-void cfg80211_offchan_cac_done_wk(struct work_struct *work);
++void cfg80211_background_cac_done_wk(struct work_struct *work);
+ 
+-void cfg80211_offchan_cac_abort_wk(struct work_struct *work);
++void cfg80211_background_cac_abort_wk(struct work_struct *work);
+ 
+ bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
+ 				  struct ieee80211_channel *chan);
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -920,7 +920,7 @@ void __cfg80211_radar_event(struct wiphy
+ 	cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
+ 
+ 	if (offchan)
+-		queue_work(cfg80211_wq, &rdev->offchan_cac_abort_wk);
++		queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
+ 
+ 	cfg80211_sched_dfs_chan_update(rdev);
+ 
+@@ -975,10 +975,10 @@ void cfg80211_cac_event(struct net_devic
+ EXPORT_SYMBOL(cfg80211_cac_event);
+ 
+ static void
+-__cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
+-			     struct wireless_dev *wdev,
+-			     const struct cfg80211_chan_def *chandef,
+-			     enum nl80211_radar_event event)
++__cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
++				struct wireless_dev *wdev,
++				const struct cfg80211_chan_def *chandef,
++				enum nl80211_radar_event event)
+ {
+ 	struct wiphy *wiphy = &rdev->wiphy;
+ 	struct net_device *netdev;
+@@ -988,7 +988,7 @@ __cfg80211_offchan_cac_event(struct cfg8
+ 	if (!cfg80211_chandef_valid(chandef))
+ 		return;
+ 
+-	if (!rdev->offchan_radar_wdev)
++	if (!rdev->background_radar_wdev)
+ 		return;
+ 
+ 	switch (event) {
+@@ -997,12 +997,12 @@ __cfg80211_offchan_cac_event(struct cfg8
+ 		memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef));
+ 		queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
+ 		cfg80211_sched_dfs_chan_update(rdev);
+-		wdev = rdev->offchan_radar_wdev;
++		wdev = rdev->background_radar_wdev;
+ 		break;
+ 	case NL80211_RADAR_CAC_ABORTED:
+-		if (!cancel_delayed_work(&rdev->offchan_cac_done_wk))
++		if (!cancel_delayed_work(&rdev->background_cac_done_wk))
+ 			return;
+-		wdev = rdev->offchan_radar_wdev;
++		wdev = rdev->background_radar_wdev;
+ 		break;
+ 	case NL80211_RADAR_CAC_STARTED:
+ 		break;
+@@ -1015,49 +1015,49 @@ __cfg80211_offchan_cac_event(struct cfg8
+ }
+ 
+ static void
+-cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
+-			   const struct cfg80211_chan_def *chandef,
+-			   enum nl80211_radar_event event)
++cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
++			      const struct cfg80211_chan_def *chandef,
++			      enum nl80211_radar_event event)
+ {
+ 	wiphy_lock(&rdev->wiphy);
+-	__cfg80211_offchan_cac_event(rdev, rdev->offchan_radar_wdev,
+-				     chandef, event);
++	__cfg80211_background_cac_event(rdev, rdev->background_radar_wdev,
++					chandef, event);
+ 	wiphy_unlock(&rdev->wiphy);
+ }
+ 
+-void cfg80211_offchan_cac_done_wk(struct work_struct *work)
++void cfg80211_background_cac_done_wk(struct work_struct *work)
+ {
+ 	struct delayed_work *delayed_work = to_delayed_work(work);
+ 	struct cfg80211_registered_device *rdev;
+ 
+ 	rdev = container_of(delayed_work, struct cfg80211_registered_device,
+-			    offchan_cac_done_wk);
+-	cfg80211_offchan_cac_event(rdev, &rdev->offchan_radar_chandef,
+-				   NL80211_RADAR_CAC_FINISHED);
++			    background_cac_done_wk);
++	cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
++				      NL80211_RADAR_CAC_FINISHED);
+ }
+ 
+-void cfg80211_offchan_cac_abort_wk(struct work_struct *work)
++void cfg80211_background_cac_abort_wk(struct work_struct *work)
+ {
+ 	struct cfg80211_registered_device *rdev;
+ 
+ 	rdev = container_of(work, struct cfg80211_registered_device,
+-			    offchan_cac_abort_wk);
+-	cfg80211_offchan_cac_event(rdev, &rdev->offchan_radar_chandef,
+-				   NL80211_RADAR_CAC_ABORTED);
++			    background_cac_abort_wk);
++	cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
++				      NL80211_RADAR_CAC_ABORTED);
+ }
+ 
+-void cfg80211_offchan_cac_abort(struct wiphy *wiphy)
++void cfg80211_background_cac_abort(struct wiphy *wiphy)
+ {
+ 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+ 
+-	queue_work(cfg80211_wq, &rdev->offchan_cac_abort_wk);
++	queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
+ }
+-EXPORT_SYMBOL(cfg80211_offchan_cac_abort);
++EXPORT_SYMBOL(cfg80211_background_cac_abort);
+ 
+ int
+-cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
+-				       struct wireless_dev *wdev,
+-				       struct cfg80211_chan_def *chandef)
++cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rdev,
++					  struct wireless_dev *wdev,
++					  struct cfg80211_chan_def *chandef)
+ {
+ 	unsigned int cac_time_ms;
+ 	int err;
+@@ -1065,19 +1065,19 @@ cfg80211_start_offchan_radar_detection(s
+ 	lockdep_assert_wiphy(&rdev->wiphy);
+ 
+ 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
+-				     NL80211_EXT_FEATURE_RADAR_OFFCHAN))
++				     NL80211_EXT_FEATURE_RADAR_BACKGROUND))
+ 		return -EOPNOTSUPP;
+ 
+ 	/* Offchannel chain already locked by another wdev */
+-	if (rdev->offchan_radar_wdev && rdev->offchan_radar_wdev != wdev)
++	if (rdev->background_radar_wdev && rdev->background_radar_wdev != wdev)
+ 		return -EBUSY;
+ 
+ 	/* CAC already in progress on the offchannel chain */
+-	if (rdev->offchan_radar_wdev == wdev &&
+-	    delayed_work_pending(&rdev->offchan_cac_done_wk))
++	if (rdev->background_radar_wdev == wdev &&
++	    delayed_work_pending(&rdev->background_cac_done_wk))
+ 		return -EBUSY;
+ 
+-	err = rdev_set_radar_offchan(rdev, chandef);
++	err = rdev_set_radar_background(rdev, chandef);
+ 	if (err)
+ 		return err;
+ 
+@@ -1085,30 +1085,31 @@ cfg80211_start_offchan_radar_detection(s
+ 	if (!cac_time_ms)
+ 		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
+ 
+-	rdev->offchan_radar_chandef = *chandef;
+-	rdev->offchan_radar_wdev = wdev; /* Get offchain ownership */
++	rdev->background_radar_chandef = *chandef;
++	rdev->background_radar_wdev = wdev; /* Get offchain ownership */
+ 
+-	__cfg80211_offchan_cac_event(rdev, wdev, chandef,
+-				     NL80211_RADAR_CAC_STARTED);
+-	queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_done_wk,
++	__cfg80211_background_cac_event(rdev, wdev, chandef,
++					NL80211_RADAR_CAC_STARTED);
++	queue_delayed_work(cfg80211_wq, &rdev->background_cac_done_wk,
+ 			   msecs_to_jiffies(cac_time_ms));
+ 
+ 	return 0;
+ }
+ 
+-void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev)
++void cfg80211_stop_background_radar_detection(struct wireless_dev *wdev)
+ {
+ 	struct wiphy *wiphy = wdev->wiphy;
+ 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+ 
+ 	lockdep_assert_wiphy(wiphy);
+ 
+-	if (wdev != rdev->offchan_radar_wdev)
++	if (wdev != rdev->background_radar_wdev)
+ 		return;
+ 
+-	rdev_set_radar_offchan(rdev, NULL);
+-	rdev->offchan_radar_wdev = NULL; /* Release offchain ownership */
++	rdev_set_radar_background(rdev, NULL);
++	rdev->background_radar_wdev = NULL; /* Release offchain ownership */
+ 
+-	__cfg80211_offchan_cac_event(rdev, wdev, &rdev->offchan_radar_chandef,
+-				     NL80211_RADAR_CAC_ABORTED);
++	__cfg80211_background_cac_event(rdev, wdev,
++					&rdev->background_radar_chandef,
++					NL80211_RADAR_CAC_ABORTED);
+ }
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -801,7 +801,7 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_MBSSID_CONFIG] =
+ 			NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
+ 	[NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
+-	[NL80211_ATTR_RADAR_OFFCHAN] = { .type = NLA_FLAG },
++	[NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
+ };
+ 
+ /* policy for the key attributes */
+@@ -9306,9 +9306,9 @@ static int nl80211_start_radar_detection
+ 		goto unlock;
+ 	}
+ 
+-	if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_OFFCHAN])) {
+-		err = cfg80211_start_offchan_radar_detection(rdev, wdev,
+-							     &chandef);
++	if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND])) {
++		err = cfg80211_start_background_radar_detection(rdev, wdev,
++								&chandef);
+ 		goto unlock;
+ 	}
+ 
+--- a/net/wireless/rdev-ops.h
++++ b/net/wireless/rdev-ops.h
+@@ -1382,17 +1382,17 @@ static inline int rdev_color_change(stru
+ }
+ 
+ static inline int
+-rdev_set_radar_offchan(struct cfg80211_registered_device *rdev,
+-		       struct cfg80211_chan_def *chandef)
++rdev_set_radar_background(struct cfg80211_registered_device *rdev,
++			  struct cfg80211_chan_def *chandef)
+ {
+ 	struct wiphy *wiphy = &rdev->wiphy;
+ 	int ret;
+ 
+-	if (!rdev->ops->set_radar_offchan)
++	if (!rdev->ops->set_radar_background)
+ 		return -EOPNOTSUPP;
+ 
+-	trace_rdev_set_radar_offchan(wiphy, chandef);
+-	ret = rdev->ops->set_radar_offchan(wiphy, chandef);
++	trace_rdev_set_radar_background(wiphy, chandef);
++	ret = rdev->ops->set_radar_background(wiphy, chandef);
+ 	trace_rdev_return_int(wiphy, ret);
+ 
+ 	return ret;
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -3646,7 +3646,7 @@ TRACE_EVENT(cfg80211_bss_color_notify,
+ 		  __entry->color_bitmap)
+ );
+ 
+-TRACE_EVENT(rdev_set_radar_offchan,
++TRACE_EVENT(rdev_set_radar_background,
+ 	TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
+ 
+ 	TP_ARGS(wiphy, chandef),
diff --git a/package/kernel/mac80211/patches/subsys/323-mac80211-MBSSID-support-in-interface-handling.patch b/package/kernel/mac80211/patches/subsys/323-mac80211-MBSSID-support-in-interface-handling.patch
new file mode 100644
index 0000000000..a135e3d1b5
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/323-mac80211-MBSSID-support-in-interface-handling.patch
@@ -0,0 +1,144 @@
+From: John Crispin <john@phrozen.org>
+Date: Wed, 15 Sep 2021 19:54:35 -0700
+Subject: [PATCH] mac80211: MBSSID support in interface handling
+
+Configure multiple BSSID and enhanced multi-BSSID advertisement (EMA)
+parameters in mac80211 for AP mode.
+
+For each interface, 'mbssid_tx_vif' points to the transmitting interface of
+the MBSSID set. The pointer is set to NULL if MBSSID is disabled.
+
+Function ieee80211_stop() is modified to always bring down all the
+non-transmitting interfaces first and the transmitting interface last.
+
+Signed-off-by: John Crispin <john@phrozen.org>
+Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
+Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
+Link: https://lore.kernel.org/r/20210916025437.29138-3-alokad@codeaurora.org
+[slightly change logic to be more obvious]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1719,6 +1719,7 @@ enum ieee80211_offload_flags {
+  *	write-protected by sdata_lock and local->mtx so holding either is fine
+  *	for read access.
+  * @color_change_color: the bss color that will be used after the change.
++ * @mbssid_tx_vif: Pointer to the transmitting interface if MBSSID is enabled.
+  */
+ struct ieee80211_vif {
+ 	enum nl80211_iftype type;
+@@ -1750,6 +1751,8 @@ struct ieee80211_vif {
+ 	bool color_change_active;
+ 	u8 color_change_color;
+ 
++	struct ieee80211_vif *mbssid_tx_vif;
++
+ 	/* must be last */
+ 	u8 drv_priv[] __aligned(sizeof(void *));
+ };
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -112,6 +112,36 @@ static int ieee80211_set_mon_options(str
+ 	return 0;
+ }
+ 
++static int ieee80211_set_ap_mbssid_options(struct ieee80211_sub_if_data *sdata,
++					   struct cfg80211_mbssid_config params)
++{
++	struct ieee80211_sub_if_data *tx_sdata;
++
++	sdata->vif.mbssid_tx_vif = NULL;
++	sdata->vif.bss_conf.bssid_index = 0;
++	sdata->vif.bss_conf.nontransmitted = false;
++	sdata->vif.bss_conf.ema_ap = false;
++
++	if (sdata->vif.type != NL80211_IFTYPE_AP || !params.tx_wdev)
++		return -EINVAL;
++
++	tx_sdata = IEEE80211_WDEV_TO_SUB_IF(params.tx_wdev);
++	if (!tx_sdata)
++		return -EINVAL;
++
++	if (tx_sdata == sdata) {
++		sdata->vif.mbssid_tx_vif = &sdata->vif;
++	} else {
++		sdata->vif.mbssid_tx_vif = &tx_sdata->vif;
++		sdata->vif.bss_conf.nontransmitted = true;
++		sdata->vif.bss_conf.bssid_index = params.index;
++	}
++	if (params.ema)
++		sdata->vif.bss_conf.ema_ap = true;
++
++	return 0;
++}
++
+ static struct wireless_dev *ieee80211_add_iface(struct wiphy *wiphy,
+ 						const char *name,
+ 						unsigned char name_assign_type,
+@@ -1107,6 +1137,14 @@ static int ieee80211_start_ap(struct wip
+ 			changed |= BSS_CHANGED_HE_BSS_COLOR;
+ 	}
+ 
++	if (sdata->vif.type == NL80211_IFTYPE_AP &&
++	    params->mbssid_config.tx_wdev) {
++		err = ieee80211_set_ap_mbssid_options(sdata,
++						      params->mbssid_config);
++		if (err)
++			return err;
++	}
++
+ 	mutex_lock(&local->mtx);
+ 	err = ieee80211_vif_use_channel(sdata, &params->chandef,
+ 					IEEE80211_CHANCTX_SHARED);
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -632,17 +632,46 @@ static void ieee80211_do_stop(struct iee
+ 		ieee80211_add_virtual_monitor(local);
+ }
+ 
++static void ieee80211_stop_mbssid(struct ieee80211_sub_if_data *sdata)
++{
++	struct ieee80211_sub_if_data *tx_sdata, *non_tx_sdata, *tmp_sdata;
++	struct ieee80211_vif *tx_vif = sdata->vif.mbssid_tx_vif;
++
++	if (!tx_vif)
++		return;
++
++	tx_sdata = vif_to_sdata(tx_vif);
++	sdata->vif.mbssid_tx_vif = NULL;
++
++	list_for_each_entry_safe(non_tx_sdata, tmp_sdata,
++				 &tx_sdata->local->interfaces, list) {
++		if (non_tx_sdata != sdata && non_tx_sdata != tx_sdata &&
++		    non_tx_sdata->vif.mbssid_tx_vif == tx_vif &&
++		    ieee80211_sdata_running(non_tx_sdata)) {
++			non_tx_sdata->vif.mbssid_tx_vif = NULL;
++			dev_close(non_tx_sdata->wdev.netdev);
++		}
++	}
++
++	if (sdata != tx_sdata && ieee80211_sdata_running(tx_sdata)) {
++		tx_sdata->vif.mbssid_tx_vif = NULL;
++		dev_close(tx_sdata->wdev.netdev);
++	}
++}
++
+ static int ieee80211_stop(struct net_device *dev)
+ {
+ 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ 
+-	/* close all dependent VLAN interfaces before locking wiphy */
++	/* close dependent VLAN and MBSSID interfaces before locking wiphy */
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP) {
+ 		struct ieee80211_sub_if_data *vlan, *tmpsdata;
+ 
+ 		list_for_each_entry_safe(vlan, tmpsdata, &sdata->u.ap.vlans,
+ 					 u.vlan.list)
+ 			dev_close(vlan->dev);
++
++		ieee80211_stop_mbssid(sdata);
+ 	}
+ 
+ 	wiphy_lock(sdata->local->hw.wiphy);
diff --git a/package/kernel/mac80211/patches/subsys/324-mac80211-MBSSID-beacon-handling-in-AP-mode.patch b/package/kernel/mac80211/patches/subsys/324-mac80211-MBSSID-beacon-handling-in-AP-mode.patch
new file mode 100644
index 0000000000..fdbcce9450
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/324-mac80211-MBSSID-beacon-handling-in-AP-mode.patch
@@ -0,0 +1,326 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 24 Feb 2022 12:54:58 +0100
+Subject: [PATCH] mac80211: MBSSID beacon handling in AP mode
+
+Add new fields in struct beacon_data to store all MBSSID elements.
+Generate a beacon template which includes all MBSSID elements.
+Move CSA offset to reflect the MBSSID element length.
+
+Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
+Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
+Co-developed-by: John Crispin <john@phrozen.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Tested-by: Money Wang <money.wang@mediatek.com>
+Link: https://lore.kernel.org/r/5322db3c303f431adaf191ab31c45e151dde5465.1645702516.git.lorenzo@kernel.org
+[small cleanups]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -4938,12 +4938,14 @@ void ieee80211_report_low_ack(struct iee
+  * @cntdwn_counter_offs: array of IEEE80211_MAX_CNTDWN_COUNTERS_NUM offsets
+  *	to countdown counters.  This array can contain zero values which
+  *	should be ignored.
++ * @mbssid_off: position of the multiple bssid element
+  */
+ struct ieee80211_mutable_offsets {
+ 	u16 tim_offset;
+ 	u16 tim_length;
+ 
+ 	u16 cntdwn_counter_offs[IEEE80211_MAX_CNTDWN_COUNTERS_NUM];
++	u16 mbssid_off;
+ };
+ 
+ /**
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -989,11 +989,29 @@ static int ieee80211_set_ftm_responder_p
+ 	return 0;
+ }
+ 
++static int
++ieee80211_copy_mbssid_beacon(u8 *pos, struct cfg80211_mbssid_elems *dst,
++			     struct cfg80211_mbssid_elems *src)
++{
++	int i, offset = 0;
++
++	for (i = 0; i < src->cnt; i++) {
++		memcpy(pos + offset, src->elem[i].data, src->elem[i].len);
++		dst->elem[i].len = src->elem[i].len;
++		dst->elem[i].data = pos + offset;
++		offset += dst->elem[i].len;
++	}
++	dst->cnt = src->cnt;
++
++	return offset;
++}
++
+ static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
+ 				   struct cfg80211_beacon_data *params,
+ 				   const struct ieee80211_csa_settings *csa,
+ 				   const struct ieee80211_color_change_settings *cca)
+ {
++	struct cfg80211_mbssid_elems *mbssid = NULL;
+ 	struct beacon_data *new, *old;
+ 	int new_head_len, new_tail_len;
+ 	int size, err;
+@@ -1021,6 +1039,17 @@ static int ieee80211_assign_beacon(struc
+ 
+ 	size = sizeof(*new) + new_head_len + new_tail_len;
+ 
++	/* new or old multiple BSSID elements? */
++	if (params->mbssid_ies) {
++		mbssid = params->mbssid_ies;
++		size += struct_size(new->mbssid_ies, elem, mbssid->cnt);
++		size += ieee80211_get_mbssid_beacon_len(mbssid);
++	} else if (old && old->mbssid_ies) {
++		mbssid = old->mbssid_ies;
++		size += struct_size(new->mbssid_ies, elem, mbssid->cnt);
++		size += ieee80211_get_mbssid_beacon_len(mbssid);
++	}
++
+ 	new = kzalloc(size, GFP_KERNEL);
+ 	if (!new)
+ 		return -ENOMEM;
+@@ -1029,12 +1058,20 @@ static int ieee80211_assign_beacon(struc
+ 
+ 	/*
+ 	 * pointers go into the block we allocated,
+-	 * memory is | beacon_data | head | tail |
++	 * memory is | beacon_data | head | tail | mbssid_ies
+ 	 */
+ 	new->head = ((u8 *) new) + sizeof(*new);
+ 	new->tail = new->head + new_head_len;
+ 	new->head_len = new_head_len;
+ 	new->tail_len = new_tail_len;
++	/* copy in optional mbssid_ies */
++	if (mbssid) {
++		u8 *pos = new->tail + new->tail_len;
++
++		new->mbssid_ies = (void *)pos;
++		pos += struct_size(new->mbssid_ies, elem, mbssid->cnt);
++		ieee80211_copy_mbssid_beacon(pos, new->mbssid_ies, mbssid);
++	}
+ 
+ 	if (csa) {
+ 		new->cntdwn_current_counter = csa->count;
+@@ -1332,8 +1369,11 @@ static int ieee80211_stop_ap(struct wiph
+ 
+ 	mutex_unlock(&local->mtx);
+ 
+-	kfree(sdata->u.ap.next_beacon);
+-	sdata->u.ap.next_beacon = NULL;
++	if (sdata->u.ap.next_beacon) {
++		kfree(sdata->u.ap.next_beacon->mbssid_ies);
++		kfree(sdata->u.ap.next_beacon);
++		sdata->u.ap.next_beacon = NULL;
++	}
+ 
+ 	/* turn off carrier for this interface and dependent VLANs */
+ 	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+@@ -3126,12 +3166,24 @@ cfg80211_beacon_dup(struct cfg80211_beac
+ 
+ 	len = beacon->head_len + beacon->tail_len + beacon->beacon_ies_len +
+ 	      beacon->proberesp_ies_len + beacon->assocresp_ies_len +
+-	      beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len;
++	      beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len +
++	      ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies);
+ 
+ 	new_beacon = kzalloc(sizeof(*new_beacon) + len, GFP_KERNEL);
+ 	if (!new_beacon)
+ 		return NULL;
+ 
++	if (beacon->mbssid_ies && beacon->mbssid_ies->cnt) {
++		new_beacon->mbssid_ies =
++			kzalloc(struct_size(new_beacon->mbssid_ies,
++					    elem, beacon->mbssid_ies->cnt),
++				GFP_KERNEL);
++		if (!new_beacon->mbssid_ies) {
++			kfree(new_beacon);
++			return NULL;
++		}
++	}
++
+ 	pos = (u8 *)(new_beacon + 1);
+ 	if (beacon->head_len) {
+ 		new_beacon->head_len = beacon->head_len;
+@@ -3169,6 +3221,10 @@ cfg80211_beacon_dup(struct cfg80211_beac
+ 		memcpy(pos, beacon->probe_resp, beacon->probe_resp_len);
+ 		pos += beacon->probe_resp_len;
+ 	}
++	if (beacon->mbssid_ies && beacon->mbssid_ies->cnt)
++		pos += ieee80211_copy_mbssid_beacon(pos,
++						    new_beacon->mbssid_ies,
++						    beacon->mbssid_ies);
+ 
+ 	/* might copy -1, meaning no changes requested */
+ 	new_beacon->ftm_responder = beacon->ftm_responder;
+@@ -3206,8 +3262,11 @@ static int ieee80211_set_after_csa_beaco
+ 	case NL80211_IFTYPE_AP:
+ 		err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon,
+ 					      NULL, NULL);
+-		kfree(sdata->u.ap.next_beacon);
+-		sdata->u.ap.next_beacon = NULL;
++		if (sdata->u.ap.next_beacon) {
++			kfree(sdata->u.ap.next_beacon->mbssid_ies);
++			kfree(sdata->u.ap.next_beacon);
++			sdata->u.ap.next_beacon = NULL;
++		}
+ 
+ 		if (err < 0)
+ 			return err;
+@@ -3362,8 +3421,12 @@ static int ieee80211_set_csa_beacon(stru
+ 		if ((params->n_counter_offsets_beacon >
+ 		     IEEE80211_MAX_CNTDWN_COUNTERS_NUM) ||
+ 		    (params->n_counter_offsets_presp >
+-		     IEEE80211_MAX_CNTDWN_COUNTERS_NUM))
++		     IEEE80211_MAX_CNTDWN_COUNTERS_NUM)) {
++			kfree(sdata->u.ap.next_beacon->mbssid_ies);
++			kfree(sdata->u.ap.next_beacon);
++			sdata->u.ap.next_beacon = NULL;
+ 			return -EINVAL;
++		}
+ 
+ 		csa.counter_offsets_beacon = params->counter_offsets_beacon;
+ 		csa.counter_offsets_presp = params->counter_offsets_presp;
+@@ -3373,7 +3436,9 @@ static int ieee80211_set_csa_beacon(stru
+ 
+ 		err = ieee80211_assign_beacon(sdata, &params->beacon_csa, &csa, NULL);
+ 		if (err < 0) {
++			kfree(sdata->u.ap.next_beacon->mbssid_ies);
+ 			kfree(sdata->u.ap.next_beacon);
++			sdata->u.ap.next_beacon = NULL;
+ 			return err;
+ 		}
+ 		*changed |= err;
+@@ -3463,8 +3528,11 @@ static int ieee80211_set_csa_beacon(stru
+ static void ieee80211_color_change_abort(struct ieee80211_sub_if_data  *sdata)
+ {
+ 	sdata->vif.color_change_active = false;
+-	kfree(sdata->u.ap.next_beacon);
+-	sdata->u.ap.next_beacon = NULL;
++	if (sdata->u.ap.next_beacon) {
++		kfree(sdata->u.ap.next_beacon->mbssid_ies);
++		kfree(sdata->u.ap.next_beacon);
++		sdata->u.ap.next_beacon = NULL;
++	}
+ 
+ 	cfg80211_color_change_aborted_notify(sdata->dev);
+ }
+@@ -4202,8 +4270,11 @@ ieee80211_set_after_color_change_beacon(
+ 
+ 		ret = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon,
+ 					      NULL, NULL);
+-		kfree(sdata->u.ap.next_beacon);
+-		sdata->u.ap.next_beacon = NULL;
++		if (sdata->u.ap.next_beacon) {
++			kfree(sdata->u.ap.next_beacon->mbssid_ies);
++			kfree(sdata->u.ap.next_beacon);
++			sdata->u.ap.next_beacon = NULL;
++		}
+ 
+ 		if (ret < 0)
+ 			return ret;
+@@ -4246,7 +4317,11 @@ ieee80211_set_color_change_beacon(struct
+ 		err = ieee80211_assign_beacon(sdata, &params->beacon_color_change,
+ 					      NULL, &color_change);
+ 		if (err < 0) {
+-			kfree(sdata->u.ap.next_beacon);
++			if (sdata->u.ap.next_beacon) {
++				kfree(sdata->u.ap.next_beacon->mbssid_ies);
++				kfree(sdata->u.ap.next_beacon);
++				sdata->u.ap.next_beacon = NULL;
++			}
+ 			return err;
+ 		}
+ 		*changed |= err;
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -261,6 +261,7 @@ struct beacon_data {
+ 	struct ieee80211_meshconf_ie *meshconf;
+ 	u16 cntdwn_counter_offsets[IEEE80211_MAX_CNTDWN_COUNTERS_NUM];
+ 	u8 cntdwn_current_counter;
++	struct cfg80211_mbssid_elems *mbssid_ies;
+ 	struct rcu_head rcu_head;
+ };
+ 
+@@ -1083,6 +1084,20 @@ ieee80211_vif_get_shift(struct ieee80211
+ 	return shift;
+ }
+ 
++static inline int
++ieee80211_get_mbssid_beacon_len(struct cfg80211_mbssid_elems *elems)
++{
++	int i, len = 0;
++
++	if (!elems)
++		return 0;
++
++	for (i = 0; i < elems->cnt; i++)
++		len += elems->elem[i].len;
++
++	return len;
++}
++
+ enum {
+ 	IEEE80211_RX_MSG	= 1,
+ 	IEEE80211_TX_STATUS_MSG	= 2,
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -5041,6 +5041,19 @@ ieee80211_beacon_get_finish(struct ieee8
+ 		       IEEE80211_TX_CTL_FIRST_FRAGMENT;
+ }
+ 
++static void
++ieee80211_beacon_add_mbssid(struct sk_buff *skb, struct beacon_data *beacon)
++{
++	int i;
++
++	if (!beacon->mbssid_ies)
++		return;
++
++	for (i = 0; i < beacon->mbssid_ies->cnt; i++)
++		skb_put_data(skb, beacon->mbssid_ies->elem[i].data,
++			     beacon->mbssid_ies->elem[i].len);
++}
++
+ static struct sk_buff *
+ ieee80211_beacon_get_ap(struct ieee80211_hw *hw,
+ 			struct ieee80211_vif *vif,
+@@ -5054,6 +5067,7 @@ ieee80211_beacon_get_ap(struct ieee80211
+ 	struct ieee80211_if_ap *ap = &sdata->u.ap;
+ 	struct sk_buff *skb = NULL;
+ 	u16 csa_off_base = 0;
++	int mbssid_len;
+ 
+ 	if (beacon->cntdwn_counter_offsets[0]) {
+ 		if (!is_template)
+@@ -5063,11 +5077,12 @@ ieee80211_beacon_get_ap(struct ieee80211
+ 	}
+ 
+ 	/* headroom, head length,
+-	 * tail length and maximum TIM length
++	 * tail length, maximum TIM length and multiple BSSID length
+ 	 */
++	mbssid_len = ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies);
+ 	skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
+ 			    beacon->tail_len + 256 +
+-			    local->hw.extra_beacon_tailroom);
++			    local->hw.extra_beacon_tailroom + mbssid_len);
+ 	if (!skb)
+ 		return NULL;
+ 
+@@ -5081,6 +5096,11 @@ ieee80211_beacon_get_ap(struct ieee80211
+ 		offs->tim_length = skb->len - beacon->head_len;
+ 		offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
+ 
++		if (mbssid_len) {
++			ieee80211_beacon_add_mbssid(skb, beacon);
++			offs->mbssid_off = skb->len - mbssid_len;
++		}
++
+ 		/* for AP the csa offsets are from tail */
+ 		csa_off_base = skb->len;
+ 	}
diff --git a/package/kernel/mac80211/patches/subsys/325-mac80211-MBSSID-channel-switch.patch b/package/kernel/mac80211/patches/subsys/325-mac80211-MBSSID-channel-switch.patch
new file mode 100644
index 0000000000..38b0de180e
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/325-mac80211-MBSSID-channel-switch.patch
@@ -0,0 +1,52 @@
+From: John Crispin <john@phrozen.org>
+Date: Thu, 24 Feb 2022 12:54:59 +0100
+Subject: [PATCH] mac80211: MBSSID channel switch
+
+Trigger ieee80211_csa_finish() on the non-transmitting interfaces
+when channel switch concludes on the transmitting interface.
+
+Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
+Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Link: https://lore.kernel.org/r/6fde4d7f9fa387494f46a7aa4a584478dcda06f1.1645702516.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -3247,9 +3247,31 @@ cfg80211_beacon_dup(struct cfg80211_beac
+ void ieee80211_csa_finish(struct ieee80211_vif *vif)
+ {
+ 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
++	struct ieee80211_local *local = sdata->local;
+ 
+-	ieee80211_queue_work(&sdata->local->hw,
+-			     &sdata->csa_finalize_work);
++	rcu_read_lock();
++
++	if (vif->mbssid_tx_vif == vif) {
++		/* Trigger ieee80211_csa_finish() on the non-transmitting
++		 * interfaces when channel switch is received on
++		 * transmitting interface
++		 */
++		struct ieee80211_sub_if_data *iter;
++
++		list_for_each_entry_rcu(iter, &local->interfaces, list) {
++			if (!ieee80211_sdata_running(iter))
++				continue;
++
++			if (iter == sdata || iter->vif.mbssid_tx_vif != vif)
++				continue;
++
++			ieee80211_queue_work(&iter->local->hw,
++					     &iter->csa_finalize_work);
++		}
++	}
++	ieee80211_queue_work(&local->hw, &sdata->csa_finalize_work);
++
++	rcu_read_unlock();
+ }
+ EXPORT_SYMBOL(ieee80211_csa_finish);
+ 
diff --git a/package/kernel/mac80211/patches/subsys/326-mac80211-update-bssid_indicator-in-ieee80211_assign_.patch b/package/kernel/mac80211/patches/subsys/326-mac80211-update-bssid_indicator-in-ieee80211_assign_.patch
new file mode 100644
index 0000000000..1955568607
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/326-mac80211-update-bssid_indicator-in-ieee80211_assign_.patch
@@ -0,0 +1,25 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 24 Feb 2022 12:55:00 +0100
+Subject: [PATCH] mac80211: update bssid_indicator in
+ ieee80211_assign_beacon
+
+Update bssid_indicator in ieee80211_bss_conf according to the
+number of bssid in the set.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/f92317e002fca9933f05a445fcefb4f53291d601.1645702516.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1071,6 +1071,9 @@ static int ieee80211_assign_beacon(struc
+ 		new->mbssid_ies = (void *)pos;
+ 		pos += struct_size(new->mbssid_ies, elem, mbssid->cnt);
+ 		ieee80211_copy_mbssid_beacon(pos, new->mbssid_ies, mbssid);
++		/* update bssid_indicator */
++		sdata->vif.bss_conf.bssid_indicator =
++			ilog2(__roundup_pow_of_two(mbssid->cnt + 1));
+ 	}
+ 
+ 	if (csa) {
diff --git a/package/kernel/mac80211/patches/subsys/328-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch b/package/kernel/mac80211/patches/subsys/328-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch
new file mode 100644
index 0000000000..f0150ddef0
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/328-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch
@@ -0,0 +1,38 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 26 Mar 2022 23:58:35 +0100
+Subject: [PATCH] mac80211: do not wake queues on a vif that is being stopped
+
+When a vif is being removed and sdata->bss is cleared, __ieee80211_wake_txqs
+can still be called on it, which crashes as soon as sdata->bss is being
+dereferenced.
+To fix this properly, check for SDATA_STATE_RUNNING before waking queues,
+and take the fq lock when setting it (to ensure that __ieee80211_wake_txqs
+observes the change when running on a different CPU
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -377,7 +377,9 @@ static void ieee80211_do_stop(struct iee
+ 	bool cancel_scan;
+ 	struct cfg80211_nan_func *func;
+ 
++	spin_lock_bh(&local->fq.lock);
+ 	clear_bit(SDATA_STATE_RUNNING, &sdata->state);
++	spin_unlock_bh(&local->fq.lock);
+ 
+ 	cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
+ 	if (cancel_scan)
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -301,6 +301,9 @@ static void __ieee80211_wake_txqs(struct
+ 	local_bh_disable();
+ 	spin_lock(&fq->lock);
+ 
++	if (!test_bit(SDATA_STATE_RUNNING, &sdata->state))
++		goto out;
++
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP)
+ 		ps = &sdata->bss->ps;
+ 
diff --git a/package/kernel/mac80211/patches/subsys/330-mac80211-switch-airtime-fairness-back-to-deficit-rou.patch b/package/kernel/mac80211/patches/subsys/330-mac80211-switch-airtime-fairness-back-to-deficit-rou.patch
new file mode 100644
index 0000000000..0ca53860a5
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/330-mac80211-switch-airtime-fairness-back-to-deficit-rou.patch
@@ -0,0 +1,1249 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 19 Jun 2022 23:13:05 +0200
+Subject: [PATCH] mac80211: switch airtime fairness back to deficit round-robin
+ scheduling
+
+This reverts commits 6a789ba679d652587532cec2a0e0274fda172f3b and
+2433647bc8d983a543e7d31b41ca2de1c7e2c198.
+
+The virtual time scheduler code has a number of issues:
+- queues slowed down by hardware/firmware powersave handling were not properly
+  handled.
+- on ath10k in push-pull mode, tx queues that the driver tries to pull from
+  were starved, causing excessive latency
+- delay between tx enqueue and reported airtime use were causing excessively
+  bursty tx behavior
+
+The bursty behavior may also be present on the round-robin scheduler, but there
+it is much easier to fix without introducing additional regressions
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -6666,6 +6666,9 @@ static inline void ieee80211_txq_schedul
+ {
+ }
+ 
++void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
++			      struct ieee80211_txq *txq, bool force);
++
+ /**
+  * ieee80211_schedule_txq - schedule a TXQ for transmission
+  *
+@@ -6678,7 +6681,11 @@ static inline void ieee80211_txq_schedul
+  * The driver may call this function if it has buffered packets for
+  * this TXQ internally.
+  */
+-void ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq);
++static inline void
++ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
++{
++	__ieee80211_schedule_txq(hw, txq, true);
++}
+ 
+ /**
+  * ieee80211_return_txq - return a TXQ previously acquired by ieee80211_next_txq()
+@@ -6690,8 +6697,12 @@ void ieee80211_schedule_txq(struct ieee8
+  * The driver may set force=true if it has buffered packets for this TXQ
+  * internally.
+  */
+-void ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq,
+-			  bool force);
++static inline void
++ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq,
++		     bool force)
++{
++	__ieee80211_schedule_txq(hw, txq, force);
++}
+ 
+ /**
+  * ieee80211_txq_may_transmit - check whether TXQ is allowed to transmit
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1554,38 +1554,6 @@ static void sta_apply_mesh_params(struct
+ #endif
+ }
+ 
+-static void sta_apply_airtime_params(struct ieee80211_local *local,
+-				     struct sta_info *sta,
+-				     struct station_parameters *params)
+-{
+-	u8 ac;
+-
+-	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+-		struct airtime_sched_info *air_sched = &local->airtime[ac];
+-		struct airtime_info *air_info = &sta->airtime[ac];
+-		struct txq_info *txqi;
+-		u8 tid;
+-
+-		spin_lock_bh(&air_sched->lock);
+-		for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
+-			if (air_info->weight == params->airtime_weight ||
+-			    !sta->sta.txq[tid] ||
+-			    ac != ieee80211_ac_from_tid(tid))
+-				continue;
+-
+-			airtime_weight_set(air_info, params->airtime_weight);
+-
+-			txqi = to_txq_info(sta->sta.txq[tid]);
+-			if (RB_EMPTY_NODE(&txqi->schedule_order))
+-				continue;
+-
+-			ieee80211_update_airtime_weight(local, air_sched,
+-							0, true);
+-		}
+-		spin_unlock_bh(&air_sched->lock);
+-	}
+-}
+-
+ static int sta_apply_parameters(struct ieee80211_local *local,
+ 				struct sta_info *sta,
+ 				struct station_parameters *params)
+@@ -1773,8 +1741,7 @@ static int sta_apply_parameters(struct i
+ 		sta_apply_mesh_params(local, sta, params);
+ 
+ 	if (params->airtime_weight)
+-		sta_apply_airtime_params(local, sta, params);
+-
++		sta->airtime_weight = params->airtime_weight;
+ 
+ 	/* set the STA state after all sta info from usermode has been set */
+ 	if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) ||
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -216,14 +216,14 @@ static ssize_t aql_txq_limit_read(struct
+ 			"VI	%u		%u\n"
+ 			"BE	%u		%u\n"
+ 			"BK	%u		%u\n",
+-			local->airtime[IEEE80211_AC_VO].aql_txq_limit_low,
+-			local->airtime[IEEE80211_AC_VO].aql_txq_limit_high,
+-			local->airtime[IEEE80211_AC_VI].aql_txq_limit_low,
+-			local->airtime[IEEE80211_AC_VI].aql_txq_limit_high,
+-			local->airtime[IEEE80211_AC_BE].aql_txq_limit_low,
+-			local->airtime[IEEE80211_AC_BE].aql_txq_limit_high,
+-			local->airtime[IEEE80211_AC_BK].aql_txq_limit_low,
+-			local->airtime[IEEE80211_AC_BK].aql_txq_limit_high);
++			local->aql_txq_limit_low[IEEE80211_AC_VO],
++			local->aql_txq_limit_high[IEEE80211_AC_VO],
++			local->aql_txq_limit_low[IEEE80211_AC_VI],
++			local->aql_txq_limit_high[IEEE80211_AC_VI],
++			local->aql_txq_limit_low[IEEE80211_AC_BE],
++			local->aql_txq_limit_high[IEEE80211_AC_BE],
++			local->aql_txq_limit_low[IEEE80211_AC_BK],
++			local->aql_txq_limit_high[IEEE80211_AC_BK]);
+ 	return simple_read_from_buffer(user_buf, count, ppos,
+ 				       buf, len);
+ }
+@@ -255,11 +255,11 @@ static ssize_t aql_txq_limit_write(struc
+ 	if (ac >= IEEE80211_NUM_ACS)
+ 		return -EINVAL;
+ 
+-	q_limit_low_old = local->airtime[ac].aql_txq_limit_low;
+-	q_limit_high_old = local->airtime[ac].aql_txq_limit_high;
++	q_limit_low_old = local->aql_txq_limit_low[ac];
++	q_limit_high_old = local->aql_txq_limit_high[ac];
+ 
+-	local->airtime[ac].aql_txq_limit_low = q_limit_low;
+-	local->airtime[ac].aql_txq_limit_high = q_limit_high;
++	local->aql_txq_limit_low[ac] = q_limit_low;
++	local->aql_txq_limit_high[ac] = q_limit_high;
+ 
+ 	mutex_lock(&local->sta_mtx);
+ 	list_for_each_entry(sta, &local->sta_list, list) {
+@@ -382,46 +382,6 @@ static const struct file_operations forc
+ 	.llseek = default_llseek,
+ };
+ 
+-static ssize_t airtime_read(struct file *file,
+-			    char __user *user_buf,
+-			    size_t count,
+-			    loff_t *ppos)
+-{
+-	struct ieee80211_local *local = file->private_data;
+-	char buf[200];
+-	u64 v_t[IEEE80211_NUM_ACS];
+-	u64 wt[IEEE80211_NUM_ACS];
+-	int len = 0, ac;
+-
+-	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+-		spin_lock_bh(&local->airtime[ac].lock);
+-		v_t[ac] = local->airtime[ac].v_t;
+-		wt[ac] = local->airtime[ac].weight_sum;
+-		spin_unlock_bh(&local->airtime[ac].lock);
+-	}
+-	len = scnprintf(buf, sizeof(buf),
+-			"\tVO         VI         BE         BK\n"
+-			"Virt-t\t%-10llu %-10llu %-10llu %-10llu\n"
+-			"Weight\t%-10llu %-10llu %-10llu %-10llu\n",
+-			v_t[0],
+-			v_t[1],
+-			v_t[2],
+-			v_t[3],
+-			wt[0],
+-			wt[1],
+-			wt[2],
+-			wt[3]);
+-
+-	return simple_read_from_buffer(user_buf, count, ppos,
+-				       buf, len);
+-}
+-
+-static const struct file_operations airtime_ops = {
+-	.read = airtime_read,
+-	.open = simple_open,
+-	.llseek = default_llseek,
+-};
+-
+ #ifdef CONFIG_PM
+ static ssize_t reset_write(struct file *file, const char __user *user_buf,
+ 			   size_t count, loff_t *ppos)
+@@ -672,11 +632,7 @@ void debugfs_hw_add(struct ieee80211_loc
+ 	if (local->ops->wake_tx_queue)
+ 		DEBUGFS_ADD_MODE(aqm, 0600);
+ 
+-	if (wiphy_ext_feature_isset(local->hw.wiphy,
+-				    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) {
+-		DEBUGFS_ADD_MODE(airtime, 0600);
+-		DEBUGFS_ADD_MODE(airtime_flags, 0600);
+-	}
++	DEBUGFS_ADD_MODE(airtime_flags, 0600);
+ 
+ 	DEBUGFS_ADD(aql_txq_limit);
+ 	debugfs_create_u32("aql_threshold", 0600,
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -512,34 +512,6 @@ static ssize_t ieee80211_if_fmt_aqm(
+ }
+ IEEE80211_IF_FILE_R(aqm);
+ 
+-static ssize_t ieee80211_if_fmt_airtime(
+-	const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
+-{
+-	struct ieee80211_local *local = sdata->local;
+-	struct ieee80211_txq *txq = sdata->vif.txq;
+-	struct airtime_info *air_info;
+-	int len;
+-
+-	if (!txq)
+-		return 0;
+-
+-	spin_lock_bh(&local->airtime[txq->ac].lock);
+-	air_info = to_airtime_info(txq);
+-	len = scnprintf(buf,
+-			buflen,
+-			"RX: %llu us\nTX: %llu us\nWeight: %u\n"
+-			"Virt-T: %lld us\n",
+-			air_info->rx_airtime,
+-			air_info->tx_airtime,
+-			air_info->weight,
+-			air_info->v_t);
+-	spin_unlock_bh(&local->airtime[txq->ac].lock);
+-
+-	return len;
+-}
+-
+-IEEE80211_IF_FILE_R(airtime);
+-
+ IEEE80211_IF_FILE(multicast_to_unicast, u.ap.multicast_to_unicast, HEX);
+ 
+ /* IBSS attributes */
+@@ -685,10 +657,8 @@ static void add_common_files(struct ieee
+ 
+ 	if (sdata->local->ops->wake_tx_queue &&
+ 	    sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
+-	    sdata->vif.type != NL80211_IFTYPE_NAN) {
++	    sdata->vif.type != NL80211_IFTYPE_NAN)
+ 		DEBUGFS_ADD(aqm);
+-		DEBUGFS_ADD(airtime);
+-	}
+ }
+ 
+ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
+--- a/net/mac80211/debugfs_sta.c
++++ b/net/mac80211/debugfs_sta.c
+@@ -202,7 +202,7 @@ static ssize_t sta_airtime_read(struct f
+ 	size_t bufsz = 400;
+ 	char *buf = kzalloc(bufsz, GFP_KERNEL), *p = buf;
+ 	u64 rx_airtime = 0, tx_airtime = 0;
+-	u64 v_t[IEEE80211_NUM_ACS];
++	s64 deficit[IEEE80211_NUM_ACS];
+ 	ssize_t rv;
+ 	int ac;
+ 
+@@ -210,18 +210,18 @@ static ssize_t sta_airtime_read(struct f
+ 		return -ENOMEM;
+ 
+ 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+-		spin_lock_bh(&local->airtime[ac].lock);
++		spin_lock_bh(&local->active_txq_lock[ac]);
+ 		rx_airtime += sta->airtime[ac].rx_airtime;
+ 		tx_airtime += sta->airtime[ac].tx_airtime;
+-		v_t[ac] = sta->airtime[ac].v_t;
+-		spin_unlock_bh(&local->airtime[ac].lock);
++		deficit[ac] = sta->airtime[ac].deficit;
++		spin_unlock_bh(&local->active_txq_lock[ac]);
+ 	}
+ 
+ 	p += scnprintf(p, bufsz + buf - p,
+ 		"RX: %llu us\nTX: %llu us\nWeight: %u\n"
+-		"Virt-T: VO: %lld us VI: %lld us BE: %lld us BK: %lld us\n",
+-		rx_airtime, tx_airtime, sta->airtime[0].weight,
+-		v_t[0], v_t[1], v_t[2], v_t[3]);
++		"Deficit: VO: %lld us VI: %lld us BE: %lld us BK: %lld us\n",
++		rx_airtime, tx_airtime, sta->airtime_weight,
++		deficit[0], deficit[1], deficit[2], deficit[3]);
+ 
+ 	rv = simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
+ 	kfree(buf);
+@@ -236,11 +236,11 @@ static ssize_t sta_airtime_write(struct
+ 	int ac;
+ 
+ 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+-		spin_lock_bh(&local->airtime[ac].lock);
++		spin_lock_bh(&local->active_txq_lock[ac]);
+ 		sta->airtime[ac].rx_airtime = 0;
+ 		sta->airtime[ac].tx_airtime = 0;
+-		sta->airtime[ac].v_t = 0;
+-		spin_unlock_bh(&local->airtime[ac].lock);
++		sta->airtime[ac].deficit = sta->airtime_weight;
++		spin_unlock_bh(&local->active_txq_lock[ac]);
+ 	}
+ 
+ 	return count;
+@@ -263,10 +263,10 @@ static ssize_t sta_aql_read(struct file
+ 		return -ENOMEM;
+ 
+ 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+-		spin_lock_bh(&local->airtime[ac].lock);
++		spin_lock_bh(&local->active_txq_lock[ac]);
+ 		q_limit_l[ac] = sta->airtime[ac].aql_limit_low;
+ 		q_limit_h[ac] = sta->airtime[ac].aql_limit_high;
+-		spin_unlock_bh(&local->airtime[ac].lock);
++		spin_unlock_bh(&local->active_txq_lock[ac]);
+ 		q_depth[ac] = atomic_read(&sta->airtime[ac].aql_tx_pending);
+ 	}
+ 
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -863,16 +863,20 @@ enum txq_info_flags {
+  * @def_flow: used as a fallback flow when a packet destined to @tin hashes to
+  *	a fq_flow which is already owned by a different tin
+  * @def_cvars: codel vars for @def_flow
+- * @schedule_order: used with ieee80211_local->active_txqs
+  * @frags: used to keep fragments created after dequeue
++ * @schedule_order: used with ieee80211_local->active_txqs
++ * @schedule_round: counter to prevent infinite loops on TXQ scheduling
+  */
+ struct txq_info {
+ 	struct fq_tin tin;
+ 	struct codel_vars def_cvars;
+ 	struct codel_stats cstats;
+-	struct rb_node schedule_order;
++
++	u16 schedule_round;
++	struct list_head schedule_order;
+ 
+ 	struct sk_buff_head frags;
++
+ 	unsigned long flags;
+ 
+ 	/* keep last! */
+@@ -949,8 +953,6 @@ struct ieee80211_sub_if_data {
+ 	struct ieee80211_tx_queue_params tx_conf[IEEE80211_NUM_ACS];
+ 	struct mac80211_qos_map __rcu *qos_map;
+ 
+-	struct airtime_info airtime[IEEE80211_NUM_ACS];
+-
+ 	struct work_struct csa_finalize_work;
+ 	bool csa_block_tx; /* write-protected by sdata_lock and local->mtx */
+ 	struct cfg80211_chan_def csa_chandef;
+@@ -1185,44 +1187,6 @@ enum mac80211_scan_state {
+ 	SCAN_ABORT,
+ };
+ 
+-/**
+- * struct airtime_sched_info - state used for airtime scheduling and AQL
+- *
+- * @lock: spinlock that protects all the fields in this struct
+- * @active_txqs: rbtree of currently backlogged queues, sorted by virtual time
+- * @schedule_pos: the current position maintained while a driver walks the tree
+- *                with ieee80211_next_txq()
+- * @active_list: list of struct airtime_info structs that were active within
+- *               the last AIRTIME_ACTIVE_DURATION (100 ms), used to compute
+- *               weight_sum
+- * @last_weight_update: used for rate limiting walking active_list
+- * @last_schedule_time: tracks the last time a transmission was scheduled; used
+- *                      for catching up v_t if no stations are eligible for
+- *                      transmission.
+- * @v_t: global virtual time; queues with v_t < this are eligible for
+- *       transmission
+- * @weight_sum: total sum of all active stations used for dividing airtime
+- * @weight_sum_reciprocal: reciprocal of weight_sum (to avoid divisions in fast
+- *                         path - see comment above
+- *                         IEEE80211_RECIPROCAL_DIVISOR_64)
+- * @aql_txq_limit_low: AQL limit when total outstanding airtime
+- *                     is < IEEE80211_AQL_THRESHOLD
+- * @aql_txq_limit_high: AQL limit when total outstanding airtime
+- *                      is > IEEE80211_AQL_THRESHOLD
+- */
+-struct airtime_sched_info {
+-	spinlock_t lock;
+-	struct rb_root_cached active_txqs;
+-	struct rb_node *schedule_pos;
+-	struct list_head active_list;
+-	u64 last_weight_update;
+-	u64 last_schedule_activity;
+-	u64 v_t;
+-	u64 weight_sum;
+-	u64 weight_sum_reciprocal;
+-	u32 aql_txq_limit_low;
+-	u32 aql_txq_limit_high;
+-};
+ DECLARE_STATIC_KEY_FALSE(aql_disable);
+ 
+ struct ieee80211_local {
+@@ -1236,8 +1200,13 @@ struct ieee80211_local {
+ 	struct codel_params cparams;
+ 
+ 	/* protects active_txqs and txqi->schedule_order */
+-	struct airtime_sched_info airtime[IEEE80211_NUM_ACS];
++	spinlock_t active_txq_lock[IEEE80211_NUM_ACS];
++	struct list_head active_txqs[IEEE80211_NUM_ACS];
++	u16 schedule_round[IEEE80211_NUM_ACS];
++
+ 	u16 airtime_flags;
++	u32 aql_txq_limit_low[IEEE80211_NUM_ACS];
++	u32 aql_txq_limit_high[IEEE80211_NUM_ACS];
+ 	u32 aql_threshold;
+ 	atomic_t aql_total_pending_airtime;
+ 
+@@ -1654,125 +1623,6 @@ static inline bool txq_has_queue(struct
+ 	return !(skb_queue_empty(&txqi->frags) && !txqi->tin.backlog_packets);
+ }
+ 
+-static inline struct airtime_info *to_airtime_info(struct ieee80211_txq *txq)
+-{
+-	struct ieee80211_sub_if_data *sdata;
+-	struct sta_info *sta;
+-
+-	if (txq->sta) {
+-		sta = container_of(txq->sta, struct sta_info, sta);
+-		return &sta->airtime[txq->ac];
+-	}
+-
+-	sdata = vif_to_sdata(txq->vif);
+-	return &sdata->airtime[txq->ac];
+-}
+-
+-/* To avoid divisions in the fast path, we keep pre-computed reciprocals for
+- * airtime weight calculations. There are two different weights to keep track
+- * of: The per-station weight and the sum of weights per phy.
+- *
+- * For the per-station weights (kept in airtime_info below), we use 32-bit
+- * reciprocals with a devisor of 2^19. This lets us keep the multiplications and
+- * divisions for the station weights as 32-bit operations at the cost of a bit
+- * of rounding error for high weights; but the choice of divisor keeps rounding
+- * errors <10% for weights <2^15, assuming no more than 8ms of airtime is
+- * reported at a time.
+- *
+- * For the per-phy sum of weights the values can get higher, so we use 64-bit
+- * operations for those with a 32-bit divisor, which should avoid any
+- * significant rounding errors.
+- */
+-#define IEEE80211_RECIPROCAL_DIVISOR_64 0x100000000ULL
+-#define IEEE80211_RECIPROCAL_SHIFT_64 32
+-#define IEEE80211_RECIPROCAL_DIVISOR_32 0x80000U
+-#define IEEE80211_RECIPROCAL_SHIFT_32 19
+-
+-static inline void airtime_weight_set(struct airtime_info *air_info, u16 weight)
+-{
+-	if (air_info->weight == weight)
+-		return;
+-
+-	air_info->weight = weight;
+-	if (weight) {
+-		air_info->weight_reciprocal =
+-			IEEE80211_RECIPROCAL_DIVISOR_32 / weight;
+-	} else {
+-		air_info->weight_reciprocal = 0;
+-	}
+-}
+-
+-static inline void airtime_weight_sum_set(struct airtime_sched_info *air_sched,
+-					  int weight_sum)
+-{
+-	if (air_sched->weight_sum == weight_sum)
+-		return;
+-
+-	air_sched->weight_sum = weight_sum;
+-	if (air_sched->weight_sum) {
+-		air_sched->weight_sum_reciprocal = IEEE80211_RECIPROCAL_DIVISOR_64;
+-		do_div(air_sched->weight_sum_reciprocal, air_sched->weight_sum);
+-	} else {
+-		air_sched->weight_sum_reciprocal = 0;
+-	}
+-}
+-
+-/* A problem when trying to enforce airtime fairness is that we want to divide
+- * the airtime between the currently *active* stations. However, basing this on
+- * the instantaneous queue state of stations doesn't work, as queues tend to
+- * oscillate very quickly between empty and occupied, leading to the scheduler
+- * thinking only a single station is active when deciding whether to allow
+- * transmission (and thus not throttling correctly).
+- *
+- * To fix this we use a timer-based notion of activity: a station is considered
+- * active if it has been scheduled within the last 100 ms; we keep a separate
+- * list of all the stations considered active in this manner, and lazily update
+- * the total weight of active stations from this list (filtering the stations in
+- * the list by their 'last active' time).
+- *
+- * We add one additional safeguard to guard against stations that manage to get
+- * scheduled every 100 ms but don't transmit a lot of data, and thus don't use
+- * up any airtime. Such stations would be able to get priority for an extended
+- * period of time if they do start transmitting at full capacity again, and so
+- * we add an explicit maximum for how far behind a station is allowed to fall in
+- * the virtual airtime domain. This limit is set to a relatively high value of
+- * 20 ms because the main mechanism for catching up idle stations is the active
+- * state as described above; i.e., the hard limit should only be hit in
+- * pathological cases.
+- */
+-#define AIRTIME_ACTIVE_DURATION (100 * NSEC_PER_MSEC)
+-#define AIRTIME_MAX_BEHIND 20000 /* 20 ms */
+-
+-static inline bool airtime_is_active(struct airtime_info *air_info, u64 now)
+-{
+-	return air_info->last_scheduled >= now - AIRTIME_ACTIVE_DURATION;
+-}
+-
+-static inline void airtime_set_active(struct airtime_sched_info *air_sched,
+-				      struct airtime_info *air_info, u64 now)
+-{
+-	air_info->last_scheduled = now;
+-	air_sched->last_schedule_activity = now;
+-	list_move_tail(&air_info->list, &air_sched->active_list);
+-}
+-
+-static inline bool airtime_catchup_v_t(struct airtime_sched_info *air_sched,
+-				       u64 v_t, u64 now)
+-{
+-	air_sched->v_t = v_t;
+-	return true;
+-}
+-
+-static inline void init_airtime_info(struct airtime_info *air_info,
+-				     struct airtime_sched_info *air_sched)
+-{
+-	atomic_set(&air_info->aql_tx_pending, 0);
+-	air_info->aql_limit_low = air_sched->aql_txq_limit_low;
+-	air_info->aql_limit_high = air_sched->aql_txq_limit_high;
+-	airtime_weight_set(air_info, IEEE80211_DEFAULT_AIRTIME_WEIGHT);
+-	INIT_LIST_HEAD(&air_info->list);
+-}
+-
+ static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
+ {
+ 	return ether_addr_equal(raddr, addr) ||
+@@ -2018,14 +1868,6 @@ int ieee80211_tx_control_port(struct wip
+ 			      u64 *cookie);
+ int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,
+ 			      const u8 *buf, size_t len);
+-void ieee80211_resort_txq(struct ieee80211_hw *hw,
+-			  struct ieee80211_txq *txq);
+-void ieee80211_unschedule_txq(struct ieee80211_hw *hw,
+-			      struct ieee80211_txq *txq,
+-			      bool purge);
+-void ieee80211_update_airtime_weight(struct ieee80211_local *local,
+-				     struct airtime_sched_info *air_sched,
+-				     u64 now, bool force);
+ 
+ /* HT */
+ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -2192,9 +2192,6 @@ int ieee80211_if_add(struct ieee80211_lo
+ 		}
+ 	}
+ 
+-	for (i = 0; i < IEEE80211_NUM_ACS; i++)
+-		init_airtime_info(&sdata->airtime[i], &local->airtime[i]);
+-
+ 	ieee80211_set_default_queues(sdata);
+ 
+ 	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -707,13 +707,10 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 	spin_lock_init(&local->queue_stop_reason_lock);
+ 
+ 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+-		struct airtime_sched_info *air_sched = &local->airtime[i];
+-
+-		air_sched->active_txqs = RB_ROOT_CACHED;
+-		INIT_LIST_HEAD(&air_sched->active_list);
+-		spin_lock_init(&air_sched->lock);
+-		air_sched->aql_txq_limit_low = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L;
+-		air_sched->aql_txq_limit_high =
++		INIT_LIST_HEAD(&local->active_txqs[i]);
++		spin_lock_init(&local->active_txq_lock[i]);
++		local->aql_txq_limit_low[i] = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L;
++		local->aql_txq_limit_high[i] =
+ 			IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H;
+ 	}
+ 
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1583,8 +1583,12 @@ static void sta_ps_start(struct sta_info
+ 
+ 	for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
+ 		struct ieee80211_txq *txq = sta->sta.txq[tid];
++		struct txq_info *txqi = to_txq_info(txq);
+ 
+-		ieee80211_unschedule_txq(&local->hw, txq, false);
++		spin_lock(&local->active_txq_lock[txq->ac]);
++		if (!list_empty(&txqi->schedule_order))
++			list_del_init(&txqi->schedule_order);
++		spin_unlock(&local->active_txq_lock[txq->ac]);
+ 
+ 		if (txq_has_queue(txq))
+ 			set_bit(tid, &sta->txq_buffered_tids);
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -426,11 +426,15 @@ struct sta_info *sta_info_alloc(struct i
+ 	if (sta_prepare_rate_control(local, sta, gfp))
+ 		goto free_txq;
+ 
++	sta->airtime_weight = IEEE80211_DEFAULT_AIRTIME_WEIGHT;
+ 
+ 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+ 		skb_queue_head_init(&sta->ps_tx_buf[i]);
+ 		skb_queue_head_init(&sta->tx_filtered[i]);
+-		init_airtime_info(&sta->airtime[i], &local->airtime[i]);
++		sta->airtime[i].deficit = sta->airtime_weight;
++		atomic_set(&sta->airtime[i].aql_tx_pending, 0);
++		sta->airtime[i].aql_limit_low = local->aql_txq_limit_low[i];
++		sta->airtime[i].aql_limit_high = local->aql_txq_limit_high[i];
+ 	}
+ 
+ 	for (i = 0; i < IEEE80211_NUM_TIDS; i++)
+@@ -1889,59 +1893,24 @@ void ieee80211_sta_set_buffered(struct i
+ }
+ EXPORT_SYMBOL(ieee80211_sta_set_buffered);
+ 
+-void ieee80211_register_airtime(struct ieee80211_txq *txq,
+-				u32 tx_airtime, u32 rx_airtime)
++void ieee80211_sta_register_airtime(struct ieee80211_sta *pubsta, u8 tid,
++				    u32 tx_airtime, u32 rx_airtime)
+ {
+-	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
+-	struct ieee80211_local *local = sdata->local;
+-	u64 weight_sum, weight_sum_reciprocal;
+-	struct airtime_sched_info *air_sched;
+-	struct airtime_info *air_info;
++	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
++	struct ieee80211_local *local = sta->sdata->local;
++	u8 ac = ieee80211_ac_from_tid(tid);
+ 	u32 airtime = 0;
+ 
+-	air_sched = &local->airtime[txq->ac];
+-	air_info = to_airtime_info(txq);
+-
+-	if (local->airtime_flags & AIRTIME_USE_TX)
++	if (sta->local->airtime_flags & AIRTIME_USE_TX)
+ 		airtime += tx_airtime;
+-	if (local->airtime_flags & AIRTIME_USE_RX)
++	if (sta->local->airtime_flags & AIRTIME_USE_RX)
+ 		airtime += rx_airtime;
+ 
+-	/* Weights scale so the unit weight is 256 */
+-	airtime <<= 8;
+-
+-	spin_lock_bh(&air_sched->lock);
+-
+-	air_info->tx_airtime += tx_airtime;
+-	air_info->rx_airtime += rx_airtime;
+-
+-	if (air_sched->weight_sum) {
+-		weight_sum = air_sched->weight_sum;
+-		weight_sum_reciprocal = air_sched->weight_sum_reciprocal;
+-	} else {
+-		weight_sum = air_info->weight;
+-		weight_sum_reciprocal = air_info->weight_reciprocal;
+-	}
+-
+-	/* Round the calculation of global vt */
+-	air_sched->v_t += (u64)((airtime + (weight_sum >> 1)) *
+-				weight_sum_reciprocal) >> IEEE80211_RECIPROCAL_SHIFT_64;
+-	air_info->v_t += (u32)((airtime + (air_info->weight >> 1)) *
+-			       air_info->weight_reciprocal) >> IEEE80211_RECIPROCAL_SHIFT_32;
+-	ieee80211_resort_txq(&local->hw, txq);
+-
+-	spin_unlock_bh(&air_sched->lock);
+-}
+-
+-void ieee80211_sta_register_airtime(struct ieee80211_sta *pubsta, u8 tid,
+-				    u32 tx_airtime, u32 rx_airtime)
+-{
+-	struct ieee80211_txq *txq = pubsta->txq[tid];
+-
+-	if (!txq)
+-		return;
+-
+-	ieee80211_register_airtime(txq, tx_airtime, rx_airtime);
++	spin_lock_bh(&local->active_txq_lock[ac]);
++	sta->airtime[ac].tx_airtime += tx_airtime;
++	sta->airtime[ac].rx_airtime += rx_airtime;
++	sta->airtime[ac].deficit -= airtime;
++	spin_unlock_bh(&local->active_txq_lock[ac]);
+ }
+ EXPORT_SYMBOL(ieee80211_sta_register_airtime);
+ 
+@@ -2385,7 +2354,7 @@ void sta_set_sinfo(struct sta_info *sta,
+ 	}
+ 
+ 	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT))) {
+-		sinfo->airtime_weight = sta->airtime[0].weight;
++		sinfo->airtime_weight = sta->airtime_weight;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT);
+ 	}
+ 
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -135,25 +135,18 @@ enum ieee80211_agg_stop_reason {
+ #define AIRTIME_USE_TX		BIT(0)
+ #define AIRTIME_USE_RX		BIT(1)
+ 
+-
+ struct airtime_info {
+ 	u64 rx_airtime;
+ 	u64 tx_airtime;
+-	u64 v_t;
+-	u64 last_scheduled;
+-	struct list_head list;
++	s64 deficit;
+ 	atomic_t aql_tx_pending; /* Estimated airtime for frames pending */
+ 	u32 aql_limit_low;
+ 	u32 aql_limit_high;
+-	u32 weight_reciprocal;
+-	u16 weight;
+ };
+ 
+ void ieee80211_sta_update_pending_airtime(struct ieee80211_local *local,
+ 					  struct sta_info *sta, u8 ac,
+ 					  u16 tx_airtime, bool tx_completed);
+-void ieee80211_register_airtime(struct ieee80211_txq *txq,
+-				u32 tx_airtime, u32 rx_airtime);
+ 
+ struct sta_info;
+ 
+@@ -523,6 +516,7 @@ struct ieee80211_fragment_cache {
+  * @tid_seq: per-TID sequence numbers for sending to this STA
+  * @airtime: per-AC struct airtime_info describing airtime statistics for this
+  *	station
++ * @airtime_weight: station weight for airtime fairness calculation purposes
+  * @ampdu_mlme: A-MPDU state machine state
+  * @mesh: mesh STA information
+  * @debugfs_dir: debug filesystem directory dentry
+@@ -653,6 +647,7 @@ struct sta_info {
+ 	u16 tid_seq[IEEE80211_QOS_CTL_TID_MASK + 1];
+ 
+ 	struct airtime_info airtime[IEEE80211_NUM_ACS];
++	u16 airtime_weight;
+ 
+ 	/*
+ 	 * Aggregation information, locked with lock.
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -983,25 +983,6 @@ static void __ieee80211_tx_status(struct
+ 		if (!(info->flags & IEEE80211_TX_CTL_INJECTED) && acked)
+ 			ieee80211_frame_acked(sta, skb);
+ 
+-	} else if (wiphy_ext_feature_isset(local->hw.wiphy,
+-					   NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) {
+-		struct ieee80211_sub_if_data *sdata;
+-		struct ieee80211_txq *txq;
+-		u32 airtime;
+-
+-		/* Account airtime to multicast queue */
+-		sdata = ieee80211_sdata_from_skb(local, skb);
+-
+-		if (sdata && (txq = sdata->vif.txq)) {
+-			airtime = info->status.tx_time ?:
+-				ieee80211_calc_expected_tx_airtime(hw,
+-								   &sdata->vif,
+-								   NULL,
+-								   skb->len,
+-								   false);
+-
+-			ieee80211_register_airtime(txq, airtime, 0);
+-		}
+ 	}
+ 
+ 	/* SNMP counters
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -18,7 +18,6 @@
+ #include <linux/bitmap.h>
+ #include <linux/rcupdate.h>
+ #include <linux/export.h>
+-#include <linux/timekeeping.h>
+ #include <net/net_namespace.h>
+ #include <net/ieee80211_radiotap.h>
+ #include <net/cfg80211.h>
+@@ -1480,7 +1479,7 @@ void ieee80211_txq_init(struct ieee80211
+ 	codel_vars_init(&txqi->def_cvars);
+ 	codel_stats_init(&txqi->cstats);
+ 	__skb_queue_head_init(&txqi->frags);
+-	RB_CLEAR_NODE(&txqi->schedule_order);
++	INIT_LIST_HEAD(&txqi->schedule_order);
+ 
+ 	txqi->txq.vif = &sdata->vif;
+ 
+@@ -1524,7 +1523,9 @@ void ieee80211_txq_purge(struct ieee8021
+ 	ieee80211_purge_tx_queue(&local->hw, &txqi->frags);
+ 	spin_unlock_bh(&fq->lock);
+ 
+-	ieee80211_unschedule_txq(&local->hw, &txqi->txq, true);
++	spin_lock_bh(&local->active_txq_lock[txqi->txq.ac]);
++	list_del_init(&txqi->schedule_order);
++	spin_unlock_bh(&local->active_txq_lock[txqi->txq.ac]);
+ }
+ 
+ void ieee80211_txq_set_params(struct ieee80211_local *local)
+@@ -3819,259 +3820,102 @@ EXPORT_SYMBOL(ieee80211_tx_dequeue);
+ struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+-	struct airtime_sched_info *air_sched;
+-	u64 now = ktime_get_coarse_boottime_ns();
+ 	struct ieee80211_txq *ret = NULL;
+-	struct airtime_info *air_info;
+-	struct txq_info *txqi = NULL;
+-	struct rb_node *node;
+-	bool first = false;
++	struct txq_info *txqi = NULL, *head = NULL;
++	bool found_eligible_txq = false;
+ 
+-	air_sched = &local->airtime[ac];
+-	spin_lock_bh(&air_sched->lock);
++	spin_lock_bh(&local->active_txq_lock[ac]);
+ 
+-	node = air_sched->schedule_pos;
+-
+-begin:
+-	if (!node) {
+-		node = rb_first_cached(&air_sched->active_txqs);
+-		first = true;
+-	} else {
+-		node = rb_next(node);
+-	}
+-
+-	if (!node)
+-		goto out;
+-
+-	txqi = container_of(node, struct txq_info, schedule_order);
+-	air_info = to_airtime_info(&txqi->txq);
+-
+-	if (air_info->v_t > air_sched->v_t &&
+-	    (!first || !airtime_catchup_v_t(air_sched, air_info->v_t, now)))
++ begin:
++	txqi = list_first_entry_or_null(&local->active_txqs[ac],
++					struct txq_info,
++					schedule_order);
++	if (!txqi)
+ 		goto out;
+ 
+-	if (!ieee80211_txq_airtime_check(hw, &txqi->txq)) {
+-		first = false;
+-		goto begin;
+-	}
+-
+-	air_sched->schedule_pos = node;
+-	air_sched->last_schedule_activity = now;
+-	ret = &txqi->txq;
+-out:
+-	spin_unlock_bh(&air_sched->lock);
+-	return ret;
+-}
+-EXPORT_SYMBOL(ieee80211_next_txq);
+-
+-static void __ieee80211_insert_txq(struct rb_root_cached *root,
+-				   struct txq_info *txqi)
+-{
+-	struct rb_node **new = &root->rb_root.rb_node;
+-	struct airtime_info *old_air, *new_air;
+-	struct rb_node *parent = NULL;
+-	struct txq_info *__txqi;
+-	bool leftmost = true;
+-
+-	while (*new) {
+-		parent = *new;
+-		__txqi = rb_entry(parent, struct txq_info, schedule_order);
+-		old_air = to_airtime_info(&__txqi->txq);
+-		new_air = to_airtime_info(&txqi->txq);
+-
+-		if (new_air->v_t <= old_air->v_t) {
+-			new = &parent->rb_left;
+-		} else {
+-			new = &parent->rb_right;
+-			leftmost = false;
+-		}
++	if (txqi == head) {
++		if (!found_eligible_txq)
++			goto out;
++		else
++			found_eligible_txq = false;
+ 	}
+ 
+-	rb_link_node(&txqi->schedule_order, parent, new);
+-	rb_insert_color_cached(&txqi->schedule_order, root, leftmost);
+-}
+-
+-void ieee80211_resort_txq(struct ieee80211_hw *hw,
+-			  struct ieee80211_txq *txq)
+-{
+-	struct airtime_info *air_info = to_airtime_info(txq);
+-	struct ieee80211_local *local = hw_to_local(hw);
+-	struct txq_info *txqi = to_txq_info(txq);
+-	struct airtime_sched_info *air_sched;
+-
+-	air_sched = &local->airtime[txq->ac];
++	if (!head)
++		head = txqi;
+ 
+-	lockdep_assert_held(&air_sched->lock);
+-
+-	if (!RB_EMPTY_NODE(&txqi->schedule_order)) {
+-		struct airtime_info *a_prev = NULL, *a_next = NULL;
+-		struct txq_info *t_prev, *t_next;
+-		struct rb_node *n_prev, *n_next;
++	if (txqi->txq.sta) {
++		struct sta_info *sta = container_of(txqi->txq.sta,
++						    struct sta_info, sta);
++		bool aql_check = ieee80211_txq_airtime_check(hw, &txqi->txq);
++		s64 deficit = sta->airtime[txqi->txq.ac].deficit;
+ 
+-		/* Erasing a node can cause an expensive rebalancing operation,
+-		 * so we check the previous and next nodes first and only remove
+-		 * and re-insert if the current node is not already in the
+-		 * correct position.
+-		 */
+-		if ((n_prev = rb_prev(&txqi->schedule_order)) != NULL) {
+-			t_prev = container_of(n_prev, struct txq_info,
+-					      schedule_order);
+-			a_prev = to_airtime_info(&t_prev->txq);
+-		}
++		if (aql_check)
++			found_eligible_txq = true;
+ 
+-		if ((n_next = rb_next(&txqi->schedule_order)) != NULL) {
+-			t_next = container_of(n_next, struct txq_info,
+-					      schedule_order);
+-			a_next = to_airtime_info(&t_next->txq);
++		if (deficit < 0)
++			sta->airtime[txqi->txq.ac].deficit +=
++				sta->airtime_weight;
++
++		if (deficit < 0 || !aql_check) {
++			list_move_tail(&txqi->schedule_order,
++				       &local->active_txqs[txqi->txq.ac]);
++			goto begin;
+ 		}
+-
+-		if ((!a_prev || a_prev->v_t <= air_info->v_t) &&
+-		    (!a_next || a_next->v_t > air_info->v_t))
+-			return;
+-
+-		if (air_sched->schedule_pos == &txqi->schedule_order)
+-			air_sched->schedule_pos = n_prev;
+-
+-		rb_erase_cached(&txqi->schedule_order,
+-				&air_sched->active_txqs);
+-		RB_CLEAR_NODE(&txqi->schedule_order);
+-		__ieee80211_insert_txq(&air_sched->active_txqs, txqi);
+ 	}
+-}
+-
+-void ieee80211_update_airtime_weight(struct ieee80211_local *local,
+-				     struct airtime_sched_info *air_sched,
+-				     u64 now, bool force)
+-{
+-	struct airtime_info *air_info, *tmp;
+-	u64 weight_sum = 0;
+-
+-	if (unlikely(!now))
+-		now = ktime_get_coarse_boottime_ns();
+-
+-	lockdep_assert_held(&air_sched->lock);
+-
+-	if (!force && (air_sched->last_weight_update <
+-		       now - AIRTIME_ACTIVE_DURATION))
+-		return;
+-
+-	list_for_each_entry_safe(air_info, tmp,
+-				 &air_sched->active_list, list) {
+-		if (airtime_is_active(air_info, now))
+-			weight_sum += air_info->weight;
+-		else
+-			list_del_init(&air_info->list);
+-	}
+-	airtime_weight_sum_set(air_sched, weight_sum);
+-	air_sched->last_weight_update = now;
+-}
+ 
+-void ieee80211_schedule_txq(struct ieee80211_hw *hw,
+-			    struct ieee80211_txq *txq)
+-	__acquires(txq_lock) __releases(txq_lock)
+-{
+-	struct ieee80211_local *local = hw_to_local(hw);
+-	struct txq_info *txqi = to_txq_info(txq);
+-	struct airtime_sched_info *air_sched;
+-	u64 now = ktime_get_coarse_boottime_ns();
+-	struct airtime_info *air_info;
+-	u8 ac = txq->ac;
+-	bool was_active;
+ 
+-	air_sched = &local->airtime[ac];
+-	air_info = to_airtime_info(txq);
+-
+-	spin_lock_bh(&air_sched->lock);
+-	was_active = airtime_is_active(air_info, now);
+-	airtime_set_active(air_sched, air_info, now);
+-
+-	if (!RB_EMPTY_NODE(&txqi->schedule_order))
++	if (txqi->schedule_round == local->schedule_round[ac])
+ 		goto out;
+ 
+-	/* If the station has been inactive for a while, catch up its v_t so it
+-	 * doesn't get indefinite priority; see comment above the definition of
+-	 * AIRTIME_MAX_BEHIND.
+-	 */
+-	if ((!was_active && air_info->v_t < air_sched->v_t) ||
+-	    air_info->v_t < air_sched->v_t - AIRTIME_MAX_BEHIND)
+-		air_info->v_t = air_sched->v_t;
+-
+-	ieee80211_update_airtime_weight(local, air_sched, now, !was_active);
+-	__ieee80211_insert_txq(&air_sched->active_txqs, txqi);
++	list_del_init(&txqi->schedule_order);
++	txqi->schedule_round = local->schedule_round[ac];
++	ret = &txqi->txq;
+ 
+ out:
+-	spin_unlock_bh(&air_sched->lock);
+-}
+-EXPORT_SYMBOL(ieee80211_schedule_txq);
+-
+-static void __ieee80211_unschedule_txq(struct ieee80211_hw *hw,
+-				       struct ieee80211_txq *txq,
+-				       bool purge)
+-{
+-	struct ieee80211_local *local = hw_to_local(hw);
+-	struct txq_info *txqi = to_txq_info(txq);
+-	struct airtime_sched_info *air_sched;
+-	struct airtime_info *air_info;
+-
+-	air_sched = &local->airtime[txq->ac];
+-	air_info = to_airtime_info(&txqi->txq);
+-
+-	lockdep_assert_held(&air_sched->lock);
+-
+-	if (purge) {
+-		list_del_init(&air_info->list);
+-		ieee80211_update_airtime_weight(local, air_sched, 0, true);
+-	}
+-
+-	if (RB_EMPTY_NODE(&txqi->schedule_order))
+-		return;
+-
+-	if (air_sched->schedule_pos == &txqi->schedule_order)
+-		air_sched->schedule_pos = rb_prev(&txqi->schedule_order);
+-
+-	if (!purge)
+-		airtime_set_active(air_sched, air_info,
+-				   ktime_get_coarse_boottime_ns());
+-
+-	rb_erase_cached(&txqi->schedule_order,
+-			&air_sched->active_txqs);
+-	RB_CLEAR_NODE(&txqi->schedule_order);
++	spin_unlock_bh(&local->active_txq_lock[ac]);
++	return ret;
+ }
++EXPORT_SYMBOL(ieee80211_next_txq);
+ 
+-void ieee80211_unschedule_txq(struct ieee80211_hw *hw,
++void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
+ 			      struct ieee80211_txq *txq,
+-			      bool purge)
+-	__acquires(txq_lock) __releases(txq_lock)
+-{
+-	struct ieee80211_local *local = hw_to_local(hw);
+-
+-	spin_lock_bh(&local->airtime[txq->ac].lock);
+-	__ieee80211_unschedule_txq(hw, txq, purge);
+-	spin_unlock_bh(&local->airtime[txq->ac].lock);
+-}
+-
+-void ieee80211_return_txq(struct ieee80211_hw *hw,
+-			  struct ieee80211_txq *txq, bool force)
++			      bool force)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct txq_info *txqi = to_txq_info(txq);
+ 
+-	spin_lock_bh(&local->airtime[txq->ac].lock);
++	spin_lock_bh(&local->active_txq_lock[txq->ac]);
+ 
+-	if (!RB_EMPTY_NODE(&txqi->schedule_order) && !force &&
+-	    !txq_has_queue(txq))
+-		__ieee80211_unschedule_txq(hw, txq, false);
++	if (list_empty(&txqi->schedule_order) &&
++	    (force || !skb_queue_empty(&txqi->frags) ||
++	     txqi->tin.backlog_packets)) {
++		/* If airtime accounting is active, always enqueue STAs at the
++		 * head of the list to ensure that they only get moved to the
++		 * back by the airtime DRR scheduler once they have a negative
++		 * deficit. A station that already has a negative deficit will
++		 * get immediately moved to the back of the list on the next
++		 * call to ieee80211_next_txq().
++		 */
++		if (txqi->txq.sta && local->airtime_flags &&
++		    wiphy_ext_feature_isset(local->hw.wiphy,
++					    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
++			list_add(&txqi->schedule_order,
++				 &local->active_txqs[txq->ac]);
++		else
++			list_add_tail(&txqi->schedule_order,
++				      &local->active_txqs[txq->ac]);
++	}
+ 
+-	spin_unlock_bh(&local->airtime[txq->ac].lock);
++	spin_unlock_bh(&local->active_txq_lock[txq->ac]);
+ }
+-EXPORT_SYMBOL(ieee80211_return_txq);
++EXPORT_SYMBOL(__ieee80211_schedule_txq);
+ 
+ DEFINE_STATIC_KEY_FALSE(aql_disable);
+ 
+ bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,
+ 				 struct ieee80211_txq *txq)
+ {
+-	struct airtime_info *air_info = to_airtime_info(txq);
++	struct sta_info *sta;
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 
+ 	if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
+@@ -4086,12 +3930,15 @@ bool ieee80211_txq_airtime_check(struct
+ 	if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
+ 		return true;
+ 
+-	if (atomic_read(&air_info->aql_tx_pending) < air_info->aql_limit_low)
++	sta = container_of(txq->sta, struct sta_info, sta);
++	if (atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
++	    sta->airtime[txq->ac].aql_limit_low)
+ 		return true;
+ 
+ 	if (atomic_read(&local->aql_total_pending_airtime) <
+ 	    local->aql_threshold &&
+-	    atomic_read(&air_info->aql_tx_pending) < air_info->aql_limit_high)
++	    atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
++	    sta->airtime[txq->ac].aql_limit_high)
+ 		return true;
+ 
+ 	return false;
+@@ -4101,59 +3948,60 @@ EXPORT_SYMBOL(ieee80211_txq_airtime_chec
+ bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
+ 				struct ieee80211_txq *txq)
+ {
+-	struct txq_info *first_txqi = NULL, *txqi = to_txq_info(txq);
+ 	struct ieee80211_local *local = hw_to_local(hw);
+-	struct airtime_sched_info *air_sched;
+-	struct airtime_info *air_info;
+-	struct rb_node *node = NULL;
+-	bool ret = false;
+-	u64 now;
+-
++	struct txq_info *iter, *tmp, *txqi = to_txq_info(txq);
++	struct sta_info *sta;
++	u8 ac = txq->ac;
+ 
+-	if (!ieee80211_txq_airtime_check(hw, txq))
+-		return false;
++	spin_lock_bh(&local->active_txq_lock[ac]);
+ 
+-	air_sched = &local->airtime[txq->ac];
+-	spin_lock_bh(&air_sched->lock);
++	if (!txqi->txq.sta)
++		goto out;
+ 
+-	if (RB_EMPTY_NODE(&txqi->schedule_order))
++	if (list_empty(&txqi->schedule_order))
+ 		goto out;
+ 
+-	now = ktime_get_coarse_boottime_ns();
++	list_for_each_entry_safe(iter, tmp, &local->active_txqs[ac],
++				 schedule_order) {
++		if (iter == txqi)
++			break;
+ 
+-	/* Like in ieee80211_next_txq(), make sure the first station in the
+-	 * scheduling order is eligible for transmission to avoid starvation.
+-	 */
+-	node = rb_first_cached(&air_sched->active_txqs);
+-	if (node) {
+-		first_txqi = container_of(node, struct txq_info,
+-					  schedule_order);
+-		air_info = to_airtime_info(&first_txqi->txq);
+-
+-		if (air_sched->v_t < air_info->v_t)
+-			airtime_catchup_v_t(air_sched, air_info->v_t, now);
++		if (!iter->txq.sta) {
++			list_move_tail(&iter->schedule_order,
++				       &local->active_txqs[ac]);
++			continue;
++		}
++		sta = container_of(iter->txq.sta, struct sta_info, sta);
++		if (sta->airtime[ac].deficit < 0)
++			sta->airtime[ac].deficit += sta->airtime_weight;
++		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
+ 	}
+ 
+-	air_info = to_airtime_info(&txqi->txq);
+-	if (air_info->v_t <= air_sched->v_t) {
+-		air_sched->last_schedule_activity = now;
+-		ret = true;
+-	}
++	sta = container_of(txqi->txq.sta, struct sta_info, sta);
++	if (sta->airtime[ac].deficit >= 0)
++		goto out;
++
++	sta->airtime[ac].deficit += sta->airtime_weight;
++	list_move_tail(&txqi->schedule_order, &local->active_txqs[ac]);
++	spin_unlock_bh(&local->active_txq_lock[ac]);
+ 
++	return false;
+ out:
+-	spin_unlock_bh(&air_sched->lock);
+-	return ret;
++	if (!list_empty(&txqi->schedule_order))
++		list_del_init(&txqi->schedule_order);
++	spin_unlock_bh(&local->active_txq_lock[ac]);
++
++	return true;
+ }
+ EXPORT_SYMBOL(ieee80211_txq_may_transmit);
+ 
+ void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+-	struct airtime_sched_info *air_sched = &local->airtime[ac];
+ 
+-	spin_lock_bh(&air_sched->lock);
+-	air_sched->schedule_pos = NULL;
+-	spin_unlock_bh(&air_sched->lock);
++	spin_lock_bh(&local->active_txq_lock[ac]);
++	local->schedule_round[ac]++;
++	spin_unlock_bh(&local->active_txq_lock[ac]);
+ }
+ EXPORT_SYMBOL(ieee80211_txq_schedule_start);
+ 
diff --git a/package/kernel/mac80211/patches/subsys/331-mac80211-make-sta-airtime-deficit-field-s32-instead-.patch b/package/kernel/mac80211/patches/subsys/331-mac80211-make-sta-airtime-deficit-field-s32-instead-.patch
new file mode 100644
index 0000000000..c006d3762a
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/331-mac80211-make-sta-airtime-deficit-field-s32-instead-.patch
@@ -0,0 +1,52 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Jun 2022 14:53:04 +0200
+Subject: [PATCH] mac80211: make sta airtime deficit field s32 instead of
+ s64
+
+32 bit is more than enough range for the airtime deficit
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/debugfs_sta.c
++++ b/net/mac80211/debugfs_sta.c
+@@ -202,7 +202,7 @@ static ssize_t sta_airtime_read(struct f
+ 	size_t bufsz = 400;
+ 	char *buf = kzalloc(bufsz, GFP_KERNEL), *p = buf;
+ 	u64 rx_airtime = 0, tx_airtime = 0;
+-	s64 deficit[IEEE80211_NUM_ACS];
++	s32 deficit[IEEE80211_NUM_ACS];
+ 	ssize_t rv;
+ 	int ac;
+ 
+@@ -219,7 +219,7 @@ static ssize_t sta_airtime_read(struct f
+ 
+ 	p += scnprintf(p, bufsz + buf - p,
+ 		"RX: %llu us\nTX: %llu us\nWeight: %u\n"
+-		"Deficit: VO: %lld us VI: %lld us BE: %lld us BK: %lld us\n",
++		"Deficit: VO: %d us VI: %d us BE: %d us BK: %d us\n",
+ 		rx_airtime, tx_airtime, sta->airtime_weight,
+ 		deficit[0], deficit[1], deficit[2], deficit[3]);
+ 
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -138,7 +138,7 @@ enum ieee80211_agg_stop_reason {
+ struct airtime_info {
+ 	u64 rx_airtime;
+ 	u64 tx_airtime;
+-	s64 deficit;
++	s32 deficit;
+ 	atomic_t aql_tx_pending; /* Estimated airtime for frames pending */
+ 	u32 aql_limit_low;
+ 	u32 aql_limit_high;
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3847,7 +3847,7 @@ struct ieee80211_txq *ieee80211_next_txq
+ 		struct sta_info *sta = container_of(txqi->txq.sta,
+ 						    struct sta_info, sta);
+ 		bool aql_check = ieee80211_txq_airtime_check(hw, &txqi->txq);
+-		s64 deficit = sta->airtime[txqi->txq.ac].deficit;
++		s32 deficit = sta->airtime[txqi->txq.ac].deficit;
+ 
+ 		if (aql_check)
+ 			found_eligible_txq = true;
diff --git a/package/kernel/mac80211/patches/subsys/332-mac80211-consider-aql_tx_pending-when-checking-airti.patch b/package/kernel/mac80211/patches/subsys/332-mac80211-consider-aql_tx_pending-when-checking-airti.patch
new file mode 100644
index 0000000000..c214294603
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/332-mac80211-consider-aql_tx_pending-when-checking-airti.patch
@@ -0,0 +1,48 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Jun 2022 14:59:09 +0200
+Subject: [PATCH] mac80211: consider aql_tx_pending when checking airtime
+ deficit
+
+When queueing packets for a station, deficit only gets added once the packets
+have been transmitted, which could be much later. During that time, a lot of
+temporary unfairness could happen, which could lead to bursty behavior.
+Fix this by subtracting the aql_tx_pending when checking the deficit in tx
+scheduling.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3817,6 +3817,13 @@ out:
+ }
+ EXPORT_SYMBOL(ieee80211_tx_dequeue);
+ 
++static inline s32 ieee80211_sta_deficit(struct sta_info *sta, u8 ac)
++{
++	struct airtime_info *air_info = &sta->airtime[ac];
++
++	return air_info->deficit - atomic_read(&air_info->aql_tx_pending);
++}
++
+ struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+@@ -3847,7 +3854,7 @@ struct ieee80211_txq *ieee80211_next_txq
+ 		struct sta_info *sta = container_of(txqi->txq.sta,
+ 						    struct sta_info, sta);
+ 		bool aql_check = ieee80211_txq_airtime_check(hw, &txqi->txq);
+-		s32 deficit = sta->airtime[txqi->txq.ac].deficit;
++		s32 deficit = ieee80211_sta_deficit(sta, txqi->txq.ac);
+ 
+ 		if (aql_check)
+ 			found_eligible_txq = true;
+@@ -3972,7 +3979,7 @@ bool ieee80211_txq_may_transmit(struct i
+ 			continue;
+ 		}
+ 		sta = container_of(iter->txq.sta, struct sta_info, sta);
+-		if (sta->airtime[ac].deficit < 0)
++		if (ieee80211_sta_deficit(sta, ac) < 0)
+ 			sta->airtime[ac].deficit += sta->airtime_weight;
+ 		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
+ 	}
diff --git a/package/kernel/mac80211/patches/subsys/333-mac80211-keep-recently-active-tx-queues-in-schedulin.patch b/package/kernel/mac80211/patches/subsys/333-mac80211-keep-recently-active-tx-queues-in-schedulin.patch
new file mode 100644
index 0000000000..317e4f0653
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/333-mac80211-keep-recently-active-tx-queues-in-schedulin.patch
@@ -0,0 +1,118 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Jun 2022 20:52:50 +0200
+Subject: [PATCH] mac80211: keep recently active tx queues in scheduling
+ list
+
+This allows proper deficit accounting to ensure that they don't carry their
+deficit until the next time they become active
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -83,6 +83,13 @@ extern const u8 ieee80211_ac_to_qos_mask
+ 
+ #define IEEE80211_MAX_NAN_INSTANCE_ID 255
+ 
++
++/*
++ * Keep a station's queues on the active list for deficit accounting purposes
++ * if it was active or queued during the last 100ms
++ */
++#define AIRTIME_ACTIVE_DURATION (HZ / 10)
++
+ struct ieee80211_bss {
+ 	u32 device_ts_beacon, device_ts_presp;
+ 
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -138,6 +138,7 @@ enum ieee80211_agg_stop_reason {
+ struct airtime_info {
+ 	u64 rx_airtime;
+ 	u64 tx_airtime;
++	u32 last_active;
+ 	s32 deficit;
+ 	atomic_t aql_tx_pending; /* Estimated airtime for frames pending */
+ 	u32 aql_limit_low;
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3824,6 +3824,36 @@ static inline s32 ieee80211_sta_deficit(
+ 	return air_info->deficit - atomic_read(&air_info->aql_tx_pending);
+ }
+ 
++static void
++ieee80211_txq_set_active(struct txq_info *txqi)
++{
++	struct sta_info *sta;
++
++	if (!txqi->txq.sta)
++		return;
++
++	sta = container_of(txqi->txq.sta, struct sta_info, sta);
++	sta->airtime[txqi->txq.ac].last_active = (u32)jiffies;
++}
++
++static bool
++ieee80211_txq_keep_active(struct txq_info *txqi)
++{
++	struct sta_info *sta;
++	u32 diff;
++
++	if (!txqi->txq.sta)
++		return false;
++
++	sta = container_of(txqi->txq.sta, struct sta_info, sta);
++	if (ieee80211_sta_deficit(sta, txqi->txq.ac) >= 0)
++		return false;
++
++	diff = (u32)jiffies - sta->airtime[txqi->txq.ac].last_active;
++
++	return diff <= AIRTIME_ACTIVE_DURATION;
++}
++
+ struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+@@ -3870,7 +3900,6 @@ struct ieee80211_txq *ieee80211_next_txq
+ 		}
+ 	}
+ 
+-
+ 	if (txqi->schedule_round == local->schedule_round[ac])
+ 		goto out;
+ 
+@@ -3890,12 +3919,13 @@ void __ieee80211_schedule_txq(struct iee
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct txq_info *txqi = to_txq_info(txq);
++	bool has_queue;
+ 
+ 	spin_lock_bh(&local->active_txq_lock[txq->ac]);
+ 
++	has_queue = force || txq_has_queue(txq);
+ 	if (list_empty(&txqi->schedule_order) &&
+-	    (force || !skb_queue_empty(&txqi->frags) ||
+-	     txqi->tin.backlog_packets)) {
++	    (has_queue || ieee80211_txq_keep_active(txqi))) {
+ 		/* If airtime accounting is active, always enqueue STAs at the
+ 		 * head of the list to ensure that they only get moved to the
+ 		 * back by the airtime DRR scheduler once they have a negative
+@@ -3903,7 +3933,7 @@ void __ieee80211_schedule_txq(struct iee
+ 		 * get immediately moved to the back of the list on the next
+ 		 * call to ieee80211_next_txq().
+ 		 */
+-		if (txqi->txq.sta && local->airtime_flags &&
++		if (txqi->txq.sta && local->airtime_flags && has_queue &&
+ 		    wiphy_ext_feature_isset(local->hw.wiphy,
+ 					    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
+ 			list_add(&txqi->schedule_order,
+@@ -3911,6 +3941,8 @@ void __ieee80211_schedule_txq(struct iee
+ 		else
+ 			list_add_tail(&txqi->schedule_order,
+ 				      &local->active_txqs[txq->ac]);
++		if (has_queue)
++			ieee80211_txq_set_active(txqi);
+ 	}
+ 
+ 	spin_unlock_bh(&local->active_txq_lock[txq->ac]);
diff --git a/package/kernel/mac80211/patches/subsys/334-mac80211-add-a-per-PHY-AQL-limit-to-improve-fairness.patch b/package/kernel/mac80211/patches/subsys/334-mac80211-add-a-per-PHY-AQL-limit-to-improve-fairness.patch
new file mode 100644
index 0000000000..42e1671ed6
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/334-mac80211-add-a-per-PHY-AQL-limit-to-improve-fairness.patch
@@ -0,0 +1,131 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Jun 2022 21:26:34 +0200
+Subject: [PATCH] mac80211: add a per-PHY AQL limit to improve fairness
+
+In order to maintain fairness, the amount of queueing needs to be limited
+beyond the simple per-station AQL budget, otherwise the driver can simply
+repeatedly do scheduling rounds until all queues that have not used their
+AQL budget become eligble.
+
+To be conservative, use the high AQL limit for the first txq and add half
+of the low AQL for each subsequent queue.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1216,6 +1216,7 @@ struct ieee80211_local {
+ 	u32 aql_txq_limit_high[IEEE80211_NUM_ACS];
+ 	u32 aql_threshold;
+ 	atomic_t aql_total_pending_airtime;
++	atomic_t aql_ac_pending_airtime[IEEE80211_NUM_ACS];
+ 
+ 	const struct ieee80211_ops *ops;
+ 
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -712,6 +712,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 		local->aql_txq_limit_low[i] = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L;
+ 		local->aql_txq_limit_high[i] =
+ 			IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H;
++		atomic_set(&local->aql_ac_pending_airtime[i], 0);
+ 	}
+ 
+ 	local->airtime_flags = AIRTIME_USE_TX | AIRTIME_USE_RX;
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1929,6 +1929,7 @@ void ieee80211_sta_update_pending_airtim
+ 				   &sta->airtime[ac].aql_tx_pending);
+ 
+ 		atomic_add(tx_airtime, &local->aql_total_pending_airtime);
++		atomic_add(tx_airtime, &local->aql_ac_pending_airtime[ac]);
+ 		return;
+ 	}
+ 
+@@ -1940,14 +1941,17 @@ void ieee80211_sta_update_pending_airtim
+ 				       tx_pending, 0);
+ 	}
+ 
++	atomic_sub(tx_airtime, &local->aql_total_pending_airtime);
+ 	tx_pending = atomic_sub_return(tx_airtime,
+-				       &local->aql_total_pending_airtime);
++				       &local->aql_ac_pending_airtime[ac]);
+ 	if (WARN_ONCE(tx_pending < 0,
+ 		      "Device %s AC %d pending airtime underflow: %u, %u",
+ 		      wiphy_name(local->hw.wiphy), ac, tx_pending,
+-		      tx_airtime))
+-		atomic_cmpxchg(&local->aql_total_pending_airtime,
++		      tx_airtime)) {
++		atomic_cmpxchg(&local->aql_ac_pending_airtime[ac],
+ 			       tx_pending, 0);
++		atomic_sub(tx_pending, &local->aql_total_pending_airtime);
++	}
+ }
+ 
+ int sta_info_move_state(struct sta_info *sta,
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3863,6 +3863,9 @@ struct ieee80211_txq *ieee80211_next_txq
+ 
+ 	spin_lock_bh(&local->active_txq_lock[ac]);
+ 
++	if (!local->schedule_round[ac])
++		goto out;
++
+  begin:
+ 	txqi = list_first_entry_or_null(&local->active_txqs[ac],
+ 					struct txq_info,
+@@ -3984,6 +3987,25 @@ bool ieee80211_txq_airtime_check(struct
+ }
+ EXPORT_SYMBOL(ieee80211_txq_airtime_check);
+ 
++static bool
++ieee80211_txq_schedule_airtime_check(struct ieee80211_local *local, u8 ac)
++{
++	unsigned int num_txq = 0;
++	struct txq_info *txq;
++	u32 aql_limit;
++
++	if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
++		return true;
++
++	list_for_each_entry(txq, &local->active_txqs[ac], schedule_order)
++		num_txq++;
++
++	aql_limit = (num_txq - 1) * local->aql_txq_limit_low[ac] / 2 +
++		    local->aql_txq_limit_high[ac];
++
++	return atomic_read(&local->aql_ac_pending_airtime[ac]) < aql_limit;
++}
++
+ bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
+ 				struct ieee80211_txq *txq)
+ {
+@@ -4000,6 +4022,9 @@ bool ieee80211_txq_may_transmit(struct i
+ 	if (list_empty(&txqi->schedule_order))
+ 		goto out;
+ 
++	if (!ieee80211_txq_schedule_airtime_check(local, ac))
++		goto out;
++
+ 	list_for_each_entry_safe(iter, tmp, &local->active_txqs[ac],
+ 				 schedule_order) {
+ 		if (iter == txqi)
+@@ -4039,7 +4064,15 @@ void ieee80211_txq_schedule_start(struct
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 
+ 	spin_lock_bh(&local->active_txq_lock[ac]);
+-	local->schedule_round[ac]++;
++
++	if (ieee80211_txq_schedule_airtime_check(local, ac)) {
++		local->schedule_round[ac]++;
++		if (!local->schedule_round[ac])
++			local->schedule_round[ac]++;
++	} else {
++		local->schedule_round[ac] = 0;
++	}
++
+ 	spin_unlock_bh(&local->active_txq_lock[ac]);
+ }
+ EXPORT_SYMBOL(ieee80211_txq_schedule_start);
diff --git a/package/kernel/mac80211/patches/subsys/335-mac80211-add-debugfs-file-to-display-per-phy-AQL-pen.patch b/package/kernel/mac80211/patches/subsys/335-mac80211-add-debugfs-file-to-display-per-phy-AQL-pen.patch
new file mode 100644
index 0000000000..df45a520fa
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/335-mac80211-add-debugfs-file-to-display-per-phy-AQL-pen.patch
@@ -0,0 +1,58 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 25 Jun 2022 21:25:40 +0200
+Subject: [PATCH] mac80211: add debugfs file to display per-phy AQL pending
+ airtime
+
+Now that the global pending airtime is more relevant for airtime fairness,
+it makes sense to make it accessible via debugfs for debugging
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -201,6 +201,36 @@ static const struct file_operations airt
+ 	.llseek = default_llseek,
+ };
+ 
++static ssize_t aql_pending_read(struct file *file,
++				char __user *user_buf,
++				size_t count, loff_t *ppos)
++{
++	struct ieee80211_local *local = file->private_data;
++	char buf[400];
++	int len = 0;
++
++	len = scnprintf(buf, sizeof(buf),
++			"AC     AQL pending\n"
++			"VO     %u us\n"
++			"VI     %u us\n"
++			"BE     %u us\n"
++			"BK     %u us\n"
++			"total  %u us\n",
++			atomic_read(&local->aql_ac_pending_airtime[IEEE80211_AC_VO]),
++			atomic_read(&local->aql_ac_pending_airtime[IEEE80211_AC_VI]),
++			atomic_read(&local->aql_ac_pending_airtime[IEEE80211_AC_BE]),
++			atomic_read(&local->aql_ac_pending_airtime[IEEE80211_AC_BK]),
++			atomic_read(&local->aql_total_pending_airtime));
++	return simple_read_from_buffer(user_buf, count, ppos,
++				       buf, len);
++}
++
++static const struct file_operations aql_pending_ops = {
++	.read = aql_pending_read,
++	.open = simple_open,
++	.llseek = default_llseek,
++};
++
+ static ssize_t aql_txq_limit_read(struct file *file,
+ 				  char __user *user_buf,
+ 				  size_t count,
+@@ -628,6 +658,7 @@ void debugfs_hw_add(struct ieee80211_loc
+ 	DEBUGFS_ADD(hw_conf);
+ 	DEBUGFS_ADD_MODE(force_tx_status, 0600);
+ 	DEBUGFS_ADD_MODE(aql_enable, 0600);
++	DEBUGFS_ADD(aql_pending);
+ 
+ 	if (local->ops->wake_tx_queue)
+ 		DEBUGFS_ADD_MODE(aqm, 0600);
diff --git a/package/kernel/mac80211/patches/subsys/336-mac80211-only-accumulate-airtime-deficit-for-active-.patch b/package/kernel/mac80211/patches/subsys/336-mac80211-only-accumulate-airtime-deficit-for-active-.patch
new file mode 100644
index 0000000000..35f07c1a97
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/336-mac80211-only-accumulate-airtime-deficit-for-active-.patch
@@ -0,0 +1,36 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 25 Jun 2022 23:10:19 +0200
+Subject: [PATCH] mac80211: only accumulate airtime deficit for active
+ clients
+
+When a client does not generate any local tx activity, accumulating airtime
+deficit for the round-robin scheduler can be harmful. If this goes on for too
+long, the deficit could grow quite large, which might cause unreasonable
+initial latency once the client becomes active
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1900,6 +1900,7 @@ void ieee80211_sta_register_airtime(stru
+ 	struct ieee80211_local *local = sta->sdata->local;
+ 	u8 ac = ieee80211_ac_from_tid(tid);
+ 	u32 airtime = 0;
++	u32 diff;
+ 
+ 	if (sta->local->airtime_flags & AIRTIME_USE_TX)
+ 		airtime += tx_airtime;
+@@ -1909,7 +1910,11 @@ void ieee80211_sta_register_airtime(stru
+ 	spin_lock_bh(&local->active_txq_lock[ac]);
+ 	sta->airtime[ac].tx_airtime += tx_airtime;
+ 	sta->airtime[ac].rx_airtime += rx_airtime;
+-	sta->airtime[ac].deficit -= airtime;
++
++	diff = (u32)jiffies - sta->airtime[ac].last_active;
++	if (diff <= AIRTIME_ACTIVE_DURATION)
++		sta->airtime[ac].deficit -= airtime;
++
+ 	spin_unlock_bh(&local->active_txq_lock[ac]);
+ }
+ EXPORT_SYMBOL(ieee80211_sta_register_airtime);
diff --git a/package/kernel/mac80211/patches/subsys/337-mac80211-increase-quantum-for-airtime-scheduler.patch b/package/kernel/mac80211/patches/subsys/337-mac80211-increase-quantum-for-airtime-scheduler.patch
new file mode 100644
index 0000000000..74e857679e
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/337-mac80211-increase-quantum-for-airtime-scheduler.patch
@@ -0,0 +1,53 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 26 Jun 2022 11:43:25 +0200
+Subject: [PATCH] mac80211: increase quantum for airtime scheduler
+
+Given the typical AQL budget and queue length, a quantum of 256 with the
+default station weight often requires iterating over all queues frequently,
+until one of them becomes eligible.
+Improve performance by using 8 times station weight as scheduler quantum
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -90,6 +90,8 @@ extern const u8 ieee80211_ac_to_qos_mask
+  */
+ #define AIRTIME_ACTIVE_DURATION (HZ / 10)
+ 
++#define AIRTIME_QUANTUM_SHIFT	3
++
+ struct ieee80211_bss {
+ 	u32 device_ts_beacon, device_ts_presp;
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3894,7 +3894,7 @@ struct ieee80211_txq *ieee80211_next_txq
+ 
+ 		if (deficit < 0)
+ 			sta->airtime[txqi->txq.ac].deficit +=
+-				sta->airtime_weight;
++				sta->airtime_weight << AIRTIME_QUANTUM_SHIFT;
+ 
+ 		if (deficit < 0 || !aql_check) {
+ 			list_move_tail(&txqi->schedule_order,
+@@ -4037,7 +4037,8 @@ bool ieee80211_txq_may_transmit(struct i
+ 		}
+ 		sta = container_of(iter->txq.sta, struct sta_info, sta);
+ 		if (ieee80211_sta_deficit(sta, ac) < 0)
+-			sta->airtime[ac].deficit += sta->airtime_weight;
++			sta->airtime[ac].deficit += sta->airtime_weight <<
++						    AIRTIME_QUANTUM_SHIFT;
+ 		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
+ 	}
+ 
+@@ -4045,7 +4046,7 @@ bool ieee80211_txq_may_transmit(struct i
+ 	if (sta->airtime[ac].deficit >= 0)
+ 		goto out;
+ 
+-	sta->airtime[ac].deficit += sta->airtime_weight;
++	sta->airtime[ac].deficit += sta->airtime_weight << AIRTIME_QUANTUM_SHIFT;
+ 	list_move_tail(&txqi->schedule_order, &local->active_txqs[ac]);
+ 	spin_unlock_bh(&local->active_txq_lock[ac]);
+ 
diff --git a/package/kernel/mac80211/patches/subsys/337-mac80211-minstrel_ht-clean-up-CCK-code.patch b/package/kernel/mac80211/patches/subsys/337-mac80211-minstrel_ht-clean-up-CCK-code.patch
deleted file mode 100644
index f667d2c94e..0000000000
--- a/package/kernel/mac80211/patches/subsys/337-mac80211-minstrel_ht-clean-up-CCK-code.patch
+++ /dev/null
@@ -1,166 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 25 Dec 2020 16:22:52 +0100
-Subject: [PATCH] mac80211: minstrel_ht: clean up CCK code
-
-- move ack overhead out of rate duration table
-- remove cck_supported, cck_supported_short
-
-Preparation for adding OFDM legacy rates support
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -136,20 +136,16 @@
- 	__VHT_GROUP(_streams, _sgi, _bw,				\
- 		    VHT_GROUP_SHIFT(_streams, _sgi, _bw))
- 
--#define CCK_DURATION(_bitrate, _short, _len)		\
-+#define CCK_DURATION(_bitrate, _short)			\
- 	(1000 * (10 /* SIFS */ +			\
- 	 (_short ? 72 + 24 : 144 + 48) +		\
--	 (8 * (_len + 4) * 10) / (_bitrate)))
--
--#define CCK_ACK_DURATION(_bitrate, _short)			\
--	(CCK_DURATION((_bitrate > 10 ? 20 : 10), false, 60) +	\
--	 CCK_DURATION(_bitrate, _short, AVG_PKT_SIZE))
-+	 (8 * (AVG_PKT_SIZE + 4) * 10) / (_bitrate)))
- 
- #define CCK_DURATION_LIST(_short, _s)			\
--	CCK_ACK_DURATION(10, _short) >> _s,		\
--	CCK_ACK_DURATION(20, _short) >> _s,		\
--	CCK_ACK_DURATION(55, _short) >> _s,		\
--	CCK_ACK_DURATION(110, _short) >> _s
-+	CCK_DURATION(10, _short) >> _s,			\
-+	CCK_DURATION(20, _short) >> _s,			\
-+	CCK_DURATION(55, _short) >> _s,			\
-+	CCK_DURATION(110, _short) >> _s
- 
- #define __CCK_GROUP(_s)					\
- 	[MINSTREL_CCK_GROUP] = {			\
-@@ -163,7 +159,7 @@
- 	}
- 
- #define CCK_GROUP_SHIFT					\
--	GROUP_SHIFT(CCK_ACK_DURATION(10, false))
-+	GROUP_SHIFT(CCK_DURATION(10, false))
- 
- #define CCK_GROUP __CCK_GROUP(CCK_GROUP_SHIFT)
- 
-@@ -349,15 +345,19 @@ int
- minstrel_ht_get_tp_avg(struct minstrel_ht_sta *mi, int group, int rate,
- 		       int prob_avg)
- {
--	unsigned int nsecs = 0;
-+	unsigned int nsecs = 0, overhead = mi->overhead;
-+	unsigned int ampdu_len = 1;
- 
- 	/* do not account throughput if sucess prob is below 10% */
- 	if (prob_avg < MINSTREL_FRAC(10, 100))
- 		return 0;
- 
--	if (group != MINSTREL_CCK_GROUP)
--		nsecs = 1000 * mi->overhead / minstrel_ht_avg_ampdu_len(mi);
-+	if (group == MINSTREL_CCK_GROUP)
-+		overhead = mi->overhead_legacy;
-+	else
-+		ampdu_len = minstrel_ht_avg_ampdu_len(mi);
- 
-+	nsecs = 1000 * overhead / ampdu_len;
- 	nsecs += minstrel_mcs_groups[group].duration[rate] <<
- 		 minstrel_mcs_groups[group].shift;
- 
-@@ -1031,7 +1031,10 @@ minstrel_calc_retransmit(struct minstrel
- 	ctime += (t_slot * cw) >> 1;
- 	cw = min((cw << 1) | 1, mp->cw_max);
- 
--	if (index / MCS_GROUP_RATES != MINSTREL_CCK_GROUP) {
-+	if (index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
-+		overhead = mi->overhead_legacy;
-+		overhead_rtscts = mi->overhead_legacy_rtscts;
-+	} else {
- 		overhead = mi->overhead;
- 		overhead_rtscts = mi->overhead_rtscts;
- 	}
-@@ -1369,18 +1372,14 @@ minstrel_ht_update_cck(struct minstrel_p
- 	if (!ieee80211_hw_check(mp->hw, SUPPORTS_HT_CCK_RATES))
- 		return;
- 
--	mi->cck_supported = 0;
--	mi->cck_supported_short = 0;
- 	for (i = 0; i < 4; i++) {
- 		if (!rate_supported(sta, sband->band, mp->cck_rates[i]))
- 			continue;
- 
--		mi->cck_supported |= BIT(i);
-+		mi->supported[MINSTREL_CCK_GROUP] |= BIT(i);
- 		if (sband->bitrates[i].flags & IEEE80211_RATE_SHORT_PREAMBLE)
--			mi->cck_supported_short |= BIT(i);
-+			mi->supported[MINSTREL_CCK_GROUP] |= BIT(i + 4);
- 	}
--
--	mi->supported[MINSTREL_CCK_GROUP] = mi->cck_supported;
- }
- 
- static void
-@@ -1394,12 +1393,13 @@ minstrel_ht_update_caps(void *priv, stru
- 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
- 	u16 ht_cap = sta->ht_cap.cap;
- 	struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
-+	const struct ieee80211_rate *ctl_rate;
-+	bool ldpc, erp;
- 	int use_vht;
- 	int n_supported = 0;
- 	int ack_dur;
- 	int stbc;
- 	int i;
--	bool ldpc;
- 
- 	/* fall back to the old minstrel for legacy stations */
- 	if (!sta->ht_cap.ht_supported)
-@@ -1423,6 +1423,14 @@ minstrel_ht_update_caps(void *priv, stru
- 	mi->overhead += ack_dur;
- 	mi->overhead_rtscts = mi->overhead + 2 * ack_dur;
- 
-+	ctl_rate = &sband->bitrates[rate_lowest_index(sband, sta)];
-+	erp = ctl_rate->flags & IEEE80211_RATE_ERP_G;
-+	ack_dur = ieee80211_frame_duration(sband->band, 10,
-+					   ctl_rate->bitrate, erp, 1,
-+					   ieee80211_chandef_get_shift(chandef));
-+	mi->overhead_legacy = ack_dur;
-+	mi->overhead_legacy_rtscts = mi->overhead_legacy + 2 * ack_dur;
-+
- 	mi->avg_ampdu_len = MINSTREL_FRAC(1, 1);
- 
- 	/* When using MRR, sample more on the first attempt, without delay */
-@@ -1523,8 +1531,6 @@ minstrel_ht_update_caps(void *priv, stru
- 	if (!n_supported)
- 		goto use_legacy;
- 
--	mi->supported[MINSTREL_CCK_GROUP] |= mi->cck_supported_short << 4;
--
- 	/* create an initial rate table with the lowest supported rates */
- 	minstrel_ht_update_stats(mp, mi, true);
- 	minstrel_ht_update_rates(mp, mi);
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -77,6 +77,8 @@ struct minstrel_ht_sta {
- 	/* overhead time in usec for each frame */
- 	unsigned int overhead;
- 	unsigned int overhead_rtscts;
-+	unsigned int overhead_legacy;
-+	unsigned int overhead_legacy_rtscts;
- 
- 	unsigned int total_packets_last;
- 	unsigned int total_packets_cur;
-@@ -97,9 +99,6 @@ struct minstrel_ht_sta {
- 	/* current MCS group to be sampled */
- 	u8 sample_group;
- 
--	u8 cck_supported;
--	u8 cck_supported_short;
--
- 	/* Bitfield of supported MCS rates of all groups */
- 	u16 supported[MINSTREL_GROUPS_NB];
- 
diff --git a/package/kernel/mac80211/patches/subsys/338-mac80211-minstrel_ht-add-support-for-OFDM-rates-on-n.patch b/package/kernel/mac80211/patches/subsys/338-mac80211-minstrel_ht-add-support-for-OFDM-rates-on-n.patch
deleted file mode 100644
index abefde7109..0000000000
--- a/package/kernel/mac80211/patches/subsys/338-mac80211-minstrel_ht-add-support-for-OFDM-rates-on-n.patch
+++ /dev/null
@@ -1,762 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 26 Dec 2020 13:56:42 +0100
-Subject: [PATCH] mac80211: minstrel_ht: add support for OFDM rates on
- non-HT clients
-
-The legacy minstrel code is essentially unmaintained and receives only very
-little testing. In order to bring the significant algorithm improvements from
-minstrel_ht to legacy clients, this patch adds support for OFDM rates to
-minstrel_ht and removes the fallback to the legacy codepath.
-This also makes it work much better on hardware with rate selection constraints,
-e.g. mt76.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel.h
-+++ b/net/mac80211/rc80211_minstrel.h
-@@ -152,6 +152,7 @@ struct minstrel_priv {
- 	unsigned int lookaround_rate_mrr;
- 
- 	u8 cck_rates[4];
-+	u8 ofdm_rates[NUM_NL80211_BANDS][8];
- 
- #ifdef CPTCFG_MAC80211_DEBUGFS
- 	/*
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -163,6 +163,38 @@
- 
- #define CCK_GROUP __CCK_GROUP(CCK_GROUP_SHIFT)
- 
-+#define OFDM_DURATION(_bitrate)				\
-+	(1000 * (16 /* SIFS + signal ext */ +		\
-+	 16 /* T_PREAMBLE */ +				\
-+	 4 /* T_SIGNAL */ +				\
-+	 4 * (((16 + 80 * (AVG_PKT_SIZE + 4) + 6) /	\
-+	      ((_bitrate) * 4)))))
-+
-+#define OFDM_DURATION_LIST(_s)				\
-+	OFDM_DURATION(60) >> _s,			\
-+	OFDM_DURATION(90) >> _s,			\
-+	OFDM_DURATION(120) >> _s,			\
-+	OFDM_DURATION(180) >> _s,			\
-+	OFDM_DURATION(240) >> _s,			\
-+	OFDM_DURATION(360) >> _s,			\
-+	OFDM_DURATION(480) >> _s,			\
-+	OFDM_DURATION(540) >> _s
-+
-+#define __OFDM_GROUP(_s)				\
-+	[MINSTREL_OFDM_GROUP] = {			\
-+		.streams = 1,				\
-+		.flags = 0,				\
-+		.shift = _s,				\
-+		.duration = {				\
-+			OFDM_DURATION_LIST(_s),		\
-+		}					\
-+	}
-+
-+#define OFDM_GROUP_SHIFT				\
-+	GROUP_SHIFT(OFDM_DURATION(60))
-+
-+#define OFDM_GROUP __OFDM_GROUP(OFDM_GROUP_SHIFT)
-+
- 
- static bool minstrel_vht_only = true;
- module_param(minstrel_vht_only, bool, 0644);
-@@ -199,6 +231,7 @@ const struct mcs_group minstrel_mcs_grou
- 	MCS_GROUP(4, 1, BW_40),
- 
- 	CCK_GROUP,
-+	OFDM_GROUP,
- 
- 	VHT_GROUP(1, 0, BW_20),
- 	VHT_GROUP(2, 0, BW_20),
-@@ -231,6 +264,8 @@ const struct mcs_group minstrel_mcs_grou
- 	VHT_GROUP(4, 1, BW_80),
- };
- 
-+const s16 minstrel_cck_bitrates[4] = { 10, 20, 55, 110 };
-+const s16 minstrel_ofdm_bitrates[8] = { 60, 90, 120, 180, 240, 360, 480, 540 };
- static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES] __read_mostly;
- 
- static void
-@@ -275,6 +310,13 @@ minstrel_get_valid_vht_rates(int bw, int
- 	return 0x3ff & ~mask;
- }
- 
-+static bool
-+minstrel_ht_is_legacy_group(int group)
-+{
-+	return group == MINSTREL_CCK_GROUP ||
-+	       group == MINSTREL_OFDM_GROUP;
-+}
-+
- /*
-  * Look up an MCS group index based on mac80211 rate information
-  */
-@@ -304,21 +346,34 @@ minstrel_ht_get_stats(struct minstrel_pr
- 	if (rate->flags & IEEE80211_TX_RC_MCS) {
- 		group = minstrel_ht_get_group_idx(rate);
- 		idx = rate->idx % 8;
--	} else if (rate->flags & IEEE80211_TX_RC_VHT_MCS) {
-+		goto out;
-+	}
-+
-+	if (rate->flags & IEEE80211_TX_RC_VHT_MCS) {
- 		group = minstrel_vht_get_group_idx(rate);
- 		idx = ieee80211_rate_get_vht_mcs(rate);
--	} else {
--		group = MINSTREL_CCK_GROUP;
-+		goto out;
-+	}
- 
--		for (idx = 0; idx < ARRAY_SIZE(mp->cck_rates); idx++)
--			if (rate->idx == mp->cck_rates[idx])
--				break;
-+	group = MINSTREL_CCK_GROUP;
-+	for (idx = 0; idx < ARRAY_SIZE(mp->cck_rates); idx++) {
-+		if (rate->idx != mp->cck_rates[idx])
-+			continue;
- 
- 		/* short preamble */
- 		if ((mi->supported[group] & BIT(idx + 4)) &&
- 		    (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
--			idx += 4;
-+				idx += 4;
-+		goto out;
- 	}
-+
-+	group = MINSTREL_OFDM_GROUP;
-+	for (idx = 0; idx < ARRAY_SIZE(mp->ofdm_rates[0]); idx++)
-+		if (rate->idx == mp->ofdm_rates[mi->band][idx])
-+			goto out;
-+
-+	idx = 0;
-+out:
- 	return &mi->groups[group].rates[idx];
- }
- 
-@@ -352,7 +407,7 @@ minstrel_ht_get_tp_avg(struct minstrel_h
- 	if (prob_avg < MINSTREL_FRAC(10, 100))
- 		return 0;
- 
--	if (group == MINSTREL_CCK_GROUP)
-+	if (minstrel_ht_is_legacy_group(group))
- 		overhead = mi->overhead_legacy;
- 	else
- 		ampdu_len = minstrel_ht_avg_ampdu_len(mi);
-@@ -439,8 +494,8 @@ minstrel_ht_set_best_prob_rate(struct mi
- 	/* if max_tp_rate[0] is from MCS_GROUP max_prob_rate get selected from
- 	 * MCS_GROUP as well as CCK_GROUP rates do not allow aggregation */
- 	max_tp_group = mi->max_tp_rate[0] / MCS_GROUP_RATES;
--	if((index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) &&
--	    (max_tp_group != MINSTREL_CCK_GROUP))
-+	if (minstrel_ht_is_legacy_group(index / MCS_GROUP_RATES) &&
-+	    !minstrel_ht_is_legacy_group(max_tp_group))
- 		return;
- 
- 	max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
-@@ -476,13 +531,13 @@ minstrel_ht_set_best_prob_rate(struct mi
- static void
- minstrel_ht_assign_best_tp_rates(struct minstrel_ht_sta *mi,
- 				 u16 tmp_mcs_tp_rate[MAX_THR_RATES],
--				 u16 tmp_cck_tp_rate[MAX_THR_RATES])
-+				 u16 tmp_legacy_tp_rate[MAX_THR_RATES])
- {
- 	unsigned int tmp_group, tmp_idx, tmp_cck_tp, tmp_mcs_tp, tmp_prob;
- 	int i;
- 
--	tmp_group = tmp_cck_tp_rate[0] / MCS_GROUP_RATES;
--	tmp_idx = tmp_cck_tp_rate[0] % MCS_GROUP_RATES;
-+	tmp_group = tmp_legacy_tp_rate[0] / MCS_GROUP_RATES;
-+	tmp_idx = tmp_legacy_tp_rate[0] % MCS_GROUP_RATES;
- 	tmp_prob = mi->groups[tmp_group].rates[tmp_idx].prob_avg;
- 	tmp_cck_tp = minstrel_ht_get_tp_avg(mi, tmp_group, tmp_idx, tmp_prob);
- 
-@@ -493,7 +548,7 @@ minstrel_ht_assign_best_tp_rates(struct
- 
- 	if (tmp_cck_tp > tmp_mcs_tp) {
- 		for(i = 0; i < MAX_THR_RATES; i++) {
--			minstrel_ht_sort_best_tp_rates(mi, tmp_cck_tp_rate[i],
-+			minstrel_ht_sort_best_tp_rates(mi, tmp_legacy_tp_rate[i],
- 						       tmp_mcs_tp_rate);
- 		}
- 	}
-@@ -511,6 +566,9 @@ minstrel_ht_prob_rate_reduce_streams(str
- 	int tmp_max_streams, group, tmp_idx, tmp_prob;
- 	int tmp_tp = 0;
- 
-+	if (!mi->sta->ht_cap.ht_supported)
-+		return;
-+
- 	tmp_max_streams = minstrel_mcs_groups[mi->max_tp_rate[0] /
- 			  MCS_GROUP_RATES].streams;
- 	for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
-@@ -675,7 +733,8 @@ minstrel_ht_update_stats(struct minstrel
- 	struct minstrel_rate_stats *mrs;
- 	int group, i, j, cur_prob;
- 	u16 tmp_mcs_tp_rate[MAX_THR_RATES], tmp_group_tp_rate[MAX_THR_RATES];
--	u16 tmp_cck_tp_rate[MAX_THR_RATES], index;
-+	u16 tmp_legacy_tp_rate[MAX_THR_RATES], index;
-+	bool ht_supported = mi->sta->ht_cap.ht_supported;
- 
- 	mi->sample_mode = MINSTREL_SAMPLE_IDLE;
- 
-@@ -704,21 +763,29 @@ minstrel_ht_update_stats(struct minstrel
- 	mi->sample_count = 0;
- 
- 	memset(tmp_mcs_tp_rate, 0, sizeof(tmp_mcs_tp_rate));
--	memset(tmp_cck_tp_rate, 0, sizeof(tmp_cck_tp_rate));
-+	memset(tmp_legacy_tp_rate, 0, sizeof(tmp_legacy_tp_rate));
- 	if (mi->supported[MINSTREL_CCK_GROUP])
--		for (j = 0; j < ARRAY_SIZE(tmp_cck_tp_rate); j++)
--			tmp_cck_tp_rate[j] = MINSTREL_CCK_GROUP * MCS_GROUP_RATES;
-+		for (j = 0; j < ARRAY_SIZE(tmp_legacy_tp_rate); j++)
-+			tmp_legacy_tp_rate[j] = MINSTREL_CCK_GROUP * MCS_GROUP_RATES;
-+	else if (mi->supported[MINSTREL_OFDM_GROUP])
-+		for (j = 0; j < ARRAY_SIZE(tmp_legacy_tp_rate); j++)
-+			tmp_legacy_tp_rate[j] = MINSTREL_OFDM_GROUP * MCS_GROUP_RATES;
- 
- 	if (mi->supported[MINSTREL_VHT_GROUP_0])
- 		index = MINSTREL_VHT_GROUP_0 * MCS_GROUP_RATES;
--	else
-+	else if (ht_supported)
- 		index = MINSTREL_HT_GROUP_0 * MCS_GROUP_RATES;
-+	else if (mi->supported[MINSTREL_CCK_GROUP])
-+		index = MINSTREL_CCK_GROUP * MCS_GROUP_RATES;
-+	else
-+		index = MINSTREL_OFDM_GROUP * MCS_GROUP_RATES;
- 
- 	for (j = 0; j < ARRAY_SIZE(tmp_mcs_tp_rate); j++)
- 		tmp_mcs_tp_rate[j] = index;
- 
- 	/* Find best rate sets within all MCS groups*/
- 	for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
-+		u16 *tp_rate = tmp_mcs_tp_rate;
- 
- 		mg = &mi->groups[group];
- 		if (!mi->supported[group])
-@@ -730,6 +797,9 @@ minstrel_ht_update_stats(struct minstrel
- 		for(j = 0; j < MAX_THR_RATES; j++)
- 			tmp_group_tp_rate[j] = MCS_GROUP_RATES * group;
- 
-+		if (group == MINSTREL_CCK_GROUP && ht_supported)
-+			tp_rate = tmp_legacy_tp_rate;
-+
- 		for (i = 0; i < MCS_GROUP_RATES; i++) {
- 			if (!(mi->supported[group] & BIT(i)))
- 				continue;
-@@ -745,13 +815,7 @@ minstrel_ht_update_stats(struct minstrel
- 				continue;
- 
- 			/* Find max throughput rate set */
--			if (group != MINSTREL_CCK_GROUP) {
--				minstrel_ht_sort_best_tp_rates(mi, index,
--							       tmp_mcs_tp_rate);
--			} else if (group == MINSTREL_CCK_GROUP) {
--				minstrel_ht_sort_best_tp_rates(mi, index,
--							       tmp_cck_tp_rate);
--			}
-+			minstrel_ht_sort_best_tp_rates(mi, index, tp_rate);
- 
- 			/* Find max throughput rate set within a group */
- 			minstrel_ht_sort_best_tp_rates(mi, index,
-@@ -766,7 +830,8 @@ minstrel_ht_update_stats(struct minstrel
- 	}
- 
- 	/* Assign new rate set per sta */
--	minstrel_ht_assign_best_tp_rates(mi, tmp_mcs_tp_rate, tmp_cck_tp_rate);
-+	minstrel_ht_assign_best_tp_rates(mi, tmp_mcs_tp_rate,
-+					 tmp_legacy_tp_rate);
- 	memcpy(mi->max_tp_rate, tmp_mcs_tp_rate, sizeof(mi->max_tp_rate));
- 
- 	/* Try to increase robustness of max_prob_rate*/
-@@ -795,8 +860,11 @@ minstrel_ht_update_stats(struct minstrel
- }
- 
- static bool
--minstrel_ht_txstat_valid(struct minstrel_priv *mp, struct ieee80211_tx_rate *rate)
-+minstrel_ht_txstat_valid(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
-+			 struct ieee80211_tx_rate *rate)
- {
-+	int i;
-+
- 	if (rate->idx < 0)
- 		return false;
- 
-@@ -807,10 +875,15 @@ minstrel_ht_txstat_valid(struct minstrel
- 	    rate->flags & IEEE80211_TX_RC_VHT_MCS)
- 		return true;
- 
--	return rate->idx == mp->cck_rates[0] ||
--	       rate->idx == mp->cck_rates[1] ||
--	       rate->idx == mp->cck_rates[2] ||
--	       rate->idx == mp->cck_rates[3];
-+	for (i = 0; i < ARRAY_SIZE(mp->cck_rates); i++)
-+		if (rate->idx == mp->cck_rates[i])
-+			return true;
-+
-+	for (i = 0; i < ARRAY_SIZE(mp->ofdm_rates[0]); i++)
-+		if (rate->idx == mp->ofdm_rates[mi->band][i])
-+			return true;
-+
-+	return false;
- }
- 
- static void
-@@ -897,11 +970,6 @@ minstrel_ht_tx_status(void *priv, struct
- 	bool sample_status = false;
- 	int i;
- 
--	if (!msp->is_ht)
--		return mac80211_minstrel.tx_status_ext(priv, sband,
--						       &msp->legacy, st);
--
--
- 	/* This packet was aggregated but doesn't carry status info */
- 	if ((info->flags & IEEE80211_TX_CTL_AMPDU) &&
- 	    !(info->flags & IEEE80211_TX_STAT_AMPDU))
-@@ -930,10 +998,10 @@ minstrel_ht_tx_status(void *priv, struct
- 	if (mi->sample_mode != MINSTREL_SAMPLE_IDLE)
- 		rate_sample = minstrel_get_ratestats(mi, mi->sample_rate);
- 
--	last = !minstrel_ht_txstat_valid(mp, &ar[0]);
-+	last = !minstrel_ht_txstat_valid(mp, mi, &ar[0]);
- 	for (i = 0; !last; i++) {
- 		last = (i == IEEE80211_TX_MAX_RATES - 1) ||
--		       !minstrel_ht_txstat_valid(mp, &ar[i + 1]);
-+		       !minstrel_ht_txstat_valid(mp, mi, &ar[i + 1]);
- 
- 		rate = minstrel_ht_get_stats(mp, mi, &ar[i]);
- 		if (rate == rate_sample)
-@@ -1031,7 +1099,7 @@ minstrel_calc_retransmit(struct minstrel
- 	ctime += (t_slot * cw) >> 1;
- 	cw = min((cw << 1) | 1, mp->cw_max);
- 
--	if (index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
-+	if (minstrel_ht_is_legacy_group(index / MCS_GROUP_RATES)) {
- 		overhead = mi->overhead_legacy;
- 		overhead_rtscts = mi->overhead_legacy_rtscts;
- 	} else {
-@@ -1064,7 +1132,8 @@ static void
- minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
-                      struct ieee80211_sta_rates *ratetbl, int offset, int index)
- {
--	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
-+	int group_idx = index / MCS_GROUP_RATES;
-+	const struct mcs_group *group = &minstrel_mcs_groups[group_idx];
- 	struct minstrel_rate_stats *mrs;
- 	u8 idx;
- 	u16 flags = group->flags;
-@@ -1083,13 +1152,17 @@ minstrel_ht_set_rate(struct minstrel_pri
- 		ratetbl->rate[offset].count_rts = mrs->retry_count_rtscts;
- 	}
- 
--	if (index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP)
-+	index %= MCS_GROUP_RATES;
-+	if (group_idx == MINSTREL_CCK_GROUP)
- 		idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
-+	else if (group_idx == MINSTREL_OFDM_GROUP)
-+		idx = mp->ofdm_rates[mi->band][index %
-+					       ARRAY_SIZE(mp->ofdm_rates[0])];
- 	else if (flags & IEEE80211_TX_RC_VHT_MCS)
- 		idx = ((group->streams - 1) << 4) |
--		      ((index % MCS_GROUP_RATES) & 0xF);
-+		      (index & 0xF);
- 	else
--		idx = index % MCS_GROUP_RATES + (group->streams - 1) * 8;
-+		idx = index + (group->streams - 1) * 8;
- 
- 	/* enable RTS/CTS if needed:
- 	 *  - if station is in dynamic SMPS (and streams > 1)
-@@ -1304,11 +1377,8 @@ minstrel_ht_get_rate(void *priv, struct
- 	struct minstrel_priv *mp = priv;
- 	int sample_idx;
- 
--	if (!msp->is_ht)
--		return mac80211_minstrel.get_rate(priv, sta, &msp->legacy, txrc);
--
- 	if (!(info->flags & IEEE80211_TX_CTL_AMPDU) &&
--	    mi->max_prob_rate / MCS_GROUP_RATES != MINSTREL_CCK_GROUP)
-+	    !minstrel_ht_is_legacy_group(mi->max_prob_rate / MCS_GROUP_RATES))
- 		minstrel_aggr_check(sta, txrc->skb);
- 
- 	info->flags |= mi->tx_flags;
-@@ -1349,6 +1419,9 @@ minstrel_ht_get_rate(void *priv, struct
- 	if (sample_group == &minstrel_mcs_groups[MINSTREL_CCK_GROUP]) {
- 		int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
- 		rate->idx = mp->cck_rates[idx];
-+	} else if (sample_group == &minstrel_mcs_groups[MINSTREL_OFDM_GROUP]) {
-+		int idx = sample_idx % ARRAY_SIZE(mp->ofdm_rates[0]);
-+		rate->idx = mp->ofdm_rates[mi->band][idx];
- 	} else if (sample_group->flags & IEEE80211_TX_RC_VHT_MCS) {
- 		ieee80211_rate_set_vht(rate, sample_idx % MCS_GROUP_RATES,
- 				       sample_group->streams);
-@@ -1369,11 +1442,13 @@ minstrel_ht_update_cck(struct minstrel_p
- 	if (sband->band != NL80211_BAND_2GHZ)
- 		return;
- 
--	if (!ieee80211_hw_check(mp->hw, SUPPORTS_HT_CCK_RATES))
-+	if (sta->ht_cap.ht_supported &&
-+	    !ieee80211_hw_check(mp->hw, SUPPORTS_HT_CCK_RATES))
- 		return;
- 
- 	for (i = 0; i < 4; i++) {
--		if (!rate_supported(sta, sband->band, mp->cck_rates[i]))
-+		if (mp->cck_rates[i] == 0xff ||
-+		    !rate_supported(sta, sband->band, mp->cck_rates[i]))
- 			continue;
- 
- 		mi->supported[MINSTREL_CCK_GROUP] |= BIT(i);
-@@ -1383,9 +1458,30 @@ minstrel_ht_update_cck(struct minstrel_p
- }
- 
- static void
-+minstrel_ht_update_ofdm(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
-+			struct ieee80211_supported_band *sband,
-+			struct ieee80211_sta *sta)
-+{
-+	const u8 *rates;
-+	int i;
-+
-+	if (sta->ht_cap.ht_supported)
-+		return;
-+
-+	rates = mp->ofdm_rates[sband->band];
-+	for (i = 0; i < ARRAY_SIZE(mp->ofdm_rates[0]); i++) {
-+		if (rates[i] == 0xff ||
-+		    !rate_supported(sta, sband->band, rates[i]))
-+			continue;
-+
-+		mi->supported[MINSTREL_OFDM_GROUP] |= BIT(i);
-+	}
-+}
-+
-+static void
- minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
- 			struct cfg80211_chan_def *chandef,
--                        struct ieee80211_sta *sta, void *priv_sta)
-+			struct ieee80211_sta *sta, void *priv_sta)
- {
- 	struct minstrel_priv *mp = priv;
- 	struct minstrel_ht_sta_priv *msp = priv_sta;
-@@ -1401,10 +1497,6 @@ minstrel_ht_update_caps(void *priv, stru
- 	int stbc;
- 	int i;
- 
--	/* fall back to the old minstrel for legacy stations */
--	if (!sta->ht_cap.ht_supported)
--		goto use_legacy;
--
- 	BUILD_BUG_ON(ARRAY_SIZE(minstrel_mcs_groups) != MINSTREL_GROUPS_NB);
- 
- 	if (vht_cap->vht_supported)
-@@ -1412,10 +1504,10 @@ minstrel_ht_update_caps(void *priv, stru
- 	else
- 		use_vht = 0;
- 
--	msp->is_ht = true;
- 	memset(mi, 0, sizeof(*mi));
- 
- 	mi->sta = sta;
-+	mi->band = sband->band;
- 	mi->last_stats_update = jiffies;
- 
- 	ack_dur = ieee80211_frame_duration(sband->band, 10, 60, 1, 1, 0);
-@@ -1464,10 +1556,8 @@ minstrel_ht_update_caps(void *priv, stru
- 		int bw, nss;
- 
- 		mi->supported[i] = 0;
--		if (i == MINSTREL_CCK_GROUP) {
--			minstrel_ht_update_cck(mp, mi, sband, sta);
-+		if (minstrel_ht_is_legacy_group(i))
- 			continue;
--		}
- 
- 		if (gflags & IEEE80211_TX_RC_SHORT_GI) {
- 			if (gflags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
-@@ -1528,22 +1618,12 @@ minstrel_ht_update_caps(void *priv, stru
- 			n_supported++;
- 	}
- 
--	if (!n_supported)
--		goto use_legacy;
-+	minstrel_ht_update_cck(mp, mi, sband, sta);
-+	minstrel_ht_update_ofdm(mp, mi, sband, sta);
- 
- 	/* create an initial rate table with the lowest supported rates */
- 	minstrel_ht_update_stats(mp, mi, true);
- 	minstrel_ht_update_rates(mp, mi);
--
--	return;
--
--use_legacy:
--	msp->is_ht = false;
--	memset(&msp->legacy, 0, sizeof(msp->legacy));
--	msp->legacy.r = msp->ratelist;
--	msp->legacy.sample_table = msp->sample_table;
--	return mac80211_minstrel.rate_init(priv, sband, chandef, sta,
--					   &msp->legacy);
- }
- 
- static void
-@@ -1611,40 +1691,70 @@ minstrel_ht_free_sta(void *priv, struct
- }
- 
- static void
--minstrel_ht_init_cck_rates(struct minstrel_priv *mp)
-+minstrel_ht_fill_rate_array(u8 *dest, struct ieee80211_supported_band *sband,
-+			    const s16 *bitrates, int n_rates, u32 rate_flags)
- {
--	static const int bitrates[4] = { 10, 20, 55, 110 };
--	struct ieee80211_supported_band *sband;
--	u32 rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
- 	int i, j;
- 
--	sband = mp->hw->wiphy->bands[NL80211_BAND_2GHZ];
--	if (!sband)
--		return;
--
- 	for (i = 0; i < sband->n_bitrates; i++) {
- 		struct ieee80211_rate *rate = &sband->bitrates[i];
- 
--		if (rate->flags & IEEE80211_RATE_ERP_G)
--			continue;
--
- 		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
- 			continue;
- 
--		for (j = 0; j < ARRAY_SIZE(bitrates); j++) {
-+		for (j = 0; j < n_rates; j++) {
- 			if (rate->bitrate != bitrates[j])
- 				continue;
- 
--			mp->cck_rates[j] = i;
-+			dest[j] = i;
- 			break;
- 		}
- 	}
- }
- 
-+static void
-+minstrel_ht_init_cck_rates(struct minstrel_priv *mp)
-+{
-+	static const s16 bitrates[4] = { 10, 20, 55, 110 };
-+	struct ieee80211_supported_band *sband;
-+	u32 rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
-+
-+	memset(mp->cck_rates, 0xff, sizeof(mp->cck_rates));
-+	sband = mp->hw->wiphy->bands[NL80211_BAND_2GHZ];
-+	if (!sband)
-+		return;
-+
-+	BUILD_BUG_ON(ARRAY_SIZE(mp->cck_rates) != ARRAY_SIZE(bitrates));
-+	minstrel_ht_fill_rate_array(mp->cck_rates, sband,
-+				    minstrel_cck_bitrates,
-+				    ARRAY_SIZE(minstrel_cck_bitrates),
-+				    rate_flags);
-+}
-+
-+static void
-+minstrel_ht_init_ofdm_rates(struct minstrel_priv *mp, enum nl80211_band band)
-+{
-+	static const s16 bitrates[8] = { 60, 90, 120, 180, 240, 360, 480, 540 };
-+	struct ieee80211_supported_band *sband;
-+	u32 rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
-+
-+	memset(mp->ofdm_rates[band], 0xff, sizeof(mp->ofdm_rates[band]));
-+	sband = mp->hw->wiphy->bands[band];
-+	if (!sband)
-+		return;
-+
-+	BUILD_BUG_ON(ARRAY_SIZE(mp->ofdm_rates[band]) != ARRAY_SIZE(bitrates));
-+	minstrel_ht_fill_rate_array(mp->ofdm_rates[band], sband,
-+				    minstrel_ofdm_bitrates,
-+				    ARRAY_SIZE(minstrel_ofdm_bitrates),
-+				    rate_flags);
-+}
-+
- static void *
- minstrel_ht_alloc(struct ieee80211_hw *hw)
- {
- 	struct minstrel_priv *mp;
-+	int i;
- 
- 	mp = kzalloc(sizeof(struct minstrel_priv), GFP_ATOMIC);
- 	if (!mp)
-@@ -1681,6 +1791,8 @@ minstrel_ht_alloc(struct ieee80211_hw *h
- 	mp->new_avg = true;
- 
- 	minstrel_ht_init_cck_rates(mp);
-+	for (i = 0; i < ARRAY_SIZE(mp->hw->wiphy->bands); i++)
-+	    minstrel_ht_init_ofdm_rates(mp, i);
- 
- 	return mp;
- }
-@@ -1713,9 +1825,6 @@ static u32 minstrel_ht_get_expected_thro
- 	struct minstrel_ht_sta *mi = &msp->ht;
- 	int i, j, prob, tp_avg;
- 
--	if (!msp->is_ht)
--		return mac80211_minstrel.get_expected_throughput(priv_sta);
--
- 	i = mi->max_tp_rate[0] / MCS_GROUP_RATES;
- 	j = mi->max_tp_rate[0] % MCS_GROUP_RATES;
- 	prob = mi->groups[i].rates[j].prob_avg;
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -18,14 +18,15 @@
- 				 MINSTREL_HT_STREAM_GROUPS)
- #define MINSTREL_VHT_GROUPS_NB	(MINSTREL_MAX_STREAMS *		\
- 				 MINSTREL_VHT_STREAM_GROUPS)
--#define MINSTREL_CCK_GROUPS_NB	1
-+#define MINSTREL_LEGACY_GROUPS_NB	2
- #define MINSTREL_GROUPS_NB	(MINSTREL_HT_GROUPS_NB +	\
- 				 MINSTREL_VHT_GROUPS_NB +	\
--				 MINSTREL_CCK_GROUPS_NB)
-+				 MINSTREL_LEGACY_GROUPS_NB)
- 
- #define MINSTREL_HT_GROUP_0	0
- #define MINSTREL_CCK_GROUP	(MINSTREL_HT_GROUP_0 + MINSTREL_HT_GROUPS_NB)
--#define MINSTREL_VHT_GROUP_0	(MINSTREL_CCK_GROUP + 1)
-+#define MINSTREL_OFDM_GROUP	(MINSTREL_CCK_GROUP + 1)
-+#define MINSTREL_VHT_GROUP_0	(MINSTREL_OFDM_GROUP + 1)
- 
- #define MCS_GROUP_RATES		10
- 
-@@ -37,6 +38,8 @@ struct mcs_group {
- 	u16 duration[MCS_GROUP_RATES];
- };
- 
-+extern const s16 minstrel_cck_bitrates[4];
-+extern const s16 minstrel_ofdm_bitrates[8];
- extern const struct mcs_group minstrel_mcs_groups[];
- 
- struct minstrel_mcs_group_data {
-@@ -99,6 +102,8 @@ struct minstrel_ht_sta {
- 	/* current MCS group to be sampled */
- 	u8 sample_group;
- 
-+	u8 band;
-+
- 	/* Bitfield of supported MCS rates of all groups */
- 	u16 supported[MINSTREL_GROUPS_NB];
- 
-@@ -107,13 +112,9 @@ struct minstrel_ht_sta {
- };
- 
- struct minstrel_ht_sta_priv {
--	union {
--		struct minstrel_ht_sta ht;
--		struct minstrel_sta_info legacy;
--	};
-+	struct minstrel_ht_sta ht;
- 	void *ratelist;
- 	void *sample_table;
--	bool is_ht;
- };
- 
- void minstrel_ht_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir);
---- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
-+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
-@@ -52,7 +52,6 @@ minstrel_ht_stats_dump(struct minstrel_h
- 
- 	for (j = 0; j < MCS_GROUP_RATES; j++) {
- 		struct minstrel_rate_stats *mrs = &mi->groups[i].rates[j];
--		static const int bitrates[4] = { 10, 20, 55, 110 };
- 		int idx = i * MCS_GROUP_RATES + j;
- 		unsigned int duration;
- 
-@@ -67,6 +66,9 @@ minstrel_ht_stats_dump(struct minstrel_h
- 			p += sprintf(p, "VHT%c0 ", htmode);
- 			p += sprintf(p, "%cGI ", gimode);
- 			p += sprintf(p, "%d  ", mg->streams);
-+		} else if (i == MINSTREL_OFDM_GROUP) {
-+			p += sprintf(p, "OFDM       ");
-+			p += sprintf(p, "1 ");
- 		} else {
- 			p += sprintf(p, "CCK    ");
- 			p += sprintf(p, "%cP  ", j < 4 ? 'L' : 'S');
-@@ -84,7 +86,12 @@ minstrel_ht_stats_dump(struct minstrel_h
- 		} else if (gflags & IEEE80211_TX_RC_VHT_MCS) {
- 			p += sprintf(p, "  MCS%-1u/%1u", j, mg->streams);
- 		} else {
--			int r = bitrates[j % 4];
-+			int r;
-+
-+			if (i == MINSTREL_OFDM_GROUP)
-+				r = minstrel_ofdm_bitrates[j % 8];
-+			else
-+				r = minstrel_cck_bitrates[j % 4];
- 
- 			p += sprintf(p, "   %2u.%1uM", r / 10, r % 10);
- 		}
-@@ -124,16 +131,8 @@ minstrel_ht_stats_open(struct inode *ino
- 	struct minstrel_ht_sta *mi = &msp->ht;
- 	struct minstrel_debugfs_info *ms;
- 	unsigned int i;
--	int ret;
- 	char *p;
- 
--	if (!msp->is_ht) {
--		inode->i_private = &msp->legacy;
--		ret = minstrel_stats_open(inode, file);
--		inode->i_private = msp;
--		return ret;
--	}
--
- 	ms = kmalloc(32768, GFP_KERNEL);
- 	if (!ms)
- 		return -ENOMEM;
-@@ -199,7 +198,6 @@ minstrel_ht_stats_csv_dump(struct minstr
- 
- 	for (j = 0; j < MCS_GROUP_RATES; j++) {
- 		struct minstrel_rate_stats *mrs = &mi->groups[i].rates[j];
--		static const int bitrates[4] = { 10, 20, 55, 110 };
- 		int idx = i * MCS_GROUP_RATES + j;
- 		unsigned int duration;
- 
-@@ -214,6 +212,8 @@ minstrel_ht_stats_csv_dump(struct minstr
- 			p += sprintf(p, "VHT%c0,", htmode);
- 			p += sprintf(p, "%cGI,", gimode);
- 			p += sprintf(p, "%d,", mg->streams);
-+		} else if (i == MINSTREL_OFDM_GROUP) {
-+			p += sprintf(p, "OFDM,,1,");
- 		} else {
- 			p += sprintf(p, "CCK,");
- 			p += sprintf(p, "%cP,", j < 4 ? 'L' : 'S');
-@@ -231,7 +231,13 @@ minstrel_ht_stats_csv_dump(struct minstr
- 		} else if (gflags & IEEE80211_TX_RC_VHT_MCS) {
- 			p += sprintf(p, ",MCS%-1u/%1u,", j, mg->streams);
- 		} else {
--			int r = bitrates[j % 4];
-+			int r;
-+
-+			if (i == MINSTREL_OFDM_GROUP)
-+				r = minstrel_ofdm_bitrates[j % 8];
-+			else
-+				r = minstrel_cck_bitrates[j % 4];
-+
- 			p += sprintf(p, ",%2u.%1uM,", r / 10, r % 10);
- 		}
- 
-@@ -274,18 +280,9 @@ minstrel_ht_stats_csv_open(struct inode
- 	struct minstrel_ht_sta *mi = &msp->ht;
- 	struct minstrel_debugfs_info *ms;
- 	unsigned int i;
--	int ret;
- 	char *p;
- 
--	if (!msp->is_ht) {
--		inode->i_private = &msp->legacy;
--		ret = minstrel_stats_csv_open(inode, file);
--		inode->i_private = msp;
--		return ret;
--	}
--
- 	ms = kmalloc(32768, GFP_KERNEL);
--
- 	if (!ms)
- 		return -ENOMEM;
- 
diff --git a/package/kernel/mac80211/patches/subsys/339-mac80211-exclude-multicast-packets-from-AQL-pending-.patch b/package/kernel/mac80211/patches/subsys/339-mac80211-exclude-multicast-packets-from-AQL-pending-.patch
new file mode 100644
index 0000000000..43c3e75d65
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/339-mac80211-exclude-multicast-packets-from-AQL-pending-.patch
@@ -0,0 +1,30 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 13 Jul 2022 07:32:26 +0200
+Subject: [PATCH] mac80211: exclude multicast packets from AQL pending airtime
+
+In AP mode, multicast traffic is handled very differently from normal traffic,
+especially if at least one client is in powersave mode.
+This means that multicast packets can be buffered a lot longer than normal
+unicast packets, and can eat up the AQL budget very quickly because of the low
+data rate.
+Along with the recent change to maintain a global PHY AQL limit, this can lead
+to significant latency spikes for unicast traffic.
+
+Since queueing multicast to hardware is currently not constrained by AQL limits
+anyway, let's just exclude it from the AQL pending airtime calculation entirely.
+
+Fixes: 8e4bac067105 ("wifi: mac80211: add a per-PHY AQL limit to improve fairness")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3792,7 +3792,7 @@ begin:
+ encap_out:
+ 	IEEE80211_SKB_CB(skb)->control.vif = vif;
+ 
+-	if (vif &&
++	if (tx.sta &&
+ 	    wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL)) {
+ 		bool ampdu = txq->ac != IEEE80211_AC_VO;
+ 		u32 airtime;
diff --git a/package/kernel/mac80211/patches/subsys/339-mac80211-remove-legacy-minstrel-rate-control.patch b/package/kernel/mac80211/patches/subsys/339-mac80211-remove-legacy-minstrel-rate-control.patch
deleted file mode 100644
index 96ee595ac1..0000000000
--- a/package/kernel/mac80211/patches/subsys/339-mac80211-remove-legacy-minstrel-rate-control.patch
+++ /dev/null
@@ -1,1328 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 26 Dec 2020 14:23:47 +0100
-Subject: [PATCH] mac80211: remove legacy minstrel rate control
-
-Now that minstrel_ht supports legacy rates, it is no longer needed
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
- delete mode 100644 net/mac80211/rc80211_minstrel.c
- delete mode 100644 net/mac80211/rc80211_minstrel.h
- delete mode 100644 net/mac80211/rc80211_minstrel_debugfs.c
-
---- a/net/mac80211/Makefile
-+++ b/net/mac80211/Makefile
-@@ -55,11 +55,9 @@ mac80211-$(CONFIG_PM) += pm.o
- CFLAGS_trace.o := -I$(src)
- 
- rc80211_minstrel-y := \
--	rc80211_minstrel.o \
- 	rc80211_minstrel_ht.o
- 
- rc80211_minstrel-$(CPTCFG_MAC80211_DEBUGFS) += \
--	rc80211_minstrel_debugfs.o \
- 	rc80211_minstrel_ht_debugfs.o
- 
- mac80211-$(CPTCFG_MAC80211_RC_MINSTREL) += $(rc80211_minstrel-y)
---- a/net/mac80211/rc80211_minstrel.c
-+++ /dev/null
-@@ -1,574 +0,0 @@
--/*
-- * Copyright (C) 2008 Felix Fietkau <nbd@openwrt.org>
-- *
-- * This program is free software; you can redistribute it and/or modify
-- * it under the terms of the GNU General Public License version 2 as
-- * published by the Free Software Foundation.
-- *
-- * Based on minstrel.c:
-- *   Copyright (C) 2005-2007 Derek Smithies <derek@indranet.co.nz>
-- *   Sponsored by Indranet Technologies Ltd
-- *
-- * Based on sample.c:
-- *   Copyright (c) 2005 John Bicket
-- *   All rights reserved.
-- *
-- *   Redistribution and use in source and binary forms, with or without
-- *   modification, are permitted provided that the following conditions
-- *   are met:
-- *   1. Redistributions of source code must retain the above copyright
-- *      notice, this list of conditions and the following disclaimer,
-- *      without modification.
-- *   2. Redistributions in binary form must reproduce at minimum a disclaimer
-- *      similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
-- *      redistribution must be conditioned upon including a substantially
-- *      similar Disclaimer requirement for further binary redistribution.
-- *   3. Neither the names of the above-listed copyright holders nor the names
-- *      of any contributors may be used to endorse or promote products derived
-- *      from this software without specific prior written permission.
-- *
-- *   Alternatively, this software may be distributed under the terms of the
-- *   GNU General Public License ("GPL") version 2 as published by the Free
-- *   Software Foundation.
-- *
-- *   NO WARRANTY
-- *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-- *   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-- *   LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
-- *   AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
-- *   THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
-- *   OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-- *   SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-- *   INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
-- *   IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-- *   ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
-- *   THE POSSIBILITY OF SUCH DAMAGES.
-- */
--#include <linux/netdevice.h>
--#include <linux/types.h>
--#include <linux/skbuff.h>
--#include <linux/debugfs.h>
--#include <linux/random.h>
--#include <linux/ieee80211.h>
--#include <linux/slab.h>
--#include <net/mac80211.h>
--#include "rate.h"
--#include "rc80211_minstrel.h"
--
--#define SAMPLE_TBL(_mi, _idx, _col) \
--		_mi->sample_table[(_idx * SAMPLE_COLUMNS) + _col]
--
--/* convert mac80211 rate index to local array index */
--static inline int
--rix_to_ndx(struct minstrel_sta_info *mi, int rix)
--{
--	int i = rix;
--	for (i = rix; i >= 0; i--)
--		if (mi->r[i].rix == rix)
--			break;
--	return i;
--}
--
--/* return current EMWA throughput */
--int minstrel_get_tp_avg(struct minstrel_rate *mr, int prob_avg)
--{
--	int usecs;
--
--	usecs = mr->perfect_tx_time;
--	if (!usecs)
--		usecs = 1000000;
--
--	/* reset thr. below 10% success */
--	if (mr->stats.prob_avg < MINSTREL_FRAC(10, 100))
--		return 0;
--
--	if (prob_avg > MINSTREL_FRAC(90, 100))
--		return MINSTREL_TRUNC(100000 * (MINSTREL_FRAC(90, 100) / usecs));
--	else
--		return MINSTREL_TRUNC(100000 * (prob_avg / usecs));
--}
--
--/* find & sort topmost throughput rates */
--static inline void
--minstrel_sort_best_tp_rates(struct minstrel_sta_info *mi, int i, u8 *tp_list)
--{
--	int j;
--	struct minstrel_rate_stats *tmp_mrs;
--	struct minstrel_rate_stats *cur_mrs = &mi->r[i].stats;
--
--	for (j = MAX_THR_RATES; j > 0; --j) {
--		tmp_mrs = &mi->r[tp_list[j - 1]].stats;
--		if (minstrel_get_tp_avg(&mi->r[i], cur_mrs->prob_avg) <=
--		    minstrel_get_tp_avg(&mi->r[tp_list[j - 1]], tmp_mrs->prob_avg))
--			break;
--	}
--
--	if (j < MAX_THR_RATES - 1)
--		memmove(&tp_list[j + 1], &tp_list[j], MAX_THR_RATES - (j + 1));
--	if (j < MAX_THR_RATES)
--		tp_list[j] = i;
--}
--
--static void
--minstrel_set_rate(struct minstrel_sta_info *mi, struct ieee80211_sta_rates *ratetbl,
--		  int offset, int idx)
--{
--	struct minstrel_rate *r = &mi->r[idx];
--
--	ratetbl->rate[offset].idx = r->rix;
--	ratetbl->rate[offset].count = r->adjusted_retry_count;
--	ratetbl->rate[offset].count_cts = r->retry_count_cts;
--	ratetbl->rate[offset].count_rts = r->stats.retry_count_rtscts;
--}
--
--static void
--minstrel_update_rates(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
--{
--	struct ieee80211_sta_rates *ratetbl;
--	int i = 0;
--
--	ratetbl = kzalloc(sizeof(*ratetbl), GFP_ATOMIC);
--	if (!ratetbl)
--		return;
--
--	/* Start with max_tp_rate */
--	minstrel_set_rate(mi, ratetbl, i++, mi->max_tp_rate[0]);
--
--	if (mp->hw->max_rates >= 3) {
--		/* At least 3 tx rates supported, use max_tp_rate2 next */
--		minstrel_set_rate(mi, ratetbl, i++, mi->max_tp_rate[1]);
--	}
--
--	if (mp->hw->max_rates >= 2) {
--		/* At least 2 tx rates supported, use max_prob_rate next */
--		minstrel_set_rate(mi, ratetbl, i++, mi->max_prob_rate);
--	}
--
--	/* Use lowest rate last */
--	ratetbl->rate[i].idx = mi->lowest_rix;
--	ratetbl->rate[i].count = mp->max_retry;
--	ratetbl->rate[i].count_cts = mp->max_retry;
--	ratetbl->rate[i].count_rts = mp->max_retry;
--
--	rate_control_set_rates(mp->hw, mi->sta, ratetbl);
--}
--
--/*
--* Recalculate statistics and counters of a given rate
--*/
--void
--minstrel_calc_rate_stats(struct minstrel_priv *mp,
--			 struct minstrel_rate_stats *mrs)
--{
--	unsigned int cur_prob;
--
--	if (unlikely(mrs->attempts > 0)) {
--		mrs->sample_skipped = 0;
--		cur_prob = MINSTREL_FRAC(mrs->success, mrs->attempts);
--		if (mp->new_avg) {
--			minstrel_filter_avg_add(&mrs->prob_avg,
--						&mrs->prob_avg_1, cur_prob);
--		} else if (unlikely(!mrs->att_hist)) {
--			mrs->prob_avg = cur_prob;
--		} else {
--			/*update exponential weighted moving avarage */
--			mrs->prob_avg = minstrel_ewma(mrs->prob_avg,
--						      cur_prob,
--						      EWMA_LEVEL);
--		}
--		mrs->att_hist += mrs->attempts;
--		mrs->succ_hist += mrs->success;
--	} else {
--		mrs->sample_skipped++;
--	}
--
--	mrs->last_success = mrs->success;
--	mrs->last_attempts = mrs->attempts;
--	mrs->success = 0;
--	mrs->attempts = 0;
--}
--
--static void
--minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
--{
--	u8 tmp_tp_rate[MAX_THR_RATES];
--	u8 tmp_prob_rate = 0;
--	int i, tmp_cur_tp, tmp_prob_tp;
--
--	for (i = 0; i < MAX_THR_RATES; i++)
--	    tmp_tp_rate[i] = 0;
--
--	for (i = 0; i < mi->n_rates; i++) {
--		struct minstrel_rate *mr = &mi->r[i];
--		struct minstrel_rate_stats *mrs = &mi->r[i].stats;
--		struct minstrel_rate_stats *tmp_mrs = &mi->r[tmp_prob_rate].stats;
--
--		/* Update statistics of success probability per rate */
--		minstrel_calc_rate_stats(mp, mrs);
--
--		/* Sample less often below the 10% chance of success.
--		 * Sample less often above the 95% chance of success. */
--		if (mrs->prob_avg > MINSTREL_FRAC(95, 100) ||
--		    mrs->prob_avg < MINSTREL_FRAC(10, 100)) {
--			mr->adjusted_retry_count = mrs->retry_count >> 1;
--			if (mr->adjusted_retry_count > 2)
--				mr->adjusted_retry_count = 2;
--			mr->sample_limit = 4;
--		} else {
--			mr->sample_limit = -1;
--			mr->adjusted_retry_count = mrs->retry_count;
--		}
--		if (!mr->adjusted_retry_count)
--			mr->adjusted_retry_count = 2;
--
--		minstrel_sort_best_tp_rates(mi, i, tmp_tp_rate);
--
--		/* To determine the most robust rate (max_prob_rate) used at
--		 * 3rd mmr stage we distinct between two cases:
--		 * (1) if any success probabilitiy >= 95%, out of those rates
--		 * choose the maximum throughput rate as max_prob_rate
--		 * (2) if all success probabilities < 95%, the rate with
--		 * highest success probability is chosen as max_prob_rate */
--		if (mrs->prob_avg >= MINSTREL_FRAC(95, 100)) {
--			tmp_cur_tp = minstrel_get_tp_avg(mr, mrs->prob_avg);
--			tmp_prob_tp = minstrel_get_tp_avg(&mi->r[tmp_prob_rate],
--							  tmp_mrs->prob_avg);
--			if (tmp_cur_tp >= tmp_prob_tp)
--				tmp_prob_rate = i;
--		} else {
--			if (mrs->prob_avg >= tmp_mrs->prob_avg)
--				tmp_prob_rate = i;
--		}
--	}
--
--	/* Assign the new rate set */
--	memcpy(mi->max_tp_rate, tmp_tp_rate, sizeof(mi->max_tp_rate));
--	mi->max_prob_rate = tmp_prob_rate;
--
--#ifdef CPTCFG_MAC80211_DEBUGFS
--	/* use fixed index if set */
--	if (mp->fixed_rate_idx != -1) {
--		mi->max_tp_rate[0] = mp->fixed_rate_idx;
--		mi->max_tp_rate[1] = mp->fixed_rate_idx;
--		mi->max_prob_rate = mp->fixed_rate_idx;
--	}
--#endif
--
--	/* Reset update timer */
--	mi->last_stats_update = jiffies;
--
--	minstrel_update_rates(mp, mi);
--}
--
--static void
--minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
--		   void *priv_sta, struct ieee80211_tx_status *st)
--{
--	struct ieee80211_tx_info *info = st->info;
--	struct minstrel_priv *mp = priv;
--	struct minstrel_sta_info *mi = priv_sta;
--	struct ieee80211_tx_rate *ar = info->status.rates;
--	int i, ndx;
--	int success;
--
--	success = !!(info->flags & IEEE80211_TX_STAT_ACK);
--
--	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
--		if (ar[i].idx < 0 || !ar[i].count)
--			break;
--
--		ndx = rix_to_ndx(mi, ar[i].idx);
--		if (ndx < 0)
--			continue;
--
--		mi->r[ndx].stats.attempts += ar[i].count;
--
--		if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0))
--			mi->r[ndx].stats.success += success;
--	}
--
--	if (time_after(jiffies, mi->last_stats_update +
--				mp->update_interval / (mp->new_avg ? 2 : 1)))
--		minstrel_update_stats(mp, mi);
--}
--
--
--static inline unsigned int
--minstrel_get_retry_count(struct minstrel_rate *mr,
--			 struct ieee80211_tx_info *info)
--{
--	u8 retry = mr->adjusted_retry_count;
--
--	if (info->control.use_rts)
--		retry = max_t(u8, 2, min(mr->stats.retry_count_rtscts, retry));
--	else if (info->control.use_cts_prot)
--		retry = max_t(u8, 2, min(mr->retry_count_cts, retry));
--	return retry;
--}
--
--
--static int
--minstrel_get_next_sample(struct minstrel_sta_info *mi)
--{
--	unsigned int sample_ndx;
--	sample_ndx = SAMPLE_TBL(mi, mi->sample_row, mi->sample_column);
--	mi->sample_row++;
--	if ((int) mi->sample_row >= mi->n_rates) {
--		mi->sample_row = 0;
--		mi->sample_column++;
--		if (mi->sample_column >= SAMPLE_COLUMNS)
--			mi->sample_column = 0;
--	}
--	return sample_ndx;
--}
--
--static void
--minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
--		  void *priv_sta, struct ieee80211_tx_rate_control *txrc)
--{
--	struct sk_buff *skb = txrc->skb;
--	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
--	struct minstrel_sta_info *mi = priv_sta;
--	struct minstrel_priv *mp = priv;
--	struct ieee80211_tx_rate *rate = &info->control.rates[0];
--	struct minstrel_rate *msr, *mr;
--	unsigned int ndx;
--	bool mrr_capable;
--	bool prev_sample;
--	int delta;
--	int sampling_ratio;
--
--	/* check multi-rate-retry capabilities & adjust lookaround_rate */
--	mrr_capable = mp->has_mrr &&
--		      !txrc->rts &&
--		      !txrc->bss_conf->use_cts_prot;
--	if (mrr_capable)
--		sampling_ratio = mp->lookaround_rate_mrr;
--	else
--		sampling_ratio = mp->lookaround_rate;
--
--	/* increase sum packet counter */
--	mi->total_packets++;
--
--#ifdef CPTCFG_MAC80211_DEBUGFS
--	if (mp->fixed_rate_idx != -1)
--		return;
--#endif
--
--	/* Don't use EAPOL frames for sampling on non-mrr hw */
--	if (mp->hw->max_rates == 1 &&
--	    (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO))
--		return;
--
--	delta = (mi->total_packets * sampling_ratio / 100) -
--			mi->sample_packets;
--
--	/* delta < 0: no sampling required */
--	prev_sample = mi->prev_sample;
--	mi->prev_sample = false;
--	if (delta < 0 || (!mrr_capable && prev_sample))
--		return;
--
--	if (mi->total_packets >= 10000) {
--		mi->sample_packets = 0;
--		mi->total_packets = 0;
--	} else if (delta > mi->n_rates * 2) {
--		/* With multi-rate retry, not every planned sample
--		 * attempt actually gets used, due to the way the retry
--		 * chain is set up - [max_tp,sample,prob,lowest] for
--		 * sample_rate < max_tp.
--		 *
--		 * If there's too much sampling backlog and the link
--		 * starts getting worse, minstrel would start bursting
--		 * out lots of sampling frames, which would result
--		 * in a large throughput loss. */
--		mi->sample_packets += (delta - mi->n_rates * 2);
--	}
--
--	/* get next random rate sample */
--	ndx = minstrel_get_next_sample(mi);
--	msr = &mi->r[ndx];
--	mr = &mi->r[mi->max_tp_rate[0]];
--
--	/* Decide if direct ( 1st mrr stage) or indirect (2nd mrr stage)
--	 * rate sampling method should be used.
--	 * Respect such rates that are not sampled for 20 interations.
--	 */
--	if (msr->perfect_tx_time < mr->perfect_tx_time ||
--	    msr->stats.sample_skipped >= 20) {
--		if (!msr->sample_limit)
--			return;
--
--		mi->sample_packets++;
--		if (msr->sample_limit > 0)
--			msr->sample_limit--;
--	}
--
--	/* If we're not using MRR and the sampling rate already
--	 * has a probability of >95%, we shouldn't be attempting
--	 * to use it, as this only wastes precious airtime */
--	if (!mrr_capable &&
--	   (mi->r[ndx].stats.prob_avg > MINSTREL_FRAC(95, 100)))
--		return;
--
--	mi->prev_sample = true;
--
--	rate->idx = mi->r[ndx].rix;
--	rate->count = minstrel_get_retry_count(&mi->r[ndx], info);
--	info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
--}
--
--
--static void
--calc_rate_durations(enum nl80211_band band,
--		    struct minstrel_rate *d,
--		    struct ieee80211_rate *rate,
--		    struct cfg80211_chan_def *chandef)
--{
--	int erp = !!(rate->flags & IEEE80211_RATE_ERP_G);
--	int shift = ieee80211_chandef_get_shift(chandef);
--
--	d->perfect_tx_time = ieee80211_frame_duration(band, 1200,
--			DIV_ROUND_UP(rate->bitrate, 1 << shift), erp, 1,
--			shift);
--	d->ack_time = ieee80211_frame_duration(band, 10,
--			DIV_ROUND_UP(rate->bitrate, 1 << shift), erp, 1,
--			shift);
--}
--
--static void
--init_sample_table(struct minstrel_sta_info *mi)
--{
--	unsigned int i, col, new_idx;
--	u8 rnd[8];
--
--	mi->sample_column = 0;
--	mi->sample_row = 0;
--	memset(mi->sample_table, 0xff, SAMPLE_COLUMNS * mi->n_rates);
--
--	for (col = 0; col < SAMPLE_COLUMNS; col++) {
--		prandom_bytes(rnd, sizeof(rnd));
--		for (i = 0; i < mi->n_rates; i++) {
--			new_idx = (i + rnd[i & 7]) % mi->n_rates;
--			while (SAMPLE_TBL(mi, new_idx, col) != 0xff)
--				new_idx = (new_idx + 1) % mi->n_rates;
--
--			SAMPLE_TBL(mi, new_idx, col) = i;
--		}
--	}
--}
--
--static void
--minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
--		   struct cfg80211_chan_def *chandef,
--		   struct ieee80211_sta *sta, void *priv_sta)
--{
--	struct minstrel_sta_info *mi = priv_sta;
--	struct minstrel_priv *mp = priv;
--	struct ieee80211_rate *ctl_rate;
--	unsigned int i, n = 0;
--	unsigned int t_slot = 9; /* FIXME: get real slot time */
--	u32 rate_flags;
--
--	mi->sta = sta;
--	mi->lowest_rix = rate_lowest_index(sband, sta);
--	ctl_rate = &sband->bitrates[mi->lowest_rix];
--	mi->sp_ack_dur = ieee80211_frame_duration(sband->band, 10,
--				ctl_rate->bitrate,
--				!!(ctl_rate->flags & IEEE80211_RATE_ERP_G), 1,
--				ieee80211_chandef_get_shift(chandef));
--
--	rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
--	memset(mi->max_tp_rate, 0, sizeof(mi->max_tp_rate));
--	mi->max_prob_rate = 0;
--
--	for (i = 0; i < sband->n_bitrates; i++) {
--		struct minstrel_rate *mr = &mi->r[n];
--		struct minstrel_rate_stats *mrs = &mi->r[n].stats;
--		unsigned int tx_time = 0, tx_time_cts = 0, tx_time_rtscts = 0;
--		unsigned int tx_time_single;
--		unsigned int cw = mp->cw_min;
--		int shift;
--
--		if (!rate_supported(sta, sband->band, i))
--			continue;
--		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
--			continue;
--
--		n++;
--		memset(mr, 0, sizeof(*mr));
--		memset(mrs, 0, sizeof(*mrs));
--
--		mr->rix = i;
--		shift = ieee80211_chandef_get_shift(chandef);
--		mr->bitrate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
--					   (1 << shift) * 5);
--		calc_rate_durations(sband->band, mr, &sband->bitrates[i],
--				    chandef);
--
--		/* calculate maximum number of retransmissions before
--		 * fallback (based on maximum segment size) */
--		mr->sample_limit = -1;
--		mrs->retry_count = 1;
--		mr->retry_count_cts = 1;
--		mrs->retry_count_rtscts = 1;
--		tx_time = mr->perfect_tx_time + mi->sp_ack_dur;
--		do {
--			/* add one retransmission */
--			tx_time_single = mr->ack_time + mr->perfect_tx_time;
--
--			/* contention window */
--			tx_time_single += (t_slot * cw) >> 1;
--			cw = min((cw << 1) | 1, mp->cw_max);
--
--			tx_time += tx_time_single;
--			tx_time_cts += tx_time_single + mi->sp_ack_dur;
--			tx_time_rtscts += tx_time_single + 2 * mi->sp_ack_dur;
--			if ((tx_time_cts < mp->segment_size) &&
--				(mr->retry_count_cts < mp->max_retry))
--				mr->retry_count_cts++;
--			if ((tx_time_rtscts < mp->segment_size) &&
--				(mrs->retry_count_rtscts < mp->max_retry))
--				mrs->retry_count_rtscts++;
--		} while ((tx_time < mp->segment_size) &&
--				(++mr->stats.retry_count < mp->max_retry));
--		mr->adjusted_retry_count = mrs->retry_count;
--		if (!(sband->bitrates[i].flags & IEEE80211_RATE_ERP_G))
--			mr->retry_count_cts = mrs->retry_count;
--	}
--
--	for (i = n; i < sband->n_bitrates; i++) {
--		struct minstrel_rate *mr = &mi->r[i];
--		mr->rix = -1;
--	}
--
--	mi->n_rates = n;
--	mi->last_stats_update = jiffies;
--
--	init_sample_table(mi);
--	minstrel_update_rates(mp, mi);
--}
--
--static u32 minstrel_get_expected_throughput(void *priv_sta)
--{
--	struct minstrel_sta_info *mi = priv_sta;
--	struct minstrel_rate_stats *tmp_mrs;
--	int idx = mi->max_tp_rate[0];
--	int tmp_cur_tp;
--
--	/* convert pkt per sec in kbps (1200 is the average pkt size used for
--	 * computing cur_tp
--	 */
--	tmp_mrs = &mi->r[idx].stats;
--	tmp_cur_tp = minstrel_get_tp_avg(&mi->r[idx], tmp_mrs->prob_avg) * 10;
--	tmp_cur_tp = tmp_cur_tp * 1200 * 8 / 1024;
--
--	return tmp_cur_tp;
--}
--
--const struct rate_control_ops mac80211_minstrel = {
--	.tx_status_ext = minstrel_tx_status,
--	.get_rate = minstrel_get_rate,
--	.rate_init = minstrel_rate_init,
--	.get_expected_throughput = minstrel_get_expected_throughput,
--};
---- a/net/mac80211/rc80211_minstrel.h
-+++ /dev/null
-@@ -1,185 +0,0 @@
--/* SPDX-License-Identifier: GPL-2.0-only */
--/*
-- * Copyright (C) 2008 Felix Fietkau <nbd@openwrt.org>
-- */
--
--#ifndef __RC_MINSTREL_H
--#define __RC_MINSTREL_H
--
--#define EWMA_LEVEL	96	/* ewma weighting factor [/EWMA_DIV] */
--#define EWMA_DIV	128
--#define SAMPLE_COLUMNS	10	/* number of columns in sample table */
--
--/* scaled fraction values */
--#define MINSTREL_SCALE  12
--#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / div)
--#define MINSTREL_TRUNC(val) ((val) >> MINSTREL_SCALE)
--
--/* number of highest throughput rates to consider*/
--#define MAX_THR_RATES 4
--
--/*
-- * Coefficients for moving average with noise filter (period=16),
-- * scaled by 10 bits
-- *
-- * a1 = exp(-pi * sqrt(2) / period)
-- * coeff2 = 2 * a1 * cos(sqrt(2) * 2 * pi / period)
-- * coeff3 = -sqr(a1)
-- * coeff1 = 1 - coeff2 - coeff3
-- */
--#define MINSTREL_AVG_COEFF1		(MINSTREL_FRAC(1, 1) - \
--					 MINSTREL_AVG_COEFF2 - \
--					 MINSTREL_AVG_COEFF3)
--#define MINSTREL_AVG_COEFF2		0x00001499
--#define MINSTREL_AVG_COEFF3		-0x0000092e
--
--/*
-- * Perform EWMA (Exponentially Weighted Moving Average) calculation
-- */
--static inline int
--minstrel_ewma(int old, int new, int weight)
--{
--	int diff, incr;
--
--	diff = new - old;
--	incr = (EWMA_DIV - weight) * diff / EWMA_DIV;
--
--	return old + incr;
--}
--
--static inline int minstrel_filter_avg_add(u16 *prev_1, u16 *prev_2, s32 in)
--{
--	s32 out_1 = *prev_1;
--	s32 out_2 = *prev_2;
--	s32 val;
--
--	if (!in)
--		in += 1;
--
--	if (!out_1) {
--		val = out_1 = in;
--		goto out;
--	}
--
--	val = MINSTREL_AVG_COEFF1 * in;
--	val += MINSTREL_AVG_COEFF2 * out_1;
--	val += MINSTREL_AVG_COEFF3 * out_2;
--	val >>= MINSTREL_SCALE;
--
--	if (val > 1 << MINSTREL_SCALE)
--		val = 1 << MINSTREL_SCALE;
--	if (val < 0)
--		val = 1;
--
--out:
--	*prev_2 = out_1;
--	*prev_1 = val;
--
--	return val;
--}
--
--struct minstrel_rate_stats {
--	/* current / last sampling period attempts/success counters */
--	u16 attempts, last_attempts;
--	u16 success, last_success;
--
--	/* total attempts/success counters */
--	u32 att_hist, succ_hist;
--
--	/* prob_avg - moving average of prob */
--	u16 prob_avg;
--	u16 prob_avg_1;
--
--	/* maximum retry counts */
--	u8 retry_count;
--	u8 retry_count_rtscts;
--
--	u8 sample_skipped;
--	bool retry_updated;
--};
--
--struct minstrel_rate {
--	int bitrate;
--
--	s8 rix;
--	u8 retry_count_cts;
--	u8 adjusted_retry_count;
--
--	unsigned int perfect_tx_time;
--	unsigned int ack_time;
--
--	int sample_limit;
--
--	struct minstrel_rate_stats stats;
--};
--
--struct minstrel_sta_info {
--	struct ieee80211_sta *sta;
--
--	unsigned long last_stats_update;
--	unsigned int sp_ack_dur;
--	unsigned int rate_avg;
--
--	unsigned int lowest_rix;
--
--	u8 max_tp_rate[MAX_THR_RATES];
--	u8 max_prob_rate;
--	unsigned int total_packets;
--	unsigned int sample_packets;
--
--	unsigned int sample_row;
--	unsigned int sample_column;
--
--	int n_rates;
--	struct minstrel_rate *r;
--	bool prev_sample;
--
--	/* sampling table */
--	u8 *sample_table;
--};
--
--struct minstrel_priv {
--	struct ieee80211_hw *hw;
--	bool has_mrr;
--	bool new_avg;
--	u32 sample_switch;
--	unsigned int cw_min;
--	unsigned int cw_max;
--	unsigned int max_retry;
--	unsigned int segment_size;
--	unsigned int update_interval;
--	unsigned int lookaround_rate;
--	unsigned int lookaround_rate_mrr;
--
--	u8 cck_rates[4];
--	u8 ofdm_rates[NUM_NL80211_BANDS][8];
--
--#ifdef CPTCFG_MAC80211_DEBUGFS
--	/*
--	 * enable fixed rate processing per RC
--	 *   - write static index to debugfs:ieee80211/phyX/rc/fixed_rate_idx
--	 *   - write -1 to enable RC processing again
--	 *   - setting will be applied on next update
--	 */
--	u32 fixed_rate_idx;
--#endif
--};
--
--struct minstrel_debugfs_info {
--	size_t len;
--	char buf[];
--};
--
--extern const struct rate_control_ops mac80211_minstrel;
--void minstrel_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir);
--
--/* Recalculate success probabilities and counters for a given rate using EWMA */
--void minstrel_calc_rate_stats(struct minstrel_priv *mp,
--			      struct minstrel_rate_stats *mrs);
--int minstrel_get_tp_avg(struct minstrel_rate *mr, int prob_avg);
--
--/* debugfs */
--int minstrel_stats_open(struct inode *inode, struct file *file);
--int minstrel_stats_csv_open(struct inode *inode, struct file *file);
--
--#endif
---- a/net/mac80211/rc80211_minstrel_debugfs.c
-+++ /dev/null
-@@ -1,172 +0,0 @@
--/*
-- * Copyright (C) 2008 Felix Fietkau <nbd@openwrt.org>
-- *
-- * This program is free software; you can redistribute it and/or modify
-- * it under the terms of the GNU General Public License version 2 as
-- * published by the Free Software Foundation.
-- *
-- * Based on minstrel.c:
-- *   Copyright (C) 2005-2007 Derek Smithies <derek@indranet.co.nz>
-- *   Sponsored by Indranet Technologies Ltd
-- *
-- * Based on sample.c:
-- *   Copyright (c) 2005 John Bicket
-- *   All rights reserved.
-- *
-- *   Redistribution and use in source and binary forms, with or without
-- *   modification, are permitted provided that the following conditions
-- *   are met:
-- *   1. Redistributions of source code must retain the above copyright
-- *      notice, this list of conditions and the following disclaimer,
-- *      without modification.
-- *   2. Redistributions in binary form must reproduce at minimum a disclaimer
-- *      similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
-- *      redistribution must be conditioned upon including a substantially
-- *      similar Disclaimer requirement for further binary redistribution.
-- *   3. Neither the names of the above-listed copyright holders nor the names
-- *      of any contributors may be used to endorse or promote products derived
-- *      from this software without specific prior written permission.
-- *
-- *   Alternatively, this software may be distributed under the terms of the
-- *   GNU General Public License ("GPL") version 2 as published by the Free
-- *   Software Foundation.
-- *
-- *   NO WARRANTY
-- *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-- *   ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-- *   LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
-- *   AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
-- *   THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
-- *   OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-- *   SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-- *   INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
-- *   IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-- *   ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
-- *   THE POSSIBILITY OF SUCH DAMAGES.
-- */
--#include <linux/netdevice.h>
--#include <linux/types.h>
--#include <linux/skbuff.h>
--#include <linux/debugfs.h>
--#include <linux/ieee80211.h>
--#include <linux/slab.h>
--#include <linux/export.h>
--#include <net/mac80211.h>
--#include "rc80211_minstrel.h"
--
--int
--minstrel_stats_open(struct inode *inode, struct file *file)
--{
--	struct minstrel_sta_info *mi = inode->i_private;
--	struct minstrel_debugfs_info *ms;
--	unsigned int i, tp_max, tp_avg, eprob;
--	char *p;
--
--	ms = kmalloc(2048, GFP_KERNEL);
--	if (!ms)
--		return -ENOMEM;
--
--	file->private_data = ms;
--	p = ms->buf;
--	p += sprintf(p, "\n");
--	p += sprintf(p,
--		     "best   __________rate_________    ____statistics___    ____last_____    ______sum-of________\n");
--	p += sprintf(p,
--		     "rate  [name idx airtime max_tp]  [avg(tp) avg(prob)]  [retry|suc|att]  [#success | #attempts]\n");
--
--	for (i = 0; i < mi->n_rates; i++) {
--		struct minstrel_rate *mr = &mi->r[i];
--		struct minstrel_rate_stats *mrs = &mi->r[i].stats;
--
--		*(p++) = (i == mi->max_tp_rate[0]) ? 'A' : ' ';
--		*(p++) = (i == mi->max_tp_rate[1]) ? 'B' : ' ';
--		*(p++) = (i == mi->max_tp_rate[2]) ? 'C' : ' ';
--		*(p++) = (i == mi->max_tp_rate[3]) ? 'D' : ' ';
--		*(p++) = (i == mi->max_prob_rate) ? 'P' : ' ';
--
--		p += sprintf(p, " %3u%s ", mr->bitrate / 2,
--				(mr->bitrate & 1 ? ".5" : "  "));
--		p += sprintf(p, "%3u  ", i);
--		p += sprintf(p, "%6u ", mr->perfect_tx_time);
--
--		tp_max = minstrel_get_tp_avg(mr, MINSTREL_FRAC(100,100));
--		tp_avg = minstrel_get_tp_avg(mr, mrs->prob_avg);
--		eprob = MINSTREL_TRUNC(mrs->prob_avg * 1000);
--
--		p += sprintf(p, "%4u.%1u    %4u.%1u     %3u.%1u"
--				"     %3u   %3u %-3u   "
--				"%9llu   %-9llu\n",
--				tp_max / 10, tp_max % 10,
--				tp_avg / 10, tp_avg % 10,
--				eprob / 10, eprob % 10,
--				mrs->retry_count,
--				mrs->last_success,
--				mrs->last_attempts,
--				(unsigned long long)mrs->succ_hist,
--				(unsigned long long)mrs->att_hist);
--	}
--	p += sprintf(p, "\nTotal packet count::    ideal %d      "
--			"lookaround %d\n\n",
--			mi->total_packets - mi->sample_packets,
--			mi->sample_packets);
--	ms->len = p - ms->buf;
--
--	WARN_ON(ms->len + sizeof(*ms) > 2048);
--
--	return 0;
--}
--
--int
--minstrel_stats_csv_open(struct inode *inode, struct file *file)
--{
--	struct minstrel_sta_info *mi = inode->i_private;
--	struct minstrel_debugfs_info *ms;
--	unsigned int i, tp_max, tp_avg, eprob;
--	char *p;
--
--	ms = kmalloc(2048, GFP_KERNEL);
--	if (!ms)
--		return -ENOMEM;
--
--	file->private_data = ms;
--	p = ms->buf;
--
--	for (i = 0; i < mi->n_rates; i++) {
--		struct minstrel_rate *mr = &mi->r[i];
--		struct minstrel_rate_stats *mrs = &mi->r[i].stats;
--
--		p += sprintf(p, "%s" ,((i == mi->max_tp_rate[0]) ? "A" : ""));
--		p += sprintf(p, "%s" ,((i == mi->max_tp_rate[1]) ? "B" : ""));
--		p += sprintf(p, "%s" ,((i == mi->max_tp_rate[2]) ? "C" : ""));
--		p += sprintf(p, "%s" ,((i == mi->max_tp_rate[3]) ? "D" : ""));
--		p += sprintf(p, "%s" ,((i == mi->max_prob_rate) ? "P" : ""));
--
--		p += sprintf(p, ",%u%s", mr->bitrate / 2,
--				(mr->bitrate & 1 ? ".5," : ","));
--		p += sprintf(p, "%u,", i);
--		p += sprintf(p, "%u,",mr->perfect_tx_time);
--
--		tp_max = minstrel_get_tp_avg(mr, MINSTREL_FRAC(100,100));
--		tp_avg = minstrel_get_tp_avg(mr, mrs->prob_avg);
--		eprob = MINSTREL_TRUNC(mrs->prob_avg * 1000);
--
--		p += sprintf(p, "%u.%u,%u.%u,%u.%u,%u,%u,%u,"
--				"%llu,%llu,%d,%d\n",
--				tp_max / 10, tp_max % 10,
--				tp_avg / 10, tp_avg % 10,
--				eprob / 10, eprob % 10,
--				mrs->retry_count,
--				mrs->last_success,
--				mrs->last_attempts,
--				(unsigned long long)mrs->succ_hist,
--				(unsigned long long)mrs->att_hist,
--				mi->total_packets - mi->sample_packets,
--				mi->sample_packets);
--
--	}
--	ms->len = p - ms->buf;
--
--	WARN_ON(ms->len + sizeof(*ms) > 2048);
--
--	return 0;
--}
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -13,7 +13,6 @@
- #include <net/mac80211.h>
- #include "rate.h"
- #include "sta_info.h"
--#include "rc80211_minstrel.h"
- #include "rc80211_minstrel_ht.h"
- 
- #define AVG_AMPDU_SIZE	16
-@@ -716,6 +715,83 @@ out:
- 	mi->sample_mode = MINSTREL_SAMPLE_ACTIVE;
- }
- 
-+static inline int
-+minstrel_ewma(int old, int new, int weight)
-+{
-+	int diff, incr;
-+
-+	diff = new - old;
-+	incr = (EWMA_DIV - weight) * diff / EWMA_DIV;
-+
-+	return old + incr;
-+}
-+
-+static inline int minstrel_filter_avg_add(u16 *prev_1, u16 *prev_2, s32 in)
-+{
-+	s32 out_1 = *prev_1;
-+	s32 out_2 = *prev_2;
-+	s32 val;
-+
-+	if (!in)
-+		in += 1;
-+
-+	if (!out_1) {
-+		val = out_1 = in;
-+		goto out;
-+	}
-+
-+	val = MINSTREL_AVG_COEFF1 * in;
-+	val += MINSTREL_AVG_COEFF2 * out_1;
-+	val += MINSTREL_AVG_COEFF3 * out_2;
-+	val >>= MINSTREL_SCALE;
-+
-+	if (val > 1 << MINSTREL_SCALE)
-+		val = 1 << MINSTREL_SCALE;
-+	if (val < 0)
-+		val = 1;
-+
-+out:
-+	*prev_2 = out_1;
-+	*prev_1 = val;
-+
-+	return val;
-+}
-+
-+/*
-+* Recalculate statistics and counters of a given rate
-+*/
-+static void
-+minstrel_ht_calc_rate_stats(struct minstrel_priv *mp,
-+			    struct minstrel_rate_stats *mrs)
-+{
-+	unsigned int cur_prob;
-+
-+	if (unlikely(mrs->attempts > 0)) {
-+		mrs->sample_skipped = 0;
-+		cur_prob = MINSTREL_FRAC(mrs->success, mrs->attempts);
-+		if (mp->new_avg) {
-+			minstrel_filter_avg_add(&mrs->prob_avg,
-+						&mrs->prob_avg_1, cur_prob);
-+		} else if (unlikely(!mrs->att_hist)) {
-+			mrs->prob_avg = cur_prob;
-+		} else {
-+			/*update exponential weighted moving avarage */
-+			mrs->prob_avg = minstrel_ewma(mrs->prob_avg,
-+						      cur_prob,
-+						      EWMA_LEVEL);
-+		}
-+		mrs->att_hist += mrs->attempts;
-+		mrs->succ_hist += mrs->success;
-+	} else {
-+		mrs->sample_skipped++;
-+	}
-+
-+	mrs->last_success = mrs->success;
-+	mrs->last_attempts = mrs->attempts;
-+	mrs->success = 0;
-+	mrs->attempts = 0;
-+}
-+
- /*
-  * Update rate statistics and select new primary rates
-  *
-@@ -808,7 +884,7 @@ minstrel_ht_update_stats(struct minstrel
- 
- 			mrs = &mg->rates[i];
- 			mrs->retry_updated = false;
--			minstrel_calc_rate_stats(mp, mrs);
-+			minstrel_ht_calc_rate_stats(mp, mrs);
- 			cur_prob = mrs->prob_avg;
- 
- 			if (minstrel_ht_get_tp_avg(mi, group, i, cur_prob) == 0)
-@@ -960,8 +1036,7 @@ minstrel_ht_tx_status(void *priv, struct
-                       void *priv_sta, struct ieee80211_tx_status *st)
- {
- 	struct ieee80211_tx_info *info = st->info;
--	struct minstrel_ht_sta_priv *msp = priv_sta;
--	struct minstrel_ht_sta *mi = &msp->ht;
-+	struct minstrel_ht_sta *mi = priv_sta;
- 	struct ieee80211_tx_rate *ar = info->status.rates;
- 	struct minstrel_rate_stats *rate, *rate2, *rate_sample = NULL;
- 	struct minstrel_priv *mp = priv;
-@@ -1372,8 +1447,7 @@ minstrel_ht_get_rate(void *priv, struct
- 	const struct mcs_group *sample_group;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
- 	struct ieee80211_tx_rate *rate = &info->status.rates[0];
--	struct minstrel_ht_sta_priv *msp = priv_sta;
--	struct minstrel_ht_sta *mi = &msp->ht;
-+	struct minstrel_ht_sta *mi = priv_sta;
- 	struct minstrel_priv *mp = priv;
- 	int sample_idx;
- 
-@@ -1484,8 +1558,7 @@ minstrel_ht_update_caps(void *priv, stru
- 			struct ieee80211_sta *sta, void *priv_sta)
- {
- 	struct minstrel_priv *mp = priv;
--	struct minstrel_ht_sta_priv *msp = priv_sta;
--	struct minstrel_ht_sta *mi = &msp->ht;
-+	struct minstrel_ht_sta *mi = priv_sta;
- 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
- 	u16 ht_cap = sta->ht_cap.cap;
- 	struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
-@@ -1647,7 +1720,7 @@ static void *
- minstrel_ht_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
- {
- 	struct ieee80211_supported_band *sband;
--	struct minstrel_ht_sta_priv *msp;
-+	struct minstrel_ht_sta *mi;
- 	struct minstrel_priv *mp = priv;
- 	struct ieee80211_hw *hw = mp->hw;
- 	int max_rates = 0;
-@@ -1659,35 +1732,13 @@ minstrel_ht_alloc_sta(void *priv, struct
- 			max_rates = sband->n_bitrates;
- 	}
- 
--	msp = kzalloc(sizeof(*msp), gfp);
--	if (!msp)
--		return NULL;
--
--	msp->ratelist = kcalloc(max_rates, sizeof(struct minstrel_rate), gfp);
--	if (!msp->ratelist)
--		goto error;
--
--	msp->sample_table = kmalloc_array(max_rates, SAMPLE_COLUMNS, gfp);
--	if (!msp->sample_table)
--		goto error1;
--
--	return msp;
--
--error1:
--	kfree(msp->ratelist);
--error:
--	kfree(msp);
--	return NULL;
-+	return kzalloc(sizeof(*mi), gfp);
- }
- 
- static void
- minstrel_ht_free_sta(void *priv, struct ieee80211_sta *sta, void *priv_sta)
- {
--	struct minstrel_ht_sta_priv *msp = priv_sta;
--
--	kfree(msp->sample_table);
--	kfree(msp->ratelist);
--	kfree(msp);
-+	kfree(priv_sta);
- }
- 
- static void
-@@ -1768,12 +1819,6 @@ minstrel_ht_alloc(struct ieee80211_hw *h
- 	mp->cw_min = 15;
- 	mp->cw_max = 1023;
- 
--	/* number of packets (in %) to use for sampling other rates
--	 * sample less often for non-mrr packets, because the overhead
--	 * is much higher than with mrr */
--	mp->lookaround_rate = 5;
--	mp->lookaround_rate_mrr = 10;
--
- 	/* maximum time that the hw is allowed to stay in one MRR segment */
- 	mp->segment_size = 6000;
- 
-@@ -1821,8 +1866,7 @@ minstrel_ht_free(void *priv)
- 
- static u32 minstrel_ht_get_expected_throughput(void *priv_sta)
- {
--	struct minstrel_ht_sta_priv *msp = priv_sta;
--	struct minstrel_ht_sta *mi = &msp->ht;
-+	struct minstrel_ht_sta *mi = priv_sta;
- 	int i, j, prob, tp_avg;
- 
- 	i = mi->max_tp_rate[0] / MCS_GROUP_RATES;
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -6,6 +6,33 @@
- #ifndef __RC_MINSTREL_HT_H
- #define __RC_MINSTREL_HT_H
- 
-+/* number of highest throughput rates to consider*/
-+#define MAX_THR_RATES 4
-+#define SAMPLE_COLUMNS	10	/* number of columns in sample table */
-+
-+/* scaled fraction values */
-+#define MINSTREL_SCALE  12
-+#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / div)
-+#define MINSTREL_TRUNC(val) ((val) >> MINSTREL_SCALE)
-+
-+#define EWMA_LEVEL	96	/* ewma weighting factor [/EWMA_DIV] */
-+#define EWMA_DIV	128
-+
-+/*
-+ * Coefficients for moving average with noise filter (period=16),
-+ * scaled by 10 bits
-+ *
-+ * a1 = exp(-pi * sqrt(2) / period)
-+ * coeff2 = 2 * a1 * cos(sqrt(2) * 2 * pi / period)
-+ * coeff3 = -sqr(a1)
-+ * coeff1 = 1 - coeff2 - coeff3
-+ */
-+#define MINSTREL_AVG_COEFF1		(MINSTREL_FRAC(1, 1) - \
-+					 MINSTREL_AVG_COEFF2 - \
-+					 MINSTREL_AVG_COEFF3)
-+#define MINSTREL_AVG_COEFF2		0x00001499
-+#define MINSTREL_AVG_COEFF3		-0x0000092e
-+
- /*
-  * The number of streams can be changed to 2 to reduce code
-  * size and memory footprint.
-@@ -30,6 +57,32 @@
- 
- #define MCS_GROUP_RATES		10
- 
-+struct minstrel_priv {
-+	struct ieee80211_hw *hw;
-+	bool has_mrr;
-+	bool new_avg;
-+	u32 sample_switch;
-+	unsigned int cw_min;
-+	unsigned int cw_max;
-+	unsigned int max_retry;
-+	unsigned int segment_size;
-+	unsigned int update_interval;
-+
-+	u8 cck_rates[4];
-+	u8 ofdm_rates[NUM_NL80211_BANDS][8];
-+
-+#ifdef CPTCFG_MAC80211_DEBUGFS
-+	/*
-+	 * enable fixed rate processing per RC
-+	 *   - write static index to debugfs:ieee80211/phyX/rc/fixed_rate_idx
-+	 *   - write -1 to enable RC processing again
-+	 *   - setting will be applied on next update
-+	 */
-+	u32 fixed_rate_idx;
-+#endif
-+};
-+
-+
- struct mcs_group {
- 	u16 flags;
- 	u8 streams;
-@@ -42,6 +95,26 @@ extern const s16 minstrel_cck_bitrates[4
- extern const s16 minstrel_ofdm_bitrates[8];
- extern const struct mcs_group minstrel_mcs_groups[];
- 
-+struct minstrel_rate_stats {
-+	/* current / last sampling period attempts/success counters */
-+	u16 attempts, last_attempts;
-+	u16 success, last_success;
-+
-+	/* total attempts/success counters */
-+	u32 att_hist, succ_hist;
-+
-+	/* prob_avg - moving average of prob */
-+	u16 prob_avg;
-+	u16 prob_avg_1;
-+
-+	/* maximum retry counts */
-+	u8 retry_count;
-+	u8 retry_count_rtscts;
-+
-+	u8 sample_skipped;
-+	bool retry_updated;
-+};
-+
- struct minstrel_mcs_group_data {
- 	u8 index;
- 	u8 column;
-@@ -111,12 +184,6 @@ struct minstrel_ht_sta {
- 	struct minstrel_mcs_group_data groups[MINSTREL_GROUPS_NB];
- };
- 
--struct minstrel_ht_sta_priv {
--	struct minstrel_ht_sta ht;
--	void *ratelist;
--	void *sample_table;
--};
--
- void minstrel_ht_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir);
- int minstrel_ht_get_tp_avg(struct minstrel_ht_sta *mi, int group, int rate,
- 			   int prob_avg);
---- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
-+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
-@@ -9,9 +9,13 @@
- #include <linux/ieee80211.h>
- #include <linux/export.h>
- #include <net/mac80211.h>
--#include "rc80211_minstrel.h"
- #include "rc80211_minstrel_ht.h"
- 
-+struct minstrel_debugfs_info {
-+	size_t len;
-+	char buf[];
-+};
-+
- static ssize_t
- minstrel_stats_read(struct file *file, char __user *buf, size_t len, loff_t *ppos)
- {
-@@ -127,8 +131,7 @@ minstrel_ht_stats_dump(struct minstrel_h
- static int
- minstrel_ht_stats_open(struct inode *inode, struct file *file)
- {
--	struct minstrel_ht_sta_priv *msp = inode->i_private;
--	struct minstrel_ht_sta *mi = &msp->ht;
-+	struct minstrel_ht_sta *mi = inode->i_private;
- 	struct minstrel_debugfs_info *ms;
- 	unsigned int i;
- 	char *p;
-@@ -276,8 +279,7 @@ minstrel_ht_stats_csv_dump(struct minstr
- static int
- minstrel_ht_stats_csv_open(struct inode *inode, struct file *file)
- {
--	struct minstrel_ht_sta_priv *msp = inode->i_private;
--	struct minstrel_ht_sta *mi = &msp->ht;
-+	struct minstrel_ht_sta *mi = inode->i_private;
- 	struct minstrel_debugfs_info *ms;
- 	unsigned int i;
- 	char *p;
-@@ -313,10 +315,8 @@ static const struct file_operations mins
- void
- minstrel_ht_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir)
- {
--	struct minstrel_ht_sta_priv *msp = priv_sta;
--
--	debugfs_create_file("rc_stats", 0444, dir, msp,
-+	debugfs_create_file("rc_stats", 0444, dir, priv_sta,
- 			    &minstrel_ht_stat_fops);
--	debugfs_create_file("rc_stats_csv", 0444, dir, msp,
-+	debugfs_create_file("rc_stats_csv", 0444, dir, priv_sta,
- 			    &minstrel_ht_stat_csv_fops);
- }
diff --git a/package/kernel/mac80211/patches/subsys/340-mac80211-minstrel_ht-remove-old-ewma-based-rate-aver.patch b/package/kernel/mac80211/patches/subsys/340-mac80211-minstrel_ht-remove-old-ewma-based-rate-aver.patch
deleted file mode 100644
index 9b6a614aa8..0000000000
--- a/package/kernel/mac80211/patches/subsys/340-mac80211-minstrel_ht-remove-old-ewma-based-rate-aver.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 26 Dec 2020 14:34:30 +0100
-Subject: [PATCH] mac80211: minstrel_ht: remove old ewma based rate average
- code
-
-The new noise filter has been the default for a while now with no reported
-downside and significant improvement compared to the old code.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -769,17 +769,8 @@ minstrel_ht_calc_rate_stats(struct minst
- 	if (unlikely(mrs->attempts > 0)) {
- 		mrs->sample_skipped = 0;
- 		cur_prob = MINSTREL_FRAC(mrs->success, mrs->attempts);
--		if (mp->new_avg) {
--			minstrel_filter_avg_add(&mrs->prob_avg,
--						&mrs->prob_avg_1, cur_prob);
--		} else if (unlikely(!mrs->att_hist)) {
--			mrs->prob_avg = cur_prob;
--		} else {
--			/*update exponential weighted moving avarage */
--			mrs->prob_avg = minstrel_ewma(mrs->prob_avg,
--						      cur_prob,
--						      EWMA_LEVEL);
--		}
-+		minstrel_filter_avg_add(&mrs->prob_avg,
-+					&mrs->prob_avg_1, cur_prob);
- 		mrs->att_hist += mrs->attempts;
- 		mrs->succ_hist += mrs->success;
- 	} else {
-@@ -913,10 +904,8 @@ minstrel_ht_update_stats(struct minstrel
- 	/* Try to increase robustness of max_prob_rate*/
- 	minstrel_ht_prob_rate_reduce_streams(mi);
- 
--	/* try to sample all available rates during each interval */
--	mi->sample_count *= 8;
--	if (mp->new_avg)
--		mi->sample_count /= 2;
-+	/* try to sample half of all available rates during each interval */
-+	mi->sample_count *= 4;
- 
- 	if (sample)
- 		minstrel_ht_rate_sample_switch(mp, mi);
-@@ -1040,7 +1029,7 @@ minstrel_ht_tx_status(void *priv, struct
- 	struct ieee80211_tx_rate *ar = info->status.rates;
- 	struct minstrel_rate_stats *rate, *rate2, *rate_sample = NULL;
- 	struct minstrel_priv *mp = priv;
--	u32 update_interval = mp->update_interval / 2;
-+	u32 update_interval = mp->update_interval;
- 	bool last, update = false;
- 	bool sample_status = false;
- 	int i;
-@@ -1090,9 +1079,8 @@ minstrel_ht_tx_status(void *priv, struct
- 
- 	switch (mi->sample_mode) {
- 	case MINSTREL_SAMPLE_IDLE:
--		if (mp->new_avg &&
--		    (mp->hw->max_rates > 1 ||
--		     mi->total_packets_cur < SAMPLE_SWITCH_THR))
-+		if (mp->hw->max_rates > 1 ||
-+		     mi->total_packets_cur < SAMPLE_SWITCH_THR)
- 			update_interval /= 2;
- 		break;
- 
-@@ -1832,8 +1820,7 @@ minstrel_ht_alloc(struct ieee80211_hw *h
- 		mp->has_mrr = true;
- 
- 	mp->hw = hw;
--	mp->update_interval = HZ / 10;
--	mp->new_avg = true;
-+	mp->update_interval = HZ / 20;
- 
- 	minstrel_ht_init_cck_rates(mp);
- 	for (i = 0; i < ARRAY_SIZE(mp->hw->wiphy->bands); i++)
-@@ -1853,8 +1840,6 @@ static void minstrel_ht_add_debugfs(stru
- 			   &mp->fixed_rate_idx);
- 	debugfs_create_u32("sample_switch", S_IRUGO | S_IWUSR, debugfsdir,
- 			   &mp->sample_switch);
--	debugfs_create_bool("new_avg", S_IRUGO | S_IWUSR, debugfsdir,
--			   &mp->new_avg);
- }
- #endif
- 
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -60,7 +60,6 @@
- struct minstrel_priv {
- 	struct ieee80211_hw *hw;
- 	bool has_mrr;
--	bool new_avg;
- 	u32 sample_switch;
- 	unsigned int cw_min;
- 	unsigned int cw_max;
diff --git a/package/kernel/mac80211/patches/subsys/340-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch b/package/kernel/mac80211/patches/subsys/340-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch
new file mode 100644
index 0000000000..82243f1d98
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/340-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch
@@ -0,0 +1,46 @@
+From aa40d5a43526cca9439a2b45fcfdcd016594dece Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Sun, 17 Jul 2022 21:21:52 +0900
+Subject: [PATCH] wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+lockdep complains use of uninitialized spinlock at ieee80211_do_stop() [1],
+for commit f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif
+that is being stopped") guards clear_bit() using fq.lock even before
+fq_init() from ieee80211_txq_setup_flows() initializes this spinlock.
+
+According to discussion [2], Toke was not happy with expanding usage of
+fq.lock. Since __ieee80211_wake_txqs() is called under RCU read lock, we
+can instead use synchronize_rcu() for flushing ieee80211_wake_txqs().
+
+Link: https://syzkaller.appspot.com/bug?extid=eceab52db7c4b961e9d6 [1]
+Link: https://lkml.kernel.org/r/874k0zowh2.fsf@toke.dk [2]
+Reported-by: syzbot <syzbot+eceab52db7c4b961e9d6@syzkaller.appspotmail.com>
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Fixes: f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif that is being stopped")
+Tested-by: syzbot <syzbot+eceab52db7c4b961e9d6@syzkaller.appspotmail.com>
+Acked-by: Toke Høiland-Jørgensen <toke@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/9cc9b81d-75a3-3925-b612-9d0ad3cab82b@I-love.SAKURA.ne.jp
+[ pick up commit 3598cb6e1862 ("wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop()") from -next]
+Link: https://lore.kernel.org/all/87o7xcq6qt.fsf@kernel.org/
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ net/mac80211/iface.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -377,9 +377,8 @@ static void ieee80211_do_stop(struct iee
+ 	bool cancel_scan;
+ 	struct cfg80211_nan_func *func;
+ 
+-	spin_lock_bh(&local->fq.lock);
+ 	clear_bit(SDATA_STATE_RUNNING, &sdata->state);
+-	spin_unlock_bh(&local->fq.lock);
++	synchronize_rcu(); /* flush _ieee80211_wake_txqs() */
+ 
+ 	cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
+ 	if (cancel_scan)
diff --git a/package/kernel/mac80211/patches/subsys/341-mac80211-minstrel_ht-improve-ampdu-length-estimation.patch b/package/kernel/mac80211/patches/subsys/341-mac80211-minstrel_ht-improve-ampdu-length-estimation.patch
deleted file mode 100644
index a8e6e89954..0000000000
--- a/package/kernel/mac80211/patches/subsys/341-mac80211-minstrel_ht-improve-ampdu-length-estimation.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 26 Dec 2020 19:08:19 +0100
-Subject: [PATCH] mac80211: minstrel_ht: improve ampdu length estimation
-
-If the driver does not report A-MPDU length, estimate it based on the rate.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -382,13 +382,37 @@ minstrel_get_ratestats(struct minstrel_h
- 	return &mi->groups[index / MCS_GROUP_RATES].rates[index % MCS_GROUP_RATES];
- }
- 
-+static inline int
-+minstrel_get_duration(int index)
-+{
-+	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
-+	unsigned int duration = group->duration[index % MCS_GROUP_RATES];
-+	return duration << group->shift;
-+}
-+
- static unsigned int
- minstrel_ht_avg_ampdu_len(struct minstrel_ht_sta *mi)
- {
--	if (!mi->avg_ampdu_len)
--		return AVG_AMPDU_SIZE;
-+	int duration;
-+
-+	if (mi->avg_ampdu_len)
-+		return MINSTREL_TRUNC(mi->avg_ampdu_len);
-+
-+	if (minstrel_ht_is_legacy_group(mi->max_tp_rate[0] / MCS_GROUP_RATES))
-+		return 1;
-+
-+	duration = minstrel_get_duration(mi->max_tp_rate[0]);
- 
--	return MINSTREL_TRUNC(mi->avg_ampdu_len);
-+	if (duration > 400 * 1000)
-+		return 2;
-+
-+	if (duration > 250 * 1000)
-+		return 4;
-+
-+	if (duration > 150 * 1000)
-+		return 8;
-+
-+	return 16;
- }
- 
- /*
-@@ -588,14 +612,6 @@ minstrel_ht_prob_rate_reduce_streams(str
- 	}
- }
- 
--static inline int
--minstrel_get_duration(int index)
--{
--	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
--	unsigned int duration = group->duration[index % MCS_GROUP_RATES];
--	return duration << group->shift;
--}
--
- static bool
- minstrel_ht_probe_group(struct minstrel_ht_sta *mi, const struct mcs_group *tp_group,
- 						int tp_idx, const struct mcs_group *group)
diff --git a/package/kernel/mac80211/patches/subsys/342-mac80211-minstrel_ht-improve-sample-rate-selection.patch b/package/kernel/mac80211/patches/subsys/342-mac80211-minstrel_ht-improve-sample-rate-selection.patch
deleted file mode 100644
index e084525235..0000000000
--- a/package/kernel/mac80211/patches/subsys/342-mac80211-minstrel_ht-improve-sample-rate-selection.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 26 Dec 2020 19:12:22 +0100
-Subject: [PATCH] mac80211: minstrel_ht: improve sample rate selection
-
-Always allow sampling of rates faster than the primary max throughput rate.
-When the second max_tp_rate is higher than the first one, sample attempts were
-previously skipped, potentially causing rate control to get stuck at a slightly
-lower rate
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -1379,13 +1379,13 @@ minstrel_get_sample_rate(struct minstrel
- 	mrs = &mg->rates[sample_idx];
- 	sample_idx += sample_group * MCS_GROUP_RATES;
- 
--	/* Set tp_rate1, tp_rate2 to the highest / second highest max_tp_rate */
-+	tp_rate1 = mi->max_tp_rate[0];
-+
-+	/* Set tp_rate2 to the second highest max_tp_rate */
- 	if (minstrel_get_duration(mi->max_tp_rate[0]) >
- 	    minstrel_get_duration(mi->max_tp_rate[1])) {
--		tp_rate1 = mi->max_tp_rate[1];
- 		tp_rate2 = mi->max_tp_rate[0];
- 	} else {
--		tp_rate1 = mi->max_tp_rate[0];
- 		tp_rate2 = mi->max_tp_rate[1];
- 	}
- 
diff --git a/package/kernel/mac80211/patches/subsys/343-mac80211-minstrel_ht-fix-max-probability-rate-select.patch b/package/kernel/mac80211/patches/subsys/343-mac80211-minstrel_ht-fix-max-probability-rate-select.patch
deleted file mode 100644
index 0dbfa9d4fb..0000000000
--- a/package/kernel/mac80211/patches/subsys/343-mac80211-minstrel_ht-fix-max-probability-rate-select.patch
+++ /dev/null
@@ -1,124 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 26 Dec 2020 19:09:08 +0100
-Subject: [PATCH] mac80211: minstrel_ht: fix max probability rate selection
-
-- do not select rates faster than the max throughput rate if probability is lower
-- reset previous rate before sorting again
-
-This ensures that the max prob rate gets set to a more reliable rate
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -495,12 +495,13 @@ minstrel_ht_sort_best_tp_rates(struct mi
-  * Find and set the topmost probability rate per sta and per group
-  */
- static void
--minstrel_ht_set_best_prob_rate(struct minstrel_ht_sta *mi, u16 index)
-+minstrel_ht_set_best_prob_rate(struct minstrel_ht_sta *mi, u16 *dest, u16 index)
- {
- 	struct minstrel_mcs_group_data *mg;
- 	struct minstrel_rate_stats *mrs;
- 	int tmp_group, tmp_idx, tmp_tp_avg, tmp_prob;
--	int max_tp_group, cur_tp_avg, cur_group, cur_idx;
-+	int max_tp_group, max_tp_idx, max_tp_prob;
-+	int cur_tp_avg, cur_group, cur_idx;
- 	int max_gpr_group, max_gpr_idx;
- 	int max_gpr_tp_avg, max_gpr_prob;
- 
-@@ -509,18 +510,26 @@ minstrel_ht_set_best_prob_rate(struct mi
- 	mg = &mi->groups[index / MCS_GROUP_RATES];
- 	mrs = &mg->rates[index % MCS_GROUP_RATES];
- 
--	tmp_group = mi->max_prob_rate / MCS_GROUP_RATES;
--	tmp_idx = mi->max_prob_rate % MCS_GROUP_RATES;
-+	tmp_group = *dest / MCS_GROUP_RATES;
-+	tmp_idx = *dest % MCS_GROUP_RATES;
- 	tmp_prob = mi->groups[tmp_group].rates[tmp_idx].prob_avg;
- 	tmp_tp_avg = minstrel_ht_get_tp_avg(mi, tmp_group, tmp_idx, tmp_prob);
- 
- 	/* if max_tp_rate[0] is from MCS_GROUP max_prob_rate get selected from
- 	 * MCS_GROUP as well as CCK_GROUP rates do not allow aggregation */
- 	max_tp_group = mi->max_tp_rate[0] / MCS_GROUP_RATES;
-+	max_tp_idx = mi->max_tp_rate[0] % MCS_GROUP_RATES;
-+	max_tp_prob = mi->groups[max_tp_group].rates[max_tp_idx].prob_avg;
-+
- 	if (minstrel_ht_is_legacy_group(index / MCS_GROUP_RATES) &&
- 	    !minstrel_ht_is_legacy_group(max_tp_group))
- 		return;
- 
-+	/* skip rates faster than max tp rate with lower prob */
-+	if (minstrel_get_duration(mi->max_tp_rate[0]) > minstrel_get_duration(index) &&
-+	    mrs->prob_avg < max_tp_prob)
-+		return;
-+
- 	max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
- 	max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
- 	max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_avg;
-@@ -538,7 +547,7 @@ minstrel_ht_set_best_prob_rate(struct mi
- 			mg->max_group_prob_rate = index;
- 	} else {
- 		if (mrs->prob_avg > tmp_prob)
--			mi->max_prob_rate = index;
-+			*dest = index;
- 		if (mrs->prob_avg > max_gpr_prob)
- 			mg->max_group_prob_rate = index;
- 	}
-@@ -816,7 +825,8 @@ minstrel_ht_update_stats(struct minstrel
- 	struct minstrel_rate_stats *mrs;
- 	int group, i, j, cur_prob;
- 	u16 tmp_mcs_tp_rate[MAX_THR_RATES], tmp_group_tp_rate[MAX_THR_RATES];
--	u16 tmp_legacy_tp_rate[MAX_THR_RATES], index;
-+	u16 tmp_legacy_tp_rate[MAX_THR_RATES], tmp_max_prob_rate;
-+	u16 index;
- 	bool ht_supported = mi->sta->ht_cap.ht_supported;
- 
- 	mi->sample_mode = MINSTREL_SAMPLE_IDLE;
-@@ -863,6 +873,7 @@ minstrel_ht_update_stats(struct minstrel
- 	else
- 		index = MINSTREL_OFDM_GROUP * MCS_GROUP_RATES;
- 
-+	tmp_max_prob_rate = index;
- 	for (j = 0; j < ARRAY_SIZE(tmp_mcs_tp_rate); j++)
- 		tmp_mcs_tp_rate[j] = index;
- 
-@@ -903,9 +914,6 @@ minstrel_ht_update_stats(struct minstrel
- 			/* Find max throughput rate set within a group */
- 			minstrel_ht_sort_best_tp_rates(mi, index,
- 						       tmp_group_tp_rate);
--
--			/* Find max probability rate per group and global */
--			minstrel_ht_set_best_prob_rate(mi, index);
- 		}
- 
- 		memcpy(mg->max_group_tp_rate, tmp_group_tp_rate,
-@@ -917,6 +925,27 @@ minstrel_ht_update_stats(struct minstrel
- 					 tmp_legacy_tp_rate);
- 	memcpy(mi->max_tp_rate, tmp_mcs_tp_rate, sizeof(mi->max_tp_rate));
- 
-+	for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
-+		if (!mi->supported[group])
-+			continue;
-+
-+		mg = &mi->groups[group];
-+		mg->max_group_prob_rate = MCS_GROUP_RATES * group;
-+
-+		for (i = 0; i < MCS_GROUP_RATES; i++) {
-+			if (!(mi->supported[group] & BIT(i)))
-+				continue;
-+
-+			index = MCS_GROUP_RATES * group + i;
-+
-+			/* Find max probability rate per group and global */
-+			minstrel_ht_set_best_prob_rate(mi, &tmp_max_prob_rate,
-+						       index);
-+		}
-+	}
-+
-+	mi->max_prob_rate = tmp_max_prob_rate;
-+
- 	/* Try to increase robustness of max_prob_rate*/
- 	minstrel_ht_prob_rate_reduce_streams(mi);
- 
diff --git a/package/kernel/mac80211/patches/subsys/344-mac80211-minstrel_ht-increase-stats-update-interval.patch b/package/kernel/mac80211/patches/subsys/344-mac80211-minstrel_ht-increase-stats-update-interval.patch
deleted file mode 100644
index 9972a9414e..0000000000
--- a/package/kernel/mac80211/patches/subsys/344-mac80211-minstrel_ht-increase-stats-update-interval.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 26 Dec 2020 19:14:58 +0100
-Subject: [PATCH] mac80211: minstrel_ht: increase stats update interval
-
-The shorter interval was leading to too many frames being used for probing
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -1865,7 +1865,7 @@ minstrel_ht_alloc(struct ieee80211_hw *h
- 		mp->has_mrr = true;
- 
- 	mp->hw = hw;
--	mp->update_interval = HZ / 20;
-+	mp->update_interval = HZ / 10;
- 
- 	minstrel_ht_init_cck_rates(mp);
- 	for (i = 0; i < ARRAY_SIZE(mp->hw->wiphy->bands); i++)
diff --git a/package/kernel/mac80211/patches/subsys/345-mac80211-minstrel_ht-fix-rounding-error-in-throughpu.patch b/package/kernel/mac80211/patches/subsys/345-mac80211-minstrel_ht-fix-rounding-error-in-throughpu.patch
deleted file mode 100644
index 1df5dec039..0000000000
--- a/package/kernel/mac80211/patches/subsys/345-mac80211-minstrel_ht-fix-rounding-error-in-throughpu.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 15 Jan 2021 12:15:06 +0100
-Subject: [PATCH] mac80211: minstrel_ht: fix rounding error in throughput
- calculation
-
-On lower data rates, the throughput calculation has a significant rounding
-error, causing rates like 48M and 54M OFDM to share the same throughput
-value with >= 90% success probablity.
-
-This is because the result of the division (prob_avg * 1000) / nsecs
-is really small (8 in this example).
-
-Improve accuracy by moving over some zeroes, making better use of the full
-range of u32 before the division.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -445,10 +445,9 @@ minstrel_ht_get_tp_avg(struct minstrel_h
- 	 * (prob is scaled - see MINSTREL_FRAC above)
- 	 */
- 	if (prob_avg > MINSTREL_FRAC(90, 100))
--		return MINSTREL_TRUNC(100000 * ((MINSTREL_FRAC(90, 100) * 1000)
--								      / nsecs));
--	else
--		return MINSTREL_TRUNC(100000 * ((prob_avg * 1000) / nsecs));
-+		prob_avg = MINSTREL_FRAC(90, 100);
-+
-+	return MINSTREL_TRUNC(100 * ((prob_avg * 1000000) / nsecs));
- }
- 
- /*
diff --git a/package/kernel/mac80211/patches/subsys/346-mac80211-minstrel_ht-use-bitfields-to-encode-rate-in.patch b/package/kernel/mac80211/patches/subsys/346-mac80211-minstrel_ht-use-bitfields-to-encode-rate-in.patch
deleted file mode 100644
index 6aa6f0ed93..0000000000
--- a/package/kernel/mac80211/patches/subsys/346-mac80211-minstrel_ht-use-bitfields-to-encode-rate-in.patch
+++ /dev/null
@@ -1,412 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Thu, 21 Jan 2021 18:29:30 +0100
-Subject: [PATCH] mac80211: minstrel_ht: use bitfields to encode rate
- indexes
-
-Get rid of a lot of divisions and modulo operations
-Reduces code size and improves performance
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -379,14 +379,14 @@ out:
- static inline struct minstrel_rate_stats *
- minstrel_get_ratestats(struct minstrel_ht_sta *mi, int index)
- {
--	return &mi->groups[index / MCS_GROUP_RATES].rates[index % MCS_GROUP_RATES];
-+	return &mi->groups[MI_RATE_GROUP(index)].rates[MI_RATE_IDX(index)];
- }
- 
--static inline int
--minstrel_get_duration(int index)
-+static inline int minstrel_get_duration(int index)
- {
--	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
--	unsigned int duration = group->duration[index % MCS_GROUP_RATES];
-+	const struct mcs_group *group = &minstrel_mcs_groups[MI_RATE_GROUP(index)];
-+	unsigned int duration = group->duration[MI_RATE_IDX(index)];
-+
- 	return duration << group->shift;
- }
- 
-@@ -398,7 +398,7 @@ minstrel_ht_avg_ampdu_len(struct minstre
- 	if (mi->avg_ampdu_len)
- 		return MINSTREL_TRUNC(mi->avg_ampdu_len);
- 
--	if (minstrel_ht_is_legacy_group(mi->max_tp_rate[0] / MCS_GROUP_RATES))
-+	if (minstrel_ht_is_legacy_group(MI_RATE_GROUP(mi->max_tp_rate[0])))
- 		return 1;
- 
- 	duration = minstrel_get_duration(mi->max_tp_rate[0]);
-@@ -465,14 +465,14 @@ minstrel_ht_sort_best_tp_rates(struct mi
- 	int tmp_group, tmp_idx, tmp_tp_avg, tmp_prob;
- 	int j = MAX_THR_RATES;
- 
--	cur_group = index / MCS_GROUP_RATES;
--	cur_idx = index  % MCS_GROUP_RATES;
-+	cur_group = MI_RATE_GROUP(index);
-+	cur_idx = MI_RATE_IDX(index);
- 	cur_prob = mi->groups[cur_group].rates[cur_idx].prob_avg;
- 	cur_tp_avg = minstrel_ht_get_tp_avg(mi, cur_group, cur_idx, cur_prob);
- 
- 	do {
--		tmp_group = tp_list[j - 1] / MCS_GROUP_RATES;
--		tmp_idx = tp_list[j - 1] % MCS_GROUP_RATES;
-+		tmp_group = MI_RATE_GROUP(tp_list[j - 1]);
-+		tmp_idx = MI_RATE_IDX(tp_list[j - 1]);
- 		tmp_prob = mi->groups[tmp_group].rates[tmp_idx].prob_avg;
- 		tmp_tp_avg = minstrel_ht_get_tp_avg(mi, tmp_group, tmp_idx,
- 						    tmp_prob);
-@@ -504,23 +504,23 @@ minstrel_ht_set_best_prob_rate(struct mi
- 	int max_gpr_group, max_gpr_idx;
- 	int max_gpr_tp_avg, max_gpr_prob;
- 
--	cur_group = index / MCS_GROUP_RATES;
--	cur_idx = index % MCS_GROUP_RATES;
--	mg = &mi->groups[index / MCS_GROUP_RATES];
--	mrs = &mg->rates[index % MCS_GROUP_RATES];
-+	cur_group = MI_RATE_GROUP(index);
-+	cur_idx = MI_RATE_IDX(index);
-+	mg = &mi->groups[cur_group];
-+	mrs = &mg->rates[cur_idx];
- 
--	tmp_group = *dest / MCS_GROUP_RATES;
--	tmp_idx = *dest % MCS_GROUP_RATES;
-+	tmp_group = MI_RATE_GROUP(*dest);
-+	tmp_idx = MI_RATE_IDX(*dest);
- 	tmp_prob = mi->groups[tmp_group].rates[tmp_idx].prob_avg;
- 	tmp_tp_avg = minstrel_ht_get_tp_avg(mi, tmp_group, tmp_idx, tmp_prob);
- 
- 	/* if max_tp_rate[0] is from MCS_GROUP max_prob_rate get selected from
- 	 * MCS_GROUP as well as CCK_GROUP rates do not allow aggregation */
--	max_tp_group = mi->max_tp_rate[0] / MCS_GROUP_RATES;
--	max_tp_idx = mi->max_tp_rate[0] % MCS_GROUP_RATES;
-+	max_tp_group = MI_RATE_GROUP(mi->max_tp_rate[0]);
-+	max_tp_idx = MI_RATE_IDX(mi->max_tp_rate[0]);
- 	max_tp_prob = mi->groups[max_tp_group].rates[max_tp_idx].prob_avg;
- 
--	if (minstrel_ht_is_legacy_group(index / MCS_GROUP_RATES) &&
-+	if (minstrel_ht_is_legacy_group(MI_RATE_GROUP(index)) &&
- 	    !minstrel_ht_is_legacy_group(max_tp_group))
- 		return;
- 
-@@ -529,8 +529,8 @@ minstrel_ht_set_best_prob_rate(struct mi
- 	    mrs->prob_avg < max_tp_prob)
- 		return;
- 
--	max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
--	max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
-+	max_gpr_group = MI_RATE_GROUP(mg->max_group_prob_rate);
-+	max_gpr_idx = MI_RATE_IDX(mg->max_group_prob_rate);
- 	max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_avg;
- 
- 	if (mrs->prob_avg > MINSTREL_FRAC(75, 100)) {
-@@ -567,13 +567,13 @@ minstrel_ht_assign_best_tp_rates(struct
- 	unsigned int tmp_group, tmp_idx, tmp_cck_tp, tmp_mcs_tp, tmp_prob;
- 	int i;
- 
--	tmp_group = tmp_legacy_tp_rate[0] / MCS_GROUP_RATES;
--	tmp_idx = tmp_legacy_tp_rate[0] % MCS_GROUP_RATES;
-+	tmp_group = MI_RATE_GROUP(tmp_legacy_tp_rate[0]);
-+	tmp_idx = MI_RATE_IDX(tmp_legacy_tp_rate[0]);
- 	tmp_prob = mi->groups[tmp_group].rates[tmp_idx].prob_avg;
- 	tmp_cck_tp = minstrel_ht_get_tp_avg(mi, tmp_group, tmp_idx, tmp_prob);
- 
--	tmp_group = tmp_mcs_tp_rate[0] / MCS_GROUP_RATES;
--	tmp_idx = tmp_mcs_tp_rate[0] % MCS_GROUP_RATES;
-+	tmp_group = MI_RATE_GROUP(tmp_mcs_tp_rate[0]);
-+	tmp_idx = MI_RATE_IDX(tmp_mcs_tp_rate[0]);
- 	tmp_prob = mi->groups[tmp_group].rates[tmp_idx].prob_avg;
- 	tmp_mcs_tp = minstrel_ht_get_tp_avg(mi, tmp_group, tmp_idx, tmp_prob);
- 
-@@ -600,14 +600,14 @@ minstrel_ht_prob_rate_reduce_streams(str
- 	if (!mi->sta->ht_cap.ht_supported)
- 		return;
- 
--	tmp_max_streams = minstrel_mcs_groups[mi->max_tp_rate[0] /
--			  MCS_GROUP_RATES].streams;
-+	group = MI_RATE_GROUP(mi->max_tp_rate[0]);
-+	tmp_max_streams = minstrel_mcs_groups[group].streams;
- 	for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
- 		mg = &mi->groups[group];
- 		if (!mi->supported[group] || group == MINSTREL_CCK_GROUP)
- 			continue;
- 
--		tmp_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
-+		tmp_idx = MI_RATE_IDX(mg->max_group_prob_rate);
- 		tmp_prob = mi->groups[group].rates[tmp_idx].prob_avg;
- 
- 		if (tmp_tp < minstrel_ht_get_tp_avg(mi, group, tmp_idx, tmp_prob) &&
-@@ -644,8 +644,8 @@ minstrel_ht_find_probe_rates(struct mins
- 	int i, g, max_dur;
- 	int tp_idx;
- 
--	tp_group = &minstrel_mcs_groups[mi->max_tp_rate[0] / MCS_GROUP_RATES];
--	tp_idx = mi->max_tp_rate[0] % MCS_GROUP_RATES;
-+	tp_group = &minstrel_mcs_groups[MI_RATE_GROUP(mi->max_tp_rate[0])];
-+	tp_idx = MI_RATE_IDX(mi->max_tp_rate[0]);
- 
- 	max_dur = minstrel_get_duration(mi->max_tp_rate[0]);
- 	if (faster_rate)
-@@ -670,7 +670,7 @@ minstrel_ht_find_probe_rates(struct mins
- 			if ((group->duration[i] << group->shift) > max_dur)
- 				continue;
- 
--			idx = g * MCS_GROUP_RATES + i;
-+			idx = MI_RATE(g, i);
- 			if (idx == mi->max_tp_rate[0])
- 				continue;
- 
-@@ -712,10 +712,10 @@ minstrel_ht_rate_sample_switch(struct mi
- 
- 	/* If no suitable rate was found, try to pick the next one in the group */
- 	if (!n_rates) {
--		int g_idx = mi->max_tp_rate[0] / MCS_GROUP_RATES;
-+		int g_idx = MI_RATE_GROUP(mi->max_tp_rate[0]);
- 		u16 supported = mi->supported[g_idx];
- 
--		supported >>= mi->max_tp_rate[0] % MCS_GROUP_RATES;
-+		supported >>= MI_RATE_IDX(mi->max_tp_rate[0]);
- 		for (i = 0; supported; supported >>= 1, i++) {
- 			if (!(supported & 1))
- 				continue;
-@@ -854,24 +854,27 @@ minstrel_ht_update_stats(struct minstrel
- 	mi->sample_slow = 0;
- 	mi->sample_count = 0;
- 
--	memset(tmp_mcs_tp_rate, 0, sizeof(tmp_mcs_tp_rate));
--	memset(tmp_legacy_tp_rate, 0, sizeof(tmp_legacy_tp_rate));
- 	if (mi->supported[MINSTREL_CCK_GROUP])
--		for (j = 0; j < ARRAY_SIZE(tmp_legacy_tp_rate); j++)
--			tmp_legacy_tp_rate[j] = MINSTREL_CCK_GROUP * MCS_GROUP_RATES;
-+		group = MINSTREL_CCK_GROUP;
- 	else if (mi->supported[MINSTREL_OFDM_GROUP])
--		for (j = 0; j < ARRAY_SIZE(tmp_legacy_tp_rate); j++)
--			tmp_legacy_tp_rate[j] = MINSTREL_OFDM_GROUP * MCS_GROUP_RATES;
-+		group = MINSTREL_OFDM_GROUP;
-+	else
-+		group = 0;
-+
-+	index = MI_RATE(group, 0);
-+	for (j = 0; j < ARRAY_SIZE(tmp_legacy_tp_rate); j++)
-+		tmp_legacy_tp_rate[j] = index;
- 
- 	if (mi->supported[MINSTREL_VHT_GROUP_0])
--		index = MINSTREL_VHT_GROUP_0 * MCS_GROUP_RATES;
-+		group = MINSTREL_VHT_GROUP_0;
- 	else if (ht_supported)
--		index = MINSTREL_HT_GROUP_0 * MCS_GROUP_RATES;
-+		group = MINSTREL_HT_GROUP_0;
- 	else if (mi->supported[MINSTREL_CCK_GROUP])
--		index = MINSTREL_CCK_GROUP * MCS_GROUP_RATES;
-+		group = MINSTREL_CCK_GROUP;
- 	else
--		index = MINSTREL_OFDM_GROUP * MCS_GROUP_RATES;
-+		group = MINSTREL_OFDM_GROUP;
- 
-+	index = MI_RATE(group, 0);
- 	tmp_max_prob_rate = index;
- 	for (j = 0; j < ARRAY_SIZE(tmp_mcs_tp_rate); j++)
- 		tmp_mcs_tp_rate[j] = index;
-@@ -888,7 +891,7 @@ minstrel_ht_update_stats(struct minstrel
- 
- 		/* (re)Initialize group rate indexes */
- 		for(j = 0; j < MAX_THR_RATES; j++)
--			tmp_group_tp_rate[j] = MCS_GROUP_RATES * group;
-+			tmp_group_tp_rate[j] = MI_RATE(group, 0);
- 
- 		if (group == MINSTREL_CCK_GROUP && ht_supported)
- 			tp_rate = tmp_legacy_tp_rate;
-@@ -897,7 +900,7 @@ minstrel_ht_update_stats(struct minstrel
- 			if (!(mi->supported[group] & BIT(i)))
- 				continue;
- 
--			index = MCS_GROUP_RATES * group + i;
-+			index = MI_RATE(group, i);
- 
- 			mrs = &mg->rates[i];
- 			mrs->retry_updated = false;
-@@ -929,13 +932,13 @@ minstrel_ht_update_stats(struct minstrel
- 			continue;
- 
- 		mg = &mi->groups[group];
--		mg->max_group_prob_rate = MCS_GROUP_RATES * group;
-+		mg->max_group_prob_rate = MI_RATE(group, 0);
- 
- 		for (i = 0; i < MCS_GROUP_RATES; i++) {
- 			if (!(mi->supported[group] & BIT(i)))
- 				continue;
- 
--			index = MCS_GROUP_RATES * group + i;
-+			index = MI_RATE(group, i);
- 
- 			/* Find max probability rate per group and global */
- 			minstrel_ht_set_best_prob_rate(mi, &tmp_max_prob_rate,
-@@ -1022,7 +1025,7 @@ minstrel_downgrade_rate(struct minstrel_
- {
- 	int group, orig_group;
- 
--	orig_group = group = *idx / MCS_GROUP_RATES;
-+	orig_group = group = MI_RATE_GROUP(*idx);
- 	while (group > 0) {
- 		group--;
- 
-@@ -1206,7 +1209,7 @@ minstrel_calc_retransmit(struct minstrel
- 	ctime += (t_slot * cw) >> 1;
- 	cw = min((cw << 1) | 1, mp->cw_max);
- 
--	if (minstrel_ht_is_legacy_group(index / MCS_GROUP_RATES)) {
-+	if (minstrel_ht_is_legacy_group(MI_RATE_GROUP(index))) {
- 		overhead = mi->overhead_legacy;
- 		overhead_rtscts = mi->overhead_legacy_rtscts;
- 	} else {
-@@ -1239,7 +1242,7 @@ static void
- minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
-                      struct ieee80211_sta_rates *ratetbl, int offset, int index)
- {
--	int group_idx = index / MCS_GROUP_RATES;
-+	int group_idx = MI_RATE_GROUP(index);
- 	const struct mcs_group *group = &minstrel_mcs_groups[group_idx];
- 	struct minstrel_rate_stats *mrs;
- 	u8 idx;
-@@ -1259,7 +1262,7 @@ minstrel_ht_set_rate(struct minstrel_pri
- 		ratetbl->rate[offset].count_rts = mrs->retry_count_rtscts;
- 	}
- 
--	index %= MCS_GROUP_RATES;
-+	index = MI_RATE_IDX(index);
- 	if (group_idx == MINSTREL_CCK_GROUP)
- 		idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
- 	else if (group_idx == MINSTREL_OFDM_GROUP)
-@@ -1289,17 +1292,17 @@ minstrel_ht_set_rate(struct minstrel_pri
- static inline int
- minstrel_ht_get_prob_avg(struct minstrel_ht_sta *mi, int rate)
- {
--	int group = rate / MCS_GROUP_RATES;
--	rate %= MCS_GROUP_RATES;
-+	int group = MI_RATE_GROUP(rate);
-+	rate = MI_RATE_IDX(rate);
- 	return mi->groups[group].rates[rate].prob_avg;
- }
- 
- static int
- minstrel_ht_get_max_amsdu_len(struct minstrel_ht_sta *mi)
- {
--	int group = mi->max_prob_rate / MCS_GROUP_RATES;
-+	int group = MI_RATE_GROUP(mi->max_prob_rate);
- 	const struct mcs_group *g = &minstrel_mcs_groups[group];
--	int rate = mi->max_prob_rate % MCS_GROUP_RATES;
-+	int rate = MI_RATE_IDX(mi->max_prob_rate);
- 	unsigned int duration;
- 
- 	/* Disable A-MSDU if max_prob_rate is bad */
-@@ -1405,7 +1408,7 @@ minstrel_get_sample_rate(struct minstrel
- 		return -1;
- 
- 	mrs = &mg->rates[sample_idx];
--	sample_idx += sample_group * MCS_GROUP_RATES;
-+	sample_idx += MI_RATE(sample_group, 0);
- 
- 	tp_rate1 = mi->max_tp_rate[0];
- 
-@@ -1455,8 +1458,7 @@ minstrel_get_sample_rate(struct minstrel
- 	 * if the link is working perfectly.
- 	 */
- 
--	cur_max_tp_streams = minstrel_mcs_groups[tp_rate1 /
--		MCS_GROUP_RATES].streams;
-+	cur_max_tp_streams = minstrel_mcs_groups[MI_RATE_GROUP(tp_rate1)].streams;
- 	if (sample_dur >= minstrel_get_duration(tp_rate2) &&
- 	    (cur_max_tp_streams - 1 <
- 	     minstrel_mcs_groups[sample_group].streams ||
-@@ -1484,7 +1486,7 @@ minstrel_ht_get_rate(void *priv, struct
- 	int sample_idx;
- 
- 	if (!(info->flags & IEEE80211_TX_CTL_AMPDU) &&
--	    !minstrel_ht_is_legacy_group(mi->max_prob_rate / MCS_GROUP_RATES))
-+	    !minstrel_ht_is_legacy_group(MI_RATE_GROUP(mi->max_prob_rate)))
- 		minstrel_aggr_check(sta, txrc->skb);
- 
- 	info->flags |= mi->tx_flags;
-@@ -1512,8 +1514,8 @@ minstrel_ht_get_rate(void *priv, struct
- 	if (sample_idx < 0)
- 		return;
- 
--	sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
--	sample_idx %= MCS_GROUP_RATES;
-+	sample_group = &minstrel_mcs_groups[MI_RATE_GROUP(sample_idx)];
-+	sample_idx = MI_RATE_IDX(sample_idx);
- 
- 	if (sample_group == &minstrel_mcs_groups[MINSTREL_CCK_GROUP] &&
- 	    (sample_idx >= 4) != txrc->short_preamble)
-@@ -1529,7 +1531,7 @@ minstrel_ht_get_rate(void *priv, struct
- 		int idx = sample_idx % ARRAY_SIZE(mp->ofdm_rates[0]);
- 		rate->idx = mp->ofdm_rates[mi->band][idx];
- 	} else if (sample_group->flags & IEEE80211_TX_RC_VHT_MCS) {
--		ieee80211_rate_set_vht(rate, sample_idx % MCS_GROUP_RATES,
-+		ieee80211_rate_set_vht(rate, MI_RATE_IDX(sample_idx),
- 				       sample_group->streams);
- 	} else {
- 		rate->idx = sample_idx + (sample_group->streams - 1) * 8;
-@@ -1898,8 +1900,8 @@ static u32 minstrel_ht_get_expected_thro
- 	struct minstrel_ht_sta *mi = priv_sta;
- 	int i, j, prob, tp_avg;
- 
--	i = mi->max_tp_rate[0] / MCS_GROUP_RATES;
--	j = mi->max_tp_rate[0] % MCS_GROUP_RATES;
-+	i = MI_RATE_GROUP(mi->max_tp_rate[0]);
-+	j = MI_RATE_IDX(mi->max_tp_rate[0]);
- 	prob = mi->groups[i].rates[j].prob_avg;
- 
- 	/* convert tp_avg from pkt per second in kbps */
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -6,6 +6,8 @@
- #ifndef __RC_MINSTREL_HT_H
- #define __RC_MINSTREL_HT_H
- 
-+#include <linux/bitfield.h>
-+
- /* number of highest throughput rates to consider*/
- #define MAX_THR_RATES 4
- #define SAMPLE_COLUMNS	10	/* number of columns in sample table */
-@@ -57,6 +59,17 @@
- 
- #define MCS_GROUP_RATES		10
- 
-+#define MI_RATE_IDX_MASK	GENMASK(3, 0)
-+#define MI_RATE_GROUP_MASK	GENMASK(15, 4)
-+
-+#define MI_RATE(_group, _idx)				\
-+	(FIELD_PREP(MI_RATE_GROUP_MASK, _group) |	\
-+	 FIELD_PREP(MI_RATE_IDX_MASK, _idx))
-+
-+#define MI_RATE_IDX(_rate) FIELD_GET(MI_RATE_IDX_MASK, _rate)
-+#define MI_RATE_GROUP(_rate) FIELD_GET(MI_RATE_GROUP_MASK, _rate)
-+
-+
- struct minstrel_priv {
- 	struct ieee80211_hw *hw;
- 	bool has_mrr;
---- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
-+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
-@@ -56,7 +56,7 @@ minstrel_ht_stats_dump(struct minstrel_h
- 
- 	for (j = 0; j < MCS_GROUP_RATES; j++) {
- 		struct minstrel_rate_stats *mrs = &mi->groups[i].rates[j];
--		int idx = i * MCS_GROUP_RATES + j;
-+		int idx = MI_RATE(i, j);
- 		unsigned int duration;
- 
- 		if (!(mi->supported[i] & BIT(j)))
-@@ -201,7 +201,7 @@ minstrel_ht_stats_csv_dump(struct minstr
- 
- 	for (j = 0; j < MCS_GROUP_RATES; j++) {
- 		struct minstrel_rate_stats *mrs = &mi->groups[i].rates[j];
--		int idx = i * MCS_GROUP_RATES + j;
-+		int idx = MI_RATE(i, j);
- 		unsigned int duration;
- 
- 		if (!(mi->supported[i] & BIT(j)))
diff --git a/package/kernel/mac80211/patches/subsys/347-mac80211-minstrel_ht-update-total-packets-counter-in.patch b/package/kernel/mac80211/patches/subsys/347-mac80211-minstrel_ht-update-total-packets-counter-in.patch
deleted file mode 100644
index dce8104934..0000000000
--- a/package/kernel/mac80211/patches/subsys/347-mac80211-minstrel_ht-update-total-packets-counter-in.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 22 Jan 2021 18:21:13 +0100
-Subject: [PATCH] mac80211: minstrel_ht: update total packets counter in tx
- status path
-
-Keep the update in one place and prepare for further rework
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -1092,6 +1092,16 @@ minstrel_ht_tx_status(void *priv, struct
- 		info->status.ampdu_len = 1;
- 	}
- 
-+	/* wraparound */
-+	if (mi->total_packets >= ~0 - info->status.ampdu_len) {
-+		mi->total_packets = 0;
-+		mi->sample_packets = 0;
-+	}
-+
-+	mi->total_packets += info->status.ampdu_len;
-+	if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
-+		mi->sample_packets += info->status.ampdu_len;
-+
- 	mi->ampdu_packets++;
- 	mi->ampdu_len += info->status.ampdu_len;
- 
-@@ -1103,9 +1113,6 @@ minstrel_ht_tx_status(void *priv, struct
- 		mi->sample_count--;
- 	}
- 
--	if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
--		mi->sample_packets += info->status.ampdu_len;
--
- 	if (mi->sample_mode != MINSTREL_SAMPLE_IDLE)
- 		rate_sample = minstrel_get_ratestats(mi, mi->sample_rate);
- 
-@@ -1503,14 +1510,6 @@ minstrel_ht_get_rate(void *priv, struct
- 	else
- 		sample_idx = minstrel_get_sample_rate(mp, mi);
- 
--	mi->total_packets++;
--
--	/* wraparound */
--	if (mi->total_packets == ~0) {
--		mi->total_packets = 0;
--		mi->sample_packets = 0;
--	}
--
- 	if (sample_idx < 0)
- 		return;
- 
diff --git a/package/kernel/mac80211/patches/subsys/348-mac80211-minstrel_ht-reduce-the-need-to-sample-slowe.patch b/package/kernel/mac80211/patches/subsys/348-mac80211-minstrel_ht-reduce-the-need-to-sample-slowe.patch
deleted file mode 100644
index dc6f11e4b9..0000000000
--- a/package/kernel/mac80211/patches/subsys/348-mac80211-minstrel_ht-reduce-the-need-to-sample-slowe.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 22 Jan 2021 19:24:59 +0100
-Subject: [PATCH] mac80211: minstrel_ht: reduce the need to sample slower
- rates
-
-In order to more gracefully be able to fall back to lower rates without too
-much throughput fluctuations, initialize all untested rates below tested ones
-to the maximum probabilty of higher rates.
-Usually this leads to untested lower rates getting initialized with a
-probability value of 100%, making them better candidates for fallback without
-having to rely on random probing
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -791,14 +791,11 @@ minstrel_ht_calc_rate_stats(struct minst
- 	unsigned int cur_prob;
- 
- 	if (unlikely(mrs->attempts > 0)) {
--		mrs->sample_skipped = 0;
- 		cur_prob = MINSTREL_FRAC(mrs->success, mrs->attempts);
- 		minstrel_filter_avg_add(&mrs->prob_avg,
- 					&mrs->prob_avg_1, cur_prob);
- 		mrs->att_hist += mrs->attempts;
- 		mrs->succ_hist += mrs->success;
--	} else {
--		mrs->sample_skipped++;
- 	}
- 
- 	mrs->last_success = mrs->success;
-@@ -851,7 +848,6 @@ minstrel_ht_update_stats(struct minstrel
- 		mi->ampdu_packets = 0;
- 	}
- 
--	mi->sample_slow = 0;
- 	mi->sample_count = 0;
- 
- 	if (mi->supported[MINSTREL_CCK_GROUP])
-@@ -882,6 +878,7 @@ minstrel_ht_update_stats(struct minstrel
- 	/* Find best rate sets within all MCS groups*/
- 	for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
- 		u16 *tp_rate = tmp_mcs_tp_rate;
-+		u16 last_prob = 0;
- 
- 		mg = &mi->groups[group];
- 		if (!mi->supported[group])
-@@ -896,7 +893,7 @@ minstrel_ht_update_stats(struct minstrel
- 		if (group == MINSTREL_CCK_GROUP && ht_supported)
- 			tp_rate = tmp_legacy_tp_rate;
- 
--		for (i = 0; i < MCS_GROUP_RATES; i++) {
-+		for (i = MCS_GROUP_RATES - 1; i >= 0; i--) {
- 			if (!(mi->supported[group] & BIT(i)))
- 				continue;
- 
-@@ -905,6 +902,11 @@ minstrel_ht_update_stats(struct minstrel
- 			mrs = &mg->rates[i];
- 			mrs->retry_updated = false;
- 			minstrel_ht_calc_rate_stats(mp, mrs);
-+
-+			if (mrs->att_hist)
-+				last_prob = max(last_prob, mrs->prob_avg);
-+			else
-+				mrs->prob_avg = max(last_prob, mrs->prob_avg);
- 			cur_prob = mrs->prob_avg;
- 
- 			if (minstrel_ht_get_tp_avg(mi, group, i, cur_prob) == 0)
-@@ -1469,13 +1471,9 @@ minstrel_get_sample_rate(struct minstrel
- 	if (sample_dur >= minstrel_get_duration(tp_rate2) &&
- 	    (cur_max_tp_streams - 1 <
- 	     minstrel_mcs_groups[sample_group].streams ||
--	     sample_dur >= minstrel_get_duration(mi->max_prob_rate))) {
--		if (mrs->sample_skipped < 20)
-+	     sample_dur >= minstrel_get_duration(mi->max_prob_rate)))
- 			return -1;
- 
--		if (mi->sample_slow++ > 2)
--			return -1;
--	}
- 	mi->sample_tries--;
- 
- 	return sample_idx;
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -123,7 +123,6 @@ struct minstrel_rate_stats {
- 	u8 retry_count;
- 	u8 retry_count_rtscts;
- 
--	u8 sample_skipped;
- 	bool retry_updated;
- };
- 
-@@ -179,7 +178,6 @@ struct minstrel_ht_sta {
- 	u8 sample_wait;
- 	u8 sample_tries;
- 	u8 sample_count;
--	u8 sample_slow;
- 
- 	enum minstrel_sample_mode sample_mode;
- 	u16 sample_rate;
diff --git a/package/kernel/mac80211/patches/subsys/349-mac80211-minstrel_ht-significantly-redesign-the-rate.patch b/package/kernel/mac80211/patches/subsys/349-mac80211-minstrel_ht-significantly-redesign-the-rate.patch
deleted file mode 100644
index 09f6fd2214..0000000000
--- a/package/kernel/mac80211/patches/subsys/349-mac80211-minstrel_ht-significantly-redesign-the-rate.patch
+++ /dev/null
@@ -1,767 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 22 Jan 2021 23:57:50 +0100
-Subject: [PATCH] mac80211: minstrel_ht: significantly redesign the rate
- probing strategy
-
-The biggest flaw in current minstrel_ht is the fact that it needs way too
-many probing packets to be able to quickly find the best rate.
-Depending on the wifi hardware and operating mode, this can significantly
-reduce throughput when not operating at the highest available data rate.
-
-In order to be able to significantly reduce the amount of rate sampling,
-we need a much smarter selection of probing rates.
-
-The new approach introduced by this patch maintains a limited set of
-available rates to be tested during a statistics window.
-
-They are split into distinct categories:
-- MINSTREL_SAMPLE_TYPE_INC - incremental rate upgrade:
-  Pick the next rate group and find the first rate that is faster than
-  the current max. throughput rate
-- MINSTREL_SAMPLE_TYPE_JUMP - random testing of higher rates:
-  Pick a random rate from the next group that is faster than the current
-  max throughput rate. This allows faster adaptation when the link changes
-  significantly
-- MINSTREL_SAMPLE_TYPE_SLOW - test a rate between max_prob, max_tp2 and
-  max_tp in order to reduce the gap between them
-
-In order to prioritize sampling, every 6 attempts are split into 3x INC,
-2x JUMP, 1x SLOW.
-
-Available rates are checked and refilled on every stats window update.
-
-With this approach, we finally get a very small delta in throughput when
-comparing setting the optimal data rate as a fixed rate vs normal rate
-control operation.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -266,6 +266,14 @@ const struct mcs_group minstrel_mcs_grou
- const s16 minstrel_cck_bitrates[4] = { 10, 20, 55, 110 };
- const s16 minstrel_ofdm_bitrates[8] = { 60, 90, 120, 180, 240, 360, 480, 540 };
- static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES] __read_mostly;
-+static const u8 minstrel_sample_seq[] = {
-+	MINSTREL_SAMPLE_TYPE_INC,
-+	MINSTREL_SAMPLE_TYPE_JUMP,
-+	MINSTREL_SAMPLE_TYPE_INC,
-+	MINSTREL_SAMPLE_TYPE_JUMP,
-+	MINSTREL_SAMPLE_TYPE_INC,
-+	MINSTREL_SAMPLE_TYPE_SLOW,
-+};
- 
- static void
- minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi);
-@@ -620,77 +628,31 @@ minstrel_ht_prob_rate_reduce_streams(str
- 	}
- }
- 
--static bool
--minstrel_ht_probe_group(struct minstrel_ht_sta *mi, const struct mcs_group *tp_group,
--						int tp_idx, const struct mcs_group *group)
--{
--	if (group->bw < tp_group->bw)
--		return false;
--
--	if (group->streams == tp_group->streams)
--		return true;
--
--	if (tp_idx < 4 && group->streams == tp_group->streams - 1)
--		return true;
--
--	return group->streams == tp_group->streams + 1;
