mac80211: sync nl80211.h with upstream and backport a WPA3 related commit

Fixes compatibility issues with the latest hostapd update

Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 91abeebd3bd29a98de516e49260d61165096009a)

5 files changed, 657 insertions, 33 deletions

diff --git a/package/kernel/mac80211/patches/subsys/010-sync-nl80211_h.patch b/package/kernel/mac80211/patches/subsys/010-sync-nl80211_h.patch
new file mode 100644
index 0000000000..e1f66ac1c3
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/010-sync-nl80211_h.patch
@@ -0,0 +1,297 @@
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -655,6 +655,9 @@
+  *	When a security association was established on an 802.1X network using
+  *	fast transition, this event should be followed by an
+  *	%NL80211_CMD_PORT_AUTHORIZED event.
++ *	Following a %NL80211_CMD_ROAM event userspace can issue
++ *	%NL80211_CMD_GET_SCAN in order to obtain the scan information for the
++ *	new BSS the card/driver roamed to.
+  * @NL80211_CMD_DISCONNECT: drop a given connection; also used to notify
+  *	userspace that a connection was dropped by the AP or due to other
+  *	reasons, for this the %NL80211_ATTR_DISCONNECTED_BY_AP and
+@@ -757,7 +760,8 @@
+  *	of any other interfaces, and other interfaces will again take
+  *	precedence when they are used.
+  *
+- * @NL80211_CMD_SET_WDS_PEER: Set the MAC address of the peer on a WDS interface.
++ * @NL80211_CMD_SET_WDS_PEER: Set the MAC address of the peer on a WDS interface
++ *	(no longer supported).
+  *
+  * @NL80211_CMD_SET_MULTICAST_TO_UNICAST: Configure if this AP should perform
+  *	multicast to unicast conversion. When enabled, all multicast packets
+@@ -1177,6 +1181,10 @@
+  *	includes the contents of the frame. %NL80211_ATTR_ACK flag is included
+  *	if the recipient acknowledged the frame.
+  *
++ * @NL80211_CMD_SET_SAR_SPECS: SAR power limitation configuration is
++ *	passed using %NL80211_ATTR_SAR_SPEC. %NL80211_ATTR_WIPHY is used to
++ *	specify the wiphy index to be applied to.
++ *
+  * @NL80211_CMD_MAX: highest used command number
+  * @__NL80211_CMD_AFTER_LAST: internal use
+  */
+@@ -1407,6 +1415,8 @@ enum nl80211_commands {
+ 
+ 	NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS,
+ 
++	NL80211_CMD_SET_SAR_SPECS,
++
+ 	/* add new commands above here */
+ 
+ 	/* used to define NL80211_CMD_MAX below */
+@@ -1750,8 +1760,9 @@ enum nl80211_commands {
+  *	specify just a single bitrate, which is to be used for the beacon.
+  *	The driver must also specify support for this with the extended
+  *	features NL80211_EXT_FEATURE_BEACON_RATE_LEGACY,
+- *	NL80211_EXT_FEATURE_BEACON_RATE_HT and
+- *	NL80211_EXT_FEATURE_BEACON_RATE_VHT.
++ *	NL80211_EXT_FEATURE_BEACON_RATE_HT,
++ *	NL80211_EXT_FEATURE_BEACON_RATE_VHT and
++ *	NL80211_EXT_FEATURE_BEACON_RATE_HE.
+  *
+  * @NL80211_ATTR_FRAME_MATCH: A binary attribute which typically must contain
+  *	at least one byte, currently used with @NL80211_CMD_REGISTER_FRAME.
+@@ -1955,8 +1966,15 @@ enum nl80211_commands {
+  * @NL80211_ATTR_PROBE_RESP: Probe Response template data. Contains the entire
+  *	probe-response frame. The DA field in the 802.11 header is zero-ed out,
+  *	to be filled by the FW.
+- * @NL80211_ATTR_DISABLE_HT:  Force HT capable interfaces to disable
+- *      this feature.  Currently, only supported in mac80211 drivers.
++ * @NL80211_ATTR_DISABLE_HT: Force HT capable interfaces to disable
++ *      this feature during association. This is a flag attribute.
++ *	Currently only supported in mac80211 drivers.
++ * @NL80211_ATTR_DISABLE_VHT: Force VHT capable interfaces to disable
++ *      this feature during association. This is a flag attribute.
++ *	Currently only supported in mac80211 drivers.
++ * @NL80211_ATTR_DISABLE_HE: Force HE capable interfaces to disable
++ *      this feature during association. This is a flag attribute.
++ *	Currently only supported in mac80211 drivers.
+  * @NL80211_ATTR_HT_CAPABILITY_MASK: Specify which bits of the
+  *      ATTR_HT_CAPABILITY to which attention should be paid.
+  *      Currently, only mac80211 NICs support this feature.
+@@ -2077,7 +2095,8 @@ enum nl80211_commands {
+  *	until the channel switch event.
