diff --git a/recipes-wifi/atenl/files/iwpriv.sh b/recipes-wifi/atenl/files/iwpriv.sh
index 0dde191..b636bf8 100644
--- a/recipes-wifi/atenl/files/iwpriv.sh
+++ b/recipes-wifi/atenl/files/iwpriv.sh
@@ -1222,10 +1222,32 @@
         ## Translate to mt76-vendor command
         "csi"|"amnt"|"ap_rfeatures"|"ap_wireless"|"mu"|"set_muru_manual_config")
             cert_cmd="$*"
-            if [ ! -z "$mld" ]; then
-                mld_interface=$(iw dev | grep Interface | awk '{print $2}')
-                cert_cmd="$(echo $* | sed 's/band[0-9]/${mld_interface}/')"
-            fi
+
+	    if [ ! -z "$mld" ]; then
+		    mld_interface=$(iw dev | grep Interface | awk '{print $2}')
+		    if [ $cmd == "ap_rfeatures" ] || [ "$cmd" == "ap_wireless" ]; then
+
+			    band_number=$(echo "$cert_cmd" | grep -o 'band[0-9]*')
+
+			    links_info_base="/sys/kernel/debug/ieee80211/phy0/netdev"
+			    links_info_intf="${mld_interface}/mt76_links_info"
+			    links_info_cmd="${links_info_base}:${links_info_intf}"
+
+			    band_link_id_info=$(
+			    	cat "$links_info_cmd" | grep "${band_number}_link_id"
+			    )
+			    band_link_id=$(
+			    	echo "$band_link_id_info" | awk -F'=' '{print $2}' | tr -d ' '
+			    )
+
+			    cmd_w_link_id=$(echo $* | sed "s/band[0-9]/& -l ${band_link_id}/g")
+			    cert_cmd=${cmd_w_link_id}
+
+		    fi
+		    ## convert bandX to mld interface name
+		    cert_cmd="$(echo ${cert_cmd} | sed 's/band[0-9]/${mld_interface}/')"
+	    fi
+
             if [ ${is_connac3} == "1" ]; then
                 hostapd_cmd="$(echo $cert_cmd | sed 's/set/raw/')"
                 do_cmd "hostapd_cli -i $hostapd_cmd"
@@ -1234,6 +1256,22 @@
             fi
             skip=1
             ;;
+    	"txbftxsndinfo"|"TxBfTxSndInfo")
+            cert_cmd="$*"
+            cmd_setting=$(echo $cert_cmd | awk -F'=' '{print $2}')
+            snd_cmd_base="/sys/kernel/debug/ieee80211/phy0/mt76/band0/bf_txsnd_info"
+            mt76_snd_cmd="echo $cmd_setting > $snd_cmd_base"
+            do_cmd "$mt76_snd_cmd"
+            skip=1
+            ;;
+    	"muruDbgInfo")
+            cert_cmd="$*"
+            cmd_setting=$(echo $cert_cmd | awk -F'=' '{print $2}')
+            muru_cmd_base="/sys/kernel/debug/ieee80211/phy0/mt76/muru_dbg"
+            mt76_muru_cmd="echo $cmd_setting > $muru_cmd_base"
+            do_cmd "$mt76_muru_cmd"
+            skip=1
+            ;;
         "ATE")
             do_ate_work ${param}
 
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0055-hostapd-mtk-fix-failure-of-BSS-wise-QoS-map-setting.patch b/recipes-wifi/hostapd/files/patches/mtk-0055-hostapd-mtk-fix-failure-of-BSS-wise-QoS-map-setting.patch
new file mode 100644
index 0000000..f9b0b42
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches/mtk-0055-hostapd-mtk-fix-failure-of-BSS-wise-QoS-map-setting.patch
@@ -0,0 +1,30 @@
+From e45a713ae920d8bcaa1da4b060fd70103a08d897 Mon Sep 17 00:00:00 2001
+From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+Date: Fri, 28 Jun 2024 11:11:47 +0800
+Subject: [PATCH] hostapd: mtk: fix failure of BSS-wise QoS-map setting
+
+wpa_driver_nl80211_data is PHY-wise data structure.
+Therfore, using it here always sets QoS map of the first BSS of the PHY.
+In order to correctly set QoS map of each BSS, BSS-wise data structure i802_bss is used.
+
+Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+---
+ src/drivers/driver_nl80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index c1d31bc..29c4b9b 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -10496,7 +10496,7 @@ static int nl80211_set_qos_map(void *priv, const u8 *qos_map_set,
+ 	wpa_hexdump(MSG_DEBUG, "nl80211: Setting QoS Map",
+ 		    qos_map_set, qos_map_set_len);
+ 
+-	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_QOS_MAP)) ||
++	if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_QOS_MAP)) ||
+ 	    nla_put(msg, NL80211_ATTR_QOS_MAP, qos_map_set_len, qos_map_set)) {
+ 		nlmsg_free(msg);
+ 		return -ENOBUFS;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches/patches.inc b/recipes-wifi/hostapd/files/patches/patches.inc
index 2809a0f..b8d4751 100644
--- a/recipes-wifi/hostapd/files/patches/patches.inc
+++ b/recipes-wifi/hostapd/files/patches/patches.inc
@@ -123,4 +123,5 @@
     file://mtk-0052-hostapd-mtk-ACS-remove-chan-freq-list-check-when-sca.patch \
     file://mtk-0053-hostapd-mtk-add-no_beacon-vendor-command-for-cert.patch \
     file://mtk-0054-hostapd-mtk-Add-support-for-gtk-rekeying-in-hostapd-.patch \
+    file://mtk-0055-hostapd-mtk-fix-failure-of-BSS-wise-QoS-map-setting.patch \
     "
diff --git a/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ucode.c b/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ucode.c
index d344190..68fb450 100644
--- a/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ucode.c
+++ b/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ucode.c
@@ -86,12 +86,16 @@
 uc_hostapd_add_iface(uc_vm_t *vm, size_t nargs)
 {
 	uc_value_t *iface = uc_fn_arg(0);
+	char *data;
 	int ret;
 
 	if (ucv_type(iface) != UC_STRING)
 		return ucv_int64_new(-1);
 
-	ret = hostapd_add_iface(interfaces, ucv_string_get(iface));
+	data = strdup(ucv_string_get(iface));
+	ret = hostapd_add_iface(interfaces, data);
+	free(data);
+
 	hostapd_ucode_update_interfaces();
 
 	return ucv_int64_new(ret);
diff --git a/recipes-wifi/hostapd/files/wifi-detect.uc b/recipes-wifi/hostapd/files/wifi-detect.uc
index 5f37588..bbaae18 100644
--- a/recipes-wifi/hostapd/files/wifi-detect.uc
+++ b/recipes-wifi/hostapd/files/wifi-detect.uc
@@ -53,6 +53,26 @@
 	return wlan[phy];
 }
 
+function freq_to_channel(freq) {
+	if (freq < 1000)
+		return 0;
+	if (freq == 2484)
+		return 14;
+	if (freq == 5935)
+		return 2;
+	if (freq < 2484)
+		return (freq - 2407) / 5;
+	if (freq >= 4910 && freq <= 4980)
+		return (freq - 4000) / 5;
+	if (freq < 5950)
+		return (freq - 5000) / 5;
+	if (freq <= 45000)
+		return (freq - 5950) / 5;
+	if (freq >= 58320 && freq <= 70200)
+		return (freq - 56160) / 2160;
+	return 0;
+}
+
 function wiphy_detect() {
 	let phys = nl.request(nl.const.NL80211_CMD_GET_WIPHY, nl.const.NLM_F_DUMP, { split_wiphy_dump: true });
 	if (!phys)
@@ -80,8 +100,10 @@
 				band_name = "6G";
 			else if (freq > 4000)
 				band_name = "5G";
-			else
+			else if (freq > 2000)
 				band_name = "2G";
+			else
+				continue;
 			bands[band_name] = band_info;
 			if (band.ht_capa > 0)
 				band_info.ht = true;
@@ -96,9 +118,13 @@
 				band_info.he = true;
 				he_phy_cap |= ift.he_cap_phy[0];
 				/* TODO: EHT */
+				/* FIXME: hardcode */
+				band_info.eht = true;
 			}
 
-			if (band_name != "2G" &&
+			if (band_name == "6G" && band_info.eht)
+				band_info.max_width = 320;
+			else if (band_name != "2G" &&
 			    (he_phy_cap & 0x18) || ((band.vht_capa >> 2) & 0x3))
 				band_info.max_width = 160;
 			else if (band_name != "2G" &&
@@ -116,24 +142,48 @@
 				push(modes, "VHT20");
 			if (band_info.he)
 				push(modes, "HE20");
+			if (band_info.eht)
+				push(modes, "EHT20");
 			if (band.ht_capa & 0x2) {
 				push(modes, "HT40");
 				if (band_info.vht)
 					push(modes, "VHT40")
 			}
-			if (he_phy_cap & 0x2)
+			if (he_phy_cap & 0x2) {
 				push(modes, "HE40");
 
+				if (band_info.eht)
+					push(modes, "EHT40");
+			}
+
+			for (let freq in band.freqs) {
+				if (freq.disabled)
+					continue;
+				let chan = freq_to_channel(freq.freq);
+				if (!chan)
+					continue;
+				band_info.default_channel = chan;
+				break;
+			}
+
 			if (band_name == "2G")
 				continue;
 			if (band_info.vht)
 				push(modes, "VHT80");
-			if (he_phy_cap & 4)
+			if (he_phy_cap & 4) {
 				push(modes, "HE80");
+				if (band_info.eht)
+					push(modes, "EHT80");
+			}
 			if ((band.vht_capa >> 2) & 0x3)
 				push(modes, "VHT160");
-			if (he_phy_cap & 0x18)
+			if (he_phy_cap & 0x18) {
 				push(modes, "HE160");
+				if (band_info.eht)
+					push(modes, "EHT160");
+			}
+			if (band_name == "6G" && band_info.eht)
+				push(modes, "EHT320");
 		}
 
 		let entry = wiphy_get_entry(name, path);
diff --git a/recipes-wifi/iw/iw_5.19.bb b/recipes-wifi/iw/iw_6.9.bb
similarity index 93%
rename from recipes-wifi/iw/iw_5.19.bb
rename to recipes-wifi/iw/iw_6.9.bb
index ac009b2..fb95959 100644
--- a/recipes-wifi/iw/iw_5.19.bb
+++ b/recipes-wifi/iw/iw_6.9.bb
@@ -14,7 +14,7 @@
            file://separate-objdir.patch \
 "
 
-SRC_URI[sha256sum] = "f167bbe947dd53bb9ebc0c1dcef5db6ad73ac1d6084f2c6f9376c5c360cc4d4e"
+SRC_URI[sha256sum] = "3f2db22ad41c675242b98ae3942dbf3112548c60a42ff739210f2de4e98e4894"
 
 PATCH_SRC = "${@bb.utils.contains('DISTRO_FEATURES', 'wifi_eht', 'patches-mlo', 'patches', d)}"
 
diff --git a/recipes-wifi/iw/patches-mlo/0001-iw-info-print-PMSR-capabilities.patch b/recipes-wifi/iw/patches-mlo/0001-iw-info-print-PMSR-capabilities.patch
deleted file mode 100644
index 9169bd9..0000000
--- a/recipes-wifi/iw/patches-mlo/0001-iw-info-print-PMSR-capabilities.patch
+++ /dev/null
@@ -1,156 +0,0 @@
-From ad2f2f8a2c0b4d450a53c24d28769cd187071dee Mon Sep 17 00:00:00 2001
-From: Jaewan Kim <jaewan@google.com>
-Date: Tue, 11 Oct 2022 14:34:05 +0900
-Subject: [PATCH 01/28] iw: info: print PMSR capabilities
-
-Print PMSR and FTM capabilities if any.
-
-Signed-off-by: Jaewan Kim <jaewan@google.com>
-Link: https://lore.kernel.org/r/20221011053405.332375-1-jaewan@google.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- info.c | 121 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 121 insertions(+)
-
-diff --git a/info.c b/info.c
-index 21ed07b..eb257f8 100644
---- a/info.c
-+++ b/info.c
-@@ -169,6 +169,124 @@ static void ext_feat_print(enum nl80211_ext_feature_index idx)
- 	}
- }
- 
-+static void __print_ftm_capability(struct nlattr *ftm_capa)
-+{
-+#define PRINT_FTM_FLAG(T, NAME) \
-+	do { \
-+		if (T[NL80211_PMSR_FTM_CAPA_ATTR_##NAME]) \
-+			printf("\t\t\t" #NAME "\n"); \
-+	} while (0)
-+
-+#define PRINT_FTM_U8(T, NAME) \
-+	do { \
-+		if (T[NL80211_PMSR_FTM_CAPA_ATTR_##NAME]) \
-+			printf("\t\t\t" #NAME ": %d\n", \
-+				nla_get_u8(T[NL80211_PMSR_FTM_CAPA_ATTR_##NAME])); \
-+	} while (0)
-+
-+	struct nlattr *tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX + 1];
-+	int ret;
-+
-+	printf("\t\tFTM (Fine time measurement or Flight time measurement)\n");
-+
-+	ret = nla_parse_nested(tb, NL80211_PMSR_FTM_CAPA_ATTR_MAX, ftm_capa,
-+			       NULL);
-+	if (ret)
-+		return;
-+
-+	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES]) {
-+#define PRINT_PREAMBLE(P, V) \
-+	do { \
-+		if (P | NL80211_PREAMBLE_##V) \
-+			printf(" " #V); \
-+	} while (0)
-+
-+		uint32_t preambles =
-+			nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES]);
-+		printf("\t\t\tPreambles:");
-+
-+		PRINT_PREAMBLE(preambles, LEGACY);
-+		PRINT_PREAMBLE(preambles, HT);
-+		PRINT_PREAMBLE(preambles, VHT);
-+		PRINT_PREAMBLE(preambles, DMG);
-+		printf("\n");
-+#undef PRINT_PREAMBLE
-+	}
-+	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS]) {
-+#define PRINT_BANDWIDTH(B, V) \
-+	do { \
-+		if (B | NL80211_CHAN_WIDTH_##V) \
-+			printf(" " #V); \
-+	} while (0)
-+
-+		uint32_t bandwidth =
-+			nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS]);
-+		printf("\t\t\tBandwidth:");
-+		PRINT_BANDWIDTH(bandwidth, 20_NOHT);
-+		PRINT_BANDWIDTH(bandwidth, 20);
-+		PRINT_BANDWIDTH(bandwidth, 40);
-+		PRINT_BANDWIDTH(bandwidth, 80);
-+		PRINT_BANDWIDTH(bandwidth, 80P80);
-+		PRINT_BANDWIDTH(bandwidth, 160);
-+		PRINT_BANDWIDTH(bandwidth, 5);
-+		PRINT_BANDWIDTH(bandwidth, 10);
-+		PRINT_BANDWIDTH(bandwidth, 1);
-+		PRINT_BANDWIDTH(bandwidth, 2);
-+		PRINT_BANDWIDTH(bandwidth, 4);
-+		PRINT_BANDWIDTH(bandwidth, 8);
-+		PRINT_BANDWIDTH(bandwidth, 16);
-+		PRINT_BANDWIDTH(bandwidth, 320);
-+		printf("\n");
-+#undef PRINT_BANDWIDTH
-+	}
-+	PRINT_FTM_U8(tb, MAX_BURSTS_EXPONENT);
-+	PRINT_FTM_U8(tb, MAX_FTMS_PER_BURST);
-+	PRINT_FTM_FLAG(tb, ASAP);
-+	PRINT_FTM_FLAG(tb, NON_ASAP);
-+	PRINT_FTM_FLAG(tb, REQ_LCI);
-+	PRINT_FTM_FLAG(tb, REQ_CIVICLOC);
-+	PRINT_FTM_FLAG(tb, TRIGGER_BASED);
-+	PRINT_FTM_FLAG(tb, NON_TRIGGER_BASED);
-+
-+#undef PRINT_FTM_U8
-+#undef PRINT_FTM_FLAG
-+}
-+
-+static void print_pmsr_capabilities(struct nlattr *pmsr_capa)
-+{
-+	struct nlattr *tb[NL80211_PMSR_ATTR_MAX + 1];
-+	struct nlattr *nla;
-+	int size;
-+	int ret;
-+
-+	printf("\tPeer measurement (PMSR)\n");
-+	ret = nla_parse_nested(tb, NL80211_PMSR_ATTR_MAX, pmsr_capa, NULL);
-+	if (ret) {
-+		printf("\t\tMalformed PMSR\n");
-+		return;
-+	}
-+
-+	if (tb[NL80211_PMSR_ATTR_MAX_PEERS])
-+		printf("\t\tMax peers: %d\n",
-+		       nla_get_u32(tb[NL80211_PMSR_ATTR_MAX_PEERS]));
-+	if (tb[NL80211_PMSR_ATTR_REPORT_AP_TSF])
-+		printf("\t\tREPORT_AP_TSF\n");
-+	if (tb[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR])
-+		printf("\t\tRANDOMIZE_MAC_ADDR\n");
-+
-+	if (tb[NL80211_PMSR_ATTR_TYPE_CAPA]) {
-+		nla_for_each_nested(nla, tb[NL80211_PMSR_ATTR_TYPE_CAPA], size) {
-+			switch (nla_type(nla)) {
-+			case NL80211_PMSR_TYPE_FTM:
-+				__print_ftm_capability(nla);
-+				break;
-+			}
-+		}
-+	} else {
-+		printf("\t\tPMSR type is missing\n");
-+	}
-+}
-+
- static int print_phy_handler(struct nl_msg *msg, void *arg)
- {
- 	struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
-@@ -741,6 +859,9 @@ broken_combination:
- 			pat->max_pattern_len, pat->max_pkt_offset, rule->max_delay);
- 	}
- 
-+	if (tb_msg[NL80211_ATTR_PEER_MEASUREMENTS])
-+		print_pmsr_capabilities(tb_msg[NL80211_ATTR_PEER_MEASUREMENTS]);
-+
- 	if (tb_msg[NL80211_ATTR_MAX_AP_ASSOC_STA])
- 		printf("\tMaximum associated stations in AP mode: %u\n",
- 		       nla_get_u16(tb_msg[NL80211_ATTR_MAX_AP_ASSOC_STA]));
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0001-iw-refactor-frequency-help.patch b/recipes-wifi/iw/patches-mlo/0001-iw-refactor-frequency-help.patch
new file mode 100644
index 0000000..d88718b
--- /dev/null
+++ b/recipes-wifi/iw/patches-mlo/0001-iw-refactor-frequency-help.patch
@@ -0,0 +1,169 @@
+From cce989770bf3375bbe4398a5ce80d9a9718460a3 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 17 May 2024 12:04:06 +0200
+Subject: [PATCH 01/10] iw: refactor frequency help
+
+The channel parsing is the same in most places, refactor
+the help strings for that to not duplicate them in all
+the commands using them. This also corrects the help for
+a number of commands that never saw 320 MHz support.
+
+Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ ap.c   | 10 ++++++----
+ iw.h   | 13 +++++++++++++
+ phy.c  | 38 +++++++++++++-------------------------
+ util.c |  4 ++--
+ 4 files changed, 34 insertions(+), 31 deletions(-)
+
+diff --git a/ap.c b/ap.c
+index 748576d..bf72fe2 100644
+--- a/ap.c
++++ b/ap.c
+@@ -144,12 +144,14 @@ static int handle_start_ap(struct nl80211_state *state,
+  nla_put_failure:
+ 	return -ENOSPC;
+ }
+-COMMAND(ap, start, "",
+-	NL80211_CMD_NEW_BEACON, 0, CIB_NETDEV, handle_start_ap,
+-	"<SSID> <control freq> [5|10|20|40|80|80+80|160] [<center1_freq> [<center2_freq>]]"
++COMMAND(ap, start,
++	"<SSID> "
++	PARSE_FREQ_ARGS("<SSID> ",
+ 	" <beacon interval in TU> <DTIM period> [hidden-ssid|zeroed-ssid] head"
+ 	" <beacon head in hexadecimal> [tail <beacon tail in hexadecimal>]"
+-	" [inactivity-time <inactivity time in seconds>] [key0:abcde d:1:6162636465]\n");
++	" [inactivity-time <inactivity time in seconds>] [key0:abcde d:1:6162636465]"),
++	NL80211_CMD_NEW_BEACON, 0, CIB_NETDEV, handle_start_ap,
++	"Start an AP. Note that this usually requires hostapd or similar.\n");
+ 
+ static int handle_stop_ap(struct nl80211_state *state,
+ 			  struct nl_msg *msg,
+diff --git a/iw.h b/iw.h
+index 7e9107e..82eee7c 100644
+--- a/iw.h
++++ b/iw.h
+@@ -209,6 +209,19 @@ int parse_hex_mask(char *hexmask, unsigned char **result, size_t *result_len,
+ unsigned char *parse_hex(char *hex, size_t *outlen);
+ 
+ int parse_keys(struct nl_msg *msg, char **argv[], int *argc);
++
++#define _PARSE_FREQ_ARGS_OPT1 "<freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz|320MHz]"
++#define _PARSE_FREQ_ARGS_OPT2 "<control freq> [5|10|20|40|80|80+80|160|320] [<center1_freq> [<center2_freq>]]"
++#define PARSE_FREQ_ARGS(pfx, sfx) \
++	pfx _PARSE_FREQ_ARGS_OPT1 sfx "\n" \
++	pfx _PARSE_FREQ_ARGS_OPT2 sfx
++#define _PARSE_FREQ_KHZ_ARGS_OPT1 "<freq in KHz> [1MHz|2MHz|4MHz|8MHz|16MHz]"
++#define _PARSE_FREQ_KHZ_ARGS_OPT2 "<control freq in KHz> [1|2|4|8|16] [<center1_freq> [<center2_freq>]]"
++#define PARSE_FREQ_KHZ_ARGS(pfx, sfx) \
++	pfx _PARSE_FREQ_KHZ_ARGS_OPT1 sfx "\n" \
++	pfx _PARSE_FREQ_KHZ_ARGS_OPT2 sfx
++#define PARSE_CHAN_ARGS(pfx) \
++	pfx "<channel> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz|320MHz]"
+ int parse_freqchan(struct chandef *chandef, bool chan, int argc, char **argv,
+ 		    int *parsed, bool freq_in_khz);
+ enum nl80211_chan_width str_to_bw(const char *str);
+diff --git a/phy.c b/phy.c
+index 4722125..584b103 100644
+--- a/phy.c
++++ b/phy.c
+@@ -198,15 +198,10 @@ static int handle_freq(struct nl80211_state *state, struct nl_msg *msg,
+ 	return put_chandef(msg, &chandef);
+ }
+ 
+-COMMAND(set, freq,
+-	"<freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz|320MHz]\n"
+-	"<control freq> [5|10|20|40|80|80+80|160] [<center1_freq> [<center2_freq>]]",
++COMMAND(set, freq, PARSE_FREQ_ARGS("", ""),
+ 	NL80211_CMD_SET_WIPHY, 0, CIB_PHY, handle_freq,
+-	"Set frequency/channel the hardware is using, including HT\n"
+-	"configuration.");
+-COMMAND(set, freq,
+-	"<freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz|320MHz]\n"
+-	"<control freq> [5|10|20|40|80|80+80|160] [<center1_freq> [<center2_freq>]]",
++	"Set frequency/channel configuration the hardware is using.");
++COMMAND(set, freq, PARSE_FREQ_ARGS("", ""),
+ 	NL80211_CMD_SET_WIPHY, 0, CIB_NETDEV, handle_freq, NULL);
+ 
+ static int handle_freq_khz(struct nl80211_state *state, struct nl_msg *msg,
+@@ -223,15 +218,11 @@ static int handle_freq_khz(struct nl80211_state *state, struct nl_msg *msg,
+ 	return put_chandef(msg, &chandef);
+ }
+ 
+-COMMAND(set, freq_khz,
+-	"<freq> [1MHz|2MHz|4MHz|8MHz|16MHz]\n"
+-	"<control freq> [1|2|4|8|16] [<center1_freq> [<center2_freq>]]",
++COMMAND(set, freq_khz, PARSE_FREQ_KHZ_ARGS("", ""),
+ 	NL80211_CMD_SET_WIPHY, 0, CIB_PHY, handle_freq_khz,
+ 	"Set frequency in kHz the hardware is using\n"
+ 	"configuration.");
+-COMMAND(set, freq_khz,
+-	"<freq> [1MHz|2MHz|4MHz|8MHz|16MHz]\n"
+-	"<control freq> [1|2|4|8|16] [<center1_freq> [<center2_freq>]]",
++COMMAND(set, freq_khz, PARSE_FREQ_KHZ_ARGS("", ""),
+ 	NL80211_CMD_SET_WIPHY, 0, CIB_NETDEV, handle_freq_khz, NULL);
+ 
+ static int handle_chan(struct nl80211_state *state, struct nl_msg *msg,
+@@ -247,9 +238,9 @@ static int handle_chan(struct nl80211_state *state, struct nl_msg *msg,
+ 
+ 	return put_chandef(msg, &chandef);
+ }
+-COMMAND(set, channel, "<channel> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz]",
++COMMAND(set, channel, PARSE_CHAN_ARGS(""),
+ 	NL80211_CMD_SET_WIPHY, 0, CIB_PHY, handle_chan, NULL);
+-COMMAND(set, channel, "<channel> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz]",
++COMMAND(set, channel, PARSE_CHAN_ARGS(""),
+ 	NL80211_CMD_SET_WIPHY, 0, CIB_NETDEV, handle_chan, NULL);
+ 
+ 
+@@ -403,22 +394,19 @@ err_out:
+ 		free(cac_trigger_argv);
+ 	return err;
+ }
+-TOPLEVEL(cac, "channel <channel> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz]\n"
+-	      "freq <freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz]\n"
+-	      "freq <control freq> [5|10|20|40|80|80+80|160] [<center1_freq> [<center2_freq>]]",
++TOPLEVEL(cac, PARSE_CHAN_ARGS("channel ") "\n"
++              PARSE_FREQ_ARGS("freq ", ""),
+ 	 0, 0, CIB_NETDEV, handle_cac, NULL);
+ COMMAND(cac, trigger,
+-	"channel <channel> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz]\n"
+-	"freq <frequency> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz]\n"
+-	"freq <frequency> [5|10|20|40|80|80+80|160] [<center1_freq> [<center2_freq>]]",
++	PARSE_CHAN_ARGS("channel ") "\n"
++	PARSE_FREQ_ARGS("freq ", ""),
+ 	NL80211_CMD_RADAR_DETECT, 0, CIB_NETDEV, handle_cac_trigger,
+ 	"Start or trigger a channel availability check (CAC) looking to look for\n"
+ 	"radars on the given channel.");
+ 
+ COMMAND(cac, background,
+-	"channel <channel> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz]\n"
+-	"freq <frequency> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz]\n"
+-	"freq <frequency> [5|10|20|40|80|80+80|160] [<center1_freq> [<center2_freq>]]",
++	PARSE_CHAN_ARGS("channel ") "\n"
++	PARSE_FREQ_ARGS("freq ", ""),
+ 	NL80211_CMD_RADAR_DETECT, 0, CIB_NETDEV, handle_cac_background,
+ 	"Start background channel availability check (CAC) looking to look for\n"
+ 	"radars on the given channel.");
+diff --git a/util.c b/util.c
+index d36dbdc..f358317 100644
+--- a/util.c
++++ b/util.c
+@@ -593,11 +593,11 @@ static int parse_freqs(struct chandef *chandef, int argc, char **argv,
+  * user by giving "NOHT" instead.
+  *
+  * The working specifier if chan is set are:
+- *   <channel> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz]
++ *   <channel> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz|320MHz]
+  *
+  * And if frequency is set:
+  *   <freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz|320MHz]
+- *   <control freq> [5|10|20|40|80|80+80|160] [<center1_freq> [<center2_freq>]]
++ *   <control freq> [5|10|20|40|80|80+80|160|320] [<center1_freq> [<center2_freq>]]
+  *
+  * If the mode/channel width is not given the NOHT is assumed.
+  *
+-- 
+2.18.0
+
diff --git a/recipes-wifi/iw/patches-mlo/0002-iw-add-cac-background-command.patch b/recipes-wifi/iw/patches-mlo/0002-iw-add-cac-background-command.patch
deleted file mode 100644
index 235a0dc..0000000
--- a/recipes-wifi/iw/patches-mlo/0002-iw-add-cac-background-command.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 82e6fba06a1489a007ef20f9db17cc066f6f53d2 Mon Sep 17 00:00:00 2001
-From: Janusz Dziedzic <janusz.dziedzic@gmail.com>
-Date: Thu, 25 Aug 2022 11:51:11 +0200
-Subject: [PATCH 02/28] iw: add cac background command
-
-Add command that request background CAC radar scan.
-Tested on mt7915.
-
-Signed-off-by: Janusz Dziedzic <janusz.dziedzic@gmail.com>
-Link: https://lore.kernel.org/r/20220825095111.1026649-1-janusz.dziedzic@gmail.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- phy.c | 17 +++++++++++++++++
- 1 file changed, 17 insertions(+)
-
-diff --git a/phy.c b/phy.c
-index 2d489ef..0a57ecb 100644
---- a/phy.c
-+++ b/phy.c
-@@ -301,6 +301,15 @@ static int handle_cac_trigger(struct nl80211_state *state,
- 	return put_chandef(msg, &chandef);
- }
- 
-+static int handle_cac_background(struct nl80211_state *state,
-+				 struct nl_msg *msg,
-+				 int argc, char **argv,
-+				 enum id_input id)
-+{
-+	nla_put_flag(msg, NL80211_ATTR_RADAR_BACKGROUND);
-+	return handle_cac_trigger(state, msg, argc, argv, id);
-+}
-+
- static int no_seq_check(struct nl_msg *msg, void *arg)
- {
- 	return NL_OK;
-@@ -381,6 +390,14 @@ COMMAND(cac, trigger,
- 	"Start or trigger a channel availability check (CAC) looking to look for\n"
- 	"radars on the given channel.");
- 
-+COMMAND(cac, background,
-+	"channel <channel> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz]\n"
-+	"freq <frequency> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz]\n"
-+	"freq <frequency> [5|10|20|40|80|80+80|160] [<center1_freq> [<center2_freq>]]",
-+	NL80211_CMD_RADAR_DETECT, 0, CIB_NETDEV, handle_cac_background,
-+	"Start background channel availability check (CAC) looking to look for\n"
-+	"radars on the given channel.");
-+
- static int handle_fragmentation(struct nl80211_state *state,
- 				struct nl_msg *msg,
- 				int argc, char **argv,
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0002-iw-add-puncturing-support.patch b/recipes-wifi/iw/patches-mlo/0002-iw-add-puncturing-support.patch
new file mode 100644
index 0000000..2ebc109
--- /dev/null
+++ b/recipes-wifi/iw/patches-mlo/0002-iw-add-puncturing-support.patch
@@ -0,0 +1,89 @@
+From b29da202bdcbdc75cd75db37175261fb22d1e13b Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 17 May 2024 12:12:10 +0200
+Subject: [PATCH 02/10] iw: add puncturing support
+
+Parse and pass the puncturing bitmap to the kernel in any
+chandef (except S1G), the kernel will check validity.
+
+Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ iw.h   |  7 ++++---
+ util.c | 15 ++++++++++++++-
+ 2 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/iw.h b/iw.h
+index 82eee7c..f416d6d 100644
+--- a/iw.h
++++ b/iw.h
+@@ -106,6 +106,7 @@ struct chandef {
+ 	unsigned int center_freq1;
+ 	unsigned int center_freq1_offset;
+ 	unsigned int center_freq2;
++	unsigned int punctured;
+ };
+ 
+ #define ARRAY_SIZE(ar) (sizeof(ar)/sizeof(ar[0]))
+@@ -210,8 +211,8 @@ unsigned char *parse_hex(char *hex, size_t *outlen);
+ 
+ int parse_keys(struct nl_msg *msg, char **argv[], int *argc);
+ 
+-#define _PARSE_FREQ_ARGS_OPT1 "<freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz|320MHz]"
+-#define _PARSE_FREQ_ARGS_OPT2 "<control freq> [5|10|20|40|80|80+80|160|320] [<center1_freq> [<center2_freq>]]"
++#define _PARSE_FREQ_ARGS_OPT1 "<freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz|320MHz] [punct <bitmap>]"
++#define _PARSE_FREQ_ARGS_OPT2 "<control freq> [5|10|20|40|80|80+80|160|320] [<center1_freq> [<center2_freq>]] [punct <bitmap>]"
+ #define PARSE_FREQ_ARGS(pfx, sfx) \
+ 	pfx _PARSE_FREQ_ARGS_OPT1 sfx "\n" \
+ 	pfx _PARSE_FREQ_ARGS_OPT2 sfx
+@@ -221,7 +222,7 @@ int parse_keys(struct nl_msg *msg, char **argv[], int *argc);
+ 	pfx _PARSE_FREQ_KHZ_ARGS_OPT1 sfx "\n" \
+ 	pfx _PARSE_FREQ_KHZ_ARGS_OPT2 sfx
+ #define PARSE_CHAN_ARGS(pfx) \
+-	pfx "<channel> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz|320MHz]"
++	pfx "<channel> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz|320MHz] [punct <bitmap>]"
+ int parse_freqchan(struct chandef *chandef, bool chan, int argc, char **argv,
+ 		    int *parsed, bool freq_in_khz);
+ enum nl80211_chan_width str_to_bw(const char *str);
+diff --git a/util.c b/util.c
+index f358317..e43d590 100644
+--- a/util.c
++++ b/util.c
+@@ -735,13 +735,23 @@ int parse_freqchan(struct chandef *chandef, bool chan, int argc, char **argv,
+ 		goto out;
+ 	}
+ 
+-	/* This was a only a channel definition, nothing further may follow. */
++	/* This was a only a channel definition, only puncturing may follow */
+ 	if (chan)
+ 		goto out;
+ 
+ 	res = parse_freqs(chandef, argc - 1, argv + 1, &_parsed, freq_in_khz);
+ 
+  out:
++	if (!freq_in_khz && argc > _parsed && strcmp(argv[_parsed], "punct") == 0) {
++		_parsed++;
++		if (argc <= _parsed)
++			return 1;
++		chandef->punctured = strtoul(argv[_parsed], &end, 10);
++		if (*end)
++			return 1;
++		_parsed++;
++	}
++
+ 	/* Error out if parsed is NULL. */
+ 	if (!parsed && _parsed != argc)
+ 		return 1;
+@@ -800,6 +810,9 @@ int put_chandef(struct nl_msg *msg, struct chandef *chandef)
+ 			    NL80211_ATTR_CENTER_FREQ2,
+ 			    chandef->center_freq2);
+ 
++	if (chandef->punctured)
++		NLA_PUT_U32(msg, NL80211_ATTR_PUNCT_BITMAP, chandef->punctured);
++
+ 	return 0;
+ 
+  nla_put_failure:
+-- 
+2.18.0
+
diff --git a/recipes-wifi/iw/patches-mlo/0003-iw-info-fix-bug-reading-preambles-and-bandwidths.patch b/recipes-wifi/iw/patches-mlo/0003-iw-info-fix-bug-reading-preambles-and-bandwidths.patch
deleted file mode 100644
index 6f97d62..0000000
--- a/recipes-wifi/iw/patches-mlo/0003-iw-info-fix-bug-reading-preambles-and-bandwidths.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From c4743bbc1b1953bdc035b871ea1899ca94c1c6ac Mon Sep 17 00:00:00 2001
-From: Jaewan Kim <jaewan@google.com>
-Date: Tue, 10 Jan 2023 00:14:55 +0900
-Subject: [PATCH 03/28] iw: info: fix bug reading preambles and bandwidths
-
-Preambles and bandwidths values are considered as bit shifts
-when they're are used for capabilities.
-
-Signed-off-by: Jaewan Kim <jaewan@google.com>
-Link: https://lore.kernel.org/r/20230109151455.325793-1-jaewan@google.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- info.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/info.c b/info.c
-index eb257f8..5229d44 100644
---- a/info.c
-+++ b/info.c
-@@ -197,7 +197,7 @@ static void __print_ftm_capability(struct nlattr *ftm_capa)
- 	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES]) {
- #define PRINT_PREAMBLE(P, V) \
- 	do { \
--		if (P | NL80211_PREAMBLE_##V) \
-+		if (P & BIT(NL80211_PREAMBLE_##V)) \
- 			printf(" " #V); \
- 	} while (0)
- 
-@@ -215,7 +215,7 @@ static void __print_ftm_capability(struct nlattr *ftm_capa)
- 	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS]) {
- #define PRINT_BANDWIDTH(B, V) \
- 	do { \
--		if (B | NL80211_CHAN_WIDTH_##V) \
-+		if (B & BIT(NL80211_CHAN_WIDTH_##V)) \
- 			printf(" " #V); \
- 	} while (0)
- 
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0003-util-clarify-comment-about-parsed-pointer.patch b/recipes-wifi/iw/patches-mlo/0003-util-clarify-comment-about-parsed-pointer.patch
new file mode 100644
index 0000000..9ac1723
--- /dev/null
+++ b/recipes-wifi/iw/patches-mlo/0003-util-clarify-comment-about-parsed-pointer.patch
@@ -0,0 +1,36 @@
+From c8b9e772aee35e1db245ec6baa7bce1c7b4110ff Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 17 May 2024 13:19:47 +0200
+Subject: [PATCH 03/10] util: clarify comment about 'parsed' pointer
+
+It took me a while to understand this (again?), so
+clarify the comment here.
+
+Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ util.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/util.c b/util.c
+index e43d590..1341a22 100644
+--- a/util.c
++++ b/util.c
+@@ -752,8 +752,12 @@ int parse_freqchan(struct chandef *chandef, bool chan, int argc, char **argv,
+ 		_parsed++;
+ 	}
+ 
+-	/* Error out if parsed is NULL. */
+-	if (!parsed && _parsed != argc)
++	/*
++	 * Either this must consume all args, or users must pass a
++	 * valid pointer as 'parsed' and use it to know how many of
++	 * the arguments this function consumed.
++	 */
++	if (_parsed != argc && !parsed)
+ 		return 1;
+ 
+ 	if (parsed)
+-- 
+2.18.0
+
diff --git a/recipes-wifi/iw/patches-mlo/0004-iw-add-support-for-retrieving-keys.patch b/recipes-wifi/iw/patches-mlo/0004-iw-add-support-for-retrieving-keys.patch
deleted file mode 100644
index 2685804..0000000
--- a/recipes-wifi/iw/patches-mlo/0004-iw-add-support-for-retrieving-keys.patch
+++ /dev/null
@@ -1,123 +0,0 @@
-From cc660ccb9a83ec23b672eef178e9b494d95e763d Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rapha=C3=ABl=20M=C3=A9lotte?= <raphael.melotte@mind.be>
-Date: Thu, 12 Jan 2023 13:25:25 +0100
-Subject: [PATCH 04/28] iw: add support for retrieving keys
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-For debugging purposes, it can be useful to be able to retrieve keys.
-
-Add a "iw key get" command, to be able to retrieve keys when the key
-index is known. A new "key" section is also introduced, in preparation
-for future key-related commands.
-
-Example retrieving a pairwise key:
-iw dev wlan0 key get 0 02:02:03:04:05:06
-
-Example retrieving a group key:
-iw dev wlan0 key get 1
-
-Note that only the outer ATTR_KEY_DATA (and seq) is reported, the
-nested KEY_DATA (and seq) within ATTR_KEY is not.
-
-Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
-Link: https://lore.kernel.org/r/20230112122525.2257298-1-raphael.melotte@mind.be
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- keys.c | 83 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 83 insertions(+)
- create mode 100644 keys.c
-
-diff --git a/keys.c b/keys.c
-new file mode 100644
-index 0000000..65aa426
---- /dev/null
-+++ b/keys.c
-@@ -0,0 +1,83 @@
-+#include <errno.h>
-+#include <netlink/genl/genl.h>
-+#include <netlink/genl/family.h>
-+#include <netlink/genl/ctrl.h>
-+#include <netlink/msg.h>
-+#include <netlink/attr.h>
-+#include "nl80211.h"
-+#include "iw.h"
-+
-+SECTION(key);
-+
-+static int print_keys(struct nl_msg *msg, void *arg)
-+{
-+	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
-+	struct nlattr *tb[NL80211_ATTR_MAX + 1];
-+
-+	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
-+		  genlmsg_attrlen(gnlh, 0), NULL);
-+
-+	if (!tb[NL80211_ATTR_KEY_IDX]) {
-+		fprintf(stderr, "KEY_IDX missing!\n");
-+		return NL_SKIP;
-+	}
-+
-+	if (!tb[NL80211_ATTR_KEY_DATA]) {
-+		fprintf(stderr, "ATTR_KEY_DATA missing!\n");
-+		return NL_SKIP;
-+	}
-+
-+	iw_hexdump("Key", nla_data(tb[NL80211_ATTR_KEY_DATA]),
-+		   nla_len(tb[NL80211_ATTR_KEY_DATA]));
-+
-+	if (!tb[NL80211_ATTR_KEY_SEQ]) {
-+		fprintf(stderr, "ATTR_KEY_SEQ missing!\n");
-+		return NL_SKIP;
-+	}
-+
-+	iw_hexdump("Key seq", nla_data(tb[NL80211_ATTR_KEY_SEQ]),
-+		   nla_len(tb[NL80211_ATTR_KEY_SEQ]));
-+
-+	return NL_OK;
-+}
-+
-+static int handle_get_key(struct nl80211_state *state,
-+			  struct nl_msg *msg, int argc, char **argv,
-+			  enum id_input id)
-+{
-+	char *end;
-+	unsigned char mac[6];
-+
-+	/* key index */
-+	if (argc) {
-+		nla_put_u8(msg, NL80211_ATTR_KEY_IDX, strtoul(argv[0], &end, 10));
-+		if (*end != '\0')
-+			return -EINVAL;
-+		argv++;
-+		argc--;
-+	}
-+
-+	/* mac */
-+	if (argc) {
-+		if (mac_addr_a2n(mac, argv[0]) == 0) {
-+			NLA_PUT(msg, NL80211_ATTR_MAC, 6, mac);
-+			nla_put_u32(msg, NL80211_ATTR_KEY_TYPE,
-+				    NL80211_KEYTYPE_PAIRWISE);
-+			argv++;
-+			argc--;
-+		} else {
-+			return -EINVAL;
-+		}
-+	} else {
-+		nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, NL80211_KEYTYPE_GROUP);
-+	}
-+
-+	register_handler(print_keys, NULL);
-+	return 0;
-+
-+ nla_put_failure:
-+	return -ENOSPC;
-+}
-+COMMAND(key, get, "<key index> <MAC address>",
-+	NL80211_CMD_GET_KEY, 0, CIB_NETDEV, handle_get_key,
-+	"Retrieve a key and key sequence.\n");
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0004-iw-remove-sizer-section-and-related-code.patch b/recipes-wifi/iw/patches-mlo/0004-iw-remove-sizer-section-and-related-code.patch
new file mode 100644
index 0000000..909a357
--- /dev/null
+++ b/recipes-wifi/iw/patches-mlo/0004-iw-remove-sizer-section-and-related-code.patch
@@ -0,0 +1,66 @@
+From 8609336b71a8ae37238dc3f4ddff251a4698a4fc Mon Sep 17 00:00:00 2001
+From: Benjamin Berg <benjamin.berg@intel.com>
+Date: Fri, 3 May 2024 13:12:06 +0200
+Subject: [PATCH 04/10] iw: remove sizer section and related code
+
+With commit 338059ace9d0 ("iw: change __cmd section scheme to fit
+gcc/clang"), the __cmd section only includes pointers to struct cmd
+rather than the struct itself. This means that the code to measure the
+spacing is not needed anymore and can be dropped.
+
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ iw.c | 23 -----------------------
+ 1 file changed, 23 deletions(-)
+
+diff --git a/iw.c b/iw.c
+index 35308ba..c99edb1 100644
+--- a/iw.c
++++ b/iw.c
+@@ -87,8 +87,6 @@ static void nl80211_cleanup(struct nl80211_state *state)
+ 	nl_socket_free(state->nl_sock);
+ }
+ 
+-static int cmd_size;
+-
+ extern struct cmd *__start___cmd[];
+ extern struct cmd *__stop___cmd;
+ 
+@@ -555,33 +553,12 @@ int handle_cmd(struct nl80211_state *state, enum id_input idby,
+ 	return __handle_cmd(state, idby, argc, argv, NULL);
+ }
+ 
+-/*
+- * Unfortunately, I don't know how densely the linker packs the struct cmd.
+- * For example, if you have a 72-byte struct cmd, the linker will pad each
+- * out to 96 bytes before putting them together in the section. There must
+- * be some algorithm, but I haven't found it yet.
+- *
+- * We used to calculate this by taking the (abs value of) the difference
+- * between __section_get and __section_set, but if LTO is enabled then this
+- * stops working because the entries of the "__cmd" section get rearranged
+- * freely by the compiler/linker.
+- *
+- * Fix this by using yet another "__sizer" section that only contains these
+- * two entries - then the (abs value of) the difference between them will
+- * be how they get packed and that can be used to iterate the __cmd section
+- * as well.
+- */
+-static struct cmd sizer1 __attribute__((section("__sizer"))) = {};
+-static struct cmd sizer2 __attribute__((section("__sizer"))) = {};
+-
+ int main(int argc, char **argv)
+ {
+ 	struct nl80211_state nlstate;
+ 	int err;
+ 	const struct cmd *cmd = NULL;
+ 
+-	/* calculate command size including padding */
+-	cmd_size = labs((long)&sizer2 - (long)&sizer1);
+ 	/* strip off self */
+ 	argc--;
+ 	argv0 = *argv++;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/iw/patches-mlo/0027-Revert-iw-allow-specifying-CFLAGS-LIBS-externally.patch b/recipes-wifi/iw/patches-mlo/0005-Revert-iw-allow-specifying-CFLAGS-LIBS-externally.patch
similarity index 93%
rename from recipes-wifi/iw/patches-mlo/0027-Revert-iw-allow-specifying-CFLAGS-LIBS-externally.patch
rename to recipes-wifi/iw/patches-mlo/0005-Revert-iw-allow-specifying-CFLAGS-LIBS-externally.patch
index 743e415..040dfd2 100644
--- a/recipes-wifi/iw/patches-mlo/0027-Revert-iw-allow-specifying-CFLAGS-LIBS-externally.patch
+++ b/recipes-wifi/iw/patches-mlo/0005-Revert-iw-allow-specifying-CFLAGS-LIBS-externally.patch
@@ -1,7 +1,7 @@
-From 3bcf45100b9512270c674099a21162c6f0c901dc Mon Sep 17 00:00:00 2001
+From 42813f2d9097bce908f1b01982096b550d829ac7 Mon Sep 17 00:00:00 2001
 From: Hauke Mehrtens <hauke@hauke-m.de>
 Date: Sun, 21 Nov 2021 00:02:57 +0100
-Subject: [PATCH 27/28] Revert "iw: allow specifying CFLAGS/LIBS externally"
+Subject: [PATCH 05/10] Revert "iw: allow specifying CFLAGS/LIBS externally"
 
