diff --git a/recipes-connectivity/hostapd/files/hostapd-full.config b/recipes-connectivity/hostapd/files/hostapd-full.config
index 5d1b2f9..22a367f 100644
--- a/recipes-connectivity/hostapd/files/hostapd-full.config
+++ b/recipes-connectivity/hostapd/files/hostapd-full.config
@@ -316,7 +316,7 @@
 CONFIG_INTERWORKING=y
 
 # Hotspot 2.0
-#CONFIG_HS20=y
+CONFIG_HS20=y
 
 # Enable SQLite database support in hlr_auc_gw, EAP-SIM DB, and eap_user_file
 #CONFIG_SQLITE=y
diff --git a/recipes-connectivity/hostapd/files/patches/340-reload_freq_change.patch b/recipes-connectivity/hostapd/files/patches/340-reload_freq_change.patch
index 3d51a47..89259f2 100644
--- a/recipes-connectivity/hostapd/files/patches/340-reload_freq_change.patch
+++ b/recipes-connectivity/hostapd/files/patches/340-reload_freq_change.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -115,6 +115,28 @@ static void hostapd_reload_bss(struct ho
+@@ -115,6 +115,29 @@ static void hostapd_reload_bss(struct ho
  #endif /* CONFIG_NO_RADIUS */
  
  	ssid = &hapd->conf->ssid;
@@ -12,6 +12,7 @@
 +			 hapd->iconf->ieee80211n,
 +			 hapd->iconf->ieee80211ac,
 +			 hapd->iconf->ieee80211ax,
++			 hapd->iconf->ieee80211be,
 +			 hapd->iconf->secondary_channel,
 +			 hostapd_get_oper_chwidth(hapd->iconf),
 +			 hostapd_get_oper_centr_freq_seg0_idx(hapd->iconf),
diff --git a/recipes-connectivity/hostapd/files/patches/350-nl80211_del_beacon_bss.patch b/recipes-connectivity/hostapd/files/patches/350-nl80211_del_beacon_bss.patch
index 3556783..8a2beb3 100644
--- a/recipes-connectivity/hostapd/files/patches/350-nl80211_del_beacon_bss.patch
+++ b/recipes-connectivity/hostapd/files/patches/350-nl80211_del_beacon_bss.patch
@@ -1,24 +1,20 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -2931,10 +2931,15 @@ static int wpa_driver_nl80211_del_beacon
- 	struct nl_msg *msg;
+@@ -2932,11 +2932,11 @@ static int wpa_driver_nl80211_del_beacon
  	struct wpa_driver_nl80211_data *drv = bss->drv;
  
-+	if (!bss->beacon_set)
-+		return 0;
-+
-+	bss->beacon_set = 0;
-+
  	wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
 -		   drv->ifindex);
 +		   bss->ifindex);
+ 	bss->beacon_set = 0;
+ 	bss->freq = 0;
  	nl80211_put_wiphy_data_ap(bss);
 -	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_DEL_BEACON);
-+	msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_BEACON);
++	msg = nl80211_bss_msg(drv, 0, NL80211_CMD_DEL_BEACON);
  	return send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
  }
  
-@@ -5617,7 +5622,7 @@ static void nl80211_teardown_ap(struct i
+@@ -5650,7 +5650,7 @@ static void nl80211_teardown_ap(struct i
  		nl80211_mgmt_unsubscribe(bss, "AP teardown");
  
  	nl80211_put_wiphy_data_ap(bss);
@@ -27,7 +23,7 @@
  }
  
  
-@@ -8071,8 +8076,6 @@ static int wpa_driver_nl80211_if_remove(
+@@ -8104,8 +8104,6 @@ static int wpa_driver_nl80211_if_remove(
  	} else {
  		wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
  		nl80211_teardown_ap(bss);
@@ -36,19 +32,3 @@
  		nl80211_destroy_bss(bss);
  		if (!bss->added_if)
  			i802_set_iface_flags(bss, 0);
-@@ -8469,7 +8472,6 @@ static int wpa_driver_nl80211_deinit_ap(
- 	if (!is_ap_interface(drv->nlmode))
- 		return -1;
- 	wpa_driver_nl80211_del_beacon(bss);
--	bss->beacon_set = 0;
- 
- 	/*
- 	 * If the P2P GO interface was dynamically added, then it is
-@@ -8489,7 +8491,6 @@ static int wpa_driver_nl80211_stop_ap(vo
- 	if (!is_ap_interface(drv->nlmode))
- 		return -1;
- 	wpa_driver_nl80211_del_beacon(bss);
--	bss->beacon_set = 0;
- 	return 0;
- }
- 
diff --git a/recipes-connectivity/hostapd/files/patches/420-indicate-features.patch b/recipes-connectivity/hostapd/files/patches/420-indicate-features.patch
index f9dff66..12edb6b 100644
--- a/recipes-connectivity/hostapd/files/patches/420-indicate-features.patch
+++ b/recipes-connectivity/hostapd/files/patches/420-indicate-features.patch
@@ -1,23 +1,24 @@
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -15,6 +15,7 @@
- #include "utils/common.h"
- #include "utils/eloop.h"
- #include "utils/uuid.h"
-+#include "utils/build_features.h"
- #include "crypto/random.h"
- #include "crypto/tls.h"
- #include "common/version.h"
-@@ -691,7 +692,7 @@ int main(int argc, char *argv[])
+@@ -31,7 +31,7 @@
+ #include "config_file.h"
+ #include "eap_register.h"
+ #include "ctrl_iface.h"
+-
++#include "build_features.h"
+ 
+ struct hapd_global {
+ 	void **drv_priv;
+@@ -692,7 +692,7 @@ int main(int argc, char *argv[])
  	wpa_supplicant_event = hostapd_wpa_event;
  	wpa_supplicant_event_global = hostapd_wpa_event_global;
  	for (;;) {
--		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:");
-+		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:g:G:v::");
+-		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:q");
++		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:g:G:qv::");
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -728,6 +729,8 @@ int main(int argc, char *argv[])
+@@ -729,6 +729,8 @@ int main(int argc, char *argv[])
  			break;
  #endif /* CONFIG_DEBUG_LINUX_TRACING */
  		case 'v':
@@ -25,7 +26,7 @@
 +				exit(!has_feature(optarg));
  			show_version();
  			exit(1);
- 			break;
+ 		case 'g':
 --- a/wpa_supplicant/main.c
 +++ b/wpa_supplicant/main.c
 @@ -12,6 +12,7 @@
@@ -33,10 +34,10 @@
  
  #include "common.h"
 +#include "build_features.h"
+ #include "crypto/crypto.h"
  #include "fst/fst.h"
  #include "wpa_supplicant_i.h"
- #include "driver_i.h"
-@@ -202,7 +203,7 @@ int main(int argc, char *argv[])
+@@ -203,7 +204,7 @@ int main(int argc, char *argv[])
  
  	for (;;) {
  		c = getopt(argc, argv,
@@ -45,7 +46,7 @@
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -305,8 +306,12 @@ int main(int argc, char *argv[])
+@@ -306,8 +307,12 @@ int main(int argc, char *argv[])
  			break;
  #endif /* CONFIG_CTRL_IFACE_DBUS_NEW */
  		case 'v':
diff --git a/recipes-connectivity/hostapd/files/patches/465-hostapd-config-support-random-BSS-color.patch b/recipes-connectivity/hostapd/files/patches/465-hostapd-config-support-random-BSS-color.patch
new file mode 100644
index 0000000..c0b0119
--- /dev/null
+++ b/recipes-connectivity/hostapd/files/patches/465-hostapd-config-support-random-BSS-color.patch
@@ -0,0 +1,24 @@
+From c9304d3303d563ad6d2619f4e07864ed12f96889 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sat, 14 May 2022 21:41:03 +0200
+Subject: [PATCH] hostapd: config: support random BSS color
+
+Configure the HE BSS color to a random value in case the config defines
+a BSS color which exceeds the max BSS color (63).
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ hostapd/config_file.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3485,6 +3485,8 @@ static int hostapd_config_fill(struct ho
+ 	} else if (os_strcmp(buf, "he_bss_color") == 0) {
+ 		conf->he_op.he_bss_color = atoi(pos) & 0x3f;
+ 		conf->he_op.he_bss_color_disabled = 0;
++		if (atoi(pos) > 63)
++			conf->he_op.he_bss_color = os_random() % 63 + 1;
+ 	} else if (os_strcmp(buf, "he_bss_color_partial") == 0) {
+ 		conf->he_op.he_bss_color_partial = atoi(pos);
+ 	} else if (os_strcmp(buf, "he_default_pe_duration") == 0) {
diff --git a/recipes-connectivity/hostapd/files/patches/750-qos_map_set_without_interworking.patch b/recipes-connectivity/hostapd/files/patches/750-qos_map_set_without_interworking.patch
index 43a4ea7..ff1d076 100644
--- a/recipes-connectivity/hostapd/files/patches/750-qos_map_set_without_interworking.patch
+++ b/recipes-connectivity/hostapd/files/patches/750-qos_map_set_without_interworking.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -1644,6 +1644,8 @@ static int parse_anqp_elem(struct hostap
+@@ -1598,6 +1598,8 @@ static int parse_anqp_elem(struct hostap
  	return 0;
  }
  
@@ -9,7 +9,7 @@
  
  static int parse_qos_map_set(struct hostapd_bss_config *bss,
  			     char *buf, int line)
-@@ -1685,8 +1687,6 @@ static int parse_qos_map_set(struct host
+@@ -1639,8 +1641,6 @@ static int parse_qos_map_set(struct host
  	return 0;
  }
  
