[rdkb][common][bsp][Refactor and sync wifi from openwrt]

[Description]
a0c7684 [MAC80211][mt76][update mt76 patches]
a2e0f7c [MAC80211][core][Remove start disabled patch in eagle]
4562ef0 [MAC80211][hostapd][Refactor hostapd patch for git am]
22614f8 [mt76][Add vendor cmd to get available color bitmap]
b7b4fef [mac80211][Track obss color bitmap]
3f4ab41 [hostapd][Add hostapd_cli cmd to get available color bitmap]
cb120e7 [MAC80211][core][remove ba timer disabled patches]
24f983f [MAC80211][misc][sync iproute2 package]
3e866ee [MAC80211][core][Mark DFS channel available for CSA]
bdc6428 [MAC80211][hostapd][Mark DFS channel available for CSA]
9113e92 [MAC80211][app][Add eagle testmode iwpriv wrapper support]
d6bd8f4 [mac80211][mt76][Refactor mt76 patches]
7829a83 [MAC80211][mt76][Add monitor vif check in testmode]
19ead62 [mt76][eagle][hostapd mbssid and ema support]

[Release-log]

Change-Id: I75bf6ff01bc50054404bca23fd31cff9d1bc8d86
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch
index b802960..12e9cf5 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch
@@ -90,7 +90,7 @@
  #include "driver-ops.h"
  
  static int mesh_allocated;
-@@ -698,6 +699,102 @@ ieee80211_mesh_update_bss_params(struct
+@@ -698,6 +699,95 @@ ieee80211_mesh_update_bss_params(struct
  			__le32_to_cpu(he_oper->he_oper_params);
  }
  
@@ -137,8 +137,7 @@
 +	if (!entry)
 +		return false;
 +
-+	if (skb_headroom(skb) + 2 * ETH_ALEN < entry->hdrlen +
-+					       entry->fast_tx.hdr_len)
++	if (skb_headroom(skb) < entry->hdrlen + entry->fast_tx.hdr_len)
 +		return false;
 +
 +	sta = rcu_dereference(entry->mpath->next_hop);
@@ -154,16 +153,9 @@
 +			tid_tx->last_tx = jiffies;
 +	}
 +
-+	/* If the skb is shared we need to obtain our own copy */
-+	if (skb_shared(skb)) {
-+		struct sk_buff *oskb = skb;
-+
-+		skb = skb_clone(skb, GFP_ATOMIC);
-+		if (!skb)
-+			return false;
-+
-+		kfree_skb(oskb);
-+	}
++	skb = skb_share_check(skb, GFP_ATOMIC);
++	if (!skb)
++		return true;
 +
 +	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
 +
@@ -184,6 +176,7 @@
 +	if (copy_sa)
 +	    ether_addr_copy(meshhdr->eaddr2, sa);
 +
++	skb_push(skb, 2 * ETH_ALEN);
 +	__ieee80211_xmit_fast(sdata, sta, &entry->fast_tx, skb, tid_tx,
 +			      entry->mpath->dst, sdata->vif.addr);
 +
@@ -193,7 +186,7 @@
  /**
   * ieee80211_fill_mesh_addresses - fill addresses of a locally originated mesh frame
   * @hdr:	802.11 frame header
-@@ -780,6 +877,8 @@ static void ieee80211_mesh_housekeeping(
+@@ -780,6 +870,8 @@ static void ieee80211_mesh_housekeeping(
  	changed = mesh_accept_plinks_update(sdata);
  	ieee80211_mbss_info_change_notify(sdata, changed);
  
@@ -566,7 +559,7 @@
 +	if (!entry)
 +		goto unlock_sta;
 +
-+	spin_lock_bh(&cache->walk_lock);
++	spin_lock(&cache->walk_lock);
 +	prev = rhashtable_lookup_get_insert_fast(&cache->rht,
 +						 &entry->rhash,
 +						 fast_tx_rht_params);
@@ -589,7 +582,7 @@
 +	hlist_add_head(&entry->walk_list, &cache->walk_head);
 +
 +unlock_cache:
-+	spin_unlock_bh(&cache->walk_lock);
++	spin_unlock(&cache->walk_lock);
 +unlock_sta:
 +	spin_unlock_bh(&sta->lock);
 +}
@@ -771,28 +764,20 @@
  {
  	struct ieee80211_local *local = sdata->local;
  	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
-@@ -3645,8 +3652,6 @@ static void __ieee80211_xmit_fast(struct
- 	struct ieee80211_tx_data tx;
+@@ -3646,7 +3653,6 @@ static void __ieee80211_xmit_fast(struct
  	ieee80211_tx_result r;
  	int hw_headroom = sdata->local->hw.extra_tx_headroom;
--	int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
+ 	int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
 -	struct ethhdr eth;
  
  	skb = skb_share_check(skb, GFP_ATOMIC);
  	if (unlikely(!skb))
-@@ -3661,16 +3666,15 @@ static void __ieee80211_xmit_fast(struct
- 	 * more room than we already have in 'extra_head'
- 	 */
- 	if (unlikely(ieee80211_skb_resize(sdata, skb,
--					  max_t(int, extra_head + hw_headroom -
-+					  max_t(int, fast_tx->hdr_len + hw_headroom -
- 						     skb_headroom(skb), 0),
+@@ -3666,11 +3672,10 @@ static void __ieee80211_xmit_fast(struct
  					  ENCRYPT_NO)))
  		goto free;
  
 -	memcpy(&eth, skb->data, ETH_HLEN - 2);
--	hdr = skb_push(skb, extra_head);
-+	hdr = skb_push(skb, fast_tx->hdr_len);
+ 	hdr = skb_push(skb, extra_head);
  	memcpy(skb->data, fast_tx->hdr, fast_tx->hdr_len);
 -	memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN);
 -	memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN);
@@ -801,16 +786,17 @@
  
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
-@@ -3689,7 +3693,7 @@ static void __ieee80211_xmit_fast(struct
+@@ -3689,7 +3694,8 @@ static void __ieee80211_xmit_fast(struct
  #endif
  
  	if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
 -		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
 +		u8 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++
  		*ieee80211_get_qos_ctl(hdr) = tid;
  	}
  
-@@ -3732,6 +3736,7 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3732,6 +3738,7 @@ static bool ieee80211_xmit_fast(struct i
  	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
  	struct tid_ampdu_tx *tid_tx = NULL;
  	struct sk_buff *next;
@@ -818,17 +804,16 @@
  	u8 tid = IEEE80211_NUM_TIDS;
  
  	/* control port protocol needs a lot of special handling */
-@@ -3757,14 +3762,18 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3757,6 +3764,8 @@ static bool ieee80211_xmit_fast(struct i
  		}
  	}
  
 +	memcpy(&eth, skb->data, ETH_HLEN - 2);
 +
  	/* after this point (skb is modified) we cannot return false */
-+	skb_pull(skb, ETH_HLEN - 2);
  	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
  	if (!skb)
- 		return true;
+@@ -3764,7 +3773,8 @@ static bool ieee80211_xmit_fast(struct i
  
  	skb_list_walk_safe(skb, skb, next) {
  		skb_mark_not_on_list(skb);
@@ -838,7 +823,7 @@
  	}
  
  	return true;
-@@ -4244,8 +4253,15 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4244,8 +4254,15 @@ void __ieee80211_subif_start_xmit(struct
  		return;
  	}
  
