diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/432-missing-typedef.patch b/recipes-wifi/hostapd/files/patches-2.10.3/432-missing-typedef.patch
deleted file mode 100644
index 7a100f1..0000000
--- a/recipes-wifi/hostapd/files/patches-2.10.3/432-missing-typedef.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/src/drivers/linux_wext.h
-+++ b/src/drivers/linux_wext.h
-@@ -26,6 +26,7 @@ typedef int32_t __s32;
- typedef uint16_t __u16;
- typedef int16_t __s16;
- typedef uint8_t __u8;
-+typedef int8_t __s8;
- #ifndef __user
- #define __user
- #endif /* __user */
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0101-hostapd-mtk-Fix-CCA-issue.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0029-hostapd-mtk-Fix-CCA-issue.patch
similarity index 88%
rename from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0101-hostapd-mtk-Fix-CCA-issue.patch
rename to recipes-wifi/hostapd/files/patches-2.10.3/mtk-0029-hostapd-mtk-Fix-CCA-issue.patch
index 9b46d70..e4667e4 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0101-hostapd-mtk-Fix-CCA-issue.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0029-hostapd-mtk-Fix-CCA-issue.patch
@@ -1,12 +1,12 @@
-From 39a0dd44653f12ce13af68de81bfae683669623a Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Thu, 11 May 2023 14:08:59 +0800
-Subject: [PATCH 101/103] hostapd: mtk: Fix CCA issue
+From c92a1e50abdad2bf3e961c9d5aa34baea81f025b Mon Sep 17 00:00:00 2001
+From: Michael Lee <michael-cy.lee@mediatek.com>
+Date: Wed, 3 May 2023 14:55:18 +0800
+Subject: [PATCH] hostapd: mtk: Fix CCA issue
 
-When receiving CCA related nl80211 command, hostapd used to work on
+When receiving CCA-related nl80211 commands, hostapd used to work on
 struct wpa_driver_nl80211_data, whose ctx always points to
-hostpad_iface->bss[0]. However, CCA command is sent on per-BSS based.
-This patch makes hostapd handle CCA related commands on per-BSS based.
+hostpad_iface->bss[0]. However, CCA commands are sent on a per-BSS based.
+This patch makes hostapd handle CCA-related commands on a per-BSS based.
 
 Signed-off-by: Michael Lee <michael-cy.lee@mediatek.com>
 ---
@@ -93,5 +93,5 @@
  #endif /* CONFIG_IEEE80211AX */
  	default:
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0102-hostapd-mtk-Fix-unexpected-AP-beacon-state-transitio.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0030-hostapd-mtk-Fix-unexpected-AP-beacon-state-transitio.patch
similarity index 66%
rename from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0102-hostapd-mtk-Fix-unexpected-AP-beacon-state-transitio.patch
rename to recipes-wifi/hostapd/files/patches-2.10.3/mtk-0030-hostapd-mtk-Fix-unexpected-AP-beacon-state-transitio.patch
index 4075531..f9c4714 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0102-hostapd-mtk-Fix-unexpected-AP-beacon-state-transitio.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0030-hostapd-mtk-Fix-unexpected-AP-beacon-state-transitio.patch
@@ -1,15 +1,14 @@
-From 097b204ffed838a4bbf7649fb23310f64ace22ad Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Thu, 11 May 2023 14:12:44 +0800
-Subject: [PATCH 102/103] hostapd: mtk: Fix unexpected AP beacon state
- transition
+From c4d3890bbf1bd8c8ac8bfaa56fd16e2391e05181 Mon Sep 17 00:00:00 2001
+From: Michael Lee <michael-cy.lee@mediatek.com>
+Date: Wed, 3 May 2023 16:10:57 +0800
+Subject: [PATCH] hostapd: mtk: Fix unexpected AP beacon state transition
 
-When AP fails setting the beacon, it assigns bss->beacon_set to 0 no
+When AP fails to set the beacon, it assigns bss->beacon_set to 0 no
 matter what the error number is.
 However, in the case that the error number is -EBUSY, the driver might
 not free the beacon and expect a later beacon re-setting. If hostapd set
-a new beacon under this case, driver will return -EALREADY.
-This patch checks the error number after hostapd fails setting the
+a new beacon under this case, the driver will return -EALREADY.
+This patch checks the error number after hostapd fails to set the
 beacon. If the error number is -EBUSY, bss->beacon_set will not be
 assigned to 0.
 