@@ -18,7 +18,7 @@
  
  #ifdef CONFIG_HS20
  static int hs20_parse_conn_capab(struct hostapd_bss_config *bss, char *buf,
-@@ -4077,10 +4077,10 @@ static int hostapd_config_fill(struct ho
+@@ -4042,10 +4042,10 @@ static int hostapd_config_fill(struct ho
  		bss->gas_frag_limit = val;
  	} else if (os_strcmp(buf, "gas_comeback_delay") == 0) {
  		bss->gas_comeback_delay = atoi(pos);
@@ -32,7 +32,7 @@
  		os_free(bss->dump_msk_file);
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -1415,6 +1415,7 @@ static int hostapd_setup_bss(struct host
+@@ -1423,6 +1423,7 @@ static int hostapd_setup_bss(struct host
  		wpa_printf(MSG_ERROR, "GAS server initialization failed");
  		return -1;
  	}
@@ -40,7 +40,7 @@
  
  	if (conf->qos_map_set_len &&
  	    hostapd_drv_set_qos_map(hapd, conf->qos_map_set,
-@@ -1422,7 +1423,6 @@ static int hostapd_setup_bss(struct host
+@@ -1430,7 +1431,6 @@ static int hostapd_setup_bss(struct host
  		wpa_printf(MSG_ERROR, "Failed to initialize QoS Map");
  		return -1;
  	}
@@ -48,40 +48,9 @@
  
  	if (conf->bss_load_update_period && bss_load_update_init(hapd)) {
  		wpa_printf(MSG_ERROR, "BSS Load initialization failed");
---- a/src/ap/drv_callbacks.c
-+++ b/src/ap/drv_callbacks.c
-@@ -271,12 +271,10 @@ int hostapd_notif_assoc(struct hostapd_d
- 	}
- #endif /* NEED_AP_MLME */
- 
--#ifdef CONFIG_INTERWORKING
- 	if (elems.ext_capab && elems.ext_capab_len > 4) {
- 		if (elems.ext_capab[4] & 0x01)
- 			sta->qos_map_enabled = 1;
- 	}
--#endif /* CONFIG_INTERWORKING */
- 
- #ifdef CONFIG_HS20
- 	wpabuf_free(sta->hs20_ie);
---- a/src/ap/ieee802_11.c
-+++ b/src/ap/ieee802_11.c
-@@ -4129,13 +4129,11 @@ static u16 copy_supp_rates(struct hostap
- static u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
- 			   const u8 *ext_capab_ie, size_t ext_capab_ie_len)
- {
--#ifdef CONFIG_INTERWORKING
- 	/* check for QoS Map support */
- 	if (ext_capab_ie_len >= 5) {
- 		if (ext_capab_ie[4] & 0x01)
- 			sta->qos_map_enabled = 1;
- 	}
--#endif /* CONFIG_INTERWORKING */
- 
- 	if (ext_capab_ie_len > 0) {
- 		sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -2540,8 +2540,6 @@ void wnm_bss_keep_alive_deinit(struct wp
+@@ -2586,8 +2586,6 @@ void wnm_bss_keep_alive_deinit(struct wp
  }
  
  
@@ -90,7 +59,7 @@
  static int wpas_qos_map_set(struct wpa_supplicant *wpa_s, const u8 *qos_map,
  			    size_t len)
  {
-@@ -2574,8 +2572,6 @@ static void interworking_process_assoc_r
+@@ -2620,8 +2618,6 @@ static void interworking_process_assoc_r
  	}
  }
  
