mac80211: Update to backports-5.10.68

Refresh all patches.
The removed patches were integrated upstream.

This contains fixes for CVE-2020-3702

1. These patches (ath, ath9k, mac80211)  were included in kernel
versions since 4.14.245 and 4.19.205. They fix security vulnerability
CVE-2020-3702 [1] similar to KrØØk, which was found by ESET [2].

Thank you Josef Schlehofer for reporting this problem.

[1] https://nvd.nist.gov/vuln/detail/CVE-2020-3702
[2] https://www.welivesecurity.com/2020/08/06/beyond-kr00k-even-more-wifi-chips-vulnerable-eavesdropping/

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

24 files changed, 82 insertions, 205 deletions

diff --git a/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
index 665231a040..c6fafb77b1 100644
--- a/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
+++ b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
@@ -2,7 +2,7 @@ Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnects
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1288,7 +1288,6 @@ static int ieee80211_stop_ap(struct wiph
+@@ -1307,7 +1307,6 @@ static int ieee80211_stop_ap(struct wiph
  	sdata->vif.bss_conf.ftmr_params = NULL;
  
  	__sta_info_flush(sdata, true);
diff --git a/package/kernel/mac80211/patches/subsys/210-ap_scan.patch b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
index ee49942459..f8c3821c51 100644
--- a/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
+++ b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2444,7 +2444,7 @@ static int ieee80211_scan(struct wiphy *
+@@ -2463,7 +2463,7 @@ static int ieee80211_scan(struct wiphy *
  		 * the  frames sent while scanning on other channel will be
  		 * lost)
  		 */
diff --git a/package/kernel/mac80211/patches/subsys/300-cfg80211-support-immediate-reconnect-request-hint.patch b/package/kernel/mac80211/patches/subsys/300-cfg80211-support-immediate-reconnect-request-hint.patch
index 8fe8723cfe..425b6895b1 100644
--- a/package/kernel/mac80211/patches/subsys/300-cfg80211-support-immediate-reconnect-request-hint.patch
+++ b/package/kernel/mac80211/patches/subsys/300-cfg80211-support-immediate-reconnect-request-hint.patch
@@ -33,7 +33,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
   * cfg80211_rx_unprot_mlme_mgmt - notification of unprotected mlme mgmt frame
 --- a/net/mac80211/mlme.c
 +++ b/net/mac80211/mlme.c
-@@ -2734,7 +2734,7 @@ static void ieee80211_report_disconnect(
+@@ -2725,7 +2725,7 @@ static void ieee80211_report_disconnect(
  	};
  
  	if (tx)
@@ -42,7 +42,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  	else
  		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);
  
-@@ -4724,7 +4724,8 @@ void ieee80211_mgd_quiesce(struct ieee80
+@@ -4719,7 +4719,8 @@ void ieee80211_mgd_quiesce(struct ieee80
  		if (ifmgd->auth_data)
  			ieee80211_destroy_auth_data(sdata, false);
  		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
@@ -152,7 +152,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  };
  
  /* policy for the key attributes */
-@@ -15903,7 +15904,7 @@ static void nl80211_send_mlme_event(stru
+@@ -15902,7 +15903,7 @@ static void nl80211_send_mlme_event(stru
  				    const u8 *buf, size_t len,
  				    enum nl80211_commands cmd, gfp_t gfp,
  				    int uapsd_queues, const u8 *req_ies,
@@ -161,7 +161,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  {
  	struct sk_buff *msg;
  	void *hdr;
-@@ -15925,6 +15926,9 @@ static void nl80211_send_mlme_event(stru
+@@ -15924,6 +15925,9 @@ static void nl80211_send_mlme_event(stru
  	     nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
  		goto nla_put_failure;
  
@@ -171,7 +171,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  	if (uapsd_queues >= 0) {
  		struct nlattr *nla_wmm =
  			nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
-@@ -15953,7 +15957,8 @@ void nl80211_send_rx_auth(struct cfg8021
+@@ -15952,7 +15956,8 @@ void nl80211_send_rx_auth(struct cfg8021
  			  size_t len, gfp_t gfp)
  {
  	nl80211_send_mlme_event(rdev, netdev, buf, len,
@@ -181,7 +181,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  }
  
  void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
-@@ -15963,23 +15968,25 @@ void nl80211_send_rx_assoc(struct cfg802
+@@ -15962,23 +15967,25 @@ void nl80211_send_rx_assoc(struct cfg802
  {
  	nl80211_send_mlme_event(rdev, netdev, buf, len,
  				NL80211_CMD_ASSOCIATE, gfp, uapsd_queues,
@@ -212,7 +212,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  }
  
  void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
-@@ -16010,7 +16017,7 @@ void cfg80211_rx_unprot_mlme_mgmt(struct
+@@ -16009,7 +16016,7 @@ void cfg80211_rx_unprot_mlme_mgmt(struct
  
  	trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
  	nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
diff --git a/package/kernel/mac80211/patches/subsys/301-mac80211-support-driver-based-disconnect-with-reconn.patch b/package/kernel/mac80211/patches/subsys/301-mac80211-support-driver-based-disconnect-with-reconn.patch
index 31621ebf11..cc9602df71 100644
--- a/package/kernel/mac80211/patches/subsys/301-mac80211-support-driver-based-disconnect-with-reconn.patch
+++ b/package/kernel/mac80211/patches/subsys/301-mac80211-support-driver-based-disconnect-with-reconn.patch
@@ -47,7 +47,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  	struct ieee80211_mgd_auth_data *auth_data;
 --- a/net/mac80211/mlme.c
 +++ b/net/mac80211/mlme.c
-@@ -2725,7 +2725,7 @@ EXPORT_SYMBOL(ieee80211_ap_probereq_get)
+@@ -2716,7 +2716,7 @@ EXPORT_SYMBOL(ieee80211_ap_probereq_get)
  
  static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
  					const u8 *buf, size_t len, bool tx,
@@ -56,7 +56,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  {
  	struct ieee80211_event event = {
  		.type = MLME_EVENT,
-@@ -2734,7 +2734,7 @@ static void ieee80211_report_disconnect(
+@@ -2725,7 +2725,7 @@ static void ieee80211_report_disconnect(
  	};
  
  	if (tx)
@@ -65,7 +65,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  	else
  		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);
  