 This reverts commit 1325244b77d56fd7a16d1e35fdae0efc151920b1.
 
@@ -69,5 +69,5 @@
  
  ifeq ($(V),1)
 -- 
-2.39.2
+2.18.0
 
diff --git a/recipes-wifi/iw/patches-mlo/0005-iw-event-fix-printf-format-error.patch b/recipes-wifi/iw/patches-mlo/0005-iw-event-fix-printf-format-error.patch
deleted file mode 100644
index 00c57f0..0000000
--- a/recipes-wifi/iw/patches-mlo/0005-iw-event-fix-printf-format-error.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From d6fd2757f7aab638022ffa635e32e21594ec382d Mon Sep 17 00:00:00 2001
-From: Stefan Weil <sw@weilnetz.de>
-Date: Sat, 21 Jan 2023 20:36:37 +0100
-Subject: [PATCH 05/28] iw: event: fix printf format error
-
-tv_usec can be a 64 bit integer which causes a compiler warning:
-
-event.c: In function 'print_event':
-event.c:930:41: warning: format '%lu' expects argument of type 'long unsigned int', but argument 3 has type 'suseconds_t' {aka 'long long int'} [-Wformat=]
-  930 |                         printf("[%s.%06lu]: ", buf, args->ts.tv_usec);
-      |                                     ~~~~^           ~~~~~~~~~~~~~~~~
-      |                                         |                   |
-      |                                         long unsigned int   suseconds_t {aka long long int}
-      |                                     %06llu
-
-Signed-off-by: Stefan Weil <sw@weilnetz.de>
-Link: https://lore.kernel.org/r/20230121193637.347109-1-sw@weilnetz.de
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- event.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/event.c b/event.c
-index 4c37297..fa2e125 100644
---- a/event.c
-+++ b/event.c
-@@ -942,7 +942,7 @@ static int print_event(struct nl_msg *msg, void *arg)
- 
- 			memset(buf, 0, 255);
- 			strftime(buf, sizeof(buf), "%Y-%m-%d %H:%M:%S", tm);
--			printf("[%s.%06lu]: ", buf, args->ts.tv_usec);
-+			printf("[%s.%06lu]: ", buf, (unsigned long )args->ts.tv_usec);
- 		} else {
- 			printf("%llu.%06llu: ", usecs/1000000, usecs % 1000000);
- 		}
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0028-survey-bss-rx-time.patch b/recipes-wifi/iw/patches-mlo/0006-survey-bss-rx-time.patch
similarity index 88%
rename from recipes-wifi/iw/patches-mlo/0028-survey-bss-rx-time.patch
rename to recipes-wifi/iw/patches-mlo/0006-survey-bss-rx-time.patch
index 3869b00..5b61920 100644
--- a/recipes-wifi/iw/patches-mlo/0028-survey-bss-rx-time.patch
+++ b/recipes-wifi/iw/patches-mlo/0006-survey-bss-rx-time.patch
@@ -1,7 +1,7 @@
-From a059a337750198bf2481073194cc55022bb71c76 Mon Sep 17 00:00:00 2001
+From a417f83cef66ca22ce0a362e4812954d15721a70 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 25 Dec 2023 11:24:01 +0800
-Subject: [PATCH 28/28] survey bss rx time
+Subject: [PATCH 06/10] survey bss rx time
 
 ---
  survey.c | 3 +++
@@ -22,5 +22,5 @@
  		printf("\tchannel transmit time:\t\t%llu ms\n",
  			(unsigned long long)nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]));
 -- 
-2.39.2
+2.18.0
 