@@ -19,7 +18,7 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 8400e57..ccfc2d0 100644
+index 8400e57..5013207 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -5126,7 +5126,8 @@ static int wpa_driver_nl80211_set_ap(void *priv,
@@ -33,5 +32,5 @@
  		bss->flink->beacon_set = 1;
  		nl80211_set_bss(bss, params->cts_protect, params->preamble,
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc b/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
index a71c43f..38ca4d8 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
@@ -36,7 +36,6 @@
     file://420-indicate-features.patch \
     file://430-hostapd_cli_ifdef.patch \
     file://431-wpa_cli_ifdef.patch \
-    file://432-missing-typedef.patch \
     file://450-scan_wait.patch;apply=no \
     file://460-wpa_supplicant-add-new-config-params-to-be-used-with.patch \
     file://463-add-mcast_rate-to-11s.patch \
@@ -87,8 +86,8 @@
     file://mtk-0026-hostapd-mtk-avoid-setting-beacon-after-wpa_supplican.patch \
     file://mtk-0027-hostapd-mtk-Fix-setting-wrong-seg0-index-for-5G-cent.patch \
     file://mtk-0028-hostapd-mtk-Add-muru-user-number-debug-command.patch \
+    file://mtk-0029-hostapd-mtk-Fix-CCA-issue.patch \
+    file://mtk-0030-hostapd-mtk-Fix-unexpected-AP-beacon-state-transitio.patch \
     file://mtk-0100-hostapd-mtk-update-eht-operation-element.patch \
-    file://mtk-0101-hostapd-mtk-Fix-CCA-issue.patch \
-    file://mtk-0102-hostapd-mtk-Fix-unexpected-AP-beacon-state-transitio.patch \
     file://mtk-0103-hostapd-mtk-Add-BW320-channel-switch-command.patch \
     "
diff --git a/recipes-wifi/hostapd/hostapd_2.10.3.bb b/recipes-wifi/hostapd/hostapd_2.10.3.bb
index 68cb4c2..06874d3 100644
--- a/recipes-wifi/hostapd/hostapd_2.10.3.bb
+++ b/recipes-wifi/hostapd/hostapd_2.10.3.bb
@@ -68,6 +68,7 @@
     echo "CONFIG_WEP=y" >> ${B}/.config
     echo "CONFIG_FILS=y" >> ${B}/.config
     echo "CONFIG_IEEE80211BE=y" >> ${B}/.config
+    echo "CONFIG_TESTING_OPTIONS=y" >> ${B}/.config
 }
 
 do_filogic_patches() {
diff --git a/recipes-wifi/hostapd/hostapd_2.10.bb b/recipes-wifi/hostapd/hostapd_2.10.bb
index 8f54916..e83d34e 100644
--- a/recipes-wifi/hostapd/hostapd_2.10.bb
+++ b/recipes-wifi/hostapd/hostapd_2.10.bb
@@ -67,6 +67,7 @@
     echo "CONFIG_MESH=y" >> ${B}/.config
     echo "CONFIG_WEP=y" >> ${B}/.config
     echo "CONFIG_FILS=y" >> ${B}/.config
+    echo "CONFIG_TESTING_OPTIONS=y" >> ${B}/.config
 }
 
 do_filogic_patches() {
diff --git a/recipes-wifi/libubox/libubox_git.bbappend b/recipes-wifi/libubox/libubox_git.bbappend
index 11a4d90..5bc09d3 100644
--- a/recipes-wifi/libubox/libubox_git.bbappend
+++ b/recipes-wifi/libubox/libubox_git.bbappend
@@ -1,3 +1,3 @@
 SRC_URI_remove = "file://0001-blobmsg-fix-array-out-of-bounds-GCC-10-warning.patch"
 