-@@ -2756,13 +2756,18 @@ static void __ieee80211_disconnect(struc
+@@ -2747,13 +2747,18 @@ static void __ieee80211_disconnect(struc
  
  	tx = !sdata->csa_block_tx;
  
@@ -89,7 +89,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  			       tx, frame_buf);
  	mutex_lock(&local->mtx);
  	sdata->vif.csa_active = false;
-@@ -2775,7 +2780,9 @@ static void __ieee80211_disconnect(struc
+@@ -2766,7 +2771,9 @@ static void __ieee80211_disconnect(struc
  	mutex_unlock(&local->mtx);
  
  	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
@@ -100,7 +100,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  
  	sdata_unlock(sdata);
  }
-@@ -2794,6 +2801,13 @@ static void ieee80211_beacon_connection_
+@@ -2785,6 +2792,13 @@ static void ieee80211_beacon_connection_
  		sdata_info(sdata, "Connection to AP %pM lost\n",
  			   ifmgd->bssid);
  		__ieee80211_disconnect(sdata);
@@ -114,7 +114,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  	} else {
  		ieee80211_mgd_probe_ap(sdata, true);
  	}
-@@ -2832,6 +2846,21 @@ void ieee80211_connection_loss(struct ie
+@@ -2823,6 +2837,21 @@ void ieee80211_connection_loss(struct ie
  }
  EXPORT_SYMBOL(ieee80211_connection_loss);
  
@@ -136,7 +136,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  
  static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
  					bool assoc)
-@@ -3135,7 +3164,7 @@ static void ieee80211_rx_mgmt_deauth(str
+@@ -3126,7 +3155,7 @@ static void ieee80211_rx_mgmt_deauth(str
  		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
  
  		ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
@@ -145,7 +145,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  		return;
  	}
  
-@@ -3184,7 +3213,8 @@ static void ieee80211_rx_mgmt_disassoc(s
+@@ -3175,7 +3204,8 @@ static void ieee80211_rx_mgmt_disassoc(s
  
  	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
  
@@ -155,7 +155,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  }
  
  static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
-@@ -4204,7 +4234,8 @@ static void ieee80211_rx_mgmt_beacon(str
+@@ -4199,7 +4229,8 @@ static void ieee80211_rx_mgmt_beacon(str
  				       true, deauth_buf);
  		ieee80211_report_disconnect(sdata, deauth_buf,
  					    sizeof(deauth_buf), true,
@@ -165,7 +165,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  		return;
  	}
  
-@@ -4349,7 +4380,7 @@ static void ieee80211_sta_connection_los
+@@ -4344,7 +4375,7 @@ static void ieee80211_sta_connection_los
  			       tx, frame_buf);
  
  	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
@@ -174,7 +174,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  }
  
  static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
-@@ -5439,7 +5470,8 @@ int ieee80211_mgd_auth(struct ieee80211_
+@@ -5434,7 +5465,8 @@ int ieee80211_mgd_auth(struct ieee80211_
  
  		ieee80211_report_disconnect(sdata, frame_buf,
  					    sizeof(frame_buf), true,
@@ -184,7 +184,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  	}
  
  	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
-@@ -5511,7 +5543,8 @@ int ieee80211_mgd_assoc(struct ieee80211
+@@ -5506,7 +5538,8 @@ int ieee80211_mgd_assoc(struct ieee80211
  
  		ieee80211_report_disconnect(sdata, frame_buf,
  					    sizeof(frame_buf), true,
@@ -194,7 +194,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  	}
  
  	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
-@@ -5810,7 +5843,7 @@ int ieee80211_mgd_deauth(struct ieee8021
+@@ -5809,7 +5842,7 @@ int ieee80211_mgd_deauth(struct ieee8021
  		ieee80211_destroy_auth_data(sdata, false);
  		ieee80211_report_disconnect(sdata, frame_buf,
  					    sizeof(frame_buf), true,
@@ -203,7 +203,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  
  		return 0;
  	}
-@@ -5830,7 +5863,7 @@ int ieee80211_mgd_deauth(struct ieee8021
+@@ -5829,7 +5862,7 @@ int ieee80211_mgd_deauth(struct ieee8021
  		ieee80211_destroy_assoc_data(sdata, false, true);
  		ieee80211_report_disconnect(sdata, frame_buf,
  					    sizeof(frame_buf), true,
@@ -212,7 +212,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  		return 0;
  	}
  
-@@ -5845,7 +5878,7 @@ int ieee80211_mgd_deauth(struct ieee8021
+@@ -5844,7 +5877,7 @@ int ieee80211_mgd_deauth(struct ieee8021
  				       req->reason_code, tx, frame_buf);
  		ieee80211_report_disconnect(sdata, frame_buf,
  					    sizeof(frame_buf), true,
@@ -221,7 +221,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  		return 0;
  	}
  
-@@ -5878,7 +5911,7 @@ int ieee80211_mgd_disassoc(struct ieee80
+@@ -5877,7 +5910,7 @@ int ieee80211_mgd_disassoc(struct ieee80
  			       frame_buf);
  
  	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
diff --git a/package/kernel/mac80211/patches/subsys/302-cfg80211-Add-support-to-configure-SAE-PWE-value-to-d.patch b/package/kernel/mac80211/patches/subsys/302-cfg80211-Add-support-to-configure-SAE-PWE-value-to-d.patch
index acfdae0f5b..da88d1413d 100644
--- a/package/kernel/mac80211/patches/subsys/302-cfg80211-Add-support-to-configure-SAE-PWE-value-to-d.patch
+++ b/package/kernel/mac80211/patches/subsys/302-cfg80211-Add-support-to-configure-SAE-PWE-value-to-d.patch
@@ -59,7 +59,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  	[NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
  };
  
