diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/080-resv_start_op.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/080-resv_start_op.patch
index 67ccc73..40b8e94 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/build/080-resv_start_op.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/080-resv_start_op.patch
@@ -12,7 +12,7 @@
  };
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -17232,7 +17232,9 @@ static struct genl_family nl80211_fam __
+@@ -17233,7 +17233,9 @@ static struct genl_family nl80211_fam __
  	.n_ops = ARRAY_SIZE(nl80211_ops),
  	.small_ops = nl80211_small_ops,
  	.n_small_ops = ARRAY_SIZE(nl80211_small_ops),
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/110-backport_napi_build_skb.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/110-backport_napi_build_skb.patch
index e2f6be5..1e152fe 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/build/110-backport_napi_build_skb.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/110-backport_napi_build_skb.patch
@@ -1,7 +1,7 @@
 --- a/backport-include/linux/skbuff.h
 +++ b/backport-include/linux/skbuff.h
-@@ -140,4 +140,8 @@ static inline u64 skb_get_kcov_handle(st
- }
+@@ -144,4 +144,8 @@ static inline u64 skb_get_kcov_handle(st
+ #define napi_build_skb build_skb
  #endif
  
 +#if LINUX_VERSION_IS_LESS(5,11,0)
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/110-mac80211_keep_keys_on_stop_ap.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/110-mac80211_keep_keys_on_stop_ap.patch
index 4dd26da..4d4a2a8 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/110-mac80211_keep_keys_on_stop_ap.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/110-mac80211_keep_keys_on_stop_ap.patch
@@ -9,8 +9,8 @@
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1512,7 +1512,6 @@ static int ieee80211_stop_ap(struct wiph
- 	link_conf->ftmr_params = NULL;
+@@ -1519,7 +1519,6 @@ static int ieee80211_stop_ap(struct wiph
+ 	link_conf->bssid_indicator = 0;
  
  	__sta_info_flush(sdata, true);
 -	ieee80211_free_keys(sdata, true);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/210-ap_scan.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/210-ap_scan.patch
index bfbb28c..10b842d 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/210-ap_scan.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/210-ap_scan.patch
@@ -8,7 +8,7 @@
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2720,6 +2720,8 @@ static int ieee80211_scan(struct wiphy *
+@@ -2727,6 +2727,8 @@ static int ieee80211_scan(struct wiphy *
  		 */
  		fallthrough;
  	case NL80211_IFTYPE_AP:
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
index d541b62..0ac9729 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
@@ -23,7 +23,7 @@
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -3976,7 +3976,7 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -3984,7 +3984,7 @@ struct ieee80211_txq *ieee80211_next_txq
  
  		if (deficit < 0)
  			sta->airtime[txqi->txq.ac].deficit +=
@@ -32,7 +32,7 @@
  
  		if (deficit < 0 || !aql_check) {
  			list_move_tail(&txqi->schedule_order,
-@@ -4119,7 +4119,8 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4127,7 +4127,8 @@ bool ieee80211_txq_may_transmit(struct i
  		}
  		sta = container_of(iter->txq.sta, struct sta_info, sta);
  		if (ieee80211_sta_deficit(sta, ac) < 0)
@@ -42,7 +42,7 @@
  		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
  	}
  
-@@ -4127,7 +4128,7 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4135,7 +4136,7 @@ bool ieee80211_txq_may_transmit(struct i
  	if (sta->airtime[ac].deficit >= 0)
  		goto out;
  
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-01-v6.2-wifi-mac80211-add-internal-handler-for-wake_tx_queue.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-01-v6.2-wifi-mac80211-add-internal-handler-for-wake_tx_queue.patch
index 7686983..d14ba05 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-01-v6.2-wifi-mac80211-add-internal-handler-for-wake_tx_queue.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-01-v6.2-wifi-mac80211-add-internal-handler-for-wake_tx_queue.patch
@@ -51,16 +51,7 @@
   *
   * Drivers can optionally delegate responsibility for scheduling queues to
   * mac80211, to take advantage of airtime fairness accounting. In this case, to
-@@ -1826,7 +1827,7 @@ struct ieee80211_vif_cfg {
-  *	for this interface.
-  * @drv_priv: data area for driver use, will always be aligned to
-  *	sizeof(void \*).
-- * @txq: the multicast data TX queue (if driver uses the TXQ abstraction)
-+ * @txq: the multicast data TX queue
-  * @txqs_stopped: per AC flag to indicate that intermediate TXQs are stopped,
-  *	protected by fq->lock.
-  * @offload_flags: 802.3 -> 802.11 enapsulation offload flags, see
-@@ -2252,8 +2253,8 @@ struct ieee80211_link_sta {
+@@ -2248,8 +2249,8 @@ struct ieee80211_link_sta {
   *	For non MLO STA it will point to the deflink data. For MLO STA
   *	ieee80211_sta_recalc_aggregates() must be called to update it.
   * @support_p2p_ps: indicates whether the STA supports P2P PS mechanism or not.
@@ -71,7 +62,7 @@
   * @deflink: This holds the default link STA information, for non MLO STA all link
   *	specific STA information is accessed through @deflink or through
   *	link[0] which points to address of @deflink. For MLO Link STA
-@@ -5691,7 +5692,7 @@ void ieee80211_key_replay(struct ieee802
+@@ -5687,7 +5688,7 @@ void ieee80211_key_replay(struct ieee802
   * @hw: pointer as obtained from ieee80211_alloc_hw().
   * @queue: queue number (counted from zero).
   *
@@ -80,7 +71,7 @@
   */
  void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue);
  
-@@ -5700,7 +5701,7 @@ void ieee80211_wake_queue(struct ieee802
+@@ -5696,7 +5697,7 @@ void ieee80211_wake_queue(struct ieee802
   * @hw: pointer as obtained from ieee80211_alloc_hw().
   * @queue: queue number (counted from zero).
   *
@@ -89,7 +80,7 @@
   */
  void ieee80211_stop_queue(struct ieee80211_hw *hw, int queue);
  
-@@ -5709,7 +5710,7 @@ void ieee80211_stop_queue(struct ieee802
+@@ -5705,7 +5706,7 @@ void ieee80211_stop_queue(struct ieee802
   * @hw: pointer as obtained from ieee80211_alloc_hw().
   * @queue: queue number (counted from zero).
   *
@@ -98,7 +89,7 @@
   *
   * Return: %true if the queue is stopped. %false otherwise.
   */
-@@ -5720,7 +5721,7 @@ int ieee80211_queue_stopped(struct ieee8
+@@ -5716,7 +5717,7 @@ int ieee80211_queue_stopped(struct ieee8
   * ieee80211_stop_queues - stop all queues
   * @hw: pointer as obtained from ieee80211_alloc_hw().
   *
@@ -107,7 +98,7 @@
   */
  void ieee80211_stop_queues(struct ieee80211_hw *hw);
  
-@@ -5728,7 +5729,7 @@ void ieee80211_stop_queues(struct ieee80
+@@ -5724,7 +5725,7 @@ void ieee80211_stop_queues(struct ieee80
   * ieee80211_wake_queues - wake all queues
   * @hw: pointer as obtained from ieee80211_alloc_hw().
   *
@@ -116,7 +107,7 @@
   */
  void ieee80211_wake_queues(struct ieee80211_hw *hw);
  
-@@ -6950,6 +6951,18 @@ static inline struct sk_buff *ieee80211_
+@@ -6946,6 +6947,18 @@ static inline struct sk_buff *ieee80211_
  }
  
  /**
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-02-v6.2-wifi-mac80211-add-wake_tx_queue-callback-to-drivers.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-02-v6.2-wifi-mac80211-add-wake_tx_queue-callback-to-drivers.patch
index 8e2c205..fee038d 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-02-v6.2-wifi-mac80211-add-wake_tx_queue-callback-to-drivers.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-02-v6.2-wifi-mac80211-add-wake_tx_queue-callback-to-drivers.patch
@@ -26,7 +26,7 @@
  	.add_interface		= adm8211_add_interface,
 --- a/drivers/net/wireless/ath/ar5523/ar5523.c
 +++ b/drivers/net/wireless/ath/ar5523/ar5523.c
-@@ -1355,6 +1355,7 @@ static const struct ieee80211_ops ar5523
+@@ -1361,6 +1361,7 @@ static const struct ieee80211_ops ar5523
  	.start			= ar5523_start,
  	.stop			= ar5523_stop,
  	.tx			= ar5523_tx,
@@ -36,7 +36,7 @@
  	.remove_interface	= ar5523_remove_interface,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -8539,6 +8539,7 @@ err_fallback:
+@@ -8587,6 +8587,7 @@ err_fallback:
  
  static const struct ieee80211_ops ath11k_ops = {
  	.tx				= ath11k_mac_op_tx,
@@ -126,7 +126,7 @@
  	.add_interface = brcms_ops_add_interface,
 --- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
 +++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
-@@ -3435,6 +3435,7 @@ static const struct attribute_group il39
+@@ -3439,6 +3439,7 @@ static const struct attribute_group il39
  
  static struct ieee80211_ops il3945_mac_ops __ro_after_init = {
  	.tx = il3945_mac_tx,
@@ -136,7 +136,7 @@
  	.add_interface = il_mac_add_interface,
 --- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
 +++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
-@@ -6304,6 +6304,7 @@ il4965_tx_queue_set_status(struct il_pri
+@@ -6308,6 +6308,7 @@ il4965_tx_queue_set_status(struct il_pri
  
  static const struct ieee80211_ops il4965_mac_ops = {
  	.tx = il4965_mac_tx,
@@ -306,7 +306,7 @@
  	.add_interface		= rtl8187_add_interface,
 --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
 +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -6561,6 +6561,7 @@ static void rtl8xxxu_stop(struct ieee802
+@@ -6548,6 +6548,7 @@ static void rtl8xxxu_stop(struct ieee802
  
  static const struct ieee80211_ops rtl8xxxu_ops = {
  	.tx = rtl8xxxu_tx,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-03-v6.2-wifi-mac80211-Drop-support-for-TX-push-path.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-03-v6.2-wifi-mac80211-Drop-support-for-TX-push-path.patch
index 9d58345..f9f9977 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-03-v6.2-wifi-mac80211-Drop-support-for-TX-push-path.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-03-v6.2-wifi-mac80211-Drop-support-for-TX-push-path.patch
@@ -11,7 +11,7 @@
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4339,9 +4339,6 @@ static int ieee80211_get_txq_stats(struc
+@@ -4346,9 +4346,6 @@ static int ieee80211_get_txq_stats(struc
  	struct ieee80211_sub_if_data *sdata;
  	int ret = 0;
  
@@ -48,7 +48,7 @@
  }
 --- a/net/mac80211/debugfs_sta.c
 +++ b/net/mac80211/debugfs_sta.c
-@@ -1056,10 +1056,8 @@ void ieee80211_sta_debugfs_add(struct st
+@@ -1057,10 +1057,8 @@ void ieee80211_sta_debugfs_add(struct st
  	DEBUGFS_ADD_COUNTER(rx_fragments, deflink.rx_stats.fragments);
  	DEBUGFS_ADD_COUNTER(tx_filtered, deflink.status_stats.filtered);
  
@@ -63,7 +63,7 @@
  				    NL80211_EXT_FEATURE_AQL))
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -2290,7 +2290,6 @@ void ieee80211_wake_queue_by_reason(stru
+@@ -2294,7 +2294,6 @@ void ieee80211_wake_queue_by_reason(stru
  void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
  				    enum queue_stop_reason reason,
  				    bool refcounted);
@@ -73,7 +73,7 @@
  void ieee80211_add_pending_skbs(struct ieee80211_local *local,
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -458,12 +458,6 @@ static void ieee80211_do_stop(struct iee
+@@ -460,12 +460,6 @@ static void ieee80211_do_stop(struct iee
  	if (cancel_scan)
  		ieee80211_scan_cancel(local);
  
@@ -86,7 +86,7 @@
  	ieee80211_roc_purge(local, sdata);
  
  	switch (sdata->vif.type) {
-@@ -811,13 +805,6 @@ static void ieee80211_uninit(struct net_
+@@ -813,13 +807,6 @@ static void ieee80211_uninit(struct net_
  	ieee80211_teardown_sdata(IEEE80211_DEV_TO_SUB_IF(dev));
  }
  
@@ -100,7 +100,7 @@
  static void
  ieee80211_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
  {
-@@ -831,7 +818,6 @@ static const struct net_device_ops ieee8
+@@ -833,7 +820,6 @@ static const struct net_device_ops ieee8
  	.ndo_start_xmit		= ieee80211_subif_start_xmit,
  	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
  	.ndo_set_mac_address 	= ieee80211_change_mac,
@@ -108,7 +108,7 @@
  	.ndo_get_stats64	= ieee80211_get_stats64,
  };
  
-@@ -939,7 +925,6 @@ static const struct net_device_ops ieee8
+@@ -941,7 +927,6 @@ static const struct net_device_ops ieee8
  	.ndo_start_xmit		= ieee80211_subif_start_xmit_8023,
  	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
  	.ndo_set_mac_address	= ieee80211_change_mac,
@@ -116,7 +116,7 @@
  	.ndo_get_stats64	= ieee80211_get_stats64,
  	.ndo_fill_forward_path	= ieee80211_netdev_fill_forward_path,
  };
-@@ -1441,35 +1426,6 @@ int ieee80211_do_open(struct wireless_de
+@@ -1443,35 +1428,6 @@ int ieee80211_do_open(struct wireless_de
  
  	ieee80211_recalc_ps(local);
  
@@ -152,7 +152,7 @@
  	set_bit(SDATA_STATE_RUNNING, &sdata->state);
  
  	return 0;
-@@ -1499,17 +1455,12 @@ static void ieee80211_if_setup(struct ne
+@@ -1501,17 +1457,12 @@ static void ieee80211_if_setup(struct ne
  {
  	ether_setup(dev);
  	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
@@ -171,7 +171,7 @@
  static void ieee80211_iface_process_skb(struct ieee80211_local *local,
  					struct ieee80211_sub_if_data *sdata,
  					struct sk_buff *skb)
-@@ -2094,9 +2045,7 @@ int ieee80211_if_add(struct ieee80211_lo
+@@ -2096,9 +2047,7 @@ int ieee80211_if_add(struct ieee80211_lo
  	struct net_device *ndev = NULL;
  	struct ieee80211_sub_if_data *sdata = NULL;
  	struct txq_info *txqi;
@@ -181,7 +181,7 @@
  
  	ASSERT_RTNL();
  
-@@ -2119,30 +2068,18 @@ int ieee80211_if_add(struct ieee80211_lo
+@@ -2121,30 +2070,18 @@ int ieee80211_if_add(struct ieee80211_lo
  				 sizeof(void *));
  		int txq_size = 0;
  
@@ -346,7 +346,7 @@
  free:
  	sta_info_free_link(&sta->deflink);
  #ifdef CPTCFG_MAC80211_MESH
-@@ -1959,9 +1954,6 @@ ieee80211_sta_ps_deliver_response(struct
+@@ -1960,9 +1955,6 @@ ieee80211_sta_ps_deliver_response(struct
  		 * TIM recalculation.
  		 */
  
@@ -356,7 +356,7 @@
  		for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
  			if (!sta->sta.txq[tid] ||
  			    !(driver_release_tids & BIT(tid)) ||
-@@ -2446,7 +2438,7 @@ static void sta_set_tidstats(struct sta_
+@@ -2447,7 +2439,7 @@ static void sta_set_tidstats(struct sta_
  		tidstats->tx_msdu_failed = sta->deflink.status_stats.msdu_failed[tid];
  	}
  
@@ -365,7 +365,7 @@
  		spin_lock_bh(&local->fq.lock);
  		rcu_read_lock();
  
-@@ -2774,9 +2766,6 @@ unsigned long ieee80211_sta_last_active(
+@@ -2775,9 +2767,6 @@ unsigned long ieee80211_sta_last_active(
  
  static void sta_update_codel_params(struct sta_info *sta, u32 thr)
  {
@@ -387,7 +387,7 @@
  	 * Set the WLAN_TDLS_TEARDOWN flag to indicate a teardown in progress.
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -1599,9 +1599,6 @@ int ieee80211_txq_setup_flows(struct iee
+@@ -1600,9 +1600,6 @@ int ieee80211_txq_setup_flows(struct iee
  	bool supp_vht = false;
  	enum nl80211_band band;
  
@@ -397,7 +397,7 @@
  	ret = fq_init(fq, 4096);
  	if (ret)
  		return ret;
-@@ -1649,9 +1646,6 @@ void ieee80211_txq_teardown_flows(struct
+@@ -1650,9 +1647,6 @@ void ieee80211_txq_teardown_flows(struct
  {
  	struct fq *fq = &local->fq;
  
@@ -407,7 +407,7 @@
  	kfree(local->cvars);
  	local->cvars = NULL;
  
-@@ -1668,8 +1662,7 @@ static bool ieee80211_queue_skb(struct i
+@@ -1669,8 +1663,7 @@ static bool ieee80211_queue_skb(struct i
  	struct ieee80211_vif *vif;
  	struct txq_info *txqi;
  
@@ -417,7 +417,7 @@
  		return false;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-@@ -4185,12 +4178,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4193,12 +4186,7 @@ void __ieee80211_subif_start_xmit(struct
  	if (IS_ERR(sta))
  		sta = NULL;
  
@@ -431,7 +431,7 @@
  	ieee80211_aggr_check(sdata, sta, skb);
  
  	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
-@@ -4501,11 +4489,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4509,11 +4497,7 @@ static void ieee80211_8023_xmit(struct i
  	struct tid_ampdu_tx *tid_tx;
  	u8 tid;
  
@@ -444,7 +444,7 @@
  
  	if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)) &&
  	    test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
-@@ -4759,9 +4743,6 @@ void ieee80211_tx_pending(struct tasklet
+@@ -4767,9 +4751,6 @@ void ieee80211_tx_pending(struct tasklet
  			if (!txok)
  				break;
  		}
@@ -454,7 +454,7 @@
  	}
  	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
  
-@@ -5954,10 +5935,9 @@ int ieee80211_tx_control_port(struct wip
+@@ -5962,10 +5943,9 @@ int ieee80211_tx_control_port(struct wip
  	}
  
  	if (!IS_ERR(sta)) {
@@ -468,7 +468,7 @@
  		 * for MLO STA, the SA should be the AP MLD address, but
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -446,39 +446,6 @@ void ieee80211_wake_txqs(struct tasklet_
+@@ -444,39 +444,6 @@ void ieee80211_wake_txqs(struct tasklet_
  	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
  }
  
@@ -508,7 +508,7 @@
  static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
  				   enum queue_stop_reason reason,
  				   bool refcounted,
-@@ -509,11 +476,7 @@ static void __ieee80211_wake_queue(struc
+@@ -507,11 +474,7 @@ static void __ieee80211_wake_queue(struc
  		/* someone still has this queue stopped */
  		return;
  
@@ -521,7 +521,7 @@
  		tasklet_schedule(&local->tx_pending_tasklet);
  
  	/*
-@@ -523,12 +486,10 @@ static void __ieee80211_wake_queue(struc
+@@ -521,12 +484,10 @@ static void __ieee80211_wake_queue(struc
  	 * release someone's lock, but it is fine because all the callers of
  	 * __ieee80211_wake_queue call it right before releasing the lock.
  	 */
@@ -538,17 +538,44 @@
  }
  
  void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
-@@ -585,10 +546,6 @@ static void __ieee80211_stop_queue(struc
- 		for (ac = 0; ac < n_acs; ac++) {
- 			if (sdata->vif.hw_queue[ac] == queue ||
- 			    sdata->vif.cab_queue == queue) {
--				if (!local->ops->wake_tx_queue) {
--					netif_stop_subqueue(sdata->dev, ac);
--					continue;
--				}
- 				spin_lock(&local->fq.lock);
- 				sdata->vif.txqs_stopped[ac] = true;
- 				spin_unlock(&local->fq.lock);
+@@ -554,8 +515,6 @@ static void __ieee80211_stop_queue(struc
+ 				   bool refcounted)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+-	struct ieee80211_sub_if_data *sdata;
+-	int n_acs = IEEE80211_NUM_ACS;
+ 
+ 	trace_stop_queue(local, queue, reason);
+ 
+@@ -567,27 +526,7 @@ static void __ieee80211_stop_queue(struc
+ 	else
+ 		local->q_stop_reasons[queue][reason]++;
+ 
+-	if (__test_and_set_bit(reason, &local->queue_stop_reasons[queue]))
+-		return;
+-
+-	if (local->hw.queues < IEEE80211_NUM_ACS)
+-		n_acs = 1;
+-
+-	rcu_read_lock();
+-	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+-		int ac;
+-
+-		if (!sdata->dev)
+-			continue;
+-
+-		for (ac = 0; ac < n_acs; ac++) {
+-			if (!local->ops->wake_tx_queue &&
+-			    (sdata->vif.hw_queue[ac] == queue ||
+-			     sdata->vif.cab_queue == queue))
+-				netif_stop_subqueue(sdata->dev, ac);
+-		}
+-	}
+-	rcu_read_unlock();
++	set_bit(reason, &local->queue_stop_reasons[queue]);
+ }
+ 
+ void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
 --- a/net/mac80211/wme.c
 +++ b/net/mac80211/wme.c
 @@ -122,6 +122,9 @@ u16 ieee80211_select_queue_80211(struct
@@ -561,7 +588,7 @@
  	if ((info->control.flags & IEEE80211_TX_CTRL_DONT_REORDER) ||
  	    local->hw.queues < IEEE80211_NUM_ACS)
  		return 0;
-@@ -141,12 +144,15 @@ u16 ieee80211_select_queue_80211(struct
+@@ -141,13 +144,16 @@ u16 ieee80211_select_queue_80211(struct
  	return ieee80211_downgrade_queue(sdata, NULL, skb);
  }
  
@@ -570,6 +597,7 @@
 +u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
 +			   struct sta_info *sta, struct sk_buff *skb)
  {
+ 	const struct ethhdr *eth = (void *)skb->data;
  	struct mac80211_qos_map *qos_map;
  	bool qos;
  
