diff --git a/recipes-wifi/atenl/files/iwpriv.sh b/recipes-wifi/atenl/files/iwpriv.sh
index f606f74..c711126 100644
--- a/recipes-wifi/atenl/files/iwpriv.sh
+++ b/recipes-wifi/atenl/files/iwpriv.sh
@@ -972,6 +972,26 @@
     echo "  mwctl <interface> dump phy_capa"
 }
 
+function register_handler {
+
+	local phy_idx=$1
+	local offset=$2
+	local val=$3
+	local cmd=$4
+	local w_cmd="write"
+
+	regidx=/sys/kernel/debug/ieee80211/phy${phy_idx}/mt76/regidx
+	regval=/sys/kernel/debug/ieee80211/phy${phy_idx}/mt76/regval
+
+	echo ${offset} > ${regidx}
+	if [[ "${cmd}" == "${w_cmd}" ]]; then
+		echo ${val} > ${regval}
+	fi
+
+	res=$(cat ${regval} | cut -d 'x' -f 2)
+	printf "%s       mac:[%s]:%s\n" ${interface_ori} ${offset} ${res}
+}
+
 # main start here
 
 if [ -z ${interface} ]; then
@@ -1157,19 +1177,29 @@
     fi
 
 elif [ "${cmd_type}" = "mac" ]; then
-    regidx=/sys/kernel/debug/ieee80211/phy${phy_idx}/mt76/regidx
-    regval=/sys/kernel/debug/ieee80211/phy${phy_idx}/mt76/regval
     offset=$(printf "0x%s" ${cmd})
     val=$(printf "0x%s" ${param})
 
-    echo ${offset} > ${regidx}
     # reg write
     if [[ ${full_cmd} == *"="* ]]; then
-        echo ${val} > ${regval}
-    fi
+        register_handler ${phy_idx} ${offset} ${val} "write"
+    else
+	start_addr=$(echo ${full_cmd} | sed s/-/' '/g | cut -d " " -f 1)
+	end_addr=$(echo ${full_cmd} | sed s/-/' '/g | cut -d " " -f 2)
+	loop=$((0x${end_addr}-0x${start_addr}))
 
-    res=$(cat ${regval} | cut -d 'x' -f 2)
-    printf "%s       mac:[%s]:%s\n" ${interface_ori} ${offset} ${res}
+	if [[ ${loop} == "0" ]]; then
+		register_handler ${phy_idx} ${offset} ${val}
+        else
+		i=0
+		while [ $i -le $loop ]; do
+			addr=$((0x${start_addr}+$i))
+			offset=$(printf "0x%x" ${addr})
+			register_handler ${phy_idx} ${offset} ${val}
+			i=$(($i + 4))
+		done
+       fi
+    fi
 
 ## dump command is only for vendor commands
 elif [ "${cmd_type}" = "dump" ]; then
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch b/recipes-wifi/hostapd/files/patches-2.10.3/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch
new file mode 100644
index 0000000..f790577
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch
@@ -0,0 +1,475 @@
+From 4791a374c9861b0d90db7fbdefe509f4e7d12247 Mon Sep 17 00:00:00 2001
+From: "howard.hsu" <howard-yh.hsu@mediatek.com>
+Date: Wed, 19 Jan 2022 19:18:07 +0800
+Subject: [PATCH 99900/99910] hostapd: mtk: Add neighbor report and BSS
+ Termination for MBO certification
+
+1. Add hostapd_neighbor_count() and hostapd_neighbor_insert_buffer ()
+The first function can count the number of neighbor report in neighbore report
+database. The second can iterate neighbor report database to build up neighbor
+report data.
+
+2. Support including neighbor report elements in ANQP response
+3. Support including neignbor report elements in BTM response
+4. Support configuring BSS Termination TSF by using hostapd_cli command
+5. Disable interface if BSS Termination TSF is set
+6. Add set_send_disassoc_frame_timer() to send disassociate frame
+Function set_disassoc_timer() may fail if key was deleted first. This new
+function will not ask to delete key as set_disassoc_timer() did.
+7. Support including neighbor report elements in BTM request
+8. Add hostapd_neighbor_set_own_report_pref()
+9. Add hostapd_neighbor_set_pref_by_non_pref_chan()
+---
+ hostapd/ctrl_iface.c   |   5 ++
+ src/ap/ap_config.c     |   1 +
+ src/ap/ap_config.h     |   1 +
+ src/ap/ctrl_iface_ap.c |  19 ++++++-
+ src/ap/gas_serv.c      |  29 ++++++++++
+ src/ap/gas_serv.h      |   2 +
+ src/ap/neighbor_db.c   | 119 +++++++++++++++++++++++++++++++++++++++++
+ src/ap/neighbor_db.h   |   9 ++++
+ src/ap/wnm_ap.c        |  72 +++++++++++++++++++++++--
+ 9 files changed, 252 insertions(+), 5 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index a258492..c2a2822 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1338,6 +1338,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
+ #endif /* CONFIG_DPP */
+ 	} else if (os_strcasecmp(cmd, "setband") == 0) {
+ 		ret = hostapd_ctrl_iface_set_band(hapd, value);
++	} else if (os_strcasecmp(cmd, "bss_termination_tsf") == 0) {
++		int termination_sec = atoi(value);
++		hapd->conf->bss_termination_tsf = termination_sec;
++		wpa_printf(MSG_DEBUG, "BSS Termination TSF: value = %d",
++                termination_sec);
+ 	} else {
+ 		ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
+ 		if (ret)
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index d7a0c7c..4a20eb4 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
+ 	/* comeback after 10 TUs */
+ 	bss->pasn_comeback_after = 10;
+ #endif /* CONFIG_PASN */
++	bss->bss_termination_tsf = 0;
+ }
+ 
+ 
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index ed3bec7..3f68e76 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -557,6 +557,7 @@ struct hostapd_bss_config {
+ 	int wnm_sleep_mode;
+ 	int wnm_sleep_mode_no_keys;
+ 	int bss_transition;
++	unsigned int bss_termination_tsf;
+ 
+ 	/* IEEE 802.11u - Interworking */
+ 	int interworking;
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index 96209ce..18bae5c 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1203,6 +1203,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ 			wpa_printf(MSG_DEBUG, "Invalid bss_term data");
+ 			return -1;
+ 		}
++		if (hapd->conf->bss_termination_tsf) {
++			WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
++		}
++
+ 		end++;
+ 		WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
+ 	}
+@@ -1229,14 +1233,25 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ 		req_mode |= WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT;
+ 	}
+ 
+-	if (os_strstr(cmd, " pref=1"))
++	if (os_strstr(cmd, " pref=1")) {
+ 		req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
++		if (nei_len == 0) {
++			// Add neigibor report from neighbor report db to nei_rep buffer
++			nei_len = hostapd_neighbor_insert_buffer (hapd, nei_rep, 1000);
++		}
++	}
+ 	if (os_strstr(cmd, " abridged=1"))
+ 		req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
+-	if (os_strstr(cmd, " disassoc_imminent=1"))
++	if (os_strstr(cmd, " disassoc_imminent=1")) {
+ 		req_mode |= WNM_BSS_TM_REQ_DISASSOC_IMMINENT;
++		/* Set own BSS neighbor report preference value as 0 */
++		hostapd_neighbor_set_own_report_pref(hapd, nei_rep, nei_len, 0);
++	}
++
+ 
+ #ifdef CONFIG_MBO
++	hostapd_neighbor_set_pref_by_non_pref_chan(hapd, sta, nei_rep, nei_len);
++
+ 	pos = os_strstr(cmd, "mbo=");
+ 	if (pos) {
+ 		unsigned int mbo_reason, cell_pref, reassoc_delay;
+diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
+index 90f1577..5845ff8 100644
+--- a/src/ap/gas_serv.c
++++ b/src/ap/gas_serv.c
+@@ -19,6 +19,7 @@
+ #include "dpp_hostapd.h"
+ #include "sta_info.h"
+ #include "gas_serv.h"
++#include "neighbor_db.h"
+ 
+ 
+ #ifdef CONFIG_DPP
+@@ -369,6 +370,24 @@ static void anqp_add_network_auth_type(struct hostapd_data *hapd,
+ 	}
+ }
+ 
++static void anqp_add_neighbor_report(struct hostapd_data *hapd,
++				       struct wpabuf *buf)
++{
++	struct hostapd_neighbor_entry *nr;
++	u8 *len_pos = gas_anqp_add_element(buf, ANQP_NEIGHBOR_REPORT);
++	if (dl_list_empty(&hapd->nr_db)) {
++		wpabuf_put_le16(buf, 0);
++	}
++	else {
++		dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry, list ) {
++			wpabuf_put_u8(buf, WLAN_EID_NEIGHBOR_REPORT);
++			wpabuf_put_u8(buf, wpabuf_len(nr->nr));
++			wpabuf_put_buf(buf, nr->nr);
++		}
++	}
++	gas_anqp_set_element_len(buf, len_pos);
++}
++
+ 
+ static void anqp_add_roaming_consortium(struct hostapd_data *hapd,
+ 					struct wpabuf *buf)
+@@ -986,6 +1005,9 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
+ 		len += 1000;
+ 	if (request & ANQP_REQ_ICON_REQUEST)
+ 		len += 65536;
++    if (request & ANQP_REQ_NEIGHBOR_REPORT) {
++        len += (40 * hostapd_neighbor_count(hapd));
++    }
+ #ifdef CONFIG_FILS
+ 	if (request & ANQP_FILS_REALM_INFO)
+ 		len += 2 * dl_list_len(&hapd->conf->fils_realms);
+@@ -1028,6 +1050,8 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
+ 		anqp_add_elem(hapd, buf, ANQP_TDLS_CAPABILITY);
+ 	if (request & ANQP_REQ_EMERGENCY_NAI)
+ 		anqp_add_elem(hapd, buf, ANQP_EMERGENCY_NAI);
++	if (request & ANQP_REQ_NEIGHBOR_REPORT)
++		anqp_add_neighbor_report(hapd, buf);
+ 
+ 	for (i = 0; i < num_extra_req; i++) {
+ #ifdef CONFIG_FILS
+@@ -1172,6 +1196,11 @@ static void rx_anqp_query_list_id(struct hostapd_data *hapd, u16 info_id,
+ 			     "Emergency NAI",
+ 			     get_anqp_elem(hapd, info_id) != NULL, qi);
+ 		break;
++	case ANQP_NEIGHBOR_REPORT:
++		set_anqp_req(ANQP_REQ_NEIGHBOR_REPORT,
++			     "Neighbor Report",
++			     get_anqp_elem(hapd, info_id) != NULL, qi);
++		break;
+ 	default:
+ #ifdef CONFIG_FILS
+ 		if (info_id == ANQP_FILS_REALM_INFO &&
+diff --git a/src/ap/gas_serv.h b/src/ap/gas_serv.h
+index 1528af4..d0241f2 100644
+--- a/src/ap/gas_serv.h
++++ b/src/ap/gas_serv.h
+@@ -40,6 +40,8 @@
+ 	(1 << (ANQP_TDLS_CAPABILITY - ANQP_QUERY_LIST))
+ #define ANQP_REQ_EMERGENCY_NAI \
+ 	(1 << (ANQP_EMERGENCY_NAI - ANQP_QUERY_LIST))
++#define ANQP_REQ_NEIGHBOR_REPORT \
++	(1 << (ANQP_NEIGHBOR_REPORT - ANQP_QUERY_LIST))
+ /*
+  * First 15 Hotspot 2.0 vendor specific ANQP-elements can be included in the
+  * optimized bitmap.
+diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
+index 52f25eb..9254d09 100644
+--- a/src/ap/neighbor_db.c
++++ b/src/ap/neighbor_db.c
+@@ -89,6 +89,38 @@ int hostapd_neighbor_show(struct hostapd_data *hapd, char *buf, size_t buflen)
+ }
+ 
+ 
++int hostapd_neighbor_count(struct hostapd_data *hapd)
++{
++	struct hostapd_neighbor_entry *nr;
++	int count = 0;
++
++	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++			 list) {
++		count++;
++	}
++	return count;
++}
++
++
++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++        size_t buflen)
++{
++	struct hostapd_neighbor_entry *nr;
++	char *pos = buf;
++
++	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++			 list) {
++		/* For neighbor report IE, we only need bssid and nr*/
++		*pos++ = WLAN_EID_NEIGHBOR_REPORT;
++		*pos++ = wpabuf_len(nr->nr);
++		os_memcpy(pos, wpabuf_head(nr->nr), wpabuf_len(nr->nr));
++		pos += wpabuf_len(nr->nr);
++	}
++
++	return pos - buf;
++}
++
++
+ static void hostapd_neighbor_clear_entry(struct hostapd_neighbor_entry *nr)
+ {
+ 	wpabuf_free(nr->nr);
+@@ -325,3 +357,90 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
+ 	wpabuf_free(nr);
+ #endif /* NEED_AP_MLME */
+ }
++
++
++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
++			 size_t buflen, const int pref)
++{
++	struct hostapd_neighbor_entry *nr;
++	char *pos, *next_nr;
++
++	pos = nei_buf;
++	next_nr = nei_buf;
++
++	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++			 list) {
++		pos = next_nr;
++		next_nr = pos + 2 + wpabuf_len(nr->nr);
++		/* Shift 2 bytes for Element ID and Neighbor report length */
++		pos = pos + 2;
++		if(os_memcmp(pos, hapd->own_addr, ETH_ALEN) == 0) {
++			/* Shift for BSSID + BSSID info + Op_class + channel num + PHY type */
++			pos = pos + 6 + 4 + 1 + 1 + 1;
++
++			/* Iterate Subelement */
++			while (next_nr - pos > 0) {
++				if (*pos == 3) {
++					pos = pos + 2;
++					*pos = pref;
++					return;
++				} else {
++					pos++;
++					int shift_len = *pos++;
++					pos = pos + shift_len;
++				}
++			}
++		}
++	}
++}
++
++#ifdef CONFIG_MBO
++void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
++			 struct sta_info* sta, char *nei_buf, size_t buflen)
++{
++	struct hostapd_neighbor_entry *nr;
++	struct mbo_non_pref_chan_info *info;
++	u8 i;
++
++	for(info = sta->non_pref_chan; info; info = info->next) {
++		/* Check OP_Class and Channel num */
++		for(i = 0; i < info->num_channels; i++) {
++			char *pos, *next_nr;
++
++			pos = nei_buf;
++			next_nr = nei_buf;
++
++			/* Iterate Neighbor report database */
++			dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++					 list) {
++				pos = next_nr;
++				next_nr = pos + 2 + wpabuf_len(nr->nr);
++				/**
++				 * Shift 12 bytes for Element ID, Neighbor report length,
++				 * BSSID and BSSID info.
++				 */
++				pos = pos + 12;
++				int nr_op_class = *pos++;
++				int nr_channel = *pos;
++				if(info->op_class == nr_op_class && info->channels[i] == nr_channel) {
++					/* Shift for Channel Num + PHY type */
++					pos = pos + 1 + 1;
++
++					// Iterate Subelement
++					while(next_nr - pos > 0) {
++						if(*pos == 3) {
++							pos = pos + 2;
++							*pos = info->pref;
++							break;
++						}else {
++							pos++;
++							int shift_len = *pos++;
++							pos = pos + shift_len;
++						}
++					}
++				}
++			}
++		}
++	}
++}
++#endif
+diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
+index 992671b..a1ddc07 100644
+--- a/src/ap/neighbor_db.h
++++ b/src/ap/neighbor_db.h
+@@ -24,4 +24,13 @@ int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid,
+ 			    const struct wpa_ssid_value *ssid);
+ void hostapd_free_neighbor_db(struct hostapd_data *hapd);
+ 
++int hostapd_neighbor_count(struct hostapd_data *hapd);
++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++        size_t buflen);
++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
++			 size_t buflen, const int pref);
++#ifdef CONFIG_MBO
++void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
++			 struct sta_info* sta, char *nei_buf, size_t buflen);
++#endif
+ #endif /* NEIGHBOR_DB_H */
+diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
+index 3ea92af..4349e1d 100644
+--- a/src/ap/wnm_ap.c
++++ b/src/ap/wnm_ap.c
+@@ -20,6 +20,7 @@
+ #include "ap/wpa_auth.h"
+ #include "mbo_ap.h"
+ #include "wnm_ap.h"
++#include "ap/neighbor_db.h"
+ 
+ #define MAX_TFS_IE_LEN  1024
+ 
+@@ -370,9 +371,21 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
+ 	u8 *pos;
+ 	int res;
+ 
+-	mgmt = os_zalloc(sizeof(*mgmt));
+-	if (mgmt == NULL)
++	int nr_num = hostapd_neighbor_count(hapd);
++	int nr_size = ETH_ALEN + 4 + 1 + 1 + 1 + 5;
++	int total_nr_size = nr_num * nr_size;
++	u8 *nr_data = os_malloc(total_nr_size);
++	int nr_data_len = 0;
++	if(nr_data == NULL) {
++		wpa_printf (MSG_ERROR, "Failed to allocate memory");
++	} else {
++	    nr_data_len = hostapd_neighbor_insert_buffer(hapd, nr_data, total_nr_size);
++	}
++	mgmt = os_zalloc(sizeof(*mgmt) + nr_data_len);
++	if (mgmt == NULL) {
++		wpa_printf (MSG_ERROR, "Failed to allocate memory for mgmt frame");
+ 		return -1;
++	}
+ 	os_memcpy(mgmt->da, addr, ETH_ALEN);
+ 	os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
+ 	os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
+@@ -382,10 +395,18 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
+ 	mgmt->u.action.u.bss_tm_req.action = WNM_BSS_TRANS_MGMT_REQ;
+ 	mgmt->u.action.u.bss_tm_req.dialog_token = dialog_token;
+ 	mgmt->u.action.u.bss_tm_req.req_mode = 0;
++	if(nr_num) {
++		mgmt->u.action.u.bss_tm_req.req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
++	}
+ 	mgmt->u.action.u.bss_tm_req.disassoc_timer = host_to_le16(0);
+ 	mgmt->u.action.u.bss_tm_req.validity_interval = 1;
+ 	pos = mgmt->u.action.u.bss_tm_req.variable;
+ 
++	if(nr_num) {
++		os_memcpy(pos, nr_data, nr_data_len);
++		pos += nr_data_len;
++	}
++
+ 	hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ 	wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
+ 		   MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
+@@ -759,6 +780,50 @@ static void set_disassoc_timer(struct hostapd_data *hapd, struct sta_info *sta,
+ }
+ 
+ 
++static void set_send_disassoc_frame_timer(struct hostapd_data *hapd, struct sta_info *sta,
++			       int disassoc_timer)
++{
++	int timeout, beacon_int;
++
++	/*
++	 * Prevent STA from reconnecting using cached PMKSA to force
++	 * full authentication with the authentication server (which may
++	 * decide to reject the connection),
++	 */
++	wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
++
++	beacon_int = hapd->iconf->beacon_int;
++	if (beacon_int < 1)
++		beacon_int = 100; /* best guess */
++	/* Calculate timeout in ms based on beacon_int in TU */
++	timeout = disassoc_timer * beacon_int * 128 / 125;
++	wpa_printf(MSG_DEBUG, "Disassociation timer for " MACSTR
++		   " set to %d ms", MAC2STR(sta->addr), timeout);
++
++	u16 reason = WLAN_REASON_PREV_AUTH_NOT_VALID;
++
++	hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
++	if (sta)
++		ap_sta_disassociate(hapd, sta, reason);
++}
++
++
++void bss_termination_disable_iface(void *eloop_ctx, void *timeout_ctx)
++{
++	struct hostapd_data *hapd = eloop_ctx;
++	hostapd_disable_iface(hapd->iface);
++}
++
++
++static void set_disable_iface_timer(struct hostapd_data *hapd, struct sta_info *sta,
++			       int disable_iface_timer)
++{
++	wpa_printf(MSG_DEBUG, "Disable interface timer set to %d secs", disable_iface_timer);
++	eloop_register_timeout(disable_iface_timer, 0,
++			       bss_termination_disable_iface, hapd, NULL);
++}
++
++
+ int wnm_send_ess_disassoc_imminent(struct hostapd_data *hapd,
+ 				   struct sta_info *sta, const char *url,
+ 				   int disassoc_timer)
+@@ -848,6 +913,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
+ 	    bss_term_dur) {
+ 		os_memcpy(pos, bss_term_dur, 12);
+ 		pos += 12;
++		set_disable_iface_timer(hapd, sta, hapd->conf->bss_termination_tsf);
+ 	}
+ 
+ 	if (url) {
+@@ -884,7 +950,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
+ 	hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ 	if (disassoc_timer) {
+ 		/* send disassociation frame after time-out */
+-		set_disassoc_timer(hapd, sta, disassoc_timer);
++		set_send_disassoc_frame_timer(hapd, sta, disassoc_timer);
+ 	}
+ 
+ 	return 0;
+-- 
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch b/recipes-wifi/hostapd/files/patches-2.10.3/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
new file mode 100644
index 0000000..3c5137d
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
@@ -0,0 +1,36 @@
+From 6d95c027c13fba5404fa8d096d55b4a072b2ec59 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 20 Sep 2022 19:33:45 +0800
+Subject: [PATCH 99901/99910] hostapd: mtk: print sae groups by hostapd ctrl
+
+---
+ hostapd/ctrl_iface.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index c2a2822..bc690c5 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1412,6 +1412,19 @@ static int hostapd_ctrl_iface_get(struct hostapd_data *hapd, char *cmd,
+ 		if (os_snprintf_error(buflen, res))
+ 			return -1;
+ 		return res;
++	} else if (os_strcmp(cmd, "sae_group_capability") == 0) {
++#ifdef CONFIG_SAE
++		/* see sae_set_group() */
++		res = os_snprintf(buf, buflen, "%s%s%s%s19 20 21",
++				  dh_groups_get(15) ? "15 ": "",
++				  dh_groups_get(16) ? "16 ": "",
++				  dh_groups_get(17) ? "17 ": "",
++				  dh_groups_get(18) ? "18 ": "");
++
++		if (os_snprintf_error(buflen, res))
++			return -1;
++		return res;
++#endif /* CONFIG_SAE */
+ 	}
+ 
+ 	return -1;
+-- 
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch b/recipes-wifi/hostapd/files/patches-2.10.3/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
new file mode 100644
index 0000000..885c6c9
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
@@ -0,0 +1,211 @@
+From 7a84545afb1f5bc2784eb5a046d56d869fb52067 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Tue, 31 May 2022 21:15:54 +0800
+Subject: [PATCH 99902/99910] hostapd: mtk: add support for runtime set in-band
+ discovery
+
+Usage:
+hostapd_cli unsolic_probe_resp [tx_type] [interval]
+
+0: disable all in-band discovery
+1: enable unsolicited probe response
+2: enable FILS discovery
+
+Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+---
+ hostapd/ctrl_iface.c         | 66 ++++++++++++++++++++++++++++++++++++
+ hostapd/hostapd_cli.c        | 20 +++++++++++
+ src/ap/beacon.c              |  5 ++-
+ src/drivers/driver_nl80211.c | 10 ++++--
+ src/drivers/nl80211_copy.h   |  1 +
+ 5 files changed, 98 insertions(+), 4 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index bc690c5..bb8c74f 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -826,6 +826,69 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
+ 
+ #endif /* CONFIG_INTERWORKING */
+ 
++static int hostapd_ctrl_iface_inband_discovery(struct hostapd_data *hapd,
++					       const char *cmd)
++{
++	struct hostapd_bss_config *conf = hapd->conf;
++	const char *pos = cmd;
++	int tx_type, interval, ret;
++
++	tx_type = atoi(pos);
++	if (tx_type < 0 || tx_type > 2) {
++		wpa_printf(MSG_ERROR, "Invalid tx type\n");
++		return -1;
++	}
++
++	pos = os_strchr(pos, ' ');
++	if(!pos)
++		return -1;
++	pos++;
++	interval = atoi(pos);
++	if (interval < 0 || interval > 20) {
++		wpa_printf(MSG_ERROR, "Invalid interval value\n");
++		return -1;
++	}
++
++	wpa_printf(MSG_ERROR, "Set inband discovery type:%d, interval:%d\n",
++			      tx_type, interval);
++
++#define DISABLE_INBAND_DISC 0
++#define UNSOL_PROBE_RESP 1
++#define FILS_DISCOVERY 2
++
++#ifdef CONFIG_FILS
++	conf->fils_discovery_max_int = 0;
++	conf->fils_discovery_min_int = 0;
++#endif /* CONFIG_FILS */
++	conf->unsol_bcast_probe_resp_interval = 0;
++
++	switch (tx_type) {
++	case DISABLE_INBAND_DISC:
++	default:
++		/* Disable both Unsolicited probe response and FILS discovery*/
++		break;
++	case UNSOL_PROBE_RESP:
++		/* Enable Unsolicited probe response */
++		conf->unsol_bcast_probe_resp_interval = interval;
++		break;
++#ifdef CONFIG_FILS
++	case FILS_DISCOVERY:
++		/* Enable FILS discovery */
++		conf->fils_discovery_min_int = interval;
++		conf->fils_discovery_max_int = interval;
++		break;
++#endif /* CONFIG_FILS */
++	}
++
++	ret = ieee802_11_update_beacons(hapd->iface);
++	if(ret) {
++		wpa_printf(MSG_DEBUG,
++			"Failed to update with inband discovery parameters\n");
++		return -1;
++	}
++
++	return 0;
++}
+ 
+ #ifdef CONFIG_WNM_AP
+ 
+@@ -3434,6 +3497,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 		if (hostapd_ctrl_iface_coloc_intf_req(hapd, buf + 15))
+ 			reply_len = -1;
+ #endif /* CONFIG_WNM_AP */
++	} else if (os_strncmp(buf, "INBAND_DISCOVERY ", 17) == 0) {
++		if (hostapd_ctrl_iface_inband_discovery(hapd, buf + 17))
++			reply_len = -1;
+ 	} else if (os_strcmp(buf, "GET_CONFIG") == 0) {
+ 		reply_len = hostapd_ctrl_iface_get_config(hapd, reply,
+ 							  reply_size);
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index 85c41d0..db21258 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -642,6 +642,24 @@ static int hostapd_cli_cmd_wps_config(struct wpa_ctrl *ctrl, int argc,
+ 	return wpa_ctrl_command(ctrl, buf);
+ }
+ 
++static int hostapd_cli_cmd_inband_discovery(struct wpa_ctrl *ctrl, int argc,
++					    char *argv[])
++{
++	char buf[300];
++	int res;
++
++	if (argc < 2) {
++		printf("Invalid 'inband_discovery' command - two arguments"
++		       "tx_type interval\n");
++		return -1;
++	}
++
++	res = os_snprintf(buf, sizeof(buf), "INBAND_DISCOVERY %s %s",
++			  argv[0], argv[1]);
++	if (os_snprintf_error(sizeof(buf), res))
++		return -1;
++	return wpa_ctrl_command(ctrl, buf);
++}
+ 
+ static int hostapd_cli_cmd_disassoc_imminent(struct wpa_ctrl *ctrl, int argc,
+ 					     char *argv[])
+@@ -1749,6 +1767,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ 	{ "driver", hostapd_cli_cmd_driver, NULL,
+ 	  "<driver sub command> [<hex formatted data>] = send driver command data" },
+ #endif /* ANDROID */
++	{ "inband_discovery", hostapd_cli_cmd_inband_discovery, NULL,
++          "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
+ 	{ NULL, NULL, NULL, NULL }
+ };
+ 
+diff --git a/src/ap/beacon.c b/src/ap/beacon.c
+index 814e86e..1a26f11 100644
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1497,6 +1497,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+ 				   struct wpa_driver_ap_params *params)
+ {
+ 	params->fd_max_int = hapd->conf->fils_discovery_max_int;
++	params->unsol_bcast_probe_resp_interval =
++		hapd->conf->unsol_bcast_probe_resp_interval;
+ 	if (is_6ghz_op_class(hapd->iconf->op_class) &&
+ 	    params->fd_max_int > FD_MAX_INTERVAL_6GHZ)
+ 		params->fd_max_int = FD_MAX_INTERVAL_6GHZ;
+@@ -1505,7 +1507,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+ 	if (params->fd_min_int > params->fd_max_int)
+ 		params->fd_min_int = params->fd_max_int;
+ 
+-	if (params->fd_max_int)