-@@ -9764,6 +9767,12 @@ static int nl80211_crypto_settings(struc
+@@ -9763,6 +9766,12 @@ static int nl80211_crypto_settings(struc
  			nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
  	}
  
diff --git a/package/kernel/mac80211/patches/subsys/311-net-fq_impl-drop-get_default_func-move-default-flow-.patch b/package/kernel/mac80211/patches/subsys/311-net-fq_impl-drop-get_default_func-move-default-flow-.patch
index 33dbb5eb90..6adca7d70d 100644
--- a/package/kernel/mac80211/patches/subsys/311-net-fq_impl-drop-get_default_func-move-default-flow-.patch
+++ b/package/kernel/mac80211/patches/subsys/311-net-fq_impl-drop-get_default_func-move-default-flow-.patch
@@ -132,7 +132,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	codel_vars_init(&txqi->def_cvars);
  	codel_stats_init(&txqi->cstats);
  	__skb_queue_head_init(&txqi->frags);
-@@ -3310,8 +3297,7 @@ static bool ieee80211_amsdu_aggregate(st
+@@ -3332,8 +3319,7 @@ static bool ieee80211_amsdu_aggregate(st
  	 */
  
  	tin = &txqi->tin;
diff --git a/package/kernel/mac80211/patches/subsys/312-net-fq_impl-do-not-maintain-a-backlog-sorted-list-of.patch b/package/kernel/mac80211/patches/subsys/312-net-fq_impl-do-not-maintain-a-backlog-sorted-list-of.patch
index 08e5cbb5b9..793c76abec 100644
--- a/package/kernel/mac80211/patches/subsys/312-net-fq_impl-do-not-maintain-a-backlog-sorted-list-of.patch
+++ b/package/kernel/mac80211/patches/subsys/312-net-fq_impl-do-not-maintain-a-backlog-sorted-list-of.patch
@@ -306,7 +306,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #endif
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -3364,8 +3364,6 @@ out_recalc:
+@@ -3386,8 +3386,6 @@ out_recalc:
  	if (head->len != orig_len) {
  		flow->backlog += head->len - orig_len;
  		tin->backlog_bytes += head->len - orig_len;
diff --git a/package/kernel/mac80211/patches/subsys/315-mac80211-add-rx-decapsulation-offload-support.patch b/package/kernel/mac80211/patches/subsys/315-mac80211-add-rx-decapsulation-offload-support.patch
index b8bb2930f5..49af25eb1d 100644
--- a/package/kernel/mac80211/patches/subsys/315-mac80211-add-rx-decapsulation-offload-support.patch
+++ b/package/kernel/mac80211/patches/subsys/315-mac80211-add-rx-decapsulation-offload-support.patch
@@ -132,7 +132,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #endif /* __MAC80211_DRIVER_OPS */
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -835,7 +835,7 @@ static const struct net_device_ops ieee8
+@@ -856,7 +856,7 @@ static const struct net_device_ops ieee8
  
  };
  
@@ -141,7 +141,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  {
  	switch (iftype) {
  	/* P2P GO and client are mapped to AP/STATION types */
-@@ -855,7 +855,7 @@ static bool ieee80211_set_sdata_offload_
+@@ -876,7 +876,7 @@ static bool ieee80211_set_sdata_offload_
  	flags = sdata->vif.offload_flags;
  
  	if (ieee80211_hw_check(&local->hw, SUPPORTS_TX_ENCAP_OFFLOAD) &&
@@ -150,7 +150,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		flags |= IEEE80211_OFFLOAD_ENCAP_ENABLED;
  
  		if (!ieee80211_hw_check(&local->hw, SUPPORTS_TX_FRAG) &&
-@@ -868,10 +868,21 @@ static bool ieee80211_set_sdata_offload_
+@@ -889,10 +889,21 @@ static bool ieee80211_set_sdata_offload_
  		flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
  	}
  
@@ -172,7 +172,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	return true;
  }
  
-@@ -889,7 +900,7 @@ static void ieee80211_set_vif_encap_ops(
+@@ -910,7 +921,7 @@ static void ieee80211_set_vif_encap_ops(
  	}
  
  	if (!ieee80211_hw_check(&local->hw, SUPPORTS_TX_ENCAP_OFFLOAD) ||
@@ -183,7 +183,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	enabled = bss->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED;
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -4198,7 +4198,9 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4195,7 +4195,9 @@ void ieee80211_check_fast_rx(struct sta_
  		.vif_type = sdata->vif.type,
  		.control_port_protocol = sdata->control_port_protocol,
  	}, *old, *new = NULL;
@@ -193,7 +193,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	/* use sparse to check that we don't return without updating */
  	__acquire(check_fast_rx);
-@@ -4311,6 +4313,17 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4308,6 +4310,17 @@ void ieee80211_check_fast_rx(struct sta_
  	if (assign)
  		new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);
  
@@ -211,7 +211,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	spin_lock_bh(&sta->lock);
  	old = rcu_dereference_protected(sta->fast_rx, true);
  	rcu_assign_pointer(sta->fast_rx, new);
-@@ -4357,6 +4370,108 @@ void ieee80211_check_fast_rx_iface(struc
+@@ -4354,6 +4367,108 @@ void ieee80211_check_fast_rx_iface(struc
  	mutex_unlock(&local->sta_mtx);
  }
  
@@ -320,7 +320,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
  				     struct ieee80211_fast_rx *fast_rx)
  {
-@@ -4377,9 +4492,6 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4374,9 +4489,6 @@ static bool ieee80211_invoke_fast_rx(str
  	} addrs __aligned(2);
  	struct ieee80211_sta_rx_stats *stats = &sta->rx_stats;
  
@@ -330,7 +330,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
  	 * to a common data structure; drivers can implement that per queue
  	 * but we don't have that information in mac80211
-@@ -4453,32 +4565,6 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4450,32 +4562,6 @@ static bool ieee80211_invoke_fast_rx(str
  	    pskb_trim(skb, skb->len - fast_rx->icv_len))
  		goto drop;
  
@@ -363,7 +363,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (rx->key && !ieee80211_has_protected(hdr->frame_control))
  		goto drop;
  