-SRCREV = "ea56013409d5823001b47a9bba6f74055a6d76a5"
+SRCREV = "75a3b870cace1171faf57bd55e5a9a2f1564f757"
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/050-lib80211_option.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/050-lib80211_option.patch
deleted file mode 100644
index c1b1bc7..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/build/050-lib80211_option.patch
+++ /dev/null
@@ -1,34 +0,0 @@
---- a/net/wireless/Kconfig
-+++ b/net/wireless/Kconfig
-@@ -188,7 +188,7 @@ config CFG80211_WEXT_EXPORT
- endif # CFG80211
- 
- config LIB80211
--	tristate
-+	tristate "lib80211"
- 	depends on m
- 	default n
- 	help
-@@ -198,19 +198,19 @@ config LIB80211
- 	  Drivers should select this themselves if needed.
- 
- config LIB80211_CRYPT_WEP
--	tristate
-+	tristate "lib80211 WEP support"
- 	depends on m
- 	select BPAUTO_CRYPTO_LIB_ARC4
- 
- config LIB80211_CRYPT_CCMP
--	tristate
-+	tristate "lib80211 CCMP support"
- 	depends on m
- 	depends on CRYPTO
- 	depends on CRYPTO_AES
- 	depends on CRYPTO_CCM
- 
- config LIB80211_CRYPT_TKIP
--	tristate
-+	tristate "lib80211 TKIP support"
- 	depends on m
- 	select BPAUTO_CRYPTO_LIB_ARC4
- 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/build.inc b/recipes-wifi/linux-mac80211/files/patches-6.x/build/build.inc
index c0e4215..dbdb7b7 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/build/build.inc
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/build.inc
@@ -5,7 +5,6 @@
     file://002-change_allconfig.patch \
     file://003-remove_bogus_modparams.patch \
     file://012-kernel_build_check.patch \
-    file://050-lib80211_option.patch \
     file://060-no_local_ssb_bcma.patch \
     file://070-remove-broken-wext-select.patch \
     file://080-resv_start_op.patch \
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/315-v6.3-wifi-mac80211-fix-receiving-A-MSDU-frames-on-mesh-in.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/315-v6.3-wifi-mac80211-fix-receiving-A-MSDU-frames-on-mesh-in.patch
index 6aec9bc..59b799b 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/315-v6.3-wifi-mac80211-fix-receiving-A-MSDU-frames-on-mesh-in.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/315-v6.3-wifi-mac80211-fix-receiving-A-MSDU-frames-on-mesh-in.patch
@@ -1,5 +1,6 @@
+From 986e43b19ae9176093da35e0a844e65c8bf9ede7 Mon Sep 17 00:00:00 2001
 From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 6 Dec 2022 11:15:02 +0100
+Date: Mon, 13 Feb 2023 11:08:54 +0100
 Subject: [PATCH] wifi: mac80211: fix receiving A-MSDU frames on mesh
  interfaces
 
@@ -33,7 +34,15 @@
 For forwarded packets, a new 802.11 header gets added.
 
 Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name
+[fix fortify build error]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 ---
+ .../wireless/marvell/mwifiex/11n_rxreorder.c  |   2 +-
+ include/net/cfg80211.h                        |  27 +-
+ net/mac80211/rx.c                             | 350 ++++++++++--------
+ net/wireless/util.c                           | 120 +++---
+ 4 files changed, 297 insertions(+), 202 deletions(-)
 
