[Add meta-filogic bsp for rdkb development]
[Description]
Add meta-filogic bsp for rdkb development
1. rdkb base on dunfell rdkb-next (> 2022q1)
2. arm64/arm 32bit bsp both can run on rdkb
[Release-log]
N/A
diff --git a/recipes-kernel/linux-mac80211/files/patches/build/000-fix_kconfig.patch b/recipes-kernel/linux-mac80211/files/patches/build/000-fix_kconfig.patch
new file mode 100644
index 0000000..3987aae
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/build/000-fix_kconfig.patch
@@ -0,0 +1,14 @@
+--- a/kconf/Makefile
++++ b/kconf/Makefile
+@@ -1,9 +1,9 @@
+-CFLAGS=-Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
++CFLAGS=-Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -DKBUILD_NO_NLS
+
+ LXDIALOG := lxdialog/checklist.o lxdialog/inputbox.o lxdialog/menubox.o lxdialog/textbox.o lxdialog/util.o lxdialog/yesno.o
+
+ conf: conf.o zconf.tab.o
+-mconf_CFLAGS := $(shell ./lxdialog/check-lxdialog.sh -ccflags) -DLOCALE
++mconf_CFLAGS := $(shell ./lxdialog/check-lxdialog.sh -ccflags)
+ mconf_LDFLAGS := $(shell ./lxdialog/check-lxdialog.sh -ldflags $(CC))
+ mconf: CFLAGS += $(mconf_CFLAGS)
+
diff --git a/recipes-kernel/linux-mac80211/files/patches/build/001-fix_build.patch b/recipes-kernel/linux-mac80211/files/patches/build/001-fix_build.patch
new file mode 100644
index 0000000..8f63d36
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/build/001-fix_build.patch
@@ -0,0 +1,169 @@
+--- a/Makefile
++++ b/Makefile
+@@ -5,7 +5,7 @@
+ ifeq ($(KERNELRELEASE),)
+
+ MAKEFLAGS += --no-print-directory
+-SHELL := /bin/bash
++SHELL := /usr/bin/env bash
+ BACKPORT_DIR := $(shell pwd)
+
+ KMODDIR ?= updates
+@@ -19,6 +19,7 @@ KLIB_BUILD ?= $(KLIB)/build/
+ KERNEL_CONFIG := $(KLIB_BUILD)/.config
+ KERNEL_MAKEFILE := $(KLIB_BUILD)/Makefile
+ CONFIG_MD5 := $(shell md5sum $(KERNEL_CONFIG) 2>/dev/null | sed 's/\s.*//')
++STAMP_KERNEL_CONFIG := .kernel_config_md5_$(CONFIG_MD5)
+
+ export KLIB KLIB_BUILD BACKPORT_DIR KMODDIR KMODPATH_ARG
+
+@@ -36,7 +37,8 @@ mrproper:
+ @rm -f .kernel_config_md5 Kconfig.versions Kconfig.kernel
+ @rm -f backport-include/backport/autoconf.h
+
+-.DEFAULT:
++.SILENT: $(STAMP_KERNEL_CONFIG)
++$(STAMP_KERNEL_CONFIG):
+ @set -e ; test -f local-symbols || ( \
+ echo "/--------------" ;\
+ echo "| You shouldn't run make in the backports tree, but only in" ;\
+@@ -60,58 +62,62 @@ mrproper:
+ echo "| (that isn't currently running.)" ;\
+ echo "\\--" ;\
+ false)
+- @set -e ; if [ "$$(cat .kernel_config_md5 2>/dev/null)" != "$(CONFIG_MD5)" ] ;\
+- then \
+- echo -n "Generating local configuration database from kernel ..." ;\
+- grep -v -f local-symbols $(KERNEL_CONFIG) | grep = | ( \
+- while read l ; do \
+- if [ "$${l:0:7}" != "CONFIG_" ] ; then \
+- continue ;\
+- fi ;\
+- l=$${l:7} ;\
+- n=$${l%%=*} ;\
+- v=$${l#*=} ;\
+- if [ "$$v" = "m" ] ; then \
+- echo config $$n ;\
+- echo ' tristate' ;\
+- elif [ "$$v" = "y" ] ; then \
+- echo config $$n ;\
+- echo ' bool' ;\
+- else \
+- continue ;\
+- fi ;\
+- echo " default $$v" ;\
+- echo "" ;\
+- done \
+- ) > Kconfig.kernel ;\
+- kver=$$($(MAKE) --no-print-directory -C $(KLIB_BUILD) M=$(BACKPORT_DIR) \
+- kernelversion | sed 's/^\(\([3-5]\|2\.6\)\.[0-9]\+\).*/\1/;t;d');\
+- test "$$kver" != "" || echo "Kernel version parse failed!" ;\
+- test "$$kver" != "" ;\
+- kvers="$$(seq 14 39 | sed 's/^/2.6./')" ;\
+- kvers="$$kvers $$(seq 0 19 | sed 's/^/3./')" ;\
+- kvers="$$kvers $$(seq 0 20 | sed 's/^/4./')" ;\
+- kvers="$$kvers $$(seq 0 99 | sed 's/^/5./')" ;\
+- print=0 ;\
+- for v in $$kvers ; do \
+- if [ "$$print" = "1" ] ; then \
+- echo config KERNEL_$$(echo $$v | tr . _) ;\
+- echo " def_bool y" ;\
+- fi ;\
+- if [ "$$v" = "$$kver" ] ; then print=1 ; fi ;\
+- done > Kconfig.versions ;\
+- # RHEL as well, sadly we need to grep for it ;\
+- RHEL_MAJOR=$$(grep '^RHEL_MAJOR' $(KERNEL_MAKEFILE) | \
+- sed 's/.*=\s*\([0-9]*\)/\1/;t;d') ;\
+- RHEL_MINOR=$$(grep '^RHEL_MINOR' $(KERNEL_MAKEFILE) | \
+- sed 's/.*=\s*\([0-9]*\)/\1/;t;d') ;\
+- for v in $$(seq 0 $$RHEL_MINOR) ; do \
+- echo config BACKPORT_RHEL_KERNEL_$${RHEL_MAJOR}_$$v ;\
+- echo " def_bool y" ;\
+- done >> Kconfig.versions ;\
+- echo " done." ;\
+- fi ;\
+- echo "$(CONFIG_MD5)" > .kernel_config_md5
++ @rm -f .kernel_config_md5_*
++ @touch $@
++
++Kconfig.kernel: $(STAMP_KERNEL_CONFIG) local-symbols
++ @printf "Generating local configuration database from kernel ..."
++ @grep -v -f local-symbols $(KERNEL_CONFIG) | grep = | ( \
++ while read l ; do \
++ if [ "$${l:0:7}" != "CONFIG_" ] ; then \
++ continue ;\
++ fi ;\
++ l=$${l:7} ;\
++ n=$${l%%=*} ;\
++ v=$${l#*=} ;\
++ if [ "$$v" = "m" ] ; then \
++ echo config $$n ;\
++ echo ' tristate' ;\
++ elif [ "$$v" = "y" ] ; then \
++ echo config $$n ;\
++ echo ' bool' ;\
++ else \
++ continue ;\
++ fi ;\
++ echo " default $$v" ;\
++ echo "" ;\
++ done \
++ ) > $@
++ @echo " done."
++
++Kconfig.versions: Kconfig.kernel
++ @kver=$$($(MAKE) --no-print-directory -C $(KLIB_BUILD) M=$(BACKPORT_DIR) \
++ kernelversion | sed 's/^\(\([3-5]\|2\.6\)\.[0-9]\+\).*/\1/;t;d');\
++ test "$$kver" != "" || echo "Kernel version parse failed!" ;\
++ test "$$kver" != "" ;\
++ kvers="$$(seq 14 39 | sed 's/^/2.6./')" ;\
++ kvers="$$kvers $$(seq 0 19 | sed 's/^/3./')" ;\
++ kvers="$$kvers $$(seq 0 20 | sed 's/^/4./')" ;\
++ kvers="$$kvers $$(seq 0 99 | sed 's/^/5./')" ;\
++ print=0 ;\
++ for v in $$kvers ; do \
++ if [ "$$print" = "1" ] ; then \
++ echo config KERNEL_$$(echo $$v | tr . _) ;\
++ echo " def_bool y" ;\
++ fi ;\
++ if [ "$$v" = "$$kver" ] ; then print=1 ; fi ;\
++ done > $@
++ @RHEL_MAJOR=$$(grep '^RHEL_MAJOR' $(KERNEL_MAKEFILE) | \
++ sed 's/.*=\s*\([0-9]*\)/\1/;t;d') ;\
++ RHEL_MINOR=$$(grep '^RHEL_MINOR' $(KERNEL_MAKEFILE) | \
++ sed 's/.*=\s*\([0-9]*\)/\1/;t;d') ;\
++ for v in $$(seq 0 $$RHEL_MINOR) ; do \
++ echo config BACKPORT_RHEL_KERNEL_$${RHEL_MAJOR}_$$v ;\
++ echo " def_bool y" ;\
++ done >> $@
++
++.DEFAULT:
++ @$(MAKE) Kconfig.versions
+ @$(MAKE) -f Makefile.real "$@"
+
+ .PHONY: defconfig-help
+--- a/Makefile.real
++++ b/Makefile.real
+@@ -59,7 +59,7 @@ defconfig-%::
+
+ backport-include/backport/autoconf.h: .config Kconfig.versions Kconfig.kernel
+ @$(MAKE) oldconfig
+- @echo -n "Building backport-include/backport/autoconf.h ..."
++ @printf "Building backport-include/backport/autoconf.h ..."
+ @grep -f local-symbols .config | ( \
+ echo "#ifndef COMPAT_AUTOCONF_INCLUDED" ;\
+ echo "#define COMPAT_AUTOCONF_INCLUDED" ;\
+@@ -80,7 +80,12 @@ backport-include/backport/autoconf.h: .c
+ esac ;\
+ done ;\
+ echo "#endif /* COMPAT_AUTOCONF_INCLUDED */" ;\
+- ) > backport-include/backport/autoconf.h
++ ) > $@.new
++ @if cmp -s $@ $@.new; then \
++ rm -f $@.new; \
++ else \
++ mv $@.new $@; \
++ fi
+ @echo " done."
+
+ .PHONY: modules
diff --git a/recipes-kernel/linux-mac80211/files/patches/build/002-change_allconfig.patch b/recipes-kernel/linux-mac80211/files/patches/build/002-change_allconfig.patch
new file mode 100644
index 0000000..368725d
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/build/002-change_allconfig.patch
@@ -0,0 +1,64 @@
+--- a/kconf/conf.c
++++ b/kconf/conf.c
+@@ -598,40 +598,12 @@ int main(int ac, char **av)
+ case oldconfig:
+ case listnewconfig:
+ case olddefconfig:
+- conf_read(NULL);
+- break;
+ case allnoconfig:
+ case allyesconfig:
+ case allmodconfig:
+ case alldefconfig:
+ case randconfig:
+- name = getenv("KCONFIG_ALLCONFIG");
+- if (!name)
+- break;
+- if ((strcmp(name, "") != 0) && (strcmp(name, "1") != 0)) {
+- if (conf_read_simple(name, S_DEF_USER)) {
+- fprintf(stderr,
+- _("*** Can't read seed configuration \"%s\"!\n"),
+- name);
+- exit(1);
+- }
+- break;
+- }
+- switch (input_mode) {
+- case allnoconfig: name = "allno.config"; break;
+- case allyesconfig: name = "allyes.config"; break;
+- case allmodconfig: name = "allmod.config"; break;
+- case alldefconfig: name = "alldef.config"; break;
+- case randconfig: name = "allrandom.config"; break;
+- default: break;
+- }
+- if (conf_read_simple(name, S_DEF_USER) &&
+- conf_read_simple("all.config", S_DEF_USER)) {
+- fprintf(stderr,
+- _("*** KCONFIG_ALLCONFIG set, but no \"%s\" or \"all.config\" file found\n"),
+- name);
+- exit(1);
+- }
++ conf_read(NULL);
+ break;
+ default:
+ break;
+--- a/kconf/confdata.c
++++ b/kconf/confdata.c
+@@ -1170,6 +1170,8 @@ bool conf_set_all_new_symbols(enum conf_
+ }
+ bool has_changed = false;
+
++ sym_clear_all_valid();
++
+ for_all_symbols(i, sym) {
+ if (sym_has_value(sym) || (sym->flags & SYMBOL_VALID))
+ continue;
+@@ -1213,8 +1215,6 @@ bool conf_set_all_new_symbols(enum conf_
+
+ }
+
+- sym_clear_all_valid();
+-
+ /*
+ * We have different type of choice blocks.
+ * If curr.tri equals to mod then we can select several
diff --git a/recipes-kernel/linux-mac80211/files/patches/build/003-remove_bogus_modparams.patch b/recipes-kernel/linux-mac80211/files/patches/build/003-remove_bogus_modparams.patch
new file mode 100644
index 0000000..aa26c8c
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/build/003-remove_bogus_modparams.patch
@@ -0,0 +1,34 @@
+--- a/compat/main.c
++++ b/compat/main.c
+@@ -19,31 +19,6 @@ MODULE_LICENSE("GPL");
+ #error "You need a CPTCFG_VERSION"
+ #endif
+
+-static char *backported_kernel_name = CPTCFG_KERNEL_NAME;
+-
+-module_param(backported_kernel_name, charp, 0400);
+-MODULE_PARM_DESC(backported_kernel_name,
+- "The kernel tree name that was used for this backport (" CPTCFG_KERNEL_NAME ")");
+-
+-#ifdef BACKPORTS_GIT_TRACKED
+-static char *backports_tracker_id = BACKPORTS_GIT_TRACKED;
+-module_param(backports_tracker_id, charp, 0400);
+-MODULE_PARM_DESC(backports_tracker_id,
+- "The version of the tree containing this backport (" BACKPORTS_GIT_TRACKED ")");
+-#else
+-static char *backported_kernel_version = CPTCFG_KERNEL_VERSION;
+-static char *backports_version = CPTCFG_VERSION;
+-
+-module_param(backported_kernel_version, charp, 0400);
+-MODULE_PARM_DESC(backported_kernel_version,
+- "The kernel version that was used for this backport (" CPTCFG_KERNEL_VERSION ")");
+-
+-module_param(backports_version, charp, 0400);
+-MODULE_PARM_DESC(backports_version,
+- "The git version of the backports tree used to generate this backport (" CPTCFG_VERSION ")");
+-
+-#endif
+-
+ void backport_dependency_symbol(void)
+ {
+ }
diff --git a/recipes-kernel/linux-mac80211/files/patches/build/012-kernel_build_check.patch b/recipes-kernel/linux-mac80211/files/patches/build/012-kernel_build_check.patch
new file mode 100644
index 0000000..d225ba1
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/build/012-kernel_build_check.patch
@@ -0,0 +1,11 @@
+--- a/Makefile
++++ b/Makefile
+@@ -2,7 +2,7 @@
+ # Makefile for the output source package
+ #
+
+-ifeq ($(KERNELRELEASE),)
++ifeq ($(KERNELVERSION),)
+
+ MAKEFLAGS += --no-print-directory
+ SHELL := /usr/bin/env bash
diff --git a/recipes-kernel/linux-mac80211/files/patches/build/015-ipw200-mtu.patch b/recipes-kernel/linux-mac80211/files/patches/build/015-ipw200-mtu.patch
new file mode 100644
index 0000000..68db4f7
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/build/015-ipw200-mtu.patch
@@ -0,0 +1,34 @@
+--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
++++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+@@ -11470,6 +11470,15 @@ static const struct attribute_group ipw_
+ .attrs = ipw_sysfs_entries,
+ };
+
++#if LINUX_VERSION_IS_LESS(4,10,0)
++static int __change_mtu(struct net_device *ndev, int new_mtu){
++ if (new_mtu < 68 || new_mtu > LIBIPW_DATA_LEN)
++ return -EINVAL;
++ ndev->mtu = new_mtu;
++ return 0;
++}
++#endif
++
+ #ifdef CPTCFG_IPW2200_PROMISCUOUS
+ static int ipw_prom_open(struct net_device *dev)
+ {
+@@ -11518,15 +11527,6 @@ static netdev_tx_t ipw_prom_hard_start_x
+ return NETDEV_TX_OK;
+ }
+
+-#if LINUX_VERSION_IS_LESS(4,10,0)
+-static int __change_mtu(struct net_device *ndev, int new_mtu){
+- if (new_mtu < 68 || new_mtu > LIBIPW_DATA_LEN)
+- return -EINVAL;
+- ndev->mtu = new_mtu;
+- return 0;
+-}
+-#endif
+-
+ static const struct net_device_ops ipw_prom_netdev_ops = {
+ #if LINUX_VERSION_IS_LESS(4,10,0)
+ .ndo_change_mtu = __change_mtu,
diff --git a/recipes-kernel/linux-mac80211/files/patches/build/050-lib80211_option.patch b/recipes-kernel/linux-mac80211/files/patches/build/050-lib80211_option.patch
new file mode 100644
index 0000000..c1b1bc7
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/build/050-lib80211_option.patch
@@ -0,0 +1,34 @@
+--- a/net/wireless/Kconfig
++++ b/net/wireless/Kconfig
+@@ -188,7 +188,7 @@ config CFG80211_WEXT_EXPORT
+ endif # CFG80211
+
+ config LIB80211
+- tristate
++ tristate "lib80211"
+ depends on m
+ default n
+ help
+@@ -198,19 +198,19 @@ config LIB80211
+ Drivers should select this themselves if needed.
+
+ config LIB80211_CRYPT_WEP
+- tristate
++ tristate "lib80211 WEP support"
+ depends on m
+ select BPAUTO_CRYPTO_LIB_ARC4
+
+ config LIB80211_CRYPT_CCMP
+- tristate
++ tristate "lib80211 CCMP support"
+ depends on m
+ depends on CRYPTO
+ depends on CRYPTO_AES
+ depends on CRYPTO_CCM
+
+ config LIB80211_CRYPT_TKIP
+- tristate
++ tristate "lib80211 TKIP support"
+ depends on m
+ select BPAUTO_CRYPTO_LIB_ARC4
+
diff --git a/recipes-kernel/linux-mac80211/files/patches/build/060-no_local_ssb_bcma.patch b/recipes-kernel/linux-mac80211/files/patches/build/060-no_local_ssb_bcma.patch
new file mode 100644
index 0000000..3967d73
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/build/060-no_local_ssb_bcma.patch
@@ -0,0 +1,335 @@
+--- a/local-symbols
++++ b/local-symbols
+@@ -421,43 +421,6 @@ USB_VL600=
+ USB_NET_CH9200=
+ USB_NET_AQC111=
+ USB_RTL8153_ECM=
+-SSB_POSSIBLE=
+-SSB=
+-SSB_SPROM=
+-SSB_BLOCKIO=
+-SSB_PCIHOST_POSSIBLE=
+-SSB_PCIHOST=
+-SSB_B43_PCI_BRIDGE=
+-SSB_PCMCIAHOST_POSSIBLE=
+-SSB_PCMCIAHOST=
+-SSB_SDIOHOST_POSSIBLE=
+-SSB_SDIOHOST=
+-SSB_HOST_SOC=
+-SSB_SERIAL=
+-SSB_DRIVER_PCICORE_POSSIBLE=
+-SSB_DRIVER_PCICORE=
+-SSB_PCICORE_HOSTMODE=
+-SSB_DRIVER_MIPS=
+-SSB_SFLASH=
+-SSB_EMBEDDED=
+-SSB_DRIVER_EXTIF=
+-SSB_DRIVER_GIGE=
+-SSB_DRIVER_GPIO=
+-BCMA_POSSIBLE=
+-BCMA=
+-BCMA_BLOCKIO=
+-BCMA_HOST_PCI_POSSIBLE=
+-BCMA_HOST_PCI=
+-BCMA_HOST_SOC=
+-BCMA_DRIVER_PCI=
+-BCMA_DRIVER_PCI_HOSTMODE=
+-BCMA_DRIVER_MIPS=
+-BCMA_PFLASH=
+-BCMA_SFLASH=
+-BCMA_NFLASH=
+-BCMA_DRIVER_GMAC_CMN=
+-BCMA_DRIVER_GPIO=
+-BCMA_DEBUG=
+ USB_ACM=
+ USB_PRINTER=
+ USB_WDM=
+--- a/drivers/net/wireless/broadcom/b43/Kconfig
++++ b/drivers/net/wireless/broadcom/b43/Kconfig
+@@ -63,21 +63,21 @@ endchoice
+ config B43_PCI_AUTOSELECT
+ bool
+ depends on B43 && SSB_PCIHOST_POSSIBLE
+- select SSB_PCIHOST
+- select SSB_B43_PCI_BRIDGE
++ depends on SSB_PCIHOST
++ depends on SSB_B43_PCI_BRIDGE
+ default y
+
+ # Auto-select SSB PCICORE driver, if possible
+ config B43_PCICORE_AUTOSELECT
+ bool
+ depends on B43 && SSB_DRIVER_PCICORE_POSSIBLE
+- select SSB_DRIVER_PCICORE
++ depends on SSB_DRIVER_PCICORE
+ default y
+
+ config B43_SDIO
+ bool "Broadcom 43xx SDIO device support"
+ depends on B43 && B43_SSB && SSB_SDIOHOST_POSSIBLE
+- select SSB_SDIOHOST
++ depends on SSB_SDIOHOST
+ help
+ Broadcom 43xx device support for Soft-MAC SDIO devices.
