[rdkb][common][bsp][Refactor and sync wifi from openwrt]

[Description]
5d19c26 [MAC80211][Rebase Patches][Fix MT7986_dev Build Fail]
bb39a33 [MAC80211][Rebase Patches][Align mt76 patches number rules]
08b5ca8 [MAC80211][core][mt76][Add fixes for recently discovered security issues]
7de3103 [MAC80211][mt76][Add eeprom comparison before writting efuse]
d2eff50 [MAC80211][rebase patches][Filogic 880 alpha release preparation update]
4879bdc [mac80211][mt76][Fix Performance Issue with Octoscope]

[Release-log]

Change-Id: Ie4bf8c0a1ee4ca1e0d31f0c3b25df795de66a8f1
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/330-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/330-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch
new file mode 100644
index 0000000..9c98d9e
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/330-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch
@@ -0,0 +1,134 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 29 Mar 2023 16:46:26 +0200
+Subject: [PATCH] wifi: ieee80211: correctly mark FTM frames non-bufferable
+
+The checks of whether or not a frame is bufferable were not
+taking into account that some action frames aren't, such as
+FTM. Check this, which requires some changes to the function
+ieee80211_is_bufferable_mmpdu() since we need the whole skb
+for the checks now.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+Reviewed-by: Peer, Ilan <ilan.peer@intel.com>
+---
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -601,8 +601,9 @@ static void iwl_mvm_skb_prepare_status(s
+ 
+ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
+ 				      struct ieee80211_tx_info *info,
+-				      struct ieee80211_hdr *hdr)
++				      struct sk_buff *skb)
+ {
++	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 	struct iwl_mvm_vif *mvmvif =
+ 		iwl_mvm_vif_from_mac80211(info->control.vif);
+ 	__le16 fc = hdr->frame_control;
+@@ -621,7 +622,7 @@ static int iwl_mvm_get_ctrl_vif_queue(st
+ 		 * reason 7 ("Class 3 frame received from nonassociated STA").
+ 		 */
+ 		if (ieee80211_is_mgmt(fc) &&
+-		    (!ieee80211_is_bufferable_mmpdu(fc) ||
++		    (!ieee80211_is_bufferable_mmpdu(skb) ||
+ 		     ieee80211_is_deauth(fc) || ieee80211_is_disassoc(fc)))
+ 			return mvm->probe_queue;
+ 
+@@ -740,7 +741,7 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mv
+ 			else
+ 				sta_id = mvmvif->mcast_sta.sta_id;
+ 
+-			queue = iwl_mvm_get_ctrl_vif_queue(mvm, &info, hdr);
++			queue = iwl_mvm_get_ctrl_vif_queue(mvm, &info, skb);
+ 		} else if (info.control.vif->type == NL80211_IFTYPE_MONITOR) {
+ 			queue = mvm->snif_queue;
+ 			sta_id = mvm->snif_sta.sta_id;
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -772,20 +772,6 @@ static inline bool ieee80211_is_any_null
+ }
+ 
+ /**
+- * ieee80211_is_bufferable_mmpdu - check if frame is bufferable MMPDU
+- * @fc: frame control field in little-endian byteorder
+- */
+-static inline bool ieee80211_is_bufferable_mmpdu(__le16 fc)
+-{
+-	/* IEEE 802.11-2012, definition of "bufferable management frame";
+-	 * note that this ignores the IBSS special case. */
+-	return ieee80211_is_mgmt(fc) &&
+-	       (ieee80211_is_action(fc) ||
+-		ieee80211_is_disassoc(fc) ||
+-		ieee80211_is_deauth(fc));
+-}
+-
+-/**
+  * ieee80211_is_first_frag - check if IEEE80211_SCTL_FRAG is not set
+  * @seq_ctrl: frame sequence control bytes in little-endian byteorder
+  */
+@@ -4121,6 +4107,44 @@ static inline u8 *ieee80211_get_DA(struc
+ }
+ 
+ /**
++ * ieee80211_is_bufferable_mmpdu - check if frame is bufferable MMPDU
++ * @skb: the skb to check, starting with the 802.11 header
++ */
++static inline bool ieee80211_is_bufferable_mmpdu(struct sk_buff *skb)
++{
++	struct ieee80211_mgmt *mgmt = (void *)skb->data;
++	__le16 fc = mgmt->frame_control;
++
++	/*
++	 * IEEE 802.11 REVme D2.0 definition of bufferable MMPDU;
++	 * note that this ignores the IBSS special case.
++	 */
++	if (!ieee80211_is_mgmt(fc))
++		return false;
++
++	if (ieee80211_is_disassoc(fc) || ieee80211_is_deauth(fc))
++		return true;
++
++	if (!ieee80211_is_action(fc))
++		return false;
++
++	if (skb->len < offsetofend(typeof(*mgmt), u.action.u.ftm.action_code))
++		return true;
++
++	/* action frame - additionally check for non-bufferable FTM */
++
++	if (mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
++	    mgmt->u.action.category != WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION)
++		return true;
++
++	if (mgmt->u.action.u.ftm.action_code == WLAN_PUB_ACTION_FTM_REQUEST ||
++	    mgmt->u.action.u.ftm.action_code == WLAN_PUBLIC_ACTION_FTM_RESPONSE)
++		return false;
++
++	return true;
++}
++
++/**
+  * _ieee80211_is_robust_mgmt_frame - check if frame is a robust management frame
+  * @hdr: the frame (buffer must include at least the first octet of payload)
+  */
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -488,7 +488,7 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
+ 		int ac = skb_get_queue_mapping(tx->skb);
+ 
+ 		if (ieee80211_is_mgmt(hdr->frame_control) &&
+-		    !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
++		    !ieee80211_is_bufferable_mmpdu(tx->skb)) {
+ 			info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
+ 			return TX_CONTINUE;
+ 		}
+@@ -1325,7 +1325,7 @@ static struct txq_info *ieee80211_get_tx
+ 	if (!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
+ 	    unlikely(!ieee80211_is_data_present(hdr->frame_control))) {
+ 		if ((!ieee80211_is_mgmt(hdr->frame_control) ||
+-		     ieee80211_is_bufferable_mmpdu(hdr->frame_control) ||
++		     ieee80211_is_bufferable_mmpdu(skb) ||
+ 		     vif->type == NL80211_IFTYPE_STATION) &&
+ 		    sta && sta->uploaded) {
+ 			/*
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/331-wifi-mac80211-flush-queues-on-STA-removal.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/331-wifi-mac80211-flush-queues-on-STA-removal.patch
new file mode 100644
index 0000000..00232ec
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/331-wifi-mac80211-flush-queues-on-STA-removal.patch
@@ -0,0 +1,36 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 Mar 2023 11:42:12 +0100
+Subject: [PATCH] wifi: mac80211: flush queues on STA removal
+
+When we remove a station, we first make it unreachable,
+then we (must) remove its keys, and then remove the
+station itself. Depending on the hardware design, if
+we have hardware crypto at all, frames still sitting
+on hardware queues may then be transmitted without a
+valid key, possibly unencrypted or with a fixed key.
+
+Fix this by flushing the queues when removing stations
+so this cannot happen.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+---
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1271,6 +1271,14 @@ static void __sta_info_destroy_part2(str
+ 		WARN_ON_ONCE(ret);
+ 	}
+ 
++	/* Flush queues before removing keys, as that might remove them
++	 * from hardware, and then depending on the offload method, any
++	 * frames sitting on hardware queues might be sent out without
++	 * any encryption at all.
++	 */
++	if (local->ops->set_key)
++		ieee80211_flush_queues(local, sta->sdata, false);
++
+ 	/* now keys can no longer be reached */
+ 	ieee80211_free_sta_keys(local, sta);
+ 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/332-wifi-iwlwifi-mvm-support-flush-on-AP-interfaces.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/332-wifi-iwlwifi-mvm-support-flush-on-AP-interfaces.patch