++	if (params->fd_max_int || (is_6ghz_op_class(hapd->iconf->op_class) &&
++	    !params->unsol_bcast_probe_resp_interval))
+ 		return hostapd_gen_fils_discovery(hapd,
+ 						  &params->fd_frame_tmpl_len);
+ 
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 53f2503..5eba0ea 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -4498,9 +4498,10 @@ static int nl80211_fils_discovery(struct i802_bss *bss, struct nl_msg *msg,
+ 			params->fd_max_int) ||
+ 	    (params->fd_frame_tmpl &&
+ 	     nla_put(msg, NL80211_FILS_DISCOVERY_ATTR_TMPL,
+-		     params->fd_frame_tmpl_len, params->fd_frame_tmpl)))
++		     params->fd_frame_tmpl_len, params->fd_frame_tmpl)) ||
++	    nla_put_u32(msg, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE,
++			params->unsol_bcast_probe_resp_interval))
+ 		return -1;
+-
+ 	nla_nest_end(msg, attr);
+ 	return 0;
+ }
+@@ -4844,7 +4845,10 @@ static int wpa_driver_nl80211_set_ap(void *priv,
+ #endif /* CONFIG_SAE */
+ 
+ #ifdef CONFIG_FILS
+-	if (params->fd_max_int && nl80211_fils_discovery(bss, msg, params) < 0)
++	if ((params->fd_max_int ||
++	    ((params->freq->freq > 5950 && params->freq->freq <= 7115) &&
++	      !(params->unsol_bcast_probe_resp_interval))) &&
++	     nl80211_fils_discovery(bss, msg, params) < 0)
+ 		goto fail;
+ #endif /* CONFIG_FILS */
+ 
+diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
+index 0568a79..c4bf3ad 100644
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -7379,6 +7379,7 @@ enum nl80211_fils_discovery_attributes {
+ 	NL80211_FILS_DISCOVERY_ATTR_INT_MIN,
+ 	NL80211_FILS_DISCOVERY_ATTR_INT_MAX,
+ 	NL80211_FILS_DISCOVERY_ATTR_TMPL,
++	NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE,
+ 
+ 	/* keep last */
+ 	__NL80211_FILS_DISCOVERY_ATTR_LAST,
+-- 
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/99903-hostapd-mtk-Add-mtk_vendor.h.patch b/recipes-wifi/hostapd/files/patches-2.10.3/99903-hostapd-mtk-Add-mtk_vendor.h.patch
new file mode 100644
index 0000000..d108ca3
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/99903-hostapd-mtk-Add-mtk_vendor.h.patch
@@ -0,0 +1,214 @@
+From 8694400211d08019e4c495fc98ca3e3783465044 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Mon, 30 May 2022 15:04:57 +0800
+Subject: [PATCH 99903/99910] hostapd: mtk: Add mtk_vendor.h
+
+---
+ src/common/mtk_vendor.h | 195 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 195 insertions(+)
+ create mode 100644 src/common/mtk_vendor.h
+
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+new file mode 100644
+index 0000000..528387f
+--- /dev/null
++++ b/src/common/mtk_vendor.h
+@@ -0,0 +1,195 @@
++// SPDX-License-Identifier: ISC
++/* Copyright (C) 2020 Felix Fietkau <nbd@nbd.name> */
++#ifndef MTK_VENDOR_H
++#define MTK_VENDOR_H
++
++#define OUI_MTK    0x000ce7
++
++enum mtk_nl80211_vendor_subcmds {
++	MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
++	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
++	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
++	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
++	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++};
++
++enum mtk_vendor_attr_edcca_ctrl {
++	MTK_VENDOR_ATTR_EDCCA_THRESHOLD_INVALID = 0,
++
++	MTK_VENDOR_ATTR_EDCCA_CTRL_MODE,
++	MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL,
++	MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL,
++	MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL,
++	MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL,
++	MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL,
++	MTK_VENDOR_ATTR_EDCCA_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
++};
++
++enum mtk_vendor_attr_edcca_ctrl_mode {
++	EDCCA_CTRL_SET_EN = 0,
++	EDCCA_CTRL_SET_THERS,
++	EDCCA_CTRL_GET_EN,
++	EDCCA_CTRL_GET_THERS,
++	EDCCA_CTRL_NUM,
++};
++
++static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
++	[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_U8 },
++};
++
++enum mtk_vendor_attr_csi_ctrl {
++	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG,
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE,
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE,
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1,
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2,
++	MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR,
++	MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL,
++
++	MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM,
++
++	MTK_VENDOR_ATTR_CSI_CTRL_DATA,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_CSI_CTRL,
++	MTK_VENDOR_ATTR_CSI_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_CSI_CTRL - 1
++};
++
++enum mtk_vendor_attr_csi_data {
++	MTK_VENDOR_ATTR_CSI_DATA_UNSPEC,
++	MTK_VENDOR_ATTR_CSI_DATA_PAD,
++
++	MTK_VENDOR_ATTR_CSI_DATA_VER,
++	MTK_VENDOR_ATTR_CSI_DATA_TS,
++	MTK_VENDOR_ATTR_CSI_DATA_RSSI,
++	MTK_VENDOR_ATTR_CSI_DATA_SNR,
++	MTK_VENDOR_ATTR_CSI_DATA_BW,
++	MTK_VENDOR_ATTR_CSI_DATA_CH_IDX,
++	MTK_VENDOR_ATTR_CSI_DATA_TA,
++	MTK_VENDOR_ATTR_CSI_DATA_I,
++	MTK_VENDOR_ATTR_CSI_DATA_Q,
++	MTK_VENDOR_ATTR_CSI_DATA_INFO,
++	MTK_VENDOR_ATTR_CSI_DATA_RSVD1,
++	MTK_VENDOR_ATTR_CSI_DATA_RSVD2,
++	MTK_VENDOR_ATTR_CSI_DATA_RSVD3,
++	MTK_VENDOR_ATTR_CSI_DATA_RSVD4,
++	MTK_VENDOR_ATTR_CSI_DATA_TX_ANT,
++	MTK_VENDOR_ATTR_CSI_DATA_RX_ANT,
++	MTK_VENDOR_ATTR_CSI_DATA_MODE,
++	MTK_VENDOR_ATTR_CSI_DATA_H_IDX,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_CSI_DATA,
++	MTK_VENDOR_ATTR_CSI_DATA_MAX =
++		NUM_MTK_VENDOR_ATTRS_CSI_DATA - 1
++};
++
++enum mtk_vendor_attr_mnt_ctrl {
++	MTK_VENDOR_ATTR_AMNT_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_AMNT_CTRL_SET,
++	MTK_VENDOR_ATTR_AMNT_CTRL_DUMP,
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_AMNT_CTRL,
++	MTK_VENDOR_ATTR_AMNT_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_AMNT_CTRL - 1
++};
++
++enum mtk_vendor_attr_mnt_set {
++	MTK_VENDOR_ATTR_AMNT_SET_UNSPEC,
++
++	MTK_VENDOR_ATTR_AMNT_SET_INDEX,
++	MTK_VENDOR_ATTR_AMNT_SET_MACADDR,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_AMNT_SET,
++	MTK_VENDOR_ATTR_AMNT_SET_MAX =
++		NUM_MTK_VENDOR_ATTRS_AMNT_SET - 1
++};
++
++enum mtk_vendor_attr_mnt_dump {
++	MTK_VENDOR_ATTR_AMNT_DUMP_UNSPEC,
++
++	MTK_VENDOR_ATTR_AMNT_DUMP_INDEX,
++	MTK_VENDOR_ATTR_AMNT_DUMP_LEN,
++	MTK_VENDOR_ATTR_AMNT_DUMP_RESULT,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_AMNT_DUMP,
++	MTK_VENDOR_ATTR_AMNT_DUMP_MAX =
++		NUM_MTK_VENDOR_ATTRS_AMNT_DUMP - 1
++};
++
++enum mtk_vendor_attr_wireless_ctrl {
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_OFDMA,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
++};
++
++enum mtk_vendor_attr_rfeature_ctrl {
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_EN,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
++};
++
++#define CSI_MAX_COUNT 256
++#define ETH_ALEN 6
++
++struct csi_data {
++	s16 data_i[CSI_MAX_COUNT];
++	s16 data_q[CSI_MAX_COUNT];
++	s8 rssi;
++	u8 snr;
++	u32 ts;
++	u8 data_bw;
++	u8 pri_ch_idx;
++	u8 ta[ETH_ALEN];
++	u32 info;
++	u8 rx_mode;
++	u32 h_idx;
++	u16 tx_idx;
++	u16 rx_idx;
++};
++
++struct amnt_data {
++	u8 idx;
++	u8 addr[ETH_ALEN];
++	s8 rssi[4];
++	u32 last_seen;
++};
++#endif /* MTK_VENDOR_H */
+-- 
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch b/recipes-wifi/hostapd/files/patches-2.10.3/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
new file mode 100644
index 0000000..e9bb053
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
@@ -0,0 +1,619 @@
+From d3d5b514064036fb17729743fa13e25646f468e9 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Mon, 30 May 2022 16:31:34 +0800
+Subject: [PATCH 99904/99910] hostapd: mtk: Support EDCCA hostapd configuration
+
+edcca_enable and edcca_compensation and implement edcca related handlers.
+---
+ hostapd/config_file.c             |  32 ++++++
+ hostapd/ctrl_iface.c              | 125 ++++++++++++++++++++++
+ src/ap/ap_config.c                |   4 +
+ src/ap/ap_config.h                |  29 ++++++
+ src/ap/ap_drv_ops.c               |  24 +++++
+ src/ap/ap_drv_ops.h               |   5 +-
+ src/ap/hostapd.c                  |   7 ++
+ src/common/mtk_vendor.h           |  19 ++--
+ src/drivers/driver.h              |   4 +
+ src/drivers/driver_nl80211.c      | 165 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h      |   1 +
+ src/drivers/driver_nl80211_capa.c |   7 ++
+ 12 files changed, 415 insertions(+), 7 deletions(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index eda9db0..0ee8952 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4753,6 +4753,38 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 	} else if (os_strcmp(buf, "eht_mu_beamformer") == 0) {
+ 		conf->eht_phy_capab.mu_beamformer = atoi(pos);
+ #endif /* CONFIG_IEEE80211BE */
++	} else if (os_strcmp(buf, "edcca_threshold") == 0) {
++		if (hostapd_parse_intlist(&conf->edcca_threshold, pos) ||
++		    conf->edcca_threshold[0] < EDCCA_MIN_CONFIG_THRES ||
++		    conf->edcca_threshold[0] > EDCCA_MAX_CONFIG_THRES ||
++		    conf->edcca_threshold[1] < EDCCA_MIN_CONFIG_THRES ||
++		    conf->edcca_threshold[1] > EDCCA_MAX_CONFIG_THRES ||
++		    conf->edcca_threshold[2] < EDCCA_MIN_CONFIG_THRES ||
++		    conf->edcca_threshold[2] > EDCCA_MAX_CONFIG_THRES) {
++			wpa_printf(MSG_ERROR, "Line %d: invalid edcca threshold",
++				   line);
++			return 1;
++		}
++	} else if (os_strcmp(buf, "edcca_enable") == 0) {
++		int mode = atoi(pos);
++		if (mode < EDCCA_MODE_FORCE_DISABLE || mode > EDCCA_MODE_AUTO) {
++			wpa_printf(MSG_ERROR, "Line %d: Invalid edcca_enable %d;"
++				  " allowed value 0 (Force Disable) or 1(Auto) ",
++				   line, mode);
++			return 1;
++		}
++		conf->edcca_enable = (u8) mode;
++	} else if (os_strcmp(buf, "edcca_compensation") == 0) {
++		int val = atoi(pos);
++		if (val < EDCCA_MIN_COMPENSATION ||
++		    val > EDCCA_MAX_COMPENSATION) {
++			wpa_printf(MSG_ERROR, "Line %d: Invalid compensation"
++				   " value %d; allowed value %d ~ %d.",
++				   line, val, EDCCA_MIN_COMPENSATION,
++				   EDCCA_MAX_COMPENSATION);
++			return 1;
++		}
++		conf->edcca_compensation = (s8) val;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index bb8c74f..9c70d54 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -598,6 +598,19 @@ static const char * pbc_status_str(enum pbc_status status)
+ }
+ 
+ 
++static const char * edcca_mode_str(enum edcca_mode status)
++{
++	switch (status) {
++		case EDCCA_MODE_FORCE_DISABLE:
++			return "Force Disable";
++		case EDCCA_MODE_AUTO:
++			return "Auto";
++		default:
++			return "Unknown";
++	}
++}
++
++
+ static int hostapd_ctrl_iface_wps_get_status(struct hostapd_data *hapd,
+ 					     char *buf, size_t buflen)
+ {
+@@ -3322,6 +3335,112 @@ static int hostapd_ctrl_iface_driver_cmd(struct hostapd_data *hapd, char *cmd,
+ #endif /* ANDROID */
+ 
+ 
++static int
++hostapd_ctrl_iface_set_edcca(struct hostapd_data *hapd, char *cmd,
++					 char *buf, size_t buflen)
++{
++	char *pos, *config, *value;
++	config = cmd;
++	pos = os_strchr(config, ' ');
++	if (pos == NULL)
++		return -1;
++	*pos++ = '\0';
++
++	if(pos == NULL)
++		return -1;
++	value = pos;
++
++	if (os_strcmp(config, "enable") == 0) {
++		int mode = atoi(value);
++		if (mode < EDCCA_MODE_FORCE_DISABLE || mode > EDCCA_MODE_AUTO) {
++			wpa_printf(MSG_ERROR, "Invalid value for edcca enable");
++			return -1;
++		}
++		hapd->iconf->edcca_enable = (u8) mode;
++		if (hostapd_drv_configure_edcca_enable(hapd) != 0)
++			return -1;
++	} else if (os_strcmp(config, "compensation") == 0) {
++		int compensation = atoi(value);
++		if (compensation < EDCCA_MIN_COMPENSATION ||
++		    compensation > EDCCA_MAX_COMPENSATION) {
++			wpa_printf(MSG_ERROR, "Invalid value for edcca compensation");
++			return -1;
++		}
++		hapd->iconf->edcca_compensation = (s8) compensation;
++		if (hostapd_drv_configure_edcca_enable(hapd) != 0)
++			return -1;
++	} else if (os_strcmp(config, "threshold") == 0) {
++		char *thres_value;
++		thres_value = os_strchr(value, ':');
++		if (thres_value == NULL)
++			return -1;
++		*thres_value++ = '\0';
++
++		if(thres_value == NULL)
++			return -1;
++		int bw_idx= atoi(value);
++		int threshold = atoi(thres_value);
++
++		if (bw_idx < EDCCA_BW_20 || bw_idx > EDCCA_BW_80) {
++			wpa_printf(MSG_ERROR,
++				   "Unsupported Bandwidth idx %d for SET_EDCCA",
++				   bw_idx);
++			return -1;
++		}
++		if (threshold < EDCCA_MIN_CONFIG_THRES ||
++		    threshold > EDCCA_MAX_CONFIG_THRES) {
++			wpa_printf(MSG_ERROR,
++				   "Unsupported threshold %d for SET_EDCCA",
++				   threshold);
++			return -1;
++		}
++
++		int threshold_arr[EDCCA_MAX_BW_NUM];
++		/* 0x7f means keep the origival value in firmware */
++		os_memset(threshold_arr, 0x7f, sizeof(threshold_arr));
++		threshold_arr[bw_idx] = threshold;
++
++		if (hostapd_drv_configure_edcca_threshold(hapd, threshold_arr) != 0)
++			return -1;
++	} else {
++		wpa_printf(MSG_ERROR,
++			"Unsupported parameter %s for SET_EDCCA", config);
++		return -1;
++	}
++	return os_snprintf(buf, buflen, "OK\n");
++}
++
++
++static int
++hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
++			     size_t buflen)
++{
++	char *pos, *end;
++
++	pos = buf;
++	end = buf + buflen;
++	u8 value[EDCCA_MAX_BW_NUM] = {0};
++
++	if (os_strcmp(cmd, "enable") == 0) {
++		return os_snprintf(pos, end - pos, "Enable: %s\n",
++				   edcca_mode_str(hapd->iconf->edcca_enable));
++	} else if (os_strcmp(cmd, "compensation") == 0) {
++		return os_snprintf(pos, end - pos, "Compensation: %d\n",
++				  hapd->iconf->edcca_compensation);
++	} else if (os_strcmp(cmd, "threshold") == 0) {
++		if (hostapd_drv_get_edcca(hapd, EDCCA_CTRL_GET_THRES, &value) != 0)
++			return -1;
++		return os_snprintf(pos, end - pos,
++				   "Threshold BW20: 0x%x, BW40: 0x%x, BW80: 0x%x\n",
++				   value[0], value[1], value[2]);
++	} else {
++		wpa_printf(MSG_ERROR,
++			"Unsupported parameter %s for GET_EDCCA", cmd);
++		return -1;
++	}
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -3868,6 +3987,12 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 		reply_len = hostapd_ctrl_iface_driver_cmd(hapd, buf + 7, reply,
+ 							  reply_size);
+ #endif /* ANDROID */
++	} else if (os_strncmp(buf, "SET_EDCCA ", 10) == 0) {
++		reply_len = hostapd_ctrl_iface_set_edcca(hapd, buf+10, reply,
++							  reply_size);
++	} else if (os_strncmp(buf, "GET_EDCCA ", 10) == 0) {
++		reply_len = hostapd_ctrl_iface_get_edcca(hapd, buf+10, reply,
++							  reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 4a20eb4..344585a 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -294,6 +294,9 @@ struct hostapd_config * hostapd_config_defaults(void)
+ 	conf->airtime_update_interval = AIRTIME_DEFAULT_UPDATE_INTERVAL;
+ #endif /* CONFIG_AIRTIME_POLICY */
+ 
++	conf->edcca_enable = EDCCA_MODE_AUTO;
++	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
++
+ 	return conf;
+ }
+ 
+@@ -1007,6 +1010,7 @@ void hostapd_config_free(struct hostapd_config *conf)
+ #ifdef CONFIG_ACS
+ 	os_free(conf->acs_chan_bias);
+ #endif /* CONFIG_ACS */
++	os_free(conf->edcca_threshold);
+ 	wpabuf_free(conf->lci);
+ 	wpabuf_free(conf->civic);
+ 
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 3f68e76..775c567 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1153,8 +1153,37 @@ struct hostapd_config {
+ #define CH_SWITCH_EHT_ENABLED BIT(0)
+ #define CH_SWITCH_EHT_DISABLED BIT(1)
+ 	unsigned int ch_switch_eht_config;
++	u8 edcca_enable;
++	s8 edcca_compensation;
++	int *edcca_threshold;
+ };
+ 
++enum edcca_mode {
++	EDCCA_MODE_FORCE_DISABLE = 0,
++	EDCCA_MODE_AUTO = 1,
++};
++
++enum edcca_bw_id {
++	EDCCA_BW_20 = 0,
++	EDCCA_BW_40,
++	EDCCA_BW_80,
++	EDCCA_MAX_BW_NUM,
++};
++
++enum mtk_vendor_attr_edcca_ctrl_mode {
++	EDCCA_CTRL_SET_EN = 0,
++	EDCCA_CTRL_SET_THRES,
++	EDCCA_CTRL_GET_EN,
++	EDCCA_CTRL_GET_THRES,
++	EDCCA_CTRL_NUM,
++};
++
++#define EDCCA_DEFAULT_COMPENSATION -6
++#define EDCCA_MIN_COMPENSATION -126
++#define EDCCA_MAX_COMPENSATION 126
++#define EDCCA_MIN_CONFIG_THRES -126
++#define EDCCA_MAX_CONFIG_THRES 0
++
+ 
+ static inline enum oper_chan_width
+ hostapd_get_oper_chwidth(struct hostapd_config *conf)
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 0c7aee2..25e967d 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1015,3 +1015,27 @@ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable)
+ 		return 0;
+ 	return hapd->driver->dpp_listen(hapd->drv_priv, enable);
+ }
++
++int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd)
++{
++	if (!hapd->driver || !hapd->driver->configure_edcca_enable)
++		return 0;
++	return hapd->driver->configure_edcca_enable(hapd->drv_priv,
++				hapd->iconf->edcca_enable,
++				hapd->iconf->edcca_compensation);
++}
++
++int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
++					  const int *threshold)
++{
++	if (!hapd->driver || !hapd->driver->configure_edcca_threshold)
++		return 0;
++	return hapd->driver->configure_edcca_threshold(hapd->drv_priv, threshold);
++}
++
++int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
++{
++	if (!hapd->driver || !hapd->driver->get_edcca)
++		return 0;
++	return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index b4fb766..70a99f4 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -138,7 +138,10 @@ int hostapd_drv_do_acs(struct hostapd_data *hapd);
+ int hostapd_drv_update_dh_ie(struct hostapd_data *hapd, const u8 *peer,
+ 			     u16 reason_code, const u8 *ie, size_t ielen);
+ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable);
+-
++int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
++int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
++					  const int *threshold);
++int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+ 
+ #include "drivers/driver.h"
+ 
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 0dd8c13..d05f948 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2295,6 +2295,13 @@ dfs_offload:
+ 	}
+ #endif /* CONFIG_MESH */
+ 
++	if (hostapd_drv_configure_edcca_enable(hapd) < 0)
++		goto fail;
++
++	if (hostapd_drv_configure_edcca_threshold(hapd,
++						  hapd->iconf->edcca_threshold) < 0)
++		goto fail;
++
+ 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ 		   iface->bss[0]->conf->iface);
+ 	if (iface->interfaces && iface->interfaces->terminate_on_error > 0)
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 528387f..7056126 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -29,14 +29,21 @@ enum mtk_vendor_attr_edcca_ctrl {
+ 		NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
+ };
+ 
+-enum mtk_vendor_attr_edcca_ctrl_mode {
+-	EDCCA_CTRL_SET_EN = 0,
+-	EDCCA_CTRL_SET_THERS,
+-	EDCCA_CTRL_GET_EN,
+-	EDCCA_CTRL_GET_THERS,
+-	EDCCA_CTRL_NUM,
++enum mtk_vendor_attr_edcca_dump {
++	MTK_VENDOR_ATTR_EDCCA_DUMP_UNSPEC = 0,
++
++	MTK_VENDOR_ATTR_EDCCA_DUMP_MODE,
++	MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL,
++	MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL,
++	MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP,
++	MTK_VENDOR_ATTR_EDCCA_DUMP_MAX =
++		NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP - 1
+ };
+ 
++
+ static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
+ 	[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
+ 	[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 1d2b1b2..3559974 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4676,6 +4676,10 @@ struct wpa_driver_ops {
+ 			      const u8 *match, size_t match_len,
+ 			      bool multicast);
+ #endif /* CONFIG_TESTING_OPTIONS */
++	int (*configure_edcca_enable)(void *priv, const u8 edcca_enable,
++				  const s8 edcca_compensation);
++	int (*configure_edcca_threshold)(void *priv, const int *threshold);
++	int (*get_edcca)(void *priv, const u8 mode, u8 *value);
+ };
+ 
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 5eba0ea..9c2782c 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -35,6 +35,8 @@
+ #include "radiotap_iter.h"
+ #include "rfkill.h"
+ #include "driver_nl80211.h"
++#include "common/mtk_vendor.h"
++#include "ap/ap_config.h"
+ 
+ 
+ #ifndef NETLINK_CAP_ACK
+@@ -12368,6 +12370,165 @@ static int testing_nl80211_radio_disable(void *priv, int disabled)
+ 
+ #endif /* CONFIG_TESTING_OPTIONS */
+ 
++static int nl80211_configure_edcca_enable(void *priv,
++					  const u8 edcca_enable,
++					  const s8 edcca_compensation)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_edcca_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting EDCCA enable");
++		return 0;
++	}
++
++	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++			MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++	    !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, EDCCA_CTRL_SET_EN) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL, edcca_enable) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
++		edcca_compensation)) {
++		wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++		nlmsg_free(msg);
++		return -ENOBUFS;
++	}
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to configure EDCCA enable. ret=%d (%s) ",
++			   ret, strerror(-ret));
++	}
++	return ret;
++}
++
++static int nl80211_configure_edcca_threshold(void *priv, const int *threshold)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_edcca_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting EDCCA threshold");
++		return 0;
++	}
++
++	if (!threshold) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Input EDCCA threshold is empty!");
++		return 0;
++	}
++
++	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++			MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++	    !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, EDCCA_CTRL_SET_THRES) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL, threshold[0] & 0xff) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL, threshold[1] & 0xff) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL, threshold[2] & 0xff)) {
++		wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++		nlmsg_free(msg);
++		return -ENOBUFS;
++	}
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to configure EDCCA threshold. ret=%d (%s) ",
++			   ret, strerror(-ret));
++	}
++	return ret;
++}
++
++
++static int edcca_info_handler(struct nl_msg *msg, void *arg)
++{
++	u8 *info = (u8*) arg;
++	struct nlattr *tb[NL80211_ATTR_MAX + 1];
++	struct nlattr *tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_MAX + 1];
++	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++	struct nlattr *nl_vend, *attr;
++
++	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++		  genlmsg_attrlen(gnlh, 0), NULL);
++
++	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++	if (!nl_vend)
++		return NL_SKIP;
++
++	nla_parse(tb_vendor, MTK_VENDOR_ATTR_EDCCA_DUMP_MAX,
++		  nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++	attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL];
++	if (!attr) {
++		wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL");
++		return NL_SKIP;
++	}
++
++	*info++ = nla_get_u8(attr);
++
++	attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL];
++	if (!attr) {
++		wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL");
++		return NL_SKIP;
++	}
++
++	*info++ = nla_get_u8(attr);
++
++	attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL];
++	if (!attr) {
++		wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL");
++		return NL_SKIP;
++	}
++
++	*info = nla_get_u8(attr);
++	return NL_SKIP;
++}
++
++
++static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_edcca_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting EDCCA threshold");
++		return 0;
++	}
++
++	if (!(msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR)) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++			MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++	    !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED)) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, mode)) {
++		wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++		nlmsg_free(msg);
++		return -ENOBUFS;
++	}
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, edcca_info_handler, value, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to get EDCCA configuration. ret=%d (%s)",
++			   ret, strerror(-ret));
++	}
++	return ret;
++}
++
+ 
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.name = "nl80211",