+
+@@ -96,13 +96,13 @@ config B43_SDIO
+ config B43_BCMA_PIO
+ bool
+ depends on B43 && B43_BCMA
+- select BCMA_BLOCKIO
++ depends on BCMA_BLOCKIO
+ default y
+
+ config B43_PIO
+ bool
+ depends on B43 && B43_SSB
+- select SSB_BLOCKIO
++ depends on SSB_BLOCKIO
+ default y
+
+ config B43_PHY_G
+--- a/drivers/net/wireless/broadcom/b43/main.c
++++ b/drivers/net/wireless/broadcom/b43/main.c
+@@ -2853,7 +2853,7 @@ static struct ssb_device *b43_ssb_gpio_d
+ {
+ struct ssb_bus *bus = dev->dev->sdev->bus;
+
+-#ifdef CPTCFG_SSB_DRIVER_PCICORE
++#ifdef CONFIG_SSB_DRIVER_PCICORE
+ return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
+ #else
+ return bus->chipco.dev;
+@@ -4870,7 +4870,7 @@ static int b43_wireless_core_init(struct
+ }
+ if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
+ hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
+-#if defined(CPTCFG_B43_SSB) && defined(CPTCFG_SSB_DRIVER_PCICORE)
++#if defined(CPTCFG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
+ if (dev->dev->bus_type == B43_BUS_SSB &&
+ dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
+ dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
+--- a/drivers/net/wireless/broadcom/b43legacy/Kconfig
++++ b/drivers/net/wireless/broadcom/b43legacy/Kconfig
+@@ -3,7 +3,7 @@ config B43LEGACY
+ tristate "Broadcom 43xx-legacy wireless support (mac80211 stack)"
+ depends on m
+ depends on SSB_POSSIBLE && MAC80211 && HAS_DMA
+- select SSB
++ depends on SSB
+ depends on FW_LOADER
+ help
+ b43legacy is a driver for 802.11b devices from Broadcom (BCM4301 and
+@@ -25,15 +25,15 @@ config B43LEGACY
+ config B43LEGACY_PCI_AUTOSELECT
+ bool
+ depends on B43LEGACY && SSB_PCIHOST_POSSIBLE
+- select SSB_PCIHOST
+- select SSB_B43_PCI_BRIDGE
++ depends on SSB_PCIHOST
++ depends on SSB_B43_PCI_BRIDGE
+ default y
+
+ # Auto-select SSB PCICORE driver, if possible
+ config B43LEGACY_PCICORE_AUTOSELECT
+ bool
+ depends on B43LEGACY && SSB_DRIVER_PCICORE_POSSIBLE
+- select SSB_DRIVER_PCICORE
++ depends on SSB_DRIVER_PCICORE
+ default y
+
+ # LED support
+--- a/drivers/net/wireless/broadcom/b43legacy/main.c
++++ b/drivers/net/wireless/broadcom/b43legacy/main.c
+@@ -1907,7 +1907,7 @@ static int b43legacy_gpio_init(struct b4
+ if (dev->dev->id.revision >= 2)
+ mask |= 0x0010; /* FIXME: This is redundant. */
+
+-#ifdef CPTCFG_SSB_DRIVER_PCICORE
++#ifdef CONFIG_SSB_DRIVER_PCICORE
+ pcidev = bus->pcicore.dev;
+ #endif
+ gpiodev = bus->chipco.dev ? : pcidev;
+@@ -1926,7 +1926,7 @@ static void b43legacy_gpio_cleanup(struc
+ struct ssb_bus *bus = dev->dev->bus;
+ struct ssb_device *gpiodev, *pcidev = NULL;
+
+-#ifdef CPTCFG_SSB_DRIVER_PCICORE
++#ifdef CONFIG_SSB_DRIVER_PCICORE
+ pcidev = bus->pcicore.dev;
+ #endif
+ gpiodev = bus->chipco.dev ? : pcidev;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
+@@ -24,7 +24,7 @@ struct brcms_led {
+ struct gpio_desc *gpiod;
+ };
+
+-#ifdef CPTCFG_BCMA_DRIVER_GPIO
++#ifdef CONFIG_BCMA_DRIVER_GPIO
+ void brcms_led_unregister(struct brcms_info *wl);
+ int brcms_led_register(struct brcms_info *wl);
+ #else
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
+@@ -42,6 +42,6 @@ brcmsmac-y := \
+ brcms_trace_events.o \
+ debug.o
+
+-brcmsmac-$(CPTCFG_BCMA_DRIVER_GPIO) += led.o
++brcmsmac-$(CONFIG_BCMA_DRIVER_GPIO) += led.o
+
+ obj-$(CPTCFG_BRCMSMAC) += brcmsmac.o
+--- a/drivers/net/wireless/broadcom/brcm80211/Kconfig
++++ b/drivers/net/wireless/broadcom/brcm80211/Kconfig
+@@ -8,7 +8,7 @@ config BRCMSMAC
+ depends on m
+ depends on MAC80211
+ depends on BCMA_POSSIBLE
+- select BCMA
++ depends on BCMA
+ select NEW_LEDS if BCMA_DRIVER_GPIO
+ select LEDS_CLASS if BCMA_DRIVER_GPIO
+ select BRCMUTIL
+--- a/Kconfig.local
++++ b/Kconfig.local
+@@ -1267,117 +1267,6 @@ config BACKPORTED_USB_NET_AQC111
+ config BACKPORTED_USB_RTL8153_ECM
+ tristate
+ default USB_RTL8153_ECM
+-config BACKPORTED_SSB_POSSIBLE
+- tristate
+- default SSB_POSSIBLE
+-config BACKPORTED_SSB
+- tristate
+- default SSB
+-config BACKPORTED_SSB_SPROM
+- tristate
+- default SSB_SPROM
+-config BACKPORTED_SSB_BLOCKIO
+- tristate
+- default SSB_BLOCKIO
+-config BACKPORTED_SSB_PCIHOST_POSSIBLE
+- tristate
+- default SSB_PCIHOST_POSSIBLE
+-config BACKPORTED_SSB_PCIHOST
+- tristate
+- default SSB_PCIHOST
+-config BACKPORTED_SSB_B43_PCI_BRIDGE
+- tristate
+- default SSB_B43_PCI_BRIDGE
+-config BACKPORTED_SSB_PCMCIAHOST_POSSIBLE
+- tristate
+- default SSB_PCMCIAHOST_POSSIBLE
+-config BACKPORTED_SSB_PCMCIAHOST
+- tristate
+- default SSB_PCMCIAHOST
+-config BACKPORTED_SSB_SDIOHOST_POSSIBLE
+- tristate
+- default SSB_SDIOHOST_POSSIBLE
+-config BACKPORTED_SSB_SDIOHOST
+- tristate
+- default SSB_SDIOHOST
+-config BACKPORTED_SSB_HOST_SOC
+- tristate
+- default SSB_HOST_SOC
+-config BACKPORTED_SSB_SERIAL
+- tristate
+- default SSB_SERIAL
+-config BACKPORTED_SSB_DRIVER_PCICORE_POSSIBLE
+- tristate
+- default SSB_DRIVER_PCICORE_POSSIBLE
+-config BACKPORTED_SSB_DRIVER_PCICORE
+- tristate
+- default SSB_DRIVER_PCICORE
+-config BACKPORTED_SSB_PCICORE_HOSTMODE
+- tristate
+- default SSB_PCICORE_HOSTMODE
+-config BACKPORTED_SSB_DRIVER_MIPS
+- tristate
+- default SSB_DRIVER_MIPS
+-config BACKPORTED_SSB_SFLASH
+- tristate
+- default SSB_SFLASH
+-config BACKPORTED_SSB_EMBEDDED
+- tristate
+- default SSB_EMBEDDED
+-config BACKPORTED_SSB_DRIVER_EXTIF
+- tristate
+- default SSB_DRIVER_EXTIF
+-config BACKPORTED_SSB_DRIVER_GIGE
+- tristate
+- default SSB_DRIVER_GIGE
+-config BACKPORTED_SSB_DRIVER_GPIO
+- tristate
+- default SSB_DRIVER_GPIO
+-config BACKPORTED_BCMA_POSSIBLE
+- tristate
+- default BCMA_POSSIBLE
+-config BACKPORTED_BCMA
+- tristate
+- default BCMA
+-config BACKPORTED_BCMA_BLOCKIO
+- tristate
+- default BCMA_BLOCKIO
+-config BACKPORTED_BCMA_HOST_PCI_POSSIBLE
+- tristate
+- default BCMA_HOST_PCI_POSSIBLE
+-config BACKPORTED_BCMA_HOST_PCI
+- tristate
+- default BCMA_HOST_PCI
+-config BACKPORTED_BCMA_HOST_SOC
+- tristate
+- default BCMA_HOST_SOC
+-config BACKPORTED_BCMA_DRIVER_PCI
+- tristate
+- default BCMA_DRIVER_PCI
+-config BACKPORTED_BCMA_DRIVER_PCI_HOSTMODE
+- tristate
+- default BCMA_DRIVER_PCI_HOSTMODE
+-config BACKPORTED_BCMA_DRIVER_MIPS
+- tristate
+- default BCMA_DRIVER_MIPS
+-config BACKPORTED_BCMA_PFLASH
+- tristate
+- default BCMA_PFLASH
+-config BACKPORTED_BCMA_SFLASH
+- tristate
+- default BCMA_SFLASH
+-config BACKPORTED_BCMA_NFLASH
+- tristate
+- default BCMA_NFLASH
+-config BACKPORTED_BCMA_DRIVER_GMAC_CMN
+- tristate
+- default BCMA_DRIVER_GMAC_CMN
+-config BACKPORTED_BCMA_DRIVER_GPIO
+- tristate
+- default BCMA_DRIVER_GPIO
+-config BACKPORTED_BCMA_DEBUG
+- tristate
+- default BCMA_DEBUG
+ config BACKPORTED_USB_ACM
+ tristate
+ default USB_ACM
+--- a/Kconfig.sources
++++ b/Kconfig.sources
+@@ -7,9 +7,6 @@ source "$BACKPORT_DIR/net/mac80211/Kconf
+ source "$BACKPORT_DIR/drivers/net/wireless/Kconfig"
+ source "$BACKPORT_DIR/drivers/net/usb/Kconfig"
+
+-source "$BACKPORT_DIR/drivers/ssb/Kconfig"
+-source "$BACKPORT_DIR/drivers/bcma/Kconfig"
+-
+ source "$BACKPORT_DIR/drivers/usb/class/Kconfig"
+
+ source "$BACKPORT_DIR/drivers/staging/Kconfig"
+--- a/Makefile.kernel
++++ b/Makefile.kernel
+@@ -40,8 +40,6 @@ obj-y += compat/
+ obj-$(CPTCFG_CFG80211) += net/wireless/
+ obj-$(CPTCFG_MAC80211) += net/mac80211/
+ obj-$(CPTCFG_WLAN) += drivers/net/wireless/
+-obj-$(CPTCFG_SSB) += drivers/ssb/
+-obj-$(CPTCFG_BCMA) += drivers/bcma/
+ obj-$(CPTCFG_USB_NET_RNDIS_WLAN) += drivers/net/usb/
+
+ obj-$(CPTCFG_USB_WDM) += drivers/usb/class/
diff --git a/recipes-kernel/linux-mac80211/files/patches/build/070-headers-fix-lockdep_assert_not_held.patch b/recipes-kernel/linux-mac80211/files/patches/build/070-headers-fix-lockdep_assert_not_held.patch
new file mode 100644
index 0000000..d946efa
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/build/070-headers-fix-lockdep_assert_not_held.patch
@@ -0,0 +1,39 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Fri, 11 Mar 2022 18:21:04 +0100
+Subject: [PATCH] headers: fix lockdep_assert_not_held()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+LOCK_STATE_HELD define was omitted during backport of
+lockdep_assert_not_held() which leads to build failures of kernels with
+CONFIG_LOCKDEP=y:
+
+ backports-5.15.8-1/backport-include/linux/lockdep.h:16:47: error: 'LOCK_STATE_HELD' undeclared (first use in this function)
+
+Fix it by adding missing LOCK_STATE_HELD define.
+
+References: https://github.com/openwrt/openwrt/pull/9373
+References: https://lore.kernel.org/backports/20220311194800.452-1-ynezz@true.cz/T/#u
+Fixes: af58b27b1b1a ("headers: Add lockdep_assert_not_held()")
+Reported-by: Oskari Rauta <oskari.rauta@gmail.com>
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ backport-include/linux/lockdep.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/backport-include/linux/lockdep.h b/backport-include/linux/lockdep.h
+index ed5ea67894e4..842e24b7ff8f 100644
+--- a/backport-include/linux/lockdep.h
++++ b/backport-include/linux/lockdep.h
+@@ -11,6 +11,9 @@ struct lockdep_map { };
+
+ #ifndef lockdep_assert_not_held
+ #ifdef CONFIG_LOCKDEP
++#ifndef LOCK_STATE_HELD
++#define LOCK_STATE_HELD 1
++#endif /* LOCK_STATE_HELD */
+ #define lockdep_assert_not_held(l) do { \
+ WARN_ON(debug_locks && \
+ lockdep_is_held(l) == LOCK_STATE_HELD); \
diff --git a/recipes-kernel/linux-mac80211/files/patches/build/build.inc b/recipes-kernel/linux-mac80211/files/patches/build/build.inc
new file mode 100644
index 0000000..7653c70
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/build/build.inc
@@ -0,0 +1,12 @@
+#patch build (come from openwrt/lede/target/linux/mediatek)
+SRC_URI_append = " \
+ file://000-fix_kconfig.patch \
+ file://001-fix_build.patch \
+ file://002-change_allconfig.patch \
+ file://003-remove_bogus_modparams.patch \
+ file://012-kernel_build_check.patch \
+ file://015-ipw200-mtu.patch \
+ file://050-lib80211_option.patch \
+ file://060-no_local_ssb_bcma.patch \
+ file://070-headers-fix-lockdep_assert_not_held.patch \
+ "
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
new file mode 100644
index 0000000..638da14
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
@@ -0,0 +1,12 @@
+Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnects
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1316,7 +1316,6 @@ static int ieee80211_stop_ap(struct wiph
+ sdata->vif.bss_conf.ftmr_params = NULL;
+
+ __sta_info_flush(sdata, true);
+- ieee80211_free_keys(sdata, true);
+
+ sdata->vif.bss_conf.enable_beacon = false;
+ sdata->beacon_rate_set = false;
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/120-cfg80211_allow_perm_addr_change.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
new file mode 100644
index 0000000..ffd8807
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
@@ -0,0 +1,43 @@
+--- a/net/wireless/sysfs.c
++++ b/net/wireless/sysfs.c
+@@ -24,18 +24,35 @@ static inline struct cfg80211_registered
+ return container_of(dev, struct cfg80211_registered_device, wiphy.dev);
+ }
+
+-#define SHOW_FMT(name, fmt, member) \
++#define SHOW_FMT(name, fmt, member, mode) \
+ static ssize_t name ## _show(struct device *dev, \
+ struct device_attribute *attr, \
+ char *buf) \
+ { \
+ return sprintf(buf, fmt "\n", dev_to_rdev(dev)->member); \
+ } \
+-static DEVICE_ATTR_RO(name)
++static DEVICE_ATTR_##mode(name)
+
+-SHOW_FMT(index, "%d", wiphy_idx);
+-SHOW_FMT(macaddress, "%pM", wiphy.perm_addr);
+-SHOW_FMT(address_mask, "%pM", wiphy.addr_mask);
++static ssize_t macaddress_store(struct device *dev,
++ struct device_attribute *attr,
++ const char *buf, size_t len)
++{
++ u8 mac[ETH_ALEN];
++
++ if (!mac_pton(buf, mac))
++ return -EINVAL;
++
++ if (buf[3 * ETH_ALEN - 1] && buf[3 * ETH_ALEN - 1] != '\n')
++ return -EINVAL;
++
++ memcpy(dev_to_rdev(dev)->wiphy.perm_addr, mac, ETH_ALEN);
++
++ return strnlen(buf, len);
++}
++
++SHOW_FMT(index, "%d", wiphy_idx, RO);
++SHOW_FMT(macaddress, "%pM", wiphy.perm_addr, RW);
++SHOW_FMT(address_mask, "%pM", wiphy.addr_mask, RO);
+
+ static ssize_t name_show(struct device *dev,
+ struct device_attribute *attr,
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/150-disable_addr_notifier.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/150-disable_addr_notifier.patch
new file mode 100644
index 0000000..e93efa4
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/150-disable_addr_notifier.patch
@@ -0,0 +1,67 @@
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -337,7 +337,7 @@ void ieee80211_restart_hw(struct ieee802
+ }
+ EXPORT_SYMBOL(ieee80211_restart_hw);
+
+-#ifdef CONFIG_INET
++#ifdef __disabled__CONFIG_INET
+ static int ieee80211_ifa_changed(struct notifier_block *nb,
+ unsigned long data, void *arg)
+ {
+@@ -396,7 +396,7 @@ static int ieee80211_ifa_changed(struct
+ }
+ #endif
+
+-#if IS_ENABLED(CONFIG_IPV6)
++#if IS_ENABLED(__disabled__CONFIG_IPV6)
+ static int ieee80211_ifa6_changed(struct notifier_block *nb,
+ unsigned long data, void *arg)
+ {
+@@ -1324,14 +1324,14 @@ int ieee80211_register_hw(struct ieee802
+ wiphy_unlock(hw->wiphy);
+ rtnl_unlock();
+
+-#ifdef CONFIG_INET
++#ifdef __disabled__CONFIG_INET
+ local->ifa_notifier.notifier_call = ieee80211_ifa_changed;
+ result = register_inetaddr_notifier(&local->ifa_notifier);
+ if (result)
+ goto fail_ifa;
+ #endif
+
+-#if IS_ENABLED(CONFIG_IPV6)
++#if IS_ENABLED(__disabled__CONFIG_IPV6)
+ local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
+ result = register_inet6addr_notifier(&local->ifa6_notifier);
+ if (result)
+@@ -1340,13 +1340,13 @@ int ieee80211_register_hw(struct ieee802
+
+ return 0;
+
+-#if IS_ENABLED(CONFIG_IPV6)
++#if IS_ENABLED(__disabled__CONFIG_IPV6)
+ fail_ifa6:
+-#ifdef CONFIG_INET
++#ifdef __disabled__CONFIG_INET
+ unregister_inetaddr_notifier(&local->ifa_notifier);
+ #endif
+ #endif
+-#if defined(CONFIG_INET) || defined(CONFIG_IPV6)
++#if defined(__disabled__CONFIG_INET) || defined(__disabled__CONFIG_IPV6)
+ fail_ifa:
+ #endif
+ wiphy_unregister(local->hw.wiphy);
+@@ -1374,10 +1374,10 @@ void ieee80211_unregister_hw(struct ieee
+ tasklet_kill(&local->tx_pending_tasklet);
+ tasklet_kill(&local->tasklet);
+
+-#ifdef CONFIG_INET
++#ifdef __disabled__CONFIG_INET
+ unregister_inetaddr_notifier(&local->ifa_notifier);
+ #endif
+-#if IS_ENABLED(CONFIG_IPV6)
++#if IS_ENABLED(__disabled__CONFIG_IPV6)
+ unregister_inet6addr_notifier(&local->ifa6_notifier);
+ #endif
+
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/210-ap_scan.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/210-ap_scan.patch
new file mode 100644
index 0000000..0c06829
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/210-ap_scan.patch
@@ -0,0 +1,11 @@
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2497,7 +2497,7 @@ static int ieee80211_scan(struct wiphy *
+ * the frames sent while scanning on other channel will be
+ * lost)
+ */
+- if (sdata->u.ap.beacon &&
++ if (0 && sdata->u.ap.beacon &&
+ (!(wiphy->features & NL80211_FEATURE_AP_SCAN) ||
+ !(req->flags & NL80211_SCAN_FLAG_AP)))
+ return -EOPNOTSUPP;
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/300-mac80211-fix-rate-control-for-retransmitted-frames.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/300-mac80211-fix-rate-control-for-retransmitted-frames.patch
new file mode 100644
index 0000000..98dfe88
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/300-mac80211-fix-rate-control-for-retransmitted-frames.patch
@@ -0,0 +1,35 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 22 Nov 2021 21:39:38 +0100
+Subject: [PATCH] mac80211: fix rate control for retransmitted frames
+
+Since retransmission clears info->control, rate control needs to be called
+again, otherwise the driver might crash due to invalid rates.
+
+Cc: stable@vger.kernel.org # 5.14+
+Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Reported-by: Robert W <rwbugreport@lost-in-the-void.net>
+Fixes: 03c3911d2d67 ("mac80211: call ieee80211_tx_h_rate_ctrl() when dequeue")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1821,15 +1821,15 @@ static int invoke_tx_handlers_late(struc
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+ ieee80211_tx_result res = TX_CONTINUE;
+
++ if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
++ CALL_TXH(ieee80211_tx_h_rate_ctrl);
++
+ if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) {
+ __skb_queue_tail(&tx->skbs, tx->skb);
+ tx->skb = NULL;
+ goto txh_done;
+ }
+
+- if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
+- CALL_TXH(ieee80211_tx_h_rate_ctrl);
+-
+ CALL_TXH(ieee80211_tx_h_michael_mic_add);
+ CALL_TXH(ieee80211_tx_h_sequence);
+ CALL_TXH(ieee80211_tx_h_fragment);
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
new file mode 100644
index 0000000..d09d707
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
@@ -0,0 +1,38 @@
+From b478e06a16a8baa00c5ecc87c1d636981f2206d5 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 29 Oct 2019 10:25:25 +0100
+Subject: [PATCH] mac80211: sta: randomize BA session dialog token allocator
+
+We currently always start the dialog token generator at zero,
+so the first dialog token we use is always 1. This would be
+OK if we had a perfect guarantee that we always do a proper
+deauth/re-auth handshake, but in IBSS mode this doesn't always
+happen properly.
+
+To make problems with block ack (aggregation) sessions getting
+stuck less likely, randomize the dialog token so if we start a
+new session but the peer still has old state for us, it can
+better detect this.
+
+This is really just a workaround to make things a bit more
+robust than they are now - a better fix would be to do a full
+authentication handshake in IBSS mode upon having discovered a
+new station, and on the receiver resetting the state (removing
+and re-adding the station) on receiving the authentication
+packet.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ net/mac80211/sta_info.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -357,6 +357,7 @@ struct sta_info *sta_info_alloc(struct i
+ INIT_WORK(&sta->drv_deliver_wk, sta_deliver_ps_frames);
+ INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
+ mutex_init(&sta->ampdu_mlme.mtx);
++ sta->ampdu_mlme.dialog_token_allocator = prandom_u32_max(U8_MAX);
+ #ifdef CPTCFG_MAC80211_MESH
+ if (ieee80211_vif_is_mesh(&sdata->vif)) {
+ sta->mesh = kzalloc(sizeof(*sta->mesh), gfp);
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/302-mac80211-fix-regression-in-SSN-handling-of-addba-tx.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/302-mac80211-fix-regression-in-SSN-handling-of-addba-tx.patch
new file mode 100644
index 0000000..dc8afb9
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/302-mac80211-fix-regression-in-SSN-handling-of-addba-tx.patch
@@ -0,0 +1,44 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 24 Nov 2021 10:30:41 +0100
+Subject: [PATCH] mac80211: fix regression in SSN handling of addba tx
+
+Some drivers that do their own sequence number allocation (e.g. ath9k) rely
+on being able to modify params->ssn on starting tx ampdu sessions.
+This was broken by a change that modified it to use sta->tid_seq[tid] instead.
+
+Cc: stable@vger.kernel.org
+Fixes: 31d8bb4e07f8 ("mac80211: agg-tx: refactor sending addba")
+Reported-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -480,8 +480,7 @@ static void ieee80211_send_addba_with_ti
+
+ /* send AddBA request */
+ ieee80211_send_addba_request(sdata, sta->sta.addr, tid,
+- tid_tx->dialog_token,
+- sta->tid_seq[tid] >> 4,
++ tid_tx->dialog_token, tid_tx->ssn,
+ buf_size, tid_tx->timeout);
+
+ WARN_ON(test_and_set_bit(HT_AGG_STATE_SENT_ADDBA, &tid_tx->state));
+@@ -523,6 +522,7 @@ void ieee80211_tx_ba_session_handle_star
+
+ params.ssn = sta->tid_seq[tid] >> 4;
+ ret = drv_ampdu_action(local, sdata, ¶ms);
++ tid_tx->ssn = params.ssn;
+ if (ret == IEEE80211_AMPDU_TX_START_DELAY_ADDBA) {
+ return;
+ } else if (ret == IEEE80211_AMPDU_TX_START_IMMEDIATE) {
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -199,6 +199,7 @@ struct tid_ampdu_tx {
+ u8 stop_initiator;
+ bool tx_stop;
+ u16 buf_size;
++ u16 ssn;
+
+ u16 failed_bar_ssn;
+ bool bar_pending;
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/303-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/303-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch
new file mode 100644
index 0000000..1ceb2be
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/303-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch
@@ -0,0 +1,62 @@
+From: Xing Song <xing.song@mediatek.com>
+Date: Tue, 23 Nov 2021 11:31:23 +0800
+Subject: [PATCH] mac80211: set up the fwd_skb->dev for mesh forwarding
+
+Mesh forwarding requires that the fwd_skb->dev is set up for TX handling,
+otherwise the following warning will be generated, so set it up for the
+pending frames.
+
+[ 72.835674 ] WARNING: CPU: 0 PID: 1193 at __skb_flow_dissect+0x284/0x1298
+[ 72.842379 ] Modules linked in: ksmbd pppoe ppp_async l2tp_ppp ...
+[ 72.962020 ] CPU: 0 PID: 1193 Comm: kworker/u5:1 Tainted: P S 5.4.137 #0
+[ 72.969938 ] Hardware name: MT7622_MT7531 RFB (DT)
+[ 72.974659 ] Workqueue: napi_workq napi_workfn
+[ 72.979025 ] pstate: 60000005 (nZCv daif -PAN -UAO)
+[ 72.983822 ] pc : __skb_flow_dissect+0x284/0x1298
+[ 72.988444 ] lr : __skb_flow_dissect+0x54/0x1298
+[ 72.992977 ] sp : ffffffc010c738c0
+[ 72.996293 ] x29: ffffffc010c738c0 x28: 0000000000000000
+[ 73.001615 ] x27: 000000000000ffc2 x26: ffffff800c2eb818
+[ 73.006937 ] x25: ffffffc010a987c8 x24: 00000000000000ce
+[ 73.012259 ] x23: ffffffc010c73a28 x22: ffffffc010a99c60
+[ 73.017581 ] x21: 000000000000ffc2 x20: ffffff80094da800
+[ 73.022903 ] x19: 0000000000000000 x18: 0000000000000014
+[ 73.028226 ] x17: 00000000084d16af x16: 00000000d1fc0bab
+[ 73.033548 ] x15: 00000000715f6034 x14: 000000009dbdd301
+[ 73.038870 ] x13: 00000000ea4dcbc3 x12: 0000000000000040
+[ 73.044192 ] x11: 000000000eb00ff0 x10: 0000000000000000
+[ 73.049513 ] x9 : 000000000eb00073 x8 : 0000000000000088
+[ 73.054834 ] x7 : 0000000000000000 x6 : 0000000000000001
+[ 73.060155 ] x5 : 0000000000000000 x4 : 0000000000000000
+[ 73.065476 ] x3 : ffffffc010a98000 x2 : 0000000000000000
+[ 73.070797 ] x1 : 0000000000000000 x0 : 0000000000000000
+[ 73.076120 ] Call trace:
+[ 73.078572 ] __skb_flow_dissect+0x284/0x1298
+[ 73.082846 ] __skb_get_hash+0x7c/0x228
+[ 73.086629 ] ieee80211_txq_may_transmit+0x7fc/0x17b8 [mac80211]
+[ 73.092564 ] ieee80211_tx_prepare_skb+0x20c/0x268 [mac80211]
+[ 73.098238 ] ieee80211_tx_pending+0x144/0x330 [mac80211]
+[ 73.103560 ] tasklet_action_common.isra.16+0xb4/0x158
+[ 73.108618 ] tasklet_action+0x2c/0x38
+[ 73.112286 ] __do_softirq+0x168/0x3b0
+[ 73.115954 ] do_softirq.part.15+0x88/0x98
+[ 73.119969 ] __local_bh_enable_ip+0xb0/0xb8
+[ 73.124156 ] napi_workfn+0x58/0x90
+[ 73.127565 ] process_one_work+0x20c/0x478
+[ 73.131579 ] worker_thread+0x50/0x4f0
+[ 73.135249 ] kthread+0x124/0x128
+[ 73.138484 ] ret_from_fork+0x10/0x1c
+
+Signed-off-by: Xing Song <xing.song@mediatek.com>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2948,6 +2948,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ if (!fwd_skb)
+ goto out;
+
++ fwd_skb->dev = sdata->dev;
+ fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
+ fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
+ info = IEEE80211_SKB_CB(fwd_skb);
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/304-mac80211-send-ADDBA-requests-using-the-tid-queue-of-.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/304-mac80211-send-ADDBA-requests-using-the-tid-queue-of-.patch
new file mode 100644
index 0000000..1c21328
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/304-mac80211-send-ADDBA-requests-using-the-tid-queue-of-.patch
@@ -0,0 +1,28 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 2 Dec 2021 13:30:05 +0100
+Subject: [PATCH] mac80211: send ADDBA requests using the tid/queue of the
+ aggregation session
+
+Sending them out on a different queue can cause a race condition where a
+number of packets in the queue may be discarded by the receiver, because
+the ADDBA request is sent too early.
+This affects any driver with software A-MPDU setup which does not allocate
+packet seqno in hardware on tx, regardless of whether iTXQ is used or not.