@@ -99,7 +68,7 @@
  
  static void multi_ap_process_assoc_resp(struct wpa_supplicant *wpa_s,
  					const u8 *ies, size_t ies_len)
-@@ -2908,10 +2904,8 @@ static int wpa_supplicant_event_associnf
+@@ -2954,10 +2950,8 @@ static int wpa_supplicant_event_associnf
  		wnm_process_assoc_resp(wpa_s, data->assoc_info.resp_ies,
  				       data->assoc_info.resp_ies_len);
  #endif /* CONFIG_WNM */
@@ -110,3 +79,19 @@
  		if (wpa_s->hw_capab == CAPAB_VHT &&
  		    get_ie(data->assoc_info.resp_ies,
  			   data->assoc_info.resp_ies_len, WLAN_EID_VHT_CAP))
+--- a/src/ap/ieee802_11_shared.c
++++ b/src/ap/ieee802_11_shared.c
+@@ -1098,13 +1098,11 @@ u8 * hostapd_eid_rsnxe(struct hostapd_da
+ u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
+ 		    const u8 *ext_capab_ie, size_t ext_capab_ie_len)
+ {
+-#ifdef CONFIG_INTERWORKING
+ 	/* check for QoS Map support */
+ 	if (ext_capab_ie_len >= 5) {
+ 		if (ext_capab_ie[4] & 0x01)
+ 			sta->qos_map_enabled = 1;
+ 	}
+-#endif /* CONFIG_INTERWORKING */
+ 
+ 	if (ext_capab_ie_len > 0) {
+ 		sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
diff --git a/recipes-connectivity/hostapd/files/patches/812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch b/recipes-connectivity/hostapd/files/patches/812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch
new file mode 100644
index 0000000..68935df
--- /dev/null
+++ b/recipes-connectivity/hostapd/files/patches/812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch
@@ -0,0 +1,44 @@
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index 55b7188..6af0ef2 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1048,7 +1048,7 @@ static int hostapd_dfs_request_channel_switch(struct hostapd_iface *iface,
+ }
+ 
+ 
+-static void hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
++static int hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
+ {
+ 	int sec = 0;
+ 	enum dfs_channel_type channel_type = DFS_NO_CAC_YET;
+@@ -1084,7 +1084,7 @@ static void hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
+ 				  oper_centr_freq_seg1_idx, true)) {
+ 		wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
+ 		iface->radar_background.channel = -1;
+-		return;
++		return -1;
+ 	}
+ 
+ 	iface->radar_background.channel = channel->chan;
+@@ -1096,6 +1096,8 @@ static void hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
+ 	wpa_printf(MSG_ERROR,
+ 		   "%s: setting background chain to chan %d (%d MHz)",
+ 		   __func__, channel->chan, channel->freq);
++
++	return 0;
+ }
+ 
+ 
+@@ -1320,8 +1322,7 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
+ 		 * Just select a new random channel according to the
+ 		 * regulations for monitoring.
+ 		 */
+-		hostpad_dfs_update_background_chain(iface);
+-		return 0;
++		return hostpad_dfs_update_background_chain(iface);
+ 	}
+ 
+ 	/*
+-- 
+2.29.2
+
diff --git a/recipes-connectivity/hostapd/files/patches/900-master-sync-include-uapi-linux-nl80211.patch b/recipes-connectivity/hostapd/files/patches/900-master-sync-include-uapi-linux-nl80211.patch
deleted file mode 100644
index fe47b57..0000000
--- a/recipes-connectivity/hostapd/files/patches/900-master-sync-include-uapi-linux-nl80211.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
-index f962c06..f7be755 100644
---- a/src/drivers/nl80211_copy.h
-+++ b/src/drivers/nl80211_copy.h
-@@ -2560,6 +2560,19 @@ enum nl80211_commands {
-  *	disassoc events to indicate that an immediate reconnect to the AP
-  *	is desired.
-  *
-+ * @NL80211_ATTR_OBSS_COLOR_BITMAP: bitmap of the u64 BSS colors for the
-+ *	%NL80211_CMD_OBSS_COLOR_COLLISION event.
-+ *
-+ * @NL80211_ATTR_COLOR_CHANGE_COUNT: u8 attribute specifying the number of TBTT's
-+ *	until the color switch event.
-+ * @NL80211_ATTR_COLOR_CHANGE_COLOR: u8 attribute specifying the color that we are
-+ *	switching to
-+ * @NL80211_ATTR_COLOR_CHANGE_ELEMS: Nested set of attributes containing the IE
-+ *	information for the time while performing a color switch.
-+ *
-+ * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
-+ *	transmit power to stay within regulatory limits. u32, dBi.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3057,6 +3070,14 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_DISABLE_HE,
- 
-+	NL80211_ATTR_OBSS_COLOR_BITMAP,
-+
-+	NL80211_ATTR_COLOR_CHANGE_COUNT,
-+	NL80211_ATTR_COLOR_CHANGE_COLOR,
-+	NL80211_ATTR_COLOR_CHANGE_ELEMS,
-+
-+	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -5950,6 +5971,9 @@ enum nl80211_feature_flags {
-  *      frame protection for all management frames exchanged during the
-  *      negotiation and range measurement procedure.
-  *
-+ * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
-+ *	detection and change announcemnts.
-+ *
-  * @NUM_NL80211_EXT_FEATURES: number of extended features.
-  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
-  */
-@@ -6014,6 +6038,7 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_SECURE_LTF,
- 	NL80211_EXT_FEATURE_SECURE_RTT,
- 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
-+	NL80211_EXT_FEATURE_BSS_COLOR,
- 
- 	/* add new features before the definition below */
- 	NUM_NL80211_EXT_FEATURES,
diff --git a/recipes-connectivity/hostapd/files/patches/901-master-zero-wait_dfs.patch b/recipes-connectivity/hostapd/files/patches/901-master-zero-wait_dfs.patch
deleted file mode 100644
index cb11aee..0000000
--- a/recipes-connectivity/hostapd/files/patches/901-master-zero-wait_dfs.patch
+++ /dev/null
@@ -1,851 +0,0 @@
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 1e1b685..8f6281a 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -2476,6 +2476,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 		conf->ieee80211d = atoi(pos);
- 	} else if (os_strcmp(buf, "ieee80211h") == 0) {
- 		conf->ieee80211h = atoi(pos);
-+	} else if (os_strcmp(buf, "radar_offchan") == 0) {
-+		conf->radar_offchan = atoi(pos);
- 	} else if (os_strcmp(buf, "ieee8021x") == 0) {
- 		bss->ieee802_1x = atoi(pos);
- 	} else if (os_strcmp(buf, "eapol_version") == 0) {
-diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
-index a89ce9b..0c951a9 100644
---- a/hostapd/hostapd.conf
-+++ b/hostapd/hostapd.conf
-@@ -143,6 +143,13 @@ ssid=test
- # ieee80211d=1 and local_pwr_constraint configured.
- #spectrum_mgmt_required=1
- 
-+# Enable radar/CAC detection through a dedicated offchannel chain available on
-+# some hw. The chain can't be used to transmits or receives frames.
-+# This feature allows to avoid CAC downtime switching on a different channel
-+# during CAC detection on the selected radar channel.
-+# (default: 0 = disabled, 1 = enabled)
-+#radar_offchan=0
-+
- # Operation mode (a = IEEE 802.11a (5 GHz), b = IEEE 802.11b (2.4 GHz),
- # g = IEEE 802.11g (2.4 GHz), ad = IEEE 802.11ad (60 GHz); a/g options are used
- # with IEEE 802.11n (HT), too, to specify band). For IEEE 802.11ac (VHT), this
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 28b7efe..ffc3c2c 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -993,6 +993,7 @@ struct hostapd_config {
- 	int ieee80211d;
- 
- 	int ieee80211h; /* DFS */
-+	int radar_offchan;
- 
- 	/*
- 	 * Local power constraint is an octet encoded as an unsigned integer in
-diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index bc49079..c97ee39 100644
---- a/src/ap/ap_drv_ops.c
-+++ b/src/ap/ap_drv_ops.c
-@@ -810,7 +810,8 @@ int hostapd_start_dfs_cac(struct hostapd_iface *iface,
- 			  int channel, int ht_enabled, int vht_enabled,
- 			  int he_enabled,
- 			  int sec_channel_offset, int oper_chwidth,
--			  int center_segment0, int center_segment1)
-+			  int center_segment0, int center_segment1,
-+			  int radar_offchan)
- {
- 	struct hostapd_data *hapd = iface->bss[0];
- 	struct hostapd_freq_params data;
-@@ -836,10 +837,14 @@ int hostapd_start_dfs_cac(struct hostapd_iface *iface,
- 		wpa_printf(MSG_ERROR, "Can't set freq params");
- 		return -1;
- 	}
-+	data.radar_offchan = radar_offchan;
- 
- 	res = hapd->driver->start_dfs_cac(hapd->drv_priv, &data);
- 	if (!res) {
--		iface->cac_started = 1;
-+		if (radar_offchan)
-+			iface->radar_offchan.cac_started = 1;
-+		else
-+			iface->cac_started = 1;
- 		os_get_reltime(&iface->dfs_cac_start);
- 	}
- 
-diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 61c8f64..92842a1 100644
---- a/src/ap/ap_drv_ops.h
-+++ b/src/ap/ap_drv_ops.h
-@@ -130,7 +130,8 @@ int hostapd_start_dfs_cac(struct hostapd_iface *iface,
- 			  int channel, int ht_enabled, int vht_enabled,
- 			  int he_enabled,
- 			  int sec_channel_offset, int oper_chwidth,
--			  int center_segment0, int center_segment1);
-+			  int center_segment0, int center_segment1,
-+			  int radar_offchan);
- int hostapd_drv_do_acs(struct hostapd_data *hapd);
- int hostapd_drv_update_dh_ie(struct hostapd_data *hapd, const u8 *peer,
- 			     u16 reason_code, const u8 *ie, size_t ielen);
-diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index eccda1a..3b1276f 100644
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -51,16 +51,31 @@ static int dfs_get_used_n_chans(struct hostapd_iface *iface, int *seg1)
- 	return n_chans;
- }
- 
--
-+/*
-+ * flags:
-+ * - 0: any channel
-+ * - 1: non-radar channel or radar available one
-+ * - 2: radar-only channel not yet available
-+ */
- static int dfs_channel_available(struct hostapd_channel_data *chan,
--				 int skip_radar)
-+				 int flags)
- {
-+	if (flags == 2) {
-+		/* Select only radar channel where CAC has not been
-+		 * performed yet
-+		 */
-+		if ((chan->flag & HOSTAPD_CHAN_RADAR) &&
-+		    (chan->flag & HOSTAPD_CHAN_DFS_MASK) ==
-+		     HOSTAPD_CHAN_DFS_USABLE)
-+			return 1;
-+		return 0;
-+	}
- 	/*
- 	 * When radar detection happens, CSA is performed. However, there's no
- 	 * time for CAC, so radar channels must be skipped when finding a new
- 	 * channel for CSA, unless they are available for immediate use.
- 	 */
--	if (skip_radar && (chan->flag & HOSTAPD_CHAN_RADAR) &&
-+	if (flags && (chan->flag & HOSTAPD_CHAN_RADAR) &&
- 	    ((chan->flag & HOSTAPD_CHAN_DFS_MASK) !=
- 	     HOSTAPD_CHAN_DFS_AVAILABLE))
- 		return 0;
-@@ -136,10 +151,15 @@ dfs_get_chan_data(struct hostapd_hw_modes *mode, int freq, int first_chan_idx)
- 	return NULL;
- }
- 
--
-+/*
-+ * flags:
-+ * - 0: any channel
-+ * - 1: non-radar channel or radar available one
-+ * - 2: radar-only channel not yet available
-+ */
- static int dfs_chan_range_available(struct hostapd_hw_modes *mode,
- 				    int first_chan_idx, int num_chans,
--				    int skip_radar)
-+				    int flags)
- {
- 	struct hostapd_channel_data *first_chan, *chan;
- 	int i;
-@@ -178,7 +198,7 @@ static int dfs_chan_range_available(struct hostapd_hw_modes *mode,
- 			return 0;
- 		}
- 
--		if (!dfs_channel_available(chan, skip_radar)) {
-+		if (!dfs_channel_available(chan, flags)) {
- 			wpa_printf(MSG_DEBUG, "DFS: channel not available %d",
- 				   first_chan->freq + i * 20);
- 			return 0;
-@@ -205,10 +225,15 @@ static int is_in_chanlist(struct hostapd_iface *iface,
-  *  - hapd->secondary_channel
-  *  - hapd->vht/he_oper_centr_freq_seg0_idx
-  *  - hapd->vht/he_oper_centr_freq_seg1_idx
-+ *
-+ * flags:
-+ * - 0: any channel
-+ * - 1: non-radar channel or radar available one
-+ * - 2: radar-only channel not yet available
-  */
- static int dfs_find_channel(struct hostapd_iface *iface,
- 			    struct hostapd_channel_data **ret_chan,
--			    int idx, int skip_radar)
-+			    int idx, int flags)
- {
- 	struct hostapd_hw_modes *mode;
- 	struct hostapd_channel_data *chan;
-@@ -233,7 +258,7 @@ static int dfs_find_channel(struct hostapd_iface *iface,
- 		}
- 
- 		/* Skip incompatible chandefs */
--		if (!dfs_chan_range_available(mode, i, n_chans, skip_radar)) {
-+		if (!dfs_chan_range_available(mode, i, n_chans, flags)) {
- 			wpa_printf(MSG_DEBUG,
- 				   "DFS: range not available for %d (%d)",
- 				   chan->freq, chan->chan);
-@@ -467,13 +492,18 @@ static int dfs_check_chans_unavailable(struct hostapd_iface *iface,
- 	return res;
- }
- 
--
-+/*
-+ * flags:
-+ * - 0: any channel
-+ * - 1: non-radar channel or radar available one
-+ * - 2: radar-only channel not yet available
-+ */
- static struct hostapd_channel_data *
- dfs_get_valid_channel(struct hostapd_iface *iface,
- 		      int *secondary_channel,
- 		      u8 *oper_centr_freq_seg0_idx,
- 		      u8 *oper_centr_freq_seg1_idx,
--		      int skip_radar)
-+		      int flags)
- {
- 	struct hostapd_hw_modes *mode;
- 	struct hostapd_channel_data *chan = NULL;
-@@ -502,7 +532,7 @@ dfs_get_valid_channel(struct hostapd_iface *iface,
- 		return NULL;
- 
- 	/* Get the count first */
--	num_available_chandefs = dfs_find_channel(iface, NULL, 0, skip_radar);
-+	num_available_chandefs = dfs_find_channel(iface, NULL, 0, flags);
- 	wpa_printf(MSG_DEBUG, "DFS: num_available_chandefs=%d",
- 		   num_available_chandefs);
- 	if (num_available_chandefs == 0)
-@@ -523,7 +553,7 @@ dfs_get_valid_channel(struct hostapd_iface *iface,
- 		return NULL;
- 
- 	chan_idx = _rand % num_available_chandefs;
--	dfs_find_channel(iface, &chan, chan_idx, skip_radar);
-+	dfs_find_channel(iface, &chan, chan_idx, flags);
- 	if (!chan) {
- 		wpa_printf(MSG_DEBUG, "DFS: no random channel found");
- 		return NULL;
-@@ -552,7 +582,7 @@ dfs_get_valid_channel(struct hostapd_iface *iface,
- 		for (i = 0; i < num_available_chandefs - 1; i++) {
- 			/* start from chan_idx + 1, end when chan_idx - 1 */
- 			chan_idx2 = (chan_idx + 1 + i) % num_available_chandefs;
--			dfs_find_channel(iface, &chan2, chan_idx2, skip_radar);
-+			dfs_find_channel(iface, &chan2, chan_idx2, flags);
- 			if (chan2 && abs(chan2->chan - chan->chan) > 12) {
- 				/* two channels are not adjacent */
- 				sec_chan_idx_80p80 = chan2->chan;
-@@ -582,6 +612,27 @@ dfs_get_valid_channel(struct hostapd_iface *iface,
- 	return chan;
- }
- 
-+static int dfs_set_valid_channel(struct hostapd_iface *iface, int skip_radar)
-+{
-+	struct hostapd_channel_data *channel;
-+	u8 cf1 = 0, cf2 = 0;
-+	int sec = 0;
-+
-+	channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2,
-+					skip_radar);
-+	if (!channel) {
-+		wpa_printf(MSG_ERROR, "could not get valid channel");
-+		return -1;
-+	}
-+
-+	iface->freq = channel->freq;
-+	iface->conf->channel = channel->chan;
-+	iface->conf->secondary_channel = sec;
-+	hostapd_set_oper_centr_freq_seg0_idx(iface->conf, cf1);
-+	hostapd_set_oper_centr_freq_seg1_idx(iface->conf, cf2);
-+
-+	return 0;
-+}
- 
- static int set_dfs_state_freq(struct hostapd_iface *iface, int freq, u32 state)
- {
-@@ -761,6 +812,11 @@ static unsigned int dfs_get_cac_time(struct hostapd_iface *iface,
- 	return cac_time_ms;
- }
- 
-+static int hostapd_is_radar_offchan_enabled(struct hostapd_iface *iface)
-+{
-+	return (iface->drv_flags2 & WPA_DRIVER_RADAR_OFFCHAN) &&
-+	       iface->conf->radar_offchan;
-+}
- 
- /*
-  * Main DFS handler
-@@ -770,9 +826,8 @@ static unsigned int dfs_get_cac_time(struct hostapd_iface *iface,
-  */
- int hostapd_handle_dfs(struct hostapd_iface *iface)
- {
--	struct hostapd_channel_data *channel;
- 	int res, n_chans, n_chans1, start_chan_idx, start_chan_idx1;
--	int skip_radar = 0;
-+	int skip_radar = 0, radar_offchan;
- 
- 	if (is_6ghz_freq(iface->freq))
- 		return 1;
-@@ -825,28 +880,18 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
- 		wpa_printf(MSG_DEBUG, "DFS %d chans unavailable - choose other channel: %s",
- 			   res, res ? "yes": "no");
- 		if (res) {
--			int sec = 0;
--			u8 cf1 = 0, cf2 = 0;
--
--			channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2,
--							skip_radar);
--			if (!channel) {
--				wpa_printf(MSG_ERROR, "could not get valid channel");
-+			if (dfs_set_valid_channel(iface, skip_radar) < 0) {
- 				hostapd_set_state(iface, HAPD_IFACE_DFS);
- 				return 0;
- 			}
--
--			iface->freq = channel->freq;
--			iface->conf->channel = channel->chan;
--			iface->conf->secondary_channel = sec;
--			hostapd_set_oper_centr_freq_seg0_idx(iface->conf, cf1);
--			hostapd_set_oper_centr_freq_seg1_idx(iface->conf, cf2);
- 		}
- 	} while (res);
- 
- 	/* Finally start CAC */
- 	hostapd_set_state(iface, HAPD_IFACE_DFS);
--	wpa_printf(MSG_DEBUG, "DFS start CAC on %d MHz", iface->freq);
-+	radar_offchan = hostapd_is_radar_offchan_enabled(iface);
-+	wpa_printf(MSG_DEBUG, "DFS start CAC on %d MHz offchan %d",
-+		   iface->freq, radar_offchan);
- 	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_CAC_START
- 		"freq=%d chan=%d sec_chan=%d, width=%d, seg0=%d, seg1=%d, cac_time=%ds",
- 		iface->freq,
-@@ -863,13 +908,37 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
- 		iface->conf->secondary_channel,
- 		hostapd_get_oper_chwidth(iface->conf),
- 		hostapd_get_oper_centr_freq_seg0_idx(iface->conf),
--		hostapd_get_oper_centr_freq_seg1_idx(iface->conf));
-+		hostapd_get_oper_centr_freq_seg1_idx(iface->conf),
-+		radar_offchan);
- 
- 	if (res) {
- 		wpa_printf(MSG_ERROR, "DFS start_dfs_cac() failed, %d", res);
- 		return -1;
- 	}
- 
-+	if (radar_offchan) {
-+		/* Cache offchannel radar parameters */
-+		iface->radar_offchan.channel = iface->conf->channel;
-+		iface->radar_offchan.secondary_channel =
-+			iface->conf->secondary_channel;
-+		iface->radar_offchan.freq = iface->freq;
-+		iface->radar_offchan.centr_freq_seg0_idx =
-+			hostapd_get_oper_centr_freq_seg0_idx(iface->conf);
-+		iface->radar_offchan.centr_freq_seg1_idx =
-+			hostapd_get_oper_centr_freq_seg1_idx(iface->conf);
-+
-+		/*
-+		 * Let's select a random channel for the moment
-+		 * and perform CAC on dedicated radar chain
-+		 */
-+		res = dfs_set_valid_channel(iface, 1);
-+		if (res < 0)
-+			return res;
-+
-+		iface->radar_offchan.temp_ch = 1;
-+		return 1;
-+	}
-+
- 	return 0;
- }
- 