 --- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
 +++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
@@ -557,7 +566,7 @@
 +		memcpy(&payload.eth.h_source, mesh_addr, ETH_ALEN);
 +		break;
 +	case MESH_FLAGS_AE_A5_A6:
-+		memcpy(&payload.eth.h_dest, mesh_addr, 2 * ETH_ALEN);
++		memcpy(&payload.eth, mesh_addr, 2 * ETH_ALEN);
 +		break;
 +	default:
 +		break;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/336-v6.4-wifi-mac80211-generate-EMA-beacons-in-AP-mode.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/336-v6.4-wifi-mac80211-generate-EMA-beacons-in-AP-mode.patch
new file mode 100644
index 0000000..088f468
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/336-v6.4-wifi-mac80211-generate-EMA-beacons-in-AP-mode.patch
@@ -0,0 +1,372 @@
+From bd54f3c29077f23dad92ef82a78061b40be30c65 Mon Sep 17 00:00:00 2001
+From: Aloka Dixit <quic_alokad@quicinc.com>
+Date: Mon, 5 Dec 2022 16:50:37 -0800
+Subject: [PATCH] wifi: mac80211: generate EMA beacons in AP mode
+
+Add APIs to generate an array of beacons for an EMA AP (enhanced
+multiple BSSID advertisements), each including a single MBSSID element.
+EMA profile periodicity equals the count of elements.
+
+- ieee80211_beacon_get_template_ema_list() - Generate and return all
+EMA beacon templates. Drivers must call ieee80211_beacon_free_ema_list()
+to free the memory. No change in the prototype for the existing API,
+ieee80211_beacon_get_template(), which should be used for non-EMA AP.
+
+- ieee80211_beacon_get_template_ema_index() - Generate a beacon which
+includes the multiple BSSID element at the given index. Drivers can use
+this function in a loop until NULL is returned which indicates end of
+available MBSSID elements.
+
+- ieee80211_beacon_free_ema_list() - free the memory allocated for the
+list of EMA beacon templates.
+
+Modify existing functions ieee80211_beacon_get_ap(),
+ieee80211_get_mbssid_beacon_len() and ieee80211_beacon_add_mbssid()
+to accept a new parameter for EMA index.
+
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+Co-developed-by: John Crispin <john@phrozen.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Link: https://lore.kernel.org/r/20221206005040.3177-2-quic_alokad@quicinc.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ include/net/mac80211.h     |  68 +++++++++++++++++++
+ net/mac80211/cfg.c         |  11 +--
+ net/mac80211/ieee80211_i.h |  10 ++-
+ net/mac80211/tx.c          | 134 ++++++++++++++++++++++++++++++++++---
+ 4 files changed, 205 insertions(+), 18 deletions(-)
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -5252,6 +5252,74 @@ ieee80211_beacon_get_template(struct iee
+ 			      unsigned int link_id);
+ 
+ /**
++ * ieee80211_beacon_get_template_ema_index - EMA beacon template generation
++ * @hw: pointer obtained from ieee80211_alloc_hw().
++ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
++ * @offs: &struct ieee80211_mutable_offsets pointer to struct that will
++ *	receive the offsets that may be updated by the driver.
++ * @link_id: the link id to which the beacon belongs (or 0 for a non-MLD AP).
++ * @ema_index: index of the beacon in the EMA set.
++ *
++ * This function follows the same rules as ieee80211_beacon_get_template()
++ * but returns a beacon template which includes multiple BSSID element at the
++ * requested index.
++ *
++ * Return: The beacon template. %NULL indicates the end of EMA templates.
++ */
++struct sk_buff *
++ieee80211_beacon_get_template_ema_index(struct ieee80211_hw *hw,
++					struct ieee80211_vif *vif,
++					struct ieee80211_mutable_offsets *offs,
++					unsigned int link_id, u8 ema_index);
++
++/**
++ * struct ieee80211_ema_beacons - List of EMA beacons
++ * @cnt: count of EMA beacons.
++ *
++ * @bcn: array of EMA beacons.
++ * @bcn.skb: the skb containing this specific beacon
++ * @bcn.offs: &struct ieee80211_mutable_offsets pointer to struct that will
++ *	receive the offsets that may be updated by the driver.
++ */
++struct ieee80211_ema_beacons {
++	u8 cnt;
++	struct {
++		struct sk_buff *skb;
++		struct ieee80211_mutable_offsets offs;
++	} bcn[];
++};
++
++/**
++ * ieee80211_beacon_get_template_ema_list - EMA beacon template generation
++ * @hw: pointer obtained from ieee80211_alloc_hw().
++ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
++ * @link_id: the link id to which the beacon belongs (or 0 for a non-MLD AP)
++ *
++ * This function follows the same rules as ieee80211_beacon_get_template()
++ * but allocates and returns a pointer to list of all beacon templates required
++ * to cover all profiles in the multiple BSSID set. Each template includes only
++ * one multiple BSSID element.
++ *
++ * Driver must call ieee80211_beacon_free_ema_list() to free the memory.
++ *
++ * Return: EMA beacon templates of type struct ieee80211_ema_beacons *.
++ *	%NULL on error.
++ */
++struct ieee80211_ema_beacons *
++ieee80211_beacon_get_template_ema_list(struct ieee80211_hw *hw,
++				       struct ieee80211_vif *vif,
++				       unsigned int link_id);
++
++/**
++ * ieee80211_beacon_free_ema_list - free an EMA beacon template list
++ * @ema_beacons: list of EMA beacons of type &struct ieee80211_ema_beacons pointers.
++ *
++ * This function will free a list previously acquired by calling
++ * ieee80211_beacon_get_template_ema_list()
++ */
++void ieee80211_beacon_free_ema_list(struct ieee80211_ema_beacons *ema_beacons);
++
++/**
+  * ieee80211_beacon_get_tim - beacon generation function
+  * @hw: pointer obtained from ieee80211_alloc_hw().
+  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1122,11 +1122,11 @@ static int ieee80211_assign_beacon(struc
+ 	if (params->mbssid_ies) {
+ 		mbssid = params->mbssid_ies;
+ 		size += struct_size(new->mbssid_ies, elem, mbssid->cnt);
+-		size += ieee80211_get_mbssid_beacon_len(mbssid);
++		size += ieee80211_get_mbssid_beacon_len(mbssid, mbssid->cnt);
+ 	} else if (old && old->mbssid_ies) {
+ 		mbssid = old->mbssid_ies;
+ 		size += struct_size(new->mbssid_ies, elem, mbssid->cnt);
+-		size += ieee80211_get_mbssid_beacon_len(mbssid);
++		size += ieee80211_get_mbssid_beacon_len(mbssid, mbssid->cnt);
+ 	}
+ 
+ 	new = kzalloc(size, GFP_KERNEL);
+@@ -3384,8 +3384,11 @@ cfg80211_beacon_dup(struct cfg80211_beac
+ 
+ 	len = beacon->head_len + beacon->tail_len + beacon->beacon_ies_len +
+ 	      beacon->proberesp_ies_len + beacon->assocresp_ies_len +
+-	      beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len +
+-	      ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies);
++	      beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len;
++
++	if (beacon->mbssid_ies)
++		len += ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies,
++						       beacon->mbssid_ies->cnt);
+ 
+ 	new_beacon = kzalloc(sizeof(*new_beacon) + len, GFP_KERNEL);
+ 	if (!new_beacon)
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1182,13 +1182,17 @@ ieee80211_vif_get_shift(struct ieee80211
+ }
+ 
+ static inline int
+-ieee80211_get_mbssid_beacon_len(struct cfg80211_mbssid_elems *elems)
++ieee80211_get_mbssid_beacon_len(struct cfg80211_mbssid_elems *elems, u8 i)
+ {
+-	int i, len = 0;
++	int len = 0;
+ 
+-	if (!elems)
++	if (!elems || !elems->cnt || i > elems->cnt)
+ 		return 0;
+ 
++	if (i < elems->cnt)
++		return elems->elem[i].len;
++