@@ -577,9 +605,9 @@
 +	skb_get_hash(skb);
 +
  	/* all mesh/ocb stations are required to support WME */
- 	if (sta && (sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
- 		    sdata->vif.type == NL80211_IFTYPE_OCB))
-@@ -176,59 +182,6 @@ u16 __ieee80211_select_queue(struct ieee
+ 	if ((sdata->vif.type == NL80211_IFTYPE_MESH_POINT &&
+ 	    !is_multicast_ether_addr(eth->h_dest)) ||
+@@ -178,59 +184,6 @@ u16 __ieee80211_select_queue(struct ieee
  	return ieee80211_downgrade_queue(sdata, sta, skb);
  }
  
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/307-v6.2-wifi-mac80211-fix-initialization-of-rx-link-and-rx-l.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/307-v6.2-wifi-mac80211-fix-initialization-of-rx-link-and-rx-l.patch
deleted file mode 100644
index 0201eea..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/307-v6.2-wifi-mac80211-fix-initialization-of-rx-link-and-rx-l.patch
+++ /dev/null
@@ -1,410 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 13 Dec 2022 21:03:19 +0100
-Subject: [PATCH] wifi: mac80211: fix initialization of rx->link and
- rx->link_sta
-
-There are some codepaths that do not initialize rx->link_sta properly. This
-causes a crash in places which assume that rx->link_sta is valid if rx->sta
-is valid.
-One known instance is triggered by __ieee80211_rx_h_amsdu being called from
-fast-rx.
-
-Since the initialization of rx->link and rx->link_sta is rather convoluted
-and duplicated in many places, clean it up by using a helper function to
-set it.
-
-Fixes: ccdde7c74ffd ("wifi: mac80211: properly implement MLO key handling")
-Fixes: b320d6c456ff ("wifi: mac80211: use correct rx link_sta instead of default")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -4067,6 +4067,58 @@ static void ieee80211_invoke_rx_handlers
- #undef CALL_RXH
- }
- 
-+static bool
-+ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
-+{
-+	if (!sta->mlo)
-+		return false;
-+
-+	return !!(sta->valid_links & BIT(link_id));
-+}
-+
-+static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,
-+				       u8 link_id)
-+{
-+	rx->link_id = link_id;
-+	rx->link = rcu_dereference(rx->sdata->link[link_id]);
-+
-+	if (!rx->sta || !rx->sta->sta.mlo)
-+		return rx->link;
-+
-+	if (!ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta, link_id))
-+		return false;
-+
-+	rx->link_sta = rcu_dereference(rx->sta->link[link_id]);
-+
-+	return rx->link && rx->link_sta;
-+}
-+
-+static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,
-+				      struct ieee80211_sta *pubsta,
-+				      int link_id)
-+{
-+	struct sta_info *sta;
-+
-+	sta = container_of(pubsta, struct sta_info, sta);
-+
-+	rx->link_id = link_id;
-+	rx->sta = sta;
-+
-+	if (sta) {
-+		rx->local = sta->sdata->local;
-+		if (!rx->sdata)
-+			rx->sdata = sta->sdata;
-+		rx->link_sta = &sta->deflink;
-+	}
-+
-+	if (link_id < 0)
-+		rx->link = &rx->sdata->deflink;
-+	else if (!ieee80211_rx_data_set_link(rx, link_id))
-+		return false;
-+
-+	return true;
-+}
-+
- /*
-  * This function makes calls into the RX path, therefore
-  * it has to be invoked under RCU read lock.
-@@ -4075,16 +4127,19 @@ void ieee80211_release_reorder_timeout(s
- {
- 	struct sk_buff_head frames;
- 	struct ieee80211_rx_data rx = {
--		.sta = sta,
--		.sdata = sta->sdata,
--		.local = sta->local,
- 		/* This is OK -- must be QoS data frame */
- 		.security_idx = tid,
- 		.seqno_idx = tid,
--		.link_id = -1,
- 	};
- 	struct tid_ampdu_rx *tid_agg_rx;
--	u8 link_id;
-+	int link_id = -1;
-+
-+	/* FIXME: statistics won't be right with this */
-+	if (sta->sta.valid_links)
-+		link_id = ffs(sta->sta.valid_links) - 1;
-+
-+	if (!ieee80211_rx_data_set_sta(&rx, &sta->sta, link_id))
-+		return;
- 
- 	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
- 	if (!tid_agg_rx)
-@@ -4104,10 +4159,6 @@ void ieee80211_release_reorder_timeout(s
- 		};
- 		drv_event_callback(rx.local, rx.sdata, &event);
- 	}
--	/* FIXME: statistics won't be right with this */
--	link_id = sta->sta.valid_links ? ffs(sta->sta.valid_links) - 1 : 0;
--	rx.link = rcu_dereference(sta->sdata->link[link_id]);
--	rx.link_sta = rcu_dereference(sta->link[link_id]);
- 
- 	ieee80211_rx_handlers(&rx, &frames);
- }
-@@ -4123,7 +4174,6 @@ void ieee80211_mark_rx_ba_filtered_frame
- 		/* This is OK -- must be QoS data frame */
- 		.security_idx = tid,
- 		.seqno_idx = tid,
--		.link_id = -1,
- 	};
- 	int i, diff;
- 
-@@ -4134,10 +4184,8 @@ void ieee80211_mark_rx_ba_filtered_frame
- 
- 	sta = container_of(pubsta, struct sta_info, sta);
- 
--	rx.sta = sta;
--	rx.sdata = sta->sdata;
--	rx.link = &rx.sdata->deflink;
--	rx.local = sta->local;
-+	if (!ieee80211_rx_data_set_sta(&rx, pubsta, -1))
-+		return;
- 
- 	rcu_read_lock();
- 	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
-@@ -4524,15 +4572,6 @@ void ieee80211_check_fast_rx_iface(struc
- 	mutex_unlock(&local->sta_mtx);
- }
- 
--static bool
--ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
--{
--	if (!sta->mlo)
--		return false;
--
--	return !!(sta->valid_links & BIT(link_id));
--}
--
- static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
- 			      struct ieee80211_fast_rx *fast_rx,
- 			      int orig_len)
-@@ -4643,7 +4682,6 @@ static bool ieee80211_invoke_fast_rx(str
- 	struct sk_buff *skb = rx->skb;
- 	struct ieee80211_hdr *hdr = (void *)skb->data;
- 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
--	struct sta_info *sta = rx->sta;
- 	int orig_len = skb->len;
- 	int hdrlen = ieee80211_hdrlen(hdr->frame_control);
- 	int snap_offs = hdrlen;
-@@ -4655,7 +4693,6 @@ static bool ieee80211_invoke_fast_rx(str
- 		u8 da[ETH_ALEN];
- 		u8 sa[ETH_ALEN];
- 	} addrs __aligned(2);
--	struct link_sta_info *link_sta;
- 	struct ieee80211_sta_rx_stats *stats;
- 
- 	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
-@@ -4758,18 +4795,10 @@ static bool ieee80211_invoke_fast_rx(str
-  drop:
- 	dev_kfree_skb(skb);
- 
--	if (rx->link_id >= 0) {
--		link_sta = rcu_dereference(sta->link[rx->link_id]);
--		if (!link_sta)
--			return true;
--	} else {
--		link_sta = &sta->deflink;
--	}
--
- 	if (fast_rx->uses_rss)
--		stats = this_cpu_ptr(link_sta->pcpu_rx_stats);
-+		stats = this_cpu_ptr(rx->link_sta->pcpu_rx_stats);
- 	else
--		stats = &link_sta->rx_stats;
-+		stats = &rx->link_sta->rx_stats;
- 
- 	stats->dropped++;
- 	return true;
-@@ -4787,8 +4816,8 @@ static bool ieee80211_prepare_and_rx_han
- 	struct ieee80211_local *local = rx->local;
- 	struct ieee80211_sub_if_data *sdata = rx->sdata;
- 	struct ieee80211_hdr *hdr = (void *)skb->data;
--	struct link_sta_info *link_sta = NULL;
--	struct ieee80211_link_data *link;
-+	struct link_sta_info *link_sta = rx->link_sta;
-+	struct ieee80211_link_data *link = rx->link;
- 
- 	rx->skb = skb;
- 
-@@ -4810,35 +4839,6 @@ static bool ieee80211_prepare_and_rx_han
- 	if (!ieee80211_accept_frame(rx))
- 		return false;
- 
--	if (rx->link_id >= 0) {
--		link = rcu_dereference(rx->sdata->link[rx->link_id]);
--
--		/* we might race link removal */
--		if (!link)
--			return true;
--		rx->link = link;
--
--		if (rx->sta) {
--			rx->link_sta =
--				rcu_dereference(rx->sta->link[rx->link_id]);
--			if (!rx->link_sta)
--				return true;
--		}
--	} else {
--		if (rx->sta)
--			rx->link_sta = &rx->sta->deflink;
--
--		rx->link = &sdata->deflink;
--	}
--
--	if (unlikely(!is_multicast_ether_addr(hdr->addr1) &&
--		     rx->link_id >= 0 && rx->sta && rx->sta->sta.mlo)) {
--		link_sta = rcu_dereference(rx->sta->link[rx->link_id]);
--
--		if (WARN_ON_ONCE(!link_sta))
--			return true;
--	}
--
- 	if (!consume) {
- 		struct skb_shared_hwtstamps *shwt;
- 
-@@ -4858,7 +4858,7 @@ static bool ieee80211_prepare_and_rx_han
- 		shwt->hwtstamp = skb_hwtstamps(skb)->hwtstamp;
- 	}
- 
--	if (unlikely(link_sta)) {
-+	if (unlikely(rx->sta && rx->sta->sta.mlo)) {
- 		/* translate to MLD addresses */
- 		if (ether_addr_equal(link->conf->addr, hdr->addr1))
- 			ether_addr_copy(hdr->addr1, rx->sdata->vif.addr);
-@@ -4888,6 +4888,7 @@ static void __ieee80211_rx_handle_8023(s
- 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
- 	struct ieee80211_fast_rx *fast_rx;
- 	struct ieee80211_rx_data rx;
-+	int link_id = -1;
- 
- 	memset(&rx, 0, sizeof(rx));
- 	rx.skb = skb;
-@@ -4904,12 +4905,8 @@ static void __ieee80211_rx_handle_8023(s
- 	if (!pubsta)
- 		goto drop;
- 
--	rx.sta = container_of(pubsta, struct sta_info, sta);
--	rx.sdata = rx.sta->sdata;
--
--	if (status->link_valid &&
--	    !ieee80211_rx_is_valid_sta_link_id(pubsta, status->link_id))
--		goto drop;
-+	if (status->link_valid)
-+		link_id = status->link_id;
- 
- 	/*
- 	 * TODO: Should the frame be dropped if the right link_id is not
-@@ -4918,19 +4915,8 @@ static void __ieee80211_rx_handle_8023(s
- 	 * link_id is used only for stats purpose and updating the stats on
- 	 * the deflink is fine?
- 	 */
--	if (status->link_valid)
--		rx.link_id = status->link_id;
--
--	if (rx.link_id >= 0) {
--		struct ieee80211_link_data *link;
--
--		link =  rcu_dereference(rx.sdata->link[rx.link_id]);
--		if (!link)
--			goto drop;
--		rx.link = link;
--	} else {
--		rx.link = &rx.sdata->deflink;
--	}
-+	if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id))
-+		goto drop;
- 
- 	fast_rx = rcu_dereference(rx.sta->fast_rx);
- 	if (!fast_rx)
-@@ -4948,6 +4934,8 @@ static bool ieee80211_rx_for_interface(s
- {
- 	struct link_sta_info *link_sta;
- 	struct ieee80211_hdr *hdr = (void *)skb->data;
-+	struct sta_info *sta;
-+	int link_id = -1;
- 
- 	/*
- 	 * Look up link station first, in case there's a
-@@ -4957,24 +4945,19 @@ static bool ieee80211_rx_for_interface(s
- 	 */
- 	link_sta = link_sta_info_get_bss(rx->sdata, hdr->addr2);
- 	if (link_sta) {
--		rx->sta = link_sta->sta;
--		rx->link_id = link_sta->link_id;
-+		sta = link_sta->sta;
-+		link_id = link_sta->link_id;
- 	} else {
- 		struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
- 
--		rx->sta = sta_info_get_bss(rx->sdata, hdr->addr2);
--		if (rx->sta) {
--			if (status->link_valid &&
--			    !ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta,
--							       status->link_id))
--				return false;
--
--			rx->link_id = status->link_valid ? status->link_id : -1;
--		} else {
--			rx->link_id = -1;
--		}
-+		sta = sta_info_get_bss(rx->sdata, hdr->addr2);
-+		if (status->link_valid)
-+			link_id = status->link_id;
- 	}
- 
-+	if (!ieee80211_rx_data_set_sta(rx, &sta->sta, link_id))
-+		return false;
-+
- 	return ieee80211_prepare_and_rx_handle(rx, skb, consume);
- }
- 
-@@ -5033,19 +5016,15 @@ static void __ieee80211_rx_handle_packet
- 
- 	if (ieee80211_is_data(fc)) {
- 		struct sta_info *sta, *prev_sta;
--		u8 link_id = status->link_id;
-+		int link_id = -1;
- 
--		if (pubsta) {
--			rx.sta = container_of(pubsta, struct sta_info, sta);
--			rx.sdata = rx.sta->sdata;
-+		if (status->link_valid)
-+			link_id = status->link_id;
- 
--			if (status->link_valid &&
--			    !ieee80211_rx_is_valid_sta_link_id(pubsta, link_id))
-+		if (pubsta) {
-+			if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id))
- 				goto out;
- 
--			if (status->link_valid)
--				rx.link_id = status->link_id;
--
- 			/*
- 			 * In MLO connection, fetch the link_id using addr2
- 			 * when the driver does not pass link_id in status.
-@@ -5063,7 +5042,7 @@ static void __ieee80211_rx_handle_packet
- 				if (!link_sta)
- 					goto out;
- 
--				rx.link_id = link_sta->link_id;
-+				ieee80211_rx_data_set_link(&rx, link_sta->link_id);
- 			}
- 
- 			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
-@@ -5079,30 +5058,27 @@ static void __ieee80211_rx_handle_packet
- 				continue;
- 			}
- 
--			if ((status->link_valid &&
--			     !ieee80211_rx_is_valid_sta_link_id(&prev_sta->sta,
--								link_id)) ||
--			    (!status->link_valid && prev_sta->sta.mlo))
-+			rx.sdata = prev_sta->sdata;
-+			if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta,
-+						       link_id))
-+				goto out;
-+
-+			if (!status->link_valid && prev_sta->sta.mlo)
- 				continue;
- 
--			rx.link_id = status->link_valid ? link_id : -1;
--			rx.sta = prev_sta;
--			rx.sdata = prev_sta->sdata;
- 			ieee80211_prepare_and_rx_handle(&rx, skb, false);
- 
- 			prev_sta = sta;
- 		}
- 
- 		if (prev_sta) {
--			if ((status->link_valid &&
--			     !ieee80211_rx_is_valid_sta_link_id(&prev_sta->sta,
--								link_id)) ||
--			    (!status->link_valid && prev_sta->sta.mlo))
-+			rx.sdata = prev_sta->sdata;
-+			if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta,
-+						       link_id))
- 				goto out;
- 
--			rx.link_id = status->link_valid ? link_id : -1;
--			rx.sta = prev_sta;
--			rx.sdata = prev_sta->sdata;
-+			if (!status->link_valid && prev_sta->sta.mlo)
-+				goto out;
- 
- 			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
- 				return;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/308-v6.2-wifi-mac80211-fix-MLO-AP_VLAN-check.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/308-v6.2-wifi-mac80211-fix-MLO-AP_VLAN-check.patch
deleted file mode 100644
index 2d181e3..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/308-v6.2-wifi-mac80211-fix-MLO-AP_VLAN-check.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 14 Dec 2022 13:46:38 +0100
-Subject: [PATCH] wifi: mac80211: fix MLO + AP_VLAN check
-
-Instead of preventing adding AP_VLAN to MLO enabled APs, this check was
-preventing adding more than one 4-addr AP_VLAN regardless of the MLO status.
-Fix this by adding missing extra checks.
-
-Fixes: ae960ee90bb1 ("wifi: mac80211: prevent VLANs on MLDs")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -364,7 +364,9 @@ static int ieee80211_check_concurrent_if
- 
- 			/* No support for VLAN with MLO yet */
- 			if (iftype == NL80211_IFTYPE_AP_VLAN &&
--			    nsdata->wdev.use_4addr)
-+			    sdata->wdev.use_4addr &&
-+			    nsdata->vif.type == NL80211_IFTYPE_AP &&
-+			    nsdata->vif.valid_links)
- 				return -EOPNOTSUPP;
- 
- 			/*
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/310-v6.2-mac80211-add-support-for-restricting-netdev-features.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/310-v6.2-mac80211-add-support-for-restricting-netdev-features.patch
index 3d286d0..812b121 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/310-v6.2-mac80211-add-support-for-restricting-netdev-features.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/310-v6.2-mac80211-add-support-for-restricting-netdev-features.patch
@@ -70,7 +70,7 @@
   * @driver_flags: flags/capabilities the driver has for this interface,
   *	these need to be set (or cleared) when the interface is added
   *	or, if supported by the driver, the interface type is changed
-@@ -1848,6 +1852,7 @@ struct ieee80211_vif {
+@@ -1846,6 +1850,7 @@ struct ieee80211_vif {
  
  	struct ieee80211_txq *txq;
  
@@ -90,7 +90,7 @@
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -1355,7 +1355,11 @@ static struct txq_info *ieee80211_get_tx
+@@ -1356,7 +1356,11 @@ static struct txq_info *ieee80211_get_tx
  
  static void ieee80211_set_skb_enqueue_time(struct sk_buff *skb)
  {
@@ -103,7 +103,7 @@
  }
  
  static u32 codel_skb_len_func(const struct sk_buff *skb)
-@@ -3578,55 +3582,79 @@ ieee80211_xmit_fast_finish(struct ieee80
+@@ -3579,55 +3583,79 @@ ieee80211_xmit_fast_finish(struct ieee80
  	return TX_CONTINUE;
  }
  
@@ -219,7 +219,7 @@
  
  	/* will not be crypto-handled beyond what we do here, so use false
  	 * as the may-encrypt argument for the resize to not account for
-@@ -3635,10 +3663,8 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3636,10 +3664,8 @@ static bool ieee80211_xmit_fast(struct i
  	if (unlikely(ieee80211_skb_resize(sdata, skb,
  					  max_t(int, extra_head + hw_headroom -
  						     skb_headroom(skb), 0),
@@ -232,7 +232,7 @@
  
  	memcpy(&eth, skb->data, ETH_HLEN - 2);
  	hdr = skb_push(skb, extra_head);
-@@ -3652,7 +3678,7 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3653,7 +3679,7 @@ static bool ieee80211_xmit_fast(struct i
  	info->control.vif = &sdata->vif;
  	info->flags = IEEE80211_TX_CTL_FIRST_FRAGMENT |
  		      IEEE80211_TX_CTL_DONTFRAG |
@@ -241,7 +241,7 @@
  	info->control.flags = IEEE80211_TX_CTRL_FAST_XMIT |
  			      u32_encode_bits(IEEE80211_LINK_UNSPECIFIED,
  					      IEEE80211_TX_CTRL_MLO_LINK);
-@@ -3676,16 +3702,14 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3677,16 +3703,14 @@ static bool ieee80211_xmit_fast(struct i
  	tx.key = fast_tx->key;
  
  	if (ieee80211_queue_skb(local, sdata, sta, skb))
@@ -261,7 +261,7 @@
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
  		sdata = container_of(sdata->bss,
-@@ -3693,6 +3717,56 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3694,6 +3718,56 @@ static bool ieee80211_xmit_fast(struct i
  
  	__skb_queue_tail(&tx.skbs, skb);
  	ieee80211_tx_frags(local, &sdata->vif, sta, &tx.skbs, false);
@@ -318,7 +318,7 @@
  	return true;
  }
  
-@@ -4193,31 +4267,14 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4201,31 +4275,14 @@ void __ieee80211_subif_start_xmit(struct
  			goto out;
  	}
  
@@ -358,7 +358,7 @@
  	}
  
  	skb_list_walk_safe(skb, skb, next) {
-@@ -4435,9 +4492,11 @@ normal:
+@@ -4443,9 +4500,11 @@ normal:
  	return NETDEV_TX_OK;
  }
  
@@ -373,7 +373,7 @@
  {
  	struct ieee80211_local *local = sdata->local;
  	struct ieee80211_tx_control control = {};
-@@ -4446,14 +4505,6 @@ static bool ieee80211_tx_8023(struct iee
+@@ -4454,14 +4513,6 @@ static bool ieee80211_tx_8023(struct iee
  	unsigned long flags;
  	int q = info->hw_queue;
  
@@ -388,7 +388,7 @@
  	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
  
  	if (local->queue_stop_reasons[q] ||
-@@ -4480,6 +4531,26 @@ static bool ieee80211_tx_8023(struct iee
+@@ -4488,6 +4539,26 @@ static bool ieee80211_tx_8023(struct iee
  	return true;
  }
  
@@ -415,7 +415,7 @@
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
  				struct ieee80211_key *key, struct sk_buff *skb)
-@@ -4487,9 +4558,13 @@ static void ieee80211_8023_xmit(struct i
+@@ -4495,9 +4566,13 @@ static void ieee80211_8023_xmit(struct i
  	struct ieee80211_tx_info *info;
  	struct ieee80211_local *local = sdata->local;
  	struct tid_ampdu_tx *tid_tx;
@@ -430,7 +430,7 @@
  
  	if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)) &&
  	    test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
-@@ -4499,9 +4574,6 @@ static void ieee80211_8023_xmit(struct i
+@@ -4507,9 +4582,6 @@ static void ieee80211_8023_xmit(struct i
  	if (unlikely(!skb))
  		return;
  
@@ -440,7 +440,7 @@
  	ieee80211_aggr_check(sdata, sta, skb);
  
  	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
-@@ -4515,22 +4587,20 @@ static void ieee80211_8023_xmit(struct i
+@@ -4523,22 +4595,20 @@ static void ieee80211_8023_xmit(struct i
  			return;
  		}
  