-@@ -890,6 +959,157 @@ int hostapd_is_dfs_chan_available(struct hostapd_iface *iface)
- 	return dfs_check_chans_available(iface, start_chan_idx, n_chans);
- }
- 
-+static int hostapd_dfs_request_channel_switch(struct hostapd_iface *iface,
-+					      int channel, int freq,
-+					      int secondary_channel,
-+					      u8 oper_centr_freq_seg0_idx,
-+					      u8 oper_centr_freq_seg1_idx)
-+{
-+	struct hostapd_hw_modes *cmode = iface->current_mode;
-+	int ieee80211_mode = IEEE80211_MODE_AP, err, i;
-+	struct csa_settings csa_settings;
-+	u8 new_vht_oper_chwidth;
-+
-+	wpa_printf(MSG_DEBUG, "DFS will switch to a new channel %d", channel);
-+	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_NEW_CHANNEL
-+		"freq=%d chan=%d sec_chan=%d", freq, channel,
-+		secondary_channel);
-+
-+	new_vht_oper_chwidth = hostapd_get_oper_chwidth(iface->conf);
-+	hostapd_set_oper_chwidth(iface->conf,
-+				 hostapd_get_oper_chwidth(iface->conf));
-+
-+	/* Setup CSA request */
-+	os_memset(&csa_settings, 0, sizeof(csa_settings));
-+	csa_settings.cs_count = 5;
-+	csa_settings.block_tx = 1;
-+#ifdef CONFIG_MESH
-+	if (iface->mconf)
-+		ieee80211_mode = IEEE80211_MODE_MESH;
-+#endif /* CONFIG_MESH */
-+	err = hostapd_set_freq_params(&csa_settings.freq_params,
-+				      iface->conf->hw_mode,
-+				      freq, channel,
-+				      iface->conf->enable_edmg,
-+				      iface->conf->edmg_channel,
-+				      iface->conf->ieee80211n,
-+				      iface->conf->ieee80211ac,
-+				      iface->conf->ieee80211ax,
-+				      secondary_channel,
-+				      new_vht_oper_chwidth,
-+				      oper_centr_freq_seg0_idx,
-+				      oper_centr_freq_seg1_idx,
-+				      cmode->vht_capab,
-+				      &cmode->he_capab[ieee80211_mode]);
-+
-+	if (err) {
-+		wpa_printf(MSG_ERROR, "DFS failed to calculate CSA freq params");
-+		hostapd_disable_iface(iface);
-+		return err;
-+	}
-+
-+	for (i = 0; i < iface->num_bss; i++) {
-+		err = hostapd_switch_channel(iface->bss[i], &csa_settings);
-+		if (err)
-+			break;
-+	}
-+
-+	if (err) {
-+		wpa_printf(MSG_WARNING, "DFS failed to schedule CSA (%d) - trying fallback",
-+			   err);
-+		iface->freq = freq;
-+		iface->conf->channel = channel;
-+		iface->conf->secondary_channel = secondary_channel;
-+		hostapd_set_oper_chwidth(iface->conf, new_vht_oper_chwidth);
-+		hostapd_set_oper_centr_freq_seg0_idx(iface->conf,
-+						     oper_centr_freq_seg0_idx);
-+		hostapd_set_oper_centr_freq_seg1_idx(iface->conf,
-+						     oper_centr_freq_seg1_idx);
-+
-+		hostapd_disable_iface(iface);
-+		hostapd_enable_iface(iface);
-+
-+		return 0;
-+	}
-+
-+	/* Channel configuration will be updated once CSA completes and
-+	 * ch_switch_notify event is received */
-+	wpa_printf(MSG_DEBUG, "DFS waiting channel switch event");
-+
-+	return 0;
-+}
-+
-+static struct hostapd_channel_data *
-+dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
-+			u8 *oper_centr_freq_seg0_idx,
-+			u8 *oper_centr_freq_seg1_idx, int *skip_radar);
-+
-+static void
-+hostpad_dfs_update_offchannel_chain(struct hostapd_iface *iface)
-+{
-+	struct hostapd_channel_data *channel;
-+	int sec = 0, flags = 2;
-+	u8 cf1 = 0, cf2 = 0;
-+
-+	channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2, 2);
-+	if (!channel || channel->chan == iface->conf->channel)
-+		channel = dfs_downgrade_bandwidth(iface, &sec, &cf1, &cf2,
-+						  &flags);
-+	if (!channel ||
-+	    hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
-+				  channel->freq, channel->chan,
-+				  iface->conf->ieee80211n,
-+				  iface->conf->ieee80211ac,
-+				  iface->conf->ieee80211ax,
-+				  sec, hostapd_get_oper_chwidth(iface->conf),
-+				  cf1, cf2, 1)) {
-+		/*
-+		 * Toggle interface state to enter DFS state
-+		 * until NOP is finished.
-+		 */
-+		wpa_printf(MSG_ERROR, "DFS failed start CAC offchannel");
-+		return;
-+	}
-+
-+	wpa_printf(MSG_DEBUG, "%s: setting offchannel chain to chan %d (%d MHz)",
-+		   __func__, channel->chan, channel->freq);
-+
-+	iface->radar_offchan.channel = channel->chan;
-+	iface->radar_offchan.freq = channel->freq;
-+	iface->radar_offchan.secondary_channel = sec;
-+	iface->radar_offchan.centr_freq_seg0_idx = cf1;
-+	iface->radar_offchan.centr_freq_seg1_idx = cf2;
-+}
-+
-+/* FIXME: check if all channel bandwith */
-+static int
-+hostapd_dfs_is_offchan_event(struct hostapd_iface *iface, int freq)
-+{
-+	if (iface->radar_offchan.freq != freq)
-+		return 0;
-+
-+	return 1;
-+}
-+
-+static int
-+hostapd_dfs_start_channel_switch_offchan(struct hostapd_iface *iface)
-+{
-+	iface->conf->channel = iface->radar_offchan.channel;
-+	iface->freq = iface->radar_offchan.freq;
-+	iface->conf->secondary_channel =
-+		iface->radar_offchan.secondary_channel;
-+	hostapd_set_oper_centr_freq_seg0_idx(iface->conf,
-+			iface->radar_offchan.centr_freq_seg0_idx);
-+	hostapd_set_oper_centr_freq_seg1_idx(iface->conf,
-+			iface->radar_offchan.centr_freq_seg1_idx);
-+
-+	hostpad_dfs_update_offchannel_chain(iface);
-+
-+	return hostapd_dfs_request_channel_switch(iface, iface->conf->channel,
-+						  iface->freq, iface->conf->secondary_channel,
-+						  hostapd_get_oper_centr_freq_seg0_idx(iface->conf),
-+						  hostapd_get_oper_centr_freq_seg1_idx(iface->conf));
-+}
- 
- int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
- 			     int ht_enabled, int chan_offset, int chan_width,
-@@ -911,6 +1131,23 @@ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
- 			set_dfs_state(iface, freq, ht_enabled, chan_offset,
- 				      chan_width, cf1, cf2,
- 				      HOSTAPD_CHAN_DFS_AVAILABLE);
-+
-+			/*
-+			 * radar event from offchannel chain for selected
-+			 * channel. Perfrom CSA, move main chain to selected
-+			 * channel and configure offchannel chain to a new DFS
-+			 * channel
-+			 */
-+			if (hostapd_is_radar_offchan_enabled(iface) &&
-+			    hostapd_dfs_is_offchan_event(iface, freq)) {
-+				iface->radar_offchan.cac_started = 0;
-+				if (iface->radar_offchan.temp_ch) {
-+					iface->radar_offchan.temp_ch = 0;
-+					return hostapd_dfs_start_channel_switch_offchan(iface);
-+				}
-+				return 0;
-+			}
-+
- 			/*
- 			 * Just mark the channel available when CAC completion
- 			 * event is received in enabled state. CAC result could
-@@ -927,6 +1164,10 @@ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
- 				iface->cac_started = 0;
- 			}
- 		}
-+	} else if (hostapd_is_radar_offchan_enabled(iface) &&
-+		   hostapd_dfs_is_offchan_event(iface, freq)) {
-+		iface->radar_offchan.cac_started = 0;
-+		hostpad_dfs_update_offchannel_chain(iface);
- 	}
- 
- 	return 0;
-@@ -1036,6 +1277,44 @@ static int hostapd_dfs_start_channel_switch_cac(struct hostapd_iface *iface)
- 	return err;
- }
- 
-+static int
-+hostapd_dfs_offchan_start_channel_switch(struct hostapd_iface *iface, int freq)
-+{
-+	if (!hostapd_is_radar_offchan_enabled(iface))
-+		return -1; /* Offchannel chain not supported */
-+
-+	wpa_printf(MSG_DEBUG,
-+		   "%s called (offchannel CAC active: %s, CSA active: %s)",
-+		   __func__, iface->radar_offchan.cac_started ? "yes" : "no",
-+		   hostapd_csa_in_progress(iface) ? "yes" : "no");
-+
-+	/* Check if CSA in progress */
-+	if (hostapd_csa_in_progress(iface))
-+		return 0;
-+
-+	/*
-+	 * If offchannel radar detation is supported and radar channel
-+	 * monitored by offchain is available switch to it without waiting
-+	 * for the CAC otherwise let's keep a random channel.
-+	 * If radar pattern is reported on offchannel chain, just switch to
-+	 * monitor another radar channel.
-+	 */
-+	if (hostapd_dfs_is_offchan_event(iface, freq)) {
-+		hostpad_dfs_update_offchannel_chain(iface);
-+		return 0;
-+	}
-+
-+	/* Offchannel not availanle yet. Perform CAC on main chain */
-+	if (iface->radar_offchan.cac_started) {
-+		/* We want to switch to monitored channel as soon as
-+		 * CAC is completed.
-+		 */
-+		iface->radar_offchan.temp_ch = 1;
-+		return -1;
-+	}
-+
-+	return hostapd_dfs_start_channel_switch_offchan(iface);
-+}
- 
- static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
- {
-@@ -1043,13 +1322,7 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
- 	int secondary_channel;
- 	u8 oper_centr_freq_seg0_idx;
- 	u8 oper_centr_freq_seg1_idx;
--	u8 new_vht_oper_chwidth;
- 	int skip_radar = 1;
--	struct csa_settings csa_settings;
--	unsigned int i;
--	int err = 1;
--	struct hostapd_hw_modes *cmode = iface->current_mode;
--	u8 current_vht_oper_chwidth = hostapd_get_oper_chwidth(iface->conf);
- 	int ieee80211_mode = IEEE80211_MODE_AP;
- 
- 	wpa_printf(MSG_DEBUG, "%s called (CAC active: %s, CSA active: %s)",
-@@ -1113,73 +1386,16 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
- 		}
- 	}
- 
--	wpa_printf(MSG_DEBUG, "DFS will switch to a new channel %d",
--		   channel->chan);
--	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_NEW_CHANNEL
--		"freq=%d chan=%d sec_chan=%d", channel->freq,
--		channel->chan, secondary_channel);
--
--	new_vht_oper_chwidth = hostapd_get_oper_chwidth(iface->conf);
--	hostapd_set_oper_chwidth(iface->conf, current_vht_oper_chwidth);
--
--	/* Setup CSA request */
--	os_memset(&csa_settings, 0, sizeof(csa_settings));
--	csa_settings.cs_count = 5;
--	csa_settings.block_tx = 1;
- #ifdef CONFIG_MESH
- 	if (iface->mconf)
- 		ieee80211_mode = IEEE80211_MODE_MESH;
- #endif /* CONFIG_MESH */
--	err = hostapd_set_freq_params(&csa_settings.freq_params,
--				      iface->conf->hw_mode,
--				      channel->freq,
--				      channel->chan,
--				      iface->conf->enable_edmg,
--				      iface->conf->edmg_channel,
--				      iface->conf->ieee80211n,
--				      iface->conf->ieee80211ac,
--				      iface->conf->ieee80211ax,
--				      secondary_channel,
--				      new_vht_oper_chwidth,
--				      oper_centr_freq_seg0_idx,
--				      oper_centr_freq_seg1_idx,
--				      cmode->vht_capab,
--				      &cmode->he_capab[ieee80211_mode]);
--
--	if (err) {
--		wpa_printf(MSG_ERROR, "DFS failed to calculate CSA freq params");
--		hostapd_disable_iface(iface);
--		return err;
--	}
- 
--	for (i = 0; i < iface->num_bss; i++) {
--		err = hostapd_switch_channel(iface->bss[i], &csa_settings);
--		if (err)
--			break;
--	}
--
--	if (err) {
--		wpa_printf(MSG_WARNING, "DFS failed to schedule CSA (%d) - trying fallback",
--			   err);
--		iface->freq = channel->freq;
--		iface->conf->channel = channel->chan;
--		iface->conf->secondary_channel = secondary_channel;
--		hostapd_set_oper_chwidth(iface->conf, new_vht_oper_chwidth);
--		hostapd_set_oper_centr_freq_seg0_idx(iface->conf,
--						     oper_centr_freq_seg0_idx);
--		hostapd_set_oper_centr_freq_seg1_idx(iface->conf,
--						     oper_centr_freq_seg1_idx);
--
--		hostapd_disable_iface(iface);
--		hostapd_enable_iface(iface);
--		return 0;
--	}
--
--	/* Channel configuration will be updated once CSA completes and
--	 * ch_switch_notify event is received */
--
--	wpa_printf(MSG_DEBUG, "DFS waiting channel switch event");
--	return 0;
-+	return hostapd_dfs_request_channel_switch(iface, channel->chan,
-+						  channel->freq,
-+						  secondary_channel,
-+						  oper_centr_freq_seg0_idx,
-+						  oper_centr_freq_seg1_idx);
- }
- 
- 
-@@ -1208,15 +1424,19 @@ int hostapd_dfs_radar_detected(struct hostapd_iface *iface, int freq,
- 	if (!res)
- 		return 0;
- 
--	/* Skip if reported radar event not overlapped our channels */
--	res = dfs_are_channels_overlapped(iface, freq, chan_width, cf1, cf2);
--	if (!res)
--		return 0;
-+	if (!hostapd_dfs_is_offchan_event(iface, freq)) {
-+		/* Skip if reported radar event not overlapped our channels */
-+		res = dfs_are_channels_overlapped(iface, freq, chan_width,
-+						  cf1, cf2);
-+		if (!res)
-+			return 0;
-+	}
- 
--	/* radar detected while operating, switch the channel. */
--	res = hostapd_dfs_start_channel_switch(iface);
-+	if (hostapd_dfs_offchan_start_channel_switch(iface, freq))
-+		/* radar detected while operating, switch the channel. */
-+		return hostapd_dfs_start_channel_switch(iface);
- 
--	return res;
-+	return 0;
- }
- 
- 
-@@ -1284,7 +1504,11 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
- 		"seg1=%d cac_time=%ds",
- 		freq, (freq - 5000) / 5, chan_offset, chan_width, cf1, cf2,
- 		iface->dfs_cac_ms / 1000);
--	iface->cac_started = 1;
-+
-+	if (hostapd_dfs_is_offchan_event(iface, freq))
-+		iface->radar_offchan.cac_started = 1;
-+	else
-+		iface->cac_started = 1;
- 	os_get_reltime(&iface->dfs_cac_start);
- 	return 0;
- }
-diff --git a/src/ap/hostapd.h b/src/ap/hostapd.h
-index 27b985d..1c6c94e 100644
---- a/src/ap/hostapd.h
-+++ b/src/ap/hostapd.h
-@@ -521,6 +521,21 @@ struct hostapd_iface {
- 	int *basic_rates;
- 	int freq;
- 
-+	/* Offchanel chain configuration */
-+	struct {
-+		int channel;
-+		int secondary_channel;
-+		int freq;
-+		int centr_freq_seg0_idx;
-+		int centr_freq_seg1_idx;
-+		/* Main chain is on temporary channel during
-+		 * CAC detection on radar offchain
-+		 */
-+		unsigned int temp_ch:1;
-+		/* CAC started on radar offchain */
-+		unsigned int cac_started:1;
-+	} radar_offchan;
-+
- 	u16 hw_flags;
- 
- 	/* Number of associated Non-ERP stations (i.e., stations using 802.11b
-diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 6d9194f..7ed47c0 100644
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -777,6 +777,11 @@ struct hostapd_freq_params {
- 	 * for IEEE 802.11ay EDMG configuration.
- 	 */
- 	struct ieee80211_edmg_config edmg;
-+
-+	/**
-+	 * radar_offchan - Whether radar/CAC offchannel is requested
-+	 */
-+	int radar_offchan;
- };
- 
- /**
-@@ -2026,6 +2031,8 @@ struct wpa_driver_capa {
- #define WPA_DRIVER_FLAGS2_OCV			0x0000000000000080ULL
- /** Driver expects user space implementation of SME in AP mode */
- #define WPA_DRIVER_FLAGS2_AP_SME		0x0000000000000100ULL
-+/** Driver supports offchannel radar/CAC detection */
-+#define WPA_DRIVER_RADAR_OFFCHAN		0x0000000000000200ULL
- 	u64 flags2;
- 
- #define FULL_AP_CLIENT_STATE_SUPP(drv_flags) \
-diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 4db8cce..62c3cd8 100644
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -4885,6 +4885,7 @@ static int nl80211_put_freq_params(struct nl_msg *msg,
- 	wpa_printf(MSG_DEBUG, "  * he_enabled=%d", freq->he_enabled);
- 	wpa_printf(MSG_DEBUG, "  * vht_enabled=%d", freq->vht_enabled);
- 	wpa_printf(MSG_DEBUG, "  * ht_enabled=%d", freq->ht_enabled);
-+	wpa_printf(MSG_DEBUG, "  * radar_offchan=%d", freq->radar_offchan);
- 
- 	hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
- 	is_24ghz = hw_mode == HOSTAPD_MODE_IEEE80211G ||
-@@ -4962,6 +4963,9 @@ static int nl80211_put_freq_params(struct nl_msg *msg,
- 				NL80211_CHAN_NO_HT))
- 			return -ENOBUFS;
- 	}
-+	if (freq->radar_offchan)
-+		nla_put_flag(msg, NL80211_ATTR_RADAR_OFFCHAN);
-+
- 	return 0;
- }
- 
-diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index cd596e3..e370ef3 100644
---- a/src/drivers/driver_nl80211_capa.c
-+++ b/src/drivers/driver_nl80211_capa.c
-@@ -665,6 +665,10 @@ static void wiphy_info_ext_feature_flags(struct wiphy_info_data *info,
- 	if (ext_feature_isset(ext_features, len,
- 			      NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION))
- 		capa->flags2 |= WPA_DRIVER_FLAGS2_OCV;
-+
-+	if (ext_feature_isset(ext_features, len,
-+			      NL80211_EXT_FEATURE_RADAR_OFFCHAN))
-+		capa->flags2 |= WPA_DRIVER_RADAR_OFFCHAN;
- }
- 
- 
-diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
-index f7be755..736b483 100644
---- a/src/drivers/nl80211_copy.h
-+++ b/src/drivers/nl80211_copy.h
-@@ -2573,6 +2573,10 @@ enum nl80211_commands {
-  * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
-  *	transmit power to stay within regulatory limits. u32, dBi.
-  *
-+ * @NL80211_ATTR_RADAR_OFFCHAN: Configure dedicated chain available for radar
-+ *	detection on some hw. The chain can't be used to transmits or receives
-+ *	frames. The driver is supposed to implement CAC management in sw or fw.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3078,6 +3082,8 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
- 
-+	NL80211_ATTR_RADAR_OFFCHAN,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -5974,6 +5980,9 @@ enum nl80211_feature_flags {
-  * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
-  *	detection and change announcemnts.
-  *
-+ * @NL80211_EXT_FEATURE_RADAR_OFFCHAN: Device supports offchannel radar/CAC
-+ *	detection.
-+ *
-  * @NUM_NL80211_EXT_FEATURES: number of extended features.
-  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
-  */
-@@ -6039,6 +6048,7 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_SECURE_RTT,
- 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
- 	NL80211_EXT_FEATURE_BSS_COLOR,
-+	NL80211_EXT_FEATURE_RADAR_OFFCHAN,
- 
- 	/* add new features before the definition below */
- 	NUM_NL80211_EXT_FEATURES,
diff --git a/recipes-connectivity/hostapd/files/patches/905-master-Support-configuring-BSS-Termination-TSF-by-using-hos.patch b/recipes-connectivity/hostapd/files/patches/905-master-Support-configuring-BSS-Termination-TSF-by-using-hos.patch
index f6832e3..ad9c926 100644
--- a/recipes-connectivity/hostapd/files/patches/905-master-Support-configuring-BSS-Termination-TSF-by-using-hos.patch
+++ b/recipes-connectivity/hostapd/files/patches/905-master-Support-configuring-BSS-Termination-TSF-by-using-hos.patch
@@ -1,31 +1,21 @@
-From 56613ad9b568a3ac7467105beaa162c68ffbbf70 Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 20:20:03 +0800
-Subject: [PATCH 4/9] Support configuring BSS Termination TSF by using
+From 6a949f8644546d689b7271228d19b1b1ad80632f Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 9 Jun 2022 19:56:18 +0800
+Subject: [PATCH 1/6] Support configuring BSS Termination TSF by using
  hostapd_cli command
 