++	/* i == elems->cnt, calculate total length of all MBSSID elements */
+ 	for (i = 0; i < elems->cnt; i++)
+ 		len += elems->elem[i].len;
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -5205,13 +5205,20 @@ ieee80211_beacon_get_finish(struct ieee8
+ }
+ 
+ static void
+-ieee80211_beacon_add_mbssid(struct sk_buff *skb, struct beacon_data *beacon)
++ieee80211_beacon_add_mbssid(struct sk_buff *skb, struct beacon_data *beacon,
++			    u8 i)
+ {
+-	int i;
++	if (!beacon->mbssid_ies || !beacon->mbssid_ies->cnt ||
++	    i > beacon->mbssid_ies->cnt)
++		return;
+ 
+-	if (!beacon->mbssid_ies)
++	if (i < beacon->mbssid_ies->cnt) {
++		skb_put_data(skb, beacon->mbssid_ies->elem[i].data,
++			     beacon->mbssid_ies->elem[i].len);
+ 		return;
++	}
+ 
++	/* i == beacon->mbssid_ies->cnt, include all MBSSID elements */
+ 	for (i = 0; i < beacon->mbssid_ies->cnt; i++)
+ 		skb_put_data(skb, beacon->mbssid_ies->elem[i].data,
+ 			     beacon->mbssid_ies->elem[i].len);
+@@ -5224,7 +5231,8 @@ ieee80211_beacon_get_ap(struct ieee80211
+ 			struct ieee80211_mutable_offsets *offs,
+ 			bool is_template,
+ 			struct beacon_data *beacon,
+-			struct ieee80211_chanctx_conf *chanctx_conf)
++			struct ieee80211_chanctx_conf *chanctx_conf,
++			u8 ema_index)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+@@ -5243,7 +5251,9 @@ ieee80211_beacon_get_ap(struct ieee80211
+ 	/* headroom, head length,
+ 	 * tail length, maximum TIM length and multiple BSSID length
+ 	 */
+-	mbssid_len = ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies);
++	mbssid_len = ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies,
++						     ema_index);
++
+ 	skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
+ 			    beacon->tail_len + 256 +
+ 			    local->hw.extra_beacon_tailroom + mbssid_len);
+@@ -5261,7 +5271,7 @@ ieee80211_beacon_get_ap(struct ieee80211
+ 		offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
+ 
+ 		if (mbssid_len) {
+-			ieee80211_beacon_add_mbssid(skb, beacon);
++			ieee80211_beacon_add_mbssid(skb, beacon, ema_index);
+ 			offs->mbssid_off = skb->len - mbssid_len;
+ 		}
+ 
+@@ -5280,12 +5290,51 @@ ieee80211_beacon_get_ap(struct ieee80211
+ 	return skb;
+ }
+ 
++static struct ieee80211_ema_beacons *
++ieee80211_beacon_get_ap_ema_list(struct ieee80211_hw *hw,
++				 struct ieee80211_vif *vif,
++				 struct ieee80211_link_data *link,
++				 struct ieee80211_mutable_offsets *offs,
++				 bool is_template, struct beacon_data *beacon,
++				 struct ieee80211_chanctx_conf *chanctx_conf)
++{
++	struct ieee80211_ema_beacons *ema = NULL;
++
++	if (!beacon->mbssid_ies || !beacon->mbssid_ies->cnt)
++		return NULL;
++
++	ema = kzalloc(struct_size(ema, bcn, beacon->mbssid_ies->cnt),
++		      GFP_ATOMIC);
++	if (!ema)
++		return NULL;
++
++	for (ema->cnt = 0; ema->cnt < beacon->mbssid_ies->cnt; ema->cnt++) {
++		ema->bcn[ema->cnt].skb =
++			ieee80211_beacon_get_ap(hw, vif, link,
++						&ema->bcn[ema->cnt].offs,
++						is_template, beacon,
++						chanctx_conf, ema->cnt);
++		if (!ema->bcn[ema->cnt].skb)
++			break;
++	}
++
++	if (ema->cnt == beacon->mbssid_ies->cnt)
++		return ema;
++
++	ieee80211_beacon_free_ema_list(ema);
++	return NULL;
++}
++
++#define IEEE80211_INCLUDE_ALL_MBSSID_ELEMS -1
++
+ static struct sk_buff *
+ __ieee80211_beacon_get(struct ieee80211_hw *hw,
+ 		       struct ieee80211_vif *vif,
+ 		       struct ieee80211_mutable_offsets *offs,
+ 		       bool is_template,
+-		       unsigned int link_id)
++		       unsigned int link_id,
++		       int ema_index,
++		       struct ieee80211_ema_beacons **ema_beacons)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct beacon_data *beacon = NULL;
+@@ -5314,8 +5363,29 @@ __ieee80211_beacon_get(struct ieee80211_
+ 		if (!beacon)
+ 			goto out;
+ 
+-		skb = ieee80211_beacon_get_ap(hw, vif, link, offs, is_template,
+-					      beacon, chanctx_conf);
++		if (ema_beacons) {
++			*ema_beacons =
++				ieee80211_beacon_get_ap_ema_list(hw, vif, link,
++								 offs,
++								 is_template,
++								 beacon,
++								 chanctx_conf);
++		} else {
++			if (beacon->mbssid_ies && beacon->mbssid_ies->cnt) {
++				if (ema_index >= beacon->mbssid_ies->cnt)
++					goto out; /* End of MBSSID elements */
++
++				if (ema_index <= IEEE80211_INCLUDE_ALL_MBSSID_ELEMS)
++					ema_index = beacon->mbssid_ies->cnt;
++			} else {
++				ema_index = 0;
++			}
++
++			skb = ieee80211_beacon_get_ap(hw, vif, link, offs,
++						      is_template, beacon,
++						      chanctx_conf,
++						      ema_index);
++		}
+ 	} else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+ 		struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+ 		struct ieee80211_hdr *hdr;
+@@ -5403,10 +5473,50 @@ ieee80211_beacon_get_template(struct iee
+ 			      struct ieee80211_mutable_offsets *offs,
+ 			      unsigned int link_id)
+ {
+-	return __ieee80211_beacon_get(hw, vif, offs, true, link_id);
++	return __ieee80211_beacon_get(hw, vif, offs, true, link_id,
++				      IEEE80211_INCLUDE_ALL_MBSSID_ELEMS, NULL);
+ }
+ EXPORT_SYMBOL(ieee80211_beacon_get_template);
+ 
++struct sk_buff *
++ieee80211_beacon_get_template_ema_index(struct ieee80211_hw *hw,
++					struct ieee80211_vif *vif,
++					struct ieee80211_mutable_offsets *offs,
++					unsigned int link_id, u8 ema_index)
++{
++	return __ieee80211_beacon_get(hw, vif, offs, true, link_id, ema_index,
++				      NULL);
++}
++EXPORT_SYMBOL(ieee80211_beacon_get_template_ema_index);
++
++void ieee80211_beacon_free_ema_list(struct ieee80211_ema_beacons *ema_beacons)
++{
++	u8 i;
++
++	if (!ema_beacons)
++		return;
++
++	for (i = 0; i < ema_beacons->cnt; i++)
++		kfree_skb(ema_beacons->bcn[i].skb);
++
++	kfree(ema_beacons);
++}
++EXPORT_SYMBOL(ieee80211_beacon_free_ema_list);
++
++struct ieee80211_ema_beacons *
++ieee80211_beacon_get_template_ema_list(struct ieee80211_hw *hw,
++				       struct ieee80211_vif *vif,
++				       unsigned int link_id)
++{
++	struct ieee80211_ema_beacons *ema_beacons = NULL;
++
++	WARN_ON(__ieee80211_beacon_get(hw, vif, NULL, false, link_id, 0,
++				       &ema_beacons));
++
++	return ema_beacons;
++}
++EXPORT_SYMBOL(ieee80211_beacon_get_template_ema_list);
++
+ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
+ 					 struct ieee80211_vif *vif,
+ 					 u16 *tim_offset, u16 *tim_length,
+@@ -5414,7 +5524,9 @@ struct sk_buff *ieee80211_beacon_get_tim
+ {
+ 	struct ieee80211_mutable_offsets offs = {};
+ 	struct sk_buff *bcn = __ieee80211_beacon_get(hw, vif, &offs, false,
+-						     link_id);
++						     link_id,
++						     IEEE80211_INCLUDE_ALL_MBSSID_ELEMS,
++						     NULL);
+ 	struct sk_buff *copy;
+ 	int shift;
+ 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
index b1e84e2..4a3984f 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
@@ -77,7 +77,7 @@
  static void ieee80211_rfkill_poll(struct wiphy *wiphy)
  {
  	struct ieee80211_local *local = wiphy_priv(wiphy);
-@@ -4953,6 +4966,7 @@ const struct cfg80211_ops mac80211_confi
+@@ -4956,6 +4969,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
@@ -87,7 +87,7 @@
  	CFG80211_TESTMODE_DUMP(ieee80211_testmode_dump)
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1538,6 +1538,7 @@ struct ieee80211_local {
+@@ -1542,6 +1542,7 @@ struct ieee80211_local {
  	int dynamic_ps_forced_timeout;
  