@@ -471,7 +471,7 @@
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
  		sdata = container_of(sdata->bss,
-@@ -4542,6 +4612,24 @@ static void ieee80211_8023_xmit(struct i
+@@ -4550,6 +4620,24 @@ static void ieee80211_8023_xmit(struct i
  	if (key)
  		info->control.hw_key = &key->conf;
  
@@ -496,7 +496,7 @@
  	ieee80211_tx_8023(sdata, skb, sta, false);
  
  	return;
-@@ -4583,6 +4671,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4591,6 +4679,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		    key->conf.cipher == WLAN_CIPHER_SUITE_TKIP))
  		goto skip_offload;
  
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/317-wifi-mac80211-fix-qos-on-mesh-interfaces.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/317-wifi-mac80211-fix-qos-on-mesh-interfaces.patch
deleted file mode 100644
index c60a88d..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/317-wifi-mac80211-fix-qos-on-mesh-interfaces.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 15 Feb 2023 15:11:54 +0100
-Subject: [PATCH] wifi: mac80211: fix qos on mesh interfaces
-
-When ieee80211_select_queue is called for mesh, the sta pointer is usually
-NULL, since the nexthop is looked up much later in the tx path.
-Explicitly check for unicast address in that case in order to make qos work
-again.
-
-Fixes: 50e2ab392919 ("wifi: mac80211: fix queue selection for mesh/OCB interfaces")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/wme.c
-+++ b/net/mac80211/wme.c
-@@ -147,6 +147,7 @@ u16 ieee80211_select_queue_80211(struct
- u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
- 			   struct sta_info *sta, struct sk_buff *skb)
- {
-+	const struct ethhdr *eth = (void *)skb->data;
- 	struct mac80211_qos_map *qos_map;
- 	bool qos;
- 
-@@ -154,8 +155,9 @@ u16 ieee80211_select_queue(struct ieee80
- 	skb_get_hash(skb);
- 
- 	/* all mesh/ocb stations are required to support WME */
--	if (sta && (sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
--		    sdata->vif.type == NL80211_IFTYPE_OCB))
-+	if ((sdata->vif.type == NL80211_IFTYPE_MESH_POINT &&
-+	    !is_multicast_ether_addr(eth->h_dest)) ||
-+	    (sdata->vif.type == NL80211_IFTYPE_OCB && sta))
- 		qos = true;
- 	else if (sta)
- 		qos = sta->sta.wme;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/318-wifi-mac80211-fix-race-in-mesh-sequence-number-assig.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/318-wifi-mac80211-fix-race-in-mesh-sequence-number-assig.patch
index 05e368c..7d01ffd 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/318-wifi-mac80211-fix-race-in-mesh-sequence-number-assig.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/318-wifi-mac80211-fix-race-in-mesh-sequence-number-assig.patch
@@ -11,7 +11,7 @@
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -695,7 +695,7 @@ struct ieee80211_if_mesh {
+@@ -696,7 +696,7 @@ struct ieee80211_if_mesh {
  	struct mesh_stats mshstats;
  	struct mesh_config mshcfg;
  	atomic_t estab_plinks;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch
index 12e9cf5..968d288 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch
@@ -40,7 +40,7 @@
  
  /* Maximum number of broadcast/multicast frames to buffer when some of the
   * associated stations are using power saving. */
-@@ -655,6 +656,19 @@ struct mesh_table {
+@@ -656,6 +657,19 @@ struct mesh_table {
  	atomic_t entries;		/* Up to MAX_MESH_NEIGHBOURS */
  };
  
@@ -60,7 +60,7 @@
  struct ieee80211_if_mesh {
  	struct timer_list housekeeping_timer;
  	struct timer_list mesh_path_timer;
-@@ -733,6 +747,7 @@ struct ieee80211_if_mesh {
+@@ -734,6 +748,7 @@ struct ieee80211_if_mesh {
  	struct mesh_table mpp_paths; /* Store paths for MPP&MAP */
  	int mesh_paths_generation;
  	int mpp_paths_generation;
@@ -68,7 +68,7 @@
  };
  
  #ifdef CPTCFG_MAC80211_MESH
-@@ -1998,6 +2013,11 @@ int ieee80211_tx_control_port(struct wip
+@@ -2002,6 +2017,11 @@ int ieee80211_tx_control_port(struct wip
  			      int link_id, u64 *cookie);
  int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,
  			      const u8 *buf, size_t len);
@@ -728,7 +728,7 @@
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -3021,6 +3021,9 @@ void ieee80211_check_fast_xmit(struct st
+@@ -3022,6 +3022,9 @@ void ieee80211_check_fast_xmit(struct st
  	if (!ieee80211_hw_check(&local->hw, SUPPORT_FAST_XMIT))
  		return;
  
@@ -738,7 +738,7 @@
  	/* Locking here protects both the pointer itself, and against concurrent
  	 * invocations winning data access races to, e.g., the key pointer that
  	 * is used.
-@@ -3402,6 +3405,9 @@ static bool ieee80211_amsdu_aggregate(st
+@@ -3403,6 +3406,9 @@ static bool ieee80211_amsdu_aggregate(st
  	if (sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
  		return false;
  
@@ -748,7 +748,7 @@
  	if (skb_is_gso(skb))
  		return false;
  
-@@ -3634,10 +3640,11 @@ free:
+@@ -3635,10 +3641,11 @@ free:
  	return NULL;
  }
  
@@ -764,7 +764,7 @@
  {
  	struct ieee80211_local *local = sdata->local;
  	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
-@@ -3646,7 +3653,6 @@ static void __ieee80211_xmit_fast(struct
+@@ -3647,7 +3654,6 @@ static void __ieee80211_xmit_fast(struct
  	ieee80211_tx_result r;
  	int hw_headroom = sdata->local->hw.extra_tx_headroom;
  	int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
@@ -772,7 +772,7 @@
  
  	skb = skb_share_check(skb, GFP_ATOMIC);
  	if (unlikely(!skb))
-@@ -3666,11 +3672,10 @@ static void __ieee80211_xmit_fast(struct
+@@ -3667,11 +3673,10 @@ static void __ieee80211_xmit_fast(struct
  					  ENCRYPT_NO)))
  		goto free;
  
@@ -786,7 +786,7 @@
  
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
-@@ -3689,7 +3694,8 @@ static void __ieee80211_xmit_fast(struct
+@@ -3690,7 +3695,8 @@ static void __ieee80211_xmit_fast(struct
  #endif
  
  	if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
@@ -796,7 +796,7 @@
  		*ieee80211_get_qos_ctl(hdr) = tid;
  	}
  
-@@ -3732,6 +3738,7 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3733,6 +3739,7 @@ static bool ieee80211_xmit_fast(struct i
  	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
  	struct tid_ampdu_tx *tid_tx = NULL;
  	struct sk_buff *next;
@@ -804,7 +804,7 @@
  	u8 tid = IEEE80211_NUM_TIDS;
  
  	/* control port protocol needs a lot of special handling */
-@@ -3757,6 +3764,8 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3758,6 +3765,8 @@ static bool ieee80211_xmit_fast(struct i
  		}
  	}
  
@@ -813,7 +813,7 @@
  	/* after this point (skb is modified) we cannot return false */
  	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
  	if (!skb)
-@@ -3764,7 +3773,8 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3765,7 +3774,8 @@ static bool ieee80211_xmit_fast(struct i
  
  	skb_list_walk_safe(skb, skb, next) {
  		skb_mark_not_on_list(skb);
@@ -823,7 +823,7 @@
  	}
  
  	return true;
-@@ -4244,8 +4254,15 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4252,8 +4262,15 @@ void __ieee80211_subif_start_xmit(struct
  		return;
  	}
  
@@ -839,7 +839,7 @@
  	if (ieee80211_lookup_ra_sta(sdata, skb, &sta))
  		goto out_free;
  
-@@ -4255,8 +4272,6 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4263,8 +4280,6 @@ void __ieee80211_subif_start_xmit(struct
  	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
  	ieee80211_aggr_check(sdata, sta, skb);
  
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch
index 7ec8f3d..28b1ff1 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch
@@ -106,7 +106,7 @@
  rx_accept:
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -2018,6 +2018,8 @@ void __ieee80211_xmit_fast(struct ieee80
+@@ -2022,6 +2022,8 @@ void __ieee80211_xmit_fast(struct ieee80
  			   struct ieee80211_fast_tx *fast_tx,
  			   struct sk_buff *skb, bool ampdu,
  			   const u8 *da, const u8 *sa);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/323-v6.3-wifi-mac80211-Add-VHT-MU-MIMO-related-flags-in-ieee8.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/323-v6.3-wifi-mac80211-Add-VHT-MU-MIMO-related-flags-in-ieee8.patch
index 2310593..e23dc4d 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/323-v6.3-wifi-mac80211-Add-VHT-MU-MIMO-related-flags-in-ieee8.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/323-v6.3-wifi-mac80211-Add-VHT-MU-MIMO-related-flags-in-ieee8.patch
@@ -44,7 +44,7 @@
  /**
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1251,6 +1251,21 @@ static int ieee80211_start_ap(struct wip
+@@ -1252,6 +1252,21 @@ static int ieee80211_start_ap(struct wip
  	prev_beacon_int = link_conf->beacon_int;
  	link_conf->beacon_int = params->beacon_interval;
  
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/324-v6.3-wifi-mac80211-Add-HE-MU-MIMO-related-flags-in-ieee80.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/324-v6.3-wifi-mac80211-Add-HE-MU-MIMO-related-flags-in-ieee80.patch
index a3c4453..f843dba 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/324-v6.3-wifi-mac80211-Add-HE-MU-MIMO-related-flags-in-ieee80.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/324-v6.3-wifi-mac80211-Add-HE-MU-MIMO-related-flags-in-ieee80.patch
@@ -44,7 +44,7 @@
  /**
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1280,6 +1280,21 @@ static int ieee80211_start_ap(struct wip
+@@ -1281,6 +1281,21 @@ static int ieee80211_start_ap(struct wip
  			changed |= BSS_CHANGED_HE_BSS_COLOR;
  	}
  
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/325-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/325-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch
index f6d3d78..1be5fcf 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/325-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/325-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch
@@ -13,7 +13,7 @@
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -5968,6 +5968,18 @@ void ieee80211_queue_delayed_work(struct
+@@ -5964,6 +5964,18 @@ void ieee80211_queue_delayed_work(struct
  				  unsigned long delay);
  
  /**
@@ -34,7 +34,7 @@
   * @tid: the TID to BA on.
 --- a/net/mac80211/agg-tx.c
 +++ b/net/mac80211/agg-tx.c
-@@ -552,6 +552,23 @@ void ieee80211_tx_ba_session_handle_star
+@@ -554,6 +554,23 @@ void ieee80211_tx_ba_session_handle_star
  	ieee80211_send_addba_with_timeout(sta, tid_tx);
  }
  
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/326-wifi-mac80211-add-mesh-fast-rx-support.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/326-wifi-mac80211-add-mesh-fast-rx-support.patch
index b2b94d0..11f39c2 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/326-wifi-mac80211-add-mesh-fast-rx-support.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/326-wifi-mac80211-add-mesh-fast-rx-support.patch
@@ -10,7 +10,7 @@
 
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -4572,6 +4572,12 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4564,6 +4564,12 @@ void ieee80211_check_fast_rx(struct sta_
  		}
  
  		break;
@@ -23,7 +23,7 @@
  	default:
  		goto clear;
  	}
-@@ -4780,6 +4786,7 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4772,6 +4778,7 @@ static bool ieee80211_invoke_fast_rx(str
  	struct sk_buff *skb = rx->skb;
  	struct ieee80211_hdr *hdr = (void *)skb->data;
  	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
@@ -31,7 +31,7 @@
  	int orig_len = skb->len;
  	int hdrlen = ieee80211_hdrlen(hdr->frame_control);
  	int snap_offs = hdrlen;
-@@ -4841,7 +4848,8 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4833,7 +4840,8 @@ static bool ieee80211_invoke_fast_rx(str
  		snap_offs += IEEE80211_CCMP_HDR_LEN;
  	}
  
@@ -41,7 +41,7 @@
  		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
  			return false;
  
-@@ -4880,13 +4888,29 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4872,13 +4880,29 @@ static bool ieee80211_invoke_fast_rx(str
  	/* do the header conversion - first grab the addresses */
  	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
  	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/327-wifi-mac80211-add-support-for-letting-drivers-regist.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/327-wifi-mac80211-add-support-for-letting-drivers-regist.patch
index f1807bd..ac290b5 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/327-wifi-mac80211-add-support-for-letting-drivers-regist.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/327-wifi-mac80211-add-support-for-letting-drivers-regist.patch
@@ -12,7 +12,7 @@
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -4196,6 +4196,10 @@ struct ieee80211_prep_tx_info {
+@@ -4192,6 +4192,10 @@ struct ieee80211_prep_tx_info {
   *	Note that a sta can also be inserted or removed with valid links,
   *	i.e. passed to @sta_add/@sta_state with sta->valid_links not zero.
   *	In fact, cannot change from having valid_links and not having them.
@@ -23,7 +23,7 @@
   */
  struct ieee80211_ops {
  	void (*tx)(struct ieee80211_hw *hw,
-@@ -4551,6 +4555,11 @@ struct ieee80211_ops {
+@@ -4547,6 +4551,11 @@ struct ieee80211_ops {
  				struct ieee80211_vif *vif,
  				struct ieee80211_sta *sta,
  				u16 old_links, u16 new_links);
@@ -63,7 +63,7 @@
  			 u16 old_links, u16 new_links,
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1935,7 +1935,8 @@ void ieee80211_color_change_finalize_wor
+@@ -1939,7 +1939,8 @@ void ieee80211_color_collision_detection
  /* interface handling */
  #define MAC80211_SUPPORTED_FEATURES_TX	(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \
  					 NETIF_F_HW_CSUM | NETIF_F_SG | \
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/328-wifi-mac80211-fix-invalid-drv_sta_pre_rcu_remove-cal.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/328-wifi-mac80211-fix-invalid-drv_sta_pre_rcu_remove-cal.patch
deleted file mode 100644
index 289906c..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/328-wifi-mac80211-fix-invalid-drv_sta_pre_rcu_remove-cal.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 24 Mar 2023 13:04:17 +0100
-Subject: [PATCH] wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for
- non-uploaded sta
-
-Avoid potential data corruption issues caused by uninitialized driver
-private data structures.
-
-Reported-by: Brian Coverstone <brian@mainsequence.net>
-Fixes: 6a9d1b91f34d ("mac80211: add pre-RCU-sync sta removal driver operation")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -1241,7 +1241,8 @@ static int __must_check __sta_info_destr
- 	list_del_rcu(&sta->list);
- 	sta->removed = true;
- 
--	drv_sta_pre_rcu_remove(local, sta->sdata, sta);
-+	if (sta->uploaded)
-+		drv_sta_pre_rcu_remove(local, sta->sdata, sta);
- 
- 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
- 	    rcu_access_pointer(sdata->u.vlan.sta) == sta)
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/330-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/330-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch
index 9c98d9e..079dd2a 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/330-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/330-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch
@@ -123,7 +123,7 @@
  			info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
  			return TX_CONTINUE;
  		}
-@@ -1325,7 +1325,7 @@ static struct txq_info *ieee80211_get_tx
+@@ -1326,7 +1326,7 @@ static struct txq_info *ieee80211_get_tx
  	if (!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
  	    unlikely(!ieee80211_is_data_present(hdr->frame_control))) {
  		if ((!ieee80211_is_mgmt(hdr->frame_control) ||
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/333-wifi-mac80211-add-flush_sta-method.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/333-wifi-mac80211-add-flush_sta-method.patch
index 300a2b6..3bba0b7 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/333-wifi-mac80211-add-flush_sta-method.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/333-wifi-mac80211-add-flush_sta-method.patch
@@ -12,7 +12,7 @@
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -3922,6 +3922,10 @@ struct ieee80211_prep_tx_info {
+@@ -3918,6 +3918,10 @@ struct ieee80211_prep_tx_info {
   *	Note that vif can be NULL.
   *	The callback can sleep.
   *
@@ -23,7 +23,7 @@
   * @channel_switch: Drivers that need (or want) to offload the channel
   *	switch operation for CSAs received from the AP may implement this
   *	callback. They must then call ieee80211_chswitch_done() to indicate
-@@ -4376,6 +4380,8 @@ struct ieee80211_ops {
+@@ -4372,6 +4376,8 @@ struct ieee80211_ops {
  #endif
  	void (*flush)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		      u32 queues, bool drop);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/335-wifi-mac80211-add-LDPC-related-flags-in-ieee80211_bs.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/335-wifi-mac80211-add-LDPC-related-flags-in-ieee80211_bs.patch
new file mode 100644
index 0000000..1b379b7
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/335-wifi-mac80211-add-LDPC-related-flags-in-ieee80211_bs.patch
@@ -0,0 +1,62 @@
+From: Ryder Lee <ryder.lee@mediatek.com>
+Date: Sat, 18 Feb 2023 01:49:25 +0800
+Subject: [PATCH] wifi: mac80211: add LDPC related flags in ieee80211_bss_conf
+
+This is utilized to pass LDPC configurations from user space
+(i.e. hostapd) to driver.
+
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Link: https://lore.kernel.org/r/1de696aaa34efd77a926eb657b8c0fda05aaa177.1676628065.git.ryder.lee@mediatek.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -653,6 +653,9 @@ struct ieee80211_fils_discovery {
+  *	write-protected by sdata_lock and local->mtx so holding either is fine
+  *	for read access.
+  * @color_change_color: the bss color that will be used after the change.
++ * @ht_ldpc: in AP mode, indicates interface has HT LDPC capability.
++ * @vht_ldpc: in AP mode, indicates interface has VHT LDPC capability.
++ * @he_ldpc: in AP mode, indicates interface has HE LDPC capability.
+  * @vht_su_beamformer: in AP mode, does this BSS support operation as an VHT SU
+  *	beamformer
+  * @vht_su_beamformee: in AP mode, does this BSS support operation as an VHT SU
+@@ -744,6 +747,9 @@ struct ieee80211_bss_conf {
+ 	bool color_change_active;
+ 	u8 color_change_color;
+ 
++	bool ht_ldpc;
++	bool vht_ldpc;
++	bool he_ldpc;
+ 	bool vht_su_beamformer;
+ 	bool vht_su_beamformee;
+ 	bool vht_mu_beamformer;
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1252,7 +1252,15 @@ static int ieee80211_start_ap(struct wip
+ 	prev_beacon_int = link_conf->beacon_int;
+ 	link_conf->beacon_int = params->beacon_interval;
+ 
++	if (params->ht_cap)
++		link_conf->ht_ldpc =
++			params->ht_cap->cap_info &
++				cpu_to_le16(IEEE80211_HT_CAP_LDPC_CODING);
++
+ 	if (params->vht_cap) {
++		link_conf->vht_ldpc =
++			params->vht_cap->vht_cap_info &
++				cpu_to_le32(IEEE80211_VHT_CAP_RXLDPC);
+ 		link_conf->vht_su_beamformer =
+ 			params->vht_cap->vht_cap_info &
+ 				cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
+@@ -1282,6 +1290,9 @@ static int ieee80211_start_ap(struct wip
+ 	}
+ 
+ 	if (params->he_cap) {
++		link_conf->he_ldpc =
++			params->he_cap->phy_cap_info[1] &
++				IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD;
+ 		link_conf->he_su_beamformer =
+ 			params->he_cap->phy_cap_info[3] &
+ 				IEEE80211_HE_PHY_CAP3_SU_BEAMFORMER;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
index d7ee33b..b1e84e2 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
@@ -18,7 +18,7 @@
  