-@@ -4490,12 +4576,6 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4487,12 +4573,6 @@ static bool ieee80211_invoke_fast_rx(str
  		return true;
  	}
  
@@ -376,7 +376,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	/* do the header conversion - first grab the addresses */
  	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
  	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
-@@ -4504,62 +4584,14 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4501,62 +4581,14 @@ static bool ieee80211_invoke_fast_rx(str
  	/* push the addresses in front */
  	memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
  
@@ -443,7 +443,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	stats->dropped++;
  	return true;
  }
-@@ -4613,6 +4645,47 @@ static bool ieee80211_prepare_and_rx_han
+@@ -4610,6 +4642,47 @@ static bool ieee80211_prepare_and_rx_han
  	return true;
  }
  
@@ -491,7 +491,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  /*
   * This is the actual Rx frames handler. as it belongs to Rx path it must
   * be called with rcu_read_lock protection.
-@@ -4850,15 +4923,20 @@ void ieee80211_rx_list(struct ieee80211_
+@@ -4847,15 +4920,20 @@ void ieee80211_rx_list(struct ieee80211_
  	 * if it was previously present.
  	 * Also, frames with less than 16 bytes are dropped.
  	 */
diff --git a/package/kernel/mac80211/patches/subsys/316-mac80211-enable-QoS-support-for-nl80211-ctrl-port.patch b/package/kernel/mac80211/patches/subsys/316-mac80211-enable-QoS-support-for-nl80211-ctrl-port.patch
index 4be011ffec..43ac9a0cef 100644
--- a/package/kernel/mac80211/patches/subsys/316-mac80211-enable-QoS-support-for-nl80211-ctrl-port.patch
+++ b/package/kernel/mac80211/patches/subsys/316-mac80211-enable-QoS-support-for-nl80211-ctrl-port.patch
@@ -69,7 +69,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  			tx->sta = sta_info_get_bss(sdata, hdr->addr1);
  		}
  		if (!tx->sta && !is_multicast_ether_addr(hdr->addr1))
-@@ -5421,6 +5419,7 @@ int ieee80211_tx_control_port(struct wip
+@@ -5443,6 +5441,7 @@ int ieee80211_tx_control_port(struct wip
  {
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	struct ieee80211_local *local = sdata->local;
@@ -77,7 +77,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  	struct sk_buff *skb;
  	struct ethhdr *ehdr;
  	u32 ctrl_flags = 0;
-@@ -5443,8 +5442,7 @@ int ieee80211_tx_control_port(struct wip
+@@ -5465,8 +5464,7 @@ int ieee80211_tx_control_port(struct wip
  	if (cookie)
  		ctrl_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
  
@@ -87,7 +87,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  
  	skb = dev_alloc_skb(local->hw.extra_tx_headroom +
  			    sizeof(struct ethhdr) + len);
-@@ -5461,10 +5459,25 @@ int ieee80211_tx_control_port(struct wip
+@@ -5483,10 +5481,25 @@ int ieee80211_tx_control_port(struct wip
  	ehdr->h_proto = proto;
  
  	skb->dev = dev;
diff --git a/package/kernel/mac80211/patches/subsys/320-mac80211_hwsim-add-6GHz-channels.patch b/package/kernel/mac80211/patches/subsys/320-mac80211_hwsim-add-6GHz-channels.patch
index a7c09f00bc..cbc55c9381 100644
--- a/package/kernel/mac80211/patches/subsys/320-mac80211_hwsim-add-6GHz-channels.patch
+++ b/package/kernel/mac80211/patches/subsys/320-mac80211_hwsim-add-6GHz-channels.patch
@@ -102,7 +102,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  	struct ieee80211_channel channels_s1g[ARRAY_SIZE(hwsim_channels_s1g)];
  	struct ieee80211_rate rates[ARRAY_SIZE(hwsim_rates)];
  	struct ieee80211_iface_combination if_combination;
-@@ -578,7 +647,8 @@ struct mac80211_hwsim_data {
+@@ -579,7 +648,8 @@ struct mac80211_hwsim_data {
  		struct ieee80211_channel *channel;
  		unsigned long next_start, start, end;
  	} survey_data[ARRAY_SIZE(hwsim_channels_2ghz) +
@@ -112,7 +112,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  
  	struct ieee80211_channel *channel;
  	u64 beacon_int	/* beacon interval in us */;
-@@ -3149,6 +3219,8 @@ static int mac80211_hwsim_new_radio(stru
+@@ -3172,6 +3242,8 @@ static int mac80211_hwsim_new_radio(stru
  		sizeof(hwsim_channels_2ghz));
  	memcpy(data->channels_5ghz, hwsim_channels_5ghz,
  		sizeof(hwsim_channels_5ghz));
diff --git a/package/kernel/mac80211/patches/subsys/321-mac80211_hwsim-make-6-GHz-channels-usable.patch b/package/kernel/mac80211/patches/subsys/321-mac80211_hwsim-make-6-GHz-channels-usable.patch
index 4bac10eefe..c21d4446ab 100644
--- a/package/kernel/mac80211/patches/subsys/321-mac80211_hwsim-make-6-GHz-channels-usable.patch
+++ b/package/kernel/mac80211/patches/subsys/321-mac80211_hwsim-make-6-GHz-channels-usable.patch
@@ -11,7 +11,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/mac80211_hwsim.c
 +++ b/drivers/net/wireless/mac80211_hwsim.c
-@@ -2968,15 +2968,19 @@ static void mac80211_hwsim_he_capab(stru
+@@ -2990,15 +2990,19 @@ static void mac80211_hwsim_he_capab(stru
  {
  	u16 n_iftype_data;
  