--}
--
--static void
--minstrel_ht_find_probe_rates(struct minstrel_ht_sta *mi, u16 *rates, int *n_rates,
--			     bool faster_rate)
-+static u16
-+__minstrel_ht_get_sample_rate(struct minstrel_ht_sta *mi,
-+			      enum minstrel_sample_type type)
- {
--	const struct mcs_group *group, *tp_group;
--	int i, g, max_dur;
--	int tp_idx;
--
--	tp_group = &minstrel_mcs_groups[MI_RATE_GROUP(mi->max_tp_rate[0])];
--	tp_idx = MI_RATE_IDX(mi->max_tp_rate[0]);
--
--	max_dur = minstrel_get_duration(mi->max_tp_rate[0]);
--	if (faster_rate)
--		max_dur -= max_dur / 16;
--
--	for (g = 0; g < MINSTREL_GROUPS_NB; g++) {
--		u16 supported = mi->supported[g];
--
--		if (!supported)
--			continue;
-+	u16 *rates = mi->sample[type].sample_rates;
-+	u16 cur;
-+	int i;
- 
--		group = &minstrel_mcs_groups[g];
--		if (!minstrel_ht_probe_group(mi, tp_group, tp_idx, group))
-+	for (i = 0; i < MINSTREL_SAMPLE_RATES; i++) {
-+		if (!rates[i])
- 			continue;
- 
--		for (i = 0; supported; supported >>= 1, i++) {
--			int idx;
--
--			if (!(supported & 1))
--				continue;
--
--			if ((group->duration[i] << group->shift) > max_dur)
--				continue;
--
--			idx = MI_RATE(g, i);
--			if (idx == mi->max_tp_rate[0])
--				continue;
--
--			rates[(*n_rates)++] = idx;
--			break;
--		}
-+		cur = rates[i];
-+		rates[i] = 0;
-+		return cur;
- 	}
-+
-+	return 0;
- }
- 
- static void
- minstrel_ht_rate_sample_switch(struct minstrel_priv *mp,
- 			       struct minstrel_ht_sta *mi)
- {
--	struct minstrel_rate_stats *mrs;
--	u16 rates[MINSTREL_GROUPS_NB];
--	int n_rates = 0;
--	int probe_rate = 0;
--	bool faster_rate;
--	int i;
--	u8 random;
-+	u16 rate;
- 
- 	/*
- 	 * Use rate switching instead of probing packets for devices with
-@@ -699,43 +661,11 @@ minstrel_ht_rate_sample_switch(struct mi
- 	if (mp->hw->max_rates > 1)
- 		return;
- 
--	/*
--	 * If the current EWMA prob is >75%, look for a rate that's 6.25%
--	 * faster than the max tp rate.
--	 * If that fails, look again for a rate that is at least as fast
--	 */
--	mrs = minstrel_get_ratestats(mi, mi->max_tp_rate[0]);
--	faster_rate = mrs->prob_avg > MINSTREL_FRAC(75, 100);
--	minstrel_ht_find_probe_rates(mi, rates, &n_rates, faster_rate);
--	if (!n_rates && faster_rate)
--		minstrel_ht_find_probe_rates(mi, rates, &n_rates, false);
--
--	/* If no suitable rate was found, try to pick the next one in the group */
--	if (!n_rates) {
--		int g_idx = MI_RATE_GROUP(mi->max_tp_rate[0]);
--		u16 supported = mi->supported[g_idx];
--
--		supported >>= MI_RATE_IDX(mi->max_tp_rate[0]);
--		for (i = 0; supported; supported >>= 1, i++) {
--			if (!(supported & 1))
--				continue;
--
--			probe_rate = mi->max_tp_rate[0] + i;
--			goto out;
--		}
--
-+	rate = __minstrel_ht_get_sample_rate(mi, MINSTREL_SAMPLE_TYPE_INC);
-+	if (!rate)
- 		return;
--	}
--
--	i = 0;
--	if (n_rates > 1) {
--		random = prandom_u32();
--		i = random % n_rates;
--	}
--	probe_rate = rates[i];
- 
--out:
--	mi->sample_rate = probe_rate;
-+	mi->sample_rate = rate;
- 	mi->sample_mode = MINSTREL_SAMPLE_ACTIVE;
- }
- 
-@@ -804,6 +734,274 @@ minstrel_ht_calc_rate_stats(struct minst
- 	mrs->attempts = 0;
- }
- 
-+static bool
-+minstrel_ht_find_sample_rate(struct minstrel_ht_sta *mi, int type, int idx)
-+{
-+	int i;
-+
-+	for (i = 0; i < MINSTREL_SAMPLE_RATES; i++) {
-+		u16 cur = mi->sample[type].sample_rates[i];
-+
-+		if (cur == idx)
-+			return true;
-+
-+		if (!cur)
-+			break;
-+	}
-+
-+	return false;
-+}
-+
-+static int
-+minstrel_ht_move_sample_rates(struct minstrel_ht_sta *mi, int type,
-+			      u32 fast_rate_dur, u32 slow_rate_dur)
-+{
-+	u16 *rates = mi->sample[type].sample_rates;
-+	int i, j;
-+
-+	for (i = 0, j = 0; i < MINSTREL_SAMPLE_RATES; i++) {
-+		u32 duration;
-+		bool valid = false;
-+		u16 cur;
-+
-+		cur = rates[i];
-+		if (!cur)
-+			continue;
-+
-+		duration = minstrel_get_duration(cur);
-+		switch (type) {
-+		case MINSTREL_SAMPLE_TYPE_SLOW:
-+			valid = duration > fast_rate_dur &&
-+				duration < slow_rate_dur;
-+			break;
-+		case MINSTREL_SAMPLE_TYPE_INC:
-+		case MINSTREL_SAMPLE_TYPE_JUMP:
-+			valid = duration < fast_rate_dur;
-+			break;
-+		default:
-+			valid = false;
-+			break;
-+		}
-+
-+		if (!valid) {
-+			rates[i] = 0;
-+			continue;
-+		}
-+
-+		if (i == j)
-+			continue;
-+
-+		rates[j++] = cur;
-+		rates[i] = 0;
-+	}
-+
-+	return j;
-+}
-+
-+static int
-+minstrel_ht_group_min_rate_offset(struct minstrel_ht_sta *mi, int group,
-+				  u32 max_duration)
-+{
-+	u16 supported = mi->supported[group];
-+	int i;
-+
-+	for (i = 0; i < MCS_GROUP_RATES && supported; i++, supported >>= 1) {
-+		if (!(supported & BIT(0)))
-+			continue;
-+
-+		if (minstrel_get_duration(MI_RATE(group, i)) >= max_duration)
-+			continue;
-+
-+		return i;
-+	}
-+
-+	return -1;
-+}
-+
-+/*
-+ * Incremental update rates:
-+ * Flip through groups and pick the first group rate that is faster than the
-+ * highest currently selected rate
-+ */
-+static u16
-+minstrel_ht_next_inc_rate(struct minstrel_ht_sta *mi, u32 fast_rate_dur)
-+{
-+	struct minstrel_mcs_group_data *mg;
-+	u8 type = MINSTREL_SAMPLE_TYPE_INC;
-+	int i, index = 0;
-+	u8 group;
-+
-+	group = mi->sample[type].sample_group;
-+	for (i = 0; i < ARRAY_SIZE(minstrel_mcs_groups); i++) {
-+		group = (group + 1) % ARRAY_SIZE(minstrel_mcs_groups);
-+		mg = &mi->groups[group];
-+
-+		index = minstrel_ht_group_min_rate_offset(mi, group,
-+							  fast_rate_dur);
-+		if (index < 0)
-+			continue;
-+
-+		index = MI_RATE(group, index & 0xf);
-+		if (!minstrel_ht_find_sample_rate(mi, type, index))
-+			goto out;
-+	}
-+	index = 0;
-+
-+out:
-+	mi->sample[type].sample_group = group;
-+
-+	return index;
-+}
-+
-+static int
-+minstrel_ht_next_group_sample_rate(struct minstrel_ht_sta *mi, int group,
-+				   u16 supported, int offset)
-+{
-+	struct minstrel_mcs_group_data *mg = &mi->groups[group];
-+	u16 idx;
-+	int i;
-+
-+	for (i = 0; i < MCS_GROUP_RATES; i++) {
-+		idx = sample_table[mg->column][mg->index];
-+		if (++mg->index >= MCS_GROUP_RATES) {
-+			mg->index = 0;
-+			if (++mg->column >= ARRAY_SIZE(sample_table))
-+				mg->column = 0;
-+		}
-+
-+		if (idx < offset)
-+			continue;
-+
-+		if (!(supported & BIT(idx)))
-+			continue;
-+
-+		return MI_RATE(group, idx);
-+	}
-+
-+	return -1;
-+}
-+
-+/*
-+ * Jump rates:
-+ * Sample random rates, use those that are faster than the highest
-+ * currently selected rate. Rates between the fastest and the slowest
-+ * get sorted into the slow sample bucket, but only if it has room
-+ */
-+static u16
-+minstrel_ht_next_jump_rate(struct minstrel_ht_sta *mi, u32 fast_rate_dur,
-+			   u32 slow_rate_dur, int *slow_rate_ofs)
-+{
-+	struct minstrel_mcs_group_data *mg;
-+	struct minstrel_rate_stats *mrs;
-+	u32 max_duration = slow_rate_dur;
-+	int i, index, offset;
-+	u16 *slow_rates;
-+	u16 supported;
-+	u32 duration;
-+	u8 group;
-+
-+	if (*slow_rate_ofs >= MINSTREL_SAMPLE_RATES)
-+		max_duration = fast_rate_dur;
-+
-+	slow_rates = mi->sample[MINSTREL_SAMPLE_TYPE_SLOW].sample_rates;
-+	group = mi->sample[MINSTREL_SAMPLE_TYPE_JUMP].sample_group;
-+	for (i = 0; i < ARRAY_SIZE(minstrel_mcs_groups); i++) {
-+		u8 type;
-+
-+		group = (group + 1) % ARRAY_SIZE(minstrel_mcs_groups);
-+		mg = &mi->groups[group];
-+
-+		supported = mi->supported[group];
-+		if (!supported)
-+			continue;
-+
-+		offset = minstrel_ht_group_min_rate_offset(mi, group,
-+							   max_duration);
-+		if (offset < 0)
-+			continue;
-+
-+		index = minstrel_ht_next_group_sample_rate(mi, group, supported,
-+							   offset);
-+		if (index < 0)
-+			continue;
-+
-+		duration = minstrel_get_duration(index);
-+		if (duration < fast_rate_dur)
-+			type = MINSTREL_SAMPLE_TYPE_JUMP;
-+		else
-+			type = MINSTREL_SAMPLE_TYPE_SLOW;
-+
-+		if (minstrel_ht_find_sample_rate(mi, type, index))
-+			continue;
-+
-+		if (type == MINSTREL_SAMPLE_TYPE_JUMP)
-+			goto found;
-+
-+		if (*slow_rate_ofs >= MINSTREL_SAMPLE_RATES)
-+			continue;
-+
-+		if (duration >= slow_rate_dur)
-+			continue;
-+
-+		/* skip slow rates with high success probability */
-+		mrs = minstrel_get_ratestats(mi, index);
-+		if (mrs->prob_avg > MINSTREL_FRAC(95, 100))
-+			continue;
-+
-+		slow_rates[(*slow_rate_ofs)++] = index;
-+		if (*slow_rate_ofs >= MINSTREL_SAMPLE_RATES)
-+			max_duration = fast_rate_dur;
-+	}
-+	index = 0;
-+
-+found:
-+	mi->sample[MINSTREL_SAMPLE_TYPE_JUMP].sample_group = group;
-+
-+	return index;
-+}
-+
-+static void
-+minstrel_ht_refill_sample_rates(struct minstrel_ht_sta *mi)
-+{
-+	u32 prob_dur = minstrel_get_duration(mi->max_prob_rate);
-+	u32 tp_dur = minstrel_get_duration(mi->max_tp_rate[0]);
-+	u32 tp2_dur = minstrel_get_duration(mi->max_tp_rate[1]);
-+	u32 fast_rate_dur = min(min(tp_dur, tp2_dur), prob_dur);
-+	u32 slow_rate_dur = max(max(tp_dur, tp2_dur), prob_dur);
-+	u16 *rates;
-+	int i, j;
-+
-+	rates = mi->sample[MINSTREL_SAMPLE_TYPE_INC].sample_rates;
-+	i = minstrel_ht_move_sample_rates(mi, MINSTREL_SAMPLE_TYPE_INC,
-+					  fast_rate_dur, slow_rate_dur);
-+	while (i < MINSTREL_SAMPLE_RATES) {
-+		rates[i] = minstrel_ht_next_inc_rate(mi, tp_dur);
-+		if (!rates[i])
-+			break;
-+
-+		i++;
-+	}
-+
-+	rates = mi->sample[MINSTREL_SAMPLE_TYPE_JUMP].sample_rates;
-+	i = minstrel_ht_move_sample_rates(mi, MINSTREL_SAMPLE_TYPE_JUMP,
-+					  fast_rate_dur, slow_rate_dur);
-+	j = minstrel_ht_move_sample_rates(mi, MINSTREL_SAMPLE_TYPE_SLOW,
-+					  fast_rate_dur, slow_rate_dur);
-+	while (i < MINSTREL_SAMPLE_RATES) {
-+		rates[i] = minstrel_ht_next_jump_rate(mi, fast_rate_dur,
-+						      slow_rate_dur, &j);
-+		if (!rates[i])
-+			break;
-+
-+		i++;
-+	}
-+
-+	for (i = 0; i < ARRAY_SIZE(mi->sample); i++)
-+		memcpy(mi->sample[i].cur_sample_rates, mi->sample[i].sample_rates,
-+		       sizeof(mi->sample[i].cur_sample_rates));
-+}
-+
-+
- /*
-  * Update rate statistics and select new primary rates
-  *
-@@ -848,8 +1046,6 @@ minstrel_ht_update_stats(struct minstrel
- 		mi->ampdu_packets = 0;
- 	}
- 
--	mi->sample_count = 0;
--
- 	if (mi->supported[MINSTREL_CCK_GROUP])
- 		group = MINSTREL_CCK_GROUP;
- 	else if (mi->supported[MINSTREL_OFDM_GROUP])
-@@ -884,8 +1080,6 @@ minstrel_ht_update_stats(struct minstrel
- 		if (!mi->supported[group])
- 			continue;
- 
--		mi->sample_count++;
--
- 		/* (re)Initialize group rate indexes */
- 		for(j = 0; j < MAX_THR_RATES; j++)
- 			tmp_group_tp_rate[j] = MI_RATE(group, 0);
-@@ -952,9 +1146,7 @@ minstrel_ht_update_stats(struct minstrel
- 
- 	/* Try to increase robustness of max_prob_rate*/
- 	minstrel_ht_prob_rate_reduce_streams(mi);
--
--	/* try to sample half of all available rates during each interval */
--	mi->sample_count *= 4;
-+	minstrel_ht_refill_sample_rates(mi);
- 
- 	if (sample)
- 		minstrel_ht_rate_sample_switch(mp, mi);
-@@ -971,6 +1163,7 @@ minstrel_ht_update_stats(struct minstrel
- 
- 	/* Reset update timer */
- 	mi->last_stats_update = jiffies;
-+	mi->sample_time = jiffies;
- }
- 
- static bool
-@@ -1001,28 +1194,6 @@ minstrel_ht_txstat_valid(struct minstrel
- }
- 
- static void
--minstrel_set_next_sample_idx(struct minstrel_ht_sta *mi)
--{
--	struct minstrel_mcs_group_data *mg;
--
--	for (;;) {
--		mi->sample_group++;
--		mi->sample_group %= ARRAY_SIZE(minstrel_mcs_groups);
--		mg = &mi->groups[mi->sample_group];
--
--		if (!mi->supported[mi->sample_group])
--			continue;
--
--		if (++mg->index >= MCS_GROUP_RATES) {
--			mg->index = 0;
--			if (++mg->column >= ARRAY_SIZE(sample_table))
--				mg->column = 0;
--		}
--		break;
--	}
--}
--
--static void
- minstrel_downgrade_rate(struct minstrel_ht_sta *mi, u16 *idx, bool primary)
- {
- 	int group, orig_group;
-@@ -1107,14 +1278,6 @@ minstrel_ht_tx_status(void *priv, struct
- 	mi->ampdu_packets++;
- 	mi->ampdu_len += info->status.ampdu_len;
- 
--	if (!mi->sample_wait && !mi->sample_tries && mi->sample_count > 0) {
--		int avg_ampdu_len = minstrel_ht_avg_ampdu_len(mi);
--
--		mi->sample_wait = 16 + 2 * avg_ampdu_len;
--		mi->sample_tries = 1;
--		mi->sample_count--;
--	}
--
- 	if (mi->sample_mode != MINSTREL_SAMPLE_IDLE)
- 		rate_sample = minstrel_get_ratestats(mi, mi->sample_rate);
- 
-@@ -1386,97 +1549,20 @@ minstrel_ht_update_rates(struct minstrel
- 	rate_control_set_rates(mp->hw, mi->sta, rates);
- }
- 
--static int
--minstrel_get_sample_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
-+static u16
-+minstrel_ht_get_sample_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
- {
--	struct minstrel_rate_stats *mrs;
--	struct minstrel_mcs_group_data *mg;
--	unsigned int sample_dur, sample_group, cur_max_tp_streams;
--	int tp_rate1, tp_rate2;
--	int sample_idx = 0;
--
--	if (mp->hw->max_rates == 1 && mp->sample_switch &&
--	    (mi->total_packets_cur >= SAMPLE_SWITCH_THR ||
--	     mp->sample_switch == 1))
--		return -1;
--
--	if (mi->sample_wait > 0) {
--		mi->sample_wait--;
--		return -1;
--	}
--
--	if (!mi->sample_tries)
--		return -1;
--
--	sample_group = mi->sample_group;
--	mg = &mi->groups[sample_group];
--	sample_idx = sample_table[mg->column][mg->index];
--	minstrel_set_next_sample_idx(mi);
--
--	if (!(mi->supported[sample_group] & BIT(sample_idx)))
--		return -1;
-+	u8 seq;
- 
--	mrs = &mg->rates[sample_idx];
--	sample_idx += MI_RATE(sample_group, 0);
--
--	tp_rate1 = mi->max_tp_rate[0];
--
--	/* Set tp_rate2 to the second highest max_tp_rate */
--	if (minstrel_get_duration(mi->max_tp_rate[0]) >
--	    minstrel_get_duration(mi->max_tp_rate[1])) {
--		tp_rate2 = mi->max_tp_rate[0];
-+	if (mp->hw->max_rates > 1) {
-+		seq = mi->sample_seq;
-+		mi->sample_seq = (seq + 1) % ARRAY_SIZE(minstrel_sample_seq);
-+		seq = minstrel_sample_seq[seq];
- 	} else {
--		tp_rate2 = mi->max_tp_rate[1];
-+		seq = MINSTREL_SAMPLE_TYPE_INC;
- 	}
- 
--	/*
--	 * Sampling might add some overhead (RTS, no aggregation)
--	 * to the frame. Hence, don't use sampling for the highest currently
--	 * used highest throughput or probability rate.
--	 */
--	if (sample_idx == mi->max_tp_rate[0] || sample_idx == mi->max_prob_rate)
--		return -1;
--
--	/*
--	 * Do not sample if the probability is already higher than 95%,
--	 * or if the rate is 3 times slower than the current max probability
--	 * rate, to avoid wasting airtime.
--	 */
--	sample_dur = minstrel_get_duration(sample_idx);
--	if (mrs->prob_avg > MINSTREL_FRAC(95, 100) ||
--	    minstrel_get_duration(mi->max_prob_rate) * 3 < sample_dur)
--		return -1;
--
--
--	/*
--	 * For devices with no configurable multi-rate retry, skip sampling
--	 * below the per-group max throughput rate, and only use one sampling
--	 * attempt per rate
--	 */
--	if (mp->hw->max_rates == 1 &&
--	    (minstrel_get_duration(mg->max_group_tp_rate[0]) < sample_dur ||
--	     mrs->attempts))
--		return -1;
--
--	/* Skip already sampled slow rates */
--	if (sample_dur >= minstrel_get_duration(tp_rate1) && mrs->attempts)
--		return -1;
--
--	/*
--	 * Make sure that lower rates get sampled only occasionally,
--	 * if the link is working perfectly.
--	 */
--
--	cur_max_tp_streams = minstrel_mcs_groups[MI_RATE_GROUP(tp_rate1)].streams;
--	if (sample_dur >= minstrel_get_duration(tp_rate2) &&
--	    (cur_max_tp_streams - 1 <
--	     minstrel_mcs_groups[sample_group].streams ||
--	     sample_dur >= minstrel_get_duration(mi->max_prob_rate)))
--			return -1;
--
--	mi->sample_tries--;
--
--	return sample_idx;
-+	return __minstrel_ht_get_sample_rate(mi, seq);
- }
- 
- static void
-@@ -1488,7 +1574,7 @@ minstrel_ht_get_rate(void *priv, struct
- 	struct ieee80211_tx_rate *rate = &info->status.rates[0];
- 	struct minstrel_ht_sta *mi = priv_sta;
- 	struct minstrel_priv *mp = priv;
--	int sample_idx;
-+	u16 sample_idx;
- 
- 	if (!(info->flags & IEEE80211_TX_CTL_AMPDU) &&
- 	    !minstrel_ht_is_legacy_group(MI_RATE_GROUP(mi->max_prob_rate)))
-@@ -1504,11 +1590,19 @@ minstrel_ht_get_rate(void *priv, struct
- 	/* Don't use EAPOL frames for sampling on non-mrr hw */
- 	if (mp->hw->max_rates == 1 &&
- 	    (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO))
--		sample_idx = -1;
--	else
--		sample_idx = minstrel_get_sample_rate(mp, mi);
-+		return;
-+
-+	if (mp->hw->max_rates == 1 && mp->sample_switch &&
-+	    (mi->total_packets_cur >= SAMPLE_SWITCH_THR ||
-+	     mp->sample_switch == 1))
-+		return;
-+
-+	if (time_is_before_jiffies(mi->sample_time))
-+		return;
- 
--	if (sample_idx < 0)
-+	mi->sample_time = jiffies + MINSTREL_SAMPLE_INTERVAL;
-+	sample_idx = minstrel_ht_get_sample_rate(mp, mi);
-+	if (!sample_idx)
- 		return;
- 
- 	sample_group = &minstrel_mcs_groups[MI_RATE_GROUP(sample_idx)];
-@@ -1629,16 +1723,6 @@ minstrel_ht_update_caps(void *priv, stru
- 
- 	mi->avg_ampdu_len = MINSTREL_FRAC(1, 1);
- 
--	/* When using MRR, sample more on the first attempt, without delay */
--	if (mp->has_mrr) {
--		mi->sample_count = 16;
--		mi->sample_wait = 0;
--	} else {
--		mi->sample_count = 8;
--		mi->sample_wait = 8;
--	}
--	mi->sample_tries = 4;
--
- 	if (!use_vht) {
- 		stbc = (ht_cap & IEEE80211_HT_CAP_RX_STBC) >>
- 			IEEE80211_HT_CAP_RX_STBC_SHIFT;
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -69,6 +69,8 @@
- #define MI_RATE_IDX(_rate) FIELD_GET(MI_RATE_IDX_MASK, _rate)
- #define MI_RATE_GROUP(_rate) FIELD_GET(MI_RATE_GROUP_MASK, _rate)
- 
-+#define MINSTREL_SAMPLE_RATES		5 /* rates per sample type */
-+#define MINSTREL_SAMPLE_INTERVAL	(HZ / 50)
- 
- struct minstrel_priv {
- 	struct ieee80211_hw *hw;
-@@ -126,6 +128,13 @@ struct minstrel_rate_stats {
- 	bool retry_updated;
- };
- 
-+enum minstrel_sample_type {
-+	MINSTREL_SAMPLE_TYPE_INC,
-+	MINSTREL_SAMPLE_TYPE_JUMP,
-+	MINSTREL_SAMPLE_TYPE_SLOW,
-+	__MINSTREL_SAMPLE_TYPE_MAX
-+};
-+
- struct minstrel_mcs_group_data {
- 	u8 index;
- 	u8 column;
-@@ -144,6 +153,12 @@ enum minstrel_sample_mode {
- 	MINSTREL_SAMPLE_PENDING,
- };
- 
-+struct minstrel_sample_category {
-+	u8 sample_group;
-+	u16 sample_rates[MINSTREL_SAMPLE_RATES];
-+	u16 cur_sample_rates[MINSTREL_SAMPLE_RATES];
-+};
-+
- struct minstrel_ht_sta {
- 	struct ieee80211_sta *sta;
- 
-@@ -175,16 +190,14 @@ struct minstrel_ht_sta {
- 	/* tx flags to add for frames for this sta */
- 	u32 tx_flags;
- 
--	u8 sample_wait;
--	u8 sample_tries;
--	u8 sample_count;
-+	unsigned long sample_time;
-+	struct minstrel_sample_category sample[__MINSTREL_SAMPLE_TYPE_MAX];
-+
-+	u8 sample_seq;
- 
- 	enum minstrel_sample_mode sample_mode;
- 	u16 sample_rate;
- 
--	/* current MCS group to be sampled */
--	u8 sample_group;
--
- 	u8 band;
- 
- 	/* Bitfield of supported MCS rates of all groups */
diff --git a/package/kernel/mac80211/patches/subsys/350-bss-color-collision.patch b/package/kernel/mac80211/patches/subsys/350-bss-color-collision.patch
new file mode 100644
index 0000000000..1e3486accd
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/350-bss-color-collision.patch
@@ -0,0 +1,118 @@
+From 6d945a33f2b0aa24fc210dadaa0af3e8218e7002 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 25 Mar 2022 11:42:41 +0100
+Subject: [PATCH] mac80211: introduce BSS color collision detection
+
+Add ieee80211_rx_check_bss_color_collision routine in order to introduce
+BSS color collision detection in mac80211 if it is not supported in HW/FW
+(e.g. for mt7915 chipset).
+Add IEEE80211_HW_DETECTS_COLOR_COLLISION flag to let the driver notify
+BSS color collision detection is supported in HW/FW. Set this for ath11k
+which apparently didn't need this code.
+
+Tested-by: Peter Chiu <Chui-Hao.Chiu@mediatek.com>
+Co-developed-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/a05eeeb1841a84560dc5aaec77894fcb69a54f27.1648204871.git.lorenzo@kernel.org
+[clarify commit message a bit, move flag to mac80211]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ drivers/net/wireless/ath/ath11k/mac.c |  5 ++-
+ include/net/mac80211.h                |  4 +++
+ net/mac80211/debugfs.c                |  1 +
+ net/mac80211/rx.c                     | 46 +++++++++++++++++++++++++++
+ 4 files changed, 55 insertions(+), 1 deletion(-)
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -2418,6 +2418,9 @@ struct ieee80211_txq {
+  *	usage and 802.11 frames with %RX_FLAG_ONLY_MONITOR set for monitor to
+  *	the stack.
+  *
++ * @IEEE80211_HW_DETECTS_COLOR_COLLISION: HW/driver has support for BSS color
++ *	collision detection and doesn't need it in software.
++ *
+  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
+  */
+ enum ieee80211_hw_flags {
+@@ -2473,6 +2476,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_SUPPORTS_TX_ENCAP_OFFLOAD,
+ 	IEEE80211_HW_SUPPORTS_RX_DECAP_OFFLOAD,
+ 	IEEE80211_HW_SUPPORTS_CONC_MON_RX_DECAP,
++	IEEE80211_HW_DETECTS_COLOR_COLLISION,
+ 
+ 	/* keep last, obviously */
+ 	NUM_IEEE80211_HW_FLAGS
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -494,6 +494,7 @@ static const char *hw_flag_names[] = {
+ 	FLAG(SUPPORTS_TX_ENCAP_OFFLOAD),
+ 	FLAG(SUPPORTS_RX_DECAP_OFFLOAD),
+ 	FLAG(SUPPORTS_CONC_MON_RX_DECAP),
++	FLAG(DETECTS_COLOR_COLLISION),
+ #undef FLAG
+ };
+ 
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3180,6 +3180,49 @@ static void ieee80211_process_sa_query_r
+ 	ieee80211_tx_skb(sdata, skb);
+ }
+ 
++static void
++ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
++{
++	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
++	const struct element *ie;
++	size_t baselen;
++
++	if (!wiphy_ext_feature_isset(rx->local->hw.wiphy,
++				     NL80211_EXT_FEATURE_BSS_COLOR))
++		return;
++
++	if (ieee80211_hw_check(&rx->local->hw, DETECTS_COLOR_COLLISION))
++		return;
++
++	if (rx->sdata->vif.csa_active)
++		return;
++
++	baselen = mgmt->u.beacon.variable - rx->skb->data;
++	if (baselen > rx->skb->len)
++		return;
++
++	ie = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION,
++				    mgmt->u.beacon.variable,
++				    rx->skb->len - baselen);
++	if (ie && ie->datalen >= sizeof(struct ieee80211_he_operation) &&
++	    ie->datalen >= ieee80211_he_oper_size(ie->data + 1)) {
++		struct ieee80211_bss_conf *bss_conf = &rx->sdata->vif.bss_conf;
++		const struct ieee80211_he_operation *he_oper;
++		u8 color;
++
++		he_oper = (void *)(ie->data + 1);
++		if (le32_get_bits(he_oper->he_oper_params,
++				  IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED))
++			return;
++
++		color = le32_get_bits(he_oper->he_oper_params,
++				      IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
++		if (color == bss_conf->he_bss_color.color)
++			ieeee80211_obss_color_collision_notify(&rx->sdata->vif,
++							       BIT_ULL(color));
++	}
++}
++
+ static ieee80211_rx_result debug_noinline
+ ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
+ {
+@@ -3205,6 +3248,9 @@ ieee80211_rx_h_mgmt_check(struct ieee802
+ 	    !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
+ 		int sig = 0;
+ 
++		/* sw bss color collision detection */
++		ieee80211_rx_check_bss_color_collision(rx);
++
+ 		if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
+ 		    !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
+ 			sig = status->signal;
diff --git a/package/kernel/mac80211/patches/subsys/350-mac80211-minstrel_ht-show-sampling-rates-in-debugfs.patch b/package/kernel/mac80211/patches/subsys/350-mac80211-minstrel_ht-show-sampling-rates-in-debugfs.patch
deleted file mode 100644
index 041ba31a37..0000000000
--- a/package/kernel/mac80211/patches/subsys/350-mac80211-minstrel_ht-show-sampling-rates-in-debugfs.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 23 Jan 2021 00:10:34 +0100
-Subject: [PATCH] mac80211: minstrel_ht: show sampling rates in debugfs
-
-This makes it easier to see what rates are going to be tested next
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
-+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
-@@ -32,6 +32,18 @@ minstrel_stats_release(struct inode *ino
- 	return 0;
- }
- 
-+static bool
-+minstrel_ht_is_sample_rate(struct minstrel_ht_sta *mi, int idx)
-+{
-+	int type, i;
-+
-+	for (type = 0; type < ARRAY_SIZE(mi->sample); type++)
-+		for (i = 0; i < MINSTREL_SAMPLE_RATES; i++)
-+			if (mi->sample[type].cur_sample_rates[i] == idx)
-+				return true;
-+	return false;
-+}
-+
- static char *
- minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
- {
-@@ -84,6 +96,7 @@ minstrel_ht_stats_dump(struct minstrel_h
- 		*(p++) = (idx == mi->max_tp_rate[2]) ? 'C' : ' ';
- 		*(p++) = (idx == mi->max_tp_rate[3]) ? 'D' : ' ';
- 		*(p++) = (idx == mi->max_prob_rate) ? 'P' : ' ';
-+		*(p++) = minstrel_ht_is_sample_rate(mi, idx) ? 'S' : ' ';
- 
- 		if (gflags & IEEE80211_TX_RC_MCS) {
- 			p += sprintf(p, "  MCS%-2u", (mg->streams - 1) * 8 + j);
-@@ -145,9 +158,9 @@ minstrel_ht_stats_open(struct inode *ino
- 
- 	p += sprintf(p, "\n");
- 	p += sprintf(p,
--		     "              best   ____________rate__________    ____statistics___    _____last____    ______sum-of________\n");
-+		     "              best    ____________rate__________    ____statistics___    _____last____    ______sum-of________\n");
- 	p += sprintf(p,
--		     "mode guard #  rate  [name   idx airtime  max_tp]  [avg(tp) avg(prob)]  [retry|suc|att]  [#success | #attempts]\n");
-+		     "mode guard #  rate   [name   idx airtime  max_tp]  [avg(tp) avg(prob)]  [retry|suc|att]  [#success | #attempts]\n");
- 
- 	p = minstrel_ht_stats_dump(mi, MINSTREL_CCK_GROUP, p);
- 	for (i = 0; i < MINSTREL_CCK_GROUP; i++)
-@@ -228,6 +241,7 @@ minstrel_ht_stats_csv_dump(struct minstr
- 		p += sprintf(p, "%s" ,((idx == mi->max_tp_rate[2]) ? "C" : ""));
- 		p += sprintf(p, "%s" ,((idx == mi->max_tp_rate[3]) ? "D" : ""));
- 		p += sprintf(p, "%s" ,((idx == mi->max_prob_rate) ? "P" : ""));
-+		p += sprintf(p, "%s", (minstrel_ht_is_sample_rate(mi, idx) ? "S" : ""));
- 
- 		if (gflags & IEEE80211_TX_RC_MCS) {
- 			p += sprintf(p, ",MCS%-2u,", (mg->streams - 1) * 8 + j);
diff --git a/package/kernel/mac80211/patches/subsys/351-mac80211-minstrel_ht-remove-sample-rate-switching-co.patch b/package/kernel/mac80211/patches/subsys/351-mac80211-minstrel_ht-remove-sample-rate-switching-co.patch
deleted file mode 100644
index 8170ff85f8..0000000000
--- a/package/kernel/mac80211/patches/subsys/351-mac80211-minstrel_ht-remove-sample-rate-switching-co.patch
+++ /dev/null
@@ -1,279 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 23 Jan 2021 07:18:26 +0100
-Subject: [PATCH] mac80211: minstrel_ht: remove sample rate switching code for
- constrained devices
-
-This was added to mitigate the effects of too much sampling on devices that
-use a static global fallback table instead of configurable multi-rate retry.
-Now that the sampling algorithm is improved, this code path no longer performs
-any better than the standard probing on affected devices.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -648,27 +648,6 @@ __minstrel_ht_get_sample_rate(struct min
- 	return 0;
- }
- 
--static void
--minstrel_ht_rate_sample_switch(struct minstrel_priv *mp,
--			       struct minstrel_ht_sta *mi)
--{
--	u16 rate;
--
--	/*
--	 * Use rate switching instead of probing packets for devices with
--	 * little control over retry fallback behavior
--	 */
--	if (mp->hw->max_rates > 1)
--		return;
--
--	rate = __minstrel_ht_get_sample_rate(mi, MINSTREL_SAMPLE_TYPE_INC);
--	if (!rate)
--		return;
--
--	mi->sample_rate = rate;
--	mi->sample_mode = MINSTREL_SAMPLE_ACTIVE;
--}
--
- static inline int
- minstrel_ewma(int old, int new, int weight)
- {
-@@ -1012,8 +991,7 @@ minstrel_ht_refill_sample_rates(struct m
-  *    higher throughput rates, even if the probablity is a bit lower
-  */
- static void
--minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
--			 bool sample)
-+minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
- {
- 	struct minstrel_mcs_group_data *mg;
- 	struct minstrel_rate_stats *mrs;
-@@ -1023,18 +1001,6 @@ minstrel_ht_update_stats(struct minstrel
- 	u16 index;
- 	bool ht_supported = mi->sta->ht_cap.ht_supported;
- 
--	mi->sample_mode = MINSTREL_SAMPLE_IDLE;
--
--	if (sample) {
--		mi->total_packets_cur = mi->total_packets -
--					mi->total_packets_last;
--		mi->total_packets_last = mi->total_packets;
--	}
--	if (!mp->sample_switch)
--		sample = false;
--	if (mi->total_packets_cur < SAMPLE_SWITCH_THR && mp->sample_switch != 1)
--	    sample = false;
--
- 	if (mi->ampdu_packets > 0) {
- 		if (!ieee80211_hw_check(mp->hw, TX_STATUS_NO_AMPDU_LEN))
- 			mi->avg_ampdu_len = minstrel_ewma(mi->avg_ampdu_len,
-@@ -1148,16 +1114,12 @@ minstrel_ht_update_stats(struct minstrel
- 	minstrel_ht_prob_rate_reduce_streams(mi);
- 	minstrel_ht_refill_sample_rates(mi);
- 
--	if (sample)
--		minstrel_ht_rate_sample_switch(mp, mi);
--
- #ifdef CPTCFG_MAC80211_DEBUGFS
- 	/* use fixed index if set */
- 	if (mp->fixed_rate_idx != -1) {
- 		for (i = 0; i < 4; i++)
- 			mi->max_tp_rate[i] = mp->fixed_rate_idx;
- 		mi->max_prob_rate = mp->fixed_rate_idx;
--		mi->sample_mode = MINSTREL_SAMPLE_IDLE;
- 	}
- #endif
- 
-@@ -1247,11 +1209,10 @@ minstrel_ht_tx_status(void *priv, struct
- 	struct ieee80211_tx_info *info = st->info;
- 	struct minstrel_ht_sta *mi = priv_sta;
- 	struct ieee80211_tx_rate *ar = info->status.rates;
--	struct minstrel_rate_stats *rate, *rate2, *rate_sample = NULL;
-+	struct minstrel_rate_stats *rate, *rate2;
- 	struct minstrel_priv *mp = priv;
- 	u32 update_interval = mp->update_interval;
- 	bool last, update = false;
--	bool sample_status = false;
- 	int i;
- 
- 	/* This packet was aggregated but doesn't carry status info */
-@@ -1278,49 +1239,18 @@ minstrel_ht_tx_status(void *priv, struct
- 	mi->ampdu_packets++;
- 	mi->ampdu_len += info->status.ampdu_len;
- 
--	if (mi->sample_mode != MINSTREL_SAMPLE_IDLE)
--		rate_sample = minstrel_get_ratestats(mi, mi->sample_rate);
--
- 	last = !minstrel_ht_txstat_valid(mp, mi, &ar[0]);
- 	for (i = 0; !last; i++) {
- 		last = (i == IEEE80211_TX_MAX_RATES - 1) ||
- 		       !minstrel_ht_txstat_valid(mp, mi, &ar[i + 1]);
- 
- 		rate = minstrel_ht_get_stats(mp, mi, &ar[i]);
--		if (rate == rate_sample)
--			sample_status = true;
--
- 		if (last)
- 			rate->success += info->status.ampdu_ack_len;
- 
- 		rate->attempts += ar[i].count * info->status.ampdu_len;
- 	}
- 
--	switch (mi->sample_mode) {
--	case MINSTREL_SAMPLE_IDLE:
--		if (mp->hw->max_rates > 1 ||
--		     mi->total_packets_cur < SAMPLE_SWITCH_THR)
--			update_interval /= 2;
--		break;
--
--	case MINSTREL_SAMPLE_ACTIVE:
--		if (!sample_status)
--			break;
--
--		mi->sample_mode = MINSTREL_SAMPLE_PENDING;
--		update = true;
--		break;
--
--	case MINSTREL_SAMPLE_PENDING:
--		if (sample_status)
--			break;
--
--		update = true;
--		minstrel_ht_update_stats(mp, mi, false);
--		break;
--	}
--
--
- 	if (mp->hw->max_rates > 1) {
- 		/*
- 		 * check for sudden death of spatial multiplexing,
-@@ -1343,7 +1273,7 @@ minstrel_ht_tx_status(void *priv, struct
- 
- 	if (time_after(jiffies, mi->last_stats_update + update_interval)) {
- 		update = true;
--		minstrel_ht_update_stats(mp, mi, true);
-+		minstrel_ht_update_stats(mp, mi);
- 	}
- 
- 	if (update)
-@@ -1522,18 +1452,14 @@ static void
- minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
- {
- 	struct ieee80211_sta_rates *rates;
--	u16 first_rate = mi->max_tp_rate[0];
- 	int i = 0;
- 
--	if (mi->sample_mode == MINSTREL_SAMPLE_ACTIVE)
--		first_rate = mi->sample_rate;
--
- 	rates = kzalloc(sizeof(*rates), GFP_ATOMIC);
- 	if (!rates)
- 		return;
- 
- 	/* Start with max_tp_rate[0] */
--	minstrel_ht_set_rate(mp, mi, rates, i++, first_rate);
-+	minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_tp_rate[0]);
- 
- 	if (mp->hw->max_rates >= 3) {
- 		/* At least 3 tx rates supported, use max_tp_rate[1] next */
-@@ -1592,11 +1518,6 @@ minstrel_ht_get_rate(void *priv, struct
- 	    (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO))
- 		return;
- 
--	if (mp->hw->max_rates == 1 && mp->sample_switch &&
--	    (mi->total_packets_cur >= SAMPLE_SWITCH_THR ||
--	     mp->sample_switch == 1))
--		return;
--
- 	if (time_is_before_jiffies(mi->sample_time))
- 		return;
- 
-@@ -1810,7 +1731,7 @@ minstrel_ht_update_caps(void *priv, stru
- 	minstrel_ht_update_ofdm(mp, mi, sband, sta);
- 
- 	/* create an initial rate table with the lowest supported rates */
--	minstrel_ht_update_stats(mp, mi, true);
-+	minstrel_ht_update_stats(mp, mi);
- 	minstrel_ht_update_rates(mp, mi);
- }
- 
-@@ -1926,8 +1847,6 @@ minstrel_ht_alloc(struct ieee80211_hw *h
- 	if (!mp)
- 		return NULL;
- 
--	mp->sample_switch = -1;
--
- 	/* contention window settings
- 	 * Just an approximation. Using the per-queue values would complicate
- 	 * the calculations and is probably unnecessary */
-@@ -1947,7 +1866,7 @@ minstrel_ht_alloc(struct ieee80211_hw *h
- 		mp->has_mrr = true;
- 
- 	mp->hw = hw;
--	mp->update_interval = HZ / 10;
-+	mp->update_interval = HZ / 20;
- 
- 	minstrel_ht_init_cck_rates(mp);
- 	for (i = 0; i < ARRAY_SIZE(mp->hw->wiphy->bands); i++)
-@@ -1965,8 +1884,6 @@ static void minstrel_ht_add_debugfs(stru
- 	mp->fixed_rate_idx = (u32) -1;
- 	debugfs_create_u32("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir,
- 			   &mp->fixed_rate_idx);
--	debugfs_create_u32("sample_switch", S_IRUGO | S_IWUSR, debugfsdir,
--			   &mp->sample_switch);
- }
- #endif
- 
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -75,7 +75,6 @@
- struct minstrel_priv {
- 	struct ieee80211_hw *hw;
- 	bool has_mrr;
--	u32 sample_switch;
- 	unsigned int cw_min;
- 	unsigned int cw_max;
- 	unsigned int max_retry;
-@@ -147,12 +146,6 @@ struct minstrel_mcs_group_data {
- 	struct minstrel_rate_stats rates[MCS_GROUP_RATES];
- };
- 
--enum minstrel_sample_mode {
--	MINSTREL_SAMPLE_IDLE,
--	MINSTREL_SAMPLE_ACTIVE,
--	MINSTREL_SAMPLE_PENDING,
--};
--
- struct minstrel_sample_category {
- 	u8 sample_group;
- 	u16 sample_rates[MINSTREL_SAMPLE_RATES];
-@@ -182,23 +175,19 @@ struct minstrel_ht_sta {
- 	unsigned int overhead_legacy;
- 	unsigned int overhead_legacy_rtscts;
- 
--	unsigned int total_packets_last;
--	unsigned int total_packets_cur;
- 	unsigned int total_packets;
- 	unsigned int sample_packets;
- 
- 	/* tx flags to add for frames for this sta */
- 	u32 tx_flags;
- 
--	unsigned long sample_time;
--	struct minstrel_sample_category sample[__MINSTREL_SAMPLE_TYPE_MAX];
-+	u8 band;
- 
- 	u8 sample_seq;
--
--	enum minstrel_sample_mode sample_mode;
- 	u16 sample_rate;
- 
--	u8 band;
-+	unsigned long sample_time;
-+	struct minstrel_sample_category sample[__MINSTREL_SAMPLE_TYPE_MAX];
- 
- 	/* Bitfield of supported MCS rates of all groups */
- 	u16 supported[MINSTREL_GROUPS_NB];
diff --git a/package/kernel/mac80211/patches/subsys/352-mac80211-minstrel_ht-fix-regression-in-the-max_prob_.patch b/package/kernel/mac80211/patches/subsys/352-mac80211-minstrel_ht-fix-regression-in-the-max_prob_.patch
deleted file mode 100644
index a366a921d4..0000000000
--- a/package/kernel/mac80211/patches/subsys/352-mac80211-minstrel_ht-fix-regression-in-the-max_prob_.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 26 Jan 2021 16:40:52 +0100
-Subject: [PATCH] mac80211: minstrel_ht: fix regression in the max_prob_rate
- fix
-
-Since mi->max_prob_rate is overwritten after the loop that calls
-minstrel_ht_set_best_prob_rate, the new best rate needs to be written to *dest
-
-Fixes: a7fca4e4037f ("mac80211: minstrel_ht: fix max probability rate selection")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -545,7 +545,7 @@ minstrel_ht_set_best_prob_rate(struct mi
- 		cur_tp_avg = minstrel_ht_get_tp_avg(mi, cur_group, cur_idx,
- 						    mrs->prob_avg);
- 		if (cur_tp_avg > tmp_tp_avg)
--			mi->max_prob_rate = index;
-+			*dest = index;
- 
- 		max_gpr_tp_avg = minstrel_ht_get_tp_avg(mi, max_gpr_group,
- 							max_gpr_idx,
diff --git a/package/kernel/mac80211/patches/subsys/371-mac80211-don-t-apply-flow-control-on-management-fram.patch b/package/kernel/mac80211/patches/subsys/371-mac80211-don-t-apply-flow-control-on-management-fram.patch
deleted file mode 100644
index 0d3b42f3b9..0000000000
--- a/package/kernel/mac80211/patches/subsys/371-mac80211-don-t-apply-flow-control-on-management-fram.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Fri, 19 Mar 2021 23:28:01 +0100
-Subject: [PATCH] mac80211: don't apply flow control on management frames
-
-In some cases (depending on the driver, but it's true e.g. for
-iwlwifi) we're using an internal TXQ for management packets,
-mostly to simplify the code and to have a place to queue them.
-However, it appears that in certain cases we can confuse the
-code and management frames are dropped, which is certainly not
-what we want.
-
-Short-circuit the processing of management frames. To keep the
-impact minimal, only put them on the frags queue and check the
-tid == management only for doing that and to skip the airtime
-fairness checks, if applicable.
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -5,7 +5,7 @@
-  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
-  * Copyright 2007	Johannes Berg <johannes@sipsolutions.net>
-  * Copyright 2013-2014  Intel Mobile Communications GmbH
-- * Copyright (C) 2018-2020 Intel Corporation
-+ * Copyright (C) 2018-2021 Intel Corporation
-  *
-  * Transmit and frame generation functions.
-  */
-@@ -1401,8 +1401,17 @@ static void ieee80211_txq_enqueue(struct
- 	ieee80211_set_skb_enqueue_time(skb);
- 
- 	spin_lock_bh(&fq->lock);
--	fq_tin_enqueue(fq, tin, flow_idx, skb,
--		       fq_skb_free_func);
-+	/*
-+	 * For management frames, don't really apply codel etc.,
-+	 * we don't want to apply any shaping or anything we just
-+	 * want to simplify the driver API by having them on the
-+	 * txqi.
-+	 */
-+	if (unlikely(txqi->txq.tid == IEEE80211_NUM_TIDS))
-+		__skb_queue_tail(&txqi->frags, skb);
-+	else
-+		fq_tin_enqueue(fq, tin, flow_idx, skb,
-+			       fq_skb_free_func);
- 	spin_unlock_bh(&fq->lock);
- }
- 
-@@ -3878,6 +3887,9 @@ bool ieee80211_txq_airtime_check(struct
- 	if (!txq->sta)
- 		return true;
- 
-+	if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
-+		return true;
-+
- 	sta = container_of(txq->sta, struct sta_info, sta);
- 	if (atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
- 	    sta->airtime[txq->ac].aql_limit_low)
diff --git a/package/kernel/mac80211/patches/subsys/372-mac80211-set-sk_pacing_shift-for-802.3-txpath.patch b/package/kernel/mac80211/patches/subsys/372-mac80211-set-sk_pacing_shift-for-802.3-txpath.patch
deleted file mode 100644
index 9e57d01e0b..0000000000
--- a/package/kernel/mac80211/patches/subsys/372-mac80211-set-sk_pacing_shift-for-802.3-txpath.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Mon, 8 Mar 2021 23:01:49 +0100
-Subject: [PATCH] mac80211: set sk_pacing_shift for 802.3 txpath
-
-Similar to 802.11 txpath, set socket sk_pacing_shift for 802.3 tx path.
-
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -4205,6 +4205,9 @@ static bool ieee80211_tx_8023(struct iee
- 	unsigned long flags;
- 	int q = info->hw_queue;
- 
-+	if (sta)
-+		sk_pacing_shift_update(skb->sk, local->hw.tx_sk_pacing_shift);
-+
- 	if (ieee80211_queue_skb(local, sdata, sta, skb))
- 		return true;
- 
diff --git a/package/kernel/mac80211/patches/subsys/373-mac80211-support-Rx-timestamp-calculation-for-all-pr.patch b/package/kernel/mac80211/patches/subsys/373-mac80211-support-Rx-timestamp-calculation-for-all-pr.patch
deleted file mode 100644
index 426a8b7d5d..0000000000
--- a/package/kernel/mac80211/patches/subsys/373-mac80211-support-Rx-timestamp-calculation-for-all-pr.patch
+++ /dev/null
@@ -1,134 +0,0 @@
-From: Avraham Stern <avraham.stern@intel.com>
-Date: Sun, 6 Dec 2020 14:54:45 +0200
-Subject: [PATCH] mac80211: support Rx timestamp calculation for all preamble
- types
-
-Add support for calculating the Rx timestamp for HE frames.
-Since now all frame types are supported, allow setting the Rx
-timestamp regardless of the frame type.
-
-Signed-off-by: Avraham Stern <avraham.stern@intel.com>
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Link: https://lore.kernel.org/r/iwlwifi.20201206145305.4786559af475.Ia54486bb0a12e5351f9d5c60ef6fcda7c9e7141c@changeid
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -1587,13 +1587,8 @@ ieee80211_have_rx_timestamp(struct ieee8
- {
- 	WARN_ON_ONCE(status->flag & RX_FLAG_MACTIME_START &&
- 		     status->flag & RX_FLAG_MACTIME_END);
--	if (status->flag & (RX_FLAG_MACTIME_START | RX_FLAG_MACTIME_END))
--		return true;
--	/* can't handle non-legacy preamble yet */
--	if (status->flag & RX_FLAG_MACTIME_PLCP_START &&
--	    status->encoding == RX_ENC_LEGACY)
--		return true;
--	return false;
-+	return !!(status->flag & (RX_FLAG_MACTIME_START | RX_FLAG_MACTIME_END |
-+				  RX_FLAG_MACTIME_PLCP_START));
- }
- 
- void ieee80211_vif_inc_num_mcast(struct ieee80211_sub_if_data *sdata);
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -3670,6 +3670,7 @@ u64 ieee80211_calculate_rx_timestamp(str
- 	u64 ts = status->mactime;
- 	struct rate_info ri;
- 	u16 rate;
-+	u8 n_ltf;
- 
- 	if (WARN_ON(!ieee80211_have_rx_timestamp(status)))
- 		return 0;
-@@ -3680,11 +3681,58 @@ u64 ieee80211_calculate_rx_timestamp(str
- 
- 	/* Fill cfg80211 rate info */
- 	switch (status->encoding) {
-+	case RX_ENC_HE:
-+		ri.flags |= RATE_INFO_FLAGS_HE_MCS;
-+		ri.mcs = status->rate_idx;
-+		ri.nss = status->nss;
-+		ri.he_ru_alloc = status->he_ru;
-+		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
-+			ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
-+
-+		/*
-+		 * See P802.11ax_D6.0, section 27.3.4 for
-+		 * VHT PPDU format.
-+		 */
-+		if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
-+			mpdu_offset += 2;
-+			ts += 36;
-+
-+			/*
-+			 * TODO:
-+			 * For HE MU PPDU, add the HE-SIG-B.
-+			 * For HE ER PPDU, add 8us for the HE-SIG-A.
-+			 * For HE TB PPDU, add 4us for the HE-STF.
-+			 * Add the HE-LTF durations - variable.
-+			 */
-+		}
-+
-+		break;
- 	case RX_ENC_HT:
- 		ri.mcs = status->rate_idx;
- 		ri.flags |= RATE_INFO_FLAGS_MCS;
- 		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
- 			ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
-+
-+		/*
-+		 * See P802.11REVmd_D3.0, section 19.3.2 for
-+		 * HT PPDU format.
-+		 */
-+		if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
-+			mpdu_offset += 2;
-+			if (status->enc_flags & RX_ENC_FLAG_HT_GF)
-+				ts += 24;
-+			else
-+				ts += 32;
-+
-+			/*
-+			 * Add Data HT-LTFs per streams
-+			 * TODO: add Extension HT-LTFs, 4us per LTF
-+			 */
-+			n_ltf = ((ri.mcs >> 3) & 3) + 1;
-+			n_ltf = n_ltf == 3 ? 4 : n_ltf;
-+			ts += n_ltf * 4;
-+		}
-+
- 		break;
- 	case RX_ENC_VHT:
- 		ri.flags |= RATE_INFO_FLAGS_VHT_MCS;
-@@ -3692,6 +3740,23 @@ u64 ieee80211_calculate_rx_timestamp(str
- 		ri.nss = status->nss;
- 		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
- 			ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
-+
-+		/*
-+		 * See P802.11REVmd_D3.0, section 21.3.2 for
-+		 * VHT PPDU format.
-+		 */
-+		if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
-+			mpdu_offset += 2;
-+			ts += 36;
-+
-+			/*
-+			 * Add VHT-LTFs per streams
-+			 */
-+			n_ltf = (ri.nss != 1) && (ri.nss % 2) ?
-+				ri.nss + 1 : ri.nss;
-+			ts += 4 * n_ltf;
-+		}
-+
- 		break;
- 	default:
- 		WARN_ON(1);
-@@ -3715,7 +3780,6 @@ u64 ieee80211_calculate_rx_timestamp(str
- 		ri.legacy = DIV_ROUND_UP(bitrate, (1 << shift));
- 
- 		if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
--			/* TODO: handle HT/VHT preambles */
- 			if (status->band == NL80211_BAND_5GHZ) {
- 				ts += 20 << shift;
- 				mpdu_offset += 2;
diff --git a/package/kernel/mac80211/patches/subsys/374-mac80211-move-A-MPDU-session-check-from-minstrel_ht-.patch b/package/kernel/mac80211/patches/subsys/374-mac80211-move-A-MPDU-session-check-from-minstrel_ht-.patch
deleted file mode 100644
index bab8917ff9..0000000000
--- a/package/kernel/mac80211/patches/subsys/374-mac80211-move-A-MPDU-session-check-from-minstrel_ht-.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Thu, 17 Jun 2021 17:56:54 +0200
-Subject: [PATCH] mac80211: move A-MPDU session check from minstrel_ht to
- mac80211
-
-This avoids calling back into tx handlers from within the rate control module.
-Preparation for deferring rate control until tx dequeue
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -6160,6 +6160,11 @@ enum rate_control_capabilities {
- 	 * otherwise the NSS difference doesn't bother us.
- 	 */
- 	RATE_CTRL_CAPA_VHT_EXT_NSS_BW = BIT(0),
-+	/**
-+	 * @RATE_CTRL_CAPA_AMPDU_TRIGGER:
-+	 * mac80211 should start A-MPDU sessions on tx
-+	 */
-+	RATE_CTRL_CAPA_AMPDU_TRIGGER = BIT(1),
- };
- 
- struct rate_control_ops {
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -1144,29 +1144,6 @@ minstrel_downgrade_prob_rate(struct mins
- }
- 
- static void
--minstrel_aggr_check(struct ieee80211_sta *pubsta, struct sk_buff *skb)
--{
--	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
--	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
--	u16 tid;
--
--	if (skb_get_queue_mapping(skb) == IEEE80211_AC_VO)
--		return;
--
--	if (unlikely(!ieee80211_is_data_qos(hdr->frame_control)))
--		return;
--
--	if (unlikely(skb->protocol == cpu_to_be16(ETH_P_PAE)))
--		return;
--
--	tid = ieee80211_get_tid(hdr);
--	if (likely(sta->ampdu_mlme.tid_tx[tid]))
--		return;
--
--	ieee80211_start_tx_ba_session(pubsta, tid, 0);
--}
--
--static void
- minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
-                       void *priv_sta, struct ieee80211_tx_status *st)
- {
-@@ -1461,10 +1438,6 @@ minstrel_ht_get_rate(void *priv, struct
- 	struct minstrel_priv *mp = priv;
- 	u16 sample_idx;
- 
--	if (!(info->flags & IEEE80211_TX_CTL_AMPDU) &&
--	    !minstrel_ht_is_legacy_group(MI_RATE_GROUP(mi->max_prob_rate)))
--		minstrel_aggr_check(sta, txrc->skb);
--
- 	info->flags |= mi->tx_flags;
- 
- #ifdef CPTCFG_MAC80211_DEBUGFS
-@@ -1870,6 +1843,7 @@ static u32 minstrel_ht_get_expected_thro
- 
- static const struct rate_control_ops mac80211_minstrel_ht = {
- 	.name = "minstrel_ht",
-+	.capa = RATE_CTRL_CAPA_AMPDU_TRIGGER,
- 	.tx_status_ext = minstrel_ht_tx_status,
- 	.get_rate = minstrel_ht_get_rate,
- 	.rate_init = minstrel_ht_rate_init,
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3965,6 +3965,29 @@ void ieee80211_txq_schedule_start(struct
- }
- EXPORT_SYMBOL(ieee80211_txq_schedule_start);
- 
-+static void
-+ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata,
-+		     struct sta_info *sta,
-+		     struct sk_buff *skb)
-+{
-+	struct rate_control_ref *ref = sdata->local->rate_ctrl;
-+	u16 tid;
-+
-+	if (!ref || !(ref->ops->capa & RATE_CTRL_CAPA_AMPDU_TRIGGER))
-+		return;
-+
-+	if (!sta || !sta->sta.ht_cap.ht_supported ||
-+	    !sta->sta.wme || skb_get_queue_mapping(skb) == IEEE80211_AC_VO ||
-+	    skb->protocol == sdata->control_port_protocol)
-+		return;
-+
-+	tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
-+	if (likely(sta->ampdu_mlme.tid_tx[tid]))
-+		return;
-+
-+	ieee80211_start_tx_ba_session(&sta->sta, tid, 0);
-+}
-+
- void __ieee80211_subif_start_xmit(struct sk_buff *skb,
- 				  struct net_device *dev,
- 				  u32 info_flags,
-@@ -3995,6 +4018,8 @@ void __ieee80211_subif_start_xmit(struct
- 		skb_get_hash(skb);
- 	}
- 
-+	ieee80211_aggr_check(sdata, sta, skb);
-+
- 	if (sta) {
- 		struct ieee80211_fast_tx *fast_tx;
- 
-@@ -4258,6 +4283,8 @@ static void ieee80211_8023_xmit(struct i
- 
- 	memset(info, 0, sizeof(*info));
- 
-+	ieee80211_aggr_check(sdata, sta, skb);
-+
- 	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
- 	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
- 	if (tid_tx) {
diff --git a/package/kernel/mac80211/patches/subsys/375-mac80211-call-ieee80211_tx_h_rate_ctrl-when-dequeue.patch b/package/kernel/mac80211/patches/subsys/375-mac80211-call-ieee80211_tx_h_rate_ctrl-when-dequeue.patch
deleted file mode 100644
index 36c46c2f83..0000000000
--- a/package/kernel/mac80211/patches/subsys/375-mac80211-call-ieee80211_tx_h_rate_ctrl-when-dequeue.patch
+++ /dev/null
@@ -1,114 +0,0 @@
-From: Ryder Lee <ryder.lee@mediatek.com>
-Date: Fri, 28 May 2021 14:05:41 +0800
-Subject: [PATCH] mac80211: call ieee80211_tx_h_rate_ctrl() when dequeue
-
-Make ieee80211_tx_h_rate_ctrl() get called on dequeue to improve
-performance since it reduces the turnaround time for rate control.
-
-Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1778,8 +1778,6 @@ static int invoke_tx_handlers_early(stru
- 	CALL_TXH(ieee80211_tx_h_ps_buf);
- 	CALL_TXH(ieee80211_tx_h_check_control_port_protocol);
- 	CALL_TXH(ieee80211_tx_h_select_key);
--	if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
--		CALL_TXH(ieee80211_tx_h_rate_ctrl);
- 
-  txh_done:
- 	if (unlikely(res == TX_DROP)) {
-@@ -1812,6 +1810,9 @@ static int invoke_tx_handlers_late(struc
- 		goto txh_done;
- 	}
- 
-+	if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
-+		CALL_TXH(ieee80211_tx_h_rate_ctrl);
-+
- 	CALL_TXH(ieee80211_tx_h_michael_mic_add);
- 	CALL_TXH(ieee80211_tx_h_sequence);
- 	CALL_TXH(ieee80211_tx_h_fragment);
-@@ -3416,15 +3417,21 @@ out:
-  * Can be called while the sta lock is held. Anything that can cause packets to
-  * be generated will cause deadlock!
-  */
--static void ieee80211_xmit_fast_finish(struct ieee80211_sub_if_data *sdata,
--				       struct sta_info *sta, u8 pn_offs,
--				       struct ieee80211_key *key,
--				       struct sk_buff *skb)
-+static ieee80211_tx_result
-+ieee80211_xmit_fast_finish(struct ieee80211_sub_if_data *sdata,
-+			   struct sta_info *sta, u8 pn_offs,
-+			   struct ieee80211_key *key,
-+			   struct ieee80211_tx_data *tx)
- {
-+	struct sk_buff *skb = tx->skb;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_hdr *hdr = (void *)skb->data;
- 	u8 tid = IEEE80211_NUM_TIDS;
- 
-+	if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL) &&
-+	    ieee80211_tx_h_rate_ctrl(tx) != TX_CONTINUE)
-+		return TX_DROP;
-+
- 	if (key)
- 		info->control.hw_key = &key->conf;
- 
-@@ -3473,6 +3480,8 @@ static void ieee80211_xmit_fast_finish(s
- 			break;
- 		}
- 	}
-+
-+	return TX_CONTINUE;
- }
- 
- static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
-@@ -3576,24 +3585,17 @@ static bool ieee80211_xmit_fast(struct i
- 	tx.sta = sta;
- 	tx.key = fast_tx->key;
- 
--	if (!ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL)) {
--		tx.skb = skb;
--		r = ieee80211_tx_h_rate_ctrl(&tx);
--		skb = tx.skb;
--		tx.skb = NULL;
--
--		if (r != TX_CONTINUE) {
--			if (r != TX_QUEUED)
--				kfree_skb(skb);
--			return true;
--		}
--	}
--
- 	if (ieee80211_queue_skb(local, sdata, sta, skb))
- 		return true;
- 
--	ieee80211_xmit_fast_finish(sdata, sta, fast_tx->pn_offs,
--				   fast_tx->key, skb);
-+	tx.skb = skb;
-+	r = ieee80211_xmit_fast_finish(sdata, sta, fast_tx->pn_offs,
-+				       fast_tx->key, &tx);
-+	tx.skb = NULL;
-+	if (r == TX_DROP) {
-+		kfree_skb(skb);
-+		return true;
-+	}
- 
- 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
- 		sdata = container_of(sdata->bss,
-@@ -3704,8 +3706,12 @@ begin:
- 		    (tx.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV))
- 			pn_offs = ieee80211_hdrlen(hdr->frame_control);
- 
--		ieee80211_xmit_fast_finish(sta->sdata, sta, pn_offs,
--					   tx.key, skb);
-+		r = ieee80211_xmit_fast_finish(sta->sdata, sta, pn_offs,
-+					       tx.key, &tx);
-+		if (r != TX_CONTINUE) {
-+			ieee80211_free_txskb(&local->hw, skb);
-+			goto begin;
-+		}
- 	} else {
- 		if (invoke_tx_handlers_late(&tx))
- 			goto begin;
diff --git a/package/kernel/mac80211/patches/subsys/376-mac80211-add-rate-control-support-for-encap-offload.patch b/package/kernel/mac80211/patches/subsys/376-mac80211-add-rate-control-support-for-encap-offload.patch
deleted file mode 100644
index 11890ae3f9..0000000000
--- a/package/kernel/mac80211/patches/subsys/376-mac80211-add-rate-control-support-for-encap-offload.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-From: Ryder Lee <ryder.lee@mediatek.com>
-Date: Fri, 28 May 2021 14:05:43 +0800
-Subject: [PATCH] mac80211: add rate control support for encap offload
-
-The software rate control cannot deal with encap offload, so fix it.
-
-Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
----
-
---- a/net/mac80211/rate.c
-+++ b/net/mac80211/rate.c
-@@ -297,15 +297,11 @@ void ieee80211_check_rate_mask(struct ie
- static bool rc_no_data_or_no_ack_use_min(struct ieee80211_tx_rate_control *txrc)
- {
- 	struct sk_buff *skb = txrc->skb;
--	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
--	__le16 fc;
--
--	fc = hdr->frame_control;
- 
- 	return (info->flags & (IEEE80211_TX_CTL_NO_ACK |
- 			       IEEE80211_TX_CTL_USE_MINRATE)) ||
--		!ieee80211_is_data(fc);
-+		!ieee80211_is_tx_data(skb);
- }
- 
- static void rc_send_low_basicrate(struct ieee80211_tx_rate *rate,
-@@ -870,7 +866,6 @@ void ieee80211_get_tx_rates(struct ieee8
- 			    int max_rates)
- {
- 	struct ieee80211_sub_if_data *sdata;
--	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_supported_band *sband;
- 
-@@ -882,7 +877,7 @@ void ieee80211_get_tx_rates(struct ieee8
- 	sdata = vif_to_sdata(vif);
- 	sband = sdata->local->hw.wiphy->bands[info->band];
- 
--	if (ieee80211_is_data(hdr->frame_control))
-+	if (ieee80211_is_tx_data(skb))
- 		rate_control_apply_mask(sdata, sta, sband, dest, max_rates);
- 
- 	if (dest[0].idx < 0)
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -679,6 +679,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
- 	u32 len;
- 	struct ieee80211_tx_rate_control txrc;
- 	struct ieee80211_sta_rates *ratetbl = NULL;
-+	bool encap = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
- 	bool assoc = false;
- 
- 	memset(&txrc, 0, sizeof(txrc));
-@@ -720,7 +721,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
- 	 * just wants a probe response.
- 	 */
- 	if (tx->sdata->vif.bss_conf.use_short_preamble &&
--	    (ieee80211_is_data(hdr->frame_control) ||
-+	    (ieee80211_is_tx_data(tx->skb) ||
- 	     (tx->sta && test_sta_flag(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
- 		txrc.short_preamble = true;
- 
-@@ -742,7 +743,8 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
- 		 "%s: Dropped data frame as no usable bitrate found while "
- 		 "scanning and associated. Target station: "
- 		 "%pM on %d GHz band\n",
--		 tx->sdata->name, hdr->addr1,
-+		 tx->sdata->name,
-+		 encap ? ((struct ethhdr *)hdr)->h_dest : hdr->addr1,
- 		 info->band ? 5 : 2))
- 		return TX_DROP;
- 
-@@ -776,7 +778,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
- 
- 	if (txrc.reported_rate.idx < 0) {
- 		txrc.reported_rate = tx->rate;
--		if (tx->sta && ieee80211_is_data(hdr->frame_control))
-+		if (tx->sta && ieee80211_is_tx_data(tx->skb))
- 			tx->sta->tx_stats.last_rate = txrc.reported_rate;
- 	} else if (tx->sta)
- 		tx->sta->tx_stats.last_rate = txrc.reported_rate;
-@@ -3694,8 +3696,16 @@ begin:
- 	else
- 		info->flags &= ~IEEE80211_TX_CTL_AMPDU;
- 
--	if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP)
-+	if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
-+		if (!ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL)) {
-+			r = ieee80211_tx_h_rate_ctrl(&tx);
-+			if (r != TX_CONTINUE) {
-+				ieee80211_free_txskb(&local->hw, skb);
-+				goto begin;
-+			}
-+		}
- 		goto encap_out;
-+	}
- 
- 	if (info->control.flags & IEEE80211_TX_CTRL_FAST_XMIT) {
- 		struct sta_info *sta = container_of(txq->sta, struct sta_info,
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -6733,4 +6733,22 @@ struct sk_buff *ieee80211_get_fils_disco
- struct sk_buff *
- ieee80211_get_unsol_bcast_probe_resp_tmpl(struct ieee80211_hw *hw,
- 					  struct ieee80211_vif *vif);
-+
-+/**
-+ * ieee80211_is_tx_data - check if frame is a data frame
-+ *
-+ * The function is used to check if a frame is a data frame. Frames with
-+ * hardware encapsulation enabled are data frames.
-+ *
-+ * @skb: the frame to be transmitted.
-+ */
-+static inline bool ieee80211_is_tx_data(struct sk_buff *skb)
-+{
-+	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	struct ieee80211_hdr *hdr = (void *) skb->data;
-+
-+	return info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP ||
-+	       ieee80211_is_data(hdr->frame_control);
-+}
-+
- #endif /* MAC80211_H */
diff --git a/package/kernel/mac80211/patches/subsys/377-mac80211-minstrel_ht-fix-sample-time-check.patch b/package/kernel/mac80211/patches/subsys/377-mac80211-minstrel_ht-fix-sample-time-check.patch
deleted file mode 100644
index 054662f3ef..0000000000
--- a/package/kernel/mac80211/patches/subsys/377-mac80211-minstrel_ht-fix-sample-time-check.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Thu, 17 Jun 2021 12:05:54 +0200
-Subject: [PATCH] mac80211: minstrel_ht: fix sample time check
-
-We need to skip sampling if the next sample time is after jiffies, not before.
-This patch fixes an issue where in some cases only very little sampling (or none
-at all) is performed, leading to really bad data rates
-
-Fixes: 80d55154b2f8 ("mac80211: minstrel_ht: significantly redesign the rate probing strategy")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -1450,7 +1450,7 @@ minstrel_ht_get_rate(void *priv, struct
- 	    (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO))
- 		return;
- 
--	if (time_is_before_jiffies(mi->sample_time))
-+	if (time_is_after_jiffies(mi->sample_time))
- 		return;
- 
- 	mi->sample_time = jiffies + MINSTREL_SAMPLE_INTERVAL;
diff --git a/package/kernel/mac80211/patches/subsys/379-mac80211-fix-starting-aggregation-sessions-on-mesh-i.patch b/package/kernel/mac80211/patches/subsys/379-mac80211-fix-starting-aggregation-sessions-on-mesh-i.patch
deleted file mode 100644
index a684b59382..0000000000
--- a/package/kernel/mac80211/patches/subsys/379-mac80211-fix-starting-aggregation-sessions-on-mesh-i.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 29 Jun 2021 13:25:09 +0200
-Subject: [PATCH] mac80211: fix starting aggregation sessions on mesh
- interfaces
-
-The logic for starting aggregation sessions was recently moved from minstrel_ht
-to mac80211, into the subif tx handler just after the sta lookup.
-Unfortunately this didn't work for mesh interfaces, since the sta lookup is
-deferred until a much later point in time on those.
-Fix this by also calling the aggregation check right after the deferred sta
-lookup.
-
-Fixes: 08a46c642001 ("mac80211: move A-MPDU session check from minstrel_ht to mac80211")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1159,6 +1159,29 @@ static bool ieee80211_tx_prep_agg(struct
- 	return queued;
- }
- 
-+static void
-+ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata,
-+		     struct sta_info *sta,
-+		     struct sk_buff *skb)
-+{
-+	struct rate_control_ref *ref = sdata->local->rate_ctrl;
-+	u16 tid;
-+
-+	if (!ref || !(ref->ops->capa & RATE_CTRL_CAPA_AMPDU_TRIGGER))
-+		return;
-+
-+	if (!sta || !sta->sta.ht_cap.ht_supported ||
-+	    !sta->sta.wme || skb_get_queue_mapping(skb) == IEEE80211_AC_VO ||
-+	    skb->protocol == sdata->control_port_protocol)
-+		return;
-+
-+	tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
-+	if (likely(sta->ampdu_mlme.tid_tx[tid]))
-+		return;
-+
-+	ieee80211_start_tx_ba_session(&sta->sta, tid, 0);
-+}
-+
- /*
-  * initialises @tx
-  * pass %NULL for the station if unknown, a valid pointer if known
-@@ -1172,6 +1195,7 @@ ieee80211_tx_prepare(struct ieee80211_su
- 	struct ieee80211_local *local = sdata->local;
- 	struct ieee80211_hdr *hdr;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	bool aggr_check = false;
- 	int tid;
- 
- 	memset(tx, 0, sizeof(*tx));
-@@ -1200,8 +1224,10 @@ ieee80211_tx_prepare(struct ieee80211_su
- 		} else if (tx->sdata->control_port_protocol == tx->skb->protocol) {
- 			tx->sta = sta_info_get_bss(sdata, hdr->addr1);
- 		}
--		if (!tx->sta && !is_multicast_ether_addr(hdr->addr1))
-+		if (!tx->sta && !is_multicast_ether_addr(hdr->addr1)) {
- 			tx->sta = sta_info_get(sdata, hdr->addr1);
-+			aggr_check = true;
-+		}
- 	}
- 
- 	if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
-@@ -1211,8 +1237,12 @@ ieee80211_tx_prepare(struct ieee80211_su
- 		struct tid_ampdu_tx *tid_tx;
- 
- 		tid = ieee80211_get_tid(hdr);
--
- 		tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]);
-+		if (!tid_tx && aggr_check) {
-+			ieee80211_aggr_check(sdata, tx->sta, skb);
-+			tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]);
-+		}
-+
- 		if (tid_tx) {
- 			bool queued;
- 
-@@ -3981,29 +4011,6 @@ void ieee80211_txq_schedule_start(struct
- }
- EXPORT_SYMBOL(ieee80211_txq_schedule_start);
- 
--static void
--ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata,
--		     struct sta_info *sta,
--		     struct sk_buff *skb)
--{
--	struct rate_control_ref *ref = sdata->local->rate_ctrl;
--	u16 tid;
--
--	if (!ref || !(ref->ops->capa & RATE_CTRL_CAPA_AMPDU_TRIGGER))
--		return;
--
--	if (!sta || !sta->sta.ht_cap.ht_supported ||
--	    !sta->sta.wme || skb_get_queue_mapping(skb) == IEEE80211_AC_VO ||
--	    skb->protocol == sdata->control_port_protocol)
--		return;
--
--	tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
--	if (likely(sta->ampdu_mlme.tid_tx[tid]))
--		return;
--
--	ieee80211_start_tx_ba_session(&sta->sta, tid, 0);
--}
--
- void __ieee80211_subif_start_xmit(struct sk_buff *skb,
- 				  struct net_device *dev,
- 				  u32 info_flags,
diff --git a/package/kernel/mac80211/patches/subsys/380-mac80211-introduce-aql_enable-node-in-debugfs.patch b/package/kernel/mac80211/patches/subsys/380-mac80211-introduce-aql_enable-node-in-debugfs.patch
deleted file mode 100644
index be370174d9..0000000000
--- a/package/kernel/mac80211/patches/subsys/380-mac80211-introduce-aql_enable-node-in-debugfs.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Sat, 9 Jan 2021 18:57:51 +0100
-Subject: [PATCH] mac80211: introduce aql_enable node in debugfs
-
-Introduce aql_enable node in debugfs in order to enable/disable aql.
-This is useful for debugging purpose.
-
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://lore.kernel.org/r/e7a934d5d84e4796c4f97ea5de4e66c824296b07.1610214851.git.lorenzo@kernel.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/debugfs.c
-+++ b/net/mac80211/debugfs.c
-@@ -281,6 +281,56 @@ static const struct file_operations aql_
- 	.llseek = default_llseek,
- };
- 
-+static ssize_t aql_enable_read(struct file *file, char __user *user_buf,
-+			       size_t count, loff_t *ppos)
-+{
-+	char buf[3];
-+	int len;
-+
-+	len = scnprintf(buf, sizeof(buf), "%d\n",
-+			!static_key_false(&aql_disable.key));
-+
-+	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-+}
-+
-+static ssize_t aql_enable_write(struct file *file, const char __user *user_buf,
-+				size_t count, loff_t *ppos)
-+{
-+	bool aql_disabled = static_key_false(&aql_disable.key);
-+	char buf[3];
-+	size_t len;
-+
-+	if (count > sizeof(buf))
-+		return -EINVAL;
-+
-+	if (copy_from_user(buf, user_buf, count))
-+		return -EFAULT;
-+
-+	buf[sizeof(buf) - 1] = '\0';
-+	len = strlen(buf);
-+	if (len > 0 && buf[len - 1] == '\n')
-+		buf[len - 1] = 0;
-+
-+	if (buf[0] == '0' && buf[1] == '\0') {
-+		if (!aql_disabled)
-+			static_branch_inc(&aql_disable);
-+	} else if (buf[0] == '1' && buf[1] == '\0') {
-+		if (aql_disabled)
-+			static_branch_dec(&aql_disable);
-+	} else {
-+		return -EINVAL;
-+	}
-+
-+	return count;
-+}
-+
-+static const struct file_operations aql_enable_ops = {
-+	.write = aql_enable_write,
-+	.read = aql_enable_read,
-+	.open = simple_open,
-+	.llseek = default_llseek,
-+};
-+
- static ssize_t force_tx_status_read(struct file *file,
- 				    char __user *user_buf,
- 				    size_t count,
-@@ -569,6 +619,7 @@ void debugfs_hw_add(struct ieee80211_loc
- 	DEBUGFS_ADD(power);
- 	DEBUGFS_ADD(hw_conf);
- 	DEBUGFS_ADD_MODE(force_tx_status, 0600);
-+	DEBUGFS_ADD_MODE(aql_enable, 0600);
- 
- 	if (local->ops->wake_tx_queue)
- 		DEBUGFS_ADD_MODE(aqm, 0600);
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -1140,6 +1140,8 @@ enum mac80211_scan_state {
- 	SCAN_ABORT,
- };
- 
-+DECLARE_STATIC_KEY_FALSE(aql_disable);
-+
- struct ieee80211_local {
- 	/* embed the driver visible part.
- 	 * don't cast (use the static inlines below), but we keep
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3921,6 +3921,8 @@ void __ieee80211_schedule_txq(struct iee
- }
- EXPORT_SYMBOL(__ieee80211_schedule_txq);
- 
-+DEFINE_STATIC_KEY_FALSE(aql_disable);
-+
- bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,
- 				 struct ieee80211_txq *txq)
- {
-@@ -3930,6 +3932,9 @@ bool ieee80211_txq_airtime_check(struct
- 	if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
- 		return true;
- 
-+	if (static_branch_unlikely(&aql_disable))
-+		return true;
-+
- 	if (!txq->sta)
- 		return true;
- 
diff --git a/package/kernel/mac80211/patches/subsys/381-mac80211-rearrange-struct-txq_info-for-fewer-holes.patch b/package/kernel/mac80211/patches/subsys/381-mac80211-rearrange-struct-txq_info-for-fewer-holes.patch
deleted file mode 100644
index 708ad6f460..0000000000
--- a/package/kernel/mac80211/patches/subsys/381-mac80211-rearrange-struct-txq_info-for-fewer-holes.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Fri, 18 Jun 2021 13:41:44 +0300
-Subject: [PATCH] mac80211: rearrange struct txq_info for fewer holes
-
-We can slightly decrease the size of struct txq_info by
-rearranging some fields for fewer holes, so do that.
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Link: https://lore.kernel.org/r/iwlwifi.20210618133832.1bf019a1fe2e.Ib54622b8d6dc1a9a7dc484e573c073119450538b@changeid
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -5,7 +5,7 @@
-  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
-  * Copyright 2007-2010	Johannes Berg <johannes@sipsolutions.net>
-  * Copyright 2013-2015  Intel Mobile Communications GmbH
-- * Copyright (C) 2018-2020 Intel Corporation
-+ * Copyright (C) 2018-2021 Intel Corporation
-  */
- 
- #ifndef IEEE80211_I_H
-@@ -848,9 +848,12 @@ struct txq_info {
- 	struct fq_tin tin;
- 	struct codel_vars def_cvars;
- 	struct codel_stats cstats;
--	struct sk_buff_head frags;
--	struct list_head schedule_order;
-+
- 	u16 schedule_round;
-+	struct list_head schedule_order;
-+
-+	struct sk_buff_head frags;
-+
- 	unsigned long flags;
- 
- 	/* keep last! */
diff --git a/package/kernel/mac80211/patches/subsys/382-mac80211-Switch-to-a-virtual-time-based-airtime-sche.patch b/package/kernel/mac80211/patches/subsys/382-mac80211-Switch-to-a-virtual-time-based-airtime-sche.patch
deleted file mode 100644
index 022c449f79..0000000000
--- a/package/kernel/mac80211/patches/subsys/382-mac80211-Switch-to-a-virtual-time-based-airtime-sche.patch
+++ /dev/null
@@ -1,1277 +0,0 @@
-From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@redhat.com>
-Date: Wed, 23 Jun 2021 15:47:55 +0200
-Subject: [PATCH] mac80211: Switch to a virtual time-based airtime scheduler
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This switches the airtime scheduler in mac80211 to use a virtual
-time-based scheduler instead of the round-robin scheduler used before.
-This has a couple of advantages:
-
-- No need to sync up the round-robin scheduler in firmware/hardware with
-  the round-robin airtime scheduler.
-
-- If several stations are eligible for transmission we can schedule both
-  of them; no need to hard-block the scheduling rotation until the head
-  of the queue has used up its quantum.
-
-- The check of whether a station is eligible for transmission becomes
-  simpler (in ieee80211_txq_may_transmit()).
-
-The drawback is that scheduling becomes slightly more expensive, as we
-need to maintain an rbtree of TXQs sorted by virtual time. This means
-that ieee80211_register_airtime() becomes O(logN) in the number of
-currently scheduled TXQs because it can change the order of the
-scheduled stations. We mitigate this overhead by only resorting when a
-station changes position in the tree, and hopefully N rarely grows too
-big (it's only TXQs currently backlogged, not all associated stations),
-so it shouldn't be too big of an issue.
-
-To prevent divisions in the fast path, we maintain both station sums and
-pre-computed reciprocals of the sums. This turns the fast-path operation
-into a multiplication, with divisions only happening as the number of
-active stations change (to re-compute the current sum of all active
-station weights). To prevent this re-computation of the reciprocal from
-happening too frequently, we use a time-based notion of station
-activity, instead of updating the weight every time a station gets
-scheduled or de-scheduled. As queues can oscillate between empty and
-occupied quite frequently, this can significantly cut down on the number
-of re-computations. It also has the added benefit of making the station
-airtime calculation independent on whether the queue happened to have
-drained at the time an airtime value was accounted.
-
-Co-developed-by: Yibo Zhao <yiboz@codeaurora.org>
-Signed-off-by: Yibo Zhao <yiboz@codeaurora.org>
-Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
-Link: https://lore.kernel.org/r/20210623134755.235545-1-toke@redhat.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -6557,9 +6557,6 @@ static inline void ieee80211_txq_schedul
- {
- }
- 
--void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
--			      struct ieee80211_txq *txq, bool force);
--
- /**
-  * ieee80211_schedule_txq - schedule a TXQ for transmission
-  *
-@@ -6572,11 +6569,7 @@ void __ieee80211_schedule_txq(struct iee
-  * The driver may call this function if it has buffered packets for
-  * this TXQ internally.
-  */
--static inline void
--ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
--{
--	__ieee80211_schedule_txq(hw, txq, true);
--}
-+void ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq);
- 
- /**
-  * ieee80211_return_txq - return a TXQ previously acquired by ieee80211_next_txq()
-@@ -6588,12 +6581,8 @@ ieee80211_schedule_txq(struct ieee80211_
-  * The driver may set force=true if it has buffered packets for this TXQ
-  * internally.
-  */
--static inline void
--ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq,
--		     bool force)
--{
--	__ieee80211_schedule_txq(hw, txq, force);
--}
-+void ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq,
-+			  bool force);
- 
- /**
-  * ieee80211_txq_may_transmit - check whether TXQ is allowed to transmit
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -1464,6 +1464,38 @@ static void sta_apply_mesh_params(struct
- #endif
- }
- 
-+static void sta_apply_airtime_params(struct ieee80211_local *local,
-+				     struct sta_info *sta,
-+				     struct station_parameters *params)
-+{
-+	u8 ac;
-+
-+	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
-+		struct airtime_sched_info *air_sched = &local->airtime[ac];
-+		struct airtime_info *air_info = &sta->airtime[ac];
-+		struct txq_info *txqi;
-+		u8 tid;
-+
-+		spin_lock_bh(&air_sched->lock);
-+		for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
-+			if (air_info->weight == params->airtime_weight ||
-+			    !sta->sta.txq[tid] ||
-+			    ac != ieee80211_ac_from_tid(tid))
-+				continue;
-+
-+			airtime_weight_set(air_info, params->airtime_weight);
-+
-+			txqi = to_txq_info(sta->sta.txq[tid]);
-+			if (RB_EMPTY_NODE(&txqi->schedule_order))
-+				continue;
-+
-+			ieee80211_update_airtime_weight(local, air_sched,
-+							0, true);
-+		}
-+		spin_unlock_bh(&air_sched->lock);
-+	}
-+}
-+
- static int sta_apply_parameters(struct ieee80211_local *local,
- 				struct sta_info *sta,
- 				struct station_parameters *params)
-@@ -1651,7 +1683,8 @@ static int sta_apply_parameters(struct i
- 		sta_apply_mesh_params(local, sta, params);
- 
- 	if (params->airtime_weight)
--		sta->airtime_weight = params->airtime_weight;
-+		sta_apply_airtime_params(local, sta, params);
-+
- 
- 	/* set the STA state after all sta info from usermode has been set */
- 	if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) ||
---- a/net/mac80211/debugfs.c
-+++ b/net/mac80211/debugfs.c
-@@ -216,14 +216,14 @@ static ssize_t aql_txq_limit_read(struct
- 			"VI	%u		%u\n"
- 			"BE	%u		%u\n"
- 			"BK	%u		%u\n",
--			local->aql_txq_limit_low[IEEE80211_AC_VO],
--			local->aql_txq_limit_high[IEEE80211_AC_VO],
--			local->aql_txq_limit_low[IEEE80211_AC_VI],
--			local->aql_txq_limit_high[IEEE80211_AC_VI],
--			local->aql_txq_limit_low[IEEE80211_AC_BE],
--			local->aql_txq_limit_high[IEEE80211_AC_BE],
--			local->aql_txq_limit_low[IEEE80211_AC_BK],
--			local->aql_txq_limit_high[IEEE80211_AC_BK]);
-+			local->airtime[IEEE80211_AC_VO].aql_txq_limit_low,
-+			local->airtime[IEEE80211_AC_VO].aql_txq_limit_high,
-+			local->airtime[IEEE80211_AC_VI].aql_txq_limit_low,
-+			local->airtime[IEEE80211_AC_VI].aql_txq_limit_high,
-+			local->airtime[IEEE80211_AC_BE].aql_txq_limit_low,
-+			local->airtime[IEEE80211_AC_BE].aql_txq_limit_high,
-+			local->airtime[IEEE80211_AC_BK].aql_txq_limit_low,
-+			local->airtime[IEEE80211_AC_BK].aql_txq_limit_high);
- 	return simple_read_from_buffer(user_buf, count, ppos,
- 				       buf, len);
- }
-@@ -255,11 +255,11 @@ static ssize_t aql_txq_limit_write(struc
- 	if (ac >= IEEE80211_NUM_ACS)
- 		return -EINVAL;
- 
--	q_limit_low_old = local->aql_txq_limit_low[ac];
--	q_limit_high_old = local->aql_txq_limit_high[ac];
-+	q_limit_low_old = local->airtime[ac].aql_txq_limit_low;
-+	q_limit_high_old = local->airtime[ac].aql_txq_limit_high;
- 
--	local->aql_txq_limit_low[ac] = q_limit_low;
--	local->aql_txq_limit_high[ac] = q_limit_high;
-+	local->airtime[ac].aql_txq_limit_low = q_limit_low;
-+	local->airtime[ac].aql_txq_limit_high = q_limit_high;
- 
- 	mutex_lock(&local->sta_mtx);
- 	list_for_each_entry(sta, &local->sta_list, list) {
-@@ -382,6 +382,46 @@ static const struct file_operations forc
- 	.llseek = default_llseek,
- };
- 
-+static ssize_t airtime_read(struct file *file,
-+			    char __user *user_buf,
-+			    size_t count,
-+			    loff_t *ppos)
-+{
-+	struct ieee80211_local *local = file->private_data;
-+	char buf[200];
-+	u64 v_t[IEEE80211_NUM_ACS];
-+	u64 wt[IEEE80211_NUM_ACS];
-+	int len = 0, ac;
-+
-+	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
-+		spin_lock_bh(&local->airtime[ac].lock);
-+		v_t[ac] = local->airtime[ac].v_t;
-+		wt[ac] = local->airtime[ac].weight_sum;
-+		spin_unlock_bh(&local->airtime[ac].lock);
-+	}
-+	len = scnprintf(buf, sizeof(buf),
-+			"\tVO         VI         BE         BK\n"
-+			"Virt-t\t%-10llu %-10llu %-10llu %-10llu\n"
-+			"Weight\t%-10llu %-10llu %-10llu %-10llu\n",
-+			v_t[0],
-+			v_t[1],
-+			v_t[2],
-+			v_t[3],
-+			wt[0],
-+			wt[1],
-+			wt[2],
-+			wt[3]);
-+
-+	return simple_read_from_buffer(user_buf, count, ppos,
-+				       buf, len);
-+}
-+
-+static const struct file_operations airtime_ops = {
-+	.read = airtime_read,
-+	.open = simple_open,
-+	.llseek = default_llseek,
-+};
-+
- #ifdef CONFIG_PM
- static ssize_t reset_write(struct file *file, const char __user *user_buf,
- 			   size_t count, loff_t *ppos)
-@@ -624,7 +664,11 @@ void debugfs_hw_add(struct ieee80211_loc
- 	if (local->ops->wake_tx_queue)
- 		DEBUGFS_ADD_MODE(aqm, 0600);
- 
--	DEBUGFS_ADD_MODE(airtime_flags, 0600);
-+	if (wiphy_ext_feature_isset(local->hw.wiphy,
-+				    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) {
-+		DEBUGFS_ADD_MODE(airtime, 0600);
-+		DEBUGFS_ADD_MODE(airtime_flags, 0600);
-+	}
- 
- 	DEBUGFS_ADD(aql_txq_limit);
- 	debugfs_create_u32("aql_threshold", 0600,
---- a/net/mac80211/debugfs_netdev.c
-+++ b/net/mac80211/debugfs_netdev.c
-@@ -513,6 +513,34 @@ static ssize_t ieee80211_if_fmt_aqm(
- }
- IEEE80211_IF_FILE_R(aqm);
- 
-+static ssize_t ieee80211_if_fmt_airtime(
-+	const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
-+{
-+	struct ieee80211_local *local = sdata->local;
-+	struct ieee80211_txq *txq = sdata->vif.txq;
-+	struct airtime_info *air_info;
-+	int len;
-+
-+	if (!txq)
-+		return 0;
-+
-+	spin_lock_bh(&local->airtime[txq->ac].lock);
-+	air_info = to_airtime_info(txq);
-+	len = scnprintf(buf,
-+			buflen,
-+			"RX: %llu us\nTX: %llu us\nWeight: %u\n"
-+			"Virt-T: %lld us\n",
-+			air_info->rx_airtime,
-+			air_info->tx_airtime,
-+			air_info->weight,
-+			air_info->v_t);
-+	spin_unlock_bh(&local->airtime[txq->ac].lock);
-+
-+	return len;
-+}
-+
-+IEEE80211_IF_FILE_R(airtime);
-+
- IEEE80211_IF_FILE(multicast_to_unicast, u.ap.multicast_to_unicast, HEX);
- 
- /* IBSS attributes */
-@@ -661,8 +689,10 @@ static void add_common_files(struct ieee
- 
- 	if (sdata->local->ops->wake_tx_queue &&
- 	    sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
--	    sdata->vif.type != NL80211_IFTYPE_NAN)
-+	    sdata->vif.type != NL80211_IFTYPE_NAN) {
- 		DEBUGFS_ADD(aqm);
-+		DEBUGFS_ADD(airtime);
-+	}
- }
- 
- static void add_sta_files(struct ieee80211_sub_if_data *sdata)
---- a/net/mac80211/debugfs_sta.c
-+++ b/net/mac80211/debugfs_sta.c
-@@ -202,7 +202,7 @@ static ssize_t sta_airtime_read(struct f
- 	size_t bufsz = 400;
- 	char *buf = kzalloc(bufsz, GFP_KERNEL), *p = buf;
- 	u64 rx_airtime = 0, tx_airtime = 0;
--	s64 deficit[IEEE80211_NUM_ACS];
-+	u64 v_t[IEEE80211_NUM_ACS];
- 	ssize_t rv;
- 	int ac;
- 
-@@ -210,18 +210,18 @@ static ssize_t sta_airtime_read(struct f
- 		return -ENOMEM;
- 
- 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
--		spin_lock_bh(&local->active_txq_lock[ac]);
-+		spin_lock_bh(&local->airtime[ac].lock);
- 		rx_airtime += sta->airtime[ac].rx_airtime;
- 		tx_airtime += sta->airtime[ac].tx_airtime;
--		deficit[ac] = sta->airtime[ac].deficit;
--		spin_unlock_bh(&local->active_txq_lock[ac]);
-+		v_t[ac] = sta->airtime[ac].v_t;
-+		spin_unlock_bh(&local->airtime[ac].lock);
- 	}
- 
- 	p += scnprintf(p, bufsz + buf - p,
- 		"RX: %llu us\nTX: %llu us\nWeight: %u\n"
--		"Deficit: VO: %lld us VI: %lld us BE: %lld us BK: %lld us\n",
--		rx_airtime, tx_airtime, sta->airtime_weight,
--		deficit[0], deficit[1], deficit[2], deficit[3]);
-+		"Virt-T: VO: %lld us VI: %lld us BE: %lld us BK: %lld us\n",
-+		rx_airtime, tx_airtime, sta->airtime[0].weight,
-+		v_t[0], v_t[1], v_t[2], v_t[3]);
- 
- 	rv = simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
- 	kfree(buf);
-@@ -236,11 +236,11 @@ static ssize_t sta_airtime_write(struct
- 	int ac;
- 
- 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
--		spin_lock_bh(&local->active_txq_lock[ac]);
-+		spin_lock_bh(&local->airtime[ac].lock);
- 		sta->airtime[ac].rx_airtime = 0;
- 		sta->airtime[ac].tx_airtime = 0;
--		sta->airtime[ac].deficit = sta->airtime_weight;
--		spin_unlock_bh(&local->active_txq_lock[ac]);
-+		sta->airtime[ac].v_t = 0;
-+		spin_unlock_bh(&local->airtime[ac].lock);
- 	}
- 
- 	return count;
-@@ -263,10 +263,10 @@ static ssize_t sta_aql_read(struct file
- 		return -ENOMEM;
- 
- 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
--		spin_lock_bh(&local->active_txq_lock[ac]);
-+		spin_lock_bh(&local->airtime[ac].lock);
- 		q_limit_l[ac] = sta->airtime[ac].aql_limit_low;
- 		q_limit_h[ac] = sta->airtime[ac].aql_limit_high;
--		spin_unlock_bh(&local->active_txq_lock[ac]);
-+		spin_unlock_bh(&local->airtime[ac].lock);
- 		q_depth[ac] = atomic_read(&sta->airtime[ac].aql_tx_pending);
- 	}
- 
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -840,20 +840,16 @@ enum txq_info_flags {
-  * @def_flow: used as a fallback flow when a packet destined to @tin hashes to
-  *	a fq_flow which is already owned by a different tin
-  * @def_cvars: codel vars for @def_flow
-- * @frags: used to keep fragments created after dequeue
-  * @schedule_order: used with ieee80211_local->active_txqs
-- * @schedule_round: counter to prevent infinite loops on TXQ scheduling
-+ * @frags: used to keep fragments created after dequeue
-  */
- struct txq_info {
- 	struct fq_tin tin;
- 	struct codel_vars def_cvars;
- 	struct codel_stats cstats;
--
--	u16 schedule_round;
--	struct list_head schedule_order;
-+	struct rb_node schedule_order;
- 
- 	struct sk_buff_head frags;
--
- 	unsigned long flags;
- 
- 	/* keep last! */
-@@ -930,6 +926,8 @@ struct ieee80211_sub_if_data {
- 	struct ieee80211_tx_queue_params tx_conf[IEEE80211_NUM_ACS];
- 	struct mac80211_qos_map __rcu *qos_map;
- 
-+	struct airtime_info airtime[IEEE80211_NUM_ACS];
-+
- 	struct work_struct csa_finalize_work;
- 	bool csa_block_tx; /* write-protected by sdata_lock and local->mtx */
- 	struct cfg80211_chan_def csa_chandef;
-@@ -1143,6 +1141,44 @@ enum mac80211_scan_state {
- 	SCAN_ABORT,
- };
- 
-+/**
-+ * struct airtime_sched_info - state used for airtime scheduling and AQL
-+ *
-+ * @lock: spinlock that protects all the fields in this struct
-+ * @active_txqs: rbtree of currently backlogged queues, sorted by virtual time
-+ * @schedule_pos: the current position maintained while a driver walks the tree
-+ *                with ieee80211_next_txq()
-+ * @active_list: list of struct airtime_info structs that were active within
-+ *               the last AIRTIME_ACTIVE_DURATION (100 ms), used to compute
-+ *               weight_sum
-+ * @last_weight_update: used for rate limiting walking active_list
-+ * @last_schedule_time: tracks the last time a transmission was scheduled; used
-+ *                      for catching up v_t if no stations are eligible for
-+ *                      transmission.
-+ * @v_t: global virtual time; queues with v_t < this are eligible for
-+ *       transmission
-+ * @weight_sum: total sum of all active stations used for dividing airtime
-+ * @weight_sum_reciprocal: reciprocal of weight_sum (to avoid divisions in fast
-+ *                         path - see comment above
-+ *                         IEEE80211_RECIPROCAL_DIVISOR_64)
-+ * @aql_txq_limit_low: AQL limit when total outstanding airtime
-+ *                     is < IEEE80211_AQL_THRESHOLD
-+ * @aql_txq_limit_high: AQL limit when total outstanding airtime
-+ *                      is > IEEE80211_AQL_THRESHOLD
-+ */
-+struct airtime_sched_info {
-+	spinlock_t lock;
-+	struct rb_root_cached active_txqs;
-+	struct rb_node *schedule_pos;
-+	struct list_head active_list;
-+	u64 last_weight_update;
-+	u64 last_schedule_activity;
-+	u64 v_t;
-+	u64 weight_sum;
-+	u64 weight_sum_reciprocal;
-+	u32 aql_txq_limit_low;
-+	u32 aql_txq_limit_high;
-+};
- DECLARE_STATIC_KEY_FALSE(aql_disable);
- 
- struct ieee80211_local {
-@@ -1156,13 +1192,8 @@ struct ieee80211_local {
- 	struct codel_params cparams;
- 
- 	/* protects active_txqs and txqi->schedule_order */
--	spinlock_t active_txq_lock[IEEE80211_NUM_ACS];
--	struct list_head active_txqs[IEEE80211_NUM_ACS];
--	u16 schedule_round[IEEE80211_NUM_ACS];
--
-+	struct airtime_sched_info airtime[IEEE80211_NUM_ACS];
- 	u16 airtime_flags;
--	u32 aql_txq_limit_low[IEEE80211_NUM_ACS];
--	u32 aql_txq_limit_high[IEEE80211_NUM_ACS];
- 	u32 aql_threshold;
- 	atomic_t aql_total_pending_airtime;
- 
-@@ -1581,6 +1612,125 @@ static inline bool txq_has_queue(struct
- 	return !(skb_queue_empty(&txqi->frags) && !txqi->tin.backlog_packets);
- }
- 
-+static inline struct airtime_info *to_airtime_info(struct ieee80211_txq *txq)
-+{
-+	struct ieee80211_sub_if_data *sdata;
-+	struct sta_info *sta;
-+
-+	if (txq->sta) {
-+		sta = container_of(txq->sta, struct sta_info, sta);
-+		return &sta->airtime[txq->ac];
-+	}
-+
-+	sdata = vif_to_sdata(txq->vif);
-+	return &sdata->airtime[txq->ac];
-+}
-+
-+/* To avoid divisions in the fast path, we keep pre-computed reciprocals for
-+ * airtime weight calculations. There are two different weights to keep track
-+ * of: The per-station weight and the sum of weights per phy.
-+ *
-+ * For the per-station weights (kept in airtime_info below), we use 32-bit
-+ * reciprocals with a devisor of 2^19. This lets us keep the multiplications and
-+ * divisions for the station weights as 32-bit operations at the cost of a bit
-+ * of rounding error for high weights; but the choice of divisor keeps rounding
-+ * errors <10% for weights <2^15, assuming no more than 8ms of airtime is
-+ * reported at a time.
-+ *
-+ * For the per-phy sum of weights the values can get higher, so we use 64-bit
-+ * operations for those with a 32-bit divisor, which should avoid any
-+ * significant rounding errors.
-+ */
-+#define IEEE80211_RECIPROCAL_DIVISOR_64 0x100000000ULL
-+#define IEEE80211_RECIPROCAL_SHIFT_64 32
-+#define IEEE80211_RECIPROCAL_DIVISOR_32 0x80000U
-+#define IEEE80211_RECIPROCAL_SHIFT_32 19
-+
-+static inline void airtime_weight_set(struct airtime_info *air_info, u16 weight)
-+{
-+	if (air_info->weight == weight)
-+		return;
-+
-+	air_info->weight = weight;
-+	if (weight) {
-+		air_info->weight_reciprocal =
-+			IEEE80211_RECIPROCAL_DIVISOR_32 / weight;
-+	} else {
-+		air_info->weight_reciprocal = 0;
-+	}
-+}
-+
-+static inline void airtime_weight_sum_set(struct airtime_sched_info *air_sched,
-+					  int weight_sum)
-+{
-+	if (air_sched->weight_sum == weight_sum)
-+		return;
-+
-+	air_sched->weight_sum = weight_sum;
-+	if (air_sched->weight_sum) {
-+		air_sched->weight_sum_reciprocal = IEEE80211_RECIPROCAL_DIVISOR_64;
-+		do_div(air_sched->weight_sum_reciprocal, air_sched->weight_sum);
-+	} else {
-+		air_sched->weight_sum_reciprocal = 0;
-+	}
-+}
-+
-+/* A problem when trying to enforce airtime fairness is that we want to divide
-+ * the airtime between the currently *active* stations. However, basing this on
-+ * the instantaneous queue state of stations doesn't work, as queues tend to
-+ * oscillate very quickly between empty and occupied, leading to the scheduler
-+ * thinking only a single station is active when deciding whether to allow
-+ * transmission (and thus not throttling correctly).
-+ *
-+ * To fix this we use a timer-based notion of activity: a station is considered
-+ * active if it has been scheduled within the last 100 ms; we keep a separate
-+ * list of all the stations considered active in this manner, and lazily update
-+ * the total weight of active stations from this list (filtering the stations in
-+ * the list by their 'last active' time).
-+ *
-+ * We add one additional safeguard to guard against stations that manage to get
-+ * scheduled every 100 ms but don't transmit a lot of data, and thus don't use
-+ * up any airtime. Such stations would be able to get priority for an extended
-+ * period of time if they do start transmitting at full capacity again, and so
-+ * we add an explicit maximum for how far behind a station is allowed to fall in
-+ * the virtual airtime domain. This limit is set to a relatively high value of
-+ * 20 ms because the main mechanism for catching up idle stations is the active
-+ * state as described above; i.e., the hard limit should only be hit in
-+ * pathological cases.
-+ */
-+#define AIRTIME_ACTIVE_DURATION (100 * NSEC_PER_MSEC)
-+#define AIRTIME_MAX_BEHIND 20000 /* 20 ms */
-+
-+static inline bool airtime_is_active(struct airtime_info *air_info, u64 now)
-+{
-+	return air_info->last_scheduled >= now - AIRTIME_ACTIVE_DURATION;
-+}
-+
-+static inline void airtime_set_active(struct airtime_sched_info *air_sched,
-+				      struct airtime_info *air_info, u64 now)
-+{
-+	air_info->last_scheduled = now;
-+	air_sched->last_schedule_activity = now;
-+	list_move_tail(&air_info->list, &air_sched->active_list);
-+}
-+
-+static inline bool airtime_catchup_v_t(struct airtime_sched_info *air_sched,
-+				       u64 v_t, u64 now)
-+{
-+	air_sched->v_t = v_t;
-+	return true;
-+}
-+
-+static inline void init_airtime_info(struct airtime_info *air_info,
-+				     struct airtime_sched_info *air_sched)
-+{
-+	atomic_set(&air_info->aql_tx_pending, 0);
-+	air_info->aql_limit_low = air_sched->aql_txq_limit_low;
-+	air_info->aql_limit_high = air_sched->aql_txq_limit_high;
-+	airtime_weight_set(air_info, IEEE80211_DEFAULT_AIRTIME_WEIGHT);
-+	INIT_LIST_HEAD(&air_info->list);
-+}
-+
- static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
- {
- 	return ether_addr_equal(raddr, addr) ||
-@@ -1821,6 +1971,14 @@ int ieee80211_tx_control_port(struct wip
- 			      u64 *cookie);
- int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,
- 			      const u8 *buf, size_t len);
-+void ieee80211_resort_txq(struct ieee80211_hw *hw,
-+			  struct ieee80211_txq *txq);
-+void ieee80211_unschedule_txq(struct ieee80211_hw *hw,
-+			      struct ieee80211_txq *txq,
-+			      bool purge);
-+void ieee80211_update_airtime_weight(struct ieee80211_local *local,
-+				     struct airtime_sched_info *air_sched,
-+				     u64 now, bool force);
- 
- /* HT */
- void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -2088,6 +2088,9 @@ int ieee80211_if_add(struct ieee80211_lo
- 		}
- 	}
- 
-+	for (i = 0; i < IEEE80211_NUM_ACS; i++)
-+		init_airtime_info(&sdata->airtime[i], &local->airtime[i]);
-+
- 	ieee80211_set_default_queues(sdata);
- 
- 	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -693,10 +693,13 @@ struct ieee80211_hw *ieee80211_alloc_hw_
- 	spin_lock_init(&local->queue_stop_reason_lock);
- 
- 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
--		INIT_LIST_HEAD(&local->active_txqs[i]);
--		spin_lock_init(&local->active_txq_lock[i]);
--		local->aql_txq_limit_low[i] = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L;
--		local->aql_txq_limit_high[i] =
-+		struct airtime_sched_info *air_sched = &local->airtime[i];
-+
-+		air_sched->active_txqs = RB_ROOT_CACHED;
-+		INIT_LIST_HEAD(&air_sched->active_list);
-+		spin_lock_init(&air_sched->lock);
-+		air_sched->aql_txq_limit_low = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L;
-+		air_sched->aql_txq_limit_high =
- 			IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H;
- 	}
- 
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -1573,12 +1573,8 @@ static void sta_ps_start(struct sta_info
- 
- 	for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
- 		struct ieee80211_txq *txq = sta->sta.txq[tid];
--		struct txq_info *txqi = to_txq_info(txq);
- 
--		spin_lock(&local->active_txq_lock[txq->ac]);
--		if (!list_empty(&txqi->schedule_order))
--			list_del_init(&txqi->schedule_order);
--		spin_unlock(&local->active_txq_lock[txq->ac]);
-+		ieee80211_unschedule_txq(&local->hw, txq, false);
- 
- 		if (txq_has_queue(txq))
- 			set_bit(tid, &sta->txq_buffered_tids);
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -426,15 +426,11 @@ struct sta_info *sta_info_alloc(struct i
- 	if (sta_prepare_rate_control(local, sta, gfp))
- 		goto free_txq;
- 
--	sta->airtime_weight = IEEE80211_DEFAULT_AIRTIME_WEIGHT;
- 
- 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
- 		skb_queue_head_init(&sta->ps_tx_buf[i]);
- 		skb_queue_head_init(&sta->tx_filtered[i]);
--		sta->airtime[i].deficit = sta->airtime_weight;
--		atomic_set(&sta->airtime[i].aql_tx_pending, 0);
--		sta->airtime[i].aql_limit_low = local->aql_txq_limit_low[i];
--		sta->airtime[i].aql_limit_high = local->aql_txq_limit_high[i];
-+		init_airtime_info(&sta->airtime[i], &local->airtime[i]);
- 	}
- 
- 	for (i = 0; i < IEEE80211_NUM_TIDS; i++)
-@@ -1893,24 +1889,59 @@ void ieee80211_sta_set_buffered(struct i
- }
- EXPORT_SYMBOL(ieee80211_sta_set_buffered);
- 
--void ieee80211_sta_register_airtime(struct ieee80211_sta *pubsta, u8 tid,
--				    u32 tx_airtime, u32 rx_airtime)
-+void ieee80211_register_airtime(struct ieee80211_txq *txq,
-+				u32 tx_airtime, u32 rx_airtime)
- {
--	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
--	struct ieee80211_local *local = sta->sdata->local;
--	u8 ac = ieee80211_ac_from_tid(tid);
-+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
-+	struct ieee80211_local *local = sdata->local;
-+	u64 weight_sum, weight_sum_reciprocal;
-+	struct airtime_sched_info *air_sched;
-+	struct airtime_info *air_info;
- 	u32 airtime = 0;
- 
--	if (sta->local->airtime_flags & AIRTIME_USE_TX)
-+	air_sched = &local->airtime[txq->ac];
-+	air_info = to_airtime_info(txq);
-+
-+	if (local->airtime_flags & AIRTIME_USE_TX)
- 		airtime += tx_airtime;
--	if (sta->local->airtime_flags & AIRTIME_USE_RX)
-+	if (local->airtime_flags & AIRTIME_USE_RX)
- 		airtime += rx_airtime;
- 
--	spin_lock_bh(&local->active_txq_lock[ac]);
--	sta->airtime[ac].tx_airtime += tx_airtime;
--	sta->airtime[ac].rx_airtime += rx_airtime;
--	sta->airtime[ac].deficit -= airtime;
--	spin_unlock_bh(&local->active_txq_lock[ac]);
-+	/* Weights scale so the unit weight is 256 */
-+	airtime <<= 8;
-+
-+	spin_lock_bh(&air_sched->lock);
-+
-+	air_info->tx_airtime += tx_airtime;
-+	air_info->rx_airtime += rx_airtime;
-+
-+	if (air_sched->weight_sum) {
-+		weight_sum = air_sched->weight_sum;
-+		weight_sum_reciprocal = air_sched->weight_sum_reciprocal;
-+	} else {
-+		weight_sum = air_info->weight;
-+		weight_sum_reciprocal = air_info->weight_reciprocal;
-+	}
-+
-+	/* Round the calculation of global vt */
-+	air_sched->v_t += (u64)((airtime + (weight_sum >> 1)) *
-+				weight_sum_reciprocal) >> IEEE80211_RECIPROCAL_SHIFT_64;
-+	air_info->v_t += (u32)((airtime + (air_info->weight >> 1)) *
-+			       air_info->weight_reciprocal) >> IEEE80211_RECIPROCAL_SHIFT_32;
-+	ieee80211_resort_txq(&local->hw, txq);
-+
-+	spin_unlock_bh(&air_sched->lock);
-+}
-+
-+void ieee80211_sta_register_airtime(struct ieee80211_sta *pubsta, u8 tid,
-+				    u32 tx_airtime, u32 rx_airtime)
-+{
-+	struct ieee80211_txq *txq = pubsta->txq[tid];
-+
-+	if (!txq)
-+		return;
-+
-+	ieee80211_register_airtime(txq, tx_airtime, rx_airtime);
- }
- EXPORT_SYMBOL(ieee80211_sta_register_airtime);
- 
-@@ -2354,7 +2385,7 @@ void sta_set_sinfo(struct sta_info *sta,
- 	}
- 
- 	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT))) {
--		sinfo->airtime_weight = sta->airtime_weight;
-+		sinfo->airtime_weight = sta->airtime[0].weight;
- 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT);
- 	}
- 
---- a/net/mac80211/sta_info.h
-+++ b/net/mac80211/sta_info.h
-@@ -135,18 +135,25 @@ enum ieee80211_agg_stop_reason {
- #define AIRTIME_USE_TX		BIT(0)
- #define AIRTIME_USE_RX		BIT(1)
- 
-+
- struct airtime_info {
- 	u64 rx_airtime;
- 	u64 tx_airtime;
--	s64 deficit;
-+	u64 v_t;
-+	u64 last_scheduled;
-+	struct list_head list;
- 	atomic_t aql_tx_pending; /* Estimated airtime for frames pending */
- 	u32 aql_limit_low;
- 	u32 aql_limit_high;
-+	u32 weight_reciprocal;
-+	u16 weight;
- };
- 
- void ieee80211_sta_update_pending_airtime(struct ieee80211_local *local,
- 					  struct sta_info *sta, u8 ac,
- 					  u16 tx_airtime, bool tx_completed);
-+void ieee80211_register_airtime(struct ieee80211_txq *txq,
-+				u32 tx_airtime, u32 rx_airtime);
- 
- struct sta_info;
- 
-@@ -516,7 +523,6 @@ struct ieee80211_fragment_cache {
-  * @tid_seq: per-TID sequence numbers for sending to this STA
-  * @airtime: per-AC struct airtime_info describing airtime statistics for this
-  *	station
-- * @airtime_weight: station weight for airtime fairness calculation purposes
-  * @ampdu_mlme: A-MPDU state machine state
-  * @mesh: mesh STA information
-  * @debugfs_dir: debug filesystem directory dentry
-@@ -647,7 +653,6 @@ struct sta_info {
- 	u16 tid_seq[IEEE80211_QOS_CTL_TID_MASK + 1];
- 
- 	struct airtime_info airtime[IEEE80211_NUM_ACS];
--	u16 airtime_weight;
- 
- 	/*
- 	 * Aggregation information, locked with lock.
---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -972,6 +972,25 @@ static void __ieee80211_tx_status(struct
- 		if (!(info->flags & IEEE80211_TX_CTL_INJECTED) && acked)
- 			ieee80211_frame_acked(sta, skb);
- 
-+	} else if (wiphy_ext_feature_isset(local->hw.wiphy,
-+					   NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) {
-+		struct ieee80211_sub_if_data *sdata;
-+		struct ieee80211_txq *txq;
-+		u32 airtime;
-+
-+		/* Account airtime to multicast queue */
-+		sdata = ieee80211_sdata_from_skb(local, skb);
-+
-+		if (sdata && (txq = sdata->vif.txq)) {
-+			airtime = info->status.tx_time ?:
-+				ieee80211_calc_expected_tx_airtime(hw,
-+								   &sdata->vif,
-+								   NULL,
-+								   skb->len,
-+								   false);
-+
-+			ieee80211_register_airtime(txq, airtime, 0);
-+		}
- 	}
- 
- 	/* SNMP counters
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -18,6 +18,7 @@
- #include <linux/bitmap.h>
- #include <linux/rcupdate.h>
- #include <linux/export.h>
-+#include <linux/timekeeping.h>
- #include <net/net_namespace.h>
- #include <net/ieee80211_radiotap.h>
- #include <net/cfg80211.h>
-@@ -1489,7 +1490,7 @@ void ieee80211_txq_init(struct ieee80211
- 	codel_vars_init(&txqi->def_cvars);
- 	codel_stats_init(&txqi->cstats);
- 	__skb_queue_head_init(&txqi->frags);
--	INIT_LIST_HEAD(&txqi->schedule_order);
-+	RB_CLEAR_NODE(&txqi->schedule_order);
- 
- 	txqi->txq.vif = &sdata->vif;
- 
-@@ -1533,9 +1534,7 @@ void ieee80211_txq_purge(struct ieee8021
- 	ieee80211_purge_tx_queue(&local->hw, &txqi->frags);
- 	spin_unlock_bh(&fq->lock);
- 
--	spin_lock_bh(&local->active_txq_lock[txqi->txq.ac]);
--	list_del_init(&txqi->schedule_order);
--	spin_unlock_bh(&local->active_txq_lock[txqi->txq.ac]);
-+	ieee80211_unschedule_txq(&local->hw, &txqi->txq, true);
- }
- 
- void ieee80211_txq_set_params(struct ieee80211_local *local)
-@@ -3831,102 +3830,259 @@ EXPORT_SYMBOL(ieee80211_tx_dequeue);
- struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
- {
- 	struct ieee80211_local *local = hw_to_local(hw);
-+	struct airtime_sched_info *air_sched;
-+	u64 now = ktime_get_boottime_ns();
- 	struct ieee80211_txq *ret = NULL;
--	struct txq_info *txqi = NULL, *head = NULL;
--	bool found_eligible_txq = false;
-+	struct airtime_info *air_info;
-+	struct txq_info *txqi = NULL;
-+	struct rb_node *node;
-+	bool first = false;
- 
--	spin_lock_bh(&local->active_txq_lock[ac]);
-+	air_sched = &local->airtime[ac];
-+	spin_lock_bh(&air_sched->lock);
- 
-- begin:
--	txqi = list_first_entry_or_null(&local->active_txqs[ac],
--					struct txq_info,
--					schedule_order);
--	if (!txqi)
-+	node = air_sched->schedule_pos;
-+
-+begin:
-+	if (!node) {
-+		node = rb_first_cached(&air_sched->active_txqs);
-+		first = true;
-+	} else {
-+		node = rb_next(node);
-+	}
-+
-+	if (!node)
- 		goto out;
- 
--	if (txqi == head) {
--		if (!found_eligible_txq)
--			goto out;
--		else
--			found_eligible_txq = false;
-+	txqi = container_of(node, struct txq_info, schedule_order);
-+	air_info = to_airtime_info(&txqi->txq);
-+
-+	if (air_info->v_t > air_sched->v_t &&
-+	    (!first || !airtime_catchup_v_t(air_sched, air_info->v_t, now)))
-+		goto out;
-+
-+	if (!ieee80211_txq_airtime_check(hw, &txqi->txq)) {
-+		first = false;
-+		goto begin;
- 	}
- 
--	if (!head)
--		head = txqi;
-+	air_sched->schedule_pos = node;
-+	air_sched->last_schedule_activity = now;
-+	ret = &txqi->txq;
-+out:
-+	spin_unlock_bh(&air_sched->lock);
-+	return ret;
-+}
-+EXPORT_SYMBOL(ieee80211_next_txq);
- 
--	if (txqi->txq.sta) {
--		struct sta_info *sta = container_of(txqi->txq.sta,
--						    struct sta_info, sta);
--		bool aql_check = ieee80211_txq_airtime_check(hw, &txqi->txq);
--		s64 deficit = sta->airtime[txqi->txq.ac].deficit;
-+static void __ieee80211_insert_txq(struct rb_root_cached *root,
-+				   struct txq_info *txqi)
-+{
-+	struct rb_node **new = &root->rb_root.rb_node;
-+	struct airtime_info *old_air, *new_air;
-+	struct rb_node *parent = NULL;
-+	struct txq_info *__txqi;
-+	bool leftmost = true;
-+
-+	while (*new) {
-+		parent = *new;
-+		__txqi = rb_entry(parent, struct txq_info, schedule_order);
-+		old_air = to_airtime_info(&__txqi->txq);
-+		new_air = to_airtime_info(&txqi->txq);
- 
--		if (aql_check)
--			found_eligible_txq = true;
-+		if (new_air->v_t <= old_air->v_t) {
-+			new = &parent->rb_left;
-+		} else {
-+			new = &parent->rb_right;
-+			leftmost = false;
-+		}
-+	}
- 
--		if (deficit < 0)
--			sta->airtime[txqi->txq.ac].deficit +=
--				sta->airtime_weight;
--
--		if (deficit < 0 || !aql_check) {
--			list_move_tail(&txqi->schedule_order,
--				       &local->active_txqs[txqi->txq.ac]);
--			goto begin;
-+	rb_link_node(&txqi->schedule_order, parent, new);
-+	rb_insert_color_cached(&txqi->schedule_order, root, leftmost);
-+}
-+
-+void ieee80211_resort_txq(struct ieee80211_hw *hw,
-+			  struct ieee80211_txq *txq)
-+{
-+	struct airtime_info *air_info = to_airtime_info(txq);
-+	struct ieee80211_local *local = hw_to_local(hw);
-+	struct txq_info *txqi = to_txq_info(txq);
-+	struct airtime_sched_info *air_sched;
-+
-+	air_sched = &local->airtime[txq->ac];
-+
-+	lockdep_assert_held(&air_sched->lock);
-+
-+	if (!RB_EMPTY_NODE(&txqi->schedule_order)) {
-+		struct airtime_info *a_prev = NULL, *a_next = NULL;
-+		struct txq_info *t_prev, *t_next;
-+		struct rb_node *n_prev, *n_next;
-+
-+		/* Erasing a node can cause an expensive rebalancing operation,
-+		 * so we check the previous and next nodes first and only remove
-+		 * and re-insert if the current node is not already in the
-+		 * correct position.
-+		 */
-+		if ((n_prev = rb_prev(&txqi->schedule_order)) != NULL) {
-+			t_prev = container_of(n_prev, struct txq_info,
-+					      schedule_order);
-+			a_prev = to_airtime_info(&t_prev->txq);
-+		}
-+
-+		if ((n_next = rb_next(&txqi->schedule_order)) != NULL) {
-+			t_next = container_of(n_next, struct txq_info,
-+					      schedule_order);
-+			a_next = to_airtime_info(&t_next->txq);
- 		}
-+
-+		if ((!a_prev || a_prev->v_t <= air_info->v_t) &&
-+		    (!a_next || a_next->v_t > air_info->v_t))
-+			return;
-+
-+		if (air_sched->schedule_pos == &txqi->schedule_order)
-+			air_sched->schedule_pos = n_prev;
-+
-+		rb_erase_cached(&txqi->schedule_order,
-+				&air_sched->active_txqs);
-+		RB_CLEAR_NODE(&txqi->schedule_order);
-+		__ieee80211_insert_txq(&air_sched->active_txqs, txqi);
- 	}
-+}
-+
-+void ieee80211_update_airtime_weight(struct ieee80211_local *local,
-+				     struct airtime_sched_info *air_sched,
-+				     u64 now, bool force)
-+{
-+	struct airtime_info *air_info, *tmp;
-+	u64 weight_sum = 0;
-+
-+	if (unlikely(!now))
-+		now = ktime_get_boottime_ns();
-+
-+	lockdep_assert_held(&air_sched->lock);
-+
-+	if (!force && (air_sched->last_weight_update <
-+		       now - AIRTIME_ACTIVE_DURATION))
-+		return;
-+
-+	list_for_each_entry_safe(air_info, tmp,
-+				 &air_sched->active_list, list) {
-+		if (airtime_is_active(air_info, now))
-+			weight_sum += air_info->weight;
-+		else
-+			list_del_init(&air_info->list);
-+	}
-+	airtime_weight_sum_set(air_sched, weight_sum);
-+	air_sched->last_weight_update = now;
-+}
- 
-+void ieee80211_schedule_txq(struct ieee80211_hw *hw,
-+			    struct ieee80211_txq *txq)
-+	__acquires(txq_lock) __releases(txq_lock)
-+{
-+	struct ieee80211_local *local = hw_to_local(hw);
-+	struct txq_info *txqi = to_txq_info(txq);
-+	struct airtime_sched_info *air_sched;
-+	u64 now = ktime_get_boottime_ns();
-+	struct airtime_info *air_info;
-+	u8 ac = txq->ac;
-+	bool was_active;
- 
--	if (txqi->schedule_round == local->schedule_round[ac])
-+	air_sched = &local->airtime[ac];
-+	air_info = to_airtime_info(txq);
-+
-+	spin_lock_bh(&air_sched->lock);
-+	was_active = airtime_is_active(air_info, now);
-+	airtime_set_active(air_sched, air_info, now);
-+
-+	if (!RB_EMPTY_NODE(&txqi->schedule_order))
- 		goto out;
- 
--	list_del_init(&txqi->schedule_order);
--	txqi->schedule_round = local->schedule_round[ac];
--	ret = &txqi->txq;
-+	/* If the station has been inactive for a while, catch up its v_t so it
-+	 * doesn't get indefinite priority; see comment above the definition of
-+	 * AIRTIME_MAX_BEHIND.
-+	 */
-+	if ((!was_active && air_info->v_t < air_sched->v_t) ||
-+	    air_info->v_t < air_sched->v_t - AIRTIME_MAX_BEHIND)
-+		air_info->v_t = air_sched->v_t;
-+
-+	ieee80211_update_airtime_weight(local, air_sched, now, !was_active);
-+	__ieee80211_insert_txq(&air_sched->active_txqs, txqi);
- 
- out:
--	spin_unlock_bh(&local->active_txq_lock[ac]);
--	return ret;
-+	spin_unlock_bh(&air_sched->lock);
- }
--EXPORT_SYMBOL(ieee80211_next_txq);
-+EXPORT_SYMBOL(ieee80211_schedule_txq);
- 
--void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
--			      struct ieee80211_txq *txq,
--			      bool force)
-+static void __ieee80211_unschedule_txq(struct ieee80211_hw *hw,
-+				       struct ieee80211_txq *txq,
-+				       bool purge)
- {
- 	struct ieee80211_local *local = hw_to_local(hw);
- 	struct txq_info *txqi = to_txq_info(txq);
-+	struct airtime_sched_info *air_sched;
-+	struct airtime_info *air_info;
- 
--	spin_lock_bh(&local->active_txq_lock[txq->ac]);
-+	air_sched = &local->airtime[txq->ac];
-+	air_info = to_airtime_info(&txqi->txq);
- 
--	if (list_empty(&txqi->schedule_order) &&
--	    (force || !skb_queue_empty(&txqi->frags) ||
--	     txqi->tin.backlog_packets)) {
--		/* If airtime accounting is active, always enqueue STAs at the
--		 * head of the list to ensure that they only get moved to the
--		 * back by the airtime DRR scheduler once they have a negative
--		 * deficit. A station that already has a negative deficit will
--		 * get immediately moved to the back of the list on the next
--		 * call to ieee80211_next_txq().
--		 */
--		if (txqi->txq.sta && local->airtime_flags &&
--		    wiphy_ext_feature_isset(local->hw.wiphy,
--					    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
--			list_add(&txqi->schedule_order,
--				 &local->active_txqs[txq->ac]);
--		else
--			list_add_tail(&txqi->schedule_order,
--				      &local->active_txqs[txq->ac]);
-+	lockdep_assert_held(&air_sched->lock);
-+
-+	if (purge) {
-+		list_del_init(&air_info->list);
-+		ieee80211_update_airtime_weight(local, air_sched, 0, true);
- 	}
- 
--	spin_unlock_bh(&local->active_txq_lock[txq->ac]);
-+	if (RB_EMPTY_NODE(&txqi->schedule_order))
-+		return;
-+
-+	if (air_sched->schedule_pos == &txqi->schedule_order)
-+		air_sched->schedule_pos = rb_prev(&txqi->schedule_order);
-+
-+	if (!purge)
-+		airtime_set_active(air_sched, air_info,
-+				   ktime_get_boottime_ns());
-+
-+	rb_erase_cached(&txqi->schedule_order,
-+			&air_sched->active_txqs);
-+	RB_CLEAR_NODE(&txqi->schedule_order);
-+}
-+
-+void ieee80211_unschedule_txq(struct ieee80211_hw *hw,
-+			      struct ieee80211_txq *txq,
-+			      bool purge)
-+	__acquires(txq_lock) __releases(txq_lock)
-+{
-+	struct ieee80211_local *local = hw_to_local(hw);
-+
-+	spin_lock_bh(&local->airtime[txq->ac].lock);
-+	__ieee80211_unschedule_txq(hw, txq, purge);
-+	spin_unlock_bh(&local->airtime[txq->ac].lock);
-+}
-+
-+void ieee80211_return_txq(struct ieee80211_hw *hw,
-+			  struct ieee80211_txq *txq, bool force)
-+{
-+	struct ieee80211_local *local = hw_to_local(hw);
-+	struct txq_info *txqi = to_txq_info(txq);
-+
-+	spin_lock_bh(&local->airtime[txq->ac].lock);
-+
-+	if (!RB_EMPTY_NODE(&txqi->schedule_order) && !force &&
-+	    !txq_has_queue(txq))
-+		__ieee80211_unschedule_txq(hw, txq, false);
-+
-+	spin_unlock_bh(&local->airtime[txq->ac].lock);
- }
--EXPORT_SYMBOL(__ieee80211_schedule_txq);
-+EXPORT_SYMBOL(ieee80211_return_txq);
- 
- DEFINE_STATIC_KEY_FALSE(aql_disable);
- 
- bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,
- 				 struct ieee80211_txq *txq)
- {
--	struct sta_info *sta;
-+	struct airtime_info *air_info = to_airtime_info(txq);
- 	struct ieee80211_local *local = hw_to_local(hw);
- 
- 	if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
-@@ -3941,15 +4097,12 @@ bool ieee80211_txq_airtime_check(struct
- 	if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
- 		return true;
- 
--	sta = container_of(txq->sta, struct sta_info, sta);
--	if (atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
--	    sta->airtime[txq->ac].aql_limit_low)
-+	if (atomic_read(&air_info->aql_tx_pending) < air_info->aql_limit_low)
- 		return true;
- 
- 	if (atomic_read(&local->aql_total_pending_airtime) <
- 	    local->aql_threshold &&
--	    atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
--	    sta->airtime[txq->ac].aql_limit_high)
-+	    atomic_read(&air_info->aql_tx_pending) < air_info->aql_limit_high)
- 		return true;
- 
- 	return false;
-@@ -3959,60 +4112,59 @@ EXPORT_SYMBOL(ieee80211_txq_airtime_chec
- bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
- 				struct ieee80211_txq *txq)
- {
-+	struct txq_info *first_txqi = NULL, *txqi = to_txq_info(txq);
- 	struct ieee80211_local *local = hw_to_local(hw);
--	struct txq_info *iter, *tmp, *txqi = to_txq_info(txq);
--	struct sta_info *sta;
--	u8 ac = txq->ac;
-+	struct airtime_sched_info *air_sched;
-+	struct airtime_info *air_info;
-+	struct rb_node *node = NULL;
-+	bool ret = false;
-+	u64 now;
- 
--	spin_lock_bh(&local->active_txq_lock[ac]);
- 
--	if (!txqi->txq.sta)
--		goto out;
-+	if (!ieee80211_txq_airtime_check(hw, txq))
-+		return false;
-+
-+	air_sched = &local->airtime[txq->ac];
-+	spin_lock_bh(&air_sched->lock);
- 
--	if (list_empty(&txqi->schedule_order))
-+	if (RB_EMPTY_NODE(&txqi->schedule_order))
- 		goto out;
- 
--	list_for_each_entry_safe(iter, tmp, &local->active_txqs[ac],
--				 schedule_order) {
--		if (iter == txqi)
--			break;
-+	now = ktime_get_boottime_ns();
- 
--		if (!iter->txq.sta) {
--			list_move_tail(&iter->schedule_order,
--				       &local->active_txqs[ac]);
--			continue;
--		}
--		sta = container_of(iter->txq.sta, struct sta_info, sta);
--		if (sta->airtime[ac].deficit < 0)
--			sta->airtime[ac].deficit += sta->airtime_weight;
--		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
-+	/* Like in ieee80211_next_txq(), make sure the first station in the
-+	 * scheduling order is eligible for transmission to avoid starvation.
-+	 */
-+	node = rb_first_cached(&air_sched->active_txqs);
-+	if (node) {
-+		first_txqi = container_of(node, struct txq_info,
-+					  schedule_order);
-+		air_info = to_airtime_info(&first_txqi->txq);
-+
-+		if (air_sched->v_t < air_info->v_t)
-+			airtime_catchup_v_t(air_sched, air_info->v_t, now);
- 	}
- 
--	sta = container_of(txqi->txq.sta, struct sta_info, sta);
--	if (sta->airtime[ac].deficit >= 0)
--		goto out;
--
--	sta->airtime[ac].deficit += sta->airtime_weight;
--	list_move_tail(&txqi->schedule_order, &local->active_txqs[ac]);
--	spin_unlock_bh(&local->active_txq_lock[ac]);
-+	air_info = to_airtime_info(&txqi->txq);
-+	if (air_info->v_t <= air_sched->v_t) {
-+		air_sched->last_schedule_activity = now;
-+		ret = true;
-+	}
- 
--	return false;
- out:
--	if (!list_empty(&txqi->schedule_order))
--		list_del_init(&txqi->schedule_order);
--	spin_unlock_bh(&local->active_txq_lock[ac]);
--
--	return true;
-+	spin_unlock_bh(&air_sched->lock);
-+	return ret;
- }
- EXPORT_SYMBOL(ieee80211_txq_may_transmit);
- 
- void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
- {
- 	struct ieee80211_local *local = hw_to_local(hw);
-+	struct airtime_sched_info *air_sched = &local->airtime[ac];
- 
--	spin_lock_bh(&local->active_txq_lock[ac]);
--	local->schedule_round[ac]++;
--	spin_unlock_bh(&local->active_txq_lock[ac]);
-+	spin_lock_bh(&air_sched->lock);
-+	air_sched->schedule_pos = NULL;
-+	spin_unlock_bh(&air_sched->lock);
- }
- EXPORT_SYMBOL(ieee80211_txq_schedule_start);
- 
diff --git a/package/kernel/mac80211/patches/subsys/384-nl80211-add-common-API-to-configure-SAR-power-limita.patch b/package/kernel/mac80211/patches/subsys/384-nl80211-add-common-API-to-configure-SAR-power-limita.patch
deleted file mode 100644
index c6930ee135..0000000000
--- a/package/kernel/mac80211/patches/subsys/384-nl80211-add-common-API-to-configure-SAR-power-limita.patch
+++ /dev/null
@@ -1,398 +0,0 @@
-From: Carl Huang <cjhuang@codeaurora.org>
-Date: Thu, 3 Dec 2020 05:37:26 -0500
-Subject: [PATCH] nl80211: add common API to configure SAR power limitations
-
-NL80211_CMD_SET_SAR_SPECS is added to configure SAR from
-user space. NL80211_ATTR_SAR_SPEC is used to pass the SAR
-power specification when used with NL80211_CMD_SET_SAR_SPECS.
-
-Wireless driver needs to register SAR type, supported frequency
-ranges to wiphy, so user space can query it. The index in
-frequency range is used to specify which sub band the power
-limitation applies to. The SAR type is for compatibility, so later
-other SAR mechanism can be implemented without breaking the user
-space SAR applications.
-
-Normal process is user space queries the SAR capability, and
-gets the index of supported frequency ranges and associates the
-power limitation with this index and sends to kernel.
-
-Here is an example of message send to kernel:
-8c 00 00 00 08 00 01 00 00 00 00 00 38 00 2b 81
-08 00 01 00 00 00 00 00 2c 00 02 80 14 00 00 80
-08 00 02 00 00 00 00 00 08 00 01 00 38 00 00 00
-14 00 01 80 08 00 02 00 01 00 00 00 08 00 01 00
-48 00 00 00
-
-NL80211_CMD_SET_SAR_SPECS:  0x8c
-NL80211_ATTR_WIPHY:     0x01(phy idx is 0)
-NL80211_ATTR_SAR_SPEC:  0x812b (NLA_NESTED)
-NL80211_SAR_ATTR_TYPE:  0x00 (NL80211_SAR_TYPE_POWER)
-NL80211_SAR_ATTR_SPECS: 0x8002 (NLA_NESTED)
-freq range 0 power: 0x38 in 0.25dbm unit (14dbm)
-freq range 1 power: 0x48 in 0.25dbm unit (18dbm)
-
-Signed-off-by: Carl Huang <cjhuang@codeaurora.org>
-Reviewed-by: Brian Norris <briannorris@chromium.org>
-Reviewed-by: Abhishek Kumar <kuabhs@chromium.org>
-Link: https://lore.kernel.org/r/20201203103728.3034-2-cjhuang@codeaurora.org
-[minor edits, NLA parse cleanups]
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -1737,6 +1737,54 @@ struct station_info {
- 	u8 connected_to_as;
- };
- 
-+/**
-+ * struct cfg80211_sar_sub_specs - sub specs limit
-+ * @power: power limitation in 0.25dbm
-+ * @freq_range_index: index the power limitation applies to
-+ */
-+struct cfg80211_sar_sub_specs {
-+	s32 power;
-+	u32 freq_range_index;
-+};
-+
-+/**
-+ * struct cfg80211_sar_specs - sar limit specs
-+ * @type: it's set with power in 0.25dbm or other types
-+ * @num_sub_specs: number of sar sub specs
-+ * @sub_specs: memory to hold the sar sub specs
-+ */
-+struct cfg80211_sar_specs {
-+	enum nl80211_sar_type type;
-+	u32 num_sub_specs;
-+	struct cfg80211_sar_sub_specs sub_specs[];
-+};
-+
-+
-+/**
-+ * @struct cfg80211_sar_chan_ranges - sar frequency ranges
-+ * @start_freq:  start range edge frequency
-+ * @end_freq:    end range edge frequency
-+ */
-+struct cfg80211_sar_freq_ranges {
-+	u32 start_freq;
-+	u32 end_freq;
-+};
-+
-+/**
-+ * struct cfg80211_sar_capa - sar limit capability
-+ * @type: it's set via power in 0.25dbm or other types
-+ * @num_freq_ranges: number of frequency ranges
-+ * @freq_ranges: memory to hold the freq ranges.
-+ *
-+ * Note: WLAN driver may append new ranges or split an existing
-+ * range to small ones and then append them.
-+ */
-+struct cfg80211_sar_capa {
-+	enum nl80211_sar_type type;
-+	u32 num_freq_ranges;
-+	const struct cfg80211_sar_freq_ranges *freq_ranges;
-+};
-+
- #if IS_ENABLED(CPTCFG_CFG80211)
- /**
-  * cfg80211_get_station - retrieve information about a given station
-@@ -4259,6 +4307,8 @@ struct cfg80211_ops {
- 				  struct cfg80211_tid_config *tid_conf);
- 	int	(*reset_tid_config)(struct wiphy *wiphy, struct net_device *dev,
- 				    const u8 *peer, u8 tids);
-+	int	(*set_sar_specs)(struct wiphy *wiphy,
-+				 struct cfg80211_sar_specs *sar);
- };
- 
- /*
-@@ -5030,6 +5080,8 @@ struct wiphy {
- 
- 	u8 max_data_retry_count;
- 
-+	const struct cfg80211_sar_capa *sar_capa;
-+
- 	char priv[] __aligned(NETDEV_ALIGN);
- };
- 
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -405,6 +405,18 @@ nl80211_unsol_bcast_probe_resp_policy[NL
- 						       .len = IEEE80211_MAX_DATA_LEN }
- };
- 
-+static const struct nla_policy
-+sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
-+	[NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
-+	[NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
-+};
-+
-+static const struct nla_policy
-+sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
-+	[NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
-+	[NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
-+};
-+
- static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
- 	[0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
- 	[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
-@@ -739,6 +751,7 @@ static const struct nla_policy nl80211_p
- 	[NL80211_ATTR_SAE_PWE] =
- 		NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
- 				 NL80211_SAE_PWE_BOTH),
-+	[NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
- 	[NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
- };
- 
-@@ -2117,6 +2130,56 @@ fail:
- 	return -ENOBUFS;
- }
- 
-+static int
-+nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
-+		      struct sk_buff *msg)
-+{
-+	struct nlattr *sar_capa, *specs, *sub_freq_range;
-+	u8 num_freq_ranges;
-+	int i;
-+
-+	if (!rdev->wiphy.sar_capa)
-+		return 0;
-+
-+	num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
-+
-+	sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
-+	if (!sar_capa)
-+		return -ENOSPC;
-+
-+	if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
-+		goto fail;
-+
-+	specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
-+	if (!specs)
-+		goto fail;
-+
-+	/* report supported freq_ranges */
-+	for (i = 0; i < num_freq_ranges; i++) {
-+		sub_freq_range = nla_nest_start(msg, i + 1);
-+		if (!sub_freq_range)
-+			goto fail;
-+
-+		if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
-+				rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
-+			goto fail;
-+
-+		if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
-+				rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
-+			goto fail;
-+
-+		nla_nest_end(msg, sub_freq_range);
-+	}
-+
-+	nla_nest_end(msg, specs);
-+	nla_nest_end(msg, sar_capa);
-+
-+	return 0;
-+fail:
-+	nla_nest_cancel(msg, sar_capa);
-+	return -ENOBUFS;
-+}
-+
- struct nl80211_dump_wiphy_state {
- 	s64 filter_wiphy;
- 	long start;
-@@ -2366,6 +2429,8 @@ static int nl80211_send_wiphy(struct cfg
- 			CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
- 			CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
- 			CMD(update_ft_ies, UPDATE_FT_IES);
-+			if (rdev->wiphy.sar_capa)
-+				CMD(set_sar_specs, SET_SAR_SPECS);
- 		}
- #undef CMD
- 
-@@ -2691,6 +2756,11 @@ static int nl80211_send_wiphy(struct cfg
- 
- 		if (nl80211_put_tid_config_support(rdev, msg))
- 			goto nla_put_failure;
-+		state->split_start++;
-+		break;
-+	case 16:
-+		if (nl80211_put_sar_specs(rdev, msg))
-+			goto nla_put_failure;
- 
- 		/* done */
- 		state->split_start = 0;
-@@ -14724,6 +14794,111 @@ static void nl80211_post_doit(__genl_con
- 	}
- }
- 
-+static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
-+				     struct cfg80211_sar_specs *sar_specs,
-+				     struct nlattr *spec[], int index)
-+{
-+	u32 range_index, i;
-+
-+	if (!sar_specs || !spec)
-+		return -EINVAL;
-+
-+	if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
-+	    !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
-+		return -EINVAL;
-+
-+	range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
-+
-+	/* check if range_index exceeds num_freq_ranges */
-+	if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
-+		return -EINVAL;
-+
-+	/* check if range_index duplicates */
-+	for (i = 0; i < index; i++) {
-+		if (sar_specs->sub_specs[i].freq_range_index == range_index)
-+			return -EINVAL;
-+	}
-+
-+	sar_specs->sub_specs[index].power =
-+		nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
-+
-+	sar_specs->sub_specs[index].freq_range_index = range_index;
-+
-+	return 0;
-+}
-+
-+static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
-+{
-+	struct cfg80211_registered_device *rdev = info->user_ptr[0];
-+	struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
-+	struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
-+	struct cfg80211_sar_specs *sar_spec;
-+	enum nl80211_sar_type type;
-+	struct nlattr *spec_list;
-+	u32 specs;
-+	int rem, err;
-+
-+	if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
-+		return -EOPNOTSUPP;
-+
-+	if (!info->attrs[NL80211_ATTR_SAR_SPEC])
-+		return -EINVAL;
-+
-+	nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
-+			 info->attrs[NL80211_ATTR_SAR_SPEC],
-+			 NULL, NULL);
-+
-+	if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
-+		return -EINVAL;
-+
-+	type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
-+	if (type != rdev->wiphy.sar_capa->type)
-+		return -EINVAL;
-+
-+	specs = 0;
-+	nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
-+		specs++;
-+
-+	if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
-+		return -EINVAL;
-+
-+	sar_spec = kzalloc(sizeof(*sar_spec) +
-+			   specs * sizeof(struct cfg80211_sar_sub_specs),
-+			   GFP_KERNEL);
-+	if (!sar_spec)
-+		return -ENOMEM;
-+
-+	sar_spec->type = type;
-+	specs = 0;
-+	nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
-+		nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
-+				 spec_list, NULL, NULL);
-+
-+		switch (type) {
-+		case NL80211_SAR_TYPE_POWER:
-+			if (nl80211_set_sar_sub_specs(rdev, sar_spec,
-+						      spec, specs)) {
-+				err = -EINVAL;
-+				goto error;
-+			}
-+			break;
-+		default:
-+			err = -EINVAL;
-+			goto error;
-+		}
-+		specs++;
-+	}
-+
-+	sar_spec->num_sub_specs = specs;
-+
-+	rdev->cur_cmd_info = info;
-+	err = rdev_set_sar_specs(rdev, sar_spec);
-+	rdev->cur_cmd_info = NULL;
-+error:
-+	kfree(sar_spec);
-+	return err;
-+}
-+
- static __genl_const struct genl_ops nl80211_ops[] = {
- 	{
- 		.cmd = NL80211_CMD_GET_WIPHY,
-@@ -15587,6 +15762,14 @@ static const struct genl_small_ops nl802
- 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
- 				  NL80211_FLAG_NEED_RTNL,
- 	},
-+	{
-+		.cmd = NL80211_CMD_SET_SAR_SPECS,
-+		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-+		.doit = nl80211_set_sar_specs,
-+		.flags = GENL_UNS_ADMIN_PERM,
-+		.internal_flags = NL80211_FLAG_NEED_WIPHY |
-+				  NL80211_FLAG_NEED_RTNL,
-+	},
- };
- 
- static struct genl_family nl80211_fam __genl_ro_after_init = {
---- a/net/wireless/rdev-ops.h
-+++ b/net/wireless/rdev-ops.h
-@@ -1356,4 +1356,16 @@ static inline int rdev_reset_tid_config(
- 	return ret;
- }
- 
-+static inline int rdev_set_sar_specs(struct cfg80211_registered_device *rdev,
-+				     struct cfg80211_sar_specs *sar)
-+{
-+	int ret;
-+
-+	trace_rdev_set_sar_specs(&rdev->wiphy, sar);
-+	ret = rdev->ops->set_sar_specs(&rdev->wiphy, sar);
-+	trace_rdev_return_int(&rdev->wiphy, ret);
-+
-+	return ret;
-+}
-+
- #endif /* __CFG80211_RDEV_OPS */
---- a/net/wireless/trace.h
-+++ b/net/wireless/trace.h
-@@ -3551,6 +3551,25 @@ TRACE_EVENT(rdev_reset_tid_config,
- 	TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", peer: " MAC_PR_FMT ", tids: 0x%x",
- 		  WIPHY_PR_ARG, NETDEV_PR_ARG, MAC_PR_ARG(peer), __entry->tids)
- );
-+
-+TRACE_EVENT(rdev_set_sar_specs,
-+	TP_PROTO(struct wiphy *wiphy, struct cfg80211_sar_specs *sar),
-+	TP_ARGS(wiphy, sar),
-+	TP_STRUCT__entry(
-+		WIPHY_ENTRY
-+		__field(u16, type)
-+		__field(u16, num)
-+	),
-+	TP_fast_assign(
-+		WIPHY_ASSIGN;
-+		__entry->type = sar->type;
-+		__entry->num = sar->num_sub_specs;
-+
-+	),
-+	TP_printk(WIPHY_PR_FMT ", Set type:%d, num_specs:%d",
-+		  WIPHY_PR_ARG, __entry->type, __entry->num)
-+);
-+
- #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
- 
- #undef TRACE_INCLUDE_PATH
diff --git a/package/kernel/mac80211/patches/subsys/385-mac80211-add-ieee80211_set_sar_specs.patch b/package/kernel/mac80211/patches/subsys/385-mac80211-add-ieee80211_set_sar_specs.patch
deleted file mode 100644
index c351bc812a..0000000000
--- a/package/kernel/mac80211/patches/subsys/385-mac80211-add-ieee80211_set_sar_specs.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From: Carl Huang <cjhuang@codeaurora.org>
-Date: Thu, 3 Dec 2020 05:37:27 -0500
-Subject: [PATCH] mac80211: add ieee80211_set_sar_specs
-
-This change registers ieee80211_set_sar_specs to
-mac80211_config_ops, so cfg80211 can call it.
-
-Signed-off-by: Carl Huang <cjhuang@codeaurora.org>
-Reviewed-by: Brian Norris <briannorris@chromium.org>
-Reviewed-by: Abhishek Kumar <kuabhs@chromium.org>
-Link: https://lore.kernel.org/r/20201203103728.3034-3-cjhuang@codeaurora.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -4207,6 +4207,8 @@ struct ieee80211_ops {
- 				   struct ieee80211_vif *vif);
- 	void (*sta_set_4addr)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 			      struct ieee80211_sta *sta, bool enabled);
-+	int (*set_sar_specs)(struct ieee80211_hw *hw,
-+			     const struct cfg80211_sar_specs *sar);
- 	void (*sta_set_decap_offload)(struct ieee80211_hw *hw,
- 				      struct ieee80211_vif *vif,
- 				      struct ieee80211_sta *sta, bool enabled);
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -4136,6 +4136,17 @@ static int ieee80211_reset_tid_config(st
- 	return ret;
- }
- 
-+static int ieee80211_set_sar_specs(struct wiphy *wiphy,
-+				   struct cfg80211_sar_specs *sar)
-+{
-+	struct ieee80211_local *local = wiphy_priv(wiphy);
-+
-+	if (!local->ops->set_sar_specs)
-+		return -EOPNOTSUPP;
-+
-+	return local->ops->set_sar_specs(&local->hw, sar);
-+}
-+
- const struct cfg80211_ops mac80211_config_ops = {
- 	.add_virtual_intf = ieee80211_add_iface,
- 	.del_virtual_intf = ieee80211_del_iface,
-@@ -4239,4 +4250,5 @@ const struct cfg80211_ops mac80211_confi
- 	.probe_mesh_link = ieee80211_probe_mesh_link,
- 	.set_tid_config = ieee80211_set_tid_config,
- 	.reset_tid_config = ieee80211_reset_tid_config,
-+	.set_sar_specs = ieee80211_set_sar_specs,
- };
diff --git a/package/kernel/mac80211/patches/subsys/386-mac80211-check-per-vif-offload_flags-in-Tx-path.patch b/package/kernel/mac80211/patches/subsys/386-mac80211-check-per-vif-offload_flags-in-Tx-path.patch
deleted file mode 100644
index e011e5333c..0000000000
--- a/package/kernel/mac80211/patches/subsys/386-mac80211-check-per-vif-offload_flags-in-Tx-path.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Ryder Lee <ryder.lee@mediatek.com>
-Date: Fri, 18 Jun 2021 04:38:59 +0800
-Subject: [PATCH] mac80211: check per vif offload_flags in Tx path
-
-offload_flags has been introduced to indicate encap status of each interface.
-An interface can encap offload at runtime, or if it has some extra limitations
-it can simply override the flags, so it's more flexible to check offload_flags
-in Tx path.
-
-Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
-Link: https://lore.kernel.org/r/177785418cf407808bf3a44760302d0647076990.1623961575.git.ryder.lee@mediatek.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3335,6 +3335,9 @@ static bool ieee80211_amsdu_aggregate(st
- 	if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
- 		return false;
- 
-+	if (sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
-+		return false;
-+
- 	if (skb_is_gso(skb))
- 		return false;
- 
diff --git a/package/kernel/mac80211/patches/subsys/387-nl80211-add-support-for-BSS-coloring.patch b/package/kernel/mac80211/patches/subsys/387-nl80211-add-support-for-BSS-coloring.patch
deleted file mode 100644
index a63dc844e1..0000000000
--- a/package/kernel/mac80211/patches/subsys/387-nl80211-add-support-for-BSS-coloring.patch
+++ /dev/null
@@ -1,485 +0,0 @@
-From: John Crispin <john@phrozen.org>
-Date: Fri, 2 Jul 2021 19:44:07 +0200
-Subject: [PATCH] nl80211: add support for BSS coloring
-
-This patch adds support for BSS color collisions to the wireless subsystem.
-Add the required functionality to nl80211 that will notify about color
-collisions, triggering the color change and notifying when it is completed.
-
-Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Signed-off-by: John Crispin <john@phrozen.org>
-Link: https://lore.kernel.org/r/500b3582aec8fe2c42ef46f3117b148cb7cbceb5.1625247619.git.lorenzo@kernel.org
-[remove unnecessary NULL initialisation]
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -1252,6 +1252,27 @@ struct cfg80211_csa_settings {
- #define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10
- 
- /**
-+ * struct cfg80211_color_change_settings - color change settings
-+ *
-+ * Used for bss color change
-+ *
-+ * @beacon_color_change: beacon data while performing the color countdown
-+ * @counter_offsets_beacon: offsets of the counters within the beacon (tail)
-+ * @counter_offsets_presp: offsets of the counters within the probe response
-+ * @beacon_next: beacon data to be used after the color change
-+ * @count: number of beacons until the color change
-+ * @color: the color used after the change
-+ */
-+struct cfg80211_color_change_settings {
-+	struct cfg80211_beacon_data beacon_color_change;
-+	u16 counter_offset_beacon;
-+	u16 counter_offset_presp;
-+	struct cfg80211_beacon_data beacon_next;
-+	u8 count;
-+	u8 color;
-+};
-+
-+/**
-  * struct iface_combination_params - input parameters for interface combinations
-  *
-  * Used to pass interface combination parameters
-@@ -3979,6 +4000,8 @@ struct mgmt_frame_regs {
-  *	This callback may sleep.
-  * @reset_tid_config: Reset TID specific configuration for the peer, for the
-  *	given TIDs. This callback may sleep.
-+ *
-+ * @color_change: Initiate a color change.
-  */
- struct cfg80211_ops {
- 	int	(*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
-@@ -4309,6 +4332,9 @@ struct cfg80211_ops {
- 				    const u8 *peer, u8 tids);
- 	int	(*set_sar_specs)(struct wiphy *wiphy,
- 				 struct cfg80211_sar_specs *sar);
-+	int	(*color_change)(struct wiphy *wiphy,
-+				struct net_device *dev,
-+				struct cfg80211_color_change_settings *params);
- };
- 
- /*
-@@ -8092,4 +8118,70 @@ void cfg80211_update_owe_info_event(stru
-  */
- void cfg80211_bss_flush(struct wiphy *wiphy);
- 
-+/**
-+ * cfg80211_bss_color_notify - notify about bss color event
-+ * @dev: network device
-+ * @gfp: allocation flags
-+ * @cmd: the actual event we want to notify
-+ * @count: the number of TBTTs until the color change happens
-+ * @color_bitmap: representations of the colors that the local BSS is aware of
-+ */
-+int cfg80211_bss_color_notify(struct net_device *dev, gfp_t gfp,
-+			      enum nl80211_commands cmd, u8 count,
-+			      u64 color_bitmap);
-+
-+/**
-+ * cfg80211_obss_color_collision_notify - notify about bss color collision
-+ * @dev: network device
-+ * @color_bitmap: representations of the colors that the local BSS is aware of
-+ */
-+static inline int cfg80211_obss_color_collision_notify(struct net_device *dev,
-+						       u64 color_bitmap)
-+{
-+	return cfg80211_bss_color_notify(dev, GFP_KERNEL,
-+					 NL80211_CMD_OBSS_COLOR_COLLISION,
-+					 0, color_bitmap);
-+}
-+
-+/**
-+ * cfg80211_color_change_started_notify - notify color change start
-+ * @dev: the device on which the color is switched
-+ * @count: the number of TBTTs until the color change happens
-+ *
-+ * Inform the userspace about the color change that has started.
-+ */
-+static inline int cfg80211_color_change_started_notify(struct net_device *dev,
-+						       u8 count)
-+{
-+	return cfg80211_bss_color_notify(dev, GFP_KERNEL,
-+					 NL80211_CMD_COLOR_CHANGE_STARTED,
-+					 count, 0);
-+}
-+
-+/**
-+ * cfg80211_color_change_aborted_notify - notify color change abort
-+ * @dev: the device on which the color is switched
-+ *
-+ * Inform the userspace about the color change that has aborted.
-+ */
-+static inline int cfg80211_color_change_aborted_notify(struct net_device *dev)
-+{
-+	return cfg80211_bss_color_notify(dev, GFP_KERNEL,
-+					 NL80211_CMD_COLOR_CHANGE_ABORTED,
-+					 0, 0);
-+}
-+
-+/**
-+ * cfg80211_color_change_notify - notify color change completion
-+ * @dev: the device on which the color was switched
-+ *
-+ * Inform the userspace about the color change that has completed.
-+ */
-+static inline int cfg80211_color_change_notify(struct net_device *dev)
-+{
-+	return cfg80211_bss_color_notify(dev, GFP_KERNEL,
-+					 NL80211_CMD_COLOR_CHANGE_COMPLETED,
-+					 0, 0);
-+}
-+
- #endif /* __NET_CFG80211_H */
---- a/include/uapi/linux/nl80211.h
-+++ b/include/uapi/linux/nl80211.h
-@@ -1185,6 +1185,21 @@
-  *	passed using %NL80211_ATTR_SAR_SPEC. %NL80211_ATTR_WIPHY is used to
-  *	specify the wiphy index to be applied to.
-  *
-+ * @NL80211_CMD_OBSS_COLOR_COLLISION: This notification is sent out whenever
-+ *	mac80211/drv detects a bss color collision.
-+ *
-+ * @NL80211_CMD_COLOR_CHANGE_REQUEST: This command is used to indicate that
-+ *	userspace wants to change the BSS color.
-+ *
-+ * @NL80211_CMD_COLOR_CHANGE_STARTED: Notify userland, that a color change has
-+ *	started
-+ *
-+ * @NL80211_CMD_COLOR_CHANGE_ABORTED: Notify userland, that the color change has
-+ *	been aborted
-+ *
-+ * @NL80211_CMD_COLOR_CHANGE_COMPLETED: Notify userland that the color change
-+ *	has completed
-+ *
-  * @NL80211_CMD_MAX: highest used command number
-  * @__NL80211_CMD_AFTER_LAST: internal use
-  */
-@@ -1417,6 +1432,14 @@ enum nl80211_commands {
- 
- 	NL80211_CMD_SET_SAR_SPECS,
- 
-+	NL80211_CMD_OBSS_COLOR_COLLISION,
-+
-+	NL80211_CMD_COLOR_CHANGE_REQUEST,
-+
-+	NL80211_CMD_COLOR_CHANGE_STARTED,
-+	NL80211_CMD_COLOR_CHANGE_ABORTED,
-+	NL80211_CMD_COLOR_CHANGE_COMPLETED,
-+
- 	/* add new commands above here */
- 
- 	/* used to define NL80211_CMD_MAX below */
-@@ -2560,6 +2583,16 @@ enum nl80211_commands {
-  *	disassoc events to indicate that an immediate reconnect to the AP
-  *	is desired.
-  *
-+ * @NL80211_ATTR_OBSS_COLOR_BITMAP: bitmap of the u64 BSS colors for the
-+ *	%NL80211_CMD_OBSS_COLOR_COLLISION event.
-+ *
-+ * @NL80211_ATTR_COLOR_CHANGE_COUNT: u8 attribute specifying the number of TBTT's
-+ *	until the color switch event.
-+ * @NL80211_ATTR_COLOR_CHANGE_COLOR: u8 attribute specifying the color that we are
-+ *	switching to
-+ * @NL80211_ATTR_COLOR_CHANGE_ELEMS: Nested set of attributes containing the IE
-+ *	information for the time while performing a color switch.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3057,6 +3090,12 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_DISABLE_HE,
- 
-+	NL80211_ATTR_OBSS_COLOR_BITMAP,
-+
-+	NL80211_ATTR_COLOR_CHANGE_COUNT,
-+	NL80211_ATTR_COLOR_CHANGE_COLOR,
-+	NL80211_ATTR_COLOR_CHANGE_ELEMS,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -5950,6 +5989,9 @@ enum nl80211_feature_flags {
-  *      frame protection for all management frames exchanged during the
-  *      negotiation and range measurement procedure.
-  *
-+ * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
-+ *	detection and change announcemnts.
-+ *
-  * @NUM_NL80211_EXT_FEATURES: number of extended features.
-  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
-  */
-@@ -6014,6 +6056,7 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_SECURE_LTF,
- 	NL80211_EXT_FEATURE_SECURE_RTT,
- 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
-+	NL80211_EXT_FEATURE_BSS_COLOR,
- 
- 	/* add new features before the definition below */
- 	NUM_NL80211_EXT_FEATURES,
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -753,6 +753,10 @@ static const struct nla_policy nl80211_p
- 				 NL80211_SAE_PWE_BOTH),
- 	[NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
- 	[NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
-+	[NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
-+	[NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
-+	[NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
-+	[NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
- };
- 
- /* policy for the key attributes */
-@@ -14689,6 +14693,106 @@ bad_tid_conf:
- 	return ret;
- }
- 
-+static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
-+{
-+	struct cfg80211_registered_device *rdev = info->user_ptr[0];
-+	struct cfg80211_color_change_settings params = {};
-+	struct net_device *dev = info->user_ptr[1];
-+	struct wireless_dev *wdev = dev->ieee80211_ptr;
-+	struct nlattr **tb;
-+	u16 offset;
-+	int err;
-+
-+	if (!rdev->ops->color_change)
-+		return -EOPNOTSUPP;
-+
-+	if (!wiphy_ext_feature_isset(&rdev->wiphy,
-+				     NL80211_EXT_FEATURE_BSS_COLOR))
-+		return -EOPNOTSUPP;
-+
-+	if (wdev->iftype != NL80211_IFTYPE_AP)
-+		return -EOPNOTSUPP;
-+
-+	if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
-+	    !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
-+	    !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
-+		return -EINVAL;
-+
-+	params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
-+	params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
-+
-+	err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_next);
-+	if (err)
-+		return err;
-+
-+	tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
-+	if (!tb)
-+		return -ENOMEM;
-+
-+	err = nla_parse_nested(tb, NL80211_ATTR_MAX,
-+			       info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
-+			       nl80211_policy, info->extack);
-+	if (err)
-+		goto out;
-+
-+	err = nl80211_parse_beacon(rdev, tb, &params.beacon_color_change);
-+	if (err)
-+		goto out;
-+
-+	if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
-+		err = -EINVAL;
-+		goto out;
-+	}
-+
-+	if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
-+		err = -EINVAL;
-+		goto out;
-+	}
-+
-+	offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
-+	if (offset >= params.beacon_color_change.tail_len) {
-+		err = -EINVAL;
-+		goto out;
-+	}
-+
-+	if (params.beacon_color_change.tail[offset] != params.count) {
-+		err = -EINVAL;
-+		goto out;
-+	}
-+
-+	params.counter_offset_beacon = offset;
-+
-+	if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
-+		if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
-+		    sizeof(u16)) {
-+			err = -EINVAL;
-+			goto out;
-+		}
-+
-+		offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
-+		if (offset >= params.beacon_color_change.probe_resp_len) {
-+			err = -EINVAL;
-+			goto out;
-+		}
-+
-+		if (params.beacon_color_change.probe_resp[offset] !=
-+		    params.count) {
-+			err = -EINVAL;
-+			goto out;
-+		}
-+
-+		params.counter_offset_presp = offset;
-+	}
-+
-+	wdev_lock(wdev);
-+	err = rdev_color_change(rdev, dev, &params);
-+	wdev_unlock(wdev);
-+
-+out:
-+	kfree(tb);
-+	return err;
-+}
-+
- #define NL80211_FLAG_NEED_WIPHY		0x01
- #define NL80211_FLAG_NEED_NETDEV	0x02
- #define NL80211_FLAG_NEED_RTNL		0x04
-@@ -15770,6 +15874,14 @@ static const struct genl_small_ops nl802
- 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
- 				  NL80211_FLAG_NEED_RTNL,
- 	},
-+	{
-+		.cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
-+		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-+		.doit = nl80211_color_change,
-+		.flags = GENL_UNS_ADMIN_PERM,
-+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-+				  NL80211_FLAG_NEED_RTNL,
-+	},
- };
- 
- static struct genl_family nl80211_fam __genl_ro_after_init = {
-@@ -17397,6 +17509,51 @@ void cfg80211_ch_switch_started_notify(s
- }
- EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
- 
-+int cfg80211_bss_color_notify(struct net_device *dev, gfp_t gfp,
-+			      enum nl80211_commands cmd, u8 count,
-+			      u64 color_bitmap)
-+{
-+	struct wireless_dev *wdev = dev->ieee80211_ptr;
-+	struct wiphy *wiphy = wdev->wiphy;
-+	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
-+	struct sk_buff *msg;
-+	void *hdr;
-+
-+	ASSERT_WDEV_LOCK(wdev);
-+
-+	trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
-+
-+	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
-+	if (!msg)
-+		return -ENOMEM;
-+
-+	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
-+	if (!hdr)
-+		goto nla_put_failure;
-+
-+	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
-+		goto nla_put_failure;
-+
-+	if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
-+	    nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
-+		goto nla_put_failure;
-+
-+	if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
-+	    nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
-+			      color_bitmap, NL80211_ATTR_PAD))
-+		goto nla_put_failure;
-+
-+	genlmsg_end(msg, hdr);
-+
-+	return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
-+				       msg, 0, NL80211_MCGRP_MLME, gfp);
-+
-+nla_put_failure:
-+	nlmsg_free(msg);
-+	return -EINVAL;
-+}
-+EXPORT_SYMBOL(cfg80211_bss_color_notify);
-+
- void
- nl80211_radar_notify(struct cfg80211_registered_device *rdev,
- 		     const struct cfg80211_chan_def *chandef,
---- a/net/wireless/rdev-ops.h
-+++ b/net/wireless/rdev-ops.h
-@@ -1368,4 +1368,17 @@ static inline int rdev_set_sar_specs(str
- 	return ret;
- }
- 
-+static inline int rdev_color_change(struct cfg80211_registered_device *rdev,
-+				    struct net_device *dev,
-+				    struct cfg80211_color_change_settings *params)
-+{
-+	int ret;
-+
-+	trace_rdev_color_change(&rdev->wiphy, dev, params);
-+	ret = rdev->ops->color_change(&rdev->wiphy, dev, params);
-+	trace_rdev_return_int(&rdev->wiphy, ret);
-+
-+	return ret;
-+}
-+
- #endif /* __CFG80211_RDEV_OPS */
---- a/net/wireless/trace.h
-+++ b/net/wireless/trace.h
-@@ -3570,6 +3570,52 @@ TRACE_EVENT(rdev_set_sar_specs,
- 		  WIPHY_PR_ARG, __entry->type, __entry->num)
- );
- 
-+TRACE_EVENT(rdev_color_change,
-+	TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
-+		 struct cfg80211_color_change_settings *params),
-+	TP_ARGS(wiphy, netdev, params),
-+	TP_STRUCT__entry(
-+		WIPHY_ENTRY
-+		NETDEV_ENTRY
-+		__field(u8, count)
-+		__field(u16, bcn_ofs)
-+		__field(u16, pres_ofs)
-+	),
-+	TP_fast_assign(
-+		WIPHY_ASSIGN;
-+		NETDEV_ASSIGN;
-+		__entry->count = params->count;
-+		__entry->bcn_ofs = params->counter_offset_beacon;
-+		__entry->pres_ofs = params->counter_offset_presp;
-+	),
-+	TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT
-+		  ", count: %u",
-+		  WIPHY_PR_ARG, NETDEV_PR_ARG,
-+		  __entry->count)
-+);
-+
-+TRACE_EVENT(cfg80211_bss_color_notify,
-+	TP_PROTO(struct net_device *netdev,
-+		 enum nl80211_commands cmd,
-+		 u8 count, u64 color_bitmap),
-+	TP_ARGS(netdev, cmd, count, color_bitmap),
-+	TP_STRUCT__entry(
-+		NETDEV_ENTRY
-+		__field(enum nl80211_bss_scan_width, cmd)
-+		__field(u8, count)
-+		__field(u64, color_bitmap)
-+	),
-+	TP_fast_assign(
-+		NETDEV_ASSIGN;
-+		__entry->cmd = cmd;
-+		__entry->count = count;
-+		__entry->color_bitmap = color_bitmap;
-+	),
-+	TP_printk(NETDEV_PR_FMT ", cmd: %x, count: %u, bitmap: %llx",
-+		  NETDEV_PR_ARG, __entry->cmd, __entry->count,
-+		  __entry->color_bitmap)
-+);
-+
- #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
- 
- #undef TRACE_INCLUDE_PATH
diff --git a/package/kernel/mac80211/patches/subsys/388-mac80211-add-support-for-BSS-color-change.patch b/package/kernel/mac80211/patches/subsys/388-mac80211-add-support-for-BSS-color-change.patch
deleted file mode 100644
index 60660764ab..0000000000
--- a/package/kernel/mac80211/patches/subsys/388-mac80211-add-support-for-BSS-color-change.patch
+++ /dev/null
@@ -1,524 +0,0 @@
-From: John Crispin <john@phrozen.org>
-Date: Fri, 2 Jul 2021 19:44:08 +0200
-Subject: [PATCH] mac80211: add support for BSS color change
-
-The color change announcement is very similar to how CSA works where
-we have an IE that includes a counter. When the counter hits 0, the new
-color is applied via an updated beacon.
-
-This patch makes the CSA counter functionality reusable, rather than
-implementing it again. This also allows for future reuse incase support
-for other counter IEs gets added.
-
-Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Signed-off-by: John Crispin <john@phrozen.org>
-Link: https://lore.kernel.org/r/057c1e67b82bee561ea44ce6a45a8462d3da6995.1625247619.git.lorenzo@kernel.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -1710,6 +1710,10 @@ enum ieee80211_offload_flags {
-  *	protected by fq->lock.
-  * @offload_flags: 802.3 -> 802.11 enapsulation offload flags, see
-  *	&enum ieee80211_offload_flags.
-+ * @color_change_active: marks whether a color change is ongoing. Internally it is
-+ *	write-protected by sdata_lock and local->mtx so holding either is fine
-+ *	for read access.
-+ * @color_change_color: the bss color that will be used after the change.
-  */
- struct ieee80211_vif {
- 	enum nl80211_iftype type;
-@@ -1738,6 +1742,9 @@ struct ieee80211_vif {
- 
- 	bool txqs_stopped[IEEE80211_NUM_ACS];
- 
-+	bool color_change_active;
-+	u8 color_change_color;
-+
- 	/* must be last */
- 	u8 drv_priv[] __aligned(sizeof(void *));
- };
-@@ -4982,6 +4989,16 @@ void ieee80211_csa_finish(struct ieee802
- bool ieee80211_beacon_cntdwn_is_complete(struct ieee80211_vif *vif);
- 
- /**
-+ * ieee80211_color_change_finish - notify mac80211 about color change
-+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
-+ *
-+ * After a color change announcement was scheduled and the counter in this
-+ * announcement hits 1, this function must be called by the driver to
-+ * notify mac80211 that the color can be changed
-+ */
-+void ieee80211_color_change_finish(struct ieee80211_vif *vif);
-+
-+/**
-  * ieee80211_proberesp_get - retrieve a Probe Response template
-  * @hw: pointer obtained from ieee80211_alloc_hw().
-  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
-@@ -6726,6 +6743,18 @@ ieee80211_get_unsol_bcast_probe_resp_tmp
- 					  struct ieee80211_vif *vif);
- 
- /**
-+ * ieeee80211_obss_color_collision_notify - notify userland about a BSS color
-+ * collision.
-+ *
-+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
-+ * @color_bitmap: a 64 bit bitmap representing the colors that the local BSS is
-+ *	aware of.
-+ */
-+void
-+ieeee80211_obss_color_collision_notify(struct ieee80211_vif *vif,
-+				       u64 color_bitmap);
-+
-+/**
-  * ieee80211_is_tx_data - check if frame is a data frame
-  *
-  * The function is used to check if a frame is a data frame. Frames with
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -827,9 +827,11 @@ static int ieee80211_set_monitor_channel
- 	return ret;
- }
- 
--static int ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
--				    const u8 *resp, size_t resp_len,
--				    const struct ieee80211_csa_settings *csa)
-+static int
-+ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
-+			 const u8 *resp, size_t resp_len,
-+			 const struct ieee80211_csa_settings *csa,
-+			 const struct ieee80211_color_change_settings *cca)
- {
- 	struct probe_resp *new, *old;
- 
-@@ -849,6 +851,8 @@ static int ieee80211_set_probe_resp(stru
- 		memcpy(new->cntdwn_counter_offsets, csa->counter_offsets_presp,
- 		       csa->n_counter_offsets_presp *
- 		       sizeof(new->cntdwn_counter_offsets[0]));
-+	else if (cca)
-+		new->cntdwn_counter_offsets[0] = cca->counter_offset_presp;
- 
- 	rcu_assign_pointer(sdata->u.ap.probe_resp, new);
- 	if (old)
-@@ -954,7 +958,8 @@ static int ieee80211_set_ftm_responder_p
- 
- static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
- 				   struct cfg80211_beacon_data *params,
--				   const struct ieee80211_csa_settings *csa)
-+				   const struct ieee80211_csa_settings *csa,
-+				   const struct ieee80211_color_change_settings *cca)
- {
- 	struct beacon_data *new, *old;
- 	int new_head_len, new_tail_len;
-@@ -1003,6 +1008,9 @@ static int ieee80211_assign_beacon(struc
- 		memcpy(new->cntdwn_counter_offsets, csa->counter_offsets_beacon,
- 		       csa->n_counter_offsets_beacon *
- 		       sizeof(new->cntdwn_counter_offsets[0]));
-+	} else if (cca) {
-+		new->cntdwn_current_counter = cca->count;
-+		new->cntdwn_counter_offsets[0] = cca->counter_offset_beacon;
- 	}
- 
- 	/* copy in head */
-@@ -1019,7 +1027,7 @@ static int ieee80211_assign_beacon(struc
- 			memcpy(new->tail, old->tail, new_tail_len);
- 
- 	err = ieee80211_set_probe_resp(sdata, params->probe_resp,
--				       params->probe_resp_len, csa);
-+				       params->probe_resp_len, csa, cca);
- 	if (err < 0) {
- 		kfree(new);
- 		return err;
-@@ -1176,7 +1184,7 @@ static int ieee80211_start_ap(struct wip
- 	if (ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL))
- 		sdata->vif.bss_conf.beacon_tx_rate = params->beacon_rate;
- 
--	err = ieee80211_assign_beacon(sdata, &params->beacon, NULL);
-+	err = ieee80211_assign_beacon(sdata, &params->beacon, NULL, NULL);
- 	if (err < 0)
- 		goto error;
- 	changed |= err;
-@@ -1234,17 +1242,17 @@ static int ieee80211_change_beacon(struc
- 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
- 	sdata_assert_lock(sdata);
- 
--	/* don't allow changing the beacon while CSA is in place - offset
-+	/* don't allow changing the beacon while a countdown is in place - offset
- 	 * of channel switch counter may change
- 	 */
--	if (sdata->vif.csa_active)
-+	if (sdata->vif.csa_active || sdata->vif.color_change_active)
- 		return -EBUSY;
- 
- 	old = sdata_dereference(sdata->u.ap.beacon, sdata);
- 	if (!old)
- 		return -ENOENT;
- 
--	err = ieee80211_assign_beacon(sdata, params, NULL);
-+	err = ieee80211_assign_beacon(sdata, params, NULL, NULL);
- 	if (err < 0)
- 		return err;
- 	ieee80211_bss_info_change_notify(sdata, err);
-@@ -3174,7 +3182,7 @@ static int ieee80211_set_after_csa_beaco
- 	switch (sdata->vif.type) {
- 	case NL80211_IFTYPE_AP:
- 		err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon,
--					      NULL);
-+					      NULL, NULL);
- 		kfree(sdata->u.ap.next_beacon);
- 		sdata->u.ap.next_beacon = NULL;
- 
-@@ -3340,7 +3348,7 @@ static int ieee80211_set_csa_beacon(stru
- 		csa.n_counter_offsets_presp = params->n_counter_offsets_presp;
- 		csa.count = params->count;
- 
--		err = ieee80211_assign_beacon(sdata, &params->beacon_csa, &csa);
-+		err = ieee80211_assign_beacon(sdata, &params->beacon_csa, &csa, NULL);
- 		if (err < 0) {
- 			kfree(sdata->u.ap.next_beacon);
- 			return err;
-@@ -3428,6 +3436,15 @@ static int ieee80211_set_csa_beacon(stru
- 	return 0;
- }
- 
-+static void ieee80211_color_change_abort(struct ieee80211_sub_if_data  *sdata)
-+{
-+	sdata->vif.color_change_active = false;
-+	kfree(sdata->u.ap.next_beacon);
-+	sdata->u.ap.next_beacon = NULL;
-+
-+	cfg80211_color_change_aborted_notify(sdata->dev);
-+}
-+
- static int
- __ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
- 			   struct cfg80211_csa_settings *params)
-@@ -3496,6 +3513,10 @@ __ieee80211_channel_switch(struct wiphy
- 		goto out;
- 	}
- 
-+	/* if there is a color change in progress, abort it */
-+	if (sdata->vif.color_change_active)
-+		ieee80211_color_change_abort(sdata);
-+
- 	err = ieee80211_set_csa_beacon(sdata, params, &changed);
- 	if (err) {
- 		ieee80211_vif_unreserve_chanctx(sdata);
-@@ -4147,6 +4168,196 @@ static int ieee80211_set_sar_specs(struc
- 	return local->ops->set_sar_specs(&local->hw, sar);
- }
- 
-+static int
-+ieee80211_set_after_color_change_beacon(struct ieee80211_sub_if_data *sdata,
-+					u32 *changed)
-+{
-+	switch (sdata->vif.type) {
-+	case NL80211_IFTYPE_AP: {
-+		int ret;
-+
-+		ret = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon,
-+					      NULL, NULL);
-+		kfree(sdata->u.ap.next_beacon);
-+		sdata->u.ap.next_beacon = NULL;
-+
-+		if (ret < 0)
-+			return ret;
-+
-+		*changed |= ret;
-+		break;
-+	}
-+	default:
-+		WARN_ON_ONCE(1);
-+		return -EINVAL;
-+	}
-+
-+	return 0;
-+}
-+
-+static int
-+ieee80211_set_color_change_beacon(struct ieee80211_sub_if_data *sdata,
-+				  struct cfg80211_color_change_settings *params,
-+				  u32 *changed)
-+{
-+	struct ieee80211_color_change_settings color_change = {};
-+	int err;
-+
-+	switch (sdata->vif.type) {
-+	case NL80211_IFTYPE_AP:
-+		sdata->u.ap.next_beacon =
-+			cfg80211_beacon_dup(&params->beacon_next);
-+		if (!sdata->u.ap.next_beacon)
-+			return -ENOMEM;
-+
-+		if (params->count <= 1)
-+			break;
-+
-+		color_change.counter_offset_beacon =
-+			params->counter_offset_beacon;
-+		color_change.counter_offset_presp =
-+			params->counter_offset_presp;
-+		color_change.count = params->count;
-+
-+		err = ieee80211_assign_beacon(sdata, &params->beacon_color_change,
-+					      NULL, &color_change);
-+		if (err < 0) {
-+			kfree(sdata->u.ap.next_beacon);
-+			return err;
-+		}
-+		*changed |= err;
-+		break;
-+	default:
-+		return -EOPNOTSUPP;
-+	}
-+
-+	return 0;
-+}
-+
-+static void
-+ieee80211_color_change_bss_config_notify(struct ieee80211_sub_if_data *sdata,
-+					 u8 color, int enable, u32 changed)
-+{
-+	sdata->vif.bss_conf.he_bss_color.color = color;
-+	sdata->vif.bss_conf.he_bss_color.enabled = enable;
-+	changed |= BSS_CHANGED_HE_BSS_COLOR;
-+
-+	ieee80211_bss_info_change_notify(sdata, changed);
-+}
-+
-+static int ieee80211_color_change_finalize(struct ieee80211_sub_if_data *sdata)
-+{
-+	struct ieee80211_local *local = sdata->local;
-+	u32 changed = 0;
-+	int err;
-+
-+	sdata_assert_lock(sdata);
-+	lockdep_assert_held(&local->mtx);
-+
-+	sdata->vif.color_change_active = false;
-+
-+	err = ieee80211_set_after_color_change_beacon(sdata, &changed);
-+	if (err) {
-+		cfg80211_color_change_aborted_notify(sdata->dev);
-+		return err;
-+	}
-+
-+	ieee80211_color_change_bss_config_notify(sdata,
-+						 sdata->vif.color_change_color,
-+						 1, changed);
-+	cfg80211_color_change_notify(sdata->dev);
-+
-+	return 0;
-+}
-+
-+void ieee80211_color_change_finalize_work(struct work_struct *work)
-+{
-+	struct ieee80211_sub_if_data *sdata =
-+		container_of(work, struct ieee80211_sub_if_data,
-+			     color_change_finalize_work);
-+	struct ieee80211_local *local = sdata->local;
-+
-+	sdata_lock(sdata);
-+	mutex_lock(&local->mtx);
-+
-+	/* AP might have been stopped while waiting for the lock. */
-+	if (!sdata->vif.color_change_active)
-+		goto unlock;
-+
-+	if (!ieee80211_sdata_running(sdata))
-+		goto unlock;
-+
-+	ieee80211_color_change_finalize(sdata);
-+
-+unlock:
-+	mutex_unlock(&local->mtx);
-+	sdata_unlock(sdata);
-+}
-+
-+void ieee80211_color_change_finish(struct ieee80211_vif *vif)
-+{
-+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-+
-+	ieee80211_queue_work(&sdata->local->hw,
-+			     &sdata->color_change_finalize_work);
-+}
-+EXPORT_SYMBOL_GPL(ieee80211_color_change_finish);
-+
-+void
-+ieeee80211_obss_color_collision_notify(struct ieee80211_vif *vif,
-+				       u64 color_bitmap)
-+{
-+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-+
-+	if (sdata->vif.color_change_active || sdata->vif.csa_active)
-+		return;
-+
-+	cfg80211_obss_color_collision_notify(sdata->dev, color_bitmap);
-+}
-+EXPORT_SYMBOL_GPL(ieeee80211_obss_color_collision_notify);
-+
-+static int
-+ieee80211_color_change(struct wiphy *wiphy, struct net_device *dev,
-+		       struct cfg80211_color_change_settings *params)
-+{
-+	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-+	struct ieee80211_local *local = sdata->local;
-+	u32 changed = 0;
-+	int err;
-+
-+	sdata_assert_lock(sdata);
-+
-+	mutex_lock(&local->mtx);
-+
-+	/* don't allow another color change if one is already active or if csa
-+	 * is active
-+	 */
-+	if (sdata->vif.color_change_active || sdata->vif.csa_active) {
-+		err = -EBUSY;
-+		goto out;
-+	}
-+
-+	err = ieee80211_set_color_change_beacon(sdata, params, &changed);
-+	if (err)
-+		goto out;
-+
-+	sdata->vif.color_change_active = true;
-+	sdata->vif.color_change_color = params->color;
-+
-+	cfg80211_color_change_started_notify(sdata->dev, params->count);
-+
-+	if (changed)
-+		ieee80211_color_change_bss_config_notify(sdata, 0, 0, changed);
-+	else
-+		/* if the beacon didn't change, we can finalize immediately */
-+		ieee80211_color_change_finalize(sdata);
-+
-+out:
-+	mutex_unlock(&local->mtx);
-+
-+	return err;
-+}
-+
- const struct cfg80211_ops mac80211_config_ops = {
- 	.add_virtual_intf = ieee80211_add_iface,
- 	.del_virtual_intf = ieee80211_del_iface,
-@@ -4251,4 +4462,5 @@ const struct cfg80211_ops mac80211_confi
- 	.set_tid_config = ieee80211_set_tid_config,
- 	.reset_tid_config = ieee80211_reset_tid_config,
- 	.set_sar_specs = ieee80211_set_sar_specs,
-+	.color_change = ieee80211_color_change,
- };
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -248,6 +248,12 @@ struct ieee80211_csa_settings {
- 	u8 count;
- };
- 
-+struct ieee80211_color_change_settings {
-+	u16 counter_offset_beacon;
-+	u16 counter_offset_presp;
-+	u8 count;
-+};
-+
- struct beacon_data {
- 	u8 *head, *tail;
- 	int head_len, tail_len;
-@@ -932,6 +938,8 @@ struct ieee80211_sub_if_data {
- 	bool csa_block_tx; /* write-protected by sdata_lock and local->mtx */
- 	struct cfg80211_chan_def csa_chandef;
- 
-+	struct work_struct color_change_finalize_work;
-+
- 	struct list_head assigned_chanctx_list; /* protected by chanctx_mtx */
- 	struct list_head reserved_chanctx_list; /* protected by chanctx_mtx */
- 
-@@ -1900,6 +1908,9 @@ void ieee80211_csa_finalize_work(struct
- int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
- 			     struct cfg80211_csa_settings *params);
- 
-+/* color change handling */
-+void ieee80211_color_change_finalize_work(struct work_struct *work);
-+
- /* interface handling */
- #define MAC80211_SUPPORTED_FEATURES_TX	(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \
- 					 NETIF_F_HW_CSUM | NETIF_F_SG | \
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -465,6 +465,7 @@ static void ieee80211_do_stop(struct iee
- 	sdata_unlock(sdata);
- 
- 	cancel_work_sync(&sdata->csa_finalize_work);
-+	cancel_work_sync(&sdata->color_change_finalize_work);
- 
- 	cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
- 
-@@ -1639,6 +1640,7 @@ static void ieee80211_setup_sdata(struct
- 	INIT_WORK(&sdata->work, ieee80211_iface_work);
- 	INIT_WORK(&sdata->recalc_smps, ieee80211_recalc_smps_work);
- 	INIT_WORK(&sdata->csa_finalize_work, ieee80211_csa_finalize_work);
-+	INIT_WORK(&sdata->color_change_finalize_work, ieee80211_color_change_finalize_work);
- 	INIT_LIST_HEAD(&sdata->assigned_chanctx_list);
- 	INIT_LIST_HEAD(&sdata->reserved_chanctx_list);
- 
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -4802,11 +4802,11 @@ static int ieee80211_beacon_add_tim(stru
- static void ieee80211_set_beacon_cntdwn(struct ieee80211_sub_if_data *sdata,
- 					struct beacon_data *beacon)
- {
-+	u8 *beacon_data, count, max_count = 1;
- 	struct probe_resp *resp;
--	u8 *beacon_data;
- 	size_t beacon_data_len;
-+	u16 *bcn_offsets;
- 	int i;
--	u8 count = beacon->cntdwn_current_counter;
- 
- 	switch (sdata->vif.type) {
- 	case NL80211_IFTYPE_AP:
-@@ -4826,21 +4826,27 @@ static void ieee80211_set_beacon_cntdwn(
- 	}
- 
- 	rcu_read_lock();
--	for (i = 0; i < IEEE80211_MAX_CNTDWN_COUNTERS_NUM; ++i) {
--		resp = rcu_dereference(sdata->u.ap.probe_resp);
-+	resp = rcu_dereference(sdata->u.ap.probe_resp);
- 
--		if (beacon->cntdwn_counter_offsets[i]) {
--			if (WARN_ON_ONCE(beacon->cntdwn_counter_offsets[i] >=
--					 beacon_data_len)) {
-+	bcn_offsets = beacon->cntdwn_counter_offsets;
-+	count = beacon->cntdwn_current_counter;
-+	if (sdata->vif.csa_active)
-+		max_count = IEEE80211_MAX_CNTDWN_COUNTERS_NUM;
-+
-+	for (i = 0; i < max_count; ++i) {
-+		if (bcn_offsets[i]) {
-+			if (WARN_ON_ONCE(bcn_offsets[i] >= beacon_data_len)) {
- 				rcu_read_unlock();
- 				return;
- 			}
--
--			beacon_data[beacon->cntdwn_counter_offsets[i]] = count;
-+			beacon_data[bcn_offsets[i]] = count;
- 		}
- 
--		if (sdata->vif.type == NL80211_IFTYPE_AP && resp)
--			resp->data[resp->cntdwn_counter_offsets[i]] = count;
-+		if (sdata->vif.type == NL80211_IFTYPE_AP && resp) {
-+			u16 *resp_offsets = resp->cntdwn_counter_offsets;
-+
-+			resp->data[resp_offsets[i]] = count;
-+		}
- 	}
- 	rcu_read_unlock();
- }
-@@ -5050,6 +5056,7 @@ __ieee80211_beacon_get(struct ieee80211_
- 			if (offs) {
- 				offs->tim_offset = beacon->head_len;
- 				offs->tim_length = skb->len - beacon->head_len;
-+				offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
- 
- 				/* for AP the csa offsets are from tail */
- 				csa_off_base = skb->len;
diff --git a/package/kernel/mac80211/patches/subsys/389-ieee80211-add-TWT-element-definitions.patch b/package/kernel/mac80211/patches/subsys/389-ieee80211-add-TWT-element-definitions.patch
deleted file mode 100644
index 369619938e..0000000000
--- a/package/kernel/mac80211/patches/subsys/389-ieee80211-add-TWT-element-definitions.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Mon, 23 Aug 2021 20:02:38 +0200
-Subject: [PATCH] ieee80211: add TWT element definitions
-
-Introduce TWT definitions and TWT Information element structure
-in ieee80211.h
-
-Tested-by: Peter Chiu <chui-hao.chiu@mediatek.com>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://lore.kernel.org/r/71d8b581fe4b5abc5b92f8d77ac2de3e2f7591b6.1629741512.git.lorenzo@kernel.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/linux/ieee80211.h
-+++ b/include/linux/ieee80211.h
-@@ -1088,6 +1088,48 @@ struct ieee80211_ext {
- 	} u;
- } __packed __aligned(2);
- 
-+#define IEEE80211_TWT_CONTROL_NDP			BIT(0)
-+#define IEEE80211_TWT_CONTROL_RESP_MODE			BIT(1)
-+#define IEEE80211_TWT_CONTROL_NEG_TYPE_BROADCAST	BIT(3)
-+#define IEEE80211_TWT_CONTROL_RX_DISABLED		BIT(4)
-+#define IEEE80211_TWT_CONTROL_WAKE_DUR_UNIT		BIT(5)
-+
-+#define IEEE80211_TWT_REQTYPE_REQUEST			BIT(0)
-+#define IEEE80211_TWT_REQTYPE_SETUP_CMD			GENMASK(3, 1)
-+#define IEEE80211_TWT_REQTYPE_TRIGGER			BIT(4)
-+#define IEEE80211_TWT_REQTYPE_IMPLICIT			BIT(5)
-+#define IEEE80211_TWT_REQTYPE_FLOWTYPE			BIT(6)
-+#define IEEE80211_TWT_REQTYPE_FLOWID			GENMASK(9, 7)
-+#define IEEE80211_TWT_REQTYPE_WAKE_INT_EXP		GENMASK(14, 10)
-+#define IEEE80211_TWT_REQTYPE_PROTECTION		BIT(15)
-+
-+enum ieee80211_twt_setup_cmd {
-+	TWT_SETUP_CMD_REQUEST,
-+	TWT_SETUP_CMD_SUGGEST,
-+	TWT_SETUP_CMD_DEMAND,
-+	TWT_SETUP_CMD_GROUPING,
-+	TWT_SETUP_CMD_ACCEPT,
-+	TWT_SETUP_CMD_ALTERNATE,
-+	TWT_SETUP_CMD_DICTATE,
-+	TWT_SETUP_CMD_REJECT,
-+};
-+
-+struct ieee80211_twt_params {
-+	__le16 req_type;
-+	__le64 twt;
-+	u8 min_twt_dur;
-+	__le16 mantissa;
-+	u8 channel;
-+} __packed;
-+
-+struct ieee80211_twt_setup {
-+	u8 dialog_token;
-+	u8 element_id;
-+	u8 length;
-+	u8 control;
-+	u8 params[];
-+} __packed;
-+
- struct ieee80211_mgmt {
- 	__le16 frame_control;
- 	__le16 duration;
-@@ -1252,6 +1294,10 @@ struct ieee80211_mgmt {
- 					__le16 toa_error;
- 					u8 variable[0];
- 				} __packed ftm;
-+				struct {
-+					u8 action_code;
-+					u8 variable[];
-+				} __packed s1g;
- 			} u;
- 		} __packed action;
- 	} u;
-@@ -2880,6 +2926,7 @@ enum ieee80211_eid {
- 	WLAN_EID_AID_RESPONSE = 211,
- 	WLAN_EID_S1G_BCN_COMPAT = 213,
- 	WLAN_EID_S1G_SHORT_BCN_INTERVAL = 214,
-+	WLAN_EID_S1G_TWT = 216,
- 	WLAN_EID_S1G_CAPABILITIES = 217,
- 	WLAN_EID_VENDOR_SPECIFIC = 221,
- 	WLAN_EID_QOS_PARAMETER = 222,
-@@ -2948,6 +2995,7 @@ enum ieee80211_category {
- 	WLAN_CATEGORY_FST = 18,
- 	WLAN_CATEGORY_UNPROT_DMG = 20,
- 	WLAN_CATEGORY_VHT = 21,
-+	WLAN_CATEGORY_S1G = 22,
- 	WLAN_CATEGORY_VENDOR_SPECIFIC_PROTECTED = 126,
- 	WLAN_CATEGORY_VENDOR_SPECIFIC = 127,
- };
-@@ -3021,6 +3069,20 @@ enum ieee80211_key_len {
- 	WLAN_KEY_LEN_BIP_GMAC_256 = 32,
- };
- 
-+enum ieee80211_s1g_actioncode {
-+	WLAN_S1G_AID_SWITCH_REQUEST,
-+	WLAN_S1G_AID_SWITCH_RESPONSE,
-+	WLAN_S1G_SYNC_CONTROL,
-+	WLAN_S1G_STA_INFO_ANNOUNCE,
-+	WLAN_S1G_EDCA_PARAM_SET,
-+	WLAN_S1G_EL_OPERATION,
-+	WLAN_S1G_TWT_SETUP,
-+	WLAN_S1G_TWT_TEARDOWN,
-+	WLAN_S1G_SECT_GROUP_ID_LIST,
-+	WLAN_S1G_SECT_ID_FEEDBACK,
-+	WLAN_S1G_TWT_INFORMATION = 11,
-+};
-+
- #define IEEE80211_WEP_IV_LEN		4
- #define IEEE80211_WEP_ICV_LEN		4
- #define IEEE80211_CCMP_HDR_LEN		8
diff --git a/package/kernel/mac80211/patches/subsys/390-mac80211-introduce-individual-TWT-support-in-AP-mode.patch b/package/kernel/mac80211/patches/subsys/390-mac80211-introduce-individual-TWT-support-in-AP-mode.patch
deleted file mode 100644
index 995a9f1ea7..0000000000
--- a/package/kernel/mac80211/patches/subsys/390-mac80211-introduce-individual-TWT-support-in-AP-mode.patch
+++ /dev/null
@@ -1,576 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Mon, 23 Aug 2021 20:02:39 +0200
-Subject: [PATCH] mac80211: introduce individual TWT support in AP mode
-
-Introduce TWT action frames parsing support to mac80211.
-Currently just individual TWT agreement are support in AP mode.
-Whenever the AP receives a TWT action frame from an associated client,
-after performing sanity checks, it will notify the underlay driver with
-requested parameters in order to check if they are supported and if there
-is enough room for a new agreement. The driver is expected to set the
-agreement result and report it to mac80211.
-
-Drivers supporting this have two new callbacks:
- - add_twt_setup (mandatory)
- - twt_teardown_request (optional)
-
-mac80211 will send an action frame reply according to the result
-reported by the driver.
-
-Tested-by: Peter Chiu <chui-hao.chiu@mediatek.com>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://lore.kernel.org/r/257512f2e22ba42b9f2624942a128dd8f141de4b.1629741512.git.lorenzo@kernel.org
-[use le16p_replace_bits(), minor cleanups, use (void *) casts,
- fix to use ieee80211_get_he_iftype_cap() correctly]
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -4219,6 +4219,11 @@ struct ieee80211_ops {
- 	void (*sta_set_decap_offload)(struct ieee80211_hw *hw,
- 				      struct ieee80211_vif *vif,
- 				      struct ieee80211_sta *sta, bool enabled);
-+	void (*add_twt_setup)(struct ieee80211_hw *hw,
-+			      struct ieee80211_sta *sta,
-+			      struct ieee80211_twt_setup *twt);
-+	void (*twt_teardown_request)(struct ieee80211_hw *hw,
-+				     struct ieee80211_sta *sta, u8 flowid);
- };
- 
- /**
---- a/net/mac80211/driver-ops.h
-+++ b/net/mac80211/driver-ops.h
-@@ -1432,4 +1432,40 @@ static inline void drv_sta_set_decap_off
- 	trace_drv_return_void(local);
- }
- 
-+static inline void drv_add_twt_setup(struct ieee80211_local *local,
-+				     struct ieee80211_sub_if_data *sdata,
-+				     struct ieee80211_sta *sta,
-+				     struct ieee80211_twt_setup *twt)
-+{
-+	struct ieee80211_twt_params *twt_agrt;
-+
-+	might_sleep();
-+
-+	if (!check_sdata_in_driver(sdata))
-+		return;
-+
-+	twt_agrt = (void *)twt->params;
-+
-+	trace_drv_add_twt_setup(local, sta, twt, twt_agrt);
-+	local->ops->add_twt_setup(&local->hw, sta, twt);
-+	trace_drv_return_void(local);
-+}
-+
-+static inline void drv_twt_teardown_request(struct ieee80211_local *local,
-+					    struct ieee80211_sub_if_data *sdata,
-+					    struct ieee80211_sta *sta,
-+					    u8 flowid)
-+{
-+	might_sleep();
-+	if (!check_sdata_in_driver(sdata))
-+		return;
-+
-+	if (!local->ops->twt_teardown_request)
-+		return;
-+
-+	trace_drv_twt_teardown_request(local, sta, flowid);
-+	local->ops->twt_teardown_request(&local->hw, sta, flowid);
-+	trace_drv_return_void(local);
-+}
-+
- #endif /* __MAC80211_DRIVER_OPS */
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -954,6 +954,7 @@ struct ieee80211_sub_if_data {
- 
- 	struct work_struct work;
- 	struct sk_buff_head skb_queue;
-+	struct sk_buff_head status_queue;
- 
- 	u8 needed_rx_chains;
- 	enum ieee80211_smps_mode smps_mode;
-@@ -2093,6 +2094,11 @@ ieee80211_he_op_ie_to_bss_conf(struct ie
- 
- /* S1G */
- void ieee80211_s1g_sta_rate_init(struct sta_info *sta);
-+bool ieee80211_s1g_is_twt_setup(struct sk_buff *skb);
-+void ieee80211_s1g_rx_twt_action(struct ieee80211_sub_if_data *sdata,
-+				 struct sk_buff *skb);
-+void ieee80211_s1g_status_twt_action(struct ieee80211_sub_if_data *sdata,
-+				     struct sk_buff *skb);
- 
- /* Spectrum management */
- void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -563,6 +563,7 @@ static void ieee80211_do_stop(struct iee
- 		 */
- 		ieee80211_free_keys(sdata, true);
- 		skb_queue_purge(&sdata->skb_queue);
-+		skb_queue_purge(&sdata->status_queue);
- 	}
- 
- 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-@@ -1070,6 +1071,7 @@ int ieee80211_add_virtual_monitor(struct
- 	}
- 
- 	skb_queue_head_init(&sdata->skb_queue);
-+	skb_queue_head_init(&sdata->status_queue);
- 	INIT_WORK(&sdata->work, ieee80211_iface_work);
- 
- 	return 0;
-@@ -1442,6 +1444,24 @@ static void ieee80211_if_setup_no_queue(
- #endif
- }
- 
-+static void ieee80211_iface_process_status(struct ieee80211_sub_if_data *sdata,
-+					   struct sk_buff *skb)
-+{
-+	struct ieee80211_mgmt *mgmt = (void *)skb->data;
-+
-+	if (ieee80211_is_action(mgmt->frame_control) &&
-+	    mgmt->u.action.category == WLAN_CATEGORY_S1G) {
-+		switch (mgmt->u.action.u.s1g.action_code) {
-+		case WLAN_S1G_TWT_TEARDOWN:
-+		case WLAN_S1G_TWT_SETUP:
-+			ieee80211_s1g_status_twt_action(sdata, skb);
-+			break;
-+		default:
-+			break;
-+		}
-+	}
-+}
-+
- static void ieee80211_iface_work(struct work_struct *work)
- {
- 	struct ieee80211_sub_if_data *sdata =
-@@ -1519,6 +1539,16 @@ static void ieee80211_iface_work(struct
- 				WARN_ON(1);
- 				break;
- 			}
-+		} else if (ieee80211_is_action(mgmt->frame_control) &&
-+			   mgmt->u.action.category == WLAN_CATEGORY_S1G) {
-+			switch (mgmt->u.action.u.s1g.action_code) {
-+			case WLAN_S1G_TWT_TEARDOWN:
-+			case WLAN_S1G_TWT_SETUP:
-+				ieee80211_s1g_rx_twt_action(sdata, skb);
-+				break;
-+			default:
-+				break;
-+			}
- 		} else if (ieee80211_is_ext(mgmt->frame_control)) {
- 			if (sdata->vif.type == NL80211_IFTYPE_STATION)
- 				ieee80211_sta_rx_queued_ext(sdata, skb);
-@@ -1574,6 +1604,12 @@ static void ieee80211_iface_work(struct
- 		kfree_skb(skb);
- 	}
- 
-+	/* process status queue */
-+	while ((skb = skb_dequeue(&sdata->status_queue))) {
-+		ieee80211_iface_process_status(sdata, skb);
-+		kfree_skb(skb);
-+	}
-+
- 	/* then other type-dependent work */
- 	switch (sdata->vif.type) {
- 	case NL80211_IFTYPE_STATION:
-@@ -1637,6 +1673,7 @@ static void ieee80211_setup_sdata(struct
- 	}
- 
- 	skb_queue_head_init(&sdata->skb_queue);
-+	skb_queue_head_init(&sdata->status_queue);
- 	INIT_WORK(&sdata->work, ieee80211_iface_work);
- 	INIT_WORK(&sdata->recalc_smps, ieee80211_recalc_smps_work);
- 	INIT_WORK(&sdata->csa_finalize_work, ieee80211_csa_finalize_work);
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -3210,6 +3210,68 @@ ieee80211_rx_h_mgmt_check(struct ieee802
- 	return RX_CONTINUE;
- }
- 
-+static bool
-+ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
-+{
-+	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)rx->skb->data;
-+	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
-+	struct ieee80211_sub_if_data *sdata = rx->sdata;
-+	const struct ieee80211_sta_he_cap *hecap;
-+	struct ieee80211_supported_band *sband;
-+
-+	/* TWT actions are only supported in AP for the moment */
-+	if (sdata->vif.type != NL80211_IFTYPE_AP)
-+		return false;
-+
-+	if (!rx->local->ops->add_twt_setup)
-+		return false;
-+
-+	sband = rx->local->hw.wiphy->bands[status->band];
-+	hecap = ieee80211_get_he_iftype_cap(sband,
-+					    ieee80211_vif_type_p2p(&sdata->vif));
-+	if (!hecap)
-+		return false;
-+
-+	if (!(hecap->he_cap_elem.mac_cap_info[0] &
-+	      IEEE80211_HE_MAC_CAP0_TWT_RES))
-+		return false;
-+
-+	if (!rx->sta)
-+		return false;
-+
-+	switch (mgmt->u.action.u.s1g.action_code) {
-+	case WLAN_S1G_TWT_SETUP: {
-+		struct ieee80211_twt_setup *twt;
-+
-+		if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +
-+				   1 + /* action code */
-+				   sizeof(struct ieee80211_twt_setup) +
-+				   2 /* TWT req_type agrt */)
-+			break;
-+
-+		twt = (void *)mgmt->u.action.u.s1g.variable;
-+		if (twt->element_id != WLAN_EID_S1G_TWT)
-+			break;
-+
-+		if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +
-+				   4 + /* action code + token + tlv */
-+				   twt->length)
-+			break;
-+
-+		return true; /* queue the frame */
-+	}
-+	case WLAN_S1G_TWT_TEARDOWN:
-+		if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE + 2)
-+			break;
-+
-+		return true; /* queue the frame */
-+	default:
-+		break;
-+	}
-+
-+	return false;
-+}
-+
- static ieee80211_rx_result debug_noinline
- ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
- {
-@@ -3489,6 +3551,17 @@ ieee80211_rx_h_action(struct ieee80211_r
- 		    !mesh_path_sel_is_hwmp(sdata))
- 			break;
- 		goto queue;
-+	case WLAN_CATEGORY_S1G:
-+		switch (mgmt->u.action.u.s1g.action_code) {
-+		case WLAN_S1G_TWT_SETUP:
-+		case WLAN_S1G_TWT_TEARDOWN:
-+			if (ieee80211_process_rx_twt_action(rx))
-+				goto queue;
-+			break;
-+		default:
-+			break;
-+		}
-+		break;
- 	}
- 
- 	return RX_CONTINUE;
---- a/net/mac80211/s1g.c
-+++ b/net/mac80211/s1g.c
-@@ -6,6 +6,7 @@
- #include <linux/ieee80211.h>
- #include <net/mac80211.h>
- #include "ieee80211_i.h"
-+#include "driver-ops.h"
- 
- void ieee80211_s1g_sta_rate_init(struct sta_info *sta)
- {
-@@ -14,3 +15,182 @@ void ieee80211_s1g_sta_rate_init(struct
- 	sta->rx_stats.last_rate =
- 			STA_STATS_FIELD(TYPE, STA_STATS_RATE_TYPE_S1G);
- }
-+
-+bool ieee80211_s1g_is_twt_setup(struct sk_buff *skb)
-+{
-+	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
-+
-+	if (likely(!ieee80211_is_action(mgmt->frame_control)))
-+		return false;
-+
-+	if (likely(mgmt->u.action.category != WLAN_CATEGORY_S1G))
-+		return false;
-+
-+	return mgmt->u.action.u.s1g.action_code == WLAN_S1G_TWT_SETUP;
-+}
-+
-+static void
-+ieee80211_s1g_send_twt_setup(struct ieee80211_sub_if_data *sdata, const u8 *da,
-+			     const u8 *bssid, struct ieee80211_twt_setup *twt)
-+{
-+	int len = IEEE80211_MIN_ACTION_SIZE + 4 + twt->length;
-+	struct ieee80211_local *local = sdata->local;
-+	struct ieee80211_mgmt *mgmt;
-+	struct sk_buff *skb;
-+
-+	skb = dev_alloc_skb(local->hw.extra_tx_headroom + len);
-+	if (!skb)
-+		return;
-+
-+	skb_reserve(skb, local->hw.extra_tx_headroom);
-+	mgmt = skb_put_zero(skb, len);
-+	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-+					  IEEE80211_STYPE_ACTION);
-+	memcpy(mgmt->da, da, ETH_ALEN);
-+	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
-+	memcpy(mgmt->bssid, bssid, ETH_ALEN);
-+
-+	mgmt->u.action.category = WLAN_CATEGORY_S1G;
-+	mgmt->u.action.u.s1g.action_code = WLAN_S1G_TWT_SETUP;
-+	memcpy(mgmt->u.action.u.s1g.variable, twt, 3 + twt->length);
-+
-+	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
-+					IEEE80211_TX_INTFL_MLME_CONN_TX |
-+					IEEE80211_TX_CTL_REQ_TX_STATUS;
-+	ieee80211_tx_skb(sdata, skb);
-+}
-+
-+static void
-+ieee80211_s1g_send_twt_teardown(struct ieee80211_sub_if_data *sdata,
-+				const u8 *da, const u8 *bssid, u8 flowid)
-+{
-+	struct ieee80211_local *local = sdata->local;
-+	struct ieee80211_mgmt *mgmt;
-+	struct sk_buff *skb;
-+	u8 *id;
-+
-+	skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-+			    IEEE80211_MIN_ACTION_SIZE + 2);
-+	if (!skb)
-+		return;
-+
-+	skb_reserve(skb, local->hw.extra_tx_headroom);
-+	mgmt = skb_put_zero(skb, IEEE80211_MIN_ACTION_SIZE + 2);
-+	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-+					  IEEE80211_STYPE_ACTION);
-+	memcpy(mgmt->da, da, ETH_ALEN);
-+	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
-+	memcpy(mgmt->bssid, bssid, ETH_ALEN);
-+
-+	mgmt->u.action.category = WLAN_CATEGORY_S1G;
-+	mgmt->u.action.u.s1g.action_code = WLAN_S1G_TWT_TEARDOWN;
-+	id = (u8 *)mgmt->u.action.u.s1g.variable;
-+	*id = flowid;
-+
-+	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
-+					IEEE80211_TX_CTL_REQ_TX_STATUS;
-+	ieee80211_tx_skb(sdata, skb);
-+}
-+
-+static void
-+ieee80211_s1g_rx_twt_setup(struct ieee80211_sub_if_data *sdata,
-+			   struct sta_info *sta, struct sk_buff *skb)
-+{
-+	struct ieee80211_mgmt *mgmt = (void *)skb->data;
-+	struct ieee80211_twt_setup *twt = (void *)mgmt->u.action.u.s1g.variable;
-+	struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
-+
-+	twt_agrt->req_type &= cpu_to_le16(~IEEE80211_TWT_REQTYPE_REQUEST);
-+
-+	/* broadcast TWT not supported yet */
-+	if (twt->control & IEEE80211_TWT_CONTROL_NEG_TYPE_BROADCAST) {
-+		le16p_replace_bits(&twt_agrt->req_type,
-+				   TWT_SETUP_CMD_REJECT,
-+				   IEEE80211_TWT_REQTYPE_SETUP_CMD);
-+		goto out;
-+	}
-+
-+	drv_add_twt_setup(sdata->local, sdata, &sta->sta, twt);
-+out:
-+	ieee80211_s1g_send_twt_setup(sdata, mgmt->sa, sdata->vif.addr, twt);
-+}
-+
-+static void
-+ieee80211_s1g_rx_twt_teardown(struct ieee80211_sub_if_data *sdata,
-+			      struct sta_info *sta, struct sk_buff *skb)
-+{
-+	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
-+
-+	drv_twt_teardown_request(sdata->local, sdata, &sta->sta,
-+				 mgmt->u.action.u.s1g.variable[0]);
-+}
-+
-+static void
-+ieee80211_s1g_tx_twt_setup_fail(struct ieee80211_sub_if_data *sdata,
-+				struct sta_info *sta, struct sk_buff *skb)
-+{
-+	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
-+	struct ieee80211_twt_setup *twt = (void *)mgmt->u.action.u.s1g.variable;
-+	struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
-+	u8 flowid = le16_get_bits(twt_agrt->req_type,
-+				  IEEE80211_TWT_REQTYPE_FLOWID);
-+
-+	drv_twt_teardown_request(sdata->local, sdata, &sta->sta, flowid);
-+
-+	ieee80211_s1g_send_twt_teardown(sdata, mgmt->sa, sdata->vif.addr,
-+					flowid);
-+}
-+
-+void ieee80211_s1g_rx_twt_action(struct ieee80211_sub_if_data *sdata,
-+				 struct sk_buff *skb)
-+{
-+	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
-+	struct ieee80211_local *local = sdata->local;
-+	struct sta_info *sta;
-+
-+	mutex_lock(&local->sta_mtx);
-+
-+	sta = sta_info_get_bss(sdata, mgmt->sa);
-+	if (!sta)
-+		goto out;
-+
-+	switch (mgmt->u.action.u.s1g.action_code) {
-+	case WLAN_S1G_TWT_SETUP:
-+		ieee80211_s1g_rx_twt_setup(sdata, sta, skb);
-+		break;
-+	case WLAN_S1G_TWT_TEARDOWN:
-+		ieee80211_s1g_rx_twt_teardown(sdata, sta, skb);
-+		break;
-+	default:
-+		break;
-+	}
-+
-+out:
-+	mutex_unlock(&local->sta_mtx);
-+}
-+
-+void ieee80211_s1g_status_twt_action(struct ieee80211_sub_if_data *sdata,
-+				     struct sk_buff *skb)
-+{
-+	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
-+	struct ieee80211_local *local = sdata->local;
-+	struct sta_info *sta;
-+
-+	mutex_lock(&local->sta_mtx);
-+
-+	sta = sta_info_get_bss(sdata, mgmt->da);
-+	if (!sta)
-+		goto out;
-+
-+	switch (mgmt->u.action.u.s1g.action_code) {
-+	case WLAN_S1G_TWT_SETUP:
-+		/* process failed twt setup frames */
-+		ieee80211_s1g_tx_twt_setup_fail(sdata, sta, skb);
-+		break;
-+	default:
-+		break;
-+	}
-+
-+out:
-+	mutex_unlock(&local->sta_mtx);
-+}
---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -705,13 +705,26 @@ static void ieee80211_report_used_skb(st
- 			/* Check to see if packet is a TDLS teardown packet */
- 			if (ieee80211_is_data(hdr->frame_control) &&
- 			    (ieee80211_get_tdls_action(skb, hdr_size) ==
--			     WLAN_TDLS_TEARDOWN))
-+			     WLAN_TDLS_TEARDOWN)) {
- 				ieee80211_tdls_td_tx_handle(local, sdata, skb,
- 							    info->flags);
--			else
-+			} else if (ieee80211_s1g_is_twt_setup(skb)) {
-+				if (!acked) {
-+					struct sk_buff *qskb;
-+
-+					qskb = skb_clone(skb, GFP_ATOMIC);
-+					if (qskb) {
-+						skb_queue_tail(&sdata->status_queue,
-+							       qskb);
-+						ieee80211_queue_work(&local->hw,
-+								     &sdata->work);
-+					}
-+				}
-+			} else {
- 				ieee80211_mgd_conn_tx_status(sdata,
- 							     hdr->frame_control,
- 							     acked);
-+			}
- 		}
- 
- 		rcu_read_unlock();
---- a/net/mac80211/trace.h
-+++ b/net/mac80211/trace.h
-@@ -2804,6 +2804,73 @@ DEFINE_EVENT(sta_flag_evt, drv_sta_set_d
- 	TP_ARGS(local, sdata, sta, enabled)
- );
- 
-+TRACE_EVENT(drv_add_twt_setup,
-+	TP_PROTO(struct ieee80211_local *local,
-+		 struct ieee80211_sta *sta,
-+		 struct ieee80211_twt_setup *twt,
-+		 struct ieee80211_twt_params *twt_agrt),
-+
-+	TP_ARGS(local, sta, twt, twt_agrt),
-+
-+	TP_STRUCT__entry(
-+		LOCAL_ENTRY
-+		STA_ENTRY
-+		__field(u8, dialog_token)
-+		__field(u8, control)
-+		__field(__le16, req_type)
-+		__field(__le64, twt)
-+		__field(u8, duration)
-+		__field(__le16, mantissa)
-+		__field(u8, channel)
-+	),
-+
-+	TP_fast_assign(
-+		LOCAL_ASSIGN;
-+		STA_ASSIGN;
-+		__entry->dialog_token = twt->dialog_token;
-+		__entry->control = twt->control;
-+		__entry->req_type = twt_agrt->req_type;
-+		__entry->twt = twt_agrt->twt;
-+		__entry->duration = twt_agrt->min_twt_dur;
-+		__entry->mantissa = twt_agrt->mantissa;
-+		__entry->channel = twt_agrt->channel;
-+	),
-+
-+	TP_printk(
-+		LOCAL_PR_FMT STA_PR_FMT
-+		" token:%d control:0x%02x req_type:0x%04x"
-+		" twt:%llu duration:%d mantissa:%d channel:%d",
-+		LOCAL_PR_ARG, STA_PR_ARG, __entry->dialog_token,
-+		__entry->control, le16_to_cpu(__entry->req_type),
-+		le64_to_cpu(__entry->twt), __entry->duration,
-+		le16_to_cpu(__entry->mantissa), __entry->channel
-+	)
-+);
-+
-+TRACE_EVENT(drv_twt_teardown_request,
-+	TP_PROTO(struct ieee80211_local *local,
-+		 struct ieee80211_sta *sta, u8 flowid),
-+
-+	TP_ARGS(local, sta, flowid),
-+
-+	TP_STRUCT__entry(
-+		LOCAL_ENTRY
-+		STA_ENTRY
-+		__field(u8, flowid)
-+	),
-+
-+	TP_fast_assign(
-+		LOCAL_ASSIGN;
-+		STA_ASSIGN;
-+		__entry->flowid = flowid;
-+	),
-+
-+	TP_printk(
-+		LOCAL_PR_FMT STA_PR_FMT " flowid:%d",
-+		LOCAL_PR_ARG, STA_PR_ARG, __entry->flowid
-+	)
-+);
-+
- #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
- 
- #undef TRACE_INCLUDE_PATH
diff --git a/package/kernel/mac80211/patches/subsys/391-wireless-align-some-HE-capabilities-with-the-spec.patch b/package/kernel/mac80211/patches/subsys/391-wireless-align-some-HE-capabilities-with-the-spec.patch
deleted file mode 100644
index 031669b961..0000000000
--- a/package/kernel/mac80211/patches/subsys/391-wireless-align-some-HE-capabilities-with-the-spec.patch
+++ /dev/null
@@ -1,196 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Fri, 9 Apr 2021 12:40:17 +0300
-Subject: [PATCH] wireless: align some HE capabilities with the spec
-
-Some names were changed, align that with the spec as of
-802.11ax-D6.1.
-
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Link: https://lore.kernel.org/r/iwlwifi.20210409123755.b1e5fbab0d8c.I3eb6076cb0714ec6aec6b8f9dee613ce4a05d825@changeid
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -3633,7 +3633,7 @@ ath11k_mac_filter_he_cap_mesh(struct iee
- 	    IEEE80211_HE_MAC_CAP4_BQR;
- 	he_cap_elem->mac_cap_info[4] &= ~m;
- 
--	m = IEEE80211_HE_MAC_CAP5_SUBCHAN_SELECVITE_TRANSMISSION |
-+	m = IEEE80211_HE_MAC_CAP5_SUBCHAN_SELECTIVE_TRANSMISSION |
- 	    IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU |
- 	    IEEE80211_HE_MAC_CAP5_PUNCTURED_SOUNDING |
- 	    IEEE80211_HE_MAC_CAP5_HT_VHT_TRIG_FRAME_RX;
-@@ -3643,7 +3643,7 @@ ath11k_mac_filter_he_cap_mesh(struct iee
- 	    IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO;
- 	he_cap_elem->phy_cap_info[2] &= ~m;
- 
--	m = IEEE80211_HE_PHY_CAP3_RX_HE_MU_PPDU_FROM_NON_AP_STA |
-+	m = IEEE80211_HE_PHY_CAP3_RX_PARTIAL_BW_SU_IN_20MHZ_MU |
- 	    IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_MASK |
- 	    IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_MASK;
- 	he_cap_elem->phy_cap_info[3] &= ~m;
-@@ -3655,13 +3655,13 @@ ath11k_mac_filter_he_cap_mesh(struct iee
- 	he_cap_elem->phy_cap_info[5] &= ~m;
- 
- 	m = IEEE80211_HE_PHY_CAP6_CODEBOOK_SIZE_75_MU |
--	    IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMER_FB |
-+	    IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB |
- 	    IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB |
- 	    IEEE80211_HE_PHY_CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO;
- 	he_cap_elem->phy_cap_info[6] &= ~m;
- 
--	m = IEEE80211_HE_PHY_CAP7_SRP_BASED_SR |
--	    IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_AR |
-+	m = IEEE80211_HE_PHY_CAP7_PSR_BASED_SR |
-+	    IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
- 	    IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ |
- 	    IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ;
- 	he_cap_elem->phy_cap_info[7] &= ~m;
---- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
-@@ -307,8 +307,8 @@ mt7915_set_stream_he_txbf_caps(struct ie
- 	    IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK;
- 	elem->phy_cap_info[5] &= ~c;
- 
--	c = IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMER_FB |
--	    IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMER_FB;
-+	c = IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
-+	    IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB;
- 	elem->phy_cap_info[6] &= ~c;
- 
- 	elem->phy_cap_info[7] &= ~IEEE80211_HE_PHY_CAP7_MAX_NC_MASK;
-@@ -348,8 +348,8 @@ mt7915_set_stream_he_txbf_caps(struct ie
- 	c = (nss - 1) | (max_t(int, mcs->tx_mcs_160, 1) << 3);
- 	elem->phy_cap_info[5] |= c;
- 
--	c = IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMER_FB |
--	    IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMER_FB;
-+	c = IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
-+	    IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB;
- 	elem->phy_cap_info[6] |= c;
- }
- 
-@@ -484,7 +484,7 @@ mt7915_init_he_caps(struct mt7915_phy *p
- 				IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE |
- 				IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT;
- 			he_cap_elem->phy_cap_info[7] |=
--				IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_AR |
-+				IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
- 				IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI;
- 			he_cap_elem->phy_cap_info[8] |=
- 				IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G |
---- a/include/linux/ieee80211.h
-+++ b/include/linux/ieee80211.h
-@@ -2065,7 +2065,7 @@ int ieee80211_get_vht_max_nss(struct iee
- #define IEEE80211_HE_MAC_CAP4_BSRP_BQRP_A_MPDU_AGG		0x01
- #define IEEE80211_HE_MAC_CAP4_QTP				0x02
- #define IEEE80211_HE_MAC_CAP4_BQR				0x04
--#define IEEE80211_HE_MAC_CAP4_SRP_RESP				0x08
-+#define IEEE80211_HE_MAC_CAP4_PSR_RESP				0x08
- #define IEEE80211_HE_MAC_CAP4_NDP_FB_REP			0x10
- #define IEEE80211_HE_MAC_CAP4_OPS				0x20
- #define IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU			0x40
-@@ -2076,7 +2076,7 @@ int ieee80211_get_vht_max_nss(struct iee
- 
- #define IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B40		0x01
- #define IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B41		0x02
--#define IEEE80211_HE_MAC_CAP5_SUBCHAN_SELECVITE_TRANSMISSION	0x04
-+#define IEEE80211_HE_MAC_CAP5_SUBCHAN_SELECTIVE_TRANSMISSION	0x04
- #define IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU			0x08
- #define IEEE80211_HE_MAC_CAP5_OM_CTRL_UL_MU_DATA_DIS_RX		0x10
- #define IEEE80211_HE_MAC_CAP5_HE_DYNAMIC_SM_PS			0x20
-@@ -2134,7 +2134,7 @@ int ieee80211_get_vht_max_nss(struct iee
- #define IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_MASK			0x18
- #define IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1				0x00
- #define IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_2				0x20
--#define IEEE80211_HE_PHY_CAP3_RX_HE_MU_PPDU_FROM_NON_AP_STA		0x40
-+#define IEEE80211_HE_PHY_CAP3_RX_PARTIAL_BW_SU_IN_20MHZ_MU		0x40
- #define IEEE80211_HE_PHY_CAP3_SU_BEAMFORMER				0x80
- 
- #define IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE				0x01
-@@ -2181,15 +2181,15 @@ int ieee80211_get_vht_max_nss(struct iee
- 
- #define IEEE80211_HE_PHY_CAP6_CODEBOOK_SIZE_42_SU			0x01
- #define IEEE80211_HE_PHY_CAP6_CODEBOOK_SIZE_75_MU			0x02
--#define IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMER_FB			0x04
--#define IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMER_FB			0x08
-+#define IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB			0x04
-+#define IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB		0x08
- #define IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB				0x10
- #define IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE			0x20
- #define IEEE80211_HE_PHY_CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO		0x40
- #define IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT			0x80
- 
--#define IEEE80211_HE_PHY_CAP7_SRP_BASED_SR				0x01
--#define IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_AR			0x02
-+#define IEEE80211_HE_PHY_CAP7_PSR_BASED_SR				0x01
-+#define IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP			0x02
- #define IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI		0x04
- #define IEEE80211_HE_PHY_CAP7_MAX_NC_1					0x08
- #define IEEE80211_HE_PHY_CAP7_MAX_NC_2					0x10
---- a/net/mac80211/debugfs_sta.c
-+++ b/net/mac80211/debugfs_sta.c
-@@ -732,15 +732,15 @@ static ssize_t sta_he_capa_read(struct f
- 	PFLAG(MAC, 4, BSRP_BQRP_A_MPDU_AGG, "BSRP-BQRP-A-MPDU-AGG");
- 	PFLAG(MAC, 4, QTP, "QTP");
- 	PFLAG(MAC, 4, BQR, "BQR");
--	PFLAG(MAC, 4, SRP_RESP, "SRP-RESP");
-+	PFLAG(MAC, 4, PSR_RESP, "PSR-RESP");
- 	PFLAG(MAC, 4, NDP_FB_REP, "NDP-FB-REP");
- 	PFLAG(MAC, 4, OPS, "OPS");
- 	PFLAG(MAC, 4, AMDSU_IN_AMPDU, "AMSDU-IN-AMPDU");
- 
- 	PRINT("MULTI-TID-AGG-TX-QOS-%d", ((cap[5] << 1) | (cap[4] >> 7)) & 0x7);
- 
--	PFLAG(MAC, 5, SUBCHAN_SELECVITE_TRANSMISSION,
--	      "SUBCHAN-SELECVITE-TRANSMISSION");
-+	PFLAG(MAC, 5, SUBCHAN_SELECTIVE_TRANSMISSION,
-+	      "SUBCHAN-SELECTIVE-TRANSMISSION");
- 	PFLAG(MAC, 5, UL_2x996_TONE_RU, "UL-2x996-TONE-RU");
- 	PFLAG(MAC, 5, OM_CTRL_UL_MU_DATA_DIS_RX, "OM-CTRL-UL-MU-DATA-DIS-RX");
- 	PFLAG(MAC, 5, HE_DYNAMIC_SM_PS, "HE-DYNAMIC-SM-PS");
-@@ -832,8 +832,8 @@ static ssize_t sta_he_capa_read(struct f
- 
- 	PFLAG(PHY, 3, DCM_MAX_RX_NSS_1, "DCM-MAX-RX-NSS-1");
- 	PFLAG(PHY, 3, DCM_MAX_RX_NSS_2, "DCM-MAX-RX-NSS-2");
--	PFLAG(PHY, 3, RX_HE_MU_PPDU_FROM_NON_AP_STA,
--	      "RX-HE-MU-PPDU-FROM-NON-AP-STA");
-+	PFLAG(PHY, 3, RX_PARTIAL_BW_SU_IN_20MHZ_MU,
-+	      "RX-PARTIAL-BW-SU-IN-20MHZ-MU");
- 	PFLAG(PHY, 3, SU_BEAMFORMER, "SU-BEAMFORMER");
- 
- 	PFLAG(PHY, 4, SU_BEAMFORMEE, "SU-BEAMFORMEE");
-@@ -853,16 +853,17 @@ static ssize_t sta_he_capa_read(struct f
- 
- 	PFLAG(PHY, 6, CODEBOOK_SIZE_42_SU, "CODEBOOK-SIZE-42-SU");
- 	PFLAG(PHY, 6, CODEBOOK_SIZE_75_MU, "CODEBOOK-SIZE-75-MU");
--	PFLAG(PHY, 6, TRIG_SU_BEAMFORMER_FB, "TRIG-SU-BEAMFORMER-FB");
--	PFLAG(PHY, 6, TRIG_MU_BEAMFORMER_FB, "TRIG-MU-BEAMFORMER-FB");
-+	PFLAG(PHY, 6, TRIG_SU_BEAMFORMING_FB, "TRIG-SU-BEAMFORMING-FB");
-+	PFLAG(PHY, 6, TRIG_MU_BEAMFORMING_PARTIAL_BW_FB,
-+	      "MU-BEAMFORMING-PARTIAL-BW-FB");
- 	PFLAG(PHY, 6, TRIG_CQI_FB, "TRIG-CQI-FB");
- 	PFLAG(PHY, 6, PARTIAL_BW_EXT_RANGE, "PARTIAL-BW-EXT-RANGE");
- 	PFLAG(PHY, 6, PARTIAL_BANDWIDTH_DL_MUMIMO,
- 	      "PARTIAL-BANDWIDTH-DL-MUMIMO");
- 	PFLAG(PHY, 6, PPE_THRESHOLD_PRESENT, "PPE-THRESHOLD-PRESENT");
- 
--	PFLAG(PHY, 7, SRP_BASED_SR, "SRP-BASED-SR");
--	PFLAG(PHY, 7, POWER_BOOST_FACTOR_AR, "POWER-BOOST-FACTOR-AR");
-+	PFLAG(PHY, 7, PSR_BASED_SR, "PSR-BASED-SR");
-+	PFLAG(PHY, 7, POWER_BOOST_FACTOR_SUPP, "POWER-BOOST-FACTOR-SUPP");
- 	PFLAG(PHY, 7, HE_SU_MU_PPDU_4XLTF_AND_08_US_GI,
- 	      "HE-SU-MU-PPDU-4XLTF-AND-08-US-GI");
- 	PFLAG_RANGE(PHY, 7, MAX_NC, 0, 1, 1, "MAX-NC-%d");
---- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
-+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
-@@ -630,7 +630,7 @@ static struct ieee80211_sband_iftype_dat
- 				.phy_cap_info[6] =
- 					IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
- 				.phy_cap_info[7] =
--					IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_AR |
-+					IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
- 					IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI |
- 					IEEE80211_HE_PHY_CAP7_MAX_NC_1,
- 				.phy_cap_info[8] =
diff --git a/package/kernel/mac80211/patches/subsys/392-wireless-fix-spelling-of-A-MSDU-in-HE-capabilities.patch b/package/kernel/mac80211/patches/subsys/392-wireless-fix-spelling-of-A-MSDU-in-HE-capabilities.patch
deleted file mode 100644
index 334fda8ea9..0000000000
--- a/package/kernel/mac80211/patches/subsys/392-wireless-fix-spelling-of-A-MSDU-in-HE-capabilities.patch
+++ /dev/null
@@ -1,113 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Fri, 9 Apr 2021 12:40:24 +0300
-Subject: [PATCH] wireless: fix spelling of A-MSDU in HE capabilities
-
-In the HE capabilities, spell A-MSDU correctly, not "A-MDSU".
-
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Link: https://lore.kernel.org/r/iwlwifi.20210409123755.9e6ff1af1181.If6868bc6902ccd9a95c74c78f716c4b41473ef14@changeid
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
-+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
-@@ -597,7 +597,7 @@ static struct ieee80211_sband_iftype_dat
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
- 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
- 				.mac_cap_info[4] =
--					IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU |
-+					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU |
- 					IEEE80211_HE_MAC_CAP4_MULTI_TID_AGG_TX_QOS_B39,
- 				.mac_cap_info[5] =
- 					IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B40 |
-@@ -681,7 +681,7 @@ static struct ieee80211_sband_iftype_dat
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
- 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
- 				.mac_cap_info[4] =
--					IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
-+					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.mac_cap_info[5] =
- 					IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU,
- 				.phy_cap_info[0] =
---- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
-@@ -427,7 +427,7 @@ mt7915_init_he_caps(struct mt7915_phy *p
- 			IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
- 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_RESERVED;
- 		he_cap_elem->mac_cap_info[4] =
--			IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU;
-+			IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU;
- 
- 		if (band == NL80211_BAND_2GHZ)
- 			he_cap_elem->phy_cap_info[0] =
---- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
-@@ -1358,7 +1358,7 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *sk
- 	if (elem->mac_cap_info[3] & IEEE80211_HE_MAC_CAP3_OMI_CONTROL)
- 		cap |= STA_REC_HE_CAP_OM;
- 
--	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU)
-+	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU)
- 		cap |= STA_REC_HE_CAP_AMSDU_IN_AMPDU;
- 
- 	if (elem->mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
---- a/include/linux/ieee80211.h
-+++ b/include/linux/ieee80211.h
-@@ -2068,7 +2068,7 @@ int ieee80211_get_vht_max_nss(struct iee
- #define IEEE80211_HE_MAC_CAP4_PSR_RESP				0x08
- #define IEEE80211_HE_MAC_CAP4_NDP_FB_REP			0x10
- #define IEEE80211_HE_MAC_CAP4_OPS				0x20
--#define IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU			0x40
-+#define IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU			0x40
- /* Multi TID agg TX is split between byte #4 and #5
-  * The value is a combination of B39,B40,B41
-  */
---- a/net/mac80211/debugfs_sta.c
-+++ b/net/mac80211/debugfs_sta.c
-@@ -735,7 +735,7 @@ static ssize_t sta_he_capa_read(struct f
- 	PFLAG(MAC, 4, PSR_RESP, "PSR-RESP");
- 	PFLAG(MAC, 4, NDP_FB_REP, "NDP-FB-REP");
- 	PFLAG(MAC, 4, OPS, "OPS");
--	PFLAG(MAC, 4, AMDSU_IN_AMPDU, "AMSDU-IN-AMPDU");
-+	PFLAG(MAC, 4, AMSDU_IN_AMPDU, "AMSDU-IN-AMPDU");
- 
- 	PRINT("MULTI-TID-AGG-TX-QOS-%d", ((cap[5] << 1) | (cap[4] >> 7)) & 0x7);
- 
---- a/drivers/net/wireless/mac80211_hwsim.c
-+++ b/drivers/net/wireless/mac80211_hwsim.c
-@@ -2757,7 +2757,7 @@ static const struct ieee80211_sband_ifty
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
- 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
--				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
-+				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.phy_cap_info[1] =
- 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
- 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
-@@ -2801,7 +2801,7 @@ static const struct ieee80211_sband_ifty
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
- 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
--				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
-+				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.phy_cap_info[1] =
- 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
- 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
-@@ -2847,7 +2847,7 @@ static const struct ieee80211_sband_ifty
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
- 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
--				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
-+				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.phy_cap_info[0] =
- 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
- 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
-@@ -2895,7 +2895,7 @@ static const struct ieee80211_sband_ifty
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
- 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
--				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
-+				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.phy_cap_info[0] =
- 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
- 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
diff --git a/package/kernel/mac80211/patches/subsys/393-wireless-align-HE-capabilities-A-MPDU-Length-Exponen.patch b/package/kernel/mac80211/patches/subsys/393-wireless-align-HE-capabilities-A-MPDU-Length-Exponen.patch
deleted file mode 100644
index 3da3648e5d..0000000000
--- a/package/kernel/mac80211/patches/subsys/393-wireless-align-HE-capabilities-A-MPDU-Length-Exponen.patch
+++ /dev/null
@@ -1,148 +0,0 @@
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Fri, 9 Apr 2021 12:40:20 +0300
-Subject: [PATCH] wireless: align HE capabilities A-MPDU Length Exponent
- Extension
-
-The A-MPDU length exponent extension is defined differently in
-802.11ax D6.1, align with that.
-
-Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
-Link: https://lore.kernel.org/r/iwlwifi.20210409123755.c2a257d3e2df.I3455245d388c52c61dace7e7958dbed7e807cfb6@changeid
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -1295,9 +1295,8 @@ static void ath11k_peer_assoc_h_he(struc
- 	 * request, then use MAX_AMPDU_LEN_FACTOR as 16 to calculate max_ampdu
- 	 * length.
- 	 */
--	ampdu_factor = (he_cap->he_cap_elem.mac_cap_info[3] &
--			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK) >>
--			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_SHIFT;
-+	ampdu_factor = u8_get_bits(he_cap->he_cap_elem.mac_cap_info[3],
-+				   IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK);
- 
- 	if (ampdu_factor) {
- 		if (sta->vht_cap.vht_supported)
---- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
-+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
-@@ -595,7 +595,7 @@ static struct ieee80211_sband_iftype_dat
- 					IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP,
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
--					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
-+					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2,
- 				.mac_cap_info[4] =
- 					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU |
- 					IEEE80211_HE_MAC_CAP4_MULTI_TID_AGG_TX_QOS_B39,
-@@ -679,7 +679,7 @@ static struct ieee80211_sband_iftype_dat
- 					IEEE80211_HE_MAC_CAP2_BSR,
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
--					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
-+					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2,
- 				.mac_cap_info[4] =
- 					IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.mac_cap_info[5] =
---- a/drivers/net/wireless/mac80211_hwsim.c
-+++ b/drivers/net/wireless/mac80211_hwsim.c
-@@ -2756,7 +2756,7 @@ static const struct ieee80211_sband_ifty
- 					IEEE80211_HE_MAC_CAP2_ACK_EN,
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
--					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
-+					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
- 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.phy_cap_info[1] =
- 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
-@@ -2800,7 +2800,7 @@ static const struct ieee80211_sband_ifty
- 					IEEE80211_HE_MAC_CAP2_ACK_EN,
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
--					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
-+					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
- 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.phy_cap_info[1] =
- 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
-@@ -2846,7 +2846,7 @@ static const struct ieee80211_sband_ifty
- 					IEEE80211_HE_MAC_CAP2_ACK_EN,
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
--					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
-+					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
- 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.phy_cap_info[0] =
- 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
-@@ -2894,7 +2894,7 @@ static const struct ieee80211_sband_ifty
- 					IEEE80211_HE_MAC_CAP2_ACK_EN,
- 				.mac_cap_info[3] =
- 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
--					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
-+					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
- 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
- 				.phy_cap_info[0] =
- 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
---- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
-@@ -425,7 +425,7 @@ mt7915_init_he_caps(struct mt7915_phy *p
- 			IEEE80211_HE_MAC_CAP0_HTC_HE;
- 		he_cap_elem->mac_cap_info[3] =
- 			IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
--			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_RESERVED;
-+			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3;
- 		he_cap_elem->mac_cap_info[4] =
- 			IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU;
- 
---- a/include/linux/ieee80211.h
-+++ b/include/linux/ieee80211.h
-@@ -2051,17 +2051,15 @@ int ieee80211_get_vht_max_nss(struct iee
-  * A-MDPU Length Exponent field in the HT capabilities, VHT capabilities and the
-  * same field in the HE capabilities.
-  */
--#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_USE_VHT	0x00
--#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_1		0x08
--#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2		0x10
--#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_RESERVED	0x18
-+#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_0		0x00
-+#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_1		0x08
-+#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2		0x10
-+#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3		0x18
- #define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK		0x18
- #define IEEE80211_HE_MAC_CAP3_AMSDU_FRAG			0x20
- #define IEEE80211_HE_MAC_CAP3_FLEX_TWT_SCHED			0x40
- #define IEEE80211_HE_MAC_CAP3_RX_CTRL_FRAME_TO_MULTIBSS		0x80
- 
--#define IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_SHIFT		3
--
- #define IEEE80211_HE_MAC_CAP4_BSRP_BQRP_A_MPDU_AGG		0x01
- #define IEEE80211_HE_MAC_CAP4_QTP				0x02
- #define IEEE80211_HE_MAC_CAP4_BQR				0x04
---- a/net/mac80211/debugfs_sta.c
-+++ b/net/mac80211/debugfs_sta.c
-@@ -711,17 +711,17 @@ static ssize_t sta_he_capa_read(struct f
- 	PFLAG(MAC, 3, OFDMA_RA, "OFDMA-RA");
- 
- 	switch (cap[3] & IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK) {
--	case IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_USE_VHT:
--		PRINT("MAX-AMPDU-LEN-EXP-USE-VHT");
-+	case IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_0:
-+		PRINT("MAX-AMPDU-LEN-EXP-USE-EXT-0");
- 		break;
--	case IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_1:
--		PRINT("MAX-AMPDU-LEN-EXP-VHT-1");
-+	case IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_1:
-+		PRINT("MAX-AMPDU-LEN-EXP-VHT-EXT-1");
- 		break;
--	case IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2:
--		PRINT("MAX-AMPDU-LEN-EXP-VHT-2");
-+	case IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2:
-+		PRINT("MAX-AMPDU-LEN-EXP-VHT-EXT-2");
- 		break;
--	case IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_RESERVED:
--		PRINT("MAX-AMPDU-LEN-EXP-RESERVED");
-+	case IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3:
-+		PRINT("MAX-AMPDU-LEN-EXP-VHT-EXT-3");
- 		break;
- 	}
- 
diff --git a/package/kernel/mac80211/patches/subsys/394-mac80211-fix-rate-control-for-retransmitted-frames.patch b/package/kernel/mac80211/patches/subsys/394-mac80211-fix-rate-control-for-retransmitted-frames.patch
deleted file mode 100644
index cd91a925f3..0000000000
--- a/package/kernel/mac80211/patches/subsys/394-mac80211-fix-rate-control-for-retransmitted-frames.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Mon, 22 Nov 2021 21:39:38 +0100
-Subject: [PATCH] mac80211: fix rate control for retransmitted frames
-
-Since retransmission clears info->control, rate control needs to be called
-again, otherwise the driver might crash due to invalid rates.
-
-Cc: stable@vger.kernel.org # 5.14+
-Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
-Reported-by: Robert W <rwbugreport@lost-in-the-void.net>
-Fixes: 03c3911d2d67 ("mac80211: call ieee80211_tx_h_rate_ctrl() when dequeue")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1835,15 +1835,15 @@ static int invoke_tx_handlers_late(struc
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
- 	ieee80211_tx_result res = TX_CONTINUE;
- 
-+	if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
-+		CALL_TXH(ieee80211_tx_h_rate_ctrl);
-+
- 	if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) {
- 		__skb_queue_tail(&tx->skbs, tx->skb);
- 		tx->skb = NULL;
- 		goto txh_done;
- 	}
- 
--	if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
--		CALL_TXH(ieee80211_tx_h_rate_ctrl);
--
- 	CALL_TXH(ieee80211_tx_h_michael_mic_add);
- 	CALL_TXH(ieee80211_tx_h_sequence);
- 	CALL_TXH(ieee80211_tx_h_fragment);
diff --git a/package/kernel/mac80211/patches/subsys/400-allow-ibss-mixed.patch b/package/kernel/mac80211/patches/subsys/400-allow-ibss-mixed.patch
index 974595e11a..f2ed528d23 100644
--- a/package/kernel/mac80211/patches/subsys/400-allow-ibss-mixed.patch
+++ b/package/kernel/mac80211/patches/subsys/400-allow-ibss-mixed.patch
@@ -5,7 +5,7 @@ and we should ignore this.
 