new file mode 100644
index 0000000..3c31dfe
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/332-wifi-iwlwifi-mvm-support-flush-on-AP-interfaces.patch
@@ -0,0 +1,34 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 Mar 2023 12:02:58 +0100
+Subject: [PATCH] wifi: iwlwifi: mvm: support flush on AP interfaces
+
+Support TX flush on AP interfaces so that we will do a
+proper flush for frames on the queue before keys are
+removed.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+---
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -4854,9 +4854,6 @@ static void iwl_mvm_mac_flush(struct iee
+ 		return;
+ 	}
+ 
+-	if (vif->type != NL80211_IFTYPE_STATION)
+-		return;
+-
+ 	/* Make sure we're done with the deferred traffic before flushing */
+ 	flush_work(&mvm->add_stream_wk);
+ 
+@@ -4874,9 +4871,6 @@ static void iwl_mvm_mac_flush(struct iee
+ 		if (mvmsta->vif != vif)
+ 			continue;
+ 
+-		/* make sure only TDLS peers or the AP are flushed */
+-		WARN_ON(i != mvmvif->ap_sta_id && !sta->tdls);
+-
+ 		if (drop) {
+ 			if (iwl_mvm_flush_sta(mvm, mvmsta, false))
+ 				IWL_ERR(mvm, "flush request fail\n");
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/333-wifi-mac80211-add-flush_sta-method.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/333-wifi-mac80211-add-flush_sta-method.patch
new file mode 100644
index 0000000..300a2b6
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/333-wifi-mac80211-add-flush_sta-method.patch
@@ -0,0 +1,91 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 Mar 2023 11:53:51 +0100
+Subject: [PATCH] wifi: mac80211: add flush_sta method
+
+Some drivers like iwlwifi might have per-STA queues, so we
+may want to flush/drop just those queues rather than all
+when removing a station. Add a separate method for that.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -3922,6 +3922,10 @@ struct ieee80211_prep_tx_info {
+  *	Note that vif can be NULL.
+  *	The callback can sleep.
+  *
++ * @flush_sta: Flush or drop all pending frames from the hardware queue(s) for
++ *	the given station, as it's about to be removed.
++ *	The callback can sleep.
++ *
+  * @channel_switch: Drivers that need (or want) to offload the channel
+  *	switch operation for CSAs received from the AP may implement this
+  *	callback. They must then call ieee80211_chswitch_done() to indicate
+@@ -4376,6 +4380,8 @@ struct ieee80211_ops {
+ #endif
+ 	void (*flush)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		      u32 queues, bool drop);
++	void (*flush_sta)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
++			  struct ieee80211_sta *sta);
+ 	void (*channel_switch)(struct ieee80211_hw *hw,
+ 			       struct ieee80211_vif *vif,
+ 			       struct ieee80211_channel_switch *ch_switch);
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -617,6 +617,21 @@ static inline void drv_flush(struct ieee
+ 	trace_drv_return_void(local);
+ }
+ 
++static inline void drv_flush_sta(struct ieee80211_local *local,
++				 struct ieee80211_sub_if_data *sdata,
++				 struct sta_info *sta)
++{
++	might_sleep();
++
++	if (sdata && !check_sdata_in_driver(sdata))
++		return;
++
++	trace_drv_flush_sta(local, sdata, &sta->sta);
++	if (local->ops->flush_sta)
++		local->ops->flush_sta(&local->hw, &sdata->vif, &sta->sta);
++	trace_drv_return_void(local);
++}
++
+ static inline void drv_channel_switch(struct ieee80211_local *local,
+ 				      struct ieee80211_sub_if_data *sdata,
+ 				      struct ieee80211_channel_switch *ch_switch)
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1276,8 +1276,12 @@ static void __sta_info_destroy_part2(str
+ 	 * frames sitting on hardware queues might be sent out without
+ 	 * any encryption at all.
+ 	 */
+-	if (local->ops->set_key)
+-		ieee80211_flush_queues(local, sta->sdata, false);
++	if (local->ops->set_key) {
++		if (local->ops->flush_sta)
++			drv_flush_sta(local, sta->sdata, sta);
++		else
++			ieee80211_flush_queues(local, sta->sdata, false);
++	}
+ 
+ 	/* now keys can no longer be reached */
+ 	ieee80211_free_sta_keys(local, sta);
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -1177,6 +1177,13 @@ TRACE_EVENT(drv_flush,
+ 	)
+ );
+ 
++DEFINE_EVENT(sta_event, drv_flush_sta,
++	TP_PROTO(struct ieee80211_local *local,
++		 struct ieee80211_sub_if_data *sdata,
++		 struct ieee80211_sta *sta),
++	TP_ARGS(local, sdata, sta)
++);
++
+ TRACE_EVENT(drv_channel_switch,
+ 	TP_PROTO(struct ieee80211_local *local,
+ 		 struct ieee80211_sub_if_data *sdata,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/334-wifi-iwlwifi-mvm-support-new-flush_sta-method.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/334-wifi-iwlwifi-mvm-support-new-flush_sta-method.patch
new file mode 100644
index 0000000..18f39d5
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/334-wifi-iwlwifi-mvm-support-new-flush_sta-method.patch
@@ -0,0 +1,53 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 Mar 2023 12:05:35 +0100
+Subject: [PATCH] wifi: iwlwifi: mvm: support new flush_sta method
+
+For iwlwifi this is simple to implement, and on newer hardware
+it's an improvement since we have per-station queues.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+---
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -4890,6 +4890,31 @@ static void iwl_mvm_mac_flush(struct iee
+ 		iwl_trans_wait_tx_queues_empty(mvm->trans, msk);
+ }
+ 
++static void iwl_mvm_mac_flush_sta(struct ieee80211_hw *hw,
++				  struct ieee80211_vif *vif,
++				  struct ieee80211_sta *sta)
++{
++	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
++	int i;
++
++	mutex_lock(&mvm->mutex);
++	for (i = 0; i < mvm->fw->ucode_capa.num_stations; i++) {
++		struct iwl_mvm_sta *mvmsta;
++		struct ieee80211_sta *tmp;
++
++		tmp = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
++						lockdep_is_held(&mvm->mutex));
++		if (tmp != sta)
++			continue;
++
++		mvmsta = iwl_mvm_sta_from_mac80211(sta);
++
++		if (iwl_mvm_flush_sta(mvm, mvmsta, false))
++			IWL_ERR(mvm, "flush request fail\n");
++	}
++	mutex_unlock(&mvm->mutex);
++}
++
+ static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
+ 				  struct survey_info *survey)
+ {
+@@ -5417,6 +5442,7 @@ const struct ieee80211_ops iwl_mvm_hw_op
+ 	.mgd_complete_tx = iwl_mvm_mac_mgd_complete_tx,
+ 	.mgd_protect_tdls_discover = iwl_mvm_mac_mgd_protect_tdls_discover,
+ 	.flush = iwl_mvm_mac_flush,
++	.flush_sta = iwl_mvm_mac_flush_sta,
+ 	.sched_scan_start = iwl_mvm_mac_sched_scan_start,
+ 	.sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
+ 	.set_key = iwl_mvm_mac_set_key,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0001-mac80211-support-minimal-EHT-rate-reporting-on-RX.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0001-mac80211-support-minimal-EHT-rate-reporting-on-RX.patch
index 7713b56..c2a871f 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0001-mac80211-support-minimal-EHT-rate-reporting-on-RX.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0001-mac80211-support-minimal-EHT-rate-reporting-on-RX.patch
@@ -1,7 +1,7 @@
-From b330aac018d272206775f120e8793ad6d11d805c Mon Sep 17 00:00:00 2001
+From a9cef32c4ffc9a23e14f72efc49e9ec4743eff23 Mon Sep 17 00:00:00 2001
 From: Johannes Berg <johannes.berg@intel.com>
 Date: Mon, 9 Jan 2023 13:07:21 +0200
-Subject: [PATCH 01/16] mac80211: support minimal EHT rate reporting on RX
+Subject: [PATCH 01/15] mac80211: support minimal EHT rate reporting on RX
 