 ---
- hostapd/ctrl_iface.c | 9 +++++++++
- src/ap/ap_config.c   | 1 +
- src/ap/ap_config.h   | 1 +
- 3 files changed, 11 insertions(+)
+ hostapd/ctrl_iface.c   | 5 +++++
+ src/ap/ap_config.c     | 1 +
+ src/ap/ap_config.h     | 1 +
+ src/ap/ctrl_iface_ap.c | 4 ++++
+ 4 files changed, 11 insertions(+)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index f50fafb..1b5a091 100644
+index 4718368..e0a7e4f 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -954,6 +954,10 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
- 			wpa_printf(MSG_DEBUG, "Invalid bss_term data");
- 			return -1;
- 		}
-+		if (hapd->conf->bss_termination_tsf) {
-+			WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
-+		}
-+
- 		end++;
- 		WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
- 	}
-@@ -1589,6 +1593,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
+@@ -1326,6 +1326,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
  #endif /* CONFIG_DPP */
  	} else if (os_strcasecmp(cmd, "setband") == 0) {
  		ret = hostapd_ctrl_iface_set_band(hapd, value);
@@ -38,7 +28,7 @@
  		ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
  		if (ret)
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 1f04686..078a3fc 100644
+index 23b67e1..f248281 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
@@ -50,10 +40,10 @@
  