+The only driver I've seen that explicitly deals with this issue internally
+is mwl8k.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -106,7 +106,7 @@ static void ieee80211_send_addba_request
+ mgmt->u.action.u.addba_req.start_seq_num =
+ cpu_to_le16(start_seq_num << 4);
+
+- ieee80211_tx_skb(sdata, skb);
++ ieee80211_tx_skb_tid(sdata, skb, tid);
+ }
+
+ void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/305-mac80211-agg-tx-don-t-schedule_and_wake_txq-under-st.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/305-mac80211-agg-tx-don-t-schedule_and_wake_txq-under-st.patch
new file mode 100644
index 0000000..008ee49
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/305-mac80211-agg-tx-don-t-schedule_and_wake_txq-under-st.patch
@@ -0,0 +1,79 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 29 Nov 2021 15:32:47 +0200
+Subject: [PATCH] mac80211: agg-tx: don't schedule_and_wake_txq() under
+ sta->lock
+
+When we call ieee80211_agg_start_txq(), that will in turn call
+schedule_and_wake_txq(). Called from ieee80211_stop_tx_ba_cb()
+this is done under sta->lock, which leads to certain circular
+lock dependencies, as reported by Chris Murphy:
+https://lore.kernel.org/r/CAJCQCtSXJ5qA4bqSPY=oLRMbv-irihVvP7A2uGutEbXQVkoNaw@mail.gmail.com
+
+In general, ieee80211_agg_start_txq() is usually not called
+with sta->lock held, only in this one place. But it's always
+called with sta->ampdu_mlme.mtx held, and that's therefore
+clearly sufficient.
+
+Change ieee80211_stop_tx_ba_cb() to also call it without the
+sta->lock held, by factoring it out of ieee80211_remove_tid_tx()
+(which is only called in this one place).
+
+This breaks the locking chain and makes it less likely that
+we'll have similar locking chain problems in the future.
+
+Reported-by: Chris Murphy <lists@colorremedies.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+---
+
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -9,7 +9,7 @@
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2007-2010, Intel Corporation
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
+- * Copyright (C) 2018 - 2020 Intel Corporation
++ * Copyright (C) 2018 - 2021 Intel Corporation
+ */
+
+ #include <linux/ieee80211.h>
+@@ -213,6 +213,8 @@ ieee80211_agg_start_txq(struct sta_info
+ struct ieee80211_txq *txq = sta->sta.txq[tid];
+ struct txq_info *txqi;
+
++ lockdep_assert_held(&sta->ampdu_mlme.mtx);
++
+ if (!txq)
+ return;
+
+@@ -290,7 +292,6 @@ static void ieee80211_remove_tid_tx(stru
+ ieee80211_assign_tid_tx(sta, tid, NULL);
+
+ ieee80211_agg_splice_finish(sta->sdata, tid);
+- ieee80211_agg_start_txq(sta, tid, false);
+
+ kfree_rcu(tid_tx, rcu_head);
+ }
+@@ -889,6 +890,7 @@ void ieee80211_stop_tx_ba_cb(struct sta_
+ {
+ struct ieee80211_sub_if_data *sdata = sta->sdata;
+ bool send_delba = false;
++ bool start_txq = false;
+
+ ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n",
+ sta->sta.addr, tid);
+@@ -906,10 +908,14 @@ void ieee80211_stop_tx_ba_cb(struct sta_
+ send_delba = true;
+
+ ieee80211_remove_tid_tx(sta, tid);
++ start_txq = true;
+
+ unlock_sta:
+ spin_unlock_bh(&sta->lock);
+
++ if (start_txq)
++ ieee80211_agg_start_txq(sta, tid, false);
++
+ if (send_delba)
+ ieee80211_send_delba(sdata, sta->sta.addr, tid,
+ WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/306-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/306-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch
new file mode 100644
index 0000000..c43cd3a
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/306-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch
@@ -0,0 +1,60 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 14 Dec 2021 17:53:12 +0100
+Subject: [PATCH] mac80211: use coarse boottime for airtime fairness code
+
+The time values used by the airtime fairness code only need to be accurate
+enough to cover station activity detection.
+Using ktime_get_coarse_boottime_ns instead of ktime_get_boottime_ns will
+drop the accuracy down to jiffies intervals, but at the same time saves
+a lot of CPU cycles in a hot path
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3820,7 +3820,7 @@ struct ieee80211_txq *ieee80211_next_txq
+ {
+ struct ieee80211_local *local = hw_to_local(hw);
+ struct airtime_sched_info *air_sched;
+- u64 now = ktime_get_boottime_ns();
++ u64 now = ktime_get_coarse_boottime_ns();
+ struct ieee80211_txq *ret = NULL;
+ struct airtime_info *air_info;
+ struct txq_info *txqi = NULL;
+@@ -3947,7 +3947,7 @@ void ieee80211_update_airtime_weight(str
+ u64 weight_sum = 0;
+
+ if (unlikely(!now))
+- now = ktime_get_boottime_ns();
++ now = ktime_get_coarse_boottime_ns();
+
+ lockdep_assert_held(&air_sched->lock);
+
+@@ -3973,7 +3973,7 @@ void ieee80211_schedule_txq(struct ieee8
+ struct ieee80211_local *local = hw_to_local(hw);
+ struct txq_info *txqi = to_txq_info(txq);
+ struct airtime_sched_info *air_sched;
+- u64 now = ktime_get_boottime_ns();
++ u64 now = ktime_get_coarse_boottime_ns();
+ struct airtime_info *air_info;
+ u8 ac = txq->ac;
+ bool was_active;
+@@ -4031,7 +4031,7 @@ static void __ieee80211_unschedule_txq(s
+
+ if (!purge)
+ airtime_set_active(air_sched, air_info,
+- ktime_get_boottime_ns());
++ ktime_get_coarse_boottime_ns());
+
+ rb_erase_cached(&txqi->schedule_order,
+ &air_sched->active_txqs);
+@@ -4119,7 +4119,7 @@ bool ieee80211_txq_may_transmit(struct i
+ if (RB_EMPTY_NODE(&txqi->schedule_order))
+ goto out;
+
+- now = ktime_get_boottime_ns();
++ now = ktime_get_coarse_boottime_ns();
+
+ /* Like in ieee80211_next_txq(), make sure the first station in the
+ * scheduling order is eligible for transmission to avoid starvation.
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/307-mac80211_hwsim-make-6-GHz-channels-usable.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/307-mac80211_hwsim-make-6-GHz-channels-usable.patch
new file mode 100644
index 0000000..9c7417e
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/307-mac80211_hwsim-make-6-GHz-channels-usable.patch
@@ -0,0 +1,74 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 24 May 2021 11:46:09 +0200
+Subject: [PATCH] mac80211_hwsim: make 6 GHz channels usable
+
+The previous commit that claimed to add 6 GHz channels didn't actually make
+them usable, since the 6 GHz band was not registered with mac80211.
+
+Fixes: 28881922abd7 ("mac80211_hwsim: add 6GHz channels")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -2992,15 +2992,19 @@ static void mac80211_hwsim_he_capab(stru
+ {
+ u16 n_iftype_data;
+
+- if (sband->band == NL80211_BAND_2GHZ) {
++ switch (sband->band) {
++ case NL80211_BAND_2GHZ:
+ n_iftype_data = ARRAY_SIZE(he_capa_2ghz);
+ sband->iftype_data =
+ (struct ieee80211_sband_iftype_data *)he_capa_2ghz;
+- } else if (sband->band == NL80211_BAND_5GHZ) {
++ break;
++ case NL80211_BAND_5GHZ:
++ case NL80211_BAND_6GHZ:
+ n_iftype_data = ARRAY_SIZE(he_capa_5ghz);
+ sband->iftype_data =
+ (struct ieee80211_sband_iftype_data *)he_capa_5ghz;
+- } else {
++ break;
++ default:
+ return;
+ }
+
+@@ -3290,6 +3294,12 @@ static int mac80211_hwsim_new_radio(stru
+ sband->vht_cap.vht_mcs.tx_mcs_map =
+ sband->vht_cap.vht_mcs.rx_mcs_map;
+ break;
++ case NL80211_BAND_6GHZ:
++ sband->channels = data->channels_6ghz;
++ sband->n_channels = ARRAY_SIZE(hwsim_channels_6ghz);
++ sband->bitrates = data->rates + 4;
++ sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
++ break;
+ case NL80211_BAND_S1GHZ:
+ memcpy(&sband->s1g_cap, &hwsim_s1g_cap,
+ sizeof(sband->s1g_cap));
+@@ -3300,6 +3310,13 @@ static int mac80211_hwsim_new_radio(stru
+ continue;
+ }
+
++ mac80211_hwsim_he_capab(sband);
++
++ hw->wiphy->bands[band] = sband;
++
++ if (band == NL80211_BAND_6GHZ)
++ continue;
++
+ sband->ht_cap.ht_supported = true;
+ sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+ IEEE80211_HT_CAP_GRN_FLD |
+@@ -3313,10 +3330,6 @@ static int mac80211_hwsim_new_radio(stru
+ sband->ht_cap.mcs.rx_mask[0] = 0xff;
+ sband->ht_cap.mcs.rx_mask[1] = 0xff;
+ sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+-
+- mac80211_hwsim_he_capab(sband);
+-
+- hw->wiphy->bands[band] = sband;
+ }
+
+ /* By default all radios belong to the first group */
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/308-mac80211-add-support-for-.ndo_fill_forward_path.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/308-mac80211-add-support-for-.ndo_fill_forward_path.patch
new file mode 100644
index 0000000..2f3c1a2
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/308-mac80211-add-support-for-.ndo_fill_forward_path.patch
@@ -0,0 +1,178 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 12 Nov 2021 12:22:23 +0100
+Subject: [PATCH] mac80211: add support for .ndo_fill_forward_path
+
+This allows drivers to provide a destination device + info for flow offload
+Only supported in combination with 802.3 encap offload
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Tested-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/20211112112223.1209-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -3937,6 +3937,8 @@ struct ieee80211_prep_tx_info {
+ * twt structure.
+ * @twt_teardown_request: Update the hw with TWT teardown request received
+ * from the peer.
++ * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
++ * resolve a path for hardware flow offloading
+ */
+ struct ieee80211_ops {
+ void (*tx)(struct ieee80211_hw *hw,
+@@ -4265,6 +4267,13 @@ struct ieee80211_ops {
+ struct ieee80211_twt_setup *twt);
+ void (*twt_teardown_request)(struct ieee80211_hw *hw,
+ struct ieee80211_sta *sta, u8 flowid);
++#if LINUX_VERSION_IS_GEQ(5,10,0)
++ int (*net_fill_forward_path)(struct ieee80211_hw *hw,
++ struct ieee80211_vif *vif,
++ struct ieee80211_sta *sta,
++ struct net_device_path_ctx *ctx,
++ struct net_device_path *path);
++#endif
+ };
+
+ /**
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1483,4 +1483,28 @@ static inline void drv_twt_teardown_requ
+ trace_drv_return_void(local);
+ }
+
++#if LINUX_VERSION_IS_GEQ(5,10,0)
++static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
++ struct ieee80211_sub_if_data *sdata,
++ struct ieee80211_sta *sta,
++ struct net_device_path_ctx *ctx,
++ struct net_device_path *path)
++{
++ int ret = -EOPNOTSUPP;
++
++ sdata = get_bss_sdata(sdata);
++ if (!check_sdata_in_driver(sdata))
++ return -EIO;
++
++ trace_drv_net_fill_forward_path(local, sdata, sta);
++ if (local->ops->net_fill_forward_path)
++ ret = local->ops->net_fill_forward_path(&local->hw,
++ &sdata->vif, sta,
++ ctx, path);
++ trace_drv_return_int(local, ret);
++
++ return ret;
++}
++#endif
++
+ #endif /* __MAC80211_DRIVER_OPS */
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1465,7 +1465,7 @@ struct ieee80211_local {
+ };
+
+ static inline struct ieee80211_sub_if_data *
+-IEEE80211_DEV_TO_SUB_IF(struct net_device *dev)
++IEEE80211_DEV_TO_SUB_IF(const struct net_device *dev)
+ {
+ return netdev_priv(dev);
+ }
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -822,6 +822,66 @@ static const struct net_device_ops ieee8
+
+ };
+
++#if LINUX_VERSION_IS_GEQ(5,10,0)
++static int ieee80211_netdev_fill_forward_path(struct net_device_path_ctx *ctx,
++ struct net_device_path *path)
++{
++ struct ieee80211_sub_if_data *sdata;
++ struct ieee80211_local *local;
++ struct sta_info *sta;
++ int ret = -ENOENT;
++
++ sdata = IEEE80211_DEV_TO_SUB_IF(ctx->dev);
++ local = sdata->local;
++
++ if (!local->ops->net_fill_forward_path)
++ return -EOPNOTSUPP;
++
++ rcu_read_lock();
++ switch (sdata->vif.type) {
++ case NL80211_IFTYPE_AP_VLAN:
++ sta = rcu_dereference(sdata->u.vlan.sta);
++ if (sta)
++ break;
++ if (sdata->wdev.use_4addr)
++ goto out;
++ if (is_multicast_ether_addr(ctx->daddr))
++ goto out;
++ sta = sta_info_get_bss(sdata, ctx->daddr);
++ break;
++ case NL80211_IFTYPE_AP:
++ if (is_multicast_ether_addr(ctx->daddr))
++ goto out;
++ sta = sta_info_get(sdata, ctx->daddr);
++ break;
++ case NL80211_IFTYPE_STATION:
++ if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) {
++ sta = sta_info_get(sdata, ctx->daddr);
++ if (sta && test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
++ if (!test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH))
++ goto out;
++
++ break;
++ }
++ }
++
++ sta = sta_info_get(sdata, sdata->u.mgd.bssid);
++ break;
++ default:
++ goto out;
++ }
++
++ if (!sta)
++ goto out;
++
++ ret = drv_net_fill_forward_path(local, sdata, &sta->sta, ctx, path);
++out:
++ rcu_read_unlock();
++
++ return ret;
++}
++#endif
++
+ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+ #if LINUX_VERSION_IS_LESS(4,10,0)
+ .ndo_change_mtu = __change_mtu,
+@@ -839,7 +901,9 @@ static const struct net_device_ops ieee8
+ #else
+ .ndo_get_stats64 = bp_ieee80211_get_stats64,
+ #endif
+-
++#if LINUX_VERSION_IS_GEQ(5,10,0)
++ .ndo_fill_forward_path = ieee80211_netdev_fill_forward_path,
++#endif
+ };
+
+ static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -2892,6 +2892,15 @@ TRACE_EVENT(drv_twt_teardown_request,
+ )
+ );
+
++#if LINUX_VERSION_IS_GEQ(5,10,0)
++DEFINE_EVENT(sta_event, drv_net_fill_forward_path,
++ TP_PROTO(struct ieee80211_local *local,
++ struct ieee80211_sub_if_data *sdata,
++ struct ieee80211_sta *sta),
++ TP_ARGS(local, sdata, sta)
++);
++#endif
++
+ #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
+
+ #undef TRACE_INCLUDE_PATH
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/309-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/309-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
new file mode 100644
index 0000000..0d475b7
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/309-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
@@ -0,0 +1,21 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 28 Apr 2021 21:03:13 +0200
+Subject: [PATCH] mac80211: minstrel_ht: fix MINSTREL_FRAC macro
+
+Add missing braces to avoid issues with e.g. using additions in the
+div expression
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.h
++++ b/net/mac80211/rc80211_minstrel_ht.h
+@@ -14,7 +14,7 @@
+
+ /* scaled fraction values */
+ #define MINSTREL_SCALE 12
+-#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / div)
++#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / (div))
+ #define MINSTREL_TRUNC(val) ((val) >> MINSTREL_SCALE)
+
+ #define EWMA_LEVEL 96 /* ewma weighting factor [/EWMA_DIV] */
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/310-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/310-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
new file mode 100644
index 0000000..16bcbc2
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/310-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
@@ -0,0 +1,30 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 6 Feb 2021 16:08:01 +0100
+Subject: [PATCH] mac80211: minstrel_ht: reduce fluctuations in rate
+ probability stats
+
+In some scenarios when there is a lot of fluctuation in packet error rates,
+rate switching can be amplified when the statistics get skewed by time slots
+with very few tries.
+Make the input data to the moving average more smooth by adding the
+success/attempts count from the last stats window as well. This has the
+advantage of smoothing the data without introducing any extra lag to sampling
+rates.
+This significantly improves rate stability on a strong test link subjected to
+periodic noise bursts generated with a SDR
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -700,7 +700,8 @@ minstrel_ht_calc_rate_stats(struct minst
+ unsigned int cur_prob;
+
+ if (unlikely(mrs->attempts > 0)) {
+- cur_prob = MINSTREL_FRAC(mrs->success, mrs->attempts);
++ cur_prob = MINSTREL_FRAC(mrs->success + mrs->last_success,
++ mrs->attempts + mrs->last_attempts);
+ minstrel_filter_avg_add(&mrs->prob_avg,
+ &mrs->prob_avg_1, cur_prob);
+ mrs->att_hist += mrs->attempts;
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/311-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/311-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
new file mode 100644
index 0000000..a6817bd
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/311-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
@@ -0,0 +1,151 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 6 Feb 2021 16:33:14 +0100
+Subject: [PATCH] mac80211: minstrel_ht: rework rate downgrade code and
+ max_prob rate selection
+
+The current fallback code for fast rate switching on potentially failing rates
+is triggering too often if there is some strong noise on the channel. This can
+lead to wild fluctuations in the rate selection.
+Additionally, switching down to max_prob_rate can create a significant gap down
+in throughput, especially when using only 2 spatial streams, because max_prob_rate
+is limited to using fewer streams than the max_tp rates.
+In order to improve throughput without reducing reliability too much, use the
+rate downgrade code for the max_prob_rate only, and allow the non-downgraded
+max_prob_rate to use as many spatial streams as the max_tp rates
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -511,6 +511,14 @@ minstrel_ht_set_best_prob_rate(struct mi
+ int cur_tp_avg, cur_group, cur_idx;
+ int max_gpr_group, max_gpr_idx;
+ int max_gpr_tp_avg, max_gpr_prob;
++ int min_dur;
++
++ min_dur = max(minstrel_get_duration(mi->max_tp_rate[0]),
++ minstrel_get_duration(mi->max_tp_rate[1]));
++
++ /* make the rate at least 18% slower than max tp rates */
++ if (minstrel_get_duration(index) <= min_dur * 19 / 16)
++ return;
+
+ cur_group = MI_RATE_GROUP(index);
+ cur_idx = MI_RATE_IDX(index);
+@@ -532,11 +540,6 @@ minstrel_ht_set_best_prob_rate(struct mi
+ !minstrel_ht_is_legacy_group(max_tp_group))
+ return;
+
+- /* skip rates faster than max tp rate with lower prob */
+- if (minstrel_get_duration(mi->max_tp_rate[0]) > minstrel_get_duration(index) &&
+- mrs->prob_avg < max_tp_prob)
+- return;
+-
+ max_gpr_group = MI_RATE_GROUP(mg->max_group_prob_rate);
+ max_gpr_idx = MI_RATE_IDX(mg->max_group_prob_rate);
+ max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_avg;
+@@ -594,40 +597,6 @@ minstrel_ht_assign_best_tp_rates(struct
+
+ }
+
+-/*
+- * Try to increase robustness of max_prob rate by decrease number of
+- * streams if possible.
+- */
+-static inline void
+-minstrel_ht_prob_rate_reduce_streams(struct minstrel_ht_sta *mi)
+-{
+- struct minstrel_mcs_group_data *mg;
+- int tmp_max_streams, group, tmp_idx, tmp_prob;
+- int tmp_tp = 0;
+-
+- if (!mi->sta->ht_cap.ht_supported)
+- return;
+-
+- group = MI_RATE_GROUP(mi->max_tp_rate[0]);
+- tmp_max_streams = minstrel_mcs_groups[group].streams;
+- for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
+- mg = &mi->groups[group];
+- if (!mi->supported[group] || group == MINSTREL_CCK_GROUP)
+- continue;
+-
+- tmp_idx = MI_RATE_IDX(mg->max_group_prob_rate);
+- tmp_prob = mi->groups[group].rates[tmp_idx].prob_avg;
+-
+- if (tmp_tp < minstrel_ht_get_tp_avg(mi, group, tmp_idx, tmp_prob) &&
+- (minstrel_mcs_groups[group].streams < tmp_max_streams)) {
+- mi->max_prob_rate = mg->max_group_prob_rate;
+- tmp_tp = minstrel_ht_get_tp_avg(mi, group,
+- tmp_idx,
+- tmp_prob);
+- }
+- }
+-}
+-
+ static u16
+ __minstrel_ht_get_sample_rate(struct minstrel_ht_sta *mi,
+ enum minstrel_sample_type type)
+@@ -1107,8 +1076,6 @@ minstrel_ht_update_stats(struct minstrel
+
+ mi->max_prob_rate = tmp_max_prob_rate;
+
+- /* Try to increase robustness of max_prob_rate*/
+- minstrel_ht_prob_rate_reduce_streams(mi);
+ minstrel_ht_refill_sample_rates(mi);
+
+ #ifdef CPTCFG_MAC80211_DEBUGFS
+@@ -1153,7 +1120,7 @@ minstrel_ht_txstat_valid(struct minstrel
+ }
+
+ static void
+-minstrel_downgrade_rate(struct minstrel_ht_sta *mi, u16 *idx, bool primary)
++minstrel_downgrade_prob_rate(struct minstrel_ht_sta *mi, u16 *idx)
+ {
+ int group, orig_group;
+
+@@ -1168,11 +1135,7 @@ minstrel_downgrade_rate(struct minstrel_
+ minstrel_mcs_groups[orig_group].streams)
+ continue;
+
+- if (primary)
+- *idx = mi->groups[group].max_group_tp_rate[0];
+- else
+- *idx = mi->groups[group].max_group_tp_rate[1];
+- break;
++ *idx = mi->groups[group].max_group_prob_rate;
+ }
+ }
+
+@@ -1183,7 +1146,7 @@ minstrel_ht_tx_status(void *priv, struct
+ struct ieee80211_tx_info *info = st->info;
+ struct minstrel_ht_sta *mi = priv_sta;
+ struct ieee80211_tx_rate *ar = info->status.rates;
+- struct minstrel_rate_stats *rate, *rate2;
++ struct minstrel_rate_stats *rate;
+ struct minstrel_priv *mp = priv;
+ u32 update_interval = mp->update_interval;
+ bool last, update = false;
+@@ -1233,18 +1196,13 @@ minstrel_ht_tx_status(void *priv, struct
+ /*
+ * check for sudden death of spatial multiplexing,
+ * downgrade to a lower number of streams if necessary.
++ * only do this for the max_prob_rate to prevent spurious
++ * rate fluctuations when the link changes suddenly
+ */
+- rate = minstrel_get_ratestats(mi, mi->max_tp_rate[0]);
++ rate = minstrel_get_ratestats(mi, mi->max_prob_rate);
+ if (rate->attempts > 30 &&
+ rate->success < rate->attempts / 4) {
+- minstrel_downgrade_rate(mi, &mi->max_tp_rate[0], true);
+- update = true;
+- }
+-
+- rate2 = minstrel_get_ratestats(mi, mi->max_tp_rate[1]);
+- if (rate2->attempts > 30 &&
+- rate2->success < rate2->attempts / 4) {
+- minstrel_downgrade_rate(mi, &mi->max_tp_rate[1], false);
++ minstrel_downgrade_prob_rate(mi, &mi->max_prob_rate);
+ update = true;
+ }
+ }
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/312-mac80211-split-beacon-retrieval-functions.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/312-mac80211-split-beacon-retrieval-functions.patch
new file mode 100644
index 0000000..18b1951
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/312-mac80211-split-beacon-retrieval-functions.patch
@@ -0,0 +1,262 @@
+From: Aloka Dixit <alokad@codeaurora.org>
+Date: Tue, 5 Oct 2021 21:09:36 -0700
+Subject: [PATCH] mac80211: split beacon retrieval functions
+
+Split __ieee80211_beacon_get() into a separate function for AP mode
+ieee80211_beacon_get_ap().
+Also, move the code common to all modes (AP, adhoc and mesh) to
+a separate function ieee80211_beacon_get_finish().