+  * @NL80211_ATTR_CH_SWITCH_BLOCK_TX: flag attribute specifying that transmission
+  *	must be blocked on the current channel (before the channel switch
+- *	operation).
++ *	operation). Also included in the channel switch started event if quiet
++ *	was requested by the AP.
+  * @NL80211_ATTR_CSA_IES: Nested set of attributes containing the IE information
+  *	for the time while performing a channel switch.
+  * @NL80211_ATTR_CNTDWN_OFFS_BEACON: An array of offsets (u16) to the channel
+@@ -2527,6 +2546,20 @@ enum nl80211_commands {
+  *	override mask. Used with NL80211_ATTR_S1G_CAPABILITY in
+  *	NL80211_CMD_ASSOCIATE or NL80211_CMD_CONNECT.
+  *
++ * @NL80211_ATTR_SAE_PWE: Indicates the mechanism(s) allowed for SAE PWE
++ *	derivation in WPA3-Personal networks which are using SAE authentication.
++ *	This is a u8 attribute that encapsulates one of the values from
++ *	&enum nl80211_sae_pwe_mechanism.
++ *
++ * @NL80211_ATTR_SAR_SPEC: SAR power limitation specification when
++ *	used with %NL80211_CMD_SET_SAR_SPECS. The message contains fields
++ *	of %nl80211_sar_attrs which specifies the sar type and related
++ *	sar specs. Sar specs contains array of %nl80211_sar_specs_attrs.
++ *
++ * @NL80211_ATTR_RECONNECT_REQUESTED: flag attribute, used with deauth and
++ *	disassoc events to indicate that an immediate reconnect to the AP
++ *	is desired.
++ *
+  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
+  * @NL80211_ATTR_MAX: highest attribute number currently defined
+  * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -3016,6 +3049,14 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_S1G_CAPABILITY,
+ 	NL80211_ATTR_S1G_CAPABILITY_MASK,
+ 
++	NL80211_ATTR_SAE_PWE,
++
++	NL80211_ATTR_RECONNECT_REQUESTED,
++
++	NL80211_ATTR_SAR_SPEC,
++
++	NL80211_ATTR_DISABLE_HE,
++
+ 	/* add attributes here, update the policy in nl80211.c */
+ 
+ 	__NL80211_ATTR_AFTER_LAST,
+@@ -5896,6 +5937,19 @@ enum nl80211_feature_flags {
+  * @NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP: Driver/device supports
+  *	unsolicited broadcast probe response transmission
+  *
++ * @NL80211_EXT_FEATURE_BEACON_RATE_HE: Driver supports beacon rate
++ *	configuration (AP/mesh) with HE rates.
++ *
++ * @NL80211_EXT_FEATURE_SECURE_LTF: Device supports secure LTF measurement
++ *      exchange protocol.
++ *
++ * @NL80211_EXT_FEATURE_SECURE_RTT: Device supports secure RTT measurement
++ *      exchange protocol.
++ *
++ * @NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE: Device supports management
++ *      frame protection for all management frames exchanged during the
++ *      negotiation and range measurement procedure.
++ *
+  * @NUM_NL80211_EXT_FEATURES: number of extended features.
+  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
+  */
+@@ -5956,6 +6010,10 @@ enum nl80211_ext_feature_index {
+ 	NL80211_EXT_FEATURE_SAE_OFFLOAD_AP,
+ 	NL80211_EXT_FEATURE_FILS_DISCOVERY,
+ 	NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP,
++	NL80211_EXT_FEATURE_BEACON_RATE_HE,
++	NL80211_EXT_FEATURE_SECURE_LTF,
++	NL80211_EXT_FEATURE_SECURE_RTT,
++	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
+ 
+ 	/* add new features before the definition below */
+ 	NUM_NL80211_EXT_FEATURES,
+@@ -6253,11 +6311,13 @@ struct nl80211_vendor_cmd_info {
+  * @NL80211_TDLS_PEER_HT: TDLS peer is HT capable.
+  * @NL80211_TDLS_PEER_VHT: TDLS peer is VHT capable.
+  * @NL80211_TDLS_PEER_WMM: TDLS peer is WMM capable.
++ * @NL80211_TDLS_PEER_HE: TDLS peer is HE capable.
+  */
+ enum nl80211_tdls_peer_capability {
+ 	NL80211_TDLS_PEER_HT = 1<<0,
+ 	NL80211_TDLS_PEER_VHT = 1<<1,
+ 	NL80211_TDLS_PEER_WMM = 1<<2,
++	NL80211_TDLS_PEER_HE = 1<<3,
+ };
+ 
+ /**
+@@ -6849,6 +6909,9 @@ enum nl80211_peer_measurement_ftm_capa {
+  *      if neither %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED nor
+  *	%NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set, EDCA based
+  *	ranging will be used.