 --- a/net/wireless/core.c
 +++ b/net/wireless/core.c
-@@ -615,21 +615,6 @@ static int wiphy_verify_combinations(str
+@@ -625,21 +625,6 @@ static int wiphy_verify_combinations(str
  				    c->limits[j].max > 1))
  				return -EINVAL;
  
diff --git a/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch
index 6f13f64208..50c24a7746 100644
--- a/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch
+++ b/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch
@@ -1,24 +1,24 @@
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -3814,6 +3814,7 @@ struct mgmt_frame_regs {
+@@ -3869,6 +3869,7 @@ struct mgmt_frame_regs {
   *	(as advertised by the nl80211 feature flag.)
   * @get_tx_power: store the current TX power into the dbm variable;
   *	return 0 if successful
 + * @set_antenna_gain: set antenna gain to reduce maximum tx power if necessary
   *
-  * @set_wds_peer: set the WDS peer for a WDS interface
-  *
-@@ -4138,6 +4139,7 @@ struct cfg80211_ops {
+  * @rfkill_poll: polls the hw rfkill line, use cfg80211 reporting
+  *	functions to adjust rfkill hw state
+@@ -4202,6 +4203,7 @@ struct cfg80211_ops {
  				enum nl80211_tx_power_setting type, int mbm);
  	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
  				int *dbm);
 +	int	(*set_antenna_gain)(struct wiphy *wiphy, int dbi);
  