 Add minimal support for RX EHT rate reporting, not yet
 adding (modifying) any radiotap headers, just statistics
@@ -17,10 +17,10 @@
  5 files changed, 64 insertions(+), 10 deletions(-)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index 6b16d6c..edc10ff 100644
+index 1ca00b5..73df564 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1436,6 +1436,7 @@ enum mac80211_rx_encoding {
+@@ -1462,6 +1462,7 @@ enum mac80211_rx_encoding {
  	RX_ENC_HT,
  	RX_ENC_VHT,
  	RX_ENC_HE,
@@ -28,7 +28,7 @@
  };
  
  /**
-@@ -1469,7 +1470,7 @@ enum mac80211_rx_encoding {
+@@ -1495,7 +1496,7 @@ enum mac80211_rx_encoding {
   * @antenna: antenna used
   * @rate_idx: index of data rate into band's supported rates or MCS index if
   *	HT or VHT is used (%RX_FLAG_HT/%RX_FLAG_VHT)
@@ -37,7 +37,7 @@
   * @flag: %RX_FLAG_\*
   * @encoding: &enum mac80211_rx_encoding
   * @bw: &enum rate_info_bw
-@@ -1477,6 +1478,8 @@ enum mac80211_rx_encoding {
+@@ -1503,6 +1504,8 @@ enum mac80211_rx_encoding {
   * @he_ru: HE RU, from &enum nl80211_he_ru_alloc
   * @he_gi: HE GI, from &enum nl80211_he_gi
   * @he_dcm: HE DCM value
@@ -46,7 +46,7 @@
   * @rx_flags: internal RX flags for mac80211
   * @ampdu_reference: A-MPDU reference number, must be a different value for
   *	each A-MPDU but the same for each subframe within one A-MPDU
-@@ -1498,8 +1501,18 @@ struct ieee80211_rx_status {
+@@ -1524,8 +1527,18 @@ struct ieee80211_rx_status {
  	u32 flag;
  	u16 freq: 13, freq_offset: 1;
  	u8 enc_flags;
@@ -68,10 +68,10 @@
  	u8 nss;
  	u8 rx_flags;
 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
-index 2a83cd8..cc11ac5 100644
+index 45aeb01..376e131 100644
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -5209,6 +5209,15 @@ void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
+@@ -5331,6 +5331,15 @@ void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
  				      status->rate_idx, status->nss))
  				goto drop;
  			break;
@@ -88,7 +88,7 @@
  			WARN_ON_ONCE(1);
  			fallthrough;
 diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
-index 97d24e9..69b4b42 100644
+index 8edee5d..8cdeb96 100644
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
 @@ -4,7 +4,7 @@
@@ -100,7 +100,7 @@
   */
  
  #include <linux/module.h>
-@@ -2368,6 +2368,13 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate,
+@@ -2372,6 +2372,13 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate,
  		rinfo->he_ru_alloc = STA_STATS_GET(HE_RU, rate);
  		rinfo->he_dcm = STA_STATS_GET(HE_DCM, rate);
  		break;
@@ -115,10 +115,10 @@
  }
  
 diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
-index 8bd7ea3..a23e3c6 100644
+index 759a1a8..ec8dff0 100644
 --- a/net/mac80211/sta_info.h
 +++ b/net/mac80211/sta_info.h
-@@ -929,6 +929,7 @@ enum sta_stats_type {
+@@ -930,6 +930,7 @@ enum sta_stats_type {
  	STA_STATS_RATE_TYPE_VHT,
  	STA_STATS_RATE_TYPE_HE,
  	STA_STATS_RATE_TYPE_S1G,
@@ -126,7 +126,7 @@
  };
  
  #define STA_STATS_FIELD_HT_MCS		GENMASK( 7,  0)
-@@ -938,12 +939,16 @@ enum sta_stats_type {
+@@ -939,12 +940,16 @@ enum sta_stats_type {
  #define STA_STATS_FIELD_VHT_NSS		GENMASK( 7,  4)
  #define STA_STATS_FIELD_HE_MCS		GENMASK( 3,  0)
  #define STA_STATS_FIELD_HE_NSS		GENMASK( 7,  4)
@@ -149,7 +149,7 @@
  
  #define STA_STATS_FIELD(_n, _v)		FIELD_PREP(STA_STATS_FIELD_ ## _n, _v)
  #define STA_STATS_GET(_n, _v)		FIELD_GET(STA_STATS_FIELD_ ## _n, _v)
-@@ -982,6 +987,13 @@ static inline u32 sta_stats_encode_rate(struct ieee80211_rx_status *s)
+@@ -983,6 +988,13 @@ static inline u32 sta_stats_encode_rate(struct ieee80211_rx_status *s)
  		r |= STA_STATS_FIELD(HE_RU, s->he_ru);
  		r |= STA_STATS_FIELD(HE_DCM, s->he_dcm);
  		break;
@@ -188,5 +188,5 @@
  		ri.flags |= RATE_INFO_FLAGS_HE_MCS;
  		ri.mcs = status->rate_idx;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0002-wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0002-wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch
index b8580cf..11f8c74 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0002-wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0002-wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch
@@ -1,7 +1,7 @@
-From 1255bfdd67f8c795e26d2417f3d2e553cae8cbe6 Mon Sep 17 00:00:00 2001
+From d9ba3e35e1291613ca15875a065326fab80e5d6d Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 9 Feb 2023 18:58:08 +0800
-Subject: [PATCH 02/16] wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
+Subject: [PATCH 02/15] wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
 