diff --git a/recipes-wifi/iw/patches-mlo/0006-update-nl80211.h.patch b/recipes-wifi/iw/patches-mlo/0006-update-nl80211.h.patch
deleted file mode 100644
index 38d68b2..0000000
--- a/recipes-wifi/iw/patches-mlo/0006-update-nl80211.h.patch
+++ /dev/null
@@ -1,425 +0,0 @@
-From de3da80461f48946b9493fb2b2d54ce6dcdc3e12 Mon Sep 17 00:00:00 2001
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Fri, 14 Apr 2023 12:50:11 +0200
-Subject: [PATCH 06/28] update nl80211.h
-
-Bring in nl80211.h from 6.4-rc.
-
-Change-Id: I96b818a987d243b5cf97e2cc9c62d57637e17165
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- info.c    |   4 +
- nl80211.h | 230 +++++++++++++++++++++++++++++++++++++++++++++++++++---
- 2 files changed, 224 insertions(+), 10 deletions(-)
-
-diff --git a/info.c b/info.c
-index 5229d44..9955e5e 100644
---- a/info.c
-+++ b/info.c
-@@ -166,6 +166,10 @@ static void ext_feat_print(enum nl80211_ext_feature_index idx)
- 	ext_feat_case(BSS_COLOR, "BSS coloring support");
- 	ext_feat_case(FILS_CRYPTO_OFFLOAD, "FILS crypto offload");
- 	ext_feat_case(RADAR_BACKGROUND, "Radar background support");
-+	ext_feat_case(POWERED_ADDR_CHANGE, "can change MAC address while up");
-+	ext_feat_case(PUNCT, "preamble puncturing in AP mode");
-+	ext_feat_case(SECURE_NAN, "secure NAN support");
-+	ext_feat_case(AUTH_AND_DEAUTH_RANDOM_TA, "random auth/deauth transmitter address");
- 	}
- }
- 
-diff --git a/nl80211.h b/nl80211.h
-index d9490e3..c59fec4 100644
---- a/nl80211.h
-+++ b/nl80211.h
-@@ -323,6 +323,17 @@
-  * Once the association is done, the driver cleans the FILS AAD data.
-  */
- 
-+/**
-+ * DOC: Multi-Link Operation
-+ *
-+ * In Multi-Link Operation, a connection between to MLDs utilizes multiple
-+ * links. To use this in nl80211, various commands and responses now need
-+ * to or will include the new %NL80211_ATTR_MLO_LINKS attribute.
-+ * Additionally, various commands that need to operate on a specific link
-+ * now need to be given the %NL80211_ATTR_MLO_LINK_ID attribute, e.g. to
-+ * use %NL80211_CMD_START_AP or similar functions.
-+ */
-+
- /**
-  * enum nl80211_commands - supported nl80211 commands
-  *
-@@ -366,14 +377,22 @@
-  *	the non-transmitting interfaces are deleted as well.
-  *
-  * @NL80211_CMD_GET_KEY: Get sequence counter information for a key specified
-- *	by %NL80211_ATTR_KEY_IDX and/or %NL80211_ATTR_MAC.
-+ *	by %NL80211_ATTR_KEY_IDX and/or %NL80211_ATTR_MAC. %NL80211_ATTR_MAC
-+ *	represents peer's MLD address for MLO pairwise key. For MLO group key,
-+ *	the link is identified by %NL80211_ATTR_MLO_LINK_ID.
-  * @NL80211_CMD_SET_KEY: Set key attributes %NL80211_ATTR_KEY_DEFAULT,
-  *	%NL80211_ATTR_KEY_DEFAULT_MGMT, or %NL80211_ATTR_KEY_THRESHOLD.
-+ *	For MLO connection, the link to set default key is identified by
-+ *	%NL80211_ATTR_MLO_LINK_ID.
-  * @NL80211_CMD_NEW_KEY: add a key with given %NL80211_ATTR_KEY_DATA,
-  *	%NL80211_ATTR_KEY_IDX, %NL80211_ATTR_MAC, %NL80211_ATTR_KEY_CIPHER,
-- *	and %NL80211_ATTR_KEY_SEQ attributes.
-+ *	and %NL80211_ATTR_KEY_SEQ attributes. %NL80211_ATTR_MAC represents
-+ *	peer's MLD address for MLO pairwise key. The link to add MLO
-+ *	group key is identified by %NL80211_ATTR_MLO_LINK_ID.
-  * @NL80211_CMD_DEL_KEY: delete a key identified by %NL80211_ATTR_KEY_IDX
-- *	or %NL80211_ATTR_MAC.
-+ *	or %NL80211_ATTR_MAC. %NL80211_ATTR_MAC represents peer's MLD address
-+ *	for MLO pairwise key. The link to delete group key is identified by
-+ *	%NL80211_ATTR_MLO_LINK_ID.
-  *
-  * @NL80211_CMD_GET_BEACON: (not used)
-  * @NL80211_CMD_SET_BEACON: change the beacon on an access point interface
-@@ -405,7 +424,8 @@
-  *	interface identified by %NL80211_ATTR_IFINDEX.
-  * @NL80211_CMD_DEL_STATION: Remove a station identified by %NL80211_ATTR_MAC
-  *	or, if no MAC address given, all stations, on the interface identified
-- *	by %NL80211_ATTR_IFINDEX. %NL80211_ATTR_MGMT_SUBTYPE and
-+ *	by %NL80211_ATTR_IFINDEX. For MLD station, MLD address is used in
-+ *	%NL80211_ATTR_MAC. %NL80211_ATTR_MGMT_SUBTYPE and
-  *	%NL80211_ATTR_REASON_CODE can optionally be used to specify which type
-  *	of disconnection indication should be sent to the station
-  *	(Deauthentication or Disassociation frame and reason code for that
-@@ -753,6 +773,13 @@
-  *	%NL80211_ATTR_CSA_C_OFFSETS_TX is an array of offsets to CSA
-  *	counters which will be updated to the current value. This attribute
-  *	is used during CSA period.
-+ *	For TX on an MLD, the frequency can be omitted and the link ID be
-+ *	specified, or if transmitting to a known peer MLD (with MLD addresses
-+ *	in the frame) both can be omitted and the link will be selected by
-+ *	lower layers.
-+ *	For RX notification, %NL80211_ATTR_RX_HW_TIMESTAMP may be included to
-+ *	indicate the frame RX timestamp and %NL80211_ATTR_TX_HW_TIMESTAMP may
-+ *	be included to indicate the ack TX timestamp.
-  * @NL80211_CMD_FRAME_WAIT_CANCEL: When an off-channel TX was requested, this
-  *	command may be used with the corresponding cookie to cancel the wait
-  *	time if it is known that it is no longer necessary.  This command is
-@@ -763,7 +790,9 @@
-  *	transmitted with %NL80211_CMD_FRAME. %NL80211_ATTR_COOKIE identifies
-  *	the TX command and %NL80211_ATTR_FRAME includes the contents of the
-  *	frame. %NL80211_ATTR_ACK flag is included if the recipient acknowledged
-- *	the frame.
-+ *	the frame. %NL80211_ATTR_TX_HW_TIMESTAMP may be included to indicate the
-+ *	tx timestamp and %NL80211_ATTR_RX_HW_TIMESTAMP may be included to
-+ *	indicate the ack RX timestamp.
-  * @NL80211_CMD_ACTION_TX_STATUS: Alias for @NL80211_CMD_FRAME_TX_STATUS for
-  *	backward compatibility.
-  *
-@@ -1108,6 +1137,12 @@
-  *	has been received. %NL80211_ATTR_FRAME is used to specify the
-  *	frame contents.  The frame is the raw EAPoL data, without ethernet or
-  *	802.11 headers.
-+ *	For an MLD transmitter, the %NL80211_ATTR_MLO_LINK_ID may be given and
-+ *	its effect will depend on the destination: If the destination is known
-+ *	to be an MLD, this will be used as a hint to select the link to transmit
-+ *	the frame on. If the destination is not an MLD, this will select both
-+ *	the link to transmit on and the source address will be set to the link
-+ *	address of that link.
-  *	When used as an event indication %NL80211_ATTR_CONTROL_PORT_ETHERTYPE,
-  *	%NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT and %NL80211_ATTR_MAC are added
-  *	indicating the protocol type of the received frame; whether the frame
-@@ -1132,6 +1167,23 @@
-  *	%NL80211_ATTR_STATUS_CODE attribute in %NL80211_CMD_EXTERNAL_AUTH
-  *	command interface.
-  *
-+ *	Host driver sends MLD address of the AP with %NL80211_ATTR_MLD_ADDR in
-+ *	%NL80211_CMD_EXTERNAL_AUTH event to indicate user space to enable MLO
-+ *	during the authentication offload in STA mode while connecting to MLD
-+ *	APs. Host driver should check %NL80211_ATTR_MLO_SUPPORT flag capability
-+ *	in %NL80211_CMD_CONNECT to know whether the user space supports enabling
-+ *	MLO during the authentication offload or not.
-+ *	User space should enable MLO during the authentication only when it
-+ *	receives the AP MLD address in authentication offload request. User
-+ *	space shouldn't enable MLO when the authentication offload request
-+ *	doesn't indicate the AP MLD address even if the AP is MLO capable.
-+ *	User space should use %NL80211_ATTR_MLD_ADDR as peer's MLD address and
-+ *	interface address identified by %NL80211_ATTR_IFINDEX as self MLD
-+ *	address. User space and host driver to use MLD addresses in RA, TA and
-+ *	BSSID fields of the frames between them, and host driver translates the
-+ *	MLD addresses to/from link addresses based on the link chosen for the
-+ *	authentication.
-+ *
-  *	Host driver reports this status on an authentication failure to the
-  *	user space through the connect result as the user space would have
-  *	initiated the connection through the connect request.
-@@ -1237,6 +1289,26 @@
-  *      to describe the BSSID address of the AP and %NL80211_ATTR_TIMEOUT to
-  *      specify the timeout value.
-  *
-+ * @NL80211_CMD_ADD_LINK: Add a new link to an interface. The
-+ *	%NL80211_ATTR_MLO_LINK_ID attribute is used for the new link.
-+ * @NL80211_CMD_REMOVE_LINK: Remove a link from an interface. This may come
-+ *	without %NL80211_ATTR_MLO_LINK_ID as an easy way to remove all links
-+ *	in preparation for e.g. roaming to a regular (non-MLO) AP.
-+ *
-+ * @NL80211_CMD_ADD_LINK_STA: Add a link to an MLD station
-+ * @NL80211_CMD_MODIFY_LINK_STA: Modify a link of an MLD station
-+ * @NL80211_CMD_REMOVE_LINK_STA: Remove a link of an MLD station
-+ *
-+ * @NL80211_CMD_SET_HW_TIMESTAMP: Enable/disable HW timestamping of Timing
-+ *	measurement and Fine timing measurement frames. If %NL80211_ATTR_MAC
-+ *	is included, enable/disable HW timestamping only for frames to/from the
-+ *	specified MAC address. Otherwise enable/disable HW timestamping for
-+ *	all TM/FTM frames (including ones that were enabled with specific MAC
-+ *	address). If %NL80211_ATTR_HW_TIMESTAMP_ENABLED is not included, disable
-+ *	HW timestamping.
-+ *	The number of peers that HW timestamping can be enabled for concurrently
-+ *	is indicated by %NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS.
-+ *
-  * @NL80211_CMD_MAX: highest used command number
-  * @__NL80211_CMD_AFTER_LAST: internal use
-  */
-@@ -1481,6 +1553,15 @@ enum nl80211_commands {
- 
- 	NL80211_CMD_ASSOC_COMEBACK,
- 
-+	NL80211_CMD_ADD_LINK,
-+	NL80211_CMD_REMOVE_LINK,
-+
-+	NL80211_CMD_ADD_LINK_STA,
-+	NL80211_CMD_MODIFY_LINK_STA,
-+	NL80211_CMD_REMOVE_LINK_STA,
-+
-+	NL80211_CMD_SET_HW_TIMESTAMP,
-+
- 	/* add new commands above here */
- 
- 	/* used to define NL80211_CMD_MAX below */
-@@ -2340,8 +2421,10 @@ enum nl80211_commands {
-  *
-  * @NL80211_ATTR_IFTYPE_EXT_CAPA: Nested attribute of the following attributes:
-  *	%NL80211_ATTR_IFTYPE, %NL80211_ATTR_EXT_CAPA,
-- *	%NL80211_ATTR_EXT_CAPA_MASK, to specify the extended capabilities per
-- *	interface type.
-+ *	%NL80211_ATTR_EXT_CAPA_MASK, to specify the extended capabilities and
-+ *	other interface-type specific capabilities per interface type. For MLO,
-+ *	%NL80211_ATTR_EML_CAPABILITY and %NL80211_ATTR_MLD_CAPA_AND_OPS are
-+ *	present.
-  *
-  * @NL80211_ATTR_MU_MIMO_GROUP_DATA: array of 24 bytes that defines a MU-MIMO
-  *	groupID for monitor mode.
-@@ -2663,6 +2746,65 @@ enum nl80211_commands {
-  *	association request when used with NL80211_CMD_NEW_STATION). Can be set
-  *	only if %NL80211_STA_FLAG_WME is set.
-  *
-+ * @NL80211_ATTR_MLO_LINK_ID: A (u8) link ID for use with MLO, to be used with
-+ *	various commands that need a link ID to operate.
-+ * @NL80211_ATTR_MLO_LINKS: A nested array of links, each containing some
-+ *	per-link information and a link ID.
-+ * @NL80211_ATTR_MLD_ADDR: An MLD address, used with various commands such as
-+ *	authenticate/associate.
-+ *
-+ * @NL80211_ATTR_MLO_SUPPORT: Flag attribute to indicate user space supports MLO
-+ *	connection. Used with %NL80211_CMD_CONNECT. If this attribute is not
-+ *	included in NL80211_CMD_CONNECT drivers must not perform MLO connection.
-+ *
-+ * @NL80211_ATTR_MAX_NUM_AKM_SUITES: U16 attribute. Indicates maximum number of
-+ *	AKM suites allowed for %NL80211_CMD_CONNECT, %NL80211_CMD_ASSOCIATE and
-+ *	%NL80211_CMD_START_AP in %NL80211_CMD_GET_WIPHY response. If this
-+ *	attribute is not present userspace shall consider maximum number of AKM
-+ *	suites allowed as %NL80211_MAX_NR_AKM_SUITES which is the legacy maximum
-+ *	number prior to the introduction of this attribute.
-+ *
-+ * @NL80211_ATTR_EML_CAPABILITY: EML Capability information (u16)
-+ * @NL80211_ATTR_MLD_CAPA_AND_OPS: MLD Capabilities and Operations (u16)
-+ *
-+ * @NL80211_ATTR_TX_HW_TIMESTAMP: Hardware timestamp for TX operation in
-+ *	nanoseconds (u64). This is the device clock timestamp so it will
-+ *	probably reset when the device is stopped or the firmware is reset.
-+ *	When used with %NL80211_CMD_FRAME_TX_STATUS, indicates the frame TX
-+ *	timestamp. When used with %NL80211_CMD_FRAME RX notification, indicates
-+ *	the ack TX timestamp.
-+ * @NL80211_ATTR_RX_HW_TIMESTAMP: Hardware timestamp for RX operation in
-+ *	nanoseconds (u64). This is the device clock timestamp so it will
-+ *	probably reset when the device is stopped or the firmware is reset.
-+ *	When used with %NL80211_CMD_FRAME_TX_STATUS, indicates the ack RX
-+ *	timestamp. When used with %NL80211_CMD_FRAME RX notification, indicates
-+ *	the incoming frame RX timestamp.
-+ * @NL80211_ATTR_TD_BITMAP: Transition Disable bitmap, for subsequent
-+ *	(re)associations.
-+ *
-+ * @NL80211_ATTR_PUNCT_BITMAP: (u32) Preamble puncturing bitmap, lowest
-+ *	bit corresponds to the lowest 20 MHz channel. Each bit set to 1
-+ *	indicates that the sub-channel is punctured. Higher 16 bits are
-+ *	reserved.
-+ *
-+ * @NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS: Maximum number of peers that HW
-+ *	timestamping can be enabled for concurrently (u16), a wiphy attribute.
-+ *	A value of 0xffff indicates setting for all peers (i.e. not specifying
-+ *	an address with %NL80211_CMD_SET_HW_TIMESTAMP) is supported.
-+ * @NL80211_ATTR_HW_TIMESTAMP_ENABLED: Indicates whether HW timestamping should
-+ *	be enabled or not (flag attribute).
-+ *
-+ * @NL80211_ATTR_EMA_RNR_ELEMS: Optional nested attribute for
-+ *	reduced neighbor report (RNR) elements. This attribute can be used
-+ *	only when NL80211_MBSSID_CONFIG_ATTR_EMA is enabled.
-+ *	Userspace is responsible for splitting the RNR into multiple
-+ *	elements such that each element excludes the non-transmitting
-+ *	profiles already included in the MBSSID element
-+ *	(%NL80211_ATTR_MBSSID_ELEMS) at the same index. Each EMA beacon
-+ *	will be generated by adding MBSSID and RNR elements at the same
-+ *	index. If the userspace includes more RNR elements than number of
-+ *	MBSSID elements then these will be added in every EMA beacon.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3177,6 +3319,28 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_DISABLE_EHT,
- 
-+	NL80211_ATTR_MLO_LINKS,
-+	NL80211_ATTR_MLO_LINK_ID,
-+	NL80211_ATTR_MLD_ADDR,
-+
-+	NL80211_ATTR_MLO_SUPPORT,
-+
-+	NL80211_ATTR_MAX_NUM_AKM_SUITES,
-+
-+	NL80211_ATTR_EML_CAPABILITY,
-+	NL80211_ATTR_MLD_CAPA_AND_OPS,
-+
-+	NL80211_ATTR_TX_HW_TIMESTAMP,
-+	NL80211_ATTR_RX_HW_TIMESTAMP,
-+	NL80211_ATTR_TD_BITMAP,
-+
-+	NL80211_ATTR_PUNCT_BITMAP,
-+
-+	NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS,
-+	NL80211_ATTR_HW_TIMESTAMP_ENABLED,
-+
-+	NL80211_ATTR_EMA_RNR_ELEMS,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -3231,6 +3395,11 @@ enum nl80211_attrs {
- #define NL80211_HE_MIN_CAPABILITY_LEN           16
- #define NL80211_HE_MAX_CAPABILITY_LEN           54
- #define NL80211_MAX_NR_CIPHER_SUITES		5
-+
-+/*
-+ * NL80211_MAX_NR_AKM_SUITES is obsolete when %NL80211_ATTR_MAX_NUM_AKM_SUITES
-+ * present in %NL80211_CMD_GET_WIPHY response.
-+ */
- #define NL80211_MAX_NR_AKM_SUITES		2
- #define NL80211_EHT_MIN_CAPABILITY_LEN          13
- #define NL80211_EHT_MAX_CAPABILITY_LEN          51
-@@ -3892,6 +4061,10 @@ enum nl80211_band_iftype_attr {
-  * @NL80211_BAND_ATTR_EDMG_BW_CONFIG: Channel BW Configuration subfield encodes
-  *	the allowed channel bandwidth configurations.
-  *	Defined by IEEE P802.11ay/D4.0 section 9.4.2.251, Table 13.
-+ * @NL80211_BAND_ATTR_S1G_MCS_NSS_SET: S1G capabilities, supported S1G-MCS and NSS
-+ *	set subfield, as in the S1G information IE, 5 bytes
-+ * @NL80211_BAND_ATTR_S1G_CAPA: S1G capabilities information subfield as in the
-+ *	S1G information IE, 10 bytes
-  * @NL80211_BAND_ATTR_MAX: highest band attribute currently defined
-  * @__NL80211_BAND_ATTR_AFTER_LAST: internal use
-  */
-@@ -3912,6 +4085,9 @@ enum nl80211_band_attr {
- 	NL80211_BAND_ATTR_EDMG_CHANNELS,
- 	NL80211_BAND_ATTR_EDMG_BW_CONFIG,
- 
-+	NL80211_BAND_ATTR_S1G_MCS_NSS_SET,
-+	NL80211_BAND_ATTR_S1G_CAPA,
-+
- 	/* keep last */
- 	__NL80211_BAND_ATTR_AFTER_LAST,
- 	NL80211_BAND_ATTR_MAX = __NL80211_BAND_ATTR_AFTER_LAST - 1
-@@ -4853,6 +5029,8 @@ enum nl80211_bss_scan_width {
-  *	Contains a nested array of signal strength attributes (u8, dBm),
-  *	using the nesting index as the antenna number.
-  * @NL80211_BSS_FREQUENCY_OFFSET: frequency offset in KHz
-+ * @NL80211_BSS_MLO_LINK_ID: MLO link ID of the BSS (u8).
-+ * @NL80211_BSS_MLD_ADDR: MLD address of this BSS if connected to it.
-  * @__NL80211_BSS_AFTER_LAST: internal
-  * @NL80211_BSS_MAX: highest BSS attribute
-  */
-@@ -4878,6 +5056,8 @@ enum nl80211_bss {
- 	NL80211_BSS_PARENT_BSSID,
- 	NL80211_BSS_CHAIN_SIGNAL,
- 	NL80211_BSS_FREQUENCY_OFFSET,
-+	NL80211_BSS_MLO_LINK_ID,
-+	NL80211_BSS_MLD_ADDR,
- 
- 	/* keep last */
- 	__NL80211_BSS_AFTER_LAST,
-@@ -5757,6 +5937,7 @@ enum plink_actions {
- #define NL80211_KEK_LEN			16
- #define NL80211_KCK_EXT_LEN		24
- #define NL80211_KEK_EXT_LEN		32
-+#define NL80211_KCK_EXT_LEN_32		32
- #define NL80211_REPLAY_CTR_LEN		8
- 
- /**
-@@ -5874,7 +6055,7 @@ enum nl80211_ap_sme_features {
-  * @NL80211_FEATURE_INACTIVITY_TIMER: This driver takes care of freeing up
-  *	the connected inactive stations in AP mode.
-  * @NL80211_FEATURE_CELL_BASE_REG_HINTS: This driver has been tested
-- *	to work properly to suppport receiving regulatory hints from
-+ *	to work properly to support receiving regulatory hints from
-  *	cellular base stations.
-  * @NL80211_FEATURE_P2P_DEVICE_NEEDS_CHANNEL: (no longer available, only
-  *	here to reserve the value for API/ABI compatibility)
-@@ -6174,6 +6355,23 @@ enum nl80211_feature_flags {
-  * @NL80211_EXT_FEATURE_RADAR_BACKGROUND: Device supports background radar/CAC
-  *	detection.
-  *
-+ * @NL80211_EXT_FEATURE_POWERED_ADDR_CHANGE: Device can perform a MAC address
-+ *	change without having to bring the underlying network device down
-+ *	first. For example, in station mode this can be used to vary the
-+ *	origin MAC address prior to a connection to a new AP for privacy
-+ *	or other reasons. Note that certain driver specific restrictions
-+ *	might apply, e.g. no scans in progress, no offchannel operations
-+ *	in progress, and no active connections.
-+ *
-+ * @NL80211_EXT_FEATURE_PUNCT: Driver supports preamble puncturing in AP mode.
-+ *
-+ * @NL80211_EXT_FEATURE_SECURE_NAN: Device supports NAN Pairing which enables
-+ *	authentication, data encryption and message integrity.
-+ *
-+ * @NL80211_EXT_FEATURE_AUTH_AND_DEAUTH_RANDOM_TA: Device supports randomized TA
-+ *	in authentication and deauthentication frames sent to unassociated peer
-+ *	using @NL80211_CMD_FRAME.
-+ *
-  * @NUM_NL80211_EXT_FEATURES: number of extended features.
-  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
-  */
-@@ -6241,6 +6439,10 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_BSS_COLOR,
- 	NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD,
- 	NL80211_EXT_FEATURE_RADAR_BACKGROUND,
-+	NL80211_EXT_FEATURE_POWERED_ADDR_CHANGE,
-+	NL80211_EXT_FEATURE_PUNCT,
-+	NL80211_EXT_FEATURE_SECURE_NAN,
-+	NL80211_EXT_FEATURE_AUTH_AND_DEAUTH_RANDOM_TA,
- 
- 	/* add new features before the definition below */
- 	NUM_NL80211_EXT_FEATURES,
-@@ -6355,8 +6557,16 @@ enum nl80211_timeout_reason {
-  * @NL80211_SCAN_FLAG_FREQ_KHZ: report scan results with
-  *	%NL80211_ATTR_SCAN_FREQ_KHZ. This also means
-  *	%NL80211_ATTR_SCAN_FREQUENCIES will not be included.
-- * @NL80211_SCAN_FLAG_COLOCATED_6GHZ: scan for colocated APs reported by
-- *	2.4/5 GHz APs
-+ * @NL80211_SCAN_FLAG_COLOCATED_6GHZ: scan for collocated APs reported by
-+ *	2.4/5 GHz APs. When the flag is set, the scan logic will use the
-+ *	information from the RNR element found in beacons/probe responses
-+ *	received on the 2.4/5 GHz channels to actively scan only the 6GHz
-+ *	channels on which APs are expected to be found. Note that when not set,
-+ *	the scan logic would scan all 6GHz channels, but since transmission of
-+ *	probe requests on non PSC channels is limited, it is highly likely that
-+ *	these channels would passively be scanned. Also note that when the flag
-+ *	is set, in addition to the colocated APs, PSC channels would also be
-+ *	scanned if the user space has asked for it.
-  */
- enum nl80211_scan_flags {
- 	NL80211_SCAN_FLAG_LOW_PRIORITY				= 1<<0,
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0007-iw-support-link-id-in-set-bitrates-command.patch b/recipes-wifi/iw/patches-mlo/0007-iw-support-link-id-in-set-bitrates-command.patch
new file mode 100644
index 0000000..8d0e0a0
--- /dev/null
+++ b/recipes-wifi/iw/patches-mlo/0007-iw-support-link-id-in-set-bitrates-command.patch
@@ -0,0 +1,59 @@
+From f885f9be220545bc3d62c369d68ded69e2711b52 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 30 May 2024 10:17:29 +0800
+Subject: [PATCH 07/10] iw: support link id in set bitrates command
+
+Since NL80211_CMD_SET_TX_BITRATE_MASK includes flag
+NL80211_FLAG_MLO_VALID_LINK_ID, nl80211_pre_do_it() will check whether
+nl80211_msg includes LINK_ID. Without this patch, iw set bitrates
+command must failed.
+
+Usage:
+iw dev <intf> set bitrates -l <link_id> [legacy | he-gi-xx ...]
+
+CR-Id: WCNCR00261410
+Change-Id: I4984054543f63c9324d9b81a240382023fbc0b0b
+---
+ bitrate.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/bitrate.c b/bitrate.c
+index 8714669..f0f81a0 100644
+--- a/bitrate.c
++++ b/bitrate.c
+@@ -146,7 +146,7 @@ int set_bitrates(struct nl_msg *msg,
+ 		 enum nl80211_attrs attr)
+ {
+ 	struct nlattr *nl_rates, *nl_band;
+-	int i, ret = 0;
++	int i, ret = 0, index = 0;
+ 	bool have_legacy_24 = false, have_legacy_5 = false;
+ 	uint8_t legacy_24[32], legacy_5[32];
+ 	int n_legacy_24 = 0, n_legacy_5 = 0;
+@@ -190,7 +190,22 @@ int set_bitrates(struct nl_msg *msg,
+ 		S_HE_LTF,
+ 	} parser_state = S_NONE;
+ 
+-	for (i = 0; i < argc; i++) {
++	if (!strcmp(argv[0], "-l")) {
++		unsigned int link_id;
++		char *endptr;
++
++		link_id = strtol(argv[1], &endptr, 10);
++		if (*endptr)
++			return 1;
++
++		if (link_id > 15)
++			return 1;
++
++		nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id);
++		index = 2;
++	}
++
++	for (i = index; i < argc; i++) {
+ 		char *end;
+ 		double tmpd;
+ 		long tmpl;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/iw/patches-mlo/0007-util-add-support-for-320Mhz-bandwidth.patch b/recipes-wifi/iw/patches-mlo/0007-util-add-support-for-320Mhz-bandwidth.patch
deleted file mode 100644
index 5794606..0000000
--- a/recipes-wifi/iw/patches-mlo/0007-util-add-support-for-320Mhz-bandwidth.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 81d112f13d290d109e0c64541c0f02a0931a7a8d Mon Sep 17 00:00:00 2001
-From: Mordechay Goodstein <mordechay.goodstein@intel.com>
-Date: Sun, 29 May 2022 19:29:55 +0300
-Subject: [PATCH 07/28] util: add support for 320Mhz bandwidth
-
-In the new standard 11be we can set up to 320Mhz bandwidth so add it
-in parsing params.
-
-Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- util.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/util.c b/util.c
-index 8a2ba10..93269ab 100644
---- a/util.c
-+++ b/util.c
-@@ -471,6 +471,7 @@ enum nl80211_chan_width str_to_bw(const char *str)
- 		{ .name = "80", .val = NL80211_CHAN_WIDTH_80, },
- 		{ .name = "80+80", .val = NL80211_CHAN_WIDTH_80P80, },
- 		{ .name = "160", .val = NL80211_CHAN_WIDTH_160, },
-+		{ .name = "320", .val = NL80211_CHAN_WIDTH_320, },
- 	};
- 	unsigned int i;
- 
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0008-iw-add-per-link-txpower-config.patch b/recipes-wifi/iw/patches-mlo/0008-iw-add-per-link-txpower-config.patch
new file mode 100644
index 0000000..61bf8e0
--- /dev/null
+++ b/recipes-wifi/iw/patches-mlo/0008-iw-add-per-link-txpower-config.patch
@@ -0,0 +1,140 @@
+From 248f4644bcfcf5701fb3ab576736091b6eb4f662 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Wed, 5 Jun 2024 22:10:24 +0800
+Subject: [PATCH 08/10] iw: add per-link txpower config
+
+Add per-link txpower config & info dump
+
+CR-Id: WCNCR00274293
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ ieee80211.h |  3 +++
+ interface.c |  9 +++++++--
+ phy.c       | 38 ++++++++++++++++++++++++++------------
+ 3 files changed, 36 insertions(+), 14 deletions(-)
+
+diff --git a/ieee80211.h b/ieee80211.h
+index 3713a4d..c86984d 100644
+--- a/ieee80211.h
++++ b/ieee80211.h
+@@ -75,4 +75,7 @@ struct ieee80211_vht_cap {
+ #define WLAN_CIPHER_SUITE_BIP_GMAC_256  SUITE(0x000FAC, 12)
+ #define WLAN_CIPHER_SUITE_BIP_CMAC_256  SUITE(0x000FAC, 13)
+ 
++/* multi-link device */
++#define IEEE80211_MLD_MAX_NUM_LINKS	15
++
+ #endif /* __IEEE80211 */
+diff --git a/interface.c b/interface.c
+index bb1a1d3..7a690fa 100644
+--- a/interface.c
++++ b/interface.c
+@@ -406,6 +406,7 @@ static int print_iface_handler(struct nl_msg *msg, void *arg)
+ 	struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
+ 	unsigned int *wiphy = arg;
+ 	const char *indent = "";
++	int32_t txp;
+ 
+ 	nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
+ 		  genlmsg_attrlen(gnlh, 0), NULL);
+@@ -449,8 +450,7 @@ static int print_iface_handler(struct nl_msg *msg, void *arg)
+ 	}
+ 
+ 	if (tb_msg[NL80211_ATTR_WIPHY_TX_POWER_LEVEL]) {
+-		int32_t txp = nla_get_u32(tb_msg[NL80211_ATTR_WIPHY_TX_POWER_LEVEL]);
+-
++		txp = nla_get_u32(tb_msg[NL80211_ATTR_WIPHY_TX_POWER_LEVEL]);
+ 		printf("%s\ttxpower %d.%.2d dBm\n",
+ 		       indent, txp / 100, txp % 100);
+ 	}
+@@ -490,6 +490,11 @@ static int print_iface_handler(struct nl_msg *msg, void *arg)
+ 				printf("\n%s\t   ", indent);
+ 				print_channel(tb);
+ 			}
++			if (tb[NL80211_ATTR_WIPHY_TX_POWER_LEVEL]) {
++				txp = nla_get_u32(tb[NL80211_ATTR_WIPHY_TX_POWER_LEVEL]);
++				printf("\n%s\t   ", indent);
++				printf("txpower %d.%.2d dBm", txp / 100, txp % 100);
++			}
+ 			printf("\n");
+ 		}
+ 	}
+diff --git a/phy.c b/phy.c
+index 584b103..f9a5b0f 100644
+--- a/phy.c
++++ b/phy.c
+@@ -686,37 +686,51 @@ static int handle_txpower(struct nl80211_state *state,
+ 			  enum id_input id)
+ {
+ 	enum nl80211_tx_power_setting type;
+-	int mbm;
++	unsigned int link_id;
++	int mbm, pos = 0;
++	char *endptr;
+ 
+-	/* get the required args */
+-	if (argc != 1 && argc != 2)
++	/* check args number */
++	if (argc < 1 && argc > 4)
+ 		return 1;
+ 
+-	if (!strcmp(argv[0], "auto"))
++	if (!strcmp(argv[0], "-l")) {
++		link_id = strtol(argv[1], &endptr, 10);
++		if (*endptr)
++			return 1;
++
++		if (link_id >= IEEE80211_MLD_MAX_NUM_LINKS) {
++			printf("link id %d exceeds max number of links\n", link_id);
++			return 2;
++		}
++		NLA_PUT_U8(msg, NL80211_ATTR_MLO_LINK_ID, link_id);
++		pos += 2;
++	}
++
++	if (!strcmp(argv[pos], "auto"))
+ 		type = NL80211_TX_POWER_AUTOMATIC;
+-	else if (!strcmp(argv[0], "fixed"))
++	else if (!strcmp(argv[pos], "fixed"))
+ 		type = NL80211_TX_POWER_FIXED;
+-	else if (!strcmp(argv[0], "limit"))
++	else if (!strcmp(argv[pos], "limit"))
+ 		type = NL80211_TX_POWER_LIMITED;
+ 	else {
+-		printf("Invalid parameter: %s\n", argv[0]);
++		printf("Invalid parameter: %s\n", argv[pos]);
+ 		return 2;
+ 	}
+ 
+ 	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_TX_POWER_SETTING, type);
+ 
+ 	if (type != NL80211_TX_POWER_AUTOMATIC) {
+-		char *endptr;
+-		if (argc != 2) {
++		if (argc < 2 + pos) {
+ 			printf("Missing TX power level argument.\n");
+ 			return 2;
+ 		}
+ 
+-		mbm = strtol(argv[1], &endptr, 10);
++		mbm = strtol(argv[pos + 1], &endptr, 10);
+ 		if (*endptr)
+ 			return 2;
+ 		NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL, mbm);
+-	} else if (argc != 1)
++	} else if (argc != 1 + pos)
+ 		return 1;
+ 
+ 	return 0;
+@@ -727,7 +741,7 @@ static int handle_txpower(struct nl80211_state *state,
+ COMMAND(set, txpower, "<auto|fixed|limit> [<tx power in mBm>]",
+ 	NL80211_CMD_SET_WIPHY, 0, CIB_PHY, handle_txpower,
+ 	"Specify transmit power level and setting type.");
+-COMMAND(set, txpower, "<auto|fixed|limit> [<tx power in mBm>]",
++COMMAND(set, txpower, "[-l <link_id>] <auto|fixed|limit> [<tx power in mBm>]",
+ 	NL80211_CMD_SET_WIPHY, 0, CIB_NETDEV, handle_txpower,
+ 	"Specify transmit power level and setting type.");
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/iw/patches-mlo/0008-util-add-support-for-320MHz-bandwidth-without-cf1.patch b/recipes-wifi/iw/patches-mlo/0008-util-add-support-for-320MHz-bandwidth-without-cf1.patch
deleted file mode 100644
index 15aed5d..0000000
--- a/recipes-wifi/iw/patches-mlo/0008-util-add-support-for-320MHz-bandwidth-without-cf1.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 997e5f13e7bc2267b28e541a2904d7f7d84227d0 Mon Sep 17 00:00:00 2001
-From: Mordechay Goodstein <mordechay.goodstein@intel.com>
-Date: Sun, 29 May 2022 19:29:55 +0300
-Subject: [PATCH 08/28] util: add support for 320MHz bandwidth without cf1
-
-Based on user input for control central freq and 320 BW find the data
-central freq (cf1).
-
-Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- phy.c  |  4 ++--
- util.c | 16 +++++++++++++++-
- 2 files changed, 17 insertions(+), 3 deletions(-)
-
-diff --git a/phy.c b/phy.c
-index 0a57ecb..15cea32 100644
---- a/phy.c
-+++ b/phy.c
-@@ -199,13 +199,13 @@ static int handle_freq(struct nl80211_state *state, struct nl_msg *msg,
- }
- 
- COMMAND(set, freq,
--	"<freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz]\n"
-+	"<freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz|320MHz]\n"
- 	"<control freq> [5|10|20|40|80|80+80|160] [<center1_freq> [<center2_freq>]]",
- 	NL80211_CMD_SET_WIPHY, 0, CIB_PHY, handle_freq,
- 	"Set frequency/channel the hardware is using, including HT\n"
- 	"configuration.");
- COMMAND(set, freq,
--	"<freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz]\n"
-+	"<freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz|320MHz]\n"
- 	"<control freq> [5|10|20|40|80|80+80|160] [<center1_freq> [<center2_freq>]]",
- 	NL80211_CMD_SET_WIPHY, 0, CIB_NETDEV, handle_freq, NULL);
- 
-diff --git a/util.c b/util.c
-index 93269ab..80dc301 100644
---- a/util.c
-+++ b/util.c
-@@ -583,7 +583,7 @@ static int parse_freqs(struct chandef *chandef, int argc, char **argv,
-  *   <channel> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz]
-  *
-  * And if frequency is set:
-- *   <freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz]
-+ *   <freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz|320MHz]
-  *   <control freq> [5|10|20|40|80|80+80|160] [<center1_freq> [<center2_freq>]]
-  *
-  * If the mode/channel width is not given the NOHT is assumed.
-@@ -1696,6 +1696,8 @@ int get_cf1(const struct chanmode *chanmode, unsigned long freq)
- 				6195, 6995 };
- 	unsigned int bw160[] = { 5180, 5500, 5955, 6115, 6275, 6435,
- 				  6595, 6755, 6915 };
-+	/* based on 11be D2 E.1 Country information and operating classes */
-+	unsigned int bw320[] = {5955, 6115, 6275, 6435, 6595, 6755};
- 
- 	switch (chanmode->width) {
- 	case NL80211_CHAN_WIDTH_80:
-@@ -1722,6 +1724,18 @@ int get_cf1(const struct chanmode *chanmode, unsigned long freq)
- 
- 		cf1 = bw160[j] + 70;
- 		break;
-+	case NL80211_CHAN_WIDTH_320:
-+		/* setup center_freq1 */
-+		for (j = 0; j < ARRAY_SIZE(bw320); j++) {
-+			if (freq >= bw320[j] && freq < bw320[j] + 160)
-+				break;
-+		}
-+
-+		if (j == ARRAY_SIZE(bw320))
-+			break;
-+
-+		cf1 = bw320[j] + 150;
-+		break;
- 	default:
- 		cf1 = freq + chanmode->freq1_diff;
- 		break;
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0009-iw-scan-set-NL80211_SCAN_FLAG_COLOCATED_6GHZ-in-case.patch b/recipes-wifi/iw/patches-mlo/0009-iw-scan-set-NL80211_SCAN_FLAG_COLOCATED_6GHZ-in-case.patch
deleted file mode 100644
index 387088e..0000000
--- a/recipes-wifi/iw/patches-mlo/0009-iw-scan-set-NL80211_SCAN_FLAG_COLOCATED_6GHZ-in-case.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 29555e143d01de7570bdb5d11d9c785f6e59e6bf Mon Sep 17 00:00:00 2001
-From: Ayala Beker <ayala.beker@intel.com>
-Date: Thu, 14 Jul 2022 09:33:36 +0300
-Subject: [PATCH 09/28] iw: scan: set NL80211_SCAN_FLAG_COLOCATED_6GHZ in case
- of full sched scan
-
-Same as in regular scan, in case of full sched scan need to set
-NL80211_SCAN_FLAG_COLOCATED_6GHZ flag, to scan for collocated
-APs by default.
-
-Signed-off-by: Ayala Beker <ayala.beker@intel.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- scan.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/scan.c b/scan.c
-index dfc136a..4c67c87 100644
---- a/scan.c
-+++ b/scan.c
-@@ -349,6 +349,8 @@ int parse_sched_scan(struct nl_msg *msg, int *argc, char ***argv)
- 		nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
- 	if (have_freqs)
- 		nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
-+	else
-+		flags |= NL80211_SCAN_FLAG_COLOCATED_6GHZ;
- 	if (have_matchset)
- 		nla_put_nested(msg, NL80211_ATTR_SCHED_SCAN_MATCH, matchset);
- 	if (have_plans)
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0009-mtk-wifi-iw-dump-links-information-in-station-dump.patch b/recipes-wifi/iw/patches-mlo/0009-mtk-wifi-iw-dump-links-information-in-station-dump.patch
new file mode 100644
index 0000000..f6c01f0
--- /dev/null
+++ b/recipes-wifi/iw/patches-mlo/0009-mtk-wifi-iw-dump-links-information-in-station-dump.patch
@@ -0,0 +1,94 @@
+From be69477058da6305cceb451a8449f41f8f9fe24d Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Tue, 11 Jun 2024 11:18:41 +0800
+Subject: [PATCH 09/10] mtk: wifi: iw: dump links information in station dump
+
+Parse and show the following link information
+1. link address
+2. Rssi
+3. Tx rate
+4. Rx rate
+5. dtim period
+4. beacon interval
+
+CR-Id: WCNCR00240772
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Change-Id: Ia6122b7938a38ca0b2eb5060c21193f705d48181
+---
+ station.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 60 insertions(+)
+
+diff --git a/station.c b/station.c
+index bf7c0f5..e91cb73 100644
+--- a/station.c
++++ b/station.c
+@@ -636,6 +636,66 @@ static int print_sta_handler(struct nl_msg *msg, void *arg)
+ 	}
+ 
+ 	printf("\n\tcurrent time:\t%llu ms\n", now_ms);
++
++	printf("\t*** MLD Information ***");
++	if (tb[NL80211_ATTR_MLO_LINK_ID])
++		printf("\n\tSetup link = %d", nla_get_u8(tb[NL80211_ATTR_MLO_LINK_ID]));
++
++	if (tb[NL80211_ATTR_MLD_ADDR]) {
++		mac_addr_n2a(mac_addr, nla_data(tb[NL80211_ATTR_MLD_ADDR]));
++		printf("\n\tMLD Address: %s", mac_addr);
++	}
++
++	if (tb[NL80211_ATTR_MLO_LINKS]) {
++		struct nlattr *link;
++		char buf[100];
++		int rem;
++
++		nla_for_each_nested(link, tb[NL80211_ATTR_MLO_LINKS], rem) {
++			struct nlattr *tb_link[NL80211_ATTR_MAX + 1];
++
++			nla_parse_nested(tb_link, NL80211_ATTR_MAX, link, NULL);
++
++			if (tb_link[NL80211_ATTR_MLO_LINK_ID])
++				printf("\n\t***** Link ID: %2d *****",
++				       nla_get_u32(tb_link[NL80211_ATTR_MLO_LINK_ID]));
++			if (tb_link[NL80211_ATTR_MAC]) {
++				mac_addr_n2a(buf, nla_data(tb_link[NL80211_ATTR_MAC]));
++				printf("\n\tLink addr: %s", buf);
++			}
++			if (nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
++					     tb_link[NL80211_ATTR_STA_INFO],
++					     stats_policy)) {
++				fprintf(stderr, "failed to parse nested attributes!\n");
++				return NL_SKIP;
++			}
++			if (sinfo[NL80211_STA_INFO_TX_BITRATE]) {
++				parse_bitrate(sinfo[NL80211_STA_INFO_TX_BITRATE],
++					      buf, sizeof(buf));
++				printf("\n\ttx bitrate:\t%s", buf);
++			}
++			if (sinfo[NL80211_STA_INFO_RX_BITRATE]) {
++				parse_bitrate(sinfo[NL80211_STA_INFO_RX_BITRATE],
++					      buf, sizeof(buf));
++				printf("\n\trx bitrate:\t%s", buf);
++			}
++			chain = get_chain_signal(sinfo[NL80211_STA_INFO_CHAIN_SIGNAL]);
++			if (sinfo[NL80211_STA_INFO_SIGNAL])
++				printf("\n\tsignal:  \t%d %sdBm",
++					(int8_t)nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]),
++					chain);
++
++			chain = get_chain_signal(sinfo[NL80211_STA_INFO_CHAIN_SIGNAL_AVG]);
++			if (sinfo[NL80211_STA_INFO_SIGNAL_AVG])
++				printf("\n\tsignal avg:\t%d %sdBm",
++					(int8_t)nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL_AVG]),
++					chain);
++
++			if (sinfo[NL80211_STA_INFO_BSS_PARAM])
++				parse_bss_param(sinfo[NL80211_STA_INFO_BSS_PARAM]);
++		}
++	}
++	printf("\n");
+ 	return NL_SKIP;
+ }