- 	int	(*set_wds_peer)(struct wiphy *wiphy, struct net_device *dev,
- 				const u8 *addr);
+ 	void	(*rfkill_poll)(struct wiphy *wiphy);
+ 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1561,6 +1561,7 @@ enum ieee80211_smps_mode {
+@@ -1566,6 +1566,7 @@ enum ieee80211_smps_mode {
   *
   * @power_level: requested transmit power (in dBm), backward compatibility
   *	value only that is set to the minimum of all interfaces
@@ -26,7 +26,7 @@
   *
   * @chandef: the channel definition to tune to
   * @radar_enabled: whether radar detection is enabled
-@@ -1581,6 +1582,7 @@ enum ieee80211_smps_mode {
+@@ -1586,6 +1587,7 @@ enum ieee80211_smps_mode {
  struct ieee80211_conf {
  	u32 flags;
  	int power_level, dynamic_ps_timeout;
@@ -36,9 +36,9 @@
  	u8 ps_dtim_period;
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -2593,6 +2593,9 @@ enum nl80211_commands {
-  * @NL80211_ATTR_COLOR_CHANGE_ELEMS: Nested set of attributes containing the IE
-  *	information for the time while performing a color switch.
+@@ -2615,6 +2615,9 @@ enum nl80211_commands {
+  *	switching on a different channel during CAC detection on the selected
+  *	radar channel.
   *
 + * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
 + *	transmit power to stay within regulatory limits. u32, dBi.
@@ -46,9 +46,9 @@
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
   * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3096,6 +3099,8 @@ enum nl80211_attrs {
- 	NL80211_ATTR_COLOR_CHANGE_COLOR,
- 	NL80211_ATTR_COLOR_CHANGE_ELEMS,
+@@ -3123,6 +3126,8 @@ enum nl80211_attrs {
+ 
+ 	NL80211_ATTR_RADAR_BACKGROUND,
  