 The value of last_rate in ieee80211_sta_rx_stats is degraded from u32 to
 u16 after being assigned to rate variable, which causes information loss
@@ -13,10 +13,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
-index 69b4b42..ff2f057 100644
+index 8cdeb96..e32841a 100644
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2380,7 +2380,7 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate,
+@@ -2384,7 +2384,7 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate,
  
  static int sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
  {
@@ -26,5 +26,5 @@
  	if (rate == STA_STATS_RATE_INVALID)
  		return -EINVAL;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0003-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0003-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
index dc41b6f..d7fcc12 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0003-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0003-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
@@ -1,7 +1,7 @@
-From 988201fdd6bfbd04989d57cfc22c13274ad1ec9f Mon Sep 17 00:00:00 2001
+From 698f8560cf794290399975b25430eb4dde7c9a3f Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 18 Jan 2022 20:29:44 +0800
-Subject: [PATCH 03/16] mac80211: mtk: do not setup twt when twt responder is
+Subject: [PATCH 03/15] mac80211: mtk: do not setup twt when twt responder is
  false
 
 ---
@@ -9,10 +9,10 @@
  1 file changed, 3 insertions(+)
 
 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
-index cc11ac5..9f2a13b 100644
+index 376e131..74cf1b6 100644
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -3298,6 +3298,9 @@ ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
+@@ -3400,6 +3400,9 @@ ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
  	if (sdata->vif.type != NL80211_IFTYPE_AP)
  		return false;
  
@@ -23,5 +23,5 @@
  		return false;
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0004-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0004-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
index 8850050..d295ee0 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0004-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0004-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
@@ -1,7 +1,7 @@
-From 85a6ee02c01369d1cde4b9c9a918ab068e2f35f7 Mon Sep 17 00:00:00 2001
+From 2063d60ddcaacdcedd28b67991d90c909fe36bf1 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 29 Mar 2022 16:06:30 +0800
-Subject: [PATCH 04/16] nl80211: mtk: extend CAC time for weather radar
+Subject: [PATCH 04/15] nl80211: mtk: extend CAC time for weather radar
  channels
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -28,5 +28,5 @@
  	if (!err) {
  		wdev->links[0].ap.chandef = chandef;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0005-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0005-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
index 8008118..66da212 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0005-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0005-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
@@ -1,7 +1,7 @@
-From 8c3a225a17490db52b25662bd56f4a0edc10bd1c Mon Sep 17 00:00:00 2001
+From 3df50bf5d97956ff372dd26a8c4b73e80d9f0752 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Fri, 1 Apr 2022 09:15:21 +0800
-Subject: [PATCH 05/16] mac80211: mtk: it's invalid case when frag_threshold is
+Subject: [PATCH 05/15] mac80211: mtk: it's invalid case when frag_threshold is
  greater than 2346
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
@@ -24,5 +24,5 @@
  			/*
  			 * Fragments (apart from the last one) are required to
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0006-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0006-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
index 011fd6d..52d2315 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0006-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0006-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
@@ -1,7 +1,7 @@
-From f9465c98061810fead9564e143a0d399d56e115d Mon Sep 17 00:00:00 2001
+From 6b53222ee6da74e4950236c05a4c276ce46dd1d2 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 19 Oct 2022 13:42:43 +0800
-Subject: [PATCH 06/16] mac80211: mtk: airtime_flags depends on
+Subject: [PATCH 06/15] mac80211: mtk: airtime_flags depends on
  NL80211_EXT_FEATURE
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
@@ -26,5 +26,5 @@
  	atomic_set(&local->aql_total_pending_airtime, 0);
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0007-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0007-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
index 8f3a7fd..0cdca93 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0007-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0007-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
@@ -1,7 +1,7 @@
-From ecc272c2cd058ff4e9bf9206089538c7153028b8 Mon Sep 17 00:00:00 2001
+From 8dc4174ddb74ccccbcf60bb9ca85b5c356ac3472 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 19 Oct 2022 13:45:42 +0800
-Subject: [PATCH 07/16] mac80211: mtk: add support for runtime set inband
+Subject: [PATCH 07/15] mac80211: mtk: add support for runtime set inband
  discovery
 
 Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
@@ -14,7 +14,7 @@
  5 files changed, 62 insertions(+), 5 deletions(-)
 
 diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
-index 118cd40..9728bf8 100644
+index 357a78f..d99b59f 100644
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
 @@ -1268,6 +1268,7 @@ struct cfg80211_fils_discovery {
@@ -26,7 +26,7 @@
  
  /**
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index edc10ff..dc4faea 100644
+index 73df564..304595c 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
 @@ -525,6 +525,7 @@ struct ieee80211_ftm_responder_params {
@@ -50,7 +50,7 @@
  	/* keep last */
  	__NL80211_FILS_DISCOVERY_ATTR_LAST,
 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index c15e72d..cd5444e 100644
+index a6b9a3b..27f7616 100644
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
 @@ -983,6 +983,7 @@ static int ieee80211_set_fils_discovery(struct ieee80211_sub_if_data *sdata,
@@ -61,7 +61,7 @@
  
  	old = sdata_dereference(link->u.ap.fils_discovery, sdata);
  	new = kzalloc(sizeof(*new) + params->tmpl_len, GFP_KERNEL);
-@@ -1403,6 +1404,9 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
+@@ -1433,6 +1434,9 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	struct ieee80211_link_data *link;
  	struct beacon_data *old;
@@ -71,7 +71,7 @@
  	int err;
  	struct ieee80211_bss_conf *link_conf;
  
-@@ -1434,7 +1438,34 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
+@@ -1464,7 +1468,34 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
  		err |= BSS_CHANGED_HE_BSS_COLOR;
  	}
  
@@ -178,5 +178,5 @@
  }
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0009-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0008-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
similarity index 98%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0009-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0008-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
index 1e4eb5b..a19f0de 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0009-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0008-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
@@ -1,8 +1,8 @@
-From 4485bc86685082b37de5a1f3e04c29be65a902a0 Mon Sep 17 00:00:00 2001
+From 737f4b1dfcf9e7ae3b7fda89a24eb89aec41e2e6 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 22 Sep 2022 14:27:41 +0800
-Subject: [PATCH] cfg80211: mtk: implement DFS status show, cac and nop skip
- command via debugfs
+Subject: [PATCH 08/15] cfg80211: mtk: implement DFS status show, cac and nop
+ skip command via debugfs
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0010-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0009-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
similarity index 85%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0010-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0009-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
index aed4506..712bad4 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0010-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0009-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
@@ -1,7 +1,7 @@
-From 981efca5e285e8b4e7c8e7f51bcbd86dc976097e Mon Sep 17 00:00:00 2001
+From 42b79ad9001c166f3b48c121e7ca27adc59e0411 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 4 Oct 2022 10:47:05 +0800
-Subject: [PATCH 10/16] mac80211: mtk: Set TWT Information Frame Disabled bit
+Subject: [PATCH 09/15] mac80211: mtk: Set TWT Information Frame Disabled bit
  as 1.
 