@@ -854,7 +839,7 @@
  	if (ieee80211_lookup_ra_sta(sdata, skb, &sta))
  		goto out_free;
  
-@@ -4255,8 +4271,6 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4255,8 +4272,6 @@ void __ieee80211_subif_start_xmit(struct
  	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
  	ieee80211_aggr_check(sdata, sta, skb);
  
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch
index 3b0bae6..7ec8f3d 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch
@@ -64,7 +64,7 @@
 +
 +	skb->dev = sdata->dev;
 +	memcpy(&eth, skb->data, ETH_HLEN - 2);
-+	skb_pull(skb, sizeof(eth));
++	skb_pull(skb, 2);
 +	__ieee80211_xmit_fast(sdata, sta, &entry->fast_tx, skb, tid_tx,
 +			      eth.h_dest, eth.h_source);
 +	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/323-wifi-mac80211-Add-VHT-MU-MIMO-related-flags-in-ieee8.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/323-wifi-mac80211-Add-VHT-MU-MIMO-related-flags-in-ieee8.patch
new file mode 100644
index 0000000..2310593
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/323-wifi-mac80211-Add-VHT-MU-MIMO-related-flags-in-ieee8.patch
@@ -0,0 +1,68 @@
+From: Muna Sinada <quic_msinada@quicinc.com>
+Date: Wed, 5 Oct 2022 14:54:45 -0700
+Subject: [PATCH] wifi: mac80211: Add VHT MU-MIMO related flags in
+ ieee80211_bss_conf
+
+Adding flags for SU Beamformer, SU Beamformee, MU Beamformer and
+MU Beamformee for VHT. This is utilized to pass MU-MIMO
+configurations from user space to driver in AP mode.
+
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Link: https://lore.kernel.org/r/1665006886-23874-1-git-send-email-quic_msinada@quicinc.com
+[fixed indentation, removed redundant !!]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -653,6 +653,14 @@ struct ieee80211_fils_discovery {
+  *	write-protected by sdata_lock and local->mtx so holding either is fine
+  *	for read access.
+  * @color_change_color: the bss color that will be used after the change.
++ * @vht_su_beamformer: in AP mode, does this BSS support operation as an VHT SU
++ *	beamformer
++ * @vht_su_beamformee: in AP mode, does this BSS support operation as an VHT SU
++ *	beamformee
++ * @vht_mu_beamformer: in AP mode, does this BSS support operation as an VHT MU
++ *	beamformer
++ * @vht_mu_beamformee: in AP mode, does this BSS support operation as an VHT MU
++ *	beamformee
+  */
+ struct ieee80211_bss_conf {
+ 	const u8 *bssid;
+@@ -726,6 +734,11 @@ struct ieee80211_bss_conf {
+ 
+ 	bool color_change_active;
+ 	u8 color_change_color;
++
++	bool vht_su_beamformer;
++	bool vht_su_beamformee;
++	bool vht_mu_beamformer;
++	bool vht_mu_beamformee;
+ };
+ 
+ /**
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1251,6 +1251,21 @@ static int ieee80211_start_ap(struct wip
+ 	prev_beacon_int = link_conf->beacon_int;
+ 	link_conf->beacon_int = params->beacon_interval;
+ 
++	if (params->vht_cap) {
++		link_conf->vht_su_beamformer =
++			params->vht_cap->vht_cap_info &
++				cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
++		link_conf->vht_su_beamformee =
++			params->vht_cap->vht_cap_info &
++				cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
++		link_conf->vht_mu_beamformer =
++			params->vht_cap->vht_cap_info &
++				cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE);
++		link_conf->vht_mu_beamformee =
++			params->vht_cap->vht_cap_info &
++				cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
++	}
++
+ 	if (params->he_cap && params->he_oper) {
+ 		link_conf->he_support = true;
+ 		link_conf->htc_trig_based_pkt_ext =
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/324-wifi-mac80211-Add-HE-MU-MIMO-related-flags-in-ieee80.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/324-wifi-mac80211-Add-HE-MU-MIMO-related-flags-in-ieee80.patch
new file mode 100644
index 0000000..a3c4453
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/324-wifi-mac80211-Add-HE-MU-MIMO-related-flags-in-ieee80.patch
@@ -0,0 +1,68 @@
+From: Muna Sinada <quic_msinada@quicinc.com>
+Date: Wed, 5 Oct 2022 14:54:46 -0700
+Subject: [PATCH] wifi: mac80211: Add HE MU-MIMO related flags in
+ ieee80211_bss_conf
+
+Adding flags for SU Beamformer, SU Beamformee, MU Beamformer and Full
+Bandwidth UL MU-MIMO for HE. This is utilized to pass MU-MIMO
+configurations from user space to driver in AP mode.
+
+Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
+Link: https://lore.kernel.org/r/1665006886-23874-2-git-send-email-quic_msinada@quicinc.com
+[fixed indentation, removed redundant !!]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -661,6 +661,15 @@ struct ieee80211_fils_discovery {
+  *	beamformer
+  * @vht_mu_beamformee: in AP mode, does this BSS support operation as an VHT MU
+  *	beamformee
++ * @he_su_beamformer: in AP-mode, does this BSS support operation as an HE SU
++ *	beamformer
++ * @he_su_beamformee: in AP-mode, does this BSS support operation as an HE SU
++ *	beamformee
++ * @he_mu_beamformer: in AP-mode, does this BSS support operation as an HE MU
++ *	beamformer
++ * @he_full_ul_mumimo: does this BSS support the reception (AP) or transmission
++ *	(non-AP STA) of an HE TB PPDU on an RU that spans the entire PPDU
++ *	bandwidth
+  */
+ struct ieee80211_bss_conf {
+ 	const u8 *bssid;
+@@ -739,6 +748,10 @@ struct ieee80211_bss_conf {
+ 	bool vht_su_beamformee;
+ 	bool vht_mu_beamformer;
+ 	bool vht_mu_beamformee;
++	bool he_su_beamformer;
++	bool he_su_beamformee;
++	bool he_mu_beamformer;
++	bool he_full_ul_mumimo;
+ };
+ 
+ /**
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1280,6 +1280,21 @@ static int ieee80211_start_ap(struct wip
+ 			changed |= BSS_CHANGED_HE_BSS_COLOR;
+ 	}
+ 
++	if (params->he_cap) {
++		link_conf->he_su_beamformer =
++			params->he_cap->phy_cap_info[3] &
++				IEEE80211_HE_PHY_CAP3_SU_BEAMFORMER;
++		link_conf->he_su_beamformee =
++			params->he_cap->phy_cap_info[4] &
++				IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE;
++		link_conf->he_mu_beamformer =
++			params->he_cap->phy_cap_info[4] &
++				IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER;
++		link_conf->he_full_ul_mumimo =
++			params->he_cap->phy_cap_info[2] &
++				IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO;
++	}
++
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP &&
+ 	    params->mbssid_config.tx_wdev) {
+ 		err = ieee80211_set_ap_mbssid_options(sdata,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/325-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/325-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch
new file mode 100644
index 0000000..f6d3d78
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/325-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch
@@ -0,0 +1,60 @@
+From: Ryder Lee <ryder.lee@mediatek.com>
+Date: Sat, 18 Feb 2023 01:50:05 +0800
+Subject: [PATCH] wifi: mac80211: introduce
+ ieee80211_refresh_tx_agg_session_timer()
+
+This allows low level drivers to refresh the tx agg session timer, based on