@@ -34,7 +34,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		return;
  	}
  
-@@ -3265,6 +3269,12 @@ static int mac80211_hwsim_new_radio(stru
+@@ -3288,6 +3292,12 @@ static int mac80211_hwsim_new_radio(stru
  			sband->vht_cap.vht_mcs.tx_mcs_map =
  				sband->vht_cap.vht_mcs.rx_mcs_map;
  			break;
@@ -47,7 +47,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		case NL80211_BAND_S1GHZ:
  			memcpy(&sband->s1g_cap, &hwsim_s1g_cap,
  			       sizeof(sband->s1g_cap));
-@@ -3275,6 +3285,13 @@ static int mac80211_hwsim_new_radio(stru
+@@ -3298,6 +3308,13 @@ static int mac80211_hwsim_new_radio(stru
  			continue;
  		}
  
@@ -61,7 +61,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		sband->ht_cap.ht_supported = true;
  		sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
  				    IEEE80211_HT_CAP_GRN_FLD |
-@@ -3288,10 +3305,6 @@ static int mac80211_hwsim_new_radio(stru
+@@ -3311,10 +3328,6 @@ static int mac80211_hwsim_new_radio(stru
  		sband->ht_cap.mcs.rx_mask[0] = 0xff;
  		sband->ht_cap.mcs.rx_mask[1] = 0xff;
  		sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
diff --git a/package/kernel/mac80211/patches/subsys/371-mac80211-don-t-apply-flow-control-on-management-fram.patch b/package/kernel/mac80211/patches/subsys/371-mac80211-don-t-apply-flow-control-on-management-fram.patch
index 8d094a3632..3ce6ceacd5 100644
--- a/package/kernel/mac80211/patches/subsys/371-mac80211-don-t-apply-flow-control-on-management-fram.patch
+++ b/package/kernel/mac80211/patches/subsys/371-mac80211-don-t-apply-flow-control-on-management-fram.patch
@@ -48,7 +48,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  	spin_unlock_bh(&fq->lock);
  }
  
-@@ -3844,6 +3853,9 @@ bool ieee80211_txq_airtime_check(struct
+@@ -3866,6 +3875,9 @@ bool ieee80211_txq_airtime_check(struct
  	if (!txq->sta)
  		return true;
  
diff --git a/package/kernel/mac80211/patches/subsys/372-mac80211-set-sk_pacing_shift-for-802.3-txpath.patch b/package/kernel/mac80211/patches/subsys/372-mac80211-set-sk_pacing_shift-for-802.3-txpath.patch
index 5bc1469a3f..c8f3047a34 100644
--- a/package/kernel/mac80211/patches/subsys/372-mac80211-set-sk_pacing_shift-for-802.3-txpath.patch
+++ b/package/kernel/mac80211/patches/subsys/372-mac80211-set-sk_pacing_shift-for-802.3-txpath.patch
@@ -9,7 +9,7 @@ Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4171,6 +4171,9 @@ static bool ieee80211_tx_8023(struct iee
+@@ -4193,6 +4193,9 @@ static bool ieee80211_tx_8023(struct iee
  	unsigned long flags;
  	int q = info->hw_queue;
  
diff --git a/package/kernel/mac80211/patches/subsys/374-mac80211-move-A-MPDU-session-check-from-minstrel_ht-.patch b/package/kernel/mac80211/patches/subsys/374-mac80211-move-A-MPDU-session-check-from-minstrel_ht-.patch
index 031f8e1636..07f5bb5263 100644
--- a/package/kernel/mac80211/patches/subsys/374-mac80211-move-A-MPDU-session-check-from-minstrel_ht-.patch
+++ b/package/kernel/mac80211/patches/subsys/374-mac80211-move-A-MPDU-session-check-from-minstrel_ht-.patch
@@ -25,7 +25,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  struct rate_control_ops {
 --- a/net/mac80211/rc80211_minstrel_ht.c
 +++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -1153,29 +1153,6 @@ minstrel_downgrade_prob_rate(struct mins
+@@ -1144,29 +1144,6 @@ minstrel_downgrade_prob_rate(struct mins
  }
  
  static void
@@ -55,7 +55,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
                        void *priv_sta, struct ieee80211_tx_status *st)
  {
-@@ -1477,10 +1454,6 @@ minstrel_ht_get_rate(void *priv, struct
+@@ -1461,10 +1438,6 @@ minstrel_ht_get_rate(void *priv, struct
  	struct minstrel_priv *mp = priv;
  	u16 sample_idx;
  
@@ -66,7 +66,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	info->flags |= mi->tx_flags;
  
  #ifdef CPTCFG_MAC80211_DEBUGFS
-@@ -1894,6 +1867,7 @@ static u32 minstrel_ht_get_expected_thro
+@@ -1870,6 +1843,7 @@ static u32 minstrel_ht_get_expected_thro
  
  static const struct rate_control_ops mac80211_minstrel_ht = {
  	.name = "minstrel_ht",
@@ -76,7 +76,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	.rate_init = minstrel_ht_rate_init,
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -3931,6 +3931,29 @@ void ieee80211_txq_schedule_start(struct
+@@ -3953,6 +3953,29 @@ void ieee80211_txq_schedule_start(struct
  }
  EXPORT_SYMBOL(ieee80211_txq_schedule_start);
  
@@ -106,7 +106,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  void __ieee80211_subif_start_xmit(struct sk_buff *skb,
  				  struct net_device *dev,
  				  u32 info_flags,
-@@ -3961,6 +3984,8 @@ void __ieee80211_subif_start_xmit(struct
+@@ -3983,6 +4006,8 @@ void __ieee80211_subif_start_xmit(struct
  		skb_get_hash(skb);
  	}
  
@@ -115,7 +115,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (sta) {
  		struct ieee80211_fast_tx *fast_tx;
  