+
+Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
+Link: https://lore.kernel.org/r/20211006040938.9531-2-alokad@codeaurora.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4987,6 +4987,115 @@ static int ieee80211_beacon_protect(stru
+ return 0;
+ }
+
++static void
++ieee80211_beacon_get_finish(struct ieee80211_hw *hw,
++ struct ieee80211_vif *vif,
++ struct ieee80211_mutable_offsets *offs,
++ struct beacon_data *beacon,
++ struct sk_buff *skb,
++ struct ieee80211_chanctx_conf *chanctx_conf,
++ u16 csa_off_base)
++{
++ struct ieee80211_local *local = hw_to_local(hw);
++ struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
++ struct ieee80211_tx_info *info;
++ enum nl80211_band band;
++ struct ieee80211_tx_rate_control txrc;
++
++ /* CSA offsets */
++ if (offs && beacon) {
++ u16 i;
++
++ for (i = 0; i < IEEE80211_MAX_CNTDWN_COUNTERS_NUM; i++) {
++ u16 csa_off = beacon->cntdwn_counter_offsets[i];
++
++ if (!csa_off)
++ continue;
++
++ offs->cntdwn_counter_offs[i] = csa_off_base + csa_off;
++ }
++ }
++
++ band = chanctx_conf->def.chan->band;
++ info = IEEE80211_SKB_CB(skb);
++ info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
++ info->flags |= IEEE80211_TX_CTL_NO_ACK;
++ info->band = band;
++
++ memset(&txrc, 0, sizeof(txrc));
++ txrc.hw = hw;
++ txrc.sband = local->hw.wiphy->bands[band];
++ txrc.bss_conf = &sdata->vif.bss_conf;
++ txrc.skb = skb;
++ txrc.reported_rate.idx = -1;
++ if (sdata->beacon_rate_set && sdata->beacon_rateidx_mask[band])
++ txrc.rate_idx_mask = sdata->beacon_rateidx_mask[band];
++ else
++ txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
++ txrc.bss = true;
++ rate_control_get_rate(sdata, NULL, &txrc);
++
++ info->control.vif = vif;
++ info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT |
++ IEEE80211_TX_CTL_ASSIGN_SEQ |
++ IEEE80211_TX_CTL_FIRST_FRAGMENT;
++}
++
++static struct sk_buff *
++ieee80211_beacon_get_ap(struct ieee80211_hw *hw,
++ struct ieee80211_vif *vif,
++ struct ieee80211_mutable_offsets *offs,
++ bool is_template,
++ struct beacon_data *beacon,
++ struct ieee80211_chanctx_conf *chanctx_conf)
++{
++ struct ieee80211_local *local = hw_to_local(hw);
++ struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
++ struct ieee80211_if_ap *ap = &sdata->u.ap;
++ struct sk_buff *skb = NULL;
++ u16 csa_off_base = 0;
++
++ if (beacon->cntdwn_counter_offsets[0]) {
++ if (!is_template)
++ ieee80211_beacon_update_cntdwn(vif);
++
++ ieee80211_set_beacon_cntdwn(sdata, beacon);
++ }
++
++ /* headroom, head length,
++ * tail length and maximum TIM length
++ */
++ skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
++ beacon->tail_len + 256 +
++ local->hw.extra_beacon_tailroom);
++ if (!skb)
++ return NULL;
++
++ skb_reserve(skb, local->tx_headroom);
++ skb_put_data(skb, beacon->head, beacon->head_len);
++
++ ieee80211_beacon_add_tim(sdata, &ap->ps, skb, is_template);
++
++ if (offs) {
++ offs->tim_offset = beacon->head_len;
++ offs->tim_length = skb->len - beacon->head_len;
++ offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
++
++ /* for AP the csa offsets are from tail */
++ csa_off_base = skb->len;
++ }
++
++ if (beacon->tail)
++ skb_put_data(skb, beacon->tail, beacon->tail_len);
++
++ if (ieee80211_beacon_protect(skb, local, sdata) < 0)
++ return NULL;
++
++ ieee80211_beacon_get_finish(hw, vif, offs, beacon, skb, chanctx_conf,
++ csa_off_base);
++ return skb;
++}
++
+ static struct sk_buff *
+ __ieee80211_beacon_get(struct ieee80211_hw *hw,
+ struct ieee80211_vif *vif,
+@@ -4996,12 +5105,8 @@ __ieee80211_beacon_get(struct ieee80211_
+ struct ieee80211_local *local = hw_to_local(hw);
+ struct beacon_data *beacon = NULL;
+ struct sk_buff *skb = NULL;
+- struct ieee80211_tx_info *info;
+ struct ieee80211_sub_if_data *sdata = NULL;
+- enum nl80211_band band;
+- struct ieee80211_tx_rate_control txrc;
+ struct ieee80211_chanctx_conf *chanctx_conf;
+- int csa_off_base = 0;
+
+ rcu_read_lock();
+
+@@ -5018,48 +5123,11 @@ __ieee80211_beacon_get(struct ieee80211_
+ struct ieee80211_if_ap *ap = &sdata->u.ap;
+
+ beacon = rcu_dereference(ap->beacon);
+- if (beacon) {
+- if (beacon->cntdwn_counter_offsets[0]) {
+- if (!is_template)
+- ieee80211_beacon_update_cntdwn(vif);
+-
+- ieee80211_set_beacon_cntdwn(sdata, beacon);
+- }
+-
+- /*
+- * headroom, head length,
+- * tail length and maximum TIM length
+- */
+- skb = dev_alloc_skb(local->tx_headroom +
+- beacon->head_len +
+- beacon->tail_len + 256 +
+- local->hw.extra_beacon_tailroom);
+- if (!skb)
+- goto out;
+-
+- skb_reserve(skb, local->tx_headroom);
+- skb_put_data(skb, beacon->head, beacon->head_len);
+-
+- ieee80211_beacon_add_tim(sdata, &ap->ps, skb,
+- is_template);
+-
+- if (offs) {
+- offs->tim_offset = beacon->head_len;
+- offs->tim_length = skb->len - beacon->head_len;
+- offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
+-
+- /* for AP the csa offsets are from tail */
+- csa_off_base = skb->len;
+- }
+-
+- if (beacon->tail)
+- skb_put_data(skb, beacon->tail,
+- beacon->tail_len);
+-
+- if (ieee80211_beacon_protect(skb, local, sdata) < 0)
+- goto out;
+- } else
++ if (!beacon)
+ goto out;
++
++ skb = ieee80211_beacon_get_ap(hw, vif, offs, is_template,
++ beacon, chanctx_conf);
+ } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+ struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+ struct ieee80211_hdr *hdr;
+@@ -5085,6 +5153,9 @@ __ieee80211_beacon_get(struct ieee80211_
+ hdr = (struct ieee80211_hdr *) skb->data;
+ hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+ IEEE80211_STYPE_BEACON);
++
++ ieee80211_beacon_get_finish(hw, vif, offs, beacon, skb,
++ chanctx_conf, 0);
+ } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
+ struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+
+@@ -5124,51 +5195,13 @@ __ieee80211_beacon_get(struct ieee80211_
+ }
+
+ skb_put_data(skb, beacon->tail, beacon->tail_len);
++ ieee80211_beacon_get_finish(hw, vif, offs, beacon, skb,
++ chanctx_conf, 0);
+ } else {
+ WARN_ON(1);
+ goto out;
+ }
+
+- /* CSA offsets */
+- if (offs && beacon) {
+- int i;
+-
+- for (i = 0; i < IEEE80211_MAX_CNTDWN_COUNTERS_NUM; i++) {
+- u16 csa_off = beacon->cntdwn_counter_offsets[i];
+-
+- if (!csa_off)
+- continue;
+-
+- offs->cntdwn_counter_offs[i] = csa_off_base + csa_off;
+- }
+- }
+-
+- band = chanctx_conf->def.chan->band;
+-
+- info = IEEE80211_SKB_CB(skb);
+-
+- info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+- info->flags |= IEEE80211_TX_CTL_NO_ACK;
+- info->band = band;
+-
+- memset(&txrc, 0, sizeof(txrc));
+- txrc.hw = hw;
+- txrc.sband = local->hw.wiphy->bands[band];
+- txrc.bss_conf = &sdata->vif.bss_conf;
+- txrc.skb = skb;
+- txrc.reported_rate.idx = -1;
+- if (sdata->beacon_rate_set && sdata->beacon_rateidx_mask[band])
+- txrc.rate_idx_mask = sdata->beacon_rateidx_mask[band];
+- else
+- txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
+- txrc.bss = true;
+- rate_control_get_rate(sdata, NULL, &txrc);
+-
+- info->control.vif = vif;
+-
+- info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT |
+- IEEE80211_TX_CTL_ASSIGN_SEQ |
+- IEEE80211_TX_CTL_FIRST_FRAGMENT;
+ out:
+ rcu_read_unlock();
+ return skb;
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/313-nl80211-MBSSID-and-EMA-support-in-AP-mode.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/313-nl80211-MBSSID-and-EMA-support-in-AP-mode.patch
new file mode 100644
index 0000000..8e6b301
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/313-nl80211-MBSSID-and-EMA-support-in-AP-mode.patch
@@ -0,0 +1,493 @@
+From: John Crispin <john@phrozen.org>
+Date: Wed, 15 Sep 2021 19:54:34 -0700
+Subject: [PATCH] nl80211: MBSSID and EMA support in AP mode
+
+Add new attributes to configure support for multiple BSSID
+and advanced multi-BSSID advertisements (EMA) in AP mode.
+
+- NL80211_ATTR_MBSSID_CONFIG used for per interface configuration.
+- NL80211_ATTR_MBSSID_ELEMS used to MBSSID elements for beacons.
+
+Memory for the elements is allocated dynamically. This change frees
+the memory in existing functions which call nl80211_parse_beacon(),
+a comment is added to indicate the new references to do the same.
+
+Signed-off-by: John Crispin <john@phrozen.org>
+Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
+Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
+Link: https://lore.kernel.org/r/20210916025437.29138-2-alokad@codeaurora.org
+[don't leave ERR_PTR hanging around]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -1046,6 +1046,36 @@ struct cfg80211_crypto_settings {
+ };
+
+ /**
++ * struct cfg80211_mbssid_config - AP settings for multi bssid
++ *
++ * @tx_wdev: pointer to the transmitted interface in the MBSSID set
++ * @index: index of this AP in the multi bssid group.
++ * @ema: set to true if the beacons should be sent out in EMA mode.
++ */
++struct cfg80211_mbssid_config {
++ struct wireless_dev *tx_wdev;
++ u8 index;
++ bool ema;
++};
++
++/**
++ * struct cfg80211_mbssid_elems - Multiple BSSID elements
++ *
++ * @cnt: Number of elements in array %elems.
++ *
++ * @elem: Array of multiple BSSID element(s) to be added into Beacon frames.
++ * @elem.data: Data for multiple BSSID elements.
++ * @elem.len: Length of data.
++ */
++struct cfg80211_mbssid_elems {
++ u8 cnt;
++ struct {
++ const u8 *data;
++ size_t len;
++ } elem[];
++};
++
++/**
+ * struct cfg80211_beacon_data - beacon data
+ * @head: head portion of beacon (before TIM IE)
+ * or %NULL if not changed
+@@ -1063,6 +1093,7 @@ struct cfg80211_crypto_settings {
+ * @assocresp_ies_len: length of assocresp_ies in octets
+ * @probe_resp_len: length of probe response template (@probe_resp)
+ * @probe_resp: probe response template (AP mode only)
++ * @mbssid_ies: multiple BSSID elements
+ * @ftm_responder: enable FTM responder functionality; -1 for no change
+ * (which also implies no change in LCI/civic location data)
+ * @lci: Measurement Report element content, starting with Measurement Token
+@@ -1080,6 +1111,7 @@ struct cfg80211_beacon_data {
+ const u8 *probe_resp;
+ const u8 *lci;
+ const u8 *civicloc;
++ struct cfg80211_mbssid_elems *mbssid_ies;
+ s8 ftm_responder;
+
+ size_t head_len, tail_len;
+@@ -1194,6 +1226,7 @@ enum cfg80211_ap_settings_flags {
+ * @he_oper: HE operation IE (or %NULL if HE isn't enabled)
+ * @fils_discovery: FILS discovery transmission parameters
+ * @unsol_bcast_probe_resp: Unsolicited broadcast probe response parameters
++ * @mbssid_config: AP settings for multiple bssid
+ */
+ struct cfg80211_ap_settings {
+ struct cfg80211_chan_def chandef;
+@@ -1226,6 +1259,7 @@ struct cfg80211_ap_settings {
+ struct cfg80211_he_bss_color he_bss_color;
+ struct cfg80211_fils_discovery fils_discovery;
+ struct cfg80211_unsol_bcast_probe_resp unsol_bcast_probe_resp;
++ struct cfg80211_mbssid_config mbssid_config;
+ };
+
+ /**
+@@ -4986,6 +5020,13 @@ struct wiphy_iftype_akm_suites {
+ * %NL80211_TID_CONFIG_ATTR_RETRY_LONG attributes
+ * @sar_capa: SAR control capabilities
+ * @rfkill: a pointer to the rfkill structure
++ *
++ * @mbssid_max_interfaces: maximum number of interfaces supported by the driver
++ * in a multiple BSSID set. This field must be set to a non-zero value
++ * by the driver to advertise MBSSID support.
++ * @mbssid_max_ema_profile_periodicity: maximum profile periodicity supported by
++ * the driver. Setting this field to a non-zero value indicates that the
++ * driver supports enhanced multi-BSSID advertisements (EMA AP).
+ */
+ struct wiphy {
+ struct mutex mtx;
+@@ -5133,6 +5174,9 @@ struct wiphy {
+
+ struct rfkill *rfkill;
+
++ u8 mbssid_max_interfaces;
++ u8 ema_max_profile_periodicity;
++
+ char priv[] __aligned(NETDEV_ALIGN);
+ };
+
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -337,7 +337,10 @@
+ * @NL80211_CMD_DEL_INTERFACE: Virtual interface was deleted, has attributes
+ * %NL80211_ATTR_IFINDEX and %NL80211_ATTR_WIPHY. Can also be sent from
+ * userspace to request deletion of a virtual interface, then requires
+- * attribute %NL80211_ATTR_IFINDEX.
++ * attribute %NL80211_ATTR_IFINDEX. If multiple BSSID advertisements are
++ * enabled using %NL80211_ATTR_MBSSID_CONFIG, %NL80211_ATTR_MBSSID_ELEMS,
++ * and if this command is used for the transmitting interface, then all
++ * the non-transmitting interfaces are deleted as well.
+ *
+ * @NL80211_CMD_GET_KEY: Get sequence counter information for a key specified
+ * by %NL80211_ATTR_KEY_IDX and/or %NL80211_ATTR_MAC.
+@@ -2593,6 +2596,18 @@ enum nl80211_commands {
+ * @NL80211_ATTR_COLOR_CHANGE_ELEMS: Nested set of attributes containing the IE
+ * information for the time while performing a color switch.
+ *
++ * @NL80211_ATTR_MBSSID_CONFIG: Nested attribute for multiple BSSID
++ * advertisements (MBSSID) parameters in AP mode.
++ * Kernel uses this attribute to indicate the driver's support for MBSSID
++ * and enhanced multi-BSSID advertisements (EMA AP) to the userspace.
++ * Userspace should use this attribute to configure per interface MBSSID
++ * parameters.
++ * See &enum nl80211_mbssid_config_attributes for details.
++ *
++ * @NL80211_ATTR_MBSSID_ELEMS: Nested parameter to pass multiple BSSID elements.
++ * Mandatory parameter for the transmitting interface to enable MBSSID.
++ * Optional for the non-transmitting interfaces.
++ *
+ * @NUM_NL80211_ATTR: total number of nl80211_attrs available
+ * @NL80211_ATTR_MAX: highest attribute number currently defined
+ * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -3096,6 +3111,9 @@ enum nl80211_attrs {
+ NL80211_ATTR_COLOR_CHANGE_COLOR,
+ NL80211_ATTR_COLOR_CHANGE_ELEMS,
+
++ NL80211_ATTR_MBSSID_CONFIG,
++ NL80211_ATTR_MBSSID_ELEMS,
++
+ /* add attributes here, update the policy in nl80211.c */
+
+ __NL80211_ATTR_AFTER_LAST,
+@@ -7349,4 +7367,60 @@ enum nl80211_sar_specs_attrs {
+ NL80211_SAR_ATTR_SPECS_MAX = __NL80211_SAR_ATTR_SPECS_LAST - 1,
+ };
+
++/**
++ * enum nl80211_mbssid_config_attributes - multiple BSSID (MBSSID) and enhanced
++ * multi-BSSID advertisements (EMA) in AP mode.
++ * Kernel uses some of these attributes to advertise driver's support for
++ * MBSSID and EMA.
++ * Remaining attributes should be used by the userspace to configure the
++ * features.
++ *
++ * @__NL80211_MBSSID_CONFIG_ATTR_INVALID: Invalid
++ *
++ * @NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES: Used by the kernel to advertise
++ * the maximum number of MBSSID interfaces supported by the driver.
++ * Driver should indicate MBSSID support by setting
++ * wiphy->mbssid_max_interfaces to a value more than or equal to 2.
++ *
++ * @NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY: Used by the kernel
++ * to advertise the maximum profile periodicity supported by the driver
++ * if EMA is enabled. Driver should indicate EMA support to the userspace
++ * by setting wiphy->mbssid_max_ema_profile_periodicity to
++ * a non-zero value.
++ *
++ * @NL80211_MBSSID_CONFIG_ATTR_INDEX: Mandatory parameter to pass the index of
++ * this BSS (u8) in the multiple BSSID set.
++ * Value must be set to 0 for the transmitting interface and non-zero for
++ * all non-transmitting interfaces. The userspace will be responsible
++ * for using unique indices for the interfaces.
++ * Range: 0 to wiphy->mbssid_max_interfaces-1.
++ *
++ * @NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX: Mandatory parameter for
++ * a non-transmitted profile which provides the interface index (u32) of
++ * the transmitted profile. The value must match one of the interface
++ * indices advertised by the kernel. Optional if the interface being set up
++ * is the transmitting one, however, if provided then the value must match
++ * the interface index of the same.
++ *
++ * @NL80211_MBSSID_CONFIG_ATTR_EMA: Flag used to enable EMA AP feature.
++ * Setting this flag is permitted only if the driver advertises EMA support
++ * by setting wiphy->mbssid_max_ema_profile_periodicity to non-zero.
++ *
++ * @__NL80211_MBSSID_CONFIG_ATTR_LAST: Internal
++ * @NL80211_MBSSID_CONFIG_ATTR_MAX: highest attribute
++ */
++enum nl80211_mbssid_config_attributes {
++ __NL80211_MBSSID_CONFIG_ATTR_INVALID,
++
++ NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
++ NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
++ NL80211_MBSSID_CONFIG_ATTR_INDEX,
++ NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX,
++ NL80211_MBSSID_CONFIG_ATTR_EMA,
++
++ /* keep last */
++ __NL80211_MBSSID_CONFIG_ATTR_LAST,
++ NL80211_MBSSID_CONFIG_ATTR_MAX = __NL80211_MBSSID_CONFIG_ATTR_LAST - 1,
++};
++
+ #endif /* __LINUX_NL80211_H */
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -439,6 +439,16 @@ sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
+ [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
+ };
+
++static const struct nla_policy
++nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
++ [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
++ [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
++ NLA_POLICY_MIN(NLA_U8, 1),
++ [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
++ [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
++ [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
++};
++
+ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
+ [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
+@@ -780,6 +790,9 @@ static const struct nla_policy nl80211_p
+ [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
+ [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
+ [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
++ [NL80211_ATTR_MBSSID_CONFIG] =
++ NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
++ [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
+ };
+
+ /* policy for the key attributes */
+@@ -2228,6 +2241,35 @@ fail:
+ return -ENOBUFS;
+ }
+
++static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
++{
++ struct nlattr *config;
++
++ if (!wiphy->mbssid_max_interfaces)
++ return 0;
++
++ config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
++ if (!config)
++ return -ENOBUFS;
++
++ if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
++ wiphy->mbssid_max_interfaces))
++ goto fail;
++
++ if (wiphy->ema_max_profile_periodicity &&
++ nla_put_u8(msg,
++ NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
++ wiphy->ema_max_profile_periodicity))
++ goto fail;
++
++ nla_nest_end(msg, config);
++ return 0;
++
++fail:
++ nla_nest_cancel(msg, config);
++ return -ENOBUFS;
++}
++
+ struct nl80211_dump_wiphy_state {
+ s64 filter_wiphy;
+ long start;
+@@ -2813,6 +2855,9 @@ static int nl80211_send_wiphy(struct cfg
+ if (nl80211_put_sar_specs(rdev, msg))
+ goto nla_put_failure;
+
++ if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
++ goto nla_put_failure;
++
+ /* done */
+ state->split_start = 0;
+ break;
+@@ -5002,6 +5047,96 @@ static int validate_beacon_tx_rate(struc
+ return 0;
+ }
+
++static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
++ struct net_device *dev,
++ struct nlattr *attrs,
++ struct cfg80211_mbssid_config *config,
++ u8 num_elems)
++{
++ struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
++
++ if (!wiphy->mbssid_max_interfaces)
++ return -EOPNOTSUPP;
++
++ if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
++ NULL) ||
++ !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
++ return -EINVAL;
++
++ config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
++ if (config->ema) {
++ if (!wiphy->ema_max_profile_periodicity)
++ return -EOPNOTSUPP;
++
++ if (num_elems > wiphy->ema_max_profile_periodicity)
++ return -EINVAL;
++ }
++
++ config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
++ if (config->index >= wiphy->mbssid_max_interfaces ||
++ (!config->index && !num_elems))
++ return -EINVAL;
++
++ if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
++ u32 tx_ifindex =
++ nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
++
++ if ((!config->index && tx_ifindex != dev->ifindex) ||
++ (config->index && tx_ifindex == dev->ifindex))
++ return -EINVAL;
++
++ if (tx_ifindex != dev->ifindex) {
++ struct net_device *tx_netdev =
++ dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
++
++ if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
++ tx_netdev->ieee80211_ptr->wiphy != wiphy ||
++ tx_netdev->ieee80211_ptr->iftype !=
++ NL80211_IFTYPE_AP) {
++ dev_put(tx_netdev);
++ return -EINVAL;
++ }
++
++ config->tx_wdev = tx_netdev->ieee80211_ptr;
++ } else {
++ config->tx_wdev = dev->ieee80211_ptr;
++ }
++ } else if (!config->index) {
++ config->tx_wdev = dev->ieee80211_ptr;
++ } else {
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
++static struct cfg80211_mbssid_elems *
++nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
++{
++ struct nlattr *nl_elems;
++ struct cfg80211_mbssid_elems *elems;
++ int rem_elems;
++ u8 i = 0, num_elems = 0;
++
++ if (!wiphy->mbssid_max_interfaces)
++ return ERR_PTR(-EINVAL);
++
++ nla_for_each_nested(nl_elems, attrs, rem_elems)
++ num_elems++;
++
++ elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
++ if (!elems)
++ return ERR_PTR(-ENOMEM);
++
++ nla_for_each_nested(nl_elems, attrs, rem_elems) {
++ elems->elem[i].data = nla_data(nl_elems);
++ elems->elem[i].len = nla_len(nl_elems);
++ i++;
++ }
++ elems->cnt = num_elems;
++ return elems;
++}
++
+ static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
+ struct nlattr *attrs[],
+ struct cfg80211_beacon_data *bcn)
+@@ -5082,6 +5217,17 @@ static int nl80211_parse_beacon(struct c
+ bcn->ftm_responder = -1;
+ }
+
++ if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
++ struct cfg80211_mbssid_elems *mbssid =
++ nl80211_parse_mbssid_elems(&rdev->wiphy,
++ attrs[NL80211_ATTR_MBSSID_ELEMS]);
++
++ if (IS_ERR(mbssid))
++ return PTR_ERR(mbssid);
++
++ bcn->mbssid_ies = mbssid;
++ }
++
+ return 0;
+ }
+
+@@ -5538,6 +5684,17 @@ static int nl80211_start_ap(struct sk_bu
+ goto out;
+ }
+
++ if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
++ err = nl80211_parse_mbssid_config(&rdev->wiphy, dev,
++ info->attrs[NL80211_ATTR_MBSSID_CONFIG],
++ ¶ms.mbssid_config,
++ params.beacon.mbssid_ies ?
++ params.beacon.mbssid_ies->cnt :
++ 0);
++ if (err)
++ goto out;
++ }
++
+ nl80211_calculate_ap_params(¶ms);
+
+ if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
+@@ -5559,6 +5716,11 @@ static int nl80211_start_ap(struct sk_bu
+
+ out:
+ kfree(params.acl);
++ kfree(params.beacon.mbssid_ies);
++ if (params.mbssid_config.tx_wdev &&
++ params.mbssid_config.tx_wdev->netdev &&
++ params.mbssid_config.tx_wdev->netdev != dev)
++ dev_put(params.mbssid_config.tx_wdev->netdev);
+
+ return err;
+ }
+@@ -5583,12 +5745,14 @@ static int nl80211_set_beacon(struct sk_
+
+ err = nl80211_parse_beacon(rdev, info->attrs, ¶ms);
+ if (err)
+- return err;
++ goto out;
+
+ wdev_lock(wdev);
+ err = rdev_change_beacon(rdev, dev, ¶ms);
+ wdev_unlock(wdev);
+
++out:
++ kfree(params.mbssid_ies);
+ return err;
+ }
+
+@@ -9265,12 +9429,14 @@ static int nl80211_channel_switch(struct
+
+ err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after);
+ if (err)
+- return err;
++ goto free;
+
+ csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
+ GFP_KERNEL);
+- if (!csa_attrs)
+- return -ENOMEM;
++ if (!csa_attrs) {
++ err = -ENOMEM;
++ goto free;
++ }
+
+ err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
+ info->attrs[NL80211_ATTR_CSA_IES],
+@@ -9389,6 +9555,8 @@ skip_beacons:
+ wdev_unlock(wdev);
+
+ free:
++ kfree(params.beacon_after.mbssid_ies);
++ kfree(params.beacon_csa.mbssid_ies);
+ kfree(csa_attrs);
+ return err;
+ }
+@@ -14924,6 +15092,8 @@ static int nl80211_color_change(struct s
+ wdev_unlock(wdev);
+
+ out:
++ kfree(params.beacon_next.mbssid_ies);
++ kfree(params.beacon_color_change.mbssid_ies);
+ kfree(tb);
+ return err;
+ }
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/314-cfg80211-implement-APIs-for-dedicated-radar-detectio.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/314-cfg80211-implement-APIs-for-dedicated-radar-detectio.patch
new file mode 100644
index 0000000..032bcf7
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/314-cfg80211-implement-APIs-for-dedicated-radar-detectio.patch
@@ -0,0 +1,378 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 23 Oct 2021 11:10:50 +0200
+Subject: [PATCH] cfg80211: implement APIs for dedicated radar detection HW
+
+If a dedicated (off-channel) radar detection hardware (chain)
+is available in the hardware/driver, allow this to be used by
+calling the NL80211_CMD_RADAR_DETECT command with a new flag
+attribute requesting off-channel radar detection is used.