++ * @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK: negotiate for LMR feedback. Only
++ *	valid if either %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED or
++ *	%NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
+  *
+  * @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal
+  * @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number
+@@ -6867,6 +6930,7 @@ enum nl80211_peer_measurement_ftm_req {
+ 	NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC,
+ 	NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED,
+ 	NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED,
++	NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK,
+ 
+ 	/* keep last */
+ 	NUM_NL80211_PMSR_FTM_REQ_ATTR,
+@@ -7124,4 +7188,115 @@ enum nl80211_unsol_bcast_probe_resp_attr
+ 	NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX =
+ 		__NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_LAST - 1
+ };
++
++/**
++ * enum nl80211_sae_pwe_mechanism - The mechanism(s) allowed for SAE PWE
++ *	derivation. Applicable only when WPA3-Personal SAE authentication is
++ *	used.
++ *
++ * @NL80211_SAE_PWE_UNSPECIFIED: not specified, used internally to indicate that
++ *	attribute is not present from userspace.
++ * @NL80211_SAE_PWE_HUNT_AND_PECK: hunting-and-pecking loop only
++ * @NL80211_SAE_PWE_HASH_TO_ELEMENT: hash-to-element only
++ * @NL80211_SAE_PWE_BOTH: both hunting-and-pecking loop and hash-to-element
++ *	can be used.
++ */
++enum nl80211_sae_pwe_mechanism {
++	NL80211_SAE_PWE_UNSPECIFIED,
++	NL80211_SAE_PWE_HUNT_AND_PECK,
++	NL80211_SAE_PWE_HASH_TO_ELEMENT,
++	NL80211_SAE_PWE_BOTH,
++};
++
++/**
++ * enum nl80211_sar_type - type of SAR specs
++ *
++ * @NL80211_SAR_TYPE_POWER: power limitation specified in 0.25dBm unit
++ *
++ */
++enum nl80211_sar_type {
++	NL80211_SAR_TYPE_POWER,
++
++	/* add new type here */
++
++	/* Keep last */
++	NUM_NL80211_SAR_TYPE,
++};
++
++/**
++ * enum nl80211_sar_attrs - Attributes for SAR spec
++ *
++ * @NL80211_SAR_ATTR_TYPE: the SAR type as defined in &enum nl80211_sar_type.
++ *
++ * @NL80211_SAR_ATTR_SPECS: Nested array of SAR power
++ *	limit specifications. Each specification contains a set
++ *	of %nl80211_sar_specs_attrs.
++ *
++ *	For SET operation, it contains array of %NL80211_SAR_ATTR_SPECS_POWER
++ *	and %NL80211_SAR_ATTR_SPECS_RANGE_INDEX.
++ *
++ *	For sar_capa dump, it contains array of
++ *	%NL80211_SAR_ATTR_SPECS_START_FREQ
++ *	and %NL80211_SAR_ATTR_SPECS_END_FREQ.
++ *
++ * @__NL80211_SAR_ATTR_LAST: Internal
++ * @NL80211_SAR_ATTR_MAX: highest sar attribute
++ *
++ * These attributes are used with %NL80211_CMD_SET_SAR_SPEC
++ */
++enum nl80211_sar_attrs {
++	__NL80211_SAR_ATTR_INVALID,
++
++	NL80211_SAR_ATTR_TYPE,
++	NL80211_SAR_ATTR_SPECS,
++
++	__NL80211_SAR_ATTR_LAST,
++	NL80211_SAR_ATTR_MAX = __NL80211_SAR_ATTR_LAST - 1,
++};
++
++/**
++ * enum nl80211_sar_specs_attrs - Attributes for SAR power limit specs
++ *
++ * @NL80211_SAR_ATTR_SPECS_POWER: Required (s32)value to specify the actual
++ *	power limit value in units of 0.25 dBm if type is
++ *	NL80211_SAR_TYPE_POWER. (i.e., a value of 44 represents 11 dBm).
++ *	0 means userspace doesn't have SAR limitation on this associated range.
++ *
++ * @NL80211_SAR_ATTR_SPECS_RANGE_INDEX: Required (u32) value to specify the
++ *	index of exported freq range table and the associated power limitation
++ *	is applied to this range.
++ *
++ *	Userspace isn't required to set all the ranges advertised by WLAN driver,
++ *	and userspace can skip some certain ranges. These skipped ranges don't
++ *	have SAR limitations, and they are same as setting the
++ *	%NL80211_SAR_ATTR_SPECS_POWER to any unreasonable high value because any
++ *	value higher than regulatory allowed value just means SAR power
++ *	limitation is removed, but it's required to set at least one range.
++ *	It's not allowed to set duplicated range in one SET operation.
++ *
++ *	Every SET operation overwrites previous SET operation.
++ *
++ * @NL80211_SAR_ATTR_SPECS_START_FREQ: Required (u32) value to specify the start
++ *	frequency of this range edge when registering SAR capability to wiphy.
++ *	It's not a channel center frequency. The unit is kHz.