  	int user_power_level; /* in dBm, for all interfaces */
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
index 9da26b5..fc8bd63 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
@@ -36,6 +36,7 @@
     file://333-wifi-mac80211-add-flush_sta-method.patch \
     file://334-wifi-iwlwifi-mvm-support-new-flush_sta-method.patch \
     file://335-wifi-mac80211-add-LDPC-related-flags-in-ieee80211_bs.patch \
+    file://336-v6.4-wifi-mac80211-generate-EMA-beacons-in-AP-mode.patch \
     file://400-allow-ibss-mixed.patch \
     file://500-mac80211_configure_antenna_gain.patch \
     file://782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch \
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/432-missing-typedef.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/432-missing-typedef.patch
deleted file mode 100644
index 7a100f1..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/432-missing-typedef.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/src/drivers/linux_wext.h
-+++ b/src/drivers/linux_wext.h
-@@ -26,6 +26,7 @@ typedef int32_t __s32;
- typedef uint16_t __u16;
- typedef int16_t __s16;
- typedef uint8_t __u8;
-+typedef int8_t __s8;
- #ifndef __user
- #define __user
- #endif /* __user */
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0101-hostapd-mtk-Fix-CCA-issue.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0029-hostapd-mtk-Fix-CCA-issue.patch
similarity index 88%
rename from recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0101-hostapd-mtk-Fix-CCA-issue.patch
rename to recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0029-hostapd-mtk-Fix-CCA-issue.patch
index 9b46d70..e4667e4 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0101-hostapd-mtk-Fix-CCA-issue.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0029-hostapd-mtk-Fix-CCA-issue.patch
@@ -1,12 +1,12 @@
-From 39a0dd44653f12ce13af68de81bfae683669623a Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Thu, 11 May 2023 14:08:59 +0800
-Subject: [PATCH 101/103] hostapd: mtk: Fix CCA issue
+From c92a1e50abdad2bf3e961c9d5aa34baea81f025b Mon Sep 17 00:00:00 2001
+From: Michael Lee <michael-cy.lee@mediatek.com>
+Date: Wed, 3 May 2023 14:55:18 +0800
+Subject: [PATCH] hostapd: mtk: Fix CCA issue
 