+
+Offchannel CAC (channel availability check) avoids the CAC
+downtime when switching to a radar channel or when turning on
+the AP.
+
+Drivers advertise support for this using the new feature flag
+NL80211_EXT_FEATURE_RADAR_OFFCHAN.
+
+Tested-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/7468e291ef5d05d692c1738d25b8f778d8ea5c3f.1634979655.git.lorenzo@kernel.org
+Link: https://lore.kernel.org/r/1e60e60fef00e14401adae81c3d49f3e5f307537.1634979655.git.lorenzo@kernel.org
+Link: https://lore.kernel.org/r/85fa50f57fc3adb2934c8d9ca0be30394de6b7e8.1634979655.git.lorenzo@kernel.org
+Link: https://lore.kernel.org/r/4b6c08671ad59aae0ac46fc94c02f31b1610eb72.1634979655.git.lorenzo@kernel.org
+Link: https://lore.kernel.org/r/241849ccaf2c228873c6f8495bf87b19159ba458.1634979655.git.lorenzo@kernel.org
+[remove offchan_mutex, fix cfg80211_stop_offchan_radar_detection(),
+ remove gfp_t argument, fix documentation, fix tracing]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4057,6 +4057,15 @@ struct mgmt_frame_regs {
+ * @set_sar_specs: Update the SAR (TX power) settings.
+ *
+ * @color_change: Initiate a color change.
++ *
++ * @set_radar_offchan: Configure dedicated offchannel chain available for
++ * radar/CAC detection on some hw. This chain can't be used to transmit
++ * or receive frames and it is bounded to a running wdev.
++ * Offchannel radar/CAC detection allows to avoid the CAC downtime
++ * switching to a different channel during CAC detection on the selected
++ * radar channel.
++ * The caller is expected to set chandef pointer to NULL in order to
++ * disable offchannel CAC/radar detection.
+ */
+ struct cfg80211_ops {
+ int (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
+@@ -4387,6 +4396,8 @@ struct cfg80211_ops {
+ int (*color_change)(struct wiphy *wiphy,
+ struct net_device *dev,
+ struct cfg80211_color_change_settings *params);
++ int (*set_radar_offchan)(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef);
+ };
+
+ /*
+@@ -7608,6 +7619,20 @@ void cfg80211_cac_event(struct net_devic
+ const struct cfg80211_chan_def *chandef,
+ enum nl80211_radar_event event, gfp_t gfp);
+
++/**
++ * cfg80211_offchan_cac_event - Channel Availability Check (CAC) offchan event
++ * @wiphy: the wiphy
++ * @chandef: chandef for the current channel
++ * @event: type of event
++ *
++ * This function is called when a Channel Availability Check (CAC) is finished,
++ * started or aborted by a offchannel dedicated chain.
++ *
++ * Note that this acquires the wiphy lock.
++ */
++void cfg80211_offchan_cac_event(struct wiphy *wiphy,
++ const struct cfg80211_chan_def *chandef,
++ enum nl80211_radar_event event);
+
+ /**
+ * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -2608,6 +2608,13 @@ enum nl80211_commands {
+ * Mandatory parameter for the transmitting interface to enable MBSSID.
+ * Optional for the non-transmitting interfaces.
+ *
++ * @NL80211_ATTR_RADAR_OFFCHAN: Configure dedicated offchannel chain available for
++ * radar/CAC detection on some hw. This chain can't be used to transmit
++ * or receive frames and it is bounded to a running wdev.
++ * Offchannel radar/CAC detection allows to avoid the CAC downtime
++ * switching on a different channel during CAC detection on the selected
++ * radar channel.
++ *
+ * @NUM_NL80211_ATTR: total number of nl80211_attrs available
+ * @NL80211_ATTR_MAX: highest attribute number currently defined
+ * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -3114,6 +3121,8 @@ enum nl80211_attrs {
+ NL80211_ATTR_MBSSID_CONFIG,
+ NL80211_ATTR_MBSSID_ELEMS,
+
++ NL80211_ATTR_RADAR_OFFCHAN,
++
+ /* add attributes here, update the policy in nl80211.c */
+
+ __NL80211_ATTR_AFTER_LAST,
+@@ -6013,6 +6022,9 @@ enum nl80211_feature_flags {
+ * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
+ * detection and change announcemnts.
+ *
++ * @NL80211_EXT_FEATURE_RADAR_OFFCHAN: Device supports offchannel radar/CAC
++ * detection.
++ *
+ * @NUM_NL80211_EXT_FEATURES: number of extended features.
+ * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
+ */
+@@ -6078,6 +6090,7 @@ enum nl80211_ext_feature_index {
+ NL80211_EXT_FEATURE_SECURE_RTT,
+ NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
+ NL80211_EXT_FEATURE_BSS_COLOR,
++ NL80211_EXT_FEATURE_RADAR_OFFCHAN,
+
+ /* add new features before the definition below */
+ NUM_NL80211_EXT_FEATURES,
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -552,6 +552,7 @@ use_default_name:
+ INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work);
+ INIT_WORK(&rdev->conn_work, cfg80211_conn_work);
+ INIT_WORK(&rdev->event_work, cfg80211_event_work);
++ INIT_DELAYED_WORK(&rdev->offchan_cac_work, cfg80211_offchan_cac_work);
+
+ init_waitqueue_head(&rdev->dev_wait);
+
+@@ -1214,6 +1215,8 @@ void __cfg80211_leave(struct cfg80211_re
+
+ cfg80211_pmsr_wdev_down(wdev);
+
++ cfg80211_stop_offchan_radar_detection(wdev);
++
+ switch (wdev->iftype) {
+ case NL80211_IFTYPE_ADHOC:
+ __cfg80211_leave_ibss(rdev, dev, true);
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -84,6 +84,10 @@ struct cfg80211_registered_device {
+
+ struct delayed_work dfs_update_channels_wk;
+
++ struct wireless_dev *offchan_radar_wdev;
++ struct cfg80211_chan_def offchan_radar_chandef;
++ struct delayed_work offchan_cac_work;
++
+ /* netlink port which started critical protocol (0 means not started) */
+ u32 crit_proto_nlportid;
+
+@@ -491,6 +495,15 @@ cfg80211_chandef_dfs_cac_time(struct wip
+
+ void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev);
+
++int
++cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
++ struct wireless_dev *wdev,
++ struct cfg80211_chan_def *chandef);
++
++void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev);
++
++void cfg80211_offchan_cac_work(struct work_struct *work);
++
+ bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
+ struct ieee80211_channel *chan);
+
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -970,3 +970,116 @@ void cfg80211_cac_event(struct net_devic
+ nl80211_radar_notify(rdev, chandef, event, netdev, gfp);
+ }
+ EXPORT_SYMBOL(cfg80211_cac_event);
++
++void cfg80211_offchan_cac_work(struct work_struct *work)
++{
++ struct delayed_work *delayed_work = to_delayed_work(work);
++ struct cfg80211_registered_device *rdev;
++
++ rdev = container_of(delayed_work, struct cfg80211_registered_device,
++ offchan_cac_work);
++ cfg80211_offchan_cac_event(&rdev->wiphy, &rdev->offchan_radar_chandef,
++ NL80211_RADAR_CAC_FINISHED);
++}
++
++static void
++__cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
++ struct wireless_dev *wdev,
++ const struct cfg80211_chan_def *chandef,
++ enum nl80211_radar_event event)
++{
++ struct wiphy *wiphy = &rdev->wiphy;
++ struct net_device *netdev;
++
++ lockdep_assert_wiphy(&rdev->wiphy);
++
++ if (event != NL80211_RADAR_CAC_STARTED && !rdev->offchan_radar_wdev)
++ return;
++
++ switch (event) {
++ case NL80211_RADAR_CAC_FINISHED:
++ cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
++ memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef));
++ queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
++ cfg80211_sched_dfs_chan_update(rdev);
++ wdev = rdev->offchan_radar_wdev;
++ rdev->offchan_radar_wdev = NULL;
++ break;
++ case NL80211_RADAR_CAC_ABORTED:
++ cancel_delayed_work(&rdev->offchan_cac_work);
++ wdev = rdev->offchan_radar_wdev;
++ rdev->offchan_radar_wdev = NULL;
++ break;
++ case NL80211_RADAR_CAC_STARTED:
++ WARN_ON(!wdev);
++ rdev->offchan_radar_wdev = wdev;
++ break;
++ default:
++ return;
++ }
++
++ netdev = wdev ? wdev->netdev : NULL;
++ nl80211_radar_notify(rdev, chandef, event, netdev, GFP_KERNEL);
++}
++
++void cfg80211_offchan_cac_event(struct wiphy *wiphy,
++ const struct cfg80211_chan_def *chandef,
++ enum nl80211_radar_event event)
++{
++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
++
++ wiphy_lock(wiphy);
++ __cfg80211_offchan_cac_event(rdev, NULL, chandef, event);
++ wiphy_unlock(wiphy);
++}
++EXPORT_SYMBOL(cfg80211_offchan_cac_event);
++
++int
++cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
++ struct wireless_dev *wdev,
++ struct cfg80211_chan_def *chandef)
++{
++ unsigned int cac_time_ms;
++ int err;
++
++ lockdep_assert_wiphy(&rdev->wiphy);
++
++ if (!wiphy_ext_feature_isset(&rdev->wiphy,
++ NL80211_EXT_FEATURE_RADAR_OFFCHAN))
++ return -EOPNOTSUPP;
++
++ if (rdev->offchan_radar_wdev)
++ return -EBUSY;
++
++ err = rdev_set_radar_offchan(rdev, chandef);
++ if (err)
++ return err;
++
++ cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, chandef);
++ if (!cac_time_ms)
++ cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
++
++ rdev->offchan_radar_chandef = *chandef;
++ __cfg80211_offchan_cac_event(rdev, wdev, chandef,
++ NL80211_RADAR_CAC_STARTED);
++ queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_work,
++ msecs_to_jiffies(cac_time_ms));
++
++ return 0;
++}
++
++void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev)
++{
++ struct wiphy *wiphy = wdev->wiphy;
++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
++
++ lockdep_assert_wiphy(wiphy);
++
++ if (wdev != rdev->offchan_radar_wdev)
++ return;
++
++ rdev_set_radar_offchan(rdev, NULL);
++
++ __cfg80211_offchan_cac_event(rdev, NULL, NULL,
++ NL80211_RADAR_CAC_ABORTED);
++}
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -793,6 +793,7 @@ static const struct nla_policy nl80211_p
+ [NL80211_ATTR_MBSSID_CONFIG] =
+ NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
+ [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
++ [NL80211_ATTR_RADAR_OFFCHAN] = { .type = NLA_FLAG },
+ };
+
+ /* policy for the key attributes */
+@@ -9269,12 +9270,6 @@ static int nl80211_start_radar_detection
+ if (err)
+ return err;
+
+- if (netif_carrier_ok(dev))
+- return -EBUSY;
+-
+- if (wdev->cac_started)
+- return -EBUSY;
+-
+ err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
+ if (err < 0)
+ return err;
+@@ -9285,6 +9280,16 @@ static int nl80211_start_radar_detection
+ if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
+ return -EINVAL;
+
++ if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_OFFCHAN]))
++ return cfg80211_start_offchan_radar_detection(rdev, wdev,
++ &chandef);
++
++ if (netif_carrier_ok(dev))
++ return -EBUSY;
++
++ if (wdev->cac_started)
++ return -EBUSY;
++
+ /* CAC start is offloaded to HW and can't be started manually */
+ if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
+ return -EOPNOTSUPP;
+--- a/net/wireless/rdev-ops.h
++++ b/net/wireless/rdev-ops.h
+@@ -1381,4 +1381,21 @@ static inline int rdev_color_change(stru
+ return ret;
+ }
+
++static inline int
++rdev_set_radar_offchan(struct cfg80211_registered_device *rdev,
++ struct cfg80211_chan_def *chandef)
++{
++ struct wiphy *wiphy = &rdev->wiphy;
++ int ret;
++
++ if (!rdev->ops->set_radar_offchan)
++ return -EOPNOTSUPP;
++
++ trace_rdev_set_radar_offchan(wiphy, chandef);
++ ret = rdev->ops->set_radar_offchan(wiphy, chandef);
++ trace_rdev_return_int(wiphy, ret);
++
++ return ret;
++}
++
+ #endif /* __CFG80211_RDEV_OPS */
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -3643,6 +3643,25 @@ TRACE_EVENT(cfg80211_bss_color_notify,
+ __entry->color_bitmap)
+ );
+
++TRACE_EVENT(rdev_set_radar_offchan,
++ TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
++
++ TP_ARGS(wiphy, chandef),
++
++ TP_STRUCT__entry(
++ WIPHY_ENTRY
++ CHAN_DEF_ENTRY
++ ),
++
++ TP_fast_assign(
++ WIPHY_ASSIGN;
++ CHAN_DEF_ASSIGN(chandef)
++ ),
++
++ TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
++ WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
++);
++
+ #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
+
+ #undef TRACE_INCLUDE_PATH
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/315-cfg80211-move-offchan_cac_event-to-a-dedicated-work.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/315-cfg80211-move-offchan_cac_event-to-a-dedicated-work.patch
new file mode 100644
index 0000000..e58c3b9
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/315-cfg80211-move-offchan_cac_event-to-a-dedicated-work.patch
@@ -0,0 +1,183 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 27 Oct 2021 11:03:42 +0200
+Subject: [PATCH] cfg80211: move offchan_cac_event to a dedicated work
+
+In order to make cfg80211_offchan_cac_abort() (renamed from
+cfg80211_offchan_cac_event) callable in other contexts and
+without so much locking restrictions, make it trigger a new
+work instead of operating directly.
+
+Do some other renames while at it to clarify.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/6145c3d0f30400a568023f67981981d24c7c6133.1635325205.git.lorenzo@kernel.org
+[rewrite commit log]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -7620,19 +7620,13 @@ void cfg80211_cac_event(struct net_devic
+ enum nl80211_radar_event event, gfp_t gfp);
+
+ /**
+- * cfg80211_offchan_cac_event - Channel Availability Check (CAC) offchan event
++ * cfg80211_offchan_cac_abort - Channel Availability Check offchan abort event
+ * @wiphy: the wiphy
+- * @chandef: chandef for the current channel
+- * @event: type of event
+ *
+- * This function is called when a Channel Availability Check (CAC) is finished,
+- * started or aborted by a offchannel dedicated chain.
+- *
+- * Note that this acquires the wiphy lock.
++ * This function is called by the driver when a Channel Availability Check
++ * (CAC) is aborted by a offchannel dedicated chain.
+ */
+-void cfg80211_offchan_cac_event(struct wiphy *wiphy,
+- const struct cfg80211_chan_def *chandef,
+- enum nl80211_radar_event event);
++void cfg80211_offchan_cac_abort(struct wiphy *wiphy);
+
+ /**
+ * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -552,7 +552,9 @@ use_default_name:
+ INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work);
+ INIT_WORK(&rdev->conn_work, cfg80211_conn_work);
+ INIT_WORK(&rdev->event_work, cfg80211_event_work);
+- INIT_DELAYED_WORK(&rdev->offchan_cac_work, cfg80211_offchan_cac_work);
++ INIT_WORK(&rdev->offchan_cac_abort_wk, cfg80211_offchan_cac_abort_wk);
++ INIT_DELAYED_WORK(&rdev->offchan_cac_done_wk,
++ cfg80211_offchan_cac_done_wk);
+
+ init_waitqueue_head(&rdev->dev_wait);
+
+@@ -1062,11 +1064,13 @@ void wiphy_unregister(struct wiphy *wiph
+ cancel_work_sync(&rdev->conn_work);
+ flush_work(&rdev->event_work);
+ cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
++ cancel_delayed_work_sync(&rdev->offchan_cac_done_wk);
+ flush_work(&rdev->destroy_work);
+ flush_work(&rdev->sched_scan_stop_wk);
+ flush_work(&rdev->propagate_radar_detect_wk);
+ flush_work(&rdev->propagate_cac_done_wk);
+ flush_work(&rdev->mgmt_registrations_update_wk);
++ flush_work(&rdev->offchan_cac_abort_wk);
+
+ #ifdef CONFIG_PM
+ if (rdev->wiphy.wowlan_config && rdev->ops->set_wakeup)
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -86,7 +86,8 @@ struct cfg80211_registered_device {
+
+ struct wireless_dev *offchan_radar_wdev;
+ struct cfg80211_chan_def offchan_radar_chandef;
+- struct delayed_work offchan_cac_work;
++ struct delayed_work offchan_cac_done_wk;
++ struct work_struct offchan_cac_abort_wk;
+
+ /* netlink port which started critical protocol (0 means not started) */
+ u32 crit_proto_nlportid;
+@@ -502,7 +503,9 @@ cfg80211_start_offchan_radar_detection(s
+
+ void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev);
+
+-void cfg80211_offchan_cac_work(struct work_struct *work);
++void cfg80211_offchan_cac_done_wk(struct work_struct *work);
++
++void cfg80211_offchan_cac_abort_wk(struct work_struct *work);
+
+ bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
+ struct ieee80211_channel *chan);
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -971,17 +971,6 @@ void cfg80211_cac_event(struct net_devic
+ }
+ EXPORT_SYMBOL(cfg80211_cac_event);
+
+-void cfg80211_offchan_cac_work(struct work_struct *work)
+-{
+- struct delayed_work *delayed_work = to_delayed_work(work);
+- struct cfg80211_registered_device *rdev;
+-
+- rdev = container_of(delayed_work, struct cfg80211_registered_device,
+- offchan_cac_work);
+- cfg80211_offchan_cac_event(&rdev->wiphy, &rdev->offchan_radar_chandef,
+- NL80211_RADAR_CAC_FINISHED);
+-}
+-
+ static void
+ __cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
+ struct wireless_dev *wdev,
+@@ -1006,7 +995,7 @@ __cfg80211_offchan_cac_event(struct cfg8
+ rdev->offchan_radar_wdev = NULL;
+ break;
+ case NL80211_RADAR_CAC_ABORTED:
+- cancel_delayed_work(&rdev->offchan_cac_work);
++ cancel_delayed_work(&rdev->offchan_cac_done_wk);
+ wdev = rdev->offchan_radar_wdev;
+ rdev->offchan_radar_wdev = NULL;
+ break;
+@@ -1022,17 +1011,44 @@ __cfg80211_offchan_cac_event(struct cfg8
+ nl80211_radar_notify(rdev, chandef, event, netdev, GFP_KERNEL);
+ }
+
+-void cfg80211_offchan_cac_event(struct wiphy *wiphy,
+- const struct cfg80211_chan_def *chandef,
+- enum nl80211_radar_event event)
++static void
++cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
++ const struct cfg80211_chan_def *chandef,
++ enum nl80211_radar_event event)
++{
++ wiphy_lock(&rdev->wiphy);
++ __cfg80211_offchan_cac_event(rdev, NULL, chandef, event);
++ wiphy_unlock(&rdev->wiphy);
++}
++
++void cfg80211_offchan_cac_done_wk(struct work_struct *work)
++{
++ struct delayed_work *delayed_work = to_delayed_work(work);
++ struct cfg80211_registered_device *rdev;
++
++ rdev = container_of(delayed_work, struct cfg80211_registered_device,
++ offchan_cac_done_wk);
++ cfg80211_offchan_cac_event(rdev, &rdev->offchan_radar_chandef,
++ NL80211_RADAR_CAC_FINISHED);
++}
++
++void cfg80211_offchan_cac_abort_wk(struct work_struct *work)
++{
++ struct cfg80211_registered_device *rdev;
++
++ rdev = container_of(work, struct cfg80211_registered_device,
++ offchan_cac_abort_wk);
++ cfg80211_offchan_cac_event(rdev, &rdev->offchan_radar_chandef,
++ NL80211_RADAR_CAC_ABORTED);
++}
++
++void cfg80211_offchan_cac_abort(struct wiphy *wiphy)
+ {
+ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+
+- wiphy_lock(wiphy);
+- __cfg80211_offchan_cac_event(rdev, NULL, chandef, event);
+- wiphy_unlock(wiphy);
++ queue_work(cfg80211_wq, &rdev->offchan_cac_abort_wk);
+ }
+-EXPORT_SYMBOL(cfg80211_offchan_cac_event);
++EXPORT_SYMBOL(cfg80211_offchan_cac_abort);
+
+ int
+ cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
+@@ -1062,7 +1078,7 @@ cfg80211_start_offchan_radar_detection(s
+ rdev->offchan_radar_chandef = *chandef;
+ __cfg80211_offchan_cac_event(rdev, wdev, chandef,
+ NL80211_RADAR_CAC_STARTED);
+- queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_work,
++ queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_done_wk,
+ msecs_to_jiffies(cac_time_ms));
+
+ return 0;
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/316-cfg80211-fix-possible-NULL-pointer-dereference-in-cf.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/316-cfg80211-fix-possible-NULL-pointer-dereference-in-cf.patch
new file mode 100644
index 0000000..362bb88
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/316-cfg80211-fix-possible-NULL-pointer-dereference-in-cf.patch
@@ -0,0 +1,99 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 3 Nov 2021 18:02:35 +0100
+Subject: [PATCH] cfg80211: fix possible NULL pointer dereference in
+ cfg80211_stop_offchan_radar_detection
+
+Fix the following NULL pointer dereference in
+cfg80211_stop_offchan_radar_detection routine that occurs when hostapd
+is stopped during the CAC on offchannel chain:
+
+Sat Jan 1 0[ 779.567851] ESR = 0x96000005
+0:12:50 2000 dae[ 779.572346] EC = 0x25: DABT (current EL), IL = 32 bits
+mon.debug hostap[ 779.578984] SET = 0, FnV = 0
+d: hostapd_inter[ 779.583445] EA = 0, S1PTW = 0
+face_deinit_free[ 779.587936] Data abort info:
+: num_bss=1 conf[ 779.592224] ISV = 0, ISS = 0x00000005
+->num_bss=1
+Sat[ 779.597403] CM = 0, WnR = 0
+ Jan 1 00:12:50[ 779.601749] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000418b2000
+ 2000 daemon.deb[ 779.609601] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
+ug hostapd: host[ 779.619657] Internal error: Oops: 96000005 [#1] SMP
+[ 779.770810] CPU: 0 PID: 2202 Comm: hostapd Not tainted 5.10.75 #0
+[ 779.776892] Hardware name: MediaTek MT7622 RFB1 board (DT)
+[ 779.782370] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)
+[ 779.788384] pc : cfg80211_chandef_valid+0x10/0x490 [cfg80211]
+[ 779.794128] lr : cfg80211_check_station_change+0x3190/0x3950 [cfg80211]
+[ 779.800731] sp : ffffffc01204b7e0
+[ 779.804036] x29: ffffffc01204b7e0 x28: ffffff80039bdc00
+[ 779.809340] x27: 0000000000000000 x26: ffffffc008cb3050
+[ 779.814644] x25: 0000000000000000 x24: 0000000000000002
+[ 779.819948] x23: ffffff8002630000 x22: ffffff8003e748d0
+[ 779.825252] x21: 0000000000000cc0 x20: ffffff8003da4a00
+[ 779.830556] x19: 0000000000000000 x18: ffffff8001bf7ce0
+[ 779.835860] x17: 00000000ffffffff x16: 0000000000000000
+[ 779.841164] x15: 0000000040d59200 x14: 00000000000019c0
+[ 779.846467] x13: 00000000000001c8 x12: 000636b9e9dab1c6
+[ 779.851771] x11: 0000000000000141 x10: 0000000000000820
+[ 779.857076] x9 : 0000000000000000 x8 : ffffff8003d7d038
+[ 779.862380] x7 : 0000000000000000 x6 : ffffff8003d7d038
+[ 779.867683] x5 : 0000000000000e90 x4 : 0000000000000038
+[ 779.872987] x3 : 0000000000000002 x2 : 0000000000000004
+[ 779.878291] x1 : 0000000000000000 x0 : 0000000000000000
+[ 779.883594] Call trace:
+[ 779.886039] cfg80211_chandef_valid+0x10/0x490 [cfg80211]
+[ 779.891434] cfg80211_check_station_change+0x3190/0x3950 [cfg80211]
+[ 779.897697] nl80211_radar_notify+0x138/0x19c [cfg80211]
+[ 779.903005] cfg80211_stop_offchan_radar_detection+0x7c/0x8c [cfg80211]
+[ 779.909616] __cfg80211_leave+0x2c/0x190 [cfg80211]
+[ 779.914490] cfg80211_register_netdevice+0x1c0/0x6d0 [cfg80211]
+[ 779.920404] raw_notifier_call_chain+0x50/0x70
+[ 779.924841] call_netdevice_notifiers_info+0x54/0xa0
+[ 779.929796] __dev_close_many+0x40/0x100
+[ 779.933712] __dev_change_flags+0x98/0x190
+[ 779.937800] dev_change_flags+0x20/0x60
+[ 779.941628] devinet_ioctl+0x534/0x6d0
+[ 779.945370] inet_ioctl+0x1bc/0x230
+[ 779.948849] sock_do_ioctl+0x44/0x200
+[ 779.952502] sock_ioctl+0x268/0x4c0
+[ 779.955985] __arm64_sys_ioctl+0xac/0xd0
+[ 779.959900] el0_svc_common.constprop.0+0x60/0x110
+[ 779.964682] do_el0_svc+0x1c/0x24
+[ 779.967990] el0_svc+0x10/0x1c
+[ 779.971036] el0_sync_handler+0x9c/0x120
+[ 779.974950] el0_sync+0x148/0x180
+[ 779.978259] Code: a9bc7bfd 910003fd a90153f3 aa0003f3 (f9400000)
+[ 779.984344] ---[ end trace 0e67b4f5d6cdeec7 ]---
+[ 779.996400] Kernel panic - not syncing: Oops: Fatal exception
+[ 780.002139] SMP: stopping secondary CPUs
+[ 780.006057] Kernel Offset: disabled
+[ 780.009537] CPU features: 0x0000002,04002004
+[ 780.013796] Memory Limit: none
+
+Fixes: b8f5facf286b ("cfg80211: implement APIs for dedicated radar detection HW")
+Reported-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Tested-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/c2e34c065bf8839c5ffa45498ae154021a72a520.1635958796.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -982,6 +982,9 @@ __cfg80211_offchan_cac_event(struct cfg8
+
+ lockdep_assert_wiphy(&rdev->wiphy);
+
++ if (!cfg80211_chandef_valid(chandef))
++ return;
++
+ if (event != NL80211_RADAR_CAC_STARTED && !rdev->offchan_radar_wdev)
+ return;
+
+@@ -1096,6 +1099,6 @@ void cfg80211_stop_offchan_radar_detecti
+
+ rdev_set_radar_offchan(rdev, NULL);
+
+- __cfg80211_offchan_cac_event(rdev, NULL, NULL,
++ __cfg80211_offchan_cac_event(rdev, wdev, &rdev->offchan_radar_chandef,
+ NL80211_RADAR_CAC_ABORTED);
+ }
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/317-cfg80211-schedule-offchan_cac_abort_wk-in-cfg80211_r.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/317-cfg80211-schedule-offchan_cac_abort_wk-in-cfg80211_r.patch
new file mode 100644
index 0000000..df7afef
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/317-cfg80211-schedule-offchan_cac_abort_wk-in-cfg80211_r.patch
@@ -0,0 +1,136 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 16 Nov 2021 12:41:52 +0100
+Subject: [PATCH] cfg80211: schedule offchan_cac_abort_wk in
+ cfg80211_radar_event
+
+If necessary schedule offchan_cac_abort_wk work in cfg80211_radar_event
+routine adding offchan parameter to cfg80211_radar_event signature.