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/iw/patches-mlo/0010-iw-add-per-radio-antenna-config.patch b/recipes-wifi/iw/patches-mlo/0010-iw-add-per-radio-antenna-config.patch
new file mode 100644
index 0000000..8a009fe
--- /dev/null
+++ b/recipes-wifi/iw/patches-mlo/0010-iw-add-per-radio-antenna-config.patch
@@ -0,0 +1,170 @@
+From a050861779a1e01ad2079830336b67d926ed7af7 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 13 Jun 2024 16:48:00 +0800
+Subject: [PATCH 10/10] iw: add per-radio antenna config
+
+Add per-radio antenna config & info dump
+Currently, there is no radio index or supported band bitmap in wiphy data struct
+& NL80211 ATTRS.
+Therefore, we just use NL80211_BANDS_XX to specify the radio we desire
+to config.
+
+CR-Id: WCNCR00274293
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Change-Id: Ibf0b3efb99b7568ba2195358cbb5483f2d91794a
+---
+ info.c | 49 +++++++++++++++++++++++++++++++++++++++++--------
+ phy.c  | 50 ++++++++++++++++++++++++++++++++++++++++----------
+ 2 files changed, 81 insertions(+), 18 deletions(-)
+
+diff --git a/info.c b/info.c
+index c5e863f..ddfef67 100644
+--- a/info.c
++++ b/info.c
+@@ -335,6 +335,14 @@ static int print_phy_handler(struct nl_msg *msg, void *arg)
+ 	static int last_band = -1;
+ 	static bool band_had_freq = false;
+ 	bool print_name = true;
++	static const char * const bands[] = {
++		[NL80211_BAND_2GHZ] = "2G",
++		[NL80211_BAND_5GHZ] = "5G",
++		[NL80211_BAND_60GHZ] = "60G",
++		[NL80211_BAND_6GHZ] = "6G",
++		[NL80211_BAND_S1GHZ] = "S1G",
++		[NL80211_BAND_LC] = "LC",
++	};
+ 
+ 	nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
+ 		  genlmsg_attrlen(gnlh, 0), NULL);
+@@ -540,16 +548,41 @@ next:
+ 	}
+ 
+ 	if (tb_msg[NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX] &&
+-	    tb_msg[NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX])
+-		printf("\tAvailable Antennas: TX %#x RX %#x\n",
+-		       nla_get_u32(tb_msg[NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX]),
+-		       nla_get_u32(tb_msg[NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX]));
++	    tb_msg[NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX]) {
++		int i, tx_num, rx_num;
++		__u32 *avail_ants_tx, *avail_ants_rx;
++
++		tx_num = nla_len(tb_msg[NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX]) / sizeof(__u32);
++		rx_num = nla_len(tb_msg[NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX]) / sizeof(__u32);
++		if (tx_num == rx_num && tx_num == NUM_NL80211_BANDS) {
++			avail_ants_tx = nla_data(tb_msg[NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX]);
++			avail_ants_rx = nla_data(tb_msg[NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX]);
++			printf("\tAvailable Antennas:\n");
++			for (i = 0; i < tx_num; i++)
++				if (avail_ants_tx[i] && avail_ants_rx[i])
++					printf("\t\t%s band: TX %#x RX %#x\n",
++					       bands[i], avail_ants_tx[i],
++					       avail_ants_rx[i]);
++		}
++	}
+ 
+ 	if (tb_msg[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
+-	    tb_msg[NL80211_ATTR_WIPHY_ANTENNA_RX])
+-		printf("\tConfigured Antennas: TX %#x RX %#x\n",
+-		       nla_get_u32(tb_msg[NL80211_ATTR_WIPHY_ANTENNA_TX]),
+-		       nla_get_u32(tb_msg[NL80211_ATTR_WIPHY_ANTENNA_RX]));
++	    tb_msg[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
++		int i, tx_num, rx_num;
++		__u32 *ants_tx, *ants_rx;
++
++		tx_num = nla_len(tb_msg[NL80211_ATTR_WIPHY_ANTENNA_TX]) / sizeof(__u32);
++		rx_num = nla_len(tb_msg[NL80211_ATTR_WIPHY_ANTENNA_RX]) / sizeof(__u32);
++		if (tx_num == rx_num && tx_num == NUM_NL80211_BANDS) {
++			ants_tx = nla_data(tb_msg[NL80211_ATTR_WIPHY_ANTENNA_TX]);
++			ants_rx = nla_data(tb_msg[NL80211_ATTR_WIPHY_ANTENNA_RX]);
++			printf("\tConfigured Antennas:\n");
++			for (i = 0; i < tx_num; i++)
++				if (ants_tx[i] && ants_rx[i])
++					printf("\t\t%s band: TX %#x RX %#x\n",
++					       bands[i], ants_tx[i], ants_rx[i]);
++		}
++	}
+ 
+ 	if (tb_msg[NL80211_ATTR_SUPPORTED_IFTYPES])
+ 		print_iftype_list("\tSupported interface modes", "\t\t",
+diff --git a/phy.c b/phy.c
+index f9a5b0f..594fb25 100644
+--- a/phy.c
++++ b/phy.c
+@@ -752,34 +752,64 @@ static int handle_antenna(struct nl80211_state *state,
+ {
+ 	char *end;
+ 	uint32_t tx_ant = 0, rx_ant = 0;
++	uint32_t tx_ants[NUM_NL80211_BANDS], rx_ants[NUM_NL80211_BANDS];
++	int i = 0, bands = 0xffffffff;
++
++	if (!strncmp(argv[0], "-b", 2)) {
++		bands = 0;
++		for (i = 1; i < argc; i++) {
++			if (!strncasecmp("2ghz", argv[i], 4))
++				bands |= BIT(NL80211_BAND_2GHZ);
++			else if (!strncasecmp("5ghz", argv[i], 4))
++				bands |= BIT(NL80211_BAND_5GHZ);
++			else if (!strncasecmp("6ghz", argv[i], 4))
++				bands |= BIT(NL80211_BAND_6GHZ);
++			else
++				break;
++		}
++
++		if (i == 1) {
++			printf("Missing configured bands argument.\n");
++			return 2;
++		}
++	}
+ 
+-	if (argc == 1 && strcmp(argv[0], "all") == 0) {
++	if (argc == 1 + i && strncmp(argv[i], "all", 3) == 0) {
+ 		tx_ant = 0xffffffff;
+ 		rx_ant = 0xffffffff;
+-	} else if (argc == 1) {
+-		tx_ant = rx_ant = strtoul(argv[0], &end, 0);
++	} else if (argc == 1 + i) {
++		tx_ant = rx_ant = strtoul(argv[i], &end, 0);
+ 		if (*end)
+ 			return 1;
+-	}
+-	else if (argc == 2) {
+-		tx_ant = strtoul(argv[0], &end, 0);
++	} else if (argc == 2 + i) {
++		tx_ant = strtoul(argv[i], &end, 0);
+ 		if (*end)
+ 			return 1;
+-		rx_ant = strtoul(argv[1], &end, 0);
++		rx_ant = strtoul(argv[i + 1], &end, 0);
+ 		if (*end)
+ 			return 1;
+ 	} else
+ 		return 1;
+ 
+-	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
+-	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
++	memset(tx_ants, 0, sizeof(tx_ants));
++	memset(rx_ants, 0, sizeof(rx_ants));
++	for (i = 0; i < NUM_NL80211_BANDS; i++) {
++		if (!(bands & BIT(i)))
++			continue;
++
++		tx_ants[i] = tx_ant;
++		rx_ants[i] = rx_ant;
++	}
++
++	NLA_PUT(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, sizeof(tx_ants), tx_ants);
++	NLA_PUT(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, sizeof(rx_ants), rx_ants);
+ 
+ 	return 0;
+ 
+  nla_put_failure:
+ 	return -ENOBUFS;
+ }
+-COMMAND(set, antenna, "<bitmap> | all | <tx bitmap> <rx bitmap>",
++COMMAND(set, antenna, "[-b [2GHz] [5GHz] [6GHz]] <bitmap> | all | <tx bitmap> <rx bitmap>",
+ 	NL80211_CMD_SET_WIPHY, 0, CIB_PHY, handle_antenna,
+ 	"Set a bitmap of allowed antennas to use for TX and RX.\n"
+ 	"The driver may reject antenna configurations it cannot support.");
+-- 
+2.18.0
+
diff --git a/recipes-wifi/iw/patches-mlo/0010-link-fix-some-formatting.patch b/recipes-wifi/iw/patches-mlo/0010-link-fix-some-formatting.patch
deleted file mode 100644
index db9f35a..0000000
--- a/recipes-wifi/iw/patches-mlo/0010-link-fix-some-formatting.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 5f64b702482d5818b8573d12ef1b58af00bbd81d Mon Sep 17 00:00:00 2001
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Wed, 31 Aug 2022 21:13:11 +0200
-Subject: [PATCH 10/28] link: fix some formatting
-
-The bss flags has a spurious newline, and we don't use a
-tab for indentation after the colon in other places, fix
-that here.
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- link.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/link.c b/link.c
-index 2074488..31de8b4 100644
---- a/link.c
-+++ b/link.c
-@@ -181,7 +181,7 @@ static int print_link_sta(struct nl_msg *msg, void *arg)
- 			fprintf(stderr, "failed to parse nested bss parameters!\n");
- 		} else {
- 			char *delim = "";
--			printf("\n\tbss flags:\t");
-+			printf("\tbss flags: ");
- 			if (binfo[NL80211_STA_BSS_PARAM_CTS_PROT]) {
- 				printf("CTS-protection");
- 				delim = " ";
-@@ -192,9 +192,9 @@ static int print_link_sta(struct nl_msg *msg, void *arg)
- 			}
- 			if (binfo[NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME])
- 				printf("%sshort-slot-time", delim);
--			printf("\n\tdtim period:\t%d",
-+			printf("\n\tdtim period: %d",
- 			       nla_get_u8(binfo[NL80211_STA_BSS_PARAM_DTIM_PERIOD]));
--			printf("\n\tbeacon int:\t%d",
-+			printf("\n\tbeacon int: %d",
- 			       nla_get_u16(binfo[NL80211_STA_BSS_PARAM_BEACON_INTERVAL]));
- 			printf("\n");
- 		}
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0011-link-update-for-MLO.patch b/recipes-wifi/iw/patches-mlo/0011-link-update-for-MLO.patch
deleted file mode 100644
index 94cce68..0000000
--- a/recipes-wifi/iw/patches-mlo/0011-link-update-for-MLO.patch
+++ /dev/null
@@ -1,172 +0,0 @@
-From 221875eb77f21d8cf1c50f046705f30708ec82bd Mon Sep 17 00:00:00 2001
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Wed, 31 Aug 2022 22:35:02 +0200
-Subject: [PATCH 11/28] link: update for MLO
-
-In MLO we need to use the MLD address to get the station
-statistics (which still need work for per-link stats),
-adjust the code.
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- iw.h   |  2 ++
- link.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++-----------
- scan.c |  3 ++-
- 3 files changed, 55 insertions(+), 12 deletions(-)
-
-diff --git a/iw.h b/iw.h
-index e712c59..45e4fbe 100644
---- a/iw.h
-+++ b/iw.h
-@@ -242,6 +242,8 @@ const char *get_status_str(uint16_t status);
- enum print_ie_type {
- 	PRINT_SCAN,
- 	PRINT_LINK,
-+	PRINT_LINK_MLO_MLD,
-+	PRINT_LINK_MLO_LINK,
- };
- 
- #define BIT(x) (1ULL<<(x))
-diff --git a/link.c b/link.c
-index 31de8b4..a090100 100644
---- a/link.c
-+++ b/link.c
-@@ -13,9 +13,10 @@
- #include "iw.h"
- 
- struct link_result {
--	uint8_t bssid[8];
-+	uint8_t sta_addr[8];
- 	bool link_found;
- 	bool anything_found;
-+	bool mld;
- };
- 
- static struct link_result lr = { .link_found = false };
-@@ -37,7 +38,9 @@ static int link_bss_handler(struct nl_msg *msg, void *arg)
- 		[NL80211_BSS_STATUS] = { .type = NLA_U32 },
- 	};
- 	struct link_result *result = arg;
--	char mac_addr[20], dev[20];
-+	char mac_addr[20], dev[20], link_addr[20];
-+	int link_id = -1;
-+	const char *indent = "\t";
- 
- 	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
- 		  genlmsg_attrlen(gnlh, 0), NULL);
-@@ -62,9 +65,44 @@ static int link_bss_handler(struct nl_msg *msg, void *arg)
- 	mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_BSSID]));
- 	if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev);
- 
-+	if (bss[NL80211_BSS_MLO_LINK_ID])
-+		link_id = nla_get_u8(bss[NL80211_BSS_MLO_LINK_ID]);
-+
-+	if (bss[NL80211_BSS_MLD_ADDR]) {
-+		mac_addr_n2a(link_addr, nla_data(bss[NL80211_BSS_BSSID]));
-+		indent = "\t\t";
-+
-+		if (result->mld) {
-+			if (memcmp(result->sta_addr,
-+				   nla_data(bss[NL80211_BSS_MLD_ADDR]), 6)) {
-+				mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_MLD_ADDR]));
-+				printf("!! inconsistent MLD address information (%s)\n",
-+				       mac_addr);
-+			}
-+		} else {
-+			mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_MLD_ADDR]));
-+			result->mld = true;
-+			memcpy(result->sta_addr,
-+			       nla_data(bss[NL80211_BSS_MLD_ADDR]), 6);
-+			if (nla_get_u32(bss[NL80211_BSS_STATUS]) == NL80211_BSS_STATUS_ASSOCIATED) {
-+				printf("Connected to %s (on %s)\n", mac_addr, dev);
-+			}
-+
-+			if (bss[NL80211_BSS_INFORMATION_ELEMENTS])
-+				print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
-+					  nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
-+					  false, PRINT_LINK_MLO_MLD);
-+		}
-+	} else {
-+		memcpy(result->sta_addr, nla_data(bss[NL80211_BSS_BSSID]), 6);
-+	}
-+
- 	switch (nla_get_u32(bss[NL80211_BSS_STATUS])) {
- 	case NL80211_BSS_STATUS_ASSOCIATED:
--		printf("Connected to %s (on %s)\n", mac_addr, dev);
-+		if (result->mld)
-+			printf("\tLink %d BSSID %s\n", link_id, link_addr);
-+		else
-+			printf("Connected to %s (on %s)\n", mac_addr, dev);
- 		break;
- 	case NL80211_BSS_STATUS_AUTHENTICATED:
- 		printf("Authenticated with %s (on %s)\n", mac_addr, dev);
-@@ -81,10 +119,10 @@ static int link_bss_handler(struct nl_msg *msg, void *arg)
- 	if (bss[NL80211_BSS_INFORMATION_ELEMENTS])
- 		print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
- 			  nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
--			  false, PRINT_LINK);
-+			  false, result->mld ? PRINT_LINK_MLO_LINK : PRINT_LINK);
- 
- 	if (bss[NL80211_BSS_FREQUENCY])
--		printf("\tfreq: %d\n",
-+		printf("%sfreq: %d\n", indent,
- 			nla_get_u32(bss[NL80211_BSS_FREQUENCY]));
- 
- 	if (nla_get_u32(bss[NL80211_BSS_STATUS]) != NL80211_BSS_STATUS_ASSOCIATED)
-@@ -92,7 +130,6 @@ static int link_bss_handler(struct nl_msg *msg, void *arg)
- 
- 	/* only in the assoc case do we want more info from station get */
- 	result->link_found = true;
--	memcpy(result->bssid, nla_data(bss[NL80211_BSS_BSSID]), 6);
- 	return NL_SKIP;
- }
- 
-@@ -250,7 +287,7 @@ static int handle_link(struct nl80211_state *state,
- 		NULL,
- 		NULL,
- 	};
--	char bssid_buf[3*6];
-+	char addr_buf[3*6];
- 	int err;
- 
- 	link_argv[0] = argv[0];
-@@ -264,15 +301,18 @@ static int handle_link(struct nl80211_state *state,
- 		return 0;
- 	}
- 
--	mac_addr_n2a(bssid_buf, lr.bssid);
--	bssid_buf[17] = '\0';
-+	mac_addr_n2a(addr_buf, lr.sta_addr);
-+	addr_buf[17] = '\0';
-+
-+	if (lr.mld)
-+		printf("MLD %s stats:\n", addr_buf);
- 
- 	station_argv[0] = argv[0];
--	station_argv[3] = bssid_buf;
-+	station_argv[3] = addr_buf;
- 	return handle_cmd(state, id, 4, station_argv);
- }
- TOPLEVEL(link, NULL, 0, 0, CIB_NETDEV, handle_link,
--	 "Print information about the current link, if any.");
-+	 "Print information about the current connection, if any.");
- HIDDEN(link, get_sta, "<mac-addr>", NL80211_CMD_GET_STATION, 0,
- 	CIB_NETDEV, handle_link_sta);
- HIDDEN(link, get_bss, NULL, NL80211_CMD_GET_SCAN, NLM_F_DUMP,
-diff --git a/scan.c b/scan.c
-index 4c67c87..dc26787 100644
---- a/scan.c
-+++ b/scan.c
-@@ -1717,7 +1717,8 @@ static void print_ie(const struct ie_print *p, const uint8_t type, uint8_t len,
- }
- 
- static const struct ie_print ieprinters[] = {
--	[0] = { "SSID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
-+	[0] = { "SSID", print_ssid, 0, 32,
-+		 BIT(PRINT_SCAN) | BIT(PRINT_LINK) | BIT(PRINT_LINK_MLO_MLD), },
- 	[1] = { "Supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
- 	[3] = { "DS Parameter set", print_ds, 1, 1, BIT(PRINT_SCAN), },
- 	[5] = { "TIM", print_tim, 4, 255, BIT(PRINT_SCAN), },
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0012-interface-print-links.patch b/recipes-wifi/iw/patches-mlo/0012-interface-print-links.patch
deleted file mode 100644
index 9e6c1a4..0000000
--- a/recipes-wifi/iw/patches-mlo/0012-interface-print-links.patch
+++ /dev/null
@@ -1,114 +0,0 @@
-From 7794573f915174b5dd2cd22e123ecd63610ccf44 Mon Sep 17 00:00:00 2001
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Fri, 2 Sep 2022 21:59:31 +0200
-Subject: [PATCH 12/28] interface: print links
-
-Print link information in 'iw dev' and 'iw ... info'.
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- interface.c | 74 ++++++++++++++++++++++++++++++++++++++---------------
- 1 file changed, 53 insertions(+), 21 deletions(-)
-
-diff --git a/interface.c b/interface.c
-index 84990c9..7e1dd58 100644
---- a/interface.c
-+++ b/interface.c
-@@ -369,6 +369,30 @@ char *channel_width_name(enum nl80211_chan_width width)
- 	}
- }
- 
-+static void print_channel(struct nlattr **tb)
-+{
-+	uint32_t freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
-+
-+	printf("channel %d (%d MHz)",
-+	       ieee80211_frequency_to_channel(freq), freq);
-+
-+	if (tb[NL80211_ATTR_CHANNEL_WIDTH]) {
-+		printf(", width: %s",
-+			channel_width_name(nla_get_u32(tb[NL80211_ATTR_CHANNEL_WIDTH])));
-+		if (tb[NL80211_ATTR_CENTER_FREQ1])
-+			printf(", center1: %d MHz",
-+				nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]));
-+		if (tb[NL80211_ATTR_CENTER_FREQ2])
-+			printf(", center2: %d MHz",
-+				nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]));
-+	} else if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
-+		enum nl80211_channel_type channel_type;
-+
-+		channel_type = nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
-+		printf(" %s", channel_type_name(channel_type));
-+	}
-+}
-+
- static int print_iface_handler(struct nl_msg *msg, void *arg)
- {
- 	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
-@@ -412,27 +436,8 @@ static int print_iface_handler(struct nl_msg *msg, void *arg)
- 	if (!wiphy && tb_msg[NL80211_ATTR_WIPHY])
- 		printf("%s\twiphy %d\n", indent, nla_get_u32(tb_msg[NL80211_ATTR_WIPHY]));
- 	if (tb_msg[NL80211_ATTR_WIPHY_FREQ]) {
--		uint32_t freq = nla_get_u32(tb_msg[NL80211_ATTR_WIPHY_FREQ]);
--
--		printf("%s\tchannel %d (%d MHz)", indent,
--		       ieee80211_frequency_to_channel(freq), freq);
--
--		if (tb_msg[NL80211_ATTR_CHANNEL_WIDTH]) {
--			printf(", width: %s",
--				channel_width_name(nla_get_u32(tb_msg[NL80211_ATTR_CHANNEL_WIDTH])));
--			if (tb_msg[NL80211_ATTR_CENTER_FREQ1])
--				printf(", center1: %d MHz",
--					nla_get_u32(tb_msg[NL80211_ATTR_CENTER_FREQ1]));
--			if (tb_msg[NL80211_ATTR_CENTER_FREQ2])
--				printf(", center2: %d MHz",
--					nla_get_u32(tb_msg[NL80211_ATTR_CENTER_FREQ2]));
--		} else if (tb_msg[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
--			enum nl80211_channel_type channel_type;
--
--			channel_type = nla_get_u32(tb_msg[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
--			printf(" %s", channel_type_name(channel_type));
--		}
--
-+		printf("%s\t", indent);
-+		print_channel(tb_msg);
- 		printf("\n");
- 	}
- 
-@@ -455,6 +460,33 @@ static int print_iface_handler(struct nl_msg *msg, void *arg)
- 			printf("%s\t4addr: on\n", indent);
- 	}
- 
-+	if (tb_msg[NL80211_ATTR_MLO_LINKS]) {
-+		struct nlattr *link;
-+		int n;
-+
-+		printf("%s\tMLD with links:\n", indent);
-+
-+		nla_for_each_nested(link, tb_msg[NL80211_ATTR_MLO_LINKS], n) {
-+			struct nlattr *tb[NL80211_ATTR_MAX + 1];
-+
-+			nla_parse_nested(tb, NL80211_ATTR_MAX, link, NULL);
-+			printf("%s\t - link", indent);
-+			if (tb[NL80211_ATTR_MLO_LINK_ID])
-+				printf(" ID %2d", nla_get_u32(tb[NL80211_ATTR_MLO_LINK_ID]));
-+			if (tb[NL80211_ATTR_MAC]) {
-+				char buf[20];
-+
-+				mac_addr_n2a(buf, nla_data(tb[NL80211_ATTR_MAC]));
-+				printf(" link addr %s", buf);
-+			}
-+			if (tb[NL80211_ATTR_WIPHY_FREQ]) {
-+				printf("\n%s\t   ", indent);
-+				print_channel(tb);
-+			}
-+			printf("\n");
-+		}
-+	}
-+
- 	return NL_SKIP;
- }
- 
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0013-util-don-t-print-EHT-info-if-not-present.patch b/recipes-wifi/iw/patches-mlo/0013-util-don-t-print-EHT-info-if-not-present.patch
deleted file mode 100644
index 105e927..0000000
--- a/recipes-wifi/iw/patches-mlo/0013-util-don-t-print-EHT-info-if-not-present.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From f5e3b43de3a5e3e6332106282bbcaf336e8204a5 Mon Sep 17 00:00:00 2001
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Wed, 15 Mar 2023 16:08:22 +0100
-Subject: [PATCH 13/28] util: don't print EHT info if not present
-
-That's just confusing, don't print it if the EHT MAC
-capabilities attribute isn't there (the kernel puts
-all the attrs together.)
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- util.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/util.c b/util.c
-index 80dc301..50e3fbc 100644
---- a/util.c
-+++ b/util.c
-@@ -1593,7 +1593,8 @@ void print_eht_info(struct nlattr *nl_iftype, int band)
- 	nla_parse(tb, NL80211_BAND_IFTYPE_ATTR_MAX,
- 		  nla_data(nl_iftype), nla_len(nl_iftype), NULL);
- 
--	if (!tb[NL80211_BAND_IFTYPE_ATTR_IFTYPES])
-+	if (!tb[NL80211_BAND_IFTYPE_ATTR_IFTYPES] ||
-+	    !tb[NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC])
- 		return;
- 
- 	printf("\t\tEHT Iftypes: ");
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0014-iw-S1G-add-frequency-set-in-kHz-and-offset-options.patch b/recipes-wifi/iw/patches-mlo/0014-iw-S1G-add-frequency-set-in-kHz-and-offset-options.patch
deleted file mode 100644
index 316d754..0000000
--- a/recipes-wifi/iw/patches-mlo/0014-iw-S1G-add-frequency-set-in-kHz-and-offset-options.patch
+++ /dev/null
@@ -1,361 +0,0 @@
-From a32046bcffcb766b4999e76399b755887d2d5d0b Mon Sep 17 00:00:00 2001
-From: Gilad Itzkovitch <gilad.itzkovitch@morsemicro.com>
-Date: Mon, 27 Feb 2023 15:05:29 +1300
-Subject: [PATCH 14/28] iw: S1G: add frequency set in kHz and offset options
-
-This change adds support to specify the set frequency in kHz for
-the set frequency command which include an offset whenever needed.
-Also, it adds S1G bandwidth options to the selected chandef.
-
-Signed-off-by: Gilad Itzkovitch <gilad.itzkovitch@morsemicro.com>
-Link: https://lore.kernel.org/r/20230227020529.504934-1-gilad.itzkovitch@virscient.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- ap.c        |  2 +-
- ibss.c      |  2 +-
- interface.c |  2 +-
- iw.h        |  5 +++-
- mesh.c      |  2 +-
- ocb.c       |  2 +-
- phy.c       | 37 ++++++++++++++++++++++-----
- util.c      | 72 ++++++++++++++++++++++++++++++++++++++++++++++++-----
- 8 files changed, 106 insertions(+), 18 deletions(-)
-
-diff --git a/ap.c b/ap.c
-index db9efb7..748576d 100644
---- a/ap.c
-+++ b/ap.c
-@@ -28,7 +28,7 @@ static int handle_start_ap(struct nl80211_state *state,
- 	argc--;
- 
- 	/* chandef */
--	res = parse_freqchan(&chandef, false, argc, argv, &parsed);
-+	res = parse_freqchan(&chandef, false, argc, argv, &parsed, false);
- 	if (res)
- 		return res;
- 	argc -= parsed;
-diff --git a/ibss.c b/ibss.c
-index f6cbc4c..6e6a835 100644
---- a/ibss.c
-+++ b/ibss.c
-@@ -30,7 +30,7 @@ static int join_ibss(struct nl80211_state *state,
- 	argv++;
- 	argc--;
- 
--	err = parse_freqchan(&chandef, false, argc, argv, &parsed);
-+	err = parse_freqchan(&chandef, false, argc, argv, &parsed, false);
- 	if (err)
- 		return err;
- 
-diff --git a/interface.c b/interface.c
-index 7e1dd58..eeef496 100644
---- a/interface.c
-+++ b/interface.c
-@@ -701,7 +701,7 @@ static int handle_chanfreq(struct nl80211_state *state, struct nl_msg *msg,
- 	int parsed;
- 	char *end;
- 
--	res = parse_freqchan(&chandef, chan, argc, argv, &parsed);
-+	res = parse_freqchan(&chandef, chan, argc, argv, &parsed, false);
- 	if (res)
- 		return res;
- 
-diff --git a/iw.h b/iw.h
-index 45e4fbe..19c76cf 100644
---- a/iw.h
-+++ b/iw.h
-@@ -102,7 +102,9 @@ struct chandef {
- 	enum nl80211_chan_width width;
- 
- 	unsigned int control_freq;
-+	unsigned int control_freq_offset;
- 	unsigned int center_freq1;
-+	unsigned int center_freq1_offset;
- 	unsigned int center_freq2;
- };
- 
-@@ -207,7 +209,8 @@ int parse_hex_mask(char *hexmask, unsigned char **result, size_t *result_len,
- unsigned char *parse_hex(char *hex, size_t *outlen);
- 
- int parse_keys(struct nl_msg *msg, char **argv[], int *argc);
--int parse_freqchan(struct chandef *chandef, bool chan, int argc, char **argv, int *parsed);
-+int parse_freqchan(struct chandef *chandef, bool chan, int argc, char **argv,
-+		    int *parsed, bool freq_in_khz);
- enum nl80211_chan_width str_to_bw(const char *str);
- int parse_txq_stats(char *buf, int buflen, struct nlattr *tid_stats_attr, int header,
- 		    int tid, const char *indent);
-diff --git a/mesh.c b/mesh.c
-index 0fb98a3..40e5e5e 100644
---- a/mesh.c
-+++ b/mesh.c
-@@ -485,7 +485,7 @@ static int join_mesh(struct nl80211_state *state,
- 		int err, parsed;
- 
- 		err = parse_freqchan(&chandef, false, argc - 1, argv + 1,
--				     &parsed);
-+				     &parsed, false);
- 		if (err)
- 			return err;
- 
-diff --git a/ocb.c b/ocb.c
-index fc9579b..ee0eedf 100644
---- a/ocb.c
-+++ b/ocb.c
-@@ -16,7 +16,7 @@ static int join_ocb(struct nl80211_state *state,
- 	if (argc < 2)
- 		return 1;
- 
--	err = parse_freqchan(&chandef, false, argc, argv, &parsed);
-+	err = parse_freqchan(&chandef, false, argc, argv, &parsed, false);
- 
- 	if (err)
- 		return err;
-diff --git a/phy.c b/phy.c
-index 15cea32..4722125 100644
---- a/phy.c
-+++ b/phy.c
-@@ -191,7 +191,7 @@ static int handle_freq(struct nl80211_state *state, struct nl_msg *msg,
- 	struct chandef chandef;
- 	int res;
- 
--	res = parse_freqchan(&chandef, false, argc, argv, NULL);
-+	res = parse_freqchan(&chandef, false, argc, argv, NULL, false);
- 	if (res)
- 		return res;
- 
-@@ -209,6 +209,31 @@ COMMAND(set, freq,
- 	"<control freq> [5|10|20|40|80|80+80|160] [<center1_freq> [<center2_freq>]]",
- 	NL80211_CMD_SET_WIPHY, 0, CIB_NETDEV, handle_freq, NULL);
- 
-+static int handle_freq_khz(struct nl80211_state *state, struct nl_msg *msg,
-+		       int argc, char **argv,
-+		       enum id_input id)
-+{
-+	struct chandef chandef;
-+	int res;
-+
-+	res = parse_freqchan(&chandef, false, argc, argv, NULL, true);
-+	if (res)
-+		return res;
-+
-+	return put_chandef(msg, &chandef);
-+}
-+
-+COMMAND(set, freq_khz,
-+	"<freq> [1MHz|2MHz|4MHz|8MHz|16MHz]\n"
-+	"<control freq> [1|2|4|8|16] [<center1_freq> [<center2_freq>]]",
-+	NL80211_CMD_SET_WIPHY, 0, CIB_PHY, handle_freq_khz,
-+	"Set frequency in kHz the hardware is using\n"
-+	"configuration.");
-+COMMAND(set, freq_khz,
-+	"<freq> [1MHz|2MHz|4MHz|8MHz|16MHz]\n"
-+	"<control freq> [1|2|4|8|16] [<center1_freq> [<center2_freq>]]",
-+	NL80211_CMD_SET_WIPHY, 0, CIB_NETDEV, handle_freq_khz, NULL);
-+
- static int handle_chan(struct nl80211_state *state, struct nl_msg *msg,
- 		       int argc, char **argv,
- 		       enum id_input id)
-@@ -216,7 +241,7 @@ static int handle_chan(struct nl80211_state *state, struct nl_msg *msg,
- 	struct chandef chandef;
- 	int res;
- 
--	res = parse_freqchan(&chandef, true, argc, argv, NULL);
-+	res = parse_freqchan(&chandef, true, argc, argv, NULL, false);
- 	if (res)
- 		return res;
- 
-@@ -288,9 +313,9 @@ static int handle_cac_trigger(struct nl80211_state *state,
- 		return 1;
- 
- 	if (strcmp(argv[0], "channel") == 0) {
--		res = parse_freqchan(&chandef, true, argc - 1, argv + 1, NULL);
-+		res = parse_freqchan(&chandef, true, argc - 1, argv + 1, NULL, false);
- 	} else if (strcmp(argv[0], "freq") == 0) {
--		res = parse_freqchan(&chandef, false, argc - 1, argv + 1, NULL);
-+		res = parse_freqchan(&chandef, false, argc - 1, argv + 1, NULL, false);
- 	} else {
- 		return 1;
- 	}
-@@ -334,9 +359,9 @@ static int handle_cac(struct nl80211_state *state,
- 		return 1;
- 
- 	if (strcmp(argv[2], "channel") == 0) {
--		err = parse_freqchan(&chandef, true, argc - 3, argv + 3, NULL);
-+		err = parse_freqchan(&chandef, true, argc - 3, argv + 3, NULL, false);
- 	} else if (strcmp(argv[2], "freq") == 0) {
--		err = parse_freqchan(&chandef, false, argc - 3, argv + 3, NULL);
-+		err = parse_freqchan(&chandef, false, argc - 3, argv + 3, NULL, false);
- 	} else {
- 		err = 1;
- 	}
-diff --git a/util.c b/util.c
-index 50e3fbc..eef0332 100644
---- a/util.c
-+++ b/util.c
-@@ -484,7 +484,7 @@ enum nl80211_chan_width str_to_bw(const char *str)
- }
- 
- static int parse_freqs(struct chandef *chandef, int argc, char **argv,
--		       int *parsed)
-+		       int *parsed, bool freq_in_khz)
- {
- 	uint32_t freq;
- 	char *end;
-@@ -537,7 +537,13 @@ static int parse_freqs(struct chandef *chandef, int argc, char **argv,
- 		return 1;
- 	*parsed += 1;
- 
--	chandef->center_freq1 = freq;
-+	if (freq_in_khz) {
-+		chandef->center_freq1 = freq / 1000;
-+		chandef->center_freq1_offset = freq % 1000;
-+	} else {
-+		chandef->center_freq1 = freq;
-+		chandef->center_freq1_offset = 0;
-+	}
- 
- 	if (!need_cf2)
- 		return 0;
-@@ -551,7 +557,11 @@ static int parse_freqs(struct chandef *chandef, int argc, char **argv,
- 	freq = strtoul(argv[2], &end, 10);
- 	if (*end)
- 		return 1;
--	chandef->center_freq2 = freq;
-+
-+	if (freq_in_khz)
-+		chandef->center_freq2 = freq / 1000;
-+	else
-+		chandef->center_freq2 = freq;
- 
- 	*parsed += 1;
- 
-@@ -568,6 +578,7 @@ static int parse_freqs(struct chandef *chandef, int argc, char **argv,
-  * @argv: Array of string arguments
-  * @parsed: Pointer to return the number of used arguments, or NULL to error
-  *          out if any argument is left unused.
-+ * @freq_in_khz: Boolean whether to parse the frequency in kHz or default as MHz
-  *
-  * The given chandef structure will be filled in from the command line
-  * arguments. argc/argv will be updated so that further arguments from the
-@@ -591,7 +602,7 @@ static int parse_freqs(struct chandef *chandef, int argc, char **argv,
-  * Return: Number of used arguments, zero or negative error number otherwise
-  */
- int parse_freqchan(struct chandef *chandef, bool chan, int argc, char **argv,
--		   int *parsed)
-+		   int *parsed, bool freq_in_khz)
- {
- 	char *end;
- 	static const struct chanmode chanmode[] = {
-@@ -631,9 +642,30 @@ int parse_freqchan(struct chandef *chandef, bool chan, int argc, char **argv,
- 		  .width = NL80211_CHAN_WIDTH_320,
- 		  .freq1_diff = 0,
- 		  .chantype = -1 },
-+		{ .name = "1MHz",
-+		  .width = NL80211_CHAN_WIDTH_1,
-+		  .freq1_diff = 0,
-+		  .chantype = -1 },
-+		{ .name = "2MHz",
-+		  .width = NL80211_CHAN_WIDTH_2,
-+		  .freq1_diff = 0,
-+		  .chantype = -1 },
-+		{ .name = "4MHz",
-+		  .width = NL80211_CHAN_WIDTH_4,
-+		  .freq1_diff = 0,
-+		  .chantype = -1 },
-+		{ .name = "8MHz",
-+		  .width = NL80211_CHAN_WIDTH_8,
-+		  .freq1_diff = 0,
-+		  .chantype = -1 },
-+		{ .name = "16MHz",
-+		  .width = NL80211_CHAN_WIDTH_16,
-+		  .freq1_diff = 0,
-+		  .chantype = -1 },
-+
- 	};
- 	const struct chanmode *chanmode_selected = NULL;
--	unsigned int freq;
-+	unsigned int freq, freq_offset = 0;
- 	unsigned int i;
- 	int _parsed = 0;
- 	int res = 0;
-@@ -643,7 +675,14 @@ int parse_freqchan(struct chandef *chandef, bool chan, int argc, char **argv,
- 
- 	if (!argv[0])
- 		goto out;
-+
- 	freq = strtoul(argv[0], &end, 10);
-+
-+	if (freq_in_khz) {
-+		freq_offset = freq % 1000;
-+		freq = freq / 1000;
-+	}
-+
- 	if (*end) {
- 		res = 1;
- 		goto out;
-@@ -660,8 +699,10 @@ int parse_freqchan(struct chandef *chandef, bool chan, int argc, char **argv,
- 		freq = ieee80211_channel_to_frequency(freq, band);
- 	}
- 	chandef->control_freq = freq;
-+	chandef->control_freq_offset = freq_offset;
- 	/* Assume 20MHz NOHT channel for now. */
- 	chandef->center_freq1 = freq;
-+	chandef->center_freq1_offset = freq_offset;
- 
- 	/* Try to parse HT mode definitions */
- 	if (argc > 1) {
-@@ -674,9 +715,20 @@ int parse_freqchan(struct chandef *chandef, bool chan, int argc, char **argv,
- 		}
- 	}
- 
-+	/* Set channel width's default value */
-+	if (chandef->control_freq < 1000)
-+		chandef->width = NL80211_CHAN_WIDTH_16;
-+	else
-+		chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
-+
- 	/* channel mode given, use it and return. */
- 	if (chanmode_selected) {
- 		chandef->center_freq1 = get_cf1(chanmode_selected, freq);
-+
-+		/* For non-S1G frequency */
-+		if (chandef->center_freq1 > 1000)
-+			chandef->center_freq1_offset = 0;
-+
- 		chandef->width = chanmode_selected->width;
- 		goto out;
- 	}
-@@ -685,7 +737,7 @@ int parse_freqchan(struct chandef *chandef, bool chan, int argc, char **argv,
- 	if (chan)
- 		goto out;
- 
--	res = parse_freqs(chandef, argc - 1, argv + 1, &_parsed);
-+	res = parse_freqs(chandef, argc - 1, argv + 1, &_parsed, freq_in_khz);
- 
-  out:
- 	/* Error out if parsed is NULL. */
-@@ -701,6 +753,9 @@ int parse_freqchan(struct chandef *chandef, bool chan, int argc, char **argv,
- int put_chandef(struct nl_msg *msg, struct chandef *chandef)
- {
- 	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chandef->control_freq);
-+	NLA_PUT_U32(msg,
-+		    NL80211_ATTR_WIPHY_FREQ_OFFSET,
-+		    chandef->control_freq_offset);
- 	NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width);
- 
- 	switch (chandef->width) {
-@@ -733,6 +788,11 @@ int put_chandef(struct nl_msg *msg, struct chandef *chandef)
- 			    NL80211_ATTR_CENTER_FREQ1,
- 			    chandef->center_freq1);
- 
-+	if (chandef->center_freq1_offset)
-+		NLA_PUT_U32(msg,
-+			    NL80211_ATTR_CENTER_FREQ1_OFFSET,
-+			    chandef->center_freq1_offset);
-+
- 	if (chandef->center_freq2)
- 		NLA_PUT_U32(msg,
- 			    NL80211_ATTR_CENTER_FREQ2,
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0015-iw-S1G-add-parsing-for-802.11ah-scan-IE-s.patch b/recipes-wifi/iw/patches-mlo/0015-iw-S1G-add-parsing-for-802.11ah-scan-IE-s.patch
deleted file mode 100644
index 79d8135..0000000
--- a/recipes-wifi/iw/patches-mlo/0015-iw-S1G-add-parsing-for-802.11ah-scan-IE-s.patch
+++ /dev/null
@@ -1,425 +0,0 @@
-From 1bc6ab0abbb6f26f35d826d166d06bc28ae47b6b Mon Sep 17 00:00:00 2001
-From: Gilad Itzkovitch <gilad.itzkovitch@morsemicro.com>
-Date: Tue, 28 Feb 2023 12:01:27 +1300
-Subject: [PATCH 15/28] iw: S1G: add parsing for 802.11ah scan IE's
-
-In order to support scan display for 802.11ah, this change adds
-parsing for S1G capabilities, operation, and short beacon interval
-information elements.
-
-Signed-off-by: Gilad Itzkovitch <gilad.itzkovitch@morsemicro.com>
-Link: https://lore.kernel.org/r/20230227230127.709496-1-gilad.itzkovitch@virscient.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- iw.h   |   5 ++
- scan.c | 109 ++++++++++++++++++++++++++++-
- util.c | 218 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- 3 files changed, 330 insertions(+), 2 deletions(-)
-
-diff --git a/iw.h b/iw.h
-index 19c76cf..7e9107e 100644
---- a/iw.h
-+++ b/iw.h
-@@ -224,6 +224,7 @@ void print_vht_info(__u32 capa, const __u8 *mcs);
- void print_he_capability(const uint8_t *ie, int len);
- void print_he_info(struct nlattr *nl_iftype);
- void print_eht_info(struct nlattr *nl_iftype, int band);
-+void print_s1g_capability(const uint8_t *caps);
- 
- char *channel_width_name(enum nl80211_chan_width width);
- const char *iftype_name(enum nl80211_iftype iftype);
-@@ -261,6 +262,9 @@ int get_cf1(const struct chanmode *chanmode, unsigned long freq);
- 
- int parse_random_mac_addr(struct nl_msg *msg, char *addrs);
- 
-+char *s1g_ss_max_support(__u8 maxss);
-+char *s1g_ss_min_support(__u8 minss);
-+
- #define SCHED_SCAN_OPTIONS "[interval <in_msecs> | scan_plans [<interval_secs:iterations>*] <interval_secs>] "	\
- 	"[delay <in_secs>] [freqs <freq>+] [matches [ssid <ssid>]+]] [active [ssid <ssid>]+|passive] "	\
- 	"[randomise[=<addr>/<mask>]] [coloc] [flush]"
-@@ -274,6 +278,7 @@ char *hex2bin(const char *hex, char *buf);
- int set_bitrates(struct nl_msg *msg, int argc, char **argv,
- 		 enum nl80211_attrs attr);
- 
-+int calc_s1g_ch_center_freq(__u8 ch_index, __u8 s1g_oper_class);
- 
- /* sections */
- DECLARE_SECTION(ap);
-diff --git a/scan.c b/scan.c
-index dc26787..7479220 100644
---- a/scan.c
-+++ b/scan.c
-@@ -1675,6 +1675,101 @@ static void print_mesh_conf(const uint8_t type, uint8_t len,
- 		printf("\t\t\t Mesh Power Save Level\n");
- }
- 
-+static void print_s1g_capa(const uint8_t type, uint8_t len,
-+			    const uint8_t *data,
-+			    const struct print_ies_data *ie_buffer)
-+{
-+	printf("\n");
-+	print_s1g_capability(data);
-+}
-+
-+static void print_short_beacon_int(const uint8_t type, uint8_t len,
-+			    const uint8_t *data,
-+			    const struct print_ies_data *ie_buffer)
-+{
-+	printf(" %d\n", (data[1] << 8) | data[0]);
-+}
-+
-+static void print_s1g_oper(const uint8_t type, uint8_t len,
-+			    const uint8_t *data,
-+			    const struct print_ies_data *ie_buffer)
-+{
-+	int oper_ch_width, prim_ch_width;
-+	int prim_ch_width_subfield = data[0] & 0x1;
-+
-+	prim_ch_width = 2;
-+
-+	/* B1-B4 BSS channel width subfield */
-+	switch ((data[0] >> 1) & 0xf) {
-+	case 0:
-+		oper_ch_width = 1;
-+		prim_ch_width = 1;
-+		if (!prim_ch_width_subfield) {
-+			oper_ch_width = -1;
-+			prim_ch_width = -1;
-+		}
-+	break;
-+	case 1:
-+		oper_ch_width = 2;
-+		if (prim_ch_width_subfield)
-+			prim_ch_width = 1;
-+		break;
-+	case 3:
-+		oper_ch_width = 4;
-+		if (prim_ch_width_subfield)
-+			prim_ch_width = 1;
-+		break;
-+	case 7:
-+		oper_ch_width = 8;
-+		if (prim_ch_width_subfield)
-+			prim_ch_width = 1;
-+		break;
-+	case 15:
-+		oper_ch_width = 16;
-+		if (prim_ch_width_subfield)
-+			prim_ch_width = 1;
-+		break;
-+	default:
-+		oper_ch_width = -1;
-+		prim_ch_width = -1;
-+		break;
-+	}
-+
-+	printf("\n");
-+	printf("\t\tChannel width:\n");
-+	if (oper_ch_width == -1 || prim_ch_width == -1) {
-+		printf("\t\t\tBSS primary channel width: invalid\n");
-+		printf("\t\t\tBSS operating channel width: invalid\n");
-+	} else {
-+		printf("\t\t\tBSS primary channel width: %d MHz\n", prim_ch_width);
-+		printf("\t\t\tBSS operating channel width: %d MHz\n", oper_ch_width);
-+	}
-+	if (data[0] & BIT(5))