  
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index f3aff36..7301bbb 100644
+index f795ee9..5dab8be 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -549,6 +549,7 @@ struct hostapd_bss_config {
+@@ -557,6 +557,7 @@ struct hostapd_bss_config {
  	int wnm_sleep_mode;
  	int wnm_sleep_mode_no_keys;
  	int bss_transition;
@@ -61,6 +51,21 @@
  
  	/* IEEE 802.11u - Interworking */
  	int interworking;
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index c496e4f..aad5180 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1202,6 +1202,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ 			wpa_printf(MSG_DEBUG, "Invalid bss_term data");
+ 			return -1;
+ 		}
++		if (hapd->conf->bss_termination_tsf) {
++			WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
++		}
++
+ 		end++;
+ 		WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
+ 	}
 -- 
 2.18.0
 
diff --git a/recipes-connectivity/hostapd/files/patches/908-master-Support-including-neighbor-report-elements-in-BTM-re.patch b/recipes-connectivity/hostapd/files/patches/908-master-Support-including-neighbor-report-elements-in-BTM-re.patch
index 1bf102a..37f2d96 100644
--- a/recipes-connectivity/hostapd/files/patches/908-master-Support-including-neighbor-report-elements-in-BTM-re.patch
+++ b/recipes-connectivity/hostapd/files/patches/908-master-Support-including-neighbor-report-elements-in-BTM-re.patch
@@ -1,17 +1,17 @@
-From 9043eff145701c6324ae48966301681adacb89c4 Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 21:16:45 +0800
-Subject: [PATCH 7/9] Support including neighbor report elements in BTM request
+From e6f1c893d375aa952e1f9c8c1eb4ecacf588e4e2 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 9 Jun 2022 19:58:57 +0800
+Subject: [PATCH 4/6] Support including neighbor report elements in BTM request
 
 ---
- hostapd/ctrl_iface.c | 7 ++++++-
+ src/ap/ctrl_iface_ap.c | 7 ++++++-
  1 file changed, 6 insertions(+), 1 deletion(-)
 
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 1b5a091..5a82ae6 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -984,8 +984,13 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index aad5180..fccc5f9 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1232,8 +1232,13 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
  		req_mode |= WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT;
  	}
  
diff --git a/recipes-connectivity/hostapd/files/patches/909-master-Add-hostapd_neighbor_set_own_report_pref.patch b/recipes-connectivity/hostapd/files/patches/909-master-Add-hostapd_neighbor_set_own_report_pref.patch
index 14571fe..f77deb2 100644
--- a/recipes-connectivity/hostapd/files/patches/909-master-Add-hostapd_neighbor_set_own_report_pref.patch
+++ b/recipes-connectivity/hostapd/files/patches/909-master-Add-hostapd_neighbor_set_own_report_pref.patch
@@ -1,21 +1,19 @@
-From 6fc069a54efb892e486dfde59cb97e0023dbbf5d Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 21:27:55 +0800
-Subject: [PATCH 8/9] Add hostapd_neighbor_set_own_report_pref()
+From 12b95b365372ca8167b8fdbfd192fcd4dcb11419 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 9 Jun 2022 20:00:49 +0800
+Subject: [PATCH 5/6] Add hostapd_neighbor_set_own_report_pref()
 