+Rename cfg80211_radar_event in __cfg80211_radar_event and introduce
+the two following inline helpers:
+- cfg80211_radar_event
+- cfg80211_offchan_radar_event
+Doing so the drv will not need to run cfg80211_offchan_cac_abort() after
+radar detection on the offchannel chain.
+
+Tested-by: Owen Peng <owen.peng@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/3ff583e021e3343a3ced54a7b09b5e184d1880dc.1637062727.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -7580,15 +7580,33 @@ void cfg80211_cqm_txe_notify(struct net_
+ void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp);
+
+ /**
+- * cfg80211_radar_event - radar detection event
++ * __cfg80211_radar_event - radar detection event
+ * @wiphy: the wiphy
+ * @chandef: chandef for the current channel
++ * @offchan: the radar has been detected on the offchannel chain
+ * @gfp: context flags
+ *
+ * This function is called when a radar is detected on the current chanenl.
+ */
+-void cfg80211_radar_event(struct wiphy *wiphy,
+- struct cfg80211_chan_def *chandef, gfp_t gfp);
++void __cfg80211_radar_event(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef,
++ bool offchan, gfp_t gfp);
++
++static inline void
++cfg80211_radar_event(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef,
++ gfp_t gfp)
++{
++ __cfg80211_radar_event(wiphy, chandef, false, gfp);
++}
++
++static inline void
++cfg80211_offchan_radar_event(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef,
++ gfp_t gfp)
++{
++ __cfg80211_radar_event(wiphy, chandef, true, gfp);
++}
+
+ /**
+ * cfg80211_sta_opmode_change_notify - STA's ht/vht operation mode change event
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -905,13 +905,13 @@ void cfg80211_dfs_channels_update_work(s
+ }
+
+
+-void cfg80211_radar_event(struct wiphy *wiphy,
+- struct cfg80211_chan_def *chandef,
+- gfp_t gfp)
++void __cfg80211_radar_event(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef,
++ bool offchan, gfp_t gfp)
+ {
+ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+
+- trace_cfg80211_radar_event(wiphy, chandef);
++ trace_cfg80211_radar_event(wiphy, chandef, offchan);
+
+ /* only set the chandef supplied channel to unavailable, in
+ * case the radar is detected on only one of multiple channels
+@@ -919,6 +919,9 @@ void cfg80211_radar_event(struct wiphy *
+ */
+ cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
+
++ if (offchan)
++ queue_work(cfg80211_wq, &rdev->offchan_cac_abort_wk);
++
+ cfg80211_sched_dfs_chan_update(rdev);
+
+ nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
+@@ -926,7 +929,7 @@ void cfg80211_radar_event(struct wiphy *
+ memcpy(&rdev->radar_chandef, chandef, sizeof(struct cfg80211_chan_def));
+ queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
+ }
+-EXPORT_SYMBOL(cfg80211_radar_event);
++EXPORT_SYMBOL(__cfg80211_radar_event);
+
+ void cfg80211_cac_event(struct net_device *netdev,
+ const struct cfg80211_chan_def *chandef,
+@@ -998,7 +1001,8 @@ __cfg80211_offchan_cac_event(struct cfg8
+ rdev->offchan_radar_wdev = NULL;
+ break;
+ case NL80211_RADAR_CAC_ABORTED:
+- cancel_delayed_work(&rdev->offchan_cac_done_wk);
++ if (!cancel_delayed_work(&rdev->offchan_cac_done_wk))
++ return;
+ wdev = rdev->offchan_radar_wdev;
+ rdev->offchan_radar_wdev = NULL;
+ break;
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -3022,18 +3022,21 @@ TRACE_EVENT(cfg80211_ch_switch_started_n
+ );
+
+ TRACE_EVENT(cfg80211_radar_event,
+- TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
+- TP_ARGS(wiphy, chandef),
++ TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef,
++ bool offchan),
++ TP_ARGS(wiphy, chandef, offchan),
+ TP_STRUCT__entry(
+ WIPHY_ENTRY
+ CHAN_DEF_ENTRY
++ __field(bool, offchan)
+ ),
+ TP_fast_assign(
+ WIPHY_ASSIGN;
+ CHAN_DEF_ASSIGN(chandef);
++ __entry->offchan = offchan;
+ ),
+- TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
+- WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
++ TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT ", offchan %d",
++ WIPHY_PR_ARG, CHAN_DEF_PR_ARG, __entry->offchan)
+ );
+
+ TRACE_EVENT(cfg80211_cac_event,
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/318-cfg80211-allow-continuous-radar-monitoring-on-offcha.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/318-cfg80211-allow-continuous-radar-monitoring-on-offcha.patch
new file mode 100644
index 0000000..ae97947
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/318-cfg80211-allow-continuous-radar-monitoring-on-offcha.patch
@@ -0,0 +1,220 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 16 Nov 2021 15:03:36 +0100
+Subject: [PATCH] cfg80211: allow continuous radar monitoring on offchannel
+ chain
+
+Allow continuous radar detection on the offchannel chain in order
+to switch to the monitored channel whenever the underlying driver
+reports a radar pattern on the main channel.
+
+Tested-by: Owen Peng <owen.peng@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/d46217310a49b14ff0e9c002f0a6e0547d70fd2c.1637071350.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/chan.c
++++ b/net/wireless/chan.c
+@@ -712,6 +712,19 @@ static bool cfg80211_is_wiphy_oper_chan(
+ return false;
+ }
+
++static bool
++cfg80211_offchan_chain_is_active(struct cfg80211_registered_device *rdev,
++ struct ieee80211_channel *channel)
++{
++ if (!rdev->offchan_radar_wdev)
++ return false;
++
++ if (!cfg80211_chandef_valid(&rdev->offchan_radar_chandef))
++ return false;
++
++ return cfg80211_is_sub_chan(&rdev->offchan_radar_chandef, channel);
++}
++
+ bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
+ struct ieee80211_channel *chan)
+ {
+@@ -728,6 +741,9 @@ bool cfg80211_any_wiphy_oper_chan(struct
+
+ if (cfg80211_is_wiphy_oper_chan(&rdev->wiphy, chan))
+ return true;
++
++ if (cfg80211_offchan_chain_is_active(rdev, chan))
++ return true;
+ }
+
+ return false;
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -988,7 +988,7 @@ __cfg80211_offchan_cac_event(struct cfg8
+ if (!cfg80211_chandef_valid(chandef))
+ return;
+
+- if (event != NL80211_RADAR_CAC_STARTED && !rdev->offchan_radar_wdev)
++ if (!rdev->offchan_radar_wdev)
+ return;
+
+ switch (event) {
+@@ -998,17 +998,13 @@ __cfg80211_offchan_cac_event(struct cfg8
+ queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
+ cfg80211_sched_dfs_chan_update(rdev);
+ wdev = rdev->offchan_radar_wdev;
+- rdev->offchan_radar_wdev = NULL;
+ break;
+ case NL80211_RADAR_CAC_ABORTED:
+ if (!cancel_delayed_work(&rdev->offchan_cac_done_wk))
+ return;
+ wdev = rdev->offchan_radar_wdev;
+- rdev->offchan_radar_wdev = NULL;
+ break;
+ case NL80211_RADAR_CAC_STARTED:
+- WARN_ON(!wdev);
+- rdev->offchan_radar_wdev = wdev;
+ break;
+ default:
+ return;
+@@ -1024,7 +1020,8 @@ cfg80211_offchan_cac_event(struct cfg802
+ enum nl80211_radar_event event)
+ {
+ wiphy_lock(&rdev->wiphy);
+- __cfg80211_offchan_cac_event(rdev, NULL, chandef, event);
++ __cfg80211_offchan_cac_event(rdev, rdev->offchan_radar_wdev,
++ chandef, event);
+ wiphy_unlock(&rdev->wiphy);
+ }
+
+@@ -1071,7 +1068,13 @@ cfg80211_start_offchan_radar_detection(s
+ NL80211_EXT_FEATURE_RADAR_OFFCHAN))
+ return -EOPNOTSUPP;
+
+- if (rdev->offchan_radar_wdev)
++ /* Offchannel chain already locked by another wdev */
++ if (rdev->offchan_radar_wdev && rdev->offchan_radar_wdev != wdev)
++ return -EBUSY;
++
++ /* CAC already in progress on the offchannel chain */
++ if (rdev->offchan_radar_wdev == wdev &&
++ delayed_work_pending(&rdev->offchan_cac_done_wk))
+ return -EBUSY;
+
+ err = rdev_set_radar_offchan(rdev, chandef);
+@@ -1083,6 +1086,8 @@ cfg80211_start_offchan_radar_detection(s
+ cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
+
+ rdev->offchan_radar_chandef = *chandef;
++ rdev->offchan_radar_wdev = wdev; /* Get offchain ownership */
++
+ __cfg80211_offchan_cac_event(rdev, wdev, chandef,
+ NL80211_RADAR_CAC_STARTED);
+ queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_done_wk,
+@@ -1102,6 +1107,7 @@ void cfg80211_stop_offchan_radar_detecti
+ return;
+
+ rdev_set_radar_offchan(rdev, NULL);
++ rdev->offchan_radar_wdev = NULL; /* Release offchain ownership */
+
+ __cfg80211_offchan_cac_event(rdev, wdev, &rdev->offchan_radar_chandef,
+ NL80211_RADAR_CAC_ABORTED);
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -9260,42 +9260,60 @@ static int nl80211_start_radar_detection
+ struct cfg80211_chan_def chandef;
+ enum nl80211_dfs_regions dfs_region;
+ unsigned int cac_time_ms;
+- int err;
++ int err = -EINVAL;
++
++ flush_delayed_work(&rdev->dfs_update_channels_wk);
++
++ wiphy_lock(wiphy);
+
+ dfs_region = reg_get_dfs_region(wiphy);
+ if (dfs_region == NL80211_DFS_UNSET)
+- return -EINVAL;
++ goto unlock;
+
+ err = nl80211_parse_chandef(rdev, info, &chandef);
+ if (err)
+- return err;
++ goto unlock;
+
+ err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
+ if (err < 0)
+- return err;
++ goto unlock;
+
+- if (err == 0)
+- return -EINVAL;
++ if (err == 0) {
++ err = -EINVAL;
++ goto unlock;
++ }
+
+- if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
+- return -EINVAL;
++ if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) {
++ err = -EINVAL;
++ goto unlock;
++ }
+
+- if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_OFFCHAN]))
+- return cfg80211_start_offchan_radar_detection(rdev, wdev,
+- &chandef);
++ if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_OFFCHAN])) {
++ err = cfg80211_start_offchan_radar_detection(rdev, wdev,
++ &chandef);
++ goto unlock;
++ }
+
+- if (netif_carrier_ok(dev))
+- return -EBUSY;
++ if (netif_carrier_ok(dev)) {
++ err = -EBUSY;
++ goto unlock;
++ }
+
+- if (wdev->cac_started)
+- return -EBUSY;
++ if (wdev->cac_started) {
++ err = -EBUSY;
++ goto unlock;
++ }
+
+ /* CAC start is offloaded to HW and can't be started manually */
+- if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
+- return -EOPNOTSUPP;
++ if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) {
++ err = -EOPNOTSUPP;
++ goto unlock;
++ }
+
+- if (!rdev->ops->start_radar_detection)
+- return -EOPNOTSUPP;
++ if (!rdev->ops->start_radar_detection) {
++ err = -EOPNOTSUPP;
++ goto unlock;
++ }
+
+ cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
+ if (WARN_ON(!cac_time_ms))
+@@ -9308,6 +9326,9 @@ static int nl80211_start_radar_detection
+ wdev->cac_start_time = jiffies;
+ wdev->cac_time_ms = cac_time_ms;
+ }
++unlock:
++ wiphy_unlock(wiphy);
++
+ return err;
+ }
+
+@@ -15926,7 +15947,8 @@ static const struct genl_small_ops nl802
+ .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .doit = nl80211_start_radar_detection,
+ .flags = GENL_UNS_ADMIN_PERM,
+- .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
++ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
++ NL80211_FLAG_NO_WIPHY_MTX,
+ },
+ {
+ .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/319-mac80211-introduce-set_radar_offchan-callback.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/319-mac80211-introduce-set_radar_offchan-callback.patch
new file mode 100644
index 0000000..eb80afb
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/319-mac80211-introduce-set_radar_offchan-callback.patch
@@ -0,0 +1,67 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 23 Oct 2021 11:10:51 +0200
+Subject: [PATCH] mac80211: introduce set_radar_offchan callback
+
+Similar to cfg80211, introduce set_radar_offchan callback in mac80211_ops
+in order to configure a dedicated offchannel chain available on some hw
+(e.g. mt7915) to perform offchannel CAC detection and avoid tx/rx downtime.
+
+Tested-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/201110606d4f3a7dfdf31440e351f2e2c375d4f0.1634979655.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -3937,6 +3937,14 @@ struct ieee80211_prep_tx_info {
+ * twt structure.
+ * @twt_teardown_request: Update the hw with TWT teardown request received
+ * from the peer.
++ * @set_radar_offchan: Configure dedicated offchannel chain available for
++ * radar/CAC detection on some hw. This chain can't be used to transmit
++ * or receive frames and it is bounded to a running wdev.
++ * Offchannel radar/CAC detection allows to avoid the CAC downtime
++ * switching to a different channel during CAC detection on the selected
++ * radar channel.
++ * The caller is expected to set chandef pointer to NULL in order to
++ * disable offchannel CAC/radar detection.
+ * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
+ * resolve a path for hardware flow offloading
+ */
+@@ -4267,6 +4275,8 @@ struct ieee80211_ops {
+ struct ieee80211_twt_setup *twt);
+ void (*twt_teardown_request)(struct ieee80211_hw *hw,
+ struct ieee80211_sta *sta, u8 flowid);
++ int (*set_radar_offchan)(struct ieee80211_hw *hw,
++ struct cfg80211_chan_def *chandef);
+ #if LINUX_VERSION_IS_GEQ(5,10,0)
+ int (*net_fill_forward_path)(struct ieee80211_hw *hw,
+ struct ieee80211_vif *vif,
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4344,6 +4344,18 @@ out:
+ return err;
+ }
+
++static int
++ieee80211_set_radar_offchan(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef)
++{
++ struct ieee80211_local *local = wiphy_priv(wiphy);
++
++ if (!local->ops->set_radar_offchan)
++ return -EOPNOTSUPP;
++
++ return local->ops->set_radar_offchan(&local->hw, chandef);
++}
++
+ const struct cfg80211_ops mac80211_config_ops = {
+ .add_virtual_intf = ieee80211_add_iface,
+ .del_virtual_intf = ieee80211_del_iface,
+@@ -4448,4 +4460,5 @@ const struct cfg80211_ops mac80211_confi
+ .reset_tid_config = ieee80211_reset_tid_config,
+ .set_sar_specs = ieee80211_set_sar_specs,
+ .color_change = ieee80211_color_change,
++ .set_radar_offchan = ieee80211_set_radar_offchan,
+ };
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/320-cfg80211-rename-offchannel_chain-structs-to-backgrou.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/320-cfg80211-rename-offchannel_chain-structs-to-backgrou.patch
new file mode 100644
index 0000000..a73e81b
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/320-cfg80211-rename-offchannel_chain-structs-to-backgrou.patch
@@ -0,0 +1,532 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 29 Nov 2021 14:11:24 +0100
+Subject: [PATCH] cfg80211: rename offchannel_chain structs to background_chain
+ to avoid confusion with ETSI standard
+
+ETSI standard defines "Offchannel CAC" as:
+"Off-Channel CAC is performed by a number of non-continuous checks
+spread over a period in time. This period, which is required to
+determine the presence of radar signals, is defined as the Off-Channel
+CAC Time..
+Minimum Off-Channel CAC Time 6 minutes and Maximum Off-Channel CAC Time
+4 hours..".
+mac80211 implementation refers to a dedicated hw chain used for continuous
+radar monitoring. Rename offchannel_* references to background_* in
+order to avoid confusion with ETSI standard.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/4204cc1d648d76b44557981713231e030a3bd991.1638190762.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4058,14 +4058,14 @@ struct mgmt_frame_regs {
+ *
+ * @color_change: Initiate a color change.
+ *
+- * @set_radar_offchan: Configure dedicated offchannel chain available for
++ * @set_radar_background: Configure dedicated offchannel chain available for
+ * radar/CAC detection on some hw. This chain can't be used to transmit
+ * or receive frames and it is bounded to a running wdev.
+- * Offchannel radar/CAC detection allows to avoid the CAC downtime
++ * Background radar/CAC detection allows to avoid the CAC downtime
+ * switching to a different channel during CAC detection on the selected
+ * radar channel.
+ * The caller is expected to set chandef pointer to NULL in order to
+- * disable offchannel CAC/radar detection.
++ * disable background CAC/radar detection.
+ */
+ struct cfg80211_ops {
+ int (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
+@@ -4396,8 +4396,8 @@ struct cfg80211_ops {
+ int (*color_change)(struct wiphy *wiphy,
+ struct net_device *dev,
+ struct cfg80211_color_change_settings *params);
+- int (*set_radar_offchan)(struct wiphy *wiphy,
+- struct cfg80211_chan_def *chandef);
++ int (*set_radar_background)(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef);
+ };
+
+ /*
+@@ -7601,9 +7601,9 @@ cfg80211_radar_event(struct wiphy *wiphy
+ }
+
+ static inline void
+-cfg80211_offchan_radar_event(struct wiphy *wiphy,
+- struct cfg80211_chan_def *chandef,
+- gfp_t gfp)
++cfg80211_background_radar_event(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef,
++ gfp_t gfp)
+ {
+ __cfg80211_radar_event(wiphy, chandef, true, gfp);
+ }
+@@ -7638,13 +7638,13 @@ void cfg80211_cac_event(struct net_devic
+ enum nl80211_radar_event event, gfp_t gfp);
+
+ /**
+- * cfg80211_offchan_cac_abort - Channel Availability Check offchan abort event
++ * cfg80211_background_cac_abort - Channel Availability Check offchan abort event
+ * @wiphy: the wiphy
+ *
+ * This function is called by the driver when a Channel Availability Check
+ * (CAC) is aborted by a offchannel dedicated chain.
+ */
+-void cfg80211_offchan_cac_abort(struct wiphy *wiphy);
++void cfg80211_background_cac_abort(struct wiphy *wiphy);
+
+ /**
+ * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -3937,14 +3937,14 @@ struct ieee80211_prep_tx_info {
+ * twt structure.
+ * @twt_teardown_request: Update the hw with TWT teardown request received
+ * from the peer.
+- * @set_radar_offchan: Configure dedicated offchannel chain available for
++ * @set_radar_background: Configure dedicated offchannel chain available for
+ * radar/CAC detection on some hw. This chain can't be used to transmit
+ * or receive frames and it is bounded to a running wdev.
+- * Offchannel radar/CAC detection allows to avoid the CAC downtime
++ * Background radar/CAC detection allows to avoid the CAC downtime
+ * switching to a different channel during CAC detection on the selected
+ * radar channel.
+ * The caller is expected to set chandef pointer to NULL in order to
+- * disable offchannel CAC/radar detection.
++ * disable background CAC/radar detection.
+ * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
+ * resolve a path for hardware flow offloading
+ */
+@@ -4275,8 +4275,8 @@ struct ieee80211_ops {
+ struct ieee80211_twt_setup *twt);
+ void (*twt_teardown_request)(struct ieee80211_hw *hw,
+ struct ieee80211_sta *sta, u8 flowid);
+- int (*set_radar_offchan)(struct ieee80211_hw *hw,
+- struct cfg80211_chan_def *chandef);
++ int (*set_radar_background)(struct ieee80211_hw *hw,
++ struct cfg80211_chan_def *chandef);
+ #if LINUX_VERSION_IS_GEQ(5,10,0)
+ int (*net_fill_forward_path)(struct ieee80211_hw *hw,
+ struct ieee80211_vif *vif,
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -2608,10 +2608,10 @@ enum nl80211_commands {
+ * Mandatory parameter for the transmitting interface to enable MBSSID.
+ * Optional for the non-transmitting interfaces.
+ *
+- * @NL80211_ATTR_RADAR_OFFCHAN: Configure dedicated offchannel chain available for
+- * radar/CAC detection on some hw. This chain can't be used to transmit
+- * or receive frames and it is bounded to a running wdev.
+- * Offchannel radar/CAC detection allows to avoid the CAC downtime
++ * @NL80211_ATTR_RADAR_BACKGROUND: Configure dedicated offchannel chain
++ * available for radar/CAC detection on some hw. This chain can't be used
++ * to transmit or receive frames and it is bounded to a running wdev.
++ * Background radar/CAC detection allows to avoid the CAC downtime
+ * switching on a different channel during CAC detection on the selected
+ * radar channel.
+ *
+@@ -3121,7 +3121,7 @@ enum nl80211_attrs {
+ NL80211_ATTR_MBSSID_CONFIG,
+ NL80211_ATTR_MBSSID_ELEMS,
+
+- NL80211_ATTR_RADAR_OFFCHAN,
++ NL80211_ATTR_RADAR_BACKGROUND,
+
+ /* add attributes here, update the policy in nl80211.c */
+
+@@ -6022,7 +6022,7 @@ enum nl80211_feature_flags {
+ * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
+ * detection and change announcemnts.
+ *
+- * @NL80211_EXT_FEATURE_RADAR_OFFCHAN: Device supports offchannel radar/CAC
++ * @NL80211_EXT_FEATURE_RADAR_BACKGROUND: Device supports background radar/CAC
+ * detection.
+ *
+ * @NUM_NL80211_EXT_FEATURES: number of extended features.
