if (!avp->assoc)
                        return false;
 
-               skb = ieee80211_nullfunc_get(sc->hw, vif, false);
+               skb = ieee80211_nullfunc_get(sc->hw, vif, -1, false);
                if (!skb)
                        return false;
 
 
                skb_new = ieee80211_proberesp_get(hw, vif);
                break;
        case RSVD_NULL:
-               skb_new = ieee80211_nullfunc_get(hw, vif, false);
+               skb_new = ieee80211_nullfunc_get(hw, vif, -1, false);
                break;
        case RSVD_QOS_NULL:
-               skb_new = ieee80211_nullfunc_get(hw, vif, true);
+               skb_new = ieee80211_nullfunc_get(hw, vif, -1, true);
                break;
        case RSVD_LPS_PG_DPK:
                skb_new = rtw_lps_pg_dpk_get(hw);
 
 
                priv->bss_loss_state++;
 
-               skb = ieee80211_nullfunc_get(priv->hw, priv->vif, false);
+               skb = ieee80211_nullfunc_get(priv->hw, priv->vif, -1, false);
                WARN_ON(!skb);
                if (skb)
                        cw1200_tx(priv->hw, NULL, skb);
                .rate = 0xFF,
        };
 
-       frame.skb = ieee80211_nullfunc_get(priv->hw, priv->vif, false);
+       frame.skb = ieee80211_nullfunc_get(priv->hw, priv->vif,-1, false);
        if (!frame.skb)
                return -ENOMEM;
 
 
                size = sizeof(struct wl12xx_null_data_template);
                ptr = NULL;
        } else {
-               skb = ieee80211_nullfunc_get(wl->hw, wl->vif, false);
+               skb = ieee80211_nullfunc_get(wl->hw, wl->vif, -1, false);
                if (!skb)
                        goto out;
                size = skb->len;
 
        } else {
                skb = ieee80211_nullfunc_get(wl->hw,
                                             wl12xx_wlvif_to_vif(wlvif),
-                                            false);
+                                            -1, false);
                if (!skb)
                        goto out;
                size = skb->len;
        struct sk_buff *skb = NULL;
        int ret = -ENOMEM;
 
-       skb = ieee80211_nullfunc_get(wl->hw, vif, false);
+       skb = ieee80211_nullfunc_get(wl->hw, vif,-1, false);
        if (!skb)
                goto out;
 
 
  * ieee80211_nullfunc_get - retrieve a nullfunc template
  * @hw: pointer obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ * @link_id: If the vif is an MLD, get a frame with the link addresses
+ *     for the given link ID. For a link_id < 0 you get a frame with
+ *     MLD addresses, however useful that might be.
  * @qos_ok: QoS NDP is acceptable to the caller, this should be set
  *     if at all possible
  *
  */
 struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
                                       struct ieee80211_vif *vif,
-                                      bool qos_ok);
+                                      int link_id, bool qos_ok);
 
 /**
  * ieee80211_probereq_get - retrieve a Probe Request template
 
        struct ieee80211_hdr_3addr *nullfunc;
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-       skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif,
-               !ieee80211_hw_check(&local->hw, DOESNT_SUPPORT_QOS_NDP));
+       skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif, -1,
+                                    !ieee80211_hw_check(&local->hw,
+                                                        DOESNT_SUPPORT_QOS_NDP));
        if (!skb)
                return;
 
 
 
 struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
                                       struct ieee80211_vif *vif,
-                                      bool qos_ok)
+                                      int link_id, bool qos_ok)
 {
+       struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+       struct ieee80211_local *local = sdata->local;
+       struct ieee80211_link_data *link = NULL;
        struct ieee80211_hdr_3addr *nullfunc;
-       struct ieee80211_sub_if_data *sdata;
-       struct ieee80211_local *local;
        struct sk_buff *skb;
        bool qos = false;
 
        if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
                return NULL;
 
-       sdata = vif_to_sdata(vif);
-       local = sdata->local;
+       skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+                           sizeof(*nullfunc) + 2);
+       if (!skb)
+               return NULL;
 
+       rcu_read_lock();
        if (qos_ok) {
                struct sta_info *sta;
 
-               rcu_read_lock();
-               sta = sta_info_get(sdata, sdata->deflink.u.mgd.bssid);
+               sta = sta_info_get(sdata, vif->cfg.ap_addr);
                qos = sta && sta->sta.wme;
-               rcu_read_unlock();
        }
 
-       skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-                           sizeof(*nullfunc) + 2);
-       if (!skb)
-               return NULL;
+       if (link_id >= 0) {
+               link = rcu_dereference(sdata->link[link_id]);
+               if (WARN_ON_ONCE(!link)) {
+                       rcu_read_unlock();
+                       kfree_skb(skb);
+                       return NULL;
+               }
+       }
 
        skb_reserve(skb, local->hw.extra_tx_headroom);
 
                skb_put_data(skb, &qoshdr, sizeof(qoshdr));
        }
 
-       memcpy(nullfunc->addr1, sdata->deflink.u.mgd.bssid, ETH_ALEN);
-       memcpy(nullfunc->addr2, vif->addr, ETH_ALEN);
-       memcpy(nullfunc->addr3, sdata->deflink.u.mgd.bssid, ETH_ALEN);
+       if (link) {
+               memcpy(nullfunc->addr1, link->conf->bssid, ETH_ALEN);
+               memcpy(nullfunc->addr2, link->conf->addr, ETH_ALEN);
+               memcpy(nullfunc->addr3, link->conf->bssid, ETH_ALEN);
+       } else {
+               memcpy(nullfunc->addr1, vif->cfg.ap_addr, ETH_ALEN);
+               memcpy(nullfunc->addr2, vif->addr, ETH_ALEN);
+               memcpy(nullfunc->addr3, vif->cfg.ap_addr, ETH_ALEN);
+       }
+       rcu_read_unlock();
 
        return skb;
 }