+@@ -12514,4 +12675,8 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.register_frame = testing_nl80211_register_frame,
+ 	.radio_disable = testing_nl80211_radio_disable,
+ #endif /* CONFIG_TESTING_OPTIONS */
++/* Need ifdef CONFIG_DRIVER_NL80211_MTK */
++	.configure_edcca_enable = nl80211_configure_edcca_enable,
++	.configure_edcca_threshold = nl80211_configure_edcca_threshold,
++	.get_edcca = nl80211_get_edcca,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 6e40d55..13e5d24 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -181,6 +181,7 @@ struct wpa_driver_nl80211_data {
+ 	unsigned int qca_do_acs:1;
+ 	unsigned int brcm_do_acs:1;
+ 	unsigned int uses_6ghz:1;
++	unsigned int mtk_edcca_vendor_cmd_avail:1;
+ 
+ 	u64 vendor_scan_cookie;
+ 	u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 7ede0d0..732ae29 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -18,6 +18,7 @@
+ #include "common/qca-vendor-attr.h"
+ #include "common/brcm_vendor.h"
+ #include "driver_nl80211.h"
++#include "common/mtk_vendor.h"
+ 
+ 
+ static int protocol_feature_handler(struct nl_msg *msg, void *arg)
+@@ -1050,6 +1051,12 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ 					break;
+ 				}
+ #endif /* CONFIG_DRIVER_NL80211_BRCM */
++			} else if (vinfo->vendor_id == OUI_MTK) {
++				switch (vinfo->subcmd) {
++				case MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL :
++					drv->mtk_edcca_vendor_cmd_avail = 1;
++					break;
++				}
+ 			}
+ 
+ 			wpa_printf(MSG_DEBUG, "nl80211: Supported vendor command: vendor_id=0x%x subcmd=%u",
+-- 
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch b/recipes-wifi/hostapd/files/patches-2.10.3/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
new file mode 100644
index 0000000..1a622f3
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
@@ -0,0 +1,450 @@
+From 893c5f92257a7313a179dc728ba51a74efbfc74a Mon Sep 17 00:00:00 2001
+From: TomLiu <tomml.liu@mediatek.com>
+Date: Tue, 9 Aug 2022 10:23:44 -0700
+Subject: [PATCH 99905/99910] hostapd: mtk: Add hostapd HEMU SET/GET control
+
+---
+ hostapd/config_file.c             |   9 +++
+ hostapd/ctrl_iface.c              |  62 +++++++++++++++++
+ hostapd/hostapd_cli.c             |  18 +++++
+ src/ap/ap_config.c                |   1 +
+ src/ap/ap_config.h                |   1 +
+ src/ap/ap_drv_ops.c               |  14 ++++
+ src/ap/ap_drv_ops.h               |   2 +
+ src/ap/hostapd.c                  |   2 +
+ src/common/mtk_vendor.h           |  15 ++++
+ src/drivers/driver.h              |  13 ++++
+ src/drivers/driver_nl80211.c      | 110 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h      |   1 +
+ src/drivers/driver_nl80211_capa.c |   3 +
+ 13 files changed, 251 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 0ee8952..b22d10b 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3659,6 +3659,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 			return 1;
+ 		}
+ 		bss->unsol_bcast_probe_resp_interval = val;
++	} else if (os_strcmp(buf, "hemu_onoff") == 0) {
++		int val = atoi(pos);
++		if (val < 0 || val > 15) {
++			wpa_printf(MSG_ERROR,
++				   "Line %d: invalid hemu_onoff value",
++				   line);
++			return 1;
++		}
++		conf->hemu_onoff = val;
+ #endif /* CONFIG_IEEE80211AX */
+ 	} else if (os_strcmp(buf, "max_listen_interval") == 0) {
+ 		bss->max_listen_interval = atoi(pos);
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 9c70d54..5f71aee 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3441,6 +3441,63 @@ hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_set_hemu(struct hostapd_data *hapd, char *cmd,
++					 char *buf, size_t buflen)
++{
++	char *pos, *config, *value;
++	config = cmd;
++	pos = os_strchr(config, ' ');
++	if (pos == NULL)
++		return -1;
++	*pos++ = '\0';
++
++	if(pos == NULL)
++		return -1;
++	value = pos;
++
++	if (os_strcmp(config, "onoff") == 0) {
++		int hemu = atoi(value);
++		if (hemu < 0 || hemu > 15) {
++			wpa_printf(MSG_ERROR, "Invalid value for hemu");
++			return -1;
++		}
++		hapd->iconf->hemu_onoff = (u8) hemu;
++	} else {
++		wpa_printf(MSG_ERROR,
++			"Unsupported parameter %s for SET_HEMU", config);
++		return -1;
++	}
++
++	if(hostapd_drv_hemu_ctrl(hapd) == 0) {
++		return os_snprintf(buf, buflen, "OK\n");
++	} else {
++		return -1;
++	}
++}
++
++
++static int
++hostapd_ctrl_iface_get_hemu(struct hostapd_data *hapd, char *buf,
++					 size_t buflen)
++{
++	u8 hemu_onoff;
++	char *pos, *end;
++
++	pos = buf;
++	end = buf + buflen;
++
++	if (hostapd_drv_hemu_dump(hapd, &hemu_onoff) == 0) {
++		hapd->iconf->hemu_onoff = hemu_onoff;
++		return os_snprintf(pos, end - pos, "[hostapd_cli] = UL MU-MIMO: %d, DL MU-MIMO: %d, UL OFDMA: %d, DL OFDMA: %d\n",
++			!!(hemu_onoff&BIT(3)), !!(hemu_onoff&BIT(2)), !!(hemu_onoff&BIT(1)), !!(hemu_onoff&BIT(0)));
++	} else {
++		wpa_printf(MSG_INFO, "ctrl iface failed to call");
++		return -1;
++	}
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -3993,6 +4050,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 	} else if (os_strncmp(buf, "GET_EDCCA ", 10) == 0) {
+ 		reply_len = hostapd_ctrl_iface_get_edcca(hapd, buf+10, reply,
+ 							  reply_size);
++	} else if (os_strncmp(buf, "SET_HEMU ", 9) == 0) {
++		reply_len = hostapd_ctrl_iface_set_hemu(hapd, buf+9, reply,
++							  reply_size);
++	} else if (os_strncmp(buf, "GET_HEMU", 8) == 0) {
++		reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index db21258..0d36477 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1380,6 +1380,20 @@ static int hostapd_cli_cmd_driver_flags(struct wpa_ctrl *ctrl, int argc,
+ }
+ 
+ 
++static int hostapd_cli_cmd_set_hemu(struct wpa_ctrl *ctrl, int argc,
++					   char *argv[])
++{
++	return hostapd_cli_cmd(ctrl, "SET_HEMU", 1, argc, argv);
++}
++
++
++static int hostapd_cli_cmd_get_hemu(struct wpa_ctrl *ctrl, int argc,
++					   char *argv[])
++{
++	return hostapd_cli_cmd(ctrl, "GET_HEMU", 0, NULL, NULL);
++}
++
++
+ #ifdef CONFIG_DPP
+ 
+ static int hostapd_cli_cmd_dpp_qr_code(struct wpa_ctrl *ctrl, int argc,
+@@ -1705,6 +1719,10 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ 	  " = send FTM range request"},
+ 	{ "driver_flags", hostapd_cli_cmd_driver_flags, NULL,
+ 	  " = show supported driver flags"},
++	{ "set_hemu", hostapd_cli_cmd_set_hemu, NULL,
++		"<value> [0-15] bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0)"},
++	{ "get_hemu", hostapd_cli_cmd_get_hemu, NULL,
++		" = show hemu onoff value in 0-15 bitmap"},
+ #ifdef CONFIG_DPP
+ 	{ "dpp_qr_code", hostapd_cli_cmd_dpp_qr_code, NULL,
+ 	  "report a scanned DPP URI from a QR Code" },
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 344585a..0e1f192 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -280,6 +280,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ 	conf->he_6ghz_max_ampdu_len_exp = 7;
+ 	conf->he_6ghz_rx_ant_pat = 1;
+ 	conf->he_6ghz_tx_ant_pat = 1;
++	conf->hemu_onoff = 13;
+ #endif /* CONFIG_IEEE80211AX */
+ 
+ 	/* The third octet of the country string uses an ASCII space character
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 775c567..41b8c68 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1114,6 +1114,7 @@ struct hostapd_config {
+ 	u8 he_6ghz_rx_ant_pat;
+ 	u8 he_6ghz_tx_ant_pat;
+ 	u8 he_6ghz_reg_pwr_type;
++	u8 hemu_onoff;
+ #endif /* CONFIG_IEEE80211AX */
+ 
+ 	/* VHT enable/disable config from CHAN_SWITCH */
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 25e967d..4598737 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1039,3 +1039,17 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
+ 		return 0;
+ 	return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
+ }
++
++int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd)
++{
++	if (!hapd->driver || !hapd->driver->hemu_ctrl)
++		return 0;
++	return hapd->driver->hemu_ctrl(hapd->drv_priv, hapd->iconf->hemu_onoff);
++}
++
++int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff)
++{
++	if (!hapd->driver || !hapd->driver->hemu_dump)
++		return 0;
++	return hapd->driver->hemu_dump(hapd->drv_priv, hemu_onoff);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 70a99f4..bca39c5 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -142,6 +142,8 @@ int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
+ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
+ 					  const int *threshold);
+ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
++int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+ 
+ #include "drivers/driver.h"
+ 
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index d05f948..921769d 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2301,6 +2301,8 @@ dfs_offload:
+ 	if (hostapd_drv_configure_edcca_threshold(hapd,
+ 						  hapd->iconf->edcca_threshold) < 0)
+ 		goto fail;
++	if (hostapd_drv_hemu_ctrl(hapd) < 0)
++		goto fail;
+ 
+ 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ 		   iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 7056126..69a46df 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -10,6 +10,8 @@ enum mtk_nl80211_vendor_subcmds {
+ 	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
+ 	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
+ 	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
++	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
++	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
+ };
+ 
+@@ -174,6 +176,19 @@ enum mtk_vendor_attr_rfeature_ctrl {
+ 		NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
+ };
+ 
++enum mtk_vendor_attr_hemu_ctrl {
++	MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF,
++	MTK_VENDOR_ATTR_HEMU_CTRL_DUMP,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
++	MTK_VENDOR_ATTR_HEMU_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
++};
++
++
+ #define CSI_MAX_COUNT 256
+ #define ETH_ALEN 6
+ 
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 3559974..4cd7505 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1623,6 +1623,11 @@ struct wpa_driver_ap_params {
+ 	 * Unsolicited broadcast Probe Response template length
+ 	 */
+ 	size_t unsol_bcast_probe_resp_tmpl_len;
++
++	/**
++	 * hemu onoff=<val> (bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0))
++	 */
++	u8 hemu_onoff;
+ };
+ 
+ struct wpa_driver_mesh_bss_params {
+@@ -4680,6 +4685,14 @@ struct wpa_driver_ops {
+ 				  const s8 edcca_compensation);
+ 	int (*configure_edcca_threshold)(void *priv, const int *threshold);
+ 	int (*get_edcca)(void *priv, const u8 mode, u8 *value);
++
++	/**
++	 * hemu_ctrl - ctrl on off for UL/DL MURU
++	 * @priv: Private driver interface data
++	 *
++	 */
++	 int (*hemu_ctrl)(void *priv, u8 hemu_onoff);
++	 int (*hemu_dump)(void *priv, u8 *hemu_onoff);
+ };
+ 
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 9c2782c..73dee2e 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12304,6 +12304,114 @@ fail:
+ }
+ 
+ 
++#ifdef CONFIG_IEEE80211AX
++static int nl80211_hemu_muruonoff(void *priv, u8 hemu_onoff)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_hemu_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting hemu control");
++		return 0;
++	}
++
++	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL) ||
++		!(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++		nla_put_u8(msg, MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF, hemu_onoff)) {
++		nlmsg_free(msg);
++		return -ENOBUFS;
++	}
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if(ret){
++		wpa_printf(MSG_ERROR, "Failed to set hemu_onoff. ret=%d (%s)", ret, strerror(-ret));
++	}
++	return ret;
++}
++
++
++static int hemu_dump_handler(struct nl_msg *msg, void *arg)
++{
++	u8 *hemu_onoff = (u8 *) arg;
++	struct nlattr *tb[NL80211_ATTR_MAX + 1];
++	struct nlattr *tb_vendor[MTK_VENDOR_ATTR_HEMU_CTRL_MAX + 1];
++	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++	struct nlattr *nl_vend, *attr;
++
++	static const struct nla_policy
++	hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL + 1] = {
++		[MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF] = {.type = NLA_U8 },
++		[MTK_VENDOR_ATTR_HEMU_CTRL_DUMP] = {.type = NLA_U8 },
++	};
++
++	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++			genlmsg_attrlen(gnlh, 0), NULL);
++
++	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++	if (!nl_vend)
++		return NL_SKIP;
++
++	nla_parse(tb_vendor, MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
++		  nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++	attr = tb_vendor[MTK_VENDOR_ATTR_HEMU_CTRL_DUMP];
++	if (!attr) {
++		wpa_printf(MSG_ERROR, "nl80211: cannot find MTK_VENDOR_ATTR_HEMU_CTRL_DUMP");
++		return NL_SKIP;
++	}
++
++	*hemu_onoff = nla_get_u8(attr);
++	wpa_printf(MSG_DEBUG, "nla_get hemu_onoff: %d\n", *hemu_onoff);
++
++	return 0;
++}
++
++static int nl80211_hemu_dump(void *priv, u8 *hemu_onoff)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *attr;
++	int ret;
++
++	if (!drv->mtk_hemu_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting hemu control");
++		return 0;
++	}
++
++	if (!(msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR)) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL)) {
++		nlmsg_free(msg);
++		return -ENOBUFS;
++	}
++
++  attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++	if (!attr) {
++		nlmsg_free(msg);
++		return -1;
++	}
++
++	nla_nest_end(msg, attr);
++
++	ret = send_and_recv_msgs(drv, msg, hemu_dump_handler, hemu_onoff, NULL, NULL);
++
++	if(ret){
++		wpa_printf(MSG_ERROR, "Failed to get hemu_onoff. ret=%d (%s)", ret, strerror(-ret));
++	}
++
++	return ret;
++}
++#endif /* CONFIG_IEEE80211AX */
++
++
+ #ifdef CONFIG_DPP
+ static int nl80211_dpp_listen(void *priv, bool enable)
+ {
+@@ -12668,6 +12776,8 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.update_connect_params = nl80211_update_connection_params,
+ 	.send_external_auth_status = nl80211_send_external_auth_status,
+ 	.set_4addr_mode = nl80211_set_4addr_mode,
++	.hemu_ctrl = nl80211_hemu_muruonoff,
++	.hemu_dump = nl80211_hemu_dump,
+ #ifdef CONFIG_DPP
+ 	.dpp_listen = nl80211_dpp_listen,
+ #endif /* CONFIG_DPP */
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 13e5d24..57f0249 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -182,6 +182,7 @@ struct wpa_driver_nl80211_data {
+ 	unsigned int brcm_do_acs:1;
+ 	unsigned int uses_6ghz:1;
+ 	unsigned int mtk_edcca_vendor_cmd_avail:1;
++	unsigned int mtk_hemu_vendor_cmd_avail:1;
+ 
+ 	u64 vendor_scan_cookie;
+ 	u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 732ae29..cc146d9 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1056,6 +1056,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ 				case MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL :
+ 					drv->mtk_edcca_vendor_cmd_avail = 1;
+ 					break;
++				case MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL :
++					drv->mtk_hemu_vendor_cmd_avail = 1;
++					break;
+ 				}
+ 			}
+ 
+-- 
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch b/recipes-wifi/hostapd/files/patches-2.10.3/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
new file mode 100644
index 0000000..594e476
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
@@ -0,0 +1,247 @@
+From c91612769eba54821da1136d5959a40438c02824 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 2 Sep 2022 01:03:23 +0800
+Subject: [PATCH 99906/99910] hostapd: mtk: Add three wire PTA ctrl hostapd
+ vendor command
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c             |  4 ++++
+ src/ap/ap_config.c                |  1 +
+ src/ap/ap_config.h                | 13 ++++++++++++
+ src/ap/ap_drv_ops.c               | 11 +++++++++++
+ src/ap/ap_drv_ops.h               |  1 +
+ src/ap/hostapd.c                  |  2 ++
+ src/common/mtk_vendor.h           | 16 +++++++++++++++
+ src/drivers/driver.h              |  8 ++++++++
+ src/drivers/driver_nl80211.c      | 33 +++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h      |  1 +
+ src/drivers/driver_nl80211_capa.c |  3 +++
+ 11 files changed, 93 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index b22d10b..18b372a 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4794,6 +4794,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 			return 1;
+ 		}
+ 		conf->edcca_compensation = (s8) val;
++	} else if (os_strcmp(buf, "three_wire_enable") == 0) {
++		u8 en = atoi(pos);
++
++		conf->three_wire_enable = en;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 0e1f192..9249a6b 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -297,6 +297,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ 
+ 	conf->edcca_enable = EDCCA_MODE_AUTO;
+ 	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
++	conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
+ 
+ 	return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 41b8c68..71cf515 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1157,6 +1157,19 @@ struct hostapd_config {
+ 	u8 edcca_enable;
+ 	s8 edcca_compensation;
+ 	int *edcca_threshold;
++	u8 three_wire_enable;
++};
++
++enum three_wire_mode {
++	THREE_WIRE_MODE_DISABLE,
++	THREE_WIRE_MODE_EXT0_ENABLE,
++	THREE_WIRE_MODE_EXT1_ENABLE,
++	THREE_WIRE_MODE_ALL_ENABLE,
++
++	/* keep last */
++	NUM_THREE_WIRE_MODE,
++	THREE_WIRE_MODE_MAX =
++		NUM_THREE_WIRE_MODE - 1
+ };
+ 
+ enum edcca_mode {
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 4598737..a1d83e4 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1053,3 +1053,14 @@ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff)
+ 		return 0;
+ 	return hapd->driver->hemu_dump(hapd->drv_priv, hemu_onoff);
+ }
++
++int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
++{
++	if (!hapd->driver || !hapd->driver->three_wire_ctrl)
++		return 0;
++	if (hapd->iconf->three_wire_enable > THREE_WIRE_MODE_MAX) {
++		wpa_printf(MSG_INFO, "Invalid value for three wire enable\n");
++		return 0;
++	}
++	return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index bca39c5..5ba6297 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -144,6 +144,7 @@ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
+ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+ int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
++int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
+ 
+ #include "drivers/driver.h"
+ 
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 921769d..f9dabdf 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2303,6 +2303,8 @@ dfs_offload:
+ 		goto fail;
+ 	if (hostapd_drv_hemu_ctrl(hapd) < 0)
+ 		goto fail;
++	if (hostapd_drv_three_wire_ctrl(hapd) < 0)
++		goto fail;
+ 
+ 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ 		   iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 69a46df..ee5a4f4 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -13,6 +13,7 @@ enum mtk_nl80211_vendor_subcmds {
+ 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ 	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
+ };
+ 
+ enum mtk_vendor_attr_edcca_ctrl {
+@@ -55,6 +56,21 @@ static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
+ 	[MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_U8 },
+ };
+ 
++enum mtk_vendor_attr_3wire_ctrl {
++	MTK_VENDOR_ATTR_3WIRE_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_3WIRE_CTRL_MODE,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL,
++	MTK_VENDOR_ATTR_3WIRE_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL - 1
++};
++
++static struct nla_policy three_wire_ctrl_policy[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL] = {
++	[MTK_VENDOR_ATTR_3WIRE_CTRL_MODE] = {.type = NLA_U8 },
++};
++
+ enum mtk_vendor_attr_csi_ctrl {
+ 	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
+ 
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 4cd7505..9ca19af 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4693,6 +4693,14 @@ struct wpa_driver_ops {
+ 	 */
+ 	 int (*hemu_ctrl)(void *priv, u8 hemu_onoff);
+ 	 int (*hemu_dump)(void *priv, u8 *hemu_onoff);
++
++	/**
++	 * three_wire_ctrl - set three_wire_ctrl mode
++	 * @priv: Private driver interface data
++	 * @three_wire_enable: three_wire_ctrl mode
++	 *
++	 */
++	 int (*three_wire_ctrl)(void *priv, u8 three_wire_enable);
+ };
+ 
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 73dee2e..2bb8cc2 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12637,6 +12637,38 @@ static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
+ 	return ret;
+ }
+ 
++static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	/* Prepare nl80211 cmd */
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_3wire_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting three wire control");
++		return 0;
++	}
++
++	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++			MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL) ||
++	    !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_3WIRE_CTRL_MODE, three_wire_enable)) {
++		nlmsg_free(msg);
++		return -ENOBUFS;
++	}
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to enable three wire. ret=%d (%s) ",
++			   ret, strerror(-ret));
++	}
++	return ret;
++}
+ 
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.name = "nl80211",
+@@ -12789,4 +12821,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.configure_edcca_enable = nl80211_configure_edcca_enable,
+ 	.configure_edcca_threshold = nl80211_configure_edcca_threshold,
+ 	.get_edcca = nl80211_get_edcca,
++	.three_wire_ctrl = nl80211_enable_three_wire,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 57f0249..9fe7811 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -183,6 +183,7 @@ struct wpa_driver_nl80211_data {
+ 	unsigned int uses_6ghz:1;
+ 	unsigned int mtk_edcca_vendor_cmd_avail:1;
+ 	unsigned int mtk_hemu_vendor_cmd_avail:1;
++	unsigned int mtk_3wire_vendor_cmd_avail:1;
+ 
+ 	u64 vendor_scan_cookie;
+ 	u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index cc146d9..04bc54e 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1059,6 +1059,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ 				case MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL :
+ 					drv->mtk_hemu_vendor_cmd_avail = 1;
+ 					break;
++				case MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL :
++					drv->mtk_3wire_vendor_cmd_avail = 1;
++					break;
+ 				}
+ 			}
+ 
+-- 
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/99907-hostapd-mtk-Add-hostapd-iBF-control.patch b/recipes-wifi/hostapd/files/patches-2.10.3/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
new file mode 100644
index 0000000..c37cb40
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
@@ -0,0 +1,431 @@
+From 4971762bfaba906054d43bd2d042c436a1ac97b2 Mon Sep 17 00:00:00 2001
+From: mtk27835 <shurong.wen@mediatek.com>
+Date: Wed, 7 Sep 2022 14:41:51 -0700
+Subject: [PATCH 99907/99910] hostapd: mtk: Add hostapd iBF control
+
+Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
+---
+ hostapd/config_file.c             |   3 +
+ hostapd/ctrl_iface.c              |  26 +++++++
+ hostapd/hostapd_cli.c             |   9 +++
+ src/ap/ap_config.c                |   1 +
+ src/ap/ap_config.h                |   2 +
+ src/ap/ap_drv_ops.c               |  14 ++++
+ src/ap/ap_drv_ops.h               |   2 +
+ src/ap/hostapd.c                  |   2 +
+ src/common/mtk_vendor.h           |  35 +++++++++-
+ src/drivers/driver.h              |  19 ++++++
+ src/drivers/driver_nl80211.c      | 108 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h      |   1 +
+ src/drivers/driver_nl80211_capa.c |   3 +
+ 13 files changed, 224 insertions(+), 1 deletion(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 18b372a..d9d882c 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4798,6 +4798,9 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 		u8 en = atoi(pos);
+ 
+ 		conf->three_wire_enable = en;
++	} else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
++		int val = atoi(pos);
++		conf->ibf_enable = !!val;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 5f71aee..c881d37 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3498,6 +3498,30 @@ hostapd_ctrl_iface_get_hemu(struct hostapd_data *hapd, char *buf,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
++					 size_t buflen)
++{