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1671,6 +1671,7 @@ enum ieee80211_smps_mode {
+@@ -1677,6 +1677,7 @@ enum ieee80211_smps_mode {
   *
   * @power_level: requested transmit power (in dBm), backward compatibility
   *	value only that is set to the minimum of all interfaces
@@ -26,7 +26,7 @@
   *
   * @chandef: the channel definition to tune to
   * @radar_enabled: whether radar detection is enabled
-@@ -1691,6 +1692,7 @@ enum ieee80211_smps_mode {
+@@ -1697,6 +1698,7 @@ enum ieee80211_smps_mode {
  struct ieee80211_conf {
  	u32 flags;
  	int power_level, dynamic_ps_timeout;
@@ -57,7 +57,7 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -3028,6 +3028,19 @@ static int ieee80211_get_tx_power(struct
+@@ -3046,6 +3046,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -77,7 +77,7 @@
  static void ieee80211_rfkill_poll(struct wiphy *wiphy)
  {
  	struct ieee80211_local *local = wiphy_priv(wiphy);
-@@ -4911,6 +4924,7 @@ const struct cfg80211_ops mac80211_confi
+@@ -4953,6 +4966,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
@@ -87,7 +87,7 @@
  	CFG80211_TESTMODE_DUMP(ieee80211_testmode_dump)
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1535,6 +1535,7 @@ struct ieee80211_local {
+@@ -1538,6 +1538,7 @@ struct ieee80211_local {
  	int dynamic_ps_forced_timeout;
  
  	int user_power_level; /* in dBm, for all interfaces */
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0001-Revert-mac80211_configure_antenna_gain.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0001-Revert-mac80211_configure_antenna_gain.patch
new file mode 100644
index 0000000..7c29367
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0001-Revert-mac80211_configure_antenna_gain.patch
@@ -0,0 +1,194 @@
+From cefd58077419436745c1ca07daf75419c96e36b5 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 18 Apr 2023 15:37:08 +0800
+Subject: [PATCH 1/9] Revert mac80211_configure_antenna_gain
+
+---
+ include/net/cfg80211.h       |  2 --
+ include/net/mac80211.h       |  2 --
+ include/uapi/linux/nl80211.h |  5 -----
+ net/mac80211/cfg.c           | 14 --------------
+ net/mac80211/ieee80211_i.h   |  1 -
+ net/mac80211/main.c          |  9 +--------
+ net/wireless/nl80211.c       | 17 -----------------
+ 7 files changed, 1 insertion(+), 49 deletions(-)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 357a78f..803949b 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4081,7 +4081,6 @@ struct mgmt_frame_regs {
+  *	(as advertised by the nl80211 feature flag.)
+  * @get_tx_power: store the current TX power into the dbm variable;
+  *	return 0 if successful
+- * @set_antenna_gain: set antenna gain to reduce maximum tx power if necessary
+  *
+  * @rfkill_poll: polls the hw rfkill line, use cfg80211 reporting
+  *	functions to adjust rfkill hw state
+@@ -4432,7 +4431,6 @@ struct cfg80211_ops {
+ 				enum nl80211_tx_power_setting type, int mbm);
+ 	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
+ 				int *dbm);
+-	int	(*set_antenna_gain)(struct wiphy *wiphy, int dbi);
+ 
+ 	void	(*rfkill_poll)(struct wiphy *wiphy);
+ 
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index da3c3b3..9c59eb8 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1677,7 +1677,6 @@ enum ieee80211_smps_mode {
+  *
+  * @power_level: requested transmit power (in dBm), backward compatibility
+  *	value only that is set to the minimum of all interfaces
+- * @max_antenna_gain: maximum antenna gain adjusted by user config (in dBi)
+  *
+  * @chandef: the channel definition to tune to
+  * @radar_enabled: whether radar detection is enabled
+@@ -1698,7 +1697,6 @@ enum ieee80211_smps_mode {
+ struct ieee80211_conf {
+ 	u32 flags;
+ 	int power_level, dynamic_ps_timeout;
+-	int max_antenna_gain;
+ 
+ 	u16 listen_interval;
+ 	u8 ps_dtim_period;
+diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
+index ba4aa09..c32e761 100644
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -2749,9 +2749,6 @@ enum nl80211_commands {
+  *	When used with %NL80211_CMD_FRAME_TX_STATUS, indicates the ack RX
+  *	timestamp. When used with %NL80211_CMD_FRAME RX notification, indicates
+  *	the incoming frame RX timestamp.
+- * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
+- *	transmit power to stay within regulatory limits. u32, dBi.
+- *
+  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
+  * @NL80211_ATTR_MAX: highest attribute number currently defined
+  * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -3280,8 +3277,6 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_TX_HW_TIMESTAMP,
+ 	NL80211_ATTR_RX_HW_TIMESTAMP,
+ 
+-	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
+-
+ 	/* add attributes here, update the policy in nl80211.c */
+ 
+ 	__NL80211_ATTR_AFTER_LAST,
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 5397fe9..7a5e459 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -3046,19 +3046,6 @@ static int ieee80211_get_tx_power(struct wiphy *wiphy,
+ 	return 0;
+ }
+ 
+-static int ieee80211_set_antenna_gain(struct wiphy *wiphy, int dbi)
+-{
+-	struct ieee80211_local *local = wiphy_priv(wiphy);
+-
+-	if (dbi < 0)
+-		return -EINVAL;
+-
+-	local->user_antenna_gain = dbi;
+-	ieee80211_hw_config(local, 0);
+-
+-	return 0;
+-}
+-
+ static void ieee80211_rfkill_poll(struct wiphy *wiphy)
+ {
+ 	struct ieee80211_local *local = wiphy_priv(wiphy);
+@@ -4966,7 +4953,6 @@ const struct cfg80211_ops mac80211_config_ops = {
+ 	.set_wiphy_params = ieee80211_set_wiphy_params,
+ 	.set_tx_power = ieee80211_set_tx_power,
+ 	.get_tx_power = ieee80211_get_tx_power,
+-	.set_antenna_gain = ieee80211_set_antenna_gain,
+ 	.rfkill_poll = ieee80211_rfkill_poll,
+ 	CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
+ 	CFG80211_TESTMODE_DUMP(ieee80211_testmode_dump)
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index e7bcdea..a4fab9a 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1538,7 +1538,6 @@ struct ieee80211_local {
+ 	int dynamic_ps_forced_timeout;
+ 
+ 	int user_power_level; /* in dBm, for all interfaces */
+-	int user_antenna_gain; /* in dBi */
+ 
+ 	enum ieee80211_smps_mode smps_mode;
+ 
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 83a1482..dfb9f4b 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -96,7 +96,7 @@ static u32 ieee80211_hw_conf_chan(struct ieee80211_local *local)
+ 	struct ieee80211_sub_if_data *sdata;
+ 	struct cfg80211_chan_def chandef = {};
+ 	u32 changed = 0;
+-	int power, max_power;
++	int power;
+ 	u32 offchannel_flag;
+ 
+ 	offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
+@@ -157,12 +157,6 @@ static u32 ieee80211_hw_conf_chan(struct ieee80211_local *local)
+ 	}
+ 	rcu_read_unlock();
+ 
+-	max_power = chandef.chan->max_reg_power;
+-	if (local->user_antenna_gain > 0) {
+-		max_power -= local->user_antenna_gain;
+-		power = min(power, max_power);
+-	}
+-
+ 	if (local->hw.conf.power_level != power) {
+ 		changed |= IEEE80211_CONF_CHANGE_POWER;
+ 		local->hw.conf.power_level = power;
+@@ -768,7 +762,6 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
+ 					 IEEE80211_RADIOTAP_MCS_HAVE_BW;
+ 	local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
+ 					 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
+-	local->user_antenna_gain = 0;
+ 	local->hw.uapsd_queues = IEEE80211_DEFAULT_UAPSD_QUEUES;
+ 	local->hw.uapsd_max_sp_len = IEEE80211_DEFAULT_MAX_SP_LEN;
+ 	local->hw.max_mtu = IEEE80211_MAX_DATA_LEN;
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 507c868..777c141 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -799,7 +799,6 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ 	[NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
+ 	[NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
+ 	[NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
+-	[NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
+ };
+ 
+ /* policy for the key attributes */
+@@ -3513,22 +3512,6 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
+ 			goto out;
+ 	}
+ 
+-	if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_GAIN]) {
+-		int idx, dbi = 0;
+-
+-		if (!rdev->ops->set_antenna_gain) {
+-			result = -EOPNOTSUPP;
+-			goto out;
+-		}
+-
+-		idx = NL80211_ATTR_WIPHY_ANTENNA_GAIN;
+-		dbi = nla_get_u32(info->attrs[idx]);
+-
+-		result = rdev->ops->set_antenna_gain(&rdev->wiphy, dbi);
+-		if (result)
+-			goto out;
+-	}
+-
+ 	if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
+ 		struct wireless_dev *txp_wdev = wdev;
+ 		enum nl80211_tx_power_setting type;
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0001-mac80211-support-minimal-EHT-rate-reporting-on-RX.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0002-mac80211-support-minimal-EHT-rate-reporting-on-RX.patch
similarity index 90%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0001-mac80211-support-minimal-EHT-rate-reporting-on-RX.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0002-mac80211-support-minimal-EHT-rate-reporting-on-RX.patch
index b069217..c063f3e 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0001-mac80211-support-minimal-EHT-rate-reporting-on-RX.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0002-mac80211-support-minimal-EHT-rate-reporting-on-RX.patch
@@ -1,7 +1,7 @@
-From 438df855ef351c2a0dda7911361e1044c9ddf8bc Mon Sep 17 00:00:00 2001
+From 2ff2e76bdbbbe8fa6923c274f276110f86acfb6a Mon Sep 17 00:00:00 2001
 From: Johannes Berg <johannes.berg@intel.com>
 Date: Mon, 9 Jan 2023 13:07:21 +0200
-Subject: [PATCH 01/16] mac80211: support minimal EHT rate reporting on RX
+Subject: [PATCH 2/9] mac80211: support minimal EHT rate reporting on RX
 
 Add minimal support for RX EHT rate reporting, not yet
 adding (modifying) any radiotap headers, just statistics
@@ -17,10 +17,10 @@
  5 files changed, 64 insertions(+), 10 deletions(-)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index c8d3c50..b8d71ab 100644
+index 9c59eb8..3388cc7 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1462,6 +1462,7 @@ enum mac80211_rx_encoding {
+@@ -1468,6 +1468,7 @@ enum mac80211_rx_encoding {
  	RX_ENC_HT,
  	RX_ENC_VHT,
  	RX_ENC_HE,
@@ -28,7 +28,7 @@
  };
  
  /**
-@@ -1495,7 +1496,7 @@ enum mac80211_rx_encoding {
+@@ -1501,7 +1502,7 @@ enum mac80211_rx_encoding {
   * @antenna: antenna used
   * @rate_idx: index of data rate into band's supported rates or MCS index if
   *	HT or VHT is used (%RX_FLAG_HT/%RX_FLAG_VHT)
@@ -37,7 +37,7 @@
   * @flag: %RX_FLAG_\*
   * @encoding: &enum mac80211_rx_encoding
   * @bw: &enum rate_info_bw
-@@ -1503,6 +1504,8 @@ enum mac80211_rx_encoding {
+@@ -1509,6 +1510,8 @@ enum mac80211_rx_encoding {
   * @he_ru: HE RU, from &enum nl80211_he_ru_alloc
   * @he_gi: HE GI, from &enum nl80211_he_gi
   * @he_dcm: HE DCM value
@@ -46,7 +46,7 @@
   * @rx_flags: internal RX flags for mac80211
   * @ampdu_reference: A-MPDU reference number, must be a different value for
   *	each A-MPDU but the same for each subframe within one A-MPDU
-@@ -1524,8 +1527,18 @@ struct ieee80211_rx_status {
+@@ -1530,8 +1533,18 @@ struct ieee80211_rx_status {
  	u32 flag;
  	u16 freq: 13, freq_offset: 1;
  	u8 enc_flags;
@@ -68,10 +68,10 @@
  	u8 nss;
  	u8 rx_flags;
 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
-index 45aeb01..376e131 100644
+index 46ae9e9..fadf2be 100644
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -5331,6 +5331,15 @@ void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
+@@ -5328,6 +5328,15 @@ void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
  				      status->rate_idx, status->nss))
  				goto drop;
  			break;
@@ -88,7 +88,7 @@
  			WARN_ON_ONCE(1);
  			fallthrough;
 diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
-index e94ff8f..a2d7bf5 100644
+index a13a8fb..50daa22 100644
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
 @@ -4,7 +4,7 @@
@@ -164,10 +164,10 @@
  		WARN_ON(1);
  		return STA_STATS_RATE_INVALID;
 diff --git a/net/mac80211/util.c b/net/mac80211/util.c
-index 005a730..608f927 100644
+index 83f6c56..5a6c091 100644
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -3926,6 +3926,19 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
+@@ -3900,6 +3900,19 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
  