-+		printf("\t\t\t1 MHz primary channel located at the lower side of 2 MHz\n");
-+	else
-+		printf("\t\t\t1 MHz primary channel located at the upper side of 2 MHz\n");
-+
-+	if (data[0] & BIT(7))
-+		printf("\t\t\tMCS 10 not recommended\n");
-+
-+	printf("\t\t* operating class: %d\n", data[1]);
-+	printf("\t\t* primary channel number: %d\n", data[2]);
-+
-+	printf("\t\t* channel index: %d\n", data[3]);
-+
-+	printf("\t\tMax S1G MCS Map:\n");
-+	printf("\t\t\tFor 1 SS: %s\n", s1g_ss_max_support((data[4] >> 2) & 0x3));
-+	printf("\t\t\tFor 2 SS: %s\n", s1g_ss_max_support((data[4] >> 6) & 0x3));
-+	printf("\t\t\tFor 3 SS: %s\n", s1g_ss_max_support((data[5] >> 2) & 0x3));
-+	printf("\t\t\tFor 4 SS: %s\n", s1g_ss_max_support((data[5] >> 6) & 0x3));
-+
-+	printf("\t\tMin S1G MCS Map:\n");
-+	printf("\t\t\tFor 1 SS: %s\n", s1g_ss_min_support(data[4] & 0x3));
-+	printf("\t\t\tFor 2 SS: %s\n", s1g_ss_min_support((data[4] >> 4) & 0x3));
-+	printf("\t\t\tFor 3 SS: %s\n", s1g_ss_min_support(data[5] & 0x3));
-+	printf("\t\t\tFor 4 SS: %s\n", s1g_ss_min_support((data[5] >> 4) & 0x3));
-+}
-+
- struct ie_print {
- 	const char *name;
- 	void (*print)(const uint8_t type, uint8_t len, const uint8_t *data,
-@@ -1748,6 +1843,9 @@ static const struct ie_print ieprinters[] = {
- 	[108] = { "802.11u Advertisement", print_11u_advert, 0, 255, BIT(PRINT_SCAN), },
- 	[111] = { "802.11u Roaming Consortium", print_11u_rcon, 2, 255, BIT(PRINT_SCAN), },
- 	[195] = { "Transmit Power Envelope", print_tx_power_envelope, 2, 5, BIT(PRINT_SCAN), },
-+	[214] = { "Short beacon interval", print_short_beacon_int, 2, 2, BIT(PRINT_SCAN), },
-+	[217] = { "S1G capabilities", print_s1g_capa, 15, 15, BIT(PRINT_SCAN), },
-+	[232] = { "S1G operation", print_s1g_oper, 6, 6, BIT(PRINT_SCAN), },
- };
- 
- static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data,
-@@ -2326,7 +2424,8 @@ void print_ies(unsigned char *ie, int ielen, bool unknown,
- 	while (ielen >= 2 && ielen - 2 >= ie[1]) {
- 		if (ie[0] < ARRAY_SIZE(ieprinters) &&
- 		    ieprinters[ie[0]].name &&
--		    ieprinters[ie[0]].flags & BIT(ptype)) {
-+		    ieprinters[ie[0]].flags & BIT(ptype) &&
-+			    ie[1] > 0) {
- 			print_ie(&ieprinters[ie[0]],
- 				 ie[0], ie[1], ie + 2, &ie_buffer);
- 		} else if (ie[0] == 221 /* vendor */) {
-@@ -2419,6 +2518,7 @@ static int print_bss_handler(struct nl_msg *msg, void *arg)
- 	static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
- 		[NL80211_BSS_TSF] = { .type = NLA_U64 },
- 		[NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
-+		[NL80211_BSS_FREQUENCY_OFFSET] = { .type = NLA_U32 },
- 		[NL80211_BSS_BSSID] = { },
- 		[NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
- 		[NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
-@@ -2491,7 +2591,12 @@ static int print_bss_handler(struct nl_msg *msg, void *arg)
- 	}
- 	if (bss[NL80211_BSS_FREQUENCY]) {
- 		int freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
--		printf("\tfreq: %d\n", freq);
-+		if (bss[NL80211_BSS_FREQUENCY_OFFSET])
-+			printf("\tfreq: %d.%d\n", freq,
-+			    nla_get_u32(bss[NL80211_BSS_FREQUENCY_OFFSET]));
-+		else
-+			printf("\tfreq: %d\n", freq);
-+
- 		if (freq > 45000)
- 			is_dmg = true;
- 	}
-diff --git a/util.c b/util.c
-index eef0332..18a97e1 100644
---- a/util.c
-+++ b/util.c
-@@ -1841,3 +1841,221 @@ int parse_random_mac_addr(struct nl_msg *msg, char *addrs)
-  nla_put_failure:
- 	return -ENOBUFS;
- }
-+
-+char *s1g_ss_max_support(__u8 maxss)
-+{
-+	switch (maxss) {
-+	case 0: return "Max S1G-MCS 2";
-+	case 1: return "Max S1G-MCS 7";
-+	case 2: return "Max S1G-MCS 9";
-+	case 3: return "Not supported";
-+	default: return "";
-+	}
-+}
-+
-+char *s1g_ss_min_support(__u8 minss)
-+{
-+	switch (minss) {
-+	case 0: return "no minimum restriction";
-+	case 1: return "MCS 0 not recommended";
-+	case 2: return "MCS 0 and 1 not recommended";
-+	case 3: return "invalid";
-+	default: return "";
-+	}
-+}
-+
-+void print_s1g_capability(const uint8_t *caps)
-+{
-+#define PRINT_S1G_CAP(_cond, _str) \
-+	do { \
-+		if (_cond) \
-+			printf("\t\t\t" _str "\n"); \
-+	} while (0)
-+
-+	static char buf[20];
-+	int offset = 0;
-+	uint8_t cap = caps[0];
-+
-+	/* S1G Capabilities Information subfield */
-+	if (cap)
-+		printf("\t\tByte[0]: 0x%02x\n", cap);
-+
-+	PRINT_S1G_CAP((cap & BIT(0)), "S1G PHY: S1G_LONG PPDU Format");
-+
-+	if ((cap >> 1) & 0x1f) {
-+		offset = sprintf(buf, "SGI support:");
-+		offset += sprintf(buf + offset, "%s", ((cap >> 1) & 0x1) ? " 1" : "");
-+		offset += sprintf(buf + offset, "%s", ((cap >> 1) & 0x2) ? " 2" : "");
-+		offset += sprintf(buf + offset, "%s", ((cap >> 1) & 0x4) ? " 4" : "");
-+		offset += sprintf(buf + offset, "%s", ((cap >> 1) & 0x8) ? " 8" : "");
-+		offset += sprintf(buf + offset, "%s", ((cap >> 1) & 0x10) ? " 16" : "");
-+		offset += sprintf(buf + offset, " MHz");
-+		printf("\t\t\t%s\n", buf);
-+	}
-+
-+	PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x0, "Channel width: 1, 2 MHz");
-+	PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x1, "Channel width: 1, 2, 4 MHz");
-+	PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x2, "Channel width: 1, 2, 4, 8 MHz");
-+	PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x3, "Channel width: 1, 2, 4, 8, 16 MHz");
-+
-+	cap = caps[1];
-+
-+	if (cap)
-+		printf("\t\tByte[1]: 0x%02x\n", cap);
-+
-+	PRINT_S1G_CAP((cap & BIT(0)), "Rx LDPC");
-+	PRINT_S1G_CAP((cap & BIT(1)), "Tx STBC");
-+	PRINT_S1G_CAP((cap & BIT(2)), "Rx STBC");
-+	PRINT_S1G_CAP((cap & BIT(3)), "SU Beamformer");
-+	PRINT_S1G_CAP((cap & BIT(4)), "SU Beamformee");
-+	if (cap & BIT(4))
-+		printf("\t\t\tBeamformee STS: %d\n", (cap >> 5) + 1);
-+
-+	cap = caps[2];
-+	printf("\t\tByte[2]: 0x%02x\n", cap);
-+
-+	if (caps[1] & BIT(3))
-+		printf("\t\t\tSounding dimensions: %d\n", (cap & 0x7) + 1);
-+
-+	PRINT_S1G_CAP((cap & BIT(3)), "MU Beamformer");
-+	PRINT_S1G_CAP((cap & BIT(4)), "MU Beamformee");
-+	PRINT_S1G_CAP((cap & BIT(5)), "+HTC-VHT Capable");
-+	PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x0, "No support for Traveling Pilot");
-+	PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x1, "Supports 1 STS Traveling Pilot");
-+	PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x3, "Supports 1 and 2 STS Traveling Pilot");
-+
-+	cap = caps[3];
-+	printf("\t\tByte[3]: 0x%02x\n", cap);
-+	PRINT_S1G_CAP((cap & BIT(0)), "RD Responder");
-+	/* BIT(1) in Byte 3 or BIT(25) in all capabilities is reserved */
-+	PRINT_S1G_CAP(((cap & BIT(2)) == 0x0), "Max MPDU length: 3895 bytes");
-+	PRINT_S1G_CAP((cap & BIT(2)), "Max MPDU length: 7991 bytes");
-+
-+	if (compute_ampdu_length((cap >> 2) & 0x3)) {
-+		printf("\t\t\tMaximum AMPDU length: %d bytes (exponent: 0x0%02x)\n",
-+		       compute_ampdu_length((cap >> 2) & 0x3), (cap >> 2) & 0x3);
-+	} else {
-+		printf("\t\t\tMaximum AMPDU length: unrecognized bytes (exponent: %d)\n",
-+		       (cap >> 2) & 0x3);
-+	}
-+
-+	printf("\t\t\tMinimum MPDU time spacing: %s (0x%02x)\n",
-+	       print_ampdu_space((cap >> 5) & 0x7), (cap >> 5) & 0x7);
-+
-+	cap = caps[4];
-+	printf("\t\tByte[4]: 0x%02x\n", cap);
-+	PRINT_S1G_CAP((cap & BIT(0)), "Uplink sync capable");
-+	PRINT_S1G_CAP((cap & BIT(1)), "Dynamic AID");
-+	PRINT_S1G_CAP((cap & BIT(2)), "BAT");
-+	PRINT_S1G_CAP((cap & BIT(3)), "TIM ADE");
-+	PRINT_S1G_CAP((cap & BIT(4)), "Non-TIM");
-+	PRINT_S1G_CAP((cap & BIT(5)), "Group AID");
-+	PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x0, "Sensor and non-sensor STAs");
-+	PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x1, "Only sensor STAs");
-+	PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x2, "Only non-sensor STAs");
-+
-+	cap = caps[5];
-+	printf("\t\tByte[5]: 0x%02x\n", cap);
-+	PRINT_S1G_CAP((cap & BIT(0)), "Centralized authentication control");
-+	PRINT_S1G_CAP((cap & BIT(1)), "Distributed authentication control");
-+	PRINT_S1G_CAP((cap & BIT(2)), "A-MSDU supported");
-+	PRINT_S1G_CAP((cap & BIT(3)), "A-MPDU supported");
-+	PRINT_S1G_CAP((cap & BIT(4)), "Asymmetric BA supported");
-+	PRINT_S1G_CAP((cap & BIT(5)), "Flow control supported");
-+	PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x0, "Sectorization operation not supported");
-+	PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x1, "TXOP-based sectorization operation");
-+	PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x2, "only group sectorization operation");
-+	PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x3, "Group and TXOP-based sectorization operations");
-+
-+	cap = caps[6];
-+	if (cap)
-+		printf("\t\tByte[6]: 0x%02x\n", cap);
-+
-+	PRINT_S1G_CAP((cap & BIT(0)), "OBSS mitigation");
-+	PRINT_S1G_CAP((cap & BIT(1)), "Fragment BA");
-+	PRINT_S1G_CAP((cap & BIT(2)), "NDP PS-Poll");
-+	PRINT_S1G_CAP((cap & BIT(3)), "RAW operation");
-+	PRINT_S1G_CAP((cap & BIT(4)), "Page slicing");
-+	PRINT_S1G_CAP((cap & BIT(5)), "TXOP sharing smplicit Ack");
-+
-+	/* Only in case +HTC-VHT Capable is 0x1 */
-+	if (caps[2] & BIT(5)) {
-+		PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x0, "Not provide VHT MFB (No Feedback)");
-+		PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x2, "Provides only unsolicited VHT MFB");
-+		PRINT_S1G_CAP(((cap >> 6) & 0x3) == 0x3,
-+				      "Provides both feedback and unsolicited VHT MFB");
-+	}
-+
-+	cap = caps[7];
-+	printf("\t\tByte[7]: 0x%02x\n", cap);
-+	PRINT_S1G_CAP((cap & BIT(0)), "TACK support as PS-Poll response");
-+	PRINT_S1G_CAP((cap & BIT(1)), "Duplicate 1 MHz");
-+	PRINT_S1G_CAP((cap & BIT(2)), "MCS negotiation");
-+	PRINT_S1G_CAP((cap & BIT(3)), "1 MHz control response preamble");
-+	PRINT_S1G_CAP((cap & BIT(4)), "NDP beamforming report poll");
-+	PRINT_S1G_CAP((cap & BIT(5)), "Unsolicited dynamic AID");
-+	PRINT_S1G_CAP((cap & BIT(6)), "Sector training operation");
-+	PRINT_S1G_CAP((cap & BIT(7)), "Temporary PS mode switch");
-+
-+	cap = caps[8];
-+	if (cap)
-+		printf("\t\tByte[8]: 0x%02x\n", cap);
-+
-+	PRINT_S1G_CAP((cap & BIT(0)), "TWT grouping");
-+	PRINT_S1G_CAP((cap & BIT(1)), "BDT capable");
-+	printf("\t\t\tColor: %u\n", (cap >> 2) & 0x7);
-+	PRINT_S1G_CAP((cap & BIT(5)), "TWT requester");
-+	PRINT_S1G_CAP((cap & BIT(6)), "TWT responder");
-+	PRINT_S1G_CAP((cap & BIT(7)), "PV1 frame support");
-+
-+	cap = caps[9];
-+	if (cap)
-+		printf("\t\tByte[9]: 0x%02x\n", cap);
-+
-+	PRINT_S1G_CAP((cap & BIT(0)), "Link Adaptation without NDP CMAC PPDU capable");
-+	/* Rest of byte 9 bits are reserved */
-+
-+	/* Supported S1G-MCS and NSS Set subfield */
-+	/* Rx S1G-MCS Map */
-+	cap = caps[10];
-+	printf("\t\tMax Rx S1G MCS Map: 0x%02x\n", cap);
-+	printf("\t\t\tFor 1 SS: %s\n", s1g_ss_max_support(cap & 0x3));
-+	printf("\t\t\tFor 2 SS: %s\n", s1g_ss_max_support((cap >> 2) & 0x3));
-+	printf("\t\t\tFor 3 SS: %s\n", s1g_ss_max_support((cap >> 4) & 0x3));
-+	printf("\t\t\tFor 4 SS: %s\n", s1g_ss_max_support((cap >> 6) & 0x3));
-+
-+	/* Rx Long GI data rate field comprises of 9 bits */
-+	cap = caps[11];
-+	if (cap || caps[12] & 0x1)
-+		printf("\t\t\tRx Highest Long GI Data Rate: %u Mbps\n",
-+		       cap + ((caps[12] & 0x1) << 8));
-+
-+	/* Tx S1G-MCS Map */
-+	cap = caps[12];
-+	printf("\t\tMax Tx S1G MCS Map: 0x%02x\n", cap);
-+	printf("\t\t\tFor 1 SS: %s\n", s1g_ss_max_support((cap >> 1) & 0x3));
-+	printf("\t\t\tFor 2 SS: %s\n", s1g_ss_max_support((cap >> 3) & 0x3));
-+	printf("\t\t\tFor 3 SS: %s\n", s1g_ss_max_support((cap >> 5) & 0x3));
-+	printf("\t\t\tFor 4 SS: %s\n", s1g_ss_max_support(((cap >> 7) & 0x1) +
-+	       ((caps[13] << 1) & 0x2)));
-+
-+	/* Tx Long GI data rate field comprises of 9 bits */
-+	cap = caps[13];
-+	if (((cap >> 7) & 0x7f) || (caps[14] & 0x3))
-+		printf("\t\t\tTx Highest Long GI Data Rate: %u Mbps\n", ((cap >> 7) & 0x7f) +
-+			((caps[14] & 0x3) << 7));
-+
-+	/* Rx and Tx single spatial streams and S1G MCS Map for 1 MHz */
-+	cap = (caps[15] >> 2) & 0xf;
-+	PRINT_S1G_CAP((cap & 0x3) == 0x0, "Rx single SS for 1 MHz: as in Rx S1G MCS Map");
-+	PRINT_S1G_CAP((cap & 0x3) == 0x1, "Rx single SS for 1 MHz: single SS and S1G-MCS 2");
-+	PRINT_S1G_CAP((cap & 0x3) == 0x2, "Rx single SS for 1 MHz: single SS and S1G-MCS 7");
-+	PRINT_S1G_CAP((cap & 0x3) == 0x3, "Rx single SS for 1 MHz: single SS and S1G-MCS 9");
-+	cap = (cap >> 2) & 0x3;
-+	PRINT_S1G_CAP((cap & 0x3) == 0x0, "Tx single SS for 1 MHz: as in Tx S1G MCS Map");
-+	PRINT_S1G_CAP((cap & 0x3) == 0x1, "Tx single SS for 1 MHz: single SS and S1G-MCS 2");
-+	PRINT_S1G_CAP((cap & 0x3) == 0x2, "Tx single SS for 1 MHz: single SS and S1G-MCS 7");
-+	PRINT_S1G_CAP((cap & 0x3) == 0x3, "Tx single SS for 1 MHz: single SS and S1G-MCS 9");
-+	/* Last 2 bits are reserved */
-+#undef PRINT_S1G_CAP
-+}
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0016-iw-S1G-add-list-command-support-for-802.11ah.patch b/recipes-wifi/iw/patches-mlo/0016-iw-S1G-add-list-command-support-for-802.11ah.patch
deleted file mode 100644
index b67eafc..0000000
--- a/recipes-wifi/iw/patches-mlo/0016-iw-S1G-add-list-command-support-for-802.11ah.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From f2d9f5b52677f5414dc194be94b5916d2b080eab Mon Sep 17 00:00:00 2001
-From: Gilad Itzkovitch <gilad.itzkovitch@morsemicro.com>
-Date: Tue, 28 Feb 2023 12:11:24 +1300
-Subject: [PATCH 16/28] iw: S1G: add list command support for 802.11ah
-
-In this changeset S1G frequencies are displayed for any S1G band
-with their relevant properties.
-
-Signed-off-by: Gilad Itzkovitch <gilad.itzkovitch@morsemicro.com>
-Link: https://lore.kernel.org/r/20230227231124.711053-1-gilad.itzkovitch@virscient.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- info.c | 13 ++++++++++++-
- util.c |  2 ++
- 2 files changed, 14 insertions(+), 1 deletion(-)
-
-diff --git a/info.c b/info.c
-index 9955e5e..364f9b3 100644
---- a/info.c
-+++ b/info.c
-@@ -301,6 +301,7 @@ static int print_phy_handler(struct nl_msg *msg, void *arg)
- 	struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1];
- 	static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
- 		[NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
-+		[NL80211_FREQUENCY_ATTR_OFFSET] = { .type = NLA_U32 },
- 		[NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
- 		[NL80211_FREQUENCY_ATTR_NO_IR] = { .type = NLA_FLAG },
- 		[__NL80211_FREQUENCY_ATTR_NO_IBSS] = { .type = NLA_FLAG },
-@@ -396,12 +397,22 @@ static int print_phy_handler(struct nl_msg *msg, void *arg)
- 				}
- 				nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) {
- 					uint32_t freq;
-+
- 					nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq),
- 						  nla_len(nl_freq), freq_policy);
- 					if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
- 						continue;
- 					freq = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
--					printf("\t\t\t* %d MHz [%d]", freq, ieee80211_frequency_to_channel(freq));
-+					if (tb_freq[NL80211_FREQUENCY_ATTR_OFFSET]) {
-+						uint32_t offset = nla_get_u32(
-+							tb_freq[NL80211_FREQUENCY_ATTR_OFFSET]);
-+						printf("\t\t\t* %d.%d MHz", freq, offset);
-+					} else {
-+						printf("\t\t\t* %d MHz", freq);
-+					}
-+
-+					if (ieee80211_frequency_to_channel(freq))
-+						printf(" [%d]", ieee80211_frequency_to_channel(freq));
- 
- 					if (tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER] &&
- 					    !tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
-diff --git a/util.c b/util.c
-index 18a97e1..dc09193 100644
---- a/util.c
-+++ b/util.c
-@@ -199,6 +199,8 @@ int ieee80211_channel_to_frequency(int chan, enum nl80211_band band)
- 
- int ieee80211_frequency_to_channel(int freq)
- {
-+	if (freq < 1000)
-+		return 0;
- 	/* see 802.11-2007 17.3.8.3.2 and Annex J */
- 	if (freq == 2484)
- 		return 14;
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0017-iw-Fix-EHT-rates-printing.patch b/recipes-wifi/iw/patches-mlo/0017-iw-Fix-EHT-rates-printing.patch
deleted file mode 100644
index 1da5c22..0000000
--- a/recipes-wifi/iw/patches-mlo/0017-iw-Fix-EHT-rates-printing.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From cf26fc9ab584833f01e27cc2dd09988179ec6a03 Mon Sep 17 00:00:00 2001
-From: Ben Greear <greearb@candelatech.com>
-Date: Tue, 16 May 2023 11:02:38 -0700
-Subject: [PATCH 17/28] iw: Fix EHT rates printing.
-
-The 20Mhz rates thing is a union with the others, so print one or
-the other.  This appears to fix the output of the mcs/bw printout.
-
-Signed-off-by: Ben Greear <greearb@candelatech.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- util.c | 46 +++++++++++++++++++++-------------------------
- 1 file changed, 21 insertions(+), 25 deletions(-)
-
-diff --git a/util.c b/util.c
-index dc09193..d36dbdc 100644
---- a/util.c
-+++ b/util.c
-@@ -1604,33 +1604,29 @@ static void __print_eht_capa(int band,
- 			printf("%s\t\tEHT bw=20 MHz, max NSS for MCS %s: Rx=%u, Tx=%u\n",
- 			       pre, mcs[i],
- 			       mcs_set[i] & 0xf, mcs_set[i] >> 4);
--	}
--
--	mcs_set += 4;
--	if (he_phy_cap[0] & (BIT(2) << 8)) {
--		for (i = 0; i < 3; i++)
--			printf("%s\t\tEHT bw <= 80 MHz, max NSS for MCS %s: Rx=%u, Tx=%u\n",
--			       pre, mcs[i + 1],
--			       mcs_set[i] & 0xf, mcs_set[i] >> 4);
--
--	}
--
--	mcs_set += 3;
--	if (he_phy_cap[0] & (BIT(3) << 8)) {
--		for (i = 0; i < 3; i++)
--			printf("%s\t\tEHT bw=160 MHz, max NSS for MCS %s: Rx=%u, Tx=%u\n",
--			       pre, mcs[i + 1],
--			       mcs_set[i] & 0xf, mcs_set[i] >> 4);
--
--	}
-+	} else {
-+		if (he_phy_cap[0] & (BIT(2) << 8)) {
-+			for (i = 0; i < 3; i++)
-+				printf("%s\t\tEHT bw <= 80 MHz, max NSS for MCS %s: Rx=%u, Tx=%u\n",
-+				       pre, mcs[i + 1],
-+				       mcs_set[i] & 0xf, mcs_set[i] >> 4);
-+		}
-+		mcs_set += 3;
- 
--	mcs_set += 3;
--	if (band == NL80211_BAND_6GHZ && (phy_cap[0] & BIT(1))) {
--		for (i = 0; i < 3; i++)
--			printf("%s\t\tEHT bw=320 MHz, max NSS for MCS %s: Rx=%u, Tx=%u\n",
--			       pre, mcs[i + 1],
--			       mcs_set[i] & 0xf, mcs_set[i] >> 4);
-+		if (he_phy_cap[0] & (BIT(3) << 8)) {
-+			for (i = 0; i < 3; i++)
-+				printf("%s\t\tEHT bw=160 MHz, max NSS for MCS %s: Rx=%u, Tx=%u\n",
-+				       pre, mcs[i + 1],
-+				       mcs_set[i] & 0xf, mcs_set[i] >> 4);
-+		}
- 
-+		mcs_set += 3;
-+		if (band == NL80211_BAND_6GHZ && (phy_cap[0] & BIT(1))) {
-+			for (i = 0; i < 3; i++)
-+				printf("%s\t\tEHT bw=320 MHz, max NSS for MCS %s: Rx=%u, Tx=%u\n",
-+				       pre, mcs[i + 1],
-+				       mcs_set[i] & 0xf, mcs_set[i] >> 4);
-+		}
- 	}
- 
- 	if (ppet && ppet_len && (phy_cap[1] & BIT(11))) {
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0018-iw-add-more-extended-capa-bits.patch b/recipes-wifi/iw/patches-mlo/0018-iw-add-more-extended-capa-bits.patch
deleted file mode 100644
index 46ec818..0000000
--- a/recipes-wifi/iw/patches-mlo/0018-iw-add-more-extended-capa-bits.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From cb491fa6b4b5bb1e7c11788a39bcf5a7a74afafa Mon Sep 17 00:00:00 2001
-From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-Date: Wed, 23 Aug 2023 13:10:02 +0300
-Subject: [PATCH 18/28] iw: add more extended capa bits
-
-Those were missing
-
-While at it, fix a bug in the default case, we want to print the actual
-bit offset which is bit + base.
-
-Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- scan.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/scan.c b/scan.c
-index 7479220..faf406d 100644
---- a/scan.c
-+++ b/scan.c
-@@ -1445,8 +1445,12 @@ static void print_capabilities(const uint8_t type, uint8_t len,
- 			CAPA(72, "Reserved");
- 			CAPA(73, "Extended Spectrum Management Capable");
- 			CAPA(74, "Reserved");
-+			CAPA(77, "TWT Requester Support");
-+			CAPA(78, "TWT Responder Support");
-+			CAPA(79, "OBSS Narrow Bandwith RU in UL OFDMA Tolerance Support");
-+
- 			default:
--				printf(" %d", bit);
-+				printf(" %d", bit + base);
- 				break;
- 			}
- #undef ADD_BIT_VAL
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0019-iw-fix-attribute-size-mismatch.patch b/recipes-wifi/iw/patches-mlo/0019-iw-fix-attribute-size-mismatch.patch
deleted file mode 100644
index 93ac02c..0000000
--- a/recipes-wifi/iw/patches-mlo/0019-iw-fix-attribute-size-mismatch.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From ea706b389fd896318bd7310b058fedf11d1b6758 Mon Sep 17 00:00:00 2001
-From: Koen Vandeputte <koen.vandeputte@citymesh.com>
-Date: Fri, 7 Jul 2023 16:48:26 +0200
-Subject: [PATCH 19/28] iw: fix attribute size mismatch
-
-NL80211_ATTR_MAX_AP_ASSOC_STA gets packed as u32 in the kernel.
-Change the receiving side to match this, or it will be wrong
-on big-endian.
-
-Signed-off-by: Koen Vandeputte <koen.vandeputte@citymesh.com>
-Link: https://lore.kernel.org/r/20230707144826.3043151-1-koen.vandeputte@citymesh.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- info.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/info.c b/info.c
-index 364f9b3..4c5f463 100644
---- a/info.c
-+++ b/info.c
-@@ -879,7 +879,7 @@ broken_combination:
- 
- 	if (tb_msg[NL80211_ATTR_MAX_AP_ASSOC_STA])
- 		printf("\tMaximum associated stations in AP mode: %u\n",
--		       nla_get_u16(tb_msg[NL80211_ATTR_MAX_AP_ASSOC_STA]));
-+		       nla_get_u32(tb_msg[NL80211_ATTR_MAX_AP_ASSOC_STA]));
- 
- 	return NL_SKIP;
- }
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0020-iw-connect-Fix-segfault-during-open-authentication.patch b/recipes-wifi/iw/patches-mlo/0020-iw-connect-Fix-segfault-during-open-authentication.patch
deleted file mode 100644
index 7e5da61..0000000
--- a/recipes-wifi/iw/patches-mlo/0020-iw-connect-Fix-segfault-during-open-authentication.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From a1c9376a115f9af4a50626d2c0fa89667afa0096 Mon Sep 17 00:00:00 2001
-From: Chaitanya Tata <chaitanya.mgit@gmail.com>
-Date: Thu, 27 Jul 2023 00:52:45 +0530
-Subject: [PATCH 20/28] iw: connect: Fix segfault during open authentication
-
-The check for remaining arguments is done after decrement effectively
-bypassing the non-zero check and causes a segfault with below command:
-
-  "connect <SSID> auth open/shared".
-
-Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
-Link: https://lore.kernel.org/r/20230726192245.100897-1-Chaitanya.Tata@nordicsemi.no
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- connect.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/connect.c b/connect.c
-index e5b177f..33e1a5f 100644
---- a/connect.c
-+++ b/connect.c
-@@ -77,6 +77,9 @@ static int iw_conn(struct nl80211_state *state,
- 	if (argc && strcmp(*argv, "key") != 0 && strcmp(*argv, "keys") != 0)
- 		return 1;
- 
-+	if (!argc)
-+		return 0;
-+
- 	argv++;
- 	argc--;
- 
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0021-update-nl80211.h.patch b/recipes-wifi/iw/patches-mlo/0021-update-nl80211.h.patch
deleted file mode 100644
index 0a3ac71..0000000
--- a/recipes-wifi/iw/patches-mlo/0021-update-nl80211.h.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From 7298198a54d81b969f688164ef33d952ddfcb81e Mon Sep 17 00:00:00 2001
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Thu, 24 Aug 2023 09:19:47 +0200
-Subject: [PATCH 21/28] update nl80211.h
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- nl80211.h | 30 +++++++++++++++++++++++++++++-
- 1 file changed, 29 insertions(+), 1 deletion(-)
-
-diff --git a/nl80211.h b/nl80211.h
-index c59fec4..88eb85c 100644
---- a/nl80211.h
-+++ b/nl80211.h
-@@ -11,7 +11,7 @@
-  * Copyright 2008 Jouni Malinen <jouni.malinen@atheros.com>
-  * Copyright 2008 Colin McCabe <colin@cozybit.com>
-  * Copyright 2015-2017	Intel Deutschland GmbH
-- * Copyright (C) 2018-2022 Intel Corporation
-+ * Copyright (C) 2018-2023 Intel Corporation
-  *
-  * Permission to use, copy, modify, and/or distribute this software for any
-  * purpose with or without fee is hereby granted, provided that the above
-@@ -1309,6 +1309,11 @@
-  *	The number of peers that HW timestamping can be enabled for concurrently
-  *	is indicated by %NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS.
-  *
-+ * @NL80211_CMD_LINKS_REMOVED: Notify userspace about the removal of STA MLD
-+ *	setup links due to AP MLD removing the corresponding affiliated APs with
-+ *	Multi-Link reconfiguration. %NL80211_ATTR_MLO_LINKS is used to provide
-+ *	information about the removed STA MLD setup links.
-+ *
-  * @NL80211_CMD_MAX: highest used command number
-  * @__NL80211_CMD_AFTER_LAST: internal use
-  */
-@@ -1562,6 +1567,8 @@ enum nl80211_commands {
- 
- 	NL80211_CMD_SET_HW_TIMESTAMP,
- 
-+	NL80211_CMD_LINKS_REMOVED,
-+
- 	/* add new commands above here */
- 
- 	/* used to define NL80211_CMD_MAX below */
-@@ -2805,6 +2812,9 @@ enum nl80211_commands {
-  *	index. If the userspace includes more RNR elements than number of
-  *	MBSSID elements then these will be added in every EMA beacon.
-  *
-+ * @NL80211_ATTR_MLO_LINK_DISABLED: Flag attribute indicating that the link is
-+ *	disabled.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3341,6 +3351,8 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_EMA_RNR_ELEMS,
- 
-+	NL80211_ATTR_MLO_LINK_DISABLED,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -3667,6 +3679,13 @@ enum nl80211_eht_ru_alloc {
-  *	(u8, see &enum nl80211_eht_gi)
-  * @NL80211_RATE_INFO_EHT_RU_ALLOC: EHT RU allocation, if not present then
-  *	non-OFDMA was used (u8, see &enum nl80211_eht_ru_alloc)
-+ * @NL80211_RATE_INFO_S1G_MCS: S1G MCS index (u8, 0-10)
-+ * @NL80211_RATE_INFO_S1G_NSS: S1G NSS value (u8, 1-4)
-+ * @NL80211_RATE_INFO_1_MHZ_WIDTH: 1 MHz S1G rate
-+ * @NL80211_RATE_INFO_2_MHZ_WIDTH: 2 MHz S1G rate
-+ * @NL80211_RATE_INFO_4_MHZ_WIDTH: 4 MHz S1G rate
-+ * @NL80211_RATE_INFO_8_MHZ_WIDTH: 8 MHz S1G rate
-+ * @NL80211_RATE_INFO_16_MHZ_WIDTH: 16 MHz S1G rate
-  * @__NL80211_RATE_INFO_AFTER_LAST: internal use
-  */
- enum nl80211_rate_info {
-@@ -3693,6 +3712,13 @@ enum nl80211_rate_info {
- 	NL80211_RATE_INFO_EHT_NSS,
- 	NL80211_RATE_INFO_EHT_GI,
- 	NL80211_RATE_INFO_EHT_RU_ALLOC,
-+	NL80211_RATE_INFO_S1G_MCS,
-+	NL80211_RATE_INFO_S1G_NSS,
-+	NL80211_RATE_INFO_1_MHZ_WIDTH,
-+	NL80211_RATE_INFO_2_MHZ_WIDTH,
-+	NL80211_RATE_INFO_4_MHZ_WIDTH,
-+	NL80211_RATE_INFO_8_MHZ_WIDTH,
-+	NL80211_RATE_INFO_16_MHZ_WIDTH,
- 
- 	/* keep last */
- 	__NL80211_RATE_INFO_AFTER_LAST,
-@@ -4424,6 +4450,7 @@ enum nl80211_sched_scan_match_attr {
-  * @NL80211_RRF_NO_160MHZ: 160MHz operation not allowed
-  * @NL80211_RRF_NO_HE: HE operation not allowed
-  * @NL80211_RRF_NO_320MHZ: 320MHz operation not allowed
-+ * @NL80211_RRF_NO_EHT: EHT operation not allowed
-  */
- enum nl80211_reg_rule_flags {
- 	NL80211_RRF_NO_OFDM		= 1<<0,
-@@ -4443,6 +4470,7 @@ enum nl80211_reg_rule_flags {
- 	NL80211_RRF_NO_160MHZ		= 1<<16,
- 	NL80211_RRF_NO_HE		= 1<<17,
- 	NL80211_RRF_NO_320MHZ		= 1<<18,
-+	NL80211_RRF_NO_EHT		= 1<<19,
- };
- 
- #define NL80211_RRF_PASSIVE_SCAN	NL80211_RRF_NO_IR
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0022-iw-S1G-add-802.11ah-support-for-link-command-display.patch b/recipes-wifi/iw/patches-mlo/0022-iw-S1G-add-802.11ah-support-for-link-command-display.patch
deleted file mode 100644
index 7bb242c..0000000
--- a/recipes-wifi/iw/patches-mlo/0022-iw-S1G-add-802.11ah-support-for-link-command-display.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From e2224c729840cc33c6ea89ba5e91b69f79c88e85 Mon Sep 17 00:00:00 2001
-From: Bassem Dawood <bassem@morsemicro.com>
-Date: Thu, 19 Oct 2023 18:40:19 +1100
-Subject: [PATCH 22/28] iw: S1G: add 802.11ah support for link command display
-
-Amending the link command which depends on kernal changes for
-802.11ah bandwidths/MCS/NSS NL80211_RATE_INFO_ attributes.
-
-S1G frequency offset being used as well for the MHz units print.
-
-Signed-off-by: Bassem Dawood <bassem@morsemicro.com>
-Link: https://lore.kernel.org/r/20231019074019.2246629-1-bassem@morsemicro.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- link.c    |  9 +++++++--
- station.c | 10 ++++++++++
- 2 files changed, 17 insertions(+), 2 deletions(-)
-
-diff --git a/link.c b/link.c
-index a090100..a7ee963 100644
---- a/link.c
-+++ b/link.c
-@@ -29,6 +29,7 @@ static int link_bss_handler(struct nl_msg *msg, void *arg)
- 	static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
- 		[NL80211_BSS_TSF] = { .type = NLA_U64 },
- 		[NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
-+		[NL80211_BSS_FREQUENCY_OFFSET] = { .type = NLA_U32 },
- 		[NL80211_BSS_BSSID] = { },
- 		[NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
- 		[NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
-@@ -41,6 +42,7 @@ static int link_bss_handler(struct nl_msg *msg, void *arg)
- 	char mac_addr[20], dev[20], link_addr[20];
- 	int link_id = -1;
- 	const char *indent = "\t";
-+	int freq_offset = 0;
- 
- 	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
- 		  genlmsg_attrlen(gnlh, 0), NULL);
-@@ -121,9 +123,12 @@ static int link_bss_handler(struct nl_msg *msg, void *arg)
- 			  nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
- 			  false, result->mld ? PRINT_LINK_MLO_LINK : PRINT_LINK);
- 
-+	if (bss[NL80211_BSS_FREQUENCY_OFFSET])
-+		freq_offset = nla_get_u32(bss[NL80211_BSS_FREQUENCY_OFFSET]);
-+
- 	if (bss[NL80211_BSS_FREQUENCY])
--		printf("%sfreq: %d\n", indent,
--			nla_get_u32(bss[NL80211_BSS_FREQUENCY]));
-+		printf("%sfreq: %d.%d\n", indent,
-+			nla_get_u32(bss[NL80211_BSS_FREQUENCY]), freq_offset);
- 
- 	if (nla_get_u32(bss[NL80211_BSS_STATUS]) != NL80211_BSS_STATUS_ASSOCIATED)
- 		return NL_SKIP;
-diff --git a/station.c b/station.c
-index da1feae..bf7c0f5 100644
---- a/station.c
-+++ b/station.c
-@@ -241,6 +241,16 @@ void parse_bitrate(struct nlattr *bitrate_attr, char *buf, int buflen)
- 		pos += snprintf(pos, buflen - (pos - buf), " 160MHz");
- 	if (rinfo[NL80211_RATE_INFO_320_MHZ_WIDTH])
- 		pos += snprintf(pos, buflen - (pos - buf), " 320MHz");
-+	if (rinfo[NL80211_RATE_INFO_1_MHZ_WIDTH])
-+		pos += snprintf(pos, buflen - (pos - buf), " 1MHz");
-+	if (rinfo[NL80211_RATE_INFO_2_MHZ_WIDTH])
-+		pos += snprintf(pos, buflen - (pos - buf), " 2MHz");
-+	if (rinfo[NL80211_RATE_INFO_4_MHZ_WIDTH])
-+		pos += snprintf(pos, buflen - (pos - buf), " 4MHz");
-+	if (rinfo[NL80211_RATE_INFO_8_MHZ_WIDTH])
-+		pos += snprintf(pos, buflen - (pos - buf), " 8MHz");
-+	if (rinfo[NL80211_RATE_INFO_16_MHZ_WIDTH])
-+		pos += snprintf(pos, buflen - (pos - buf), " 16MHz");
- 	if (rinfo[NL80211_RATE_INFO_SHORT_GI])
- 		pos += snprintf(pos, buflen - (pos - buf), " short GI");
- 	if (rinfo[NL80211_RATE_INFO_VHT_NSS])
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0023-iw-allow-extra-cflags.patch b/recipes-wifi/iw/patches-mlo/0023-iw-allow-extra-cflags.patch
deleted file mode 100644
index 9897062..0000000
--- a/recipes-wifi/iw/patches-mlo/0023-iw-allow-extra-cflags.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 44686ac3e7b536e905c3749814e4eb0e7e210440 Mon Sep 17 00:00:00 2001
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Fri, 1 Sep 2023 07:50:02 +0200
-Subject: [PATCH 23/28] iw: allow extra cflags
-
-We can override the entirety of CFLAGS from the make
-command line, but not add e.g. -Werror. Append a new
-EXTRA_CFLAGS to make that possible.
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- Makefile | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/Makefile b/Makefile
-index 2fb8db8..17be33f 100644
---- a/Makefile
-+++ b/Makefile
-@@ -18,6 +18,7 @@ CFLAGS += -Wall -Wextra -Wundef -Wstrict-prototypes -Wno-trigraphs -fno-strict-a
- CFLAGS += -Werror-implicit-function-declaration -Wsign-compare -Wno-unused-parameter
- CFLAGS += -Wdeclaration-after-statement
- CFLAGS += $(CFLAGS_EVAL)
-+CFLAGS += $(EXTRA_CFLAGS)
- 
- _OBJS := $(sort $(patsubst %.c,%.o,$(wildcard *.c)))
- VERSION_OBJS := $(filter-out version.o, $(_OBJS))
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0024-update-nl80211.h.patch b/recipes-wifi/iw/patches-mlo/0024-update-nl80211.h.patch
deleted file mode 100644
index c7d248a..0000000
--- a/recipes-wifi/iw/patches-mlo/0024-update-nl80211.h.patch
+++ /dev/null
@@ -1,623 +0,0 @@
-From ac7e46b2aaf800ff0bd1339be814754b79eed568 Mon Sep 17 00:00:00 2001
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Thu, 21 Dec 2023 12:47:01 +0100
-Subject: [PATCH 24/28] update nl80211.h
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- info.c    |   2 +
- nl80211.h | 199 ++++++++++++++++++++++++++++++++++++++++--------------
- 2 files changed, 149 insertions(+), 52 deletions(-)
-
-diff --git a/info.c b/info.c
-index 4c5f463..317e7a3 100644
---- a/info.c
-+++ b/info.c
-@@ -170,6 +170,8 @@ static void ext_feat_print(enum nl80211_ext_feature_index idx)
- 	ext_feat_case(PUNCT, "preamble puncturing in AP mode");
- 	ext_feat_case(SECURE_NAN, "secure NAN support");
- 	ext_feat_case(AUTH_AND_DEAUTH_RANDOM_TA, "random auth/deauth transmitter address");
-+	ext_feat_case(OWE_OFFLOAD, "OWE DH element handling offload (client)");
-+	ext_feat_case(OWE_OFFLOAD_AP, "OWE DH element handling offload (AP)");
- 	}
- }
- 
-diff --git a/nl80211.h b/nl80211.h
-index 88eb85c..a682b54 100644
---- a/nl80211.h
-+++ b/nl80211.h
-@@ -72,7 +72,7 @@
-  * For drivers supporting TDLS with external setup (WIPHY_FLAG_SUPPORTS_TDLS
-  * and WIPHY_FLAG_TDLS_EXTERNAL_SETUP), the station lifetime is as follows:
-  *  - a setup station entry is added, not yet authorized, without any rate
-- *    or capability information, this just exists to avoid race conditions
-+ *    or capability information; this just exists to avoid race conditions
-  *  - when the TDLS setup is done, a single NL80211_CMD_SET_STATION is valid
-  *    to add rate and capability information to the station and at the same
-  *    time mark it authorized.
-@@ -87,7 +87,7 @@
-  * DOC: Frame transmission/registration support
-  *
-  * Frame transmission and registration support exists to allow userspace
-- * management entities such as wpa_supplicant react to management frames
-+ * management entities such as wpa_supplicant to react to management frames
-  * that are not being handled by the kernel. This includes, for example,
-  * certain classes of action frames that cannot be handled in the kernel
-  * for various reasons.
-@@ -113,7 +113,7 @@
-  *
-  * Frame transmission allows userspace to send for example the required
-  * responses to action frames. It is subject to some sanity checking,
-- * but many frames can be transmitted. When a frame was transmitted, its
-+ * but many frames can be transmitted. When a frame is transmitted, its
-  * status is indicated to the sending socket.
-  *
-  * For more technical details, see the corresponding command descriptions
-@@ -123,7 +123,7 @@
- /**
-  * DOC: Virtual interface / concurrency capabilities
-  *
-- * Some devices are able to operate with virtual MACs, they can have
-+ * Some devices are able to operate with virtual MACs; they can have
-  * more than one virtual interface. The capability handling for this
-  * is a bit complex though, as there may be a number of restrictions
-  * on the types of concurrency that are supported.
-@@ -135,7 +135,7 @@
-  * Once concurrency is desired, more attributes must be observed:
-  * To start with, since some interface types are purely managed in
-  * software, like the AP-VLAN type in mac80211 for example, there's
-- * an additional list of these, they can be added at any time and
-+ * an additional list of these; they can be added at any time and
-  * are only restricted by some semantic restrictions (e.g. AP-VLAN
-  * cannot be added without a corresponding AP interface). This list
-  * is exported in the %NL80211_ATTR_SOFTWARE_IFTYPES attribute.
-@@ -164,17 +164,17 @@
-  * Packet coalesce feature helps to reduce number of received interrupts
-  * to host by buffering these packets in firmware/hardware for some
-  * predefined time. Received interrupt will be generated when one of the
-- * following events occur.
-+ * following events occurs.
-  * a) Expiration of hardware timer whose expiration time is set to maximum
-  * coalescing delay of matching coalesce rule.
-- * b) Coalescing buffer in hardware reaches it's limit.
-+ * b) Coalescing buffer in hardware reaches its limit.
-  * c) Packet doesn't match any of the configured coalesce rules.
-  *
-  * User needs to configure following parameters for creating a coalesce
-  * rule.