+querying stats from the firmware usually. Especially for some mt76 devices
+support .net_fill_forward_path would bypass mac80211, which leads to tx BA
+session timeout for certain clients.
+
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -5968,6 +5968,18 @@ void ieee80211_queue_delayed_work(struct
+ 				  unsigned long delay);
+ 
+ /**
++ * ieee80211_refresh_tx_agg_session_timer - Refresh a tx agg session timer.
++ * @sta: the station for which to start a BA session
++ * @tid: the TID to BA on.
++ *
++ * This function allows low level driver to refresh tx agg session timer
++ * to maintain BA session, the session level will still be managed by the
++ * mac80211.
++ */
++void ieee80211_refresh_tx_agg_session_timer(struct ieee80211_sta *sta,
++					    u16 tid);
++
++/**
+  * ieee80211_start_tx_ba_session - Start a tx Block Ack session.
+  * @sta: the station for which to start a BA session
+  * @tid: the TID to BA on.
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -552,6 +552,23 @@ void ieee80211_tx_ba_session_handle_star
+ 	ieee80211_send_addba_with_timeout(sta, tid_tx);
+ }
+ 
++void ieee80211_refresh_tx_agg_session_timer(struct ieee80211_sta *pubsta,
++					    u16 tid)
++{
++	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
++	struct tid_ampdu_tx *tid_tx;
++
++	if (WARN_ON_ONCE(tid >= IEEE80211_NUM_TIDS))
++		return;
++
++	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
++	if (!tid_tx)
++		return;
++
++	tid_tx->last_tx = jiffies;
++}
++EXPORT_SYMBOL(ieee80211_refresh_tx_agg_session_timer);
++
+ /*
+  * After accepting the AddBA Response we activated a timer,
+  * resetting it after each frame that we send.
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/326-wifi-mac80211-add-mesh-fast-rx-support.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/326-wifi-mac80211-add-mesh-fast-rx-support.patch
new file mode 100644
index 0000000..b2b94d0
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/326-wifi-mac80211-add-mesh-fast-rx-support.patch
@@ -0,0 +1,77 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 2 Mar 2023 13:52:29 +0100
+Subject: [PATCH] wifi: mac80211: add mesh fast-rx support
+
+This helps bring down rx CPU usage by avoiding calls to the rx handlers in
+the slow path. Supports forwarding and local rx, including A-MSDU.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4572,6 +4572,12 @@ void ieee80211_check_fast_rx(struct sta_
+ 		}
+ 
+ 		break;
++	case NL80211_IFTYPE_MESH_POINT:
++		fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_FROMDS |
++						      IEEE80211_FCTL_TODS);
++		fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
++		fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
++		break;
+ 	default:
+ 		goto clear;
+ 	}
+@@ -4780,6 +4786,7 @@ static bool ieee80211_invoke_fast_rx(str
+ 	struct sk_buff *skb = rx->skb;
+ 	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
++	static ieee80211_rx_result res;
+ 	int orig_len = skb->len;
+ 	int hdrlen = ieee80211_hdrlen(hdr->frame_control);
+ 	int snap_offs = hdrlen;
+@@ -4841,7 +4848,8 @@ static bool ieee80211_invoke_fast_rx(str
+ 		snap_offs += IEEE80211_CCMP_HDR_LEN;
+ 	}
+ 
+-	if (!(status->rx_flags & IEEE80211_RX_AMSDU)) {
++	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
++	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
+ 		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
+ 			return false;
+ 
+@@ -4880,13 +4888,29 @@ static bool ieee80211_invoke_fast_rx(str
+ 	/* do the header conversion - first grab the addresses */
+ 	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
+ 	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
+-	skb_postpull_rcsum(skb, skb->data + snap_offs,
+-			   sizeof(rfc1042_header) + 2);
+-	/* remove the SNAP but leave the ethertype */
+-	skb_pull(skb, snap_offs + sizeof(rfc1042_header));
++	if (ieee80211_vif_is_mesh(&rx->sdata->vif)) {
++	    skb_pull(skb, snap_offs - 2);
++	    put_unaligned_be16(skb->len - 2, skb->data);
++	} else {
++	    skb_postpull_rcsum(skb, skb->data + snap_offs,
++			       sizeof(rfc1042_header) + 2);
++
++	    /* remove the SNAP but leave the ethertype */
++	    skb_pull(skb, snap_offs + sizeof(rfc1042_header));
++	}
+ 	/* push the addresses in front */
+ 	memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
+ 
++	res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
++	switch (res) {
++	case RX_QUEUED:
++		return true;
++	case RX_CONTINUE:
++		break;
++	default:
++		goto drop;
++	}
++
+ 	ieee80211_rx_8023(rx, fast_rx, orig_len);
+ 
+ 	return true;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0008-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0008-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch
deleted file mode 100644
index bf8111a..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0008-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From 41ef202d35486326d8fc52466ef4ad6f7aa98e34 Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Wed, 19 Oct 2022 13:49:21 +0800
-Subject: [PATCH 08/16] mac80211: mtk: remove timerout handle for ax210 iot
- issue
-
-Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
----
- net/mac80211/agg-tx.c | 7 +++----
- 1 file changed, 3 insertions(+), 4 deletions(-)
- mode change 100644 => 100755 net/mac80211/agg-tx.c
-
-diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
-old mode 100644
-new mode 100755
-index 07c892a..1f46561
---- a/net/mac80211/agg-tx.c
-+++ b/net/mac80211/agg-tx.c
-@@ -568,10 +568,9 @@ static void sta_tx_agg_session_timer_expired(struct timer_list *t)
- 	}
- 
- 	timeout = tid_tx->last_tx + TU_TO_JIFFIES(tid_tx->timeout);
--	if (time_is_after_jiffies(timeout)) {
--		mod_timer(&tid_tx->session_timer, timeout);
--		return;
--	}
-+	/* remove timerout handle for ax210 iot issue */
-+	mod_timer(&tid_tx->session_timer, timeout);
-+	return;
- 
- 	ht_dbg(sta->sdata, "tx session timer expired on %pM tid %d\n",
- 	       sta->sta.addr, tid);
--- 
-2.25.1
-
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-check-the-control-channel-before-downgr.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-check-the-control-channel-before-downgr.patch
similarity index 92%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-check-the-control-channel-before-downgr.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-check-the-control-channel-before-downgr.patch
index 23b9ccb..18f434f 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-check-the-control-channel-before-downgr.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-check-the-control-channel-before-downgr.patch
@@ -1,7 +1,7 @@
-From cc6f40e49bfdee7c824d4b158a060c2dc42ded4c Mon Sep 17 00:00:00 2001
+From 0ed0a8f524a3288603f9eb298dcdeff7ae745e39 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 16 Dec 2022 03:31:06 +0800
-Subject: [PATCH 12/16] mac80211: mtk: check the control channel before
+Subject: [PATCH 11/19] mac80211: mtk: check the control channel before
  downgrading the bandwidth
 