  	/* Fill cfg80211 rate info */
  	switch (status->encoding) {
@@ -188,5 +188,5 @@
  		ri.flags |= RATE_INFO_FLAGS_HE_MCS;
  		ri.mcs = status->rate_idx;
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0003-cfg80211-Update-Transition-Disable-policy-during-por.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0003-cfg80211-Update-Transition-Disable-policy-during-por.patch
new file mode 100644
index 0000000..a3f6dda
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0003-cfg80211-Update-Transition-Disable-policy-during-por.patch
@@ -0,0 +1,208 @@
+From e0756f54dea42f1833e40ddfb0deb5d0b8e6dda4 Mon Sep 17 00:00:00 2001
+From: Vinayak Yadawad <vinayak.yadawad@broadcom.com>
+Date: Wed, 7 Sep 2022 18:14:48 +0530
+Subject: [PATCH 3/9] cfg80211: Update Transition Disable policy during port
+ authorization
+
+In case of 4way handshake offload, transition disable policy
+updated by the AP during EAPOL 3/4 is not updated to the upper layer.
+This results in mismatch between transition disable policy
+between the upper layer and the driver. This patch addresses this
+issue by updating transition disable policy as part of port
+authorization indication.
+
+Signed-off-by: Vinayak Yadawad <vinayak.yadawad@broadcom.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c  |  2 +-
+ include/net/cfg80211.h                               |  4 +++-
+ include/uapi/linux/nl80211.h                         |  3 +++
+ net/wireless/core.h                                  |  5 ++++-
+ net/wireless/nl80211.c                               |  8 +++++++-
+ net/wireless/nl80211.h                               |  3 ++-
+ net/wireless/sme.c                                   | 12 ++++++++----
+ net/wireless/util.c                                  |  4 +++-
+ 8 files changed, 31 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index ea8409e..bddc0af 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6005,7 +6005,7 @@ done:
+ 	brcmf_dbg(CONN, "Report roaming result\n");
+ 
+ 	if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X && profile->is_ft) {
+-		cfg80211_port_authorized(ndev, profile->bssid, GFP_KERNEL);
++		cfg80211_port_authorized(ndev, profile->bssid, NULL, 0, GFP_KERNEL);
+ 		brcmf_dbg(CONN, "Report port authorized\n");
+ 	}
+ 
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 803949b..9420086 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -7717,6 +7717,8 @@ void cfg80211_roamed(struct net_device *dev, struct cfg80211_roam_info *info,
+  *
+  * @dev: network device
+  * @bssid: the BSSID of the AP
++ * @td_bitmap: transition disable policy
++ * @td_bitmap_len: Length of transition disable policy
+  * @gfp: allocation flags
+  *
+  * This function should be called by a driver that supports 4 way handshake
+@@ -7727,7 +7729,7 @@ void cfg80211_roamed(struct net_device *dev, struct cfg80211_roam_info *info,
+  * indicate the 802.11 association.
+  */
+ void cfg80211_port_authorized(struct net_device *dev, const u8 *bssid,
+-			      gfp_t gfp);
++			      const u8* td_bitmap, u8 td_bitmap_len, gfp_t gfp);
+ 
+ /**
+  * cfg80211_disconnected - notify cfg80211 that connection was dropped
+diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
+index c32e761..c14a91b 100644
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -2749,6 +2749,8 @@ enum nl80211_commands {
+  *	When used with %NL80211_CMD_FRAME_TX_STATUS, indicates the ack RX
+  *	timestamp. When used with %NL80211_CMD_FRAME RX notification, indicates
+  *	the incoming frame RX timestamp.
++ * @NL80211_ATTR_TD_BITMAP: Transition Disable bitmap, for subsequent
++ *	(re)associations.
+  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
+  * @NL80211_ATTR_MAX: highest attribute number currently defined
+  * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -3276,6 +3278,7 @@ enum nl80211_attrs {
+ 
+ 	NL80211_ATTR_TX_HW_TIMESTAMP,
+ 	NL80211_ATTR_RX_HW_TIMESTAMP,
++	NL80211_ATTR_TD_BITMAP,
+ 
+ 	/* add attributes here, update the policy in nl80211.c */
+ 
+diff --git a/net/wireless/core.h b/net/wireless/core.h
+index f4d3b83..382455c 100644
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -271,6 +271,8 @@ struct cfg80211_event {
+ 		} ij;
+ 		struct {
+ 			u8 bssid[ETH_ALEN];
++			const u8 *td_bitmap;
++			u8 td_bitmap_len;
+ 		} pa;
+ 	};
+ };
+@@ -409,7 +411,8 @@ int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
+ 			bool wextev);
+ void __cfg80211_roamed(struct wireless_dev *wdev,
+ 		       struct cfg80211_roam_info *info);
+-void __cfg80211_port_authorized(struct wireless_dev *wdev, const u8 *bssid);
++void __cfg80211_port_authorized(struct wireless_dev *wdev, const u8 *bssid,
++				const u8 *td_bitmap, u8 td_bitmap_len);
+ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
+ 			      struct wireless_dev *wdev);
+ void cfg80211_autodisconnect_wk(struct work_struct *work);
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 777c141..6a97e52 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -17936,7 +17936,8 @@ void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
+ }
+ 
+ void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
+-				  struct net_device *netdev, const u8 *bssid)
++				  struct net_device *netdev, const u8 *bssid,
++				  const u8 *td_bitmap, u8 td_bitmap_len)
+ {
+ 	struct sk_buff *msg;
+ 	void *hdr;
+@@ -17956,6 +17957,11 @@ void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
+ 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
+ 		goto nla_put_failure;
+ 
++	if ((td_bitmap_len > 0) && td_bitmap)
++		if (nla_put(msg, NL80211_ATTR_TD_BITMAP,
++			    td_bitmap_len, td_bitmap))
++			goto nla_put_failure;
++
+ 	genlmsg_end(msg, hdr);
+ 
+ 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
+index 855d540..ba9457e 100644
+--- a/net/wireless/nl80211.h
++++ b/net/wireless/nl80211.h
+@@ -83,7 +83,8 @@ void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
+ 			 struct net_device *netdev,
+ 			 struct cfg80211_roam_info *info, gfp_t gfp);
+ void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
+-				  struct net_device *netdev, const u8 *bssid);
++				  struct net_device *netdev, const u8 *bssid,
++				  const u8 *td_bitmap, u8 td_bitmap_len);
+ void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
+ 			       struct net_device *netdev, u16 reason,
+ 			       const u8 *ie, size_t ie_len, bool from_ap);
+diff --git a/net/wireless/sme.c b/net/wireless/sme.c
+index 05e4f29..1ee4408 100644
+--- a/net/wireless/sme.c
++++ b/net/wireless/sme.c
+@@ -1266,7 +1266,8 @@ out:
+ }
+ EXPORT_SYMBOL(cfg80211_roamed);
+ 
+-void __cfg80211_port_authorized(struct wireless_dev *wdev, const u8 *bssid)
++void __cfg80211_port_authorized(struct wireless_dev *wdev, const u8 *bssid,
++					const u8 *td_bitmap, u8 td_bitmap_len)
+ {
+ 	ASSERT_WDEV_LOCK(wdev);
+ 
+@@ -1279,11 +1280,11 @@ void __cfg80211_port_authorized(struct wireless_dev *wdev, const u8 *bssid)
+ 		return;
+ 
+ 	nl80211_send_port_authorized(wiphy_to_rdev(wdev->wiphy), wdev->netdev,
+-				     bssid);
++				     bssid, td_bitmap, td_bitmap_len);
+ }
+ 
+ void cfg80211_port_authorized(struct net_device *dev, const u8 *bssid,
+-			      gfp_t gfp)
++			      const u8 *td_bitmap, u8 td_bitmap_len, gfp_t gfp)
+ {
+ 	struct wireless_dev *wdev = dev->ieee80211_ptr;
+ 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
+@@ -1293,12 +1294,15 @@ void cfg80211_port_authorized(struct net_device *dev, const u8 *bssid,
+ 	if (WARN_ON(!bssid))
+ 		return;
+ 
+-	ev = kzalloc(sizeof(*ev), gfp);
++	ev = kzalloc(sizeof(*ev) + td_bitmap_len, gfp);
+ 	if (!ev)
+ 		return;
+ 
+ 	ev->type = EVENT_PORT_AUTHORIZED;
+ 	memcpy(ev->pa.bssid, bssid, ETH_ALEN);
++	ev->pa.td_bitmap = ((u8 *)ev) + sizeof(*ev);
++	ev->pa.td_bitmap_len = td_bitmap_len;
++	memcpy((void *)ev->pa.td_bitmap, td_bitmap, td_bitmap_len);
+ 
+ 	/*
+ 	 * Use the wdev event list so that if there are pending
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 769f8fe..fdc140e 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -1057,7 +1057,9 @@ void cfg80211_process_wdev_events(struct wireless_dev *wdev)
+ 			__cfg80211_leave(wiphy_to_rdev(wdev->wiphy), wdev);
+ 			break;
+ 		case EVENT_PORT_AUTHORIZED:
+-			__cfg80211_port_authorized(wdev, ev->pa.bssid);
++			__cfg80211_port_authorized(wdev, ev->pa.bssid,
++						   ev->pa.td_bitmap,
++						   ev->pa.td_bitmap_len);
+ 			break;
+ 		}
+ 		wdev_unlock(wdev);
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0004-wifi-mac80211-mlme-handle-EHT-channel-puncturing.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0004-wifi-mac80211-mlme-handle-EHT-channel-puncturing.patch
new file mode 100644
index 0000000..d455dd0
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0004-wifi-mac80211-mlme-handle-EHT-channel-puncturing.patch
@@ -0,0 +1,400 @@
+From 67ce530e39e0372f11006c5695f682e71152f7b7 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 27 Jan 2023 12:39:31 +0100
+Subject: [PATCH 4/9] wifi: mac80211: mlme: handle EHT channel puncturing
+
+Handle the Puncturing info received from the AP in the
+EHT Operation element in beacons.
+
+If the info is invalid:
+ - during association: disable EHT connection for the AP
+ - after association: disconnect
+
+This commit includes many (internal) bugfixes and spec
+updates various people.
+
+Co-developed-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://lore.kernel.org/r/20230127123930.4fbc74582331.I3547481d49f958389f59dfeba3fcc75e72b0aa6e@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ include/net/mac80211.h     |   5 +-
+ net/mac80211/cfg.c         |   2 +-
+ net/mac80211/chan.c        |   2 +-
+ net/mac80211/ieee80211_i.h |   2 +-
+ net/mac80211/mlme.c        | 224 ++++++++++++++++++++++++++++++++++++-
+ 5 files changed, 228 insertions(+), 7 deletions(-)
+
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 3388cc7..8fb38c9 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -340,7 +340,7 @@ struct ieee80211_vif_chanctx_switch {
+  * @BSS_CHANGED_FILS_DISCOVERY: FILS discovery status changed.
+  * @BSS_CHANGED_UNSOL_BCAST_PROBE_RESP: Unsolicited broadcast probe response
+  *	status changed.
+- *
++ * @BSS_CHANGED_EHT_PUNCTURING: The channel puncturing bitmap changed.
+  */
+ enum ieee80211_bss_change {
+ 	BSS_CHANGED_ASSOC		= 1<<0,
+@@ -375,6 +375,7 @@ enum ieee80211_bss_change {
+ 	BSS_CHANGED_HE_BSS_COLOR	= 1<<29,
+ 	BSS_CHANGED_FILS_DISCOVERY      = 1<<30,
+ 	BSS_CHANGED_UNSOL_BCAST_PROBE_RESP = 1<<31,
++	BSS_CHANGED_EHT_PUNCTURING	= BIT_ULL(32),
+ 
+ 	/* when adding here, make sure to change ieee80211_reconfig */
+ };
+@@ -640,6 +641,7 @@ struct ieee80211_fils_discovery {
+  * @tx_pwr_env_num: number of @tx_pwr_env.
+  * @pwr_reduction: power constraint of BSS.
+  * @eht_support: does this BSS support EHT
++ * @eht_puncturing: bitmap to indicate which channels are punctured in this BSS
+  * @csa_active: marks whether a channel switch is going on. Internally it is
+  *	write-protected by sdata_lock and local->mtx so holding either is fine
+  *	for read access.
+@@ -739,6 +741,7 @@ struct ieee80211_bss_conf {
+ 	u8 tx_pwr_env_num;
+ 	u8 pwr_reduction;
+ 	bool eht_support;
++	u16 eht_puncturing;
+ 
+ 	bool csa_active;
+ 	bool mu_mimo_owner;
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 7a5e459..5bb43de 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4181,7 +4181,7 @@ static int ieee80211_set_ap_chanwidth(struct wiphy *wiphy,
+ 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ 	struct ieee80211_link_data *link;
+ 	int ret;
+-	u32 changed = 0;
++	u64 changed = 0;
+ 
+ 	link = sdata_dereference(sdata->link[link_id], sdata);
+ 
+diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
+index e72cf07..dbc34fb 100644
+--- a/net/mac80211/chan.c
++++ b/net/mac80211/chan.c
+@@ -1916,7 +1916,7 @@ int ieee80211_link_use_reserved_context(struct ieee80211_link_data *link)
+ 
+ int ieee80211_link_change_bandwidth(struct ieee80211_link_data *link,
+ 				    const struct cfg80211_chan_def *chandef,
+-				    u32 *changed)
++				    u64 *changed)
+ {
+ 	struct ieee80211_sub_if_data *sdata = link->sdata;
+ 	struct ieee80211_bss_conf *link_conf = link->conf;
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index a4fab9a..04128d5 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -2487,7 +2487,7 @@ int ieee80211_link_unreserve_chanctx(struct ieee80211_link_data *link);
+ int __must_check
+ ieee80211_link_change_bandwidth(struct ieee80211_link_data *link,
+ 				const struct cfg80211_chan_def *chandef,
+-				u32 *changed);
++				u64 *changed);
+ void ieee80211_link_release_channel(struct ieee80211_link_data *link);
+ void ieee80211_link_vlan_copy_chanctx(struct ieee80211_link_data *link);
+ void ieee80211_link_copy_chanctx_to_vlans(struct ieee80211_link_data *link,
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 0125b3e..8c69fd6 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -8,7 +8,7 @@
+  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+  * Copyright 2013-2014  Intel Mobile Communications GmbH
+  * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
+- * Copyright (C) 2018 - 2022 Intel Corporation
++ * Copyright (C) 2018 - 2023 Intel Corporation
+  */
+ 
+ #include <linux/delay.h>
+@@ -88,6 +88,141 @@ MODULE_PARM_DESC(probe_wait_ms,
+  */
+ #define IEEE80211_SIGNAL_AVE_MIN_COUNT	4
+ 
++struct ieee80211_per_bw_puncturing_values {
++	u8 len;
++	const u16 *valid_values;
++};
++
++static const u16 puncturing_values_80mhz[] = {
++	0x8, 0x4, 0x2, 0x1
++};
++
++static const u16 puncturing_values_160mhz[] = {
++	 0x80, 0x40, 0x20, 0x10, 0x8, 0x4, 0x2, 0x1, 0xc0, 0x30, 0xc, 0x3
++};
++
++static const u16 puncturing_values_320mhz[] = {
++	0xc000, 0x3000, 0xc00, 0x300, 0xc0, 0x30, 0xc, 0x3, 0xf000, 0xf00,
++	0xf0, 0xf, 0xfc00, 0xf300, 0xf0c0, 0xf030, 0xf00c, 0xf003, 0xc00f,
++	0x300f, 0xc0f, 0x30f, 0xcf, 0x3f
++};
++
++#define IEEE80211_PER_BW_VALID_PUNCTURING_VALUES(_bw) \
++	{ \
++		.len = ARRAY_SIZE(puncturing_values_ ## _bw ## mhz), \
++		.valid_values = puncturing_values_ ## _bw ## mhz \
++	}
++
++static const struct ieee80211_per_bw_puncturing_values per_bw_puncturing[] = {
++	IEEE80211_PER_BW_VALID_PUNCTURING_VALUES(80),
++	IEEE80211_PER_BW_VALID_PUNCTURING_VALUES(160),
++	IEEE80211_PER_BW_VALID_PUNCTURING_VALUES(320)
++};
++
++static bool ieee80211_valid_disable_subchannel_bitmap(u16 *bitmap,
++						      enum nl80211_chan_width bw)
++{
++	u32 idx, i;
++
++	switch (bw) {
++	case NL80211_CHAN_WIDTH_80:
++		idx = 0;
++		break;
++	case NL80211_CHAN_WIDTH_160:
++		idx = 1;
++		break;
++	case NL80211_CHAN_WIDTH_320:
++		idx = 2;
++		break;
++	default:
++		*bitmap = 0;
++		break;
++	}
++
++	if (!*bitmap)
++		return true;
++
++	for (i = 0; i < per_bw_puncturing[idx].len; i++)
++		if (per_bw_puncturing[idx].valid_values[i] == *bitmap)
++			return true;
++
++	return false;
++}
++
++/*
++ * Extract from the given disabled subchannel bitmap (raw format
++ * from the EHT Operation Element) the bits for the subchannel
++ * we're using right now.
++ */
++static u16
++ieee80211_extract_dis_subch_bmap(const struct ieee80211_eht_operation *eht_oper,
++				 struct cfg80211_chan_def *chandef, u16 bitmap)
++{
++	struct ieee80211_eht_operation_info *info = (void *)eht_oper->optional;
++	struct cfg80211_chan_def ap_chandef = *chandef;
++	u32 ap_center_freq, local_center_freq;
++	u32 ap_bw, local_bw;
++	int ap_start_freq, local_start_freq;
++	u16 shift, mask;
++
++	if (!(eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) ||
++	    !(eht_oper->params &
++	      IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT))
++		return 0;
++
++	/* set 160/320 supported to get the full AP definition */
++	ieee80211_chandef_eht_oper(eht_oper, true, true, &ap_chandef);
++	ap_center_freq = ap_chandef.center_freq1;
++	ap_bw = 20 * BIT(u8_get_bits(info->control,
++				     IEEE80211_EHT_OPER_CHAN_WIDTH));
++	ap_start_freq = ap_center_freq - ap_bw / 2;
++	local_center_freq = chandef->center_freq1;
++	local_bw = 20 * BIT(ieee80211_chan_width_to_rx_bw(chandef->width));
++	local_start_freq = local_center_freq - local_bw / 2;
++	shift = (local_start_freq - ap_start_freq) / 20;
++	mask = BIT(local_bw / 20) - 1;
++
++	return (bitmap >> shift) & mask;
++}
++
++/*
++ * Handle the puncturing bitmap, possibly downgrading bandwidth to get a
++ * valid bitmap.
++ */
++static void
++ieee80211_handle_puncturing_bitmap(struct ieee80211_link_data *link,
++				   const struct ieee80211_eht_operation *eht_oper,
++				   u16 bitmap, u64 *changed)
++{
++	struct cfg80211_chan_def *chandef = &link->conf->chandef;
++	u16 extracted;
++	u64 _changed = 0;
++
++	if (!changed)
++		changed = &_changed;
++
++	while (chandef->width > NL80211_CHAN_WIDTH_40) {
++		extracted =
++			ieee80211_extract_dis_subch_bmap(eht_oper, chandef,
++							 bitmap);
++
++		if (ieee80211_valid_disable_subchannel_bitmap(&bitmap,
++							      chandef->width))
++			break;
++		link->u.mgd.conn_flags |=
++			ieee80211_chandef_downgrade(chandef);
++		*changed |= BSS_CHANGED_BANDWIDTH;
++	}
++
++	if (chandef->width <= NL80211_CHAN_WIDTH_40)
++		extracted = 0;
++
++	if (link->conf->eht_puncturing != extracted) {
++		link->conf->eht_puncturing = extracted;
++		*changed |= BSS_CHANGED_EHT_PUNCTURING;
++	}
++}
++
+ /*
+  * We can have multiple work items (and connection probing)
+  * scheduling this timer, but we need to take care to only
+@@ -413,7 +548,7 @@ static int ieee80211_config_bw(struct ieee80211_link_data *link,
+ 			       const struct ieee80211_he_operation *he_oper,
+ 			       const struct ieee80211_eht_operation *eht_oper,
+ 			       const struct ieee80211_s1g_oper_ie *s1g_oper,
+-			       const u8 *bssid, u32 *changed)
++			       const u8 *bssid, u64 *changed)
+ {
+ 	struct ieee80211_sub_if_data *sdata = link->sdata;
+ 	struct ieee80211_local *local = sdata->local;
+@@ -4111,6 +4246,7 @@ static bool ieee80211_assoc_config_link(struct ieee80211_link_data *link,
+ 							    link_sta);
+ 
+ 			bss_conf->eht_support = link_sta->pub->eht_cap.has_eht;
++			*changed |= BSS_CHANGED_EHT_PUNCTURING;
+ 		} else {
+ 			bss_conf->eht_support = false;
+ 		}
+@@ -5423,6 +5559,45 @@ static bool ieee80211_rx_our_beacon(const u8 *tx_bssid,
+ 	return ether_addr_equal(tx_bssid, bss->transmitted_bss->bssid);
+ }
+ 
++static bool ieee80211_config_puncturing(struct ieee80211_link_data *link,
++					const struct ieee80211_eht_operation *eht_oper,
++					u64 *changed)
++{
++	u16 bitmap = 0, extracted;
++
++	if ((eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) &&
++	    (eht_oper->params &
++	     IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT)) {
++		const struct ieee80211_eht_operation_info *info =
++			(void *)eht_oper->optional;
++		const u8 *disable_subchannel_bitmap = info->optional;
++
++		bitmap = get_unaligned_le16(disable_subchannel_bitmap);
++	}
++
++	extracted = ieee80211_extract_dis_subch_bmap(eht_oper,
++						     &link->conf->chandef,
++						     bitmap);
++
++	/* accept if there are no changes */
++	if (!(*changed & BSS_CHANGED_BANDWIDTH) &&
++	    extracted == link->conf->eht_puncturing)
++		return true;
++
++	if (!ieee80211_valid_disable_subchannel_bitmap(&bitmap,
++						       link->conf->chandef.width)) {
++		link_info(link,
++			  "Got an invalid disable subchannel bitmap from AP %pM: bitmap = 0x%x, bw = 0x%x. disconnect\n",
++			  link->u.mgd.bssid,
++			  bitmap,
++			  link->conf->chandef.width);
++		return false;
++	}
++
++	ieee80211_handle_puncturing_bitmap(link, eht_oper, bitmap, changed);
++	return true;
++}
++
+ static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link,
+ 				     struct ieee80211_hdr *hdr, size_t len,
+ 				     struct ieee80211_rx_status *rx_status)
+@@ -5439,7 +5614,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link,
+ 	struct ieee80211_channel *chan;
+ 	struct link_sta_info *link_sta;
+ 	struct sta_info *sta;
+-	u32 changed = 0;
++	u64 changed = 0;
+ 	bool erp_valid;
+ 	u8 erp_value = 0;
+ 	u32 ncrc = 0;
+@@ -5731,6 +5906,21 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link,
+ 					       elems->pwr_constr_elem,
+ 					       elems->cisco_dtpc_elem);
+ 
++	if (elems->eht_operation &&
++	    !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_EHT)) {
++		if (!ieee80211_config_puncturing(link, elems->eht_operation,
++						 &changed)) {
++			ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
++					       WLAN_REASON_DEAUTH_LEAVING,
++					       true, deauth_buf);
++			ieee80211_report_disconnect(sdata, deauth_buf,
++						    sizeof(deauth_buf), true,
++						    WLAN_REASON_DEAUTH_LEAVING,
++						    false);
++			goto free;
++		}
++	}
++
+ 	ieee80211_link_info_change_notify(sdata, link, changed);
+ free:
+ 	kfree(elems);
+@@ -6832,9 +7022,12 @@ ieee80211_setup_assoc_link(struct ieee80211_sub_if_data *sdata,
+ 		ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
+ 	}
+ 
++	link->conf->eht_puncturing = 0;
++
+ 	rcu_read_lock();
+ 	beacon_ies = rcu_dereference(cbss->beacon_ies);
+ 	if (beacon_ies) {
++		const struct ieee80211_eht_operation *eht_oper;
+ 		const struct element *elem;
+ 		u8 dtim_count = 0;
+ 
+@@ -6863,6 +7056,31 @@ ieee80211_setup_assoc_link(struct ieee80211_sub_if_data *sdata,
+ 			link->conf->ema_ap = true;
+ 		else
+ 			link->conf->ema_ap = false;
++
++		elem = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION,
++					      beacon_ies->data, beacon_ies->len);
++		eht_oper = (const void *)(elem->data + 1);
++
++		if (elem &&
++		    ieee80211_eht_oper_size_ok((const void *)(elem->data + 1),
++					       elem->datalen - 1) &&
++		    (eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) &&
++		    (eht_oper->params & IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT)) {
++			const struct ieee80211_eht_operation_info *info =
++				(void *)eht_oper->optional;
++			const u8 *disable_subchannel_bitmap = info->optional;
++			u16 bitmap;
++
++			bitmap = get_unaligned_le16(disable_subchannel_bitmap);
++			if (ieee80211_valid_disable_subchannel_bitmap(&bitmap,
++								      link->conf->chandef.width))
++				ieee80211_handle_puncturing_bitmap(link,
++								   eht_oper,
++								   bitmap,
++								   NULL);
++			else
++				conn_flags |= IEEE80211_CONN_DISABLE_EHT;
++		}
+ 	}
+ 	rcu_read_unlock();
+ 
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0005-wifi-cfg80211-move-puncturing-bitmap-validation-from.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0005-wifi-cfg80211-move-puncturing-bitmap-validation-from.patch
new file mode 100644
index 0000000..2a7cd07
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0005-wifi-cfg80211-move-puncturing-bitmap-validation-from.patch
@@ -0,0 +1,228 @@
+From 40e52a97b1bc7b280198cb63e11663d784bd48c8 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Mon, 30 Jan 2023 16:12:24 -0800
+Subject: [PATCH 5/9] wifi: cfg80211: move puncturing bitmap validation from
+ mac80211
+
+- Move ieee80211_valid_disable_subchannel_bitmap() from mlme.c to
+  chan.c, rename it as cfg80211_valid_disable_subchannel_bitmap()
+  and export it.
+- Modify the prototype to include struct cfg80211_chan_def instead
+  of only bandwidth to support a check which returns false if the
+  primary channel is punctured.
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Link: https://lore.kernel.org/r/20230131001227.25014-2-quic_alokad@quicinc.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ include/net/cfg80211.h | 12 +++++++
+ net/mac80211/mlme.c    | 73 ++++--------------------------------------
+ net/wireless/chan.c    | 69 +++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 87 insertions(+), 67 deletions(-)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 9420086..d532612 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -8948,4 +8948,16 @@ static inline int cfg80211_color_change_notify(struct net_device *dev)
+ 					 0, 0);
+ }
+ 
++/**
++ * cfg80211_valid_disable_subchannel_bitmap - validate puncturing bitmap
++ * @bitmap: bitmap to be validated
++ * @chandef: channel definition
++ *
++ * Validate the puncturing bitmap.
++ *
++ * Return: %true if the bitmap is valid. %false otherwise.
++ */
++bool cfg80211_valid_disable_subchannel_bitmap(u16 *bitmap,
++					      const struct cfg80211_chan_def *chandef);
++
+ #endif /* __NET_CFG80211_H */
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 8c69fd6..2716ae0 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -88,67 +88,6 @@ MODULE_PARM_DESC(probe_wait_ms,
+  */
+ #define IEEE80211_SIGNAL_AVE_MIN_COUNT	4
+ 
+-struct ieee80211_per_bw_puncturing_values {
+-	u8 len;
+-	const u16 *valid_values;
+-};
+-
+-static const u16 puncturing_values_80mhz[] = {
+-	0x8, 0x4, 0x2, 0x1
+-};
+-
+-static const u16 puncturing_values_160mhz[] = {
+-	 0x80, 0x40, 0x20, 0x10, 0x8, 0x4, 0x2, 0x1, 0xc0, 0x30, 0xc, 0x3
+-};
+-
+-static const u16 puncturing_values_320mhz[] = {
+-	0xc000, 0x3000, 0xc00, 0x300, 0xc0, 0x30, 0xc, 0x3, 0xf000, 0xf00,
+-	0xf0, 0xf, 0xfc00, 0xf300, 0xf0c0, 0xf030, 0xf00c, 0xf003, 0xc00f,
+-	0x300f, 0xc0f, 0x30f, 0xcf, 0x3f
+-};
+-
+-#define IEEE80211_PER_BW_VALID_PUNCTURING_VALUES(_bw) \
+-	{ \
+-		.len = ARRAY_SIZE(puncturing_values_ ## _bw ## mhz), \
+-		.valid_values = puncturing_values_ ## _bw ## mhz \
+-	}
+-
+-static const struct ieee80211_per_bw_puncturing_values per_bw_puncturing[] = {
+-	IEEE80211_PER_BW_VALID_PUNCTURING_VALUES(80),
+-	IEEE80211_PER_BW_VALID_PUNCTURING_VALUES(160),
+-	IEEE80211_PER_BW_VALID_PUNCTURING_VALUES(320)
+-};
+-
+-static bool ieee80211_valid_disable_subchannel_bitmap(u16 *bitmap,
+-						      enum nl80211_chan_width bw)
+-{
+-	u32 idx, i;
+-
+-	switch (bw) {
+-	case NL80211_CHAN_WIDTH_80:
+-		idx = 0;
+-		break;
+-	case NL80211_CHAN_WIDTH_160:
+-		idx = 1;
+-		break;
+-	case NL80211_CHAN_WIDTH_320:
+-		idx = 2;
+-		break;
+-	default:
+-		*bitmap = 0;
+-		break;
+-	}
+-
+-	if (!*bitmap)
+-		return true;
+-
+-	for (i = 0; i < per_bw_puncturing[idx].len; i++)
+-		if (per_bw_puncturing[idx].valid_values[i] == *bitmap)
+-			return true;
+-
+-	return false;
+-}
+-
+ /*
+  * Extract from the given disabled subchannel bitmap (raw format
+  * from the EHT Operation Element) the bits for the subchannel
+@@ -206,8 +145,8 @@ ieee80211_handle_puncturing_bitmap(struct ieee80211_link_data *link,
+ 			ieee80211_extract_dis_subch_bmap(eht_oper, chandef,
+ 							 bitmap);
+ 
+-		if (ieee80211_valid_disable_subchannel_bitmap(&bitmap,
+-							      chandef->width))
++		if (cfg80211_valid_disable_subchannel_bitmap(&bitmap,
++							     chandef))
+ 			break;
+ 		link->u.mgd.conn_flags |=
+ 			ieee80211_chandef_downgrade(chandef);
+@@ -5584,8 +5523,8 @@ static bool ieee80211_config_puncturing(struct ieee80211_link_data *link,
+ 	    extracted == link->conf->eht_puncturing)
+ 		return true;
+ 
+-	if (!ieee80211_valid_disable_subchannel_bitmap(&bitmap,
+-						       link->conf->chandef.width)) {
++	if (!cfg80211_valid_disable_subchannel_bitmap(&bitmap,
++						      &link->conf->chandef)) {
+ 		link_info(link,
+ 			  "Got an invalid disable subchannel bitmap from AP %pM: bitmap = 0x%x, bw = 0x%x. disconnect\n",
+ 			  link->u.mgd.bssid,
+@@ -7072,8 +7011,8 @@ ieee80211_setup_assoc_link(struct ieee80211_sub_if_data *sdata,
+ 			u16 bitmap;
+ 
+ 			bitmap = get_unaligned_le16(disable_subchannel_bitmap);
+-			if (ieee80211_valid_disable_subchannel_bitmap(&bitmap,
+-								      link->conf->chandef.width))
++			if (cfg80211_valid_disable_subchannel_bitmap(&bitmap,
++								     &link->conf->chandef))
+ 				ieee80211_handle_puncturing_bitmap(link,
+ 								   eht_oper,
+ 								   bitmap,
+diff --git a/net/wireless/chan.c b/net/wireless/chan.c
+index 29b5c2f..d5ed976 100644
+--- a/net/wireless/chan.c
++++ b/net/wireless/chan.c
+@@ -1460,3 +1460,72 @@ struct cfg80211_chan_def *wdev_chandef(struct wireless_dev *wdev,
+ 	}
+ }
+ EXPORT_SYMBOL(wdev_chandef);
++
++struct cfg80211_per_bw_puncturing_values {
++	u8 len;
++	const u16 *valid_values;
++};
++
++static const u16 puncturing_values_80mhz[] = {
++	0x8, 0x4, 0x2, 0x1
++};
++
++static const u16 puncturing_values_160mhz[] = {
++	 0x80, 0x40, 0x20, 0x10, 0x8, 0x4, 0x2, 0x1, 0xc0, 0x30, 0xc, 0x3
++};
++
++static const u16 puncturing_values_320mhz[] = {