 This modification means that current implementation do not support twt information frame.
@@ -22,5 +22,5 @@
  	/* broadcast TWT not supported yet */
  	if (twt->control & IEEE80211_TWT_CONTROL_NEG_TYPE_BROADCAST) {
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-check-the-control-channel-before-downgr.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0010-mac80211-mtk-check-the-control-channel-before-downgr.patch
similarity index 92%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-check-the-control-channel-before-downgr.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0010-mac80211-mtk-check-the-control-channel-before-downgr.patch
index 18f434f..c37aac7 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-check-the-control-channel-before-downgr.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0010-mac80211-mtk-check-the-control-channel-before-downgr.patch
@@ -1,7 +1,7 @@
-From 0ed0a8f524a3288603f9eb298dcdeff7ae745e39 Mon Sep 17 00:00:00 2001
+From f498afc5b130da3d23a2c86729368c64e487e6d8 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 16 Dec 2022 03:31:06 +0800
-Subject: [PATCH 11/19] mac80211: mtk: check the control channel before
+Subject: [PATCH 10/15] mac80211: mtk: check the control channel before
  downgrading the bandwidth
 
 ---
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-fix-tx-amsdu-aggregation.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-fix-tx-amsdu-aggregation.patch
similarity index 90%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-fix-tx-amsdu-aggregation.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-fix-tx-amsdu-aggregation.patch
index 6b5dab9..3ea4905 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-fix-tx-amsdu-aggregation.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-fix-tx-amsdu-aggregation.patch
@@ -1,7 +1,7 @@
-From bb385f098e5f12c7ec0cc5032ac32a27f6713af6 Mon Sep 17 00:00:00 2001
+From 2f9f28a6bd5d6fda61b8b596729d1ccb3ac47ace Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Wed, 14 Dec 2022 00:26:50 -0800
-Subject: [PATCH 12/19] mac80211: mtk: fix tx amsdu aggregation
+Subject: [PATCH 11/15] mac80211: mtk: fix tx amsdu aggregation
 
 ---
  include/net/mac80211.h | 7 +++++++
@@ -9,7 +9,7 @@
  2 files changed, 11 insertions(+), 2 deletions(-)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index 5908ba3..ad5f217 100644
+index 304595c..6e5ad3e 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
 @@ -2890,6 +2890,13 @@ static inline void _ieee80211_hw_set(struct ieee80211_hw *hw,
@@ -27,7 +27,7 @@
   * struct ieee80211_scan_request - hw scan request
   *
 diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
-index 65c35e4..6b7ec6e 100755
+index d5a1ddb..56cd1fc 100644
 --- a/net/mac80211/agg-tx.c
 +++ b/net/mac80211/agg-tx.c
 @@ -66,7 +66,8 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
similarity index 96%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
index 4d394b6..aab6297 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
@@ -1,7 +1,7 @@
-From 2a801c07d58b8c9b9d5e9049856c7ef7b504d841 Mon Sep 17 00:00:00 2001
+From ff5cdddc754c347baa757ca225e18e40d8b263a4 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Wed, 18 May 2022 15:10:22 +0800
-Subject: [PATCH 13/19] mac80211: mtk: add fill receive path ops to get wed idx
+Subject: [PATCH 12/15] mac80211: mtk: add fill receive path ops to get wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
similarity index 95%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
index 3b2b718..5e2ff4d 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
@@ -1,7 +1,7 @@
-From 83f826c468a145fb205cffe0f5fcc8d69143bb78 Mon Sep 17 00:00:00 2001
+From 872a283c4ddf853e6f3c280925eae1e2b0c015b8 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Tue, 13 Dec 2022 09:04:49 +0800
-Subject: [PATCH 15/19] mac80211: mtk: fix build error on Linux Kernel 5.4
+Subject: [PATCH 13/15] mac80211: mtk: fix build error on Linux Kernel 5.4
 
 ---
  include/linux/ieee80211.h          | 8 +++-----
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-track-obss-color-bitmap.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-track-obss-color-bitmap.patch
similarity index 94%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-track-obss-color-bitmap.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-track-obss-color-bitmap.patch
index a97deae..3562dff 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-track-obss-color-bitmap.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-track-obss-color-bitmap.patch
@@ -1,7 +1,7 @@
-From 7dac751fa9d42920b3b62258bffd7e5dd143f284 Mon Sep 17 00:00:00 2001
+From 3b4fed31dabb63ad6e1c9d29e18e90be228accd9 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Mon, 13 Mar 2023 05:23:37 +0800
-Subject: [PATCH 1/2] mac80211: mtk: track obss color bitmap
+Subject: [PATCH 14/15] mac80211: mtk: track obss color bitmap
 
 Track OBSS BSS color when receive their beacon.
 
@@ -16,7 +16,7 @@
  4 files changed, 33 insertions(+), 6 deletions(-)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index 1de9fad..3cf1745 100644
+index cc02639..83bbf70 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
 @@ -729,6 +729,7 @@ struct ieee80211_bss_conf {
@@ -68,7 +68,7 @@
  static int
  ieee80211_color_change(struct wiphy *wiphy, struct net_device *dev,
 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
-index e99b8fd..fd2f650 100644
+index 74cf1b6..bc5b471 100644
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
 @@ -3338,9 +3338,14 @@ ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
@@ -89,7 +89,7 @@
  	}
  }
 diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
-index 9f43775..71e312f 100644
+index e0ccf5f..f005207 100644
 --- a/net/mac80211/trace.h
 +++ b/net/mac80211/trace.h
 @@ -3051,6 +3051,27 @@ TRACE_EVENT(stop_queue,
@@ -121,5 +121,5 @@
  
  #undef TRACE_INCLUDE_PATH
 -- 
-2.39.0
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0016-mac80211-mtk-aging-color-bitmap.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-ageout-color-bitmap.patch
similarity index 94%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0016-mac80211-mtk-aging-color-bitmap.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-ageout-color-bitmap.patch
index 8953cb9..b1e7ec1 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0016-mac80211-mtk-aging-color-bitmap.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-ageout-color-bitmap.patch
@@ -1,7 +1,7 @@
-From 638a487c558695eff644966027833704e583ab4d Mon Sep 17 00:00:00 2001
+From fb56546c9ec94dd9f8ca4b6cfd91d029710b75c2 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Mon, 13 Mar 2023 05:36:59 +0800
-Subject: [PATCH] mac80211: mtk: ageout color bitmap
+Subject: [PATCH 15/15] mac80211: mtk: ageout color bitmap
 