 ---
@@ -50,5 +50,5 @@
  		*conn_flags |=
  			ieee80211_chandef_downgrade(&chandef);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch
deleted file mode 100644
index c42a00f..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0011-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch
+++ /dev/null
@@ -1,261 +0,0 @@
-From 7dd3aacd15e5678a617001dc329cf942ed7f4298 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Wed, 5 Oct 2022 19:13:43 +0800
-Subject: [PATCH 11/16] mac80211: mtk: fix the issue of AP and STA starting on
- DFS channel concurrently
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- include/net/cfg80211.h       | 22 ++++++++++++++++++
- include/uapi/linux/nl80211.h |  2 +-
- net/mac80211/cfg.c           | 44 ++++++++++++++++++++++++++++++++++++
- net/mac80211/chan.c          |  2 +-
- net/wireless/chan.c          |  6 ++---
- net/wireless/nl80211.c       |  7 ++++++
- net/wireless/rdev-ops.h      | 16 +++++++++++++
- net/wireless/trace.h         | 15 ++++++++++++
- 8 files changed, 109 insertions(+), 5 deletions(-)
-
-diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
-index f9c2cc3..84e769b 100644
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -888,6 +888,24 @@ cfg80211_chandef_identical(const struct cfg80211_chan_def *chandef1,
- 		chandef1->center_freq2 == chandef2->center_freq2);
- }
- 
-+/**
-+ * cfg80211_chan_fully_overlap - check if two channel are fully overlapped
-+ * @chandef1: first channel definition
-+ * @chandef2: second channel definition
-+ *
-+ * Return: %true if the channels are valid and fully overlapped, %false otherwise.
-+ */
-+static inline bool
-+cfg80211_chan_fully_overlap(const struct cfg80211_chan_def *chandef1,
-+			    const struct cfg80211_chan_def *chandef2)
-+{
-+	return (chandef1->center_freq1 != 0 &&
-+		chandef1->center_freq1 == chandef2->center_freq1 &&
-+		chandef1->width == chandef2->width &&
-+		chandef1->freq1_offset == chandef2->freq1_offset &&
-+		chandef1->center_freq2 == chandef2->center_freq2);
-+}
-+
- /**
-  * cfg80211_chandef_is_edmg - check if chandef represents an EDMG channel
-  *
-@@ -4642,6 +4660,8 @@ struct cfg80211_ops {
- 	int	(*del_link_station)(struct wiphy *wiphy, struct net_device *dev,
- 				    struct link_station_del_parameters *params);
- 	void	(*skip_cac)(struct wireless_dev *wdev);
-+	void	(*check_cac_skip)(struct wiphy *wiphy,
-+				  struct cfg80211_chan_def *chandef);
- };
- 
- /*
-@@ -5847,6 +5867,8 @@ struct wireless_dev {
- 		};
- 	} links[IEEE80211_MLD_MAX_NUM_LINKS];
- 	u16 valid_links;
-+
-+	bool start_disabled;
- };
- 
- static inline const u8 *wdev_address(struct wireless_dev *wdev)
-diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
-index 1293d30..db9d0a8 100644
---- a/include/uapi/linux/nl80211.h
-+++ b/include/uapi/linux/nl80211.h
-@@ -3283,7 +3283,7 @@ enum nl80211_attrs {
- 	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
- 
- 	/* add attributes here, update the policy in nl80211.c */
--
-+	NL80211_ATTR_START_DISABLED = 999,
- 	__NL80211_ATTR_AFTER_LAST,
- 	NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
- 	NL80211_ATTR_MAX = __NL80211_ATTR_AFTER_LAST - 1
-diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index 5718c56..9da02d9 100644
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -4889,6 +4889,49 @@ ieee80211_skip_cac(struct wireless_dev *wdev)
- 	}
- }
- 
-+static void
-+ieee80211_check_cac_skip(struct wiphy *wiphy,
-+			 struct cfg80211_chan_def *chandef)
-+{
-+	struct ieee80211_local *local = wiphy_priv(wiphy);
-+	struct ieee80211_sub_if_data *s1;
-+	struct ieee80211_sub_if_data *s2;
-+	struct ieee80211_sub_if_data *sdata_sta;
-+	struct ieee80211_if_managed *ifmgd;
-+	struct ieee80211_channel *chan;
-+	struct wireless_dev *wdev;
-+	unsigned int cac_time_ms;
-+
-+	mutex_lock(&local->mtx);
-+	/* Bypass AP's cac if there is a STA associated to the same DFS channel */
-+	list_for_each_entry(s1, &local->interfaces, list) {
-+		ifmgd = &s1->u.mgd;
-+
-+		if (s1->vif.type == NL80211_IFTYPE_STATION && ifmgd->associated)
-+			sdata_sta = s1;
-+		else
-+			continue;
-+
-+		list_for_each_entry(s2, &local->interfaces, list) {
-+			wdev = &s2->wdev;
-+			chan = wdev->links[0].ap.chandef.chan;
-+			if (chan) {
-+				if (!(chan->flags & IEEE80211_CHAN_RADAR))
-+					continue;
-+
-+				if (wdev->identifier != sdata_sta->wdev.identifier &&
-+				    chan->dfs_state == NL80211_DFS_USABLE && wdev->cac_started &&
-+				    cfg80211_chan_fully_overlap(&sdata_sta->vif.bss_conf.chandef,
-+								&s2->vif.bss_conf.chandef)) {
-+					ieee80211_skip_cac(wdev);
-+					sdata_info(s2, "Skip CAC on the associated STA's chan\n");
-+				}
-+			}
-+		}
-+	}
-+	mutex_unlock(&local->mtx);
-+}
-+
- const struct cfg80211_ops mac80211_config_ops = {
- 	.add_virtual_intf = ieee80211_add_iface,
- 	.del_virtual_intf = ieee80211_del_iface,
-@@ -5001,4 +5044,5 @@ const struct cfg80211_ops mac80211_config_ops = {
- 	.mod_link_station = ieee80211_mod_link_station,
- 	.del_link_station = ieee80211_del_link_station,
- 	.skip_cac = ieee80211_skip_cac,
-+	.check_cac_skip = ieee80211_check_cac_skip,
- };
-diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
-index e72cf07..94496d7 100644
---- a/net/mac80211/chan.c
-+++ b/net/mac80211/chan.c
-@@ -567,7 +567,7 @@ bool ieee80211_is_radar_required(struct ieee80211_local *local)
- 
- 			link = rcu_dereference(sdata->link[link_id]);
- 
--			if (link && link->radar_required) {
-+			if (link && link->radar_required && sdata->wdev.cac_started) {
- 				rcu_read_unlock();
- 				return true;
- 			}
-diff --git a/net/wireless/chan.c b/net/wireless/chan.c
-index 29b5c2f..bf21f99 100644
---- a/net/wireless/chan.c
-+++ b/net/wireless/chan.c
-@@ -719,16 +719,16 @@ bool cfg80211_beaconing_iface_active(struct wireless_dev *wdev)
- 	case NL80211_IFTYPE_AP:
- 	case NL80211_IFTYPE_P2P_GO:
- 		for_each_valid_link(wdev, link) {
--			if (wdev->links[link].ap.beacon_interval)
-+			if (wdev->links[link].ap.beacon_interval || wdev->start_disabled)
- 				return true;
- 		}
- 		break;
- 	case NL80211_IFTYPE_ADHOC:
--		if (wdev->u.ibss.ssid_len)
-+		if (wdev->u.ibss.ssid_len || wdev->start_disabled)
- 			return true;
- 		break;
- 	case NL80211_IFTYPE_MESH_POINT:
--		if (wdev->u.mesh.id_len)
-+		if (wdev->u.mesh.id_len || wdev->start_disabled)
- 			return true;
- 		break;
- 	case NL80211_IFTYPE_STATION:
-diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
-index 202f802..cc8d4b2 100644
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -789,6 +789,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
- 			NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
- 	[NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
- 	[NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
-+	[NL80211_ATTR_START_DISABLED] = { .type = NLA_FLAG },
- 	[NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
- 	[NL80211_ATTR_EHT_CAPABILITY] =
- 		NLA_POLICY_BINARY_RANGE(NL80211_EHT_MIN_CAPABILITY_LEN, NL80211_EHT_MAX_CAPABILITY_LEN),
-@@ -5803,6 +5804,11 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
- 	if (wdev->links[link_id].ap.beacon_interval)
- 		return -EALREADY;
- 
-+	if (info->attrs[NL80211_ATTR_START_DISABLED]) {
-+		wdev->start_disabled = nla_get_flag(info->attrs[NL80211_ATTR_START_DISABLED]);
-+		return 0;
-+	}
-+
- 	/* these are required for START_AP */
- 	if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
- 	    !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
-@@ -9846,6 +9852,7 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
- 		wdev->cac_started = true;
- 		wdev->cac_start_time = jiffies;
- 		wdev->cac_time_ms = cac_time_ms;
-+		err = rdev_check_cac_skip(rdev, &wdev->links[0].ap.chandef);
- 	}
- unlock:
- 	wiphy_unlock(wiphy);
-diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
-index ce83152..ffa504a 100644
---- a/net/wireless/rdev-ops.h
-+++ b/net/wireless/rdev-ops.h
-@@ -1508,4 +1508,20 @@ rdev_skip_cac(struct cfg80211_registered_device *rdev,
- 	return 0;
- }
- 
-+static inline int
-+rdev_check_cac_skip(struct cfg80211_registered_device *rdev,
-+		    struct cfg80211_chan_def *chandef)
-+{
-+	struct wiphy *wiphy = &rdev->wiphy;
-+
-+	if (!rdev->ops->check_cac_skip)
-+		return -EOPNOTSUPP;
-+
-+	trace_rdev_check_cac_skip(wiphy, chandef);
-+	rdev->ops->check_cac_skip(wiphy, chandef);
-+	trace_rdev_return_void(wiphy);
-+
-+	return 0;
-+}
-+
- #endif /* __CFG80211_RDEV_OPS */
-diff --git a/net/wireless/trace.h b/net/wireless/trace.h
-index d3a98e8..72c8f0e 100644
---- a/net/wireless/trace.h
-+++ b/net/wireless/trace.h
-@@ -3913,6 +3913,21 @@ TRACE_EVENT(rdev_skip_cac,
- 	    TP_printk(WDEV_PR_FMT, WDEV_PR_ARG)
- );
- 
-+TRACE_EVENT(rdev_check_cac_skip,
-+	    TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
-+
-+	    TP_ARGS(wiphy, chandef),
-+
-+	    TP_STRUCT__entry(WIPHY_ENTRY
-+			     CHAN_DEF_ENTRY),
-+
-+	    TP_fast_assign(WIPHY_ASSIGN;
-+			   CHAN_DEF_ASSIGN(chandef)),
-+
-+	    TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
-+		      WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
-+);
-+
- #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
- 
- #undef TRACE_INCLUDE_PATH
--- 
-2.25.1
-
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-fix-tx-amsdu-aggregation.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-fix-tx-amsdu-aggregation.patch
similarity index 87%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-fix-tx-amsdu-aggregation.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-fix-tx-amsdu-aggregation.patch
index da3eede..6b5dab9 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-fix-tx-amsdu-aggregation.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0012-mac80211-mtk-fix-tx-amsdu-aggregation.patch
@@ -1,7 +1,7 @@
-From e07d5401accc96f8380bf42ec454c9ea42255196 Mon Sep 17 00:00:00 2001
+From bb385f098e5f12c7ec0cc5032ac32a27f6713af6 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Wed, 14 Dec 2022 00:26:50 -0800
-Subject: [PATCH 13/16] mac80211: mtk: fix tx amsdu aggregation
+Subject: [PATCH 12/19] mac80211: mtk: fix tx amsdu aggregation
 