++ *
++ * @NL80211_SAR_ATTR_SPECS_END_FREQ: Required (u32) value to specify the end
++ *	frequency of this range edge when registering SAR capability to wiphy.
++ *	It's not a channel center frequency. The unit is kHz.
++ *
++ * @__NL80211_SAR_ATTR_SPECS_LAST: Internal
++ * @NL80211_SAR_ATTR_SPECS_MAX: highest sar specs attribute
++ */
++enum nl80211_sar_specs_attrs {
++	__NL80211_SAR_ATTR_SPECS_INVALID,
++
++	NL80211_SAR_ATTR_SPECS_POWER,
++	NL80211_SAR_ATTR_SPECS_RANGE_INDEX,
++	NL80211_SAR_ATTR_SPECS_START_FREQ,
++	NL80211_SAR_ATTR_SPECS_END_FREQ,
++
++	__NL80211_SAR_ATTR_SPECS_LAST,
++	NL80211_SAR_ATTR_SPECS_MAX = __NL80211_SAR_ATTR_SPECS_LAST - 1,
++};
++
+ #endif /* __LINUX_NL80211_H */
diff --git a/package/kernel/mac80211/patches/subsys/300-cfg80211-support-immediate-reconnect-request-hint.patch b/package/kernel/mac80211/patches/subsys/300-cfg80211-support-immediate-reconnect-request-hint.patch
index 7c442429cf..8fe8723cfe 100644
--- a/package/kernel/mac80211/patches/subsys/300-cfg80211-support-immediate-reconnect-request-hint.patch
+++ b/package/kernel/mac80211/patches/subsys/300-cfg80211-support-immediate-reconnect-request-hint.patch
@@ -31,28 +31,6 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  
  /**
   * cfg80211_rx_unprot_mlme_mgmt - notification of unprotected mlme mgmt frame
---- a/include/uapi/linux/nl80211.h
-+++ b/include/uapi/linux/nl80211.h
-@@ -2527,6 +2527,10 @@ enum nl80211_commands {
-  *	override mask. Used with NL80211_ATTR_S1G_CAPABILITY in
-  *	NL80211_CMD_ASSOCIATE or NL80211_CMD_CONNECT.
-  *
-+ * @NL80211_ATTR_RECONNECT_REQUESTED: flag attribute, used with deauth and
-+ *	disassoc events to indicate that an immediate reconnect to the AP
-+ *	is desired.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3016,6 +3020,8 @@ enum nl80211_attrs {
- 	NL80211_ATTR_S1G_CAPABILITY,
- 	NL80211_ATTR_S1G_CAPABILITY_MASK,
- 
-+	NL80211_ATTR_RECONNECT_REQUESTED,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/mlme.c
 +++ b/net/mac80211/mlme.c
 @@ -2734,7 +2734,7 @@ static void ieee80211_report_disconnect(
diff --git a/package/kernel/mac80211/patches/subsys/302-cfg80211-Add-support-to-configure-SAE-PWE-value-to-d.patch b/package/kernel/mac80211/patches/subsys/302-cfg80211-Add-support-to-configure-SAE-PWE-value-to-d.patch
new file mode 100644
index 0000000000..acfdae0f5b
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/302-cfg80211-Add-support-to-configure-SAE-PWE-value-to-d.patch
@@ -0,0 +1,74 @@
+From: Rohan Dutta <drohan@codeaurora.org>
+Date: Tue, 27 Oct 2020 12:09:10 +0200
+Subject: [PATCH] cfg80211: Add support to configure SAE PWE value to drivers
+
+Add support to configure SAE PWE preference from userspace to drivers in
+both AP and STA modes. This is needed for cases where the driver takes
+care of Authentication frame processing (SME in the driver) so that
+correct enforcement of the acceptable PWE derivation mechanism can be
+performed.
+
+The userspace applications can pass the sae_pwe value using the
+NL80211_ATTR_SAE_PWE attribute in the NL80211_CMD_CONNECT and
+NL80211_CMD_START_AP commands to the driver. This allows selection
+between the hunting-and-pecking loop and hash-to-element options for PWE
+derivation. For backwards compatibility, this new attribute is optional
+and if not included, the driver is notified of the value being
+unspecified.
+
+Signed-off-by: Rohan Dutta <drohan@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Link: https://lore.kernel.org/r/20201027100910.22283-1-jouni@codeaurora.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -1009,6 +1009,14 @@ struct survey_info {
+  * @sae_pwd: password for SAE authentication (for devices supporting SAE
+  *	offload)
+  * @sae_pwd_len: length of SAE password (for devices supporting SAE offload)
++ * @sae_pwe: The mechanisms allowed for SAE PWE derivation
++ *	NL80211_SAE_PWE_UNSPECIFIED: Not-specified, used to indicate userspace
++ *		did not specify any preference. The driver should follow its
++ *		internal policy in such a scenario.