-  * a) Maximum coalescing delay
-  * b) List of packet patterns which needs to be matched
-- * c) Condition for coalescence. pattern 'match' or 'no match'
-+ * c) Condition for coalescence: pattern 'match' or 'no match'
-  * Multiple such rules can be created.
-  */
- 
-@@ -213,7 +213,7 @@
- /**
-  * DOC: FILS shared key authentication offload
-  *
-- * FILS shared key authentication offload can be advertized by drivers by
-+ * FILS shared key authentication offload can be advertised by drivers by
-  * setting @NL80211_EXT_FEATURE_FILS_SK_OFFLOAD flag. The drivers that support
-  * FILS shared key authentication offload should be able to construct the
-  * authentication and association frames for FILS shared key authentication and
-@@ -239,7 +239,7 @@
-  * The PMKSA can be maintained in userspace persistently so that it can be used
-  * later after reboots or wifi turn off/on also.
-  *
-- * %NL80211_ATTR_FILS_CACHE_ID is the cache identifier advertized by a FILS
-+ * %NL80211_ATTR_FILS_CACHE_ID is the cache identifier advertised by a FILS
-  * capable AP supporting PMK caching. It specifies the scope within which the
-  * PMKSAs are cached in an ESS. %NL80211_CMD_SET_PMKSA and
-  * %NL80211_CMD_DEL_PMKSA are enhanced to allow support for PMKSA caching based
-@@ -290,12 +290,12 @@
-  * If the configuration needs to be applied for specific peer then the MAC
-  * address of the peer needs to be passed in %NL80211_ATTR_MAC, otherwise the
-  * configuration will be applied for all the connected peers in the vif except
-- * any peers that have peer specific configuration for the TID by default; if
-- * the %NL80211_TID_CONFIG_ATTR_OVERRIDE flag is set, peer specific values
-+ * any peers that have peer-specific configuration for the TID by default; if
-+ * the %NL80211_TID_CONFIG_ATTR_OVERRIDE flag is set, peer-specific values
-  * will be overwritten.
-  *
-- * All this configuration is valid only for STA's current connection
-- * i.e. the configuration will be reset to default when the STA connects back
-+ * All this configuration is valid only for STA's current connection,
-+ * i.e., the configuration will be reset to default when the STA connects back
-  * after disconnection/roaming, and this configuration will be cleared when
-  * the interface goes down.
-  */
-@@ -326,7 +326,7 @@
- /**
-  * DOC: Multi-Link Operation
-  *
-- * In Multi-Link Operation, a connection between to MLDs utilizes multiple
-+ * In Multi-Link Operation, a connection between two MLDs utilizes multiple
-  * links. To use this in nl80211, various commands and responses now need
-  * to or will include the new %NL80211_ATTR_MLO_LINKS attribute.
-  * Additionally, various commands that need to operate on a specific link
-@@ -334,6 +334,15 @@
-  * use %NL80211_CMD_START_AP or similar functions.
-  */
- 
-+/**
-+ * DOC: OWE DH IE handling offload
-+ *
-+ * By setting @NL80211_EXT_FEATURE_OWE_OFFLOAD flag, drivers can indicate
-+ * kernel/application space to avoid DH IE handling. When this flag is
-+ * advertised, the driver/device will take care of DH IE inclusion and
-+ * processing of peer DH IE to generate PMK.
-+ */
-+
- /**
-  * enum nl80211_commands - supported nl80211 commands
-  *
-@@ -512,7 +521,7 @@
-  *	%NL80211_ATTR_SCHED_SCAN_PLANS. If %NL80211_ATTR_SCHED_SCAN_PLANS is
-  *	not specified and only %NL80211_ATTR_SCHED_SCAN_INTERVAL is specified,
-  *	scheduled scan will run in an infinite loop with the specified interval.
-- *	These attributes are mutually exculsive,
-+ *	These attributes are mutually exclusive,
-  *	i.e. NL80211_ATTR_SCHED_SCAN_INTERVAL must not be passed if
-  *	NL80211_ATTR_SCHED_SCAN_PLANS is defined.
-  *	If for some reason scheduled scan is aborted by the driver, all scan
-@@ -543,7 +552,7 @@
-  *	%NL80211_CMD_STOP_SCHED_SCAN command is received or when the interface
-  *	is brought down while a scheduled scan was running.
-  *
-- * @NL80211_CMD_GET_SURVEY: get survey resuls, e.g. channel occupation
-+ * @NL80211_CMD_GET_SURVEY: get survey results, e.g. channel occupation
-  *      or noise level
-  * @NL80211_CMD_NEW_SURVEY_RESULTS: survey data notification (as a reply to
-  *	NL80211_CMD_GET_SURVEY and on the "scan" multicast group)
-@@ -554,12 +563,13 @@
-  *	using %NL80211_ATTR_SSID, %NL80211_ATTR_FILS_CACHE_ID,
-  *	%NL80211_ATTR_PMKID, and %NL80211_ATTR_PMK in case of FILS
-  *	authentication where %NL80211_ATTR_FILS_CACHE_ID is the identifier
-- *	advertized by a FILS capable AP identifying the scope of PMKSA in an
-+ *	advertised by a FILS capable AP identifying the scope of PMKSA in an
-  *	ESS.
-  * @NL80211_CMD_DEL_PMKSA: Delete a PMKSA cache entry, using %NL80211_ATTR_MAC
-  *	(for the BSSID) and %NL80211_ATTR_PMKID or using %NL80211_ATTR_SSID,
-  *	%NL80211_ATTR_FILS_CACHE_ID, and %NL80211_ATTR_PMKID in case of FILS
-- *	authentication.
-+ *	authentication. Additionally in case of SAE offload and OWE offloads
-+ *	PMKSA entry can be deleted using %NL80211_ATTR_SSID.
-  * @NL80211_CMD_FLUSH_PMKSA: Flush all PMKSA cache entries.
-  *
-  * @NL80211_CMD_REG_CHANGE: indicates to userspace the regulatory domain
-@@ -598,7 +608,7 @@
-  *	BSSID in case of station mode). %NL80211_ATTR_SSID is used to specify
-  *	the SSID (mainly for association, but is included in authentication
-  *	request, too, to help BSS selection. %NL80211_ATTR_WIPHY_FREQ +
-- *	%NL80211_ATTR_WIPHY_FREQ_OFFSET is used to specify the frequence of the
-+ *	%NL80211_ATTR_WIPHY_FREQ_OFFSET is used to specify the frequency of the
-  *	channel in MHz. %NL80211_ATTR_AUTH_TYPE is used to specify the
-  *	authentication type. %NL80211_ATTR_IE is used to define IEs
-  *	(VendorSpecificInfo, but also including RSN IE and FT IEs) to be added
-@@ -807,7 +817,7 @@
-  *	reached.
-  * @NL80211_CMD_SET_CHANNEL: Set the channel (using %NL80211_ATTR_WIPHY_FREQ
-  *	and the attributes determining channel width) the given interface
-- *	(identifed by %NL80211_ATTR_IFINDEX) shall operate on.
-+ *	(identified by %NL80211_ATTR_IFINDEX) shall operate on.
-  *	In case multiple channels are supported by the device, the mechanism
-  *	with which it switches channels is implementation-defined.
-  *	When a monitor interface is given, it can only switch channel while
-@@ -879,7 +889,7 @@
-  *	inform userspace of the new replay counter.
-  *
-  * @NL80211_CMD_PMKSA_CANDIDATE: This is used as an event to inform userspace
-- *	of PMKSA caching dandidates.
-+ *	of PMKSA caching candidates.
-  *
-  * @NL80211_CMD_TDLS_OPER: Perform a high-level TDLS command (e.g. link setup).
-  *	In addition, this can be used as an event to request userspace to take
-@@ -915,7 +925,7 @@
-  *
-  * @NL80211_CMD_PROBE_CLIENT: Probe an associated station on an AP interface
-  *	by sending a null data frame to it and reporting when the frame is
-- *	acknowleged. This is used to allow timing out inactive clients. Uses
-+ *	acknowledged. This is used to allow timing out inactive clients. Uses
-  *	%NL80211_ATTR_IFINDEX and %NL80211_ATTR_MAC. The command returns a
-  *	direct reply with an %NL80211_ATTR_COOKIE that is later used to match
-  *	up the event with the request. The event includes the same data and
-@@ -1126,11 +1136,15 @@
-  * @NL80211_CMD_DEL_PMK: For offloaded 4-Way handshake, delete the previously
-  *	configured PMK for the authenticator address identified by
-  *	%NL80211_ATTR_MAC.
-- * @NL80211_CMD_PORT_AUTHORIZED: An event that indicates an 802.1X FT roam was
-- *	completed successfully. Drivers that support 4 way handshake offload
-- *	should send this event after indicating 802.1X FT assocation with
-- *	%NL80211_CMD_ROAM. If the 4 way handshake failed %NL80211_CMD_DISCONNECT
-- *	should be indicated instead.
-+ * @NL80211_CMD_PORT_AUTHORIZED: An event that indicates port is authorized and
-+ *	open for regular data traffic. For STA/P2P-client, this event is sent
-+ *	with AP MAC address and for AP/P2P-GO, the event carries the STA/P2P-
-+ *	client MAC address.
-+ *	Drivers that support 4 way handshake offload should send this event for
-+ *	STA/P2P-client after successful 4-way HS or after 802.1X FT following
-+ *	NL80211_CMD_CONNECT or NL80211_CMD_ROAM. Drivers using AP/P2P-GO 4-way
-+ *	handshake offload should send this event on successful completion of
-+ *	4-way handshake with the peer (STA/P2P-client).
-  * @NL80211_CMD_CONTROL_PORT_FRAME: Control Port (e.g. PAE) frame TX request
-  *	and RX notification.  This command is used both as a request to transmit
-  *	a control port frame and as a notification that a control port frame
-@@ -1314,6 +1328,11 @@
-  *	Multi-Link reconfiguration. %NL80211_ATTR_MLO_LINKS is used to provide
-  *	information about the removed STA MLD setup links.
-  *
-+ * @NL80211_CMD_SET_TID_TO_LINK_MAPPING: Set the TID to Link Mapping for a
-+ *      non-AP MLD station. The %NL80211_ATTR_MLO_TTLM_DLINK and
-+ *      %NL80211_ATTR_MLO_TTLM_ULINK attributes are used to specify the
-+ *      TID to Link mapping for downlink/uplink traffic.
-+ *
-  * @NL80211_CMD_MAX: highest used command number
-  * @__NL80211_CMD_AFTER_LAST: internal use
-  */
-@@ -1569,6 +1588,8 @@ enum nl80211_commands {
- 
- 	NL80211_CMD_LINKS_REMOVED,
- 
-+	NL80211_CMD_SET_TID_TO_LINK_MAPPING,
-+
- 	/* add new commands above here */
- 
- 	/* used to define NL80211_CMD_MAX below */
-@@ -1826,7 +1847,7 @@ enum nl80211_commands {
-  *	using %CMD_CONTROL_PORT_FRAME.  If control port routing over NL80211 is
-  *	to be used then userspace must also use the %NL80211_ATTR_SOCKET_OWNER
-  *	flag. When used with %NL80211_ATTR_CONTROL_PORT_NO_PREAUTH, pre-auth
-- *	frames are not forwared over the control port.
-+ *	frames are not forwarded over the control port.
-  *
-  * @NL80211_ATTR_TESTDATA: Testmode data blob, passed through to the driver.
-  *	We recommend using nested, driver-specific attributes within this.
-@@ -1963,10 +1984,10 @@ enum nl80211_commands {
-  *	bit. Depending on which antennas are selected in the bitmap, 802.11n
-  *	drivers can derive which chainmasks to use (if all antennas belonging to
-  *	a particular chain are disabled this chain should be disabled) and if
-- *	a chain has diversity antennas wether diversity should be used or not.
-+ *	a chain has diversity antennas whether diversity should be used or not.
-  *	HT capabilities (STBC, TX Beamforming, Antenna selection) can be
-  *	derived from the available chains after applying the antenna mask.
-- *	Non-802.11n drivers can derive wether to use diversity or not.
-+ *	Non-802.11n drivers can derive whether to use diversity or not.
-  *	Drivers may reject configurations or RX/TX mask combinations they cannot
-  *	support by returning -EINVAL.
-  *
-@@ -2536,7 +2557,7 @@ enum nl80211_commands {
-  *	from successful FILS authentication and is used with
-  *	%NL80211_CMD_CONNECT.
-  *
-- * @NL80211_ATTR_FILS_CACHE_ID: A 2-octet identifier advertized by a FILS AP
-+ * @NL80211_ATTR_FILS_CACHE_ID: A 2-octet identifier advertised by a FILS AP
-  *	identifying the scope of PMKSAs. This is used with
-  *	@NL80211_CMD_SET_PMKSA and @NL80211_CMD_DEL_PMKSA.
-  *
-@@ -2690,11 +2711,13 @@ enum nl80211_commands {
-  *
-  * @NL80211_ATTR_FILS_DISCOVERY: Optional parameter to configure FILS
-  *	discovery. It is a nested attribute, see
-- *	&enum nl80211_fils_discovery_attributes.
-+ *	&enum nl80211_fils_discovery_attributes. Userspace should pass an empty
-+ *	nested attribute to disable this feature and delete the templates.
-  *
-  * @NL80211_ATTR_UNSOL_BCAST_PROBE_RESP: Optional parameter to configure
-  *	unsolicited broadcast probe response. It is a nested attribute, see
-- *	&enum nl80211_unsol_bcast_probe_resp_attributes.
-+ *	&enum nl80211_unsol_bcast_probe_resp_attributes. Userspace should pass an empty
-+ *	nested attribute to disable this feature and delete the templates.
-  *
-  * @NL80211_ATTR_S1G_CAPABILITY: S1G Capability information element (from
-  *	association request when used with NL80211_CMD_NEW_STATION)
-@@ -2815,6 +2838,19 @@ enum nl80211_commands {
-  * @NL80211_ATTR_MLO_LINK_DISABLED: Flag attribute indicating that the link is
-  *	disabled.
-  *
-+ * @NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA: Include BSS usage data, i.e.
-+ *	include BSSes that can only be used in restricted scenarios and/or
-+ *	cannot be used at all.
-+ *
-+ * @NL80211_ATTR_MLO_TTLM_DLINK: Binary attribute specifying the downlink TID to
-+ *      link mapping. The length is 8 * sizeof(u16). For each TID the link
-+ *      mapping is as defined in section 9.4.2.314 (TID-To-Link Mapping element)
-+ *      in Draft P802.11be_D4.0.
-+ * @NL80211_ATTR_MLO_TTLM_ULINK: Binary attribute specifying the uplink TID to
-+ *      link mapping. The length is 8 * sizeof(u16). For each TID the link
-+ *      mapping is as defined in section 9.4.2.314 (TID-To-Link Mapping element)
-+ *      in Draft P802.11be_D4.0.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3353,6 +3389,11 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_MLO_LINK_DISABLED,
- 
-+	NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA,
-+
-+	NL80211_ATTR_MLO_TTLM_DLINK,
-+	NL80211_ATTR_MLO_TTLM_ULINK,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -4159,7 +4200,7 @@ enum nl80211_wmm_rule {
-  *	(100 * dBm).
-  * @NL80211_FREQUENCY_ATTR_DFS_STATE: current state for DFS
-  *	(enum nl80211_dfs_state)
-- * @NL80211_FREQUENCY_ATTR_DFS_TIME: time in miliseconds for how long
-+ * @NL80211_FREQUENCY_ATTR_DFS_TIME: time in milliseconds for how long
-  *	this channel is in this DFS state.
-  * @NL80211_FREQUENCY_ATTR_NO_HT40_MINUS: HT40- isn't possible with this
-  *	channel as the control channel
-@@ -4213,6 +4254,8 @@ enum nl80211_wmm_rule {
-  *	as the primary or any of the secondary channels isn't possible
-  * @NL80211_FREQUENCY_ATTR_NO_EHT: EHT operation is not allowed on this channel
-  *	in current regulatory domain.
-+ * @NL80211_FREQUENCY_ATTR_PSD: Power spectral density (in dBm) that
-+ *	is allowed on this channel in current regulatory domain.
-  * @NL80211_FREQUENCY_ATTR_MAX: highest frequency attribute number
-  *	currently defined
-  * @__NL80211_FREQUENCY_ATTR_AFTER_LAST: internal use
-@@ -4251,6 +4294,7 @@ enum nl80211_frequency_attr {
- 	NL80211_FREQUENCY_ATTR_16MHZ,
- 	NL80211_FREQUENCY_ATTR_NO_320MHZ,
- 	NL80211_FREQUENCY_ATTR_NO_EHT,
-+	NL80211_FREQUENCY_ATTR_PSD,
- 
- 	/* keep last */
- 	__NL80211_FREQUENCY_ATTR_AFTER_LAST,
-@@ -4351,6 +4395,8 @@ enum nl80211_reg_type {
-  * 	a given frequency range. The value is in mBm (100 * dBm).
-  * @NL80211_ATTR_DFS_CAC_TIME: DFS CAC time in milliseconds.
-  *	If not present or 0 default CAC time will be used.
-+ * @NL80211_ATTR_POWER_RULE_PSD: power spectral density (in dBm).
-+ *	This could be negative.
-  * @NL80211_REG_RULE_ATTR_MAX: highest regulatory rule attribute number
-  *	currently defined
-  * @__NL80211_REG_RULE_ATTR_AFTER_LAST: internal use
-@@ -4368,6 +4414,8 @@ enum nl80211_reg_rule_attr {
- 
- 	NL80211_ATTR_DFS_CAC_TIME,
- 
-+	NL80211_ATTR_POWER_RULE_PSD,
-+
- 	/* keep last */
- 	__NL80211_REG_RULE_ATTR_AFTER_LAST,
- 	NL80211_REG_RULE_ATTR_MAX = __NL80211_REG_RULE_ATTR_AFTER_LAST - 1
-@@ -4451,6 +4499,7 @@ enum nl80211_sched_scan_match_attr {
-  * @NL80211_RRF_NO_HE: HE operation not allowed
-  * @NL80211_RRF_NO_320MHZ: 320MHz operation not allowed
-  * @NL80211_RRF_NO_EHT: EHT operation not allowed
-+ * @NL80211_RRF_PSD: Ruleset has power spectral density value
-  */
- enum nl80211_reg_rule_flags {
- 	NL80211_RRF_NO_OFDM		= 1<<0,
-@@ -4471,6 +4520,7 @@ enum nl80211_reg_rule_flags {
- 	NL80211_RRF_NO_HE		= 1<<17,
- 	NL80211_RRF_NO_320MHZ		= 1<<18,
- 	NL80211_RRF_NO_EHT		= 1<<19,
-+	NL80211_RRF_PSD			= 1<<20,
- };
- 
- #define NL80211_RRF_PASSIVE_SCAN	NL80211_RRF_NO_IR
-@@ -5007,6 +5057,30 @@ enum nl80211_bss_scan_width {
- 	NL80211_BSS_CHAN_WIDTH_2,
- };
- 
-+/**
-+ * enum nl80211_bss_use_for - bitmap indicating possible BSS use
-+ * @NL80211_BSS_USE_FOR_NORMAL: Use this BSS for normal "connection",
-+ *	including IBSS/MBSS depending on the type.
-+ * @NL80211_BSS_USE_FOR_MLD_LINK: This BSS can be used as a link in an
-+ *	MLO connection. Note that for an MLO connection, all links including
-+ *	the assoc link must have this flag set, and the assoc link must
-+ *	additionally have %NL80211_BSS_USE_FOR_NORMAL set.
-+ */
-+enum nl80211_bss_use_for {
-+	NL80211_BSS_USE_FOR_NORMAL = 1 << 0,
-+	NL80211_BSS_USE_FOR_MLD_LINK = 1 << 1,
-+};
-+
-+/**
-+ * enum nl80211_bss_cannot_use_reasons - reason(s) connection to a
-+ *	BSS isn't possible
-+ * @NL80211_BSS_CANNOT_USE_NSTR_NONPRIMARY: NSTR nonprimary links aren't
-+ *	supported by the device, and this BSS entry represents one.
-+ */
-+enum nl80211_bss_cannot_use_reasons {
-+	NL80211_BSS_CANNOT_USE_NSTR_NONPRIMARY	= 1 << 0,
-+};
-+
- /**
-  * enum nl80211_bss - netlink attributes for a BSS
-  *
-@@ -5038,7 +5112,7 @@ enum nl80211_bss_scan_width {
-  *	elements from a Beacon frame (bin); not present if no Beacon frame has
-  *	yet been received
-  * @NL80211_BSS_CHAN_WIDTH: channel width of the control channel
-- *	(u32, enum nl80211_bss_scan_width)
-+ *	(u32, enum nl80211_bss_scan_width) - No longer used!
-  * @NL80211_BSS_BEACON_TSF: TSF of the last received beacon (u64)
-  *	(not present if no beacon frame has been received yet)
-  * @NL80211_BSS_PRESP_DATA: the data in @NL80211_BSS_INFORMATION_ELEMENTS and
-@@ -5059,6 +5133,14 @@ enum nl80211_bss_scan_width {
-  * @NL80211_BSS_FREQUENCY_OFFSET: frequency offset in KHz
-  * @NL80211_BSS_MLO_LINK_ID: MLO link ID of the BSS (u8).
-  * @NL80211_BSS_MLD_ADDR: MLD address of this BSS if connected to it.
-+ * @NL80211_BSS_USE_FOR: u32 bitmap attribute indicating what the BSS can be
-+ *	used for, see &enum nl80211_bss_use_for.
-+ * @NL80211_BSS_CANNOT_USE_REASONS: Indicates the reason that this BSS cannot
-+ *	be used for all or some of the possible uses by the device reporting it,
-+ *	even though its presence was detected.
-+ *	This is a u64 attribute containing a bitmap of values from
-+ *	&enum nl80211_cannot_use_reasons, note that the attribute may be missing
-+ *	if no reasons are specified.
-  * @__NL80211_BSS_AFTER_LAST: internal
-  * @NL80211_BSS_MAX: highest BSS attribute
-  */
-@@ -5086,6 +5168,8 @@ enum nl80211_bss {
- 	NL80211_BSS_FREQUENCY_OFFSET,
- 	NL80211_BSS_MLO_LINK_ID,
- 	NL80211_BSS_MLD_ADDR,
-+	NL80211_BSS_USE_FOR,
-+	NL80211_BSS_CANNOT_USE_REASONS,
- 
- 	/* keep last */
- 	__NL80211_BSS_AFTER_LAST,
-@@ -5434,7 +5518,7 @@ enum nl80211_tx_rate_setting {
-  *	(%NL80211_TID_CONFIG_ATTR_TIDS, %NL80211_TID_CONFIG_ATTR_OVERRIDE).
-  * @NL80211_TID_CONFIG_ATTR_PEER_SUPP: same as the previous per-vif one, but
-  *	per peer instead.
-- * @NL80211_TID_CONFIG_ATTR_OVERRIDE: flag attribue, if set indicates
-+ * @NL80211_TID_CONFIG_ATTR_OVERRIDE: flag attribute, if set indicates
-  *	that the new configuration overrides all previous peer
-  *	configurations, otherwise previous peer specific configurations
-  *	should be left untouched.
-@@ -5817,7 +5901,7 @@ enum nl80211_attr_coalesce_rule {
- 
- /**
-  * enum nl80211_coalesce_condition - coalesce rule conditions
-- * @NL80211_COALESCE_CONDITION_MATCH: coalaesce Rx packets when patterns
-+ * @NL80211_COALESCE_CONDITION_MATCH: coalesce Rx packets when patterns
-  *	in a rule are matched.
-  * @NL80211_COALESCE_CONDITION_NO_MATCH: coalesce Rx packets when patterns
-  *	in a rule are not matched.
-@@ -5916,7 +6000,7 @@ enum nl80211_if_combination_attrs {
-  * enum nl80211_plink_state - state of a mesh peer link finite state machine
-  *
-  * @NL80211_PLINK_LISTEN: initial state, considered the implicit
-- *	state of non existent mesh peer links
-+ *	state of non-existent mesh peer links
-  * @NL80211_PLINK_OPN_SNT: mesh plink open frame has been sent to
-  *	this mesh peer
-  * @NL80211_PLINK_OPN_RCVD: mesh plink open frame has been received
-@@ -6209,7 +6293,7 @@ enum nl80211_feature_flags {
-  *	request to use RRM (see %NL80211_ATTR_USE_RRM) with
-  *	%NL80211_CMD_ASSOCIATE and %NL80211_CMD_CONNECT requests, which will set
-  *	the ASSOC_REQ_USE_RRM flag in the association request even if
-- *	NL80211_FEATURE_QUIET is not advertized.
-+ *	NL80211_FEATURE_QUIET is not advertised.
-  * @NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER: This device supports MU-MIMO air
-  *	sniffer which means that it can be configured to hear packets from
-  *	certain groups which can be configured by the
-@@ -6221,13 +6305,15 @@ enum nl80211_feature_flags {
-  *	the BSS that the interface that requested the scan is connected to
-  *	(if available).
-  * @NL80211_EXT_FEATURE_BSS_PARENT_TSF: Per BSS, this driver reports the
-- *	time the last beacon/probe was received. The time is the TSF of the
-- *	BSS that the interface that requested the scan is connected to
-- *	(if available).
-+ *	time the last beacon/probe was received. For a non-MLO connection, the
-+ *	time is the TSF of the BSS that the interface that requested the scan is
-+ *	connected to (if available). For an MLO connection, the time is the TSF
-+ *	of the BSS corresponding with link ID specified in the scan request (if
-+ *	specified).
-  * @NL80211_EXT_FEATURE_SET_SCAN_DWELL: This driver supports configuration of
-  *	channel dwell time.
-  * @NL80211_EXT_FEATURE_BEACON_RATE_LEGACY: Driver supports beacon rate
-- *	configuration (AP/mesh), supporting a legacy (non HT/VHT) rate.
-+ *	configuration (AP/mesh), supporting a legacy (non-HT/VHT) rate.
-  * @NL80211_EXT_FEATURE_BEACON_RATE_HT: Driver supports beacon rate
-  *	configuration (AP/mesh) with HT rates.
-  * @NL80211_EXT_FEATURE_BEACON_RATE_VHT: Driver supports beacon rate
-@@ -6400,6 +6486,12 @@ enum nl80211_feature_flags {
-  *	in authentication and deauthentication frames sent to unassociated peer
-  *	using @NL80211_CMD_FRAME.
-  *
-+ * @NL80211_EXT_FEATURE_OWE_OFFLOAD: Driver/Device wants to do OWE DH IE
-+ *	handling in station mode.
-+ *
-+ * @NL80211_EXT_FEATURE_OWE_OFFLOAD_AP: Driver/Device wants to do OWE DH IE
-+ *	handling in AP mode.
-+ *
-  * @NUM_NL80211_EXT_FEATURES: number of extended features.
-  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
-  */
-@@ -6471,6 +6563,8 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_PUNCT,
- 	NL80211_EXT_FEATURE_SECURE_NAN,
- 	NL80211_EXT_FEATURE_AUTH_AND_DEAUTH_RANDOM_TA,
-+	NL80211_EXT_FEATURE_OWE_OFFLOAD,
-+	NL80211_EXT_FEATURE_OWE_OFFLOAD_AP,
- 
- 	/* add new features before the definition below */
- 	NUM_NL80211_EXT_FEATURES,
-@@ -6555,7 +6649,7 @@ enum nl80211_timeout_reason {
-  *	request parameters IE in the probe request
-  * @NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP: accept broadcast probe responses
-  * @NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE: send probe request frames at
-- *	rate of at least 5.5M. In case non OCE AP is discovered in the channel,
-+ *	rate of at least 5.5M. In case non-OCE AP is discovered in the channel,
-  *	only the first probe req in the channel will be sent in high rate.
-  * @NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION: allow probe request
-  *	tx deferral (dot11FILSProbeDelay shall be set to 15ms)
-@@ -6591,7 +6685,7 @@ enum nl80211_timeout_reason {
-  *	received on the 2.4/5 GHz channels to actively scan only the 6GHz
-  *	channels on which APs are expected to be found. Note that when not set,
-  *	the scan logic would scan all 6GHz channels, but since transmission of
-- *	probe requests on non PSC channels is limited, it is highly likely that
-+ *	probe requests on non-PSC channels is limited, it is highly likely that
-  *	these channels would passively be scanned. Also note that when the flag
-  *	is set, in addition to the colocated APs, PSC channels would also be
-  *	scanned if the user space has asked for it.
-@@ -6923,7 +7017,7 @@ enum nl80211_nan_func_term_reason {
-  *	The instance ID for the follow up Service Discovery Frame. This is u8.
-  * @NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID: relevant if the function's type
-  *	is follow up. This is a u8.
-- *	The requestor instance ID for the follow up Service Discovery Frame.
-+ *	The requester instance ID for the follow up Service Discovery Frame.
-  * @NL80211_NAN_FUNC_FOLLOW_UP_DEST: the MAC address of the recipient of the
-  *	follow up Service Discovery Frame. This is a binary attribute.
-  * @NL80211_NAN_FUNC_CLOSE_RANGE: is this function limited for devices in a
-@@ -7313,7 +7407,7 @@ enum nl80211_peer_measurement_attrs {
-  * @NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED: flag attribute indicating if
-  *	trigger based ranging measurement is supported
-  * @NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED: flag attribute indicating
-- *	if non trigger based ranging measurement is supported
-+ *	if non-trigger-based ranging measurement is supported
-  *
-  * @NUM_NL80211_PMSR_FTM_CAPA_ATTR: internal
-  * @NL80211_PMSR_FTM_CAPA_ATTR_MAX: highest attribute number
-@@ -7367,7 +7461,7 @@ enum nl80211_peer_measurement_ftm_capa {
-  *      if neither %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED nor
-  *	%NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set, EDCA based
-  *	ranging will be used.
-- * @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED: request non trigger based
-+ * @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED: request non-trigger-based
-  *	ranging measurement (flag)
-  *	This attribute and %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED are
-  *	mutually exclusive.
-@@ -7445,7 +7539,7 @@ enum nl80211_peer_measurement_ftm_failure_reasons {
-  * @NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS: number of FTM Request frames
-  *	transmitted (u32, optional)
-  * @NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES: number of FTM Request frames
-- *	that were acknowleged (u32, optional)
-+ *	that were acknowledged (u32, optional)
-  * @NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME: retry time received from the
-  *	busy peer (u32, seconds)
-  * @NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP: actual number of bursts exponent
-@@ -7606,7 +7700,7 @@ enum nl80211_iftype_akm_attributes {
-  * @NL80211_FILS_DISCOVERY_ATTR_INT_MIN: Minimum packet interval (u32, TU).
-  *	Allowed range: 0..10000 (TU = Time Unit)
-  * @NL80211_FILS_DISCOVERY_ATTR_INT_MAX: Maximum packet interval (u32, TU).
-- *	Allowed range: 0..10000 (TU = Time Unit)
-+ *	Allowed range: 0..10000 (TU = Time Unit). If set to 0, the feature is disabled.
-  * @NL80211_FILS_DISCOVERY_ATTR_TMPL: Template data for FILS discovery action
-  *	frame including the headers.
-  *
-@@ -7639,7 +7733,8 @@ enum nl80211_fils_discovery_attributes {
-  *
-  * @NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT: Maximum packet interval (u32, TU).
-  *	Allowed range: 0..20 (TU = Time Unit). IEEE P802.11ax/D6.0
-- *	26.17.2.3.2 (AP behavior for fast passive scanning).
-+ *	26.17.2.3.2 (AP behavior for fast passive scanning). If set to 0, the feature is
-+ *	disabled.
-  * @NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL: Unsolicited broadcast probe response
-  *	frame template (binary).
-  *
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0025-bump-version-to-6.7.patch b/recipes-wifi/iw/patches-mlo/0025-bump-version-to-6.7.patch
deleted file mode 100644
index 89cdbb7..0000000
--- a/recipes-wifi/iw/patches-mlo/0025-bump-version-to-6.7.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 52ae9650b3a09306608cc266bd2ca5b4d789d453 Mon Sep 17 00:00:00 2001
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Thu, 21 Dec 2023 12:51:14 +0100
-Subject: [PATCH 25/28] bump version to 6.7
-
-This already has some "will be 6.8" content, but
-that's not entirely closed yet.
-
-Change-Id: I16beefdf8b5e37fc72948d8a874772dc8c97e7b2
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- version.sh | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/version.sh b/version.sh
-index 9895056..3091e1e 100755
---- a/version.sh
-+++ b/version.sh
-@@ -1,6 +1,6 @@
- #!/bin/sh
- 
--VERSION="5.19"
-+VERSION="6.7"
- OUT="$1"
- 
- # get the absolute path for the OUT file
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/0026-update-nl80211.h.patch b/recipes-wifi/iw/patches-mlo/0026-update-nl80211.h.patch
deleted file mode 100644
index 6c12bd8..0000000
--- a/recipes-wifi/iw/patches-mlo/0026-update-nl80211.h.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-From c49eb9ee6847953b24ba265add49fa4ec587c7a8 Mon Sep 17 00:00:00 2001
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Thu, 21 Dec 2023 20:42:17 +0100
-Subject: [PATCH 26/28] update nl80211.h
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- info.c    |  1 +
- nl80211.h | 29 +++++++++++++++++++++++++++++
- 2 files changed, 30 insertions(+)
-
-diff --git a/info.c b/info.c
-index 317e7a3..40dcc81 100644
---- a/info.c
-+++ b/info.c
-@@ -172,6 +172,7 @@ static void ext_feat_print(enum nl80211_ext_feature_index idx)
- 	ext_feat_case(AUTH_AND_DEAUTH_RANDOM_TA, "random auth/deauth transmitter address");
- 	ext_feat_case(OWE_OFFLOAD, "OWE DH element handling offload (client)");
- 	ext_feat_case(OWE_OFFLOAD_AP, "OWE DH element handling offload (AP)");
-+	ext_feat_case(DFS_CONCURRENT, "DFS channel use under concurrent DFS master");
- 	}
- }
- 
-diff --git a/nl80211.h b/nl80211.h
-index a682b54..1ccdcae 100644
---- a/nl80211.h
-+++ b/nl80211.h
-@@ -4256,6 +4256,14 @@ enum nl80211_wmm_rule {
-  *	in current regulatory domain.
-  * @NL80211_FREQUENCY_ATTR_PSD: Power spectral density (in dBm) that
-  *	is allowed on this channel in current regulatory domain.
-+ * @NL80211_FREQUENCY_ATTR_DFS_CONCURRENT: Operation on this channel is
-+ *	allowed for peer-to-peer or adhoc communication under the control
-+ *	of a DFS master which operates on the same channel (FCC-594280 D01
-+ *	Section B.3). Should be used together with %NL80211_RRF_DFS only.
-+ * @NL80211_FREQUENCY_ATTR_NO_UHB_VLP_CLIENT: Client connection to VLP AP
-+ *	not allowed using this channel
-+ * @NL80211_FREQUENCY_ATTR_NO_UHB_AFC_CLIENT: Client connection to AFC AP
-+ *	not allowed using this channel
-  * @NL80211_FREQUENCY_ATTR_MAX: highest frequency attribute number
-  *	currently defined
-  * @__NL80211_FREQUENCY_ATTR_AFTER_LAST: internal use
-@@ -4295,6 +4303,9 @@ enum nl80211_frequency_attr {
- 	NL80211_FREQUENCY_ATTR_NO_320MHZ,
- 	NL80211_FREQUENCY_ATTR_NO_EHT,
- 	NL80211_FREQUENCY_ATTR_PSD,
-+	NL80211_FREQUENCY_ATTR_DFS_CONCURRENT,
-+	NL80211_FREQUENCY_ATTR_NO_UHB_VLP_CLIENT,
-+	NL80211_FREQUENCY_ATTR_NO_UHB_AFC_CLIENT,
- 
- 	/* keep last */
- 	__NL80211_FREQUENCY_ATTR_AFTER_LAST,
-@@ -4500,6 +4511,12 @@ enum nl80211_sched_scan_match_attr {
-  * @NL80211_RRF_NO_320MHZ: 320MHz operation not allowed
-  * @NL80211_RRF_NO_EHT: EHT operation not allowed
-  * @NL80211_RRF_PSD: Ruleset has power spectral density value
-+ * @NL80211_RRF_DFS_CONCURRENT: Operation on this channel is allowed for
-+	peer-to-peer or adhoc communication under the control of a DFS master
-+	which operates on the same channel (FCC-594280 D01 Section B.3).
-+	Should be used together with %NL80211_RRF_DFS only.
-+ * @NL80211_RRF_NO_UHB_VLP_CLIENT: Client connection to VLP AP not allowed
-+ * @NL80211_RRF_NO_UHB_AFC_CLIENT: Client connection to AFC AP not allowed
-  */
- enum nl80211_reg_rule_flags {
- 	NL80211_RRF_NO_OFDM		= 1<<0,
-@@ -4521,6 +4538,9 @@ enum nl80211_reg_rule_flags {
- 	NL80211_RRF_NO_320MHZ		= 1<<18,
- 	NL80211_RRF_NO_EHT		= 1<<19,
- 	NL80211_RRF_PSD			= 1<<20,
-+	NL80211_RRF_DFS_CONCURRENT	= 1<<21,
-+	NL80211_RRF_NO_UHB_VLP_CLIENT	= 1<<22,
-+	NL80211_RRF_NO_UHB_AFC_CLIENT	= 1<<23,
- };
- 
- #define NL80211_RRF_PASSIVE_SCAN	NL80211_RRF_NO_IR
-@@ -5076,9 +5096,12 @@ enum nl80211_bss_use_for {
-  *	BSS isn't possible
-  * @NL80211_BSS_CANNOT_USE_NSTR_NONPRIMARY: NSTR nonprimary links aren't
-  *	supported by the device, and this BSS entry represents one.
-+ * @NL80211_BSS_CANNOT_USE_UHB_PWR_MISMATCH: STA is not supporting
-+ *	the AP power type (SP, VLP, AP) that the AP uses.
-  */
- enum nl80211_bss_cannot_use_reasons {
- 	NL80211_BSS_CANNOT_USE_NSTR_NONPRIMARY	= 1 << 0,
-+	NL80211_BSS_CANNOT_USE_UHB_PWR_MISMATCH	= 1 << 1,
- };
- 
- /**
-@@ -6492,6 +6515,11 @@ enum nl80211_feature_flags {
-  * @NL80211_EXT_FEATURE_OWE_OFFLOAD_AP: Driver/Device wants to do OWE DH IE
-  *	handling in AP mode.
-  *
-+ * @NL80211_EXT_FEATURE_DFS_CONCURRENT: The device supports peer-to-peer or
-+ *	ad hoc operation on DFS channels under the control of a concurrent
-+ *	DFS master on the same channel as described in FCC-594280 D01
-+ *	(Section B.3). This, for example, allows P2P GO and P2P clients to
-+ *	operate on DFS channels as long as there's a concurrent BSS connection.
-  * @NUM_NL80211_EXT_FEATURES: number of extended features.
-  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
-  */
-@@ -6565,6 +6593,7 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_AUTH_AND_DEAUTH_RANDOM_TA,
- 	NL80211_EXT_FEATURE_OWE_OFFLOAD,
- 	NL80211_EXT_FEATURE_OWE_OFFLOAD_AP,
-+	NL80211_EXT_FEATURE_DFS_CONCURRENT,
- 
- 	/* add new features before the definition below */
- 	NUM_NL80211_EXT_FEATURES,
--- 
-2.39.2
-
diff --git a/recipes-wifi/iw/patches-mlo/patches.inc b/recipes-wifi/iw/patches-mlo/patches.inc
index 09d5579..5c18fcd 100644
--- a/recipes-wifi/iw/patches-mlo/patches.inc
+++ b/recipes-wifi/iw/patches-mlo/patches.inc
@@ -1,31 +1,13 @@
 #patch patches (come from openwrt/lede/target/linux/mediatek)
 SRC_URI_append = " \
-    file://0001-iw-info-print-PMSR-capabilities.patch \
-    file://0002-iw-add-cac-background-command.patch \
-    file://0003-iw-info-fix-bug-reading-preambles-and-bandwidths.patch \
-    file://0004-iw-add-support-for-retrieving-keys.patch \
-    file://0005-iw-event-fix-printf-format-error.patch \
-    file://0006-update-nl80211.h.patch \
-    file://0007-util-add-support-for-320Mhz-bandwidth.patch \
-    file://0008-util-add-support-for-320MHz-bandwidth-without-cf1.patch \
-    file://0009-iw-scan-set-NL80211_SCAN_FLAG_COLOCATED_6GHZ-in-case.patch \
-    file://0010-link-fix-some-formatting.patch \
-    file://0011-link-update-for-MLO.patch \
-    file://0012-interface-print-links.patch \
-    file://0013-util-don-t-print-EHT-info-if-not-present.patch \
-    file://0014-iw-S1G-add-frequency-set-in-kHz-and-offset-options.patch \
-    file://0015-iw-S1G-add-parsing-for-802.11ah-scan-IE-s.patch \
-    file://0016-iw-S1G-add-list-command-support-for-802.11ah.patch \
-    file://0017-iw-Fix-EHT-rates-printing.patch \
-    file://0018-iw-add-more-extended-capa-bits.patch \
-    file://0019-iw-fix-attribute-size-mismatch.patch \
-    file://0020-iw-connect-Fix-segfault-during-open-authentication.patch \
-    file://0021-update-nl80211.h.patch \
-    file://0022-iw-S1G-add-802.11ah-support-for-link-command-display.patch \
-    file://0023-iw-allow-extra-cflags.patch \
-    file://0024-update-nl80211.h.patch \
-    file://0025-bump-version-to-6.7.patch \
-    file://0026-update-nl80211.h.patch \
-    file://0027-Revert-iw-allow-specifying-CFLAGS-LIBS-externally.patch \
-    file://0028-survey-bss-rx-time.patch \
+    file://0001-iw-refactor-frequency-help.patch \
+    file://0002-iw-add-puncturing-support.patch \
+    file://0003-util-clarify-comment-about-parsed-pointer.patch \
+    file://0004-iw-remove-sizer-section-and-related-code.patch \
+    file://0005-Revert-iw-allow-specifying-CFLAGS-LIBS-externally.patch \
+    file://0006-survey-bss-rx-time.patch \
+    file://0007-iw-support-link-id-in-set-bitrates-command.patch \
+    file://0008-iw-add-per-link-txpower-config.patch \
+    file://0009-mtk-wifi-iw-dump-links-information-in-station-dump.patch \
+    file://0010-iw-add-per-radio-antenna-config.patch \
     "
diff --git a/recipes-wifi/iw/patches/010-Revert-iw-allow-specifying-CFLAGS-LIBS-externally.patch b/recipes-wifi/iw/patches/010-Revert-iw-allow-specifying-CFLAGS-LIBS-externally.patch
index 1254efa..1c93f00 100644
--- a/recipes-wifi/iw/patches/010-Revert-iw-allow-specifying-CFLAGS-LIBS-externally.patch
+++ b/recipes-wifi/iw/patches/010-Revert-iw-allow-specifying-CFLAGS-LIBS-externally.patch
@@ -16,7 +16,7 @@
 