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
 +
@@ -57,7 +57,7 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2769,6 +2769,19 @@ static int ieee80211_get_tx_power(struct
+@@ -2812,6 +2812,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -74,20 +74,20 @@
 +	return 0;
 +}
 +
- static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
- 				  const u8 *addr)
+ static void ieee80211_rfkill_poll(struct wiphy *wiphy)
  {
-@@ -4413,6 +4426,7 @@ const struct cfg80211_ops mac80211_confi
+ 	struct ieee80211_local *local = wiphy_priv(wiphy);
+@@ -4516,6 +4529,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
 +	.set_antenna_gain = ieee80211_set_antenna_gain,
- 	.set_wds_peer = ieee80211_set_wds_peer,
  	.rfkill_poll = ieee80211_rfkill_poll,
  	CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
+ 	CFG80211_TESTMODE_DUMP(ieee80211_testmode_dump)
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1435,6 +1435,7 @@ struct ieee80211_local {
+@@ -1448,6 +1448,7 @@ struct ieee80211_local {
  	int dynamic_ps_forced_timeout;
  
  	int user_power_level; /* in dBm, for all interfaces */
@@ -119,7 +119,7 @@
  	if (local->hw.conf.power_level != power) {
  		changed |= IEEE80211_CONF_CHANGE_POWER;
  		local->hw.conf.power_level = power;
-@@ -665,6 +671,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -679,6 +685,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  					 IEEE80211_RADIOTAP_MCS_HAVE_BW;
  	local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
  					 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
@@ -129,32 +129,34 @@
  	local->hw.max_mtu = IEEE80211_MAX_DATA_LEN;
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -757,6 +757,7 @@ static const struct nla_policy nl80211_p
- 	[NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
- 	[NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
- 	[NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
+@@ -802,6 +802,7 @@ static const struct nla_policy nl80211_p
+ 			NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
+ 	[NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
+ 	[NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
 +	[NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
  };
  
  /* policy for the key attributes */
-@@ -3322,6 +3323,20 @@ static int nl80211_set_wiphy(struct sk_b
+@@ -3391,6 +3392,22 @@ static int nl80211_set_wiphy(struct sk_b
  		if (result)
- 			return result;
+ 			goto out;
  	}
 +
 +	if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_GAIN]) {
 +		int idx, dbi = 0;
 +
-+		if (!rdev->ops->set_antenna_gain)
-+			return -EOPNOTSUPP;
++		if (!rdev->ops->set_antenna_gain) {
++			result = -EOPNOTSUPP;
++			goto out;
++		}
 +
 +		idx = NL80211_ATTR_WIPHY_ANTENNA_GAIN;
 +		dbi = nla_get_u32(info->attrs[idx]);
 +
 +		result = rdev->ops->set_antenna_gain(&rdev->wiphy, dbi);
 +		if (result)
-+			return result;
++			goto out;
 +	}
  
- 	if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
- 	    info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
+ 	if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
+ 		struct wireless_dev *txp_wdev = wdev;
diff --git a/package/kernel/mac80211/patches/subsys/783-sync-nl80211.patch b/package/kernel/mac80211/patches/subsys/783-sync-nl80211.patch
new file mode 100644
index 0000000000..dc2b05b1a3
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/783-sync-nl80211.patch
@@ -0,0 +1,22 @@
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -6027,6 +6027,11 @@ enum nl80211_feature_flags {
+  * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
+  *	detection and change announcemnts.
+  *
++ * @NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD: Driver running in AP mode supports
++ *	FILS encryption and decryption for (Re)Association Request and Response
++ *	frames. Userspace has to share FILS AAD details to the driver by using
++ *	@NL80211_CMD_SET_FILS_AAD.
++ *
+  * @NL80211_EXT_FEATURE_RADAR_BACKGROUND: Device supports background radar/CAC
+  *	detection.
+  *
+@@ -6095,6 +6100,7 @@ enum nl80211_ext_feature_index {
+ 	NL80211_EXT_FEATURE_SECURE_RTT,
+ 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
+ 	NL80211_EXT_FEATURE_BSS_COLOR,
++	NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD,
+ 	NL80211_EXT_FEATURE_RADAR_BACKGROUND,
+ 
+ 	/* add new features before the definition below */
diff --git a/package/kernel/mac80211/realtek.mk b/package/kernel/mac80211/realtek.mk
index 75cb94d7b6..44c6c25b08 100644
--- a/package/kernel/mac80211/realtek.mk
+++ b/package/kernel/mac80211/realtek.mk
@@ -27,6 +27,8 @@ config-y += STAGING
 
 config-$(call config_package,rtw88) += RTW88 RTW88_CORE RTW88_PCI
 config-y += RTW88_8822BE RTW88_8822CE RTW88_8723DE
+config-$(CONFIG_PACKAGE_RTW88_DEBUG) += RTW88_DEBUG
+config-$(CONFIG_PACKAGE_RTW88_DEBUGFS) += RTW88_DEBUGFS
 
 define KernelPackage/rtl818x/Default
   $(call KernelPackage/mac80211/Default)
@@ -175,6 +177,22 @@ define KernelPackage/rtl8xxxu/description
   Please report your results!
 endef
 
+define KernelPackage/rtw88/config
+	config PACKAGE_RTW88_DEBUG
+		bool "Realtek wireless debugging (rtw88)"
+		depends on PACKAGE_kmod-rtw88
+		help
+		  Enable debugging output for rtw88 devices
+
+	config PACKAGE_RTW88_DEBUGFS
+		bool "Enable rtw88 debugfS support"
+		select KERNEL_DEBUG_FS
+		depends on PACKAGE_kmod-rtw88
+		help
+		  Select this to see extensive information about
+		  the internal state of rtw88 in debugfs.
+endef
+
 define KernelPackage/rtw88
   $(call KernelPackage/mac80211/Default)
   TITLE:=Realtek RTL8822BE/RTL8822CE/RTL8723DE
diff --git a/package/kernel/mt76/Makefile b/package/kernel/mt76/Makefile
index 8210478c37..a18cca73a9 100644
--- a/package/kernel/mt76/Makefile
+++ b/package/kernel/mt76/Makefile
@@ -8,9 +8,9 @@ PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/openwrt/mt76
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2021-12-03
-PKG_SOURCE_VERSION:=678071ef70297b7264661c356ddb3c8cf7f3c87b
-PKG_MIRROR_HASH:=b1f8613f7c65ca6a893f83ed9efc3f7ce72b9b4904fd11b89264f57f4f2a3b5e
+PKG_SOURCE_DATE:=2022-09-06
+PKG_SOURCE_VERSION:=d70546462b7b51ebc2bcdd5c534fdf3465be62a4
+PKG_MIRROR_HASH:=3d6b68d70a78c0072ed10ab2548344b6b3a70ad99e4edc258fafa16886f4abf9
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_USE_NINJA:=0
@@ -221,22 +221,31 @@ endef
 define KernelPackage/mt7915e
   $(KernelPackage/mt76-default)
   TITLE:=MediaTek MT7915e wireless driver
-  DEPENDS+=@PCI_SUPPORT +kmod-mt7615-common +kmod-hwmon-core +kmod-thermal +@DRIVER_11AX_SUPPORT
+  DEPENDS+=@PCI_SUPPORT +kmod-mt7615-common +kmod-hwmon-core +kmod-thermal +@DRIVER_11AX_SUPPORT +@KERNEL_RELAY
   FILES:= $(PKG_BUILD_DIR)/mt7915/mt7915e.ko
   AUTOLOAD:=$(call AutoProbe,mt7915e)
 endef
 
 define KernelPackage/mt7921-common
+  $(KernelPackage/mt76-default)
   TITLE:=MediaTek MT7615 wireless driver common code
   HIDDEN:=1
-  DEPENDS+=@PCI_SUPPORT +kmod-mt76-core +kmod-mt76-connac
+  DEPENDS+=+kmod-mt76-connac +@DRIVER_11AX_SUPPORT
   FILES:= $(PKG_BUILD_DIR)/mt7921/mt7921-common.ko
 endef
 
+define KernelPackage/mt7921u
+  $(KernelPackage/mt76-default)
+  TITLE:=MediaTek MT7921U wireless driver
+  DEPENDS+=+kmod-mt76-usb +kmod-mt7921-common
+  FILES:= $(PKG_BUILD_DIR)/mt7921/mt7921u.ko
+  AUTOLOAD:=$(call AutoProbe,mt7921u)
+endef
+
 define KernelPackage/mt7921s
   $(KernelPackage/mt76-default)
-  TITLE:=MediaTek MT7921s wireless driver
-  DEPENDS+=@PCI_SUPPORT +kmod-mt76-connac +kmod-mt76-sdio +kmod-mt7921-common
+  TITLE:=MediaTek MT7921S wireless driver
+  DEPENDS+=+kmod-mt76-sdio +kmod-mt7921-common
   FILES:= $(PKG_BUILD_DIR)/mt7921/mt7921s.ko
   AUTOLOAD:=$(call AutoProbe,mt7921s)
 endef
@@ -244,7 +253,7 @@ endef
 define KernelPackage/mt7921e
   $(KernelPackage/mt76-default)
   TITLE:=MediaTek MT7921e wireless driver
-  DEPENDS+=@PCI_SUPPORT +kmod-mt76-connac +kmod-mt7921-common
+  DEPENDS+=@PCI_SUPPORT +kmod-mt7921-common
   FILES:= $(PKG_BUILD_DIR)/mt7921/mt7921e.ko
   AUTOLOAD:=$(call AutoProbe,mt7921e)
 endef
@@ -338,6 +347,9 @@ endif
 ifdef CONFIG_PACKAGE_kmod-mt7921-common
   PKG_MAKE_FLAGS += CONFIG_MT7921_COMMON=m
 endif
+ifdef CONFIG_PACKAGE_kmod-mt7921u
+  PKG_MAKE_FLAGS += CONFIG_MT7921U=m
+endif
 ifdef CONFIG_PACKAGE_kmod-mt7921s
   PKG_MAKE_FLAGS += CONFIG_MT7921S=m
 endif
@@ -474,6 +486,7 @@ $(eval $(call KernelPackage,mt7663u))
 $(eval $(call KernelPackage,mt7663s))
 $(eval $(call KernelPackage,mt7915e))
 $(eval $(call KernelPackage,mt7921-common))
+$(eval $(call KernelPackage,mt7921u))
 $(eval $(call KernelPackage,mt7921s))
 $(eval $(call KernelPackage,mt7921e))
 $(eval $(call KernelPackage,mt76))
diff --git a/package/kernel/mt76/patches/100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch b/package/kernel/mt76/patches/100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch
deleted file mode 100644
index 24b1240548..0000000000
--- a/package/kernel/mt76/patches/100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 23 Nov 2021 17:01:45 +0100
-Subject: [PATCH] Revert "of: net: pass the dst buffer to of_get_mac_address()"
-
-This reverts commit 4932c5d80153c336c77dbe8d7af9f8fdd879d01f.
----
-
---- a/eeprom.c
-+++ b/eeprom.c
-@@ -105,9 +105,15 @@ mt76_eeprom_override(struct mt76_phy *ph
- {
- 	struct mt76_dev *dev = phy->dev;
- 
-+#ifdef CONFIG_OF
- 	struct device_node *np = dev->dev->of_node;
-+	const u8 *mac = NULL;
- 
--	of_get_mac_address(np, phy->macaddr);
-+	if (np)
-+		mac = of_get_mac_address(np);
-+	if (!IS_ERR_OR_NULL(mac))
-+		ether_addr_copy(phy->macaddr, mac);
-+#endif
- 
- 	if (!is_valid_ether_addr(phy->macaddr)) {
- 		eth_random_addr(phy->macaddr);
diff --git a/package/kernel/mt76/patches/101-fix-encap-offload-ethernet-type-check.patch b/package/kernel/mt76/patches/101-fix-encap-offload-ethernet-type-check.patch
deleted file mode 100644
index d81aa4dfa3..0000000000
--- a/package/kernel/mt76/patches/101-fix-encap-offload-ethernet-type-check.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-To: linux-wireless@vger.kernel.org
-Cc: =?utf-8?q?Thibaut_VAR=C3=88NE?= <hacks+kernel@slashdirt.org>
-Subject: [PATCH] mt76: fix encap offload ethernet type check
-Date: Wed, 20 Apr 2022 14:33:08 +0200
-Message-Id: <20220420123308.70104-1-nbd@nbd.name>
-
-The driver needs to check if the format is 802.2 vs 802.3 in order to set
-a tx descriptor flag. skb->protocol can't be used, since it may not be properly
-initialized for packets coming in from a packet socket.
-Fix misdetection by checking the ethertype from the skb data instead
-
-Reported-by: Thibaut VARÈNE <hacks+kernel@slashdirt.org>
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 4 +++-
- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 4 +++-
- 2 files changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
-index 5f4a0e811137..e353e8c44d6c 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -1016,6 +1016,7 @@ mt7915_mac_write_txwi_8023(struct mt7915_dev *dev, __le32 *txwi,
- 
- 	u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
- 	u8 fc_type, fc_stype;
-+	u16 ethertype;
- 	bool wmm = false;
- 	u32 val;
- 
-@@ -1029,7 +1030,8 @@ mt7915_mac_write_txwi_8023(struct mt7915_dev *dev, __le32 *txwi,
- 	val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_802_3) |
- 	      FIELD_PREP(MT_TXD1_TID, tid);
- 
--	if (be16_to_cpu(skb->protocol) >= ETH_P_802_3_MIN)
-+	ethertype = get_unaligned_be16(&skb->data[12]);
-+	if (ethertype >= ETH_P_802_3_MIN)
- 		val |= MT_TXD1_ETH_802_3;
- 
- 	txwi[1] |= cpu_to_le32(val);
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
-index 368e54c53ddd..ac11e8b28f13 100644
---- a/mt7921/mac.c
-+++ b/mt7921/mac.c
-@@ -814,6 +814,7 @@ mt7921_mac_write_txwi_8023(struct mt7921_dev *dev, __le32 *txwi,
- {
- 	u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
- 	u8 fc_type, fc_stype;
-+	u16 ethertype;
- 	bool wmm = false;
- 	u32 val;
- 
-@@ -827,7 +828,8 @@ mt7921_mac_write_txwi_8023(struct mt7921_dev *dev, __le32 *txwi,
- 	val = FIELD_PREP(MT_TXD1_HDR_FORMAT, MT_HDR_FORMAT_802_3) |
- 	      FIELD_PREP(MT_TXD1_TID, tid);
- 
--	if (be16_to_cpu(skb->protocol) >= ETH_P_802_3_MIN)
-+	ethertype = get_unaligned_be16(&skb->data[12]);
-+	if (ethertype >= ETH_P_802_3_MIN)
- 		val |= MT_TXD1_ETH_802_3;
- 
- 	txwi[1] |= cpu_to_le32(val);
diff --git a/package/kernel/rtl8188eu/Makefile b/package/kernel/rtl8188eu/Makefile
index 9ae74a2121..740ed89763 100644
--- a/package/kernel/rtl8188eu/Makefile
+++ b/package/kernel/rtl8188eu/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=rtl8188eu
-PKG_RELEASE:=1
+PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE_URL:=https://github.com/aircrack-ng/rtl8188eus.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2021-02-06
-PKG_SOURCE_VERSION:=1e7145f3237b3eeb3baf775f4a883e6d79c1cfe6
-PKG_MIRROR_HASH:=3f68779aed2b9fabca042ea4effbdf35e25e632a00febe6c3f09646a8c75ee5d
+PKG_SOURCE_DATE:=2022-03-20
+PKG_SOURCE_VERSION:=0958f294f90b49d6bad4972b14f90676e5d858d3
+PKG_MIRROR_HASH:=dead457e82a8b19a7fa66d7981c5f675e0d8d2d9d297aba5443c793822c22a8f
 
 PKG_BUILD_PARALLEL:=1
 
diff --git a/package/kernel/rtl8188eu/patches/010-disable-default-build-x86.patch b/package/kernel/rtl8188eu/patches/010-disable-default-build-x86.patch
index fc8b53f3c2..e96e92e567 100644
--- a/package/kernel/rtl8188eu/patches/010-disable-default-build-x86.patch
+++ b/package/kernel/rtl8188eu/patches/010-disable-default-build-x86.patch
@@ -1,6 +1,6 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -91,7 +91,7 @@ CONFIG_RTW_SDIO_PM_KEEP_POWER = y
+@@ -92,7 +92,7 @@ CONFIG_RTW_SDIO_PM_KEEP_POWER = y
  ###################### MP HW TX MODE FOR VHT #######################
  CONFIG_MP_VHT_HW_TX_MODE = n
  ###################### Platform Related #######################
diff --git a/package/kernel/rtl8188eu/patches/030-wireless-5.8.patch b/package/kernel/rtl8188eu/patches/030-wireless-5.8.patch
index 25bc7d0800..432b62cf09 100644
--- a/package/kernel/rtl8188eu/patches/030-wireless-5.8.patch
+++ b/package/kernel/rtl8188eu/patches/030-wireless-5.8.patch
@@ -1,46 +1,20 @@
 --- a/os_dep/linux/ioctl_cfg80211.c
 +++ b/os_dep/linux/ioctl_cfg80211.c
-@@ -7094,14 +7094,14 @@ static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy,
- #else
- 	struct net_device *ndev,
- #endif
--#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0))
-+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) || defined(BUILD_OPENWRT)
- 	struct mgmt_frame_regs *upd)
- #else
- 	u16 frame_type, bool reg)
- #endif
- 
- {
--#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0))
-+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) || defined(BUILD_OPENWRT)
- 	u32 rtw_mask = BIT(IEEE80211_STYPE_PROBE_REQ >> 4);
- #endif
-     
-@@ -7110,7 +7110,7 @@ static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy,
- #endif
- 
- /* hardcoded always true, to make it pass compilation */
--#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0))
-+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) || defined(BUILD_OPENWRT)
- 	bool reg = true;
- #endif
- 
-@@ -7137,7 +7137,7 @@ static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy,
- 	/* Wait QC Verify */
- 	return;
+@@ -7094,7 +7094,7 @@ exit:
+ 	return ret;
+ }
  
 -#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0))
 +#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) || defined(BUILD_OPENWRT)
- 	switch (upd->interface_stypes) {
- #else
- 	switch (frame_type) {
-@@ -9463,7 +9463,7 @@ static struct cfg80211_ops rtw_cfg80211_ops = {
+ static void cfg80211_rtw_update_mgmt_frame_register(struct wiphy *wiphy,
+                                              struct wireless_dev *wdev,
+                                              struct mgmt_frame_regs *upd)
+@@ -9430,7 +9430,7 @@ static struct cfg80211_ops rtw_cfg80211_
  
  #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)) || defined(COMPAT_KERNEL_RELEASE)
  	.mgmt_tx = cfg80211_rtw_mgmt_tx,
 -#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0))
 +#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)) || defined(BUILD_OPENWRT)
- 	.update_mgmt_frame_registrations = cfg80211_rtw_mgmt_frame_register,
+ 	.update_mgmt_frame_registrations = cfg80211_rtw_update_mgmt_frame_register,
  #else
  	.mgmt_frame_register = cfg80211_rtw_mgmt_frame_register,
diff --git a/package/kernel/rtl8189es/Makefile b/package/kernel/rtl8189es/Makefile
index 88bc389d0f..1421dca9d9 100644
--- a/package/kernel/rtl8189es/Makefile
+++ b/package/kernel/rtl8189es/Makefile
@@ -5,13 +5,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=rtl8189es
-PKG_RELEASE:=1
+PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE_URL:=https://github.com/jwrdegoede/rtl8189ES_linux.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2021-03-03
-PKG_SOURCE_VERSION:=03ac413135a355b55b693154c44b70f86a39732e
-PKG_MIRROR_HASH:=5cdd69a0c2383e66ae27b0518b4d6a3e845928767d644e1e2b12095b98ed8fbe
+PKG_SOURCE_DATE:=2022-03-28
+PKG_SOURCE_VERSION:=39c17661136da48f8e9c644194dce6a7f5076896
+PKG_MIRROR_HASH:=9f4f5aeb0bcfc13ef8376a6c2037f325d6e5434dd57c9d00859afd9e70d1fff1
 
 PKG_MAINTAINER:=Hauke Mehrtens <hauke@hauke-m.de>
 PKG_BUILD_PARALLEL:=1
diff --git a/package/kernel/rtl8189es/patches/020-wireless-5.8.patch b/package/kernel/rtl8189es/patches/020-wireless-5.8.patch
index ee34307e44..1cebf1ac91 100644
--- a/package/kernel/rtl8189es/patches/020-wireless-5.8.patch
+++ b/package/kernel/rtl8189es/patches/020-wireless-5.8.patch
@@ -1,8 +1,6 @@
-diff --git a/os_dep/linux/ioctl_cfg80211.c b/os_dep/linux/ioctl_cfg80211.c
-index b5eb513..901501a 100644
 --- a/os_dep/linux/ioctl_cfg80211.c
 +++ b/os_dep/linux/ioctl_cfg80211.c
-@@ -5573,7 +5573,7 @@ static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy,
+@@ -5569,7 +5569,7 @@ static void cfg80211_rtw_mgmt_frame_regi
  #else
  	struct net_device *ndev,
  #endif
@@ -11,7 +9,7 @@ index b5eb513..901501a 100644
  	struct mgmt_frame_regs *upd)
  #else
  	u16 frame_type, bool reg)
-@@ -5583,7 +5583,7 @@ static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy,
+@@ -5579,7 +5579,7 @@ static void cfg80211_rtw_mgmt_frame_regi
  	struct net_device *ndev = wdev_to_ndev(wdev);
  #endif
  	_adapter *adapter;
@@ -20,7 +18,7 @@ index b5eb513..901501a 100644
  	u16 frame_type = BIT(upd->global_stypes << 4);
  	bool reg = false;
  #endif
-@@ -6516,7 +6516,7 @@ static struct cfg80211_ops rtw_cfg80211_ops = {
+@@ -6510,7 +6510,7 @@ static struct cfg80211_ops rtw_cfg80211_
  	.action = cfg80211_rtw_mgmt_tx,
  #endif
  
diff --git a/package/kernel/rtl8192eu/Makefile b/package/kernel/rtl8192eu/Makefile
index 55f38bdbfc..4b70495743 100644
--- a/package/kernel/rtl8192eu/Makefile
+++ b/package/kernel/rtl8192eu/Makefile
@@ -1,20 +1,17 @@
+# SPDX-License-Identifier: GPL-3.0-only
 #
-# Copyright (C) 2021 ImmortalWrt
-#
-# This is free software, licensed under the GNU General Public License v3.
-# See /LICENSE for more information.
-#
+# Copyright (C) 2021 ImmortalWrt.org
 
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=rtl8192eu
-PKG_RELEASE:=1
+PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE_URL:=https://github.com/Mange/rtl8192eu-linux-driver.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2021-05-12
-PKG_SOURCE_VERSION:=546419675335bb80d4548e22ccef915573a5a1e2
-PKG_MIRROR_HASH:=a425a934d973aad20bc51ab2d1131bb81d2c6ebab687a029310e78cf9c81c4f3
+PKG_SOURCE_DATE:=2021-10-23
+PKG_SOURCE_VERSION:=744bbe52976e51895fce2c1d4075f97a98dca2b2
+PKG_MIRROR_HASH:=8624216a6dabfdfcde122b5f05da5cafae621a165c7b88c6f9cc6e451c000f58
 
 PKG_BUILD_PARALLEL:=1
 
diff --git a/package/kernel/rtl8192eu/patches/010-disable-default-build-x86.patch b/package/kernel/rtl8192eu/patches/010-disable-default-build-x86.patch
index 861f241000..06c58f46ab 100644
--- a/package/kernel/rtl8192eu/patches/010-disable-default-build-x86.patch
+++ b/package/kernel/rtl8192eu/patches/010-disable-default-build-x86.patch
@@ -1,6 +1,6 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -124,7 +124,7 @@ CONFIG_MP_VHT_HW_TX_MODE = n
+@@ -119,7 +119,7 @@ CONFIG_MP_VHT_HW_TX_MODE = n
  ###################### Platform Related #######################
  CONFIG_PLATFORM_ARM_RPI = n
  CONFIG_PLATFORM_ARM_AARCH64 = n
diff --git a/package/kernel/rtl8192eu/patches/030-wireless-5.8.patch b/package/kernel/rtl8192eu/patches/030-wireless-5.8.patch
index ea5260c65a..4f486fdd78 100644
--- a/package/kernel/rtl8192eu/patches/030-wireless-5.8.patch
+++ b/package/kernel/rtl8192eu/patches/030-wireless-5.8.patch
@@ -1,6 +1,15 @@
 --- a/os_dep/linux/ioctl_cfg80211.c
 +++ b/os_dep/linux/ioctl_cfg80211.c
-@@ -7484,7 +7484,7 @@ exit:
+@@ -439,7 +439,7 @@ u8 rtw_cfg80211_ch_switch_notify(_adapte
+ 
+ #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0))
+ 	if (started) {
+-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0) || defined(BUILD_OPENWRT))
+ 		cfg80211_ch_switch_started_notify(adapter->pnetdev, &chdef, 0, false);
+ #else
+ 		cfg80211_ch_switch_started_notify(adapter->pnetdev, &chdef, 0);
+@@ -7456,7 +7456,7 @@ exit:
  	return ret;
  }
  
@@ -9,7 +18,7 @@
  static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy,
  #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
  	struct wireless_dev *wdev,
-@@ -9948,7 +9948,7 @@ static struct cfg80211_ops rtw_cfg80211_ops = {
+@@ -9920,7 +9920,7 @@ static struct cfg80211_ops rtw_cfg80211_
  
  #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)) || defined(COMPAT_KERNEL_RELEASE)
  	.mgmt_tx = cfg80211_rtw_mgmt_tx,
diff --git a/package/kernel/rtl8812au-ac/Makefile b/package/kernel/rtl8812au-ac/Makefile
index 3e7ac14f7c..0d85a80c2f 100644
--- a/package/kernel/rtl8812au-ac/Makefile
+++ b/package/kernel/rtl8812au-ac/Makefile
@@ -1,24 +1,20 @@
+# SPDX-License-Identifier: GPL-3.0-only
 #
 # Copyright (C) 2020 stepheny
 # <https://github.com/aircrack-ng/rtl8812au/pull/619>
 #
-# Copyright (C) 2021 ImmortalWrt
-# <https://immortalwrt.org>
-#
-# This is free software, licensed under the GNU General Public License v3.
-# See /LICENSE for more information.
-#
+# Copyright (C) 2021 ImmortalWrt.org
 
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=rtl8812au-ac
-PKG_RELEASE:=1
+PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE_URL:=https://github.com/aircrack-ng/rtl8812au.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2021-05-22
-PKG_SOURCE_VERSION:=0b87ed921a8682856aed5a3e68344b0087f3c93c
-PKG_MIRROR_HASH:=f351622acacda52580d5983f5fa6130f625c80f9ee7500543ff8333d57ec3b74
+PKG_SOURCE_DATE:=2021-06-27
+PKG_SOURCE_VERSION:=b8167e66b4ac046b3b76c2c40008d84528e91594
+PKG_MIRROR_HASH:=f3608afb663ccfc796e776bd26b99d9f9cb8dd053bd302eab5c077e498010ce9
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=LICENSE
diff --git a/package/kernel/rtl8812au-ac/patches/020-change-value-of-vht-enable-and-usb-mode.patch b/package/kernel/rtl8812au-ac/patches/020-change-value-of-vht-enable-and-usb-mode.patch
index 8a57356c18..3c7bfdf13e 100644
--- a/package/kernel/rtl8812au-ac/patches/020-change-value-of-vht-enable-and-usb-mode.patch
+++ b/package/kernel/rtl8812au-ac/patches/020-change-value-of-vht-enable-and-usb-mode.patch
@@ -1,6 +1,6 @@
 --- a/os_dep/linux/os_intfs.c
 +++ b/os_dep/linux/os_intfs.c
-@@ -254,7 +254,7 @@ int rtw_bfee_rf_number = 0; /*BeamformeeCapRfNum  Rf path number, 0 for auto, ot
+@@ -254,7 +254,7 @@ int rtw_bfee_rf_number = 0; /*Beamformee
  #endif /* CONFIG_80211N_HT */
  
  #ifdef CONFIG_80211AC_VHT
@@ -9,7 +9,7 @@
  module_param(rtw_vht_enable, int, 0644);
  
  int rtw_ampdu_factor = 7;
-@@ -324,7 +324,7 @@ int rtw_drv_ant_band_switch = 1; /* 0:OFF , 1:ON, Driver control antenna band sw
+@@ -324,7 +324,7 @@ int rtw_drv_ant_band_switch = 1; /* 0:OF
  int rtw_single_ant_path; /*0:main ant , 1:aux ant , Fixed single antenna path, default main ant*/
  
  /* 0: doesn't switch, 1: switch from usb2.0 to usb 3.0 2: switch from usb3.0 to usb 2.0 */
diff --git a/package/kernel/rtl8812au-ac/patches/030-add-missing-code-for-concurrent-mode.patch b/package/kernel/rtl8812au-ac/patches/030-add-missing-code-for-concurrent-mode.patch
index f6af34d3e3..5e3abce660 100644
--- a/package/kernel/rtl8812au-ac/patches/030-add-missing-code-for-concurrent-mode.patch
+++ b/package/kernel/rtl8812au-ac/patches/030-add-missing-code-for-concurrent-mode.patch
@@ -1,6 +1,6 @@
 --- a/os_dep/linux/os_intfs.c
 +++ b/os_dep/linux/os_intfs.c
-@@ -2803,6 +2803,7 @@ static int netdev_vir_if_close(struct net_device *pnetdev)
+@@ -2803,6 +2803,7 @@ static int netdev_vir_if_close(struct ne
  {
  	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
  	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
diff --git a/package/kernel/rtl8812au-ac/patches/040-wireless-5.8.patch b/package/kernel/rtl8812au-ac/patches/040-wireless-5.8.patch
index 6fb74745d0..acb0b73918 100644
--- a/package/kernel/rtl8812au-ac/patches/040-wireless-5.8.patch
+++ b/package/kernel/rtl8812au-ac/patches/040-wireless-5.8.patch
@@ -1,5 +1,14 @@
 --- a/os_dep/linux/ioctl_cfg80211.c
 +++ b/os_dep/linux/ioctl_cfg80211.c
+@@ -460,7 +460,7 @@ u8 rtw_cfg80211_ch_switch_notify(_adapte
+ 
+ #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0))
+ 	if (started) {
+-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0) || defined(BUILD_OPENWRT))
+ 		cfg80211_ch_switch_started_notify(adapter->pnetdev, &chdef, 0, false);
+ #else
+ 		cfg80211_ch_switch_started_notify(adapter->pnetdev, &chdef, 0);
 @@ -7733,7 +7733,7 @@ exit:
  	return ret;
  }
@@ -9,7 +18,7 @@
  static void cfg80211_rtw_update_mgmt_frame_register(struct wiphy *wiphy,
                                               struct wireless_dev *wdev,
                                               struct mgmt_frame_regs *upd)
-@@ -10185,7 +10185,7 @@ static struct cfg80211_ops rtw_cfg80211_ops = {
+@@ -10185,7 +10185,7 @@ static struct cfg80211_ops rtw_cfg80211_
  
  #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)) || defined(COMPAT_KERNEL_RELEASE)
  	.mgmt_tx = cfg80211_rtw_mgmt_tx,
diff --git a/package/kernel/rtl8812au-ac/patches/050-Fix-kernel-5.15-compilation.patch b/package/kernel/rtl8812au-ac/patches/050-Fix-kernel-5.15-compilation.patch
new file mode 100644
index 0000000000..e35d48043c
--- /dev/null
+++ b/package/kernel/rtl8812au-ac/patches/050-Fix-kernel-5.15-compilation.patch
@@ -0,0 +1,72 @@
+From 47a38b7c736dd9e9baac9eb07a6dceb83429fb49 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Carlos=20Garc=C3=A9s?= <CGarces@users.noreply.github.com>
+Date: Sun, 10 Oct 2021 12:39:42 +0200
+Subject: [PATCH] Fix kernel 5.15 compilation Remove IPX support from driver,
+ set as obsolete in Jan 2018. IPX is not supported by the linux kernel since
+ v5.15-rc1 see commit 6c9b40844751ea30c72f7a2f92f4d704bc6b2927
+
+---
+ core/rtw_br_ext.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/core/rtw_br_ext.c
++++ b/core/rtw_br_ext.c
+@@ -17,7 +17,10 @@
+ #ifdef __KERNEL__
+ 	#include <linux/if_arp.h>
+ 	#include <net/ip.h>
++	#include <linux/version.h>
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0)
+ 	#include <net/ipx.h>
++#endif
+ 	#include <linux/atalk.h>
+ 	#include <linux/udp.h>
+ 	#include <linux/if_pppox.h>
+@@ -169,6 +172,7 @@ static __inline__ void __nat25_generate_
+ }
+ 
+ 
++#ifdef _NET_INET_IPX_H_
+ static __inline__ void __nat25_generate_ipx_network_addr_with_node(unsigned char *networkAddr,
+ 		unsigned int *ipxNetAddr, unsigned char *ipxNodeAddr)
+ {
+@@ -189,6 +193,7 @@ static __inline__ void __nat25_generate_
+ 	memcpy(networkAddr + 1, (unsigned char *)ipxNetAddr, 4);
+ 	memcpy(networkAddr + 5, (unsigned char *)ipxSocketAddr, 2);
+ }
++#endif
+ 
+ 
+ static __inline__ void __nat25_generate_apple_network_addr(unsigned char *networkAddr,
+@@ -330,6 +335,7 @@ static __inline__ int __nat25_network_ha
+ 		x = networkAddr[7] ^ networkAddr[8] ^ networkAddr[9] ^ networkAddr[10];
+ 
+ 		return x & (NAT25_HASH_SIZE - 1);
++#ifdef _NET_INET_IPX_H_
+ 	} else if (networkAddr[0] == NAT25_IPX) {
+ 		unsigned long x;
+ 
+@@ -337,6 +343,7 @@ static __inline__ int __nat25_network_ha
+ 		    networkAddr[6] ^ networkAddr[7] ^ networkAddr[8] ^ networkAddr[9] ^ networkAddr[10];
+ 
+ 		return x & (NAT25_HASH_SIZE - 1);
++#endif
+ 	} else if (networkAddr[0] == NAT25_APPLE) {
+ 		unsigned long x;
+ 
+@@ -889,6 +896,7 @@ int nat25_db_handle(_adapter *priv, stru
+ 		}
+ 	}
+ 
++#ifdef _NET_INET_IPX_H_
+ 	/*---------------------------------------------------*/
+ 	/*         Handle IPX and Apple Talk frame          */
+ 	/*---------------------------------------------------*/
+@@ -1109,6 +1117,7 @@ int nat25_db_handle(_adapter *priv, stru
+ 
+ 		return -1;
+ 	}
++#endif
+ 
+ 	/*---------------------------------------------------*/
+ 	/*                Handle PPPoE frame                */
diff --git a/package/kernel/rtl8812au-ct/Makefile b/package/kernel/rtl8812au-ct/Makefile
index 4dab3fd232..aa2d7a2ea9 100644
--- a/package/kernel/rtl8812au-ct/Makefile
+++ b/package/kernel/rtl8812au-ct/Makefile
@@ -1,16 +1,16 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=rtl8812au-ct
-PKG_RELEASE=2
+PKG_RELEASE=1
 
 PKG_LICENSE:=GPLv2
 PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/greearb/rtl8812AU_8821AU_linux.git
-PKG_MIRROR_HASH:=fa689e034cad9e4683ea784b8f3cb590492ab5c68e8babd492a4e8bf2de3b114
+PKG_MIRROR_HASH:=31e658df3e4d4c18c396259c2e0bef2bfc44a4aa870931f031a31e948be98af4
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2020-01-12
-PKG_SOURCE_VERSION:=e0d586aa93cb8687dd7dc0e593b6a820df2d6e1d
+PKG_SOURCE_DATE:=2021-11-07
+PKG_SOURCE_VERSION:=39df55967b7de9f6c9600017b724303f95a8b9e2
 
 PKG_MAINTAINER:=Ben Greear <greearb@candelatech.com>
 PKG_BUILD_PARALLEL:=1
diff --git a/package/kernel/rtl8812au-ct/patches/003-wireless-5.8.patch b/package/kernel/rtl8812au-ct/patches/003-wireless-5.8.patch
index 64c5ab162b..67ebb82b38 100644
--- a/package/kernel/rtl8812au-ct/patches/003-wireless-5.8.patch
+++ b/package/kernel/rtl8812au-ct/patches/003-wireless-5.8.patch
@@ -1,6 +1,6 @@
 --- a/os_dep/linux/ioctl_cfg80211.c
 +++ b/os_dep/linux/ioctl_cfg80211.c
-@@ -5177,6 +5177,14 @@ exit:
+@@ -5177,6 +5177,15 @@ exit:
  	return ret;
  }
  
@@ -11,19 +11,12 @@
 +{
 +
 +}
-+#else
- static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy,
- #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
-         struct wireless_dev *wdev,
-@@ -5205,6 +5213,7 @@ static void cfg80211_rtw_mgmt_frame_regi
- exit:
- 	return;
- }
 +#endif
- 
++ 
  #if defined(CONFIG_TDLS) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3,2,0))
  static int cfg80211_rtw_tdls_mgmt(struct wiphy *wiphy,
-@@ -6019,7 +6028,10 @@ static struct cfg80211_ops rtw_cfg80211_
+ 		struct net_device *ndev,
+@@ -5990,7 +5999,10 @@ static struct cfg80211_ops rtw_cfg80211_
  	.cancel_remain_on_channel = cfg80211_rtw_cancel_remain_on_channel,
  #endif
  
@@ -33,5 +26,5 @@
 +	.update_mgmt_frame_registrations = cfg80211_rtw_update_mgmt_frame_registrations,
 +#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
  	.mgmt_tx = cfg80211_rtw_mgmt_tx,
- 	.mgmt_frame_register = cfg80211_rtw_mgmt_frame_register,
  #elif  (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,34) && LINUX_VERSION_CODE<=KERNEL_VERSION(2,6,35))
+ 	.action = cfg80211_rtw_mgmt_tx,
diff --git a/package/kernel/rtl8821cu/Makefile b/package/kernel/rtl8821cu/Makefile
index 052efad813..7450e80731 100644
--- a/package/kernel/rtl8821cu/Makefile
+++ b/package/kernel/rtl8821cu/Makefile
@@ -13,9 +13,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_URL:=https://github.com/brektrou/rtl8821CU.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2020-12-19
-PKG_SOURCE_VERSION:=428a0820487418ec69c0edb91726d1cf19763b1e
-PKG_MIRROR_HASH:=77958d3bff8b0145504a10959765be0e3743b9c4880a5173d156238c2c569a56
+PKG_SOURCE_DATE:=2022-04-09
+PKG_SOURCE_VERSION:=8c2226a74ae718439d56248bd2e44ccf717086d5
+PKG_MIRROR_HASH:=3353a3bc4c73652eceaab95809aab27c3ae8bbf7e915b73488361a061ba91b84
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=LICENSE
@@ -62,10 +62,6 @@ EXTRA_CFLAGS:= \
 	-DCONFIG_CONCURRENT_MODE \
 	-DBUILD_OPENWRT
 
-ifeq ($(ARCH),arm)
-	EXTRA_CFLAGS += -mfloat-abi=softfp
-endif
-
 ifeq ($(BOARD),x86)
 	EXTRA_CFLAGS += -mhard-float
 endif
diff --git a/package/kernel/rtl8821cu/patches/010-remove-extra-cflags.patch b/package/kernel/rtl8821cu/patches/010-remove-extra-cflags.patch
deleted file mode 100644
index bc753af413..0000000000
--- a/package/kernel/rtl8821cu/patches/010-remove-extra-cflags.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/Makefile
-+++ b/Makefile
-@@ -2103,8 +2103,6 @@ ifeq ($(ARCH), i386)
- EXTRA_CFLAGS += -mhard-float
- else ifeq ($(ARCH), x86_64)
- EXTRA_CFLAGS += -mhard-float
--else ifeq ($(ARCH), arm)
--EXTRA_CFLAGS += -mfloat-abi=hard
- endif
- 
- ifeq ($(CONFIG_MULTIDRV), y)
diff --git a/package/kernel/rtl88x2bu/patches/020-wireless-5.8.patch b/package/kernel/rtl88x2bu/patches/030-wireless-5.8.patch
similarity index 67%
rename from package/kernel/rtl88x2bu/patches/020-wireless-5.8.patch
rename to package/kernel/rtl88x2bu/patches/030-wireless-5.8.patch
index b5911b0436..0e92f1f845 100644
--- a/package/kernel/rtl88x2bu/patches/020-wireless-5.8.patch
+++ b/package/kernel/rtl88x2bu/patches/030-wireless-5.8.patch
@@ -1,5 +1,14 @@
 --- a/os_dep/linux/ioctl_cfg80211.c
 +++ b/os_dep/linux/ioctl_cfg80211.c
+@@ -437,7 +437,7 @@ u8 rtw_cfg80211_ch_switch_notify(_adapter *adapter, u8 ch, u8 bw, u8 offset,
+ 
+ #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0))
+ 	if (started) {
+-	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0))
++	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)) || defined(BUILD_OPENWRT)
+ 
+ 		/* --- cfg80211_ch_switch_started_notfiy() ---
+ 		 *  A new parameter, bool quiet, is added from Linux kernel v5.11,
 @@ -7808,7 +7808,7 @@ exit:
  	return ret;
  }
diff --git a/package/libs/libnl-tiny/Makefile b/package/libs/libnl-tiny/Makefile
index bdb496c48e..48df6a4c8c 100644
--- a/package/libs/libnl-tiny/Makefile
+++ b/package/libs/libnl-tiny/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libnl-tiny
-PKG_RELEASE:=2
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/libnl-tiny.git
-PKG_SOURCE_DATE:=2020-08-05
-PKG_SOURCE_VERSION:=c291088f631d1694f7ba0444b59677b194348da8
-PKG_MIRROR_HASH:=99bcce12701bb34dadb39689d95c2c5cf1e27719d0ecfd645d3957a8947025ac
+PKG_SOURCE_DATE:=2022-05-17
+PKG_SOURCE_VERSION:=b5b2ba09c4f1c8b3c21580aea7223edc2f5e92be
+PKG_MIRROR_HASH:=b957d56aa8c2e7b55184111be69eb8dea734f1feba19e670a91f302459a48a78
 CMAKE_INSTALL:=1
 
 PKG_LICENSE:=LGPL-2.1
@@ -27,7 +27,7 @@ define Package/libnl-tiny
   SECTION:=libs
   CATEGORY:=Libraries
   TITLE:=netlink socket library
-  ABI_VERSION:=1
+  ABI_VERSION:=$(PKG_SOURCE_DATE)
 endef
 
 define Package/libnl-tiny/description
diff --git a/package/network/services/hostapd/Config.in b/package/network/services/hostapd/Config.in
index 5c00f3e24e..4cfcaafade 100644
--- a/package/network/services/hostapd/Config.in
+++ b/package/network/services/hostapd/Config.in
@@ -78,6 +78,7 @@ config DRIVER_11AC_SUPPORT
 config DRIVER_11AX_SUPPORT
 	bool
 	default n
+	select WPA_MBO_SUPPORT
 
 config WPA_ENABLE_WEP
 	bool "Enable support for unsecure and obsolete WEP"
@@ -87,3 +88,17 @@ config WPA_ENABLE_WEP
 	  for anything anymore. The functionality needed to use WEP is available in the
 	  current hostapd release under this optional build parameter and completely
 	  removed in a future release.
+
+config WPA_MBO_SUPPORT
+	bool "Multi Band Operation (Agile Multiband)"
+	default PACKAGE_wpa-supplicant || \
+		PACKAGE_wpa-supplicant-openssl || \
+		PACKAGE_wpa-supplicant-wolfssl || \
+		PACKAGE_wpad || \
+		PACKAGE_wpad-openssl || \
+		PACKAGE_wpad-wolfssl
+	help
+	  Multi Band Operation aka (Agile Multiband) enables features
+	  that facilitate efficient use of multiple frequency bands.
+	  Enabling MBO on an AP using RSN requires 802.11w to be enabled.
+	  Hostapd will refuse to start if MBO and RSN are enabled without 11w.
diff --git a/package/network/services/hostapd/Makefile b/package/network/services/hostapd/Makefile
index e529a2efd3..c4aa6d04f3 100644
--- a/package/network/services/hostapd/Makefile
+++ b/package/network/services/hostapd/Makefile
@@ -1,19 +1,17 @@
-# Copyright (C) 2006-2014 OpenWrt.org
-#
-# This is free software, licensed under the GNU General Public License v2.
-# See /LICENSE for more information.
+# SPDX-License-Identifier: GPL-2.0-only
 #
+# Copyright (C) 2006-2021 OpenWrt.org
 
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hostapd
-PKG_RELEASE:=40
+PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE_URL:=http://w1.fi/hostap.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2020-06-08
-PKG_SOURCE_VERSION:=5a8b366233f5585e68a4ffbb604fbb4a848eb325
-PKG_MIRROR_HASH:=1b2a4947034142587a3f81eac2ea27dd64650e77f8943d973623b47533be2393
+PKG_SOURCE_DATE:=2022-06-02
+PKG_SOURCE_VERSION:=4383528e01955d995d3b3db201e4c0f9840e8236
+PKG_MIRROR_HASH:=1b533287661d4877d56aca8a5b2a53d84d2a90eebe246d8d9b3adf943da7f0a1
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=BSD-3-Clause
@@ -93,6 +91,7 @@ DRIVER_MAKEOPTS= \
 	CONFIG_IEEE80211AC=$(HOSTAPD_IEEE80211AC) \
 	CONFIG_IEEE80211AX=$(HOSTAPD_IEEE80211AX) \
 	CONFIG_DRIVER_WEXT=$(CONFIG_DRIVER_WEXT_SUPPORT) \
+	CONFIG_MBO=$(CONFIG_WPA_MBO_SUPPORT)
 
 ifeq ($(SSL_VARIANT),openssl)
   DRIVER_MAKEOPTS += CONFIG_TLS=openssl CONFIG_SAE=y
@@ -145,6 +144,7 @@ define Package/hostapd/Default
   TITLE:=IEEE 802.1x Authenticator
   URL:=http://hostap.epitest.fi/
   DEPENDS:=$(DRV_DEPENDS) +hostapd-common +libubus
+  EXTRA_DEPENDS:=hostapd-common (=$(PKG_VERSION)-$(PKG_RELEASE))
   USERID:=network=101:network=101
   PROVIDES:=hostapd
   CONFLICTS:=$(HOSTAPD_PROVIDERS)
@@ -166,7 +166,7 @@ define Package/hostapd-openssl
 $(call Package/hostapd/Default,$(1))
   TITLE+= (OpenSSL full)
   VARIANT:=full-openssl
-  DEPENDS+=+libopenssl
+  DEPENDS+=+PACKAGE_hostapd-openssl:libopenssl
 endef
 
 Package/hostapd-openssl/description = $(Package/hostapd/description)
@@ -175,7 +175,7 @@ define Package/hostapd-wolfssl
 $(call Package/hostapd/Default,$(1))
   TITLE+= (wolfSSL full)
   VARIANT:=full-wolfssl
-  DEPENDS+=+libwolfssl
+  DEPENDS+=+PACKAGE_hostapd-wolfssl:libwolfssl
 endef
 
 Package/hostapd-wolfssl/description = $(Package/hostapd/description)
@@ -194,7 +194,7 @@ define Package/hostapd-basic-openssl
 $(call Package/hostapd/Default,$(1))
   TITLE+= (WPA-PSK, 11r and 11w)
   VARIANT:=basic-openssl
-  DEPENDS+=+libopenssl
+  DEPENDS+=+PACKAGE_hostapd-basic-openssl:libopenssl
 endef
 
 define Package/hostapd-basic-openssl/description
@@ -205,7 +205,7 @@ define Package/hostapd-basic-wolfssl
 $(call Package/hostapd/Default,$(1))
   TITLE+= (WPA-PSK, 11r and 11w)
   VARIANT:=basic-wolfssl
-  DEPENDS+=+libwolfssl
+  DEPENDS+=+PACKAGE_hostapd-basic-wolfssl:libwolfssl
 endef
 
 define Package/hostapd-basic-wolfssl/description
@@ -229,6 +229,7 @@ define Package/wpad/Default
   SUBMENU:=WirelessAPD
   TITLE:=IEEE 802.1x Auth/Supplicant
   DEPENDS:=$(DRV_DEPENDS) +hostapd-common +libubus
+  EXTRA_DEPENDS:=hostapd-common (=$(PKG_VERSION)-$(PKG_RELEASE))
   USERID:=network=101:network=101
   URL:=http://hostap.epitest.fi/
   PROVIDES:=hostapd wpa-supplicant
@@ -252,7 +253,7 @@ define Package/wpad-openssl
 $(call Package/wpad/Default,$(1))
   TITLE+= (OpenSSL full)
   VARIANT:=wpad-full-openssl
-  DEPENDS+=+libopenssl
+  DEPENDS+=+PACKAGE_wpad-openssl:libopenssl
 endef
 
 Package/wpad-openssl/description = $(Package/wpad/description)
@@ -261,7 +262,7 @@ define Package/wpad-wolfssl
 $(call Package/wpad/Default,$(1))
   TITLE+= (wolfSSL full)
   VARIANT:=wpad-full-wolfssl
-  DEPENDS+=+libwolfssl
+  DEPENDS+=+PACKAGE_wpad-wolfssl:libwolfssl
 endef
 
 Package/wpad-wolfssl/description = $(Package/wpad/description)
@@ -280,7 +281,7 @@ define Package/wpad-basic-openssl
 $(call Package/wpad/Default,$(1))
   TITLE+= (OpenSSL, 11r, 11w)
   VARIANT:=wpad-basic-openssl
-  DEPENDS+=+libopenssl
+  DEPENDS+=+PACKAGE_wpad-basic-openssl:libopenssl
 endef
 
 define Package/wpad-basic-openssl/description
@@ -291,7 +292,7 @@ define Package/wpad-basic-wolfssl
 $(call Package/wpad/Default,$(1))
   TITLE+= (wolfSSL, 11r, 11w)
   VARIANT:=wpad-basic-wolfssl
-  DEPENDS+=+libwolfssl
+  DEPENDS+=+PACKAGE_wpad-basic-wolfssl:libwolfssl
 endef
 
 define Package/wpad-basic-wolfssl/description
@@ -321,7 +322,7 @@ endef
 define Package/wpad-mesh-openssl
 $(call Package/wpad-mesh,$(1))
   TITLE+= (OpenSSL, 11s, SAE)
-  DEPENDS+=+libopenssl
+  DEPENDS+=+PACKAGE_wpad-mesh-openssl:libopenssl
   VARIANT:=wpad-mesh-openssl
 endef
 
@@ -330,7 +331,7 @@ Package/wpad-mesh-openssl/description = $(Package/wpad-mesh/description)
 define Package/wpad-mesh-wolfssl
 $(call Package/wpad-mesh,$(1))
   TITLE+= (wolfSSL, 11s, SAE)
-  DEPENDS+=+libwolfssl
+  DEPENDS+=+PACKAGE_wpad-mesh-wolfssl:libwolfssl
   VARIANT:=wpad-mesh-wolfssl
 endef
 
@@ -344,6 +345,7 @@ define Package/wpa-supplicant/Default
   TITLE:=WPA Supplicant
   URL:=http://hostap.epitest.fi/wpa_supplicant/
   DEPENDS:=$(DRV_DEPENDS) +hostapd-common +libubus
+  EXTRA_DEPENDS:=hostapd-common (=$(PKG_VERSION)-$(PKG_RELEASE))
   USERID:=network=101:network=101
   PROVIDES:=wpa-supplicant
   CONFLICTS:=$(SUPPLICANT_PROVIDERS)
@@ -360,14 +362,14 @@ define Package/wpa-supplicant-openssl
 $(call Package/wpa-supplicant/Default,$(1))
   TITLE+= (OpenSSL full)
   VARIANT:=supplicant-full-openssl
-  DEPENDS+=+libopenssl
+  DEPENDS+=+PACKAGE_wpa-supplicant-openssl:libopenssl
 endef
 
 define Package/wpa-supplicant-wolfssl
 $(call Package/wpa-supplicant/Default,$(1))
   TITLE+= (wolfSSL full)
   VARIANT:=supplicant-full-wolfssl
-  DEPENDS+=+libwolfssl
+  DEPENDS+=+PACKAGE_wpa-supplicant-wolfssl:libwolfssl
 endef
 
 define Package/wpa-supplicant/config
@@ -391,14 +393,14 @@ define Package/wpa-supplicant-mesh-openssl
 $(call Package/wpa-supplicant-mesh/Default,$(1))
   TITLE+= (OpenSSL, 11s, SAE)
   VARIANT:=supplicant-mesh-openssl
-  DEPENDS+=+libopenssl
+  DEPENDS+=+PACKAGE_wpa-supplicant-mesh-openssl:libopenssl
 endef
 
 define Package/wpa-supplicant-mesh-wolfssl
 $(call Package/wpa-supplicant-mesh/Default,$(1))
   TITLE+= (wolfSSL, 11s, SAE)
   VARIANT:=supplicant-mesh-wolfssl
-  DEPENDS+=+libwolfssl
+  DEPENDS+=+PACKAGE_wpa-supplicant-mesh-wolfssl:libwolfssl
 endef
 
 define Package/wpa-supplicant-basic
@@ -428,6 +430,7 @@ define Package/hostapd-utils
   TITLE:=IEEE 802.1x Authenticator (utils)
   URL:=http://hostap.epitest.fi/
   DEPENDS:=@$(subst $(space),||,$(foreach pkg,$(HOSTAPD_PROVIDERS),PACKAGE_$(pkg)))
+  VARIANT:=*
 endef
 
 define Package/hostapd-utils/description
@@ -441,6 +444,7 @@ define Package/wpa-cli
   SUBMENU:=WirelessAPD
   DEPENDS:=@$(subst $(space),||,$(foreach pkg,$(SUPPLICANT_PROVIDERS),PACKAGE_$(pkg)))
   TITLE:=WPA Supplicant command line control utility
+  VARIANT:=*
 endef
 
 define Package/eapol-test/Default
@@ -462,7 +466,7 @@ define Package/eapol-test-openssl
   TITLE+= (OpenSSL full)
   VARIANT:=supplicant-full-openssl
   CONFLICTS:=$(filter-out eapol-test-openssl ,$(EAPOL_TEST_PROVIDERS))
-  DEPENDS+=+libopenssl
+  DEPENDS+=+PACKAGE_eapol-test-openssl:libopenssl
   PROVIDES:=eapol-test
 endef
 
@@ -471,7 +475,7 @@ define Package/eapol-test-wolfssl
   TITLE+= (wolfSSL full)
   VARIANT:=supplicant-full-wolfssl
   CONFLICTS:=$(filter-out eapol-test-openssl ,$(filter-out eapol-test-wolfssl ,$(EAPOL_TEST_PROVIDERS)))
-  DEPENDS+=+libwolfssl
+  DEPENDS+=+PACKAGE_eapol-test-wolfssl:libwolfssl
   PROVIDES:=eapol-test
 endef
 
@@ -524,6 +528,7 @@ define Build/RunMake
 		LIBS_c="$(TARGET_LDFLAGS_C)" \
 		AR="$(TARGET_CROSS)gcc-ar" \
 		BCHECK= \
+		$(if $(findstring s,$(OPENWRT_VERBOSE)),V=1) \
 		$(2)
 endef
 
@@ -597,6 +602,7 @@ endef
 
 define Package/hostapd-common/install
 	$(INSTALL_DIR) $(1)/etc/capabilities $(1)/etc/rc.button $(1)/etc/hotplug.d/ieee80211 $(1)/etc/init.d $(1)/lib/netifd  $(1)/usr/share/acl.d
+	$(INSTALL_BIN) ./files/dhcp-get-server.sh $(1)/lib/netifd/dhcp-get-server.sh
 	$(INSTALL_DATA) ./files/hostapd.sh $(1)/lib/netifd/hostapd.sh
 	$(INSTALL_BIN) ./files/wpad.init $(1)/etc/init.d/wpad
 	$(INSTALL_BIN) ./files/wps-hotplug.sh $(1)/etc/rc.button/wps
@@ -678,6 +684,9 @@ ifeq ($(BUILD_VARIANT),supplicant-full-wolfssl)
   endef
 endif
 
+# Build hostapd-common before its dependents, to avoid
+# spurious rebuilds when building multiple variants.
+$(eval $(call BuildPackage,hostapd-common))
 $(eval $(call BuildPackage,hostapd))
 $(eval $(call BuildPackage,hostapd-basic))
 $(eval $(call BuildPackage,hostapd-basic-openssl))
@@ -704,7 +713,6 @@ $(eval $(call BuildPackage,wpa-supplicant-openssl))
 $(eval $(call BuildPackage,wpa-supplicant-wolfssl))
 $(eval $(call BuildPackage,wpa-cli))
 $(eval $(call BuildPackage,hostapd-utils))
-$(eval $(call BuildPackage,hostapd-common))
 $(eval $(call BuildPackage,eapol-test))
 $(eval $(call BuildPackage,eapol-test-openssl))
 $(eval $(call BuildPackage,eapol-test-wolfssl))
diff --git a/package/network/services/hostapd/README.md b/package/network/services/hostapd/README.md
new file mode 100644
index 0000000000..2150863306
--- /dev/null
+++ b/package/network/services/hostapd/README.md
@@ -0,0 +1,419 @@
+# UBUS methods - hostapd
+
+## bss_mgmt_enable
+Enable 802.11k/v features.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| neighbor_report | bool | no | enable 802.11k neighbor reports |
+| beacon_report | bool | no | enable 802.11k beacon reports |
+| link_measurements | bool | no | enable 802.11k link measurements |
+| bss_transition | bool | no | enable 802.11v BSS transition support |
+
+### example
+`ubus call hostapd.wl5-fb bss_mgmt_enable '{ "neighbor_report": true, "beacon_report": true, "link_measurements": true, "bss_transition": true
+}'`
+
+
+## bss_transition_request
+Initiate an 802.11v transition request.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| addr | string | yes | client MAC address |
+| disassociation_imminent | bool | no | set Disassociation Imminent bit |
+| disassociation_timer | int32 | no | disassociate client if it doesn't roam after this time |
+| validity_period | int32 | no | validity of the BSS Transition Candiate List |
+| neighbors | array | no | BSS Transition Candidate List |
+| abridged | bool | no | prefer APs in the BSS Transition Candidate List |
+| dialog_token | int32 | no | identifier for the request/report transaction |
+| mbo_reason | int32 | no | MBO Transition Reason Code Attribute |
+| cell_pref | int32 | no | MBO Cellular Data Connection Preference Attribute |
+| reassoc_delay | int32 | no | MBO Re-association retry delay |
+
+### example
+`ubus call hostapd.wl5-fb bss_transition_request '{ "addr": "68:2F:67:8B:98:ED", "disassociation_imminent": false, "disassociation_timer": 0, "validity_period": 30, "neighbors": ["b6a7b9cbeebabf5900008064090603026a00"], "abridged": 1 }'`
+
+
+## config_add
+Dynamically load a BSS configuration from a file. This is used by netifd's mac80211 support script to configure BSSes on multiple PHYs in a single hostapd instance.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| iface | string | yes | WiFi interface name |
+| config | string | yes | path to hostapd config file |
+
+
+## config_remove
+Dynamically remove a BSS configuration.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| iface | string | yes | WiFi interface name |
+
+
+## del_client
+Kick a client off the network.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| addr | string | yes | client MAC address |
+| reason | int32 | no | 802.11 reason code |
+| deauth | bool | no | deauthenticates client instead of disassociating |
+| ban_time | int32 | no | ban client for N milliseconds |
+
+### example
+`ubus call hostapd.wl5-fb del_client '{ "addr": "68:2f:67:8b:98:ed", "reason": 5, "deauth": true, "ban_time": 10000 }'`
+
+
+## get_clients
+Show associated clients.
+
+### example
+`ubus call hostapd.wl5-fb get_clients`
+
+### output
+```json
+{
+        "freq": 5260,
+        "clients": {
+                "68:2f:67:8b:98:ed": {
+                        "auth": true,
+                        "assoc": true,
+                        "authorized": true,
+                        "preauth": false,
+                        "wds": false,
+                        "wmm": true,
+                        "ht": true,
+                        "vht": true,
+                        "he": false,
+                        "wps": false,
+                        "mfp": true,
+                        "rrm": [
+                                0,
+                                0,
+                                0,
+                                0,
+                                0
+                        ],
+                        "extended_capabilities": [
+                                0,
+                                0,
+                                0,
+                                0,
+                                0,
+                                0,
+                                0,
+                                64
+                        ],
+                        "aid": 3,
+                        "signature": "wifi4|probe:0,1,45,127,107,191,221(0017f2,10),221(001018,2),htcap:006f,htagg:1b,htmcs:0000ffff,vhtcap:0f825832,vhtrxmcs:0000ffea,vhttxmcs:0000ffea,extcap:0000008000000040|assoc:0,1,33,36,48,45,127,191,221(0017f2,10),221(001018,2),221(0050f2,2),htcap:006f,htagg:1b,htmcs:0000ffff,vhtcap:0f825832,vhtrxmcs:0000ffea,vhttxmcs:0000ffea,txpow:14f9,extcap:0000000000000040",
+                        "bytes": {
+                                "rx": 1933667,
+                                "tx": 746805
+                        },
+                        "airtime": {
+                                "rx": 208863,
+                                "tx": 9037883
+                        },
+                        "packets": {
+                                "rx": 3587,
+                                "tx": 2185
+                        },
+                        "rate": {
+                                "rx": 866700,
+                                "tx": 866700
+                        },
+                        "signal": -50,
+                        "capabilities": {
+                                "vht": {
+                                        "su_beamformee": true,
+                                        "mu_beamformee": false,
+                                        "mcs_map": {
+                                                "rx": {
+                                                        "1ss": 9,
+                                                        "2ss": 9,
+                                                        "3ss": 9,
+                                                        "4ss": -1,
+                                                        "5ss": -1,
+                                                        "6ss": -1,
+                                                        "7ss": -1,
+                                                        "8ss": -1
+                                                },
+                                                "tx": {
+                                                        "1ss": 9,
+                                                        "2ss": 9,
+                                                        "3ss": 9,
+                                                        "4ss": -1,
+                                                        "5ss": -1,
+                                                        "6ss": -1,
+                                                        "7ss": -1,
+                                                        "8ss": -1
+                                                }
+                                        }
+                                }
+                        }
+                }
+        }
+}
+```
+
+
+## get_features
+Show HT/VHT support.
+
+### example
+`ubus call hostapd.wl5-fb get_features`
+
+### output
+```json
+{
+        "ht_supported": true,
+        "vht_supported": true
+}
+```
+
+
+## get_status
+Get BSS status.
+
+### example
+`ubus call hostapd.wl5-fb get_status`
+
+### output
+```json
+{
+        "status": "ENABLED",
+        "bssid": "b6:a7:b9:cb:ee:bc",
+        "ssid": "fb",
+        "freq": 5260,
+        "channel": 52,
+        "op_class": 128,
+        "beacon_interval": 100,
+        "phy": "wl5-lan",
+        "rrm": {
+                "neighbor_report_tx": 0
+        },
+        "wnm": {
+                "bss_transition_query_rx": 0,
+                "bss_transition_request_tx": 0,
+                "bss_transition_response_rx": 0
+        },
+        "airtime": {
+                "time": 259561738,
+                "time_busy": 2844249,
+                "utilization": 0
+        },
+        "dfs": {
+                "cac_seconds": 60,
+                "cac_active": false,
+                "cac_seconds_left": 0
+        }
+}
+```
+
+
+## link_measurement_req
+Initiate an 802.11k Link Measurement Request.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| addr | string | yes | client MAC address |
+| tx-power-used | int32 | no | transmit power used to transmit the Link Measurement Request frame |
+| tx-power-max | int32 | no | upper limit of transmit power to be used by the client |
+
+
+## list_bans
+List banned clients.
+
+### example
+`ubus call hostapd.wl5-fb list_bans`
+
+### output
+```json
+{
+        "clients": [
+                "68:2f:67:8b:98:ed"
+        ]
+}
+```
+
+
+## notify_response
+When enabled, hostapd will send a ubus notification and wait for a response before responding to various requests. This is used by e.g. usteer to make it possible to ignore probe requests.
+
+:warning: enabling this will cause hostapd to stop responding to probe requests unless a ubus subscriber responds to the ubus notifications.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| notify_response | int32 | yes | disable (0) or enable (!0) |
+
+### example
+`ubus call hostapd.wl5-fb notify_response '{ "notify_response": 1 }'`
+
+## reload
+Reload BSS configuration.
+
+:warning: this can cause problems for certain configurations:
+
+```
+Mon May 16 16:09:08 2022 daemon.warn hostapd: Failed to check if DFS is required; ret=-1
+Mon May 16 16:09:08 2022 daemon.warn hostapd: Failed to check if DFS is required; ret=-1
+Mon May 16 16:09:08 2022 daemon.err hostapd: Wrong coupling between HT and VHT/HE channel setting
+```
+
+### example
+`ubus call hostapd.wl5-fb reload`
+
+
+## rrm_beacon_req
+Send a Beacon Measurement Request to a client.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| addr | string | yes | client MAC address |
+| op_class | int32 | yes | the Regulatory Class for which this Measurement Request applies |
+| channel | int32 | yes | channel to measure |
+| duration | int32 | yes | compile Beacon Measurement Report after N TU |
+| mode | int32 | yes | mode to be used for measurement (0: passive, 1: active, 2: beacon table) |
+| bssid | string | no | filter BSSes in Beacon Measurement Report by BSSID |
+| ssid | string | no | filter BSSes in Beacon Measurement Report by SSID|
+
+
+## rrm_nr_get_own
+Show Neighbor Report Element for this BSS.
+
+### example
+`ubus call hostapd.wl5-fb rrm_nr_get_own`
+
+### output
+```json
+{
+        "value": [
+                "b6:a7:b9:cb:ee:bc",
+                "fb",
+                "b6a7b9cbeebcaf5900008095090603029b00"
+        ]
+}
+```
+
+
+## rrm_nr_list
+Show Neighbor Report Elements for other BSSes in this ESS.
+
+### example
+`ubus call hostapd.wl5-fb rrm_nr_list`
+
+### output
+```json
+{
+        "list": [
+                [
+                        "b6:a7:b9:cb:ee:ba",
+                        "fb",
+                        "b6a7b9cbeebabf5900008064090603026a00"
+                ]
+        ]
+}
+```
+
+## rrm_nr_set
+Set the Neighbor Report Elements. An element for the node on which this command is executed will always be added.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| list | array | yes | array of Neighbor Report Elements in the format of the rrm_nr_list output |
+
+### example
+`ubus call hostapd.wl5-fb rrm_nr_set '{ "list": [ [ "b6:a7:b9:cb:ee:ba", "fb", "b6a7b9cbeebabf5900008064090603026a00" ] ] }'`
+
+
+## set_vendor_elements
+Configure Vendor-specific Information Elements for BSS.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| vendor_elements | string | yes | Vendor-specific Information Elements as hex string |
+
+### example
+`ubus call hostapd.wl5-fb set_vendor_elements '{ "vendor_elements": "dd054857dd6662" }'`
+
+
+## switch_chan
+Initiate a channel switch.
+
+:warning: trying to switch to the channel that is currently in use will fail: `Command failed: Operation not supported`
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| freq | int32 | yes | frequency in MHz to switch to |
+| bcn_count | int32 | no | count in Beacon frames (TBTT) to perform the switch |
+| center_freq1 | int32 | no | segment 0 center frequency in MHz (valid for HT and VHT) |
+| center_freq2 | int32 | no | segment 1 center frequency in MHz (valid only for 80 MHz channel width and an 80+80 channel) |
+| bandwidth | int32 | no | channel width to use |
+| sec_channel_offset| int32 | no | secondary channel offset for HT40 (0 = disabled, 1 = HT40+, -1 = HT40-) |
+| ht | bool | no | enable 802.11n |
+| vht | bool | no | enable 802.11ac |
+| he | bool | no | enable 802.11ax |
+| block_tx | bool | no | block transmission during CSA period |
+| csa_force | bool | no | restart the interface in case the CSA fails |
+
+## example
+`ubus call hostapd.wl5-fb switch_chan '{ "freq": 5180, "bcn_count": 10, "center_freq1": 5210, "bandwidth": 80, "he": 1, "block_tx": 1, "csa_force": 0 }'`
+
+
+## update_airtime
+Set dynamic airtime weight for client.
+
+### arguments
+| Name | Type | Required | Description |
+|---|---|---|---|
+| sta | string | yes | client MAC address |
+| weight | int32 | yes | airtime weight |
+
+
+## update_beacon
+Force beacon frame content to be updated and to start beaconing on an interface that uses start_disabled=1.
+
+### example
+`ubus call hostapd.wl5-fb update_beacon`
+
+
+## wps_status
+Get WPS status for BSS.
+
+### example
+`ubus call hostapd.wl5-fb wps_status`
+
+### output
+```json
+{
+        "pbc_status": "Disabled",
+        "last_wps_result": "None"
+}
+```
+
+
+## wps_cancel
+Cancel WPS Push Button Configuration.
+
+### example
+`ubus call hostapd.wl5-fb wps_cancel`
+
+
+## wps_start
+Start WPS Push Button Configuration.
+
+### example
+`ubus call hostapd.wl5-fb wps_start`
diff --git a/package/network/services/hostapd/files/dhcp-get-server.sh b/package/network/services/hostapd/files/dhcp-get-server.sh
new file mode 100644
index 0000000000..a1509ace2f
--- /dev/null
+++ b/package/network/services/hostapd/files/dhcp-get-server.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+[ "$1" = bound ] && echo "$serverid"
diff --git a/package/network/services/hostapd/files/hostapd-basic.config b/package/network/services/hostapd/files/hostapd-basic.config
index 33c38192b1..3d19d8f902 100644
--- a/package/network/services/hostapd/files/hostapd-basic.config
+++ b/package/network/services/hostapd/files/hostapd-basic.config
@@ -54,7 +54,7 @@ CONFIG_RSN_PREAUTH=y
 #CONFIG_IEEE80211W=y
 
 # Support Operating Channel Validation
-#CONFIG_OCV=y
+CONFIG_OCV=y
 
 # Integrated EAP server
 #CONFIG_EAP=y
@@ -386,6 +386,9 @@ CONFIG_TLS=internal
 # Airtime policy support
 CONFIG_AIRTIME_POLICY=y
 
+# Proxy ARP support
+#CONFIG_PROXYARP=y
+
 # Override default value for the wpa_disable_eapol_key_retries configuration
 # parameter. See that parameter in hostapd.conf for more details.
 #CFLAGS += -DDEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES=1
diff --git a/package/network/services/hostapd/files/hostapd-full.config b/package/network/services/hostapd/files/hostapd-full.config
index df272e443a..b92f9a25b8 100644
--- a/package/network/services/hostapd/files/hostapd-full.config
+++ b/package/network/services/hostapd/files/hostapd-full.config
@@ -54,13 +54,13 @@ CONFIG_RSN_PREAUTH=y
 #CONFIG_IEEE80211W=y
 
 # Support Operating Channel Validation
-#CONFIG_OCV=y
+CONFIG_OCV=y
 
 # Integrated EAP server
 CONFIG_EAP=y
 
 # EAP Re-authentication Protocol (ERP) in integrated EAP server
-#CONFIG_ERP=y
+CONFIG_ERP=y
 
 # EAP-MD5 for the integrated EAP server
 CONFIG_EAP_MD5=y
@@ -316,7 +316,7 @@ CONFIG_INTERNAL_LIBTOMMATH=y
 CONFIG_INTERWORKING=y
 
 # Hotspot 2.0
-#CONFIG_HS20=y
+CONFIG_HS20=y
 
 # Enable SQLite database support in hlr_auc_gw, EAP-SIM DB, and eap_user_file
 #CONFIG_SQLITE=y
@@ -386,6 +386,9 @@ CONFIG_TAXONOMY=y
 # Airtime policy support
 CONFIG_AIRTIME_POLICY=y
 
+# Proxy ARP support
+CONFIG_PROXYARP=y
+
 # Override default value for the wpa_disable_eapol_key_retries configuration
 # parameter. See that parameter in hostapd.conf for more details.
 #CFLAGS += -DDEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES=1
diff --git a/package/network/services/hostapd/files/hostapd-mini.config b/package/network/services/hostapd/files/hostapd-mini.config
index b3050f7bbc..f2ed071ec0 100644
--- a/package/network/services/hostapd/files/hostapd-mini.config
+++ b/package/network/services/hostapd/files/hostapd-mini.config
@@ -386,6 +386,9 @@ CONFIG_TLS=internal
 # Airtime policy support
 #CONFIG_AIRTIME_POLICY=y
 
+# Proxy ARP support
+#CONFIG_PROXYARP=y
+
 # Override default value for the wpa_disable_eapol_key_retries configuration
 # parameter. See that parameter in hostapd.conf for more details.
 #CFLAGS += -DDEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES=1
diff --git a/package/network/services/hostapd/files/hostapd.sh b/package/network/services/hostapd/files/hostapd.sh
index 408bf268f2..38c8bc9c41 100644
--- a/package/network/services/hostapd/files/hostapd.sh
+++ b/package/network/services/hostapd/files/hostapd.sh
@@ -48,12 +48,15 @@ hostapd_append_wpa_key_mgmt() {
 		;;
 		eap192)
 			append wpa_key_mgmt "WPA-EAP-SUITE-B-192"
-			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP-SHA384"
 		;;
 		eap-eap192)
 			append wpa_key_mgmt "WPA-EAP-SUITE-B-192"
 			append wpa_key_mgmt "WPA-EAP"
-			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP"
+			[ "${ieee80211r:-0}" -gt 0 ] && {
+				append wpa_key_mgmt "FT-EAP-SHA384"
+				append wpa_key_mgmt "FT-EAP"
+			}
 			[ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-EAP-SHA256"
 		;;
 		sae)
@@ -72,6 +75,15 @@ hostapd_append_wpa_key_mgmt() {
 		;;
 	esac
 
+	[ "$fils" -gt 0 ] && {
+		case "$auth_type" in
+			eap*)
+				append wpa_key_mgmt FILS-SHA256
+				[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt FT-FILS-SHA256
+			;;
+		esac
+	}
+
 	[ "$auth_osen" = "1" ] && append wpa_key_mgmt "OSEN"
 }
 
@@ -100,8 +112,11 @@ hostapd_common_add_device_config() {
 	config_add_string require_mode
 	config_add_boolean legacy_rates
 	config_add_int cell_density
-	config_add_boolean vendor_vht
 	config_add_int rts_threshold
+	config_add_int rssi_reject_assoc_rssi
+	config_add_int rssi_ignore_probe_request
+	config_add_int maxassoc
+	config_add_boolean vendor_vht
 
 	config_add_string acs_chan_bias
 	config_add_array hostapd_options
@@ -118,8 +133,9 @@ hostapd_prepare_device_config() {
 	local base_cfg=
 
 	json_get_vars country country3 country_ie beacon_int:100 dtim_period:2 doth require_mode legacy_rates \
-		acs_chan_bias local_pwr_constraint spectrum_mgmt_required airtime_mode cell_density vendor_vht \
-		rts_threshold beacon_rate
+		acs_chan_bias local_pwr_constraint spectrum_mgmt_required airtime_mode cell_density \
+		rts_threshold beacon_rate rssi_reject_assoc_rssi rssi_ignore_probe_request maxassoc \
+		vendor_vht
 
 	hostapd_set_log_options base_cfg
 
@@ -212,6 +228,8 @@ hostapd_prepare_device_config() {
 		hostapd_add_rate brlist "$br"
 	done
 
+	[ -n "$rssi_reject_assoc_rssi" ] && append base_cfg "rssi_reject_assoc_rssi=$rssi_reject_assoc_rssi" "$N"
+	[ -n "$rssi_ignore_probe_request" ] && append base_cfg "rssi_ignore_probe_request=$rssi_ignore_probe_request" "$N"
 	[ -n "$beacon_rate" ] && append base_cfg "beacon_rate=$beacon_rate" "$N"
 	[ -n "$rlist" ] && append base_cfg "supported_rates=$rlist" "$N"
 	[ -n "$brlist" ] && append base_cfg "basic_rates=$brlist" "$N"
@@ -219,6 +237,7 @@ hostapd_prepare_device_config() {
 	[ -n "$rts_threshold" ] && append base_cfg "rts_threshold=$rts_threshold" "$N"
 	append base_cfg "dtim_period=$dtim_period" "$N"
 	[ "$airtime_mode" -gt 0 ] && append base_cfg "airtime_mode=$airtime_mode" "$N"
+	[ -n "$maxassoc" ] && append base_cfg "iface_max_num_sta=$maxassoc" "$N"
 
 	json_get_values opts hostapd_options
 	for val in $opts; do
@@ -233,7 +252,7 @@ EOF
 
 hostapd_common_add_bss_config() {
 	config_add_string 'bssid:macaddr' 'ssid:string'
-	config_add_boolean wds wmm uapsd hidden utf8_ssid
+	config_add_boolean wds wmm uapsd hidden utf8_ssid ppsk
 
 	config_add_int maxassoc max_inactivity
 	config_add_boolean disassoc_low_ack isolate short_preamble skip_inactivity_poll
@@ -291,7 +310,7 @@ hostapd_common_add_bss_config() {
 	config_add_string wps_device_type wps_device_name wps_manufacturer wps_pin
 	config_add_string multi_ap_backhaul_ssid multi_ap_backhaul_key
 
-	config_add_boolean wnm_sleep_mode wnm_sleep_mode_no_keys bss_transition
+	config_add_boolean wnm_sleep_mode wnm_sleep_mode_no_keys bss_transition mbo
 	config_add_int time_advertisement
 	config_add_string time_zone
 	config_add_string vendor_elements
@@ -319,8 +338,10 @@ hostapd_common_add_bss_config() {
 	config_add_array supported_rates
 
 	config_add_boolean sae_require_mfp
+	config_add_int sae_pwe
 
 	config_add_string 'owe_transition_bssid:macaddr' 'owe_transition_ssid:string'
+	config_add_string owe_transition_ifname
 
 	config_add_boolean iw_enabled iw_internet iw_asra iw_esr iw_uesa
 	config_add_int iw_access_network_type iw_venue_group iw_venue_type
@@ -343,9 +364,10 @@ hostapd_common_add_bss_config() {
 	config_add_array airtime_sta_weight
 	config_add_int airtime_bss_weight airtime_bss_limit
 
-	config_add_boolean multicast_to_unicast per_sta_vif
+	config_add_boolean multicast_to_unicast multicast_to_unicast_all proxy_arp per_sta_vif
 
 	config_add_array hostapd_bss_options
+	config_add_boolean default_disabled
 
 	config_add_boolean request_cui
 	config_add_array radius_auth_req_attr
@@ -353,6 +375,11 @@ hostapd_common_add_bss_config() {
 
 	config_add_int eap_server
 	config_add_string eap_user_file ca_cert server_cert private_key private_key_passwd server_id
+
+	config_add_boolean fils
+	config_add_string fils_dhcp
+
+	config_add_int ocv
 }
 
 hostapd_set_vlan_file() {
@@ -508,7 +535,7 @@ hostapd_set_bss_options() {
 
 	wireless_vif_parse_encryption
 
-	local bss_conf bss_md5sum
+	local bss_conf bss_md5sum ft_key
 	local wep_rekey wpa_group_rekey wpa_pair_rekey wpa_master_rekey wpa_key_mgmt
 
 	json_get_vars \
@@ -520,13 +547,14 @@ hostapd_set_bss_options() {
 		macfilter ssid utf8_ssid wmm uapsd hidden short_preamble rsn_preauth \
 		iapp_interface eapol_version dynamic_vlan ieee80211w nasid \
 		acct_server acct_secret acct_port acct_interval \
-		bss_load_update_period chan_util_avg_period sae_require_mfp \
+		bss_load_update_period chan_util_avg_period sae_require_mfp sae_pwe \
 		multi_ap multi_ap_backhaul_ssid multi_ap_backhaul_key skip_inactivity_poll \
-		airtime_bss_weight airtime_bss_limit airtime_sta_weight \
-		multicast_to_unicast per_sta_vif \
+		ppsk airtime_bss_weight airtime_bss_limit airtime_sta_weight \
+		multicast_to_unicast_all proxy_arp per_sta_vif \
 		eap_server eap_user_file ca_cert server_cert private_key private_key_passwd server_id \
-		vendor_elements
+		vendor_elements fils ocv
 
+	set_default fils 0
 	set_default isolate 0
 	set_default maxassoc 0
 	set_default max_inactivity 0
@@ -544,10 +572,13 @@ hostapd_set_bss_options() {
 	set_default chan_util_avg_period 600
 	set_default utf8_ssid 1
 	set_default multi_ap 0
+	set_default ppsk 0
 	set_default airtime_bss_weight 0
 	set_default airtime_bss_limit 0
 	set_default eap_server 0
 
+	/usr/sbin/hostapd -vfils || fils=0
+
 	append bss_conf "ctrl_interface=/var/run/hostapd"
 	if [ "$isolate" -gt 0 ]; then
 		append bss_conf "ap_isolate=$isolate" "$N"
@@ -595,26 +626,32 @@ hostapd_set_bss_options() {
 		json_for_each_item append_radius_acct_req_attr radius_acct_req_attr
 	}
 
+	[ -n "$ocv" ] && append bss_conf "ocv=$ocv" "$N"
+
 	case "$auth_type" in
 		sae|owe|eap192|eap-eap192)
 			set_default ieee80211w 2
 			set_default sae_require_mfp 1
+			set_default sae_pwe 2
 		;;
 		psk-sae)
 			set_default ieee80211w 1
 			set_default sae_require_mfp 1
+			set_default sae_pwe 2
 		;;
 	esac
 	[ -n "$sae_require_mfp" ] && append bss_conf "sae_require_mfp=$sae_require_mfp" "$N"
+	[ -n "$sae_pwe" ] && append bss_conf "sae_pwe=$sae_pwe" "$N"
 
 	local vlan_possible=""
 
 	case "$auth_type" in
 		none|owe)
-			json_get_vars owe_transition_bssid owe_transition_ssid
+			json_get_vars owe_transition_bssid owe_transition_ssid owe_transition_ifname
 
 			[ -n "$owe_transition_ssid" ] && append bss_conf "owe_transition_ssid=\"$owe_transition_ssid\"" "$N"
 			[ -n "$owe_transition_bssid" ] && append bss_conf "owe_transition_bssid=$owe_transition_bssid" "$N"
+			[ -n "$owe_transition_ifname" ] && append bss_conf "owe_transition_ifname=$owe_transition_ifname" "$N"
 
 			wps_possible=1
 			# Here we make the assumption that if we're in open mode
@@ -623,7 +660,15 @@ hostapd_set_bss_options() {
 		;;
 		psk|sae|psk-sae)
 			json_get_vars key wpa_psk_file
-			if [ ${#key} -eq 64 ]; then
+			if [ "$auth_type" = "psk" ] && [ "$ppsk" -ne 0 ] ; then
+				json_get_vars auth_server auth_secret auth_port
+				set_default auth_port 1812
+				append bss_conf "auth_server_addr=$auth_server" "$N"
+				append bss_conf "auth_server_port=$auth_port" "$N"
+				append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+				append bss_conf "macaddr_acl=2" "$N"
+				append bss_conf "wpa_psk_radius=2" "$N"
+			elif [ ${#key} -eq 64 ]; then
 				append bss_conf "wpa_psk=$key" "$N"
 			elif [ ${#key} -ge 8 ] && [ ${#key} -le 63 ]; then
 				append bss_conf "wpa_passphrase=$key" "$N"
@@ -647,7 +692,9 @@ hostapd_set_bss_options() {
 				auth_server auth_secret auth_port \
 				dae_client dae_secret dae_port \
 				ownip radius_client_addr \
-				eap_reauth_period request_cui
+				eap_reauth_period request_cui \
+				erp_domain mobility_domain \
+				fils_realm fils_dhcp
 
 			# radius can provide VLAN ID for clients
 			vlan_possible=1
@@ -657,6 +704,30 @@ hostapd_set_bss_options() {
 			[ -n "$auth_port" ] || json_get_var auth_port port
 			[ -n "$auth_secret" ] || json_get_var auth_secret key
 
+			[ "$fils" -gt 0 ] && {
+				set_default erp_domain "$mobility_domain"
+				set_default erp_domain "$(echo "$ssid" | md5sum | head -c 8)"
+				set_default fils_realm "$erp_domain"
+
+				append bss_conf "erp_send_reauth_start=1" "$N"
+				append bss_conf "erp_domain=$erp_domain" "$N"
+				append bss_conf "fils_realm=$fils_realm" "$N"
+				append bss_conf "fils_cache_id=$(echo "$fils_realm" | md5sum | head -c 4)" "$N"
+
+				[ "$fils_dhcp" = "*" ] && {
+					json_get_values network network
+					fils_dhcp=
+					for net in $network; do
+						fils_dhcp="$(ifstatus "$net" | jsonfilter -e '@.data.dhcpserver')"
+						[ -n "$fils_dhcp" ] && break
+					done
+
+					[ -z "$fils_dhcp" -a -n "$network_bridge" -a -n "$network_ifname" ] && \
+						fils_dhcp="$(udhcpc -B -n -q -s /lib/netifd/dhcp-get-server.sh -t 1 -i "$network_ifname" 2>/dev/null)"
+				}
+				[ -n "$fils_dhcp" ] && append bss_conf "dhcp_server=$fils_dhcp" "$N"
+			}
+
 			set_default auth_port 1812
 			set_default dae_port 3799
 			set_default request_cui 0
@@ -692,6 +763,25 @@ hostapd_set_bss_options() {
 		;;
 	esac
 
+	case "$auth_type" in
+		none|owe|psk|sae|psk-sae|wep)
+			json_get_vars \
+			auth_server auth_port auth_secret \
+			ownip radius_client_addr
+
+			[ -n "$auth_server" ] &&  {
+				set_default auth_port 1812
+
+				append bss_conf "auth_server_addr=$auth_server" "$N"
+				append bss_conf "auth_server_port=$auth_port" "$N"
+				[ -n "$auth_secret" ] && append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+				[ -n "$ownip" ] && append bss_conf "own_ip_addr=$ownip" "$N"
+				[ -n "$radius_client_addr" ] && append bss_conf "radius_client_addr=$radius_client_addr" "$N"
+				append bss_conf "macaddr_acl=2" "$N"
+			}
+		;;
+	esac
+
 	local auth_algs=$((($auth_mode_shared << 1) | $auth_mode_open))
 	append bss_conf "auth_algs=${auth_algs:-1}" "$N"
 	append bss_conf "wpa=$wpa" "$N"
@@ -754,10 +844,11 @@ hostapd_set_bss_options() {
 		append bss_conf "iapp_interface=$ifname" "$N"
 	}
 
-	json_get_vars time_advertisement time_zone wnm_sleep_mode wnm_sleep_mode_no_keys bss_transition
+	json_get_vars time_advertisement time_zone wnm_sleep_mode wnm_sleep_mode_no_keys bss_transition mbo
 	set_default bss_transition 0
 	set_default wnm_sleep_mode 0
 	set_default wnm_sleep_mode_no_keys 0
+	set_default mbo 0
 
 	[ -n "$time_advertisement" ] && append bss_conf "time_advertisement=$time_advertisement" "$N"
 	[ -n "$time_zone" ] && append bss_conf "time_zone=$time_zone" "$N"
@@ -766,6 +857,7 @@ hostapd_set_bss_options() {
 		[ "$wnm_sleep_mode_no_keys" -eq "1" ] && append bss_conf "wnm_sleep_mode_no_keys=1" "$N"
 	fi
 	[ "$bss_transition" -eq "1" ] && append bss_conf "bss_transition=1" "$N"
+	[ "$mbo" -eq 1 ] && append bss_conf "mbo=1" "$N"
 
 	json_get_vars ieee80211k rrm_neighbor_report rrm_beacon_report
 	set_default ieee80211k 0
@@ -828,10 +920,10 @@ hostapd_set_bss_options() {
 				set_default pmk_r1_push 0
 
 				[ -n "$r0kh" -a -n "$r1kh" ] || {
-					key=`echo -n "$mobility_domain/$auth_secret" | md5sum | awk '{print $1}'`
+					ft_key=`echo -n "$mobility_domain/${auth_secret:-${key}}" | md5sum | awk '{print $1}'`
 
-					set_default r0kh "ff:ff:ff:ff:ff:ff,*,$key"
-					set_default r1kh "00:00:00:00:00:00,00:00:00:00:00:00,$key"
+					set_default r0kh "ff:ff:ff:ff:ff:ff,*,$ft_key"
+					set_default r1kh "00:00:00:00:00:00,00:00:00:00:00:00,$ft_key"
 				}
 
 				[ -n "$r1_key_holder" ] && append bss_conf "r1_key_holder=$r1_key_holder" "$N"
@@ -846,6 +938,10 @@ hostapd_set_bss_options() {
 				done
 			fi
 		fi
+		if [ "$fils" -gt 0 ]; then
+			json_get_vars fils_realm
+			set_default fils_realm "$(echo "$ssid" | md5sum | head -c 8)"
+		fi
 
 		append bss_conf "wpa_disable_eapol_key_retries=$wpa_disable_eapol_key_retries" "$N"
 
@@ -870,7 +966,7 @@ hostapd_set_bss_options() {
 		fi
 
 		append bss_conf "okc=$auth_cache" "$N"
-		[ "$auth_cache" = 0 ] && append bss_conf "disable_pmksa_caching=1" "$N"
+		[ "$auth_cache" = 0 -a "$fils" = 0 ] && append bss_conf "disable_pmksa_caching=1" "$N"
 
 		# RSN -> allow management frame protection
 		case "$ieee80211w" in
@@ -878,7 +974,11 @@ hostapd_set_bss_options() {
 				json_get_vars ieee80211w_mgmt_cipher ieee80211w_max_timeout ieee80211w_retry_timeout
 				append bss_conf "ieee80211w=$ieee80211w" "$N"
 				[ "$ieee80211w" -gt "0" ] && {
-					append bss_conf "group_mgmt_cipher=${ieee80211w_mgmt_cipher:-AES-128-CMAC}" "$N"
+					if [ "$auth_type" = "eap192" ]; then
+						append bss_conf "group_mgmt_cipher=BIP-GMAC-256" "$N"
+					else
+						append bss_conf "group_mgmt_cipher=${ieee80211w_mgmt_cipher:-AES-128-CMAC}" "$N"
+					fi
 					[ -n "$ieee80211w_max_timeout" ] && \
 						append bss_conf "assoc_sa_query_max_timeout=$ieee80211w_max_timeout" "$N"
 					[ -n "$ieee80211w_retry_timeout" ] && \
@@ -1024,6 +1124,7 @@ hostapd_set_bss_options() {
 
 	if [ "$eap_server" = "1" ]; then
 		append bss_conf "eap_server=1" "$N"
+		append bss_conf "eap_server_erp=1" "$N"
 		[ -n "$eap_user_file" ] && append bss_conf "eap_user_file=$eap_user_file" "$N"
 		[ -n "$ca_cert" ] && append bss_conf "ca_cert=$ca_cert" "$N"
 		[ -n "$server_cert" ] && append bss_conf "server_cert=$server_cert" "$N"
@@ -1032,9 +1133,13 @@ hostapd_set_bss_options() {
 		[ -n "$server_id" ] && append bss_conf "server_id=$server_id" "$N"
 	fi
 
-	set_default multicast_to_unicast 0
-	if [ "$multicast_to_unicast" -gt 0 ]; then
-		append bss_conf "multicast_to_unicast=$multicast_to_unicast" "$N"
+	set_default multicast_to_unicast_all 0
+	if [ "$multicast_to_unicast_all" -gt 0 ]; then
+		append bss_conf "multicast_to_unicast=$multicast_to_unicast_all" "$N"
+	fi
+	set_default proxy_arp 0
+	if [ "$proxy_arp" -gt 0 ]; then
+		append bss_conf "proxy_arp=$proxy_arp" "$N"
 	fi
 
 	set_default per_sta_vif 0
@@ -1186,8 +1291,9 @@ wpa_supplicant_add_network() {
 	json_get_vars \
 		ssid bssid key \
 		basic_rate mcast_rate \
-		ieee80211w ieee80211r \
-		multi_ap
+		ieee80211w ieee80211r fils ocv \
+		multi_ap \
+		default_disabled
 
 	case "$auth_type" in
 		sae|owe|eap192|eap-eap192)
@@ -1200,6 +1306,7 @@ wpa_supplicant_add_network() {
 
 	set_default ieee80211r 0
 	set_default multi_ap 0
+	set_default default_disabled 0
 
 	local key_mgmt='NONE'
 	local network_data=
@@ -1231,7 +1338,12 @@ wpa_supplicant_add_network() {
 		scan_ssid=""
 	}
 
-	[ "$multi_ap" = 1 -a "$_w_mode" = "sta" ] && append network_data "multi_ap_backhaul_sta=1" "$N$T"
+	[ "$_w_mode" = "sta" ] && {
+		[ "$multi_ap" = 1 ] && append network_data "multi_ap_backhaul_sta=1" "$N$T"
+		[ "$default_disabled" = 1 ] && append network_data "disabled=1" "$N$T"
+	}
+
+	[ -n "$ocv" ] && append network_data "ocv=$ocv" "$N$T"
 
 	case "$auth_type" in
 		none) ;;
@@ -1273,6 +1385,7 @@ wpa_supplicant_add_network() {
 
 			json_get_vars eap_type identity anonymous_identity ca_cert ca_cert_usesystem
 
+			[ "$fils" -gt 0 ] && append network_data "erp=1" "$N$T"
 			if [ "$ca_cert_usesystem" -eq "1" -a -f "/etc/ssl/certs/ca-certificates.crt" ]; then
 				append network_data "ca_cert=\"/etc/ssl/certs/ca-certificates.crt\"" "$N$T"
 			else
diff --git a/package/network/services/hostapd/files/wpa_supplicant-basic.config b/package/network/services/hostapd/files/wpa_supplicant-basic.config
index c550b37b21..6abd8e2331 100644
--- a/package/network/services/hostapd/files/wpa_supplicant-basic.config
+++ b/package/network/services/hostapd/files/wpa_supplicant-basic.config
@@ -315,7 +315,7 @@ CONFIG_NO_LINUX_PACKET_SOCKET_WAR=y
 #CONFIG_IEEE80211W=y
 
 # Support Operating Channel Validation
-#CONFIG_OCV=y
+CONFIG_OCV=y
 
 # Select TLS implementation
 # openssl = OpenSSL (default)
diff --git a/package/network/services/hostapd/files/wpa_supplicant-full.config b/package/network/services/hostapd/files/wpa_supplicant-full.config
index b3e85d073d..d24fbbb01f 100644
--- a/package/network/services/hostapd/files/wpa_supplicant-full.config
+++ b/package/network/services/hostapd/files/wpa_supplicant-full.config
@@ -315,7 +315,7 @@ CONFIG_NO_LINUX_PACKET_SOCKET_WAR=y
 #CONFIG_IEEE80211W=y
 
 # Support Operating Channel Validation
-#CONFIG_OCV=y
+CONFIG_OCV=y
 
 # Select TLS implementation
 # openssl = OpenSSL (default)
@@ -578,7 +578,7 @@ CONFIG_HS20=y
 #CONFIG_MBO=y
 
 # Fast Initial Link Setup (FILS) (IEEE 802.11ai)
-#CONFIG_FILS=y
+CONFIG_FILS=y
 # FILS shared key authentication with PFS
 #CONFIG_FILS_SK_PFS=y
 
diff --git a/package/network/services/hostapd/files/wpa_supplicant-p2p.config b/package/network/services/hostapd/files/wpa_supplicant-p2p.config
index b00847a256..0dcc88e648 100644
--- a/package/network/services/hostapd/files/wpa_supplicant-p2p.config
+++ b/package/network/services/hostapd/files/wpa_supplicant-p2p.config
@@ -578,7 +578,7 @@ CONFIG_P2P=y
 #CONFIG_MBO=y
 