++ *	NL80211_SAE_PWE_HUNT_AND_PECK: Allow hunting-and-pecking loop only
++ *	NL80211_SAE_PWE_HASH_TO_ELEMENT: Allow hash-to-element only
++ *	NL80211_SAE_PWE_BOTH: Allow either hunting-and-pecking loop
++ *		or hash-to-element
+  */
+ struct cfg80211_crypto_settings {
+ 	u32 wpa_versions;
+@@ -1027,6 +1035,7 @@ struct cfg80211_crypto_settings {
+ 	const u8 *psk;
+ 	const u8 *sae_pwd;
+ 	u8 sae_pwd_len;
++	enum nl80211_sae_pwe_mechanism sae_pwe;
+ };
+ 
+ /**
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -736,6 +736,9 @@ static const struct nla_policy nl80211_p
+ 		NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
+ 	[NL80211_ATTR_S1G_CAPABILITY_MASK] =
+ 		NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
++	[NL80211_ATTR_SAE_PWE] =
++		NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
++				 NL80211_SAE_PWE_BOTH),
+ 	[NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
+ };
+ 
+@@ -9764,6 +9767,12 @@ static int nl80211_crypto_settings(struc
+ 			nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
+ 	}
+ 
++	if (info->attrs[NL80211_ATTR_SAE_PWE])
++		settings->sae_pwe =
++			nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]);
++	else
++		settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED;
++
+ 	return 0;
+ }
+ 
diff --git a/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch
index eb967f77d7..febe42eb9d 100644
--- a/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch
+++ b/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch
@@ -1,6 +1,6 @@
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -3736,6 +3736,7 @@ struct mgmt_frame_regs {
+@@ -3745,6 +3745,7 @@ struct mgmt_frame_regs {
   *	(as advertised by the nl80211 feature flag.)
   * @get_tx_power: store the current TX power into the dbm variable;
   *	return 0 if successful
@@ -8,7 +8,7 @@
   *
   * @set_wds_peer: set the WDS peer for a WDS interface
   *
-@@ -4058,6 +4059,7 @@ struct cfg80211_ops {
+@@ -4067,6 +4068,7 @@ struct cfg80211_ops {
  				enum nl80211_tx_power_setting type, int mbm);
  	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
  				int *dbm);
@@ -36,7 +36,7 @@
  	u8 ps_dtim_period;
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -2531,6 +2531,9 @@ enum nl80211_commands {
+@@ -2560,6 +2560,9 @@ enum nl80211_commands {
   *	disassoc events to indicate that an immediate reconnect to the AP
   *	is desired.
   *
@@ -46,9 +46,9 @@
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
   * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3022,6 +3025,8 @@ enum nl80211_attrs {
+@@ -3057,6 +3060,8 @@ enum nl80211_attrs {
  
- 	NL80211_ATTR_RECONNECT_REQUESTED,
+ 	NL80211_ATTR_DISABLE_HE,
  
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
 +
@@ -129,15 +129,15 @@
  	local->hw.max_mtu = IEEE80211_MAX_DATA_LEN;
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -737,6 +737,7 @@ static const struct nla_policy nl80211_p
- 	[NL80211_ATTR_S1G_CAPABILITY_MASK] =
- 		NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
+@@ -740,6 +740,7 @@ static const struct nla_policy nl80211_p
+ 		NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
+ 				 NL80211_SAE_PWE_BOTH),
  	[NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
 +	[NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
  };
  
  /* policy for the key attributes */
-@@ -3245,6 +3246,20 @@ static int nl80211_set_wiphy(struct sk_b
+@@ -3248,6 +3249,20 @@ static int nl80211_set_wiphy(struct sk_b
  		if (result)
  			return result;
  	}
diff --git a/package/network/utils/iw/patches/001-nl80211_h_sync.patch b/package/network/utils/iw/patches/001-nl80211_h_sync.patch
index 5aa3cd5146..1d6ea0fae0 100644
--- a/package/network/utils/iw/patches/001-nl80211_h_sync.patch
+++ b/package/network/utils/iw/patches/001-nl80211_h_sync.patch
@@ -1,9 +1,99 @@
 --- a/nl80211.h
 +++ b/nl80211.h
-@@ -2527,6 +2527,13 @@ enum nl80211_commands {
+@@ -655,6 +655,9 @@
+  *	When a security association was established on an 802.1X network using
+  *	fast transition, this event should be followed by an
+  *	%NL80211_CMD_PORT_AUTHORIZED event.
++ *	Following a %NL80211_CMD_ROAM event userspace can issue
++ *	%NL80211_CMD_GET_SCAN in order to obtain the scan information for the
++ *	new BSS the card/driver roamed to.
+  * @NL80211_CMD_DISCONNECT: drop a given connection; also used to notify
+  *	userspace that a connection was dropped by the AP or due to other
+  *	reasons, for this the %NL80211_ATTR_DISCONNECTED_BY_AP and
+@@ -757,7 +760,8 @@
+  *	of any other interfaces, and other interfaces will again take
+  *	precedence when they are used.