 --- a/Makefile
 +++ b/Makefile
-@@ -45,30 +45,30 @@ NLLIBNAME = libnl-1
+@@ -46,30 +46,30 @@ NLLIBNAME = libnl-1
  endif
  
  ifeq ($(NL2FOUND),Y)
@@ -55,7 +55,7 @@
  NLLIBNAME = libnl-3.1
  endif
  
-@@ -76,8 +76,8 @@ ifeq ($(NLLIBNAME),)
+@@ -77,8 +77,8 @@ ifeq ($(NLLIBNAME),)
  $(error Cannot find development files for any supported version of libnl)
  endif
  
diff --git a/recipes-wifi/iw/patches/1000-Add-support-for-5G-U-NII-3-6G-BW320.patch b/recipes-wifi/iw/patches/1000-Add-support-for-5G-U-NII-3-6G-BW320.patch
index a69e063..e71ca9b 100644
--- a/recipes-wifi/iw/patches/1000-Add-support-for-5G-U-NII-3-6G-BW320.patch
+++ b/recipes-wifi/iw/patches/1000-Add-support-for-5G-U-NII-3-6G-BW320.patch
@@ -1,4 +1,4 @@
-From ed0fd20be0b27d0f3f95819228c87c771a8c3c43 Mon Sep 17 00:00:00 2001
+From 5201393755c54df7469a36d771f6eefdbf230fd1 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 2 Mar 2023 10:07:05 +0800
 Subject: [PATCH] Add support for 5G U-NII-3 & 6G BW320
@@ -6,42 +6,34 @@
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  phy.c  |  4 ++--
- util.c | 11 ++++++-----
- 2 files changed, 8 insertions(+), 7 deletions(-)
+ util.c | 10 +++++-----
+ 2 files changed, 7 insertions(+), 7 deletions(-)
 
 diff --git a/phy.c b/phy.c
-index 2d489ef..4fa66b7 100644
+index 4722125..abe94db 100644
 --- a/phy.c
 +++ b/phy.c
 @@ -200,13 +200,13 @@ static int handle_freq(struct nl80211_state *state, struct nl_msg *msg,
  
  COMMAND(set, freq,
- 	"<freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz]\n"
+ 	"<freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz|320MHz]\n"
 -	"<control freq> [5|10|20|40|80|80+80|160] [<center1_freq> [<center2_freq>]]",
 +	"<control freq> [5|10|20|40|80|80+80|160|320] [<center1_freq> [<center2_freq>]]",
  	NL80211_CMD_SET_WIPHY, 0, CIB_PHY, handle_freq,
  	"Set frequency/channel the hardware is using, including HT\n"
  	"configuration.");
  COMMAND(set, freq,
- 	"<freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz]\n"
+ 	"<freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz|160MHz|320MHz]\n"
 -	"<control freq> [5|10|20|40|80|80+80|160] [<center1_freq> [<center2_freq>]]",
 +	"<control freq> [5|10|20|40|80|80+80|160|320] [<center1_freq> [<center2_freq>]]",
  	NL80211_CMD_SET_WIPHY, 0, CIB_NETDEV, handle_freq, NULL);
  
- static int handle_chan(struct nl80211_state *state, struct nl_msg *msg,
+ static int handle_freq_khz(struct nl80211_state *state, struct nl_msg *msg,
 diff --git a/util.c b/util.c
-index 8a2ba10..7126ce8 100644
+index d36dbdc..818dc96 100644
 --- a/util.c
 +++ b/util.c
-@@ -471,6 +471,7 @@ enum nl80211_chan_width str_to_bw(const char *str)
- 		{ .name = "80", .val = NL80211_CHAN_WIDTH_80, },
- 		{ .name = "80+80", .val = NL80211_CHAN_WIDTH_80P80, },
- 		{ .name = "160", .val = NL80211_CHAN_WIDTH_160, },
-+		{ .name = "320", .val = NL80211_CHAN_WIDTH_320, },
- 	};
- 	unsigned int i;
- 
-@@ -1690,11 +1691,11 @@ int get_cf1(const struct chanmode *chanmode, unsigned long freq)
+@@ -1750,11 +1750,11 @@ int get_cf1(const struct chanmode *chanmode, unsigned long freq)
  {
  	unsigned int cf1 = freq, j;
  	unsigned int bw80[] = { 5180, 5260, 5500, 5580, 5660, 5745,
@@ -55,9 +47,9 @@
 +				6835, 6915, 6995 };
 +	unsigned int bw160[] = { 5180, 5500, 5745, 5955, 6115, 6275,
 +				 6435, 6595, 6755, 6915 };
+ 	/* based on 11be D2 E.1 Country information and operating classes */
+ 	unsigned int bw320[] = {5955, 6115, 6275, 6435, 6595, 6755};
  
- 	switch (chanmode->width) {
- 	case NL80211_CHAN_WIDTH_80:
 -- 
 2.18.0
 
diff --git a/recipes-wifi/iwinfo/iwinfo_git.bb b/recipes-wifi/iwinfo/iwinfo_git.bb
index 5d02eaf..15ef360 100644
--- a/recipes-wifi/iwinfo/iwinfo_git.bb
+++ b/recipes-wifi/iwinfo/iwinfo_git.bb
@@ -8,7 +8,7 @@
 SECTION = "base"
 DEPENDS += "uci lua ubus libnl-tiny"
 
-SRCREV = "79a96150647110fb03852bc321bd37159d63ae1a"
+SRCREV = "215820132b943b700d56441ecbd5a4efa09edc7c"
 
 SRC_URI = "git://git.openwrt.org/project/iwinfo.git;branch=master \
            file://0002-fix-order-of-linker-cmdline-to-help-linking.patch \
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0031-mac80211-mtk-add-callback-function-to-set-QoS-map-in.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0031-mac80211-mtk-add-callback-function-to-set-QoS-map-in.patch
new file mode 100644
index 0000000..8dd492d
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0031-mac80211-mtk-add-callback-function-to-set-QoS-map-in.patch
@@ -0,0 +1,95 @@
+From 843e2b25433dc6c3cbc2ff4a754bef091cabe54b Mon Sep 17 00:00:00 2001
+From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+Date: Mon, 24 Jun 2024 17:50:08 +0800
+Subject: [PATCH] mac80211: mtk: add callback function to set QoS map in HW
+
+The mapping from IP DSCP to IEEE 802.11 user priority may be customized.
+Therefore, the mapping needs to be passed to HW, so that the QoS type of traffic can be mapped in a consistent manner for both SW and HW paths.
+
+Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+---
+ include/net/mac80211.h    |  3 +++
+ net/mac80211/cfg.c        |  2 +-
+ net/mac80211/driver-ops.h | 16 ++++++++++++++++
+ net/mac80211/trace.h      |  6 ++++++
+ 4 files changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 5c26752..b622c76 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -3982,6 +3982,7 @@ struct ieee80211_prep_tx_info {
+  *	disable background CAC/radar detection.
+  * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
+  *	resolve a path for hardware flow offloading
++ * @set_qos_map: Set QoS mapping information to driver.
+  */
+ struct ieee80211_ops {
+ 	void (*tx)(struct ieee80211_hw *hw,
+@@ -4321,6 +4322,8 @@ struct ieee80211_ops {
+ 				     struct net_device_path_ctx *ctx,
+ 				     struct net_device_path *path);
+ #endif
++	int (*set_qos_map)(struct ieee80211_vif *vif,
++			   struct cfg80211_qos_map *qos_map);
+ };
+ 
+ /**
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index ffb60a2..80fba54 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4040,7 +4040,7 @@ static int ieee80211_set_qos_map(struct wiphy *wiphy,
+ 	if (old_qos_map)
+ 		kfree_rcu(old_qos_map, rcu_head);
+ 
+-	return 0;
++	return drv_set_qos_map(sdata->local, sdata, qos_map);
+ }
+ 
+ static int ieee80211_set_ap_chanwidth(struct wiphy *wiphy,
+diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
+index 9e8003f..d4723dc 100644
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1525,4 +1525,20 @@ static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
+ }
+ #endif
+ 
++static inline int drv_set_qos_map(struct ieee80211_local *local,
++				  struct ieee80211_sub_if_data *sdata,
++				  struct cfg80211_qos_map *qos_map)
++{
++	int ret = -EOPNOTSUPP;
++
++	might_sleep();
++
++	trace_drv_set_qos_map(local, sdata);
++	if (local->ops->set_qos_map)
++		ret = local->ops->set_qos_map(&sdata->vif, qos_map);
++	trace_drv_return_int(local, ret);
++
++	return ret;
++}
++
+ #endif /* __MAC80211_DRIVER_OPS */
+diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
+index d15dadd..c6fc75e 100644
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -2929,6 +2929,12 @@ TRACE_EVENT(bss_color_bitmap,
+ 	)
+ );
+ 
++DEFINE_EVENT(local_sdata_evt, drv_set_qos_map,
++	TP_PROTO(struct ieee80211_local *local,
++		 struct ieee80211_sub_if_data *sdata),
++	TP_ARGS(local, sdata)
++);
++
+ #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
+ 
+ #undef TRACE_INCLUDE_PATH
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0031-mac80211-mtk-add-exported-function-for-SoftMAC-drive.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0031-mac80211-mtk-add-exported-function-for-SoftMAC-drive.patch
deleted file mode 100644
index a26fc33..0000000
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0031-mac80211-mtk-add-exported-function-for-SoftMAC-drive.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From ac1e8443a250f418b6124e7b4f4ea65a03c4d02b Mon Sep 17 00:00:00 2001
-From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
-Date: Fri, 26 Apr 2024 09:29:39 +0800
-Subject: [PATCH] mac80211: mtk: add exported function for SoftMAC driver to
- get QoS map
-
-The mapping from IP DSCP to IEEE 802.11 user priority may be customized.
-Therefore, driver needs to pass the mapping to HW, so that the QoS type of traffic can be mapped in a consistent manner for both SW and HW paths.
-
-Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
----
- include/net/mac80211.h | 12 ++++++++++++
- net/mac80211/util.c    | 10 +++++++++-
- 2 files changed, 21 insertions(+), 1 deletion(-)
-
-diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index 5c26752..420963f 100644
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -6942,4 +6942,16 @@ static inline bool ieee80211_is_tx_data(struct sk_buff *skb)
-  * @hw: pointer as obtained from ieee80211_alloc_hw()
-  */
- unsigned long ieee80211_get_scanning(struct ieee80211_hw *hw);
-+
-+/**
-+ * ieee80211_get_qos_map - get QoS mapping information.
-+ *
-+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
-+ *
-+ * Return: Pointer to the QoS mapping information.
-+ *
-+ * Note that the return value is an RCU-protected pointer, so rcu_read_lock()
-+ * must be held when calling this function.
-+ */
-+struct cfg80211_qos_map *ieee80211_get_qos_map(struct ieee80211_vif *vif);
- #endif /* MAC80211_H */
-diff --git a/net/mac80211/util.c b/net/mac80211/util.c
-index e07fe73..865c4ac 100644
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -4643,4 +4643,12 @@ unsigned long ieee80211_get_scanning(struct ieee80211_hw *hw)
- 
- 	return local->scanning;
- }
--EXPORT_SYMBOL(ieee80211_get_scanning);
-\ No newline at end of file
-+EXPORT_SYMBOL(ieee80211_get_scanning);
-+
-+struct cfg80211_qos_map *ieee80211_get_qos_map(struct ieee80211_vif *vif)
-+{
-+	struct mac80211_qos_map *qos_map = rcu_dereference(vif_to_sdata(vif)->qos_map);
-+
-+	return qos_map ? &qos_map->qos_map : NULL;
-+}
-+EXPORT_SYMBOL(ieee80211_get_qos_map);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-9900-mac80211-mtk-mask-kernel-version-limitation-and-fill.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-9900-mac80211-mtk-mask-kernel-version-limitation-and-fill.patch
index e6288ed..fd446aa 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-9900-mac80211-mtk-mask-kernel-version-limitation-and-fill.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-9900-mac80211-mtk-mask-kernel-version-limitation-and-fill.patch
@@ -1,7 +1,7 @@
-From bad36168042569eb4c7ab6a549f7444a40e299c3 Mon Sep 17 00:00:00 2001
+From 026c9872e3460f1632b60324e062016887b31134 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 11 Mar 2022 11:34:11 +0800
-Subject: [PATCH 9900/9903] mac80211: mtk: mask kernel version limitation and
+Subject: [PATCH 9900/9902] mac80211: mtk: mask kernel version limitation and
  fill forward path in kernel 5.4
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -13,10 +13,10 @@
  4 files changed, 10 deletions(-)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index 91affd5..42192cd 100644
+index b622c76..c6625c2 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -4307,13 +4307,11 @@ struct ieee80211_ops {
+@@ -4315,13 +4315,11 @@ struct ieee80211_ops {
  				     struct ieee80211_sta *sta, u8 flowid);
  	int (*set_radar_background)(struct ieee80211_hw *hw,
  				    struct cfg80211_chan_def *chandef);
@@ -27,11 +27,11 @@
  				     struct net_device_path_ctx *ctx,
  				     struct net_device_path *path);
 -#endif
+ 	int (*set_qos_map)(struct ieee80211_vif *vif,
+ 			   struct cfg80211_qos_map *qos_map);
  };
- 
- /**
 diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
-index 9e8003f..19e2ada 100644
+index d4723dc..91ea8b2 100644
 --- a/net/mac80211/driver-ops.h
 +++ b/net/mac80211/driver-ops.h
 @@ -1501,7 +1501,6 @@ static inline void drv_twt_teardown_request(struct ieee80211_local *local,
@@ -42,18 +42,19 @@
  static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
  					    struct ieee80211_sub_if_data *sdata,
  					    struct ieee80211_sta *sta,
-@@ -1523,6 +1522,5 @@ static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
+@@ -1523,7 +1522,6 @@ static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
  
  	return ret;
  }
 -#endif
  
- #endif /* __MAC80211_DRIVER_OPS */
+ static inline int drv_set_qos_map(struct ieee80211_local *local,
+ 				  struct ieee80211_sub_if_data *sdata,
 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index 00b0443..a7169a5 100644
+index 138ad79..4b92867 100644
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -853,7 +853,6 @@ static const struct net_device_ops ieee80211_monitorif_ops = {
+@@ -875,7 +875,6 @@ static const struct net_device_ops ieee80211_monitorif_ops = {
  
  };
  
@@ -61,7 +62,7 @@
  static int ieee80211_netdev_fill_forward_path(struct net_device_path_ctx *ctx,
  					      struct net_device_path *path)
  {
-@@ -911,7 +910,6 @@ out:
+@@ -933,7 +932,6 @@ out:
  
  	return ret;
  }
@@ -69,7 +70,7 @@
  
  static const struct net_device_ops ieee80211_dataif_8023_ops = {
  #if LINUX_VERSION_IS_LESS(4,10,0)
-@@ -930,9 +928,7 @@ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+@@ -952,9 +950,7 @@ static const struct net_device_ops ieee80211_dataif_8023_ops = {
  #else
  	.ndo_get_stats64 = bp_ieee80211_get_stats64,
  #endif
@@ -80,7 +81,7 @@
  
  static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
 diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
-index d15dadd..8770033 100644
+index c6fc75e..6b7b46b 100644
 --- a/net/mac80211/trace.h
 +++ b/net/mac80211/trace.h
 @@ -2899,14 +2899,12 @@ TRACE_EVENT(drv_twt_teardown_request,
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-9901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-9901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
index 75abcb8..a87a9ea 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-9901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-9901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
@@ -1,23 +1,23 @@
-From 0161154c18a464bbb350bcb5ef620bd255940640 Mon Sep 17 00:00:00 2001
+From e5612cde83ef67f8fa4633f7d364e05bac6e02a3 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Wed, 18 May 2022 15:10:22 +0800
-Subject: [PATCH 9901/9903] mac80211: mtk: add fill receive path ops to get wed
+Subject: [PATCH 9901/9902] mac80211: mtk: add fill receive path ops to get wed
  idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
  include/net/mac80211.h    | 12 ++++++++++++
- net/mac80211/driver-ops.h | 13 +++++++++++++
+ net/mac80211/driver-ops.h | 14 +++++++++++++-
  net/mac80211/iface.c      | 24 ++++++++++++++++++++++++
  net/mac80211/util.c       |  9 +++++++++
- 4 files changed, 58 insertions(+)
+ 4 files changed, 58 insertions(+), 1 deletion(-)
  mode change 100644 => 100755 include/net/mac80211.h
  mode change 100644 => 100755 net/mac80211/util.c
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
 old mode 100644
 new mode 100755
-index 42192cd..8a71026
+index c6625c2..cb8b28d
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
 @@ -1798,6 +1798,13 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
@@ -34,30 +34,30 @@
  /**
   * enum ieee80211_key_flags - key flags
   *
-@@ -3975,6 +3982,8 @@ struct ieee80211_prep_tx_info {
+@@ -3982,6 +3989,8 @@ struct ieee80211_prep_tx_info {
   *	disable background CAC/radar detection.
   * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
   *	resolve a path for hardware flow offloading
 + * @net_fill_receive_path: Called from .ndo_fill_receive_path in order to
 + *	get a path for hardware flow offloading
+  * @set_qos_map: Set QoS mapping information to driver.
   */
  struct ieee80211_ops {
- 	void (*tx)(struct ieee80211_hw *hw,
-@@ -4312,6 +4321,9 @@ struct ieee80211_ops {
+@@ -4320,6 +4329,9 @@ struct ieee80211_ops {
  				     struct ieee80211_sta *sta,
  				     struct net_device_path_ctx *ctx,
  				     struct net_device_path *path);
 +	int (*net_fill_receive_path)(struct ieee80211_hw *hw,
 +				     struct net_device_path_ctx *ctx,
 +				     struct net_device_path *path);
+ 	int (*set_qos_map)(struct ieee80211_vif *vif,
+ 			   struct cfg80211_qos_map *qos_map);
  };
- 
- /**
 diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
-index 19e2ada..88dedfc 100644
+index 91ea8b2..348f815 100644
 --- a/net/mac80211/driver-ops.h
 +++ b/net/mac80211/driver-ops.h
-@@ -1523,4 +1523,17 @@ static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
+@@ -1523,6 +1523,19 @@ static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
  	return ret;
  }
  
@@ -74,12 +74,20 @@
 +	return ret;
 +}
 +
+ static inline int drv_set_qos_map(struct ieee80211_local *local,
+ 				  struct ieee80211_sub_if_data *sdata,
+ 				  struct cfg80211_qos_map *qos_map)
+@@ -1538,5 +1551,4 @@ static inline int drv_set_qos_map(struct ieee80211_local *local,
+ 
+ 	return ret;
+ }
+-
  #endif /* __MAC80211_DRIVER_OPS */
 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index a7169a5..8a4f4e1 100644
+index 4b92867..c08bfbe 100644
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -911,6 +911,29 @@ out:
+@@ -933,6 +933,29 @@ out:
  	return ret;
  }
  
@@ -109,7 +117,7 @@
  static const struct net_device_ops ieee80211_dataif_8023_ops = {
  #if LINUX_VERSION_IS_LESS(4,10,0)
  	.ndo_change_mtu = __change_mtu,
-@@ -929,6 +952,7 @@ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+@@ -951,6 +974,7 @@ static const struct net_device_ops ieee80211_dataif_8023_ops = {
  	.ndo_get_stats64 = bp_ieee80211_get_stats64,
  #endif
  	.ndo_fill_forward_path = ieee80211_netdev_fill_forward_path,
@@ -120,7 +128,7 @@
 diff --git a/net/mac80211/util.c b/net/mac80211/util.c
 old mode 100644
 new mode 100755
-index 8d36b05..d26a2b8
+index e07fe73..809eb37
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
 @@ -898,6 +898,15 @@ struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-9902-mac80211-mtk-add-support-for-letting-drivers-registe.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-9902-mac80211-mtk-add-support-for-letting-drivers-registe.patch
index 414693e..ea8fde2 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-9902-mac80211-mtk-add-support-for-letting-drivers-registe.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-9902-mac80211-mtk-add-support-for-letting-drivers-registe.patch
@@ -1,7 +1,7 @@
-From fdc7f27785b716eae1e02df73c095ecfe2677d9f Mon Sep 17 00:00:00 2001
+From d62db23d46d1887aff58c76b0eb9960a46afb9bf Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 28 Mar 2023 10:53:31 +0800
-Subject: [PATCH 9902/9903] mac80211: mtk: add support for letting drivers
+Subject: [PATCH 9902/9902] mac80211: mtk: add support for letting drivers
  register tc offload support
 
 On newer MediaTek SoCs (e.g. MT7986), WLAN->WLAN or WLAN->Ethernet flows can
@@ -18,10 +18,10 @@
  5 files changed, 70 insertions(+), 1 deletion(-)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index 8a71026..861bc9a 100755
+index cb8b28d..6104072 100755
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -3984,6 +3984,10 @@ struct ieee80211_prep_tx_info {
+@@ -3991,6 +3991,10 @@ struct ieee80211_prep_tx_info {
   *	resolve a path for hardware flow offloading
   * @net_fill_receive_path: Called from .ndo_fill_receive_path in order to
   *	get a path for hardware flow offloading
@@ -29,10 +29,10 @@
 + *	flow offloading for flows originating from the vif.
 + *	Note that the driver must not assume that the vif driver_data is valid
 + *	at this point, since the callback can be called during netdev teardown.
+  * @set_qos_map: Set QoS mapping information to driver.
   */
  struct ieee80211_ops {
- 	void (*tx)(struct ieee80211_hw *hw,
-@@ -4324,6 +4328,11 @@ struct ieee80211_ops {
+@@ -4332,6 +4336,11 @@ struct ieee80211_ops {
  	int (*net_fill_receive_path)(struct ieee80211_hw *hw,
  				     struct net_device_path_ctx *ctx,
  				     struct net_device_path *path);
@@ -41,14 +41,14 @@
 +			    struct net_device *dev,
 +			    enum tc_setup_type type,
 +			    void *type_data);
+ 	int (*set_qos_map)(struct ieee80211_vif *vif,
+ 			   struct cfg80211_qos_map *qos_map);
  };
- 
- /**
 diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
-index 88dedfc..3ceba5e 100644
+index 348f815..f56a71f 100644
 --- a/net/mac80211/driver-ops.h
 +++ b/net/mac80211/driver-ops.h
-@@ -1536,4 +1536,21 @@ static inline int drv_net_fill_receive_path(struct ieee80211_local *local,
+@@ -1536,6 +1536,23 @@ static inline int drv_net_fill_receive_path(struct ieee80211_local *local,
  	return ret;
  }
  
@@ -69,12 +69,14 @@
 +	return ret;
 +}
 +
- #endif /* __MAC80211_DRIVER_OPS */
+ static inline int drv_set_qos_map(struct ieee80211_local *local,
+ 				  struct ieee80211_sub_if_data *sdata,
+ 				  struct cfg80211_qos_map *qos_map)
 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index 2519c14..fe7a03a 100644
+index bb5906d..b02ca21 100644
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1822,7 +1822,8 @@ void ieee80211_color_aging_work(struct work_struct *work);
+@@ -1824,7 +1824,8 @@ void ieee80211_color_aging_work(struct work_struct *work);
  /* interface handling */
  #define MAC80211_SUPPORTED_FEATURES_TX	(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \
  					 NETIF_F_HW_CSUM | NETIF_F_SG | \
@@ -85,10 +87,10 @@
  #define MAC80211_SUPPORTED_FEATURES	(MAC80211_SUPPORTED_FEATURES_TX | \
  					 MAC80211_SUPPORTED_FEATURES_RX)
 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index 8a4f4e1..f3bf837 100644
+index c08bfbe..ddeaa8f 100644
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -773,6 +773,21 @@ static int __change_mtu(struct net_device *ndev, int new_mtu){
+@@ -795,6 +795,21 @@ static int __change_mtu(struct net_device *ndev, int new_mtu){
  }
  #endif
  
@@ -110,7 +112,7 @@
  static const struct net_device_ops ieee80211_dataif_ops = {
  #if LINUX_VERSION_IS_LESS(4,10,0)
  	.ndo_change_mtu = __change_mtu,
-@@ -790,6 +805,7 @@ static const struct net_device_ops ieee80211_dataif_ops = {
+@@ -812,6 +827,7 @@ static const struct net_device_ops ieee80211_dataif_ops = {
  #else
  	.ndo_get_stats64 = bp_ieee80211_get_stats64,
  #endif
@@ -118,7 +120,7 @@
  
  };
  
-@@ -953,6 +969,7 @@ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+@@ -975,6 +991,7 @@ static const struct net_device_ops ieee80211_dataif_8023_ops = {
  #endif
  	.ndo_fill_forward_path = ieee80211_netdev_fill_forward_path,
  	.ndo_fill_receive_path = ieee80211_netdev_fill_receive_path,
@@ -127,7 +129,7 @@
  
  static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
 diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
-index 8770033..78d9803 100644
+index 6b7b46b..5aea24a 100644
 --- a/net/mac80211/trace.h
 +++ b/net/mac80211/trace.h
 @@ -2906,6 +2906,31 @@ DEFINE_EVENT(sta_event, drv_net_fill_forward_path,
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
index 54c4208..71e0e62 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
@@ -88,7 +88,7 @@
     file://mtk-0028-mac80211-mtk-backport-refactor-STA-CSA-paring-flow.patch \
     file://mtk-0029-mac80211-mtk-send-4-addr-nullfunc-after-drv_event_ca.patch \
     file://mtk-0030-mac80211-mtk-fix-incorrect-VIF-assignment-for-IEEE-8.patch \
-    file://mtk-0031-mac80211-mtk-add-exported-function-for-SoftMAC-drive.patch \
+    file://mtk-0031-mac80211-mtk-add-callback-function-to-set-QoS-map-in.patch \
     file://mtk-0032-mac80211-mtk-fix-inconsistent-QoS-mapping-between-AP.patch \
     file://mtk-9900-mac80211-mtk-mask-kernel-version-limitation-and-fill.patch \
     file://mtk-9901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch \
diff --git a/recipes-wifi/linux-mt76/files/patches/0018-wifi-mt76-mt7915-fix-inconsistent-QoS-mapping-betwee.patch b/recipes-wifi/linux-mt76/files/patches/0018-wifi-mt76-mt7915-fix-inconsistent-QoS-mapping-betwee.patch
index 1e80fd3..c871c60 100644
--- a/recipes-wifi/linux-mt76/files/patches/0018-wifi-mt76-mt7915-fix-inconsistent-QoS-mapping-betwee.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0018-wifi-mt76-mt7915-fix-inconsistent-QoS-mapping-betwee.patch
@@ -1,25 +1,23 @@
-From aae5bbaf6054b1bd04e31346054ddad42d85d33e Mon Sep 17 00:00:00 2001
+From 5fd6278fa4d62c140f40fe2d7ae0bd86074b2d36 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Thu, 25 Apr 2024 17:17:13 +0800
-Subject: [PATCH 18/21] wifi: mt76: mt7915: fix inconsistent QoS mapping
- between SW and HW
+Subject: [PATCH] wifi: mt76: mt7915: fix inconsistent QoS mapping between SW
+ and HW
 
 The mapping from IP DSCP to IEEE 802.11 user priority may be customized.
-Therefore, driver needs to pass the mapping to HW, so that the QoS type of traffic can be mapped in a consistent manner for both SW and HW paths.
+Therefore, the mapping needs to be passed to HW, so that the QoS type of traffic can be mapped in a consistent manner for both SW and HW paths.
 