-When receiving CCA related nl80211 command, hostapd used to work on
+When receiving CCA-related nl80211 commands, hostapd used to work on
 struct wpa_driver_nl80211_data, whose ctx always points to
-hostpad_iface->bss[0]. However, CCA command is sent on per-BSS based.
-This patch makes hostapd handle CCA related commands on per-BSS based.
+hostpad_iface->bss[0]. However, CCA commands are sent on a per-BSS based.
+This patch makes hostapd handle CCA-related commands on a per-BSS based.
 
 Signed-off-by: Michael Lee <michael-cy.lee@mediatek.com>
 ---
@@ -93,5 +93,5 @@
  #endif /* CONFIG_IEEE80211AX */
  	default:
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0102-hostapd-mtk-Fix-unexpected-AP-beacon-state-transitio.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0030-hostapd-mtk-Fix-unexpected-AP-beacon-state-transitio.patch
similarity index 66%
rename from recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0102-hostapd-mtk-Fix-unexpected-AP-beacon-state-transitio.patch
rename to recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0030-hostapd-mtk-Fix-unexpected-AP-beacon-state-transitio.patch
index 4075531..f9c4714 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0102-hostapd-mtk-Fix-unexpected-AP-beacon-state-transitio.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0030-hostapd-mtk-Fix-unexpected-AP-beacon-state-transitio.patch
@@ -1,15 +1,14 @@
-From 097b204ffed838a4bbf7649fb23310f64ace22ad Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Thu, 11 May 2023 14:12:44 +0800
-Subject: [PATCH 102/103] hostapd: mtk: Fix unexpected AP beacon state
- transition
+From c4d3890bbf1bd8c8ac8bfaa56fd16e2391e05181 Mon Sep 17 00:00:00 2001
+From: Michael Lee <michael-cy.lee@mediatek.com>
+Date: Wed, 3 May 2023 16:10:57 +0800
+Subject: [PATCH] hostapd: mtk: Fix unexpected AP beacon state transition
 