+  *
+- * @NL80211_CMD_SET_WDS_PEER: Set the MAC address of the peer on a WDS interface.
++ * @NL80211_CMD_SET_WDS_PEER: Set the MAC address of the peer on a WDS interface
++ *	(no longer supported).
+  *
+  * @NL80211_CMD_SET_MULTICAST_TO_UNICAST: Configure if this AP should perform
+  *	multicast to unicast conversion. When enabled, all multicast packets
+@@ -1177,6 +1181,10 @@
+  *	includes the contents of the frame. %NL80211_ATTR_ACK flag is included
+  *	if the recipient acknowledged the frame.
+  *
++ * @NL80211_CMD_SET_SAR_SPECS: SAR power limitation configuration is
++ *	passed using %NL80211_ATTR_SAR_SPEC. %NL80211_ATTR_WIPHY is used to
++ *	specify the wiphy index to be applied to.
++ *
+  * @NL80211_CMD_MAX: highest used command number
+  * @__NL80211_CMD_AFTER_LAST: internal use
+  */
+@@ -1407,6 +1415,8 @@ enum nl80211_commands {
+ 
+ 	NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS,
+ 
++	NL80211_CMD_SET_SAR_SPECS,
++
+ 	/* add new commands above here */
+ 
+ 	/* used to define NL80211_CMD_MAX below */
+@@ -1750,8 +1760,9 @@ enum nl80211_commands {
+  *	specify just a single bitrate, which is to be used for the beacon.
+  *	The driver must also specify support for this with the extended
+  *	features NL80211_EXT_FEATURE_BEACON_RATE_LEGACY,
+- *	NL80211_EXT_FEATURE_BEACON_RATE_HT and
+- *	NL80211_EXT_FEATURE_BEACON_RATE_VHT.
++ *	NL80211_EXT_FEATURE_BEACON_RATE_HT,
++ *	NL80211_EXT_FEATURE_BEACON_RATE_VHT and
++ *	NL80211_EXT_FEATURE_BEACON_RATE_HE.
+  *
+  * @NL80211_ATTR_FRAME_MATCH: A binary attribute which typically must contain
+  *	at least one byte, currently used with @NL80211_CMD_REGISTER_FRAME.
+@@ -1955,8 +1966,15 @@ enum nl80211_commands {
+  * @NL80211_ATTR_PROBE_RESP: Probe Response template data. Contains the entire
+  *	probe-response frame. The DA field in the 802.11 header is zero-ed out,
+  *	to be filled by the FW.
+- * @NL80211_ATTR_DISABLE_HT:  Force HT capable interfaces to disable
+- *      this feature.  Currently, only supported in mac80211 drivers.
++ * @NL80211_ATTR_DISABLE_HT: Force HT capable interfaces to disable
++ *      this feature during association. This is a flag attribute.
++ *	Currently only supported in mac80211 drivers.
++ * @NL80211_ATTR_DISABLE_VHT: Force VHT capable interfaces to disable
++ *      this feature during association. This is a flag attribute.
++ *	Currently only supported in mac80211 drivers.
++ * @NL80211_ATTR_DISABLE_HE: Force HE capable interfaces to disable
++ *      this feature during association. This is a flag attribute.
++ *	Currently only supported in mac80211 drivers.
+  * @NL80211_ATTR_HT_CAPABILITY_MASK: Specify which bits of the
+  *      ATTR_HT_CAPABILITY to which attention should be paid.
+  *      Currently, only mac80211 NICs support this feature.
+@@ -2077,7 +2095,8 @@ enum nl80211_commands {
+  *	until the channel switch event.
+  * @NL80211_ATTR_CH_SWITCH_BLOCK_TX: flag attribute specifying that transmission
+  *	must be blocked on the current channel (before the channel switch
+- *	operation).
++ *	operation). Also included in the channel switch started event if quiet
++ *	was requested by the AP.
+  * @NL80211_ATTR_CSA_IES: Nested set of attributes containing the IE information
+  *	for the time while performing a channel switch.
+  * @NL80211_ATTR_CNTDWN_OFFS_BEACON: An array of offsets (u16) to the channel
+@@ -2527,6 +2546,23 @@ enum nl80211_commands {
   *	override mask. Used with NL80211_ATTR_S1G_CAPABILITY in
   *	NL80211_CMD_ASSOCIATE or NL80211_CMD_CONNECT.
   *
++ * @NL80211_ATTR_SAE_PWE: Indicates the mechanism(s) allowed for SAE PWE
++ *	derivation in WPA3-Personal networks which are using SAE authentication.
++ *	This is a u8 attribute that encapsulates one of the values from
++ *	&enum nl80211_sae_pwe_mechanism.