-@@ -4224,6 +4249,8 @@ static void ieee80211_8023_xmit(struct i
+@@ -4246,6 +4271,8 @@ static void ieee80211_8023_xmit(struct i
  
  	memset(info, 0, sizeof(*info));
  
diff --git a/package/kernel/mac80211/patches/subsys/375-mac80211-call-ieee80211_tx_h_rate_ctrl-when-dequeue.patch b/package/kernel/mac80211/patches/subsys/375-mac80211-call-ieee80211_tx_h_rate_ctrl-when-dequeue.patch
index cf84fca68a..26f7f59296 100644
--- a/package/kernel/mac80211/patches/subsys/375-mac80211-call-ieee80211_tx_h_rate_ctrl-when-dequeue.patch
+++ b/package/kernel/mac80211/patches/subsys/375-mac80211-call-ieee80211_tx_h_rate_ctrl-when-dequeue.patch
@@ -29,7 +29,7 @@ Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
  	CALL_TXH(ieee80211_tx_h_michael_mic_add);
  	CALL_TXH(ieee80211_tx_h_sequence);
  	CALL_TXH(ieee80211_tx_h_fragment);
-@@ -3382,15 +3383,21 @@ out:
+@@ -3404,15 +3405,21 @@ out:
   * Can be called while the sta lock is held. Anything that can cause packets to
   * be generated will cause deadlock!
   */
@@ -55,7 +55,7 @@ Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
  	if (key)
  		info->control.hw_key = &key->conf;
  
-@@ -3439,6 +3446,8 @@ static void ieee80211_xmit_fast_finish(s
+@@ -3461,6 +3468,8 @@ static void ieee80211_xmit_fast_finish(s
  			break;
  		}
  	}
@@ -64,7 +64,7 @@ Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
  }
  
  static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
-@@ -3542,24 +3551,17 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3564,24 +3573,17 @@ static bool ieee80211_xmit_fast(struct i
  	tx.sta = sta;
  	tx.key = fast_tx->key;
  
@@ -97,7 +97,7 @@ Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
  		sdata = container_of(sdata->bss,
-@@ -3670,8 +3672,12 @@ begin:
+@@ -3692,8 +3694,12 @@ begin:
  		    (tx.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV))
  			pn_offs = ieee80211_hdrlen(hdr->frame_control);
  
diff --git a/package/kernel/mac80211/patches/subsys/376-mac80211-add-rate-control-support-for-encap-offload.patch b/package/kernel/mac80211/patches/subsys/376-mac80211-add-rate-control-support-for-encap-offload.patch
index f22b0d9849..5d390990cd 100644
--- a/package/kernel/mac80211/patches/subsys/376-mac80211-add-rate-control-support-for-encap-offload.patch
+++ b/package/kernel/mac80211/patches/subsys/376-mac80211-add-rate-control-support-for-encap-offload.patch
@@ -81,7 +81,7 @@ Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
  			tx->sta->tx_stats.last_rate = txrc.reported_rate;
  	} else if (tx->sta)
  		tx->sta->tx_stats.last_rate = txrc.reported_rate;
-@@ -3660,8 +3662,16 @@ begin:
+@@ -3682,8 +3684,16 @@ begin:
  	else
  		info->flags &= ~IEEE80211_TX_CTL_AMPDU;
  
@@ -101,7 +101,7 @@ Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
  		struct sta_info *sta = container_of(txq->sta, struct sta_info,
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -6728,4 +6728,22 @@ struct sk_buff *ieee80211_get_fils_disco
+@@ -6733,4 +6733,22 @@ struct sk_buff *ieee80211_get_fils_disco
  struct sk_buff *
  ieee80211_get_unsol_bcast_probe_resp_tmpl(struct ieee80211_hw *hw,
  					  struct ieee80211_vif *vif);
diff --git a/package/kernel/mac80211/patches/subsys/377-mac80211-minstrel_ht-fix-sample-time-check.patch b/package/kernel/mac80211/patches/subsys/377-mac80211-minstrel_ht-fix-sample-time-check.patch
index d4b327c69c..054662f3ef 100644
--- a/package/kernel/mac80211/patches/subsys/377-mac80211-minstrel_ht-fix-sample-time-check.patch
+++ b/package/kernel/mac80211/patches/subsys/377-mac80211-minstrel_ht-fix-sample-time-check.patch
@@ -12,7 +12,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/rc80211_minstrel_ht.c
 +++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -1466,7 +1466,7 @@ minstrel_ht_get_rate(void *priv, struct
+@@ -1450,7 +1450,7 @@ minstrel_ht_get_rate(void *priv, struct
  	    (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO))
  		return;
  
diff --git a/package/kernel/mac80211/patches/subsys/378-mac80211-remove-iwlwifi-specific-workaround-that-bro.patch b/package/kernel/mac80211/patches/subsys/378-mac80211-remove-iwlwifi-specific-workaround-that-bro.patch
deleted file mode 100644
index a5ad377e6f..0000000000
--- a/package/kernel/mac80211/patches/subsys/378-mac80211-remove-iwlwifi-specific-workaround-that-bro.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 19 Jun 2021 12:10:14 +0200
-Subject: [PATCH] mac80211: remove iwlwifi specific workaround that broke sta
- NDP tx
-
-Sending nulldata packets is important for sw AP link probing and detecting
-4-address mode links. The checks that dropped these packets were apparently
-added to work around an iwlwifi firmware bug with multi-TID aggregation.
-
-Fixes: 41cbb0f5a295 ("mac80211: add support for HE")
-Cc: stable@vger.kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
-+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
-@@ -1085,6 +1085,9 @@ static int iwl_mvm_tx_mpdu(struct iwl_mv
- 	if (WARN_ON_ONCE(mvmsta->sta_id == IWL_MVM_INVALID_STA))
- 		return -1;
- 
-+	if (unlikely(ieee80211_is_any_nullfunc(fc)) && sta->he_cap.has_he)
-+		return -1;
-+
- 	if (unlikely(ieee80211_is_probe_resp(fc)))
- 		iwl_mvm_probe_resp_set_noa(mvm, skb);
- 
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -1094,11 +1094,6 @@ void ieee80211_send_nullfunc(struct ieee
- 	struct ieee80211_hdr_3addr *nullfunc;
- 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
- 
--	/* Don't send NDPs when STA is connected HE */
--	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
--	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
--		return;
--
- 	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif,
- 		!ieee80211_hw_check(&local->hw, DOESNT_SUPPORT_QOS_NDP));
- 	if (!skb)
-@@ -1130,10 +1125,6 @@ static void ieee80211_send_4addr_nullfun
- 	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
- 		return;
- 
--	/* Don't send NDPs when connected HE */
--	if (!(sdata->u.mgd.flags & IEEE80211_STA_DISABLE_HE))
--		return;
--
- 	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
- 	if (!skb)
- 		return;
diff --git a/package/kernel/mac80211/patches/subsys/379-mac80211-fix-starting-aggregation-sessions-on-mesh-i.patch b/package/kernel/mac80211/patches/subsys/379-mac80211-fix-starting-aggregation-sessions-on-mesh-i.patch
index 2ad083f150..c7902d6542 100644
--- a/package/kernel/mac80211/patches/subsys/379-mac80211-fix-starting-aggregation-sessions-on-mesh-i.patch
+++ b/package/kernel/mac80211/patches/subsys/379-mac80211-fix-starting-aggregation-sessions-on-mesh-i.patch
@@ -80,7 +80,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		if (tid_tx) {
  			bool queued;
  