 # Fast Initial Link Setup (FILS) (IEEE 802.11ai)
-#CONFIG_FILS=y
+CONFIG_FILS=y
 # FILS shared key authentication with PFS
 #CONFIG_FILS_SK_PFS=y
 
@@ -622,4 +622,4 @@ CONFIG_UBUS=y
 # OpenWrt patch 380-disable-ctrl-iface-mib.patch
 # leads to the MIB only being compiled in if
 # CONFIG_CTRL_IFACE_MIB is enabled.
-#CONFIG_CTRL_IFACE_MIB=y
+CONFIG_CTRL_IFACE_MIB=y
diff --git a/package/network/services/hostapd/files/wps-hotplug.sh b/package/network/services/hostapd/files/wps-hotplug.sh
index d00939d769..073bdd1868 100644
--- a/package/network/services/hostapd/files/wps-hotplug.sh
+++ b/package/network/services/hostapd/files/wps-hotplug.sh
@@ -38,13 +38,20 @@ wps_catch_credentials() {
 	done
 }
 
-if [ "$ACTION" = "pressed" -a "$BUTTON" = "wps" ]; then
-	wps_done=0
-	ubusobjs="$( ubus -S list hostapd.* )"
-	for ubusobj in $ubusobjs; do
-		ubus -S call $ubusobj wps_start && wps_done=1
-	done
-	[ $wps_done = 0 ] || return 0
+if [ "$ACTION" = "released" ] && [ "$BUTTON" = "wps" ]; then
+	# If the button was pressed for 3 seconds or more, trigger WPS on
+	# wpa_supplicant only, no matter if hostapd is running or not.  If
+	# was pressed for less than 3 seconds, try triggering on
+	# hostapd. If there is no hostapd instance to trigger it on or WPS
+	# is not enabled on them, trigger it on wpa_supplicant.
+	if [ "$SEEN" -lt 3 ] ; then
+		wps_done=0
+		ubusobjs="$( ubus -S list hostapd.* )"
+		for ubusobj in $ubusobjs; do
+			ubus -S call $ubusobj wps_start && wps_done=1
+		done
+		[ $wps_done = 0 ] || return 0
+	fi
 	wps_done=0
 	ubusobjs="$( ubus -S list wpa_supplicant.* )"
 	for ubusobj in $ubusobjs; do
diff --git a/package/network/services/hostapd/patches/001-HE-VHT-fix-frequency-setup-with-HE-enabled.patch b/package/network/services/hostapd/patches/001-HE-VHT-fix-frequency-setup-with-HE-enabled.patch
deleted file mode 100644
index 37c17c50af..0000000000
--- a/package/network/services/hostapd/patches/001-HE-VHT-fix-frequency-setup-with-HE-enabled.patch
+++ /dev/null
@@ -1,196 +0,0 @@
-From 91976250359b263a44861aebe553b20627fe487e Mon Sep 17 00:00:00 2001
-From: Markus Theil <markus.theil@tu-ilmenau.de>
-Date: Tue, 30 Jun 2020 13:53:17 +0200
-Subject: [PATCH 01/19] HE/VHT: fix frequency setup with HE enabled
-
-Some places in the code base were not using the
-wrappers like hostapd_set_oper_centr_freq_seg0_idx
-and friends. This could lead to errors, for example when
-joining 80 MHz mesh networks. Fix this, by enforcing
-usage of these wrappers.
-
-wpa_supplicant_conf_ap_ht now checks for HE capability
-before dealing with VHT in order for these wrappers to work,
-as they first check HE support in the config.
-
-While doing these changes, I've noticed that the extra
-channel setup code for mesh networks in wpa_supplicant/mesh.c
-should not be necessary anymore and dropped it.
-wpa_supplicant_conf_ap_ht should handle this setup already.
-
-Acked-by: John Crispin <john@phrozen.org>
-Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
----
- src/ap/dfs.c          |  8 ++++----
- wpa_supplicant/ap.c   | 40 +++++++++++++++++++++++-----------------
- wpa_supplicant/mesh.c | 24 ------------------------
- 3 files changed, 27 insertions(+), 45 deletions(-)
-
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -1028,7 +1028,7 @@ static int hostapd_dfs_start_channel_swi
- 	unsigned int i;
- 	int err = 1;
- 	struct hostapd_hw_modes *cmode = iface->current_mode;
--	u8 current_vht_oper_chwidth = iface->conf->vht_oper_chwidth;
-+	u8 current_vht_oper_chwidth = hostapd_get_oper_chwidth(iface->conf);
- 
- 	wpa_printf(MSG_DEBUG, "%s called (CAC active: %s, CSA active: %s)",
- 		   __func__, iface->cac_started ? "yes" : "no",
-@@ -1089,8 +1089,8 @@ static int hostapd_dfs_start_channel_swi
- 		"freq=%d chan=%d sec_chan=%d", channel->freq,
- 		channel->chan, secondary_channel);
- 
--	new_vht_oper_chwidth = iface->conf->vht_oper_chwidth;
--	iface->conf->vht_oper_chwidth = current_vht_oper_chwidth;
-+	new_vht_oper_chwidth = hostapd_get_oper_chwidth(iface->conf);
-+	hostapd_set_oper_chwidth(iface->conf, current_vht_oper_chwidth);
- 
- 	/* Setup CSA request */
- 	os_memset(&csa_settings, 0, sizeof(csa_settings));
-@@ -1130,7 +1130,7 @@ static int hostapd_dfs_start_channel_swi
- 		iface->freq = channel->freq;
- 		iface->conf->channel = channel->chan;
- 		iface->conf->secondary_channel = secondary_channel;
--		iface->conf->vht_oper_chwidth = new_vht_oper_chwidth;
-+		hostapd_set_oper_chwidth(iface->conf, new_vht_oper_chwidth);
- 		hostapd_set_oper_centr_freq_seg0_idx(iface->conf,
- 						     oper_centr_freq_seg0_idx);
- 		hostapd_set_oper_centr_freq_seg1_idx(iface->conf,
---- a/wpa_supplicant/ap.c
-+++ b/wpa_supplicant/ap.c
-@@ -52,6 +52,7 @@ static void wpas_conf_ap_vht(struct wpa_
- #ifdef CONFIG_P2P
- 	u8 center_chan = 0;
- 	u8 channel = conf->channel;
-+	u8 freq_seg_idx;
- #endif /* CONFIG_P2P */
- 
- 	if (!conf->secondary_channel)
-@@ -59,19 +60,21 @@ static void wpas_conf_ap_vht(struct wpa_
- 
- 	/* Use the maximum oper channel width if it's given. */
- 	if (ssid->max_oper_chwidth)
--		conf->vht_oper_chwidth = ssid->max_oper_chwidth;
-+		hostapd_set_oper_chwidth(conf, ssid->max_oper_chwidth);
- 
- 	ieee80211_freq_to_chan(ssid->vht_center_freq2,
--			       &conf->vht_oper_centr_freq_seg1_idx);
-+			       &freq_seg_idx);
-+	hostapd_set_oper_centr_freq_seg1_idx(conf, freq_seg_idx);
- 
- 	if (!ssid->p2p_group) {
- 		if (!ssid->vht_center_freq1 ||
--		    conf->vht_oper_chwidth == CHANWIDTH_USE_HT)
-+		    hostapd_get_oper_chwidth(conf) == CHANWIDTH_USE_HT)
- 			goto no_vht;
- 		ieee80211_freq_to_chan(ssid->vht_center_freq1,
--				       &conf->vht_oper_centr_freq_seg0_idx);
-+				       &freq_seg_idx);
-+		hostapd_set_oper_centr_freq_seg0_idx(conf, freq_seg_idx);
- 		wpa_printf(MSG_DEBUG, "VHT seg0 index %d for AP",
--			   conf->vht_oper_centr_freq_seg0_idx);
-+			   hostapd_get_oper_centr_freq_seg0_idx(conf));
- 		return;
- 	}
- 
-@@ -96,14 +99,14 @@ static void wpas_conf_ap_vht(struct wpa_
- 		 * try oper_cwidth 160 MHz first then VHT 80 MHz, if 160 MHz is
- 		 * not supported.
- 		 */
--		conf->vht_oper_chwidth = CHANWIDTH_160MHZ;
-+		hostapd_set_oper_chwidth(conf, CHANWIDTH_160MHZ);
- 		center_chan = wpas_p2p_get_vht160_center(wpa_s, mode, channel);
- 		if (center_chan) {
- 			wpa_printf(MSG_DEBUG,
- 				   "VHT center channel %u for auto-selected 160 MHz bandwidth",
- 				   center_chan);
- 		} else {
--			conf->vht_oper_chwidth = CHANWIDTH_80MHZ;
-+			hostapd_set_oper_chwidth(conf, CHANWIDTH_80MHZ);
- 			center_chan = wpas_p2p_get_vht80_center(wpa_s, mode,
- 								channel);
- 			wpa_printf(MSG_DEBUG,
-@@ -115,9 +118,9 @@ static void wpas_conf_ap_vht(struct wpa_
- 	if (!center_chan)
- 		goto no_vht;
- 
--	conf->vht_oper_centr_freq_seg0_idx = center_chan;
-+	hostapd_set_oper_centr_freq_seg0_idx(conf, center_chan);
- 	wpa_printf(MSG_DEBUG, "VHT seg0 index %d for P2P GO",
--		   conf->vht_oper_centr_freq_seg0_idx);
-+		   hostapd_get_oper_centr_freq_seg0_idx(conf));
- 	return;
- #endif /* CONFIG_P2P */
- 
-@@ -125,9 +128,9 @@ no_vht:
- 	wpa_printf(MSG_DEBUG,
- 		   "No VHT higher bandwidth support for the selected channel %d",
- 		   conf->channel);
--	conf->vht_oper_centr_freq_seg0_idx =
--		conf->channel + conf->secondary_channel * 2;
--	conf->vht_oper_chwidth = CHANWIDTH_USE_HT;
-+	hostapd_set_oper_centr_freq_seg0_idx(conf,
-+					     conf->channel + conf->secondary_channel * 2);
-+	hostapd_set_oper_chwidth(conf, CHANWIDTH_USE_HT);
- }
- 
- 
-@@ -231,16 +234,19 @@ int wpa_supplicant_conf_ap_ht(struct wpa
- 				 HT_CAP_INFO_TX_STBC |
- 				 HT_CAP_INFO_MAX_AMSDU_SIZE);
- 
-+			/* check this before VHT, because setting oper chan
-+			 * width and friends is the same call for HE and VHT
-+			 * and checks if conf->ieee8021ax == 1 */
-+			if (mode->he_capab[wpas_mode_to_ieee80211_mode(
-+					    ssid->mode)].he_supported &&
-+			    ssid->he)
-+				conf->ieee80211ax = 1;
-+
- 			if (mode->vht_capab && ssid->vht) {
- 				conf->ieee80211ac = 1;
- 				conf->vht_capab |= mode->vht_capab;
- 				wpas_conf_ap_vht(wpa_s, ssid, conf, mode);
- 			}
--
--			if (mode->he_capab[wpas_mode_to_ieee80211_mode(
--					    ssid->mode)].he_supported &&
--			    ssid->he)
--				conf->ieee80211ax = 1;
- 		}
- 	}
- 
---- a/wpa_supplicant/mesh.c
-+++ b/wpa_supplicant/mesh.c
-@@ -333,30 +333,6 @@ static int wpa_supplicant_mesh_init(stru
- 			   frequency);
- 		goto out_free;
- 	}
--	if (ssid->ht40)
--		conf->secondary_channel = ssid->ht40;
--	if (conf->hw_mode == HOSTAPD_MODE_IEEE80211A && ssid->vht) {
--		if (ssid->max_oper_chwidth != DEFAULT_MAX_OPER_CHWIDTH)
--			conf->vht_oper_chwidth = ssid->max_oper_chwidth;
--		switch (conf->vht_oper_chwidth) {
--		case CHANWIDTH_80MHZ:
--		case CHANWIDTH_80P80MHZ:
--			ieee80211_freq_to_chan(
--				frequency,
--				&conf->vht_oper_centr_freq_seg0_idx);
--			conf->vht_oper_centr_freq_seg0_idx += ssid->ht40 * 2;
--			break;
--		case CHANWIDTH_160MHZ:
--			ieee80211_freq_to_chan(
--				frequency,
--				&conf->vht_oper_centr_freq_seg0_idx);
--			conf->vht_oper_centr_freq_seg0_idx += ssid->ht40 * 2;
--			conf->vht_oper_centr_freq_seg0_idx += 40 / 5;
--			break;
--		}
--		ieee80211_freq_to_chan(ssid->vht_center_freq2,
--				       &conf->vht_oper_centr_freq_seg1_idx);
--	}
- 
- 	if (ssid->mesh_basic_rates == NULL) {
- 		/*
diff --git a/package/network/services/hostapd/patches/802-wolfssl-init-RNG-with-ECC-key.patch b/package/network/services/hostapd/patches/001-wolfssl-init-RNG-with-ECC-key.patch
similarity index 85%
rename from package/network/services/hostapd/patches/802-wolfssl-init-RNG-with-ECC-key.patch
rename to package/network/services/hostapd/patches/001-wolfssl-init-RNG-with-ECC-key.patch
index 84fc1c9351..994aa30626 100644
--- a/package/network/services/hostapd/patches/802-wolfssl-init-RNG-with-ECC-key.patch
+++ b/package/network/services/hostapd/patches/001-wolfssl-init-RNG-with-ECC-key.patch
@@ -16,7 +16,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/src/crypto/crypto_wolfssl.c
 +++ b/src/crypto/crypto_wolfssl.c
-@@ -1303,6 +1303,7 @@ int ecc_projective_add_point(ecc_point *
+@@ -1307,6 +1307,7 @@ int ecc_projective_add_point(ecc_point *
  
  struct crypto_ec {
  	ecc_key key;
@@ -24,7 +24,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  	mp_int a;
  	mp_int prime;
  	mp_int order;
-@@ -1357,6 +1358,8 @@ struct crypto_ec * crypto_ec_init(int gr
+@@ -1361,6 +1362,8 @@ struct crypto_ec * crypto_ec_init(int gr
  		return NULL;
  
  	if (wc_ecc_init(&e->key) != 0 ||
@@ -33,7 +33,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  	    wc_ecc_set_curve(&e->key, 0, curve_id) != 0 ||
  	    mp_init(&e->a) != MP_OKAY ||
  	    mp_init(&e->prime) != MP_OKAY ||
-@@ -1388,6 +1391,7 @@ void crypto_ec_deinit(struct crypto_ec*
+@@ -1392,6 +1395,7 @@ void crypto_ec_deinit(struct crypto_ec*
  	mp_clear(&e->order);
  	mp_clear(&e->prime);
  	mp_clear(&e->a);
diff --git a/package/network/services/hostapd/patches/002-mesh-fix-channel-init-order-disable-pri-sec-channel-.patch b/package/network/services/hostapd/patches/002-mesh-fix-channel-init-order-disable-pri-sec-channel-.patch
deleted file mode 100644
index c7101b1dbc..0000000000
--- a/package/network/services/hostapd/patches/002-mesh-fix-channel-init-order-disable-pri-sec-channel-.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-From d869c753b79a1423c2bd9b0afdfa0d89d55a930c Mon Sep 17 00:00:00 2001
-From: Markus Theil <markus.theil@tu-ilmenau.de>
-Date: Tue, 30 Jun 2020 13:53:18 +0200
-Subject: [PATCH 02/19] mesh: fix channel init order, disable pri/sec channel
- switch
-
-wpa_supplicant_conf_ap_ht has to happen before hostapd_setup_interface
-in order for its configuration settings to have effect on interface
-configuration.
-
-Disable primary and secondary channel switch because of missing tie
-breaking rule/frames in mesh networks. A rather long comment about
-this issue is placed in mesh.c in the corresponding place.
-
-In consequence, remove mesh coex test, which contradicts this change.
-
-I was not able to reproduce the memory corruption during
-mesh_secure_ocv_mix_legacy, which lead to a revert of a similar patch
-in the past.
-
-Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
----
- tests/hwsim/test_wpas_mesh.py | 50 -----------------------------------
- wpa_supplicant/mesh.c         | 25 ++++++++++++++++--
- 2 files changed, 23 insertions(+), 52 deletions(-)
-
---- a/tests/hwsim/test_wpas_mesh.py
-+++ b/tests/hwsim/test_wpas_mesh.py
-@@ -933,56 +933,6 @@ def _test_wpas_mesh_open_5ghz(dev, apdev
-     dev[0].dump_monitor()
-     dev[1].dump_monitor()
- 
--def test_wpas_mesh_open_5ghz_coex(dev, apdev):
--    """Mesh network on 5 GHz band and 20/40 coex change"""
--    try:
--        _test_wpas_mesh_open_5ghz_coex(dev, apdev)
--    finally:
--        dev[0].request("MESH_GROUP_REMOVE " + dev[0].ifname)
--        dev[1].request("MESH_GROUP_REMOVE " + dev[1].ifname)
--        set_world_reg(apdev0=apdev[0], dev0=dev[0])
--        dev[0].flush_scan_cache()
--        dev[1].flush_scan_cache()
--
--def _test_wpas_mesh_open_5ghz_coex(dev, apdev):
--    check_mesh_support(dev[0])
--    subprocess.call(['iw', 'reg', 'set', 'US'])
--
--    # Start a 20 MHz BSS on channel 40 that would be the secondary channel of
--    # HT40+ mesh on channel 36.
--    params = {"ssid": "test-ht40",
--              "hw_mode": "a",
--              "channel": "40",
--              "country_code": "US"}
--    hapd = hostapd.add_ap(apdev[0], params)
--    bssid = hapd.own_addr()
--
--    for i in range(2):
--        for j in range(5):
--            ev = dev[i].wait_event(["CTRL-EVENT-REGDOM-CHANGE"], timeout=5)
--            if ev is None:
--                raise Exception("No regdom change event")
--            if "alpha2=US" in ev:
--                break
--        dev[i].scan_for_bss(bssid, freq=5200)
--        add_open_mesh_network(dev[i], freq="5180")
--
--    check_mesh_joined_connected(dev)
--
--    freq = dev[0].get_status_field("freq")
--    if freq != "5200":
--        raise Exception("Unexpected STATUS freq=" + freq)
--    sig = dev[0].request("SIGNAL_POLL").splitlines()
--    if "FREQUENCY=5200" not in sig:
--        raise Exception("Unexpected SIGNAL_POLL output: " + str(sig))
--
--    hapd.disable()
--    dev[0].mesh_group_remove()
--    dev[1].mesh_group_remove()
--    check_mesh_group_removed(dev[0])
--    check_mesh_group_removed(dev[1])
--    dev[0].dump_monitor()
--    dev[1].dump_monitor()
- 
- def test_wpas_mesh_open_ht40(dev, apdev):
-     """Mesh and HT40 support difference"""
---- a/wpa_supplicant/mesh.c
-+++ b/wpa_supplicant/mesh.c
-@@ -363,6 +363,29 @@ static int wpa_supplicant_mesh_init(stru
- 		conf->basic_rates[rate_len] = -1;
- 	}
- 
-+	/* While it can enhance performance to switch the primary channel, which
-+	 * is also the secondary channel of another network at the same time),
-+	 * to the other primary channel, problems exist with this in mesh networks.
-+	 *
-+	 * Example with problems:
-+	 *     - 3 mesh nodes M1-M3, freq (5200, 5180)
-+	 *     - other node O1, e.g. AP mode, freq (5180, 5200),
-+	 * Locations: O1 M1      M2      M3
-+	 *
-+	 * M3 can only send frames to M1 over M2, no direct connection is possible
-+	 * Start O1, M1 and M3 first, M1 or O1 will switch channels to align with
-+	 * each other. M3 does not swap, because M1 or O1 cannot be reached.
-+	 * M2 is started afterwards and can either connect to M3 or M1 because of
-+	 * this primary secondary channel switch.
-+	 *
-+	 * Solutions: (1) central coordination -> not always possible
-+	 *            (2) disable pri/sec channel switch in mesh networks
-+	 *
-+	 * In AP mode, when all nodes can work independently, this poses of course
-+	 * no problem, therefore disable it only in mesh mode.`*/
-+	conf->no_pri_sec_switch = 1;
-+	wpa_supplicant_conf_ap_ht(wpa_s, ssid, conf);
-+
- 	if (wpa_drv_init_mesh(wpa_s)) {
- 		wpa_msg(wpa_s, MSG_ERROR, "Failed to init mesh in driver");
- 		return -1;
-@@ -374,8 +397,6 @@ static int wpa_supplicant_mesh_init(stru
- 		return -1;
- 	}
- 
--	wpa_supplicant_conf_ap_ht(wpa_s, ssid, conf);
--
- 	return 0;
- out_free:
- 	wpa_supplicant_mesh_deinit(wpa_s);
diff --git a/package/network/services/hostapd/patches/003-wpa_supplicant-handle-HT40-and-mode-downgrade-in-AP-.patch b/package/network/services/hostapd/patches/003-wpa_supplicant-handle-HT40-and-mode-downgrade-in-AP-.patch
deleted file mode 100644
index f42620042d..0000000000
--- a/package/network/services/hostapd/patches/003-wpa_supplicant-handle-HT40-and-mode-downgrade-in-AP-.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From 978a59514ccde994b5c06e1cbb49cc8cebe6381c Mon Sep 17 00:00:00 2001
-From: Markus Theil <markus.theil@tu-ilmenau.de>
-Date: Tue, 30 Jun 2020 13:53:19 +0200
-Subject: [PATCH 03/19] wpa_supplicant: handle HT40 and mode downgrade in AP
- mode
-
-This patch adds some missing pieces to the interface configuration
-of AP/mesh mode in wpa_supplicant.
- - check for secondary channel and HT40 capability
- - try to downgrade to 11b if 11g is not available
-Especially with the HT40 check, this code now performs all settings,
-which the deleted/duplicated mesh code did.
-
-Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
----
- wpa_supplicant/ap.c | 49 ++++++++++++++++++++++++++++++++++++---------
- 1 file changed, 40 insertions(+), 9 deletions(-)
-
---- a/wpa_supplicant/ap.c
-+++ b/wpa_supplicant/ap.c
-@@ -134,6 +134,23 @@ no_vht:
- }
- 
- 
-+static struct hostapd_hw_modes *wpa_supplicant_find_hw_mode(struct wpa_supplicant *wpa_s,
-+							    enum hostapd_hw_mode hw_mode)
-+{
-+	struct hostapd_hw_modes *mode = NULL;
-+	int i;
-+
-+	for (i = 0; i < wpa_s->hw.num_modes; i++) {
-+		if (wpa_s->hw.modes[i].mode == hw_mode) {
-+			mode = &wpa_s->hw.modes[i];
-+			break;
-+		}
-+	}
-+
-+	return mode;
-+}
-+
-+
- int wpa_supplicant_conf_ap_ht(struct wpa_supplicant *wpa_s,
- 			      struct wpa_ssid *ssid,
- 			      struct hostapd_config *conf)
-@@ -147,9 +164,6 @@ int wpa_supplicant_conf_ap_ht(struct wpa
- 		return -1;
- 	}
- 
--	/* TODO: enable HT40 if driver supports it;
--	 * drop to 11b if driver does not support 11g */
--
- 	/*
- 	 * Enable HT20 if the driver supports it, by setting conf->ieee80211n
- 	 * and a mask of allowed capabilities within conf->ht_capab.
-@@ -158,17 +172,27 @@ int wpa_supplicant_conf_ap_ht(struct wpa
- 	 */
- 	if (wpa_s->hw.modes) {
- 		struct hostapd_hw_modes *mode = NULL;
--		int i, no_ht = 0;
-+		int no_ht = 0;
- 
- 		wpa_printf(MSG_DEBUG,
- 			   "Determining HT/VHT options based on driver capabilities (freq=%u chan=%u)",
- 			   ssid->frequency, conf->channel);
- 
--		for (i = 0; i < wpa_s->hw.num_modes; i++) {
--			if (wpa_s->hw.modes[i].mode == conf->hw_mode) {
--				mode = &wpa_s->hw.modes[i];
--				break;
--			}
-+		mode = wpa_supplicant_find_hw_mode(wpa_s, conf->hw_mode);
-+
-+		/* may drop drop to 11b if driver does not support 11g */
-+		if (!mode && conf->hw_mode == HOSTAPD_MODE_IEEE80211G) {
-+			conf->hw_mode = HOSTAPD_MODE_IEEE80211B;
-+			wpa_printf(MSG_INFO,
-+			   "Try downgrade to IEEE 802.11b as 802.11g is not "
-+			   "supported by the current hardware");
-+			mode = wpa_supplicant_find_hw_mode(wpa_s, conf->hw_mode);
-+		}
-+
-+		if (!mode) {
-+			wpa_printf(MSG_ERROR,
-+			   "No match between requested and supported hw modes found");
-+			return -1;
- 		}
- 
- #ifdef CONFIG_HT_OVERRIDES
-@@ -193,6 +217,13 @@ int wpa_supplicant_conf_ap_ht(struct wpa
- 				      HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET),
- 				   ssid->ht40);
- 			conf->ieee80211n = 1;
-+
-+			if (ssid->ht40 &&
-+			    mode->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
-+				conf->secondary_channel = ssid->ht40;
-+			else
-+				conf->secondary_channel = 0;
-+
- #ifdef CONFIG_P2P
- 			if (ssid->p2p_group &&
- 			    conf->hw_mode == HOSTAPD_MODE_IEEE80211A &&
diff --git a/package/network/services/hostapd/patches/004-wpa_supplicant-fix-frequency-config-for-non-p2p-vht-.patch b/package/network/services/hostapd/patches/004-wpa_supplicant-fix-frequency-config-for-non-p2p-vht-.patch
deleted file mode 100644
index e8682af644..0000000000
--- a/package/network/services/hostapd/patches/004-wpa_supplicant-fix-frequency-config-for-non-p2p-vht-.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 7f7325dae1d03a3964d4e91940d8369f3fed7b43 Mon Sep 17 00:00:00 2001
-From: Markus Theil <markus.theil@tu-ilmenau.de>
-Date: Tue, 30 Jun 2020 13:53:20 +0200
-Subject: [PATCH 04/19] wpa_supplicant: fix frequency config for non p2p vht/he
- cases
-
-Fix compile without CONFIG_P2P and only set secondary channel seg idx
-if we use a mode supporting a sec channel for vht/he.
-
-Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
----
- wpa_supplicant/ap.c | 23 +++++++++++++----------
- 1 file changed, 13 insertions(+), 10 deletions(-)
-
---- a/wpa_supplicant/ap.c
-+++ b/wpa_supplicant/ap.c
-@@ -52,8 +52,8 @@ static void wpas_conf_ap_vht(struct wpa_
- #ifdef CONFIG_P2P
- 	u8 center_chan = 0;
- 	u8 channel = conf->channel;
--	u8 freq_seg_idx;
- #endif /* CONFIG_P2P */
-+	u8 freq_seg_idx;
- 
- 	if (!conf->secondary_channel)
- 		goto no_vht;
-@@ -62,24 +62,27 @@ static void wpas_conf_ap_vht(struct wpa_
- 	if (ssid->max_oper_chwidth)
- 		hostapd_set_oper_chwidth(conf, ssid->max_oper_chwidth);
- 
--	ieee80211_freq_to_chan(ssid->vht_center_freq2,
--			       &freq_seg_idx);
--	hostapd_set_oper_centr_freq_seg1_idx(conf, freq_seg_idx);
--
- 	if (!ssid->p2p_group) {
--		if (!ssid->vht_center_freq1 ||
--		    hostapd_get_oper_chwidth(conf) == CHANWIDTH_USE_HT)
-+		if (!ssid->vht_center_freq1)
- 			goto no_vht;
- 		ieee80211_freq_to_chan(ssid->vht_center_freq1,
- 				       &freq_seg_idx);
- 		hostapd_set_oper_centr_freq_seg0_idx(conf, freq_seg_idx);
--		wpa_printf(MSG_DEBUG, "VHT seg0 index %d for AP",
--			   hostapd_get_oper_centr_freq_seg0_idx(conf));
-+
-+		if (hostapd_get_oper_chwidth(conf) == CHANWIDTH_80P80MHZ) {
-+			ieee80211_freq_to_chan(ssid->vht_center_freq2,
-+					       &freq_seg_idx);
-+			hostapd_set_oper_centr_freq_seg1_idx(conf, freq_seg_idx);
-+		}
-+
-+		wpa_printf(MSG_DEBUG, "VHT seg0 index %d and seg1 index %d for AP",
-+			   hostapd_get_oper_centr_freq_seg0_idx(conf),
-+			   hostapd_get_oper_centr_freq_seg1_idx(conf));
- 		return;
- 	}
- 
- #ifdef CONFIG_P2P
--	switch (conf->vht_oper_chwidth) {
-+	switch (hostapd_get_oper_chwidth(conf)) {
- 	case CHANWIDTH_80MHZ:
- 	case CHANWIDTH_80P80MHZ:
- 		center_chan = wpas_p2p_get_vht80_center(wpa_s, mode, channel);
diff --git a/package/network/services/hostapd/patches/005-wpa_supplicant-enable-vht-and-he-in-default-config-p.patch b/package/network/services/hostapd/patches/005-wpa_supplicant-enable-vht-and-he-in-default-config-p.patch
deleted file mode 100644
index 25d74252cd..0000000000
--- a/package/network/services/hostapd/patches/005-wpa_supplicant-enable-vht-and-he-in-default-config-p.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From ff7fb3fa0831c8521327d777c5607a3b7d8736b8 Mon Sep 17 00:00:00 2001
-From: Markus Theil <markus.theil@tu-ilmenau.de>
-Date: Tue, 30 Jun 2020 13:53:21 +0200
-Subject: [PATCH 05/19] wpa_supplicant: enable vht and he in default config
- parameters
-
-Enable VHT and HE as default config parameters in order for
-wpa_supplicant AP mode to use it, if hw support is given.
-
-Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
----
- wpa_supplicant/config.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/wpa_supplicant/config.c
-+++ b/wpa_supplicant/config.c
-@@ -3036,6 +3036,8 @@ void wpa_config_set_network_defaults(str
- 	ssid->wpa_deny_ptk0_rekey = PTK0_REKEY_ALLOW_ALWAYS;
- 	ssid->bg_scan_period = DEFAULT_BG_SCAN_PERIOD;
- 	ssid->ht = 1;
-+	ssid->vht = 1;
-+	ssid->he = 1;
- #ifdef IEEE8021X_EAPOL
- 	ssid->eapol_flags = DEFAULT_EAPOL_FLAGS;
- 	ssid->eap_workaround = DEFAULT_EAP_WORKAROUND;
diff --git a/package/network/services/hostapd/patches/006-hw_features-better-debug-messages-for-some-error-cas.patch b/package/network/services/hostapd/patches/006-hw_features-better-debug-messages-for-some-error-cas.patch
deleted file mode 100644
index 31b1ac0d38..0000000000
--- a/package/network/services/hostapd/patches/006-hw_features-better-debug-messages-for-some-error-cas.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 6522dcbbcf71abcb80cce84b93b4a9a5cfcd4fca Mon Sep 17 00:00:00 2001
-From: Markus Theil <markus.theil@tu-ilmenau.de>
-Date: Tue, 30 Jun 2020 13:53:22 +0200
-Subject: [PATCH 06/19] hw_features: better debug messages for some error cases
-
-Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
----
- src/common/hw_features_common.c | 29 ++++++++++++++++++++++-------
- 1 file changed, 22 insertions(+), 7 deletions(-)
-
---- a/src/common/hw_features_common.c
-+++ b/src/common/hw_features_common.c
-@@ -540,13 +540,18 @@ int hostapd_set_freq_params(struct hosta
- 		if (center_segment1 ||
- 		    (center_segment0 != 0 &&
- 		     5000 + center_segment0 * 5 != data->center_freq1 &&
--		     2407 + center_segment0 * 5 != data->center_freq1))
-+		     2407 + center_segment0 * 5 != data->center_freq1)) {
-+			wpa_printf(MSG_ERROR, "20/40 MHz: center segment 0 (=%i) and center freq 1 (=%i) not in sync",
-+				   center_segment0, data->center_freq1);
- 			return -1;
-+		}
- 		break;
- 	case CHANWIDTH_80P80MHZ:
- 		if (center_segment1 == center_segment0 + 4 ||
--		    center_segment1 == center_segment0 - 4)
-+		    center_segment1 == center_segment0 - 4) {
-+			wpa_printf(MSG_ERROR, "80+80 MHz: center segment 1 only 20 MHz apart");
- 			return -1;
-+		}
- 		data->center_freq2 = 5000 + center_segment1 * 5;
- 		/* fall through */
- 	case CHANWIDTH_80MHZ:
-@@ -555,8 +560,10 @@ int hostapd_set_freq_params(struct hosta
- 		     center_segment1) ||
- 		    (oper_chwidth == CHANWIDTH_80P80MHZ &&
- 		     !center_segment1) ||
--		    !sec_channel_offset)
-+		    !sec_channel_offset) {
-+			wpa_printf(MSG_ERROR, "80/80+80 MHz: center segment 1 wrong or no second channel offset");
- 			return -1;
-+		}
- 		if (!center_segment0) {
- 			if (channel <= 48)
- 				center_segment0 = 42;
-@@ -582,16 +589,22 @@ int hostapd_set_freq_params(struct hosta
- 			    center_segment0 == channel - 2 ||
- 			    center_segment0 == channel - 6)
- 				data->center_freq1 = 5000 + center_segment0 * 5;
--			else
-+			else {
-+				wpa_printf(MSG_ERROR, "Wrong coupling between HT and VHT/HE channel setting");
- 				return -1;
-+			}
- 		}
- 		break;
- 	case CHANWIDTH_160MHZ:
- 		data->bandwidth = 160;
--		if (center_segment1)
-+		if (center_segment1) {
-+			wpa_printf(MSG_ERROR, "160 MHz: center segment 1 should not be set");
- 			return -1;
--		if (!sec_channel_offset)
-+		}
-+		if (!sec_channel_offset) {
-+			wpa_printf(MSG_ERROR, "160 MHz: second channel offset not set");
- 			return -1;
-+		}
- 		/*
- 		 * Note: HT/VHT config and params are coupled. Check if
- 		 * HT40 channel band is in VHT160 channel band configuration.
-@@ -605,8 +618,10 @@ int hostapd_set_freq_params(struct hosta
- 		    center_segment0 == channel - 10 ||
- 		    center_segment0 == channel - 14)
- 			data->center_freq1 = 5000 + center_segment0 * 5;
--		else
-+		else {
-+			wpa_printf(MSG_ERROR, "160 MHz: HT40 channel band is not in 160 MHz band");
- 			return -1;
-+		}
- 		break;
- 	}
- 
diff --git a/package/network/services/hostapd/patches/007-dfs-use-helper-functions-for-vht-he-parameters.patch b/package/network/services/hostapd/patches/007-dfs-use-helper-functions-for-vht-he-parameters.patch
deleted file mode 100644
index 3481c52eef..0000000000
--- a/package/network/services/hostapd/patches/007-dfs-use-helper-functions-for-vht-he-parameters.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 6eacc14904b6f09a1490e697c01adf5dc56c4905 Mon Sep 17 00:00:00 2001
-From: Markus Theil <markus.theil@tu-ilmenau.de>
-Date: Tue, 30 Jun 2020 13:53:23 +0200
-Subject: [PATCH 07/19] dfs: use helper functions for vht/he parameters
-
-Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
----
- src/ap/dfs.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -955,10 +955,12 @@ dfs_downgrade_bandwidth(struct hostapd_i
- 		if (*skip_radar) {
- 			*skip_radar = 0;
- 		} else {
--			if (iface->conf->vht_oper_chwidth == CHANWIDTH_USE_HT)
-+			int oper_chwidth = hostapd_get_oper_chwidth(iface->conf);
-+
-+			if (oper_chwidth == CHANWIDTH_USE_HT)
- 				break;
- 			*skip_radar = 1;
--			iface->conf->vht_oper_chwidth--;
-+			hostapd_set_oper_chwidth(iface->conf, oper_chwidth - 1);
- 		}
- 	}
- 
diff --git a/package/network/services/hostapd/patches/008-mesh-use-setup-completion-callback-to-complete-mesh-.patch b/package/network/services/hostapd/patches/008-mesh-use-setup-completion-callback-to-complete-mesh-.patch
deleted file mode 100644
index 28c283d035..0000000000
--- a/package/network/services/hostapd/patches/008-mesh-use-setup-completion-callback-to-complete-mesh-.patch
+++ /dev/null
@@ -1,108 +0,0 @@
-From 11e5bbe58eebdb10793eec374b6c8ccc7daf7ec8 Mon Sep 17 00:00:00 2001
-From: Peter Oh <peter.oh@bowerswilkins.com>
-Date: Tue, 30 Jun 2020 14:18:56 +0200
-Subject: [PATCH 08/19] mesh: use setup completion callback to complete mesh
- join
-
-mesh join function is the last function to be called during
-mesh join process, but it's been called a bit earlier than
-it's supposed to be, so that some mesh parameter values
-such as VHT capabilities not applied correct when mesh join
-is in process.
-Moreover current design of mesh join that is called directly
-after mesh initialization isn't suitable for DFS channels to use,
-since mesh join process should be paused until DFS CAC is
-done and resumed after it's done.
-The callback will be called by hostapd_setup_interface_complete_sync.
-There is possiblity that completing mesh init fails, so add error
-handle codes.
-
-Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
----
- src/ap/hostapd.c      | 11 ++++++++++-
- wpa_supplicant/mesh.c | 12 ++++++++++--
- 2 files changed, 20 insertions(+), 3 deletions(-)
-
---- a/src/ap/hostapd.c
-+++ b/src/ap/hostapd.c
-@@ -434,6 +434,8 @@ static void hostapd_free_hapd_data(struc
- #ifdef CONFIG_MESH
- 	wpabuf_free(hapd->mesh_pending_auth);
- 	hapd->mesh_pending_auth = NULL;
-+	/* handling setup failure is already done */
-+	hapd->setup_complete_cb = NULL;
- #endif /* CONFIG_MESH */
- 
- 	hostapd_clean_rrm(hapd);
-@@ -2156,6 +2158,13 @@ dfs_offload:
- 	if (hapd->setup_complete_cb)
- 		hapd->setup_complete_cb(hapd->setup_complete_cb_ctx);
- 
-+#ifdef CONFIG_MESH
-+	if (delay_apply_cfg && iface->mconf == NULL) {
-+		wpa_printf(MSG_ERROR, "Error while completing mesh init");
-+		goto fail;
-+	}
-+#endif /* CONFIG_MESH */
-+
- 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
- 		   iface->bss[0]->conf->iface);
- 	if (iface->interfaces && iface->interfaces->terminate_on_error > 0)
-@@ -2299,7 +2308,7 @@ int hostapd_setup_interface(struct hosta
- 	ret = setup_interface(iface);
- 	if (ret) {
- 		wpa_printf(MSG_ERROR, "%s: Unable to setup interface.",
--			   iface->bss[0]->conf->iface);
-+			iface->conf ? iface->conf->bss[0]->iface : "N/A");
- 		return -1;
- 	}
- 
---- a/wpa_supplicant/mesh.c
-+++ b/wpa_supplicant/mesh.c
-@@ -193,7 +193,6 @@ static int wpas_mesh_init_rsn(struct wpa
- 	return !wpa_s->mesh_rsn ? -1 : 0;
- }
- 
--
- static int wpas_mesh_complete(struct wpa_supplicant *wpa_s)
- {
- 	struct hostapd_iface *ifmsh = wpa_s->ifmsh;
-@@ -244,6 +243,13 @@ static int wpas_mesh_complete(struct wpa
- }
- 
- 
-+static void wpas_mesh_complete_cb(void *arg)
-+{
-+	struct wpa_supplicant *wpa_s = arg;
-+	wpas_mesh_complete(wpa_s);
-+}
-+
-+
- static int wpa_supplicant_mesh_init(struct wpa_supplicant *wpa_s,
- 				    struct wpa_ssid *ssid,
- 				    struct hostapd_freq_params *freq)
-@@ -267,6 +273,7 @@ static int wpa_supplicant_mesh_init(stru
- 	if (!ifmsh)
- 		return -ENOMEM;
- 
-+	ifmsh->owner = wpa_s;
- 	ifmsh->drv_flags = wpa_s->drv_flags;
- 	ifmsh->drv_flags2 = wpa_s->drv_flags2;
- 	ifmsh->num_bss = 1;
-@@ -285,6 +292,8 @@ static int wpa_supplicant_mesh_init(stru
- 	bss->drv_priv = wpa_s->drv_priv;
- 	bss->iface = ifmsh;
- 	bss->mesh_sta_free_cb = mesh_mpm_free_sta;
-+	bss->setup_complete_cb = wpas_mesh_complete_cb;
-+	bss->setup_complete_cb_ctx = wpa_s;
- 	frequency = ssid->frequency;
- 	if (frequency != freq->freq &&
- 	    frequency == freq->freq + freq->sec_channel_offset * 20) {
-@@ -523,7 +532,6 @@ int wpa_supplicant_join_mesh(struct wpa_
- 		goto out;
- 	}
- 
--	ret = wpas_mesh_complete(wpa_s);
- out:
- 	return ret;
- }
diff --git a/package/network/services/hostapd/patches/009-mesh-update-ssid-frequency-as-pri-sec-channel-switch.patch b/package/network/services/hostapd/patches/009-mesh-update-ssid-frequency-as-pri-sec-channel-switch.patch
deleted file mode 100644
index b48de67636..0000000000
--- a/package/network/services/hostapd/patches/009-mesh-update-ssid-frequency-as-pri-sec-channel-switch.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 87c5e8883898e7eb8e9637e212350c1925a22654 Mon Sep 17 00:00:00 2001
-From: Peter Oh <peter.oh@bowerswilkins.com>
-Date: Tue, 30 Jun 2020 14:18:57 +0200
-Subject: [PATCH 09/19] mesh: update ssid->frequency as pri/sec channel switch
-
-ssid->frequency is one of variables used to gets channel
-number from given frequency. Leave it as unchanged when
-pri/sec channel switched will cause picking up wrong
-channel number after applying secondary channel offset
-for HT40 and leads failing interface bring-up.
-
-Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
----
- wpa_supplicant/mesh.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/wpa_supplicant/mesh.c
-+++ b/wpa_supplicant/mesh.c
-@@ -299,6 +299,7 @@ static int wpa_supplicant_mesh_init(stru
- 	    frequency == freq->freq + freq->sec_channel_offset * 20) {
- 		wpa_printf(MSG_DEBUG, "mesh: pri/sec channels switched");
- 		frequency = freq->freq;
-+		ssid->frequency = frequency;
- 	}
- 	wpa_s->assoc_freq = frequency;
- 	wpa_s->current_ssid = ssid;
diff --git a/package/network/services/hostapd/patches/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch b/package/network/services/hostapd/patches/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch
index 8afeba93ed..16d24d1000 100644
--- a/package/network/services/hostapd/patches/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch
+++ b/package/network/services/hostapd/patches/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch
@@ -14,16 +14,37 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
 
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2349,6 +2349,8 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2409,7 +2409,7 @@ static int drv_supports_vht(struct wpa_s
+ }
+ 
+ 
+-static bool ibss_mesh_is_80mhz_avail(int channel, struct hostapd_hw_modes *mode)
++static bool ibss_mesh_is_80mhz_avail(int channel, struct hostapd_hw_modes *mode, bool dfs_enabled)
+ {
+ 	int i;
+ 
+@@ -2418,7 +2418,10 @@ static bool ibss_mesh_is_80mhz_avail(int
+ 
+ 		chan = hw_get_channel_chan(mode, i, NULL);
+ 		if (!chan ||
+-		    chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
++		    chan->flag & HOSTAPD_CHAN_DISABLED)
++			return false;
++		
++		if (!dfs_enabled && chan->flag & (HOSTAPD_CHAN_RADAR | HOSTAPD_CHAN_NO_IR))
+ 			return false;
+ 	}
+ 
+@@ -2447,6 +2450,8 @@ void ibss_mesh_setup_freq(struct wpa_sup
  	int chwidth, seg0, seg1;
  	u32 vht_caps = 0;
- 	int is_24ghz;
-+	int dfs_enabled = wpa_s->conf->country[0] &&
-+			 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_RADAR);
+ 	bool is_24ghz, is_6ghz;
++	bool dfs_enabled = wpa_s->conf->country[0] &&
++			   (wpa_s->drv_flags & WPA_DRIVER_FLAGS_RADAR);
  
  	freq->freq = ssid->frequency;
  
-@@ -2436,8 +2438,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2543,8 +2548,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
  		return;
  
  	/* Check primary channel flags */
@@ -36,7 +57,7 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  
  	freq->channel = pri_chan->chan;
  
-@@ -2470,8 +2475,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2577,8 +2585,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
  		return;
  
  	/* Check secondary channel flags */
@@ -49,20 +70,25 @@ Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
  
  	if (ht40 == -1) {
  		if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
-@@ -2564,8 +2572,11 @@ skip_ht40:
- 			return;
+@@ -2667,7 +2678,7 @@ skip_to_6ghz:
+ 		return;
  
- 		/* Back to HT configuration if channel not usable */
--		if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
-+		if (chan->flag & HOSTAPD_CHAN_DISABLED)
- 			return;
-+		if (chan->flag & (HOSTAPD_CHAN_RADAR | HOSTAPD_CHAN_NO_IR))
-+			if (!dfs_enabled)
-+				return;
- 	}
+ 	/* Back to HT configuration if channel not usable */
+-	if (!ibss_mesh_is_80mhz_avail(channel, mode))
++	if (!ibss_mesh_is_80mhz_avail(channel, mode, dfs_enabled))
+ 		return;
  
  	chwidth = CHANWIDTH_80MHZ;
-@@ -2585,10 +2596,12 @@ skip_ht40:
+@@ -2681,7 +2692,7 @@ skip_to_6ghz:
+ 		 * above; check the remaining four 20 MHz channels for the total
+ 		 * of 160 MHz bandwidth.
+ 		 */
+-		if (!ibss_mesh_is_80mhz_avail(channel + 16, mode))
++		if (!ibss_mesh_is_80mhz_avail(channel + 16, mode, dfs_enabled))
+ 			return;
+ 
+ 		for (j = 0; j < ARRAY_SIZE(bw160); j++) {
+@@ -2711,10 +2722,12 @@ skip_to_6ghz:
  				if (!chan)
  					continue;
  
diff --git a/package/network/services/hostapd/patches/011-mesh-do-not-set-offchanok-on-DFS-channels-in-non-ETS.patch b/package/network/services/hostapd/patches/011-mesh-do-not-set-offchanok-on-DFS-channels-in-non-ETS.patch
deleted file mode 100644
index d491f7c4bc..0000000000
--- a/package/network/services/hostapd/patches/011-mesh-do-not-set-offchanok-on-DFS-channels-in-non-ETS.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From af8dcbc87466ed6472850a4f1cfe252652cb3d26 Mon Sep 17 00:00:00 2001
-From: Peter Oh <peter.oh@bowerswilkins.com>
-Date: Tue, 30 Jun 2020 14:18:59 +0200
-Subject: [PATCH 11/19] mesh: do not set offchanok on DFS channels in non-ETSI
-
-mac80211 does not allow mgmt tx to use off channel on
-DFS channels in non-ETSI domain, because it will invalidate
-CAC result on current operating channel.
-(mac80211 commit: 34373d12f3cbb74960a73431138ef619d857996f)
-Hence don't set offchanok for mgmt tx in case of DFS channels
-in non-ETSI.
-
-Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
----
- src/drivers/driver_nl80211.c | 19 +++++++++++++++++++
- 1 file changed, 19 insertions(+)
-
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -7788,7 +7788,11 @@ static int wpa_driver_nl80211_send_actio
- 	int ret = -1;
- 	u8 *buf;
- 	struct ieee80211_hdr *hdr;
-+	struct hostapd_hw_modes *modes;
- 	int offchanok = 1;
-+	u16 num_modes, flags;
-+	u8 dfs_domain;
-+	int i;
- 
- 	if (is_ap_interface(drv->nlmode) && (int) freq == bss->freq &&
- 	    bss->beacon_set)
-@@ -7817,6 +7821,21 @@ static int wpa_driver_nl80211_send_actio
- 		os_memset(bss->rand_addr, 0, ETH_ALEN);
- 	}
- 
-+	if (is_mesh_interface(drv->nlmode)) {
-+		modes = nl80211_get_hw_feature_data(bss, &num_modes,
-+						    &flags, &dfs_domain);
-+		if (dfs_domain != HOSTAPD_DFS_REGION_ETSI &&
-+		    ieee80211_is_dfs(bss->freq, modes, num_modes))
-+			offchanok = 0;
-+		if (modes) {
-+			for (i = 0; i < num_modes; i++) {
-+				os_free(modes[i].channels);
-+				os_free(modes[i].rates);
-+			}
-+			os_free(modes);
-+		}
-+	}
-+
- 	if (is_ap_interface(drv->nlmode) &&
- 	    (!(drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
- 	     (int) freq == bss->freq || drv->device_ap_sme ||
diff --git a/package/network/services/hostapd/patches/019-mesh-use-deterministic-channel-on-channel-switch.patch b/package/network/services/hostapd/patches/011-mesh-use-deterministic-channel-on-channel-switch.patch
similarity index 92%
rename from package/network/services/hostapd/patches/019-mesh-use-deterministic-channel-on-channel-switch.patch
rename to package/network/services/hostapd/patches/011-mesh-use-deterministic-channel-on-channel-switch.patch
index 8e38a8e53c..1faeacf766 100644
--- a/package/network/services/hostapd/patches/019-mesh-use-deterministic-channel-on-channel-switch.patch
+++ b/package/network/services/hostapd/patches/011-mesh-use-deterministic-channel-on-channel-switch.patch
@@ -29,7 +29,7 @@ Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
  
  
  static int dfs_get_used_n_chans(struct hostapd_iface *iface, int *seg1)
-@@ -480,9 +481,14 @@ dfs_get_valid_channel(struct hostapd_ifa
+@@ -483,9 +484,14 @@ dfs_get_valid_channel(struct hostapd_ifa
  	int num_available_chandefs;
  	int chan_idx, chan_idx2;
  	int sec_chan_idx_80p80 = -1;
@@ -44,7 +44,7 @@ Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
  	wpa_printf(MSG_DEBUG, "DFS: Selecting random channel");
  	*secondary_channel = 0;
  	*oper_centr_freq_seg0_idx = 0;
-@@ -502,8 +508,20 @@ dfs_get_valid_channel(struct hostapd_ifa
+@@ -505,8 +511,20 @@ dfs_get_valid_channel(struct hostapd_ifa
  	if (num_available_chandefs == 0)
  		return NULL;
  
@@ -68,7 +68,7 @@ Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
  	if (!chan) {
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -9473,6 +9473,10 @@ static int nl80211_switch_channel(void *
+@@ -9895,6 +9895,10 @@ static int nl80211_switch_channel(void *
  	if (ret)
  		goto error;
  
diff --git a/package/network/services/hostapd/patches/012-mesh-fix-channel-switch-error-during-CAC.patch b/package/network/services/hostapd/patches/012-mesh-fix-channel-switch-error-during-CAC.patch
deleted file mode 100644
index f324d81ae3..0000000000
--- a/package/network/services/hostapd/patches/012-mesh-fix-channel-switch-error-during-CAC.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From ab6995f15aae17af93507dd2344615f91672a31a Mon Sep 17 00:00:00 2001
-From: Peter Oh <peter.oh@bowerswilkins.com>
-Date: Tue, 30 Jun 2020 14:19:00 +0200
-Subject: [PATCH 12/19] mesh: fix channel switch error during CAC
-
-Mesh interface has used its channel parameters that configured
-during its initialization even after channel switched due to
-DFS radar detection during CAC which caused channel switch error.
-This change fixes the error by updating its channel parameters
-when channel's been changed from initial one.
-
-Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
----
- wpa_supplicant/mesh.c | 34 ++++++++++++++++++++++++++++++++++
- 1 file changed, 34 insertions(+)
-
---- a/wpa_supplicant/mesh.c
-+++ b/wpa_supplicant/mesh.c
-@@ -13,6 +13,7 @@
- #include "utils/uuid.h"
- #include "common/ieee802_11_defs.h"
- #include "common/wpa_ctrl.h"
-+#include "common/hw_features_common.h"
- #include "ap/sta_info.h"
- #include "ap/hostapd.h"
- #include "ap/ieee802_11.h"
-@@ -206,6 +207,39 @@ static int wpas_mesh_complete(struct wpa
- 		return -1;
- 	}
- 
-+	/*
-+	 * inspect if channel's been changed since initialized.
-+	 * i.e. DFS radar detection
-+	 */
-+	if (ifmsh->freq != params->freq.freq) {
-+		wpa_s->assoc_freq = ifmsh->freq;
-+		ssid->frequency = ifmsh->freq;
-+		struct he_capabilities *he_capab = NULL;
-+
-+		if (ifmsh->current_mode)
-+			he_capab = &ifmsh->current_mode->he_capab[IEEE80211_MODE_MESH];
-+
-+		if (hostapd_set_freq_params(&params->freq,
-+				ifmsh->conf->hw_mode,
-+				ifmsh->freq,
-+				ifmsh->conf->channel,
-+				ifmsh->conf->enable_edmg,
-+				ifmsh->conf->edmg_channel,
-+				ifmsh->conf->ieee80211n,
-+				ifmsh->conf->ieee80211ac,
-+				ifmsh->conf->ieee80211ax,
-+				ifmsh->conf->secondary_channel,
-+				hostapd_get_oper_chwidth(ifmsh->conf),
-+				hostapd_get_oper_centr_freq_seg0_idx(ifmsh->conf),
-+				hostapd_get_oper_centr_freq_seg1_idx(ifmsh->conf),
-+				ifmsh->conf->vht_capab,
-+				he_capab)) {
-+			wpa_printf(MSG_ERROR, "Error updating mesh frequency params.");
-+			wpa_supplicant_mesh_deinit(wpa_s);
-+			return -1;
-+		}
-+	}
-+
- 	if (ifmsh->mconf->security != MESH_CONF_SEC_NONE &&
- 	    wpas_mesh_init_rsn(wpa_s)) {
- 		wpa_printf(MSG_ERROR,
diff --git a/package/network/services/hostapd/patches/013-mesh-inform-kernel-driver-DFS-handler-in-userspace.patch b/package/network/services/hostapd/patches/013-mesh-inform-kernel-driver-DFS-handler-in-userspace.patch
deleted file mode 100644
index fb4e68636e..0000000000
--- a/package/network/services/hostapd/patches/013-mesh-inform-kernel-driver-DFS-handler-in-userspace.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From f1118eca5b1a63a4acb2a11ceea15dc4bc259c77 Mon Sep 17 00:00:00 2001
-From: Peter Oh <peter.oh@bowerswilkins.com>
-Date: Tue, 30 Jun 2020 14:19:01 +0200
-Subject: [PATCH 13/19] mesh: inform kernel driver DFS handler in userspace
-
-NL80211_ATTR_HANDLE_DFS is required by kerenel space
-to enable DFS channels that indicates DFS handler
-resides in userspace.
-
-Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
----
- src/drivers/driver.h         | 1 +
- src/drivers/driver_nl80211.c | 3 +++
- wpa_supplicant/mesh.c        | 1 +
- 3 files changed, 5 insertions(+)
-
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -1542,6 +1542,7 @@ struct wpa_driver_mesh_join_params {
- #define WPA_DRIVER_MESH_FLAG_SAE_AUTH	0x00000004
- #define WPA_DRIVER_MESH_FLAG_AMPE	0x00000008
- 	unsigned int flags;
-+	u8 handle_dfs;
- };
- 
- struct wpa_driver_set_key_params {
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -10070,6 +10070,9 @@ static int nl80211_join_mesh(struct i802
- 
- 	wpa_printf(MSG_DEBUG, "  * flags=%08X", params->flags);
- 
-+	if (params->handle_dfs)
-+		if (nla_put_flag(msg, NL80211_ATTR_HANDLE_DFS))
-+			goto fail;
- 	container = nla_nest_start(msg, NL80211_ATTR_MESH_SETUP);
- 	if (!container)
- 		goto fail;
---- a/wpa_supplicant/mesh.c
-+++ b/wpa_supplicant/mesh.c
-@@ -355,6 +355,7 @@ static int wpa_supplicant_mesh_init(stru
- 		conf->country[0] = wpa_s->conf->country[0];
- 		conf->country[1] = wpa_s->conf->country[1];
- 		conf->country[2] = ' ';
-+		wpa_s->mesh_params->handle_dfs = 1;
- 	}
- 
- 	bss->iconf = conf;
diff --git a/package/network/services/hostapd/patches/014-mesh-fixes-for-mesh-init-deinit.patch b/package/network/services/hostapd/patches/014-mesh-fixes-for-mesh-init-deinit.patch
deleted file mode 100644
index fe12d401e4..0000000000
--- a/package/network/services/hostapd/patches/014-mesh-fixes-for-mesh-init-deinit.patch
+++ /dev/null
@@ -1,158 +0,0 @@
-From 30bdefd7559d57eae8c3c7e6f721ecf7be929bf2 Mon Sep 17 00:00:00 2001
-From: Markus Theil <markus.theil@tu-ilmenau.de>
-Date: Tue, 30 Jun 2020 14:19:02 +0200
-Subject: [PATCH 14/19] mesh: fixes for mesh init/deinit
-
-Send mesh group started notification after join completion
-callback is called.
-
-Implement outstanding TODO, to leave the mesh network on deinit.
-
-Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
----
- wpa_supplicant/mesh.c           | 32 ++++++++++++++++++++------------
- wpa_supplicant/mesh.h           |  6 ++++--
- wpa_supplicant/wpa_supplicant.c |  8 ++------
- 3 files changed, 26 insertions(+), 20 deletions(-)
-
---- a/wpa_supplicant/mesh.c
-+++ b/wpa_supplicant/mesh.c
-@@ -30,20 +30,20 @@
- 
- static void wpa_supplicant_mesh_deinit(struct wpa_supplicant *wpa_s)
- {
--	wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
-+	wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh, true);
- 	wpa_s->ifmsh = NULL;
- 	wpa_s->current_ssid = NULL;
- 	os_free(wpa_s->mesh_rsn);
- 	wpa_s->mesh_rsn = NULL;
- 	os_free(wpa_s->mesh_params);
- 	wpa_s->mesh_params = NULL;
--	/* TODO: leave mesh (stop beacon). This will happen on link down
--	 * anyway, so it's not urgent */
-+	wpa_supplicant_leave_mesh(wpa_s, false);
- }
- 
- 
- void wpa_supplicant_mesh_iface_deinit(struct wpa_supplicant *wpa_s,
--				      struct hostapd_iface *ifmsh)
-+				      struct hostapd_iface *ifmsh,
-+				      bool also_clear_hostapd)
- {
- 	if (!ifmsh)
- 		return;
-@@ -64,8 +64,10 @@ void wpa_supplicant_mesh_iface_deinit(st
- 	}
- 
- 	/* take care of shared data */
--	hostapd_interface_deinit(ifmsh);
--	hostapd_interface_free(ifmsh);
-+	if (also_clear_hostapd) {
-+		hostapd_interface_deinit(ifmsh);
-+		hostapd_interface_free(ifmsh);
-+	}
- }
- 
- 
-@@ -244,8 +246,7 @@ static int wpas_mesh_complete(struct wpa
- 	    wpas_mesh_init_rsn(wpa_s)) {
- 		wpa_printf(MSG_ERROR,
- 			   "mesh: RSN initialization failed - deinit mesh");
--		wpa_supplicant_mesh_deinit(wpa_s);
--		wpa_drv_leave_mesh(wpa_s);
-+		wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh, false);
- 		return -1;
- 	}
- 
-@@ -270,9 +271,15 @@ static int wpas_mesh_complete(struct wpa
- 	/* hostapd sets the interface down until we associate */
- 	wpa_drv_set_operstate(wpa_s, 1);
- 
--	if (!ret)
-+	if (!ret) {
- 		wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
- 
-+		wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
-+			wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
-+			ssid->id);
-+		wpas_notify_mesh_group_started(wpa_s, ssid);
-+	}
-+
- 	return ret;
- }
- 
-@@ -563,7 +570,7 @@ int wpa_supplicant_join_mesh(struct wpa_
- 	wpa_s->mesh_params = params;
- 	if (wpa_supplicant_mesh_init(wpa_s, ssid, &params->freq)) {
- 		wpa_msg(wpa_s, MSG_ERROR, "Failed to init mesh");
--		wpa_drv_leave_mesh(wpa_s);
-+		wpa_supplicant_leave_mesh(wpa_s, true);
- 		ret = -1;
- 		goto out;
- 	}
-@@ -573,14 +580,15 @@ out:
- }
- 
- 
--int wpa_supplicant_leave_mesh(struct wpa_supplicant *wpa_s)
-+int wpa_supplicant_leave_mesh(struct wpa_supplicant *wpa_s, bool need_deinit)
- {
- 	int ret = 0;
- 
- 	wpa_msg(wpa_s, MSG_INFO, "leaving mesh");
- 
- 	/* Need to send peering close messages first */
--	wpa_supplicant_mesh_deinit(wpa_s);
-+	if (need_deinit)
-+		wpa_supplicant_mesh_deinit(wpa_s);
- 
- 	ret = wpa_drv_leave_mesh(wpa_s);
- 	if (ret)
---- a/wpa_supplicant/mesh.h
-+++ b/wpa_supplicant/mesh.h
-@@ -11,9 +11,11 @@
- 
- int wpa_supplicant_join_mesh(struct wpa_supplicant *wpa_s,
- 			     struct wpa_ssid *ssid);
--int wpa_supplicant_leave_mesh(struct wpa_supplicant *wpa_s);
-+int wpa_supplicant_leave_mesh(struct wpa_supplicant *wpa_s,
-+			      bool need_deinit);
- void wpa_supplicant_mesh_iface_deinit(struct wpa_supplicant *wpa_s,
--				      struct hostapd_iface *ifmsh);
-+				      struct hostapd_iface *ifmsh,
-+				      bool also_clear_hostapd);
- int wpas_mesh_scan_result_text(const u8 *ies, size_t ies_len, char *buf,
- 			       char *end);
- int wpas_mesh_add_interface(struct wpa_supplicant *wpa_s, char *ifname,
---- a/wpa_supplicant/wpa_supplicant.c
-+++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2225,10 +2225,6 @@ void wpa_supplicant_associate(struct wpa
- 			return;
- 		}
- 		wpa_s->current_bss = bss;
--		wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
--			wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
--			ssid->id);
--		wpas_notify_mesh_group_started(wpa_s, ssid);
- #else /* CONFIG_MESH */
- 		wpa_msg(wpa_s, MSG_ERROR,
- 			"mesh mode support not included in the build");
-@@ -3938,7 +3934,7 @@ void wpa_supplicant_deauthenticate(struc
- 			wpa_s->ifname);
- 		wpas_notify_mesh_group_removed(wpa_s, mconf->meshid,
- 					       mconf->meshid_len, reason_code);
--		wpa_supplicant_leave_mesh(wpa_s);
-+		wpa_supplicant_leave_mesh(wpa_s, true);
- 	}
- #endif /* CONFIG_MESH */
- 
-@@ -6551,7 +6547,7 @@ static void wpa_supplicant_deinit_iface(
- 
- #ifdef CONFIG_MESH
- 	if (wpa_s->ifmsh) {
--		wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
-+		wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh, true);
- 		wpa_s->ifmsh = NULL;
- 	}
- #endif /* CONFIG_MESH */
diff --git a/package/network/services/hostapd/patches/015-mesh-fix-DFS-deinit-init.patch b/package/network/services/hostapd/patches/015-mesh-fix-DFS-deinit-init.patch
deleted file mode 100644
index c540dd6786..0000000000
--- a/package/network/services/hostapd/patches/015-mesh-fix-DFS-deinit-init.patch
+++ /dev/null
@@ -1,262 +0,0 @@
-From d017f5d98a143c46c3c3fcb0e6507ca0b2bebdb0 Mon Sep 17 00:00:00 2001
-From: Markus Theil <markus.theil@tu-ilmenau.de>
-Date: Tue, 30 Jun 2020 14:19:03 +0200
-Subject: [PATCH 15/19] mesh: fix DFS deinit/init
-
-The hostapd DFS code deinitializes and initializes the
-AP interface, if a clean channel switch is not possible.
-In this case the AP code paths would deinit the driver, for
-example nl80211, without wpa_supplicant code paths getting
-notice of this.
-
-Therefore add callbacks for wpa_supplicant mesh methods,
-which are called on init/deinit of the AP bss. These
-callbacks are then used to handle the reset in the mesh
-code.
-
-Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
----
- src/ap/dfs.c          |  2 +-
- src/ap/hostapd.c      | 17 ++++++--
- src/ap/hostapd.h      |  6 +++
- wpa_supplicant/mesh.c | 90 +++++++++++++++++++++++++++++++++++++------
- 4 files changed, 100 insertions(+), 15 deletions(-)
-
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -1112,7 +1112,7 @@ static int hostapd_dfs_start_channel_swi
- 				      oper_centr_freq_seg0_idx,
- 				      oper_centr_freq_seg1_idx,
- 				      cmode->vht_capab,
--				      &cmode->he_capab[IEEE80211_MODE_AP]);
-+				      &cmode->he_capab[iface->conf->hw_mode]);
- 
- 	if (err) {
- 		wpa_printf(MSG_ERROR, "DFS failed to calculate CSA freq params");
---- a/src/ap/hostapd.c
-+++ b/src/ap/hostapd.c
-@@ -354,7 +354,7 @@ static int hostapd_broadcast_wep_set(str
- #endif /* CONFIG_WEP */
- 
- 
--static void hostapd_free_hapd_data(struct hostapd_data *hapd)
-+void hostapd_free_hapd_data(struct hostapd_data *hapd)
- {
- 	os_free(hapd->probereq_cb);
- 	hapd->probereq_cb = NULL;
-@@ -498,7 +498,7 @@ static void sta_track_deinit(struct host
- }
- 
- 
--static void hostapd_cleanup_iface_partial(struct hostapd_iface *iface)
-+void hostapd_cleanup_iface_partial(struct hostapd_iface *iface)
- {
- 	wpa_printf(MSG_DEBUG, "%s(%p)", __func__, iface);
- #ifdef NEED_AP_MLME
-@@ -626,7 +626,7 @@ static int hostapd_flush_old_stations(st
- }
- 
- 
--static void hostapd_bss_deinit_no_free(struct hostapd_data *hapd)
-+void hostapd_bss_deinit_no_free(struct hostapd_data *hapd)
- {
- 	hostapd_free_stas(hapd);
- 	hostapd_flush_old_stations(hapd, WLAN_REASON_DEAUTH_LEAVING);
-@@ -2690,6 +2690,13 @@ int hostapd_enable_iface(struct hostapd_
- {
- 	size_t j;
- 
-+	if (hapd_iface == NULL)
-+		return -1;
-+
-+	if (hapd_iface->enable_iface_cb != NULL) {
-+		return hapd_iface->enable_iface_cb(hapd_iface);
-+	}
-+
- 	if (hapd_iface->bss[0]->drv_priv != NULL) {
- 		wpa_printf(MSG_ERROR, "Interface %s already enabled",
- 			   hapd_iface->conf->bss[0]->iface);
-@@ -2751,6 +2758,10 @@ int hostapd_disable_iface(struct hostapd
- 	if (hapd_iface == NULL)
- 		return -1;
- 
-+	if (hapd_iface->disable_iface_cb != NULL) {
-+		return hapd_iface->disable_iface_cb(hapd_iface);
-+	}
-+
- 	if (hapd_iface->bss[0]->drv_priv == NULL) {
- 		wpa_printf(MSG_INFO, "Interface %s already disabled",
- 			   hapd_iface->conf->bss[0]->iface);
---- a/src/ap/hostapd.h
-+++ b/src/ap/hostapd.h
-@@ -589,6 +589,9 @@ struct hostapd_iface {
- 
- 	/* Previous WMM element information */
- 	struct hostapd_wmm_ac_params prev_wmm[WMM_AC_NUM];
-+
-+	int (*enable_iface_cb)(struct hostapd_iface *iface);
-+	int (*disable_iface_cb)(struct hostapd_iface *iface);
- };
- 
- /* hostapd.c */
-@@ -617,6 +620,9 @@ void hostapd_interface_deinit_free(struc
- int hostapd_enable_iface(struct hostapd_iface *hapd_iface);
- int hostapd_reload_iface(struct hostapd_iface *hapd_iface);
- int hostapd_disable_iface(struct hostapd_iface *hapd_iface);
-+void hostapd_bss_deinit_no_free(struct hostapd_data *hapd);
-+void hostapd_free_hapd_data(struct hostapd_data *hapd);
-+void hostapd_cleanup_iface_partial(struct hostapd_iface *iface);
- int hostapd_add_iface(struct hapd_interfaces *ifaces, char *buf);
- int hostapd_remove_iface(struct hapd_interfaces *ifaces, char *buf);
- void hostapd_channel_list_updated(struct hostapd_iface *iface, int initiator);
---- a/wpa_supplicant/mesh.c
-+++ b/wpa_supplicant/mesh.c
-@@ -28,15 +28,20 @@
- #include "mesh.h"
- 
- 
--static void wpa_supplicant_mesh_deinit(struct wpa_supplicant *wpa_s)
-+static void wpa_supplicant_mesh_deinit(struct wpa_supplicant *wpa_s, bool also_clear_hostapd)
- {
--	wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh, true);
--	wpa_s->ifmsh = NULL;
--	wpa_s->current_ssid = NULL;
-+	wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh, also_clear_hostapd);
-+
-+	if (also_clear_hostapd) {
-+		wpa_s->ifmsh = NULL;
-+		wpa_s->current_ssid = NULL;
-+		os_free(wpa_s->mesh_params);
-+		wpa_s->mesh_params = NULL;
-+	}
-+
- 	os_free(wpa_s->mesh_rsn);
- 	wpa_s->mesh_rsn = NULL;
--	os_free(wpa_s->mesh_params);
--	wpa_s->mesh_params = NULL;
-+
- 	wpa_supplicant_leave_mesh(wpa_s, false);
- }
- 
-@@ -237,7 +242,7 @@ static int wpas_mesh_complete(struct wpa
- 				ifmsh->conf->vht_capab,
- 				he_capab)) {
- 			wpa_printf(MSG_ERROR, "Error updating mesh frequency params.");
--			wpa_supplicant_mesh_deinit(wpa_s);
-+			wpa_supplicant_mesh_deinit(wpa_s, true);
- 			return -1;
- 		}
- 	}
-@@ -246,7 +251,7 @@ static int wpas_mesh_complete(struct wpa
- 	    wpas_mesh_init_rsn(wpa_s)) {
- 		wpa_printf(MSG_ERROR,
- 			   "mesh: RSN initialization failed - deinit mesh");
--		wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh, false);
-+		wpa_supplicant_mesh_deinit(wpa_s, false);
- 		return -1;
- 	}
- 
-@@ -291,6 +296,67 @@ static void wpas_mesh_complete_cb(void *
- }
- 
- 
-+static int wpa_supplicant_mesh_enable_iface_cb(struct hostapd_iface *ifmsh)
-+{
-+	struct wpa_supplicant *wpa_s = ifmsh->owner;
-+	struct hostapd_data *bss;
-+
-+	ifmsh->mconf = mesh_config_create(wpa_s, wpa_s->current_ssid);
-+
-+	bss = ifmsh->bss[0];
-+	bss->msg_ctx = wpa_s;
-+	os_memcpy(bss->own_addr, wpa_s->own_addr, ETH_ALEN);
-+	bss->driver = wpa_s->driver;
-+	bss->drv_priv = wpa_s->drv_priv;
-+	bss->iface = ifmsh;
-+	bss->mesh_sta_free_cb = mesh_mpm_free_sta;
-+	bss->setup_complete_cb = wpas_mesh_complete_cb;
-+	bss->setup_complete_cb_ctx = wpa_s;
-+
-+	bss->conf->start_disabled = 1;
-+	bss->conf->mesh = MESH_ENABLED;
-+	bss->conf->ap_max_inactivity = wpa_s->conf->mesh_max_inactivity;
-+
-+	if (wpa_drv_init_mesh(wpa_s)) {
-+		wpa_msg(wpa_s, MSG_ERROR, "Failed to init mesh in driver");
-+		return -1;
-+	}
-+
-+	if (hostapd_setup_interface(ifmsh)) {
-+		wpa_printf(MSG_ERROR,
-+			   "Failed to initialize hostapd interface for mesh");
-+		return -1;
-+	}
-+
-+	return 0;
-+}
-+
-+
-+static int wpa_supplicant_mesh_disable_iface_cb(struct hostapd_iface *ifmsh)
-+{
-+	struct wpa_supplicant *wpa_s = ifmsh->owner;
-+	int j;
-+
-+	wpa_supplicant_mesh_deinit(wpa_s, false);
-+
-+#ifdef NEED_AP_MLME
-+	for (j = 0; j < ifmsh->num_bss; j++)
-+		hostapd_cleanup_cs_params(ifmsh->bss[j]);
-+#endif /* NEED_AP_MLME */
-+
-+	/* same as hostapd_interface_deinit without deinitializing ctrl-iface */
-+	for (j = 0; j < ifmsh->num_bss; j++) {
-+		struct hostapd_data *hapd = ifmsh->bss[j];
-+		hostapd_bss_deinit_no_free(hapd);
-+		hostapd_free_hapd_data(hapd);
-+	}
-+
-+	hostapd_cleanup_iface_partial(ifmsh);
-+
-+	return 0;
-+}
-+
-+
- static int wpa_supplicant_mesh_init(struct wpa_supplicant *wpa_s,
- 				    struct wpa_ssid *ssid,
- 				    struct hostapd_freq_params *freq)
-@@ -318,6 +384,8 @@ static int wpa_supplicant_mesh_init(stru
- 	ifmsh->drv_flags = wpa_s->drv_flags;
- 	ifmsh->drv_flags2 = wpa_s->drv_flags2;
- 	ifmsh->num_bss = 1;
-+	ifmsh->enable_iface_cb = wpa_supplicant_mesh_enable_iface_cb;
-+	ifmsh->disable_iface_cb = wpa_supplicant_mesh_disable_iface_cb;
- 	ifmsh->bss = os_calloc(wpa_s->ifmsh->num_bss,
- 			       sizeof(struct hostapd_data *));
- 	if (!ifmsh->bss)
-@@ -451,7 +519,7 @@ static int wpa_supplicant_mesh_init(stru
- 
- 	return 0;
- out_free:
--	wpa_supplicant_mesh_deinit(wpa_s);
-+	wpa_supplicant_mesh_deinit(wpa_s, true);
- 	return -ENOMEM;
- }
- 
-@@ -499,7 +567,7 @@ int wpa_supplicant_join_mesh(struct wpa_
- 		goto out;
- 	}
- 
--	wpa_supplicant_mesh_deinit(wpa_s);
-+	wpa_supplicant_mesh_deinit(wpa_s, true);
- 
- 	wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
- 	wpa_s->group_cipher = WPA_CIPHER_NONE;
-@@ -588,7 +656,7 @@ int wpa_supplicant_leave_mesh(struct wpa
- 
- 	/* Need to send peering close messages first */
- 	if (need_deinit)
--		wpa_supplicant_mesh_deinit(wpa_s);
-+		wpa_supplicant_mesh_deinit(wpa_s, true);
- 
- 	ret = wpa_drv_leave_mesh(wpa_s);
- 	if (ret)
diff --git a/package/network/services/hostapd/patches/016-tests-DFS-test-for-wpa_supplicant-mesh.patch b/package/network/services/hostapd/patches/016-tests-DFS-test-for-wpa_supplicant-mesh.patch
deleted file mode 100644
index b6a51b2f35..0000000000
--- a/package/network/services/hostapd/patches/016-tests-DFS-test-for-wpa_supplicant-mesh.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From 6ee4e70d469b8ce05013ed524eea32ea303e6563 Mon Sep 17 00:00:00 2001
-From: Markus Theil <markus.theil@tu-ilmenau.de>
-Date: Tue, 30 Jun 2020 14:19:04 +0200
-Subject: [PATCH 16/19] tests: DFS test for wpa_supplicant mesh
-
-Add a test with uses a DFS channel, waits for CAC
-afterwards successfull mesh join and then triggers
-a radar event and check if the mesh comes up again
-on the same device.
-
-Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
----
- tests/hwsim/test_wpas_mesh.py | 56 +++++++++++++++++++++++++++++++++--
- 1 file changed, 54 insertions(+), 2 deletions(-)
-
---- a/tests/hwsim/test_wpas_mesh.py
-+++ b/tests/hwsim/test_wpas_mesh.py
-@@ -80,8 +80,23 @@ def check_mesh_scan(dev, params, other_s
-     if '[MESH]' not in bss['flags']:
-         raise Exception("BSS output did not include MESH flag")
- 
--def check_mesh_group_added(dev):
--    ev = dev.wait_event(["MESH-GROUP-STARTED"])
-+def check_dfs_started(dev, timeout=10):
-+    ev = dev.wait_event(["DFS-CAC-START"], timeout=timeout)
-+    if ev is None:
-+        raise Exception("Test exception: CAC did not start")
-+
-+def check_dfs_finished(dev, timeout=70):
-+    ev = dev.wait_event(["DFS-CAC-COMPLETED"], timeout=timeout)
-+    if ev is None:
-+        raise Exception("Test exception: CAC did not finish")
-+
-+def check_mesh_radar_handling_finished(dev, timeout=75):
-+    ev = dev.wait_event(["CTRL-EVENT-CHANNEL-SWITCH", "MESH-GROUP-STARTED"], timeout=timeout)
-+    if ev is None:
-+        raise Exception("Test exception: Couldn't join mesh")
-+
-+def check_mesh_group_added(dev, timeout=10):
-+    ev = dev.wait_event(["MESH-GROUP-STARTED"], timeout=timeout)
-     if ev is None:
-         raise Exception("Test exception: Couldn't join mesh")
- 
-@@ -91,6 +106,10 @@ def check_mesh_group_removed(dev):
-     if ev is None:
-         raise Exception("Test exception: Couldn't leave mesh")
- 
-+def check_regdom_change(dev, timeout=10):
-+    ev = dev.wait_event(["CTRL-EVENT-REGDOM-CHANGE"], timeout=timeout)
-+    if ev is None:
-+        raise Exception("Test exception: No regdom change happened.")
- 
- def check_mesh_peer_connected(dev, timeout=10):
-     ev = dev.wait_event(["MESH-PEER-CONNECTED"], timeout=timeout)
-@@ -167,6 +186,39 @@ def test_wpas_mesh_group_remove(dev):
-     check_mesh_group_removed(dev[0])
-     dev[0].mesh_group_remove()
- 
-+def dfs_simulate_radar(dev):
-+    logger.info("Trigger a simulated radar event")
-+    phyname = dev.get_driver_status_field("phyname")
-+    radar_file = '/sys/kernel/debug/ieee80211/' + phyname + '/hwsim/dfs_simulate_radar'
-+    with open(radar_file, 'w') as f:
-+        f.write('1')
-+
-+@long_duration_test
-+def test_wpas_mesh_peer_connected_dfs(dev):
-+    """wpa_supplicant MESH peer connected"""
-+    dev[0].set("country", "DE")
-+    dev[1].set("country", "DE")
-+
-+    check_regdom_change(dev[0])
-+    check_regdom_change(dev[1])
-+
-+    check_mesh_support(dev[0])
-+    add_open_mesh_network(dev[0], freq="5500", beacon_int=160)
-+    add_open_mesh_network(dev[1], freq="5500", beacon_int=160)
-+    check_dfs_started(dev[0])
-+    check_dfs_finished(dev[0])
-+    check_mesh_joined_connected(dev, timeout0=10)
-+
-+    dfs_simulate_radar(dev[0])
-+
-+    check_mesh_radar_handling_finished(dev[0], timeout=75)
-+
-+    dev[0].set("country", "00")
-+    dev[1].set("country", "00")
-+
-+    check_regdom_change(dev[0])
-+    check_regdom_change(dev[1])
-+
- def test_wpas_mesh_peer_connected(dev):
-     """wpa_supplicant MESH peer connected"""
-     check_mesh_support(dev[0])
diff --git a/package/network/services/hostapd/patches/017-mesh-fix-mesh_oom-test.patch b/package/network/services/hostapd/patches/017-mesh-fix-mesh_oom-test.patch
deleted file mode 100644
index cc566c7de2..0000000000
--- a/package/network/services/hostapd/patches/017-mesh-fix-mesh_oom-test.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 928da9a270deaf4409aee4d87a33a6f61b56c136 Mon Sep 17 00:00:00 2001
-From: Markus Theil <markus.theil@tu-ilmenau.de>
-Date: Tue, 30 Jun 2020 14:19:05 +0200
-Subject: [PATCH 17/19] mesh: fix mesh_oom test
-
-Only change freq params, if ifmsh->freq is set initially, which only
-happens if hostapd_get_hw_features in setup_interface2 succeeds.
-
-Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
----
- wpa_supplicant/mesh.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/wpa_supplicant/mesh.c
-+++ b/wpa_supplicant/mesh.c
-@@ -218,7 +218,7 @@ static int wpas_mesh_complete(struct wpa
- 	 * inspect if channel's been changed since initialized.
- 	 * i.e. DFS radar detection
- 	 */
--	if (ifmsh->freq != params->freq.freq) {
-+	if (ifmsh->freq > 0 && ifmsh->freq != params->freq.freq) {
- 		wpa_s->assoc_freq = ifmsh->freq;
- 		ssid->frequency = ifmsh->freq;
- 		struct he_capabilities *he_capab = NULL;
diff --git a/package/network/services/hostapd/patches/018-mesh-move-mesh-freq-setting-to-own-function.patch b/package/network/services/hostapd/patches/018-mesh-move-mesh-freq-setting-to-own-function.patch
deleted file mode 100644
index 1dd7d37411..0000000000
--- a/package/network/services/hostapd/patches/018-mesh-move-mesh-freq-setting-to-own-function.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From 1eab0e62920f443f8814bad846f6439843223b69 Mon Sep 17 00:00:00 2001
-From: Markus Theil <markus.theil@tu-ilmenau.de>
-Date: Tue, 30 Jun 2020 14:19:06 +0200
-Subject: [PATCH 18/19] mesh: move mesh freq setting to own function
-
-Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
----
- wpa_supplicant/mesh.c | 59 ++++++++++++++++++++++++++-----------------
- 1 file changed, 36 insertions(+), 23 deletions(-)
-
---- a/wpa_supplicant/mesh.c
-+++ b/wpa_supplicant/mesh.c
-@@ -201,6 +201,40 @@ static int wpas_mesh_init_rsn(struct wpa
- 	return !wpa_s->mesh_rsn ? -1 : 0;
- }
- 
-+
-+static int wpas_mesh_update_freq_params(struct wpa_supplicant *wpa_s)
-+{
-+	struct wpa_driver_mesh_join_params *params = wpa_s->mesh_params;
-+	struct hostapd_iface *ifmsh = wpa_s->ifmsh;
-+	struct he_capabilities *he_capab = NULL;
-+
-+	if (ifmsh->current_mode)
-+		he_capab = &ifmsh->current_mode->he_capab[IEEE80211_MODE_MESH];
-+
-+	if (hostapd_set_freq_params(&params->freq,
-+			ifmsh->conf->hw_mode,
-+			ifmsh->freq,
-+			ifmsh->conf->channel,
-+			ifmsh->conf->enable_edmg,
-+			ifmsh->conf->edmg_channel,
-+			ifmsh->conf->ieee80211n,
-+			ifmsh->conf->ieee80211ac,
-+			ifmsh->conf->ieee80211ax,
-+			ifmsh->conf->secondary_channel,
-+			hostapd_get_oper_chwidth(ifmsh->conf),
-+			hostapd_get_oper_centr_freq_seg0_idx(ifmsh->conf),
-+			hostapd_get_oper_centr_freq_seg1_idx(ifmsh->conf),
-+			ifmsh->conf->vht_capab,
-+			he_capab)) {
-+		wpa_printf(MSG_ERROR, "Error updating mesh frequency params.");
-+		wpa_supplicant_mesh_deinit(wpa_s, true);
-+		return -1;
-+	}
-+
-+	return 0;
-+}
-+
-+
- static int wpas_mesh_complete(struct wpa_supplicant *wpa_s)
- {
- 	struct hostapd_iface *ifmsh = wpa_s->ifmsh;
-@@ -221,30 +255,8 @@ static int wpas_mesh_complete(struct wpa
- 	if (ifmsh->freq > 0 && ifmsh->freq != params->freq.freq) {
- 		wpa_s->assoc_freq = ifmsh->freq;
- 		ssid->frequency = ifmsh->freq;
--		struct he_capabilities *he_capab = NULL;
--
--		if (ifmsh->current_mode)
--			he_capab = &ifmsh->current_mode->he_capab[IEEE80211_MODE_MESH];
--
--		if (hostapd_set_freq_params(&params->freq,
--				ifmsh->conf->hw_mode,
--				ifmsh->freq,
--				ifmsh->conf->channel,
--				ifmsh->conf->enable_edmg,
--				ifmsh->conf->edmg_channel,
--				ifmsh->conf->ieee80211n,
--				ifmsh->conf->ieee80211ac,
--				ifmsh->conf->ieee80211ax,
--				ifmsh->conf->secondary_channel,
--				hostapd_get_oper_chwidth(ifmsh->conf),
--				hostapd_get_oper_centr_freq_seg0_idx(ifmsh->conf),
--				hostapd_get_oper_centr_freq_seg1_idx(ifmsh->conf),
--				ifmsh->conf->vht_capab,
--				he_capab)) {
--			wpa_printf(MSG_ERROR, "Error updating mesh frequency params.");
--			wpa_supplicant_mesh_deinit(wpa_s, true);
-+		if (wpas_mesh_update_freq_params(wpa_s) != 0)
- 			return -1;
--		}
- 	}
- 
- 	if (ifmsh->mconf->security != MESH_CONF_SEC_NONE &&
-@@ -518,6 +530,7 @@ static int wpa_supplicant_mesh_init(stru
- 	}
- 
- 	return 0;
-+
- out_free:
- 	wpa_supplicant_mesh_deinit(wpa_s, true);
- 	return -ENOMEM;
diff --git a/package/network/services/hostapd/patches/020-ignore-4addr-mode-enabling-error.patch b/package/network/services/hostapd/patches/020-ignore-4addr-mode-enabling-error.patch
deleted file mode 100644
index f6751829a5..0000000000
--- a/package/network/services/hostapd/patches/020-ignore-4addr-mode-enabling-error.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From c7cca9b08f3e1e49c4a4a59ec66c47d91448e6ae Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Sat, 13 Feb 2021 23:59:28 +0200
-Subject: [PATCH] nl80211: Ignore 4addr mode enabling error if it was already
- enabled
-
-nl80211_set_4addr_mode() could fail when trying to enable 4addr mode on
-an interface that is in a bridge and has 4addr mode already enabled.
-This operation would not have been necessary in the first place and this
-failure results in disconnecting, e.g., when roaming from one backhaul
-BSS to another BSS with Multi AP.
-
-Avoid this issue by ignoring the nl80211 command failure in the case
-where 4addr mode is being enabled while it has already been enabled.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- src/drivers/driver_nl80211.c | 23 +++++++++++++++++++++++
- 1 file changed, 23 insertions(+)
-
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -617,6 +617,7 @@ struct wiphy_idx_data {
- 	int wiphy_idx;
- 	enum nl80211_iftype nlmode;
- 	u8 *macaddr;
-+	u8 use_4addr;
- };
- 
- 
-@@ -639,6 +640,9 @@ static int netdev_info_handler(struct nl
- 		os_memcpy(info->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
- 			  ETH_ALEN);
- 
-+	if (tb[NL80211_ATTR_4ADDR])
-+		info->use_4addr = nla_get_u8(tb[NL80211_ATTR_4ADDR]);
-+
- 	return NL_SKIP;
- }
- 
-@@ -691,6 +695,20 @@ static int nl80211_get_macaddr(struct i8
- }
- 
- 
-+static int nl80211_get_4addr(struct i802_bss *bss)
-+{
-+	struct nl_msg *msg;
-+	struct wiphy_idx_data data = {
-+		.use_4addr = 0,
-+	};
-+
-+	if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_GET_INTERFACE)) ||
-+	    send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data))
-+		return -1;
-+	return data.use_4addr;
-+}
-+
-+
- static int nl80211_register_beacons(struct wpa_driver_nl80211_data *drv,
- 				    struct nl80211_wiphy_data *w)
- {
-@@ -11508,6 +11526,11 @@ static int nl80211_set_4addr_mode(void *
- 
- 	ret = send_and_recv_msgs(drv, msg, NULL, NULL);
- 	msg = NULL;
-+	if (ret && val && nl80211_get_4addr(bss) == 1) {
-+		wpa_printf(MSG_DEBUG,
-+			   "nl80211: 4addr mode was already enabled");
-+		ret = 0;
-+	}
- 	if (!ret) {
- 		if (bridge_ifname[0] && val &&
- 		    i802_check_bridge(drv, bss, bridge_ifname, bss->ifname) < 0)
diff --git a/package/network/services/hostapd/patches/021-fix-sta-add-after-previous-connection.patch b/package/network/services/hostapd/patches/021-fix-sta-add-after-previous-connection.patch
new file mode 100644
index 0000000000..ac02ec5ab7
--- /dev/null
+++ b/package/network/services/hostapd/patches/021-fix-sta-add-after-previous-connection.patch
@@ -0,0 +1,26 @@
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -4944,6 +4944,13 @@ static int add_associated_sta(struct hos
+ 	 * drivers to accept the STA parameter configuration. Since this is
+ 	 * after a new FT-over-DS exchange, a new TK has been derived, so key
+ 	 * reinstallation is not a concern for this case.
++	 *
++	 * If the STA was associated and authorized earlier, but came for a new
++	 * connection (!added_unassoc + !reassoc), remove the existing STA entry
++	 * so that it can be re-added. This case is rarely seen when the AP could
++	 * not receive the deauth/disassoc frame from the STA. And the STA comes
++	 * back with new connection within a short period or before the inactive
++	 * STA entry is removed from the list.
+ 	 */
+ 	wpa_printf(MSG_DEBUG, "Add associated STA " MACSTR
+ 		   " (added_unassoc=%d auth_alg=%u ft_over_ds=%u reassoc=%d authorized=%d ft_tk=%d fils_tk=%d)",
+@@ -4957,7 +4964,8 @@ static int add_associated_sta(struct hos
+ 	    (!(sta->flags & WLAN_STA_AUTHORIZED) ||
+ 	     (reassoc && sta->ft_over_ds && sta->auth_alg == WLAN_AUTH_FT) ||
+ 	     (!wpa_auth_sta_ft_tk_already_set(sta->wpa_sm) &&
+-	      !wpa_auth_sta_fils_tk_already_set(sta->wpa_sm)))) {
++	      !wpa_auth_sta_fils_tk_already_set(sta->wpa_sm)) ||
++	     (!reassoc && (sta->flags & WLAN_STA_AUTHORIZED)))) {
+ 		hostapd_drv_sta_remove(hapd, sta->addr);
+ 		wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED);
+ 		set = 0;
diff --git a/package/network/services/hostapd/patches/022-hostapd-fix-use-of-uninitialized-stack-variables.patch b/package/network/services/hostapd/patches/022-hostapd-fix-use-of-uninitialized-stack-variables.patch
new file mode 100644
index 0000000000..c7da33f029
--- /dev/null
+++ b/package/network/services/hostapd/patches/022-hostapd-fix-use-of-uninitialized-stack-variables.patch
@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 8 Jul 2021 16:33:03 +0200
+Subject: [PATCH] hostapd: fix use of uninitialized stack variables
+
+When a CSA is performed on an 80 MHz channel, hostapd_change_config_freq
+unconditionally calls hostapd_set_oper_centr_freq_seg0/1_idx with seg0/1
+filled by ieee80211_freq_to_chan.
+However, if ieee80211_freq_to_chan fails (because the freq is 0 or invalid),
+seg0/1 remains uninitialized and filled with stack garbage, causing errors
+such as "hostapd: 80 MHz: center segment 1 configured"
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -3431,7 +3431,7 @@ static int hostapd_change_config_freq(st
+ 				      struct hostapd_freq_params *old_params)
+ {
+ 	int channel;
+-	u8 seg0, seg1;
++	u8 seg0 = 0, seg1 = 0;
+ 	struct hostapd_hw_modes *mode;
+ 
+ 	if (!params->channel) {
diff --git a/package/network/services/hostapd/patches/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch b/package/network/services/hostapd/patches/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch
index f65362fe96..ade0b11311 100644
--- a/package/network/services/hostapd/patches/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch
+++ b/package/network/services/hostapd/patches/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch
@@ -20,7 +20,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #include <linux/rtnetlink.h>
  #include <netpacket/packet.h>
  #include <linux/errqueue.h>
-@@ -4965,26 +4962,29 @@ fail:
+@@ -5300,26 +5297,29 @@ fail:
  
  static void rtnl_neigh_delete_fdb_entry(struct i802_bss *bss, const u8 *addr)
  {
@@ -64,7 +64,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (err < 0) {
  		wpa_printf(MSG_DEBUG, "nl80211: bridge FDB entry delete for "
  			   MACSTR " ifindex=%d failed: %s", MAC2STR(addr),
-@@ -4994,9 +4994,8 @@ static void rtnl_neigh_delete_fdb_entry(
+@@ -5329,9 +5329,8 @@ static void rtnl_neigh_delete_fdb_entry(
  			   MACSTR, MAC2STR(addr));
  	}
  
@@ -76,7 +76,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  
-@@ -7337,7 +7336,6 @@ static void *i802_init(struct hostapd_da
+@@ -7714,7 +7713,6 @@ static void *i802_init(struct hostapd_da
  	    (params->num_bridge == 0 || !params->bridge[0]))
  		add_ifidx(drv, br_ifindex, drv->ifindex);
  
@@ -84,7 +84,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (bss->added_if_into_bridge || bss->already_in_bridge) {
  		int err;
  
-@@ -7354,7 +7352,6 @@ static void *i802_init(struct hostapd_da
+@@ -7731,7 +7729,6 @@ static void *i802_init(struct hostapd_da
  			goto failed;
  		}
  	}
@@ -92,7 +92,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (drv->capa.flags2 & WPA_DRIVER_FLAGS2_CONTROL_PORT_RX) {
  		wpa_printf(MSG_DEBUG,
-@@ -10238,13 +10235,14 @@ static int wpa_driver_br_add_ip_neigh(vo
+@@ -10678,13 +10675,14 @@ static int wpa_driver_br_add_ip_neigh(vo
  				      const u8 *ipaddr, int prefixlen,
  				      const u8 *addr)
  {
@@ -112,7 +112,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	int res;
  
  	if (!ipaddr || prefixlen == 0 || !addr)
-@@ -10263,85 +10261,66 @@ static int wpa_driver_br_add_ip_neigh(vo
+@@ -10703,85 +10701,66 @@ static int wpa_driver_br_add_ip_neigh(vo
  	}
  
  	if (version == 4) {
@@ -220,7 +220,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		addrsize = 16;
  	} else {
  		return -EINVAL;
-@@ -10359,41 +10338,30 @@ static int wpa_driver_br_delete_ip_neigh
+@@ -10799,41 +10778,30 @@ static int wpa_driver_br_delete_ip_neigh
  		return -1;
  	}
  
diff --git a/package/network/services/hostapd/patches/040-mesh-allow-processing-authentication-frames-in-block.patch b/package/network/services/hostapd/patches/040-mesh-allow-processing-authentication-frames-in-block.patch
index 55dd980cd7..6d9fd81acf 100644
--- a/package/network/services/hostapd/patches/040-mesh-allow-processing-authentication-frames-in-block.patch
+++ b/package/network/services/hostapd/patches/040-mesh-allow-processing-authentication-frames-in-block.patch
@@ -16,7 +16,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
-@@ -2527,15 +2527,6 @@ static void handle_auth(struct hostapd_d
+@@ -3761,15 +3761,6 @@ static void handle_auth(struct hostapd_d
  				       seq_ctrl);
  			return;
  		}
@@ -29,6 +29,6 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 -			return;
 -		}
 -#endif /* CONFIG_MESH */
- 	} else {
- #ifdef CONFIG_MESH
- 		if (hapd->conf->mesh & MESH_ENABLED) {
+ #ifdef CONFIG_PASN
+ 		if (auth_alg == WLAN_AUTH_PASN &&
+ 		    (sta->flags & WLAN_STA_ASSOC)) {
diff --git a/package/network/services/hostapd/patches/050-build_fix.patch b/package/network/services/hostapd/patches/050-build_fix.patch
new file mode 100644
index 0000000000..2652a83316
--- /dev/null
+++ b/package/network/services/hostapd/patches/050-build_fix.patch
@@ -0,0 +1,20 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -323,6 +323,7 @@ ifdef CONFIG_FILS
+ CFLAGS += -DCONFIG_FILS
+ OBJS += ../src/ap/fils_hlp.o
+ NEED_SHA384=y
++NEED_HMAC_SHA384_KDF=y
+ NEED_AES_SIV=y
+ ifdef CONFIG_FILS_SK_PFS
+ CFLAGS += -DCONFIG_FILS_SK_PFS
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -312,6 +312,7 @@ endif
+ ifdef CONFIG_FILS
+ CFLAGS += -DCONFIG_FILS
+ NEED_SHA384=y
++NEED_HMAC_SHA384_KDF=y
+ NEED_AES_SIV=y
+ ifdef CONFIG_FILS_SK_PFS
+ CFLAGS += -DCONFIG_FILS_SK_PFS
diff --git a/package/network/services/hostapd/patches/050-mesh-make-forwarding-configurable.patch b/package/network/services/hostapd/patches/050-mesh-make-forwarding-configurable.patch
deleted file mode 100644
index 4d64ec8287..0000000000
--- a/package/network/services/hostapd/patches/050-mesh-make-forwarding-configurable.patch
+++ /dev/null
@@ -1,219 +0,0 @@
-From 90fe6429624fc48bc0e5d2d7eeecb7498708b5e3 Mon Sep 17 00:00:00 2001
-From: Daniel Golle <daniel@makrotopia.org>
-Date: Wed, 18 Apr 2018 19:24:31 +0200
-Subject: [PATCH 18/18] mesh: make forwarding configurable
-
-Allow mesh_fwding to be specified in a mesh bss config, pass that
-to the driver (only nl80211 implemented for now) and announce
-forwarding capability accordingly.
-
-Signed-off-by: Daniel Golle <daniel@makrotopia.org>
----
- src/ap/ap_config.h                 | 2 ++
- src/drivers/driver.h               | 2 ++
- src/drivers/driver_nl80211.c       | 3 +++
- wpa_supplicant/config.c            | 4 ++++
- wpa_supplicant/config.h            | 9 +++++++++
- wpa_supplicant/config_file.c       | 4 ++++
- wpa_supplicant/config_ssid.h       | 5 +++++
- wpa_supplicant/mesh.c              | 6 ++++++
- wpa_supplicant/mesh_mpm.c          | 4 ++--
- wpa_supplicant/wpa_supplicant.conf | 3 +++
- 10 files changed, 40 insertions(+), 2 deletions(-)
-
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -51,6 +51,7 @@ struct mesh_conf {
- 	int dot11MeshRetryTimeout; /* msec */
- 	int dot11MeshConfirmTimeout; /* msec */
- 	int dot11MeshHoldingTimeout; /* msec */
-+	int mesh_fwding;
- };
- 
- #define MAX_STA_COUNT 2007
-@@ -701,6 +702,7 @@ struct hostapd_bss_config {
- 
- #define MESH_ENABLED BIT(0)
- 	int mesh;
-+	int mesh_fwding;
- 
- 	u8 radio_measurements[RRM_CAPABILITIES_IE_LEN];
- 
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -1515,6 +1515,7 @@ struct wpa_driver_mesh_bss_params {
- #define WPA_DRIVER_MESH_CONF_FLAG_MAX_PEER_LINKS	0x00000004
- #define WPA_DRIVER_MESH_CONF_FLAG_HT_OP_MODE		0x00000008
- #define WPA_DRIVER_MESH_CONF_FLAG_RSSI_THRESHOLD	0x00000010
-+#define WPA_DRIVER_MESH_CONF_FLAG_FORWARDING		0x00000020
- 	/*
- 	 * TODO: Other mesh configuration parameters would go here.
- 	 * See NL80211_MESHCONF_* for all the mesh config parameters.
-@@ -1524,6 +1525,7 @@ struct wpa_driver_mesh_bss_params {
- 	int peer_link_timeout;
- 	int max_peer_links;
- 	int rssi_threshold;
-+	int forwarding;
- 	u16 ht_opmode;
- };
- 
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -10038,6 +10038,9 @@ static int nl80211_put_mesh_config(struc
- 	if (((params->flags & WPA_DRIVER_MESH_CONF_FLAG_AUTO_PLINKS) &&
- 	     nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
- 			params->auto_plinks)) ||
-+	    ((params->flags & WPA_DRIVER_MESH_CONF_FLAG_FORWARDING) &&
-+	     nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
-+			params->forwarding)) ||
- 	    ((params->flags & WPA_DRIVER_MESH_CONF_FLAG_MAX_PEER_LINKS) &&
- 	     nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
- 			 params->max_peer_links)) ||
---- a/wpa_supplicant/config.c
-+++ b/wpa_supplicant/config.c
-@@ -2473,6 +2473,7 @@ static const struct parse_data ssid_fiel
- #ifdef CONFIG_MESH
- 	{ INT_RANGE(mode, 0, 5) },
- 	{ INT_RANGE(no_auto_peer, 0, 1) },
-+	{ INT_RANGE(mesh_fwding, 0, 1) },
- 	{ INT_RANGE(mesh_rssi_threshold, -255, 1) },
- #else /* CONFIG_MESH */
- 	{ INT_RANGE(mode, 0, 4) },
-@@ -3049,6 +3050,7 @@ void wpa_config_set_network_defaults(str
- 	ssid->dot11MeshRetryTimeout = DEFAULT_MESH_RETRY_TIMEOUT;
- 	ssid->dot11MeshConfirmTimeout = DEFAULT_MESH_CONFIRM_TIMEOUT;
- 	ssid->dot11MeshHoldingTimeout = DEFAULT_MESH_HOLDING_TIMEOUT;
-+	ssid->mesh_fwding = DEFAULT_MESH_FWDING;
- 	ssid->mesh_rssi_threshold = DEFAULT_MESH_RSSI_THRESHOLD;
- #endif /* CONFIG_MESH */
- #ifdef CONFIG_HT_OVERRIDES
-@@ -4276,6 +4278,7 @@ struct wpa_config * wpa_config_alloc_emp
- 	config->user_mpm = DEFAULT_USER_MPM;
- 	config->max_peer_links = DEFAULT_MAX_PEER_LINKS;
- 	config->mesh_max_inactivity = DEFAULT_MESH_MAX_INACTIVITY;
-+	config->mesh_fwding = DEFAULT_MESH_FWDING;
- 	config->dot11RSNASAERetransPeriod =
- 		DEFAULT_DOT11_RSNA_SAE_RETRANS_PERIOD;
- 	config->fast_reauth = DEFAULT_FAST_REAUTH;
-@@ -4914,6 +4917,7 @@ static const struct global_parse_data gl
- 	{ INT(user_mpm), 0 },
- 	{ INT_RANGE(max_peer_links, 0, 255), 0 },
- 	{ INT(mesh_max_inactivity), 0 },
-+	{ INT_RANGE(mesh_fwding, 0, 1), 0 },
- 	{ INT(dot11RSNASAERetransPeriod), 0 },
- #endif /* CONFIG_MESH */
- 	{ INT(disable_scan_offload), 0 },
---- a/wpa_supplicant/config.h
-+++ b/wpa_supplicant/config.h
-@@ -18,6 +18,7 @@
- #define DEFAULT_USER_MPM 1
- #define DEFAULT_MAX_PEER_LINKS 99
- #define DEFAULT_MESH_MAX_INACTIVITY 300
-+#define DEFAULT_MESH_FWDING 1
- /*
-  * The default dot11RSNASAERetransPeriod is defined as 40 ms in the standard,
-  * but use 1000 ms in practice to avoid issues on low power CPUs.
-@@ -1351,6 +1352,14 @@ struct wpa_config {
- 	int mesh_max_inactivity;
- 
- 	/**
-+	 * mesh_fwding - Mesh network layer-2 forwarding
-+	 *
-+	 * This controls whether to enable layer-2 forwarding.
-+	 * By default: 1: enabled
-+	 */
-+	int mesh_fwding;
-+
-+	/**
- 	 * dot11RSNASAERetransPeriod - Timeout to retransmit SAE Auth frame
- 	 *
- 	 * This timeout value is used in mesh STA to retransmit
---- a/wpa_supplicant/config_file.c
-+++ b/wpa_supplicant/config_file.c
-@@ -866,6 +866,7 @@ static void wpa_config_write_network(FIL
- #endif /* IEEE8021X_EAPOL */
- 	INT(mode);
- 	INT(no_auto_peer);
-+	INT(mesh_fwding);
- 	INT(frequency);
- 	INT(enable_edmg);
- 	INT(edmg_channel);
-@@ -1527,6 +1528,9 @@ static void wpa_config_write_global(FILE
- 		fprintf(f, "mesh_max_inactivity=%d\n",
- 			config->mesh_max_inactivity);
- 
-+	if (config->mesh_fwding != DEFAULT_MESH_FWDING)
-+		fprintf(f, "mesh_fwding=%d\n", config->mesh_fwding);
-+
- 	if (config->dot11RSNASAERetransPeriod !=
- 	    DEFAULT_DOT11_RSNA_SAE_RETRANS_PERIOD)
- 		fprintf(f, "dot11RSNASAERetransPeriod=%d\n",
---- a/wpa_supplicant/config_ssid.h
-+++ b/wpa_supplicant/config_ssid.h
-@@ -546,6 +546,11 @@ struct wpa_ssid {
- 	int dot11MeshConfirmTimeout; /* msec */
- 	int dot11MeshHoldingTimeout; /* msec */
- 
-+	/**
-+	 * Mesh network layer-2 forwarding
-+	 */
-+	int mesh_fwding;
-+
- 	int ht;
- 	int ht40;
- 
---- a/wpa_supplicant/mesh.c
-+++ b/wpa_supplicant/mesh.c
-@@ -137,6 +137,7 @@ static struct mesh_conf * mesh_config_cr
- 	conf->mesh_cc_id = 0;
- 	conf->mesh_sp_id = MESH_SYNC_METHOD_NEIGHBOR_OFFSET;
- 	conf->mesh_auth_id = (conf->security & MESH_CONF_SEC_AUTH) ? 1 : 0;
-+	conf->mesh_fwding = ssid->mesh_fwding;
- 	conf->dot11MeshMaxRetries = ssid->dot11MeshMaxRetries;
- 	conf->dot11MeshRetryTimeout = ssid->dot11MeshRetryTimeout;
- 	conf->dot11MeshConfirmTimeout = ssid->dot11MeshConfirmTimeout;
-@@ -434,6 +435,7 @@ static int wpa_supplicant_mesh_init(stru
- 	bss->conf->start_disabled = 1;
- 	bss->conf->mesh = MESH_ENABLED;
- 	bss->conf->ap_max_inactivity = wpa_s->conf->mesh_max_inactivity;
-+	bss->conf->mesh_fwding = wpa_s->conf->mesh_fwding;
- 
- 	if (ieee80211_is_dfs(ssid->frequency, wpa_s->hw.modes,
- 			     wpa_s->hw.num_modes) && wpa_s->conf->country[0]) {
-@@ -647,6 +649,10 @@ int wpa_supplicant_join_mesh(struct wpa_
- 	}
- 	params->conf.peer_link_timeout = wpa_s->conf->mesh_max_inactivity;
- 
-+	/* always explicitely set forwarding to on or off for now */
-+	params->conf.flags |= WPA_DRIVER_MESH_CONF_FLAG_FORWARDING;
-+	params->conf.forwarding = ssid->mesh_fwding;
-+
- 	os_free(wpa_s->mesh_params);
- 	wpa_s->mesh_params = params;
- 	if (wpa_supplicant_mesh_init(wpa_s, ssid, &params->freq)) {
---- a/wpa_supplicant/mesh_mpm.c
-+++ b/wpa_supplicant/mesh_mpm.c
-@@ -303,9 +303,9 @@ static void mesh_mpm_send_plink_action(s
- 		info = (bss->num_plinks > 63 ? 63 : bss->num_plinks) << 1;
- 		/* TODO: Add Connected to Mesh Gate/AS subfields */
- 		wpabuf_put_u8(buf, info);
--		/* always forwarding & accepting plinks for now */
-+		/* set forwarding & always accepting plinks for now */
- 		wpabuf_put_u8(buf, MESH_CAP_ACCEPT_ADDITIONAL_PEER |
--			      MESH_CAP_FORWARDING);
-+			      (conf->mesh_fwding ? MESH_CAP_FORWARDING : 0));
- 	} else {	/* Peer closing frame */
- 		/* IE: Mesh ID */
- 		wpabuf_put_u8(buf, WLAN_EID_MESH_ID);
---- a/wpa_supplicant/wpa_supplicant.conf
-+++ b/wpa_supplicant/wpa_supplicant.conf
-@@ -150,6 +150,9 @@ ap_scan=1
- # This timeout value is used in mesh STA to clean up inactive stations.
- #mesh_max_inactivity=300
- 
-+# Enable 802.11s layer-2 routing and forwarding
-+#mesh_fwding=1
-+
- # cert_in_cb - Whether to include a peer certificate dump in events
- # This controls whether peer certificates for authentication server and
- # its certificate chain are included in EAP peer certificate events. This is
diff --git a/package/network/services/hostapd/patches/060-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch b/package/network/services/hostapd/patches/060-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch
deleted file mode 100644
index 1202ff3725..0000000000
--- a/package/network/services/hostapd/patches/060-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 8460e3230988ef2ec13ce6b69b687e941f6cdb32 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <jouni@codeaurora.org>
-Date: Tue, 8 Dec 2020 23:52:50 +0200
-Subject: [PATCH] P2P: Fix a corner case in peer addition based on PD Request
-
-p2p_add_device() may remove the oldest entry if there is no room in the
-peer table for a new peer. This would result in any pointer to that
-removed entry becoming stale. A corner case with an invalid PD Request
-frame could result in such a case ending up using (read+write) freed
-memory. This could only by triggered when the peer table has reached its
-maximum size and the PD Request frame is received from the P2P Device
-Address of the oldest remaining entry and the frame has incorrect P2P
-Device Address in the payload.
-
-Fix this by fetching the dev pointer again after having called
-p2p_add_device() so that the stale pointer cannot be used.
-
-Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request")
-Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
----
- src/p2p/p2p_pd.c | 12 +++++-------
- 1 file changed, 5 insertions(+), 7 deletions(-)
-
---- a/src/p2p/p2p_pd.c
-+++ b/src/p2p/p2p_pd.c
-@@ -595,14 +595,12 @@ void p2p_process_prov_disc_req(struct p2
- 			goto out;
- 		}
- 
-+		dev = p2p_get_device(p2p, sa);
- 		if (!dev) {
--			dev = p2p_get_device(p2p, sa);
--			if (!dev) {
--				p2p_dbg(p2p,
--					"Provision Discovery device not found "
--					MACSTR, MAC2STR(sa));
--				goto out;
--			}
-+			p2p_dbg(p2p,
-+				"Provision Discovery device not found "
-+				MACSTR, MAC2STR(sa));
-+			goto out;
- 		}
- 	} else if (msg.wfd_subelems) {
- 		wpabuf_free(dev->info.wfd_subelems);
diff --git a/package/network/services/hostapd/patches/072-dragonfly-Add-sqrt-helper-function.patch b/package/network/services/hostapd/patches/072-dragonfly-Add-sqrt-helper-function.patch
deleted file mode 100644
index b8b1e078b0..0000000000
--- a/package/network/services/hostapd/patches/072-dragonfly-Add-sqrt-helper-function.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 2232d3d5f188b65dbb6c823ac62175412739eb16 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Fri, 7 Jan 2022 13:47:16 +0200
-Subject: [PATCH 2/4] dragonfly: Add sqrt() helper function
-
-This is a backport of "SAE: Move sqrt() implementation into a helper
-function" to introduce the helper function needed for the following
-patches.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- src/common/dragonfly.c | 34 ++++++++++++++++++++++++++++++++++
- src/common/dragonfly.h |  2 ++
- 2 files changed, 36 insertions(+)
-
---- a/src/common/dragonfly.c
-+++ b/src/common/dragonfly.c
-@@ -213,3 +213,37 @@ int dragonfly_generate_scalar(const stru
- 		   "dragonfly: Unable to get randomness for own scalar");
- 	return -1;
- }
-+
-+
-+/* res = sqrt(val) */
-+int dragonfly_sqrt(struct crypto_ec *ec, const struct crypto_bignum *val,
-+		   struct crypto_bignum *res)
-+{
-+	const struct crypto_bignum *prime;
-+	struct crypto_bignum *tmp, *one;
-+	int ret = 0;
-+	u8 prime_bin[DRAGONFLY_MAX_ECC_PRIME_LEN];
-+	size_t prime_len;
-+
-+	/* For prime p such that p = 3 mod 4, sqrt(w) = w^((p+1)/4) mod p */
-+
-+	prime = crypto_ec_get_prime(ec);
-+	prime_len = crypto_ec_prime_len(ec);
-+	tmp = crypto_bignum_init();
-+	one = crypto_bignum_init_uint(1);
-+
-+	if (crypto_bignum_to_bin(prime, prime_bin, sizeof(prime_bin),
-+				 prime_len) < 0 ||
-+	    (prime_bin[prime_len - 1] & 0x03) != 3 ||
-+	    !tmp || !one ||
-+	    /* tmp = (p+1)/4 */
-+	    crypto_bignum_add(prime, one, tmp) < 0 ||
-+	    crypto_bignum_rshift(tmp, 2, tmp) < 0 ||
-+	    /* res = sqrt(val) */
-+	    crypto_bignum_exptmod(val, tmp, prime, res) < 0)
-+		ret = -1;
-+
-+	crypto_bignum_deinit(tmp, 0);
-+	crypto_bignum_deinit(one, 0);
-+	return ret;
-+}
---- a/src/common/dragonfly.h
-+++ b/src/common/dragonfly.h
-@@ -27,5 +27,7 @@ int dragonfly_generate_scalar(const stru
- 			      struct crypto_bignum *_rand,
- 			      struct crypto_bignum *_mask,
- 			      struct crypto_bignum *scalar);
-+int dragonfly_sqrt(struct crypto_ec *ec, const struct crypto_bignum *val,
-+		   struct crypto_bignum *res);
- 
- #endif /* DRAGONFLY_H */
diff --git a/package/network/services/hostapd/patches/073-SAE-Derive-the-y-coordinate-for-PWE-with-own-impleme.patch b/package/network/services/hostapd/patches/073-SAE-Derive-the-y-coordinate-for-PWE-with-own-impleme.patch
deleted file mode 100644
index f0db451316..0000000000
--- a/package/network/services/hostapd/patches/073-SAE-Derive-the-y-coordinate-for-PWE-with-own-impleme.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From fe534b0baaa8c0e6ddeb24cf529d6e50e33dc501 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Fri, 7 Jan 2022 13:47:16 +0200
-Subject: [PATCH 3/4] SAE: Derive the y coordinate for PWE with own
- implementation
-
-The crypto_ec_point_solve_y_coord() wrapper function might not use
-constant time operations in the crypto library and as such, could leak
-side channel information about the password that is used to generate the
-PWE in the hunting and pecking loop. As such, calculate the two possible
-y coordinate values and pick the correct one to use with constant time
-selection.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- src/common/sae.c | 47 +++++++++++++++++++++++++++++++++--------------
- 1 file changed, 33 insertions(+), 14 deletions(-)
-
---- a/src/common/sae.c
-+++ b/src/common/sae.c
-@@ -294,14 +294,16 @@ static int sae_derive_pwe_ecc(struct sae
- 	int pwd_seed_odd = 0;
- 	u8 prime[SAE_MAX_ECC_PRIME_LEN];
- 	size_t prime_len;
--	struct crypto_bignum *x = NULL, *qr = NULL, *qnr = NULL;
-+	struct crypto_bignum *x = NULL, *y = NULL, *qr = NULL, *qnr = NULL;
- 	u8 x_bin[SAE_MAX_ECC_PRIME_LEN];
- 	u8 x_cand_bin[SAE_MAX_ECC_PRIME_LEN];
- 	u8 qr_bin[SAE_MAX_ECC_PRIME_LEN];
- 	u8 qnr_bin[SAE_MAX_ECC_PRIME_LEN];
-+	u8 x_y[2 * SAE_MAX_ECC_PRIME_LEN];
- 	int res = -1;
- 	u8 found = 0; /* 0 (false) or 0xff (true) to be used as const_time_*
- 		       * mask */
-+	unsigned int is_eq;
- 
- 	os_memset(x_bin, 0, sizeof(x_bin));
- 
-@@ -410,25 +412,42 @@ static int sae_derive_pwe_ecc(struct sae
- 		goto fail;
- 	}
- 
--	if (!sae->tmp->pwe_ecc)
--		sae->tmp->pwe_ecc = crypto_ec_point_init(sae->tmp->ec);
--	if (!sae->tmp->pwe_ecc)
--		res = -1;
--	else
--		res = crypto_ec_point_solve_y_coord(sae->tmp->ec,
--						    sae->tmp->pwe_ecc, x,
--						    pwd_seed_odd);
--	if (res < 0) {
--		/*
--		 * This should not happen since we already checked that there
--		 * is a result.
--		 */
-+	/* y = sqrt(x^3 + ax + b) mod p
-+	 * if LSB(save) == LSB(y): PWE = (x, y)
-+	 * else: PWE = (x, p - y)
-+	 *
-+	 * Calculate y and the two possible values for PWE and after that,
-+	 * use constant time selection to copy the correct alternative.
-+	 */
-+	y = crypto_ec_point_compute_y_sqr(sae->tmp->ec, x);
-+	if (!y ||
-+	    dragonfly_sqrt(sae->tmp->ec, y, y) < 0 ||
-+	    crypto_bignum_to_bin(y, x_y, SAE_MAX_ECC_PRIME_LEN,
-+				 prime_len) < 0 ||
-+	    crypto_bignum_sub(sae->tmp->prime, y, y) < 0 ||
-+	    crypto_bignum_to_bin(y, x_y + SAE_MAX_ECC_PRIME_LEN,
-+				 SAE_MAX_ECC_PRIME_LEN, prime_len) < 0) {
- 		wpa_printf(MSG_DEBUG, "SAE: Could not solve y");
-+		goto fail;
-+	}
-+
-+	is_eq = const_time_eq(pwd_seed_odd, x_y[prime_len - 1] & 0x01);
-+	const_time_select_bin(is_eq, x_y, x_y + SAE_MAX_ECC_PRIME_LEN,
-+			      prime_len, x_y + prime_len);
-+	os_memcpy(x_y, x_bin, prime_len);
-+	wpa_hexdump_key(MSG_DEBUG, "SAE: PWE", x_y, 2 * prime_len);
-+	crypto_ec_point_deinit(sae->tmp->pwe_ecc, 1);
-+	sae->tmp->pwe_ecc = crypto_ec_point_from_bin(sae->tmp->ec, x_y);
-+	if (!sae->tmp->pwe_ecc) {
-+		wpa_printf(MSG_DEBUG, "SAE: Could not generate PWE");
-+		res = -1;
- 	}
- 
- fail:
-+	forced_memzero(x_y, sizeof(x_y));
- 	crypto_bignum_deinit(qr, 0);
- 	crypto_bignum_deinit(qnr, 0);
-+	crypto_bignum_deinit(y, 1);
- 	os_free(dummy_password);
- 	bin_clear_free(tmp_password, password_len);
- 	crypto_bignum_deinit(x, 1);
diff --git a/package/network/services/hostapd/patches/074-EAP-pwd-Derive-the-y-coordinate-for-PWE-with-own-imp.patch b/package/network/services/hostapd/patches/074-EAP-pwd-Derive-the-y-coordinate-for-PWE-with-own-imp.patch
deleted file mode 100644
index c5ddddcec3..0000000000
--- a/package/network/services/hostapd/patches/074-EAP-pwd-Derive-the-y-coordinate-for-PWE-with-own-imp.patch
+++ /dev/null
@@ -1,108 +0,0 @@
-From 603cd880e7f90595482658a7136fa6a7be5cb485 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Fri, 7 Jan 2022 18:52:27 +0200
-Subject: [PATCH 4/4] EAP-pwd: Derive the y coordinate for PWE with own
- implementation
-
-The crypto_ec_point_solve_y_coord() wrapper function might not use
-constant time operations in the crypto library and as such, could leak
-side channel information about the password that is used to generate the
-PWE in the hunting and pecking loop. As such, calculate the two possible
-y coordinate values and pick the correct one to use with constant time
-selection.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- src/eap_common/eap_pwd_common.c | 46 ++++++++++++++++++++++++++-------
- 1 file changed, 36 insertions(+), 10 deletions(-)
-
---- a/src/eap_common/eap_pwd_common.c
-+++ b/src/eap_common/eap_pwd_common.c
-@@ -127,7 +127,8 @@ int compute_password_element(EAP_PWD_gro
- 	u8 qr_or_qnr_bin[MAX_ECC_PRIME_LEN];
- 	u8 x_bin[MAX_ECC_PRIME_LEN];
- 	u8 prime_bin[MAX_ECC_PRIME_LEN];
--	struct crypto_bignum *tmp2 = NULL;
-+	u8 x_y[2 * MAX_ECC_PRIME_LEN];
-+	struct crypto_bignum *tmp2 = NULL, *y = NULL;
- 	struct crypto_hash *hash;
- 	unsigned char pwe_digest[SHA256_MAC_LEN], *prfbuf = NULL, ctr;
- 	int ret = 0, res;
-@@ -139,6 +140,7 @@ int compute_password_element(EAP_PWD_gro
- 	u8 found_ctr = 0, is_odd = 0;
- 	int cmp_prime;
- 	unsigned int in_range;
-+	unsigned int is_eq;
- 
- 	if (grp->pwe)
- 		return -1;
-@@ -151,11 +153,6 @@ int compute_password_element(EAP_PWD_gro
- 	if (crypto_bignum_to_bin(prime, prime_bin, sizeof(prime_bin),
- 				 primebytelen) < 0)
- 		return -1;
--	grp->pwe = crypto_ec_point_init(grp->group);
--	if (!grp->pwe) {
--		wpa_printf(MSG_INFO, "EAP-pwd: unable to create bignums");
--		goto fail;
--	}
- 
- 	if ((prfbuf = os_malloc(primebytelen)) == NULL) {
- 		wpa_printf(MSG_INFO, "EAP-pwd: unable to malloc space for prf "
-@@ -261,10 +258,37 @@ int compute_password_element(EAP_PWD_gro
- 	 */
- 	crypto_bignum_deinit(x_candidate, 1);
- 	x_candidate = crypto_bignum_init_set(x_bin, primebytelen);
--	if (!x_candidate ||
--	    crypto_ec_point_solve_y_coord(grp->group, grp->pwe, x_candidate,
--					  is_odd) != 0) {
--		wpa_printf(MSG_INFO, "EAP-pwd: Could not solve for y");
-+	if (!x_candidate)
-+		goto fail;
-+
-+	/* y = sqrt(x^3 + ax + b) mod p
-+	 * if LSB(y) == LSB(pwd-seed): PWE = (x, y)
-+	 * else: PWE = (x, p - y)
-+	 *
-+	 * Calculate y and the two possible values for PWE and after that,
-+	 * use constant time selection to copy the correct alternative.
-+	 */
-+	y = crypto_ec_point_compute_y_sqr(grp->group, x_candidate);
-+	if (!y ||
-+	    dragonfly_sqrt(grp->group, y, y) < 0 ||
-+	    crypto_bignum_to_bin(y, x_y, MAX_ECC_PRIME_LEN, primebytelen) < 0 ||
-+	    crypto_bignum_sub(prime, y, y) < 0 ||
-+	    crypto_bignum_to_bin(y, x_y + MAX_ECC_PRIME_LEN,
-+				 MAX_ECC_PRIME_LEN, primebytelen) < 0) {
-+		wpa_printf(MSG_DEBUG, "SAE: Could not solve y");
-+		goto fail;
-+	}
-+
-+	/* Constant time selection of the y coordinate from the two
-+	 * options */
-+	is_eq = const_time_eq(is_odd, x_y[primebytelen - 1] & 0x01);
-+	const_time_select_bin(is_eq, x_y, x_y + MAX_ECC_PRIME_LEN,
-+			      primebytelen, x_y + primebytelen);
-+	os_memcpy(x_y, x_bin, primebytelen);
-+	wpa_hexdump_key(MSG_DEBUG, "EAP-pwd: PWE", x_y, 2 * primebytelen);
-+	grp->pwe = crypto_ec_point_from_bin(grp->group, x_y);
-+	if (!grp->pwe) {
-+		wpa_printf(MSG_DEBUG, "EAP-pwd: Could not generate PWE");
- 		goto fail;
- 	}
- 
-@@ -289,6 +313,7 @@ int compute_password_element(EAP_PWD_gro
- 	/* cleanliness and order.... */
- 	crypto_bignum_deinit(x_candidate, 1);
- 	crypto_bignum_deinit(tmp2, 1);
-+	crypto_bignum_deinit(y, 1);
- 	crypto_bignum_deinit(qr, 1);
- 	crypto_bignum_deinit(qnr, 1);
- 	bin_clear_free(prfbuf, primebytelen);
-@@ -296,6 +321,7 @@ int compute_password_element(EAP_PWD_gro
- 	os_memset(qnr_bin, 0, sizeof(qnr_bin));
- 	os_memset(qr_or_qnr_bin, 0, sizeof(qr_or_qnr_bin));
- 	os_memset(pwe_digest, 0, sizeof(pwe_digest));
-+	forced_memzero(x_y, sizeof(x_y));
- 
- 	return ret;
- }
diff --git a/package/network/services/hostapd/patches/110-notify-mgmt-frames.patch b/package/network/services/hostapd/patches/110-notify-mgmt-frames.patch
deleted file mode 100644
index c3a66a7115..0000000000
--- a/package/network/services/hostapd/patches/110-notify-mgmt-frames.patch
+++ /dev/null
@@ -1,116 +0,0 @@
-From 53f8fdb534d5222a0e852e38afde3f49832ace06 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rapha=C3=ABl=20M=C3=A9lotte?= <raphael.melotte@mind.be>
-Date: Thu, 26 Nov 2020 09:27:40 +0100
-Subject: [PATCH] hostapd: Add an option to notify management frames on
- ctrl_iface
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-In some contexts (e.g. Multi-AP) it can be useful to have access to
-some of the management frames in upper layers (e.g. to be able to
-process the content of association requests externally).
-
-Add 'notify_mgmt_frames'. When enabled, it will notify the ctrl_iface
-when a management frame arrives using 'AP_MGMT_FRAME_RECEIVED'.
-
-Note that to avoid completely flooding the ctrl_iface, not all
-management frames are included (e.g. beacons are excluded).
-
-Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
----
- hostapd/config_file.c |  2 ++
- hostapd/hostapd.conf  |  4 ++++
- src/ap/ap_config.h    |  2 ++
- src/ap/ieee802_11.c   | 25 +++++++++++++++++++++++++
- src/common/wpa_ctrl.h |  3 +++
- 5 files changed, 36 insertions(+)
-
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -4456,6 +4456,8 @@ static int hostapd_config_fill(struct ho
- 		bss->multicast_to_unicast = atoi(pos);
- 	} else if (os_strcmp(buf, "broadcast_deauth") == 0) {
- 		bss->broadcast_deauth = atoi(pos);
-+	} else if (os_strcmp(buf, "notify_mgmt_frames") == 0) {
-+		conf->notify_mgmt_frames = atoi(pos);
- #ifdef CONFIG_DPP
- 	} else if (os_strcmp(buf, "dpp_name") == 0) {
- 		os_free(bss->dpp_name);
---- a/hostapd/hostapd.conf
-+++ b/hostapd/hostapd.conf
-@@ -571,6 +571,10 @@ wmm_ac_vo_acm=0
- # Default: 1 (enabled)
- #broadcast_deauth=1
- 
-+# Get notifications for management frames:
-+# Default: 0 (disabled)
-+#notify_mgmt_frames=0
-+
- ##### IEEE 802.11n related configuration ######################################
- 
- # ieee80211n: Whether IEEE 802.11n (HT) is enabled
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -1060,6 +1060,8 @@ struct hostapd_config {
- 	unsigned int airtime_update_interval;
- #define AIRTIME_MODE_MAX (__AIRTIME_MODE_MAX - 1)
- #endif /* CONFIG_AIRTIME_POLICY */
-+
-+	u8 notify_mgmt_frames;
- };
- 
- 
---- a/src/ap/ieee802_11.c
-+++ b/src/ap/ieee802_11.c
-@@ -4869,6 +4869,28 @@ static int handle_action(struct hostapd_
- 	return 1;
- }
- 
-+/**
-+ * notify_mgmt_frame - notify of management frames on the control interface.
-+ * @hapd: hostapd BSS data structure (the BSS to which the management frame was
-+ * sent to)
-+ * @buf: management frame data (starting from IEEE 802.11 header)
-+ * @len: length of frame data in octets
-+ *
-+ * Notify the control interface of any management frame.
-+ */
-+static void notify_mgmt_frame(struct hostapd_data *hapd, const u8 *buf,
-+			      size_t len)
-+{
-+
-+	int hex_len = len * 2 + 1;
-+	char *hex = os_malloc(hex_len);
-+
-+	if (hex) {
-+		wpa_snprintf_hex(hex, hex_len, buf, len);
-+		wpa_msg_ctrl(hapd->msg_ctx, MSG_INFO, AP_MGMT_FRAME_RECEIVED "buf=%s", hex);
-+		os_free(hex);
-+	}
-+}
- 
- /**
-  * ieee802_11_mgmt - process incoming IEEE 802.11 management frames
-@@ -4960,6 +4982,9 @@ int ieee802_11_mgmt(struct hostapd_data
- 	if (hapd->iconf->track_sta_max_num)
- 		sta_track_add(hapd->iface, mgmt->sa, ssi_signal);
- 
-+	if (hapd->iconf->notify_mgmt_frames)
-+		notify_mgmt_frame(hapd, buf, len);
-+
- 	switch (stype) {
- 	case WLAN_FC_STYPE_AUTH:
- 		wpa_printf(MSG_DEBUG, "mgmt::auth");
---- a/src/common/wpa_ctrl.h
-+++ b/src/common/wpa_ctrl.h
-@@ -396,6 +396,9 @@ extern "C" {
- #define BIT(x) (1U << (x))
- #endif
- 
-+/* Event triggered for received management frame */
-+#define AP_MGMT_FRAME_RECEIVED "AP-MGMT-FRAME-RECEIVED "
-+
- /* BSS command information masks */
- 
- #define WPA_BSS_MASK_ALL		0xFFFDFFFF
diff --git a/package/network/services/hostapd/patches/110-wolfssl-compile-fix.patch b/package/network/services/hostapd/patches/110-wolfssl-compile-fix.patch
deleted file mode 100644
index a7b5409602..0000000000
--- a/package/network/services/hostapd/patches/110-wolfssl-compile-fix.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/src/crypto/tls_wolfssl.c
-+++ b/src/crypto/tls_wolfssl.c
-@@ -19,6 +19,7 @@
- #include <wolfssl/ssl.h>
- #include <wolfssl/error-ssl.h>
- #include <wolfssl/wolfcrypt/asn.h>
-+#include <wolfssl/openssl/x509v3.h>
- 
- #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
- #define HAVE_AESGCM
diff --git a/package/network/services/hostapd/patches/120-reconfigure-wps-credentials.patch b/package/network/services/hostapd/patches/120-reconfigure-wps-credentials.patch
deleted file mode 100644
index 1826b6685b..0000000000
--- a/package/network/services/hostapd/patches/120-reconfigure-wps-credentials.patch
+++ /dev/null
@@ -1,178 +0,0 @@
-From b389a77a0f6dccf495dbce5be9476000f6ec06a2 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rapha=C3=ABl=20M=C3=A9lotte?= <raphael.melotte@mind.be>
-Date: Wed, 9 Dec 2020 19:55:53 +0100
-Subject: [PATCH] wps: reconfigure credentials on reload
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When new credentials are configured and hostapd is reconfigured using
-SIGHUP (or reload on the ctrl_iface), also update the wps credentials.
-
-Before these changes, when WPS is triggered the registar always serves
-the credentials that were configured when hostapd started.
-
-Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
----
- src/ap/wps_hostapd.c    | 86 +++++++++++++++++++++++++++++++++++++++--
- src/wps/wps.h           |  6 +++
- src/wps/wps_registrar.c | 29 ++++++++++++++
- 3 files changed, 118 insertions(+), 3 deletions(-)
-
---- a/src/ap/wps_hostapd.c
-+++ b/src/ap/wps_hostapd.c
-@@ -1375,6 +1375,43 @@ static void hostapd_wps_nfc_clear(struct
- #endif /* CONFIG_WPS_NFC */
- }
- 
-+int hostapd_wps_update_multi_ap(struct hostapd_data *hapd,
-+				struct wps_registrar *reg) {
-+	struct hostapd_bss_config *conf = hapd->conf;
-+	u8 *multi_ap_backhaul_network_key = NULL;
-+	size_t multi_ap_backhaul_network_key_len = 0;
-+	int ret = -1;
-+
-+	if ((conf->multi_ap & FRONTHAUL_BSS) &&
-+	    conf->multi_ap_backhaul_ssid.ssid_len) {
-+		if (conf->multi_ap_backhaul_ssid.wpa_passphrase) {
-+			multi_ap_backhaul_network_key =
-+				(u8 *) os_strdup(conf->multi_ap_backhaul_ssid.wpa_passphrase);
-+			if (multi_ap_backhaul_network_key == NULL)
-+				return -1;
-+			multi_ap_backhaul_network_key_len =
-+				os_strlen(conf->multi_ap_backhaul_ssid.wpa_passphrase);
-+		} else if (conf->multi_ap_backhaul_ssid.wpa_psk) {
-+			multi_ap_backhaul_network_key = os_malloc(2 * PMK_LEN + 1);
-+			if (multi_ap_backhaul_network_key == NULL)
-+				return -1;
-+			wpa_snprintf_hex((char *) multi_ap_backhaul_network_key,
-+					 2 * PMK_LEN + 1,
-+					 conf->multi_ap_backhaul_ssid.wpa_psk->psk,
-+					 PMK_LEN);
-+			multi_ap_backhaul_network_key_len = 2 * PMK_LEN;
-+		}
-+		ret = wps_registrar_update_multi_ap(reg,
-+						    conf->multi_ap_backhaul_ssid.ssid,
-+						    conf->multi_ap_backhaul_ssid.ssid_len,
-+						    multi_ap_backhaul_network_key,
-+						    multi_ap_backhaul_network_key_len);
-+		os_free(multi_ap_backhaul_network_key);
-+	}
-+	return ret;
-+}
-+
-+
- 
- void hostapd_deinit_wps(struct hostapd_data *hapd)
- {
-@@ -1409,11 +1446,54 @@ void hostapd_update_wps(struct hostapd_d
- 	hapd->wps->upc = hapd->conf->upc;
- #endif /* CONFIG_WPS_UPNP */
- 
--	hostapd_wps_set_vendor_ext(hapd, hapd->wps);
--	hostapd_wps_set_application_ext(hapd, hapd->wps);
-+	struct wps_context *wps = hapd->wps;
-+	struct hostapd_bss_config *conf = hapd->conf;
-+
-+	os_memcpy(wps->ssid, conf->ssid.ssid, conf->ssid.ssid_len);
-+	wps->ssid_len = conf->ssid.ssid_len;
-+
-+	/* Clear wps settings, then fill them again */
-+	os_free(wps->network_key);
-+	wps->network_key = NULL;
-+	wps->network_key_len = 0;
-+	wps->psk_set = 0;
-+	if (conf->ssid.wpa_psk_file) {
-+		/* Use per-device PSKs */
-+	} else if (conf->ssid.wpa_passphrase) {
-+		wps->network_key = (u8 *) os_strdup(conf->ssid.wpa_passphrase);
-+		if (wps->network_key == NULL)
-+			return;
-+		wps->network_key_len = os_strlen(conf->ssid.wpa_passphrase);
-+	} else if (conf->ssid.wpa_psk) {
-+		wps->network_key = os_malloc(2 * PMK_LEN + 1);
-+		if (wps->network_key == NULL)
-+			return;
-+		wpa_snprintf_hex((char *) wps->network_key, 2 * PMK_LEN + 1,
-+				 conf->ssid.wpa_psk->psk, PMK_LEN);
-+		wps->network_key_len = 2 * PMK_LEN;
-+#ifdef CONFIG_WEP
-+	} else if (conf->ssid.wep.keys_set && conf->ssid.wep.key[0]) {
-+		wps->network_key = os_malloc(conf->ssid.wep.len[0]);
-+		if (wps->network_key == NULL)
-+			return;
-+		os_memcpy(wps->network_key, conf->ssid.wep.key[0],
-+			  conf->ssid.wep.len[0]);
-+		wps->network_key_len = conf->ssid.wep.len[0];
-+#endif /* CONFIG_WEP */
-+	}
-+
-+	if (conf->ssid.wpa_psk) {
-+		os_memcpy(wps->psk, conf->ssid.wpa_psk->psk, PMK_LEN);
-+		wps->psk_set = 1;
-+	}
-+
-+	hostapd_wps_update_multi_ap(hapd, wps->registrar);
-+
-+	hostapd_wps_set_vendor_ext(hapd, wps);
-+	hostapd_wps_set_application_ext(hapd, wps);
- 
- 	if (hapd->conf->wps_state)
--		wps_registrar_update_ie(hapd->wps->registrar);
-+		wps_registrar_update_ie(wps->registrar);
- 	else
- 		hostapd_deinit_wps(hapd);
- }
---- a/src/wps/wps.h
-+++ b/src/wps/wps.h
-@@ -938,6 +938,12 @@ struct wpabuf * wps_build_nfc_handover_s
- 					       struct wpabuf *nfc_dh_pubkey,
- 					       struct wpabuf *nfc_dev_pw);
- 
-+int wps_registrar_update_multi_ap(struct wps_registrar *reg,
-+				  const u8 *multi_ap_backhaul_ssid,
-+				  size_t multi_ap_backhaul_ssid_len,
-+				  const u8 *multi_ap_backhaul_network_key,
-+				  size_t multi_ap_backhaul_network_key_len);
-+
- /* ndef.c */
- struct wpabuf * ndef_parse_wifi(const struct wpabuf *buf);
- struct wpabuf * ndef_build_wifi(const struct wpabuf *buf);
---- a/src/wps/wps_registrar.c
-+++ b/src/wps/wps_registrar.c
-@@ -3669,6 +3669,35 @@ int wps_registrar_config_ap(struct wps_r
- }
- 
- 
-+int wps_registrar_update_multi_ap(struct wps_registrar *reg,
-+				  const u8 *multi_ap_backhaul_ssid,
-+				  size_t multi_ap_backhaul_ssid_len,
-+				  const u8 *multi_ap_backhaul_network_key,
-+				  size_t multi_ap_backhaul_network_key_len)
-+{
-+	if (multi_ap_backhaul_ssid != NULL) {
-+		os_memcpy(reg->multi_ap_backhaul_ssid,
-+			  multi_ap_backhaul_ssid,
-+			  multi_ap_backhaul_ssid_len);
-+		reg->multi_ap_backhaul_ssid_len =
-+			multi_ap_backhaul_ssid_len;
-+	}
-+	os_free(reg->multi_ap_backhaul_network_key);
-+	reg->multi_ap_backhaul_network_key = NULL;
-+	reg->multi_ap_backhaul_network_key_len = 0;
-+
-+	if (multi_ap_backhaul_network_key != NULL) {
-+		reg->multi_ap_backhaul_network_key =
-+			os_memdup(multi_ap_backhaul_network_key,
-+				  multi_ap_backhaul_network_key_len);
-+		if (reg->multi_ap_backhaul_network_key == NULL)
-+			return -1;
-+		reg->multi_ap_backhaul_network_key_len =
-+			multi_ap_backhaul_network_key_len;
-+	}
-+	return 0;
-+}
-+
- #ifdef CONFIG_WPS_NFC
- 
- int wps_registrar_add_nfc_pw_token(struct wps_registrar *reg,
diff --git a/package/network/services/hostapd/patches/200-multicall.patch b/package/network/services/hostapd/patches/200-multicall.patch
index 9119a24c55..ad82e020f6 100644
--- a/package/network/services/hostapd/patches/200-multicall.patch
+++ b/package/network/services/hostapd/patches/200-multicall.patch
@@ -1,14 +1,14 @@
 --- a/hostapd/Makefile
 +++ b/hostapd/Makefile
-@@ -31,6 +31,7 @@ CFLAGS += -I$(abspath ../src/utils)
- export BINDIR ?= /usr/local/bin/
+@@ -1,6 +1,7 @@
+ ALL=hostapd hostapd_cli
+ CONFIG_FILE = .config
  