++	u8 ibf_enable;
++	int ret;
++	char *pos, *end;
++
++	pos = buf;
++	end = buf + buflen;
++
++	if (hostapd_drv_ibf_dump(hapd, &ibf_enable) == 0) {
++		hapd->iconf->ibf_enable = ibf_enable;
++		ret = os_snprintf(pos, end - pos, "ibf_enable: %u\n",
++			  ibf_enable);
++	}
++
++	if (os_snprintf_error(end - pos, ret))
++		return 0;
++
++	return ret;
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -4055,6 +4079,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 							  reply_size);
+ 	} else if (os_strncmp(buf, "GET_HEMU", 8) == 0) {
+ 		reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
++	} else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
++		reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index 0d36477..c2a123a 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1586,6 +1586,13 @@ static int hostapd_cli_cmd_driver(struct wpa_ctrl *ctrl, int argc, char *argv[])
+ #endif /* ANDROID */
+ 
+ 
++static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
++					   char *argv[])
++{
++	return hostapd_cli_cmd(ctrl, "GET_IBF", 0, NULL, NULL);
++}
++
++
+ struct hostapd_cli_cmd {
+ 	const char *cmd;
+ 	int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]);
+@@ -1787,6 +1794,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ #endif /* ANDROID */
+ 	{ "inband_discovery", hostapd_cli_cmd_inband_discovery, NULL,
+           "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
++	{ "get_ibf", hostapd_cli_cmd_get_ibf, NULL,
++	  " = show iBF state (enabled/disabled)"},
+ 	{ NULL, NULL, NULL, NULL }
+ };
+ 
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 9249a6b..7a96cb8 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -298,6 +298,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ 	conf->edcca_enable = EDCCA_MODE_AUTO;
+ 	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
+ 	conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
++	conf->ibf_enable = IBF_DEFAULT_ENABLE;
+ 
+ 	return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 71cf515..44a0e7e 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1158,6 +1158,7 @@ struct hostapd_config {
+ 	s8 edcca_compensation;
+ 	int *edcca_threshold;
+ 	u8 three_wire_enable;
++	u8 ibf_enable;
+ };
+ 
+ enum three_wire_mode {
+@@ -1198,6 +1199,7 @@ enum mtk_vendor_attr_edcca_ctrl_mode {
+ #define EDCCA_MIN_CONFIG_THRES -126
+ #define EDCCA_MAX_CONFIG_THRES 0
+ 
++#define IBF_DEFAULT_ENABLE 0
+ 
+ static inline enum oper_chan_width
+ hostapd_get_oper_chwidth(struct hostapd_config *conf)
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index a1d83e4..60ae825 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1064,3 +1064,17 @@ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
+ 	}
+ 	return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
+ }
++
++int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd)
++{
++	if (!hapd->driver || !hapd->driver->ibf_ctrl)
++		return 0;
++	return hapd->driver->ibf_ctrl(hapd->drv_priv, hapd->iconf->ibf_enable);
++}
++
++int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
++{
++	if (!hapd->driver || !hapd->driver->ibf_dump)
++		return 0;
++	return hapd->driver->ibf_dump(hapd->drv_priv, ibf_enable);
++}
+\ No newline at end of file
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 5ba6297..ab9aedc 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -145,6 +145,8 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+ int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable);
+ 
+ #include "drivers/driver.h"
+ 
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index f9dabdf..e44b73d 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2305,6 +2305,8 @@ dfs_offload:
+ 		goto fail;
+ 	if (hostapd_drv_three_wire_ctrl(hapd) < 0)
+ 		goto fail;
++	if (hostapd_drv_ibf_ctrl(hapd) < 0)
++		goto fail;
+ 
+ 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ 		   iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index ee5a4f4..4050cf8 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -13,7 +13,8 @@ enum mtk_nl80211_vendor_subcmds {
+ 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ 	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
+-	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
++	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8,
++	MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL = 0xc9,
+ };
+ 
+ enum mtk_vendor_attr_edcca_ctrl {
+@@ -204,6 +205,38 @@ enum mtk_vendor_attr_hemu_ctrl {
+ 		NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
+ };
+ 
++enum mtk_vendor_attr_ibf_ctrl {
++	MTK_VENDOR_ATTR_IBF_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_IBF_CTRL_ENABLE,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_IBF_CTRL,
++	MTK_VENDOR_ATTR_IBF_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_IBF_CTRL - 1
++};
++
++enum mtk_vendor_attr_ibf_dump {
++	MTK_VENDOR_ATTR_IBF_DUMP_UNSPEC,
++
++	MTK_VENDOR_ATTR_IBF_DUMP_ENABLE,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_IBF_DUMP,
++	MTK_VENDOR_ATTR_IBF_DUMP_MAX =
++		NUM_MTK_VENDOR_ATTRS_IBF_DUMP - 1
++};
++
++static struct nla_policy
++ibf_ctrl_policy[NUM_MTK_VENDOR_ATTRS_IBF_CTRL] = {
++	[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE] = { .type = NLA_U8 },
++};
++
++static struct nla_policy
++ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
++	[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE] = { .type = NLA_U8 },
++};
++
+ 
+ #define CSI_MAX_COUNT 256
+ #define ETH_ALEN 6
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 9ca19af..71ded61 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1628,6 +1628,11 @@ struct wpa_driver_ap_params {
+ 	 * hemu onoff=<val> (bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0))
+ 	 */
+ 	u8 hemu_onoff;
++
++	/**
++	 * ibf_enable=<val>
++	 */
++	u8 ibf_enable;
+ };
+ 
+ struct wpa_driver_mesh_bss_params {
+@@ -4701,6 +4706,20 @@ struct wpa_driver_ops {
+ 	 *
+ 	 */
+ 	 int (*three_wire_ctrl)(void *priv, u8 three_wire_enable);
++
++	/**
++	 * ibf_ctrl - ctrl disable/enable for ibf
++	 * @priv: Private driver interface data
++	 *
++	 */
++	int (*ibf_ctrl)(void *priv, u8 ibf_enable);
++
++	/**
++	 * ibf_dump - dump ibf
++	 * @priv: Private driver interface data
++	 *
++	 */
++	int (*ibf_dump)(void *priv, u8 *ibf_enable);
+ };
+ 
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 2bb8cc2..e974f85 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12670,6 +12670,112 @@ static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
+ 	return ret;
+ }
+ 
++static int nl80211_ibf_enable(void *priv, u8 ibf_enable)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_ibf_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting ibf control");
++		return 0;
++	}
++
++	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++	if (!msg)
++		goto fail;
++
++	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL))
++		goto fail;
++
++	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++	if (!data)
++		goto fail;
++
++	nla_put_u8(msg, MTK_VENDOR_ATTR_IBF_CTRL_ENABLE, ibf_enable);
++
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to set ibf_enable. ret=%d (%s)", ret, strerror(-ret));
++	}
++
++	return ret;
++
++fail:
++	nlmsg_free(msg);
++	return -ENOBUFS;
++}
++
++static int ibf_dump_handler(struct nl_msg *msg, void *arg)
++{
++	u8 *ibf_enable = (u8 *) arg;
++	struct nlattr *tb[NL80211_ATTR_MAX + 1];
++	struct nlattr *tb_vendor[MTK_VENDOR_ATTR_IBF_DUMP_MAX + 1];
++	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++	struct nlattr *nl_vend, *attr;
++
++	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++			genlmsg_attrlen(gnlh, 0), NULL);
++
++	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++	if (!nl_vend)
++		return NL_SKIP;
++
++	nla_parse(tb_vendor, MTK_VENDOR_ATTR_IBF_DUMP_MAX,
++			nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++	attr = tb_vendor[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE];
++	if (!attr) {
++		wpa_printf(MSG_ERROR, "nl80211: cannot find MTK_VENDOR_ATTR_IBF_DUMP_ENABLE");
++		return NL_SKIP;
++	}
++
++	*ibf_enable = nla_get_u8(attr);
++
++	return NL_SKIP;
++}
++
++static int
++nl80211_ibf_dump(void *priv, u8 *ibf_enable)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
++	if (!msg)
++		goto fail;
++
++	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL))
++		goto fail;
++
++	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED);
++	if (!data)
++		goto fail;
++
++	nla_nest_end(msg, data);
++
++	ret = send_and_recv_msgs(drv, msg, ibf_dump_handler, ibf_enable, NULL, NULL);
++
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to dump ibf_enable. ret=%d (%s)", ret, strerror(-ret));
++	}
++
++	return ret;
++
++fail:
++	nlmsg_free(msg);
++	return -ENOBUFS;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.name = "nl80211",
+ 	.desc = "Linux nl80211/cfg80211",
+@@ -12822,4 +12928,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.configure_edcca_threshold = nl80211_configure_edcca_threshold,
+ 	.get_edcca = nl80211_get_edcca,
+ 	.three_wire_ctrl = nl80211_enable_three_wire,
++	.ibf_ctrl = nl80211_ibf_enable,
++	.ibf_dump = nl80211_ibf_dump,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 9fe7811..607592c 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -184,6 +184,7 @@ struct wpa_driver_nl80211_data {
+ 	unsigned int mtk_edcca_vendor_cmd_avail:1;
+ 	unsigned int mtk_hemu_vendor_cmd_avail:1;
+ 	unsigned int mtk_3wire_vendor_cmd_avail:1;
++	unsigned int mtk_ibf_vendor_cmd_avail:1;
+ 
+ 	u64 vendor_scan_cookie;
+ 	u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 04bc54e..9ecc0ff 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1062,6 +1062,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ 				case MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL :
+ 					drv->mtk_3wire_vendor_cmd_avail = 1;
+ 					break;
++				case MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL:
++					drv->mtk_ibf_vendor_cmd_avail = 1;
++					break;
+ 				}
+ 			}
+ 
+-- 
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch b/recipes-wifi/hostapd/files/patches-2.10.3/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
new file mode 100644
index 0000000..47628d7
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
@@ -0,0 +1,27 @@
+From f96a62568fb3c419e71f8d7469d485dce55f4da6 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 22 Sep 2022 16:08:09 +0800
+Subject: [PATCH 99908/99910] hostapd: mtk: Do not include HE capab IE if
+ associated sta's HE capab IE is invalid
+
+---
+ src/ap/ieee802_11.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
+index d921783..098793e 100644
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -5192,7 +5192,8 @@ static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
+ #endif /* CONFIG_IEEE80211AC */
+ 
+ #ifdef CONFIG_IEEE80211AX
+-	if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax) {
++	if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax &&
++			sta->flags & WLAN_STA_HE) {
+ 		p = hostapd_eid_he_capab(hapd, p, IEEE80211_MODE_AP);
+ 		p = hostapd_eid_he_operation(hapd, p);
+ 		p = hostapd_eid_cca(hapd, p);
+-- 
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch b/recipes-wifi/hostapd/files/patches-2.10.3/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
new file mode 100644
index 0000000..c1fc3f1
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
@@ -0,0 +1,376 @@
+From 782f38f2eec27e438e55cb09e824a6ffc1c3eb18 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 7 Oct 2022 10:46:29 +0800
+Subject: [PATCH 99909/99910] hostapd: mtk: Add DFS and ZWDFS support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c        |  4 ++
+ hostapd/ctrl_iface.c         | 95 ++++++++++++++++++++++++++++++++++++
+ src/ap/ap_config.h           | 13 +++++
+ src/ap/dfs.c                 | 35 +++++++------
+ src/ap/dfs.h                 | 15 ++++++
+ src/ap/hostapd.c             |  4 +-
+ src/drivers/driver.h         |  7 +++
+ src/drivers/driver_nl80211.c | 29 +++++++++++
+ src/drivers/nl80211_copy.h   |  1 +
+ 9 files changed, 186 insertions(+), 17 deletions(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index d9d882c..fd61448 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4801,6 +4801,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 	} else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
+ 		int val = atoi(pos);
+ 		conf->ibf_enable = !!val;
++	} else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
++		u8 en = strtol(pos, NULL, 10);
++
++		conf->dfs_detect_mode = en;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index c881d37..6ea1573 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3522,6 +3522,96 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
++				       char *buf, size_t buflen)
++{
++	u8 dfs_detect_mode;
++
++	if (!value)
++		return -1;
++
++	dfs_detect_mode = strtol(value, NULL, 10);
++	if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
++		wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
++		return -1;
++	}
++	hapd->iconf->dfs_detect_mode = dfs_detect_mode;
++
++	return os_snprintf(buf, buflen, "OK\n");
++}
++
++
++static int
++hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
++				    char *buf, size_t buflen)
++{
++	struct hostapd_iface *iface = hapd->iface;
++	char *pos, *param;
++	enum hostapd_hw_mode hw_mode;
++	bool chan_found = false;
++	int i, num_available_chandefs, channel, chan_width, sec = 0;
++	int sec_chan_idx_80p80 = -1;
++	u8 oper_centr_freq_seg0_idx, oper_centr_freq_seg1_idx;
++	struct hostapd_channel_data *chan;
++	enum dfs_channel_type type = DFS_NO_CAC_YET;
++
++	param = os_strchr(cmd, ' ');
++	if (!param)
++		return -1;
++	*param++ = '\0';
++
++	pos = os_strstr(param, "chan=");
++	if (pos)
++		channel = strtol(pos + 5, NULL, 10);
++	else
++		return -1;
++
++	num_available_chandefs = dfs_find_channel(iface, NULL, 0, type);
++	for (i = 0; i < num_available_chandefs; i++) {
++		dfs_find_channel(iface, &chan, i, type);
++		if (chan->chan == channel) {
++			chan_found = true;
++			break;
++		}
++	}
++
++	if (!chan_found)
++		return -1;
++
++	if (iface->conf->secondary_channel)
++		sec = 1;
++
++	dfs_adjust_center_freq(iface, chan,
++			       sec,
++			       sec_chan_idx_80p80,
++			       &oper_centr_freq_seg0_idx,
++			       &oper_centr_freq_seg1_idx);
++
++	if (hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
++				  chan->freq, chan->chan,
++				  iface->conf->ieee80211n,
++				  iface->conf->ieee80211ac,
++				  iface->conf->ieee80211ax,
++				  iface->conf->ieee80211be,
++				  sec, hostapd_get_oper_chwidth(iface->conf),
++				  oper_centr_freq_seg0_idx,
++				  oper_centr_freq_seg1_idx, true)) {
++		wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
++		iface->radar_background.channel = -1;
++		return -1;
++	}
++
++	iface->radar_background.channel = chan->chan;
++	iface->radar_background.freq = chan->freq;
++	iface->radar_background.secondary_channel = sec;
++	iface->radar_background.centr_freq_seg0_idx = oper_centr_freq_seg0_idx;
++	iface->radar_background.centr_freq_seg1_idx = oper_centr_freq_seg1_idx;
++
++	return os_snprintf(buf, buflen, "OK\n");
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -4081,6 +4171,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 		reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ 	} else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
+ 		reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
++	} else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
++		reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
++								   reply, reply_size);
++	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
++		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 44a0e7e..3f5afdf 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1159,6 +1159,7 @@ struct hostapd_config {
+ 	int *edcca_threshold;
+ 	u8 three_wire_enable;
+ 	u8 ibf_enable;
++	u8 dfs_detect_mode;
+ };
+ 
+ enum three_wire_mode {
+@@ -1173,6 +1174,18 @@ enum three_wire_mode {
+ 		NUM_THREE_WIRE_MODE - 1
+ };
+ 
++enum dfs_mode {
++	DFS_DETECT_MODE_DISABLE,
++	DFS_DETECT_MODE_AP_ENABLE,
++	DFS_DETECT_MODE_BACKGROUND_ENABLE,
++	DFS_DETECT_MODE_ALL_ENABLE,
++
++	/* keep last */
++	NUM_DFS_DETECT_MODE,
++	DFS_DETECT_MODE_MAX =
++		NUM_DFS_DETECT_MODE - 1
++};
++
+ enum edcca_mode {
+ 	EDCCA_MODE_FORCE_DISABLE = 0,
+ 	EDCCA_MODE_AUTO = 1,
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index b5d105d..1c3f678 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -19,13 +19,6 @@
+ #include "dfs.h"
+ #include "crypto/crypto.h"
+ 
+-
+-enum dfs_channel_type {
+-	DFS_ANY_CHANNEL,
+-	DFS_AVAILABLE, /* non-radar or radar-available */
+-	DFS_NO_CAC_YET, /* radar-not-yet-available */
+-};
+-
+ static struct hostapd_channel_data *
+ dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
+ 			u8 *oper_centr_freq_seg0_idx,
+@@ -238,9 +231,9 @@ static int is_in_chanlist(struct hostapd_iface *iface,
+  *  - hapd->vht/he_oper_centr_freq_seg0_idx
+  *  - hapd->vht/he_oper_centr_freq_seg1_idx
+  */
+-static int dfs_find_channel(struct hostapd_iface *iface,
+-			    struct hostapd_channel_data **ret_chan,
+-			    int idx, enum dfs_channel_type type)
++int dfs_find_channel(struct hostapd_iface *iface,
++		     struct hostapd_channel_data **ret_chan,
++		     int idx, enum dfs_channel_type type)
+ {
+ 	struct hostapd_hw_modes *mode;
+ 	struct hostapd_channel_data *chan;
+@@ -299,12 +292,12 @@ static int dfs_find_channel(struct hostapd_iface *iface,
+ }
+ 
+ 
+-static void dfs_adjust_center_freq(struct hostapd_iface *iface,
+-				   struct hostapd_channel_data *chan,
+-				   int secondary_channel,
+-				   int sec_chan_idx_80p80,
+-				   u8 *oper_centr_freq_seg0_idx,
+-				   u8 *oper_centr_freq_seg1_idx)
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++			    struct hostapd_channel_data *chan,
++			    int secondary_channel,
++			    int sec_chan_idx_80p80,
++			    u8 *oper_centr_freq_seg0_idx,
++			    u8 *oper_centr_freq_seg1_idx)
+ {
+ 	if (!iface->conf->ieee80211ac && !iface->conf->ieee80211ax)
+ 		return;
+@@ -1317,6 +1310,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
+ 		   __func__, iface->radar_background.cac_started ? "yes" : "no",
+ 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
+ 
++	/* Skip channel switch when background dfs detect mode is on */
++	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
++	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++		return 0;
++
+ 	/* Check if CSA in progress */
+ 	if (hostapd_csa_in_progress(iface))
+ 		return 0;
+@@ -1365,6 +1363,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
+ 		   __func__, iface->cac_started ? "yes" : "no",
+ 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
+ 
++	/* Skip channel switch when dfs detect mode is on */
++	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
++	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++		return 0;
++
+ 	/* Check if CSA in progress */
+ 	if (hostapd_csa_in_progress(iface))
+ 		return 0;
+diff --git a/src/ap/dfs.h b/src/ap/dfs.h
+index 606c1b3..c2556d2 100644
+--- a/src/ap/dfs.h
++++ b/src/ap/dfs.h
+@@ -9,6 +9,12 @@
+ #ifndef DFS_H
+ #define DFS_H
+ 
++enum dfs_channel_type {
++	DFS_ANY_CHANNEL,
++	DFS_AVAILABLE, /* non-radar or radar-available */
++	DFS_NO_CAC_YET, /* radar-not-yet-available */
++};
++
+ int hostapd_handle_dfs(struct hostapd_iface *iface);
+ 
+ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
+@@ -32,5 +38,14 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
+ int hostapd_handle_dfs_offload(struct hostapd_iface *iface);
+ int hostapd_is_dfs_overlap(struct hostapd_iface *iface, enum chan_width width,
+ 			   int center_freq);
++int dfs_find_channel(struct hostapd_iface *iface,
++		     struct hostapd_channel_data **ret_chan,
++		     int idx, enum dfs_channel_type type);
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++			    struct hostapd_channel_data *chan,
++			    int secondary_channel,
++			    int sec_chan_idx_80p80,
++			    u8 *oper_centr_freq_seg0_idx,
++			    u8 *oper_centr_freq_seg1_idx);
+ 
+ #endif /* DFS_H */
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index e44b73d..793ce2f 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -1463,7 +1463,9 @@ static int hostapd_setup_bss(struct hostapd_data *hapd, int first)
+ 		return -1;
+ 	}
+ 
+-	if (!conf->start_disabled && ieee802_11_set_beacon(hapd) < 0)
++	if (conf->start_disabled)
++		hapd->driver->start_disabled(hapd->drv_priv);
++	else if (ieee802_11_set_beacon(hapd) < 0)
+ 		return -1;
+ 
+ 	if (flush_old_stations && !conf->start_disabled &&
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 71ded61..aa23fbd 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4720,6 +4720,13 @@ struct wpa_driver_ops {
+ 	 *
+ 	 */
+ 	int (*ibf_dump)(void *priv, u8 *ibf_enable);
++
++	/**
++	 * start_disabled - set start_disabled to cfg80211
++	 * @priv: Private driver interface data
++	 *
++	 */
++	int (*start_disabled)(void *priv);
+ };
+ 
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index e974f85..003adc4 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12776,6 +12776,34 @@ fail:
+ 	return -ENOBUFS;
+ }
+ 
++static int nl80211_start_disabled(void *priv)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	msg = nl80211_bss_msg(bss, 0, NL80211_CMD_NEW_BEACON);
++	if (!msg)
++		goto fail;
++
++	if (nla_put_flag(msg, NL80211_ATTR_START_DISABLED))
++		goto fail;
++
++	ret = send_and_recv_msgs_connect_handle(drv, msg, bss, 1);
++
++	if (ret)
++		wpa_printf(MSG_ERROR, "Failed to set start_disabled. ret=%d (%s)",
++			   ret, strerror(-ret));
++
++	return ret;
++
++fail:
++	nlmsg_free(msg);
++	return ret;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.name = "nl80211",
+ 	.desc = "Linux nl80211/cfg80211",
+@@ -12930,4 +12958,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.three_wire_ctrl = nl80211_enable_three_wire,
+ 	.ibf_ctrl = nl80211_ibf_enable,
+ 	.ibf_dump = nl80211_ibf_dump,
++	.start_disabled = nl80211_start_disabled,
+ };
+diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
+index c4bf3ad..79bc76c 100644
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -3176,6 +3176,7 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_EHT_CAPABILITY,
+ 
+ 	/* add attributes here, update the policy in nl80211.c */
++	NL80211_ATTR_START_DISABLED = 999,
+ 
+ 	__NL80211_ATTR_AFTER_LAST,
+ 	NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
+-- 
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/99910-hostapd-mtk-Add-amsdu-set-get-ctrl.patch b/recipes-wifi/hostapd/files/patches-2.10.3/99910-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
new file mode 100644
index 0000000..c05a444
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/99910-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
@@ -0,0 +1,400 @@
+From 6cf5ec59e09945a075909b8070d9795869db081e Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Fri, 16 Dec 2022 03:57:11 +0800
+Subject: [PATCH 99910/99910] hostapd: mtk: Add amsdu set get ctrl
+
+---
+ hostapd/config_file.c             |   9 +++
+ hostapd/ctrl_iface.c              |  26 +++++++
+ hostapd/hostapd_cli.c             |   9 +++
+ src/ap/ap_config.c                |   1 +
+ src/ap/ap_config.h                |   1 +
+ src/ap/ap_drv_ops.c               |  14 ++++
+ src/ap/ap_drv_ops.h               |   2 +
+ src/ap/hostapd.c                  |   2 +
+ src/common/mtk_vendor.h           |  17 ++++-
+ src/drivers/driver.h              |   9 +++
+ src/drivers/driver_nl80211.c      | 114 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h      |   1 +
+ src/drivers/driver_nl80211_capa.c |   3 +
+ 13 files changed, 207 insertions(+), 1 deletion(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index fd61448..759033b 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4805,6 +4805,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 		u8 en = strtol(pos, NULL, 10);
+ 
+ 		conf->dfs_detect_mode = en;
++	} else if (os_strcmp(buf, "amsdu") == 0) {
++		int val = atoi(pos);
++		if (val < 0 || val > 1) {
++			wpa_printf(MSG_ERROR,
++					 "Line %d: invalid amsdu value",
++					 line);
++			return 1;
++		}