++	0xc000, 0x3000, 0xc00, 0x300, 0xc0, 0x30, 0xc, 0x3, 0xf000, 0xf00,
++	0xf0, 0xf, 0xfc00, 0xf300, 0xf0c0, 0xf030, 0xf00c, 0xf003, 0xc00f,
++	0x300f, 0xc0f, 0x30f, 0xcf, 0x3f
++};
++
++#define CFG80211_PER_BW_VALID_PUNCTURING_VALUES(_bw) \
++	{ \
++		.len = ARRAY_SIZE(puncturing_values_ ## _bw ## mhz), \
++		.valid_values = puncturing_values_ ## _bw ## mhz \
++	}
++
++static const struct cfg80211_per_bw_puncturing_values per_bw_puncturing[] = {
++	CFG80211_PER_BW_VALID_PUNCTURING_VALUES(80),
++	CFG80211_PER_BW_VALID_PUNCTURING_VALUES(160),
++	CFG80211_PER_BW_VALID_PUNCTURING_VALUES(320)
++};
++
++bool cfg80211_valid_disable_subchannel_bitmap(u16 *bitmap,
++					      const struct cfg80211_chan_def *chandef)
++{
++	u32 idx, i, start_freq;
++
++	switch (chandef->width) {
++	case NL80211_CHAN_WIDTH_80:
++		idx = 0;
++		start_freq = chandef->center_freq1 - 40;
++		break;
++	case NL80211_CHAN_WIDTH_160:
++		idx = 1;
++		start_freq = chandef->center_freq1 - 80;
++		break;
++	case NL80211_CHAN_WIDTH_320:
++		idx = 2;
++		start_freq = chandef->center_freq1 - 160;
++		break;
++	default:
++		*bitmap = 0;
++		break;
++	}
++
++	if (!*bitmap)
++		return true;
++
++	/* check if primary channel is punctured */
++	if (*bitmap & (u16)BIT((chandef->chan->center_freq - start_freq) / 20))
++		return false;
++
++	for (i = 0; i < per_bw_puncturing[idx].len; i++)
++		if (per_bw_puncturing[idx].valid_values[i] == *bitmap)
++			return true;
++
++	return false;
++}
++EXPORT_SYMBOL(cfg80211_valid_disable_subchannel_bitmap);
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0006-wifi-nl80211-validate-and-configure-puncturing-bitma.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0006-wifi-nl80211-validate-and-configure-puncturing-bitma.patch
new file mode 100644
index 0000000..75fe1bb
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0006-wifi-nl80211-validate-and-configure-puncturing-bitma.patch
@@ -0,0 +1,178 @@
+From 63bd8cc91635ad129587df0227be49074538b36e Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Mon, 30 Jan 2023 16:12:25 -0800
+Subject: [PATCH 6/9] wifi: nl80211: validate and configure puncturing bitmap
+
+- New feature flag, NL80211_EXT_FEATURE_PUNCT, to advertise
+  driver support for preamble puncturing in AP mode.
+- New attribute, NL80211_ATTR_PUNCT_BITMAP, to receive a puncturing
+  bitmap from the userspace during AP bring up (NL80211_CMD_START_AP)
+  and channel switch (NL80211_CMD_CHANNEL_SWITCH) operations. Each bit
+  corresponds to a 20 MHz channel in the operating bandwidth, lowest
+  bit for the lowest channel. Bit set to 1 indicates that the channel
+  is punctured. Higher 16 bits are reserved.
+- New members added to structures cfg80211_ap_settings and
+  cfg80211_csa_settings to propagate the bitmap to the driver after
+  validation.
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Link: https://lore.kernel.org/r/20230131001227.25014-3-quic_alokad@quicinc.com
+[move validation against 0xffff into policy]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ include/net/cfg80211.h       |  8 ++++++++
+ include/uapi/linux/nl80211.h | 11 +++++++++++
+ net/wireless/nl80211.c       | 32 ++++++++++++++++++++++++++++++++
+ 3 files changed, 51 insertions(+)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index d532612..9c65eda 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -1327,6 +1327,9 @@ struct cfg80211_unsol_bcast_probe_resp {
+  * @fils_discovery: FILS discovery transmission parameters
+  * @unsol_bcast_probe_resp: Unsolicited broadcast probe response parameters
+  * @mbssid_config: AP settings for multiple bssid
++ * @punct_bitmap: Preamble puncturing bitmap. Each bit represents
++ *	a 20 MHz channel, lowest bit corresponding to the lowest channel.
++ *	Bit set to 1 indicates that the channel is punctured.
+  */
+ struct cfg80211_ap_settings {
+ 	struct cfg80211_chan_def chandef;
+@@ -1361,6 +1364,7 @@ struct cfg80211_ap_settings {
+ 	struct cfg80211_fils_discovery fils_discovery;
+ 	struct cfg80211_unsol_bcast_probe_resp unsol_bcast_probe_resp;
+ 	struct cfg80211_mbssid_config mbssid_config;
++	u16 punct_bitmap;
+ };
+ 
+ /**
+@@ -1378,6 +1382,9 @@ struct cfg80211_ap_settings {
+  * @radar_required: whether radar detection is required on the new channel
+  * @block_tx: whether transmissions should be blocked while changing
+  * @count: number of beacons until switch
++ * @punct_bitmap: Preamble puncturing bitmap. Each bit represents
++ *	a 20 MHz channel, lowest bit corresponding to the lowest channel.
++ *	Bit set to 1 indicates that the channel is punctured.
+  */
+ struct cfg80211_csa_settings {
+ 	struct cfg80211_chan_def chandef;
+@@ -1390,6 +1397,7 @@ struct cfg80211_csa_settings {
+ 	bool radar_required;
+ 	bool block_tx;
+ 	u8 count;
++	u16 punct_bitmap;
+ };
+ 
+ /**
+diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
+index c14a91b..173aef8 100644
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -2751,6 +2751,12 @@ enum nl80211_commands {
+  *	the incoming frame RX timestamp.
+  * @NL80211_ATTR_TD_BITMAP: Transition Disable bitmap, for subsequent
+  *	(re)associations.
++ *
++ * @NL80211_ATTR_PUNCT_BITMAP: (u32) Preamble puncturing bitmap, lowest
++ *	bit corresponds to the lowest 20 MHz channel. Each bit set to 1
++ *	indicates that the sub-channel is punctured. Higher 16 bits are
++ *	reserved.
++ *
+  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
+  * @NL80211_ATTR_MAX: highest attribute number currently defined
+  * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -3280,6 +3286,8 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_RX_HW_TIMESTAMP,
+ 	NL80211_ATTR_TD_BITMAP,
+ 
++	NL80211_ATTR_PUNCT_BITMAP,
++
+ 	/* add attributes here, update the policy in nl80211.c */
+ 
+ 	__NL80211_ATTR_AFTER_LAST,
+@@ -6294,6 +6302,8 @@ enum nl80211_feature_flags {
+  *	might apply, e.g. no scans in progress, no offchannel operations
+  *	in progress, and no active connections.
+  *
++ * @NL80211_EXT_FEATURE_PUNCT: Driver supports preamble puncturing in AP mode.
++ *
+  * @NUM_NL80211_EXT_FEATURES: number of extended features.
+  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
+  */
+@@ -6362,6 +6372,7 @@ enum nl80211_ext_feature_index {
+ 	NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD,
+ 	NL80211_EXT_FEATURE_RADAR_BACKGROUND,
+ 	NL80211_EXT_FEATURE_POWERED_ADDR_CHANGE,
++	NL80211_EXT_FEATURE_PUNCT,
+ 
+ 	/* add new features before the definition below */
+ 	NUM_NL80211_EXT_FEATURES,
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 6a97e52..4cc095d 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -799,6 +799,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ 	[NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
+ 	[NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
+ 	[NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
++	[NL80211_ATTR_PUNCT_BITMAP] = NLA_POLICY_RANGE(NLA_U8, 0, 0xffff),
+ };
+ 
+ /* policy for the key attributes */
+@@ -3167,6 +3168,21 @@ static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
+ 		wdev->iftype == NL80211_IFTYPE_P2P_GO;
+ }
+ 
++static int nl80211_parse_punct_bitmap(struct cfg80211_registered_device *rdev,
++				      struct genl_info *info,
++				      const struct cfg80211_chan_def *chandef,
++				      u16 *punct_bitmap)
++{
++	if (!wiphy_ext_feature_isset(&rdev->wiphy, NL80211_EXT_FEATURE_PUNCT))
++		return -EINVAL;
++
++	*punct_bitmap = nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]);
++	if (!cfg80211_valid_disable_subchannel_bitmap(punct_bitmap, chandef))
++		return -EINVAL;
++
++	return 0;
++}
++
+ int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
+ 			  struct genl_info *info,
+ 			  struct cfg80211_chan_def *chandef)
+@@ -5912,6 +5928,14 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
+ 		goto out;
+ 	}
+ 
++	if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
++		err = nl80211_parse_punct_bitmap(rdev, info,
++						 &params->chandef,
++						 &params->punct_bitmap);
++		if (err)
++			goto out;
++	}
++
+ 	if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params->chandef,
+ 					   wdev->iftype)) {
+ 		err = -EINVAL;
+@@ -10050,6 +10074,14 @@ skip_beacons:
+ 	if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
+ 		params.block_tx = true;
+ 
++	if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
++		err = nl80211_parse_punct_bitmap(rdev, info,
++						 &params.chandef,
++						 &params.punct_bitmap);
++		if (err)
++			goto free;
++	}
++
+ 	wdev_lock(wdev);
+ 	err = rdev_channel_switch(rdev, dev, &params);
+ 	wdev_unlock(wdev);
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0007-wifi-cfg80211-include-puncturing-bitmap-in-channel-s.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0007-wifi-cfg80211-include-puncturing-bitmap-in-channel-s.patch
new file mode 100644
index 0000000..73498f0
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0007-wifi-cfg80211-include-puncturing-bitmap-in-channel-s.patch
@@ -0,0 +1,282 @@
+From a0306fbf2adb7074815390d6adbe58fb72533556 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Mon, 30 Jan 2023 16:12:26 -0800
+Subject: [PATCH 7/9] wifi: cfg80211: include puncturing bitmap in channel
+ switch events
+
+Add puncturing bitmap in channel switch notifications
+and corresponding trace functions.
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Link: https://lore.kernel.org/r/20230131001227.25014-4-quic_alokad@quicinc.com
+[fix qtnfmac]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ drivers/net/wireless/ath/ath6kl/cfg80211.c    |  2 +-
+ drivers/net/wireless/marvell/mwifiex/11h.c    |  2 +-
+ .../net/wireless/quantenna/qtnfmac/event.c    |  2 +-
+ include/net/cfg80211.h                        |  6 +++--
+ net/mac80211/cfg.c                            |  5 ++--
+ net/mac80211/mlme.c                           |  4 ++--
+ net/wireless/nl80211.c                        | 20 ++++++++++------
+ net/wireless/trace.h                          | 24 ++++++++++++-------
+ 8 files changed, 41 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+index 07de0bd..576c449 100644
+--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+@@ -1119,7 +1119,7 @@ void ath6kl_cfg80211_ch_switch_notify(struct ath6kl_vif *vif, int freq,
+ 					NL80211_CHAN_HT20 : NL80211_CHAN_NO_HT);
+ 
+ 	mutex_lock(&vif->wdev.mtx);
+-	cfg80211_ch_switch_notify(vif->ndev, &chandef, 0);
++	cfg80211_ch_switch_notify(vif->ndev, &chandef, 0, 0);
+ 	mutex_unlock(&vif->wdev.mtx);
+ }
+ 
+diff --git a/drivers/net/wireless/marvell/mwifiex/11h.c b/drivers/net/wireless/marvell/mwifiex/11h.c
+index 6a9d7bc..b0c40a7 100644
+--- a/drivers/net/wireless/marvell/mwifiex/11h.c
++++ b/drivers/net/wireless/marvell/mwifiex/11h.c
+@@ -292,6 +292,6 @@ void mwifiex_dfs_chan_sw_work_queue(struct work_struct *work)
+ 	mwifiex_dbg(priv->adapter, MSG,
+ 		    "indicating channel switch completion to kernel\n");
+ 	mutex_lock(&priv->wdev.mtx);
+-	cfg80211_ch_switch_notify(priv->netdev, &priv->dfs_chandef, 0);
++	cfg80211_ch_switch_notify(priv->netdev, &priv->dfs_chandef, 0, 0);
+ 	mutex_unlock(&priv->wdev.mtx);
+ }
+diff --git a/drivers/net/wireless/quantenna/qtnfmac/event.c b/drivers/net/wireless/quantenna/qtnfmac/event.c
+index 4fafe37..0e336ff 100644
+--- a/drivers/net/wireless/quantenna/qtnfmac/event.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/event.c
+@@ -478,7 +478,7 @@ qtnf_event_handle_freq_change(struct qtnf_wmac *mac,
+ 			continue;
+ 
+ 		mutex_lock(&vif->wdev.mtx);
+-		cfg80211_ch_switch_notify(vif->netdev, &chandef, 0);
++		cfg80211_ch_switch_notify(vif->netdev, &chandef, 0, 0);
+ 		mutex_unlock(&vif->wdev.mtx);
+ 	}
+ 
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 9c65eda..8d72357 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -8322,13 +8322,14 @@ bool cfg80211_reg_can_beacon_relax(struct wiphy *wiphy,
+  * @dev: the device which switched channels
+  * @chandef: the new channel definition
+  * @link_id: the link ID for MLO, must be 0 for non-MLO
++ * @punct_bitmap: the new puncturing bitmap
+  *
+  * Caller must acquire wdev_lock, therefore must only be called from sleepable
+  * driver context!
+  */
+ void cfg80211_ch_switch_notify(struct net_device *dev,
+ 			       struct cfg80211_chan_def *chandef,
+-			       unsigned int link_id);
++			       unsigned int link_id, u16 punct_bitmap);
+ 
+ /*
+  * cfg80211_ch_switch_started_notify - notify channel switch start
+@@ -8337,6 +8338,7 @@ void cfg80211_ch_switch_notify(struct net_device *dev,
+  * @link_id: the link ID for MLO, must be 0 for non-MLO
+  * @count: the number of TBTTs until the channel switch happens
+  * @quiet: whether or not immediate quiet was requested by the AP
++ * @punct_bitmap: the future puncturing bitmap
+  *
+  * Inform the userspace about the channel switch that has just
+  * started, so that it can take appropriate actions (eg. starting
+@@ -8345,7 +8347,7 @@ void cfg80211_ch_switch_notify(struct net_device *dev,
+ void cfg80211_ch_switch_started_notify(struct net_device *dev,
+ 				       struct cfg80211_chan_def *chandef,
+ 				       unsigned int link_id, u8 count,
+-				       bool quiet);
++				       bool quiet, u16 punct_bitmap);
+ 
+ /**
+  * ieee80211_operating_class_to_band - convert operating class to band
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 5bb43de..17d1e71 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -3597,7 +3597,8 @@ static int __ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
+ 	if (err)
+ 		return err;
+ 
+-	cfg80211_ch_switch_notify(sdata->dev, &sdata->deflink.csa_chandef, 0);
++	cfg80211_ch_switch_notify(sdata->dev, &sdata->deflink.csa_chandef, 0,
++				  0);
+ 
+ 	return 0;
+ }
+@@ -3869,7 +3870,7 @@ __ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+ 
+ 	cfg80211_ch_switch_started_notify(sdata->dev,
+ 					  &sdata->deflink.csa_chandef, 0,
+-					  params->count, params->block_tx);
++					  params->count, params->block_tx, 0);
+ 
+ 	if (changed) {
+ 		ieee80211_link_info_change_notify(sdata, &sdata->deflink,
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 2716ae0..d63434b 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1778,7 +1778,7 @@ static void ieee80211_chswitch_post_beacon(struct ieee80211_link_data *link)
+ 		return;
+ 	}
+ 
+-	cfg80211_ch_switch_notify(sdata->dev, &link->reserved_chandef, 0);
++	cfg80211_ch_switch_notify(sdata->dev, &link->reserved_chandef, 0, 0);
+ }
+ 
+ void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
+@@ -1988,7 +1988,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_link_data *link,
+ 	mutex_unlock(&local->mtx);
+ 
+ 	cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef, 0,
+-					  csa_ie.count, csa_ie.mode);
++					  csa_ie.count, csa_ie.mode, 0);
+ 
+ 	if (local->ops->channel_switch) {
+ 		/* use driver's channel switch callback */
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 4cc095d..f3b2fc4 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -18973,7 +18973,7 @@ static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
+ 				     struct cfg80211_chan_def *chandef,
+ 				     gfp_t gfp,
+ 				     enum nl80211_commands notif,
+-				     u8 count, bool quiet)
++				     u8 count, bool quiet, u16 punct_bitmap)
+ {
+ 	struct wireless_dev *wdev = netdev->ieee80211_ptr;
+ 	struct sk_buff *msg;
+@@ -19007,6 +19007,9 @@ static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
+ 			goto nla_put_failure;
+ 	}
+ 
++	if (nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, punct_bitmap))
++		goto nla_put_failure;
++
+ 	genlmsg_end(msg, hdr);
+ 
+ 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+@@ -19019,7 +19022,7 @@ static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
+ 
+ void cfg80211_ch_switch_notify(struct net_device *dev,
+ 			       struct cfg80211_chan_def *chandef,
+-			       unsigned int link_id)
++			       unsigned int link_id, u16 punct_bitmap)
+ {
+ 	struct wireless_dev *wdev = dev->ieee80211_ptr;
+ 	struct wiphy *wiphy = wdev->wiphy;
+@@ -19028,7 +19031,7 @@ void cfg80211_ch_switch_notify(struct net_device *dev,
+ 	ASSERT_WDEV_LOCK(wdev);
+ 	WARN_INVALID_LINK_ID(wdev, link_id);
+ 
+-	trace_cfg80211_ch_switch_notify(dev, chandef, link_id);
++	trace_cfg80211_ch_switch_notify(dev, chandef, link_id, punct_bitmap);
+ 
+ 	switch (wdev->iftype) {
+ 	case NL80211_IFTYPE_STATION:
+@@ -19056,14 +19059,15 @@ void cfg80211_ch_switch_notify(struct net_device *dev,
+ 	cfg80211_sched_dfs_chan_update(rdev);
+ 
+ 	nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
+-				 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false);
++				 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false,
++				 punct_bitmap);
+ }
+ EXPORT_SYMBOL(cfg80211_ch_switch_notify);
+ 
+ void cfg80211_ch_switch_started_notify(struct net_device *dev,
+ 				       struct cfg80211_chan_def *chandef,
+ 				       unsigned int link_id, u8 count,
+-				       bool quiet)
++				       bool quiet, u16 punct_bitmap)
+ {
+ 	struct wireless_dev *wdev = dev->ieee80211_ptr;
+ 	struct wiphy *wiphy = wdev->wiphy;
+@@ -19072,11 +19076,13 @@ void cfg80211_ch_switch_started_notify(struct net_device *dev,
+ 	ASSERT_WDEV_LOCK(wdev);
+ 	WARN_INVALID_LINK_ID(wdev, link_id);
+ 
+-	trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id);
++	trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id,
++						punct_bitmap);
++
+ 
+ 	nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
+ 				 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
+-				 count, quiet);
++				 count, quiet, punct_bitmap);
+ }
+ EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
+ 
+diff --git a/net/wireless/trace.h b/net/wireless/trace.h
+index 8e7c00f..4a7d0ae 100644
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -3245,39 +3245,47 @@ TRACE_EVENT(cfg80211_chandef_dfs_required,
+ TRACE_EVENT(cfg80211_ch_switch_notify,
+ 	TP_PROTO(struct net_device *netdev,
+ 		 struct cfg80211_chan_def *chandef,
+-		 unsigned int link_id),
+-	TP_ARGS(netdev, chandef, link_id),
++		 unsigned int link_id,
++		 u16 punct_bitmap),
++	TP_ARGS(netdev, chandef, link_id, punct_bitmap),
+ 	TP_STRUCT__entry(
+ 		NETDEV_ENTRY
+ 		CHAN_DEF_ENTRY
+ 		__field(unsigned int, link_id)
++		__field(u16, punct_bitmap)
+ 	),
+ 	TP_fast_assign(
+ 		NETDEV_ASSIGN;
+ 		CHAN_DEF_ASSIGN(chandef);
+ 		__entry->link_id = link_id;
++		__entry->punct_bitmap = punct_bitmap;
+ 	),
+-	TP_printk(NETDEV_PR_FMT ", " CHAN_DEF_PR_FMT ", link:%d",
+-		  NETDEV_PR_ARG, CHAN_DEF_PR_ARG, __entry->link_id)
++	TP_printk(NETDEV_PR_FMT ", " CHAN_DEF_PR_FMT ", link:%d, punct_bitmap:%u",
++		  NETDEV_PR_ARG, CHAN_DEF_PR_ARG, __entry->link_id,
++		  __entry->punct_bitmap)
+ );
+ 
+ TRACE_EVENT(cfg80211_ch_switch_started_notify,
+ 	TP_PROTO(struct net_device *netdev,
+ 		 struct cfg80211_chan_def *chandef,
+-		 unsigned int link_id),
+-	TP_ARGS(netdev, chandef, link_id),
++		 unsigned int link_id,
++		 u16 punct_bitmap),
++	TP_ARGS(netdev, chandef, link_id, punct_bitmap),
+ 	TP_STRUCT__entry(
+ 		NETDEV_ENTRY
+ 		CHAN_DEF_ENTRY
+ 		__field(unsigned int, link_id)
++		__field(u16, punct_bitmap)
+ 	),
+ 	TP_fast_assign(
+ 		NETDEV_ASSIGN;
+ 		CHAN_DEF_ASSIGN(chandef);
+ 		__entry->link_id = link_id;
++		__entry->punct_bitmap = punct_bitmap;
+ 	),
+-	TP_printk(NETDEV_PR_FMT ", " CHAN_DEF_PR_FMT ", link:%d",
+-		  NETDEV_PR_ARG, CHAN_DEF_PR_ARG, __entry->link_id)
++	TP_printk(NETDEV_PR_FMT ", " CHAN_DEF_PR_FMT ", link:%d, punct_bitmap:%u",
++		  NETDEV_PR_ARG, CHAN_DEF_PR_ARG, __entry->link_id,
++		  __entry->punct_bitmap)
+ );
+ 
+ TRACE_EVENT(cfg80211_radar_event,
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0008-wifi-mac80211-configure-puncturing-bitmap.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0008-wifi-mac80211-configure-puncturing-bitmap.patch
new file mode 100644
index 0000000..80c4b61
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0008-wifi-mac80211-configure-puncturing-bitmap.patch
@@ -0,0 +1,114 @@
+From b5bdd1f773d65d640844f4b8a3e63c25057f1b46 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Mon, 30 Jan 2023 16:12:27 -0800
+Subject: [PATCH 8/9] wifi: mac80211: configure puncturing bitmap
+
+- Configure the bitmap in link_conf and notify the driver.
+- Modify 'change' in ieee80211_start_ap() from u32 to u64 to support
+BSS_CHANGED_EHT_PUNCTURING.
+- Propagate the bitmap in channel switch events to userspace.
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Link: https://lore.kernel.org/r/20230131001227.25014-5-quic_alokad@quicinc.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ include/net/mac80211.h |  3 +++
+ net/mac80211/cfg.c     | 22 +++++++++++++++++++---
+ 2 files changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 8fb38c9..c4ff6a3 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -645,6 +645,7 @@ struct ieee80211_fils_discovery {
+  * @csa_active: marks whether a channel switch is going on. Internally it is
+  *	write-protected by sdata_lock and local->mtx so holding either is fine
+  *	for read access.
++ * @csa_punct_bitmap: new puncturing bitmap for channel switch
+  * @mu_mimo_owner: indicates interface owns MU-MIMO capability
+  * @chanctx_conf: The channel context this interface is assigned to, or %NULL
+  *	when it is not assigned. This pointer is RCU-protected due to the TX
+@@ -744,6 +745,8 @@ struct ieee80211_bss_conf {
+ 	u16 eht_puncturing;
+ 
+ 	bool csa_active;
++	u16 csa_punct_bitmap;
++
+ 	bool mu_mimo_owner;
+ 	struct ieee80211_chanctx_conf __rcu *chanctx_conf;
+ 
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 17d1e71..6defc1d 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1220,7 +1220,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct beacon_data *old;
+ 	struct ieee80211_sub_if_data *vlan;
+-	u32 changed = BSS_CHANGED_BEACON_INT |
++	u64 changed = BSS_CHANGED_BEACON_INT |
+ 		      BSS_CHANGED_BEACON_ENABLED |
+ 		      BSS_CHANGED_BEACON |
+ 		      BSS_CHANGED_P2P_PS |
+@@ -1307,6 +1307,11 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
+ 				IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO;
+ 	}
+ 
++	if (params->eht_cap) {
++		link_conf->eht_puncturing = params->punct_bitmap;
++		changed |= BSS_CHANGED_EHT_PUNCTURING;
++	}
++
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP &&
+ 	    params->mbssid_config.tx_wdev) {
+ 		err = ieee80211_set_ap_mbssid_options(sdata,
+@@ -3556,6 +3561,12 @@ static int __ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
+ 	lockdep_assert_held(&local->mtx);
+ 	lockdep_assert_held(&local->chanctx_mtx);
+ 
++	if (sdata->vif.bss_conf.eht_puncturing != sdata->vif.bss_conf.csa_punct_bitmap) {
++		sdata->vif.bss_conf.eht_puncturing =
++					sdata->vif.bss_conf.csa_punct_bitmap;
++		changed |= BSS_CHANGED_EHT_PUNCTURING;
++	}
++
+ 	/*
+ 	 * using reservation isn't immediate as it may be deferred until later
+ 	 * with multi-vif. once reservation is complete it will re-schedule the
+@@ -3598,7 +3609,7 @@ static int __ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
+ 		return err;
+ 
+ 	cfg80211_ch_switch_notify(sdata->dev, &sdata->deflink.csa_chandef, 0,
+-				  0);
++				  sdata->vif.bss_conf.eht_puncturing);
+ 
+ 	return 0;
+ }
+@@ -3860,9 +3871,13 @@ __ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+ 		goto out;
+ 	}
+ 
++	if (params->punct_bitmap && !sdata->vif.bss_conf.eht_support)
++		goto out;
++
+ 	sdata->deflink.csa_chandef = params->chandef;
+ 	sdata->deflink.csa_block_tx = params->block_tx;
+ 	sdata->vif.bss_conf.csa_active = true;
++	sdata->vif.bss_conf.csa_punct_bitmap = params->punct_bitmap;
+ 
+ 	if (sdata->deflink.csa_block_tx)
+ 		ieee80211_stop_vif_queues(local, sdata,
+@@ -3870,7 +3885,8 @@ __ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+ 
+ 	cfg80211_ch_switch_started_notify(sdata->dev,
+ 					  &sdata->deflink.csa_chandef, 0,
+-					  params->count, params->block_tx, 0);
++					  params->count, params->block_tx,
++					  sdata->vif.bss_conf.csa_punct_bitmap);
+ 
+ 	if (changed) {
+ 		ieee80211_link_info_change_notify(sdata, &sdata->deflink,
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0009-wifi-mac80211-add-EHT-MU-MIMO-related-flags-in-ieee8.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0009-wifi-mac80211-add-EHT-MU-MIMO-related-flags-in-ieee8.patch
new file mode 100644
index 0000000..74c0d07
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/bp-0009-wifi-mac80211-add-EHT-MU-MIMO-related-flags-in-ieee8.patch
@@ -0,0 +1,75 @@
+From 4244ed072fedc6f391ddad20fbc70bbb9dfb7c2c Mon Sep 17 00:00:00 2001
+From: Ryder Lee <ryder.lee@mediatek.com>
+Date: Sat, 18 Feb 2023 01:48:59 +0800
+Subject: [PATCH 9/9] wifi: mac80211: add EHT MU-MIMO related flags in
+ ieee80211_bss_conf
+
+Similar to VHT/HE. This is utilized to pass MU-MIMO configurations
+from user space (i.e. hostapd) to driver.
+
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Link: https://lore.kernel.org/r/8d9966c4c1e77cb1ade77d42bdc49905609192e9.1676628065.git.ryder.lee@mediatek.com
+[move into combined if statement, reset on !eht]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ include/net/mac80211.h |  9 +++++++++
+ net/mac80211/cfg.c     | 16 ++++++++++++++++
+ 2 files changed, 25 insertions(+)
+
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index c4ff6a3..24d2a66 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -676,6 +676,12 @@ struct ieee80211_fils_discovery {
+  * @he_full_ul_mumimo: does this BSS support the reception (AP) or transmission
+  *	(non-AP STA) of an HE TB PPDU on an RU that spans the entire PPDU
+  *	bandwidth
++ * @eht_su_beamformer: in AP-mode, does this BSS enable operation as an EHT SU
++ *	beamformer
++ * @eht_su_beamformee: in AP-mode, does this BSS enable operation as an EHT SU
++ *	beamformee
++ * @eht_mu_beamformer: in AP-mode, does this BSS enable operation as an EHT MU
++ *	beamformer
+  */
+ struct ieee80211_bss_conf {
+ 	const u8 *bssid;
+@@ -764,6 +770,9 @@ struct ieee80211_bss_conf {
+ 	bool he_su_beamformee;
+ 	bool he_mu_beamformer;
+ 	bool he_full_ul_mumimo;
++	bool eht_su_beamformer;
++	bool eht_su_beamformee;
++	bool eht_mu_beamformer;
+ };
+ 
+ /**
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 6defc1d..49760bf 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1310,6 +1310,22 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
+ 	if (params->eht_cap) {
+ 		link_conf->eht_puncturing = params->punct_bitmap;
+ 		changed |= BSS_CHANGED_EHT_PUNCTURING;
++
++		link_conf->eht_su_beamformer =
++			params->eht_cap->fixed.phy_cap_info[0] &
++				IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER;
++		link_conf->eht_su_beamformee =
++			params->eht_cap->fixed.phy_cap_info[0] &
++				IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE;
++		link_conf->eht_mu_beamformer =
++			params->eht_cap->fixed.phy_cap_info[7] &
++				(IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
++				 IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
++				 IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ);
++	} else {
++		link_conf->eht_su_beamformer = false;
++		link_conf->eht_su_beamformee = false;
++		link_conf->eht_mu_beamformer = false;
+ 	}
+ 
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP &&
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0003-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0001-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
similarity index 76%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0003-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0001-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
index 11ed298..c75457d 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0003-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0001-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
@@ -1,7 +1,7 @@
-From a1ef2ad6df856f2b27001e3487b8bb643458647e Mon Sep 17 00:00:00 2001
+From 635092a3fd448ecca927e72882f05dc52bb1d21b Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 18 Jan 2022 20:29:44 +0800
-Subject: [PATCH 03/16] mac80211: mtk: do not setup twt when twt responder is
+Subject: [PATCH 01/14] mac80211: mtk: do not setup twt when twt responder is
  false
 