+@@ -6090,7 +6090,7 @@ enum nl80211_ext_feature_index {
+ NL80211_EXT_FEATURE_SECURE_RTT,
+ NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
+ NL80211_EXT_FEATURE_BSS_COLOR,
+- NL80211_EXT_FEATURE_RADAR_OFFCHAN,
++ NL80211_EXT_FEATURE_RADAR_BACKGROUND,
+
+ /* add new features before the definition below */
+ NUM_NL80211_EXT_FEATURES,
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4345,15 +4345,15 @@ out:
+ }
+
+ static int
+-ieee80211_set_radar_offchan(struct wiphy *wiphy,
+- struct cfg80211_chan_def *chandef)
++ieee80211_set_radar_background(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef)
+ {
+ struct ieee80211_local *local = wiphy_priv(wiphy);
+
+- if (!local->ops->set_radar_offchan)
++ if (!local->ops->set_radar_background)
+ return -EOPNOTSUPP;
+
+- return local->ops->set_radar_offchan(&local->hw, chandef);
++ return local->ops->set_radar_background(&local->hw, chandef);
+ }
+
+ const struct cfg80211_ops mac80211_config_ops = {
+@@ -4460,5 +4460,5 @@ const struct cfg80211_ops mac80211_confi
+ .reset_tid_config = ieee80211_reset_tid_config,
+ .set_sar_specs = ieee80211_set_sar_specs,
+ .color_change = ieee80211_color_change,
+- .set_radar_offchan = ieee80211_set_radar_offchan,
++ .set_radar_background = ieee80211_set_radar_background,
+ };
+--- a/net/wireless/chan.c
++++ b/net/wireless/chan.c
+@@ -716,13 +716,13 @@ static bool
+ cfg80211_offchan_chain_is_active(struct cfg80211_registered_device *rdev,
+ struct ieee80211_channel *channel)
+ {
+- if (!rdev->offchan_radar_wdev)
++ if (!rdev->background_radar_wdev)
+ return false;
+
+- if (!cfg80211_chandef_valid(&rdev->offchan_radar_chandef))
++ if (!cfg80211_chandef_valid(&rdev->background_radar_chandef))
+ return false;
+
+- return cfg80211_is_sub_chan(&rdev->offchan_radar_chandef, channel);
++ return cfg80211_is_sub_chan(&rdev->background_radar_chandef, channel);
+ }
+
+ bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -552,9 +552,10 @@ use_default_name:
+ INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work);
+ INIT_WORK(&rdev->conn_work, cfg80211_conn_work);
+ INIT_WORK(&rdev->event_work, cfg80211_event_work);
+- INIT_WORK(&rdev->offchan_cac_abort_wk, cfg80211_offchan_cac_abort_wk);
+- INIT_DELAYED_WORK(&rdev->offchan_cac_done_wk,
+- cfg80211_offchan_cac_done_wk);
++ INIT_WORK(&rdev->background_cac_abort_wk,
++ cfg80211_background_cac_abort_wk);
++ INIT_DELAYED_WORK(&rdev->background_cac_done_wk,
++ cfg80211_background_cac_done_wk);
+
+ init_waitqueue_head(&rdev->dev_wait);
+
+@@ -1064,13 +1065,13 @@ void wiphy_unregister(struct wiphy *wiph
+ cancel_work_sync(&rdev->conn_work);
+ flush_work(&rdev->event_work);
+ cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
+- cancel_delayed_work_sync(&rdev->offchan_cac_done_wk);
++ cancel_delayed_work_sync(&rdev->background_cac_done_wk);
+ flush_work(&rdev->destroy_work);
+ flush_work(&rdev->sched_scan_stop_wk);
+ flush_work(&rdev->propagate_radar_detect_wk);
+ flush_work(&rdev->propagate_cac_done_wk);
+ flush_work(&rdev->mgmt_registrations_update_wk);
+- flush_work(&rdev->offchan_cac_abort_wk);
++ flush_work(&rdev->background_cac_abort_wk);
+
+ #ifdef CONFIG_PM
+ if (rdev->wiphy.wowlan_config && rdev->ops->set_wakeup)
+@@ -1219,7 +1220,7 @@ void __cfg80211_leave(struct cfg80211_re
+
+ cfg80211_pmsr_wdev_down(wdev);
+
+- cfg80211_stop_offchan_radar_detection(wdev);
++ cfg80211_stop_background_radar_detection(wdev);
+
+ switch (wdev->iftype) {
+ case NL80211_IFTYPE_ADHOC:
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -84,10 +84,10 @@ struct cfg80211_registered_device {
+
+ struct delayed_work dfs_update_channels_wk;
+
+- struct wireless_dev *offchan_radar_wdev;
+- struct cfg80211_chan_def offchan_radar_chandef;
+- struct delayed_work offchan_cac_done_wk;
+- struct work_struct offchan_cac_abort_wk;
++ struct wireless_dev *background_radar_wdev;
++ struct cfg80211_chan_def background_radar_chandef;
++ struct delayed_work background_cac_done_wk;
++ struct work_struct background_cac_abort_wk;
+
+ /* netlink port which started critical protocol (0 means not started) */
+ u32 crit_proto_nlportid;
+@@ -497,15 +497,15 @@ cfg80211_chandef_dfs_cac_time(struct wip
+ void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev);
+
+ int
+-cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
+- struct wireless_dev *wdev,
+- struct cfg80211_chan_def *chandef);
++cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rdev,
++ struct wireless_dev *wdev,
++ struct cfg80211_chan_def *chandef);
+
+-void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev);
++void cfg80211_stop_background_radar_detection(struct wireless_dev *wdev);
+
+-void cfg80211_offchan_cac_done_wk(struct work_struct *work);
++void cfg80211_background_cac_done_wk(struct work_struct *work);
+
+-void cfg80211_offchan_cac_abort_wk(struct work_struct *work);
++void cfg80211_background_cac_abort_wk(struct work_struct *work);
+
+ bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
+ struct ieee80211_channel *chan);
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -920,7 +920,7 @@ void __cfg80211_radar_event(struct wiphy
+ cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
+
+ if (offchan)
+- queue_work(cfg80211_wq, &rdev->offchan_cac_abort_wk);
++ queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
+
+ cfg80211_sched_dfs_chan_update(rdev);
+
+@@ -975,10 +975,10 @@ void cfg80211_cac_event(struct net_devic
+ EXPORT_SYMBOL(cfg80211_cac_event);
+
+ static void
+-__cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
+- struct wireless_dev *wdev,
+- const struct cfg80211_chan_def *chandef,
+- enum nl80211_radar_event event)
++__cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
++ struct wireless_dev *wdev,
++ const struct cfg80211_chan_def *chandef,
++ enum nl80211_radar_event event)
+ {
+ struct wiphy *wiphy = &rdev->wiphy;
+ struct net_device *netdev;
+@@ -988,7 +988,7 @@ __cfg80211_offchan_cac_event(struct cfg8
+ if (!cfg80211_chandef_valid(chandef))
+ return;
+
+- if (!rdev->offchan_radar_wdev)
++ if (!rdev->background_radar_wdev)
+ return;
+
+ switch (event) {
+@@ -997,12 +997,12 @@ __cfg80211_offchan_cac_event(struct cfg8
+ memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef));
+ queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
+ cfg80211_sched_dfs_chan_update(rdev);
+- wdev = rdev->offchan_radar_wdev;
++ wdev = rdev->background_radar_wdev;
+ break;
+ case NL80211_RADAR_CAC_ABORTED:
+- if (!cancel_delayed_work(&rdev->offchan_cac_done_wk))
++ if (!cancel_delayed_work(&rdev->background_cac_done_wk))
+ return;
+- wdev = rdev->offchan_radar_wdev;
++ wdev = rdev->background_radar_wdev;
+ break;
+ case NL80211_RADAR_CAC_STARTED:
+ break;
+@@ -1015,49 +1015,49 @@ __cfg80211_offchan_cac_event(struct cfg8
+ }
+
+ static void
+-cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
+- const struct cfg80211_chan_def *chandef,
+- enum nl80211_radar_event event)
++cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
++ const struct cfg80211_chan_def *chandef,
++ enum nl80211_radar_event event)
+ {
+ wiphy_lock(&rdev->wiphy);
+- __cfg80211_offchan_cac_event(rdev, rdev->offchan_radar_wdev,
+- chandef, event);
++ __cfg80211_background_cac_event(rdev, rdev->background_radar_wdev,
++ chandef, event);
+ wiphy_unlock(&rdev->wiphy);
+ }
+
+-void cfg80211_offchan_cac_done_wk(struct work_struct *work)
++void cfg80211_background_cac_done_wk(struct work_struct *work)
+ {
+ struct delayed_work *delayed_work = to_delayed_work(work);
+ struct cfg80211_registered_device *rdev;
+
+ rdev = container_of(delayed_work, struct cfg80211_registered_device,
+- offchan_cac_done_wk);
+- cfg80211_offchan_cac_event(rdev, &rdev->offchan_radar_chandef,
+- NL80211_RADAR_CAC_FINISHED);
++ background_cac_done_wk);
++ cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
++ NL80211_RADAR_CAC_FINISHED);
+ }
+
+-void cfg80211_offchan_cac_abort_wk(struct work_struct *work)
++void cfg80211_background_cac_abort_wk(struct work_struct *work)
+ {
+ struct cfg80211_registered_device *rdev;
+
+ rdev = container_of(work, struct cfg80211_registered_device,
+- offchan_cac_abort_wk);
+- cfg80211_offchan_cac_event(rdev, &rdev->offchan_radar_chandef,
+- NL80211_RADAR_CAC_ABORTED);
++ background_cac_abort_wk);
++ cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
++ NL80211_RADAR_CAC_ABORTED);
+ }
+
+-void cfg80211_offchan_cac_abort(struct wiphy *wiphy)
++void cfg80211_background_cac_abort(struct wiphy *wiphy)
+ {
+ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+
+- queue_work(cfg80211_wq, &rdev->offchan_cac_abort_wk);
++ queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
+ }
+-EXPORT_SYMBOL(cfg80211_offchan_cac_abort);
++EXPORT_SYMBOL(cfg80211_background_cac_abort);
+
+ int
+-cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
+- struct wireless_dev *wdev,
+- struct cfg80211_chan_def *chandef)
++cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rdev,
++ struct wireless_dev *wdev,
++ struct cfg80211_chan_def *chandef)
+ {
+ unsigned int cac_time_ms;
+ int err;
+@@ -1065,19 +1065,19 @@ cfg80211_start_offchan_radar_detection(s
+ lockdep_assert_wiphy(&rdev->wiphy);
+
+ if (!wiphy_ext_feature_isset(&rdev->wiphy,
+- NL80211_EXT_FEATURE_RADAR_OFFCHAN))
++ NL80211_EXT_FEATURE_RADAR_BACKGROUND))
+ return -EOPNOTSUPP;
+
+ /* Offchannel chain already locked by another wdev */
+- if (rdev->offchan_radar_wdev && rdev->offchan_radar_wdev != wdev)
++ if (rdev->background_radar_wdev && rdev->background_radar_wdev != wdev)
+ return -EBUSY;
+
+ /* CAC already in progress on the offchannel chain */
+- if (rdev->offchan_radar_wdev == wdev &&
+- delayed_work_pending(&rdev->offchan_cac_done_wk))
++ if (rdev->background_radar_wdev == wdev &&
++ delayed_work_pending(&rdev->background_cac_done_wk))
+ return -EBUSY;
+
+- err = rdev_set_radar_offchan(rdev, chandef);
++ err = rdev_set_radar_background(rdev, chandef);
+ if (err)
+ return err;
+
+@@ -1085,30 +1085,31 @@ cfg80211_start_offchan_radar_detection(s
+ if (!cac_time_ms)
+ cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
+
+- rdev->offchan_radar_chandef = *chandef;
+- rdev->offchan_radar_wdev = wdev; /* Get offchain ownership */
++ rdev->background_radar_chandef = *chandef;
++ rdev->background_radar_wdev = wdev; /* Get offchain ownership */
+
+- __cfg80211_offchan_cac_event(rdev, wdev, chandef,
+- NL80211_RADAR_CAC_STARTED);
+- queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_done_wk,
++ __cfg80211_background_cac_event(rdev, wdev, chandef,
++ NL80211_RADAR_CAC_STARTED);
++ queue_delayed_work(cfg80211_wq, &rdev->background_cac_done_wk,
+ msecs_to_jiffies(cac_time_ms));
+
+ return 0;
+ }
+
+-void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev)
++void cfg80211_stop_background_radar_detection(struct wireless_dev *wdev)
+ {
+ struct wiphy *wiphy = wdev->wiphy;
+ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+
+ lockdep_assert_wiphy(wiphy);
+
+- if (wdev != rdev->offchan_radar_wdev)
++ if (wdev != rdev->background_radar_wdev)
+ return;
+
+- rdev_set_radar_offchan(rdev, NULL);
+- rdev->offchan_radar_wdev = NULL; /* Release offchain ownership */
++ rdev_set_radar_background(rdev, NULL);
++ rdev->background_radar_wdev = NULL; /* Release offchain ownership */
+
+- __cfg80211_offchan_cac_event(rdev, wdev, &rdev->offchan_radar_chandef,
+- NL80211_RADAR_CAC_ABORTED);
++ __cfg80211_background_cac_event(rdev, wdev,
++ &rdev->background_radar_chandef,
++ NL80211_RADAR_CAC_ABORTED);
+ }
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -793,7 +793,7 @@ static const struct nla_policy nl80211_p
+ [NL80211_ATTR_MBSSID_CONFIG] =
+ NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
+ [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
+- [NL80211_ATTR_RADAR_OFFCHAN] = { .type = NLA_FLAG },
++ [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
+ };
+
+ /* policy for the key attributes */
+@@ -9288,9 +9288,9 @@ static int nl80211_start_radar_detection
+ goto unlock;
+ }
+
+- if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_OFFCHAN])) {
+- err = cfg80211_start_offchan_radar_detection(rdev, wdev,
+- &chandef);
++ if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND])) {
++ err = cfg80211_start_background_radar_detection(rdev, wdev,
++ &chandef);
+ goto unlock;
+ }
+
+--- a/net/wireless/rdev-ops.h
++++ b/net/wireless/rdev-ops.h
+@@ -1382,17 +1382,17 @@ static inline int rdev_color_change(stru
+ }
+
+ static inline int
+-rdev_set_radar_offchan(struct cfg80211_registered_device *rdev,
+- struct cfg80211_chan_def *chandef)
++rdev_set_radar_background(struct cfg80211_registered_device *rdev,
++ struct cfg80211_chan_def *chandef)
+ {
+ struct wiphy *wiphy = &rdev->wiphy;
+ int ret;
+
+- if (!rdev->ops->set_radar_offchan)
++ if (!rdev->ops->set_radar_background)
+ return -EOPNOTSUPP;
+
+- trace_rdev_set_radar_offchan(wiphy, chandef);
+- ret = rdev->ops->set_radar_offchan(wiphy, chandef);
++ trace_rdev_set_radar_background(wiphy, chandef);
++ ret = rdev->ops->set_radar_background(wiphy, chandef);
+ trace_rdev_return_int(wiphy, ret);
+
+ return ret;
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -3646,7 +3646,7 @@ TRACE_EVENT(cfg80211_bss_color_notify,
+ __entry->color_bitmap)
+ );
+
+-TRACE_EVENT(rdev_set_radar_offchan,
++TRACE_EVENT(rdev_set_radar_background,
+ TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
+
+ TP_ARGS(wiphy, chandef),
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/321-mac80211-fix-EAPoL-rekey-fail-in-802.3-rx-path.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/321-mac80211-fix-EAPoL-rekey-fail-in-802.3-rx-path.patch
new file mode 100644
index 0000000..932403d
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/321-mac80211-fix-EAPoL-rekey-fail-in-802.3-rx-path.patch
@@ -0,0 +1,43 @@
+From: Deren Wu <deren.wu@mediatek.com>
+Date: Sun, 13 Feb 2022 00:20:15 +0800
+Subject: [PATCH] mac80211: fix EAPoL rekey fail in 802.3 rx path
+
+mac80211 set capability NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211
+to upper layer by default. That means we should pass EAPoL packets through
+nl80211 path only, and should not send the EAPoL skb to netdevice diretly.
+At the meanwhile, wpa_supplicant would not regist sock to listen EAPoL skb
+on the netdevice.
+
+However, there is no contorl_port_protocol handler in mac80211 for 802.3 RX
+packets, mac80211 driver would pass up the EAPoL rekey frame to netdevice
+and wpa_supplicant would be never interactive with this kind of packets,
+if SUPPORTS_RX_DECAP_OFFLOAD is enabled. This causes STA always rekey fail
+if EAPoL frame go through 802.3 path.
+
+To avoid this problem, align the same process as 802.11 type to handle
+this frame before put it into network stack.
+
+Fixes: 80a915ec4427 ("mac80211: add rx decapsulation offload support")
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4523,16 +4523,7 @@ static void ieee80211_rx_8023(struct iee
+
+ /* deliver to local stack */
+ skb->protocol = eth_type_trans(skb, fast_rx->dev);
+- memset(skb->cb, 0, sizeof(skb->cb));
+- if (rx->list)
+-#if LINUX_VERSION_IS_GEQ(4,19,0)
+- list_add_tail(&skb->list, rx->list);
+-#else
+- __skb_queue_tail(rx->list, skb);
+-#endif
+- else
+- netif_receive_skb(skb);
+-
++ ieee80211_deliver_skb_to_local_stack(skb, rx);
+ }
+
+ static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/322-mac80211-fix-forwarded-mesh-frames-AC-queue-selectio.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/322-mac80211-fix-forwarded-mesh-frames-AC-queue-selectio.patch
new file mode 100644
index 0000000..50693f7
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/322-mac80211-fix-forwarded-mesh-frames-AC-queue-selectio.patch
@@ -0,0 +1,50 @@
+From: Nicolas Escande <nico.escande@gmail.com>
+Date: Mon, 14 Feb 2022 18:32:14 +0100
+Subject: [PATCH] mac80211: fix forwarded mesh frames AC & queue selection
+
+There are two problems with the current code that have been highlighted
+with the AQL feature that is now enbaled by default.
+
+First problem is in ieee80211_rx_h_mesh_fwding(),
+ieee80211_select_queue_80211() is used on received packets to choose
+the sending AC queue of the forwarding packet although this function
+should only be called on TX packet (it uses ieee80211_tx_info).
+This ends with forwarded mesh packets been sent on unrelated random AC
+queue. To fix that, AC queue can directly be infered from skb->priority
+which has been extracted from QOS info (see ieee80211_parse_qos()).
+
+Second problem is the value of queue_mapping set on forwarded mesh
+frames via skb_set_queue_mapping() is not the AC of the packet but a
+hardware queue index. This may or may not work depending on AC to HW
+queue mapping which is driver specific.
+
+Both of these issues lead to improper AC selection while forwarding
+mesh packets but more importantly due to improper airtime accounting
+(which is done on a per STA, per AC basis) caused traffic stall with
+the introduction of AQL.
+
+Fixes: cf44012810cc ("mac80211: fix unnecessary frame drops in mesh fwding")
+Fixes: d3c1597b8d1b ("mac80211: fix forwarded mesh frame queue mapping")
+Co-developed-by: Remi Pommarel <repk@triplefau.lt>
+Signed-off-by: Remi Pommarel <repk@triplefau.lt>
+Signed-off-by: Nicolas Escande <nico.escande@gmail.com>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2921,13 +2921,13 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ ether_addr_equal(sdata->vif.addr, hdr->addr3))
+ return RX_CONTINUE;
+
+- ac = ieee80211_select_queue_80211(sdata, skb, hdr);
++ ac = ieee802_1d_to_ac[skb->priority];
+ q = sdata->vif.hw_queue[ac];
+ if (ieee80211_queue_stopped(&local->hw, q)) {
+ IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
+ return RX_DROP_MONITOR;
+ }
+- skb_set_queue_mapping(skb, q);
++ skb_set_queue_mapping(skb, ac);
+
+ if (!--mesh_hdr->ttl) {
+ if (!is_multicast_ether_addr(hdr->addr1))
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/323-mac80211-MBSSID-support-in-interface-handling.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/323-mac80211-MBSSID-support-in-interface-handling.patch
new file mode 100644
index 0000000..a135e3d
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/323-mac80211-MBSSID-support-in-interface-handling.patch
@@ -0,0 +1,144 @@
+From: John Crispin <john@phrozen.org>
+Date: Wed, 15 Sep 2021 19:54:35 -0700
+Subject: [PATCH] mac80211: MBSSID support in interface handling
+
+Configure multiple BSSID and enhanced multi-BSSID advertisement (EMA)
+parameters in mac80211 for AP mode.
+
+For each interface, 'mbssid_tx_vif' points to the transmitting interface of
+the MBSSID set. The pointer is set to NULL if MBSSID is disabled.
+
+Function ieee80211_stop() is modified to always bring down all the
+non-transmitting interfaces first and the transmitting interface last.
+
+Signed-off-by: John Crispin <john@phrozen.org>
+Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
+Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
+Link: https://lore.kernel.org/r/20210916025437.29138-3-alokad@codeaurora.org
+[slightly change logic to be more obvious]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1719,6 +1719,7 @@ enum ieee80211_offload_flags {
+ * write-protected by sdata_lock and local->mtx so holding either is fine
+ * for read access.
+ * @color_change_color: the bss color that will be used after the change.
++ * @mbssid_tx_vif: Pointer to the transmitting interface if MBSSID is enabled.
+ */
+ struct ieee80211_vif {
+ enum nl80211_iftype type;
+@@ -1750,6 +1751,8 @@ struct ieee80211_vif {
+ bool color_change_active;
+ u8 color_change_color;
+
++ struct ieee80211_vif *mbssid_tx_vif;
++
+ /* must be last */
+ u8 drv_priv[] __aligned(sizeof(void *));
+ };
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -112,6 +112,36 @@ static int ieee80211_set_mon_options(str
+ return 0;
+ }
+
++static int ieee80211_set_ap_mbssid_options(struct ieee80211_sub_if_data *sdata,
++ struct cfg80211_mbssid_config params)
++{
++ struct ieee80211_sub_if_data *tx_sdata;
++
++ sdata->vif.mbssid_tx_vif = NULL;
++ sdata->vif.bss_conf.bssid_index = 0;
++ sdata->vif.bss_conf.nontransmitted = false;
++ sdata->vif.bss_conf.ema_ap = false;
++
++ if (sdata->vif.type != NL80211_IFTYPE_AP || !params.tx_wdev)
++ return -EINVAL;
++
++ tx_sdata = IEEE80211_WDEV_TO_SUB_IF(params.tx_wdev);
++ if (!tx_sdata)
++ return -EINVAL;
++
++ if (tx_sdata == sdata) {
++ sdata->vif.mbssid_tx_vif = &sdata->vif;
++ } else {
++ sdata->vif.mbssid_tx_vif = &tx_sdata->vif;
++ sdata->vif.bss_conf.nontransmitted = true;
++ sdata->vif.bss_conf.bssid_index = params.index;
++ }
++ if (params.ema)
++ sdata->vif.bss_conf.ema_ap = true;
++
++ return 0;
++}
++
+ static struct wireless_dev *ieee80211_add_iface(struct wiphy *wiphy,
+ const char *name,
+ unsigned char name_assign_type,
+@@ -1107,6 +1137,14 @@ static int ieee80211_start_ap(struct wip
+ changed |= BSS_CHANGED_HE_BSS_COLOR;
+ }
+
++ if (sdata->vif.type == NL80211_IFTYPE_AP &&
++ params->mbssid_config.tx_wdev) {
++ err = ieee80211_set_ap_mbssid_options(sdata,
++ params->mbssid_config);
++ if (err)
++ return err;
++ }
++
+ mutex_lock(&local->mtx);
+ err = ieee80211_vif_use_channel(sdata, ¶ms->chandef,
+ IEEE80211_CHANCTX_SHARED);
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -632,17 +632,46 @@ static void ieee80211_do_stop(struct iee
+ ieee80211_add_virtual_monitor(local);
+ }
+
++static void ieee80211_stop_mbssid(struct ieee80211_sub_if_data *sdata)
++{
++ struct ieee80211_sub_if_data *tx_sdata, *non_tx_sdata, *tmp_sdata;
++ struct ieee80211_vif *tx_vif = sdata->vif.mbssid_tx_vif;
++
++ if (!tx_vif)
++ return;
++
++ tx_sdata = vif_to_sdata(tx_vif);
++ sdata->vif.mbssid_tx_vif = NULL;
++
++ list_for_each_entry_safe(non_tx_sdata, tmp_sdata,
++ &tx_sdata->local->interfaces, list) {
++ if (non_tx_sdata != sdata && non_tx_sdata != tx_sdata &&
++ non_tx_sdata->vif.mbssid_tx_vif == tx_vif &&
++ ieee80211_sdata_running(non_tx_sdata)) {
++ non_tx_sdata->vif.mbssid_tx_vif = NULL;
++ dev_close(non_tx_sdata->wdev.netdev);
++ }
++ }
++
++ if (sdata != tx_sdata && ieee80211_sdata_running(tx_sdata)) {
++ tx_sdata->vif.mbssid_tx_vif = NULL;
++ dev_close(tx_sdata->wdev.netdev);
++ }
++}
++
+ static int ieee80211_stop(struct net_device *dev)
+ {
+ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+- /* close all dependent VLAN interfaces before locking wiphy */
++ /* close dependent VLAN and MBSSID interfaces before locking wiphy */
+ if (sdata->vif.type == NL80211_IFTYPE_AP) {
+ struct ieee80211_sub_if_data *vlan, *tmpsdata;
+
+ list_for_each_entry_safe(vlan, tmpsdata, &sdata->u.ap.vlans,
+ u.vlan.list)
+ dev_close(vlan->dev);
++
++ ieee80211_stop_mbssid(sdata);
+ }
+
+ wiphy_lock(sdata->local->hw.wiphy);
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/324-mac80211-MBSSID-beacon-handling-in-AP-mode.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/324-mac80211-MBSSID-beacon-handling-in-AP-mode.patch
new file mode 100644
index 0000000..c76f4ae
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/324-mac80211-MBSSID-beacon-handling-in-AP-mode.patch
@@ -0,0 +1,326 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 24 Feb 2022 12:54:58 +0100
+Subject: [PATCH] mac80211: MBSSID beacon handling in AP mode
+
+Add new fields in struct beacon_data to store all MBSSID elements.
+Generate a beacon template which includes all MBSSID elements.
+Move CSA offset to reflect the MBSSID element length.
+
+Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
+Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
+Co-developed-by: John Crispin <john@phrozen.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Tested-by: Money Wang <money.wang@mediatek.com>
+Link: https://lore.kernel.org/r/5322db3c303f431adaf191ab31c45e151dde5465.1645702516.git.lorenzo@kernel.org
+[small cleanups]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -4938,12 +4938,14 @@ void ieee80211_report_low_ack(struct iee
+ * @cntdwn_counter_offs: array of IEEE80211_MAX_CNTDWN_COUNTERS_NUM offsets
+ * to countdown counters. This array can contain zero values which
+ * should be ignored.