-If my own BSS is going to terminate itself, the preference value of neighbor
-report must be set to 0.
 ---
- hostapd/ctrl_iface.c |  5 ++++-
- src/ap/neighbor_db.c | 36 ++++++++++++++++++++++++++++++++++++
- src/ap/neighbor_db.h |  2 ++
- 3 files changed, 42 insertions(+), 1 deletion(-)
+ src/ap/ctrl_iface_ap.c |  6 +++++-
+ src/ap/neighbor_db.c   | 36 ++++++++++++++++++++++++++++++++++++
+ src/ap/neighbor_db.h   |  2 ++
+ 3 files changed, 43 insertions(+), 1 deletion(-)
 
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 5a82ae6..3146a25 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -993,8 +993,11 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index fccc5f9..d5d4e33 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1241,8 +1241,12 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
  	}
  	if (os_strstr(cmd, " abridged=1"))
  		req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
@@ -25,14 +23,15 @@
 +		/* Set own BSS neighbor report preference value as 0 */
 +		hostapd_neighbor_set_own_report_pref(hapd, nei_rep, nei_len, 0);
 +	}
++
  
  #ifdef CONFIG_MBO
  	pos = os_strstr(cmd, "mbo=");
 diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
-index ce6865d..bc1b163 100644
+index fabe64d..20a4417 100644
 --- a/src/ap/neighbor_db.c
 +++ b/src/ap/neighbor_db.c
-@@ -352,3 +352,39 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
+@@ -355,3 +355,39 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
  	wpabuf_free(nr);
  #endif /* NEED_AP_MLME */
  }
diff --git a/recipes-connectivity/hostapd/files/patches/910-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch b/recipes-connectivity/hostapd/files/patches/910-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
index 632475c..8a9e47e 100644
--- a/recipes-connectivity/hostapd/files/patches/910-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
+++ b/recipes-connectivity/hostapd/files/patches/910-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
@@ -1,22 +1,20 @@
-From 7aab6cf66cfb7dea480d16e312e0f0eb08e758ab Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 21:32:17 +0800
-Subject: [PATCH 9/9] Add hostapd_neighbor_set_pref_by_non_pref_chan()
+From be49aa855a83b3bb0c6a96380960b54cbdabcb56 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 9 Jun 2022 20:02:06 +0800
+Subject: [PATCH 6/6] Add hostapd_neighbor_set_pref_by_non_pref_chan()
 
-The preference value of neighbor report shall be modified according to struct
-non_pref_chan_info.
 ---
- hostapd/ctrl_iface.c |  2 ++
- src/ap/neighbor_db.c | 51 ++++++++++++++++++++++++++++++++++++++++++++
- src/ap/neighbor_db.h |  4 ++++
+ src/ap/ctrl_iface_ap.c |  2 ++
+ src/ap/neighbor_db.c   | 51 ++++++++++++++++++++++++++++++++++++++++++
+ src/ap/neighbor_db.h   |  4 ++++
  3 files changed, 57 insertions(+)
 
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 3146a25..974e5b9 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -1000,6 +1000,8 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
- 	}
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index d5d4e33..a888b76 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1249,6 +1249,8 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ 
  
  #ifdef CONFIG_MBO
 +	hostapd_neighbor_set_pref_by_non_pref_chan(hapd, sta, nei_rep, nei_len);
@@ -25,10 +23,10 @@
  	if (pos) {
  		unsigned int mbo_reason, cell_pref, reassoc_delay;
 diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
-index bc1b163..75b6fcc 100644
+index 20a4417..8c27da9 100644
 --- a/src/ap/neighbor_db.c
 +++ b/src/ap/neighbor_db.c
-@@ -388,3 +388,54 @@ void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_b
+@@ -391,3 +391,54 @@ void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_b
  		}
  	}
  }
diff --git a/recipes-connectivity/hostapd/files/patches/912-master-add-the-destination-address-of-unsolicited-Probe.patch b/recipes-connectivity/hostapd/files/patches/912-master-add-the-destination-address-of-unsolicited-Probe.patch
deleted file mode 100644
index e9b630f..0000000
--- a/recipes-connectivity/hostapd/files/patches/912-master-add-the-destination-address-of-unsolicited-Probe.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 96a7f383290f78e15f1e7a5bc33099c81f104c5b Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Fri, 6 May 2022 11:02:36 +0800
-Subject: hostapd: Add the destination address of unsolicited Probe Response
- frame
-
-Without this, hostapd generates Probe Response frames with the null
-destination address when hostapd enables unsolicited Probe Response
-frame transmission. Fix this to use the broadcast address instead.
-
-Fixes: 024b4b2a298f ("AP: Unsolicited broadcast Probe Response configuration")
-Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
----
- src/ap/beacon.c | 13 +++++++++----
- 1 file changed, 9 insertions(+), 4 deletions(-)
-
-diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index eaa403326..58872bfda 100644
---- a/src/ap/beacon.c
-+++ b/src/ap/beacon.c
-@@ -464,7 +464,8 @@ static u8 * hostapd_eid_supported_op_classes(struct hostapd_data *hapd, u8 *eid)
- 
- static u8 * hostapd_gen_probe_resp(struct hostapd_data *hapd,
- 				   const struct ieee80211_mgmt *req,
--				   int is_p2p, size_t *resp_len)
-+				   int is_p2p, size_t *resp_len,
-+				   bool bcast_probe_resp)
- {
- 	struct ieee80211_mgmt *resp;
- 	u8 *pos, *epos, *csa_pos;
-@@ -531,6 +532,9 @@ static u8 * hostapd_gen_probe_resp(struct hostapd_data *hapd,
- 					   WLAN_FC_STYPE_PROBE_RESP);
- 	if (req)
- 		os_memcpy(resp->da, req->sa, ETH_ALEN);
-+	else if (bcast_probe_resp)
-+		os_memset(resp->da, 0xff, ETH_ALEN);
-+
- 	os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN);
- 
- 	os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN);
-@@ -1141,7 +1145,7 @@ void handle_probe_req(struct hostapd_data *hapd,
- 		     " signal=%d", MAC2STR(mgmt->sa), ssi_signal);
- 
- 	resp = hostapd_gen_probe_resp(hapd, mgmt, elems.p2p != NULL,
--				      &resp_len);
-+				      &resp_len, false);
- 	if (resp == NULL)
- 		return;
- 
-@@ -1210,7 +1214,7 @@ static u8 * hostapd_probe_resp_offloads(struct hostapd_data *hapd,
- 			   "this");
- 
- 	/* Generate a Probe Response template for the non-P2P case */
--	return hostapd_gen_probe_resp(hapd, NULL, 0, resp_len);
-+	return hostapd_gen_probe_resp(hapd, NULL, 0, resp_len, false);
- }
- 
- #endif /* NEED_AP_MLME */
-@@ -1228,7 +1232,8 @@ static u8 * hostapd_unsol_bcast_probe_resp(struct hostapd_data *hapd,
- 		hapd->conf->unsol_bcast_probe_resp_interval;
- 
- 	return hostapd_gen_probe_resp(hapd, NULL, 0,
--				      &params->unsol_bcast_probe_resp_tmpl_len);
-+				      &params->unsol_bcast_probe_resp_tmpl_len,
-+				      true);
- }
- #endif /* CONFIG_IEEE80211AX */
- 
--- 
-cgit v1.2.3-18-g5258
-
diff --git a/recipes-connectivity/hostapd/files/patches/913-master-add-support-for-runtime-set-in-band-discover.patch b/recipes-connectivity/hostapd/files/patches/913-master-add-support-for-runtime-set-in-band-discover.patch
index 306b221..d217f5d 100644
--- a/recipes-connectivity/hostapd/files/patches/913-master-add-support-for-runtime-set-in-band-discover.patch
+++ b/recipes-connectivity/hostapd/files/patches/913-master-add-support-for-runtime-set-in-band-discover.patch
@@ -1,7 +1,7 @@
-From 8c9d9f2b8da1b0e3e0832e7d7b02d75c4c0a4f3e Mon Sep 17 00:00:00 2001
+From 31ec868f23a1bae48fceab6f2fb5f8b1a3a909a1 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Thu, 24 May 2022 21:48:21 +0800
-Subject: [PATCH] hostapd:v2 add support for runtime set in-band discovery-v2
+Date: Tue, 31 May 2022 21:15:54 +0800
+Subject: [PATCH] hostapd: add support for runtime set in-band discovery
 
 Usage:
 hostapd_cli unsolic_probe_resp [tx_type] [interval]
@@ -12,18 +12,18 @@
 
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 ---
- hostapd/ctrl_iface.c         | 62 ++++++++++++++++++++++++++++++++++++
- hostapd/hostapd_cli.c        | 20 ++++++++++++
+ hostapd/ctrl_iface.c         | 66 ++++++++++++++++++++++++++++++++++++
+ hostapd/hostapd_cli.c        | 20 +++++++++++
  src/ap/beacon.c              |  5 ++-
  src/drivers/driver_nl80211.c |  8 +++--
  src/drivers/nl80211_copy.h   |  1 +
- 5 files changed, 92 insertions(+), 4 deletions(-)
+ 5 files changed, 96 insertions(+), 4 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 86adf18e5..41740cfd5 100644
+index 86adf18e5..ce04cd641 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -769,6 +769,65 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
+@@ -769,6 +769,69 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
  
  #endif /* CONFIG_INTERWORKING */
  
@@ -57,8 +57,10 @@
 +#define UNSOL_PROBE_RESP 1
 +#define FILS_DISCOVERY 2
 +
++#ifdef CONFIG_FILS
 +	conf->fils_discovery_max_int = 0;
 +	conf->fils_discovery_min_int = 0;
++#endif /* CONFIG_FILS */
 +	conf->unsol_bcast_probe_resp_interval = 0;
 +
 +	switch (tx_type) {
@@ -70,11 +72,13 @@
 +		/* Enable Unsolicited probe response */
 +		conf->unsol_bcast_probe_resp_interval = interval;
 +		break;
++#ifdef CONFIG_FILS
 +	case FILS_DISCOVERY:
 +		/* Enable FILS discovery */
 +		conf->fils_discovery_min_int = interval;
 +		conf->fils_discovery_max_int = interval;
 +		break;
++#endif /* CONFIG_FILS */
 +	}
 +
 +	ret = ieee802_11_update_beacons(hapd->iface);
@@ -89,7 +93,7 @@
  