 Adding a periodic work which runs once per second to check BSS color.
 OBSS BSS Color will be ageout if not seen for 10 seconds.
@@ -15,7 +15,7 @@
  6 files changed, 44 insertions(+)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index 3cf1745..d044be5 100644
+index 83bbf70..5ca2f10 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
 @@ -730,6 +730,7 @@ struct ieee80211_bss_conf {
@@ -68,7 +68,7 @@
  ieee80211_set_radar_background(struct wiphy *wiphy,
  			       struct cfg80211_chan_def *chandef)
 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index a10ef29..4f4dd89 100644
+index f7da92b..bc3f133 100644
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
 @@ -987,6 +987,7 @@ struct ieee80211_link_data {
@@ -93,7 +93,7 @@
  /* interface handling */
  #define MAC80211_SUPPORTED_FEATURES_TX	(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \
 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index b80fb66..98682a0 100644
+index b82065c..6a300ab 100644
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
 @@ -541,6 +541,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do
@@ -129,7 +129,7 @@
  	if (!deflink) {
  		switch (sdata->vif.type) {
 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
-index fd2f650..67c768c 100644
+index bc5b471..b96eb7c 100644
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
 @@ -3340,6 +3340,7 @@ ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
@@ -141,5 +141,5 @@
  		trace_bss_color_bitmap(color, bss_conf->used_color_bitmap);
  
 -- 
-2.39.0
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0100-mac80211-mtk-add-EHT-BA1024-support.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0100-mac80211-mtk-add-EHT-BA1024-support.patch
index 237bc45..5493895 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0100-mac80211-mtk-add-EHT-BA1024-support.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0100-mac80211-mtk-add-EHT-BA1024-support.patch
@@ -1,7 +1,7 @@
-From b068bbf279658acaef1bef11e6a7052948eb1ef0 Mon Sep 17 00:00:00 2001
+From 21b39d41faf3a67127778d85a79029002ed65291 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Sun, 25 Dec 2022 22:43:46 +0800
-Subject: [PATCH 100/101] mac80211: mtk: add EHT BA1024 support
+Subject: [PATCH 100/102] mac80211: mtk: add EHT BA1024 support
 
 ---
  include/linux/ieee80211.h |  2 ++
@@ -22,7 +22,7 @@
  				struct{
  					u8 action_code;
 diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
-index 318c71e..7f750c1 100755
+index 56cd1fc..8daf292 100644
 --- a/net/mac80211/agg-tx.c
 +++ b/net/mac80211/agg-tx.c
 @@ -66,10 +66,17 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
@@ -73,7 +73,7 @@
  	} else {
  		/*
  		 * We really should use what the driver told us it will
-@@ -960,13 +979,35 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
+@@ -978,13 +997,35 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
  {
  	struct tid_ampdu_tx *tid_tx;
  	struct ieee80211_txq *txq;
@@ -110,5 +110,5 @@
  
  	txq = sta->sta.txq[tid];
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0101-mac80211-mtk-add-rate-duration-for-EHT-rate.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0101-mac80211-mtk-add-rate-duration-for-EHT-rate.patch
index bedbd70..27ed002 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0101-mac80211-mtk-add-rate-duration-for-EHT-rate.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0101-mac80211-mtk-add-rate-duration-for-EHT-rate.patch
@@ -1,7 +1,7 @@
-From 91dc0a129c141c018097e5cae0e3e0ae5ff44b41 Mon Sep 17 00:00:00 2001
+From a1d426d8bb909612b66c31d450fd717177862d2f Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Sun, 25 Dec 2022 22:43:46 +0800
-Subject: [PATCH 101/101] mac80211: mtk: add rate duration for EHT rate.
+Subject: [PATCH 101/102] mac80211: mtk: add rate duration for EHT rate.
 