 ---
@@ -9,7 +9,7 @@
  1 file changed, 3 insertions(+)
 
 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
-index 376e131..74cf1b6 100644
+index fadf2be..54dcaf6 100644
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
 @@ -3400,6 +3400,9 @@ ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
@@ -23,5 +23,5 @@
  		return false;
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0004-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0002-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
similarity index 81%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0004-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0002-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
index c9fe0da..cfd0e09 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0004-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0002-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
@@ -1,7 +1,7 @@
-From b82da9ed2020a06076b9b9ebef757c15b4fb37bd Mon Sep 17 00:00:00 2001
+From dacd08119ef3964c826d1949b35c5b926b40eb2b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 29 Mar 2022 16:06:30 +0800
-Subject: [PATCH 04/16] nl80211: mtk: extend CAC time for weather radar
+Subject: [PATCH 02/14] nl80211: mtk: extend CAC time for weather radar
  channels
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 7 insertions(+)
 
 diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
-index 84bf9e8..d3b03ab 100644
+index f3b2fc4..0430bbe 100644
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -9807,6 +9807,13 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
+@@ -9817,6 +9817,13 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
  	if (WARN_ON(!cac_time_ms))
  		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
  
@@ -28,5 +28,5 @@
  	if (!err) {
  		wdev->links[0].ap.chandef = chandef;
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0002-wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0002-wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch
deleted file mode 100644
index 184fa2a..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0002-wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 229f35ad8a192a4e7063336cc58717dab0707b5a Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Thu, 9 Feb 2023 18:58:08 +0800
-Subject: [PATCH 02/16] wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
-
-The value of last_rate in ieee80211_sta_rx_stats is degraded from u32 to
-u16 after being assigned to rate variable, which causes information loss
-in STA_STATS_FIELD_TYPE and later bitfields.
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- net/mac80211/sta_info.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
-index a2d7bf5..50daa22 100644
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -2396,7 +2396,7 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate,
- 
- static int sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
- {
--	u16 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate);
-+	u32 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate);
- 
- 	if (rate == STA_STATS_RATE_INVALID)
- 		return -EINVAL;
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0005-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0003-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
similarity index 71%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0005-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0003-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
index bfff312..b31ba64 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0005-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0003-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
@@ -1,7 +1,7 @@
-From 7ed5ec8df5bca3356f404d6521350910470ebeef Mon Sep 17 00:00:00 2001
+From efac6783560b2859f49f0a5d3dceff0e388431cf Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Fri, 1 Apr 2022 09:15:21 +0800
-Subject: [PATCH 05/16] mac80211: mtk: it's invalid case when frag_threshold is
+Subject: [PATCH 03/14] mac80211: mtk: it's invalid case when frag_threshold is
  greater than 2346
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 3 insertions(+)
 
 diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
-index d3b03ab..aa04e11 100644
+index 0430bbe..c5620f3 100644
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -3615,6 +3615,9 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
+@@ -3614,6 +3614,9 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
  			goto out;
  		}
  
@@ -24,5 +24,5 @@
  			/*
  			 * Fragments (apart from the last one) are required to
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0006-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0004-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
similarity index 77%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0006-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0004-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
index 5b61259..5a81d9b 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0006-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0004-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
@@ -1,7 +1,7 @@
-From 2c6976fcc20d5eeb2935cdede2dfc3571eace7a3 Mon Sep 17 00:00:00 2001
+From f88d59e107e1d962ebf77be9e1d0b35b188c8185 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 19 Oct 2022 13:42:43 +0800
-Subject: [PATCH 06/16] mac80211: mtk: airtime_flags depends on
+Subject: [PATCH 04/14] mac80211: mtk: airtime_flags depends on
  NL80211_EXT_FEATURE
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/net/mac80211/main.c b/net/mac80211/main.c
-index 83a1482..f6fb626 100644
+index dfb9f4b..06d111d 100644
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -804,8 +804,9 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
+@@ -797,8 +797,9 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
  			IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H;
  		atomic_set(&local->aql_ac_pending_airtime[i], 0);
  	}
@@ -26,5 +26,5 @@
  	atomic_set(&local->aql_total_pending_airtime, 0);
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0007-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0005-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
similarity index 86%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0007-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0005-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
index 647eb54..0bbbfe0 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0007-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0005-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
@@ -1,7 +1,7 @@
-From c972bda9f1fdb2e587aa1a0ce8315c456835b461 Mon Sep 17 00:00:00 2001
+From 5deaaa36bfeb7a68bbcce8770011ef49be6a6991 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 19 Oct 2022 13:45:42 +0800
-Subject: [PATCH 07/16] mac80211: mtk: add support for runtime set inband
+Subject: [PATCH 05/14] mac80211: mtk: add support for runtime set inband
  discovery
 
 Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
@@ -14,7 +14,7 @@
  5 files changed, 62 insertions(+), 5 deletions(-)
 
 diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
-index 357a78f..d99b59f 100644
+index 8d72357..450de58 100644
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
 @@ -1268,6 +1268,7 @@ struct cfg80211_fils_discovery {
@@ -26,10 +26,10 @@
  
  /**
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index b8d71ab..bec4ac6 100644
+index 24d2a66..09fad2b 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -525,6 +525,7 @@ struct ieee80211_ftm_responder_params {
+@@ -526,6 +526,7 @@ struct ieee80211_ftm_responder_params {
  struct ieee80211_fils_discovery {
  	u32 min_interval;
  	u32 max_interval;
@@ -38,10 +38,10 @@
  
  /**
 diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
-index ba4aa09..1293d30 100644
+index 173aef8..bd26a06 100644
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -7504,6 +7504,7 @@ enum nl80211_fils_discovery_attributes {
+@@ -7513,6 +7513,7 @@ enum nl80211_fils_discovery_attributes {
  	NL80211_FILS_DISCOVERY_ATTR_INT_MIN,
  	NL80211_FILS_DISCOVERY_ATTR_INT_MAX,
  	NL80211_FILS_DISCOVERY_ATTR_TMPL,
@@ -50,10 +50,10 @@
  	/* keep last */
  	__NL80211_FILS_DISCOVERY_ATTR_LAST,
 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index a6b9a3b..27f7616 100644
+index 49760bf..97f7905 100644
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -983,6 +983,7 @@ static int ieee80211_set_fils_discovery(struct ieee80211_sub_if_data *sdata,
+@@ -984,6 +984,7 @@ static int ieee80211_set_fils_discovery(struct ieee80211_sub_if_data *sdata,
  	fd = &link_conf->fils_discovery;
  	fd->min_interval = params->min_interval;
  	fd->max_interval = params->max_interval;
@@ -61,7 +61,7 @@
  
  	old = sdata_dereference(link->u.ap.fils_discovery, sdata);
  	new = kzalloc(sizeof(*new) + params->tmpl_len, GFP_KERNEL);
-@@ -1433,6 +1434,9 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
+@@ -1466,6 +1467,9 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	struct ieee80211_link_data *link;
  	struct beacon_data *old;
@@ -71,7 +71,7 @@
  	int err;
  	struct ieee80211_bss_conf *link_conf;
  
-@@ -1464,7 +1468,34 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
+@@ -1497,7 +1501,34 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
  		err |= BSS_CHANGED_HE_BSS_COLOR;
  	}
  
@@ -108,7 +108,7 @@
  }
  
 diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
-index aa04e11..202f802 100644
+index c5620f3..95676d9 100644
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
 @@ -423,6 +423,7 @@ nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
@@ -119,7 +119,7 @@
  };
  
  static const struct nla_policy
-@@ -5603,6 +5604,8 @@ static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
+@@ -5605,6 +5606,8 @@ static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
  	fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
  	fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
  	fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
@@ -128,7 +128,7 @@
  
  	return 0;
  }
-@@ -6082,7 +6085,8 @@ static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
+@@ -6092,7 +6095,8 @@ static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
  	unsigned int link_id = nl80211_link_id(info->attrs);
  	struct net_device *dev = info->user_ptr[1];
  	struct wireless_dev *wdev = dev->ieee80211_ptr;
@@ -138,7 +138,7 @@
  	int err;
  
  	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
-@@ -6095,16 +6099,35 @@ static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
+@@ -6105,16 +6109,35 @@ static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
  	if (!wdev->links[link_id].ap.beacon_interval)
  		return -EINVAL;
  
@@ -178,5 +178,5 @@
  }
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0008-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0006-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
similarity index 96%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0008-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0006-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
index 0f62b99..300a6f8 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0008-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0006-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
@@ -1,7 +1,7 @@
-From 7cdaa36e98e9bdc9621614fb7b7ad088683dddb7 Mon Sep 17 00:00:00 2001
+From 5d3d13bfb9074bd384f1f079b1064496f79e5b91 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 22 Sep 2022 14:27:41 +0800
-Subject: [PATCH 08/16] cfg80211: mtk: implement DFS status show, cac and nop
+Subject: [PATCH 06/14] cfg80211: mtk: implement DFS status show, cac and nop
  skip command via debugfs
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -16,10 +16,10 @@
  7 files changed, 320 insertions(+), 7 deletions(-)
 
 diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
-index d99b59f..bbd3de4 100644
+index 450de58..ddd63e7 100644
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -4641,6 +4641,7 @@ struct cfg80211_ops {
+@@ -4647,6 +4647,7 @@ struct cfg80211_ops {
  				    struct link_station_parameters *params);
  	int	(*del_link_station)(struct wiphy *wiphy, struct net_device *dev,
  				    struct link_station_del_parameters *params);
@@ -28,10 +28,10 @@
  
  /*
 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index 27f7616..3e35433 100644
+index 97f7905..36a2c8d 100644
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4900,6 +4900,25 @@ ieee80211_del_link_station(struct wiphy *wiphy, struct net_device *dev,
+@@ -4962,6 +4962,25 @@ ieee80211_del_link_station(struct wiphy *wiphy, struct net_device *dev,
  	return ret;
  }
  
@@ -57,14 +57,14 @@
  const struct cfg80211_ops mac80211_config_ops = {
  	.add_virtual_intf = ieee80211_add_iface,
  	.del_virtual_intf = ieee80211_del_iface,
-@@ -5011,4 +5030,5 @@ const struct cfg80211_ops mac80211_config_ops = {
+@@ -5072,4 +5091,5 @@ const struct cfg80211_ops mac80211_config_ops = {
  	.add_link_station = ieee80211_add_link_station,
  	.mod_link_station = ieee80211_mod_link_station,
  	.del_link_station = ieee80211_del_link_station,
 +	.skip_cac = ieee80211_skip_cac,
  };
 diff --git a/net/wireless/core.h b/net/wireless/core.h
-index f4d3b83..b1bc314 100644
+index 382455c..c9d7712 100644
 --- a/net/wireless/core.h
 +++ b/net/wireless/core.h
 @@ -86,6 +86,9 @@ struct cfg80211_registered_device {
@@ -433,10 +433,10 @@
 +
  #endif /* __CFG80211_RDEV_OPS */
 diff --git a/net/wireless/trace.h b/net/wireless/trace.h
-index 8e7c00f..d3a98e8 100644
+index 4a7d0ae..4d44c55 100644
 --- a/net/wireless/trace.h
 +++ b/net/wireless/trace.h
-@@ -3901,6 +3901,18 @@ TRACE_EVENT(rdev_del_link_station,
+@@ -3909,6 +3909,18 @@ TRACE_EVENT(rdev_del_link_station,
  		  __entry->link_id)
  );
  
@@ -456,5 +456,5 @@
  
  #undef TRACE_INCLUDE_PATH
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0009-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0007-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
similarity index 85%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0009-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0007-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
index 1afed8d..0b33292 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0009-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0007-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
@@ -1,7 +1,7 @@
-From b85e0a64d46ca9aae3f96f991b0880565bde4cc8 Mon Sep 17 00:00:00 2001
+From f6619b6ecec6122b107fa3c3c9bb0e2a4ceaba87 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 4 Oct 2022 10:47:05 +0800
-Subject: [PATCH 09/16] mac80211: mtk: Set TWT Information Frame Disabled bit
+Subject: [PATCH 07/14] mac80211: mtk: Set TWT Information Frame Disabled bit
  as 1.
 