++		conf->amsdu = val;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 6ea1573..0ad8451 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3612,6 +3612,30 @@ hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_get_amsdu(struct hostapd_data *hapd, char *buf,
++					 size_t buflen)
++{
++	u8 amsdu;
++	int ret;
++	char *pos, *end;
++
++	pos = buf;
++	end = buf + buflen;
++
++	if (hostapd_drv_amsdu_dump(hapd, &amsdu) == 0) {
++		hapd->iconf->amsdu = amsdu;
++		ret = os_snprintf(pos, end - pos, "[hostapd_cli] AMSDU: %u\n",
++					hapd->iconf->amsdu);
++	}
++
++	if (os_snprintf_error(end - pos, ret))
++		return 0;
++
++	return ret;
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -4176,6 +4200,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 								   reply, reply_size);
+ 	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
+ 		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
++	} else if (os_strncmp(buf, "GET_AMSDU", 9) == 0) {
++		reply_len = hostapd_ctrl_iface_get_amsdu(hapd, reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index c2a123a..30b3392 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1593,6 +1593,13 @@ static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
+ }
+ 
+ 
++static int hostapd_cli_cmd_get_amsdu(struct wpa_ctrl *ctrl, int argc,
++					   char *argv[])
++{
++	return hostapd_cli_cmd(ctrl, "GET_AMSDU", 0, NULL, NULL);
++}
++
++
+ struct hostapd_cli_cmd {
+ 	const char *cmd;
+ 	int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]);
+@@ -1796,6 +1803,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+           "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
+ 	{ "get_ibf", hostapd_cli_cmd_get_ibf, NULL,
+ 	  " = show iBF state (enabled/disabled)"},
++	{ "get_amsdu", hostapd_cli_cmd_get_amsdu, NULL,
++		" = show AMSDU state"},
+ 	{ NULL, NULL, NULL, NULL }
+ };
+ 
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 7a96cb8..85ad5e4 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -299,6 +299,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ 	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
+ 	conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
+ 	conf->ibf_enable = IBF_DEFAULT_ENABLE;
++	conf->amsdu = 1;
+ 
+ 	return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 3f5afdf..92f1bd6 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1160,6 +1160,7 @@ struct hostapd_config {
+ 	u8 three_wire_enable;
+ 	u8 ibf_enable;
+ 	u8 dfs_detect_mode;
++	u8 amsdu;
+ };
+ 
+ enum three_wire_mode {
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 60ae825..1a82f23 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1077,4 +1077,18 @@ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
+ 	if (!hapd->driver || !hapd->driver->ibf_dump)
+ 		return 0;
+ 	return hapd->driver->ibf_dump(hapd->drv_priv, ibf_enable);
++}
++
++int hostapd_drv_amsdu_ctrl(struct hostapd_data *hapd)
++{
++	if (!hapd->driver || !hapd->driver->amsdu_ctrl)
++		return 0;
++	return hapd->driver->amsdu_ctrl(hapd->drv_priv, hapd->iconf->amsdu);
++}
++
++int hostapd_drv_amsdu_dump(struct hostapd_data *hapd, u8 *amsdu)
++{
++	if (!hapd->driver || !hapd->driver->amsdu_dump)
++		return 0;
++	return hapd->driver->amsdu_dump(hapd->drv_priv, amsdu);
+ }
+\ No newline at end of file
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index ab9aedc..4406666 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -147,6 +147,8 @@ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable);
++int hostapd_drv_amsdu_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_amsdu_dump(struct hostapd_data *hapd, u8 *amsdu);
+ 
+ #include "drivers/driver.h"
+ 
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 793ce2f..aef01f2 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2309,6 +2309,8 @@ dfs_offload:
+ 		goto fail;
+ 	if (hostapd_drv_ibf_ctrl(hapd) < 0)
+ 		goto fail;
++	if (hostapd_drv_amsdu_ctrl(hapd) < 0)
++		goto fail;
+ 
+ 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ 		   iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 4050cf8..0999ea9 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -167,7 +167,6 @@ enum mtk_vendor_attr_wireless_ctrl {
+ 	MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
+ 	MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
+ 	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
+-	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU,
+ 	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
+ 	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT,
+ 
+@@ -177,6 +176,22 @@ enum mtk_vendor_attr_wireless_ctrl {
+ 		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
+ };
+ 
++enum mtk_vendor_attr_wireless_dump {
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_UNSPEC,
++
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP,
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX =
++		NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP - 1
++};
++
++static const struct nla_policy
++wireless_dump_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP] = {
++	[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU] = { .type = NLA_U8 },
++};
++
+ enum mtk_vendor_attr_rfeature_ctrl {
+ 	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
+ 
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index aa23fbd..b07aaf3 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4727,6 +4727,15 @@ struct wpa_driver_ops {
+ 	 *
+ 	 */
+ 	int (*start_disabled)(void *priv);
++
++	/**
++	 * amsdu_ctrl - enable/disable amsdu
++	 * amsdu_dump - get current amsdu status
++	 * @priv: Private driver interface data
++	 *
++	 */
++	int (*amsdu_ctrl)(void *priv, u8 amsdu);
++	int (*amsdu_dump)(void *priv, u8 *amsdu);
+ };
+ 
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 003adc4..5c04284 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12804,6 +12804,118 @@ fail:
+ 	return ret;
+ }
+ 
++static int nl80211_enable_amsdu(void *priv, u8 amsdu)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_wireless_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting ap wireless control");
++		return 0;
++	}
++
++	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++	if (!msg)
++		goto fail;
++
++	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
++		goto fail;
++
++	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++	if (!data)
++		goto fail;
++
++	nla_put_u8(msg, MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU, amsdu);
++
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to set amsdu. ret=%d (%s)", ret, strerror(-ret));
++	}
++
++	return ret;
++
++fail:
++	nlmsg_free(msg);
++	return -ENOBUFS;
++}
++
++static int dump_amsdu_handler(struct nl_msg *msg, void *arg)
++{
++	u8 *amsdu = (u8 *) arg;
++	struct nlattr *tb[NL80211_ATTR_MAX + 1];
++	struct nlattr *tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX + 1];
++	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++	struct nlattr *nl_vend, *attr_amsdu;
++
++	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++			genlmsg_attrlen(gnlh, 0), NULL);
++
++	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++	if (!nl_vend)
++		return NL_SKIP;
++
++	nla_parse(tb_vendor, MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX,
++			nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++	attr_amsdu = tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU];
++	if (!attr_amsdu ){
++		wpa_printf(MSG_ERROR, "nl80211: cannot find vendor attributes");
++		return NL_SKIP;
++	}
++
++	*amsdu = nla_get_u8(attr_amsdu);
++
++	return NL_SKIP;
++}
++
++static int
++nl80211_dump_amsdu(void *priv, u8 *amsdu)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_wireless_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++				 "nl80211: Driver does not support ap_wireless control");
++		return 0;
++	}
++
++	msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
++	if (!msg)
++		goto fail;
++
++	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
++		goto fail;
++
++	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++	if (!data)
++		goto fail;
++
++	nla_nest_end(msg, data);
++
++	ret = send_and_recv_msgs(drv, msg, dump_amsdu_handler, amsdu, NULL, NULL);
++
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to dump amsdu. ret=%d (%s)", ret, strerror(-ret));
++	}
++
++	return ret;
++
++fail:
++	nlmsg_free(msg);
++	return -ENOBUFS;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.name = "nl80211",
+ 	.desc = "Linux nl80211/cfg80211",
+@@ -12959,4 +13071,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.ibf_ctrl = nl80211_ibf_enable,
+ 	.ibf_dump = nl80211_ibf_dump,
+ 	.start_disabled = nl80211_start_disabled,
++	.amsdu_ctrl = nl80211_enable_amsdu,
++	.amsdu_dump = nl80211_dump_amsdu,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 607592c..e570224 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -185,6 +185,7 @@ struct wpa_driver_nl80211_data {
+ 	unsigned int mtk_hemu_vendor_cmd_avail:1;
+ 	unsigned int mtk_3wire_vendor_cmd_avail:1;
+ 	unsigned int mtk_ibf_vendor_cmd_avail:1;
++	unsigned int mtk_wireless_vendor_cmd_avail:1;
+ 
+ 	u64 vendor_scan_cookie;
+ 	u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 9ecc0ff..fcfa68b 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1065,6 +1065,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ 				case MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL:
+ 					drv->mtk_ibf_vendor_cmd_avail = 1;
+ 					break;
++				case MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL:
++					drv->mtk_wireless_vendor_cmd_avail = 1;
++					break;
+ 				}
+ 			}
+ 
+-- 
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/99911-hostapd-mtk-Add-he_ldpc-configuration.patch b/recipes-wifi/hostapd/files/patches-2.10.3/99911-hostapd-mtk-Add-he_ldpc-configuration.patch
new file mode 100644
index 0000000..2e8dfe0
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/99911-hostapd-mtk-Add-he_ldpc-configuration.patch
@@ -0,0 +1,102 @@
+From 216258435a119d48c233b63c2383850bc5f86e94 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Thu, 12 Jan 2023 15:18:19 +0800
+Subject: [PATCH] hostapd: mtk: Add he_ldpc configuration
+
+---
+ hostapd/config_file.c        | 2 ++
+ hostapd/hostapd.conf         | 5 +++++
+ src/ap/ap_config.c           | 1 +
+ src/ap/ap_config.h           | 1 +
+ src/ap/ieee802_11_he.c       | 7 +++++++
+ src/common/ieee802_11_defs.h | 3 +++
+ 6 files changed, 19 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 10ea525..4237a5c 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3508,6 +3508,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 		conf->he_phy_capab.he_su_beamformee = atoi(pos);
+ 	} else if (os_strcmp(buf, "he_mu_beamformer") == 0) {
+ 		conf->he_phy_capab.he_mu_beamformer = atoi(pos);
++	} else if (os_strcmp(buf, "he_ldpc") == 0) {
++		conf->he_phy_capab.he_ldpc = atoi(pos);
+ 	} else if (os_strcmp(buf, "he_bss_color") == 0) {
+ 		conf->he_op.he_bss_color = atoi(pos) & 0x3f;
+ 		conf->he_op.he_bss_color_disabled = 0;
+diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
+index ea67aa1..e3a5eb3 100644
+--- a/hostapd/hostapd.conf
++++ b/hostapd/hostapd.conf
+@@ -830,6 +830,11 @@ wmm_ac_vo_acm=0
+ # 1 = supported
+ #he_mu_beamformer=1
+ 
++#he_ldpc: HE LDPC support
++# 0 = not supported
++# 1 = supported (default)
++#he_ldpc=1
++
+ # he_bss_color: BSS color (1-63)
+ #he_bss_color=1
+ 
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 85ad5e4..b283de6 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -268,6 +268,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ #endif /* CONFIG_ACS */
+ 
+ #ifdef CONFIG_IEEE80211AX
++	conf->he_phy_capab.he_ldpc = 1;
+ 	conf->he_op.he_rts_threshold = HE_OPERATION_RTS_THRESHOLD_MASK >>
+ 		HE_OPERATION_RTS_THRESHOLD_OFFSET;
+ 	/* Set default basic MCS/NSS set to single stream MCS 0-7 */
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index a9ac396..b8b20a7 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -929,6 +929,7 @@ struct hostapd_bss_config {
+  * struct he_phy_capabilities_info - HE PHY capabilities
+  */
+ struct he_phy_capabilities_info {
++	bool he_ldpc;
+ 	bool he_su_beamformer;
+ 	bool he_su_beamformee;
+ 	bool he_mu_beamformer;
+diff --git a/src/ap/ieee802_11_he.c b/src/ap/ieee802_11_he.c
+index b5b7e5d..f27aeb1 100644
+--- a/src/ap/ieee802_11_he.c
++++ b/src/ap/ieee802_11_he.c
+@@ -138,6 +138,13 @@ u8 * hostapd_eid_he_capab(struct hostapd_data *hapd, u8 *eid,
+ 		os_memcpy(&cap->optional[mcs_nss_size],
+ 			  mode->he_capab[opmode].ppet,  ppet_size);
+ 
++	if (hapd->iface->conf->he_phy_capab.he_ldpc)
++		cap->he_phy_capab_info[HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX] |=
++			HE_PHYCAP_LDPC_CODING_IN_PAYLOAD;
++	else
++		cap->he_phy_capab_info[HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX] &=
++			~HE_PHYCAP_LDPC_CODING_IN_PAYLOAD;
++
+ 	if (hapd->iface->conf->he_phy_capab.he_su_beamformer)
+ 		cap->he_phy_capab_info[HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX] |=
+ 			HE_PHYCAP_SU_BEAMFORMER_CAPAB;
+diff --git a/src/common/ieee802_11_defs.h b/src/common/ieee802_11_defs.h
+index 65e125e..62088bd 100644
+--- a/src/common/ieee802_11_defs.h
++++ b/src/common/ieee802_11_defs.h
+@@ -2298,6 +2298,9 @@ struct ieee80211_spatial_reuse {
+ #define HE_PHYCAP_CHANNEL_WIDTH_SET_160MHZ_IN_5G	((u8) BIT(3))
+ #define HE_PHYCAP_CHANNEL_WIDTH_SET_80PLUS80MHZ_IN_5G	((u8) BIT(4))
+ 
++#define HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX	1
++#define HE_PHYCAP_LDPC_CODING_IN_PAYLOAD	((u8) BIT(5))
++
+ #define HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX	3
+ #define HE_PHYCAP_SU_BEAMFORMER_CAPAB		((u8) BIT(7))
+ #define HE_PHYCAP_SU_BEAMFORMEE_CAPAB_IDX	4
+-- 
+2.39.0
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/99912-hostapd-mtk-Add-the-broadcast-destination-address-of.patch b/recipes-wifi/hostapd/files/patches-2.10.3/99912-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
new file mode 100644
index 0000000..df9dcc5
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/99912-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
@@ -0,0 +1,43 @@
+From 9c04bbbe2677cc11b88c867ab7b1df7e408483b5 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Tue, 17 Jan 2023 13:25:18 +0800
+Subject: [PATCH] hostapd: mtk: Add the broadcast destination address of Probe
+ Response frame on 6 GHz
+
+According to IEEE 802.11ax 26.17.2.3.2,
+if a 6 GHz AP receives a Probe Request frame and responds with a Probe Response frame,
+the Address 1 field of the Probe Response frame shall be set to the broadcast address,
+unless the AP is not indicating its actual SSID in the SSID element of its Beacon frames.
+
+Without this, hostapd fill the Address 1 feild of the Probe Response frame
+with the source address from Probe Request frame on 6 GHz.
+Fix this to use broadcast address instead.
+
+Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
+---
+ src/ap/beacon.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/src/ap/beacon.c b/src/ap/beacon.c
+index 1a26f11..f3ea5c2 100644
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1156,8 +1156,13 @@ void handle_probe_req(struct hostapd_data *hapd,
+ 	wpa_msg_ctrl(hapd->msg_ctx, MSG_INFO, RX_PROBE_REQUEST "sa=" MACSTR
+ 		     " signal=%d", MAC2STR(mgmt->sa), ssi_signal);
+ 
+-	resp = hostapd_gen_probe_resp(hapd, mgmt, elems.p2p != NULL,
+-				      &resp_len, false);
++	if (is_6ghz_op_class(hapd->iconf->op_class) &&
++	    is_broadcast_ether_addr(mgmt->da))
++		resp = hostapd_gen_probe_resp(hapd, NULL, elems.p2p != NULL,
++					      &resp_len, true);
++	else
++		resp = hostapd_gen_probe_resp(hapd, mgmt, elems.p2p != NULL,
++					      &resp_len, false);
+ 	if (resp == NULL)
+ 		return;
+ 
+-- 
+2.39.0
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc b/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
index 500c124..23e59fe 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
@@ -62,4 +62,17 @@
     file://800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch \
     file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
     file://992-openssl-include-rsa.patch \
+    file://99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch \
+    file://99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch \
+    file://99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch \
+    file://99903-hostapd-mtk-Add-mtk_vendor.h.patch \
+    file://99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch \
+    file://99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch \
+    file://99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch \
+    file://99907-hostapd-mtk-Add-hostapd-iBF-control.patch \
+    file://99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch \
+    file://99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch \
+    file://99910-hostapd-mtk-Add-amsdu-set-get-ctrl.patch \
+    file://99911-hostapd-mtk-Add-he_ldpc-configuration.patch \
+    file://99912-hostapd-mtk-Add-the-broadcast-destination-address-of.patch \
     "
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch
new file mode 100644
index 0000000..f790577
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch
@@ -0,0 +1,475 @@
+From 4791a374c9861b0d90db7fbdefe509f4e7d12247 Mon Sep 17 00:00:00 2001
+From: "howard.hsu" <howard-yh.hsu@mediatek.com>
+Date: Wed, 19 Jan 2022 19:18:07 +0800
+Subject: [PATCH 99900/99910] hostapd: mtk: Add neighbor report and BSS
+ Termination for MBO certification
+
+1. Add hostapd_neighbor_count() and hostapd_neighbor_insert_buffer ()
+The first function can count the number of neighbor report in neighbore report
+database. The second can iterate neighbor report database to build up neighbor
+report data.
+
+2. Support including neighbor report elements in ANQP response
+3. Support including neignbor report elements in BTM response
+4. Support configuring BSS Termination TSF by using hostapd_cli command
+5. Disable interface if BSS Termination TSF is set
+6. Add set_send_disassoc_frame_timer() to send disassociate frame
+Function set_disassoc_timer() may fail if key was deleted first. This new
+function will not ask to delete key as set_disassoc_timer() did.
+7. Support including neighbor report elements in BTM request
+8. Add hostapd_neighbor_set_own_report_pref()
+9. Add hostapd_neighbor_set_pref_by_non_pref_chan()
+---
+ hostapd/ctrl_iface.c   |   5 ++
+ src/ap/ap_config.c     |   1 +
+ src/ap/ap_config.h     |   1 +
+ src/ap/ctrl_iface_ap.c |  19 ++++++-
+ src/ap/gas_serv.c      |  29 ++++++++++
+ src/ap/gas_serv.h      |   2 +
+ src/ap/neighbor_db.c   | 119 +++++++++++++++++++++++++++++++++++++++++
+ src/ap/neighbor_db.h   |   9 ++++
+ src/ap/wnm_ap.c        |  72 +++++++++++++++++++++++--
+ 9 files changed, 252 insertions(+), 5 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index a258492..c2a2822 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1338,6 +1338,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
+ #endif /* CONFIG_DPP */
+ 	} else if (os_strcasecmp(cmd, "setband") == 0) {
+ 		ret = hostapd_ctrl_iface_set_band(hapd, value);
++	} else if (os_strcasecmp(cmd, "bss_termination_tsf") == 0) {
++		int termination_sec = atoi(value);
++		hapd->conf->bss_termination_tsf = termination_sec;
++		wpa_printf(MSG_DEBUG, "BSS Termination TSF: value = %d",
++                termination_sec);
+ 	} else {
+ 		ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
+ 		if (ret)
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index d7a0c7c..4a20eb4 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
+ 	/* comeback after 10 TUs */
+ 	bss->pasn_comeback_after = 10;
+ #endif /* CONFIG_PASN */
++	bss->bss_termination_tsf = 0;
+ }
+ 
+ 
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index ed3bec7..3f68e76 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -557,6 +557,7 @@ struct hostapd_bss_config {
+ 	int wnm_sleep_mode;
+ 	int wnm_sleep_mode_no_keys;
+ 	int bss_transition;
++	unsigned int bss_termination_tsf;
+ 
+ 	/* IEEE 802.11u - Interworking */
+ 	int interworking;
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index 96209ce..18bae5c 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1203,6 +1203,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ 			wpa_printf(MSG_DEBUG, "Invalid bss_term data");
+ 			return -1;
+ 		}
++		if (hapd->conf->bss_termination_tsf) {
++			WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
++		}
++
+ 		end++;
+ 		WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
+ 	}
+@@ -1229,14 +1233,25 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ 		req_mode |= WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT;
+ 	}
+ 
+-	if (os_strstr(cmd, " pref=1"))
++	if (os_strstr(cmd, " pref=1")) {
+ 		req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
++		if (nei_len == 0) {
++			// Add neigibor report from neighbor report db to nei_rep buffer
++			nei_len = hostapd_neighbor_insert_buffer (hapd, nei_rep, 1000);
++		}
++	}
+ 	if (os_strstr(cmd, " abridged=1"))
+ 		req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
+-	if (os_strstr(cmd, " disassoc_imminent=1"))
++	if (os_strstr(cmd, " disassoc_imminent=1")) {
+ 		req_mode |= WNM_BSS_TM_REQ_DISASSOC_IMMINENT;
++		/* Set own BSS neighbor report preference value as 0 */
++		hostapd_neighbor_set_own_report_pref(hapd, nei_rep, nei_len, 0);
++	}
++
+ 
+ #ifdef CONFIG_MBO
++	hostapd_neighbor_set_pref_by_non_pref_chan(hapd, sta, nei_rep, nei_len);
++
+ 	pos = os_strstr(cmd, "mbo=");
+ 	if (pos) {
+ 		unsigned int mbo_reason, cell_pref, reassoc_delay;
+diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
+index 90f1577..5845ff8 100644
+--- a/src/ap/gas_serv.c
++++ b/src/ap/gas_serv.c
+@@ -19,6 +19,7 @@
+ #include "dpp_hostapd.h"
+ #include "sta_info.h"
+ #include "gas_serv.h"
++#include "neighbor_db.h"
+ 
+ 
+ #ifdef CONFIG_DPP
+@@ -369,6 +370,24 @@ static void anqp_add_network_auth_type(struct hostapd_data *hapd,
+ 	}
+ }
+ 
++static void anqp_add_neighbor_report(struct hostapd_data *hapd,
++				       struct wpabuf *buf)
++{
++	struct hostapd_neighbor_entry *nr;
++	u8 *len_pos = gas_anqp_add_element(buf, ANQP_NEIGHBOR_REPORT);
++	if (dl_list_empty(&hapd->nr_db)) {
++		wpabuf_put_le16(buf, 0);
++	}
++	else {
++		dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry, list ) {
++			wpabuf_put_u8(buf, WLAN_EID_NEIGHBOR_REPORT);
++			wpabuf_put_u8(buf, wpabuf_len(nr->nr));
++			wpabuf_put_buf(buf, nr->nr);
++		}
++	}
++	gas_anqp_set_element_len(buf, len_pos);
++}
++
+ 
+ static void anqp_add_roaming_consortium(struct hostapd_data *hapd,
+ 					struct wpabuf *buf)
+@@ -986,6 +1005,9 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
+ 		len += 1000;
+ 	if (request & ANQP_REQ_ICON_REQUEST)
+ 		len += 65536;
++    if (request & ANQP_REQ_NEIGHBOR_REPORT) {
++        len += (40 * hostapd_neighbor_count(hapd));
++    }
+ #ifdef CONFIG_FILS
+ 	if (request & ANQP_FILS_REALM_INFO)
+ 		len += 2 * dl_list_len(&hapd->conf->fils_realms);
+@@ -1028,6 +1050,8 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
+ 		anqp_add_elem(hapd, buf, ANQP_TDLS_CAPABILITY);
+ 	if (request & ANQP_REQ_EMERGENCY_NAI)
+ 		anqp_add_elem(hapd, buf, ANQP_EMERGENCY_NAI);
++	if (request & ANQP_REQ_NEIGHBOR_REPORT)
++		anqp_add_neighbor_report(hapd, buf);
+ 
+ 	for (i = 0; i < num_extra_req; i++) {
+ #ifdef CONFIG_FILS
+@@ -1172,6 +1196,11 @@ static void rx_anqp_query_list_id(struct hostapd_data *hapd, u16 info_id,
+ 			     "Emergency NAI",
+ 			     get_anqp_elem(hapd, info_id) != NULL, qi);
+ 		break;
++	case ANQP_NEIGHBOR_REPORT:
++		set_anqp_req(ANQP_REQ_NEIGHBOR_REPORT,
++			     "Neighbor Report",
++			     get_anqp_elem(hapd, info_id) != NULL, qi);
++		break;
+ 	default:
+ #ifdef CONFIG_FILS
+ 		if (info_id == ANQP_FILS_REALM_INFO &&
+diff --git a/src/ap/gas_serv.h b/src/ap/gas_serv.h
+index 1528af4..d0241f2 100644
+--- a/src/ap/gas_serv.h
++++ b/src/ap/gas_serv.h
+@@ -40,6 +40,8 @@
+ 	(1 << (ANQP_TDLS_CAPABILITY - ANQP_QUERY_LIST))
+ #define ANQP_REQ_EMERGENCY_NAI \
+ 	(1 << (ANQP_EMERGENCY_NAI - ANQP_QUERY_LIST))
++#define ANQP_REQ_NEIGHBOR_REPORT \
++	(1 << (ANQP_NEIGHBOR_REPORT - ANQP_QUERY_LIST))
+ /*
+  * First 15 Hotspot 2.0 vendor specific ANQP-elements can be included in the
+  * optimized bitmap.
+diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
+index 52f25eb..9254d09 100644
+--- a/src/ap/neighbor_db.c
++++ b/src/ap/neighbor_db.c
+@@ -89,6 +89,38 @@ int hostapd_neighbor_show(struct hostapd_data *hapd, char *buf, size_t buflen)
+ }
+ 
+ 
++int hostapd_neighbor_count(struct hostapd_data *hapd)
++{
++	struct hostapd_neighbor_entry *nr;
++	int count = 0;
++
++	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++			 list) {
++		count++;
++	}
++	return count;
++}
++
++
++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++        size_t buflen)
++{
++	struct hostapd_neighbor_entry *nr;
++	char *pos = buf;
++
++	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++			 list) {
++		/* For neighbor report IE, we only need bssid and nr*/
++		*pos++ = WLAN_EID_NEIGHBOR_REPORT;
++		*pos++ = wpabuf_len(nr->nr);
++		os_memcpy(pos, wpabuf_head(nr->nr), wpabuf_len(nr->nr));
++		pos += wpabuf_len(nr->nr);
++	}
++
++	return pos - buf;
++}
++
++
+ static void hostapd_neighbor_clear_entry(struct hostapd_neighbor_entry *nr)
+ {
+ 	wpabuf_free(nr->nr);
+@@ -325,3 +357,90 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
+ 	wpabuf_free(nr);
+ #endif /* NEED_AP_MLME */
+ }
++
++
++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
++			 size_t buflen, const int pref)
++{
++	struct hostapd_neighbor_entry *nr;
++	char *pos, *next_nr;
++
++	pos = nei_buf;
++	next_nr = nei_buf;
++
++	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++			 list) {
++		pos = next_nr;
++		next_nr = pos + 2 + wpabuf_len(nr->nr);
++		/* Shift 2 bytes for Element ID and Neighbor report length */
++		pos = pos + 2;
++		if(os_memcmp(pos, hapd->own_addr, ETH_ALEN) == 0) {
++			/* Shift for BSSID + BSSID info + Op_class + channel num + PHY type */
++			pos = pos + 6 + 4 + 1 + 1 + 1;
++
++			/* Iterate Subelement */
++			while (next_nr - pos > 0) {
++				if (*pos == 3) {
++					pos = pos + 2;
++					*pos = pref;
++					return;
++				} else {
++					pos++;
++					int shift_len = *pos++;
++					pos = pos + shift_len;
++				}
++			}
++		}
++	}
++}
++
++#ifdef CONFIG_MBO
++void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
++			 struct sta_info* sta, char *nei_buf, size_t buflen)
++{
++	struct hostapd_neighbor_entry *nr;
++	struct mbo_non_pref_chan_info *info;
++	u8 i;
++
++	for(info = sta->non_pref_chan; info; info = info->next) {
++		/* Check OP_Class and Channel num */
++		for(i = 0; i < info->num_channels; i++) {
++			char *pos, *next_nr;
++
++			pos = nei_buf;
++			next_nr = nei_buf;
++
++			/* Iterate Neighbor report database */
++			dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++					 list) {
++				pos = next_nr;
++				next_nr = pos + 2 + wpabuf_len(nr->nr);
++				/**
++				 * Shift 12 bytes for Element ID, Neighbor report length,
++				 * BSSID and BSSID info.
++				 */
++				pos = pos + 12;
++				int nr_op_class = *pos++;
++				int nr_channel = *pos;
++				if(info->op_class == nr_op_class && info->channels[i] == nr_channel) {
++					/* Shift for Channel Num + PHY type */
++					pos = pos + 1 + 1;
++
++					// Iterate Subelement
++					while(next_nr - pos > 0) {
++						if(*pos == 3) {
++							pos = pos + 2;
++							*pos = info->pref;
++							break;
++						}else {
++							pos++;
++							int shift_len = *pos++;
++							pos = pos + shift_len;
++						}
++					}
++				}
++			}
++		}
++	}
++}
++#endif
+diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
+index 992671b..a1ddc07 100644
+--- a/src/ap/neighbor_db.h
++++ b/src/ap/neighbor_db.h
+@@ -24,4 +24,13 @@ int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid,
+ 			    const struct wpa_ssid_value *ssid);
+ void hostapd_free_neighbor_db(struct hostapd_data *hapd);
+ 
++int hostapd_neighbor_count(struct hostapd_data *hapd);
++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++        size_t buflen);
++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
++			 size_t buflen, const int pref);
++#ifdef CONFIG_MBO
++void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
++			 struct sta_info* sta, char *nei_buf, size_t buflen);
++#endif
+ #endif /* NEIGHBOR_DB_H */
+diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
+index 3ea92af..4349e1d 100644
+--- a/src/ap/wnm_ap.c
++++ b/src/ap/wnm_ap.c
+@@ -20,6 +20,7 @@
+ #include "ap/wpa_auth.h"
+ #include "mbo_ap.h"
+ #include "wnm_ap.h"
++#include "ap/neighbor_db.h"
+ 
+ #define MAX_TFS_IE_LEN  1024
+ 
+@@ -370,9 +371,21 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
+ 	u8 *pos;
+ 	int res;
+ 
+-	mgmt = os_zalloc(sizeof(*mgmt));
+-	if (mgmt == NULL)
++	int nr_num = hostapd_neighbor_count(hapd);
++	int nr_size = ETH_ALEN + 4 + 1 + 1 + 1 + 5;
++	int total_nr_size = nr_num * nr_size;
++	u8 *nr_data = os_malloc(total_nr_size);
++	int nr_data_len = 0;
++	if(nr_data == NULL) {
++		wpa_printf (MSG_ERROR, "Failed to allocate memory");
++	} else {
++	    nr_data_len = hostapd_neighbor_insert_buffer(hapd, nr_data, total_nr_size);
++	}
++	mgmt = os_zalloc(sizeof(*mgmt) + nr_data_len);
++	if (mgmt == NULL) {
++		wpa_printf (MSG_ERROR, "Failed to allocate memory for mgmt frame");
+ 		return -1;
++	}
+ 	os_memcpy(mgmt->da, addr, ETH_ALEN);
+ 	os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
+ 	os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
+@@ -382,10 +395,18 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
+ 	mgmt->u.action.u.bss_tm_req.action = WNM_BSS_TRANS_MGMT_REQ;
+ 	mgmt->u.action.u.bss_tm_req.dialog_token = dialog_token;
+ 	mgmt->u.action.u.bss_tm_req.req_mode = 0;
++	if(nr_num) {
++		mgmt->u.action.u.bss_tm_req.req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
++	}
+ 	mgmt->u.action.u.bss_tm_req.disassoc_timer = host_to_le16(0);
+ 	mgmt->u.action.u.bss_tm_req.validity_interval = 1;
+ 	pos = mgmt->u.action.u.bss_tm_req.variable;
+ 
++	if(nr_num) {
++		os_memcpy(pos, nr_data, nr_data_len);
++		pos += nr_data_len;
++	}
++
+ 	hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ 	wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
+ 		   MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
+@@ -759,6 +780,50 @@ static void set_disassoc_timer(struct hostapd_data *hapd, struct sta_info *sta,
+ }
+ 
+ 
++static void set_send_disassoc_frame_timer(struct hostapd_data *hapd, struct sta_info *sta,
++			       int disassoc_timer)
++{
++	int timeout, beacon_int;
++
++	/*
++	 * Prevent STA from reconnecting using cached PMKSA to force
++	 * full authentication with the authentication server (which may
++	 * decide to reject the connection),
++	 */
++	wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
++
++	beacon_int = hapd->iconf->beacon_int;
++	if (beacon_int < 1)
++		beacon_int = 100; /* best guess */
++	/* Calculate timeout in ms based on beacon_int in TU */
++	timeout = disassoc_timer * beacon_int * 128 / 125;
++	wpa_printf(MSG_DEBUG, "Disassociation timer for " MACSTR
++		   " set to %d ms", MAC2STR(sta->addr), timeout);
++
++	u16 reason = WLAN_REASON_PREV_AUTH_NOT_VALID;
++
++	hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
++	if (sta)
++		ap_sta_disassociate(hapd, sta, reason);
++}
++
++
++void bss_termination_disable_iface(void *eloop_ctx, void *timeout_ctx)
++{
++	struct hostapd_data *hapd = eloop_ctx;
++	hostapd_disable_iface(hapd->iface);
++}
++
++
++static void set_disable_iface_timer(struct hostapd_data *hapd, struct sta_info *sta,
++			       int disable_iface_timer)
++{
++	wpa_printf(MSG_DEBUG, "Disable interface timer set to %d secs", disable_iface_timer);
++	eloop_register_timeout(disable_iface_timer, 0,
++			       bss_termination_disable_iface, hapd, NULL);
++}
++
++
+ int wnm_send_ess_disassoc_imminent(struct hostapd_data *hapd,
+ 				   struct sta_info *sta, const char *url,
+ 				   int disassoc_timer)
+@@ -848,6 +913,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
+ 	    bss_term_dur) {
+ 		os_memcpy(pos, bss_term_dur, 12);
+ 		pos += 12;
++		set_disable_iface_timer(hapd, sta, hapd->conf->bss_termination_tsf);
+ 	}
+ 
+ 	if (url) {
+@@ -884,7 +950,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
+ 	hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ 	if (disassoc_timer) {
+ 		/* send disassociation frame after time-out */
+-		set_disassoc_timer(hapd, sta, disassoc_timer);
++		set_send_disassoc_frame_timer(hapd, sta, disassoc_timer);
+ 	}
+ 
+ 	return 0;
+-- 
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
new file mode 100644
index 0000000..3c5137d
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
@@ -0,0 +1,36 @@
+From 6d95c027c13fba5404fa8d096d55b4a072b2ec59 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 20 Sep 2022 19:33:45 +0800
+Subject: [PATCH 99901/99910] hostapd: mtk: print sae groups by hostapd ctrl
+
+---
+ hostapd/ctrl_iface.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index c2a2822..bc690c5 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1412,6 +1412,19 @@ static int hostapd_ctrl_iface_get(struct hostapd_data *hapd, char *cmd,
+ 		if (os_snprintf_error(buflen, res))
+ 			return -1;
+ 		return res;
++	} else if (os_strcmp(cmd, "sae_group_capability") == 0) {
++#ifdef CONFIG_SAE
++		/* see sae_set_group() */
++		res = os_snprintf(buf, buflen, "%s%s%s%s19 20 21",
++				  dh_groups_get(15) ? "15 ": "",
++				  dh_groups_get(16) ? "16 ": "",
++				  dh_groups_get(17) ? "17 ": "",
++				  dh_groups_get(18) ? "18 ": "");
++
++		if (os_snprintf_error(buflen, res))
++			return -1;
++		return res;
++#endif /* CONFIG_SAE */
+ 	}
+ 
+ 	return -1;
+-- 
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
new file mode 100644
index 0000000..885c6c9
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
@@ -0,0 +1,211 @@
+From 7a84545afb1f5bc2784eb5a046d56d869fb52067 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Tue, 31 May 2022 21:15:54 +0800
+Subject: [PATCH 99902/99910] hostapd: mtk: add support for runtime set in-band
+ discovery
+
+Usage:
+hostapd_cli unsolic_probe_resp [tx_type] [interval]
+
+0: disable all in-band discovery
+1: enable unsolicited probe response
+2: enable FILS discovery
+
+Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+---
+ hostapd/ctrl_iface.c         | 66 ++++++++++++++++++++++++++++++++++++
+ hostapd/hostapd_cli.c        | 20 +++++++++++
+ src/ap/beacon.c              |  5 ++-
+ src/drivers/driver_nl80211.c | 10 ++++--
+ src/drivers/nl80211_copy.h   |  1 +
+ 5 files changed, 98 insertions(+), 4 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index bc690c5..bb8c74f 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -826,6 +826,69 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
+ 
+ #endif /* CONFIG_INTERWORKING */
+ 
++static int hostapd_ctrl_iface_inband_discovery(struct hostapd_data *hapd,
++					       const char *cmd)
++{
++	struct hostapd_bss_config *conf = hapd->conf;
++	const char *pos = cmd;
++	int tx_type, interval, ret;
++
++	tx_type = atoi(pos);
++	if (tx_type < 0 || tx_type > 2) {
++		wpa_printf(MSG_ERROR, "Invalid tx type\n");
++		return -1;
++	}
++
++	pos = os_strchr(pos, ' ');
++	if(!pos)
++		return -1;
++	pos++;
++	interval = atoi(pos);
++	if (interval < 0 || interval > 20) {
++		wpa_printf(MSG_ERROR, "Invalid interval value\n");
++		return -1;
++	}
++
++	wpa_printf(MSG_ERROR, "Set inband discovery type:%d, interval:%d\n",
++			      tx_type, interval);
++
++#define DISABLE_INBAND_DISC 0
++#define UNSOL_PROBE_RESP 1
++#define FILS_DISCOVERY 2
++
++#ifdef CONFIG_FILS
++	conf->fils_discovery_max_int = 0;
++	conf->fils_discovery_min_int = 0;
++#endif /* CONFIG_FILS */
++	conf->unsol_bcast_probe_resp_interval = 0;
++
++	switch (tx_type) {
++	case DISABLE_INBAND_DISC:
++	default:
++		/* Disable both Unsolicited probe response and FILS discovery*/
++		break;
++	case UNSOL_PROBE_RESP:
++		/* Enable Unsolicited probe response */
++		conf->unsol_bcast_probe_resp_interval = interval;
++		break;
++#ifdef CONFIG_FILS
++	case FILS_DISCOVERY:
++		/* Enable FILS discovery */
++		conf->fils_discovery_min_int = interval;
++		conf->fils_discovery_max_int = interval;
++		break;
++#endif /* CONFIG_FILS */
++	}
++
++	ret = ieee802_11_update_beacons(hapd->iface);
++	if(ret) {
++		wpa_printf(MSG_DEBUG,
++			"Failed to update with inband discovery parameters\n");
++		return -1;
++	}
++
++	return 0;
++}
+ 
+ #ifdef CONFIG_WNM_AP
+ 
+@@ -3434,6 +3497,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 		if (hostapd_ctrl_iface_coloc_intf_req(hapd, buf + 15))
+ 			reply_len = -1;
+ #endif /* CONFIG_WNM_AP */
++	} else if (os_strncmp(buf, "INBAND_DISCOVERY ", 17) == 0) {
++		if (hostapd_ctrl_iface_inband_discovery(hapd, buf + 17))
++			reply_len = -1;
+ 	} else if (os_strcmp(buf, "GET_CONFIG") == 0) {
+ 		reply_len = hostapd_ctrl_iface_get_config(hapd, reply,
+ 							  reply_size);
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index 85c41d0..db21258 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -642,6 +642,24 @@ static int hostapd_cli_cmd_wps_config(struct wpa_ctrl *ctrl, int argc,
+ 	return wpa_ctrl_command(ctrl, buf);
+ }
+ 
++static int hostapd_cli_cmd_inband_discovery(struct wpa_ctrl *ctrl, int argc,
++					    char *argv[])
++{
++	char buf[300];
++	int res;
++
++	if (argc < 2) {
++		printf("Invalid 'inband_discovery' command - two arguments"
++		       "tx_type interval\n");
++		return -1;
++	}
++
++	res = os_snprintf(buf, sizeof(buf), "INBAND_DISCOVERY %s %s",
++			  argv[0], argv[1]);
++	if (os_snprintf_error(sizeof(buf), res))
++		return -1;
++	return wpa_ctrl_command(ctrl, buf);
++}
+ 
+ static int hostapd_cli_cmd_disassoc_imminent(struct wpa_ctrl *ctrl, int argc,
+ 					     char *argv[])
+@@ -1749,6 +1767,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ 	{ "driver", hostapd_cli_cmd_driver, NULL,
+ 	  "<driver sub command> [<hex formatted data>] = send driver command data" },
+ #endif /* ANDROID */
++	{ "inband_discovery", hostapd_cli_cmd_inband_discovery, NULL,
++          "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
+ 	{ NULL, NULL, NULL, NULL }
+ };
+ 
+diff --git a/src/ap/beacon.c b/src/ap/beacon.c
+index 814e86e..1a26f11 100644
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1497,6 +1497,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+ 				   struct wpa_driver_ap_params *params)
+ {
+ 	params->fd_max_int = hapd->conf->fils_discovery_max_int;
++	params->unsol_bcast_probe_resp_interval =
++		hapd->conf->unsol_bcast_probe_resp_interval;
+ 	if (is_6ghz_op_class(hapd->iconf->op_class) &&
+ 	    params->fd_max_int > FD_MAX_INTERVAL_6GHZ)
+ 		params->fd_max_int = FD_MAX_INTERVAL_6GHZ;
+@@ -1505,7 +1507,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+ 	if (params->fd_min_int > params->fd_max_int)
+ 		params->fd_min_int = params->fd_max_int;
+ 
+-	if (params->fd_max_int)
++	if (params->fd_max_int || (is_6ghz_op_class(hapd->iconf->op_class) &&
++	    !params->unsol_bcast_probe_resp_interval))
+ 		return hostapd_gen_fils_discovery(hapd,
+ 						  &params->fd_frame_tmpl_len);
+ 
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 53f2503..5eba0ea 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -4498,9 +4498,10 @@ static int nl80211_fils_discovery(struct i802_bss *bss, struct nl_msg *msg,
+ 			params->fd_max_int) ||
+ 	    (params->fd_frame_tmpl &&
+ 	     nla_put(msg, NL80211_FILS_DISCOVERY_ATTR_TMPL,
+-		     params->fd_frame_tmpl_len, params->fd_frame_tmpl)))
++		     params->fd_frame_tmpl_len, params->fd_frame_tmpl)) ||
++	    nla_put_u32(msg, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE,
++			params->unsol_bcast_probe_resp_interval))
+ 		return -1;
+-
+ 	nla_nest_end(msg, attr);
+ 	return 0;
+ }
+@@ -4844,7 +4845,10 @@ static int wpa_driver_nl80211_set_ap(void *priv,
+ #endif /* CONFIG_SAE */
+ 
+ #ifdef CONFIG_FILS
+-	if (params->fd_max_int && nl80211_fils_discovery(bss, msg, params) < 0)
++	if ((params->fd_max_int ||
++	    ((params->freq->freq > 5950 && params->freq->freq <= 7115) &&
++	      !(params->unsol_bcast_probe_resp_interval))) &&
++	     nl80211_fils_discovery(bss, msg, params) < 0)
+ 		goto fail;
+ #endif /* CONFIG_FILS */
+ 
+diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
+index 0568a79..c4bf3ad 100644
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -7379,6 +7379,7 @@ enum nl80211_fils_discovery_attributes {
+ 	NL80211_FILS_DISCOVERY_ATTR_INT_MIN,
+ 	NL80211_FILS_DISCOVERY_ATTR_INT_MAX,
+ 	NL80211_FILS_DISCOVERY_ATTR_TMPL,
++	NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE,
+ 
+ 	/* keep last */
+ 	__NL80211_FILS_DISCOVERY_ATTR_LAST,
+-- 
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99903-hostapd-mtk-Add-mtk_vendor.h.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99903-hostapd-mtk-Add-mtk_vendor.h.patch
new file mode 100644
index 0000000..d108ca3
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99903-hostapd-mtk-Add-mtk_vendor.h.patch
@@ -0,0 +1,214 @@
+From 8694400211d08019e4c495fc98ca3e3783465044 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Mon, 30 May 2022 15:04:57 +0800
+Subject: [PATCH 99903/99910] hostapd: mtk: Add mtk_vendor.h
+
+---
+ src/common/mtk_vendor.h | 195 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 195 insertions(+)
+ create mode 100644 src/common/mtk_vendor.h
+
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+new file mode 100644
+index 0000000..528387f
+--- /dev/null
++++ b/src/common/mtk_vendor.h
+@@ -0,0 +1,195 @@
++// SPDX-License-Identifier: ISC
++/* Copyright (C) 2020 Felix Fietkau <nbd@nbd.name> */
++#ifndef MTK_VENDOR_H
++#define MTK_VENDOR_H
++
++#define OUI_MTK    0x000ce7
++
++enum mtk_nl80211_vendor_subcmds {
++	MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
++	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
++	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
++	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
++	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++};
++
++enum mtk_vendor_attr_edcca_ctrl {
++	MTK_VENDOR_ATTR_EDCCA_THRESHOLD_INVALID = 0,
++
++	MTK_VENDOR_ATTR_EDCCA_CTRL_MODE,
++	MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL,
++	MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL,
++	MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL,
++	MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL,
++	MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL,
++	MTK_VENDOR_ATTR_EDCCA_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
++};
++
++enum mtk_vendor_attr_edcca_ctrl_mode {
++	EDCCA_CTRL_SET_EN = 0,
++	EDCCA_CTRL_SET_THERS,
++	EDCCA_CTRL_GET_EN,
++	EDCCA_CTRL_GET_THERS,
++	EDCCA_CTRL_NUM,
++};
++
++static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
++	[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_U8 },
++};
++
++enum mtk_vendor_attr_csi_ctrl {
++	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG,
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE,
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE,
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1,
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2,
++	MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR,
++	MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL,
++
++	MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM,
++
++	MTK_VENDOR_ATTR_CSI_CTRL_DATA,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_CSI_CTRL,
++	MTK_VENDOR_ATTR_CSI_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_CSI_CTRL - 1
++};
++
++enum mtk_vendor_attr_csi_data {
++	MTK_VENDOR_ATTR_CSI_DATA_UNSPEC,
++	MTK_VENDOR_ATTR_CSI_DATA_PAD,
++
++	MTK_VENDOR_ATTR_CSI_DATA_VER,
++	MTK_VENDOR_ATTR_CSI_DATA_TS,
++	MTK_VENDOR_ATTR_CSI_DATA_RSSI,
++	MTK_VENDOR_ATTR_CSI_DATA_SNR,
++	MTK_VENDOR_ATTR_CSI_DATA_BW,
++	MTK_VENDOR_ATTR_CSI_DATA_CH_IDX,
++	MTK_VENDOR_ATTR_CSI_DATA_TA,
++	MTK_VENDOR_ATTR_CSI_DATA_I,
++	MTK_VENDOR_ATTR_CSI_DATA_Q,
++	MTK_VENDOR_ATTR_CSI_DATA_INFO,
++	MTK_VENDOR_ATTR_CSI_DATA_RSVD1,
++	MTK_VENDOR_ATTR_CSI_DATA_RSVD2,
++	MTK_VENDOR_ATTR_CSI_DATA_RSVD3,
++	MTK_VENDOR_ATTR_CSI_DATA_RSVD4,
++	MTK_VENDOR_ATTR_CSI_DATA_TX_ANT,
++	MTK_VENDOR_ATTR_CSI_DATA_RX_ANT,
++	MTK_VENDOR_ATTR_CSI_DATA_MODE,
++	MTK_VENDOR_ATTR_CSI_DATA_H_IDX,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_CSI_DATA,
++	MTK_VENDOR_ATTR_CSI_DATA_MAX =
++		NUM_MTK_VENDOR_ATTRS_CSI_DATA - 1
++};
++
++enum mtk_vendor_attr_mnt_ctrl {
++	MTK_VENDOR_ATTR_AMNT_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_AMNT_CTRL_SET,
++	MTK_VENDOR_ATTR_AMNT_CTRL_DUMP,
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_AMNT_CTRL,
++	MTK_VENDOR_ATTR_AMNT_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_AMNT_CTRL - 1
++};
++
++enum mtk_vendor_attr_mnt_set {
++	MTK_VENDOR_ATTR_AMNT_SET_UNSPEC,
++
++	MTK_VENDOR_ATTR_AMNT_SET_INDEX,
++	MTK_VENDOR_ATTR_AMNT_SET_MACADDR,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_AMNT_SET,
++	MTK_VENDOR_ATTR_AMNT_SET_MAX =
++		NUM_MTK_VENDOR_ATTRS_AMNT_SET - 1
++};
++
++enum mtk_vendor_attr_mnt_dump {
++	MTK_VENDOR_ATTR_AMNT_DUMP_UNSPEC,
++
++	MTK_VENDOR_ATTR_AMNT_DUMP_INDEX,
++	MTK_VENDOR_ATTR_AMNT_DUMP_LEN,
++	MTK_VENDOR_ATTR_AMNT_DUMP_RESULT,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_AMNT_DUMP,
++	MTK_VENDOR_ATTR_AMNT_DUMP_MAX =
++		NUM_MTK_VENDOR_ATTRS_AMNT_DUMP - 1
++};
++
++enum mtk_vendor_attr_wireless_ctrl {
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_OFDMA,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
++};
++
++enum mtk_vendor_attr_rfeature_ctrl {
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_EN,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
++};
++
++#define CSI_MAX_COUNT 256
++#define ETH_ALEN 6
++
++struct csi_data {
++	s16 data_i[CSI_MAX_COUNT];
++	s16 data_q[CSI_MAX_COUNT];
++	s8 rssi;
++	u8 snr;
++	u32 ts;
++	u8 data_bw;
++	u8 pri_ch_idx;
++	u8 ta[ETH_ALEN];
++	u32 info;
++	u8 rx_mode;
++	u32 h_idx;
++	u16 tx_idx;
++	u16 rx_idx;
++};
++
++struct amnt_data {
++	u8 idx;
++	u8 addr[ETH_ALEN];
++	s8 rssi[4];
++	u32 last_seen;
++};
++#endif /* MTK_VENDOR_H */
+-- 
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
new file mode 100644
index 0000000..e9bb053
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
@@ -0,0 +1,619 @@
+From d3d5b514064036fb17729743fa13e25646f468e9 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Mon, 30 May 2022 16:31:34 +0800
+Subject: [PATCH 99904/99910] hostapd: mtk: Support EDCCA hostapd configuration
+
+edcca_enable and edcca_compensation and implement edcca related handlers.