 ---
  include/net/mac80211.h | 7 +++++++
@@ -9,10 +9,10 @@
  2 files changed, 11 insertions(+), 2 deletions(-)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index dc4faea..286810b 100644
+index 5908ba3..ad5f217 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2864,6 +2864,13 @@ static inline void _ieee80211_hw_set(struct ieee80211_hw *hw,
+@@ -2890,6 +2890,13 @@ static inline void _ieee80211_hw_set(struct ieee80211_hw *hw,
  }
  #define ieee80211_hw_set(hw, flg)	_ieee80211_hw_set(hw, IEEE80211_HW_##flg)
  
@@ -27,7 +27,7 @@
   * struct ieee80211_scan_request - hw scan request
   *
 diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
-index 1f46561..318c71e 100755
+index 65c35e4..6b7ec6e 100755
 --- a/net/mac80211/agg-tx.c
 +++ b/net/mac80211/agg-tx.c
 @@ -66,7 +66,8 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
@@ -51,5 +51,5 @@
  	capab |= u16_encode_bits(tid, IEEE80211_ADDBA_PARAM_TID_MASK);
  	capab |= u16_encode_bits(agg_size, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
similarity index 91%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
index 277e231..8d2067f 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
@@ -1,7 +1,7 @@
-From b36c1fd5e967880b025a8301aadbeb832a364639 Mon Sep 17 00:00:00 2001
+From 2a801c07d58b8c9b9d5e9049856c7ef7b504d841 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Wed, 18 May 2022 15:10:22 +0800
-Subject: [PATCH 14/16] mac80211: mtk: add fill receive path ops to get wed idx
+Subject: [PATCH 13/19] mac80211: mtk: add fill receive path ops to get wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -13,10 +13,10 @@
  mode change 100644 => 100755 net/mac80211/util.c
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index 286810b..f68eb7d 100644
+index ad5f217..d1d7fc3 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1354,7 +1354,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
+@@ -1380,7 +1380,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
   * @RX_FLAG_AMPDU_EOF_BIT_KNOWN: The EOF value is known
   * @RX_FLAG_RADIOTAP_HE: HE radiotap data is present
   *	(&struct ieee80211_radiotap_he, mac80211 will fill in
@@ -25,7 +25,7 @@
   *	 - DATA3_DATA_MCS
   *	 - DATA3_DATA_DCM
   *	 - DATA3_CODING
-@@ -1362,7 +1362,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
+@@ -1388,7 +1388,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
   *	 - DATA5_DATA_BW_RU_ALLOC
   *	 - DATA6_NSTS
   *	 - DATA3_STBC
@@ -34,7 +34,7 @@
   *	from the RX info data, so leave those zeroed when building this data)
   * @RX_FLAG_RADIOTAP_HE_MU: HE MU radiotap data is present
   *	(&struct ieee80211_radiotap_he_mu)
-@@ -1924,6 +1924,12 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
+@@ -1950,6 +1950,12 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
   */
  struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif);
  