 This modification means that current implementation do not support twt information frame.
@@ -22,5 +22,5 @@
  	/* broadcast TWT not supported yet */
  	if (twt->control & IEEE80211_TWT_CONTROL_NEG_TYPE_BROADCAST) {
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0010-mac80211-mtk-check-the-control-channel-before-downgr.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0008-mac80211-mtk-check-the-control-channel-before-downgr.patch
similarity index 82%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0010-mac80211-mtk-check-the-control-channel-before-downgr.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0008-mac80211-mtk-check-the-control-channel-before-downgr.patch
index 93391c6..685e0b7 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0010-mac80211-mtk-check-the-control-channel-before-downgr.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0008-mac80211-mtk-check-the-control-channel-before-downgr.patch
@@ -1,7 +1,7 @@
-From c34a03c59c59f000b6f77387e88bc10800dcb466 Mon Sep 17 00:00:00 2001
+From 74dec28f086c6d919d936fb159bfb3fada5f4ca7 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 16 Dec 2022 03:31:06 +0800
-Subject: [PATCH 10/16] mac80211: mtk: check the control channel before
+Subject: [PATCH 08/14] mac80211: mtk: check the control channel before
  downgrading the bandwidth
 
 ---
@@ -9,10 +9,10 @@
  1 file changed, 23 insertions(+)
 
 diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
-index d8484cd..8ab5c52 100644
+index d63434b..72d153f 100644
 --- a/net/mac80211/mlme.c
 +++ b/net/mac80211/mlme.c
-@@ -4582,6 +4582,26 @@ ieee80211_verify_sta_he_mcs_support(struct ieee80211_sub_if_data *sdata,
+@@ -4657,6 +4657,26 @@ ieee80211_verify_sta_he_mcs_support(struct ieee80211_sub_if_data *sdata,
  	return false;
  }
  
@@ -39,7 +39,7 @@
  static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
  				  struct ieee80211_link_data *link,
  				  struct cfg80211_bss *cbss,
-@@ -4808,6 +4828,9 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
+@@ -4883,6 +4903,9 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
  	    chandef.width == NL80211_CHAN_WIDTH_10)
  		goto out;
  
@@ -50,5 +50,5 @@
  		*conn_flags |=
  			ieee80211_chandef_downgrade(&chandef);
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-fix-tx-amsdu-aggregation.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0009-mac80211-mtk-fix-tx-amsdu-aggregation.patch
similarity index 87%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-fix-tx-amsdu-aggregation.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0009-mac80211-mtk-fix-tx-amsdu-aggregation.patch
index 087a3d8..fd2295f 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-fix-tx-amsdu-aggregation.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0009-mac80211-mtk-fix-tx-amsdu-aggregation.patch
@@ -1,7 +1,7 @@
-From 75f9ff29a96378e57e611faa1410c647ca6d66d2 Mon Sep 17 00:00:00 2001
+From e12f4ecc226a21580958bcbb2f418ae979e49a36 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Wed, 14 Dec 2022 00:26:50 -0800
-Subject: [PATCH 11/16] mac80211: mtk: fix tx amsdu aggregation
+Subject: [PATCH 09/14] mac80211: mtk: fix tx amsdu aggregation
 
 ---
  include/net/mac80211.h | 7 +++++++
@@ -9,10 +9,10 @@
  2 files changed, 11 insertions(+), 2 deletions(-)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index bec4ac6..decc558 100644
+index 09fad2b..bd257ce 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2890,6 +2890,13 @@ static inline void _ieee80211_hw_set(struct ieee80211_hw *hw,
+@@ -2905,6 +2905,13 @@ static inline void _ieee80211_hw_set(struct ieee80211_hw *hw,
  }
  #define ieee80211_hw_set(hw, flg)	_ieee80211_hw_set(hw, IEEE80211_HW_##flg)
  
@@ -27,7 +27,7 @@
   * struct ieee80211_scan_request - hw scan request
   *
 diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
-index d5a1ddb..56cd1fc 100644
+index 6597607..752ad09 100644
 --- a/net/mac80211/agg-tx.c
 +++ b/net/mac80211/agg-tx.c
 @@ -66,7 +66,8 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
@@ -51,5 +51,5 @@
  	capab |= u16_encode_bits(tid, IEEE80211_ADDBA_PARAM_TID_MASK);
  	capab |= u16_encode_bits(agg_size, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK);
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0010-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
similarity index 90%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0010-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
index 2a2a337..a160e14 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0010-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
@@ -1,7 +1,7 @@
-From 98416f74912dd94359588ef08efe7b047f028162 Mon Sep 17 00:00:00 2001
+From ea115965135f78dc8993f1a73a0600fb5b83cdf7 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Wed, 18 May 2022 15:10:22 +0800
-Subject: [PATCH 12/16] mac80211: mtk: add fill receive path ops to get wed idx
+Subject: [PATCH 10/14] mac80211: mtk: add fill receive path ops to get wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -12,10 +12,10 @@
  4 files changed, 50 insertions(+)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index decc558..33e16d2 100644
+index bd257ce..9208a8d 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -4211,6 +4211,8 @@ struct ieee80211_prep_tx_info {
+@@ -4226,6 +4226,8 @@ struct ieee80211_prep_tx_info {
   *	disable background CAC/radar detection.
   * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
   *	resolve a path for hardware flow offloading
@@ -24,7 +24,7 @@
   * @change_vif_links: Change the valid links on an interface, note that while
   *	removing the old link information is still valid (link_conf pointer),
   *	but may immediately disappear after the function returns. The old or
-@@ -4576,6 +4578,9 @@ struct ieee80211_ops {
+@@ -4591,6 +4593,9 @@ struct ieee80211_ops {
  				     struct ieee80211_sta *sta,
  				     struct net_device_path_ctx *ctx,
  				     struct net_device_path *path);
@@ -35,7 +35,7 @@
  				struct ieee80211_vif *vif,
  				u16 old_links, u16 new_links,
 diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
-index c5c81d5..084b710 100644
+index 37f428e..b076658 100644
 --- a/net/mac80211/driver-ops.h
 +++ b/net/mac80211/driver-ops.h
 @@ -1485,6 +1485,19 @@ static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
@@ -100,10 +100,10 @@
  };
  
 diff --git a/net/mac80211/util.c b/net/mac80211/util.c
-index 608f927..fd63ee3 100644
+index 5a6c091..f6a2561 100644
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -914,6 +914,15 @@ struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
+@@ -888,6 +888,15 @@ struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
  }
  EXPORT_SYMBOL_GPL(ieee80211_vif_to_wdev);
  
@@ -120,5 +120,5 @@
   * Nothing should have been stuffed into the workqueue during
   * the suspend->resume cycle. Since we can't check each caller
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
similarity index 89%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
index 675510e..17a5248 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
@@ -1,7 +1,7 @@
-From 2396b71e50211886c7b5f165b8baf0c1fb06d67e Mon Sep 17 00:00:00 2001
+From ecf81145d85cc3d991d360d283b83a0e91ecf1da Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Tue, 13 Dec 2022 09:04:49 +0800
-Subject: [PATCH 13/16] mac80211: mtk: fix build error on Linux Kernel 5.4
+Subject: [PATCH 11/14] mac80211: mtk: fix build error on Linux Kernel 5.4
 
 ---
  include/linux/ieee80211.h          | 8 +++-----
@@ -11,7 +11,7 @@
  4 files changed, 11 insertions(+), 7 deletions(-)
 
 diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
-index a1f1b57..7f5c362 100644
+index d15816f..00d381e 100644
 --- a/include/linux/ieee80211.h
 +++ b/include/linux/ieee80211.h
 @@ -310,11 +310,9 @@ static inline u16 ieee80211_sn_sub(u16 sn1, u16 sn2)
@@ -66,10 +66,10 @@
  
  
 diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
-index 202f802..1035f74 100644
+index 95676d9..6f1d60a 100644
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -16441,9 +16441,11 @@ static const struct genl_ops nl80211_ops[] = {
+@@ -16457,9 +16457,11 @@ static const struct genl_ops nl80211_ops[] = {
  		/* can be retrieved by unprivileged users */
  		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
  	},
@@ -81,7 +81,7 @@
  	{
  		.cmd = NL80211_CMD_SET_WIPHY,
  		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-@@ -17280,8 +17282,10 @@ static struct genl_family nl80211_fam __genl_ro_after_init = {
+@@ -17296,8 +17298,10 @@ static struct genl_family nl80211_fam __genl_ro_after_init = {
  	.module = THIS_MODULE,
  	.ops = nl80211_ops,
  	.n_ops = ARRAY_SIZE(nl80211_ops),
@@ -93,5 +93,5 @@
  	.resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
  #endif
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-track-obss-color-bitmap.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-track-obss-color-bitmap.patch
similarity index 85%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-track-obss-color-bitmap.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-track-obss-color-bitmap.patch
index 2ec5fd4..607670c 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-track-obss-color-bitmap.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-track-obss-color-bitmap.patch
@@ -1,7 +1,7 @@
-From 96ebd540e830ff997f572f7dd4306accfb50f9c3 Mon Sep 17 00:00:00 2001
+From a7b0e17e0dafe6cfe58f88465006cd0c9e7c3217 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Mon, 13 Mar 2023 05:23:37 +0800
-Subject: [PATCH 14/16] mac80211: mtk: track obss color bitmap
+Subject: [PATCH 12/14] mac80211: mtk: track obss color bitmap
 
 Track OBSS BSS color when receive their beacon.
 
@@ -16,10 +16,10 @@
  4 files changed, 33 insertions(+), 6 deletions(-)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index 33e16d2..ef95cc7 100644
+index 9208a8d..299425a 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -729,6 +729,7 @@ struct ieee80211_bss_conf {
+@@ -741,6 +741,7 @@ struct ieee80211_bss_conf {
  	} he_oper;
  	struct ieee80211_he_obss_pd he_obss_pd;
  	struct cfg80211_he_bss_color he_bss_color;
@@ -27,7 +27,7 @@
  	struct ieee80211_fils_discovery fils_discovery;
  	u32 unsol_bcast_probe_resp_interval;
  	struct cfg80211_bitrate_mask beacon_tx_rate;
-@@ -7254,7 +7255,7 @@ ieee80211_get_unsol_bcast_probe_resp_tmpl(struct ieee80211_hw *hw,
+@@ -7269,7 +7270,7 @@ ieee80211_get_unsol_bcast_probe_resp_tmpl(struct ieee80211_hw *hw,
  					  struct ieee80211_vif *vif);
  
  /**
@@ -36,7 +36,7 @@
   * collision.
   *
   * @vif: &struct ieee80211_vif pointer from the add_interface callback.
-@@ -7263,7 +7264,7 @@ ieee80211_get_unsol_bcast_probe_resp_tmpl(struct ieee80211_hw *hw,
+@@ -7278,7 +7279,7 @@ ieee80211_get_unsol_bcast_probe_resp_tmpl(struct ieee80211_hw *hw,
   * @gfp: allocation flags
   */
  void
@@ -46,10 +46,10 @@
  
  /**
 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index 3e35433..5c9dda1 100644
+index 36a2c8d..0ecc026 100644
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4698,7 +4698,7 @@ void ieee80211_color_change_finish(struct ieee80211_vif *vif)
+@@ -4750,7 +4750,7 @@ void ieee80211_color_change_finish(struct ieee80211_vif *vif)
  EXPORT_SYMBOL_GPL(ieee80211_color_change_finish);
  
  void
@@ -58,9 +58,9 @@
  				       u64 color_bitmap, gfp_t gfp)
  {
  	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-@@ -4708,7 +4708,7 @@ ieeee80211_obss_color_collision_notify(struct ieee80211_vif *vif,
- 
- 	cfg80211_obss_color_collision_notify(sdata->dev, color_bitmap, gfp);
+@@ -4770,7 +4770,7 @@ ieeee80211_obss_color_collision_notify(struct ieee80211_vif *vif,
+ 				     &link->color_collision_detect_work,
+ 				     msecs_to_jiffies(500));
  }
 -EXPORT_SYMBOL_GPL(ieeee80211_obss_color_collision_notify);
 +EXPORT_SYMBOL_GPL(ieee80211_obss_color_collision_notify);
@@ -68,7 +68,7 @@
  static int
  ieee80211_color_change(struct wiphy *wiphy, struct net_device *dev,
 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
-index 74cf1b6..bc5b471 100644
+index 54dcaf6..0048c22 100644
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
 @@ -3338,9 +3338,14 @@ ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
@@ -121,5 +121,5 @@
  
  #undef TRACE_INCLUDE_PATH
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-ageout-color-bitmap.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-ageout-color-bitmap.patch
similarity index 86%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-ageout-color-bitmap.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-ageout-color-bitmap.patch
index a5fa9ab..fd6c275 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-ageout-color-bitmap.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-ageout-color-bitmap.patch
@@ -1,7 +1,7 @@
-From c481f3323ae0e44feeba59851258b1612b2808a0 Mon Sep 17 00:00:00 2001
+From 0a99124e2d3cd3c5d34903c92cedff7461284993 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Mon, 13 Mar 2023 05:36:59 +0800
-Subject: [PATCH 15/16] mac80211: mtk: ageout color bitmap
+Subject: [PATCH 13/14] mac80211: mtk: ageout color bitmap
 
 Adding a periodic work which runs once per second to check BSS color.
 OBSS BSS Color will be ageout if not seen for 10 seconds.
@@ -15,10 +15,10 @@
  6 files changed, 44 insertions(+)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index ef95cc7..323d57f 100644
+index 299425a..b4f156e 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -730,6 +730,7 @@ struct ieee80211_bss_conf {
+@@ -742,6 +742,7 @@ struct ieee80211_bss_conf {
  	struct ieee80211_he_obss_pd he_obss_pd;
  	struct cfg80211_he_bss_color he_bss_color;
  	u64 used_color_bitmap;
@@ -27,10 +27,10 @@
  	u32 unsol_bcast_probe_resp_interval;
  	struct cfg80211_bitrate_mask beacon_tx_rate;
 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index 5c9dda1..343ce2b 100644
+index 0ecc026..3c83024 100644
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4755,6 +4755,36 @@ out:
+@@ -4817,6 +4817,36 @@ out:
  	return err;
  }
  
@@ -68,18 +68,18 @@
  ieee80211_set_radar_background(struct wiphy *wiphy,
  			       struct cfg80211_chan_def *chandef)
 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index f7da92b..bc3f133 100644
+index 04128d5..bf2c51e 100644
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -987,6 +987,7 @@ struct ieee80211_link_data {
- 	struct cfg80211_chan_def csa_chandef;
+@@ -989,6 +989,7 @@ struct ieee80211_link_data {
  
  	struct work_struct color_change_finalize_work;
+ 	struct delayed_work color_collision_detect_work;
 +	struct delayed_work color_aging_work;
+ 	u64 color_bitmap;
  
  	/* context reservation -- protected with chanctx_mtx */
- 	struct ieee80211_chanctx *reserved_chanctx;
-@@ -1930,8 +1931,12 @@ void ieee80211_csa_finalize_work(struct work_struct *work);
+@@ -1932,9 +1933,13 @@ void ieee80211_csa_finalize_work(struct work_struct *work);
  int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
  			     struct cfg80211_csa_settings *params);
  
@@ -88,6 +88,7 @@
 +
  /* color change handling */
  void ieee80211_color_change_finalize_work(struct work_struct *work);
+ void ieee80211_color_collision_detection_work(struct work_struct *work);
 +void ieee80211_color_aging_work(struct work_struct *work);
  
  /* interface handling */
@@ -116,10 +117,10 @@
   err_del_interface:
  	drv_remove_interface(local, sdata);
 diff --git a/net/mac80211/link.c b/net/mac80211/link.c
-index e309708..d34cdc2 100644
+index a1b3031..7d4cdfb 100644
 --- a/net/mac80211/link.c
 +++ b/net/mac80211/link.c
-@@ -43,6 +43,8 @@ void ieee80211_link_init(struct ieee80211_sub_if_data *sdata,
+@@ -45,6 +45,8 @@ void ieee80211_link_init(struct ieee80211_sub_if_data *sdata,
  	INIT_LIST_HEAD(&link->reserved_chanctx_list);
  	INIT_DELAYED_WORK(&link->dfs_cac_timer_work,
  			  ieee80211_dfs_cac_timer_work);
@@ -129,7 +130,7 @@
  	if (!deflink) {
  		switch (sdata->vif.type) {
 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
-index bc5b471..b96eb7c 100644
+index 0048c22..d953e46 100644
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
 @@ -3340,6 +3340,7 @@ ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
@@ -141,5 +142,5 @@
  		trace_bss_color_bitmap(color, bss_conf->used_color_bitmap);
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0016-mac80211-mtk-update-max_bssid_indicator-based-on-rea.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-update-max_bssid_indicator-based-on-rea.patch
similarity index 74%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0016-mac80211-mtk-update-max_bssid_indicator-based-on-rea.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-update-max_bssid_indicator-based-on-rea.patch
index ccb0b16..205d30d 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0016-mac80211-mtk-update-max_bssid_indicator-based-on-rea.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-update-max_bssid_indicator-based-on-rea.patch
@@ -1,7 +1,7 @@
-From 631e4f9d0eba26d18e4746421105d7fdf2f7d392 Mon Sep 17 00:00:00 2001
+From 869bb0c749acc325ea6ecbf7513a90159d426602 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 14 Apr 2023 05:05:17 +0800
-Subject: [PATCH 16/16] mac80211: mtk: update max_bssid_indicator based on real
+Subject: [PATCH 14/14] mac80211: mtk: update max_bssid_indicator based on real
  BSS numbers
 
 ---
@@ -9,10 +9,10 @@
  1 file changed, 1 insertion(+), 2 deletions(-)
 
 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index 343ce2b..61d9df8 100644
+index 3c83024..d5ffa64 100644
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1151,8 +1151,7 @@ static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
+@@ -1152,8 +1152,7 @@ static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
  		pos += struct_size(new->mbssid_ies, elem, mbssid->cnt);
  		ieee80211_copy_mbssid_beacon(pos, new->mbssid_ies, mbssid);
  		/* update bssid_indicator */
@@ -23,5 +23,5 @@
  
  	if (csa) {
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
index b338357..9da26b5 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
@@ -12,8 +12,6 @@
     file://306-02-v6.2-wifi-mac80211-add-wake_tx_queue-callback-to-drivers.patch \
     file://306-03-v6.2-wifi-mac80211-Drop-support-for-TX-push-path.patch \
     file://306-04-v6.2-wifi-realtek-remove-duplicated-wake_tx_queue.patch \
-    file://307-v6.2-wifi-mac80211-fix-initialization-of-rx-link-and-rx-l.patch \
-    file://308-v6.2-wifi-mac80211-fix-MLO-AP_VLAN-check.patch \
     file://310-v6.2-mac80211-add-support-for-restricting-netdev-features.patch \
     file://311-v6.2-wifi-mac80211-fix-and-simplify-unencrypted-drop-chec.patch \
     file://312-v6.3-wifi-cfg80211-move-A-MSDU-check-in-ieee80211_data_to.patch \
@@ -21,7 +19,6 @@
     file://314-v6.3-wifi-mac80211-remove-mesh-forwarding-congestion-chec.patch \
     file://315-v6.3-wifi-mac80211-fix-receiving-A-MSDU-frames-on-mesh-in.patch \
     file://316-v6.3-wifi-mac80211-add-a-workaround-for-receiving-non-sta.patch \
-    file://317-wifi-mac80211-fix-qos-on-mesh-interfaces.patch \
     file://318-wifi-mac80211-fix-race-in-mesh-sequence-number-assig.patch \
     file://319-wifi-mac80211-mesh-fast-xmit-support.patch \
     file://320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch \
@@ -32,32 +29,39 @@
     file://325-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch \
     file://326-wifi-mac80211-add-mesh-fast-rx-support.patch \
     file://327-wifi-mac80211-add-support-for-letting-drivers-regist.patch \
-    file://328-wifi-mac80211-fix-invalid-drv_sta_pre_rcu_remove-cal.patch \
     file://329-wifi-mac80211-fix-receiving-mesh-packets-in-forwardi.patch \
     file://330-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch \
     file://331-wifi-mac80211-flush-queues-on-STA-removal.patch \
     file://332-wifi-iwlwifi-mvm-support-flush-on-AP-interfaces.patch \
     file://333-wifi-mac80211-add-flush_sta-method.patch \
     file://334-wifi-iwlwifi-mvm-support-new-flush_sta-method.patch \
+    file://335-wifi-mac80211-add-LDPC-related-flags-in-ieee80211_bs.patch \
     file://400-allow-ibss-mixed.patch \
     file://500-mac80211_configure_antenna_gain.patch \
     file://782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch \
-    file://mtk-0001-mac80211-support-minimal-EHT-rate-reporting-on-RX.patch \
-    file://mtk-0002-wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch \
-    file://mtk-0003-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch \
-    file://mtk-0004-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch \
-    file://mtk-0005-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch \
-    file://mtk-0006-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch \
-    file://mtk-0007-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch \
-    file://mtk-0008-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch \
-    file://mtk-0009-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch \
-    file://mtk-0010-mac80211-mtk-check-the-control-channel-before-downgr.patch \
-    file://mtk-0011-mac80211-mtk-fix-tx-amsdu-aggregation.patch \
-    file://mtk-0012-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch \
-    file://mtk-0013-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch \
-    file://mtk-0014-mac80211-mtk-track-obss-color-bitmap.patch \
-    file://mtk-0015-mac80211-mtk-ageout-color-bitmap.patch \
-    file://mtk-0016-mac80211-mtk-update-max_bssid_indicator-based-on-rea.patch \
+    file://bp-0001-Revert-mac80211_configure_antenna_gain.patch \
+    file://bp-0002-mac80211-support-minimal-EHT-rate-reporting-on-RX.patch \
+    file://bp-0003-cfg80211-Update-Transition-Disable-policy-during-por.patch \
+    file://bp-0004-wifi-mac80211-mlme-handle-EHT-channel-puncturing.patch \
+    file://bp-0005-wifi-cfg80211-move-puncturing-bitmap-validation-from.patch \
+    file://bp-0006-wifi-nl80211-validate-and-configure-puncturing-bitma.patch \
+    file://bp-0007-wifi-cfg80211-include-puncturing-bitmap-in-channel-s.patch \
+    file://bp-0008-wifi-mac80211-configure-puncturing-bitmap.patch \
+    file://bp-0009-wifi-mac80211-add-EHT-MU-MIMO-related-flags-in-ieee8.patch \
+    file://mtk-0001-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch \
+    file://mtk-0002-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch \
+    file://mtk-0003-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch \
+    file://mtk-0004-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch \
+    file://mtk-0005-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch \
+    file://mtk-0006-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch \
+    file://mtk-0007-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch \
+    file://mtk-0008-mac80211-mtk-check-the-control-channel-before-downgr.patch \
+    file://mtk-0009-mac80211-mtk-fix-tx-amsdu-aggregation.patch \
+    file://mtk-0010-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch \
+    file://mtk-0011-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch \
+    file://mtk-0012-mac80211-mtk-track-obss-color-bitmap.patch \
+    file://mtk-0013-mac80211-mtk-ageout-color-bitmap.patch \
+    file://mtk-0014-mac80211-mtk-update-max_bssid_indicator-based-on-rea.patch \
     file://mtk-0100-mac80211-mtk-add-EHT-BA1024-support.patch \
     file://mtk-0101-mac80211-mtk-add-rate-duration-for-EHT-rate.patch \
     file://mtk-0103-mac80211-mtk-add-send-bar-on-addbarsp_handle.patch \
diff --git a/recipes-wifi/linux-mac80211/linux-mac80211_6.%.bb b/recipes-wifi/linux-mac80211/linux-mac80211_6.%.bb
index 42dbcb1..9010d00 100644
--- a/recipes-wifi/linux-mac80211/linux-mac80211_6.%.bb
+++ b/recipes-wifi/linux-mac80211/linux-mac80211_6.%.bb
@@ -6,14 +6,14 @@
 
 inherit module
 
-PV = "6.1-rc8"
+PV = "6.1.24"
 
 SRC_URI = " \
     http://mirror2.openwrt.org/sources/backports-${PV}.tar.xz \
     file://config \
     file://0001-rdkb-fix_build_issue-mac80211-without_depmod.patch;apply=no \
     "
-SRC_URI[sha256sum] = "7f3d96c2573183cd79d6a3ebe5e1b7b73c19d1326d443c85b69c4181f14e6e2b"
+SRC_URI[sha256sum] = "5d39aca7e34c33cb9b3e366117b2e86841b7bdd37933679d6b1e61be6b150648"
 
 DEPENDS += "virtual/kernel"
 DEPENDS += "bison-native coreutils-native flex-native"