- -include .config
 +-include $(if $(MULTICALL), ../wpa_supplicant/.config)
+ include ../src/build.rules
  
- ifndef CONFIG_NO_GITVER
- # Add VERSION_STR postfix for builds from a git repository
-@@ -204,7 +205,8 @@ endif
+ ifdef LIBS
+@@ -199,7 +200,8 @@ endif
  
  ifdef CONFIG_NO_VLAN
  CFLAGS += -DCONFIG_NO_VLAN
@@ -18,7 +18,7 @@
  OBJS += ../src/ap/vlan_init.o
  OBJS += ../src/ap/vlan_ifconfig.o
  OBJS += ../src/ap/vlan.o
-@@ -354,10 +356,14 @@ CFLAGS += -DCONFIG_MBO
+@@ -350,10 +352,14 @@ CFLAGS += -DCONFIG_MBO
  OBJS += ../src/ap/mbo_ap.o
  endif
  
@@ -36,9 +36,9 @@
  LIBS += $(DRV_AP_LIBS)
  
  ifdef CONFIG_L2_PACKET
-@@ -1311,6 +1317,12 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
- 
- BCHECK=../src/drivers/build.hostapd
+@@ -1281,6 +1287,12 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
+ _OBJS_VAR := OBJS
+ include ../src/objs.mk
  
 +hostapd_multi.a: $(BCHECK) $(OBJS)
 +	$(Q)$(CC) -c -o hostapd_multi.o -Dmain=hostapd_main $(CFLAGS) main.c
@@ -46,12 +46,12 @@
 +	@rm -f $@
 +	@$(AR) cr $@ hostapd_multi.o $(OBJS)
 +
- hostapd: $(BCHECK) $(OBJS)
+ hostapd: $(OBJS)
  	$(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
  	@$(E) "  LD " $@
-@@ -1374,6 +1386,12 @@ SOBJS += ../src/crypto/sha256-kdf.o
- SOBJS += ../src/crypto/sha384-kdf.o
- SOBJS += ../src/crypto/sha512-kdf.o
+@@ -1355,6 +1367,12 @@ include ../src/objs.mk
+ _OBJS_VAR := SOBJS
+ include ../src/objs.mk
  
 +dump_cflags:
 +	@printf "%s " "$(CFLAGS)"
@@ -64,15 +64,15 @@
  	@$(E) "  LD " $@
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -27,6 +27,7 @@ CFLAGS += -I$(abspath ../src)
- CFLAGS += -I$(abspath ../src/utils)
+@@ -17,6 +17,7 @@ endif
+ EXTRA_TARGETS=dynamic_eap_methods
  
- -include .config
+ CONFIG_FILE=.config
 +-include $(if $(MULTICALL),../hostapd/.config)
+ include ../src/build.rules
  
- ifndef CONFIG_NO_GITVER
- # Add VERSION_STR postfix for builds from a git repository
-@@ -369,7 +370,9 @@ endif
+ ifdef LIBS
+@@ -363,7 +364,9 @@ endif
  ifdef CONFIG_IBSS_RSN
  NEED_RSN_AUTHENTICATOR=y
  CFLAGS += -DCONFIG_IBSS_RSN
@@ -82,7 +82,7 @@
  OBJS += ibss_rsn.o
  endif
  
-@@ -890,6 +893,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
+@@ -900,6 +903,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
  CFLAGS += -DCONFIG_DYNAMIC_EAP_METHODS
  LIBS += -ldl -rdynamic
  endif
@@ -93,7 +93,7 @@
  endif
  
  ifdef CONFIG_AP
-@@ -897,9 +904,11 @@ NEED_EAP_COMMON=y
+@@ -907,9 +914,11 @@ NEED_EAP_COMMON=y
  NEED_RSN_AUTHENTICATOR=y
  CFLAGS += -DCONFIG_AP
  OBJS += ap.o
@@ -105,7 +105,7 @@
  OBJS += ../src/ap/hostapd.o
  OBJS += ../src/ap/wpa_auth_glue.o
  OBJS += ../src/ap/utils.o
-@@ -979,6 +988,12 @@ endif
+@@ -989,6 +998,12 @@ endif
  ifdef CONFIG_HS20
  OBJS += ../src/ap/hs20.o
  endif
@@ -118,7 +118,7 @@
  endif
  
  ifdef CONFIG_MBO
-@@ -987,7 +1002,9 @@ CFLAGS += -DCONFIG_MBO
+@@ -997,7 +1012,9 @@ CFLAGS += -DCONFIG_MBO
  endif
  
  ifdef NEED_RSN_AUTHENTICATOR
@@ -128,10 +128,10 @@
  NEED_AES_WRAP=y
  OBJS += ../src/ap/wpa_auth.o
  OBJS += ../src/ap/wpa_auth_ie.o
-@@ -1897,6 +1914,12 @@ wpa_priv: $(BCHECK) $(OBJS_priv)
- 
- $(OBJS_c) $(OBJS_t) $(OBJS_t2) $(OBJS) $(BCHECK) $(EXTRA_progs): .config
+@@ -1891,6 +1908,12 @@ wpa_priv: $(BCHECK) $(OBJS_priv)
  
+ _OBJS_VAR := OBJS
+ include ../src/objs.mk
 +wpa_supplicant_multi.a: .config $(BCHECK) $(OBJS) $(EXTRA_progs)
 +	$(Q)$(CC) -c -o wpa_supplicant_multi.o -Dmain=wpa_supplicant_main $(CFLAGS) main.c
 +	@$(E) "  CC " $<
@@ -141,7 +141,7 @@
  wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs)
  	$(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
  	@$(E) "  LD " $@
-@@ -1997,6 +2020,12 @@ endif
+@@ -2023,6 +2046,12 @@ eap_gpsk.so: $(SRC_EAP_GPSK)
  	$(Q)sed -e 's|\@BINDIR\@|$(BINDIR)|g' $< >$@
  	@$(E) "  sed" $<
  
@@ -156,7 +156,7 @@
  wpa_cli.exe: wpa_cli
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -5886,8 +5886,8 @@ union wpa_event_data {
+@@ -6033,8 +6033,8 @@ union wpa_event_data {
   * Driver wrapper code should call this function whenever an event is received
   * from the driver.
   */
@@ -167,7 +167,7 @@
  
  /**
   * wpa_supplicant_event_global - Report a driver event for wpa_supplicant
-@@ -5899,7 +5899,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -6046,7 +6046,7 @@ void wpa_supplicant_event(void *ctx, enu
   * Same as wpa_supplicant_event(), but we search for the interface in
   * wpa_global.
   */
@@ -178,7 +178,7 @@
  /*
 --- a/src/ap/drv_callbacks.c
 +++ b/src/ap/drv_callbacks.c
-@@ -1789,8 +1789,8 @@ err:
+@@ -1842,8 +1842,8 @@ err:
  #endif /* CONFIG_OWE */
  
  
@@ -189,7 +189,7 @@
  {
  	struct hostapd_data *hapd = ctx;
  #ifndef CONFIG_NO_STDOUT_DEBUG
-@@ -2035,7 +2035,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -2088,7 +2088,7 @@ void wpa_supplicant_event(void *ctx, enu
  }
  
  
@@ -231,7 +231,7 @@
  	os_memset(&global, 0, sizeof(global));
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -4579,8 +4579,8 @@ static void wpas_event_unprot_beacon(str
+@@ -4891,8 +4891,8 @@ static void wpas_event_unprot_beacon(str
  }
  
  
@@ -242,7 +242,7 @@
  {
  	struct wpa_supplicant *wpa_s = ctx;
  	int resched;
-@@ -5398,7 +5398,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -5745,7 +5745,7 @@ void wpa_supplicant_event(void *ctx, enu
  }
  
  
@@ -253,7 +253,7 @@
  	struct wpa_supplicant *wpa_s;
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -6594,7 +6594,6 @@ struct wpa_interface * wpa_supplicant_ma
+@@ -7043,7 +7043,6 @@ struct wpa_interface * wpa_supplicant_ma
  	return NULL;
  }
  
@@ -261,7 +261,7 @@
  /**
   * wpa_supplicant_match_existing - Match existing interfaces
   * @global: Pointer to global data from wpa_supplicant_init()
-@@ -6631,6 +6630,11 @@ static int wpa_supplicant_match_existing
+@@ -7078,6 +7077,11 @@ static int wpa_supplicant_match_existing
  
  #endif /* CONFIG_MATCH_IFACE */
  
@@ -273,7 +273,7 @@
  
  /**
   * wpa_supplicant_add_iface - Add a new network interface
-@@ -6887,6 +6891,8 @@ struct wpa_global * wpa_supplicant_init(
+@@ -7334,6 +7338,8 @@ struct wpa_global * wpa_supplicant_init(
  #ifndef CONFIG_NO_WPA_MSG
  	wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
  #endif /* CONFIG_NO_WPA_MSG */
@@ -296,7 +296,7 @@
  
  #ifdef CONFIG_WPS
  static int gen_uuid(const char *txt_addr)
-@@ -684,6 +689,8 @@ int main(int argc, char *argv[])
+@@ -683,6 +688,8 @@ int main(int argc, char *argv[])
  		return -1;
  #endif /* CONFIG_DPP */
  
@@ -333,7 +333,7 @@
  
  const struct wpa_driver_ops *const wpa_drivers[] = { NULL };
  
-@@ -1292,6 +1297,10 @@ static void usage(void)
+@@ -1291,6 +1296,10 @@ static void usage(void)
  	       "option several times.\n");
  }
  
@@ -344,7 +344,7 @@
  
  int main(int argc, char *argv[])
  {
-@@ -1312,6 +1321,8 @@ int main(int argc, char *argv[])
+@@ -1311,6 +1320,8 @@ int main(int argc, char *argv[])
  	if (os_program_init())
  		return -1;
  
diff --git a/package/network/services/hostapd/patches/300-noscan.patch b/package/network/services/hostapd/patches/300-noscan.patch
index 638b76f84e..01a33d0d03 100644
--- a/package/network/services/hostapd/patches/300-noscan.patch
+++ b/package/network/services/hostapd/patches/300-noscan.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -3493,6 +3493,10 @@ static int hostapd_config_fill(struct ho
+@@ -3474,6 +3474,10 @@ static int hostapd_config_fill(struct ho
  		if (bss->ocv && !bss->ieee80211w)
  			bss->ieee80211w = 1;
  #endif /* CONFIG_OCV */
@@ -13,7 +13,7 @@
  	} else if (os_strcmp(buf, "ht_capab") == 0) {
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -984,6 +984,8 @@ struct hostapd_config {
+@@ -1014,6 +1014,8 @@ struct hostapd_config {
  
  	int ht_op_mode_fixed;
  	u16 ht_capab;
@@ -24,7 +24,7 @@
  	int no_pri_sec_switch;
 --- a/src/ap/hw_features.c
 +++ b/src/ap/hw_features.c
-@@ -500,7 +500,8 @@ static int ieee80211n_check_40mhz(struct
+@@ -517,7 +517,8 @@ static int ieee80211n_check_40mhz(struct
  	int ret;
  
  	/* Check that HT40 is used and PRI / SEC switch is allowed */
diff --git a/package/network/services/hostapd/patches/301-mesh-noscan.patch b/package/network/services/hostapd/patches/301-mesh-noscan.patch
index f85b72453e..e682efb543 100644
--- a/package/network/services/hostapd/patches/301-mesh-noscan.patch
+++ b/package/network/services/hostapd/patches/301-mesh-noscan.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/config.c
 +++ b/wpa_supplicant/config.c
-@@ -2478,6 +2478,7 @@ static const struct parse_data ssid_fiel
+@@ -2532,6 +2532,7 @@ static const struct parse_data ssid_fiel
  #else /* CONFIG_MESH */
  	{ INT_RANGE(mode, 0, 4) },
  #endif /* CONFIG_MESH */
@@ -10,7 +10,7 @@
  	{ STR(id_str) },
 --- a/wpa_supplicant/config_file.c
 +++ b/wpa_supplicant/config_file.c
-@@ -866,6 +866,7 @@ static void wpa_config_write_network(FIL
+@@ -769,6 +769,7 @@ static void wpa_config_write_network(FIL
  #endif /* IEEE8021X_EAPOL */
  	INT(mode);
  	INT(no_auto_peer);
@@ -20,7 +20,7 @@
  	INT(enable_edmg);
 --- a/wpa_supplicant/mesh.c
 +++ b/wpa_supplicant/mesh.c
-@@ -467,6 +467,8 @@ static int wpa_supplicant_mesh_init(stru
+@@ -505,6 +505,8 @@ static int wpa_supplicant_mesh_init(stru
  			   frequency);
  		goto out_free;
  	}
@@ -31,14 +31,17 @@
  		/*
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2334,12 +2334,12 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2436,7 +2436,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
  	int ieee80211_mode = wpas_mode_to_ieee80211_mode(ssid->mode);
  	enum hostapd_hw_mode hw_mode;
  	struct hostapd_hw_modes *mode = NULL;
 -	int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
 +	int ht40plus[] = { 1, 2, 3, 4, 5, 6, 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
  			   184, 192 };
- 	int vht80[] = { 36, 52, 100, 116, 132, 149 };
+ 	int bw80[] = { 5180, 5260, 5500, 5580, 5660, 5745, 5955,
+ 		       6035, 6115, 6195, 6275, 6355, 6435, 6515,
+@@ -2444,7 +2444,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ 	int bw160[] = { 5955, 6115, 6275, 6435, 6595, 6755, 6915 };
  	struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
  	u8 channel;
 -	int i, chan_idx, ht40 = -1, res, obss_scan = 1;
@@ -46,7 +49,7 @@
  	unsigned int j, k;
  	struct hostapd_freq_params vht_freq;
  	int chwidth, seg0, seg1;
-@@ -2421,7 +2421,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2535,7 +2535,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
  #endif /* CONFIG_HE_OVERRIDES */
  
  	/* Setup higher BW only for 5 GHz */
@@ -57,7 +60,7 @@
  	for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
 --- a/wpa_supplicant/config_ssid.h
 +++ b/wpa_supplicant/config_ssid.h
-@@ -971,6 +971,8 @@ struct wpa_ssid {
+@@ -974,6 +974,8 @@ struct wpa_ssid {
  	 */
  	int no_auto_peer;
  
diff --git a/package/network/services/hostapd/patches/310-rescan_immediately.patch b/package/network/services/hostapd/patches/310-rescan_immediately.patch
index 0040b61c6b..b0c1cb8354 100644
--- a/package/network/services/hostapd/patches/310-rescan_immediately.patch
+++ b/package/network/services/hostapd/patches/310-rescan_immediately.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -4949,7 +4949,7 @@ wpa_supplicant_alloc(struct wpa_supplica
+@@ -5377,7 +5377,7 @@ wpa_supplicant_alloc(struct wpa_supplica
  	if (wpa_s == NULL)
  		return NULL;
  	wpa_s->scan_req = INITIAL_SCAN_REQ;
diff --git a/package/network/services/hostapd/patches/320-optional_rfkill.patch b/package/network/services/hostapd/patches/320-optional_rfkill.patch
index a703c7e132..01537790e0 100644
--- a/package/network/services/hostapd/patches/320-optional_rfkill.patch
+++ b/package/network/services/hostapd/patches/320-optional_rfkill.patch
@@ -1,6 +1,6 @@
 --- a/src/drivers/drivers.mak
 +++ b/src/drivers/drivers.mak
-@@ -50,7 +50,6 @@ NEED_SME=y
+@@ -54,7 +54,6 @@ NEED_SME=y
  NEED_AP_MLME=y
  NEED_NETLINK=y
  NEED_LINUX_IOCTL=y
@@ -8,7 +8,7 @@
  NEED_RADIOTAP=y
  NEED_LIBNL=y
  endif
-@@ -107,7 +106,6 @@ DRV_WPA_CFLAGS += -DCONFIG_DRIVER_WEXT
+@@ -111,7 +110,6 @@ DRV_WPA_CFLAGS += -DCONFIG_DRIVER_WEXT
  CONFIG_WIRELESS_EXTENSION=y
  NEED_NETLINK=y
  NEED_LINUX_IOCTL=y
@@ -16,7 +16,7 @@
  endif
  
  ifdef CONFIG_DRIVER_NDIS
-@@ -133,7 +131,6 @@ endif
+@@ -137,7 +135,6 @@ endif
  ifdef CONFIG_WIRELESS_EXTENSION
  DRV_WPA_CFLAGS += -DCONFIG_WIRELESS_EXTENSION
  DRV_WPA_OBJS += ../src/drivers/driver_wext.o
@@ -24,7 +24,7 @@
  endif
  
  ifdef NEED_NETLINK
-@@ -142,6 +139,7 @@ endif
+@@ -146,6 +143,7 @@ endif
  
  ifdef NEED_RFKILL
  DRV_OBJS += ../src/drivers/rfkill.o
diff --git a/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch b/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch
index ccd8589728..37033c3035 100644
--- a/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch
+++ b/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch
@@ -1,6 +1,6 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -4661,7 +4661,7 @@ static int nl80211_set_channel(struct i8
+@@ -4986,7 +4986,7 @@ static int nl80211_set_channel(struct i8
  		   freq->freq, freq->ht_enabled, freq->vht_enabled, freq->he_enabled,
  		   freq->bandwidth, freq->center_freq1, freq->center_freq2);
  
diff --git a/package/network/services/hostapd/patches/340-reload_freq_change.patch b/package/network/services/hostapd/patches/340-reload_freq_change.patch
index e0e62c2a11..89259f2f44 100644
--- a/package/network/services/hostapd/patches/340-reload_freq_change.patch
+++ b/package/network/services/hostapd/patches/340-reload_freq_change.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -114,6 +114,28 @@ static void hostapd_reload_bss(struct ho
+@@ -115,6 +115,29 @@ static void hostapd_reload_bss(struct ho
  #endif /* CONFIG_NO_RADIUS */
  
  	ssid = &hapd->conf->ssid;
@@ -12,6 +12,7 @@
 +			 hapd->iconf->ieee80211n,
 +			 hapd->iconf->ieee80211ac,
 +			 hapd->iconf->ieee80211ax,
++			 hapd->iconf->ieee80211be,
 +			 hapd->iconf->secondary_channel,
 +			 hostapd_get_oper_chwidth(hapd->iconf),
 +			 hostapd_get_oper_centr_freq_seg0_idx(hapd->iconf),
@@ -29,7 +30,7 @@
  	if (!ssid->wpa_psk_set && ssid->wpa_psk && !ssid->wpa_psk->next &&
  	    ssid->wpa_passphrase_set && ssid->wpa_passphrase) {
  		/*
-@@ -215,6 +237,7 @@ int hostapd_reload_config(struct hostapd
+@@ -216,6 +238,7 @@ int hostapd_reload_config(struct hostapd
  	struct hostapd_data *hapd = iface->bss[0];
  	struct hostapd_config *newconf, *oldconf;
  	size_t j;
@@ -37,7 +38,7 @@
  
  	if (iface->config_fname == NULL) {
  		/* Only in-memory config in use - assume it has been updated */
-@@ -265,24 +288,20 @@ int hostapd_reload_config(struct hostapd
+@@ -266,24 +289,20 @@ int hostapd_reload_config(struct hostapd
  	}
  	iface->conf = newconf;
  
diff --git a/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch b/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch
index 90fa5eff5d..b13dcb0673 100644
--- a/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch
+++ b/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/ap.c
 +++ b/wpa_supplicant/ap.c
-@@ -1466,15 +1466,35 @@ int ap_switch_channel(struct wpa_supplic
+@@ -1611,15 +1611,35 @@ int ap_switch_channel(struct wpa_supplic
  
  
  #ifdef CONFIG_CTRL_IFACE
diff --git a/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch b/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch
index 076950fe35..8a2beb312f 100644
--- a/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch
+++ b/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch
@@ -1,24 +1,20 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -2803,10 +2803,15 @@ static int wpa_driver_nl80211_del_beacon
- 	struct nl_msg *msg;
+@@ -2932,11 +2932,11 @@ static int wpa_driver_nl80211_del_beacon
  	struct wpa_driver_nl80211_data *drv = bss->drv;
  
-+	if (!bss->beacon_set)
-+		return 0;
-+
-+	bss->beacon_set = 0;
-+
  	wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
 -		   drv->ifindex);
 +		   bss->ifindex);
+ 	bss->beacon_set = 0;
+ 	bss->freq = 0;
  	nl80211_put_wiphy_data_ap(bss);
 -	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_DEL_BEACON);
-+	msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_BEACON);
- 	return send_and_recv_msgs(drv, msg, NULL, NULL);
++	msg = nl80211_bss_msg(drv, 0, NL80211_CMD_DEL_BEACON);
+ 	return send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
  }
  
-@@ -5278,7 +5283,7 @@ static void nl80211_teardown_ap(struct i
+@@ -5650,7 +5650,7 @@ static void nl80211_teardown_ap(struct i
  		nl80211_mgmt_unsubscribe(bss, "AP teardown");
  
  	nl80211_put_wiphy_data_ap(bss);
@@ -27,7 +23,7 @@
  }
  
  
-@@ -7694,8 +7699,6 @@ static int wpa_driver_nl80211_if_remove(
+@@ -8104,8 +8104,6 @@ static int wpa_driver_nl80211_if_remove(
  	} else {
  		wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
  		nl80211_teardown_ap(bss);
@@ -36,19 +32,3 @@
  		nl80211_destroy_bss(bss);
  		if (!bss->added_if)
  			i802_set_iface_flags(bss, 0);
-@@ -8089,7 +8092,6 @@ static int wpa_driver_nl80211_deinit_ap(
- 	if (!is_ap_interface(drv->nlmode))
- 		return -1;
- 	wpa_driver_nl80211_del_beacon(bss);
--	bss->beacon_set = 0;
- 
- 	/*
- 	 * If the P2P GO interface was dynamically added, then it is
-@@ -8109,7 +8111,6 @@ static int wpa_driver_nl80211_stop_ap(vo
- 	if (!is_ap_interface(drv->nlmode))
- 		return -1;
- 	wpa_driver_nl80211_del_beacon(bss);
--	bss->beacon_set = 0;
- 	return 0;
- }
- 
diff --git a/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch b/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch
index 31c5102cb1..7f3aa91889 100644
--- a/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch
+++ b/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -65,6 +65,7 @@
+@@ -67,6 +67,7 @@
  #include "fst/fst_ctrl_iface.h"
  #include "config_file.h"
  #include "ctrl_iface.h"
@@ -8,7 +8,7 @@
  
  
  #define HOSTAPD_CLI_DUP_VALUE_MAX_LEN 256
-@@ -80,6 +81,7 @@ static void hostapd_ctrl_iface_send(stru
+@@ -82,6 +83,7 @@ static void hostapd_ctrl_iface_send(stru
  				    enum wpa_msg_type type,
  				    const char *buf, size_t len);
  
@@ -16,7 +16,7 @@
  
  static int hostapd_ctrl_iface_attach(struct hostapd_data *hapd,
  				     struct sockaddr_storage *from,
-@@ -131,6 +133,61 @@ static int hostapd_ctrl_iface_new_sta(st
+@@ -133,6 +135,61 @@ static int hostapd_ctrl_iface_new_sta(st
  	return 0;
  }
  
@@ -78,7 +78,7 @@
  
  #ifdef NEED_AP_MLME
  static int hostapd_ctrl_iface_sa_query(struct hostapd_data *hapd,
-@@ -3546,6 +3603,8 @@ static int hostapd_ctrl_iface_receive_pr
+@@ -3771,6 +3828,8 @@ static int hostapd_ctrl_iface_receive_pr
  	} else if (os_strncmp(buf, "VENDOR ", 7) == 0) {
  		reply_len = hostapd_ctrl_iface_vendor(hapd, buf + 7, reply,
  						      reply_size);
@@ -89,7 +89,7 @@
  #ifdef RADIUS_SERVER
 --- a/src/ap/ctrl_iface_ap.c
 +++ b/src/ap/ctrl_iface_ap.c
-@@ -917,7 +917,13 @@ int hostapd_parse_csa_settings(const cha
+@@ -927,7 +927,13 @@ int hostapd_parse_csa_settings(const cha
  
  int hostapd_ctrl_iface_stop_ap(struct hostapd_data *hapd)
  {
diff --git a/package/network/services/hostapd/patches/370-ap_sta_support.patch b/package/network/services/hostapd/patches/370-ap_sta_support.patch
index 1c5f72ddc0..c81c841a43 100644
--- a/package/network/services/hostapd/patches/370-ap_sta_support.patch
+++ b/package/network/services/hostapd/patches/370-ap_sta_support.patch
@@ -1,17 +1,6 @@
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -26,6 +26,10 @@ CFLAGS += $(EXTRA_CFLAGS)
- CFLAGS += -I$(abspath ../src)
- CFLAGS += -I$(abspath ../src/utils)
- 
-+ifdef MULTICALL
-+CFLAGS += -DMULTICALL
-+endif
-+
- -include .config
- -include $(if $(MULTICALL),../hostapd/.config)
- 
-@@ -118,6 +122,8 @@ OBJS_c += ../src/utils/common.o
+@@ -108,6 +108,8 @@ OBJS_c += ../src/utils/common.o
  OBJS_c += ../src/common/cli.o
  OBJS += wmm_ac.o
  
@@ -30,7 +19,7 @@
  #include "drivers/driver.h"
  #include "eap_peer/eap.h"
  #include "wpa_supplicant_i.h"
-@@ -294,6 +295,10 @@ void calculate_update_time(const struct
+@@ -282,6 +283,10 @@ void calculate_update_time(const struct
  static void wpa_bss_copy_res(struct wpa_bss *dst, struct wpa_scan_res *src,
  			     struct os_reltime *fetch_time)
  {
@@ -41,7 +30,7 @@
  	dst->flags = src->flags;
  	os_memcpy(dst->bssid, src->bssid, ETH_ALEN);
  	dst->freq = src->freq;
-@@ -306,6 +311,15 @@ static void wpa_bss_copy_res(struct wpa_
+@@ -294,6 +299,15 @@ static void wpa_bss_copy_res(struct wpa_
  	dst->est_throughput = src->est_throughput;
  	dst->snr = src->snr;
  
@@ -59,7 +48,7 @@
  
 --- a/wpa_supplicant/bss.h
 +++ b/wpa_supplicant/bss.h
-@@ -83,6 +83,10 @@ struct wpa_bss {
+@@ -94,6 +94,10 @@ struct wpa_bss {
  	u8 ssid[SSID_MAX_LEN];
  	/** Length of SSID */
  	size_t ssid_len;
@@ -110,7 +99,7 @@
  			break;
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -129,6 +129,54 @@ static void wpas_update_fils_connect_par
+@@ -130,6 +130,54 @@ static void wpas_update_fils_connect_par
  static void wpas_update_owe_connect_params(struct wpa_supplicant *wpa_s);
  #endif /* CONFIG_OWE */
  
@@ -165,7 +154,7 @@
  
  #ifdef CONFIG_WEP
  /* Configure default/group WEP keys for static WEP */
-@@ -991,6 +1039,8 @@ void wpa_supplicant_set_state(struct wpa
+@@ -1015,6 +1063,8 @@ void wpa_supplicant_set_state(struct wpa
  
  		sme_sched_obss_scan(wpa_s, 1);
  
@@ -174,7 +163,7 @@
  #if defined(CONFIG_FILS) && defined(IEEE8021X_EAPOL)
  		if (!fils_hlp_sent && ssid && ssid->eap.erp)
  			update_fils_connect_params = true;
-@@ -1001,6 +1051,8 @@ void wpa_supplicant_set_state(struct wpa
+@@ -1025,6 +1075,8 @@ void wpa_supplicant_set_state(struct wpa
  #endif /* CONFIG_OWE */
  	} else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
  		   state == WPA_ASSOCIATED) {
@@ -183,7 +172,7 @@
  		wpa_s->new_connection = 1;
  		wpa_drv_set_operstate(wpa_s, 0);
  #ifndef IEEE8021X_EAPOL
-@@ -2225,6 +2277,8 @@ void wpa_supplicant_associate(struct wpa
+@@ -2308,6 +2360,8 @@ void wpa_supplicant_associate(struct wpa
  			return;
  		}
  		wpa_s->current_bss = bss;
@@ -192,7 +181,7 @@
  #else /* CONFIG_MESH */
  		wpa_msg(wpa_s, MSG_ERROR,
  			"mesh mode support not included in the build");
-@@ -6207,6 +6261,16 @@ static int wpa_supplicant_init_iface(str
+@@ -6650,6 +6704,16 @@ static int wpa_supplicant_init_iface(str
  			   sizeof(wpa_s->bridge_ifname));
  	}
  
@@ -209,7 +198,7 @@
  	/* RSNA Supplicant Key Management - INITIALIZE */
  	eapol_sm_notify_portEnabled(wpa_s->eapol, false);
  	eapol_sm_notify_portValid(wpa_s->eapol, false);
-@@ -6540,6 +6604,11 @@ static void wpa_supplicant_deinit_iface(
+@@ -6987,6 +7051,11 @@ static void wpa_supplicant_deinit_iface(
  	if (terminate)
  		wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
  
@@ -218,9 +207,9 @@
 +		wpa_s->hostapd = NULL;
 +	}
 +
- 	if (wpa_s->ctrl_iface) {
- 		wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
- 		wpa_s->ctrl_iface = NULL;
+ 	wpa_supplicant_ctrl_iface_deinit(wpa_s, wpa_s->ctrl_iface);
+ 	wpa_s->ctrl_iface = NULL;
+ 
 --- a/wpa_supplicant/wpa_supplicant_i.h
 +++ b/wpa_supplicant/wpa_supplicant_i.h
 @@ -104,6 +104,11 @@ struct wpa_interface {
@@ -235,7 +224,7 @@
  	 * bridge_ifname - Optional bridge interface name
  	 *
  	 * If the driver interface (ifname) is included in a Linux bridge
-@@ -530,6 +535,8 @@ struct wpa_supplicant {
+@@ -718,6 +723,8 @@ struct wpa_supplicant {
  #endif /* CONFIG_CTRL_IFACE_BINDER */
  	char bridge_ifname[16];
  
@@ -246,23 +235,24 @@
  
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -2712,6 +2712,11 @@ static int hostapd_ctrl_iface_chan_switc
+@@ -2889,6 +2889,12 @@ static int hostapd_ctrl_iface_chan_switc
  		return 0;
  	}
  
 +	if (os_strstr(pos, " auto-ht")) {
 +		settings.freq_params.ht_enabled = iface->conf->ieee80211n;
 +		settings.freq_params.vht_enabled = iface->conf->ieee80211ac;
++		settings.freq_params.he_enabled = iface->conf->ieee80211ax;
 +	}
 +
  	for (i = 0; i < iface->num_bss; i++) {
  
- 		/* Save CHAN_SWITCH VHT config */
+ 		/* Save CHAN_SWITCH VHT and HE config */
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
-@@ -1468,11 +1468,6 @@ int ieee802_11_set_beacon(struct hostapd
- 	struct wpabuf *beacon, *proberesp, *assocresp;
- 	int res, ret = -1;
+@@ -1791,11 +1791,6 @@ static int __ieee802_11_set_beacon(struc
+ 		return -1;
+ 	}
  
 -	if (hapd->csa_in_progress) {
 -		wpa_printf(MSG_ERROR, "Cannot set beacons during CSA period");
@@ -274,7 +264,7 @@
  	if (ieee802_11_build_ap_params(hapd, &params) < 0)
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -4579,6 +4579,60 @@ static void wpas_event_unprot_beacon(str
+@@ -4891,6 +4891,60 @@ static void wpas_event_unprot_beacon(str
  }
  
  
@@ -335,7 +325,7 @@
  void supplicant_event(void *ctx, enum wpa_event_type event,
  		      union wpa_event_data *data)
  {
-@@ -4881,8 +4935,10 @@ void supplicant_event(void *ctx, enum wp
+@@ -5206,8 +5260,10 @@ void supplicant_event(void *ctx, enum wp
  			channel_width_to_string(data->ch_switch.ch_width),
  			data->ch_switch.cf1,
  			data->ch_switch.cf2);
@@ -349,7 +339,7 @@
  		wpa_s->current_ssid->frequency = data->ch_switch.freq;
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -5690,6 +5690,7 @@ union wpa_event_data {
+@@ -5837,6 +5837,7 @@ union wpa_event_data {
  
  	/**
  	 * struct ch_switch
@@ -357,7 +347,7 @@
  	 * @freq: Frequency of new channel in MHz
  	 * @ht_enabled: Whether this is an HT channel
  	 * @ch_offset: Secondary channel offset
-@@ -5698,6 +5699,7 @@ union wpa_event_data {
+@@ -5845,6 +5846,7 @@ union wpa_event_data {
  	 * @cf2: Center frequency 2
  	 */
  	struct ch_switch {
@@ -367,7 +357,7 @@
  		int ch_offset;
 --- a/src/drivers/driver_nl80211_event.c
 +++ b/src/drivers/driver_nl80211_event.c
-@@ -541,7 +541,7 @@ static void mlme_event_ch_switch(struct
+@@ -684,7 +684,7 @@ static void mlme_event_ch_switch(struct
  				 struct nlattr *ifindex, struct nlattr *freq,
  				 struct nlattr *type, struct nlattr *bw,
  				 struct nlattr *cf1, struct nlattr *cf2,
@@ -376,7 +366,7 @@
  {
  	struct i802_bss *bss;
  	union wpa_event_data data;
-@@ -600,6 +600,8 @@ static void mlme_event_ch_switch(struct
+@@ -745,6 +745,8 @@ static void mlme_event_ch_switch(struct
  		data.ch_switch.cf1 = nla_get_u32(cf1);
  	if (cf2)
  		data.ch_switch.cf2 = nla_get_u32(cf2);
@@ -385,7 +375,7 @@
  
  	if (finished)
  		bss->freq = data.ch_switch.freq;
-@@ -2686,6 +2688,7 @@ static void do_process_drv_event(struct
+@@ -3003,6 +3005,7 @@ static void do_process_drv_event(struct
  				     tb[NL80211_ATTR_CHANNEL_WIDTH],
  				     tb[NL80211_ATTR_CENTER_FREQ1],
  				     tb[NL80211_ATTR_CENTER_FREQ2],
@@ -393,7 +383,7 @@
  				     0);
  		break;
  	case NL80211_CMD_CH_SWITCH_NOTIFY:
-@@ -2696,6 +2699,7 @@ static void do_process_drv_event(struct
+@@ -3013,6 +3016,7 @@ static void do_process_drv_event(struct
  				     tb[NL80211_ATTR_CHANNEL_WIDTH],
  				     tb[NL80211_ATTR_CENTER_FREQ1],
  				     tb[NL80211_ATTR_CENTER_FREQ2],
diff --git a/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch b/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch
index b98b2d0cba..92b52a6d37 100644
--- a/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch
+++ b/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/Makefile
 +++ b/hostapd/Makefile
-@@ -226,6 +226,9 @@ endif
+@@ -221,6 +221,9 @@ endif
  ifdef CONFIG_NO_CTRL_IFACE
  CFLAGS += -DCONFIG_NO_CTRL_IFACE
  else
@@ -12,7 +12,7 @@
  else
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -3370,6 +3370,7 @@ static int hostapd_ctrl_iface_receive_pr
+@@ -3587,6 +3587,7 @@ static int hostapd_ctrl_iface_receive_pr
  						      reply_size);
  	} else if (os_strcmp(buf, "STATUS-DRIVER") == 0) {
  		reply_len = hostapd_drv_status(hapd, reply, reply_size);
@@ -20,7 +20,7 @@
  	} else if (os_strcmp(buf, "MIB") == 0) {
  		reply_len = ieee802_11_get_mib(hapd, reply, reply_size);
  		if (reply_len >= 0) {
-@@ -3411,6 +3412,7 @@ static int hostapd_ctrl_iface_receive_pr
+@@ -3628,6 +3629,7 @@ static int hostapd_ctrl_iface_receive_pr
  	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
  		reply_len = hostapd_ctrl_iface_sta_next(hapd, buf + 9, reply,
  							reply_size);
@@ -30,7 +30,7 @@
  			reply_len = -1;
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -952,6 +952,9 @@ ifdef CONFIG_FILS
+@@ -958,6 +958,9 @@ ifdef CONFIG_FILS
  OBJS += ../src/ap/fils_hlp.o
  endif
  ifdef CONFIG_CTRL_IFACE
@@ -42,7 +42,7 @@
  
 --- a/wpa_supplicant/ctrl_iface.c
 +++ b/wpa_supplicant/ctrl_iface.c
-@@ -2267,7 +2267,7 @@ static int wpa_supplicant_ctrl_iface_sta
+@@ -2314,7 +2314,7 @@ static int wpa_supplicant_ctrl_iface_sta
  			pos += ret;
  		}
  
@@ -51,7 +51,7 @@
  		if (wpa_s->ap_iface) {
  			pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos,
  							    end - pos,
-@@ -10366,6 +10366,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -11494,6 +11494,7 @@ char * wpa_supplicant_ctrl_iface_process
  			reply_len = -1;
  	} else if (os_strncmp(buf, "NOTE ", 5) == 0) {
  		wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
@@ -59,7 +59,7 @@
  	} else if (os_strcmp(buf, "MIB") == 0) {
  		reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
  		if (reply_len >= 0) {
-@@ -10378,6 +10379,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -11506,6 +11507,7 @@ char * wpa_supplicant_ctrl_iface_process
  				reply_size - reply_len);
  #endif /* CONFIG_MACSEC */
  		}
@@ -67,7 +67,7 @@
  	} else if (os_strncmp(buf, "STATUS", 6) == 0) {
  		reply_len = wpa_supplicant_ctrl_iface_status(
  			wpa_s, buf + 6, reply, reply_size);
-@@ -10862,6 +10864,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -11994,6 +11996,7 @@ char * wpa_supplicant_ctrl_iface_process
  		reply_len = wpa_supplicant_ctrl_iface_bss(
  			wpa_s, buf + 4, reply, reply_size);
  #ifdef CONFIG_AP
@@ -75,7 +75,7 @@
  	} else if (os_strcmp(buf, "STA-FIRST") == 0) {
  		reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
  	} else if (os_strncmp(buf, "STA ", 4) == 0) {
-@@ -10870,12 +10873,15 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -12002,12 +12005,15 @@ char * wpa_supplicant_ctrl_iface_process
  	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
  		reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
  						   reply_size);
@@ -101,7 +101,7 @@
  
  static size_t hostapd_write_ht_mcs_bitmask(char *buf, size_t buflen,
  					   size_t curr_len, const u8 *mcs_set)
-@@ -451,6 +452,7 @@ int hostapd_ctrl_iface_sta_next(struct h
+@@ -459,6 +460,7 @@ int hostapd_ctrl_iface_sta_next(struct h
  	return hostapd_ctrl_iface_sta_mib(hapd, sta->next, buf, buflen);
  }
  
@@ -109,7 +109,7 @@
  
  #ifdef CONFIG_P2P_MANAGER
  static int p2p_manager_disconnect(struct hostapd_data *hapd, u16 stype,
-@@ -806,12 +808,12 @@ int hostapd_ctrl_iface_status(struct hos
+@@ -815,12 +817,12 @@ int hostapd_ctrl_iface_status(struct hos
  			return len;
  		len += ret;
  	}
@@ -126,7 +126,7 @@
  		if (os_snprintf_error(buflen - len, ret))
 --- a/src/ap/ieee802_1x.c
 +++ b/src/ap/ieee802_1x.c
-@@ -2711,6 +2711,7 @@ static const char * bool_txt(bool val)
+@@ -2712,6 +2712,7 @@ static const char * bool_txt(bool val)
  	return val ? "TRUE" : "FALSE";
  }
  
@@ -134,7 +134,7 @@
  
  int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
  {
-@@ -2897,6 +2898,7 @@ int ieee802_1x_get_mib_sta(struct hostap
+@@ -2898,6 +2899,7 @@ int ieee802_1x_get_mib_sta(struct hostap
  	return len;
  }
  
@@ -144,7 +144,7 @@
  static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx)
 --- a/src/ap/wpa_auth.c
 +++ b/src/ap/wpa_auth.c
-@@ -4451,6 +4451,7 @@ static const char * wpa_bool_txt(int val
+@@ -4519,6 +4519,7 @@ static const char * wpa_bool_txt(int val
  	return val ? "TRUE" : "FALSE";
  }
  
@@ -152,7 +152,7 @@
  
  #define RSN_SUITE "%02x-%02x-%02x-%d"
  #define RSN_SUITE_ARG(s) \
-@@ -4601,7 +4602,7 @@ int wpa_get_mib_sta(struct wpa_state_mac
+@@ -4669,7 +4670,7 @@ int wpa_get_mib_sta(struct wpa_state_mac
  
  	return len;
  }
@@ -163,7 +163,7 @@
  {
 --- a/src/rsn_supp/wpa.c
 +++ b/src/rsn_supp/wpa.c
-@@ -2728,6 +2728,8 @@ static u32 wpa_key_mgmt_suite(struct wpa
+@@ -2777,6 +2777,8 @@ static u32 wpa_key_mgmt_suite(struct wpa
  }
  
  
@@ -172,7 +172,7 @@
  #define RSN_SUITE "%02x-%02x-%02x-%d"
  #define RSN_SUITE_ARG(s) \
  ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
-@@ -2809,6 +2811,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch
+@@ -2858,6 +2860,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch
  
  	return (int) len;
  }
@@ -182,7 +182,7 @@
  
 --- a/wpa_supplicant/ap.c
 +++ b/wpa_supplicant/ap.c
-@@ -1324,7 +1324,7 @@ int wpas_ap_wps_nfc_report_handover(stru
+@@ -1462,7 +1462,7 @@ int wpas_ap_wps_nfc_report_handover(stru
  #endif /* CONFIG_WPS */
  
  
diff --git a/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch b/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch
index 9dee2d738e..65a8b07e65 100644
--- a/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch
+++ b/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch
@@ -1,6 +1,6 @@
 --- a/src/common/wpa_common.c
 +++ b/src/common/wpa_common.c
-@@ -2121,6 +2121,31 @@ u32 wpa_akm_to_suite(int akm)
+@@ -2444,6 +2444,31 @@ u32 wpa_akm_to_suite(int akm)
  }
  
  
@@ -32,7 +32,7 @@
  int wpa_compare_rsn_ie(int ft_initial_assoc,
  		       const u8 *ie1, size_t ie1len,
  		       const u8 *ie2, size_t ie2len)
-@@ -2128,8 +2153,19 @@ int wpa_compare_rsn_ie(int ft_initial_as
+@@ -2451,8 +2476,19 @@ int wpa_compare_rsn_ie(int ft_initial_as
  	if (ie1 == NULL || ie2 == NULL)
  		return -1;
  
diff --git a/package/network/services/hostapd/patches/400-wps_single_auth_enc_type.patch b/package/network/services/hostapd/patches/400-wps_single_auth_enc_type.patch
index 73a8c7694d..f708bf39ba 100644
--- a/package/network/services/hostapd/patches/400-wps_single_auth_enc_type.patch
+++ b/package/network/services/hostapd/patches/400-wps_single_auth_enc_type.patch
@@ -11,7 +11,7 @@
  			bss->wpa_pairwise |= WPA_CIPHER_TKIP;
  #endif /* CONFIG_NO_TKIP */
  		bss->rsn_pairwise = bss->wpa_pairwise;
-@@ -1178,8 +1177,7 @@ int hostapd_init_wps(struct hostapd_data
+@@ -1180,8 +1179,7 @@ int hostapd_init_wps(struct hostapd_data
  					  WPA_CIPHER_GCMP_256)) {
  			wps->encr_types |= WPS_ENCR_AES;
  			wps->encr_types_rsn |= WPS_ENCR_AES;
diff --git a/package/network/services/hostapd/patches/420-indicate-features.patch b/package/network/services/hostapd/patches/420-indicate-features.patch
index 9f216347f4..12edb6bacc 100644
--- a/package/network/services/hostapd/patches/420-indicate-features.patch
+++ b/package/network/services/hostapd/patches/420-indicate-features.patch
@@ -1,23 +1,24 @@
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -15,6 +15,7 @@
- #include "utils/common.h"
- #include "utils/eloop.h"
- #include "utils/uuid.h"
-+#include "utils/build_features.h"
- #include "crypto/random.h"
- #include "crypto/tls.h"
- #include "common/version.h"
-@@ -692,7 +693,7 @@ int main(int argc, char *argv[])
+@@ -31,7 +31,7 @@
+ #include "config_file.h"
+ #include "eap_register.h"
+ #include "ctrl_iface.h"
+-
++#include "build_features.h"
+ 
+ struct hapd_global {
+ 	void **drv_priv;
+@@ -692,7 +692,7 @@ int main(int argc, char *argv[])
  	wpa_supplicant_event = hostapd_wpa_event;
  	wpa_supplicant_event_global = hostapd_wpa_event_global;
  	for (;;) {
--		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:");
-+		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:g:G:v::");
+-		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:q");
++		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:g:G:qv::");
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -729,6 +730,8 @@ int main(int argc, char *argv[])
+@@ -729,6 +729,8 @@ int main(int argc, char *argv[])
  			break;
  #endif /* CONFIG_DEBUG_LINUX_TRACING */
  		case 'v':
@@ -25,7 +26,7 @@
 +				exit(!has_feature(optarg));
  			show_version();
  			exit(1);
- 			break;
+ 		case 'g':
 --- a/wpa_supplicant/main.c
 +++ b/wpa_supplicant/main.c
 @@ -12,6 +12,7 @@
@@ -33,10 +34,10 @@
  
  #include "common.h"
 +#include "build_features.h"
+ #include "crypto/crypto.h"
  #include "fst/fst.h"
  #include "wpa_supplicant_i.h"
- #include "driver_i.h"
-@@ -202,7 +203,7 @@ int main(int argc, char *argv[])
+@@ -203,7 +204,7 @@ int main(int argc, char *argv[])
  
  	for (;;) {
  		c = getopt(argc, argv,
@@ -45,7 +46,7 @@
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -305,8 +306,12 @@ int main(int argc, char *argv[])
+@@ -306,8 +307,12 @@ int main(int argc, char *argv[])
  			break;
  #endif /* CONFIG_CTRL_IFACE_DBUS_NEW */
  		case 'v':
diff --git a/package/network/services/hostapd/patches/430-hostapd_cli_ifdef.patch b/package/network/services/hostapd/patches/430-hostapd_cli_ifdef.patch
index 3744464c89..dc1fa3d29d 100644
--- a/package/network/services/hostapd/patches/430-hostapd_cli_ifdef.patch
+++ b/package/network/services/hostapd/patches/430-hostapd_cli_ifdef.patch
@@ -32,7 +32,7 @@
  
  
  static int hostapd_cli_cmd_disassoc_imminent(struct wpa_ctrl *ctrl, int argc,
-@@ -1532,13 +1528,10 @@ static const struct hostapd_cli_cmd host
+@@ -1579,13 +1575,10 @@ static const struct hostapd_cli_cmd host
  	{ "disassociate", hostapd_cli_cmd_disassociate,
  	  hostapd_complete_stations,
  	  "<addr> = disassociate a station" },
@@ -46,7 +46,7 @@
  	{ "wps_pin", hostapd_cli_cmd_wps_pin, NULL,
  	  "<uuid> <pin> [timeout] [addr] = add WPS Enrollee PIN" },
  	{ "wps_check_pin", hostapd_cli_cmd_wps_check_pin, NULL,
-@@ -1563,7 +1556,6 @@ static const struct hostapd_cli_cmd host
+@@ -1610,7 +1603,6 @@ static const struct hostapd_cli_cmd host
  	  "<SSID> <auth> <encr> <key> = configure AP" },
  	{ "wps_get_status", hostapd_cli_cmd_wps_get_status, NULL,
  	  "= show current WPS status" },
diff --git a/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch b/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
index 99c552821b..28f07c7dc2 100644
--- a/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
+++ b/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
@@ -22,7 +22,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  #include "common/defs.h"
  #include "common/ieee802_11_defs.h"
  #include "common/wpa_common.h"
-@@ -850,6 +851,9 @@ struct wpa_driver_associate_params {
+@@ -857,6 +858,9 @@ struct wpa_driver_associate_params {
  	 * responsible for selecting with which BSS to associate. */
  	const u8 *bssid;
  
@@ -42,7 +42,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  #include "config.h"
  
  
-@@ -2269,6 +2270,97 @@ static char * wpa_config_write_peerkey(c
+@@ -2321,6 +2322,97 @@ static char * wpa_config_write_peerkey(c
  #endif /* NO_CONFIG_WRITE */
  
  
@@ -140,7 +140,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  /* Helper macros for network block parser */
  
  #ifdef OFFSET
-@@ -2552,6 +2644,8 @@ static const struct parse_data ssid_fiel
+@@ -2606,6 +2698,8 @@ static const struct parse_data ssid_fiel
  	{ INT(ap_max_inactivity) },
  	{ INT(dtim_period) },
  	{ INT(beacon_int) },
@@ -162,7 +162,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  
  
  #define DEFAULT_EAP_WORKAROUND ((unsigned int) -1)
-@@ -843,6 +845,9 @@ struct wpa_ssid {
+@@ -846,6 +848,9 @@ struct wpa_ssid {
  	 */
  	void *parent_cred;
  
@@ -174,7 +174,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  	 * macsec_policy - Determines the policy for MACsec secure session
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -3638,6 +3638,12 @@ static void wpas_start_assoc_cb(struct w
+@@ -3865,6 +3865,12 @@ static void wpas_start_assoc_cb(struct w
  			params.beacon_int = ssid->beacon_int;
  		else
  			params.beacon_int = wpa_s->conf->beacon_int;
diff --git a/package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch b/package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch
index b5dec991d0..0be77f9845 100644
--- a/package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch
+++ b/package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch
@@ -10,7 +10,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
 
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -5601,7 +5601,7 @@ static int wpa_driver_nl80211_ibss(struc
+@@ -5966,7 +5966,7 @@ static int wpa_driver_nl80211_ibss(struc
  				   struct wpa_driver_associate_params *params)
  {
  	struct nl_msg *msg;
@@ -19,7 +19,7 @@ Signed-hostap: Antonio Quartulli <ordex@autistici.org>
  	int count = 0;
  
  	wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
-@@ -5628,6 +5628,37 @@ retry:
+@@ -5993,6 +5993,37 @@ retry:
  	    nl80211_put_beacon_int(msg, params->beacon_int))
  		goto fail;
  
diff --git a/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch b/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch
index 7e21da263d..bd1d4d7565 100644
--- a/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch
+++ b/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch
@@ -19,17 +19,17 @@ Tested-by: Simon Wunderlich <simon.wunderlich@openmesh.com>
 
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -1549,6 +1549,7 @@ struct wpa_driver_mesh_join_params {
+@@ -1624,6 +1624,7 @@ struct wpa_driver_mesh_join_params {
  #define WPA_DRIVER_MESH_FLAG_AMPE	0x00000008
  	unsigned int flags;
- 	u8 handle_dfs;
+ 	bool handle_dfs;
 +	int mcast_rate;
  };
  
  struct wpa_driver_set_key_params {
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -10058,6 +10058,18 @@ static int nl80211_put_mesh_id(struct nl
+@@ -10496,6 +10496,18 @@ static int nl80211_put_mesh_id(struct nl
  }
  
  
@@ -48,7 +48,7 @@ Tested-by: Simon Wunderlich <simon.wunderlich@openmesh.com>
  static int nl80211_put_mesh_config(struct nl_msg *msg,
  				   struct wpa_driver_mesh_bss_params *params)
  {
-@@ -10119,6 +10131,7 @@ static int nl80211_join_mesh(struct i802
+@@ -10557,6 +10569,7 @@ static int nl80211_join_mesh(struct i802
  	    nl80211_put_basic_rates(msg, params->basic_rates) ||
  	    nl80211_put_mesh_id(msg, params->meshid, params->meshid_len) ||
  	    nl80211_put_beacon_int(msg, params->beacon_int) ||
@@ -58,7 +58,7 @@ Tested-by: Simon Wunderlich <simon.wunderlich@openmesh.com>
  
 --- a/wpa_supplicant/mesh.c
 +++ b/wpa_supplicant/mesh.c
-@@ -592,6 +592,7 @@ int wpa_supplicant_join_mesh(struct wpa_
+@@ -631,6 +631,7 @@ int wpa_supplicant_join_mesh(struct wpa_
  
  	params->meshid = ssid->ssid;
  	params->meshid_len = ssid->ssid_len;
diff --git a/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch b/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch
index 6d48175163..4807727e0e 100644
--- a/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch
+++ b/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -2407,11 +2407,13 @@ void ibss_mesh_setup_freq(struct wpa_sup
+@@ -2512,11 +2512,13 @@ void ibss_mesh_setup_freq(struct wpa_sup
  	for (j = 0; j < wpa_s->last_scan_res_used; j++) {
  		struct wpa_bss *bss = wpa_s->last_scan_res[j];
  
diff --git a/package/network/services/hostapd/patches/465-hostapd-config-support-random-BSS-color.patch b/package/network/services/hostapd/patches/465-hostapd-config-support-random-BSS-color.patch
new file mode 100644
index 0000000000..c0b01196c4
--- /dev/null
+++ b/package/network/services/hostapd/patches/465-hostapd-config-support-random-BSS-color.patch
@@ -0,0 +1,24 @@
+From c9304d3303d563ad6d2619f4e07864ed12f96889 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sat, 14 May 2022 21:41:03 +0200
+Subject: [PATCH] hostapd: config: support random BSS color
+
+Configure the HE BSS color to a random value in case the config defines
+a BSS color which exceeds the max BSS color (63).
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ hostapd/config_file.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3485,6 +3485,8 @@ static int hostapd_config_fill(struct ho
+ 	} else if (os_strcmp(buf, "he_bss_color") == 0) {
+ 		conf->he_op.he_bss_color = atoi(pos) & 0x3f;
+ 		conf->he_op.he_bss_color_disabled = 0;
++		if (atoi(pos) > 63)
++			conf->he_op.he_bss_color = os_random() % 63 + 1;
+ 	} else if (os_strcmp(buf, "he_bss_color_partial") == 0) {
+ 		conf->he_op.he_bss_color_partial = atoi(pos);
+ 	} else if (os_strcmp(buf, "he_default_pe_duration") == 0) {
diff --git a/package/network/services/hostapd/patches/470-survey_data_fallback.patch b/package/network/services/hostapd/patches/470-survey_data_fallback.patch
index 57a78ee865..359b5f3ef8 100644
--- a/package/network/services/hostapd/patches/470-survey_data_fallback.patch
+++ b/package/network/services/hostapd/patches/470-survey_data_fallback.patch
@@ -1,26 +1,6 @@
 --- a/src/ap/acs.c
 +++ b/src/ap/acs.c
-@@ -302,18 +302,12 @@ static void acs_fail(struct hostapd_ifac
- static long double
- acs_survey_interference_factor(struct freq_survey *survey, s8 min_nf)
- {
--	long double factor, busy, total;
-+	long double factor, busy = 0, total;
- 
- 	if (survey->filled & SURVEY_HAS_CHAN_TIME_BUSY)
- 		busy = survey->channel_time_busy;
- 	else if (survey->filled & SURVEY_HAS_CHAN_TIME_RX)
- 		busy = survey->channel_time_rx;
--	else {
--		/* This shouldn't really happen as survey data is checked in
--		 * acs_sanity_check() */
--		wpa_printf(MSG_ERROR, "ACS: Survey data missing");
--		return 0;
--	}
- 
- 	total = survey->channel_time;
- 
-@@ -415,20 +409,19 @@ static int acs_usable_vht160_chan(const
+@@ -420,20 +420,19 @@ static int acs_usable_bw160_chan(const s
  static int acs_survey_is_sufficient(struct freq_survey *survey)
  {
  	if (!(survey->filled & SURVEY_HAS_NF)) {
diff --git a/package/network/services/hostapd/patches/500-lto-jobserver-support.patch b/package/network/services/hostapd/patches/500-lto-jobserver-support.patch
index 46030859de..c51db01fec 100644
--- a/package/network/services/hostapd/patches/500-lto-jobserver-support.patch
+++ b/package/network/services/hostapd/patches/500-lto-jobserver-support.patch
@@ -1,16 +1,17 @@
 --- a/hostapd/Makefile
 +++ b/hostapd/Makefile
-@@ -1327,14 +1327,14 @@ hostapd_multi.a: $(BCHECK) $(OBJS)
+@@ -1297,7 +1297,7 @@ hostapd_multi.a: $(BCHECK) $(OBJS)
  	@$(AR) cr $@ hostapd_multi.o $(OBJS)
  
- hostapd: $(BCHECK) $(OBJS)
+ hostapd: $(OBJS)
 -	$(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
 +	+$(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
  	@$(E) "  LD " $@
  
  ifdef CONFIG_WPA_TRACE
- OBJS_c += ../src/utils/trace.o
- endif
+@@ -1308,7 +1308,7 @@ _OBJS_VAR := OBJS_c
+ include ../src/objs.mk
+ 
  hostapd_cli: $(OBJS_c)
 -	$(Q)$(CC) $(LDFLAGS) -o hostapd_cli $(OBJS_c) $(LIBS_c)
 +	+$(Q)$(CC) $(LDFLAGS) -o hostapd_cli $(OBJS_c) $(LIBS_c)
@@ -19,7 +20,7 @@
  NOBJS = nt_password_hash.o ../src/crypto/ms_funcs.o $(SHA1OBJS)
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -1930,23 +1930,23 @@ wpa_supplicant_multi.a: .config $(BCHECK
+@@ -1920,31 +1920,31 @@ wpa_supplicant_multi.a: .config $(BCHECK
  	@$(AR) cr $@ wpa_supplicant_multi.o $(OBJS)
  
  wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs)
@@ -27,21 +28,29 @@
 +	+$(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
  	@$(E) "  LD " $@
  
+ _OBJS_VAR := OBJS_t
+ include ../src/objs.mk
  eapol_test: $(OBJS_t)
 -	$(Q)$(LDO) $(LDFLAGS) -o eapol_test $(OBJS_t) $(LIBS)
 +	+$(Q)$(LDO) $(LDFLAGS) -o eapol_test $(OBJS_t) $(LIBS)
  	@$(E) "  LD " $@
  
+ _OBJS_VAR := OBJS_t2
+ include ../src/objs.mk
  preauth_test: $(OBJS_t2)
 -	$(Q)$(LDO) $(LDFLAGS) -o preauth_test $(OBJS_t2) $(LIBS)
 +	+$(Q)$(LDO) $(LDFLAGS) -o preauth_test $(OBJS_t2) $(LIBS)
  	@$(E) "  LD " $@
  
+ _OBJS_VAR := OBJS_p
+ include ../src/objs.mk
  wpa_passphrase: $(OBJS_p)
 -	$(Q)$(LDO) $(LDFLAGS) -o wpa_passphrase $(OBJS_p) $(LIBS_p) $(LIBS)
 +	+$(Q)$(LDO) $(LDFLAGS) -o wpa_passphrase $(OBJS_p) $(LIBS_p) $(LIBS)
  	@$(E) "  LD " $@
  
+ _OBJS_VAR := OBJS_c
+ include ../src/objs.mk
  wpa_cli: $(OBJS_c)
 -	$(Q)$(LDO) $(LDFLAGS) -o wpa_cli $(OBJS_c) $(LIBS_c)
 +	+$(Q)$(LDO) $(LDFLAGS) -o wpa_cli $(OBJS_c) $(LIBS_c)
diff --git a/package/network/services/hostapd/patches/590-rrm-wnm-statistics.patch b/package/network/services/hostapd/patches/590-rrm-wnm-statistics.patch
new file mode 100644
index 0000000000..ee3ab7938a
--- /dev/null
+++ b/package/network/services/hostapd/patches/590-rrm-wnm-statistics.patch
@@ -0,0 +1,92 @@
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -150,6 +150,21 @@ struct hostapd_sae_commit_queue {
+ };
+ 
+ /**
++ * struct hostapd_openwrt_stats - OpenWrt custom STA/AP statistics
++ */
++struct hostapd_openwrt_stats {
++	struct {
++		u64 neighbor_report_tx;
++	} rrm;
++
++	struct {
++		u64 bss_transition_query_rx;
++		u64 bss_transition_request_tx;
++		u64 bss_transition_response_rx;
++	} wnm;
++};
++
++/**
+  * struct hostapd_data - hostapd per-BSS data structure
+  */
+ struct hostapd_data {
+@@ -163,6 +178,9 @@ struct hostapd_data {
+ 
+ 	u8 own_addr[ETH_ALEN];
+ 
++	/* OpenWrt specific statistics */
++	struct hostapd_openwrt_stats openwrt_stats;
++
+ 	int num_sta; /* number of entries in sta_list */
+ 	struct sta_info *sta_list; /* STA info list head */
+ #define STA_HASH_SIZE 256
+--- a/src/ap/wnm_ap.c
++++ b/src/ap/wnm_ap.c
+@@ -386,6 +386,7 @@ static int ieee802_11_send_bss_trans_mgm
+ 	mgmt->u.action.u.bss_tm_req.validity_interval = 1;
+ 	pos = mgmt->u.action.u.bss_tm_req.variable;
+ 
++	hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ 	wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
+ 		   MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
+ 		   "validity_interval=%u",
+@@ -646,10 +647,12 @@ int ieee802_11_rx_wnm_action_ap(struct h
+ 
+ 	switch (action) {
+ 	case WNM_BSS_TRANS_MGMT_QUERY:
++		hapd->openwrt_stats.wnm.bss_transition_query_rx++;
+ 		ieee802_11_rx_bss_trans_mgmt_query(hapd, mgmt->sa, payload,
+ 						   plen);
+ 		return 0;
+ 	case WNM_BSS_TRANS_MGMT_RESP:
++		hapd->openwrt_stats.wnm.bss_transition_response_rx++;
+ 		ieee802_11_rx_bss_trans_mgmt_resp(hapd, mgmt->sa, payload,
+ 						  plen);
+ 		return 0;
+@@ -696,6 +699,7 @@ int wnm_send_disassoc_imminent(struct ho
+ 
+ 	pos = mgmt->u.action.u.bss_tm_req.variable;
+ 
++	hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ 	wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request frame to indicate imminent disassociation (disassoc_timer=%d) to "
+ 		   MACSTR, disassoc_timer, MAC2STR(sta->addr));
+ 	if (hostapd_drv_send_mlme(hapd, buf, pos - buf, 0, NULL, 0, 0) < 0) {
+@@ -777,6 +781,7 @@ int wnm_send_ess_disassoc_imminent(struc
+ 		return -1;
+ 	}
+ 
++	hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ 	if (disassoc_timer) {
+ 		/* send disassociation frame after time-out */
+ 		set_disassoc_timer(hapd, sta, disassoc_timer);
+@@ -857,6 +862,7 @@ int wnm_send_bss_tm_req(struct hostapd_d
+ 	}
+ 	os_free(buf);
+ 
++	hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ 	if (disassoc_timer) {
+ 		/* send disassociation frame after time-out */
+ 		set_disassoc_timer(hapd, sta, disassoc_timer);
+--- a/src/ap/rrm.c
++++ b/src/ap/rrm.c
+@@ -269,6 +269,8 @@ static void hostapd_send_nei_report_resp
+ 		}
+ 	}
+ 
++	hapd->openwrt_stats.rrm.neighbor_report_tx++;
++
+ 	hostapd_drv_send_action(hapd, hapd->iface->freq, 0, addr,
+ 				wpabuf_head(buf), wpabuf_len(buf));
+ 	wpabuf_free(buf);
diff --git a/package/network/services/hostapd/patches/600-ubus_support.patch b/package/network/services/hostapd/patches/600-ubus_support.patch
index d8fdec3d24..4abb6887f6 100644
--- a/package/network/services/hostapd/patches/600-ubus_support.patch
+++ b/package/network/services/hostapd/patches/600-ubus_support.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/Makefile
 +++ b/hostapd/Makefile
-@@ -171,6 +171,11 @@ OBJS += ../src/common/hw_features_common
+@@ -166,6 +166,11 @@ OBJS += ../src/common/hw_features_common
  
  OBJS += ../src/eapol_auth/eapol_auth_sm.o
  
@@ -31,7 +31,7 @@
  };
  
  enum hostapd_chan_status {
-@@ -154,6 +155,7 @@ struct hostapd_data {
+@@ -171,6 +172,7 @@ struct hostapd_data {
  	struct hostapd_iface *iface;
  	struct hostapd_config *iconf;
  	struct hostapd_bss_config *conf;
@@ -39,7 +39,7 @@
  	int interface_added; /* virtual interface added for this BSS */
  	unsigned int started:1;
  	unsigned int disabled:1;
-@@ -606,6 +608,7 @@ hostapd_alloc_bss_data(struct hostapd_if
+@@ -630,6 +632,7 @@ hostapd_alloc_bss_data(struct hostapd_if
  		       struct hostapd_bss_config *bss);
  int hostapd_setup_interface(struct hostapd_iface *iface);
  int hostapd_setup_interface_complete(struct hostapd_iface *iface, int err);
@@ -49,7 +49,7 @@
  struct hostapd_iface * hostapd_alloc_iface(void);
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -395,6 +395,7 @@ void hostapd_free_hapd_data(struct hosta
+@@ -396,6 +396,7 @@ void hostapd_free_hapd_data(struct hosta
  	hapd->beacon_set_done = 0;
  
  	wpa_printf(MSG_DEBUG, "%s(%s)", __func__, hapd->conf->iface);
@@ -57,7 +57,7 @@
  	accounting_deinit(hapd);
  	hostapd_deinit_wpa(hapd);
  	vlan_deinit(hapd);
-@@ -1417,6 +1418,8 @@ static int hostapd_setup_bss(struct host
+@@ -1422,6 +1423,8 @@ static int hostapd_setup_bss(struct host
  	if (hapd->driver && hapd->driver->set_operstate)
  		hapd->driver->set_operstate(hapd->drv_priv, 1);
  
@@ -66,7 +66,7 @@
  	return 0;
  }
  
-@@ -1999,6 +2002,7 @@ static int hostapd_setup_interface_compl
+@@ -2028,6 +2031,7 @@ static int hostapd_setup_interface_compl
  	if (err)
  		goto fail;
  
@@ -74,7 +74,7 @@
  	wpa_printf(MSG_DEBUG, "Completing interface initialization");
  	if (iface->freq) {
  #ifdef NEED_AP_MLME
-@@ -2196,6 +2200,7 @@ dfs_offload:
+@@ -2225,6 +2229,7 @@ dfs_offload:
  
  fail:
  	wpa_printf(MSG_ERROR, "Interface initialization failed");
@@ -82,7 +82,7 @@
  	hostapd_set_state(iface, HAPD_IFACE_DISABLED);
  	wpa_msg(hapd->msg_ctx, MSG_INFO, AP_EVENT_DISABLED);
  #ifdef CONFIG_FST
-@@ -2669,6 +2674,7 @@ void hostapd_interface_deinit_free(struc
+@@ -2700,6 +2705,7 @@ void hostapd_interface_deinit_free(struc
  		   (unsigned int) iface->conf->num_bss);
  	driver = iface->bss[0]->driver;
  	drv_priv = iface->bss[0]->drv_priv;
@@ -92,7 +92,7 @@
  		   __func__, driver, drv_priv);
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
-@@ -2327,13 +2327,18 @@ static void handle_auth(struct hostapd_d
+@@ -3553,13 +3553,18 @@ static void handle_auth(struct hostapd_d
  	u16 auth_alg, auth_transaction, status_code;
  	u16 resp = WLAN_STATUS_SUCCESS;
  	struct sta_info *sta = NULL;
@@ -112,7 +112,7 @@
  
  	if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
  		wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
-@@ -2493,6 +2498,13 @@ static void handle_auth(struct hostapd_d
+@@ -3727,6 +3732,13 @@ static void handle_auth(struct hostapd_d
  		resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
  		goto fail;
  	}
@@ -126,16 +126,16 @@
  	if (res == HOSTAPD_ACL_PENDING)
  		return;
  
-@@ -4157,7 +4169,7 @@ static void handle_assoc(struct hostapd_
+@@ -5447,7 +5459,7 @@ static void handle_assoc(struct hostapd_
  	int resp = WLAN_STATUS_SUCCESS;
- 	u16 reply_res;
+ 	u16 reply_res = WLAN_STATUS_UNSPECIFIED_FAILURE;
  	const u8 *pos;
 -	int left, i;
 +	int left, i, ubus_resp;
  	struct sta_info *sta;
  	u8 *tmp = NULL;
  #ifdef CONFIG_FILS
-@@ -4370,6 +4382,11 @@ static void handle_assoc(struct hostapd_
+@@ -5660,6 +5672,11 @@ static void handle_assoc(struct hostapd_
  		left = res;
  	}
  #endif /* CONFIG_FILS */
@@ -147,7 +147,7 @@
  
  	/* followed by SSID and Supported rates; and HT capabilities if 802.11n
  	 * is used */
-@@ -4468,6 +4485,14 @@ static void handle_assoc(struct hostapd_
+@@ -5758,6 +5775,13 @@ static void handle_assoc(struct hostapd_
  	}
  #endif /* CONFIG_FILS */
  
@@ -158,11 +158,10 @@
 +		resp = ubus_resp > 0 ? (u16) ubus_resp : WLAN_STATUS_UNSPECIFIED_FAILURE;
 +		goto fail;
 +	}
-+
   fail:
  
  	/*
-@@ -4561,6 +4586,7 @@ static void handle_disassoc(struct hosta
+@@ -5851,6 +5875,7 @@ static void handle_disassoc(struct hosta
  	wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
  		   MAC2STR(mgmt->sa),
  		   le_to_host16(mgmt->u.disassoc.reason_code));
@@ -170,9 +169,9 @@
  
  	sta = ap_get_sta(hapd, mgmt->sa);
  	if (sta == NULL) {
-@@ -4627,6 +4653,8 @@ static void handle_deauth(struct hostapd
- 		" reason_code=%d",
- 		MAC2STR(mgmt->sa), le_to_host16(mgmt->u.deauth.reason_code));
+@@ -5920,6 +5945,8 @@ static void handle_deauth(struct hostapd
+ 	/* Clear the PTKSA cache entries for PASN */
+ 	ptksa_cache_flush(hapd->ptksa, mgmt->sa, WPA_CIPHER_NONE);
  
 +	hostapd_ubus_notify(hapd, "deauth", mgmt->sa);
 +
@@ -181,7 +180,7 @@
  		wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
-@@ -814,6 +814,12 @@ void handle_probe_req(struct hostapd_dat
+@@ -852,6 +852,12 @@ void handle_probe_req(struct hostapd_dat
  	u16 csa_offs[2];
  	size_t csa_offs_len;
  	struct radius_sta rad_info;
@@ -192,9 +191,9 @@
 +		.elems = &elems,
 +	};
  
- 	if (len < IEEE80211_HDRLEN)
- 		return;
-@@ -996,6 +1002,12 @@ void handle_probe_req(struct hostapd_dat
+ 	if (hapd->iconf->rssi_ignore_probe_request && ssi_signal &&
+ 	    ssi_signal < hapd->iconf->rssi_ignore_probe_request)
+@@ -1038,6 +1044,12 @@ void handle_probe_req(struct hostapd_dat
  	}
  #endif /* CONFIG_P2P */
  
@@ -209,7 +208,7 @@
  
 --- a/src/ap/drv_callbacks.c
 +++ b/src/ap/drv_callbacks.c
-@@ -119,6 +119,10 @@ int hostapd_notif_assoc(struct hostapd_d
+@@ -145,6 +145,10 @@ int hostapd_notif_assoc(struct hostapd_d
  	u16 reason = WLAN_REASON_UNSPECIFIED;
  	int status = WLAN_STATUS_SUCCESS;
  	const u8 *p2p_dev_addr = NULL;
@@ -220,7 +219,7 @@
  
  	if (addr == NULL) {
  		/*
-@@ -211,6 +215,12 @@ int hostapd_notif_assoc(struct hostapd_d
+@@ -237,6 +241,12 @@ int hostapd_notif_assoc(struct hostapd_d
  		goto fail;
  	}
  
@@ -235,7 +234,7 @@
  		wpabuf_free(sta->p2p_ie);
 --- a/src/ap/sta_info.c
 +++ b/src/ap/sta_info.c
-@@ -423,6 +423,7 @@ void ap_handle_timer(void *eloop_ctx, vo
+@@ -458,6 +458,7 @@ void ap_handle_timer(void *eloop_ctx, vo
  		hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
  			       HOSTAPD_LEVEL_INFO, "deauthenticated due to "
  			       "local deauth request");
@@ -243,7 +242,7 @@
  		ap_free_sta(hapd, sta);
  		return;
  	}
-@@ -578,6 +579,7 @@ skip_poll:
+@@ -613,6 +614,7 @@ skip_poll:
  		mlme_deauthenticate_indication(
  			hapd, sta,
  			WLAN_REASON_PREV_AUTH_NOT_VALID);
@@ -251,7 +250,7 @@
  		ap_free_sta(hapd, sta);
  		break;
  	}
-@@ -1294,6 +1296,7 @@ void ap_sta_set_authorized(struct hostap
+@@ -1329,6 +1331,7 @@ void ap_sta_set_authorized(struct hostap
  					  buf, ip_addr, keyid_buf);
  	} else {
  		wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED "%s", buf);
@@ -261,7 +260,7 @@
  		    hapd->msg_ctx_parent != hapd->msg_ctx)
 --- a/src/ap/wpa_auth_glue.c
 +++ b/src/ap/wpa_auth_glue.c
-@@ -259,6 +259,7 @@ static void hostapd_wpa_auth_psk_failure
+@@ -265,6 +265,7 @@ static void hostapd_wpa_auth_psk_failure
  	struct hostapd_data *hapd = ctx;
  	wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_POSSIBLE_PSK_MISMATCH MACSTR,
  		MAC2STR(addr));
@@ -271,7 +270,7 @@
  
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -190,6 +190,12 @@ ifdef CONFIG_EAPOL_TEST
+@@ -176,6 +176,12 @@ ifdef CONFIG_EAPOL_TEST
  CFLAGS += -Werror -DEAPOL_TEST
  endif
  
@@ -284,7 +283,7 @@
  ifdef CONFIG_CODE_COVERAGE
  CFLAGS += -O0 -fprofile-arcs -ftest-coverage
  LIBS += -lgcov
-@@ -956,6 +962,9 @@ ifdef CONFIG_CTRL_IFACE_MIB
+@@ -962,6 +968,9 @@ ifdef CONFIG_CTRL_IFACE_MIB
  CFLAGS += -DCONFIG_CTRL_IFACE_MIB
  endif
  OBJS += ../src/ap/ctrl_iface_ap.o
@@ -296,7 +295,7 @@
  CFLAGS += -DEAP_SERVER -DEAP_SERVER_IDENTITY
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -6794,6 +6794,8 @@ struct wpa_supplicant * wpa_supplicant_a
+@@ -7241,6 +7241,8 @@ struct wpa_supplicant * wpa_supplicant_a
  	}
  #endif /* CONFIG_P2P */
  
@@ -305,7 +304,7 @@
  	return wpa_s;
  }
  
-@@ -6820,6 +6822,8 @@ int wpa_supplicant_remove_iface(struct w
+@@ -7267,6 +7269,8 @@ int wpa_supplicant_remove_iface(struct w
  	struct wpa_supplicant *parent = wpa_s->parent;
  #endif /* CONFIG_MESH */
  
@@ -314,7 +313,7 @@
  	/* Remove interface from the global list of interfaces */
  	prev = global->ifaces;
  	if (prev == wpa_s) {
-@@ -7123,8 +7127,12 @@ int wpa_supplicant_run(struct wpa_global
+@@ -7570,8 +7574,12 @@ int wpa_supplicant_run(struct wpa_global
  	eloop_register_signal_terminate(wpa_supplicant_terminate, global);
  	eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
  
@@ -329,7 +328,7 @@
  
 --- a/wpa_supplicant/wpa_supplicant_i.h
 +++ b/wpa_supplicant/wpa_supplicant_i.h
-@@ -17,6 +17,7 @@
+@@ -19,6 +19,7 @@
  #include "wps/wps_defs.h"
  #include "config_ssid.h"
  #include "wmm_ac.h"
@@ -337,7 +336,7 @@
  
  extern const char *const wpa_supplicant_version;
  extern const char *const wpa_supplicant_license;
-@@ -310,6 +311,8 @@ struct wpa_global {
+@@ -322,6 +323,8 @@ struct wpa_global {
  #endif /* CONFIG_WIFI_DISPLAY */
  
  	struct psk_list_entry *add_psk; /* From group formation */
@@ -346,7 +345,7 @@
  };
  
  
-@@ -520,6 +523,7 @@ struct wpa_supplicant {
+@@ -708,6 +711,7 @@ struct wpa_supplicant {
  	unsigned char own_addr[ETH_ALEN];
  	unsigned char perm_addr[ETH_ALEN];
  	char ifname[100];
@@ -364,7 +363,7 @@
  
  
  #ifndef WPS_PIN_SCAN_IGNORE_SEL_REG
-@@ -392,6 +393,8 @@ static int wpa_supplicant_wps_cred(void
+@@ -393,6 +394,8 @@ static int wpa_supplicant_wps_cred(void
  	wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute",
  			cred->cred_attr, cred->cred_attr_len);
  
@@ -375,7 +374,7 @@
  
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -896,6 +896,7 @@ int main(int argc, char *argv[])
+@@ -895,6 +895,7 @@ int main(int argc, char *argv[])
  	}
  
  	hostapd_global_ctrl_iface_init(&interfaces);
@@ -383,7 +382,7 @@
  
  	if (hostapd_global_run(&interfaces, daemonize, pid_file)) {
  		wpa_printf(MSG_ERROR, "Failed to start eloop");
-@@ -905,6 +906,7 @@ int main(int argc, char *argv[])
+@@ -904,6 +905,7 @@ int main(int argc, char *argv[])
  	ret = 0;
  
   out:
@@ -424,7 +423,7 @@
  }
  
  
-@@ -350,6 +353,9 @@ void hostapd_handle_radio_measurement(st
+@@ -352,6 +355,9 @@ void hostapd_handle_radio_measurement(st
  		   mgmt->u.action.u.rrm.action, MAC2STR(mgmt->sa));
  
  	switch (mgmt->u.action.u.rrm.action) {
@@ -434,9 +433,109 @@
  	case WLAN_RRM_RADIO_MEASUREMENT_REPORT:
  		hostapd_handle_radio_msmt_report(hapd, buf, len);
  		break;
+--- a/src/ap/vlan_init.c
++++ b/src/ap/vlan_init.c
+@@ -22,6 +22,7 @@
+ static int vlan_if_add(struct hostapd_data *hapd, struct hostapd_vlan *vlan,
+ 		       int existsok)
+ {
++	bool vlan_exists = iface_exists(vlan->ifname);
+ 	int ret;
+ #ifdef CONFIG_WEP
+ 	int i;
+@@ -36,7 +37,7 @@ static int vlan_if_add(struct hostapd_da
+ 	}
+ #endif /* CONFIG_WEP */
+ 
+-	if (!iface_exists(vlan->ifname))
++	if (!vlan_exists)
+ 		ret = hostapd_vlan_if_add(hapd, vlan->ifname);
+ 	else if (!existsok)
+ 		return -1;
+@@ -51,6 +52,9 @@ static int vlan_if_add(struct hostapd_da
+ 	if (hapd->wpa_auth)
+ 		ret = wpa_auth_ensure_group(hapd->wpa_auth, vlan->vlan_id);
+ 
++	if (!ret && !vlan_exists)
++		hostapd_ubus_add_vlan(hapd, vlan);
++
+ 	if (ret == 0)
+ 		return ret;
+ 
+@@ -77,6 +81,8 @@ int vlan_if_remove(struct hostapd_data *
+ 			   "WPA deinitialization for VLAN %d failed (%d)",
+ 			   vlan->vlan_id, ret);
+ 
++	hostapd_ubus_remove_vlan(hapd, vlan);
++
+ 	return hostapd_vlan_if_remove(hapd, vlan->ifname);
+ }
+ 
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1196,6 +1196,8 @@ int hostapd_dfs_radar_detected(struct ho
+ 		"freq=%d ht_enabled=%d chan_offset=%d chan_width=%d cf1=%d cf2=%d",
+ 		freq, ht_enabled, chan_offset, chan_width, cf1, cf2);
+ 
++	hostapd_ubus_notify_radar_detected(iface, freq, chan_width, cf1, cf2);
++
+ 	/* Proceed only if DFS is not offloaded to the driver */
+ 	if (iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD)
+ 		return 0;
+--- a/src/ap/airtime_policy.c
++++ b/src/ap/airtime_policy.c
+@@ -112,8 +112,14 @@ static void set_sta_weights(struct hosta
+ {
+ 	struct sta_info *sta;
+ 
+-	for (sta = hapd->sta_list; sta; sta = sta->next)
+-		sta_set_airtime_weight(hapd, sta, weight);
++	for (sta = hapd->sta_list; sta; sta = sta->next) {
++		unsigned int sta_weight = weight;
++
++		if (sta->dyn_airtime_weight)
++			sta_weight = (weight * sta->dyn_airtime_weight) / 256;
++
++		sta_set_airtime_weight(hapd, sta, sta_weight);
++	}
+ }
+ 
+ 
+@@ -244,7 +250,10 @@ int airtime_policy_new_sta(struct hostap
+ 	unsigned int weight;
+ 
+ 	if (hapd->iconf->airtime_mode == AIRTIME_MODE_STATIC) {
+-		weight = get_weight_for_sta(hapd, sta->addr);
++		if (sta->dyn_airtime_weight)
++			weight = sta->dyn_airtime_weight;
++		else
++			weight = get_weight_for_sta(hapd, sta->addr);
+ 		if (weight)
+ 			return sta_set_airtime_weight(hapd, sta, weight);
+ 	}
+--- a/src/ap/sta_info.h
++++ b/src/ap/sta_info.h
+@@ -324,6 +324,7 @@ struct sta_info {
+ #endif /* CONFIG_TESTING_OPTIONS */
+ #ifdef CONFIG_AIRTIME_POLICY
+ 	unsigned int airtime_weight;
++	unsigned int dyn_airtime_weight;
+ 	struct os_reltime backlogged_until;
+ #endif /* CONFIG_AIRTIME_POLICY */
+ 
 --- a/src/ap/wnm_ap.c
 +++ b/src/ap/wnm_ap.c
-@@ -461,7 +461,7 @@ static void ieee802_11_rx_bss_trans_mgmt
+@@ -442,7 +442,8 @@ static void ieee802_11_rx_bss_trans_mgmt
+ 	wpa_hexdump(MSG_DEBUG, "WNM: BSS Transition Candidate List Entries",
+ 		    pos, end - pos);
+ 
+-	ieee802_11_send_bss_trans_mgmt_request(hapd, addr, dialog_token);
++	if (!hostapd_ubus_notify_bss_transition_query(hapd, addr, dialog_token, reason, pos, end - pos))
++		ieee802_11_send_bss_trans_mgmt_request(hapd, addr, dialog_token);
+ }
+ 
+ 
+@@ -464,7 +465,7 @@ static void ieee802_11_rx_bss_trans_mgmt
  					      size_t len)
  {
  	u8 dialog_token, status_code, bss_termination_delay;
@@ -445,7 +544,7 @@
  	int enabled = hapd->conf->bss_transition;
  	struct sta_info *sta;
  
-@@ -508,6 +508,7 @@ static void ieee802_11_rx_bss_trans_mgmt
+@@ -511,6 +512,7 @@ static void ieee802_11_rx_bss_trans_mgmt
  			wpa_printf(MSG_DEBUG, "WNM: not enough room for Target BSSID field");
  			return;
  		}
@@ -453,7 +552,7 @@
  		sta->agreed_to_steer = 1;
  		eloop_cancel_timeout(ap_sta_reset_steer_flag_timer, hapd, sta);
  		eloop_register_timeout(2, 0, ap_sta_reset_steer_flag_timer,
-@@ -527,6 +528,10 @@ static void ieee802_11_rx_bss_trans_mgmt
+@@ -530,6 +532,10 @@ static void ieee802_11_rx_bss_trans_mgmt
  			MAC2STR(addr), status_code, bss_termination_delay);
  	}
  
diff --git a/package/network/services/hostapd/patches/610-hostapd_cli_ujail_permission.patch b/package/network/services/hostapd/patches/610-hostapd_cli_ujail_permission.patch
new file mode 100644
index 0000000000..a03fcc9f92
--- /dev/null
+++ b/package/network/services/hostapd/patches/610-hostapd_cli_ujail_permission.patch
@@ -0,0 +1,33 @@
+--- a/src/common/wpa_ctrl.c
++++ b/src/common/wpa_ctrl.c
+@@ -135,7 +135,7 @@ try_again:
+ 		return NULL;
+ 	}
+ 	tries++;
+-#ifdef ANDROID
++
+ 	/* Set client socket file permissions so that bind() creates the client
+ 	 * socket with these permissions and there is no need to try to change
+ 	 * them with chmod() after bind() which would have potential issues with
+@@ -147,7 +147,7 @@ try_again:
+ 	 * operations to allow the response to go through. Those are using the
+ 	 * no-deference-symlinks version to avoid races. */
+ 	fchmod(ctrl->s, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
+-#endif /* ANDROID */
++
+ 	if (bind(ctrl->s, (struct sockaddr *) &ctrl->local,
+ 		    sizeof(ctrl->local)) < 0) {
+ 		if (errno == EADDRINUSE && tries < 2) {
+@@ -165,7 +165,11 @@ try_again:
+ 		return NULL;
+ 	}
+ 
+-#ifdef ANDROID
++#ifndef ANDROID
++	/* Set group even if we do not have privileges to change owner */
++	lchown(ctrl->local.sun_path, -1, 101);
++	lchown(ctrl->local.sun_path, 101, 101);
++#else
+ 	/* Set group even if we do not have privileges to change owner */
+ 	lchown(ctrl->local.sun_path, -1, AID_WIFI);
+ 	lchown(ctrl->local.sun_path, AID_SYSTEM, AID_WIFI);
diff --git a/package/network/services/hostapd/patches/700-wifi-reload.patch b/package/network/services/hostapd/patches/700-wifi-reload.patch
index ceb92265dd..e6d7c2f673 100644
--- a/package/network/services/hostapd/patches/700-wifi-reload.patch
+++ b/package/network/services/hostapd/patches/700-wifi-reload.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -2501,6 +2501,8 @@ static int hostapd_config_fill(struct ho
+@@ -2458,6 +2458,8 @@ static int hostapd_config_fill(struct ho
  		bss->isolate = atoi(pos);
  	} else if (os_strcmp(buf, "ap_max_inactivity") == 0) {
  		bss->ap_max_inactivity = atoi(pos);
@@ -9,7 +9,7 @@
  	} else if (os_strcmp(buf, "skip_inactivity_poll") == 0) {
  		bss->skip_inactivity_poll = atoi(pos);
  	} else if (os_strcmp(buf, "country_code") == 0) {
-@@ -3197,6 +3199,8 @@ static int hostapd_config_fill(struct ho
+@@ -3158,6 +3160,8 @@ static int hostapd_config_fill(struct ho
  		}
  	} else if (os_strcmp(buf, "acs_exclude_dfs") == 0) {
  		conf->acs_exclude_dfs = atoi(pos);
@@ -20,7 +20,7 @@
  	} else if (os_strcmp(buf, "channel") == 0) {
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
-@@ -780,6 +780,7 @@ void hostapd_config_free_bss(struct host
+@@ -792,6 +792,7 @@ void hostapd_config_free_bss(struct host
  	os_free(conf->radius_req_attr_sqlite);
  	os_free(conf->rsn_preauth_interfaces);
  	os_free(conf->ctrl_interface);
@@ -28,7 +28,7 @@
  	os_free(conf->ca_cert);
  	os_free(conf->server_cert);
  	os_free(conf->server_cert2);
-@@ -972,6 +973,7 @@ void hostapd_config_free(struct hostapd_
+@@ -988,6 +989,7 @@ void hostapd_config_free(struct hostapd_
  
  	for (i = 0; i < conf->num_bss; i++)
  		hostapd_config_free_bss(conf->bss[i]);
@@ -38,25 +38,26 @@
  	os_free(conf->basic_rates);
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -871,6 +871,7 @@ struct hostapd_bss_config {
- 	 */
- 	u8 mka_psk_set;
- #endif /* CONFIG_MACSEC */
-+	char *config_id;
- };
+@@ -279,6 +279,8 @@ struct hostapd_bss_config {
+ 	char vlan_bridge[IFNAMSIZ + 1];
+ 	char wds_bridge[IFNAMSIZ + 1];
  
- /**
-@@ -1062,6 +1063,7 @@ struct hostapd_config {
- 	unsigned int airtime_update_interval;
- #define AIRTIME_MODE_MAX (__AIRTIME_MODE_MAX - 1)
- #endif /* CONFIG_AIRTIME_POLICY */
++	char *config_id;
++
+ 	enum hostapd_logger_level logger_syslog_level, logger_stdout_level;
+ 
+ 	unsigned int logger_syslog; /* module bitfield */
+@@ -942,6 +944,7 @@ struct spatial_reuse {
+ struct hostapd_config {
+ 	struct hostapd_bss_config **bss, *last_bss;
+ 	size_t num_bss;
 +	char *config_id;
  
- 	u8 notify_mgmt_frames;
- };
+ 	u16 beacon_int;
+ 	int rts_threshold;
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -218,6 +218,10 @@ static int hostapd_iface_conf_changed(st
+@@ -219,6 +219,10 @@ static int hostapd_iface_conf_changed(st
  {
  	size_t i;
  
@@ -67,7 +68,7 @@
  	if (newconf->num_bss != oldconf->num_bss)
  		return 1;
  
-@@ -231,7 +235,7 @@ static int hostapd_iface_conf_changed(st
+@@ -232,7 +236,7 @@ static int hostapd_iface_conf_changed(st
  }
  
  
@@ -76,7 +77,7 @@
  {
  	struct hapd_interfaces *interfaces = iface->interfaces;
  	struct hostapd_data *hapd = iface->bss[0];
-@@ -254,13 +258,16 @@ int hostapd_reload_config(struct hostapd
+@@ -255,13 +259,16 @@ int hostapd_reload_config(struct hostapd
  	if (newconf == NULL)
  		return -1;
  
@@ -95,7 +96,7 @@
  		wpa_printf(MSG_DEBUG,
  			   "Configuration changes include interface/BSS modification - force full disable+enable sequence");
  		fname = os_strdup(iface->config_fname);
-@@ -285,6 +292,24 @@ int hostapd_reload_config(struct hostapd
+@@ -286,6 +293,24 @@ int hostapd_reload_config(struct hostapd
  			wpa_printf(MSG_ERROR,
  				   "Failed to enable interface on config reload");
  		return res;
@@ -120,7 +121,7 @@
  	}
  	iface->conf = newconf;
  
-@@ -301,6 +326,12 @@ int hostapd_reload_config(struct hostapd
+@@ -302,6 +327,12 @@ int hostapd_reload_config(struct hostapd
  
  	for (j = 0; j < iface->num_bss; j++) {
  		hapd = iface->bss[j];
@@ -133,7 +134,7 @@
  		hapd->iconf = newconf;
  		hapd->conf = newconf->bss[j];
  		hostapd_reload_bss(hapd);
-@@ -2366,6 +2397,10 @@ hostapd_alloc_bss_data(struct hostapd_if
+@@ -2397,6 +2428,10 @@ hostapd_alloc_bss_data(struct hostapd_if
  	hapd->iconf = conf;
  	hapd->conf = bss;
  	hapd->iface = hapd_iface;
@@ -155,7 +156,7 @@
  	struct hostapd_config * (*config_read_cb)(const char *config_fname);
  	int (*ctrl_iface_init)(struct hostapd_data *hapd);
  	void (*ctrl_iface_deinit)(struct hostapd_data *hapd);
-@@ -156,6 +156,7 @@ struct hostapd_data {
+@@ -173,6 +173,7 @@ struct hostapd_data {
  	struct hostapd_config *iconf;
  	struct hostapd_bss_config *conf;
  	struct hostapd_ubus_bss ubus;
@@ -163,7 +164,7 @@
  	int interface_added; /* virtual interface added for this BSS */
  	unsigned int started:1;
  	unsigned int disabled:1;
-@@ -600,7 +601,7 @@ struct hostapd_iface {
+@@ -624,7 +625,7 @@ struct hostapd_iface {
  int hostapd_for_each_interface(struct hapd_interfaces *interfaces,
  			       int (*cb)(struct hostapd_iface *iface,
  					 void *ctx), void *ctx);
@@ -174,7 +175,7 @@
  hostapd_alloc_bss_data(struct hostapd_iface *hapd_iface,
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -4508,6 +4508,9 @@ static int wpa_driver_nl80211_set_ap(voi
+@@ -4833,6 +4833,9 @@ static int wpa_driver_nl80211_set_ap(voi
  	if (ret) {
  		wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
  			   ret, strerror(-ret));
@@ -186,7 +187,7 @@
  		nl80211_set_bss(bss, params->cts_protect, params->preamble,
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -184,7 +184,7 @@ static int hostapd_ctrl_iface_update(str
+@@ -186,7 +186,7 @@ static int hostapd_ctrl_iface_update(str
  	iface->interfaces->config_read_cb = hostapd_ctrl_iface_config_read;
  	reload_opts = txt;
  
diff --git a/package/network/services/hostapd/patches/710-vlan_no_bridge.patch b/package/network/services/hostapd/patches/710-vlan_no_bridge.patch
index 7de4e2c1d4..856dc8ba88 100644
--- a/package/network/services/hostapd/patches/710-vlan_no_bridge.patch
+++ b/package/network/services/hostapd/patches/710-vlan_no_bridge.patch
@@ -10,19 +10,27 @@
  #define DYNAMIC_VLAN_NAMING_END 2
 --- a/src/ap/vlan_full.c
 +++ b/src/ap/vlan_full.c
-@@ -466,6 +466,9 @@ void vlan_newlink(const char *ifname, st
- 
- 	wpa_printf(MSG_DEBUG, "VLAN: vlan_newlink(%s)", ifname);
+@@ -475,6 +475,9 @@ void vlan_newlink(const char *ifname, st
+ 	if (!vlan)
+ 		return;
  