+---
+ hostapd/config_file.c             |  32 ++++++
+ hostapd/ctrl_iface.c              | 125 ++++++++++++++++++++++
+ src/ap/ap_config.c                |   4 +
+ src/ap/ap_config.h                |  29 ++++++
+ src/ap/ap_drv_ops.c               |  24 +++++
+ src/ap/ap_drv_ops.h               |   5 +-
+ src/ap/hostapd.c                  |   7 ++
+ src/common/mtk_vendor.h           |  19 ++--
+ src/drivers/driver.h              |   4 +
+ src/drivers/driver_nl80211.c      | 165 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h      |   1 +
+ src/drivers/driver_nl80211_capa.c |   7 ++
+ 12 files changed, 415 insertions(+), 7 deletions(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index eda9db0..0ee8952 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4753,6 +4753,38 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 	} else if (os_strcmp(buf, "eht_mu_beamformer") == 0) {
+ 		conf->eht_phy_capab.mu_beamformer = atoi(pos);
+ #endif /* CONFIG_IEEE80211BE */
++	} else if (os_strcmp(buf, "edcca_threshold") == 0) {
++		if (hostapd_parse_intlist(&conf->edcca_threshold, pos) ||
++		    conf->edcca_threshold[0] < EDCCA_MIN_CONFIG_THRES ||
++		    conf->edcca_threshold[0] > EDCCA_MAX_CONFIG_THRES ||
++		    conf->edcca_threshold[1] < EDCCA_MIN_CONFIG_THRES ||
++		    conf->edcca_threshold[1] > EDCCA_MAX_CONFIG_THRES ||
++		    conf->edcca_threshold[2] < EDCCA_MIN_CONFIG_THRES ||
++		    conf->edcca_threshold[2] > EDCCA_MAX_CONFIG_THRES) {
++			wpa_printf(MSG_ERROR, "Line %d: invalid edcca threshold",
++				   line);
++			return 1;
++		}
++	} else if (os_strcmp(buf, "edcca_enable") == 0) {
++		int mode = atoi(pos);
++		if (mode < EDCCA_MODE_FORCE_DISABLE || mode > EDCCA_MODE_AUTO) {
++			wpa_printf(MSG_ERROR, "Line %d: Invalid edcca_enable %d;"
++				  " allowed value 0 (Force Disable) or 1(Auto) ",
++				   line, mode);
++			return 1;
++		}
++		conf->edcca_enable = (u8) mode;
++	} else if (os_strcmp(buf, "edcca_compensation") == 0) {
++		int val = atoi(pos);
++		if (val < EDCCA_MIN_COMPENSATION ||
++		    val > EDCCA_MAX_COMPENSATION) {
++			wpa_printf(MSG_ERROR, "Line %d: Invalid compensation"
++				   " value %d; allowed value %d ~ %d.",
++				   line, val, EDCCA_MIN_COMPENSATION,
++				   EDCCA_MAX_COMPENSATION);
++			return 1;
++		}
++		conf->edcca_compensation = (s8) val;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index bb8c74f..9c70d54 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -598,6 +598,19 @@ static const char * pbc_status_str(enum pbc_status status)
+ }
+ 
+ 
++static const char * edcca_mode_str(enum edcca_mode status)
++{
++	switch (status) {
++		case EDCCA_MODE_FORCE_DISABLE:
++			return "Force Disable";
++		case EDCCA_MODE_AUTO:
++			return "Auto";
++		default:
++			return "Unknown";
++	}
++}
++
++
+ static int hostapd_ctrl_iface_wps_get_status(struct hostapd_data *hapd,
+ 					     char *buf, size_t buflen)
+ {
+@@ -3322,6 +3335,112 @@ static int hostapd_ctrl_iface_driver_cmd(struct hostapd_data *hapd, char *cmd,
+ #endif /* ANDROID */
+ 
+ 
++static int
++hostapd_ctrl_iface_set_edcca(struct hostapd_data *hapd, char *cmd,
++					 char *buf, size_t buflen)
++{
++	char *pos, *config, *value;
++	config = cmd;
++	pos = os_strchr(config, ' ');
++	if (pos == NULL)
++		return -1;
++	*pos++ = '\0';
++
++	if(pos == NULL)
++		return -1;
++	value = pos;
++
++	if (os_strcmp(config, "enable") == 0) {
++		int mode = atoi(value);
++		if (mode < EDCCA_MODE_FORCE_DISABLE || mode > EDCCA_MODE_AUTO) {
++			wpa_printf(MSG_ERROR, "Invalid value for edcca enable");
++			return -1;
++		}
++		hapd->iconf->edcca_enable = (u8) mode;
++		if (hostapd_drv_configure_edcca_enable(hapd) != 0)
++			return -1;
++	} else if (os_strcmp(config, "compensation") == 0) {
++		int compensation = atoi(value);
++		if (compensation < EDCCA_MIN_COMPENSATION ||
++		    compensation > EDCCA_MAX_COMPENSATION) {
++			wpa_printf(MSG_ERROR, "Invalid value for edcca compensation");
++			return -1;
++		}
++		hapd->iconf->edcca_compensation = (s8) compensation;
++		if (hostapd_drv_configure_edcca_enable(hapd) != 0)
++			return -1;
++	} else if (os_strcmp(config, "threshold") == 0) {
++		char *thres_value;
++		thres_value = os_strchr(value, ':');
++		if (thres_value == NULL)
++			return -1;
++		*thres_value++ = '\0';
++
++		if(thres_value == NULL)
++			return -1;
++		int bw_idx= atoi(value);
++		int threshold = atoi(thres_value);
++
++		if (bw_idx < EDCCA_BW_20 || bw_idx > EDCCA_BW_80) {
++			wpa_printf(MSG_ERROR,
++				   "Unsupported Bandwidth idx %d for SET_EDCCA",
++				   bw_idx);
++			return -1;
++		}
++		if (threshold < EDCCA_MIN_CONFIG_THRES ||
++		    threshold > EDCCA_MAX_CONFIG_THRES) {
++			wpa_printf(MSG_ERROR,
++				   "Unsupported threshold %d for SET_EDCCA",
++				   threshold);
++			return -1;
++		}
++
++		int threshold_arr[EDCCA_MAX_BW_NUM];
++		/* 0x7f means keep the origival value in firmware */
++		os_memset(threshold_arr, 0x7f, sizeof(threshold_arr));
++		threshold_arr[bw_idx] = threshold;
++
++		if (hostapd_drv_configure_edcca_threshold(hapd, threshold_arr) != 0)
++			return -1;
++	} else {
++		wpa_printf(MSG_ERROR,
++			"Unsupported parameter %s for SET_EDCCA", config);
++		return -1;
++	}
++	return os_snprintf(buf, buflen, "OK\n");
++}
++
++
++static int
++hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
++			     size_t buflen)
++{
++	char *pos, *end;
++
++	pos = buf;
++	end = buf + buflen;
++	u8 value[EDCCA_MAX_BW_NUM] = {0};
++
++	if (os_strcmp(cmd, "enable") == 0) {
++		return os_snprintf(pos, end - pos, "Enable: %s\n",
++				   edcca_mode_str(hapd->iconf->edcca_enable));
++	} else if (os_strcmp(cmd, "compensation") == 0) {
++		return os_snprintf(pos, end - pos, "Compensation: %d\n",
++				  hapd->iconf->edcca_compensation);
++	} else if (os_strcmp(cmd, "threshold") == 0) {
++		if (hostapd_drv_get_edcca(hapd, EDCCA_CTRL_GET_THRES, &value) != 0)
++			return -1;
++		return os_snprintf(pos, end - pos,
++				   "Threshold BW20: 0x%x, BW40: 0x%x, BW80: 0x%x\n",
++				   value[0], value[1], value[2]);
++	} else {
++		wpa_printf(MSG_ERROR,
++			"Unsupported parameter %s for GET_EDCCA", cmd);
++		return -1;
++	}
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -3868,6 +3987,12 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 		reply_len = hostapd_ctrl_iface_driver_cmd(hapd, buf + 7, reply,
+ 							  reply_size);
+ #endif /* ANDROID */
++	} else if (os_strncmp(buf, "SET_EDCCA ", 10) == 0) {
++		reply_len = hostapd_ctrl_iface_set_edcca(hapd, buf+10, reply,
++							  reply_size);
++	} else if (os_strncmp(buf, "GET_EDCCA ", 10) == 0) {
++		reply_len = hostapd_ctrl_iface_get_edcca(hapd, buf+10, reply,
++							  reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 4a20eb4..344585a 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -294,6 +294,9 @@ struct hostapd_config * hostapd_config_defaults(void)
+ 	conf->airtime_update_interval = AIRTIME_DEFAULT_UPDATE_INTERVAL;
+ #endif /* CONFIG_AIRTIME_POLICY */
+ 
++	conf->edcca_enable = EDCCA_MODE_AUTO;
++	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
++
+ 	return conf;
+ }
+ 
+@@ -1007,6 +1010,7 @@ void hostapd_config_free(struct hostapd_config *conf)
+ #ifdef CONFIG_ACS
+ 	os_free(conf->acs_chan_bias);
+ #endif /* CONFIG_ACS */
++	os_free(conf->edcca_threshold);
+ 	wpabuf_free(conf->lci);
+ 	wpabuf_free(conf->civic);
+ 
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 3f68e76..775c567 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1153,8 +1153,37 @@ struct hostapd_config {
+ #define CH_SWITCH_EHT_ENABLED BIT(0)
+ #define CH_SWITCH_EHT_DISABLED BIT(1)
+ 	unsigned int ch_switch_eht_config;
++	u8 edcca_enable;
++	s8 edcca_compensation;
++	int *edcca_threshold;
+ };
+ 
++enum edcca_mode {
++	EDCCA_MODE_FORCE_DISABLE = 0,
++	EDCCA_MODE_AUTO = 1,
++};
++
++enum edcca_bw_id {
++	EDCCA_BW_20 = 0,
++	EDCCA_BW_40,
++	EDCCA_BW_80,
++	EDCCA_MAX_BW_NUM,
++};
++
++enum mtk_vendor_attr_edcca_ctrl_mode {
++	EDCCA_CTRL_SET_EN = 0,
++	EDCCA_CTRL_SET_THRES,
++	EDCCA_CTRL_GET_EN,
++	EDCCA_CTRL_GET_THRES,
++	EDCCA_CTRL_NUM,
++};
++
++#define EDCCA_DEFAULT_COMPENSATION -6
++#define EDCCA_MIN_COMPENSATION -126
++#define EDCCA_MAX_COMPENSATION 126
++#define EDCCA_MIN_CONFIG_THRES -126
++#define EDCCA_MAX_CONFIG_THRES 0
++
+ 
+ static inline enum oper_chan_width
+ hostapd_get_oper_chwidth(struct hostapd_config *conf)
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 0c7aee2..25e967d 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1015,3 +1015,27 @@ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable)
+ 		return 0;
+ 	return hapd->driver->dpp_listen(hapd->drv_priv, enable);
+ }
++
++int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd)
++{
++	if (!hapd->driver || !hapd->driver->configure_edcca_enable)
++		return 0;
++	return hapd->driver->configure_edcca_enable(hapd->drv_priv,
++				hapd->iconf->edcca_enable,
++				hapd->iconf->edcca_compensation);
++}
++
++int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
++					  const int *threshold)
++{
++	if (!hapd->driver || !hapd->driver->configure_edcca_threshold)
++		return 0;
++	return hapd->driver->configure_edcca_threshold(hapd->drv_priv, threshold);
++}
++
++int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
++{
++	if (!hapd->driver || !hapd->driver->get_edcca)
++		return 0;
++	return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index b4fb766..70a99f4 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -138,7 +138,10 @@ int hostapd_drv_do_acs(struct hostapd_data *hapd);
+ int hostapd_drv_update_dh_ie(struct hostapd_data *hapd, const u8 *peer,
+ 			     u16 reason_code, const u8 *ie, size_t ielen);
+ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable);
+-
++int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
++int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
++					  const int *threshold);
++int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+ 
+ #include "drivers/driver.h"
+ 
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 0dd8c13..d05f948 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2295,6 +2295,13 @@ dfs_offload:
+ 	}
+ #endif /* CONFIG_MESH */
+ 
++	if (hostapd_drv_configure_edcca_enable(hapd) < 0)
++		goto fail;
++
++	if (hostapd_drv_configure_edcca_threshold(hapd,
++						  hapd->iconf->edcca_threshold) < 0)
++		goto fail;
++
+ 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ 		   iface->bss[0]->conf->iface);
+ 	if (iface->interfaces && iface->interfaces->terminate_on_error > 0)
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 528387f..7056126 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -29,14 +29,21 @@ enum mtk_vendor_attr_edcca_ctrl {
+ 		NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
+ };
+ 
+-enum mtk_vendor_attr_edcca_ctrl_mode {
+-	EDCCA_CTRL_SET_EN = 0,
+-	EDCCA_CTRL_SET_THERS,
+-	EDCCA_CTRL_GET_EN,
+-	EDCCA_CTRL_GET_THERS,
+-	EDCCA_CTRL_NUM,
++enum mtk_vendor_attr_edcca_dump {
++	MTK_VENDOR_ATTR_EDCCA_DUMP_UNSPEC = 0,
++
++	MTK_VENDOR_ATTR_EDCCA_DUMP_MODE,
++	MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL,
++	MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL,
++	MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP,
++	MTK_VENDOR_ATTR_EDCCA_DUMP_MAX =
++		NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP - 1
+ };
+ 
++
+ static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
+ 	[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
+ 	[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 1d2b1b2..3559974 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4676,6 +4676,10 @@ struct wpa_driver_ops {
+ 			      const u8 *match, size_t match_len,
+ 			      bool multicast);
+ #endif /* CONFIG_TESTING_OPTIONS */
++	int (*configure_edcca_enable)(void *priv, const u8 edcca_enable,
++				  const s8 edcca_compensation);
++	int (*configure_edcca_threshold)(void *priv, const int *threshold);
++	int (*get_edcca)(void *priv, const u8 mode, u8 *value);
+ };
+ 
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 5eba0ea..9c2782c 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -35,6 +35,8 @@
+ #include "radiotap_iter.h"
+ #include "rfkill.h"
+ #include "driver_nl80211.h"
++#include "common/mtk_vendor.h"
++#include "ap/ap_config.h"
+ 
+ 
+ #ifndef NETLINK_CAP_ACK
+@@ -12368,6 +12370,165 @@ static int testing_nl80211_radio_disable(void *priv, int disabled)
+ 
+ #endif /* CONFIG_TESTING_OPTIONS */
+ 
++static int nl80211_configure_edcca_enable(void *priv,
++					  const u8 edcca_enable,
++					  const s8 edcca_compensation)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_edcca_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting EDCCA enable");
++		return 0;
++	}
++
++	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++			MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++	    !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, EDCCA_CTRL_SET_EN) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL, edcca_enable) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
++		edcca_compensation)) {
++		wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++		nlmsg_free(msg);
++		return -ENOBUFS;
++	}
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to configure EDCCA enable. ret=%d (%s) ",
++			   ret, strerror(-ret));
++	}
++	return ret;
++}
++
++static int nl80211_configure_edcca_threshold(void *priv, const int *threshold)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_edcca_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting EDCCA threshold");
++		return 0;
++	}
++
++	if (!threshold) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Input EDCCA threshold is empty!");
++		return 0;
++	}
++
++	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++			MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++	    !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, EDCCA_CTRL_SET_THRES) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL, threshold[0] & 0xff) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL, threshold[1] & 0xff) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL, threshold[2] & 0xff)) {
++		wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++		nlmsg_free(msg);
++		return -ENOBUFS;
++	}
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to configure EDCCA threshold. ret=%d (%s) ",
++			   ret, strerror(-ret));
++	}
++	return ret;
++}
++
++
++static int edcca_info_handler(struct nl_msg *msg, void *arg)
++{
++	u8 *info = (u8*) arg;
++	struct nlattr *tb[NL80211_ATTR_MAX + 1];
++	struct nlattr *tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_MAX + 1];
++	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++	struct nlattr *nl_vend, *attr;
++
++	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++		  genlmsg_attrlen(gnlh, 0), NULL);
++
++	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++	if (!nl_vend)
++		return NL_SKIP;
++
++	nla_parse(tb_vendor, MTK_VENDOR_ATTR_EDCCA_DUMP_MAX,
++		  nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++	attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL];
++	if (!attr) {
++		wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL");
++		return NL_SKIP;
++	}
++
++	*info++ = nla_get_u8(attr);
++
++	attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL];
++	if (!attr) {
++		wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL");
++		return NL_SKIP;
++	}
++
++	*info++ = nla_get_u8(attr);
++
++	attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL];
++	if (!attr) {
++		wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL");
++		return NL_SKIP;
++	}
++
++	*info = nla_get_u8(attr);
++	return NL_SKIP;
++}
++
++
++static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_edcca_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting EDCCA threshold");
++		return 0;
++	}
++
++	if (!(msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR)) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++			MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++	    !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED)) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, mode)) {
++		wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++		nlmsg_free(msg);
++		return -ENOBUFS;
++	}
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, edcca_info_handler, value, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to get EDCCA configuration. ret=%d (%s)",
++			   ret, strerror(-ret));
++	}
++	return ret;
++}
++
+ 
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.name = "nl80211",
+@@ -12514,4 +12675,8 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.register_frame = testing_nl80211_register_frame,
+ 	.radio_disable = testing_nl80211_radio_disable,
+ #endif /* CONFIG_TESTING_OPTIONS */
++/* Need ifdef CONFIG_DRIVER_NL80211_MTK */
++	.configure_edcca_enable = nl80211_configure_edcca_enable,
++	.configure_edcca_threshold = nl80211_configure_edcca_threshold,
++	.get_edcca = nl80211_get_edcca,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 6e40d55..13e5d24 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -181,6 +181,7 @@ struct wpa_driver_nl80211_data {
+ 	unsigned int qca_do_acs:1;
+ 	unsigned int brcm_do_acs:1;
+ 	unsigned int uses_6ghz:1;
++	unsigned int mtk_edcca_vendor_cmd_avail:1;
+ 
+ 	u64 vendor_scan_cookie;
+ 	u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 7ede0d0..732ae29 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -18,6 +18,7 @@
+ #include "common/qca-vendor-attr.h"
+ #include "common/brcm_vendor.h"
+ #include "driver_nl80211.h"
++#include "common/mtk_vendor.h"
+ 
+ 
+ static int protocol_feature_handler(struct nl_msg *msg, void *arg)
+@@ -1050,6 +1051,12 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ 					break;
+ 				}
+ #endif /* CONFIG_DRIVER_NL80211_BRCM */
++			} else if (vinfo->vendor_id == OUI_MTK) {
++				switch (vinfo->subcmd) {
++				case MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL :
++					drv->mtk_edcca_vendor_cmd_avail = 1;
++					break;
++				}
+ 			}
+ 
+ 			wpa_printf(MSG_DEBUG, "nl80211: Supported vendor command: vendor_id=0x%x subcmd=%u",
+-- 
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
new file mode 100644
index 0000000..1a622f3
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
@@ -0,0 +1,450 @@
+From 893c5f92257a7313a179dc728ba51a74efbfc74a Mon Sep 17 00:00:00 2001
+From: TomLiu <tomml.liu@mediatek.com>
+Date: Tue, 9 Aug 2022 10:23:44 -0700
+Subject: [PATCH 99905/99910] hostapd: mtk: Add hostapd HEMU SET/GET control
+
+---
+ hostapd/config_file.c             |   9 +++
+ hostapd/ctrl_iface.c              |  62 +++++++++++++++++
+ hostapd/hostapd_cli.c             |  18 +++++
+ src/ap/ap_config.c                |   1 +
+ src/ap/ap_config.h                |   1 +
+ src/ap/ap_drv_ops.c               |  14 ++++
+ src/ap/ap_drv_ops.h               |   2 +
+ src/ap/hostapd.c                  |   2 +
+ src/common/mtk_vendor.h           |  15 ++++
+ src/drivers/driver.h              |  13 ++++
+ src/drivers/driver_nl80211.c      | 110 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h      |   1 +
+ src/drivers/driver_nl80211_capa.c |   3 +
+ 13 files changed, 251 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 0ee8952..b22d10b 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3659,6 +3659,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 			return 1;
+ 		}
+ 		bss->unsol_bcast_probe_resp_interval = val;
++	} else if (os_strcmp(buf, "hemu_onoff") == 0) {
++		int val = atoi(pos);
++		if (val < 0 || val > 15) {
++			wpa_printf(MSG_ERROR,
++				   "Line %d: invalid hemu_onoff value",
++				   line);
++			return 1;
++		}
++		conf->hemu_onoff = val;
+ #endif /* CONFIG_IEEE80211AX */
+ 	} else if (os_strcmp(buf, "max_listen_interval") == 0) {
+ 		bss->max_listen_interval = atoi(pos);
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 9c70d54..5f71aee 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3441,6 +3441,63 @@ hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_set_hemu(struct hostapd_data *hapd, char *cmd,
++					 char *buf, size_t buflen)
++{
++	char *pos, *config, *value;
++	config = cmd;
++	pos = os_strchr(config, ' ');
++	if (pos == NULL)
++		return -1;
++	*pos++ = '\0';
++
++	if(pos == NULL)
++		return -1;
++	value = pos;
++
++	if (os_strcmp(config, "onoff") == 0) {
++		int hemu = atoi(value);
++		if (hemu < 0 || hemu > 15) {
++			wpa_printf(MSG_ERROR, "Invalid value for hemu");
++			return -1;
++		}
++		hapd->iconf->hemu_onoff = (u8) hemu;
++	} else {
++		wpa_printf(MSG_ERROR,
++			"Unsupported parameter %s for SET_HEMU", config);
++		return -1;
++	}
++
++	if(hostapd_drv_hemu_ctrl(hapd) == 0) {
++		return os_snprintf(buf, buflen, "OK\n");
++	} else {
++		return -1;
++	}
++}
++
++
++static int
++hostapd_ctrl_iface_get_hemu(struct hostapd_data *hapd, char *buf,
++					 size_t buflen)
++{
++	u8 hemu_onoff;
++	char *pos, *end;
++
++	pos = buf;
++	end = buf + buflen;
++
++	if (hostapd_drv_hemu_dump(hapd, &hemu_onoff) == 0) {
++		hapd->iconf->hemu_onoff = hemu_onoff;
++		return os_snprintf(pos, end - pos, "[hostapd_cli] = UL MU-MIMO: %d, DL MU-MIMO: %d, UL OFDMA: %d, DL OFDMA: %d\n",
++			!!(hemu_onoff&BIT(3)), !!(hemu_onoff&BIT(2)), !!(hemu_onoff&BIT(1)), !!(hemu_onoff&BIT(0)));
++	} else {
++		wpa_printf(MSG_INFO, "ctrl iface failed to call");
++		return -1;
++	}
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -3993,6 +4050,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 	} else if (os_strncmp(buf, "GET_EDCCA ", 10) == 0) {
+ 		reply_len = hostapd_ctrl_iface_get_edcca(hapd, buf+10, reply,
+ 							  reply_size);
++	} else if (os_strncmp(buf, "SET_HEMU ", 9) == 0) {
++		reply_len = hostapd_ctrl_iface_set_hemu(hapd, buf+9, reply,
++							  reply_size);
++	} else if (os_strncmp(buf, "GET_HEMU", 8) == 0) {
++		reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index db21258..0d36477 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1380,6 +1380,20 @@ static int hostapd_cli_cmd_driver_flags(struct wpa_ctrl *ctrl, int argc,
+ }
+ 
+ 
++static int hostapd_cli_cmd_set_hemu(struct wpa_ctrl *ctrl, int argc,
++					   char *argv[])
++{
++	return hostapd_cli_cmd(ctrl, "SET_HEMU", 1, argc, argv);
++}
++
++
++static int hostapd_cli_cmd_get_hemu(struct wpa_ctrl *ctrl, int argc,
++					   char *argv[])
++{
++	return hostapd_cli_cmd(ctrl, "GET_HEMU", 0, NULL, NULL);
++}
++
++
+ #ifdef CONFIG_DPP
+ 
+ static int hostapd_cli_cmd_dpp_qr_code(struct wpa_ctrl *ctrl, int argc,
+@@ -1705,6 +1719,10 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ 	  " = send FTM range request"},
+ 	{ "driver_flags", hostapd_cli_cmd_driver_flags, NULL,
+ 	  " = show supported driver flags"},
++	{ "set_hemu", hostapd_cli_cmd_set_hemu, NULL,