++ * @mbssid_off: position of the multiple bssid element
+ */
+ struct ieee80211_mutable_offsets {
+ u16 tim_offset;
+ u16 tim_length;
+
+ u16 cntdwn_counter_offs[IEEE80211_MAX_CNTDWN_COUNTERS_NUM];
++ u16 mbssid_off;
+ };
+
+ /**
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -989,11 +989,29 @@ static int ieee80211_set_ftm_responder_p
+ return 0;
+ }
+
++static int
++ieee80211_copy_mbssid_beacon(u8 *pos, struct cfg80211_mbssid_elems *dst,
++ struct cfg80211_mbssid_elems *src)
++{
++ int i, offset = 0;
++
++ for (i = 0; i < src->cnt; i++) {
++ memcpy(pos + offset, src->elem[i].data, src->elem[i].len);
++ dst->elem[i].len = src->elem[i].len;
++ dst->elem[i].data = pos + offset;
++ offset += dst->elem[i].len;
++ }
++ dst->cnt = src->cnt;
++
++ return offset;
++}
++
+ static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
+ struct cfg80211_beacon_data *params,
+ const struct ieee80211_csa_settings *csa,
+ const struct ieee80211_color_change_settings *cca)
+ {
++ struct cfg80211_mbssid_elems *mbssid = NULL;
+ struct beacon_data *new, *old;
+ int new_head_len, new_tail_len;
+ int size, err;
+@@ -1021,6 +1039,17 @@ static int ieee80211_assign_beacon(struc
+
+ size = sizeof(*new) + new_head_len + new_tail_len;
+
++ /* new or old multiple BSSID elements? */
++ if (params->mbssid_ies) {
++ mbssid = params->mbssid_ies;
++ size += struct_size(new->mbssid_ies, elem, mbssid->cnt);
++ size += ieee80211_get_mbssid_beacon_len(mbssid);
++ } else if (old && old->mbssid_ies) {
++ mbssid = old->mbssid_ies;
++ size += struct_size(new->mbssid_ies, elem, mbssid->cnt);
++ size += ieee80211_get_mbssid_beacon_len(mbssid);
++ }
++
+ new = kzalloc(size, GFP_KERNEL);
+ if (!new)
+ return -ENOMEM;
+@@ -1029,12 +1058,20 @@ static int ieee80211_assign_beacon(struc
+
+ /*
+ * pointers go into the block we allocated,
+- * memory is | beacon_data | head | tail |
++ * memory is | beacon_data | head | tail | mbssid_ies
+ */
+ new->head = ((u8 *) new) + sizeof(*new);
+ new->tail = new->head + new_head_len;
+ new->head_len = new_head_len;
+ new->tail_len = new_tail_len;
++ /* copy in optional mbssid_ies */
++ if (mbssid) {
++ u8 *pos = new->tail + new->tail_len;
++
++ new->mbssid_ies = (void *)pos;
++ pos += struct_size(new->mbssid_ies, elem, mbssid->cnt);
++ ieee80211_copy_mbssid_beacon(pos, new->mbssid_ies, mbssid);
++ }
+
+ if (csa) {
+ new->cntdwn_current_counter = csa->count;
+@@ -1329,8 +1366,11 @@ static int ieee80211_stop_ap(struct wiph
+
+ mutex_unlock(&local->mtx);
+
+- kfree(sdata->u.ap.next_beacon);
+- sdata->u.ap.next_beacon = NULL;
++ if (sdata->u.ap.next_beacon) {
++ kfree(sdata->u.ap.next_beacon->mbssid_ies);
++ kfree(sdata->u.ap.next_beacon);
++ sdata->u.ap.next_beacon = NULL;
++ }
+
+ /* turn off carrier for this interface and dependent VLANs */
+ list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+@@ -3126,12 +3166,24 @@ cfg80211_beacon_dup(struct cfg80211_beac
+
+ len = beacon->head_len + beacon->tail_len + beacon->beacon_ies_len +
+ beacon->proberesp_ies_len + beacon->assocresp_ies_len +
+- beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len;
++ beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len +
++ ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies);
+
+ new_beacon = kzalloc(sizeof(*new_beacon) + len, GFP_KERNEL);
+ if (!new_beacon)
+ return NULL;
+
++ if (beacon->mbssid_ies && beacon->mbssid_ies->cnt) {
++ new_beacon->mbssid_ies =
++ kzalloc(struct_size(new_beacon->mbssid_ies,
++ elem, beacon->mbssid_ies->cnt),
++ GFP_KERNEL);
++ if (!new_beacon->mbssid_ies) {
++ kfree(new_beacon);
++ return NULL;
++ }
++ }
++
+ pos = (u8 *)(new_beacon + 1);
+ if (beacon->head_len) {
+ new_beacon->head_len = beacon->head_len;
+@@ -3169,6 +3221,10 @@ cfg80211_beacon_dup(struct cfg80211_beac
+ memcpy(pos, beacon->probe_resp, beacon->probe_resp_len);
+ pos += beacon->probe_resp_len;
+ }
++ if (beacon->mbssid_ies && beacon->mbssid_ies->cnt)
++ pos += ieee80211_copy_mbssid_beacon(pos,
++ new_beacon->mbssid_ies,
++ beacon->mbssid_ies);
+
+ /* might copy -1, meaning no changes requested */
+ new_beacon->ftm_responder = beacon->ftm_responder;
+@@ -3206,8 +3262,11 @@ static int ieee80211_set_after_csa_beaco
+ case NL80211_IFTYPE_AP:
+ err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon,
+ NULL, NULL);
+- kfree(sdata->u.ap.next_beacon);
+- sdata->u.ap.next_beacon = NULL;
++ if (sdata->u.ap.next_beacon) {
++ kfree(sdata->u.ap.next_beacon->mbssid_ies);
++ kfree(sdata->u.ap.next_beacon);
++ sdata->u.ap.next_beacon = NULL;
++ }
+
+ if (err < 0)
+ return err;
+@@ -3362,8 +3421,12 @@ static int ieee80211_set_csa_beacon(stru
+ if ((params->n_counter_offsets_beacon >
+ IEEE80211_MAX_CNTDWN_COUNTERS_NUM) ||
+ (params->n_counter_offsets_presp >
+- IEEE80211_MAX_CNTDWN_COUNTERS_NUM))
++ IEEE80211_MAX_CNTDWN_COUNTERS_NUM)) {
++ kfree(sdata->u.ap.next_beacon->mbssid_ies);
++ kfree(sdata->u.ap.next_beacon);
++ sdata->u.ap.next_beacon = NULL;
+ return -EINVAL;
++ }
+
+ csa.counter_offsets_beacon = params->counter_offsets_beacon;
+ csa.counter_offsets_presp = params->counter_offsets_presp;
+@@ -3373,7 +3436,9 @@ static int ieee80211_set_csa_beacon(stru
+
+ err = ieee80211_assign_beacon(sdata, ¶ms->beacon_csa, &csa, NULL);
+ if (err < 0) {
++ kfree(sdata->u.ap.next_beacon->mbssid_ies);
+ kfree(sdata->u.ap.next_beacon);
++ sdata->u.ap.next_beacon = NULL;
+ return err;
+ }
+ *changed |= err;
+@@ -3463,8 +3528,11 @@ static int ieee80211_set_csa_beacon(stru
+ static void ieee80211_color_change_abort(struct ieee80211_sub_if_data *sdata)
+ {
+ sdata->vif.color_change_active = false;
+- kfree(sdata->u.ap.next_beacon);
+- sdata->u.ap.next_beacon = NULL;
++ if (sdata->u.ap.next_beacon) {
++ kfree(sdata->u.ap.next_beacon->mbssid_ies);
++ kfree(sdata->u.ap.next_beacon);
++ sdata->u.ap.next_beacon = NULL;
++ }
+
+ cfg80211_color_change_aborted_notify(sdata->dev);
+ }
+@@ -4202,8 +4270,11 @@ ieee80211_set_after_color_change_beacon(
+
+ ret = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon,
+ NULL, NULL);
+- kfree(sdata->u.ap.next_beacon);
+- sdata->u.ap.next_beacon = NULL;
++ if (sdata->u.ap.next_beacon) {
++ kfree(sdata->u.ap.next_beacon->mbssid_ies);
++ kfree(sdata->u.ap.next_beacon);
++ sdata->u.ap.next_beacon = NULL;
++ }
+
+ if (ret < 0)
+ return ret;
+@@ -4246,7 +4317,11 @@ ieee80211_set_color_change_beacon(struct
+ err = ieee80211_assign_beacon(sdata, ¶ms->beacon_color_change,
+ NULL, &color_change);
+ if (err < 0) {
+- kfree(sdata->u.ap.next_beacon);
++ if (sdata->u.ap.next_beacon) {
++ kfree(sdata->u.ap.next_beacon->mbssid_ies);
++ kfree(sdata->u.ap.next_beacon);
++ sdata->u.ap.next_beacon = NULL;
++ }
+ return err;
+ }
+ *changed |= err;
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -261,6 +261,7 @@ struct beacon_data {
+ struct ieee80211_meshconf_ie *meshconf;
+ u16 cntdwn_counter_offsets[IEEE80211_MAX_CNTDWN_COUNTERS_NUM];
+ u8 cntdwn_current_counter;
++ struct cfg80211_mbssid_elems *mbssid_ies;
+ struct rcu_head rcu_head;
+ };
+
+@@ -1063,6 +1064,20 @@ ieee80211_vif_get_shift(struct ieee80211
+ return shift;
+ }
+
++static inline int
++ieee80211_get_mbssid_beacon_len(struct cfg80211_mbssid_elems *elems)
++{
++ int i, len = 0;
++
++ if (!elems)
++ return 0;
++
++ for (i = 0; i < elems->cnt; i++)
++ len += elems->elem[i].len;
++
++ return len;
++}
++
+ enum {
+ IEEE80211_RX_MSG = 1,
+ IEEE80211_TX_STATUS_MSG = 2,
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -5041,6 +5041,19 @@ ieee80211_beacon_get_finish(struct ieee8
+ IEEE80211_TX_CTL_FIRST_FRAGMENT;
+ }
+
++static void
++ieee80211_beacon_add_mbssid(struct sk_buff *skb, struct beacon_data *beacon)
++{
++ int i;
++
++ if (!beacon->mbssid_ies)
++ return;
++
++ for (i = 0; i < beacon->mbssid_ies->cnt; i++)
++ skb_put_data(skb, beacon->mbssid_ies->elem[i].data,
++ beacon->mbssid_ies->elem[i].len);
++}
++
+ static struct sk_buff *
+ ieee80211_beacon_get_ap(struct ieee80211_hw *hw,
+ struct ieee80211_vif *vif,
+@@ -5054,6 +5067,7 @@ ieee80211_beacon_get_ap(struct ieee80211
+ struct ieee80211_if_ap *ap = &sdata->u.ap;
+ struct sk_buff *skb = NULL;
+ u16 csa_off_base = 0;
++ int mbssid_len;
+
+ if (beacon->cntdwn_counter_offsets[0]) {
+ if (!is_template)
+@@ -5063,11 +5077,12 @@ ieee80211_beacon_get_ap(struct ieee80211
+ }
+
+ /* headroom, head length,
+- * tail length and maximum TIM length
++ * tail length, maximum TIM length and multiple BSSID length
+ */
++ mbssid_len = ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies);
+ skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
+ beacon->tail_len + 256 +
+- local->hw.extra_beacon_tailroom);
++ local->hw.extra_beacon_tailroom + mbssid_len);
+ if (!skb)
+ return NULL;
+
+@@ -5081,6 +5096,11 @@ ieee80211_beacon_get_ap(struct ieee80211
+ offs->tim_length = skb->len - beacon->head_len;
+ offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
+
++ if (mbssid_len) {
++ ieee80211_beacon_add_mbssid(skb, beacon);
++ offs->mbssid_off = skb->len - mbssid_len;
++ }
++
+ /* for AP the csa offsets are from tail */
+ csa_off_base = skb->len;
+ }
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/325-mac80211-MBSSID-channel-switch.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/325-mac80211-MBSSID-channel-switch.patch
new file mode 100644
index 0000000..38b0de1
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/325-mac80211-MBSSID-channel-switch.patch
@@ -0,0 +1,52 @@
+From: John Crispin <john@phrozen.org>
+Date: Thu, 24 Feb 2022 12:54:59 +0100
+Subject: [PATCH] mac80211: MBSSID channel switch
+
+Trigger ieee80211_csa_finish() on the non-transmitting interfaces
+when channel switch concludes on the transmitting interface.
+
+Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
+Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Link: https://lore.kernel.org/r/6fde4d7f9fa387494f46a7aa4a584478dcda06f1.1645702516.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -3247,9 +3247,31 @@ cfg80211_beacon_dup(struct cfg80211_beac
+ void ieee80211_csa_finish(struct ieee80211_vif *vif)
+ {
+ struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
++ struct ieee80211_local *local = sdata->local;
+
+- ieee80211_queue_work(&sdata->local->hw,
+- &sdata->csa_finalize_work);
++ rcu_read_lock();
++
++ if (vif->mbssid_tx_vif == vif) {
++ /* Trigger ieee80211_csa_finish() on the non-transmitting
++ * interfaces when channel switch is received on
++ * transmitting interface
++ */
++ struct ieee80211_sub_if_data *iter;
++
++ list_for_each_entry_rcu(iter, &local->interfaces, list) {
++ if (!ieee80211_sdata_running(iter))
++ continue;
++
++ if (iter == sdata || iter->vif.mbssid_tx_vif != vif)
++ continue;
++
++ ieee80211_queue_work(&iter->local->hw,
++ &iter->csa_finalize_work);
++ }
++ }
++ ieee80211_queue_work(&local->hw, &sdata->csa_finalize_work);
++
++ rcu_read_unlock();
+ }
+ EXPORT_SYMBOL(ieee80211_csa_finish);
+
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/326-mac80211-update-bssid_indicator-in-ieee80211_assign_.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/326-mac80211-update-bssid_indicator-in-ieee80211_assign_.patch
new file mode 100644
index 0000000..1955568
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/326-mac80211-update-bssid_indicator-in-ieee80211_assign_.patch
@@ -0,0 +1,25 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 24 Feb 2022 12:55:00 +0100
+Subject: [PATCH] mac80211: update bssid_indicator in
+ ieee80211_assign_beacon
+
+Update bssid_indicator in ieee80211_bss_conf according to the
+number of bssid in the set.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/f92317e002fca9933f05a445fcefb4f53291d601.1645702516.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1071,6 +1071,9 @@ static int ieee80211_assign_beacon(struc
+ new->mbssid_ies = (void *)pos;
+ pos += struct_size(new->mbssid_ies, elem, mbssid->cnt);
+ ieee80211_copy_mbssid_beacon(pos, new->mbssid_ies, mbssid);
++ /* update bssid_indicator */
++ sdata->vif.bss_conf.bssid_indicator =
++ ilog2(__roundup_pow_of_two(mbssid->cnt + 1));
+ }
+
+ if (csa) {
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/400-allow-ibss-mixed.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/400-allow-ibss-mixed.patch
new file mode 100644
index 0000000..d12c8ad
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/400-allow-ibss-mixed.patch
@@ -0,0 +1,29 @@
+ath10k-ct starting with version 5.2 allows the combination of
+NL80211_IFTYPE_ADHOC and beacon_int_min_gcd in ath10k_10x_ct_if_comb
+which triggers this warning. Ben told me that this is not a big problem
+and we should ignore this.
+
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -634,21 +634,6 @@ static int wiphy_verify_combinations(str
+ c->limits[j].max > 1))
+ return -EINVAL;
+
+- /*
+- * This isn't well-defined right now. If you have an
+- * IBSS interface, then its beacon interval may change
+- * by joining other networks, and nothing prevents it
+- * from doing that.
+- * So technically we probably shouldn't even allow AP
+- * and IBSS in the same interface, but it seems that
+- * some drivers support that, possibly only with fixed
+- * beacon intervals for IBSS.
+- */
+- if (WARN_ON(types & BIT(NL80211_IFTYPE_ADHOC) &&
+- c->beacon_int_min_gcd)) {
+- return -EINVAL;
+- }
+-
+ cnt += c->limits[j].max;
+ /*
+ * Don't advertise an unsupported type
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/500-mac80211_configure_antenna_gain.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/500-mac80211_configure_antenna_gain.patch
new file mode 100644
index 0000000..c4acfd1
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/500-mac80211_configure_antenna_gain.patch
@@ -0,0 +1,162 @@
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -3869,6 +3869,7 @@ struct mgmt_frame_regs {
+ * (as advertised by the nl80211 feature flag.)
+ * @get_tx_power: store the current TX power into the dbm variable;
+ * return 0 if successful
++ * @set_antenna_gain: set antenna gain to reduce maximum tx power if necessary
+ *
+ * @rfkill_poll: polls the hw rfkill line, use cfg80211 reporting
+ * functions to adjust rfkill hw state
+@@ -4202,6 +4203,7 @@ struct cfg80211_ops {
+ enum nl80211_tx_power_setting type, int mbm);
+ int (*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
+ int *dbm);
++ int (*set_antenna_gain)(struct wiphy *wiphy, int dbi);
+
+ void (*rfkill_poll)(struct wiphy *wiphy);
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1566,6 +1566,7 @@ enum ieee80211_smps_mode {
+ *
+ * @power_level: requested transmit power (in dBm), backward compatibility
+ * value only that is set to the minimum of all interfaces
++ * @max_antenna_gain: maximum antenna gain adjusted by user config (in dBi)
+ *
+ * @chandef: the channel definition to tune to
+ * @radar_enabled: whether radar detection is enabled
+@@ -1586,6 +1587,7 @@ enum ieee80211_smps_mode {
+ struct ieee80211_conf {
+ u32 flags;
+ int power_level, dynamic_ps_timeout;
++ int max_antenna_gain;
+
+ u16 listen_interval;
+ u8 ps_dtim_period;
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -2615,6 +2615,9 @@ enum nl80211_commands {
+ * switching on a different channel during CAC detection on the selected
+ * radar channel.
+ *
++ * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
++ * transmit power to stay within regulatory limits. u32, dBi.
++ *
+ * @NUM_NL80211_ATTR: total number of nl80211_attrs available
+ * @NL80211_ATTR_MAX: highest attribute number currently defined
+ * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -3123,6 +3126,8 @@ enum nl80211_attrs {
+
+ NL80211_ATTR_RADAR_BACKGROUND,
+
++ NL80211_ATTR_WIPHY_ANTENNA_GAIN,
++
+ /* add attributes here, update the policy in nl80211.c */
+
+ __NL80211_ATTR_AFTER_LAST,
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2845,6 +2845,19 @@ static int ieee80211_get_tx_power(struct
+ return 0;
+ }
+
++static int ieee80211_set_antenna_gain(struct wiphy *wiphy, int dbi)
++{
++ struct ieee80211_local *local = wiphy_priv(wiphy);
++
++ if (dbi < 0)
++ return -EINVAL;
++
++ local->user_antenna_gain = dbi;
++ ieee80211_hw_config(local, 0);
++
++ return 0;
++}
++
+ static void ieee80211_rfkill_poll(struct wiphy *wiphy)
+ {
+ struct ieee80211_local *local = wiphy_priv(wiphy);
+@@ -4549,6 +4562,7 @@ const struct cfg80211_ops mac80211_confi
+ .set_wiphy_params = ieee80211_set_wiphy_params,
+ .set_tx_power = ieee80211_set_tx_power,
+ .get_tx_power = ieee80211_get_tx_power,
++ .set_antenna_gain = ieee80211_set_antenna_gain,
+ .rfkill_poll = ieee80211_rfkill_poll,
+ CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
+ CFG80211_TESTMODE_DUMP(ieee80211_testmode_dump)
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1444,6 +1444,7 @@ struct ieee80211_local {
+ int dynamic_ps_forced_timeout;
+
+ int user_power_level; /* in dBm, for all interfaces */
++ int user_antenna_gain; /* in dBi */
+
+ enum ieee80211_smps_mode smps_mode;
+
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -96,7 +96,7 @@ static u32 ieee80211_hw_conf_chan(struct
+ struct ieee80211_sub_if_data *sdata;
+ struct cfg80211_chan_def chandef = {};
+ u32 changed = 0;
+- int power;
++ int power, max_power;
+ u32 offchannel_flag;
+
+ offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
+@@ -157,6 +157,12 @@ static u32 ieee80211_hw_conf_chan(struct
+ }
+ rcu_read_unlock();
+
++ max_power = chandef.chan->max_reg_power;
++ if (local->user_antenna_gain > 0) {
++ max_power -= local->user_antenna_gain;
++ power = min(power, max_power);
++ }
++
+ if (local->hw.conf.power_level != power) {
+ changed |= IEEE80211_CONF_CHANGE_POWER;
+ local->hw.conf.power_level = power;
+@@ -679,6 +685,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ IEEE80211_RADIOTAP_MCS_HAVE_BW;
+ local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
+ IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
++ local->user_antenna_gain = 0;
+ local->hw.uapsd_queues = IEEE80211_DEFAULT_UAPSD_QUEUES;
+ local->hw.uapsd_max_sp_len = IEEE80211_DEFAULT_MAX_SP_LEN;
+ local->hw.max_mtu = IEEE80211_MAX_DATA_LEN;
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -794,6 +794,7 @@ static const struct nla_policy nl80211_p
+ NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
+ [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
+ [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
++ [NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
+ };
+
+ /* policy for the key attributes */
+@@ -3374,6 +3375,22 @@ static int nl80211_set_wiphy(struct sk_b
+ if (result)
+ goto out;
+ }
++
++ if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_GAIN]) {
++ int idx, dbi = 0;
++
++ if (!rdev->ops->set_antenna_gain) {
++ result = -EOPNOTSUPP;
++ goto out;
++ }
++
++ idx = NL80211_ATTR_WIPHY_ANTENNA_GAIN;
++ dbi = nla_get_u32(info->attrs[idx]);
++
++ result = rdev->ops->set_antenna_gain(&rdev->wiphy, dbi);
++ if (result)
++ goto out;
++ }
+
+ if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
+ struct wireless_dev *txp_wdev = wdev;
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch
new file mode 100644
index 0000000..26af6a2
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch
@@ -0,0 +1,29 @@
+--- a/backport-include/linux/of_net.h
++++ /dev/null
+@@ -1,26 +0,0 @@
+-#ifndef _BP_OF_NET_H
+-#define _BP_OF_NET_H
+-#include_next <linux/of_net.h>
+-#include <linux/version.h>
+-#include <linux/etherdevice.h>
+-
+-/* The behavior of of_get_mac_address() changed in kernel 5.2, it now
+- * returns an error code and not NULL in case of an error.
+- */
+-#if LINUX_VERSION_IS_LESS(5,13,0)
+-static inline int backport_of_get_mac_address(struct device_node *np, u8 *mac_out)
+-{
+- const void *mac = of_get_mac_address(np);
+-
+- if (!mac)
+- return -ENODEV;
+- if (IS_ERR(mac))
+- return PTR_ERR(mac);
+- ether_addr_copy(mac_out, mac);
+-
+- return 0;
+-}
+-#define of_get_mac_address LINUX_BACKPORT(of_get_mac_address)
+-#endif /* < 5.2 */
+-
+-#endif /* _BP_OF_NET_H */
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc b/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc
new file mode 100644
index 0000000..aae370f
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc
@@ -0,0 +1,37 @@
+#patch subsys (come from openwrt/lede/target/linux/mediatek)
+SRC_URI_append = " \
+ file://110-mac80211_keep_keys_on_stop_ap.patch \
+ file://120-cfg80211_allow_perm_addr_change.patch \
+ file://150-disable_addr_notifier.patch \
+ file://210-ap_scan.patch \
+ file://300-mac80211-fix-rate-control-for-retransmitted-frames.patch \
+ file://301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch \
+ file://302-mac80211-fix-regression-in-SSN-handling-of-addba-tx.patch \
+ file://303-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch \
+ file://304-mac80211-send-ADDBA-requests-using-the-tid-queue-of-.patch \
+ file://305-mac80211-agg-tx-don-t-schedule_and_wake_txq-under-st.patch \
+ file://306-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch \
+ file://307-mac80211_hwsim-make-6-GHz-channels-usable.patch \
+ file://308-mac80211-add-support-for-.ndo_fill_forward_path.patch \
+ file://309-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch \
+ file://310-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch \
+ file://311-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch \
+ file://312-mac80211-split-beacon-retrieval-functions.patch \
+ file://313-nl80211-MBSSID-and-EMA-support-in-AP-mode.patch \
+ file://314-cfg80211-implement-APIs-for-dedicated-radar-detectio.patch \
+ file://315-cfg80211-move-offchan_cac_event-to-a-dedicated-work.patch \
+ file://316-cfg80211-fix-possible-NULL-pointer-dereference-in-cf.patch \
+ file://317-cfg80211-schedule-offchan_cac_abort_wk-in-cfg80211_r.patch \
+ file://318-cfg80211-allow-continuous-radar-monitoring-on-offcha.patch \
+ file://319-mac80211-introduce-set_radar_offchan-callback.patch \
+ file://320-cfg80211-rename-offchannel_chain-structs-to-backgrou.patch \
+ file://321-mac80211-fix-EAPoL-rekey-fail-in-802.3-rx-path.patch \
+ file://322-mac80211-fix-forwarded-mesh-frames-AC-queue-selectio.patch \
+ file://323-mac80211-MBSSID-support-in-interface-handling.patch \
+ file://324-mac80211-MBSSID-beacon-handling-in-AP-mode.patch \
+ file://325-mac80211-MBSSID-channel-switch.patch \
+ file://326-mac80211-update-bssid_indicator-in-ieee80211_assign_.patch \
+ file://400-allow-ibss-mixed.patch \
+ file://500-mac80211_configure_antenna_gain.patch \
+ file://782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch \
+ "