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt76_connac_mcu.h |  1 +
- mt7915/main.c     |  5 +++++
- mt7915/mcu.c      | 37 +++++++++++++++++++++++++++++++++++++
- mt7915/mt7915.h   |  3 +++
- 4 files changed, 46 insertions(+)
+ mt7915/main.c     | 44 ++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 45 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 1dd8244..0936c1c 100644
+index 8899eea..5c25f1a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1236,6 +1236,7 @@ enum {
+@@ -1238,6 +1238,7 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -28,31 +26,15 @@
  
  enum {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 5ed84bc..c6880ca 100644
+index 5ed84bc..be11e4f 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1697,6 +1697,11 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
- 
- 	ctx->dev = NULL;
- 
-+	if (!mvif->qos_map_enabled) {
-+		mt7915_mcu_set_qos_map(dev, vif);
-+		mvif->qos_map_enabled = true;
-+	}
-+
+@@ -1619,6 +1619,49 @@ mt7915_set_frag_threshold(struct ieee80211_hw *hw, u32 val)
  	return 0;
  }
- #endif
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 446c512..64d2710 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -4212,3 +4212,40 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  
- 	return 0;
- }
-+
-+int mt7915_mcu_set_qos_map(struct mt7915_dev *dev, struct ieee80211_vif *vif)
++static int
++mt7915_set_qos_map(struct ieee80211_vif *vif, struct cfg80211_qos_map *qos_map)
 +{
 +#define IP_DSCP_NUM	64
 +	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -63,52 +45,48 @@
 +		s8 qos_map[IP_DSCP_NUM];
 +	} __packed req = {
 +		.bss_idx = mvif->mt76.idx,
-+		.qos_map_enable = false,
++		.qos_map_enable = qos_map ? true : false,
 +	};
-+	struct cfg80211_qos_map *qos_map;
 +
-+	rcu_read_lock();
-+	qos_map = ieee80211_get_qos_map(vif);
++	/* Prevent access to members of mt7915_vif before its initialization. */
++	if (!mvif->phy)
++		return -EPERM;
++
 +	if (qos_map) {
-+		struct cfg80211_dscp_range *dscp_range = qos_map->up;
-+		s8 up;
++		struct cfg80211_dscp_exception *exception = qos_map->dscp_exception;
++		struct cfg80211_dscp_range *range = qos_map->up;
++		s8 i;
++
++		for (i = 0; i < IEEE80211_NUM_UPS; ++i) {
++			u8 low = range[i].low, high = range[i].high;
 +
-+		req.qos_map_enable = true;
-+		for (up = 0; up < IEEE80211_NUM_UPS; ++up) {
-+			u8 low = dscp_range[up].low, high = dscp_range[up].high;
++			if (low < IP_DSCP_NUM && high < IP_DSCP_NUM && low <= high)
++				memset(req.qos_map + low, i, high - low + 1);
++		}
 +
-+			if (low >= IP_DSCP_NUM || high >= IP_DSCP_NUM || low > high)
-+				continue;
++		for (i = 0; i < qos_map->num_des; ++i) {
++			u8 dscp = exception[i].dscp, up = exception[i].up;
 +
-+			memset(req.qos_map + low, up, high - low + 1);
++			if (dscp < IP_DSCP_NUM && up < IEEE80211_NUM_UPS)
++				req.qos_map[dscp] = up;
 +		}
 +	}
-+	rcu_read_unlock();
 +
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(SET_QOS_MAP), &req,
-+				 sizeof(req), false);
++	return mt76_mcu_send_msg(&mvif->phy->dev->mt76, MCU_WA_EXT_CMD(SET_QOS_MAP),
++				 &req, sizeof(req), true);
 +}
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 74cd8ca..c813433 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -175,6 +175,8 @@ struct mt7915_vif {
- 
- 	struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
- 	struct cfg80211_bitrate_mask bitrate_mask;
 +
-+	bool qos_map_enabled;
- };
- 
- /* crash-dump */
-@@ -521,6 +523,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
- void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
- void mt7915_mcu_exit(struct mt7915_dev *dev);
- void mt7915_mcu_wmm_pbc_work(struct work_struct *work);
-+int mt7915_mcu_set_qos_map(struct mt7915_dev *dev, struct ieee80211_vif *vif);
- 
- static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
- {
+ static int
+ mt7915_set_radar_background(struct ieee80211_hw *hw,
+ 			    struct cfg80211_chan_def *chandef)
+@@ -1747,6 +1790,7 @@ const struct ieee80211_ops mt7915_ops = {
+ 	.add_twt_setup = mt7915_mac_add_twt_setup,
+ 	.twt_teardown_request = mt7915_twt_teardown_request,
+ 	.set_frag_threshold = mt7915_set_frag_threshold,
++	.set_qos_map = mt7915_set_qos_map,
+ 	CFG80211_TESTMODE_CMD(mt76_testmode_cmd)
+ 	CFG80211_TESTMODE_DUMP(mt76_testmode_dump)
+ #ifdef CONFIG_MAC80211_DEBUGFS
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/0021-wifi-mt76-mt7915-remove-unnecessary-register-setting.patch b/recipes-wifi/linux-mt76/files/patches/0021-wifi-mt76-mt7915-remove-unnecessary-register-setting.patch
index cc3e8cd..1f9d540 100644
--- a/recipes-wifi/linux-mt76/files/patches/0021-wifi-mt76-mt7915-remove-unnecessary-register-setting.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0021-wifi-mt76-mt7915-remove-unnecessary-register-setting.patch
@@ -1,20 +1,19 @@
-From cae043c9d117d77ed5189c8c258b7f4ea622e79f Mon Sep 17 00:00:00 2001
+From 1af0fe3345f26594c78e91681997ad3a1838fc7c Mon Sep 17 00:00:00 2001
 From: Henry Yen <henry.yen@mediatek.com>
 Date: Wed, 6 Mar 2024 12:42:06 +0800
-Subject: [PATCH 21/21] wifi: mt76: mt7915: remove unnecessary register
- settings
+Subject: [PATCH] wifi: mt76: mt7915: remove unnecessary register settings
 
 Remove unnecessary register settings from the driver layer,
 and let firmware take over the configuration control.
 
 Signed-off-by: Henry.Yen <henry.yen@mediatek.com>
 ---
- mt7915/init.c | 35 -----------------------------------
+ mt7915/init.c | 30 ------------------------------
  mt7915/mac.c  | 43 +------------------------------------------
- 2 files changed, 1 insertion(+), 77 deletions(-)
+ 2 files changed, 1 insertion(+), 72 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 19a68c5..2ae7977 100644
+index 19a68c5..15ae27a 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -475,30 +475,6 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
@@ -48,19 +47,19 @@
  	/* mt7915: disable rx rate report by default due to hw issues */
  	mt76_clear(dev, MT_DMA_DCR0(band), MT_DMA_DCR0_RXD_G5_EN);
  
-@@ -601,23 +577,12 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
+@@ -601,23 +577,17 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
  void mt7915_mac_init(struct mt7915_dev *dev)
  {
  	int i;
 -	u32 rx_len = is_mt7915(&dev->mt76) ? 0x400 : 0x680;
--
--	/* config pse qid6 wfdma port selection */
--	if (!is_mt7915(&dev->mt76) && dev->hif2)
--		mt76_rmw(dev, MT_WF_PP_TOP_RXQ_WFDMA_CF_5, 0,
--			 MT_WF_PP_TOP_RXQ_QID6_WFDMA_HIF_SEL_MASK);
--
--	mt76_rmw_field(dev, MT_MDP_DCR1, MT_MDP_DCR1_MAX_RX_LEN, rx_len);
  
+ 	/* config pse qid6 wfdma port selection */
+ 	if (!is_mt7915(&dev->mt76) && dev->hif2)
+ 		mt76_rmw(dev, MT_WF_PP_TOP_RXQ_WFDMA_CF_5, 0,
+ 			 MT_WF_PP_TOP_RXQ_QID6_WFDMA_HIF_SEL_MASK);
+ 
+-	mt76_rmw_field(dev, MT_MDP_DCR1, MT_MDP_DCR1_MAX_RX_LEN, rx_len);
+-
  	if (!is_mt7915(&dev->mt76))
  		mt76_clear(dev, MT_MDP_DCR2, MT_MDP_DCR2_RX_TRANS_SHORT);
  	else
diff --git a/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch b/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
index 1ca58f2..646d0bf 100644
--- a/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
@@ -1,8 +1,7 @@
-From 95297b6768f36fbe3a9d7c6c8bef138e4f3c3fdb Mon Sep 17 00:00:00 2001
+From 57ca0074490c096cf61f5857ceb233f9a763cf82 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
-Subject: [PATCH 1000/1051] wifi: mt76: mt7915: add mtk internal debug tools
- for mt76
+Subject: [PATCH] wifi: mt76: mt7915: add mtk internal debug tools for mt76
 
 ---
  mt76_connac_mcu.h     |    6 +
@@ -24,10 +23,10 @@
  create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 99cdd1b..a8690cd 100644
+index 79d248d..78ddc6e 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1195,6 +1195,7 @@ enum {
+@@ -1197,6 +1197,7 @@ enum {
  	MCU_EXT_CMD_SET_TX_POWER_CTRL = 0x11,
  	MCU_EXT_CMD_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_CMD_TXBF_ACTION = 0x1e,
@@ -35,7 +34,7 @@
  	MCU_EXT_CMD_EFUSE_BUFFER_MODE = 0x21,
  	MCU_EXT_CMD_THERMAL_PROT = 0x23,
  	MCU_EXT_CMD_STA_REC_UPDATE = 0x25,
-@@ -1218,6 +1219,11 @@ enum {
+@@ -1220,6 +1221,11 @@ enum {
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
  	MCU_EXT_CMD_RXDCOC_CAL = 0x59,
  	MCU_EXT_CMD_GET_MIB_INFO = 0x5a,
@@ -272,7 +271,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 1da1d32..5523031 100644
+index 417002f..4d8cb1c 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -73,7 +73,11 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -296,7 +295,7 @@
  	mt7915_mac_wtbl_update(dev, idx,
  			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 91a1031..37b1505 100644
+index 2326523..5493efa 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -205,6 +205,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -356,10 +355,11 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
  	struct {
-@@ -4214,6 +4241,25 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -4213,3 +4240,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+ 
  	return 0;
  }
- 
++
 +#ifdef MTK_DEBUG
 +int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
 +{
@@ -378,10 +378,6 @@
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
 +}
 +#endif
-+
- int mt7915_mcu_set_qos_map(struct mt7915_dev *dev, struct ieee80211_vif *vif)
- {
- #define IP_DSCP_NUM	64
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
 index fa0847d..9ae0f07 100644
 --- a/mt7915/mcu.h
@@ -398,7 +394,7 @@
  	MCU_WA_PARAM_RED_SETTING = 0x40,
  };
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index c813433..d2224dc 100644
+index 74cd8ca..58c0bf9 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -409,7 +405,7 @@
  #define MT7915_MAX_INTERFACES		19
  #define MT7915_WTBL_SIZE		288
  #define MT7916_WTBL_SIZE		544
-@@ -246,6 +247,14 @@ struct mt7915_phy {
+@@ -244,6 +245,14 @@ struct mt7915_phy {
  #endif
  };
  
@@ -424,7 +420,7 @@
  struct mt7915_dev {
  	union { /* must be first */
  		struct mt76_dev mt76;
-@@ -329,6 +338,33 @@ struct mt7915_dev {
+@@ -327,6 +336,33 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -458,7 +454,7 @@
  	bool wmm_pbc_enable;
  	struct work_struct wmm_pbc_work;
  	u32 adie_type;
-@@ -613,4 +649,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -610,4 +646,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
@@ -1933,7 +1929,7 @@
 +#endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 new file mode 100644
-index 0000000..62d3a99
+index 0000000..665d8bd
 --- /dev/null
 +++ b/mt7915/mtk_debugfs.c
 @@ -0,0 +1,3750 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
index 1d59fe5..3c95bdb 100644
--- a/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -1,7 +1,7 @@
-From a1458a719b2aaa796b0345a8d1cec7f0c574ffaa Mon Sep 17 00:00:00 2001
+From d1999bcb10d6f3b0d97bad2ba47ea3bae1b38a52 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 27 Oct 2022 17:42:07 +0800
-Subject: [PATCH 1011/1051] wifi: mt76: testmode: add ZWDFS test mode support
+Subject: [PATCH] wifi: mt76: testmode: add ZWDFS test mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -18,7 +18,7 @@
  10 files changed, 508 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index 20577af..53b0964 100644
+index 5dfae96..65ec039 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -793,6 +793,15 @@ struct mt76_testmode_data {
@@ -38,10 +38,10 @@
  
  struct mt76_vif {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 6511060..9ac1c46 100644
+index 6060eec..09d41b5 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1241,6 +1241,7 @@ enum {
+@@ -1243,6 +1243,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -49,7 +49,7 @@
  	MCU_EXT_CMD_RX_STAT = 0xa4,
  	MCU_EXT_CMD_SET_SPR = 0xa8,
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
-@@ -1252,6 +1253,7 @@ enum {
+@@ -1254,6 +1255,7 @@ enum {
  	MCU_EXT_CMD_SET_QOS_MAP = 0xb4,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
@@ -58,7 +58,7 @@
  
  enum {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 38fca52..18091ec 100644
+index 17a23e3..3ba91a6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2759,6 +2759,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
@@ -69,10 +69,11 @@
  		req.band_idx = phy->mt76->band_idx;
  		req.scan_mode = 2;
  		break;
-@@ -4955,6 +4956,71 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
+@@ -4954,3 +4955,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
+ 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
  }
  #endif
- 
++
 +int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp)
 +{
 +	struct mt7915_dev *dev = phy->dev;
@@ -137,10 +138,6 @@
 +
 +	return 0;
 +}
-+
- int mt7915_mcu_set_qos_map(struct mt7915_dev *dev, struct ieee80211_vif *vif)
- {
- #define IP_DSCP_NUM	64
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
 index c791c7f..066246b 100644
 --- a/mt7915/mcu.h
@@ -199,10 +196,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 66e2226..0f4a0b6 100644
+index ca385b6..00f5544 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -295,6 +295,7 @@ struct mt7915_phy {
+@@ -306,6 +306,7 @@ struct mt7915_phy {
  
  	struct mt76_mib_stats mib;
  	struct mt76_channel_state state_ts;
@@ -210,7 +207,7 @@
  
  	u8 stats_work_count;
  	struct list_head stats_list;
-@@ -770,6 +771,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -786,6 +787,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
  
@@ -561,7 +558,7 @@
  
  static int
 diff --git a/testmode.c b/testmode.c
-index b1986ad..b369826 100644
+index 06b10a3..d8fc5d6 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -26,6 +26,13 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -614,7 +611,7 @@
  		goto out;
  
  	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
-@@ -866,6 +886,9 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -868,6 +888,9 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_MODE, td->tx_rate_mode) ||
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_SGI, td->tx_rate_sgi) ||
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
diff --git a/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch b/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
index 800a594..d1a98ab 100644
--- a/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
@@ -1,8 +1,8 @@
-From f96277de40ffa712ec6cb2450543611871eaf3ea Mon Sep 17 00:00:00 2001
+From 5cdc71e26586cf3a314a0971a83a00181c3e305b Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 15 Dec 2022 19:45:18 +0800
-Subject: [PATCH 1012/1051] wifi: mt76: testmode: add iBF/eBF cal and cert
- commands with golden
+Subject: [PATCH] wifi: mt76: testmode: add iBF/eBF cal and cert commands with
+ golden
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -25,7 +25,7 @@
  16 files changed, 859 insertions(+), 325 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 53b0964..1455144 100644
+index 65ec039..4408ba8 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -755,6 +755,7 @@ struct mt76_testmode_data {
@@ -84,7 +84,7 @@
  	txwi[6] |= cpu_to_le32(val);
  #endif
 diff --git a/mt7915/main.c b/mt7915/main.c
-index aebfda8..a5e33dc 100644
+index 8ec508d..b0e11f1 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -205,46 +205,37 @@ static void mt7915_init_bitrate_mask(struct ieee80211_vif *vif)
@@ -175,7 +175,7 @@
  
  	return ret;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 18091ec..751e413 100644
+index 3ba91a6..0b5b3ae 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -199,6 +199,7 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -468,10 +468,10 @@
  	[AGG_AALCR0]		= 0x028,
  	[AGG_AWSCR0]		= 0x030,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 0f4a0b6..43f5ea4 100644
+index 00f5544..ef92b2e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -314,7 +314,6 @@ struct mt7915_phy {
+@@ -325,7 +325,6 @@ struct mt7915_phy {
  
  		u8 spe_idx;
  
@@ -479,7 +479,7 @@
  		bool bf_ever_en;
  	} test;
  #endif
-@@ -428,7 +427,7 @@ struct mt7915_dev {
+@@ -443,7 +442,7 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -488,7 +488,7 @@
  	struct {
  		void *txbf_phase_cal;
  		void *txbf_pfmu_data;
-@@ -576,6 +575,7 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
+@@ -591,6 +590,7 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
  int mt7915_dma_start(struct mt7915_dev *dev, bool reset, bool wed_reset);
  int mt7915_txbf_init(struct mt7915_dev *dev);
  void mt7915_init_txpower(struct mt7915_phy *phy);
@@ -496,14 +496,13 @@
  void mt7915_reset(struct mt7915_dev *dev);
  int mt7915_run(struct ieee80211_hw *hw);
  int mt7915_mcu_init(struct mt7915_dev *dev);
-@@ -656,11 +656,13 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -671,10 +671,12 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
 -int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
 -void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_wmm_pbc_work(struct work_struct *work);
- int mt7915_mcu_set_qos_map(struct mt7915_dev *dev, struct ieee80211_vif *vif);
  
 +#ifdef CONFIG_NL80211_TESTMODE
 +void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
@@ -512,7 +511,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
  	return is_mt7915(&dev->mt76) ? MT7915_WTBL_SIZE : MT7916_WTBL_SIZE;
-@@ -794,4 +796,10 @@ enum {
+@@ -810,4 +812,10 @@ enum {
  
  #endif
  
@@ -524,7 +523,7 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 84f8fae..9e490ad 100644
+index 54daa73..02fe61a 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2888,6 +2888,36 @@ mt7915_txpower_level_set(void *data, u64 val)
@@ -1851,7 +1850,7 @@
  
  #endif
 diff --git a/testmode.c b/testmode.c
-index b369826..a3e6d4a 100644
+index d8fc5d6..56b9205 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -196,6 +196,7 @@ mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
diff --git a/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch b/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
index bc69731..c8d1472 100644
--- a/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
@@ -1,7 +1,7 @@
-From 3273e4f5ee8a6b68c6f2f22ec6f0aa32423e2f4c Mon Sep 17 00:00:00 2001
+From d49feab75f9fc7ffc5fd8b817b11c80251ec720c Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 1015/1051] wifi: mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH] wifi: mt76: mt7915: add vendor subcmd EDCCA ctrl
  enable/threshold/compensation
 
 ---
@@ -15,10 +15,10 @@
  7 files changed, 264 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 9ac1c46..012f9be 100644
+index 09d41b5..10b6133 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1252,6 +1252,7 @@ enum {
+@@ -1254,6 +1254,7 @@ enum {
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_SET_QOS_MAP = 0xb4,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
@@ -27,7 +27,7 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/main.c b/mt7915/main.c
-index a5e33dc..f927c5a 100644
+index b0e11f1..b1d7383 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -479,6 +479,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -41,13 +41,14 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 751e413..badc831 100644
+index 0b5b3ae..0e04fc2 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -5038,6 +5038,78 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+@@ -5037,3 +5037,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+ 
  	return 0;
  }
- 
++
 +int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation)
 +{
 +	static const u8 ch_band[] = {
@@ -119,10 +120,6 @@
 +
 +	return 0;
 +}
-+
- int mt7915_mcu_set_qos_map(struct mt7915_dev *dev, struct ieee80211_vif *vif)
- {
- #define IP_DSCP_NUM	64
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
 index de17c57..1682c11 100644
 --- a/mt7915/mcu.h
@@ -156,10 +153,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2c13d3a..ea450ae 100644
+index 64cfa2e..141c151 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -773,7 +773,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -789,7 +789,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -170,10 +167,10 @@
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 757aecb..3a58684 100644
+index 9e8d244..aaa0cf1 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
-@@ -63,6 +63,24 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
+@@ -64,6 +64,24 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
  	[MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_STA] = { .type = NLA_U16 },
  };
  
@@ -198,7 +195,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -1036,6 +1054,108 @@ mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -1172,6 +1190,108 @@ mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len;
  }
  
@@ -307,7 +304,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -1104,6 +1224,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1240,6 +1360,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_phy_capa_ctrl_dump,
  		.policy = phy_capa_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_PHY_CAPA_CTRL_MAX,
@@ -327,7 +324,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 34dd7d0..284994a 100644
+index e58884c..c8d30b5 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -3,6 +3,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch b/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
index 2e4209c..e96992e 100644
--- a/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
@@ -1,7 +1,7 @@
-From 576714a8019a3be8e4b7a2e59829b9af3d3e125f Mon Sep 17 00:00:00 2001
+From 7f50bd85cb6e13254fa6e72667e1b34599c64f27 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Feb 2023 16:29:42 +0800
-Subject: [PATCH 1026/1051] wifi: mt76: mt7915: disable SW-ACI by default
+Subject: [PATCH] wifi: mt76: mt7915: disable SW-ACI by default
 
 Support to enable/disable SW-ACI by module parameter "sw_aci_enable".
 SW-ACI feature is disable by default.
@@ -13,7 +13,7 @@
  4 files changed, 29 insertions(+), 9 deletions(-)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 4e1a430..3db1c0b 100644
+index 9fa01e9..05076b3 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -8,6 +8,10 @@
@@ -39,13 +39,14 @@
  
  	if (phy != &dev->phy) {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 2e6eefc..7039933 100644
+index 8e895b3..236f666 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -5223,6 +5223,21 @@ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value)
+@@ -5222,3 +5222,18 @@ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value)
+ 
  	return 0;
  }
- 
++
 +int mt7915_mcu_sw_aci_set(struct mt7915_dev *dev, bool val)
 +{
 +#define SWLNA_ENABLE 6
@@ -60,15 +61,11 @@
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SWLNA_ACI_CTRL), &req,
 +				 sizeof(req), NULL);
 +}
-+
- int mt7915_mcu_set_qos_map(struct mt7915_dev *dev, struct ieee80211_vif *vif)
- {
- #define IP_DSCP_NUM	64
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 804d554..498674d 100644
+index 82d374e..3fa3257 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -785,6 +785,7 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -801,6 +801,7 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  #endif
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
  int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
@@ -77,7 +74,7 @@
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 8f2f496..ad7abda 100644
+index 3e84d75..d932360 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -3773,16 +3773,12 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
diff --git a/recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-support-scs-feature.patch b/recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-support-scs-feature.patch
index 9163c75..e826d19 100644
--- a/recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-support-scs-feature.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-support-scs-feature.patch
@@ -1,7 +1,7 @@
-From 0bb9fb5e89b2891ab7b9f9216ae5ef73a9210c25 Mon Sep 17 00:00:00 2001
+From 28300199dbd301df08b570d527aeb76adac50343 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Wed, 6 Dec 2023 08:53:03 +0800
-Subject: [PATCH 1040/1051] wifi: mt76: mt7915: support scs feature
+Subject: [PATCH 1040/1041] wifi: mt76: mt7915: support scs feature
 
 Add support scs feature for connac2 codebase. This commit includes three
 parts.
@@ -29,7 +29,7 @@
  9 files changed, 188 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index cff22f5..7ffba7d 100644
+index 86e4a60..8450d3b 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -311,6 +311,7 @@ struct mt76_sta_stats {
@@ -49,10 +49,10 @@
  
  enum mt76_wcid_flags {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 94fcf32..247b520 100644
+index dc2a47d..8b7fe87 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1236,6 +1236,7 @@ enum {
+@@ -1238,6 +1238,7 @@ enum {
  	MCU_EXT_CMD_SET_RDD_PATTERN = 0x7d,
  	MCU_EXT_CMD_MWDS_SUPPORT = 0x80,
  	MCU_EXT_CMD_SET_SER_TRIGGER = 0x81,
@@ -61,10 +61,10 @@
  	MCU_EXT_CMD_FW_DBG_CTRL = 0x95,
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 0f8a772..2196d5f 100644
+index 4dbb84a..ec61911 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -1213,6 +1213,7 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1219,6 +1219,7 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	spin_lock_init(&dev->phy.stats_lock);
  	INIT_WORK(&dev->rc_work, mt7915_mac_sta_rc_work);
  	INIT_DELAYED_WORK(&dev->mphy.mac_work, mt7915_mac_work);
@@ -116,7 +116,7 @@
  		 wiphy_name(dev->mt76.hw->wiphy));
  }
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3db1c0b..da998e1 100644
+index 05076b3..ba009e6 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -89,12 +89,24 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -153,13 +153,14 @@
  		mt7915_mcu_set_mac(dev, dev->phy.mt76->band_idx, false, false);
  	}
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ef9f0ce..762c035 100644
+index 052ec99..297ded7 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -5239,6 +5239,124 @@ int mt7915_mcu_sw_aci_set(struct mt7915_dev *dev, bool val)
+@@ -5238,3 +5238,121 @@ int mt7915_mcu_sw_aci_set(struct mt7915_dev *dev, bool val)
+ 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SWLNA_ACI_CTRL), &req,
  				 sizeof(req), NULL);
  }
- 
++
 +int mt7915_mcu_set_scs_en(struct mt7915_phy *phy, u8 enable)
 +{
 +	struct mt7915_dev *dev = phy->dev;
@@ -277,10 +278,6 @@
 +	if (scs_enable_flag)
 +		ieee80211_queue_delayed_work(mt76_hw(dev), &dev->scs_work, HZ);
 +}
-+
- int mt7915_mcu_set_qos_map(struct mt7915_dev *dev, struct ieee80211_vif *vif)
- {
- #define IP_DSCP_NUM	64
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
 index 3089fb6..742a785 100644
 --- a/mt7915/mcu.h
@@ -295,10 +292,10 @@
 +};
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 3170aca..696db7b 100644
+index c8f9ed5..6b27be9 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -272,6 +272,15 @@ struct mt7915_air_monitor_ctrl {
+@@ -283,6 +283,15 @@ struct mt7915_air_monitor_ctrl {
  };
  #endif
  
@@ -314,7 +311,7 @@
  struct mt7915_phy {
  	struct mt76_phy *mt76;
  	struct mt7915_dev *dev;
-@@ -346,6 +355,7 @@ struct mt7915_phy {
+@@ -361,6 +370,7 @@ struct mt7915_phy {
  
  	struct mt7915_air_monitor_ctrl amnt_ctrl;
  #endif
@@ -322,7 +319,7 @@
  };
  
  #ifdef MTK_DEBUG
-@@ -478,6 +488,8 @@ struct mt7915_dev {
+@@ -493,6 +503,8 @@ struct mt7915_dev {
  	} adie[ADIE_MAX_CNT];
  #endif
  
@@ -331,7 +328,7 @@
  	bool wmm_pbc_enable;
  	struct work_struct wmm_pbc_work;
  	u32 adie_type;
-@@ -805,6 +817,8 @@ int mt7915_mcu_sw_aci_set(struct mt7915_dev *dev, bool val);
+@@ -821,6 +833,8 @@ int mt7915_mcu_sw_aci_set(struct mt7915_dev *dev, bool val);
  int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  int mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val);
@@ -341,7 +338,7 @@
  #ifdef MTK_DEBUG
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index dad5ed7..0953223 100644
+index c8efd26..e60dc85 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -3820,6 +3820,29 @@ mt7915_sr_enable_set(void *data, u64 val)
diff --git a/recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch b/recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch
index c682fc5..4576a2c 100644
--- a/recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch
@@ -1,7 +1,7 @@
-From d7dce21af9906258a21e0ff73349900f41c46bbd Mon Sep 17 00:00:00 2001
+From 9fd80f6b724ba3f7272da8856e3b3d07d04dadb8 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 21 Dec 2023 20:35:36 +0800
-Subject: [PATCH 1041/1051] wifi: mt76: mt7915: support thermal recal debug
+Subject: [PATCH 1041/1041] wifi: mt76: mt7915: support thermal recal debug
  commnad
 
 Add thermal recal debug command:
@@ -21,10 +21,10 @@
  4 files changed, 35 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 247b520..e445046 100644
+index 8b7fe87..c34c6e6 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1232,6 +1232,7 @@ enum {
+@@ -1234,6 +1234,7 @@ enum {
  	MCU_EXT_CMD_RED_ENABLE = 0x68,
  	MCU_EXT_CMD_PKT_BUDGET_CTRL = 0x6c,
  	MCU_EXT_CMD_CP_SUPPORT = 0x75,
@@ -33,13 +33,14 @@
  	MCU_EXT_CMD_SET_RDD_PATTERN = 0x7d,
  	MCU_EXT_CMD_MWDS_SUPPORT = 0x80,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 762c035..87409a4 100644
+index 297ded7..b66e5ea 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -5357,6 +5357,21 @@ void mt7915_mcu_scs_sta_poll(struct work_struct *work)
+@@ -5356,3 +5356,18 @@ void mt7915_mcu_scs_sta_poll(struct work_struct *work)
+ 	if (scs_enable_flag)
  		ieee80211_queue_delayed_work(mt76_hw(dev), &dev->scs_work, HZ);
  }
- 
++
 +int mt7915_mcu_thermal_debug(struct mt7915_dev *dev, u8 mode, u8 action)
 +{
 +	struct {
@@ -54,15 +55,11 @@
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_DEBUG), &req,
 +				 sizeof(req), true);
 +}
-+
- int mt7915_mcu_set_qos_map(struct mt7915_dev *dev, struct ieee80211_vif *vif)
- {
- #define IP_DSCP_NUM	64
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 696db7b..2981e5a 100644
+index 6b27be9..496ccd9 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -819,6 +819,7 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+@@ -835,6 +835,7 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
  int mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val);
  int mt7915_mcu_set_scs_en(struct mt7915_phy *phy, u8 enable);
  void mt7915_mcu_scs_sta_poll(struct work_struct *work);
@@ -71,7 +68,7 @@
  #ifdef MTK_DEBUG
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 0953223..53294c1 100644
+index e60dc85..0677495 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -3843,6 +3843,22 @@ mt7915_scs_enable_set(void *data, u64 val)
diff --git a/recipes-wifi/linux-mt76/files/patches/1052-wifi-mt76-mt7915-Clear-private-driver-data-in-case-o.patch b/recipes-wifi/linux-mt76/files/patches/1052-wifi-mt76-mt7915-Clear-private-driver-data-in-case-o.patch
new file mode 100644
index 0000000..2f6e452
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1052-wifi-mt76-mt7915-Clear-private-driver-data-in-case-o.patch
@@ -0,0 +1,28 @@
+From f92bc600352365982f4c674de61454dfdcba6bcd Mon Sep 17 00:00:00 2001
+From: Rex Lu <rex.lu@mediatek.com>
+Date: Fri, 5 Jul 2024 17:50:29 +0800
+Subject: [PATCH] wifi: mt76: mt7915: Clear private driver data in case of
+ reuse
+
+Signed-off-by: Rex Lu <rex.lu@mediatek.com>
+---
+ mt7915/main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 6912ea7..4a4c372 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -230,6 +230,9 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
+ 	bool ext_phy = phy != &dev->phy;
+ 	int idx, ret = 0;
+ 
++	/* Clear private driver data in case of reuse */
++	memset(mvif, 0, sizeof(struct mt7915_vif));
++
+ 	/* To differentiate the mac address of TXD and TXCMD interface */
+ 	vif->addr[0] |= bf_en;
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index 6a62f1f..f5d6773 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -74,6 +74,7 @@
     file://1049-wifi-mt76-mt7915-add-foolproof-mechanism-for-ZWDFS-d.patch \
     file://1050-mtk-wifi-mt76-mt7915-assign-DEAUTH-to-ALTX-queue-for.patch \
     file://1051-wifi-mt76-mt7915-set-channel-after-sta-is-associated.patch \
+    file://1052-wifi-mt76-mt7915-Clear-private-driver-data-in-case-o.patch \
     file://2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch \
     file://2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch \
     file://2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch \
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_dsp_24.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_dsp_24.bin
deleted file mode 100644
index 0ee44c4..0000000
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_dsp_24.bin
+++ /dev/null
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_eeprom_24_2i5i.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_eeprom_24_2i5i.bin
deleted file mode 100644
index f82d194..0000000
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_eeprom_24_2i5i.bin
+++ /dev/null
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_rom_patch_24.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_rom_patch_24.bin
deleted file mode 100644
index 556abce..0000000
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_rom_patch_24.bin
+++ /dev/null
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_wa_24.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_wa_24.bin
deleted file mode 100644
index cee6d27..0000000
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_wa_24.bin
+++ /dev/null
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_wm_24.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_wm_24.bin
deleted file mode 100644
index f2b68ec..0000000
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_wm_24.bin
+++ /dev/null
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_wm_tm_24.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_wm_tm_24.bin
deleted file mode 100644
index f4a2305..0000000
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_wm_tm_24.bin
+++ /dev/null
Binary files differ
diff --git a/recipes-wifi/wireless-regdb/wireless-regdb_2024.05.08.bb b/recipes-wifi/wireless-regdb/wireless-regdb_2024.07.04.bb
similarity index 95%
rename from recipes-wifi/wireless-regdb/wireless-regdb_2024.05.08.bb
rename to recipes-wifi/wireless-regdb/wireless-regdb_2024.07.04.bb
index a6b9bb5..cb614bc 100644
--- a/recipes-wifi/wireless-regdb/wireless-regdb_2024.05.08.bb
+++ b/recipes-wifi/wireless-regdb/wireless-regdb_2024.07.04.bb
@@ -5,7 +5,7 @@
 LIC_FILES_CHKSUM = "file://LICENSE;md5=07c4f6dea3845b02a18dc00c8c87699c"
 
 SRC_URI = "https://www.kernel.org/pub/software/network/${BPN}/${BP}.tar.xz"
-SRC_URI[sha256sum] = "9aee1d86ebebb363b714bec941b2820f31e3b7f1a485ddc9fcbd9985c7d3e7c4"
+SRC_URI[sha256sum] = "9832a14e1be24abff7be30dee3c9a1afb5fdfcf475a0d91aafef039f8d85f5eb"
 
 FILESEXTRAPATHS_prepend := "${THISDIR}/files/patches:"
 require files/patches/patches.inc
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0055-hostapd-mtk-fix-failure-of-BSS-wise-QoS-map-setting.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0055-hostapd-mtk-fix-failure-of-BSS-wise-QoS-map-setting.patch
new file mode 100644
index 0000000..f9b0b42
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0055-hostapd-mtk-fix-failure-of-BSS-wise-QoS-map-setting.patch
@@ -0,0 +1,30 @@
+From e45a713ae920d8bcaa1da4b060fd70103a08d897 Mon Sep 17 00:00:00 2001
+From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+Date: Fri, 28 Jun 2024 11:11:47 +0800
+Subject: [PATCH] hostapd: mtk: fix failure of BSS-wise QoS-map setting
+
+wpa_driver_nl80211_data is PHY-wise data structure.
+Therfore, using it here always sets QoS map of the first BSS of the PHY.
+In order to correctly set QoS map of each BSS, BSS-wise data structure i802_bss is used.
+
+Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+---
+ src/drivers/driver_nl80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index c1d31bc..29c4b9b 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -10496,7 +10496,7 @@ static int nl80211_set_qos_map(void *priv, const u8 *qos_map_set,
+ 	wpa_hexdump(MSG_DEBUG, "nl80211: Setting QoS Map",
+ 		    qos_map_set, qos_map_set_len);
+ 
+-	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_QOS_MAP)) ||
++	if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_QOS_MAP)) ||
+ 	    nla_put(msg, NL80211_ATTR_QOS_MAP, qos_map_set_len, qos_map_set)) {
+ 		nlmsg_free(msg);
+ 		return -ENOBUFS;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches/patches.inc b/recipes-wifi/wpa-supplicant/files/patches/patches.inc
index 2809a0f..b8d4751 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/patches.inc
+++ b/recipes-wifi/wpa-supplicant/files/patches/patches.inc
@@ -123,4 +123,5 @@
     file://mtk-0052-hostapd-mtk-ACS-remove-chan-freq-list-check-when-sca.patch \
     file://mtk-0053-hostapd-mtk-add-no_beacon-vendor-command-for-cert.patch \
     file://mtk-0054-hostapd-mtk-Add-support-for-gtk-rekeying-in-hostapd-.patch \
+    file://mtk-0055-hostapd-mtk-fix-failure-of-BSS-wise-QoS-map-setting.patch \
     "
diff --git a/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ucode.c b/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ucode.c
index d344190..68fb450 100644
--- a/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ucode.c
+++ b/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ucode.c
@@ -86,12 +86,16 @@
 uc_hostapd_add_iface(uc_vm_t *vm, size_t nargs)
 {
 	uc_value_t *iface = uc_fn_arg(0);
+	char *data;
 	int ret;
 
 	if (ucv_type(iface) != UC_STRING)
 		return ucv_int64_new(-1);
 
-	ret = hostapd_add_iface(interfaces, ucv_string_get(iface));
+	data = strdup(ucv_string_get(iface));
+	ret = hostapd_add_iface(interfaces, data);
+	free(data);
+
 	hostapd_ucode_update_interfaces();
 
 	return ucv_int64_new(ret);