 ---
  net/mac80211/airtime.c | 349 ++++++++++++++++++++++++++++++++++++++++-
@@ -436,5 +436,5 @@
  	if (stat->encoding != RX_ENC_LEGACY)
  		return true;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
index 6976f33..a56cd17 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
@@ -34,6 +34,11 @@
     file://327-wifi-mac80211-add-support-for-letting-drivers-regist.patch \
     file://328-wifi-mac80211-fix-invalid-drv_sta_pre_rcu_remove-cal.patch \
     file://329-wifi-mac80211-fix-receiving-mesh-packets-in-forwardi.patch \
+    file://330-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch \
+    file://331-wifi-mac80211-flush-queues-on-STA-removal.patch \
+    file://332-wifi-iwlwifi-mvm-support-flush-on-AP-interfaces.patch \
+    file://333-wifi-mac80211-add-flush_sta-method.patch \
+    file://334-wifi-iwlwifi-mvm-support-new-flush_sta-method.patch \
     file://400-allow-ibss-mixed.patch \
     file://500-mac80211_configure_antenna_gain.patch \
     file://782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch \
@@ -44,14 +49,14 @@
     file://mtk-0005-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch \
     file://mtk-0006-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch \
     file://mtk-0007-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch \
-    file://mtk-0009-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch \
-    file://mtk-0010-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch \
-    file://mtk-0011-mac80211-mtk-check-the-control-channel-before-downgr.patch \
-    file://mtk-0012-mac80211-mtk-fix-tx-amsdu-aggregation.patch \
-    file://mtk-0013-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch \
-    file://mtk-0014-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch \
-    file://mtk-0015-mac80211-mtk-track-obss-color-bitmap.patch \
-    file://mtk-0016-mac80211-mtk-aging-color-bitmap.patch \
+    file://mtk-0008-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch \
+    file://mtk-0009-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch \
+    file://mtk-0010-mac80211-mtk-check-the-control-channel-before-downgr.patch \
+    file://mtk-0011-mac80211-mtk-fix-tx-amsdu-aggregation.patch \
+    file://mtk-0012-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch \
+    file://mtk-0013-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch \
+    file://mtk-0014-mac80211-mtk-track-obss-color-bitmap.patch \
+    file://mtk-0015-mac80211-mtk-ageout-color-bitmap.patch \
     file://mtk-0100-mac80211-mtk-add-EHT-BA1024-support.patch \
     file://mtk-0101-mac80211-mtk-add-rate-duration-for-EHT-rate.patch \
     file://mtk-0103-mac80211-mtk-add-send-bar-on-addbarsp_handle.patch \
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/348-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/348-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch
new file mode 100644
index 0000000..ac707de
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/348-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch
@@ -0,0 +1,134 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 29 Mar 2023 16:46:26 +0200
+Subject: [PATCH] wifi: ieee80211: correctly mark FTM frames non-bufferable
+
+The checks of whether or not a frame is bufferable were not
+taking into account that some action frames aren't, such as
+FTM. Check this, which requires some changes to the function
+ieee80211_is_bufferable_mmpdu() since we need the whole skb
+for the checks now.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+Reviewed-by: Peer, Ilan <ilan.peer@intel.com>
+---
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -551,8 +551,9 @@ static void iwl_mvm_skb_prepare_status(s
+ 
+ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
+ 				      struct ieee80211_tx_info *info,
+-				      struct ieee80211_hdr *hdr)
++				      struct sk_buff *skb)
+ {
++	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 	struct iwl_mvm_vif *mvmvif =
+ 		iwl_mvm_vif_from_mac80211(info->control.vif);
+ 	__le16 fc = hdr->frame_control;
+@@ -571,7 +572,7 @@ static int iwl_mvm_get_ctrl_vif_queue(st
+ 		 * reason 7 ("Class 3 frame received from nonassociated STA").
+ 		 */
+ 		if (ieee80211_is_mgmt(fc) &&
+-		    (!ieee80211_is_bufferable_mmpdu(fc) ||
++		    (!ieee80211_is_bufferable_mmpdu(skb) ||
+ 		     ieee80211_is_deauth(fc) || ieee80211_is_disassoc(fc)))
+ 			return mvm->probe_queue;
+ 
+@@ -689,7 +690,7 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mv
+ 			else
+ 				sta_id = mvmvif->mcast_sta.sta_id;
+ 
+-			queue = iwl_mvm_get_ctrl_vif_queue(mvm, &info, hdr);
++			queue = iwl_mvm_get_ctrl_vif_queue(mvm, &info, skb);
+ 		} else if (info.control.vif->type == NL80211_IFTYPE_MONITOR) {
+ 			queue = mvm->snif_queue;
+ 			sta_id = mvm->snif_sta.sta_id;
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -738,20 +738,6 @@ static inline bool ieee80211_is_any_null
+ }
+ 
+ /**
+- * ieee80211_is_bufferable_mmpdu - check if frame is bufferable MMPDU
+- * @fc: frame control field in little-endian byteorder
+- */
+-static inline bool ieee80211_is_bufferable_mmpdu(__le16 fc)
+-{
+-	/* IEEE 802.11-2012, definition of "bufferable management frame";
+-	 * note that this ignores the IBSS special case. */
+-	return ieee80211_is_mgmt(fc) &&
+-	       (ieee80211_is_action(fc) ||
+-		ieee80211_is_disassoc(fc) ||
+-		ieee80211_is_deauth(fc));
+-}
+-
+-/**
+  * ieee80211_is_first_frag - check if IEEE80211_SCTL_FRAG is not set
+  * @seq_ctrl: frame sequence control bytes in little-endian byteorder
+  */
+@@ -3672,6 +3658,44 @@ static inline u8 *ieee80211_get_DA(struc
+ }
+ 
+ /**
++ * ieee80211_is_bufferable_mmpdu - check if frame is bufferable MMPDU
++ * @skb: the skb to check, starting with the 802.11 header
++ */
++static inline bool ieee80211_is_bufferable_mmpdu(struct sk_buff *skb)
++{
++	struct ieee80211_mgmt *mgmt = (void *)skb->data;
++	__le16 fc = mgmt->frame_control;
++
++	/*
++	 * IEEE 802.11 REVme D2.0 definition of bufferable MMPDU;
++	 * note that this ignores the IBSS special case.
++	 */
++	if (!ieee80211_is_mgmt(fc))
++		return false;
++
++	if (ieee80211_is_disassoc(fc) || ieee80211_is_deauth(fc))
++		return true;
++
++	if (!ieee80211_is_action(fc))
++		return false;
++
++	if (skb->len < offsetofend(typeof(*mgmt), u.action.u.ftm.action_code))
++		return true;
++
++	/* action frame - additionally check for non-bufferable FTM */
++
++	if (mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
++	    mgmt->u.action.category != WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION)
++		return true;
++
++	if (mgmt->u.action.u.ftm.action_code == WLAN_PUB_ACTION_FTM_REQUEST ||
++	    mgmt->u.action.u.ftm.action_code == WLAN_PUB_ACTION_FTM)
++		return false;
++
++	return true;
++}
++
++/**
+  * _ieee80211_is_robust_mgmt_frame - check if frame is a robust management frame
+  * @hdr: the frame (buffer must include at least the first octet of payload)
+  */
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -487,7 +487,7 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
+ 		int ac = skb_get_queue_mapping(tx->skb);
+ 
+ 		if (ieee80211_is_mgmt(hdr->frame_control) &&
+-		    !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
++		    !ieee80211_is_bufferable_mmpdu(tx->skb)) {
+ 			info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
+ 			return TX_CONTINUE;
+ 		}
+@@ -1282,7 +1282,7 @@ static struct txq_info *ieee80211_get_tx
+ 	if (!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
+ 	    unlikely(!ieee80211_is_data_present(hdr->frame_control))) {
+ 		if ((!ieee80211_is_mgmt(hdr->frame_control) ||
+-		     ieee80211_is_bufferable_mmpdu(hdr->frame_control) ||
++		     ieee80211_is_bufferable_mmpdu(skb) ||
+ 		     vif->type == NL80211_IFTYPE_STATION) &&
+ 		    sta && sta->uploaded) {
+ 			/*
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/349-wifi-mac80211-flush-queues-on-STA-removal.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/349-wifi-mac80211-flush-queues-on-STA-removal.patch
new file mode 100644
index 0000000..3e148a9
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/349-wifi-mac80211-flush-queues-on-STA-removal.patch
@@ -0,0 +1,36 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 Mar 2023 11:42:12 +0100
+Subject: [PATCH] wifi: mac80211: flush queues on STA removal
+
+When we remove a station, we first make it unreachable,
+then we (must) remove its keys, and then remove the
+station itself. Depending on the hardware design, if
+we have hardware crypto at all, frames still sitting