-When AP fails setting the beacon, it assigns bss->beacon_set to 0 no
+When AP fails to set the beacon, it assigns bss->beacon_set to 0 no
 matter what the error number is.
 However, in the case that the error number is -EBUSY, the driver might
 not free the beacon and expect a later beacon re-setting. If hostapd set
-a new beacon under this case, driver will return -EALREADY.
-This patch checks the error number after hostapd fails setting the
+a new beacon under this case, the driver will return -EALREADY.
+This patch checks the error number after hostapd fails to set the
 beacon. If the error number is -EBUSY, bss->beacon_set will not be
 assigned to 0.
 
@@ -19,7 +18,7 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 8400e57..ccfc2d0 100644
+index 8400e57..5013207 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -5126,7 +5126,8 @@ static int wpa_driver_nl80211_set_ap(void *priv,
@@ -33,5 +32,5 @@
  		bss->flink->beacon_set = 1;
  		nl80211_set_bss(bss, params->cts_protect, params->preamble,
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
index a71c43f..38ca4d8 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
@@ -36,7 +36,6 @@
     file://420-indicate-features.patch \
     file://430-hostapd_cli_ifdef.patch \
     file://431-wpa_cli_ifdef.patch \
-    file://432-missing-typedef.patch \
     file://450-scan_wait.patch;apply=no \
     file://460-wpa_supplicant-add-new-config-params-to-be-used-with.patch \
     file://463-add-mcast_rate-to-11s.patch \
@@ -87,8 +86,8 @@
     file://mtk-0026-hostapd-mtk-avoid-setting-beacon-after-wpa_supplican.patch \
     file://mtk-0027-hostapd-mtk-Fix-setting-wrong-seg0-index-for-5G-cent.patch \
     file://mtk-0028-hostapd-mtk-Add-muru-user-number-debug-command.patch \
+    file://mtk-0029-hostapd-mtk-Fix-CCA-issue.patch \
+    file://mtk-0030-hostapd-mtk-Fix-unexpected-AP-beacon-state-transitio.patch \
     file://mtk-0100-hostapd-mtk-update-eht-operation-element.patch \
-    file://mtk-0101-hostapd-mtk-Fix-CCA-issue.patch \
-    file://mtk-0102-hostapd-mtk-Fix-unexpected-AP-beacon-state-transitio.patch \
     file://mtk-0103-hostapd-mtk-Add-BW320-channel-switch-command.patch \
     "