@@ -47,7 +47,7 @@
  /**
   * lockdep_vif_mutex_held - for lockdep checks on link poiners
   * @vif: the interface to check
-@@ -4193,6 +4199,8 @@ struct ieee80211_prep_tx_info {
+@@ -4219,6 +4225,8 @@ struct ieee80211_prep_tx_info {
   *	Note that a sta can also be inserted or removed with valid links,
   *	i.e. passed to @sta_add/@sta_state with sta->valid_links not zero.
   *	In fact, cannot change from having valid_links and not having them.
@@ -56,7 +56,7 @@
   */
  struct ieee80211_ops {
  	void (*tx)(struct ieee80211_hw *hw,
-@@ -4548,6 +4556,9 @@ struct ieee80211_ops {
+@@ -4574,6 +4582,9 @@ struct ieee80211_ops {
  				struct ieee80211_vif *vif,
  				struct ieee80211_sta *sta,
  				u16 old_links, u16 new_links);
@@ -153,5 +153,5 @@
   * Nothing should have been stuffed into the workqueue during
   * the suspend->resume cycle. Since we can't check each caller
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-register-.ndo_setup_tc-to-support-wifi2.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-register-.ndo_setup_tc-to-support-wifi2.patch
similarity index 90%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-register-.ndo_setup_tc-to-support-wifi2.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-register-.ndo_setup_tc-to-support-wifi2.patch
index 60ab368..c32e2a0 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-register-.ndo_setup_tc-to-support-wifi2.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-register-.ndo_setup_tc-to-support-wifi2.patch
@@ -1,7 +1,7 @@
-From d0bf320b53011bf418e32991f899683280da184f Mon Sep 17 00:00:00 2001
+From a4cd8f81a63827647e88021cbcfc479f024221cb Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 23 Dec 2022 18:12:41 +0800
-Subject: [PATCH 15/16] mac80211: mtk: register .ndo_setup_tc to support
+Subject: [PATCH 14/19] mac80211: mtk: register .ndo_setup_tc to support
  wifi2wifi offload
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -11,10 +11,10 @@
  2 files changed, 31 insertions(+)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index f68eb7d..c453b19 100644
+index d1d7fc3..1de9fad 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -4201,6 +4201,8 @@ struct ieee80211_prep_tx_info {
+@@ -4227,6 +4227,8 @@ struct ieee80211_prep_tx_info {
   *	In fact, cannot change from having valid_links and not having them.
   * @net_fill_receive_path: Called from .ndo_fill_receive_path in order to
   *	get a path for hardware flow offloading
@@ -23,7 +23,7 @@
   */
  struct ieee80211_ops {
  	void (*tx)(struct ieee80211_hw *hw,
-@@ -4559,6 +4561,9 @@ struct ieee80211_ops {
+@@ -4585,6 +4587,9 @@ struct ieee80211_ops {
  	int (*net_fill_receive_path)(struct ieee80211_hw *hw,
  				     struct net_device_path_ctx *ctx,
  				     struct net_device_path *path);
@@ -85,5 +85,5 @@
  	dev->needs_free_netdev = true;
  	dev->priv_destructor = ieee80211_if_free;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0016-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
similarity index 90%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0016-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
index bb53403..3b2b718 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0016-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
@@ -1,7 +1,7 @@
-From 12d2196bb600818a9fc9081037c509f2624b2d25 Mon Sep 17 00:00:00 2001
+From 83f826c468a145fb205cffe0f5fcc8d69143bb78 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Tue, 13 Dec 2022 09:04:49 +0800
-Subject: [PATCH 16/16] mac80211: mtk: fix build error on Linux Kernel 5.4
+Subject: [PATCH 15/19] mac80211: mtk: fix build error on Linux Kernel 5.4
 