  #ifdef CONFIG_WNM_AP
  
-@@ -3673,6 +3732,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+@@ -3673,6 +3736,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
  		if (hostapd_ctrl_iface_coloc_intf_req(hapd, buf + 15))
  			reply_len = -1;
  #endif /* CONFIG_WNM_AP */
@@ -138,10 +142,10 @@
  };
  
 diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index 3c49653cc..367e32611 100644
+index a96155ada..68e847956 100644
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
-@@ -1406,6 +1406,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+@@ -1408,6 +1408,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
  				   struct wpa_driver_ap_params *params)
  {
  	params->fd_max_int = hapd->conf->fils_discovery_max_int;
@@ -150,7 +154,7 @@
  	if (is_6ghz_op_class(hapd->iconf->op_class) &&
  	    params->fd_max_int > FD_MAX_INTERVAL_6GHZ)
  		params->fd_max_int = FD_MAX_INTERVAL_6GHZ;
-@@ -1414,7 +1416,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+@@ -1416,7 +1418,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
  	if (params->fd_min_int > params->fd_max_int)
  		params->fd_min_int = params->fd_max_int;
  
diff --git a/recipes-connectivity/hostapd/files/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch b/recipes-connectivity/hostapd/files/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
new file mode 100644
index 0000000..3665c6c
--- /dev/null
+++ b/recipes-connectivity/hostapd/files/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
@@ -0,0 +1,38 @@
+From f0e9f5aab52b3eab85d28338cc996972ced4c39c Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Tue, 17 May 2022 23:07:59 +0200
+Subject: [PATCH] ctrl: make WNM_AP functions dependant on CONFIG_AP
+
+This fixes linking errors found when compiling wpa_supplicant with
+CONFIG_WNM_AP enabled but CONFIG_AP disabled.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ wpa_supplicant/ctrl_iface.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
+index ac337e0f5..6e23114e6 100644
+--- a/wpa_supplicant/ctrl_iface.c
++++ b/wpa_supplicant/ctrl_iface.c
+@@ -12185,7 +12185,7 @@ char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
+ 		if (wpas_ctrl_iface_coloc_intf_report(wpa_s, buf + 18))
+ 			reply_len = -1;
+ #endif /* CONFIG_WNM */
+-#ifdef CONFIG_WNM_AP
++#if defined(CONFIG_AP) && defined(CONFIG_WNM_AP)
+ 	} else if (os_strncmp(buf, "DISASSOC_IMMINENT ", 18) == 0) {
+ 		if (ap_ctrl_iface_disassoc_imminent(wpa_s, buf + 18))
+ 			reply_len = -1;
+@@ -12195,7 +12195,7 @@ char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
+ 	} else if (os_strncmp(buf, "BSS_TM_REQ ", 11) == 0) {
+ 		if (ap_ctrl_iface_bss_tm_req(wpa_s, buf + 11))
+ 			reply_len = -1;
+-#endif /* CONFIG_WNM_AP */
++#endif /* CONFIG_AP && CONFIG_WNM_AP */
+ 	} else if (os_strcmp(buf, "FLUSH") == 0) {
+ 		wpa_supplicant_ctrl_iface_flush(wpa_s);
+ 	} else if (os_strncmp(buf, "RADIO_WORK ", 11) == 0) {
+-- 
+2.35.1
+
diff --git a/recipes-connectivity/hostapd/files/patches/patches.inc b/recipes-connectivity/hostapd/files/patches/patches.inc
index 36ec650..af2e054 100644
--- a/recipes-connectivity/hostapd/files/patches/patches.inc
+++ b/recipes-connectivity/hostapd/files/patches/patches.inc
@@ -35,6 +35,7 @@
     file://461-driver_nl80211-use-new-parameters-during-ibss-join.patch \
     file://463-add-mcast_rate-to-11s.patch \
     file://464-fix-mesh-obss-check.patch \
+    file://465-hostapd-config-support-random-BSS-color.patch \
     file://470-survey_data_fallback.patch \
     file://500-lto-jobserver-support.patch \
     file://590-rrm-wnm-statistics.patch \
@@ -49,8 +50,7 @@
     file://740-snoop_iface.patch \
     file://750-qos_map_set_without_interworking.patch \
     file://751-qos_map_ignore_when_unsupported.patch \
-    file://900-master-sync-include-uapi-linux-nl80211.patch \
-    file://901-master-zero-wait_dfs.patch \
+    file://812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch \
     file://902-master-Add-hostapd_neighbor_count-and-hostapd_neighbor_inse.patch \
     file://903-master-Support-including-neighbor-report-elements-in-ANQP-r.patch \
     file://904-master-Support-including-neignbor-report-elements-in-BTM-re.patch \
@@ -61,6 +61,6 @@
     file://909-master-Add-hostapd_neighbor_set_own_report_pref.patch \
     file://910-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch \
     file://911-master-print-sae-groups-by-hostapd-ctrl.patch \
-    file://912-master-add-the-destination-address-of-unsolicited-Probe.patch \
     file://913-master-add-support-for-runtime-set-in-band-discover.patch \
+    file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
     "
diff --git a/recipes-connectivity/hostapd/files/src/src/ap/ubus.c b/recipes-connectivity/hostapd/files/src/src/ap/ubus.c
index fa325ea..1199098 100644
--- a/recipes-connectivity/hostapd/files/src/src/ap/ubus.c
+++ b/recipes-connectivity/hostapd/files/src/src/ap/ubus.c
@@ -445,6 +445,12 @@
 	blobmsg_add_u32(&b, "channel", channel);
 	blobmsg_add_u32(&b, "op_class", op_class);
 	blobmsg_add_u32(&b, "beacon_interval", hapd->iconf->beacon_int);
+#ifdef CONFIG_IEEE80211AX
+	blobmsg_add_u32(&b, "bss_color", hapd->iface->conf->he_op.he_bss_color_disabled ? -1 :
+					 hapd->iface->conf->he_op.he_bss_color);
+#else
+	blobmsg_add_u32(&b, "bss_color", -1);
+#endif
 
 	snprintf(phy_name, 17, "%s", hapd->iface->phy);
 	blobmsg_add_string(&b, "phy", phy_name);
@@ -888,10 +894,13 @@
 				css.freq_params.ht_enabled,
 				css.freq_params.vht_enabled,
 				css.freq_params.he_enabled,
+				css.freq_params.eht_enabled,
 				css.freq_params.sec_channel_offset,
 				chwidth, seg0, seg1,
 				iconf->vht_capab,
 				mode ? &mode->he_capab[IEEE80211_MODE_AP] :
+				NULL,
+				mode ? &mode->eht_capab[IEEE80211_MODE_AP] :
 				NULL);
 
 	for (i = 0; i < hapd->iface->num_bss; i++) {
@@ -1570,50 +1579,6 @@
 	return hostapd_bss_tr_send(hapd, addr, da_imminent, abridged, da_timer, valid_period,
 				   dialog_token, tb[BSS_TR_NEIGHBORS]);
 }
-
-enum {
-	WNM_DISASSOC_ADDR,
-	WNM_DISASSOC_DURATION,
-	WNM_DISASSOC_NEIGHBORS,
-	WNM_DISASSOC_ABRIDGED,
-	__WNM_DISASSOC_MAX,
-};
-
-static const struct blobmsg_policy wnm_disassoc_policy[__WNM_DISASSOC_MAX] = {
-	[WNM_DISASSOC_ADDR] = { "addr", BLOBMSG_TYPE_STRING },
-	[WNM_DISASSOC_DURATION] { "duration", BLOBMSG_TYPE_INT32 },
-	[WNM_DISASSOC_NEIGHBORS] { "neighbors", BLOBMSG_TYPE_ARRAY },
-	[WNM_DISASSOC_ABRIDGED] { "abridged", BLOBMSG_TYPE_BOOL },
-};
-
-static int
-hostapd_wnm_disassoc_imminent(struct ubus_context *ctx, struct ubus_object *obj,
-			      struct ubus_request_data *ureq, const char *method,
-			      struct blob_attr *msg)
-{
-	struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj);
-	struct blob_attr *tb[__WNM_DISASSOC_MAX];
-	struct sta_info *sta;
-	int duration = 10;
-	u8 addr[ETH_ALEN];
-	bool abridged;
-
-	blobmsg_parse(wnm_disassoc_policy, __WNM_DISASSOC_MAX, tb, blob_data(msg), blob_len(msg));
-
-	if (!tb[WNM_DISASSOC_ADDR])
-		return UBUS_STATUS_INVALID_ARGUMENT;
-
-	if (hwaddr_aton(blobmsg_data(tb[WNM_DISASSOC_ADDR]), addr))
-		return UBUS_STATUS_INVALID_ARGUMENT;
-
-	if (tb[WNM_DISASSOC_DURATION])
-		duration = blobmsg_get_u32(tb[WNM_DISASSOC_DURATION]);
-
-	abridged = !!(tb[WNM_DISASSOC_ABRIDGED] && blobmsg_get_bool(tb[WNM_DISASSOC_ABRIDGED]));
-
-	return hostapd_bss_tr_send(hapd, addr, true, abridged, duration, duration,
-				   1, tb[WNM_DISASSOC_NEIGHBORS]);
-}
 #endif
 
 #ifdef CONFIG_AIRTIME_POLICY
@@ -1698,7 +1663,6 @@
 	UBUS_METHOD("rrm_beacon_req", hostapd_rrm_beacon_req, beacon_req_policy),
 	UBUS_METHOD("link_measurement_req", hostapd_rrm_lm_req, lm_req_policy),
 #ifdef CONFIG_WNM_AP
-	UBUS_METHOD("wnm_disassoc_imminent", hostapd_wnm_disassoc_imminent, wnm_disassoc_policy),
 	UBUS_METHOD("bss_transition_request", hostapd_bss_transition_request, bss_tr_policy),
 #endif
 };