-@@ -3947,29 +3977,6 @@ void ieee80211_txq_schedule_start(struct
+@@ -3969,29 +3999,6 @@ void ieee80211_txq_schedule_start(struct
  }
  EXPORT_SYMBOL(ieee80211_txq_schedule_start);
  
diff --git a/package/kernel/mac80211/patches/subsys/380-mac80211-introduce-aql_enable-node-in-debugfs.patch b/package/kernel/mac80211/patches/subsys/380-mac80211-introduce-aql_enable-node-in-debugfs.patch
index b21b671c10..073782188a 100644
--- a/package/kernel/mac80211/patches/subsys/380-mac80211-introduce-aql_enable-node-in-debugfs.patch
+++ b/package/kernel/mac80211/patches/subsys/380-mac80211-introduce-aql_enable-node-in-debugfs.patch
@@ -90,7 +90,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  	 * don't cast (use the static inlines below), but we keep
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -3887,6 +3887,8 @@ void __ieee80211_schedule_txq(struct iee
+@@ -3909,6 +3909,8 @@ void __ieee80211_schedule_txq(struct iee
  }
  EXPORT_SYMBOL(__ieee80211_schedule_txq);
  
@@ -99,7 +99,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,
  				 struct ieee80211_txq *txq)
  {
-@@ -3896,6 +3898,9 @@ bool ieee80211_txq_airtime_check(struct
+@@ -3918,6 +3920,9 @@ bool ieee80211_txq_airtime_check(struct
  	if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
  		return true;
  
diff --git a/package/kernel/mac80211/patches/subsys/382-mac80211-Switch-to-a-virtual-time-based-airtime-sche.patch b/package/kernel/mac80211/patches/subsys/382-mac80211-Switch-to-a-virtual-time-based-airtime-sche.patch
index ba78f7a142..2fe12771c0 100644
--- a/package/kernel/mac80211/patches/subsys/382-mac80211-Switch-to-a-virtual-time-based-airtime-sche.patch
+++ b/package/kernel/mac80211/patches/subsys/382-mac80211-Switch-to-a-virtual-time-based-airtime-sche.patch
@@ -50,7 +50,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -6552,9 +6552,6 @@ static inline void ieee80211_txq_schedul
+@@ -6557,9 +6557,6 @@ static inline void ieee80211_txq_schedul
  {
  }
  
@@ -60,7 +60,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  /**
   * ieee80211_schedule_txq - schedule a TXQ for transmission
   *
-@@ -6567,11 +6564,7 @@ void __ieee80211_schedule_txq(struct iee
+@@ -6572,11 +6569,7 @@ void __ieee80211_schedule_txq(struct iee
   * The driver may call this function if it has buffered packets for
   * this TXQ internally.
   */
@@ -73,7 +73,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  
  /**
   * ieee80211_return_txq - return a TXQ previously acquired by ieee80211_next_txq()
-@@ -6583,12 +6576,8 @@ ieee80211_schedule_txq(struct ieee80211_
+@@ -6588,12 +6581,8 @@ ieee80211_schedule_txq(struct ieee80211_
   * The driver may set force=true if it has buffered packets for this TXQ
   * internally.
   */
@@ -90,7 +90,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
   * ieee80211_txq_may_transmit - check whether TXQ is allowed to transmit
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1442,6 +1442,38 @@ static void sta_apply_mesh_params(struct
+@@ -1461,6 +1461,38 @@ static void sta_apply_mesh_params(struct
  #endif
  }
  
@@ -129,7 +129,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  static int sta_apply_parameters(struct ieee80211_local *local,
  				struct sta_info *sta,
  				struct station_parameters *params)
-@@ -1629,7 +1661,8 @@ static int sta_apply_parameters(struct i
+@@ -1648,7 +1680,8 @@ static int sta_apply_parameters(struct i
  		sta_apply_mesh_params(local, sta, params);
  
  	if (params->airtime_weight)
@@ -590,7 +590,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -2067,6 +2067,9 @@ int ieee80211_if_add(struct ieee80211_lo
+@@ -2088,6 +2088,9 @@ int ieee80211_if_add(struct ieee80211_lo
  		}
  	}
  
@@ -655,7 +655,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  	}
  
  	for (i = 0; i < IEEE80211_NUM_TIDS; i++)
-@@ -1898,24 +1894,59 @@ void ieee80211_sta_set_buffered(struct i
+@@ -1893,24 +1889,59 @@ void ieee80211_sta_set_buffered(struct i
  }
  EXPORT_SYMBOL(ieee80211_sta_set_buffered);
  
@@ -727,7 +727,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  }
  EXPORT_SYMBOL(ieee80211_sta_register_airtime);
  
-@@ -2364,7 +2395,7 @@ void sta_set_sinfo(struct sta_info *sta,
+@@ -2354,7 +2385,7 @@ void sta_set_sinfo(struct sta_info *sta,
  	}
  