 ---
  include/linux/ieee80211.h          | 8 +++-----
@@ -66,10 +66,10 @@
  
  
 diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
-index cc8d4b2..8928a26 100644
+index 202f802..1035f74 100644
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -16448,9 +16448,11 @@ static const struct genl_ops nl80211_ops[] = {
+@@ -16441,9 +16441,11 @@ static const struct genl_ops nl80211_ops[] = {
  		/* can be retrieved by unprivileged users */
  		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
  	},
@@ -81,7 +81,7 @@
  	{
  		.cmd = NL80211_CMD_SET_WIPHY,
  		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-@@ -17287,8 +17289,10 @@ static struct genl_family nl80211_fam __genl_ro_after_init = {
+@@ -17280,8 +17282,10 @@ static struct genl_family nl80211_fam __genl_ro_after_init = {
  	.module = THIS_MODULE,
  	.ops = nl80211_ops,
  	.n_ops = ARRAY_SIZE(nl80211_ops),
@@ -93,5 +93,5 @@
  	.resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
index db2b20a..a2d8984 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
@@ -27,6 +27,10 @@
     file://320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch \
     file://321-mac80211-fix-mesh-forwarding.patch \
     file://322-wifi-mac80211-fix-mesh-path-discovery-based-on-unica.patch \
+    file://323-wifi-mac80211-Add-VHT-MU-MIMO-related-flags-in-ieee8.patch \
+    file://324-wifi-mac80211-Add-HE-MU-MIMO-related-flags-in-ieee80.patch \
+    file://325-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch \
+    file://326-wifi-mac80211-add-mesh-fast-rx-support.patch \
     file://400-allow-ibss-mixed.patch \
     file://500-mac80211_configure_antenna_gain.patch \
     file://782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch \
@@ -37,15 +41,13 @@
     file://mtk-0005-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch \
     file://mtk-0006-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch \
     file://mtk-0007-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch \
-    file://mtk-0008-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch \
     file://mtk-0009-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch \
     file://mtk-0010-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch \
-    file://mtk-0011-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch \
-    file://mtk-0012-mac80211-mtk-check-the-control-channel-before-downgr.patch \
-    file://mtk-0013-mac80211-mtk-fix-tx-amsdu-aggregation.patch \
-    file://mtk-0014-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch \
-    file://mtk-0015-mac80211-mtk-register-.ndo_setup_tc-to-support-wifi2.patch \
-    file://mtk-0016-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch \
+    file://mtk-0011-mac80211-mtk-check-the-control-channel-before-downgr.patch \
+    file://mtk-0012-mac80211-mtk-fix-tx-amsdu-aggregation.patch \
+    file://mtk-0013-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch \
+    file://mtk-0014-mac80211-mtk-register-.ndo_setup_tc-to-support-wifi2.patch \
+    file://mtk-0015-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch \
     file://mtk-0100-mac80211-mtk-add-EHT-BA1024-support.patch \
     file://mtk-0101-mac80211-mtk-add-rate-duration-for-EHT-rate.patch \
     "
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/347-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/347-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch
new file mode 100644
index 0000000..acd6c12
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/347-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch
@@ -0,0 +1,60 @@
+From: Ryder Lee <ryder.lee@mediatek.com>
+Date: Sat, 18 Feb 2023 01:50:05 +0800
+Subject: [PATCH] wifi: mac80211: introduce
+ ieee80211_refresh_tx_agg_session_timer()
+
+This allows low level drivers to refresh the tx agg session timer, based on
+querying stats from the firmware usually. Especially for some mt76 devices
+support .net_fill_forward_path would bypass mac80211, which leads to tx BA
+session timeout for certain clients.
+
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -5970,6 +5970,18 @@ void ieee80211_queue_delayed_work(struct
+ 				  unsigned long delay);
+ 
+ /**
++ * ieee80211_refresh_tx_agg_session_timer - Refresh a tx agg session timer.
++ * @sta: the station for which to start a BA session
++ * @tid: the TID to BA on.
++ *
++ * This function allows low level driver to refresh tx agg session timer
++ * to maintain BA session, the session level will still be managed by the
++ * mac80211.
++ */
++void ieee80211_refresh_tx_agg_session_timer(struct ieee80211_sta *sta,
++					    u16 tid);
++
++/**
+  * ieee80211_start_tx_ba_session - Start a tx Block Ack session.
+  * @sta: the station for which to start a BA session
+  * @tid: the TID to BA on.
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -552,6 +552,23 @@ void ieee80211_tx_ba_session_handle_star
+ 	ieee80211_send_addba_with_timeout(sta, tid_tx);
+ }
+ 
++void ieee80211_refresh_tx_agg_session_timer(struct ieee80211_sta *pubsta,
++					    u16 tid)
++{
++	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
++	struct tid_ampdu_tx *tid_tx;
++
++	if (WARN_ON_ONCE(tid >= IEEE80211_NUM_TIDS))
++		return;
++
++	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
++	if (!tid_tx)
++		return;
++
++	tid_tx->last_tx = jiffies;
++}
++EXPORT_SYMBOL(ieee80211_refresh_tx_agg_session_timer);
++
+ /*
+  * After accepting the AddBA Response we activated a timer,
+  * resetting it after each frame that we send.
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0009-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0009-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch
deleted file mode 100644
index 50f2684..0000000
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0009-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From 733277b58ef0b13581c4c22231003f1910d60a5b Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Wed, 19 Oct 2022 13:49:21 +0800
-Subject: [PATCH 908/915] mac80211: mtk: remove timerout handle for ax210 iot
- issue
-
-Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
----
- net/mac80211/agg-tx.c | 7 +++----
- 1 file changed, 3 insertions(+), 4 deletions(-)
- mode change 100644 => 100755 net/mac80211/agg-tx.c
-
-diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
-old mode 100644
-new mode 100755
-index 1deb3d8..c30f02d
---- a/net/mac80211/agg-tx.c
-+++ b/net/mac80211/agg-tx.c
-@@ -568,10 +568,9 @@ static void sta_tx_agg_session_timer_expired(struct timer_list *t)
- 	}
- 
- 	timeout = tid_tx->last_tx + TU_TO_JIFFIES(tid_tx->timeout);
--	if (time_is_after_jiffies(timeout)) {
--		mod_timer(&tid_tx->session_timer, timeout);
--		return;
--	}
-+	/* remove timerout handle for ax210 iot issue */
-+	mod_timer(&tid_tx->session_timer, timeout);
-+	return;
- 
- 	ht_dbg(sta->sdata, "tx session timer expired on %pM tid %d\n",
- 	       sta->sta.addr, tid);
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0014--mac80211-mtk-track-obss-color-bitmap.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0014--mac80211-mtk-track-obss-color-bitmap.patch
new file mode 100644
index 0000000..18d8aab
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0014--mac80211-mtk-track-obss-color-bitmap.patch
@@ -0,0 +1,102 @@
+From 40ceb2dcc486ddefb5e4cb69e4cd86906242872c Mon Sep 17 00:00:00 2001
+From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
+Date: Tue, 15 Nov 2022 06:35:48 +0800
+Subject: [PATCH] mac80211: mtk: track obss color bitmap
+
+Track OBSS BSS color when receive their beacon.
+
+Adding 2 tracepoint for debug, usage:
+echo 1 > /sys/kernel/debug/tracing/events/mac80211/bss_color_bitmap/enable
+echo 1 > /sys/kernel/debug/tracing/events/mac80211/bss_color_collision/enable
+---
+ include/net/cfg80211.h |  1 +
+ net/mac80211/rx.c      | 14 ++++++++++++--
+ net/mac80211/trace.h   | 35 +++++++++++++++++++++++++++++++++++
+ 3 files changed, 48 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index c4c0926..e5175c2 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -307,6 +307,7 @@ struct cfg80211_he_bss_color {
+ 	u8 color;
+ 	bool enabled;
+ 	bool partial;
++	u64 used_color_bitmap;
+ };
+ 
+ /**
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index eb16838..4a6491c 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3219,9 +3219,18 @@ ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
+ 
+ 		color = le32_get_bits(he_oper->he_oper_params,
+ 				      IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
+-		if (color == bss_conf->he_bss_color.color)
++
++		bss_conf->he_bss_color.used_color_bitmap |= BIT_ULL(color);
++
++		trace_bss_color_bitmap(color,
++				       bss_conf->he_bss_color.used_color_bitmap);
++
++		if (color == bss_conf->he_bss_color.color) {
++			trace_bss_color_collision(color);