 +	if (hapd->conf->ssid.vlan_no_bridge)
-+		return;
++		goto out;
 +
- 	for (vlan = hapd->conf->vlan; vlan; vlan = vlan->next) {
- 		if (vlan->configured ||
- 		    os_strcmp(ifname, vlan->ifname) != 0)
+ 	vlan->configured = 1;
+ 
+ 	notempty = vlan->vlan_desc.notempty;
+@@ -506,6 +509,7 @@ void vlan_newlink(const char *ifname, st
+ 				    ifname, br_name, tagged[i], hapd);
+ 	}
+ 
++out:
+ 	ifconfig_up(ifname);
+ }
+ 
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -3400,6 +3400,8 @@ static int hostapd_config_fill(struct ho
+@@ -3381,6 +3381,8 @@ static int hostapd_config_fill(struct ho
  #ifndef CONFIG_NO_VLAN
  	} else if (os_strcmp(buf, "dynamic_vlan") == 0) {
  		bss->ssid.dynamic_vlan = atoi(pos);
diff --git a/package/network/services/hostapd/patches/711-wds_bridge_force.patch b/package/network/services/hostapd/patches/711-wds_bridge_force.patch
index 01507b6d36..a22580c357 100644
--- a/package/network/services/hostapd/patches/711-wds_bridge_force.patch
+++ b/package/network/services/hostapd/patches/711-wds_bridge_force.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -2405,6 +2405,8 @@ static int hostapd_config_fill(struct ho
+@@ -2358,6 +2358,8 @@ static int hostapd_config_fill(struct ho
  			   sizeof(conf->bss[0]->iface));
  	} else if (os_strcmp(buf, "bridge") == 0) {
  		os_strlcpy(bss->bridge, pos, sizeof(bss->bridge));
diff --git a/package/network/services/hostapd/patches/720-iface_max_num_sta.patch b/package/network/services/hostapd/patches/720-iface_max_num_sta.patch
new file mode 100644
index 0000000000..106f9d7407
--- /dev/null
+++ b/package/network/services/hostapd/patches/720-iface_max_num_sta.patch
@@ -0,0 +1,82 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2880,6 +2880,14 @@ static int hostapd_config_fill(struct ho
+ 				   line, bss->max_num_sta, MAX_STA_COUNT);
+ 			return 1;
+ 		}
++	} else if (os_strcmp(buf, "iface_max_num_sta") == 0) {
++		conf->max_num_sta = atoi(pos);
++		if (conf->max_num_sta < 0 ||
++		    conf->max_num_sta > MAX_STA_COUNT) {
++			wpa_printf(MSG_ERROR, "Line %d: Invalid max_num_sta=%d; allowed range 0..%d",
++				   line, conf->max_num_sta, MAX_STA_COUNT);
++			return 1;
++		}
+ 	} else if (os_strcmp(buf, "wpa") == 0) {
+ 		bss->wpa = atoi(pos);
+ 	} else if (os_strcmp(buf, "extended_key_id") == 0) {
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -668,6 +668,7 @@ void hostapd_cleanup_cs_params(struct ho
+ void hostapd_periodic_iface(struct hostapd_iface *iface);
+ int hostapd_owe_trans_get_info(struct hostapd_data *hapd);
+ void hostapd_ocv_check_csa_sa_query(void *eloop_ctx, void *timeout_ctx);
++int hostapd_check_max_sta(struct hostapd_data *hapd);
+ 
+ /* utils.c */
+ int hostapd_register_probereq_cb(struct hostapd_data *hapd,
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -236,6 +236,30 @@ static int hostapd_iface_conf_changed(st
+ }
+ 
+ 
++static inline int hostapd_iface_num_sta(struct hostapd_iface *iface)
++{
++	int num_sta = 0;
++	int i;
++
++	for (i = 0; i < iface->num_bss; i++)
++		num_sta += iface->bss[i]->num_sta;
++
++	return num_sta;
++}
++
++
++int hostapd_check_max_sta(struct hostapd_data *hapd)
++{
++	if (hapd->num_sta >= hapd->conf->max_num_sta)
++		return 1;
++
++	if (hapd->iconf->max_num_sta &&
++	    hostapd_iface_num_sta(hapd->iface) >= hapd->iconf->max_num_sta)
++		return 1;
++
++	return 0;
++}
++
+ int hostapd_reload_config(struct hostapd_iface *iface, int reconf)
+ {
+ 	struct hapd_interfaces *interfaces = iface->interfaces;
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1068,7 +1068,7 @@ void handle_probe_req(struct hostapd_dat
+ 	if (hapd->conf->no_probe_resp_if_max_sta &&
+ 	    is_multicast_ether_addr(mgmt->da) &&
+ 	    is_multicast_ether_addr(mgmt->bssid) &&
+-	    hapd->num_sta >= hapd->conf->max_num_sta &&
++	    hostapd_check_max_sta(hapd) &&
+ 	    !ap_get_sta(hapd, mgmt->sa)) {
+ 		wpa_printf(MSG_MSGDUMP, "%s: Ignore Probe Request from " MACSTR
+ 			   " since no room for additional STA",
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -981,6 +981,8 @@ struct hostapd_config {
+ 	unsigned int track_sta_max_num;
+ 	unsigned int track_sta_max_age;
+ 
++	int max_num_sta;
++
+ 	char country[3]; /* first two octets: country code as described in
+ 			  * ISO/IEC 3166-1. Third octet:
+ 			  * ' ' (ascii 32): all environments
diff --git a/package/network/services/hostapd/patches/730-ft_iface.patch b/package/network/services/hostapd/patches/730-ft_iface.patch
index c1adf1ffcf..b5809222d7 100644
--- a/package/network/services/hostapd/patches/730-ft_iface.patch
+++ b/package/network/services/hostapd/patches/730-ft_iface.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -3069,6 +3069,8 @@ static int hostapd_config_fill(struct ho
+@@ -3038,6 +3038,8 @@ static int hostapd_config_fill(struct ho
  		wpa_printf(MSG_INFO,
  			   "Line %d: Obsolete peerkey parameter ignored", line);
  #ifdef CONFIG_IEEE80211R_AP
@@ -11,7 +11,7 @@
  		    hexstr2bin(pos, bss->mobility_domain,
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -284,6 +284,7 @@ struct airtime_sta_weight {
+@@ -277,6 +277,7 @@ struct airtime_sta_weight {
  struct hostapd_bss_config {
  	char iface[IFNAMSIZ + 1];
  	char bridge[IFNAMSIZ + 1];
@@ -21,7 +21,7 @@
  
 --- a/src/ap/wpa_auth_glue.c
 +++ b/src/ap/wpa_auth_glue.c
-@@ -1511,8 +1511,12 @@ int hostapd_setup_wpa(struct hostapd_dat
+@@ -1566,8 +1566,12 @@ int hostapd_setup_wpa(struct hostapd_dat
  	    wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt)) {
  		const char *ft_iface;
  
diff --git a/package/network/services/hostapd/patches/740-snoop_iface.patch b/package/network/services/hostapd/patches/740-snoop_iface.patch
index 15aaf4b8e4..2ed73750ca 100644
--- a/package/network/services/hostapd/patches/740-snoop_iface.patch
+++ b/package/network/services/hostapd/patches/740-snoop_iface.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -285,6 +285,7 @@ struct hostapd_bss_config {
+@@ -278,6 +278,7 @@ struct hostapd_bss_config {
  	char iface[IFNAMSIZ + 1];
  	char bridge[IFNAMSIZ + 1];
  	char ft_iface[IFNAMSIZ + 1];
@@ -55,7 +55,7 @@
  			   "x_snoop: Failed to initialize L2 packet processing %s",
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -2407,6 +2407,8 @@ static int hostapd_config_fill(struct ho
+@@ -2360,6 +2360,8 @@ static int hostapd_config_fill(struct ho
  		os_strlcpy(bss->bridge, pos, sizeof(bss->bridge));
  		if (!bss->wds_bridge[0])
  			os_strlcpy(bss->wds_bridge, pos, sizeof(bss->wds_bridge));
diff --git a/package/network/services/hostapd/patches/750-qos_map_set_without_interworking.patch b/package/network/services/hostapd/patches/750-qos_map_set_without_interworking.patch
index 94f4a2b297..ff1d076b37 100644
--- a/package/network/services/hostapd/patches/750-qos_map_set_without_interworking.patch
+++ b/package/network/services/hostapd/patches/750-qos_map_set_without_interworking.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -1711,6 +1711,8 @@ static int parse_anqp_elem(struct hostap
+@@ -1598,6 +1598,8 @@ static int parse_anqp_elem(struct hostap
  	return 0;
  }
  
@@ -9,7 +9,7 @@
  
  static int parse_qos_map_set(struct hostapd_bss_config *bss,
  			     char *buf, int line)
-@@ -1752,8 +1754,6 @@ static int parse_qos_map_set(struct host
+@@ -1639,8 +1641,6 @@ static int parse_qos_map_set(struct host
  	return 0;
  }
  
@@ -18,7 +18,7 @@
  
  #ifdef CONFIG_HS20
  static int hs20_parse_conn_capab(struct hostapd_bss_config *bss, char *buf,
-@@ -4050,10 +4050,10 @@ static int hostapd_config_fill(struct ho
+@@ -4042,10 +4042,10 @@ static int hostapd_config_fill(struct ho
  		bss->gas_frag_limit = val;
  	} else if (os_strcmp(buf, "gas_comeback_delay") == 0) {
  		bss->gas_comeback_delay = atoi(pos);
@@ -32,7 +32,7 @@
  		os_free(bss->dump_msk_file);
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -1386,6 +1386,7 @@ static int hostapd_setup_bss(struct host
+@@ -1423,6 +1423,7 @@ static int hostapd_setup_bss(struct host
  		wpa_printf(MSG_ERROR, "GAS server initialization failed");
  		return -1;
  	}
@@ -40,7 +40,7 @@
  
  	if (conf->qos_map_set_len &&
  	    hostapd_drv_set_qos_map(hapd, conf->qos_map_set,
-@@ -1393,7 +1394,6 @@ static int hostapd_setup_bss(struct host
+@@ -1430,7 +1431,6 @@ static int hostapd_setup_bss(struct host
  		wpa_printf(MSG_ERROR, "Failed to initialize QoS Map");
  		return -1;
  	}
@@ -48,26 +48,42 @@
  
  	if (conf->bss_load_update_period && bss_load_update_init(hapd)) {
  		wpa_printf(MSG_ERROR, "BSS Load initialization failed");
---- a/src/ap/drv_callbacks.c
-+++ b/src/ap/drv_callbacks.c
-@@ -245,12 +245,10 @@ int hostapd_notif_assoc(struct hostapd_d
- 	}
- #endif /* NEED_AP_MLME */
+--- a/wpa_supplicant/events.c
++++ b/wpa_supplicant/events.c
+@@ -2586,8 +2586,6 @@ void wnm_bss_keep_alive_deinit(struct wp
+ }
+ 
  
 -#ifdef CONFIG_INTERWORKING
- 	if (elems.ext_capab && elems.ext_capab_len > 4) {
- 		if (elems.ext_capab[4] & 0x01)
- 			sta->qos_map_enabled = 1;
+-
+ static int wpas_qos_map_set(struct wpa_supplicant *wpa_s, const u8 *qos_map,
+ 			    size_t len)
+ {
+@@ -2620,8 +2618,6 @@ static void interworking_process_assoc_r
  	}
--#endif /* CONFIG_INTERWORKING */
+ }
  
- #ifdef CONFIG_HS20
- 	wpabuf_free(sta->hs20_ie);
---- a/src/ap/ieee802_11.c
-+++ b/src/ap/ieee802_11.c
-@@ -2875,13 +2875,11 @@ static u16 copy_supp_rates(struct hostap
- static u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
- 			   const u8 *ext_capab_ie, size_t ext_capab_ie_len)
+-#endif /* CONFIG_INTERWORKING */
+-
+ 
+ static void multi_ap_process_assoc_resp(struct wpa_supplicant *wpa_s,
+ 					const u8 *ies, size_t ies_len)
+@@ -2954,10 +2950,8 @@ static int wpa_supplicant_event_associnf
+ 		wnm_process_assoc_resp(wpa_s, data->assoc_info.resp_ies,
+ 				       data->assoc_info.resp_ies_len);
+ #endif /* CONFIG_WNM */
+-#ifdef CONFIG_INTERWORKING
+ 		interworking_process_assoc_resp(wpa_s, data->assoc_info.resp_ies,
+ 						data->assoc_info.resp_ies_len);
+-#endif /* CONFIG_INTERWORKING */
+ 		if (wpa_s->hw_capab == CAPAB_VHT &&
+ 		    get_ie(data->assoc_info.resp_ies,
+ 			   data->assoc_info.resp_ies_len, WLAN_EID_VHT_CAP))
+--- a/src/ap/ieee802_11_shared.c
++++ b/src/ap/ieee802_11_shared.c
+@@ -1098,13 +1098,11 @@ u8 * hostapd_eid_rsnxe(struct hostapd_da
+ u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
+ 		    const u8 *ext_capab_ie, size_t ext_capab_ie_len)
  {
 -#ifdef CONFIG_INTERWORKING
  	/* check for QoS Map support */
@@ -79,34 +95,3 @@
  
  	if (ext_capab_ie_len > 0) {
  		sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
---- a/wpa_supplicant/events.c
-+++ b/wpa_supplicant/events.c
-@@ -2500,8 +2500,6 @@ void wnm_bss_keep_alive_deinit(struct wp
- }
- 
- 
--#ifdef CONFIG_INTERWORKING
--
- static int wpas_qos_map_set(struct wpa_supplicant *wpa_s, const u8 *qos_map,
- 			    size_t len)
- {
-@@ -2534,8 +2532,6 @@ static void interworking_process_assoc_r
- 	}
- }
- 
--#endif /* CONFIG_INTERWORKING */
--
- 
- static void multi_ap_process_assoc_resp(struct wpa_supplicant *wpa_s,
- 					const u8 *ies, size_t ies_len)
-@@ -2669,10 +2665,8 @@ static int wpa_supplicant_event_associnf
- 		wnm_process_assoc_resp(wpa_s, data->assoc_info.resp_ies,
- 				       data->assoc_info.resp_ies_len);
- #endif /* CONFIG_WNM */
--#ifdef CONFIG_INTERWORKING
- 		interworking_process_assoc_resp(wpa_s, data->assoc_info.resp_ies,
- 						data->assoc_info.resp_ies_len);
--#endif /* CONFIG_INTERWORKING */
- 		if (wpa_s->hw_capab == CAPAB_VHT &&
- 		    get_ie(data->assoc_info.resp_ies,
- 			   data->assoc_info.resp_ies_len, WLAN_EID_VHT_CAP))
diff --git a/package/network/services/hostapd/patches/800-dfs-enter-DFS-state-if-no-available-channel-is-found.patch b/package/network/services/hostapd/patches/800-dfs-enter-DFS-state-if-no-available-channel-is-found.patch
deleted file mode 100644
index 3e4638d7ff..0000000000
--- a/package/network/services/hostapd/patches/800-dfs-enter-DFS-state-if-no-available-channel-is-found.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From cefc52e6b93731c713f1bba1cb5e7e92105b758b Mon Sep 17 00:00:00 2001
-From: David Bauer <mail@david-bauer.net>
-Date: Fri, 3 Jul 2020 23:00:34 +0200
-Subject: [PATCH] dfs: enter DFS state if no available channel is found
-
-Previously hostapd would not stop transmitting when a DFS event was
-detected and no available channel to switch to was available.
-
-Disable and re-enable the interface to enter DFS state. This way, TX
-does not happen until the kernel notifies hostapd about the NOP
-expiring.
-
-Signed-off-by: David Bauer <mail@david-bauer.net>
----
- src/ap/dfs.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -1086,8 +1086,15 @@ static int hostapd_dfs_start_channel_swi
- 						  &oper_centr_freq_seg0_idx,
- 						  &oper_centr_freq_seg1_idx,
- 						  &skip_radar);
--		if (!channel)
--			return err;
-+		if (!channel) {
-+			/*
-+			 * Toggle interface state to enter DFS state
-+			 * until NOP is finished.
-+			 */
-+			hostapd_disable_iface(iface);
-+			hostapd_enable_iface(iface);
-+			return 0;
-+		}
- 		if (!skip_radar) {
- 			iface->freq = channel->freq;
- 			iface->conf->channel = channel->chan;
diff --git a/package/network/services/hostapd/patches/801-P2P-Fix-copying-of-secondary-device-types-for-P2P-gr.patch b/package/network/services/hostapd/patches/801-P2P-Fix-copying-of-secondary-device-types-for-P2P-gr.patch
deleted file mode 100644
index 944f7d71c9..0000000000
--- a/package/network/services/hostapd/patches/801-P2P-Fix-copying-of-secondary-device-types-for-P2P-gr.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 947272febe24a8f0ea828b5b2f35f13c3821901e Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <jouni@codeaurora.org>
-Date: Mon, 9 Nov 2020 11:43:12 +0200
-Subject: [PATCH] P2P: Fix copying of secondary device types for P2P group
- client
-
-Parsing and copying of WPS secondary device types list was verifying
-that the contents is not too long for the internal maximum in the case
-of WPS messages, but similar validation was missing from the case of P2P
-group information which encodes this information in a different
-attribute. This could result in writing beyond the memory area assigned
-for these entries and corrupting memory within an instance of struct
-p2p_device. This could result in invalid operations and unexpected
-behavior when trying to free pointers from that corrupted memory.
-
-Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27269
-Fixes: e57ae6e19edf ("P2P: Keep track of secondary device types for peers")
-Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
----
- src/p2p/p2p.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/src/p2p/p2p.c
-+++ b/src/p2p/p2p.c
-@@ -453,6 +453,8 @@ static void p2p_copy_client_info(struct
- 	dev->info.config_methods = cli->config_methods;
- 	os_memcpy(dev->info.pri_dev_type, cli->pri_dev_type, 8);
- 	dev->info.wps_sec_dev_type_list_len = 8 * cli->num_sec_dev_types;
-+	if (dev->info.wps_sec_dev_type_list_len > WPS_SEC_DEV_TYPE_MAX_LEN)
-+		dev->info.wps_sec_dev_type_list_len = WPS_SEC_DEV_TYPE_MAX_LEN;
- 	os_memcpy(dev->info.wps_sec_dev_type_list, cli->sec_dev_types,
- 		  dev->info.wps_sec_dev_type_list_len);
- }
diff --git a/package/network/services/hostapd/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch b/package/network/services/hostapd/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
new file mode 100644
index 0000000000..3665c6c33f
--- /dev/null
+++ b/package/network/services/hostapd/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
@@ -0,0 +1,38 @@
+From f0e9f5aab52b3eab85d28338cc996972ced4c39c Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Tue, 17 May 2022 23:07:59 +0200
+Subject: [PATCH] ctrl: make WNM_AP functions dependant on CONFIG_AP
+
+This fixes linking errors found when compiling wpa_supplicant with
+CONFIG_WNM_AP enabled but CONFIG_AP disabled.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ wpa_supplicant/ctrl_iface.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
+index ac337e0f5..6e23114e6 100644
+--- a/wpa_supplicant/ctrl_iface.c
++++ b/wpa_supplicant/ctrl_iface.c
+@@ -12185,7 +12185,7 @@ char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
+ 		if (wpas_ctrl_iface_coloc_intf_report(wpa_s, buf + 18))
+ 			reply_len = -1;
+ #endif /* CONFIG_WNM */
+-#ifdef CONFIG_WNM_AP
++#if defined(CONFIG_AP) && defined(CONFIG_WNM_AP)
+ 	} else if (os_strncmp(buf, "DISASSOC_IMMINENT ", 18) == 0) {
+ 		if (ap_ctrl_iface_disassoc_imminent(wpa_s, buf + 18))
+ 			reply_len = -1;
+@@ -12195,7 +12195,7 @@ char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
+ 	} else if (os_strncmp(buf, "BSS_TM_REQ ", 11) == 0) {
+ 		if (ap_ctrl_iface_bss_tm_req(wpa_s, buf + 11))
+ 			reply_len = -1;
+-#endif /* CONFIG_WNM_AP */
++#endif /* CONFIG_AP && CONFIG_WNM_AP */
+ 	} else if (os_strcmp(buf, "FLUSH") == 0) {
+ 		wpa_supplicant_ctrl_iface_flush(wpa_s);
+ 	} else if (os_strncmp(buf, "RADIO_WORK ", 11) == 0) {
+-- 
+2.35.1
+
diff --git a/package/network/services/hostapd/patches/991-fix-compile.patch b/package/network/services/hostapd/patches/991-fix-compile.patch
new file mode 100644
index 0000000000..d08efa08bd
--- /dev/null
+++ b/package/network/services/hostapd/patches/991-fix-compile.patch
@@ -0,0 +1,19 @@
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -8104,6 +8104,7 @@ int wpas_network_disabled(struct wpa_sup
+ 	    !ssid->mem_only_psk)
+ 		return 1;
+ 
++#ifdef CONFIG_IEEE8021X_EAPOL
+ #ifdef CRYPTO_RSA_OAEP_SHA256
+ 	if (ssid->eap.imsi_privacy_cert) {
+ 		struct crypto_rsa_key *key;
+@@ -8121,7 +8122,7 @@ int wpas_network_disabled(struct wpa_sup
+ 		}
+ 	}
+ #endif /* CRYPTO_RSA_OAEP_SHA256 */
+-
++#endif /* CONFIG_IEEE8021X_EAPOL */
+ 	return 0;
+ }
+ 
diff --git a/package/network/services/hostapd/patches/992-openssl-include-rsa.patch b/package/network/services/hostapd/patches/992-openssl-include-rsa.patch
new file mode 100644
index 0000000000..581ae9f67a
--- /dev/null
+++ b/package/network/services/hostapd/patches/992-openssl-include-rsa.patch
@@ -0,0 +1,32 @@
+From f374d52079111a4340acb6df835f45ac6b5f3f60 Mon Sep 17 00:00:00 2001
+From: Andre Heider <a.heider@gmail.com>
+Date: Wed, 22 Jun 2022 14:13:55 +0200
+Subject: OpenSSL: Include rsa.h for all OpenSSL versions
+
+This fixes the build with OpenSSL 1.1.1:
+../src/crypto/crypto_openssl.c: In function 'crypto_rsa_oaep_sha256_decrypt':
+../src/crypto/crypto_openssl.c:4404:49: error: 'RSA_PKCS1_OAEP_PADDING' undeclared (first use in this function)
+
+Signed-off-by: Andre Heider <a.heider@gmail.com>
+---
+ src/crypto/crypto_openssl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/src/crypto/crypto_openssl.c
++++ b/src/crypto/crypto_openssl.c
+@@ -16,6 +16,7 @@
+ #include <openssl/dh.h>
+ #include <openssl/hmac.h>
+ #include <openssl/rand.h>
++#include <openssl/rsa.h>
+ #include <openssl/pem.h>
+ #ifdef CONFIG_ECC
+ #include <openssl/ec.h>
+@@ -25,7 +26,6 @@
+ #include <openssl/provider.h>
+ #include <openssl/core_names.h>
+ #include <openssl/param_build.h>
+-#include <openssl/rsa.h>
+ #include <openssl/encoder.h>
+ #include <openssl/decoder.h>
+ #else /* OpenSSL version >= 3.0 */
diff --git a/package/network/services/hostapd/src/src/ap/ubus.c b/package/network/services/hostapd/src/src/ap/ubus.c
index a8b8599b54..622eab8838 100644
--- a/package/network/services/hostapd/src/src/ap/ubus.c
+++ b/package/network/services/hostapd/src/src/ap/ubus.c
@@ -11,6 +11,7 @@
 #include "utils/eloop.h"
 #include "utils/wpabuf.h"
 #include "common/ieee802_11_defs.h"
+#include "common/hw_features_common.h"
 #include "hostapd.h"
 #include "neighbor_db.h"
 #include "wps_hostapd.h"
@@ -21,6 +22,8 @@
 #include "rrm.h"
 #include "wnm_ap.h"
 #include "taxonomy.h"
+#include "airtime_policy.h"
+#include "hw_features.h"
 
 static struct ubus_context *ctx;
 static struct blob_buf b;
@@ -297,6 +300,7 @@ hostapd_bss_get_clients(struct ubus_context *ctx, struct ubus_object *obj,
 		{ "wmm", WLAN_STA_WMM },
 		{ "ht", WLAN_STA_HT },
 		{ "vht", WLAN_STA_VHT },
+		{ "he", WLAN_STA_HE },
 		{ "wps", WLAN_STA_WPS },
 		{ "mfp", WLAN_STA_MFP },
 	};
@@ -314,6 +318,10 @@ hostapd_bss_get_clients(struct ubus_context *ctx, struct ubus_object *obj,
 			blobmsg_add_u8(&b, sta_flags[i].name,
 				       !!(sta->flags & sta_flags[i].flag));
 
+#ifdef CONFIG_MBO
+		blobmsg_add_u8(&b, "mbo", !!(sta->cell_capa));
+#endif
+
 		r = blobmsg_open_array(&b, "rrm");
 		for (i = 0; i < ARRAY_SIZE(sta->rrm_enabled_capa); i++)
 			blobmsg_add_u32(&b, "", sta->rrm_enabled_capa[i]);
@@ -414,7 +422,7 @@ hostapd_bss_get_status(struct ubus_context *ctx, struct ubus_object *obj,
 		       struct blob_attr *msg)
 {
 	struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj);
-	void *airtime_table, *dfs_table;
+	void *airtime_table, *dfs_table, *rrm_table, *wnm_table;
 	struct os_reltime now;
 	char ssid[SSID_MAX_LEN + 1];
 	char phy_name[17];
@@ -441,10 +449,28 @@ hostapd_bss_get_status(struct ubus_context *ctx, struct ubus_object *obj,
 	blobmsg_add_u32(&b, "channel", channel);
 	blobmsg_add_u32(&b, "op_class", op_class);
 	blobmsg_add_u32(&b, "beacon_interval", hapd->iconf->beacon_int);
+#ifdef CONFIG_IEEE80211AX
+	blobmsg_add_u32(&b, "bss_color", hapd->iface->conf->he_op.he_bss_color_disabled ? -1 :
+					 hapd->iface->conf->he_op.he_bss_color);
+#else
+	blobmsg_add_u32(&b, "bss_color", -1);
+#endif
 
 	snprintf(phy_name, 17, "%s", hapd->iface->phy);
 	blobmsg_add_string(&b, "phy", phy_name);
 
+	/* RRM */
+	rrm_table = blobmsg_open_table(&b, "rrm");
+	blobmsg_add_u64(&b, "neighbor_report_tx", hapd->openwrt_stats.rrm.neighbor_report_tx);
+	blobmsg_close_table(&b, rrm_table);
+
+	/* WNM */
+	wnm_table = blobmsg_open_table(&b, "wnm");
+	blobmsg_add_u64(&b, "bss_transition_query_rx", hapd->openwrt_stats.wnm.bss_transition_query_rx);
+	blobmsg_add_u64(&b, "bss_transition_request_tx", hapd->openwrt_stats.wnm.bss_transition_request_tx);
+	blobmsg_add_u64(&b, "bss_transition_response_rx", hapd->openwrt_stats.wnm.bss_transition_response_rx);
+	blobmsg_close_table(&b, wnm_table);
+
 	/* Airtime */
 	airtime_table = blobmsg_open_table(&b, "airtime");
 	blobmsg_add_u64(&b, "time", hapd->iface->last_channel_time);
@@ -758,7 +784,9 @@ enum {
 	CSA_SEC_CHANNEL_OFFSET,
 	CSA_HT,
 	CSA_VHT,
+	CSA_HE,
 	CSA_BLOCK_TX,
+	CSA_FORCE,
 	__CSA_MAX
 };
 
@@ -771,9 +799,20 @@ static const struct blobmsg_policy csa_policy[__CSA_MAX] = {
 	[CSA_SEC_CHANNEL_OFFSET] = { "sec_channel_offset", BLOBMSG_TYPE_INT32 },
 	[CSA_HT] = { "ht", BLOBMSG_TYPE_BOOL },
 	[CSA_VHT] = { "vht", BLOBMSG_TYPE_BOOL },
+	[CSA_HE] = { "he", BLOBMSG_TYPE_BOOL },
 	[CSA_BLOCK_TX] = { "block_tx", BLOBMSG_TYPE_BOOL },
+	[CSA_FORCE] = { "force", BLOBMSG_TYPE_BOOL },
 };
 
+
+static void switch_chan_fallback_cb(void *eloop_data, void *user_ctx)
+{
+	struct hostapd_iface *iface = eloop_data;
+	struct hostapd_freq_params *freq_params = user_ctx;
+
+	hostapd_switch_channel_fallback(iface, freq_params);
+}
+
 #ifdef NEED_AP_MLME
 static int
 hostapd_switch_chan(struct ubus_context *ctx, struct ubus_object *obj,
@@ -782,14 +821,42 @@ hostapd_switch_chan(struct ubus_context *ctx, struct ubus_object *obj,
 {
 	struct blob_attr *tb[__CSA_MAX];
 	struct hostapd_data *hapd = get_hapd_from_object(obj);
-	struct csa_settings css;
+	struct hostapd_config *iconf = hapd->iface->conf;
+	struct hostapd_freq_params *freq_params;
+	struct hostapd_hw_modes *mode = hapd->iface->current_mode;
+	struct csa_settings css = {
+		.freq_params = {
+			.ht_enabled = iconf->ieee80211n,
+			.vht_enabled = iconf->ieee80211ac,
+			.he_enabled = iconf->ieee80211ax,
+			.sec_channel_offset = iconf->secondary_channel,
+		}
+	};
+	u8 chwidth = hostapd_get_oper_chwidth(iconf);
+	u8 seg0 = 0, seg1 = 0;
+	int ret = UBUS_STATUS_OK;
+	int i;
 
 	blobmsg_parse(csa_policy, __CSA_MAX, tb, blob_data(msg), blob_len(msg));
 
 	if (!tb[CSA_FREQ])
 		return UBUS_STATUS_INVALID_ARGUMENT;
 
-	memset(&css, 0, sizeof(css));
+	switch (iconf->vht_oper_chwidth) {
+	case CHANWIDTH_USE_HT:
+		if (iconf->secondary_channel)
+			css.freq_params.bandwidth = 40;
+		else
+			css.freq_params.bandwidth = 20;
+		break;
+	case CHANWIDTH_160MHZ:
+		css.freq_params.bandwidth = 160;
+		break;
+	default:
+		css.freq_params.bandwidth = 80;
+		break;
+	}
+
 	css.freq_params.freq = blobmsg_get_u32(tb[CSA_FREQ]);
 
 #define SET_CSA_SETTING(name, field, type) \
@@ -805,12 +872,57 @@ hostapd_switch_chan(struct ubus_context *ctx, struct ubus_object *obj,
 	SET_CSA_SETTING(CSA_SEC_CHANNEL_OFFSET, freq_params.sec_channel_offset, u32);
 	SET_CSA_SETTING(CSA_HT, freq_params.ht_enabled, bool);
 	SET_CSA_SETTING(CSA_VHT, freq_params.vht_enabled, bool);
+	SET_CSA_SETTING(CSA_HE, freq_params.he_enabled, bool);
 	SET_CSA_SETTING(CSA_BLOCK_TX, block_tx, bool);
 
-
-	if (hostapd_switch_channel(hapd, &css) != 0)
+	css.freq_params.channel = hostapd_hw_get_channel(hapd, css.freq_params.freq);
+	if (!css.freq_params.channel)
 		return UBUS_STATUS_NOT_SUPPORTED;
-	return UBUS_STATUS_OK;
+
+	switch (css.freq_params.bandwidth) {
+	case 160:
+		chwidth = CHANWIDTH_160MHZ;
+		break;
+	case 80:
+		chwidth = css.freq_params.center_freq2 ? CHANWIDTH_80P80MHZ : CHANWIDTH_80MHZ;
+		break;
+	default:
+		chwidth = CHANWIDTH_USE_HT;
+		break;
+	}
+
+	hostapd_set_freq_params(&css.freq_params, iconf->hw_mode,
+				css.freq_params.freq,
+				css.freq_params.channel, iconf->enable_edmg,
+				iconf->edmg_channel,
+				css.freq_params.ht_enabled,
+				css.freq_params.vht_enabled,
+				css.freq_params.he_enabled,
+				css.freq_params.eht_enabled,
+				css.freq_params.sec_channel_offset,
+				chwidth, seg0, seg1,
+				iconf->vht_capab,
+				mode ? &mode->he_capab[IEEE80211_MODE_AP] :
+				NULL,
+				mode ? &mode->eht_capab[IEEE80211_MODE_AP] :
+				NULL);
+
+	for (i = 0; i < hapd->iface->num_bss; i++) {
+		struct hostapd_data *bss = hapd->iface->bss[i];
+
+		if (hostapd_switch_channel(bss, &css) != 0)
+			ret = UBUS_STATUS_NOT_SUPPORTED;
+	}
+
+	if (!ret || !tb[CSA_FORCE] || !blobmsg_get_bool(tb[CSA_FORCE]))
+		return ret;
+
+	freq_params = malloc(sizeof(*freq_params));
+	memcpy(freq_params, &css.freq_params, sizeof(*freq_params));
+	eloop_register_timeout(0, 1, switch_chan_fallback_cb,
+			       hapd->iface, freq_params);
+
+	return 0;
 #undef SET_CSA_SETTING
 }
 #endif
@@ -1150,7 +1262,7 @@ hostapd_rrm_nr_set(struct ubus_context *ctx, struct ubus_object *obj,
 			memcpy(&ssid, s, ssid.ssid_len);
 		}
 
-		hostapd_neighbor_set(hapd, bssid, &ssid, data, NULL, NULL, 0);
+		hostapd_neighbor_set(hapd, bssid, &ssid, data, NULL, NULL, 0, 0);
 		wpabuf_free(data);
 		continue;
 
@@ -1345,7 +1457,8 @@ void hostapd_ubus_handle_link_measurement(struct hostapd_data *hapd, const u8 *d
 
 static int
 hostapd_bss_tr_send(struct hostapd_data *hapd, u8 *addr, bool disassoc_imminent, bool abridged,
-		    u16 disassoc_timer, u8 validity_period, struct blob_attr *neighbors)
+		    u16 disassoc_timer, u8 validity_period, u8 dialog_token,
+		    struct blob_attr *neighbors, u8 mbo_reason, u8 cell_pref, u8 reassoc_delay)
 {
 	struct blob_attr *cur;
 	struct sta_info *sta;
@@ -1353,6 +1466,8 @@ hostapd_bss_tr_send(struct hostapd_data *hapd, u8 *addr, bool disassoc_imminent,
 	int rem;
 	u8 *nr = NULL;
 	u8 req_mode = 0;
+	u8 mbo[10];
+	size_t mbo_len = 0;
 
 	sta = ap_get_sta(hapd, addr);
 	if (!sta)
@@ -1404,8 +1519,37 @@ hostapd_bss_tr_send(struct hostapd_data *hapd, u8 *addr, bool disassoc_imminent,
 	if (disassoc_imminent)
 		req_mode |= WNM_BSS_TM_REQ_DISASSOC_IMMINENT;
 
+#ifdef CONFIG_MBO
+	u8 *mbo_pos = mbo;
+
+	if (mbo_reason > MBO_TRANSITION_REASON_PREMIUM_AP)
+		return UBUS_STATUS_INVALID_ARGUMENT;
+
+	if (cell_pref != 0 && cell_pref != 1 && cell_pref != 255)
+		return UBUS_STATUS_INVALID_ARGUMENT;
+
+	if (reassoc_delay > 65535 || (reassoc_delay && !disassoc_imminent))
+		return UBUS_STATUS_INVALID_ARGUMENT;
+
+	*mbo_pos++ = MBO_ATTR_ID_TRANSITION_REASON;
+	*mbo_pos++ = 1;
+	*mbo_pos++ = mbo_reason;
+	*mbo_pos++ = MBO_ATTR_ID_CELL_DATA_PREF;
+	*mbo_pos++ = 1;
+	*mbo_pos++ = cell_pref;
+
+	if (reassoc_delay) {
+		*mbo_pos++ = MBO_ATTR_ID_ASSOC_RETRY_DELAY;
+		*mbo_pos++ = 2;
+		WPA_PUT_LE16(mbo_pos, reassoc_delay);
+		mbo_pos += 2;
+	}
+
+	mbo_len = mbo_pos - mbo;
+#endif
+
 	if (wnm_send_bss_tm_req(hapd, sta, req_mode, disassoc_timer, validity_period, NULL,
-				NULL, nr, nr_len, NULL, 0))
+				dialog_token, NULL, nr, nr_len, mbo_len ? mbo : NULL, mbo_len))
 		return UBUS_STATUS_UNKNOWN_ERROR;
 
 	return 0;
@@ -1418,6 +1562,12 @@ enum {
 	BSS_TR_VALID_PERIOD,
 	BSS_TR_NEIGHBORS,
 	BSS_TR_ABRIDGED,
+	BSS_TR_DIALOG_TOKEN,
+#ifdef CONFIG_MBO
+	BSS_TR_MBO_REASON,
+	BSS_TR_CELL_PREF,
+	BSS_TR_REASSOC_DELAY,
+#endif
 	__BSS_TR_DISASSOC_MAX
 };
 
@@ -1428,6 +1578,12 @@ static const struct blobmsg_policy bss_tr_policy[__BSS_TR_DISASSOC_MAX] = {
 	[BSS_TR_VALID_PERIOD] = { "validity_period", BLOBMSG_TYPE_INT32 },
 	[BSS_TR_NEIGHBORS] = { "neighbors", BLOBMSG_TYPE_ARRAY },
 	[BSS_TR_ABRIDGED] = { "abridged", BLOBMSG_TYPE_BOOL },
+	[BSS_TR_DIALOG_TOKEN] = { "dialog_token", BLOBMSG_TYPE_INT32 },
+#ifdef CONFIG_MBO
+	[BSS_TR_MBO_REASON] = { "mbo_reason", BLOBMSG_TYPE_INT32 },
+	[BSS_TR_CELL_PREF] = { "cell_pref", BLOBMSG_TYPE_INT32 },
+	[BSS_TR_REASSOC_DELAY] = { "reassoc_delay", BLOBMSG_TYPE_INT32 },
+#endif
 };
 
 static int
@@ -1441,8 +1597,12 @@ hostapd_bss_transition_request(struct ubus_context *ctx, struct ubus_object *obj
 	u32 da_timer = 0;
 	u32 valid_period = 0;
 	u8 addr[ETH_ALEN];
+	u32 dialog_token = 1;
 	bool abridged;
 	bool da_imminent;
+	u8 mbo_reason;
+	u8 cell_pref;
+	u8 reassoc_delay;
 
 	blobmsg_parse(bss_tr_policy, __BSS_TR_DISASSOC_MAX, tb, blob_data(msg), blob_len(msg));
 
@@ -1458,63 +1618,90 @@ hostapd_bss_transition_request(struct ubus_context *ctx, struct ubus_object *obj
 	if (tb[BSS_TR_VALID_PERIOD])
 		valid_period = blobmsg_get_u32(tb[BSS_TR_VALID_PERIOD]);
 
+	if (tb[BSS_TR_DIALOG_TOKEN])
+		dialog_token = blobmsg_get_u32(tb[BSS_TR_DIALOG_TOKEN]);
+
 	da_imminent = !!(tb[BSS_TR_DA_IMMINENT] && blobmsg_get_bool(tb[BSS_TR_DA_IMMINENT]));
 	abridged = !!(tb[BSS_TR_ABRIDGED] && blobmsg_get_bool(tb[BSS_TR_ABRIDGED]));
 
-	return hostapd_bss_tr_send(hapd, addr, da_imminent, abridged, da_timer, valid_period,
-				   tb[BSS_TR_NEIGHBORS]);
-}
+#ifdef CONFIG_MBO
+	if (tb[BSS_TR_MBO_REASON])
+		mbo_reason = blobmsg_get_u32(tb[BSS_TR_MBO_REASON]);
 
+	if (tb[BSS_TR_CELL_PREF])
+		cell_pref = blobmsg_get_u32(tb[BSS_TR_CELL_PREF]);
+
+	if (tb[BSS_TR_REASSOC_DELAY])
+		reassoc_delay = blobmsg_get_u32(tb[BSS_TR_REASSOC_DELAY]);
+#endif
+
+	return hostapd_bss_tr_send(hapd, addr, da_imminent, abridged, da_timer, valid_period,
+				   dialog_token, tb[BSS_TR_NEIGHBORS], mbo_reason, cell_pref, reassoc_delay);
+}
+#endif
+
+#ifdef CONFIG_AIRTIME_POLICY
 enum {
-	WNM_DISASSOC_ADDR,
-	WNM_DISASSOC_DURATION,
-	WNM_DISASSOC_NEIGHBORS,
-	WNM_DISASSOC_ABRIDGED,
-	__WNM_DISASSOC_MAX,
+	UPDATE_AIRTIME_STA,
+	UPDATE_AIRTIME_WEIGHT,
+	__UPDATE_AIRTIME_MAX,
 };
 
-static const struct blobmsg_policy wnm_disassoc_policy[__WNM_DISASSOC_MAX] = {
-	[WNM_DISASSOC_ADDR] = { "addr", BLOBMSG_TYPE_STRING },
-	[WNM_DISASSOC_DURATION] { "duration", BLOBMSG_TYPE_INT32 },
-	[WNM_DISASSOC_NEIGHBORS] { "neighbors", BLOBMSG_TYPE_ARRAY },
-	[WNM_DISASSOC_ABRIDGED] { "abridged", BLOBMSG_TYPE_BOOL },
+
+static const struct blobmsg_policy airtime_policy[__UPDATE_AIRTIME_MAX] = {
+	[UPDATE_AIRTIME_STA] = { "sta", BLOBMSG_TYPE_STRING },
+	[UPDATE_AIRTIME_WEIGHT] = { "weight", BLOBMSG_TYPE_INT32 },
 };
 
 static int
-hostapd_wnm_disassoc_imminent(struct ubus_context *ctx, struct ubus_object *obj,
-			      struct ubus_request_data *ureq, const char *method,
-			      struct blob_attr *msg)
+hostapd_bss_update_airtime(struct ubus_context *ctx, struct ubus_object *obj,
+			   struct ubus_request_data *ureq, const char *method,
+			   struct blob_attr *msg)
 {
 	struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj);
-	struct blob_attr *tb[__WNM_DISASSOC_MAX];
-	struct sta_info *sta;
-	int duration = 10;
+	struct blob_attr *tb[__UPDATE_AIRTIME_MAX];
+	struct sta_info *sta = NULL;
 	u8 addr[ETH_ALEN];
-	bool abridged;
+	int weight;
 
-	blobmsg_parse(wnm_disassoc_policy, __WNM_DISASSOC_MAX, tb, blob_data(msg), blob_len(msg));
+	blobmsg_parse(airtime_policy, __UPDATE_AIRTIME_MAX, tb, blob_data(msg), blob_len(msg));
 
-	if (!tb[WNM_DISASSOC_ADDR])
+	if (!tb[UPDATE_AIRTIME_WEIGHT])
 		return UBUS_STATUS_INVALID_ARGUMENT;
 
-	if (hwaddr_aton(blobmsg_data(tb[WNM_DISASSOC_ADDR]), addr))
+	weight = blobmsg_get_u32(tb[UPDATE_AIRTIME_WEIGHT]);
+
+	if (!tb[UPDATE_AIRTIME_STA]) {
+		if (!weight)
+			return UBUS_STATUS_INVALID_ARGUMENT;
+
+		hapd->conf->airtime_weight = weight;
+		return 0;
+	}
+
+	if (hwaddr_aton(blobmsg_data(tb[UPDATE_AIRTIME_STA]), addr))
 		return UBUS_STATUS_INVALID_ARGUMENT;
 
-	if (tb[WNM_DISASSOC_DURATION])
-		duration = blobmsg_get_u32(tb[WNM_DISASSOC_DURATION]);
+	sta = ap_get_sta(hapd, addr);
+	if (!sta)
+		return UBUS_STATUS_NOT_FOUND;
 
-	abridged = !!(tb[WNM_DISASSOC_ABRIDGED] && blobmsg_get_bool(tb[WNM_DISASSOC_ABRIDGED]));
+	sta->dyn_airtime_weight = weight;
+	airtime_policy_new_sta(hapd, sta);
 
-	return hostapd_bss_tr_send(hapd, addr, true, abridged, duration, duration,
-				   tb[WNM_DISASSOC_NEIGHBORS]);
+	return 0;
 }
 #endif
 
+
 static const struct ubus_method bss_methods[] = {
 	UBUS_METHOD_NOARG("reload", hostapd_bss_reload),
 	UBUS_METHOD_NOARG("get_clients", hostapd_bss_get_clients),
 	UBUS_METHOD_NOARG("get_status", hostapd_bss_get_status),
 	UBUS_METHOD("del_client", hostapd_bss_del_client, del_policy),
+#ifdef CONFIG_AIRTIME_POLICY
+	UBUS_METHOD("update_airtime", hostapd_bss_update_airtime, airtime_policy),
+#endif
 	UBUS_METHOD_NOARG("list_bans", hostapd_bss_list_bans),
 #ifdef CONFIG_WPS
 	UBUS_METHOD_NOARG("wps_start", hostapd_bss_wps_start),
@@ -1535,7 +1722,6 @@ static const struct ubus_method bss_methods[] = {
 	UBUS_METHOD("rrm_beacon_req", hostapd_rrm_beacon_req, beacon_req_policy),
 	UBUS_METHOD("link_measurement_req", hostapd_rrm_lm_req, lm_req_policy),
 #ifdef CONFIG_WNM_AP
-	UBUS_METHOD("wnm_disassoc_imminent", hostapd_wnm_disassoc_imminent, wnm_disassoc_policy),
 	UBUS_METHOD("bss_transition_request", hostapd_bss_transition_request, bss_tr_policy),
 #endif
 };
@@ -1599,6 +1785,43 @@ void hostapd_ubus_free_bss(struct hostapd_data *hapd)
 	free(name);
 }
 
+static void
+hostapd_ubus_vlan_action(struct hostapd_data *hapd, struct hostapd_vlan *vlan,
+			 const char *action)
+{
+	struct vlan_description *desc = &vlan->vlan_desc;
+	void *c;
+	int i;
+
+	if (!hapd->ubus.obj.has_subscribers)
+		return;
+
+	blob_buf_init(&b, 0);
+	blobmsg_add_string(&b, "ifname", vlan->ifname);
+	blobmsg_add_string(&b, "bridge", vlan->bridge);
+	blobmsg_add_u32(&b, "vlan_id", vlan->vlan_id);
+
+	if (desc->notempty) {
+		blobmsg_add_u32(&b, "untagged", desc->untagged);
+		c = blobmsg_open_array(&b, "tagged");
+		for (i = 0; i < ARRAY_SIZE(desc->tagged) && desc->tagged[i]; i++)
+			blobmsg_add_u32(&b, "", desc->tagged[i]);
+		blobmsg_close_array(&b, c);
+	}
+
+	ubus_notify(ctx, &hapd->ubus.obj, action, b.head, -1);
+}
+
+void hostapd_ubus_add_vlan(struct hostapd_data *hapd, struct hostapd_vlan *vlan)
+{
+	hostapd_ubus_vlan_action(hapd, vlan, "vlan_add");
+}
+
+void hostapd_ubus_remove_vlan(struct hostapd_data *hapd, struct hostapd_vlan *vlan)
+{
+	hostapd_ubus_vlan_action(hapd, vlan, "vlan_remove");
+}
+
 static const struct ubus_method daemon_methods[] = {
 	UBUS_METHOD("config_add", hostapd_config_add, config_add_policy),
 	UBUS_METHOD("config_remove", hostapd_config_remove, config_remove_policy),
@@ -1786,13 +2009,48 @@ void hostapd_ubus_notify_beacon_report(
 	ubus_notify(ctx, &hapd->ubus.obj, "beacon-report", b.head, -1);
 }
 
+void hostapd_ubus_notify_radar_detected(struct hostapd_iface *iface, int frequency,
+					int chan_width, int cf1, int cf2)
+{
+	struct hostapd_data *hapd;
+	int i;
+
+	blob_buf_init(&b, 0);
+	blobmsg_add_u16(&b, "frequency", frequency);
+	blobmsg_add_u16(&b, "width", chan_width);
+	blobmsg_add_u16(&b, "center1", cf1);
+	blobmsg_add_u16(&b, "center2", cf2);
+
+	for (i = 0; i < iface->num_bss; i++) {
+		hapd = iface->bss[i];
+		ubus_notify(ctx, &hapd->ubus.obj, "radar-detected", b.head, -1);
+	}
+}
+
+#ifdef CONFIG_WNM_AP
+static void hostapd_ubus_notify_bss_transition_add_candidate_list(
+	const u8 *candidate_list, u16 candidate_list_len)
+{
+	char *cl_str;
+	int i;
+
+	if (candidate_list_len == 0)
+		return;
+
+	cl_str = blobmsg_alloc_string_buffer(&b, "candidate-list", candidate_list_len * 2 + 1);
+	for (i = 0; i < candidate_list_len; i++)
+		snprintf(&cl_str[i*2], 3, "%02X", candidate_list[i]);
+	blobmsg_add_string_buffer(&b);
+
+}
+#endif
+
 void hostapd_ubus_notify_bss_transition_response(
 	struct hostapd_data *hapd, const u8 *addr, u8 dialog_token, u8 status_code,
 	u8 bss_termination_delay, const u8 *target_bssid,
 	const u8 *candidate_list, u16 candidate_list_len)
 {
 #ifdef CONFIG_WNM_AP
-	char *cl_str;
 	u16 i;
 
 	if (!hapd->ubus.obj.has_subscribers)
@@ -1808,13 +2066,45 @@ void hostapd_ubus_notify_bss_transition_response(
 	blobmsg_add_u8(&b, "bss-termination-delay", bss_termination_delay);
 	if (target_bssid)
 		blobmsg_add_macaddr(&b, "target-bssid", target_bssid);
-	if (candidate_list_len > 0) {
-		cl_str = blobmsg_alloc_string_buffer(&b, "candidate-list", candidate_list_len * 2 + 1);
-		for (i = 0; i < candidate_list_len; i++)
-			snprintf(&cl_str[i*2], 3, "%02X", candidate_list[i]);
-		blobmsg_add_string_buffer(&b);
-	}
+	
+	hostapd_ubus_notify_bss_transition_add_candidate_list(candidate_list, candidate_list_len);
 
 	ubus_notify(ctx, &hapd->ubus.obj, "bss-transition-response", b.head, -1);
 #endif
 }
+
+int hostapd_ubus_notify_bss_transition_query(
+	struct hostapd_data *hapd, const u8 *addr, u8 dialog_token, u8 reason,
+	const u8 *candidate_list, u16 candidate_list_len)
+{
+#ifdef CONFIG_WNM_AP
+	struct ubus_event_req ureq = {};
+	char *cl_str;
+	u16 i;
+
+	if (!hapd->ubus.obj.has_subscribers)
+		return 0;
+
+	if (!addr)
+		return 0;
+
+	blob_buf_init(&b, 0);
+	blobmsg_add_macaddr(&b, "address", addr);
+	blobmsg_add_u8(&b, "dialog-token", dialog_token);
+	blobmsg_add_u8(&b, "reason", reason);
+	hostapd_ubus_notify_bss_transition_add_candidate_list(candidate_list, candidate_list_len);
+
+	if (!hapd->ubus.notify_response) {
+		ubus_notify(ctx, &hapd->ubus.obj, "bss-transition-query", b.head, -1);
+		return 0;
+	}
+
+	if (ubus_notify_async(ctx, &hapd->ubus.obj, "bss-transition-query", b.head, &ureq.nreq))
+		return 0;
+
+	ureq.nreq.status_cb = ubus_event_cb;
+	ubus_complete_request(ctx, &ureq.nreq.req, 100);
+
+	return ureq.resp;
+#endif
+}
diff --git a/package/network/services/hostapd/src/src/ap/ubus.h b/package/network/services/hostapd/src/src/ap/ubus.h
index 006798dcc7..5a33b624d0 100644
--- a/package/network/services/hostapd/src/src/ap/ubus.h
+++ b/package/network/services/hostapd/src/src/ap/ubus.h
@@ -43,6 +43,8 @@ void hostapd_ubus_add_iface(struct hostapd_iface *iface);
 void hostapd_ubus_free_iface(struct hostapd_iface *iface);
 void hostapd_ubus_add_bss(struct hostapd_data *hapd);
 void hostapd_ubus_free_bss(struct hostapd_data *hapd);
+void hostapd_ubus_add_vlan(struct hostapd_data *hapd, struct hostapd_vlan *vlan);
+void hostapd_ubus_remove_vlan(struct hostapd_data *hapd, struct hostapd_vlan *vlan);
 
 int hostapd_ubus_handle_event(struct hostapd_data *hapd, struct hostapd_ubus_request *req);
 void hostapd_ubus_handle_link_measurement(struct hostapd_data *hapd, const u8 *data, size_t len);
@@ -51,6 +53,8 @@ void hostapd_ubus_notify_beacon_report(struct hostapd_data *hapd,
 				       const u8 *addr, u8 token, u8 rep_mode,
 				       struct rrm_measurement_beacon_report *rep,
 				       size_t len);
+void hostapd_ubus_notify_radar_detected(struct hostapd_iface *iface, int frequency,
+					int chan_width, int cf1, int cf2);
 
 void hostapd_ubus_notify_bss_transition_response(
 	struct hostapd_data *hapd, const u8 *addr, u8 dialog_token, u8 status_code,
@@ -58,6 +62,9 @@ void hostapd_ubus_notify_bss_transition_response(
 	const u8 *candidate_list, u16 candidate_list_len);
 void hostapd_ubus_add(struct hapd_interfaces *interfaces);
 void hostapd_ubus_free(struct hapd_interfaces *interfaces);
+int hostapd_ubus_notify_bss_transition_query(
+	struct hostapd_data *hapd, const u8 *addr, u8 dialog_token, u8 reason,
+	const u8 *candidate_list, u16 candidate_list_len);
 
 #else
 
@@ -79,6 +86,14 @@ static inline void hostapd_ubus_free_bss(struct hostapd_data *hapd)
 {
 }
 
+static inline void hostapd_ubus_add_vlan(struct hostapd_data *hapd, struct hostapd_vlan *vlan)
+{
+}
+
+static inline void hostapd_ubus_remove_vlan(struct hostapd_data *hapd, struct hostapd_vlan *vlan)
+{
+}
+
 static inline int hostapd_ubus_handle_event(struct hostapd_data *hapd, struct hostapd_ubus_request *req)
 {
 	return 0;
@@ -99,6 +114,10 @@ static inline void hostapd_ubus_notify_beacon_report(struct hostapd_data *hapd,
 						     size_t len)
 {
 }
+static inline void hostapd_ubus_notify_radar_detected(struct hostapd_iface *iface, int frequency,
+						      int chan_width, int cf1, int cf2)
+{
+}
 
 static inline void hostapd_ubus_notify_bss_transition_response(
 	struct hostapd_data *hapd, const u8 *addr, u8 dialog_token, u8 status_code,
@@ -114,6 +133,13 @@ static inline void hostapd_ubus_add(struct hapd_interfaces *interfaces)
 static inline void hostapd_ubus_free(struct hapd_interfaces *interfaces)
 {
 }
+
+static inline int hostapd_ubus_notify_bss_transition_query(
+	struct hostapd_data *hapd, const u8 *addr, u8 dialog_token, u8 reason,
+	const u8 *candidate_list, u16 candidate_list_len)
+{
+	return 0;
+}
 #endif
 
 #endif
diff --git a/package/network/services/hostapd/src/src/utils/build_features.h b/package/network/services/hostapd/src/src/utils/build_features.h
index c7fccad413..642a35836e 100644
--- a/package/network/services/hostapd/src/src/utils/build_features.h
+++ b/package/network/services/hostapd/src/src/utils/build_features.h
@@ -23,8 +23,6 @@ static inline int has_feature(const char *feat)
 	if (!strcmp(feat, "11r"))
 		return 1;
 #endif
-	if (!strcmp(feat, "11w"))
-		return 1;
 #ifdef CONFIG_ACS
 	if (!strcmp(feat, "acs"))
 		return 1;
@@ -52,6 +50,14 @@ static inline int has_feature(const char *feat)
 #ifdef CONFIG_WPS
 	if (!strcmp(feat, "wps"))
 		return 1;
+#endif
+#ifdef CONFIG_FILS
+	if (!strcmp(feat, "fils"))
+		return 1;
+#endif
+#ifdef CONFIG_OCV
+	if (!strcmp(feat, "ocv"))
+		return 1;
 #endif
 	return 0;
 }
diff --git a/package/network/utils/iw/Makefile b/package/network/utils/iw/Makefile
index 8e11046189..eb3a9ba091 100644
--- a/package/network/utils/iw/Makefile
+++ b/package/network/utils/iw/Makefile
@@ -8,13 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=iw
-PKG_VERSION:=5.9-8fab0c9e
-PKG_RELEASE:=$(AUTORELEASE)
-
-PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://git.kernel.org/pub/scm/linux/kernel/git/jberg/iw.git
-PKG_SOURCE_VERSION:=8fab0c9ee9db217587a58efcc37421c86edcb638
-PKG_MIRROR_HASH:=797b322bc03952f3127ae0a7da476c14ada1bbe9a9ae234a56dd6f864c568e16
+PKG_VERSION:=5.19
+PKG_RELEASE:=1
+ 
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_SOURCE_URL:=@KERNEL/software/network/iw
+PKG_HASH:=f167bbe947dd53bb9ebc0c1dcef5db6ad73ac1d6084f2c6f9376c5c360cc4d4e
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=GPL-2.0
diff --git a/package/network/utils/iw/patches/001-nl80211_h_sync.patch b/package/network/utils/iw/patches/001-nl80211_h_sync.patch
index 2f724b61ff..49d08d9b01 100644
--- a/package/network/utils/iw/patches/001-nl80211_h_sync.patch
+++ b/package/network/utils/iw/patches/001-nl80211_h_sync.patch
@@ -1,345 +1,554 @@
 --- a/nl80211.h
 +++ b/nl80211.h
-@@ -655,6 +655,9 @@
-  *	When a security association was established on an 802.1X network using
-  *	fast transition, this event should be followed by an
-  *	%NL80211_CMD_PORT_AUTHORIZED event.
-+ *	Following a %NL80211_CMD_ROAM event userspace can issue
-+ *	%NL80211_CMD_GET_SCAN in order to obtain the scan information for the
-+ *	new BSS the card/driver roamed to.
-  * @NL80211_CMD_DISCONNECT: drop a given connection; also used to notify
-  *	userspace that a connection was dropped by the AP or due to other
-  *	reasons, for this the %NL80211_ATTR_DISCONNECTED_BY_AP and
-@@ -757,7 +760,8 @@
-  *	of any other interfaces, and other interfaces will again take
-  *	precedence when they are used.
+@@ -11,7 +11,7 @@
+  * Copyright 2008 Jouni Malinen <jouni.malinen@atheros.com>
+  * Copyright 2008 Colin McCabe <colin@cozybit.com>
+  * Copyright 2015-2017	Intel Deutschland GmbH
+- * Copyright (C) 2018-2022 Intel Corporation
++ * Copyright (C) 2018-2021 Intel Corporation
   *
-- * @NL80211_CMD_SET_WDS_PEER: Set the MAC address of the peer on a WDS interface.
-+ * @NL80211_CMD_SET_WDS_PEER: Set the MAC address of the peer on a WDS interface
-+ *	(no longer supported).
+  * Permission to use, copy, modify, and/or distribute this software for any
+  * purpose with or without fee is hereby granted, provided that the above
+@@ -301,29 +301,6 @@
+  */
+ 
+ /**
+- * DOC: FILS shared key crypto offload
+- *
+- * This feature is applicable to drivers running in AP mode.
+- *
+- * FILS shared key crypto offload can be advertised by drivers by setting
+- * @NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD flag. The drivers that support
+- * FILS shared key crypto offload should be able to encrypt and decrypt
+- * association frames for FILS shared key authentication as per IEEE 802.11ai.
+- * With this capability, for FILS key derivation, drivers depend on userspace.
+- *
+- * After FILS key derivation, userspace shares the FILS AAD details with the
+- * driver and the driver stores the same to use in decryption of association
+- * request and in encryption of association response. The below parameters
+- * should be given to the driver in %NL80211_CMD_SET_FILS_AAD.
+- *	%NL80211_ATTR_MAC - STA MAC address, used for storing FILS AAD per STA
+- *	%NL80211_ATTR_FILS_KEK - Used for encryption or decryption
+- *	%NL80211_ATTR_FILS_NONCES - Used for encryption or decryption
+- *			(STA Nonce 16 bytes followed by AP Nonce 16 bytes)
+- *
+- * Once the association is done, the driver cleans the FILS AAD data.
+- */
+-
+-/**
+  * enum nl80211_commands - supported nl80211 commands
   *
-  * @NL80211_CMD_SET_MULTICAST_TO_UNICAST: Configure if this AP should perform
-  *	multicast to unicast conversion. When enabled, all multicast packets
-@@ -1177,6 +1181,25 @@
-  *	includes the contents of the frame. %NL80211_ATTR_ACK flag is included
-  *	if the recipient acknowledged the frame.
+  * @NL80211_CMD_UNSPEC: unspecified command to catch errors
+@@ -1226,17 +1203,6 @@
+  * @NL80211_CMD_COLOR_CHANGE_COMPLETED: Notify userland that the color change
+  *	has completed
   *
-+ * @NL80211_CMD_SET_SAR_SPECS: SAR power limitation configuration is
-+ *	passed using %NL80211_ATTR_SAR_SPEC. %NL80211_ATTR_WIPHY is used to
-+ *	specify the wiphy index to be applied to.
-+ *
-+ * @NL80211_CMD_OBSS_COLOR_COLLISION: This notification is sent out whenever
-+ *	mac80211/drv detects a bss color collision.
-+ *
-+ * @NL80211_CMD_COLOR_CHANGE_REQUEST: This command is used to indicate that
-+ *	userspace wants to change the BSS color.
-+ *
-+ * @NL80211_CMD_COLOR_CHANGE_STARTED: Notify userland, that a color change has
-+ *	started
-+ *
-+ * @NL80211_CMD_COLOR_CHANGE_ABORTED: Notify userland, that the color change has
-+ *	been aborted
-+ *
-+ * @NL80211_CMD_COLOR_CHANGE_COMPLETED: Notify userland that the color change
-+ *	has completed
-+ *
+- * @NL80211_CMD_SET_FILS_AAD: Set FILS AAD data to the driver using -
+- *	&NL80211_ATTR_MAC - for STA MAC address
+- *	&NL80211_ATTR_FILS_KEK - for KEK
+- *	&NL80211_ATTR_FILS_NONCES - for FILS Nonces
+- *		(STA Nonce 16 bytes followed by AP Nonce 16 bytes)
+- *
+- * @NL80211_CMD_ASSOC_COMEBACK: notification about an association
+- *      temporal rejection with comeback. The event includes %NL80211_ATTR_MAC
+- *      to describe the BSSID address of the AP and %NL80211_ATTR_TIMEOUT to
+- *      specify the timeout value.
+- *
   * @NL80211_CMD_MAX: highest used command number
   * @__NL80211_CMD_AFTER_LAST: internal use
   */
-@@ -1407,6 +1430,16 @@ enum nl80211_commands {
+@@ -1477,10 +1443,6 @@ enum nl80211_commands {
+ 	NL80211_CMD_COLOR_CHANGE_ABORTED,
+ 	NL80211_CMD_COLOR_CHANGE_COMPLETED,
  
- 	NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS,
- 
-+	NL80211_CMD_SET_SAR_SPECS,
-+
-+	NL80211_CMD_OBSS_COLOR_COLLISION,
-+
-+	NL80211_CMD_COLOR_CHANGE_REQUEST,
-+
-+	NL80211_CMD_COLOR_CHANGE_STARTED,
-+	NL80211_CMD_COLOR_CHANGE_ABORTED,
-+	NL80211_CMD_COLOR_CHANGE_COMPLETED,
-+
+-	NL80211_CMD_SET_FILS_AAD,
+-
+-	NL80211_CMD_ASSOC_COMEBACK,
+-
  	/* add new commands above here */
  
  	/* used to define NL80211_CMD_MAX below */
-@@ -1750,8 +1783,9 @@ enum nl80211_commands {
-  *	specify just a single bitrate, which is to be used for the beacon.
-  *	The driver must also specify support for this with the extended
-  *	features NL80211_EXT_FEATURE_BEACON_RATE_LEGACY,
-- *	NL80211_EXT_FEATURE_BEACON_RATE_HT and
-- *	NL80211_EXT_FEATURE_BEACON_RATE_VHT.
-+ *	NL80211_EXT_FEATURE_BEACON_RATE_HT,
-+ *	NL80211_EXT_FEATURE_BEACON_RATE_VHT and
-+ *	NL80211_EXT_FEATURE_BEACON_RATE_HE.
+@@ -2477,9 +2439,7 @@ enum nl80211_commands {
+  *	space supports external authentication. This attribute shall be used
+  *	with %NL80211_CMD_CONNECT and %NL80211_CMD_START_AP request. The driver
+  *	may offload authentication processing to user space if this capability
+- *	is indicated in the respective requests from the user space. (This flag
+- *	attribute deprecated for %NL80211_CMD_START_AP, use
+- *	%NL80211_ATTR_AP_SETTINGS_FLAGS)
++ *	is indicated in the respective requests from the user space.
   *
-  * @NL80211_ATTR_FRAME_MATCH: A binary attribute which typically must contain
-  *	at least one byte, currently used with @NL80211_CMD_REGISTER_FRAME.
-@@ -1955,8 +1989,15 @@ enum nl80211_commands {
-  * @NL80211_ATTR_PROBE_RESP: Probe Response template data. Contains the entire
-  *	probe-response frame. The DA field in the 802.11 header is zero-ed out,
-  *	to be filled by the FW.
-- * @NL80211_ATTR_DISABLE_HT:  Force HT capable interfaces to disable
-- *      this feature.  Currently, only supported in mac80211 drivers.
-+ * @NL80211_ATTR_DISABLE_HT: Force HT capable interfaces to disable
-+ *      this feature during association. This is a flag attribute.
-+ *	Currently only supported in mac80211 drivers.
-+ * @NL80211_ATTR_DISABLE_VHT: Force VHT capable interfaces to disable
-+ *      this feature during association. This is a flag attribute.
-+ *	Currently only supported in mac80211 drivers.
-+ * @NL80211_ATTR_DISABLE_HE: Force HE capable interfaces to disable
-+ *      this feature during association. This is a flag attribute.
-+ *	Currently only supported in mac80211 drivers.
-  * @NL80211_ATTR_HT_CAPABILITY_MASK: Specify which bits of the
-  *      ATTR_HT_CAPABILITY to which attention should be paid.
-  *      Currently, only mac80211 NICs support this feature.
-@@ -2077,7 +2118,8 @@ enum nl80211_commands {
-  *	until the channel switch event.
-  * @NL80211_ATTR_CH_SWITCH_BLOCK_TX: flag attribute specifying that transmission
-  *	must be blocked on the current channel (before the channel switch
-- *	operation).
-+ *	operation). Also included in the channel switch started event if quiet
-+ *	was requested by the AP.
-  * @NL80211_ATTR_CSA_IES: Nested set of attributes containing the IE information
-  *	for the time while performing a channel switch.
-  * @NL80211_ATTR_CNTDWN_OFFS_BEACON: An array of offsets (u16) to the channel
-@@ -2527,6 +2569,33 @@ enum nl80211_commands {
-  *	override mask. Used with NL80211_ATTR_S1G_CAPABILITY in
-  *	NL80211_CMD_ASSOCIATE or NL80211_CMD_CONNECT.
+  * @NL80211_ATTR_NSS: Station's New/updated  RX_NSS value notified using this
+  *	u8 attribute. This is used with %NL80211_CMD_STA_OPMODE_CHANGED.
+@@ -2655,13 +2615,8 @@ enum nl80211_commands {
+  *	switching on a different channel during CAC detection on the selected
+  *	radar channel.
   *
-+ * @NL80211_ATTR_SAE_PWE: Indicates the mechanism(s) allowed for SAE PWE
-+ *	derivation in WPA3-Personal networks which are using SAE authentication.
-+ *	This is a u8 attribute that encapsulates one of the values from
-+ *	&enum nl80211_sae_pwe_mechanism.
-+ *
-+ * @NL80211_ATTR_SAR_SPEC: SAR power limitation specification when
-+ *	used with %NL80211_CMD_SET_SAR_SPECS. The message contains fields
-+ *	of %nl80211_sar_attrs which specifies the sar type and related
-+ *	sar specs. Sar specs contains array of %nl80211_sar_specs_attrs.
-+ *
-+ * @NL80211_ATTR_RECONNECT_REQUESTED: flag attribute, used with deauth and
-+ *	disassoc events to indicate that an immediate reconnect to the AP
-+ *	is desired.
-+ *
-+ * @NL80211_ATTR_OBSS_COLOR_BITMAP: bitmap of the u64 BSS colors for the
-+ *	%NL80211_CMD_OBSS_COLOR_COLLISION event.
-+ *
-+ * @NL80211_ATTR_COLOR_CHANGE_COUNT: u8 attribute specifying the number of TBTT's
-+ *	until the color switch event.
-+ * @NL80211_ATTR_COLOR_CHANGE_COLOR: u8 attribute specifying the color that we are
-+ *	switching to
-+ * @NL80211_ATTR_COLOR_CHANGE_ELEMS: Nested set of attributes containing the IE
-+ *	information for the time while performing a color switch.
-+ *
+- * @NL80211_ATTR_AP_SETTINGS_FLAGS: u32 attribute contains ap settings flags,
+- *	enumerated in &enum nl80211_ap_settings_flags. This attribute shall be
+- *	used with %NL80211_CMD_START_AP request.
+- *
+- * @NL80211_ATTR_EHT_CAPABILITY: EHT Capability information element (from
+- *	association request when used with NL80211_CMD_NEW_STATION). Can be set
+- *	only if %NL80211_STA_FLAG_WME is set.
 + * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
 + *	transmit power to stay within regulatory limits. u32, dBi.
-+ *
+  *
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3016,6 +3085,22 @@ enum nl80211_attrs {
- 	NL80211_ATTR_S1G_CAPABILITY,
- 	NL80211_ATTR_S1G_CAPABILITY_MASK,
+@@ -3171,11 +3126,7 @@ enum nl80211_attrs {
  
-+	NL80211_ATTR_SAE_PWE,
-+
-+	NL80211_ATTR_RECONNECT_REQUESTED,
-+
-+	NL80211_ATTR_SAR_SPEC,
-+
-+	NL80211_ATTR_DISABLE_HE,
-+
-+	NL80211_ATTR_OBSS_COLOR_BITMAP,
-+
-+	NL80211_ATTR_COLOR_CHANGE_COUNT,
-+	NL80211_ATTR_COLOR_CHANGE_COLOR,
-+	NL80211_ATTR_COLOR_CHANGE_ELEMS,
-+
+ 	NL80211_ATTR_RADAR_BACKGROUND,
+ 
+-	NL80211_ATTR_AP_SETTINGS_FLAGS,
+-
+-	NL80211_ATTR_EHT_CAPABILITY,
+-
+-	NL80211_ATTR_DISABLE_EHT,
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
-+
+ 
  	/* add attributes here, update the policy in nl80211.c */
  
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -5896,6 +5981,22 @@ enum nl80211_feature_flags {
-  * @NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP: Driver/device supports
-  *	unsolicited broadcast probe response transmission
-  *
-+ * @NL80211_EXT_FEATURE_BEACON_RATE_HE: Driver supports beacon rate
-+ *	configuration (AP/mesh) with HE rates.
-+ *
-+ * @NL80211_EXT_FEATURE_SECURE_LTF: Device supports secure LTF measurement
-+ *      exchange protocol.
-+ *
-+ * @NL80211_EXT_FEATURE_SECURE_RTT: Device supports secure RTT measurement
-+ *      exchange protocol.
-+ *
-+ * @NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE: Device supports management
-+ *      frame protection for all management frames exchanged during the
-+ *      negotiation and range measurement procedure.
-+ *
-+ * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
-+ *	detection and change announcemnts.
-+ *
-  * @NUM_NL80211_EXT_FEATURES: number of extended features.
-  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
-  */
-@@ -5956,6 +6057,11 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_SAE_OFFLOAD_AP,
- 	NL80211_EXT_FEATURE_FILS_DISCOVERY,
- 	NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP,
-+	NL80211_EXT_FEATURE_BEACON_RATE_HE,
-+	NL80211_EXT_FEATURE_SECURE_LTF,
-+	NL80211_EXT_FEATURE_SECURE_RTT,
-+	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
-+	NL80211_EXT_FEATURE_BSS_COLOR,
+@@ -3232,8 +3183,6 @@ enum nl80211_attrs {
+ #define NL80211_HE_MAX_CAPABILITY_LEN           54
+ #define NL80211_MAX_NR_CIPHER_SUITES		5
+ #define NL80211_MAX_NR_AKM_SUITES		2
+-#define NL80211_EHT_MIN_CAPABILITY_LEN          13
+-#define NL80211_EHT_MAX_CAPABILITY_LEN          51
  
- 	/* add new features before the definition below */
- 	NUM_NL80211_EXT_FEATURES,
-@@ -6253,11 +6359,13 @@ struct nl80211_vendor_cmd_info {
-  * @NL80211_TDLS_PEER_HT: TDLS peer is HT capable.
-  * @NL80211_TDLS_PEER_VHT: TDLS peer is VHT capable.
-  * @NL80211_TDLS_PEER_WMM: TDLS peer is WMM capable.
-+ * @NL80211_TDLS_PEER_HE: TDLS peer is HE capable.
-  */
- enum nl80211_tdls_peer_capability {
- 	NL80211_TDLS_PEER_HT = 1<<0,
- 	NL80211_TDLS_PEER_VHT = 1<<1,
- 	NL80211_TDLS_PEER_WMM = 1<<2,
-+	NL80211_TDLS_PEER_HE = 1<<3,
+ #define NL80211_MIN_REMAIN_ON_CHANNEL_TIME	10
+ 
+@@ -3261,7 +3210,7 @@ enum nl80211_attrs {
+  *	and therefore can't be created in the normal ways, use the
+  *	%NL80211_CMD_START_P2P_DEVICE and %NL80211_CMD_STOP_P2P_DEVICE
+  *	commands to create and destroy one
+- * @NL80211_IFTYPE_OCB: Outside Context of a BSS
++ * @NL80211_IF_TYPE_OCB: Outside Context of a BSS
+  *	This mode corresponds to the MIB variable dot11OCBActivated=true
+  * @NL80211_IFTYPE_NAN: NAN device interface type (not a netdev)
+  * @NL80211_IFTYPE_MAX: highest interface type number currently defined
+@@ -3403,56 +3352,6 @@ enum nl80211_he_ru_alloc {
  };
  
  /**
-@@ -6849,6 +6957,9 @@ enum nl80211_peer_measurement_ftm_capa {
-  *      if neither %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED nor
-  *	%NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set, EDCA based
-  *	ranging will be used.
-+ * @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK: negotiate for LMR feedback. Only
-+ *	valid if either %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED or
-+ *	%NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
+- * enum nl80211_eht_gi - EHT guard interval
+- * @NL80211_RATE_INFO_EHT_GI_0_8: 0.8 usec
+- * @NL80211_RATE_INFO_EHT_GI_1_6: 1.6 usec
+- * @NL80211_RATE_INFO_EHT_GI_3_2: 3.2 usec
+- */
+-enum nl80211_eht_gi {
+-	NL80211_RATE_INFO_EHT_GI_0_8,
+-	NL80211_RATE_INFO_EHT_GI_1_6,
+-	NL80211_RATE_INFO_EHT_GI_3_2,
+-};
+-
+-/**
+- * enum nl80211_eht_ru_alloc - EHT RU allocation values
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC_26: 26-tone RU allocation
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC_52: 52-tone RU allocation
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC_52P26: 52+26-tone RU allocation
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC_106: 106-tone RU allocation
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC_106P26: 106+26 tone RU allocation
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC_242: 242-tone RU allocation
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC_484: 484-tone RU allocation
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC_484P242: 484+242 tone RU allocation
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC_996: 996-tone RU allocation
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC_996P484: 996+484 tone RU allocation
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC_996P484P242: 996+484+242 tone RU allocation
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC_2x996: 2x996-tone RU allocation
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC_2x996P484: 2x996+484 tone RU allocation
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC_3x996: 3x996-tone RU allocation
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC_3x996P484: 3x996+484 tone RU allocation
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC_4x996: 4x996-tone RU allocation
+- */
+-enum nl80211_eht_ru_alloc {
+-	NL80211_RATE_INFO_EHT_RU_ALLOC_26,
+-	NL80211_RATE_INFO_EHT_RU_ALLOC_52,
+-	NL80211_RATE_INFO_EHT_RU_ALLOC_52P26,
+-	NL80211_RATE_INFO_EHT_RU_ALLOC_106,
+-	NL80211_RATE_INFO_EHT_RU_ALLOC_106P26,
+-	NL80211_RATE_INFO_EHT_RU_ALLOC_242,
+-	NL80211_RATE_INFO_EHT_RU_ALLOC_484,
+-	NL80211_RATE_INFO_EHT_RU_ALLOC_484P242,
+-	NL80211_RATE_INFO_EHT_RU_ALLOC_996,
+-	NL80211_RATE_INFO_EHT_RU_ALLOC_996P484,
+-	NL80211_RATE_INFO_EHT_RU_ALLOC_996P484P242,
+-	NL80211_RATE_INFO_EHT_RU_ALLOC_2x996,
+-	NL80211_RATE_INFO_EHT_RU_ALLOC_2x996P484,
+-	NL80211_RATE_INFO_EHT_RU_ALLOC_3x996,
+-	NL80211_RATE_INFO_EHT_RU_ALLOC_3x996P484,
+-	NL80211_RATE_INFO_EHT_RU_ALLOC_4x996,
+-};
+-
+-/**
+  * enum nl80211_rate_info - bitrate information
   *
-  * @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal
-  * @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number
-@@ -6867,6 +6978,7 @@ enum nl80211_peer_measurement_ftm_req {
- 	NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC,
- 	NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED,
- 	NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED,
-+	NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK,
+  * These attribute types are used with %NL80211_STA_INFO_TXRATE
+@@ -3491,13 +3390,6 @@ enum nl80211_eht_ru_alloc {
+  * @NL80211_RATE_INFO_HE_DCM: HE DCM value (u8, 0/1)
+  * @NL80211_RATE_INFO_RU_ALLOC: HE RU allocation, if not present then
+  *	non-OFDMA was used (u8, see &enum nl80211_he_ru_alloc)
+- * @NL80211_RATE_INFO_320_MHZ_WIDTH: 320 MHz bitrate
+- * @NL80211_RATE_INFO_EHT_MCS: EHT MCS index (u8, 0-15)
+- * @NL80211_RATE_INFO_EHT_NSS: EHT NSS value (u8, 1-8)
+- * @NL80211_RATE_INFO_EHT_GI: EHT guard interval identifier
+- *	(u8, see &enum nl80211_eht_gi)
+- * @NL80211_RATE_INFO_EHT_RU_ALLOC: EHT RU allocation, if not present then
+- *	non-OFDMA was used (u8, see &enum nl80211_eht_ru_alloc)
+  * @__NL80211_RATE_INFO_AFTER_LAST: internal use
+  */
+ enum nl80211_rate_info {
+@@ -3519,11 +3411,6 @@ enum nl80211_rate_info {
+ 	NL80211_RATE_INFO_HE_GI,
+ 	NL80211_RATE_INFO_HE_DCM,
+ 	NL80211_RATE_INFO_HE_RU_ALLOC,
+-	NL80211_RATE_INFO_320_MHZ_WIDTH,
+-	NL80211_RATE_INFO_EHT_MCS,
+-	NL80211_RATE_INFO_EHT_NSS,
+-	NL80211_RATE_INFO_EHT_GI,
+-	NL80211_RATE_INFO_EHT_RU_ALLOC,
  
  	/* keep last */
- 	NUM_NL80211_PMSR_FTM_REQ_ATTR,
-@@ -7124,4 +7236,115 @@ enum nl80211_unsol_bcast_probe_resp_attr
- 	NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX =
- 		__NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_LAST - 1
+ 	__NL80211_RATE_INFO_AFTER_LAST,
+@@ -3834,20 +3721,13 @@ enum nl80211_mpath_info {
+  *     capabilities IE
+  * @NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE: HE PPE thresholds information as
+  *     defined in HE capabilities IE
++ * @NL80211_BAND_IFTYPE_ATTR_MAX: highest band HE capability attribute currently
++ *     defined
+  * @NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA: HE 6GHz band capabilities (__le16),
+  *	given for all 6 GHz band channels
+  * @NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS: vendor element capabilities that are
+  *	advertised on this band/for this iftype (binary)
+- * @NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC: EHT MAC capabilities as in EHT
+- *	capabilities element
+- * @NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY: EHT PHY capabilities as in EHT
+- *	capabilities element
+- * @NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET: EHT supported NSS/MCS as in EHT
+- *	capabilities element
+- * @NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE: EHT PPE thresholds information as
+- *	defined in EHT capabilities element
+  * @__NL80211_BAND_IFTYPE_ATTR_AFTER_LAST: internal use
+- * @NL80211_BAND_IFTYPE_ATTR_MAX: highest band attribute currently defined
+  */
+ enum nl80211_band_iftype_attr {
+ 	__NL80211_BAND_IFTYPE_ATTR_INVALID,
+@@ -3859,10 +3739,6 @@ enum nl80211_band_iftype_attr {
+ 	NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
+ 	NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
+ 	NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
+-	NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
+-	NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
+-	NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
+-	NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
+ 
+ 	/* keep last */
+ 	__NL80211_BAND_IFTYPE_ATTR_AFTER_LAST,
+@@ -4007,10 +3883,6 @@ enum nl80211_wmm_rule {
+  *	on this channel in current regulatory domain.
+  * @NL80211_FREQUENCY_ATTR_16MHZ: 16 MHz operation is allowed
+  *	on this channel in current regulatory domain.
+- * @NL80211_FREQUENCY_ATTR_NO_320MHZ: any 320 MHz channel using this channel
+- *	as the primary or any of the secondary channels isn't possible
+- * @NL80211_FREQUENCY_ATTR_NO_EHT: EHT operation is not allowed on this channel
+- *	in current regulatory domain.
+  * @NL80211_FREQUENCY_ATTR_MAX: highest frequency attribute number
+  *	currently defined
+  * @__NL80211_FREQUENCY_ATTR_AFTER_LAST: internal use
+@@ -4047,8 +3919,6 @@ enum nl80211_frequency_attr {
+ 	NL80211_FREQUENCY_ATTR_4MHZ,
+ 	NL80211_FREQUENCY_ATTR_8MHZ,
+ 	NL80211_FREQUENCY_ATTR_16MHZ,
+-	NL80211_FREQUENCY_ATTR_NO_320MHZ,
+-	NL80211_FREQUENCY_ATTR_NO_EHT,
+ 
+ 	/* keep last */
+ 	__NL80211_FREQUENCY_ATTR_AFTER_LAST,
+@@ -4247,7 +4117,6 @@ enum nl80211_sched_scan_match_attr {
+  * @NL80211_RRF_NO_80MHZ: 80MHz operation not allowed
+  * @NL80211_RRF_NO_160MHZ: 160MHz operation not allowed
+  * @NL80211_RRF_NO_HE: HE operation not allowed
+- * @NL80211_RRF_NO_320MHZ: 320MHz operation not allowed
+  */
+ enum nl80211_reg_rule_flags {
+ 	NL80211_RRF_NO_OFDM		= 1<<0,
+@@ -4266,7 +4135,6 @@ enum nl80211_reg_rule_flags {
+ 	NL80211_RRF_NO_80MHZ		= 1<<15,
+ 	NL80211_RRF_NO_160MHZ		= 1<<16,
+ 	NL80211_RRF_NO_HE		= 1<<17,
+-	NL80211_RRF_NO_320MHZ		= 1<<18,
+ };
+ 
+ #define NL80211_RRF_PASSIVE_SCAN	NL80211_RRF_NO_IR
+@@ -4764,8 +4632,6 @@ enum nl80211_key_mode {
+  * @NL80211_CHAN_WIDTH_4: 4 MHz OFDM channel
+  * @NL80211_CHAN_WIDTH_8: 8 MHz OFDM channel
+  * @NL80211_CHAN_WIDTH_16: 16 MHz OFDM channel
+- * @NL80211_CHAN_WIDTH_320: 320 MHz channel, the %NL80211_ATTR_CENTER_FREQ1
+- *	attribute must be provided as well
+  */
+ enum nl80211_chan_width {
+ 	NL80211_CHAN_WIDTH_20_NOHT,
+@@ -4781,7 +4647,6 @@ enum nl80211_chan_width {
+ 	NL80211_CHAN_WIDTH_4,
+ 	NL80211_CHAN_WIDTH_8,
+ 	NL80211_CHAN_WIDTH_16,
+-	NL80211_CHAN_WIDTH_320,
+ };
+ 
+ /**
+@@ -5096,7 +4961,6 @@ enum nl80211_txrate_gi {
+  * @NL80211_BAND_60GHZ: around 60 GHz band (58.32 - 69.12 GHz)
+  * @NL80211_BAND_6GHZ: around 6 GHz band (5.9 - 7.2 GHz)
+  * @NL80211_BAND_S1GHZ: around 900MHz, supported by S1G PHYs
+- * @NL80211_BAND_LC: light communication band (placeholder)
+  * @NUM_NL80211_BANDS: number of bands, avoid using this in userspace
+  *	since newer kernel versions may support more bands
+  */
+@@ -5106,7 +4970,6 @@ enum nl80211_band {
+ 	NL80211_BAND_60GHZ,
+ 	NL80211_BAND_6GHZ,
+ 	NL80211_BAND_S1GHZ,
+-	NL80211_BAND_LC,
+ 
+ 	NUM_NL80211_BANDS,
+ };
+@@ -5673,7 +5536,7 @@ enum nl80211_iface_limit_attrs {
+  *	=> allows 8 of AP/GO that can have BI gcd >= min gcd
+  *
+  *	numbers = [ #{STA} <= 2 ], channels = 2, max = 2
+- *	=> allows two STAs on the same or on different channels
++ *	=> allows two STAs on different channels
+  *
+  *	numbers = [ #{STA} <= 1, #{P2P-client,P2P-GO} <= 3 ], max = 4
+  *	=> allows a STA plus three P2P interfaces
+@@ -5718,7 +5581,7 @@ enum nl80211_if_combination_attrs {
+  * @NL80211_PLINK_ESTAB: mesh peer link is established
+  * @NL80211_PLINK_HOLDING: mesh peer link is being closed or cancelled
+  * @NL80211_PLINK_BLOCKED: all frames transmitted from this mesh
+- *	plink are discarded, except for authentication frames
++ *	plink are discarded
+  * @NUM_NL80211_PLINK_STATES: number of peer link states
+  * @MAX_NL80211_PLINK_STATES: highest numerical value of plink states
+  */
+@@ -5855,15 +5718,13 @@ enum nl80211_tdls_operation {
+ 	NL80211_TDLS_DISABLE_LINK,
+ };
+ 
+-/**
++/*
+  * enum nl80211_ap_sme_features - device-integrated AP features
+- * @NL80211_AP_SME_SA_QUERY_OFFLOAD: SA Query procedures offloaded to driver
+- *	when user space indicates support for SA Query procedures offload during
+- *	"start ap" with %NL80211_AP_SETTINGS_SA_QUERY_OFFLOAD_SUPPORT.
+- */
++ * Reserved for future use, no bits are defined in
++ * NL80211_ATTR_DEVICE_AP_SME yet.
+ enum nl80211_ap_sme_features {
+-	NL80211_AP_SME_SA_QUERY_OFFLOAD		= 1 << 0,
  };
-+
-+/**
-+ * enum nl80211_sae_pwe_mechanism - The mechanism(s) allowed for SAE PWE
-+ *	derivation. Applicable only when WPA3-Personal SAE authentication is
-+ *	used.
-+ *
-+ * @NL80211_SAE_PWE_UNSPECIFIED: not specified, used internally to indicate that
-+ *	attribute is not present from userspace.
-+ * @NL80211_SAE_PWE_HUNT_AND_PECK: hunting-and-pecking loop only
-+ * @NL80211_SAE_PWE_HASH_TO_ELEMENT: hash-to-element only
-+ * @NL80211_SAE_PWE_BOTH: both hunting-and-pecking loop and hash-to-element
-+ *	can be used.
 + */
-+enum nl80211_sae_pwe_mechanism {
-+	NL80211_SAE_PWE_UNSPECIFIED,
-+	NL80211_SAE_PWE_HUNT_AND_PECK,
-+	NL80211_SAE_PWE_HASH_TO_ELEMENT,
-+	NL80211_SAE_PWE_BOTH,
-+};
-+
-+/**
-+ * enum nl80211_sar_type - type of SAR specs
-+ *
-+ * @NL80211_SAR_TYPE_POWER: power limitation specified in 0.25dBm unit
-+ *
-+ */
-+enum nl80211_sar_type {
-+	NL80211_SAR_TYPE_POWER,
-+
-+	/* add new type here */
-+
-+	/* Keep last */
-+	NUM_NL80211_SAR_TYPE,
-+};
-+
-+/**
-+ * enum nl80211_sar_attrs - Attributes for SAR spec
-+ *
-+ * @NL80211_SAR_ATTR_TYPE: the SAR type as defined in &enum nl80211_sar_type.
-+ *
-+ * @NL80211_SAR_ATTR_SPECS: Nested array of SAR power
-+ *	limit specifications. Each specification contains a set
-+ *	of %nl80211_sar_specs_attrs.
-+ *
-+ *	For SET operation, it contains array of %NL80211_SAR_ATTR_SPECS_POWER
-+ *	and %NL80211_SAR_ATTR_SPECS_RANGE_INDEX.
-+ *
-+ *	For sar_capa dump, it contains array of
-+ *	%NL80211_SAR_ATTR_SPECS_START_FREQ
-+ *	and %NL80211_SAR_ATTR_SPECS_END_FREQ.
-+ *
-+ * @__NL80211_SAR_ATTR_LAST: Internal
-+ * @NL80211_SAR_ATTR_MAX: highest sar attribute
-+ *
-+ * These attributes are used with %NL80211_CMD_SET_SAR_SPEC
-+ */
-+enum nl80211_sar_attrs {
-+	__NL80211_SAR_ATTR_INVALID,
-+
-+	NL80211_SAR_ATTR_TYPE,
-+	NL80211_SAR_ATTR_SPECS,
-+
-+	__NL80211_SAR_ATTR_LAST,
-+	NL80211_SAR_ATTR_MAX = __NL80211_SAR_ATTR_LAST - 1,
-+};
-+
-+/**
-+ * enum nl80211_sar_specs_attrs - Attributes for SAR power limit specs
-+ *
-+ * @NL80211_SAR_ATTR_SPECS_POWER: Required (s32)value to specify the actual
-+ *	power limit value in units of 0.25 dBm if type is
-+ *	NL80211_SAR_TYPE_POWER. (i.e., a value of 44 represents 11 dBm).
-+ *	0 means userspace doesn't have SAR limitation on this associated range.
-+ *
-+ * @NL80211_SAR_ATTR_SPECS_RANGE_INDEX: Required (u32) value to specify the
-+ *	index of exported freq range table and the associated power limitation
-+ *	is applied to this range.
-+ *
-+ *	Userspace isn't required to set all the ranges advertised by WLAN driver,
-+ *	and userspace can skip some certain ranges. These skipped ranges don't
-+ *	have SAR limitations, and they are same as setting the
-+ *	%NL80211_SAR_ATTR_SPECS_POWER to any unreasonable high value because any
-+ *	value higher than regulatory allowed value just means SAR power
-+ *	limitation is removed, but it's required to set at least one range.
-+ *	It's not allowed to set duplicated range in one SET operation.
-+ *
-+ *	Every SET operation overwrites previous SET operation.
-+ *
-+ * @NL80211_SAR_ATTR_SPECS_START_FREQ: Required (u32) value to specify the start
-+ *	frequency of this range edge when registering SAR capability to wiphy.
-+ *	It's not a channel center frequency. The unit is kHz.
-+ *
-+ * @NL80211_SAR_ATTR_SPECS_END_FREQ: Required (u32) value to specify the end
-+ *	frequency of this range edge when registering SAR capability to wiphy.
-+ *	It's not a channel center frequency. The unit is kHz.
-+ *
-+ * @__NL80211_SAR_ATTR_SPECS_LAST: Internal
-+ * @NL80211_SAR_ATTR_SPECS_MAX: highest sar specs attribute
-+ */
-+enum nl80211_sar_specs_attrs {
-+	__NL80211_SAR_ATTR_SPECS_INVALID,
-+
-+	NL80211_SAR_ATTR_SPECS_POWER,
-+	NL80211_SAR_ATTR_SPECS_RANGE_INDEX,
-+	NL80211_SAR_ATTR_SPECS_START_FREQ,
-+	NL80211_SAR_ATTR_SPECS_END_FREQ,
-+
-+	__NL80211_SAR_ATTR_SPECS_LAST,
-+	NL80211_SAR_ATTR_SPECS_MAX = __NL80211_SAR_ATTR_SPECS_LAST - 1,
-+};
-+
+ 
+ /**
+  * enum nl80211_feature_flags - device/driver features
+@@ -6166,11 +6027,6 @@ enum nl80211_feature_flags {
+  * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
+  *	detection and change announcemnts.
+  *
+- * @NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD: Driver running in AP mode supports
+- *	FILS encryption and decryption for (Re)Association Request and Response
+- *	frames. Userspace has to share FILS AAD details to the driver by using
+- *	@NL80211_CMD_SET_FILS_AAD.
+- *
+  * @NL80211_EXT_FEATURE_RADAR_BACKGROUND: Device supports background radar/CAC
+  *	detection.
+  *
+@@ -6239,7 +6095,6 @@ enum nl80211_ext_feature_index {
+ 	NL80211_EXT_FEATURE_SECURE_RTT,
+ 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
+ 	NL80211_EXT_FEATURE_BSS_COLOR,
+-	NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD,
+ 	NL80211_EXT_FEATURE_RADAR_BACKGROUND,
+ 
+ 	/* add new features before the definition below */
+@@ -7548,7 +7403,7 @@ enum nl80211_sar_specs_attrs {
+  * @NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY: Used by the kernel
+  *	to advertise the maximum profile periodicity supported by the driver
+  *	if EMA is enabled. Driver should indicate EMA support to the userspace
+- *	by setting wiphy->ema_max_profile_periodicity to
++ *	by setting wiphy->mbssid_max_ema_profile_periodicity to
+  *	a non-zero value.
+  *
+  * @NL80211_MBSSID_CONFIG_ATTR_INDEX: Mandatory parameter to pass the index of
+@@ -7567,7 +7422,7 @@ enum nl80211_sar_specs_attrs {
+  *
+  * @NL80211_MBSSID_CONFIG_ATTR_EMA: Flag used to enable EMA AP feature.
+  *	Setting this flag is permitted only if the driver advertises EMA support
+- *	by setting wiphy->ema_max_profile_periodicity to non-zero.
++ *	by setting wiphy->mbssid_max_ema_profile_periodicity to non-zero.
+  *
+  * @__NL80211_MBSSID_CONFIG_ATTR_LAST: Internal
+  * @NL80211_MBSSID_CONFIG_ATTR_MAX: highest attribute
+@@ -7586,20 +7441,4 @@ enum nl80211_mbssid_config_attributes {
+ 	NL80211_MBSSID_CONFIG_ATTR_MAX = __NL80211_MBSSID_CONFIG_ATTR_LAST - 1,
+ };
+ 
+-/**
+- * enum nl80211_ap_settings_flags - AP settings flags
+- *
+- * @NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT: AP supports external
+- *	authentication.
+- * @NL80211_AP_SETTINGS_SA_QUERY_OFFLOAD_SUPPORT: Userspace supports SA Query
+- *	procedures offload to driver. If driver advertises
+- *	%NL80211_AP_SME_SA_QUERY_OFFLOAD in AP SME features, userspace shall
+- *	ignore SA Query procedures and validations when this flag is set by
+- *	userspace.
+- */
+-enum nl80211_ap_settings_flags {
+-	NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT	= 1 << 0,
+-	NL80211_AP_SETTINGS_SA_QUERY_OFFLOAD_SUPPORT	= 1 << 1,
+-};
+-
  #endif /* __LINUX_NL80211_H */
+--- a/event.c
++++ b/event.c
+@@ -1292,9 +1292,6 @@ static int print_event(struct nl_msg *ms
+ 	case NL80211_CMD_CH_SWITCH_NOTIFY:
+ 		parse_ch_switch_notify(tb, gnlh->cmd);
+ 		break;
+-	case NL80211_CMD_ASSOC_COMEBACK: /* 147 */
+-		parse_assoc_comeback(tb, gnlh->cmd);
+-		break;
+ 	default:
+ 		printf("unknown event %d (%s)\n",
+ 		       gnlh->cmd, command_name(gnlh->cmd));
+--- a/info.c
++++ b/info.c
+@@ -164,7 +164,6 @@ static void ext_feat_print(enum nl80211_
+ 	ext_feat_case(PROT_RANGE_NEGO_AND_MEASURE,
+ 		      "support for MFP in range measurement negotiation/procedure");
+ 	ext_feat_case(BSS_COLOR, "BSS coloring support");
+-	ext_feat_case(FILS_CRYPTO_OFFLOAD, "FILS crypto offload");
+ 	ext_feat_case(RADAR_BACKGROUND, "Radar background support");
+ 	}
+ }
+--- a/interface.c
++++ b/interface.c
+@@ -362,8 +362,6 @@ char *channel_width_name(enum nl80211_ch
+ 		return "5 MHz";
+ 	case NL80211_CHAN_WIDTH_10:
+ 		return "10 MHz";
+-	case NL80211_CHAN_WIDTH_320:
+-		return "320 MHz";
+ 	default:
+ 		return "unknown";
+ 	}
+--- a/util.c
++++ b/util.c
+@@ -508,7 +508,6 @@ static int parse_freqs(struct chandef *c
+ 	case NL80211_CHAN_WIDTH_40:
+ 	case NL80211_CHAN_WIDTH_80:
+ 	case NL80211_CHAN_WIDTH_160:
+-	case NL80211_CHAN_WIDTH_320:
+ 		need_cf1 = true;
+ 		break;
+ 	case NL80211_CHAN_WIDTH_1:
+@@ -626,10 +625,6 @@ int parse_freqchan(struct chandef *chand
+ 		  .width = NL80211_CHAN_WIDTH_160,
+ 		  .freq1_diff = 0,
+ 		  .chantype = -1 },
+-		{ .name = "320MHz",
+-		  .width = NL80211_CHAN_WIDTH_320,
+-		  .freq1_diff = 0,
+-		  .chantype = -1 },
+ 	};
+ 	const struct chanmode *chanmode_selected = NULL;
+ 	unsigned int freq;
+@@ -1599,48 +1594,6 @@ void print_eht_info(struct nlattr *nl_if
+ 	print_iftype_line(tb[NL80211_BAND_IFTYPE_ATTR_IFTYPES]);
+ 	printf("\n");
+ 
+-	if (tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC]) {
+-		len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC]);
+-		if (len > sizeof(mac_cap))
+-			len = sizeof(mac_cap);
+-		memcpy(mac_cap,
+-		       nla_data(tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC]),
+-		       len);
+-	}
+-
+-	if (tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY]) {
+-		len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY]);
+-
+-		if (len > sizeof(phy_cap))
+-			len = sizeof(phy_cap);
+-
+-		memcpy(phy_cap,
+-		       nla_data(tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY]),
+-		       len);
+-	}
+-
+-	if (tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET]) {
+-		len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET]);
+-		if (len > sizeof(mcs_set))
+-			len = sizeof(mcs_set);
+-		memcpy(mcs_set,
+-		       nla_data(tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET]),
+-		       len);
+-
+-		// Assume that all parts of the MCS set are present
+-		mcs_len = sizeof(mcs_set);
+-	}
+-
+-	if (tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE]) {
+-		len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE]);
+-		if (len > sizeof(ppet))
+-			len = sizeof(ppet);
+-		memcpy(ppet,
+-		       nla_data(tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE]),
+-		       len);
+-		ppet_len = len;
+-	}
+-
+ 	if (tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY]) {
+ 		len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY]);
+ 
+--- a/reg.c
++++ b/reg.c
+@@ -210,7 +210,6 @@ static int print_reg_handler(struct nl_m
+ 		PARSE_FLAG(NL80211_RRF_NO_80MHZ, "NO-80MHZ");
+ 		PARSE_FLAG(NL80211_RRF_NO_160MHZ, "NO-160MHZ");
+ 		PARSE_FLAG(NL80211_RRF_NO_HE, "NO-HE");
+-		PARSE_FLAG(NL80211_RRF_NO_320MHZ, "NO-320MHZ");
+ 
+ 		/* Kernels that support NO_IR always turn on both flags */
+ 		if ((flags & NL80211_RRF_NO_IR) && (flags & __NL80211_RRF_NO_IBSS)) {
+--- a/station.c
++++ b/station.c
+@@ -239,8 +239,6 @@ void parse_bitrate(struct nlattr *bitrat
+ 		pos += snprintf(pos, buflen - (pos - buf), " 80P80MHz");
+ 	if (rinfo[NL80211_RATE_INFO_160_MHZ_WIDTH])
+ 		pos += snprintf(pos, buflen - (pos - buf), " 160MHz");
+-	if (rinfo[NL80211_RATE_INFO_320_MHZ_WIDTH])
+-		pos += snprintf(pos, buflen - (pos - buf), " 320MHz");
+ 	if (rinfo[NL80211_RATE_INFO_SHORT_GI])
+ 		pos += snprintf(pos, buflen - (pos - buf), " short GI");
+ 	if (rinfo[NL80211_RATE_INFO_VHT_NSS])
+@@ -261,18 +259,6 @@ void parse_bitrate(struct nlattr *bitrat
+ 	if (rinfo[NL80211_RATE_INFO_HE_RU_ALLOC])
+ 		pos += snprintf(pos, buflen - (pos - buf),
+ 				" HE-RU-ALLOC %d", nla_get_u8(rinfo[NL80211_RATE_INFO_HE_RU_ALLOC]));
+-	if (rinfo[NL80211_RATE_INFO_EHT_MCS])
+-		pos += snprintf(pos, buflen - (pos - buf),
+-				" EHT-MCS %d", nla_get_u8(rinfo[NL80211_RATE_INFO_EHT_MCS]));
+-	if (rinfo[NL80211_RATE_INFO_EHT_NSS])
+-		pos += snprintf(pos, buflen - (pos - buf),
+-				" EHT-NSS %d", nla_get_u8(rinfo[NL80211_RATE_INFO_EHT_NSS]));
+-	if (rinfo[NL80211_RATE_INFO_EHT_GI])
+-		pos += snprintf(pos, buflen - (pos - buf),
+-				" EHT-GI %d", nla_get_u8(rinfo[NL80211_RATE_INFO_EHT_GI]));
+-	if (rinfo[NL80211_RATE_INFO_EHT_RU_ALLOC])
+-		pos += snprintf(pos, buflen - (pos - buf),
+-				" EHT-RU-ALLOC %d", nla_get_u8(rinfo[NL80211_RATE_INFO_EHT_RU_ALLOC]));
+ }
+ 
+ static char *get_chain_signal(struct nlattr *attr_list)
diff --git a/package/network/utils/iw/patches/010-Revert-iw-allow-specifying-CFLAGS-LIBS-externally.patch b/package/network/utils/iw/patches/010-Revert-iw-allow-specifying-CFLAGS-LIBS-externally.patch
new file mode 100644
index 0000000000..1254efa9c7
--- /dev/null
+++ b/package/network/utils/iw/patches/010-Revert-iw-allow-specifying-CFLAGS-LIBS-externally.patch
@@ -0,0 +1,68 @@
+From 1f3706d10812d70adefe32fe0d7d3a3ec25374f0 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Sun, 21 Nov 2021 00:02:57 +0100
+Subject: Revert "iw: allow specifying CFLAGS/LIBS externally"
+
+This reverts commit 1325244b77d56fd7a16d1e35fdae0efc151920b1.
+
+The OpenWrt build system provides the CFLAGS and LIBS names from the 
+package Makefile to overwrite them for libnl-tiny. This is not possible 
+after this upstream change which we revert here any more
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+---
+ Makefile | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -45,30 +45,30 @@ NLLIBNAME = libnl-1
+ endif
+ 
+ ifeq ($(NL2FOUND),Y)
+-override CFLAGS += -DCONFIG_LIBNL20
+-override LIBS += -lnl-genl
++CFLAGS += -DCONFIG_LIBNL20
++LIBS += -lnl-genl
+ NLLIBNAME = libnl-2.0
+ endif
+ 
+ ifeq ($(NL3xFOUND),Y)
+ # libnl 3.2 might be found as 3.2 and 3.0
+ NL3FOUND = N
+-override CFLAGS += -DCONFIG_LIBNL30
+-override LIBS += -lnl-genl-3
++CFLAGS += -DCONFIG_LIBNL30
++LIBS += -lnl-genl-3
+ NLLIBNAME = libnl-3.0
+ endif
+ 
+ ifeq ($(NL3FOUND),Y)
+-override CFLAGS += -DCONFIG_LIBNL30
+-override LIBS += -lnl-genl
++CFLAGS += -DCONFIG_LIBNL30
++LIBS += -lnl-genl
+ NLLIBNAME = libnl-3.0
+ endif
+ 
+ # nl-3.1 has a broken libnl-gnl-3.1.pc file
+ # as show by pkg-config --debug --libs --cflags --exact-version=3.1 libnl-genl-3.1;echo $?
+ ifeq ($(NL31FOUND),Y)
+-override CFLAGS += -DCONFIG_LIBNL30
+-override LIBS += -lnl-genl
++CFLAGS += -DCONFIG_LIBNL30
++LIBS += -lnl-genl
+ NLLIBNAME = libnl-3.1
+ endif
+ 
+@@ -76,8 +76,8 @@ ifeq ($(NLLIBNAME),)
+ $(error Cannot find development files for any supported version of libnl)
+ endif
+ 
+-override LIBS += $(shell $(PKG_CONFIG) --libs $(NLLIBNAME))
+-override CFLAGS += $(shell $(PKG_CONFIG) --cflags $(NLLIBNAME))
++LIBS += $(shell $(PKG_CONFIG) --libs $(NLLIBNAME))
++CFLAGS += $(shell $(PKG_CONFIG) --cflags $(NLLIBNAME))
+ endif # NO_PKG_CONFIG
+ 
+ ifeq ($(V),1)
diff --git a/package/network/utils/iw/patches/200-reduce_size.patch b/package/network/utils/iw/patches/200-reduce_size.patch
index c50a4a4d38..88df56b385 100644
--- a/package/network/utils/iw/patches/200-reduce_size.patch
+++ b/package/network/utils/iw/patches/200-reduce_size.patch
@@ -1,6 +1,6 @@
 --- a/event.c
 +++ b/event.c
-@@ -956,6 +956,7 @@ static int print_event(struct nl_msg *ms
+@@ -971,6 +971,7 @@ static int print_event(struct nl_msg *ms
  	}
  
  	switch (gnlh->cmd) {
@@ -8,7 +8,7 @@
  	case NL80211_CMD_NEW_WIPHY:
  		printf("renamed to %s\n", nla_get_string(tb[NL80211_ATTR_WIPHY_NAME]));
  		break;
-@@ -991,6 +992,7 @@ static int print_event(struct nl_msg *ms
+@@ -1006,6 +1007,7 @@ static int print_event(struct nl_msg *ms
  	case NL80211_CMD_SCHED_SCAN_RESULTS:
  		printf("got scheduled scan results\n");
  		break;
@@ -16,7 +16,7 @@
  	case NL80211_CMD_WIPHY_REG_CHANGE:
  	case NL80211_CMD_REG_CHANGE:
  		if (gnlh->cmd == NL80211_CMD_WIPHY_REG_CHANGE)
-@@ -1073,6 +1075,7 @@ static int print_event(struct nl_msg *ms
+@@ -1088,6 +1090,7 @@ static int print_event(struct nl_msg *ms
  		mac_addr_n2a(macbuf, nla_data(tb[NL80211_ATTR_MAC]));
  		printf("del station %s\n", macbuf);
  		break;
@@ -24,7 +24,7 @@
  	case NL80211_CMD_JOIN_IBSS:
  		mac_addr_n2a(macbuf, nla_data(tb[NL80211_ATTR_MAC]));
  		printf("IBSS %s joined\n", macbuf);
-@@ -1271,9 +1274,9 @@ static int print_event(struct nl_msg *ms
+@@ -1292,9 +1295,9 @@ static int print_event(struct nl_msg *ms
  	case NL80211_CMD_CH_SWITCH_NOTIFY:
  		parse_ch_switch_notify(tb, gnlh->cmd);
  		break;
@@ -38,7 +38,7 @@
  
 --- a/info.c
 +++ b/info.c
-@@ -216,6 +216,7 @@ next:
+@@ -308,6 +308,7 @@ next:
  				}
  			}
  
@@ -46,7 +46,7 @@
  			if (tb_band[NL80211_BAND_ATTR_RATES]) {
  			printf("\t\tBitrates (non-HT):\n");
  			nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) {
-@@ -232,6 +233,7 @@ next:
+@@ -324,6 +325,7 @@ next:
  				printf("\n");
  			}
  			}
@@ -54,7 +54,7 @@
  		}
  	}
  
-@@ -297,6 +299,7 @@ next:
+@@ -389,6 +391,7 @@ next:
  		printf("\tCoverage class: %d (up to %dm)\n", coverage, 450 * coverage);
  	}
  
@@ -62,7 +62,7 @@
  	if (tb_msg[NL80211_ATTR_CIPHER_SUITES]) {
  		int num = nla_len(tb_msg[NL80211_ATTR_CIPHER_SUITES]) / sizeof(__u32);
  		int i;
-@@ -308,6 +311,7 @@ next:
+@@ -400,6 +403,7 @@ next:
  					cipher_name(ciphers[i]));
  		}
  	}
@@ -70,21 +70,19 @@
  
  	if (tb_msg[NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX] &&
  	    tb_msg[NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX])
-@@ -327,11 +331,13 @@ next:
- 			printf("\t\t * %s\n", iftype_name(nla_type(nl_mode)));
- 	}
+@@ -417,9 +421,11 @@ next:
+ 		print_iftype_list("\tSupported interface modes", "\t\t",
+ 				  tb_msg[NL80211_ATTR_SUPPORTED_IFTYPES]);
  
 +#ifdef IW_FULL
- 	if (tb_msg[NL80211_ATTR_SOFTWARE_IFTYPES]) {
- 		printf("\tsoftware interface modes (can always be added):\n");
- 		nla_for_each_nested(nl_mode, tb_msg[NL80211_ATTR_SOFTWARE_IFTYPES], rem_mode)
- 			printf("\t\t * %s\n", iftype_name(nla_type(nl_mode)));
- 	}
+ 	if (tb_msg[NL80211_ATTR_SOFTWARE_IFTYPES])
+ 		print_iftype_list("\tsoftware interface modes (can always be added)",
+ 				  "\t\t", tb_msg[NL80211_ATTR_SOFTWARE_IFTYPES]);
 +#endif
  
  	if (tb_msg[NL80211_ATTR_INTERFACE_COMBINATIONS]) {
  		struct nlattr *nl_combi;
-@@ -428,6 +434,7 @@ broken_combination:
+@@ -509,6 +515,7 @@ broken_combination:
  			printf("\tinterface combinations are not supported\n");
  	}
  
@@ -92,7 +90,7 @@
  	if (tb_msg[NL80211_ATTR_SUPPORTED_COMMANDS]) {
  		printf("\tSupported commands:\n");
  		nla_for_each_nested(nl_cmd, tb_msg[NL80211_ATTR_SUPPORTED_COMMANDS], rem_cmd)
-@@ -525,6 +532,7 @@ broken_combination:
+@@ -606,6 +613,7 @@ broken_combination:
  				printf("\t\t * wake up on TCP connection\n");
  		}
  	}
@@ -100,7 +98,7 @@
  
  	if (tb_msg[NL80211_ATTR_ROAM_SUPPORT])
  		printf("\tDevice supports roaming.\n");
-@@ -563,6 +571,7 @@ broken_combination:
+@@ -644,6 +652,7 @@ broken_combination:
  		}
  	}
  
@@ -108,7 +106,7 @@
  	if (tb_msg[NL80211_ATTR_FEATURE_FLAGS]) {
  		unsigned int features = nla_get_u32(tb_msg[NL80211_ATTR_FEATURE_FLAGS]);
  
-@@ -627,6 +636,7 @@ broken_combination:
+@@ -708,6 +717,7 @@ broken_combination:
  		if (features & NL80211_FEATURE_ND_RANDOM_MAC_ADDR)
  			printf("\tDevice supports randomizing MAC-addr in net-detect scans.\n");
  	}
@@ -116,7 +114,7 @@
  
  	if (tb_msg[NL80211_ATTR_TDLS_SUPPORT])
  		printf("\tDevice supports T-DLS.\n");
-@@ -762,6 +772,7 @@ TOPLEVEL(list, NULL, NL80211_CMD_GET_WIP
+@@ -773,6 +783,7 @@ TOPLEVEL(list, NULL, NL80211_CMD_GET_WIP
  	 "List all wireless devices and their capabilities.");
  TOPLEVEL(phy, NULL, NL80211_CMD_GET_WIPHY, NLM_F_DUMP, CIB_NONE, handle_info, NULL);
  
@@ -124,7 +122,7 @@
  static int handle_commands(struct nl80211_state *state, struct nl_msg *msg,
  			   int argc, char **argv, enum id_input id)
  {
-@@ -773,6 +784,7 @@ static int handle_commands(struct nl8021
+@@ -784,6 +795,7 @@ static int handle_commands(struct nl8021
  }
  TOPLEVEL(commands, NULL, NL80211_CMD_GET_WIPHY, 0, CIB_NONE, handle_commands,
  	 "list all known commands and their decimal & hex value");
diff --git a/package/network/utils/iwinfo/Makefile b/package/network/utils/iwinfo/Makefile
index 25cc210acb..4735181712 100644
--- a/package/network/utils/iwinfo/Makefile
+++ b/package/network/utils/iwinfo/Makefile
@@ -11,9 +11,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/iwinfo.git
-PKG_SOURCE_DATE:=2022-04-26
-PKG_SOURCE_VERSION:=dc6847eb5ec8747867bc20f1024723c6397c1df7
-PKG_MIRROR_HASH:=3f243cf75f4cec02e9e8ecc2087577146845346c0172808f64dea066f84f88d4
+PKG_SOURCE_DATE:=2022-08-19
+PKG_SOURCE_VERSION:=0dad3e6660594592071ae49a77a907e2b11a98fe
+PKG_MIRROR_HASH:=2162ee3158328ffe39018e50f34d74b47a6c7a26460e30d7984ca16cbc859d80
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=GPL-2.0
 
diff --git a/target/linux/ath79/dts/ar9342_ubnt_wa.dtsi b/target/linux/ath79/dts/ar9342_ubnt_wa.dtsi
index ac036ccd85..fa36e37768 100644
--- a/target/linux/ath79/dts/ar9342_ubnt_wa.dtsi
+++ b/target/linux/ath79/dts/ar9342_ubnt_wa.dtsi
@@ -78,6 +78,6 @@
 &wmac {
 	status = "okay";
 
-	qca,disable-5ghz;
+	ieee80211-freq-limit = <2402000 2482000>;
 	mtd-cal-data = <&art 0x1000>;
 };
diff --git a/target/linux/ath79/dts/ar9344_engenius_exx600.dtsi b/target/linux/ath79/dts/ar9344_engenius_exx600.dtsi
index 1c318f2083..09dc5806d7 100644
--- a/target/linux/ath79/dts/ar9344_engenius_exx600.dtsi
+++ b/target/linux/ath79/dts/ar9344_engenius_exx600.dtsi
@@ -69,7 +69,7 @@
 	ath9k: wifi@0,0,0 {
 		compatible = "pci168c,0030";
 		reg = <0x0 0 0 0 0>;
-		qca,disable-5ghz;
+		ieee80211-freq-limit = <2402000 2482000>;
 		qca,no-eeprom;
 		#gpio-cells = <2>;
 		gpio-controller;
@@ -79,7 +79,7 @@
 &wmac {
 	status = "okay";
 
-	qca,disable-2ghz;
+	ieee80211-freq-limit = <4900000 5990000>;
 
 	mtd-cal-data = <&art 0x1000>;
 };
diff --git a/target/linux/ath79/dts/ar9344_pcs_cap324.dts b/target/linux/ath79/dts/ar9344_pcs_cap324.dts
index 3ce8bb58fc..07d344cac5 100644
--- a/target/linux/ath79/dts/ar9344_pcs_cap324.dts
+++ b/target/linux/ath79/dts/ar9344_pcs_cap324.dts
@@ -122,7 +122,7 @@
 		mtd-mac-address-increment = <(-2)>;
 		mtd-cal-data = <&art 0x5000>;
 		qca,no-eeprom;
-		qca,disable-5ghz;
+		ieee80211-freq-limit = <2402000 2482000>;
 		#gpio-cells = <2>;
 		gpio-controller;
 	};
@@ -131,7 +131,7 @@
 &wmac {
 	status = "okay";
 
-	qca,disable-2ghz;
+	ieee80211-freq-limit = <4900000 5990000>;
 	mtd-cal-data = <&art 0x1000>;
 	mtd-mac-address = <&art 0x0>;
 	mtd-mac-address-increment = <(-1)>;
diff --git a/target/linux/generic/files/include/linux/soc/mediatek/mtk_wed.h b/target/linux/generic/files/include/linux/soc/mediatek/mtk_wed.h
new file mode 100644
index 0000000000..0a7197f55a
--- /dev/null
+++ b/target/linux/generic/files/include/linux/soc/mediatek/mtk_wed.h
@@ -0,0 +1,68 @@
+#ifndef __MTK_WED_H
+#define __MTK_WED_H
+
+#include <linux/kernel.h>
+#include <linux/rcupdate.h>
+#include <linux/regmap.h>
+#include <linux/pci.h>
+
+#define MTK_WED_TX_QUEUES		2
+
+struct mtk_wed_hw;
+struct mtk_wdma_desc;
+
+struct mtk_wed_ring {
+	struct mtk_wdma_desc *desc;
+	dma_addr_t desc_phys;
+	int size;
+
+	u32 reg_base;
+	void __iomem *wpdma;
+};
+
+struct mtk_wed_device {
+};
+
+struct mtk_wed_ops {
+	int (*attach)(struct mtk_wed_device *dev);
+	int (*tx_ring_setup)(struct mtk_wed_device *dev, int ring,
+			     void __iomem *regs);
+	int (*txfree_ring_setup)(struct mtk_wed_device *dev,
+				 void __iomem *regs);
+	void (*detach)(struct mtk_wed_device *dev);
+
+	void (*stop)(struct mtk_wed_device *dev);
+	void (*start)(struct mtk_wed_device *dev, u32 irq_mask);
+	void (*reset_dma)(struct mtk_wed_device *dev);
+
+	u32 (*reg_read)(struct mtk_wed_device *dev, u32 reg);
+	void (*reg_write)(struct mtk_wed_device *dev, u32 reg, u32 val);
+
+	u32 (*irq_get)(struct mtk_wed_device *dev, u32 mask);
+	void (*irq_set_mask)(struct mtk_wed_device *dev, u32 mask);
+};
+
+extern const struct mtk_wed_ops __rcu *mtk_soc_wed_ops;
+
+static inline int
+mtk_wed_device_attach(struct mtk_wed_device *dev)
+{
+	int ret = -ENODEV;
+
+	return ret;
+}
+
+static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
+{
+	return false;
+}
+#define mtk_wed_device_detach(_dev) do {} while (0)
+#define mtk_wed_device_start(_dev, _mask) do {} while (0)
+#define mtk_wed_device_tx_ring_setup(_dev, _ring, _regs) -ENODEV
+#define mtk_wed_device_txfree_ring_setup(_dev, _ring, _regs) -ENODEV
+#define mtk_wed_device_reg_read(_dev, _reg) 0
+#define mtk_wed_device_reg_write(_dev, _reg, _val) do {} while (0)
+#define mtk_wed_device_irq_get(_dev, _mask) 0
+#define mtk_wed_device_irq_set_mask(_dev, _mask) do {} while (0)
+
+#endif
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_bt_homehub-v5a.dts b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_bt_homehub-v5a.dts
index f817b3a41b..124f089d18 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_bt_homehub-v5a.dts
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_bt_homehub-v5a.dts
@@ -267,7 +267,7 @@
 		compatible = "pci168c,002d";
 		reg = <0x7000 0 0 0 0>;
 		qca,no-eeprom; /* load from ath9k-eeprom-pci-0000:00:0e.0.bin */
-		qca,disable-5ghz;
+		ieee80211-freq-limit = <2402000 2482000>;
 	};
 };