+on hardware queues may then be transmitted without a
+valid key, possibly unencrypted or with a fixed key.
+
+Fix this by flushing the queues when removing stations
+so this cannot happen.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+---
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1070,6 +1070,14 @@ static void __sta_info_destroy_part2(str
+ 		WARN_ON_ONCE(ret);
+ 	}
+ 
++	/* Flush queues before removing keys, as that might remove them
++	 * from hardware, and then depending on the offload method, any
++	 * frames sitting on hardware queues might be sent out without
++	 * any encryption at all.
++	 */
++	if (local->ops->set_key)
++		ieee80211_flush_queues(local, sta->sdata, false);
++
+ 	/* now keys can no longer be reached */
+ 	ieee80211_free_sta_keys(local, sta);
+ 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/350-wifi-iwlwifi-mvm-support-flush-on-AP-interfaces.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/350-wifi-iwlwifi-mvm-support-flush-on-AP-interfaces.patch
new file mode 100644
index 0000000..0b070b1
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/350-wifi-iwlwifi-mvm-support-flush-on-AP-interfaces.patch
@@ -0,0 +1,34 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 Mar 2023 12:02:58 +0100
+Subject: [PATCH] wifi: iwlwifi: mvm: support flush on AP interfaces
+
+Support TX flush on AP interfaces so that we will do a
+proper flush for frames on the queue before keys are
+removed.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+---
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -4817,9 +4817,6 @@ static void iwl_mvm_mac_flush(struct iee
+ 		return;
+ 	}
+ 
+-	if (vif->type != NL80211_IFTYPE_STATION)
+-		return;
+-
+ 	/* Make sure we're done with the deferred traffic before flushing */
+ 	flush_work(&mvm->add_stream_wk);
+ 
+@@ -4837,9 +4834,6 @@ static void iwl_mvm_mac_flush(struct iee
+ 		if (mvmsta->vif != vif)
+ 			continue;
+ 
+-		/* make sure only TDLS peers or the AP are flushed */
+-		WARN_ON(i != mvmvif->ap_sta_id && !sta->tdls);
+-
+ 		if (drop) {
+ 			if (iwl_mvm_flush_sta(mvm, mvmsta, false))
+ 				IWL_ERR(mvm, "flush request fail\n");
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/351-wifi-mac80211-add-flush_sta-method.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/351-wifi-mac80211-add-flush_sta-method.patch
new file mode 100644
index 0000000..ae2ef83
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/351-wifi-mac80211-add-flush_sta-method.patch
@@ -0,0 +1,91 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 Mar 2023 11:53:51 +0100
+Subject: [PATCH] wifi: mac80211: add flush_sta method
+
+Some drivers like iwlwifi might have per-STA queues, so we
+may want to flush/drop just those queues rather than all
+when removing a station. Add a separate method for that.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -3688,6 +3688,10 @@ struct ieee80211_prep_tx_info {
+  *	Note that vif can be NULL.
+  *	The callback can sleep.
+  *
++ * @flush_sta: Flush or drop all pending frames from the hardware queue(s) for
++ *	the given station, as it's about to be removed.
++ *	The callback can sleep.
++ *
+  * @channel_switch: Drivers that need (or want) to offload the channel
+  *	switch operation for CSAs received from the AP may implement this
+  *	callback. They must then call ieee80211_chswitch_done() to indicate
+@@ -4116,6 +4120,8 @@ struct ieee80211_ops {
+ #endif
+ 	void (*flush)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		      u32 queues, bool drop);
++	void (*flush_sta)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
++			  struct ieee80211_sta *sta);
+ 	void (*channel_switch)(struct ieee80211_hw *hw,
+ 			       struct ieee80211_vif *vif,
+ 			       struct ieee80211_channel_switch *ch_switch);
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -639,6 +639,21 @@ static inline void drv_flush(struct ieee
+ 	trace_drv_return_void(local);
+ }
+ 
++static inline void drv_flush_sta(struct ieee80211_local *local,
++				 struct ieee80211_sub_if_data *sdata,
++				 struct sta_info *sta)
++{
++	might_sleep();
++
++	if (sdata && !check_sdata_in_driver(sdata))
++		return;
++
++	trace_drv_flush_sta(local, sdata, &sta->sta);
++	if (local->ops->flush_sta)
++		local->ops->flush_sta(&local->hw, &sdata->vif, &sta->sta);
++	trace_drv_return_void(local);
++}
++
+ static inline void drv_channel_switch(struct ieee80211_local *local,
+ 				      struct ieee80211_sub_if_data *sdata,
+ 				      struct ieee80211_channel_switch *ch_switch)
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1075,8 +1075,12 @@ static void __sta_info_destroy_part2(str
+ 	 * frames sitting on hardware queues might be sent out without
+ 	 * any encryption at all.
+ 	 */
+-	if (local->ops->set_key)
+-		ieee80211_flush_queues(local, sta->sdata, false);
++	if (local->ops->set_key) {
++		if (local->ops->flush_sta)
++			drv_flush_sta(local, sta->sdata, sta);
++		else
++			ieee80211_flush_queues(local, sta->sdata, false);
++	}
+ 
+ 	/* now keys can no longer be reached */
+ 	ieee80211_free_sta_keys(local, sta);
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -1140,6 +1140,13 @@ TRACE_EVENT(drv_flush,
+ 	)
+ );
+ 
++DEFINE_EVENT(sta_event, drv_flush_sta,
++	TP_PROTO(struct ieee80211_local *local,
++		 struct ieee80211_sub_if_data *sdata,
++		 struct ieee80211_sta *sta),
++	TP_ARGS(local, sdata, sta)
++);
++
+ TRACE_EVENT(drv_channel_switch,
+ 	TP_PROTO(struct ieee80211_local *local,
+ 		 struct ieee80211_sub_if_data *sdata,
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/352-wifi-iwlwifi-mvm-support-new-flush_sta-method.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/352-wifi-iwlwifi-mvm-support-new-flush_sta-method.patch
new file mode 100644
index 0000000..31f60ce
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/352-wifi-iwlwifi-mvm-support-new-flush_sta-method.patch
@@ -0,0 +1,53 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 Mar 2023 12:05:35 +0100
+Subject: [PATCH] wifi: iwlwifi: mvm: support new flush_sta method
+
+For iwlwifi this is simple to implement, and on newer hardware
+it's an improvement since we have per-station queues.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Greenman, Gregory <gregory.greenman@intel.com>
+---
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -4853,6 +4853,31 @@ static void iwl_mvm_mac_flush(struct iee
+ 		iwl_trans_wait_tx_queues_empty(mvm->trans, msk);
+ }
+ 
++static void iwl_mvm_mac_flush_sta(struct ieee80211_hw *hw,
++				  struct ieee80211_vif *vif,
++				  struct ieee80211_sta *sta)
++{
++	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
++	int i;
++
++	mutex_lock(&mvm->mutex);
++	for (i = 0; i < mvm->fw->ucode_capa.num_stations; i++) {
++		struct iwl_mvm_sta *mvmsta;
++		struct ieee80211_sta *tmp;
++
++		tmp = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
++						lockdep_is_held(&mvm->mutex));
++		if (tmp != sta)
++			continue;
++
++		mvmsta = iwl_mvm_sta_from_mac80211(sta);
++
++		if (iwl_mvm_flush_sta(mvm, mvmsta, false))
++			IWL_ERR(mvm, "flush request fail\n");
++	}
++	mutex_unlock(&mvm->mutex);
++}
++
+ static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
+ 				  struct survey_info *survey)
+ {
+@@ -5366,6 +5391,7 @@ const struct ieee80211_ops iwl_mvm_hw_op
+ 	.mgd_prepare_tx = iwl_mvm_mac_mgd_prepare_tx,
+ 	.mgd_protect_tdls_discover = iwl_mvm_mac_mgd_protect_tdls_discover,
+ 	.flush = iwl_mvm_mac_flush,
++	.flush_sta = iwl_mvm_mac_flush_sta,
+ 	.sched_scan_start = iwl_mvm_mac_sched_scan_start,
+ 	.sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
+ 	.set_key = iwl_mvm_mac_set_key,
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
index 897492a..0f32537 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
@@ -43,6 +43,11 @@
     file://345-v6.1-wifi-mac80211-do-not-drop-packets-smaller-than-the-L.patch \
     file://346-v6.0-wifi-mac80211-fix-mesh-airtime-link-metric-estimatin.patch \
     file://347-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch \
+    file://348-wifi-ieee80211-correctly-mark-FTM-frames-non-buffera.patch \
+    file://349-wifi-mac80211-flush-queues-on-STA-removal.patch \
+    file://350-wifi-iwlwifi-mvm-support-flush-on-AP-interfaces.patch \
+    file://351-wifi-mac80211-add-flush_sta-method.patch \
+    file://352-wifi-iwlwifi-mvm-support-new-flush_sta-method.patch \
     file://363-v5.19-bss-color-collision.patch \
     file://364-mac80211-add-support-for-restricting-netdev-features.patch \
     file://400-allow-ibss-mixed.patch \