++
+ 			ieeee80211_obss_color_collision_notify(&rx->sdata->vif,
+-							       BIT_ULL(color));
++				bss_conf->he_bss_color.used_color_bitmap);
++		}
+ 	}
+ }
+ 
+diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
+index d91498f..013f5e4 100644
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -2899,6 +2899,41 @@ DEFINE_EVENT(sta_event, drv_net_fill_forward_path,
+ 	TP_ARGS(local, sdata, sta)
+ );
+ 
++TRACE_EVENT(bss_color_bitmap,
++	TP_PROTO(u8 color,
++		 u64 color_bitmap),
++
++	TP_ARGS(color, color_bitmap),
++
++	TP_STRUCT__entry(
++		__field(u8, color)
++		__field(u64, color_bitmap)
++	),
++
++	TP_fast_assign(
++		__entry->color = color;
++		__entry->color_bitmap = color_bitmap;
++	),
++
++	TP_printk(
++		"color=%u color_bitmap=0x%llx", __entry->color, __entry->color_bitmap
++	)
++);
++
++TRACE_EVENT(bss_color_collision,
++	TP_PROTO(u8 color),
++
++	TP_ARGS(color),
++
++	TP_STRUCT__entry(__field(u8, color)),
++
++	TP_fast_assign(
++		__entry->color = color;
++	),
++
++	TP_printk("collision detected on color %u", __entry->color)
++);
++
+ #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
+ 
+ #undef TRACE_INCLUDE_PATH
+-- 
+2.36.1
+
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0015-mac80211-mtk-aging-color-bitmap.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0015-mac80211-mtk-aging-color-bitmap.patch
new file mode 100644
index 0000000..4ed9142
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0015-mac80211-mtk-aging-color-bitmap.patch
@@ -0,0 +1,126 @@
+From f6cd955e1c042a00691fa80d231495024cfcf7a5 Mon Sep 17 00:00:00 2001
+From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
+Date: Tue, 15 Nov 2022 11:03:22 +0800
+Subject: [PATCH] mac80211: mtk: ageout color bitmap
+
+Adding a periodic work which runs once per second to check BSS color.
+OBSS BSS Color will be ageout if not seen for 10 seconds.
+---
+ include/net/cfg80211.h     |  1 +
+ net/mac80211/cfg.c         | 25 +++++++++++++++++++++++++
+ net/mac80211/ieee80211_i.h |  4 ++++
+ net/mac80211/iface.c       |  5 +++++
+ net/mac80211/rx.c          |  1 +
+ 5 files changed, 36 insertions(+)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index e5175c2..3e826f0 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -308,6 +308,7 @@ struct cfg80211_he_bss_color {
+ 	bool enabled;
+ 	bool partial;
+ 	u64 used_color_bitmap;
++	u64 color_last_seen[64];
+ };
+ 
+ /**
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index a7b6284..f084912 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4425,6 +4425,31 @@ unlock:
+ 	sdata_unlock(sdata);
+ }
+ 
++void ieee80211_color_aging_work(struct work_struct *work)
++{
++	struct ieee80211_sub_if_data *sdata =
++		container_of(work, struct ieee80211_sub_if_data,
++			     color_aging_work.work);
++	struct cfg80211_he_bss_color *he_bss_color = &sdata->vif.bss_conf.he_bss_color;
++	int i = 0;
++
++	sdata_lock(sdata);
++
++	for (i = 0; i < IEEE80211_BSS_COLOR_MAX; i++) {
++		/* ageout if not seen for a period */
++		if ((he_bss_color->used_color_bitmap & BIT_ULL(i)) &&
++		    time_before(he_bss_color->color_last_seen[i],
++			jiffies - IEEE80211_BSS_COLOR_AGEOUT_TIME * HZ)) {
++			he_bss_color->used_color_bitmap &= ~BIT_ULL(i);
++		}
++	}
++
++	ieee80211_queue_delayed_work(&sdata->local->hw,
++				     &sdata->color_aging_work, HZ);
++
++	sdata_unlock(sdata);
++}
++
+ void ieee80211_color_change_finish(struct ieee80211_vif *vif)
+ {
+ 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 6edabd8..415f202 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1033,6 +1033,8 @@ struct ieee80211_sub_if_data {
+ 	} debugfs;
+ #endif
+ 
++	struct delayed_work color_aging_work;
++
+ 	/* must be last, dynamically sized area in this! */
+ 	struct ieee80211_vif vif;
+ };
+@@ -1811,8 +1813,11 @@ void ieee80211_csa_finalize_work(struct work_struct *work);
+ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+ 			     struct cfg80211_csa_settings *params);
+ 
++#define IEEE80211_BSS_COLOR_AGEOUT_TIME	10
++#define IEEE80211_BSS_COLOR_MAX		64
+ /* color change handling */
+ void ieee80211_color_change_finalize_work(struct work_struct *work);
++void ieee80211_color_aging_work(struct work_struct *work);
+ 
+ /* interface handling */
+ #define MAC80211_SUPPORTED_FEATURES_TX	(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 43f6cb0..7f26828 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -466,6 +466,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do
+ 	cancel_work_sync(&sdata->color_change_finalize_work);
+ 
+ 	cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
++	if (sdata->vif.type == NL80211_IFTYPE_AP)
++		cancel_delayed_work_sync(&sdata->color_aging_work);
+ 
+ 	if (sdata->wdev.cac_started) {
+ 		chandef = sdata->vif.bss_conf.chandef;
+@@ -1804,6 +1806,9 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
+ 		skb_queue_head_init(&sdata->u.ap.ps.bc_buf);
+ 		INIT_LIST_HEAD(&sdata->u.ap.vlans);
+ 		sdata->vif.bss_conf.bssid = sdata->vif.addr;
++		INIT_DELAYED_WORK(&sdata->color_aging_work, ieee80211_color_aging_work);
++		ieee80211_queue_delayed_work(&sdata->local->hw,
++					     &sdata->color_aging_work, 0);
+ 		break;
+ 	case NL80211_IFTYPE_P2P_CLIENT:
+ 		type = NL80211_IFTYPE_STATION;
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 789a41b..4a6491c 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3221,6 +3221,7 @@ ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
+ 				      IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
+ 
+ 		bss_conf->he_bss_color.used_color_bitmap |= BIT_ULL(color);
++		bss_conf->he_bss_color.color_last_seen[color] = jiffies;
+ 
+ 		trace_bss_color_bitmap(color,
+ 				       bss_conf->he_bss_color.used_color_bitmap);
+-- 
+2.39.0
+
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0015-nl80211-mtk-Mark-DFS-channel-as-available-for-CSA.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0015-nl80211-mtk-Mark-DFS-channel-as-available-for-CSA.patch
new file mode 100644
index 0000000..eff574e
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0015-nl80211-mtk-Mark-DFS-channel-as-available-for-CSA.patch
@@ -0,0 +1,28 @@
+From 20d6ed31c0e6c15cfbc120bea6a8729121560371 Mon Sep 17 00:00:00 2001
+From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
+Date: Tue, 21 Feb 2023 15:24:09 +0800
+Subject: [PATCH] nl80211: mtk: Mark DFS channel as available for CSA.
+
+---
+ net/wireless/nl80211.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 8dc928d..a02aacb 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3193,6 +3193,11 @@ int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
+ 		return -EINVAL;
+ 	}
+ 
++	/* Use RADAR_BACKGROUND attribute here for skipping CAC */
++	if (info->attrs[NL80211_ATTR_RADAR_BACKGROUND]) {
++		cfg80211_set_dfs_state(&rdev->wiphy, chandef, NL80211_DFS_AVAILABLE);
++	}
++
+ 	if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
+ 				     IEEE80211_CHAN_DISABLED)) {
+ 		NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
index ae088f6..dcebb38 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
@@ -42,6 +42,7 @@
     file://344-v6.1-wifi-cfg80211-fix-ieee80211_data_to_8023_exthdr-hand.patch \
     file://345-v6.1-wifi-mac80211-do-not-drop-packets-smaller-than-the-L.patch \
     file://346-v6.0-wifi-mac80211-fix-mesh-airtime-link-metric-estimatin.patch \
+    file://347-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch \
     file://363-v5.19-bss-color-collision.patch \
     file://364-mac80211-add-support-for-restricting-netdev-features.patch \
     file://400-allow-ibss-mixed.patch \
@@ -57,12 +58,14 @@
     file://mtk-0006-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch \
     file://mtk-0007-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robus.patch \
     file://mtk-0008-mac80211-mtk-make-4addr-null-frames-using-min_rate-f.patch \
-    file://mtk-0009-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch \
     file://mtk-0010-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch \
     file://mtk-0011-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch \
     file://mtk-0012-mac80211-mtk-check-the-control-channel-before-downgr.patch \
     file://mtk-0013-mac80211-mtk-fix-tx-amsdu-aggregation.patch \
+    file://mtk-0014--mac80211-mtk-track-obss-color-bitmap.patch \
     file://mtk-0014-mac80211-mtk-add-sta-assisted-DFS-state-update-mecha.patch \
+    file://mtk-0015-mac80211-mtk-aging-color-bitmap.patch \
+    file://mtk-0015-nl80211-mtk-Mark-DFS-channel-as-available-for-CSA.patch \
     file://mtk-9900-mac80211-mtk-mask-kernel-version-limitation-and-fil.patch \
     file://mtk-9901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch \
     file://mtk-9902-mac80211-mtk-register-.ndo_setup_tc-to-support-wifi2.patch \