++ *
++ * @NL80211_ATTR_SAR_SPEC: SAR power limitation specification when
++ *	used with %NL80211_CMD_SET_SAR_SPECS. The message contains fields
++ *	of %nl80211_sar_attrs which specifies the sar type and related
++ *	sar specs. Sar specs contains array of %nl80211_sar_specs_attrs.
++ *
 + * @NL80211_ATTR_RECONNECT_REQUESTED: flag attribute, used with deauth and
 + *	disassoc events to indicate that an immediate reconnect to the AP
 + *	is desired.
@@ -14,14 +104,199 @@
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
   * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3016,6 +3023,10 @@ enum nl80211_attrs {
+@@ -3016,6 +3052,16 @@ enum nl80211_attrs {
  	NL80211_ATTR_S1G_CAPABILITY,
  	NL80211_ATTR_S1G_CAPABILITY_MASK,
  
++	NL80211_ATTR_SAE_PWE,
++
 +	NL80211_ATTR_RECONNECT_REQUESTED,
 +
++	NL80211_ATTR_SAR_SPEC,
++
++	NL80211_ATTR_DISABLE_HE,
++
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
 +
  	/* add attributes here, update the policy in nl80211.c */
  
  	__NL80211_ATTR_AFTER_LAST,
+@@ -5896,6 +5942,19 @@ enum nl80211_feature_flags {
+  * @NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP: Driver/device supports
+  *	unsolicited broadcast probe response transmission
+  *
++ * @NL80211_EXT_FEATURE_BEACON_RATE_HE: Driver supports beacon rate
++ *	configuration (AP/mesh) with HE rates.
++ *
++ * @NL80211_EXT_FEATURE_SECURE_LTF: Device supports secure LTF measurement
++ *      exchange protocol.
++ *
++ * @NL80211_EXT_FEATURE_SECURE_RTT: Device supports secure RTT measurement
++ *      exchange protocol.
++ *
++ * @NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE: Device supports management
++ *      frame protection for all management frames exchanged during the
++ *      negotiation and range measurement procedure.
++ *
+  * @NUM_NL80211_EXT_FEATURES: number of extended features.
+  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
+  */
+@@ -5956,6 +6015,10 @@ enum nl80211_ext_feature_index {
+ 	NL80211_EXT_FEATURE_SAE_OFFLOAD_AP,
+ 	NL80211_EXT_FEATURE_FILS_DISCOVERY,
+ 	NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP,
++	NL80211_EXT_FEATURE_BEACON_RATE_HE,
++	NL80211_EXT_FEATURE_SECURE_LTF,
++	NL80211_EXT_FEATURE_SECURE_RTT,
++	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
+ 
+ 	/* add new features before the definition below */
+ 	NUM_NL80211_EXT_FEATURES,
+@@ -6253,11 +6316,13 @@ struct nl80211_vendor_cmd_info {
+  * @NL80211_TDLS_PEER_HT: TDLS peer is HT capable.
+  * @NL80211_TDLS_PEER_VHT: TDLS peer is VHT capable.
+  * @NL80211_TDLS_PEER_WMM: TDLS peer is WMM capable.
++ * @NL80211_TDLS_PEER_HE: TDLS peer is HE capable.
+  */
+ enum nl80211_tdls_peer_capability {
+ 	NL80211_TDLS_PEER_HT = 1<<0,
+ 	NL80211_TDLS_PEER_VHT = 1<<1,
+ 	NL80211_TDLS_PEER_WMM = 1<<2,
++	NL80211_TDLS_PEER_HE = 1<<3,
+ };
+ 
+ /**
+@@ -6849,6 +6914,9 @@ enum nl80211_peer_measurement_ftm_capa {
+  *      if neither %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED nor
+  *	%NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set, EDCA based
+  *	ranging will be used.
++ * @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK: negotiate for LMR feedback. Only
++ *	valid if either %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED or
++ *	%NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
+  *
+  * @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal
+  * @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number
+@@ -6867,6 +6935,7 @@ enum nl80211_peer_measurement_ftm_req {
+ 	NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC,
+ 	NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED,
+ 	NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED,
++	NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK,
+ 
+ 	/* keep last */
+ 	NUM_NL80211_PMSR_FTM_REQ_ATTR,
+@@ -7124,4 +7193,115 @@ enum nl80211_unsol_bcast_probe_resp_attr
+ 	NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX =
+ 		__NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_LAST - 1
+ };
++
++/**
++ * enum nl80211_sae_pwe_mechanism - The mechanism(s) allowed for SAE PWE
++ *	derivation. Applicable only when WPA3-Personal SAE authentication is
++ *	used.
++ *
++ * @NL80211_SAE_PWE_UNSPECIFIED: not specified, used internally to indicate that
++ *	attribute is not present from userspace.
++ * @NL80211_SAE_PWE_HUNT_AND_PECK: hunting-and-pecking loop only
++ * @NL80211_SAE_PWE_HASH_TO_ELEMENT: hash-to-element only
++ * @NL80211_SAE_PWE_BOTH: both hunting-and-pecking loop and hash-to-element
++ *	can be used.