  	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT))) {
@@ -839,7 +839,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  }
  
  void ieee80211_txq_set_params(struct ieee80211_local *local)
-@@ -3797,102 +3796,259 @@ EXPORT_SYMBOL(ieee80211_tx_dequeue);
+@@ -3819,102 +3818,259 @@ EXPORT_SYMBOL(ieee80211_tx_dequeue);
  struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
  {
  	struct ieee80211_local *local = hw_to_local(hw);
@@ -1161,7 +1161,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  	struct ieee80211_local *local = hw_to_local(hw);
  
  	if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
-@@ -3907,15 +4063,12 @@ bool ieee80211_txq_airtime_check(struct
+@@ -3929,15 +4085,12 @@ bool ieee80211_txq_airtime_check(struct
  	if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
  		return true;
  
@@ -1179,7 +1179,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  		return true;
  
  	return false;
-@@ -3925,60 +4078,59 @@ EXPORT_SYMBOL(ieee80211_txq_airtime_chec
+@@ -3947,60 +4100,59 @@ EXPORT_SYMBOL(ieee80211_txq_airtime_chec
  bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
  				struct ieee80211_txq *txq)
  {
diff --git a/package/kernel/mac80211/patches/subsys/383-mac80211-fix-enabling-4-address-mode-on-a-sta-vif-af.patch b/package/kernel/mac80211/patches/subsys/383-mac80211-fix-enabling-4-address-mode-on-a-sta-vif-af.patch
deleted file mode 100644
index c1f77ff5d9..0000000000
--- a/package/kernel/mac80211/patches/subsys/383-mac80211-fix-enabling-4-address-mode-on-a-sta-vif-af.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 2 Jul 2021 06:57:53 +0200
-Subject: [PATCH] mac80211: fix enabling 4-address mode on a sta vif after
- assoc
-
-Notify the driver about the 4-address mode change and also send a nulldata
-packet to the AP to notify it about the change
-
-Fixes: 1ff4e8f2dec8 ("mac80211: notify the driver when a sta uses 4-address mode")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -152,6 +152,8 @@ static int ieee80211_change_iface(struct
- 				  struct vif_params *params)
- {
- 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-+	struct ieee80211_local *local = sdata->local;
-+	struct sta_info *sta;
- 	int ret;
- 
- 	ret = ieee80211_if_change_type(sdata, type);
-@@ -162,7 +164,24 @@ static int ieee80211_change_iface(struct
- 		RCU_INIT_POINTER(sdata->u.vlan.sta, NULL);
- 		ieee80211_check_fast_rx_iface(sdata);
- 	} else if (type == NL80211_IFTYPE_STATION && params->use_4addr >= 0) {
-+		struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-+
-+		if (params->use_4addr == ifmgd->use_4addr)
-+			return 0;
-+
- 		sdata->u.mgd.use_4addr = params->use_4addr;
-+		if (!ifmgd->associated)
-+			return 0;
-+
-+		mutex_lock(&local->sta_mtx);
-+		sta = sta_info_get(sdata, ifmgd->bssid);
-+		if (sta)
-+			drv_sta_set_4addr(local, sdata, &sta->sta,
-+					  params->use_4addr);
-+		mutex_unlock(&local->sta_mtx);
-+
-+		if (params->use_4addr)
-+			ieee80211_send_4addr_nullfunc(local, sdata);
- 	}
- 
- 	if (sdata->vif.type == NL80211_IFTYPE_MONITOR) {
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -2215,6 +2215,8 @@ void ieee80211_dynamic_ps_timer(struct t
- void ieee80211_send_nullfunc(struct ieee80211_local *local,
- 			     struct ieee80211_sub_if_data *sdata,
- 			     bool powersave);
-+void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
-+				   struct ieee80211_sub_if_data *sdata);
- void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
- 			     struct ieee80211_hdr *hdr, bool ack, u16 tx_time);
- 
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -1115,8 +1115,8 @@ void ieee80211_send_nullfunc(struct ieee
- 	ieee80211_tx_skb(sdata, skb);
- }
- 
--static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
--					  struct ieee80211_sub_if_data *sdata)
-+void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
-+				   struct ieee80211_sub_if_data *sdata)
- {
- 	struct sk_buff *skb;
- 	struct ieee80211_hdr *nullfunc;
diff --git a/package/kernel/mac80211/patches/subsys/384-nl80211-add-common-API-to-configure-SAR-power-limita.patch b/package/kernel/mac80211/patches/subsys/384-nl80211-add-common-API-to-configure-SAR-power-limita.patch
index 0c9ae3595d..a47e29794c 100644
--- a/package/kernel/mac80211/patches/subsys/384-nl80211-add-common-API-to-configure-SAR-power-limita.patch
+++ b/package/kernel/mac80211/patches/subsys/384-nl80211-add-common-API-to-configure-SAR-power-limita.patch
@@ -222,7 +222,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  
  		/* done */
  		state->split_start = 0;
-@@ -14713,6 +14783,111 @@ static void nl80211_post_doit(__genl_con
+@@ -14712,6 +14782,111 @@ static void nl80211_post_doit(__genl_con
  	}
  }
  
@@ -334,7 +334,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  static __genl_const struct genl_ops nl80211_ops[] = {
  	{
  		.cmd = NL80211_CMD_GET_WIPHY,
-@@ -15576,6 +15751,14 @@ static const struct genl_small_ops nl802
+@@ -15575,6 +15750,14 @@ static const struct genl_small_ops nl802
  		.internal_flags = NL80211_FLAG_NEED_NETDEV |
  				  NL80211_FLAG_NEED_RTNL,
  	},
diff --git a/package/kernel/mac80211/patches/subsys/386-mac80211-check-per-vif-offload_flags-in-Tx-path.patch b/package/kernel/mac80211/patches/subsys/386-mac80211-check-per-vif-offload_flags-in-Tx-path.patch
index cfad1c3927..c2cc16cd48 100644
--- a/package/kernel/mac80211/patches/subsys/386-mac80211-check-per-vif-offload_flags-in-Tx-path.patch
+++ b/package/kernel/mac80211/patches/subsys/386-mac80211-check-per-vif-offload_flags-in-Tx-path.patch
@@ -14,7 +14,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -3309,6 +3309,9 @@ static bool ieee80211_amsdu_aggregate(st
+@@ -3331,6 +3331,9 @@ static bool ieee80211_amsdu_aggregate(st
  	if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
  		return false;