++ */
++enum nl80211_sae_pwe_mechanism {
++	NL80211_SAE_PWE_UNSPECIFIED,
++	NL80211_SAE_PWE_HUNT_AND_PECK,
++	NL80211_SAE_PWE_HASH_TO_ELEMENT,
++	NL80211_SAE_PWE_BOTH,
++};
++
++/**
++ * enum nl80211_sar_type - type of SAR specs
++ *
++ * @NL80211_SAR_TYPE_POWER: power limitation specified in 0.25dBm unit
++ *
++ */
++enum nl80211_sar_type {
++	NL80211_SAR_TYPE_POWER,
++
++	/* add new type here */
++
++	/* Keep last */
++	NUM_NL80211_SAR_TYPE,
++};
++
++/**
++ * enum nl80211_sar_attrs - Attributes for SAR spec
++ *
++ * @NL80211_SAR_ATTR_TYPE: the SAR type as defined in &enum nl80211_sar_type.
++ *
++ * @NL80211_SAR_ATTR_SPECS: Nested array of SAR power
++ *	limit specifications. Each specification contains a set
++ *	of %nl80211_sar_specs_attrs.
++ *
++ *	For SET operation, it contains array of %NL80211_SAR_ATTR_SPECS_POWER
++ *	and %NL80211_SAR_ATTR_SPECS_RANGE_INDEX.
++ *
++ *	For sar_capa dump, it contains array of
++ *	%NL80211_SAR_ATTR_SPECS_START_FREQ
++ *	and %NL80211_SAR_ATTR_SPECS_END_FREQ.
++ *
++ * @__NL80211_SAR_ATTR_LAST: Internal
++ * @NL80211_SAR_ATTR_MAX: highest sar attribute
++ *
++ * These attributes are used with %NL80211_CMD_SET_SAR_SPEC
++ */
++enum nl80211_sar_attrs {
++	__NL80211_SAR_ATTR_INVALID,
++
++	NL80211_SAR_ATTR_TYPE,
++	NL80211_SAR_ATTR_SPECS,
++
++	__NL80211_SAR_ATTR_LAST,
++	NL80211_SAR_ATTR_MAX = __NL80211_SAR_ATTR_LAST - 1,
++};
++
++/**
++ * enum nl80211_sar_specs_attrs - Attributes for SAR power limit specs
++ *
++ * @NL80211_SAR_ATTR_SPECS_POWER: Required (s32)value to specify the actual
++ *	power limit value in units of 0.25 dBm if type is
++ *	NL80211_SAR_TYPE_POWER. (i.e., a value of 44 represents 11 dBm).
++ *	0 means userspace doesn't have SAR limitation on this associated range.
++ *
++ * @NL80211_SAR_ATTR_SPECS_RANGE_INDEX: Required (u32) value to specify the
++ *	index of exported freq range table and the associated power limitation
++ *	is applied to this range.
++ *
++ *	Userspace isn't required to set all the ranges advertised by WLAN driver,
++ *	and userspace can skip some certain ranges. These skipped ranges don't
++ *	have SAR limitations, and they are same as setting the
++ *	%NL80211_SAR_ATTR_SPECS_POWER to any unreasonable high value because any
++ *	value higher than regulatory allowed value just means SAR power
++ *	limitation is removed, but it's required to set at least one range.
++ *	It's not allowed to set duplicated range in one SET operation.
++ *
++ *	Every SET operation overwrites previous SET operation.
++ *
++ * @NL80211_SAR_ATTR_SPECS_START_FREQ: Required (u32) value to specify the start
++ *	frequency of this range edge when registering SAR capability to wiphy.
++ *	It's not a channel center frequency. The unit is kHz.
++ *
++ * @NL80211_SAR_ATTR_SPECS_END_FREQ: Required (u32) value to specify the end
++ *	frequency of this range edge when registering SAR capability to wiphy.
++ *	It's not a channel center frequency. The unit is kHz.
++ *
++ * @__NL80211_SAR_ATTR_SPECS_LAST: Internal
++ * @NL80211_SAR_ATTR_SPECS_MAX: highest sar specs attribute
++ */
++enum nl80211_sar_specs_attrs {
++	__NL80211_SAR_ATTR_SPECS_INVALID,
++
++	NL80211_SAR_ATTR_SPECS_POWER,
++	NL80211_SAR_ATTR_SPECS_RANGE_INDEX,
++	NL80211_SAR_ATTR_SPECS_START_FREQ,
++	NL80211_SAR_ATTR_SPECS_END_FREQ,
++
++	__NL80211_SAR_ATTR_SPECS_LAST,
++	NL80211_SAR_ATTR_SPECS_MAX = __NL80211_SAR_ATTR_SPECS_LAST - 1,
++};
++
+ #endif /* __LINUX_NL80211_H */