++		"<value> [0-15] bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0)"},
++	{ "get_hemu", hostapd_cli_cmd_get_hemu, NULL,
++		" = show hemu onoff value in 0-15 bitmap"},
+ #ifdef CONFIG_DPP
+ 	{ "dpp_qr_code", hostapd_cli_cmd_dpp_qr_code, NULL,
+ 	  "report a scanned DPP URI from a QR Code" },
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 344585a..0e1f192 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -280,6 +280,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ 	conf->he_6ghz_max_ampdu_len_exp = 7;
+ 	conf->he_6ghz_rx_ant_pat = 1;
+ 	conf->he_6ghz_tx_ant_pat = 1;
++	conf->hemu_onoff = 13;
+ #endif /* CONFIG_IEEE80211AX */
+ 
+ 	/* The third octet of the country string uses an ASCII space character
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 775c567..41b8c68 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1114,6 +1114,7 @@ struct hostapd_config {
+ 	u8 he_6ghz_rx_ant_pat;
+ 	u8 he_6ghz_tx_ant_pat;
+ 	u8 he_6ghz_reg_pwr_type;
++	u8 hemu_onoff;
+ #endif /* CONFIG_IEEE80211AX */
+ 
+ 	/* VHT enable/disable config from CHAN_SWITCH */
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 25e967d..4598737 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1039,3 +1039,17 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
+ 		return 0;
+ 	return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
+ }
++
++int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd)
++{
++	if (!hapd->driver || !hapd->driver->hemu_ctrl)
++		return 0;
++	return hapd->driver->hemu_ctrl(hapd->drv_priv, hapd->iconf->hemu_onoff);
++}
++
++int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff)
++{
++	if (!hapd->driver || !hapd->driver->hemu_dump)
++		return 0;
++	return hapd->driver->hemu_dump(hapd->drv_priv, hemu_onoff);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 70a99f4..bca39c5 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -142,6 +142,8 @@ int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
+ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
+ 					  const int *threshold);
+ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
++int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+ 
+ #include "drivers/driver.h"
+ 
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index d05f948..921769d 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2301,6 +2301,8 @@ dfs_offload:
+ 	if (hostapd_drv_configure_edcca_threshold(hapd,
+ 						  hapd->iconf->edcca_threshold) < 0)
+ 		goto fail;
++	if (hostapd_drv_hemu_ctrl(hapd) < 0)
++		goto fail;
+ 
+ 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ 		   iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 7056126..69a46df 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -10,6 +10,8 @@ enum mtk_nl80211_vendor_subcmds {
+ 	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
+ 	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
+ 	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
++	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
++	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
+ };
+ 
+@@ -174,6 +176,19 @@ enum mtk_vendor_attr_rfeature_ctrl {
+ 		NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
+ };
+ 
++enum mtk_vendor_attr_hemu_ctrl {
++	MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF,
++	MTK_VENDOR_ATTR_HEMU_CTRL_DUMP,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
++	MTK_VENDOR_ATTR_HEMU_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
++};
++
++
+ #define CSI_MAX_COUNT 256
+ #define ETH_ALEN 6
+ 
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 3559974..4cd7505 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1623,6 +1623,11 @@ struct wpa_driver_ap_params {
+ 	 * Unsolicited broadcast Probe Response template length
+ 	 */
+ 	size_t unsol_bcast_probe_resp_tmpl_len;
++
++	/**
++	 * hemu onoff=<val> (bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0))
++	 */
++	u8 hemu_onoff;
+ };
+ 
+ struct wpa_driver_mesh_bss_params {
+@@ -4680,6 +4685,14 @@ struct wpa_driver_ops {
+ 				  const s8 edcca_compensation);
+ 	int (*configure_edcca_threshold)(void *priv, const int *threshold);
+ 	int (*get_edcca)(void *priv, const u8 mode, u8 *value);
++
++	/**
++	 * hemu_ctrl - ctrl on off for UL/DL MURU
++	 * @priv: Private driver interface data
++	 *
++	 */
++	 int (*hemu_ctrl)(void *priv, u8 hemu_onoff);
++	 int (*hemu_dump)(void *priv, u8 *hemu_onoff);
+ };
+ 
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 9c2782c..73dee2e 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12304,6 +12304,114 @@ fail:
+ }
+ 
+ 
++#ifdef CONFIG_IEEE80211AX
++static int nl80211_hemu_muruonoff(void *priv, u8 hemu_onoff)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_hemu_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting hemu control");
++		return 0;
++	}
++
++	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL) ||
++		!(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++		nla_put_u8(msg, MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF, hemu_onoff)) {
++		nlmsg_free(msg);
++		return -ENOBUFS;
++	}
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if(ret){
++		wpa_printf(MSG_ERROR, "Failed to set hemu_onoff. ret=%d (%s)", ret, strerror(-ret));
++	}
++	return ret;
++}
++
++
++static int hemu_dump_handler(struct nl_msg *msg, void *arg)
++{
++	u8 *hemu_onoff = (u8 *) arg;
++	struct nlattr *tb[NL80211_ATTR_MAX + 1];
++	struct nlattr *tb_vendor[MTK_VENDOR_ATTR_HEMU_CTRL_MAX + 1];
++	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++	struct nlattr *nl_vend, *attr;
++
++	static const struct nla_policy
++	hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL + 1] = {
++		[MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF] = {.type = NLA_U8 },
++		[MTK_VENDOR_ATTR_HEMU_CTRL_DUMP] = {.type = NLA_U8 },
++	};
++
++	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++			genlmsg_attrlen(gnlh, 0), NULL);
++
++	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++	if (!nl_vend)
++		return NL_SKIP;
++
++	nla_parse(tb_vendor, MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
++		  nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++	attr = tb_vendor[MTK_VENDOR_ATTR_HEMU_CTRL_DUMP];
++	if (!attr) {
++		wpa_printf(MSG_ERROR, "nl80211: cannot find MTK_VENDOR_ATTR_HEMU_CTRL_DUMP");
++		return NL_SKIP;
++	}
++
++	*hemu_onoff = nla_get_u8(attr);
++	wpa_printf(MSG_DEBUG, "nla_get hemu_onoff: %d\n", *hemu_onoff);
++
++	return 0;
++}
++
++static int nl80211_hemu_dump(void *priv, u8 *hemu_onoff)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *attr;
++	int ret;
++
++	if (!drv->mtk_hemu_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting hemu control");
++		return 0;
++	}
++
++	if (!(msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR)) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL)) {
++		nlmsg_free(msg);
++		return -ENOBUFS;
++	}
++
++  attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++	if (!attr) {
++		nlmsg_free(msg);
++		return -1;
++	}
++
++	nla_nest_end(msg, attr);
++
++	ret = send_and_recv_msgs(drv, msg, hemu_dump_handler, hemu_onoff, NULL, NULL);
++
++	if(ret){
++		wpa_printf(MSG_ERROR, "Failed to get hemu_onoff. ret=%d (%s)", ret, strerror(-ret));
++	}
++
++	return ret;
++}
++#endif /* CONFIG_IEEE80211AX */
++
++
+ #ifdef CONFIG_DPP
+ static int nl80211_dpp_listen(void *priv, bool enable)
+ {
+@@ -12668,6 +12776,8 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.update_connect_params = nl80211_update_connection_params,
+ 	.send_external_auth_status = nl80211_send_external_auth_status,
+ 	.set_4addr_mode = nl80211_set_4addr_mode,
++	.hemu_ctrl = nl80211_hemu_muruonoff,
++	.hemu_dump = nl80211_hemu_dump,
+ #ifdef CONFIG_DPP
+ 	.dpp_listen = nl80211_dpp_listen,
+ #endif /* CONFIG_DPP */
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 13e5d24..57f0249 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -182,6 +182,7 @@ struct wpa_driver_nl80211_data {
+ 	unsigned int brcm_do_acs:1;
+ 	unsigned int uses_6ghz:1;
+ 	unsigned int mtk_edcca_vendor_cmd_avail:1;
++	unsigned int mtk_hemu_vendor_cmd_avail:1;
+ 
+ 	u64 vendor_scan_cookie;
+ 	u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 732ae29..cc146d9 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1056,6 +1056,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ 				case MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL :
+ 					drv->mtk_edcca_vendor_cmd_avail = 1;
+ 					break;
++				case MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL :
++					drv->mtk_hemu_vendor_cmd_avail = 1;
++					break;
+ 				}
+ 			}
+ 
+-- 
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
new file mode 100644
index 0000000..594e476
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
@@ -0,0 +1,247 @@
+From c91612769eba54821da1136d5959a40438c02824 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 2 Sep 2022 01:03:23 +0800
+Subject: [PATCH 99906/99910] hostapd: mtk: Add three wire PTA ctrl hostapd
+ vendor command
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c             |  4 ++++
+ src/ap/ap_config.c                |  1 +
+ src/ap/ap_config.h                | 13 ++++++++++++
+ src/ap/ap_drv_ops.c               | 11 +++++++++++
+ src/ap/ap_drv_ops.h               |  1 +
+ src/ap/hostapd.c                  |  2 ++
+ src/common/mtk_vendor.h           | 16 +++++++++++++++
+ src/drivers/driver.h              |  8 ++++++++
+ src/drivers/driver_nl80211.c      | 33 +++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h      |  1 +
+ src/drivers/driver_nl80211_capa.c |  3 +++
+ 11 files changed, 93 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index b22d10b..18b372a 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4794,6 +4794,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 			return 1;
+ 		}
+ 		conf->edcca_compensation = (s8) val;
++	} else if (os_strcmp(buf, "three_wire_enable") == 0) {
++		u8 en = atoi(pos);
++
++		conf->three_wire_enable = en;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 0e1f192..9249a6b 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -297,6 +297,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ 
+ 	conf->edcca_enable = EDCCA_MODE_AUTO;
+ 	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
++	conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
+ 
+ 	return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 41b8c68..71cf515 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1157,6 +1157,19 @@ struct hostapd_config {
+ 	u8 edcca_enable;
+ 	s8 edcca_compensation;
+ 	int *edcca_threshold;
++	u8 three_wire_enable;
++};
++
++enum three_wire_mode {
++	THREE_WIRE_MODE_DISABLE,
++	THREE_WIRE_MODE_EXT0_ENABLE,
++	THREE_WIRE_MODE_EXT1_ENABLE,
++	THREE_WIRE_MODE_ALL_ENABLE,
++
++	/* keep last */
++	NUM_THREE_WIRE_MODE,
++	THREE_WIRE_MODE_MAX =
++		NUM_THREE_WIRE_MODE - 1
+ };
+ 
+ enum edcca_mode {
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 4598737..a1d83e4 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1053,3 +1053,14 @@ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff)
+ 		return 0;
+ 	return hapd->driver->hemu_dump(hapd->drv_priv, hemu_onoff);
+ }
++
++int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
++{
++	if (!hapd->driver || !hapd->driver->three_wire_ctrl)
++		return 0;
++	if (hapd->iconf->three_wire_enable > THREE_WIRE_MODE_MAX) {
++		wpa_printf(MSG_INFO, "Invalid value for three wire enable\n");
++		return 0;
++	}
++	return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index bca39c5..5ba6297 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -144,6 +144,7 @@ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
+ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+ int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
++int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
+ 
+ #include "drivers/driver.h"
+ 
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 921769d..f9dabdf 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2303,6 +2303,8 @@ dfs_offload:
+ 		goto fail;
+ 	if (hostapd_drv_hemu_ctrl(hapd) < 0)
+ 		goto fail;
++	if (hostapd_drv_three_wire_ctrl(hapd) < 0)
++		goto fail;
+ 
+ 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ 		   iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 69a46df..ee5a4f4 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -13,6 +13,7 @@ enum mtk_nl80211_vendor_subcmds {
+ 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ 	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
+ };
+ 
+ enum mtk_vendor_attr_edcca_ctrl {
+@@ -55,6 +56,21 @@ static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
+ 	[MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_U8 },
+ };
+ 
++enum mtk_vendor_attr_3wire_ctrl {
++	MTK_VENDOR_ATTR_3WIRE_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_3WIRE_CTRL_MODE,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL,
++	MTK_VENDOR_ATTR_3WIRE_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL - 1
++};
++
++static struct nla_policy three_wire_ctrl_policy[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL] = {
++	[MTK_VENDOR_ATTR_3WIRE_CTRL_MODE] = {.type = NLA_U8 },
++};
++
+ enum mtk_vendor_attr_csi_ctrl {
+ 	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
+ 
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 4cd7505..9ca19af 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4693,6 +4693,14 @@ struct wpa_driver_ops {
+ 	 */
+ 	 int (*hemu_ctrl)(void *priv, u8 hemu_onoff);
+ 	 int (*hemu_dump)(void *priv, u8 *hemu_onoff);
++
++	/**
++	 * three_wire_ctrl - set three_wire_ctrl mode
++	 * @priv: Private driver interface data
++	 * @three_wire_enable: three_wire_ctrl mode
++	 *
++	 */
++	 int (*three_wire_ctrl)(void *priv, u8 three_wire_enable);
+ };
+ 
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 73dee2e..2bb8cc2 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12637,6 +12637,38 @@ static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
+ 	return ret;
+ }
+ 
++static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	/* Prepare nl80211 cmd */
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_3wire_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting three wire control");
++		return 0;
++	}
++
++	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++			MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL) ||
++	    !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_3WIRE_CTRL_MODE, three_wire_enable)) {
++		nlmsg_free(msg);
++		return -ENOBUFS;
++	}
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to enable three wire. ret=%d (%s) ",
++			   ret, strerror(-ret));
++	}
++	return ret;
++}
+ 
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.name = "nl80211",
+@@ -12789,4 +12821,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.configure_edcca_enable = nl80211_configure_edcca_enable,
+ 	.configure_edcca_threshold = nl80211_configure_edcca_threshold,
+ 	.get_edcca = nl80211_get_edcca,
++	.three_wire_ctrl = nl80211_enable_three_wire,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 57f0249..9fe7811 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -183,6 +183,7 @@ struct wpa_driver_nl80211_data {
+ 	unsigned int uses_6ghz:1;
+ 	unsigned int mtk_edcca_vendor_cmd_avail:1;
+ 	unsigned int mtk_hemu_vendor_cmd_avail:1;
++	unsigned int mtk_3wire_vendor_cmd_avail:1;
+ 
+ 	u64 vendor_scan_cookie;
+ 	u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index cc146d9..04bc54e 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1059,6 +1059,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ 				case MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL :
+ 					drv->mtk_hemu_vendor_cmd_avail = 1;
+ 					break;
++				case MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL :
++					drv->mtk_3wire_vendor_cmd_avail = 1;
++					break;
+ 				}
+ 			}
+ 
+-- 
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99907-hostapd-mtk-Add-hostapd-iBF-control.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
new file mode 100644
index 0000000..c37cb40
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
@@ -0,0 +1,431 @@
+From 4971762bfaba906054d43bd2d042c436a1ac97b2 Mon Sep 17 00:00:00 2001
+From: mtk27835 <shurong.wen@mediatek.com>
+Date: Wed, 7 Sep 2022 14:41:51 -0700
+Subject: [PATCH 99907/99910] hostapd: mtk: Add hostapd iBF control
+
+Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
+---
+ hostapd/config_file.c             |   3 +
+ hostapd/ctrl_iface.c              |  26 +++++++
+ hostapd/hostapd_cli.c             |   9 +++
+ src/ap/ap_config.c                |   1 +
+ src/ap/ap_config.h                |   2 +
+ src/ap/ap_drv_ops.c               |  14 ++++
+ src/ap/ap_drv_ops.h               |   2 +
+ src/ap/hostapd.c                  |   2 +
+ src/common/mtk_vendor.h           |  35 +++++++++-
+ src/drivers/driver.h              |  19 ++++++
+ src/drivers/driver_nl80211.c      | 108 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h      |   1 +
+ src/drivers/driver_nl80211_capa.c |   3 +
+ 13 files changed, 224 insertions(+), 1 deletion(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 18b372a..d9d882c 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4798,6 +4798,9 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 		u8 en = atoi(pos);
+ 
+ 		conf->three_wire_enable = en;
++	} else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
++		int val = atoi(pos);
++		conf->ibf_enable = !!val;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 5f71aee..c881d37 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3498,6 +3498,30 @@ hostapd_ctrl_iface_get_hemu(struct hostapd_data *hapd, char *buf,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
++					 size_t buflen)
++{
++	u8 ibf_enable;
++	int ret;
++	char *pos, *end;
++
++	pos = buf;
++	end = buf + buflen;
++
++	if (hostapd_drv_ibf_dump(hapd, &ibf_enable) == 0) {
++		hapd->iconf->ibf_enable = ibf_enable;
++		ret = os_snprintf(pos, end - pos, "ibf_enable: %u\n",
++			  ibf_enable);
++	}
++
++	if (os_snprintf_error(end - pos, ret))
++		return 0;
++
++	return ret;
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -4055,6 +4079,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 							  reply_size);
+ 	} else if (os_strncmp(buf, "GET_HEMU", 8) == 0) {
+ 		reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
++	} else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
++		reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index 0d36477..c2a123a 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1586,6 +1586,13 @@ static int hostapd_cli_cmd_driver(struct wpa_ctrl *ctrl, int argc, char *argv[])
+ #endif /* ANDROID */
+ 
+ 
++static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
++					   char *argv[])
++{
++	return hostapd_cli_cmd(ctrl, "GET_IBF", 0, NULL, NULL);
++}
++
++
+ struct hostapd_cli_cmd {
+ 	const char *cmd;
+ 	int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]);
+@@ -1787,6 +1794,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ #endif /* ANDROID */
+ 	{ "inband_discovery", hostapd_cli_cmd_inband_discovery, NULL,
+           "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
++	{ "get_ibf", hostapd_cli_cmd_get_ibf, NULL,
++	  " = show iBF state (enabled/disabled)"},
+ 	{ NULL, NULL, NULL, NULL }
+ };
+ 
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 9249a6b..7a96cb8 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -298,6 +298,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ 	conf->edcca_enable = EDCCA_MODE_AUTO;
+ 	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
+ 	conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
++	conf->ibf_enable = IBF_DEFAULT_ENABLE;
+ 
+ 	return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 71cf515..44a0e7e 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1158,6 +1158,7 @@ struct hostapd_config {
+ 	s8 edcca_compensation;
+ 	int *edcca_threshold;
+ 	u8 three_wire_enable;
++	u8 ibf_enable;
+ };
+ 
+ enum three_wire_mode {
+@@ -1198,6 +1199,7 @@ enum mtk_vendor_attr_edcca_ctrl_mode {
+ #define EDCCA_MIN_CONFIG_THRES -126
+ #define EDCCA_MAX_CONFIG_THRES 0
+ 
++#define IBF_DEFAULT_ENABLE 0
+ 
+ static inline enum oper_chan_width
+ hostapd_get_oper_chwidth(struct hostapd_config *conf)
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index a1d83e4..60ae825 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1064,3 +1064,17 @@ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
+ 	}
+ 	return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
+ }
++
++int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd)
++{
++	if (!hapd->driver || !hapd->driver->ibf_ctrl)
++		return 0;
++	return hapd->driver->ibf_ctrl(hapd->drv_priv, hapd->iconf->ibf_enable);
++}
++
++int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
++{
++	if (!hapd->driver || !hapd->driver->ibf_dump)
++		return 0;
++	return hapd->driver->ibf_dump(hapd->drv_priv, ibf_enable);
++}
+\ No newline at end of file
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 5ba6297..ab9aedc 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -145,6 +145,8 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+ int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable);
+ 
+ #include "drivers/driver.h"
+ 
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index f9dabdf..e44b73d 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2305,6 +2305,8 @@ dfs_offload:
+ 		goto fail;
+ 	if (hostapd_drv_three_wire_ctrl(hapd) < 0)
+ 		goto fail;
++	if (hostapd_drv_ibf_ctrl(hapd) < 0)
++		goto fail;
+ 
+ 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ 		   iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index ee5a4f4..4050cf8 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -13,7 +13,8 @@ enum mtk_nl80211_vendor_subcmds {
+ 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ 	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
+-	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
++	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8,
++	MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL = 0xc9,
+ };
+ 
+ enum mtk_vendor_attr_edcca_ctrl {
+@@ -204,6 +205,38 @@ enum mtk_vendor_attr_hemu_ctrl {
+ 		NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
+ };
+ 
++enum mtk_vendor_attr_ibf_ctrl {
++	MTK_VENDOR_ATTR_IBF_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_IBF_CTRL_ENABLE,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_IBF_CTRL,
++	MTK_VENDOR_ATTR_IBF_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_IBF_CTRL - 1
++};
++
++enum mtk_vendor_attr_ibf_dump {
++	MTK_VENDOR_ATTR_IBF_DUMP_UNSPEC,
++
++	MTK_VENDOR_ATTR_IBF_DUMP_ENABLE,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_IBF_DUMP,
++	MTK_VENDOR_ATTR_IBF_DUMP_MAX =
++		NUM_MTK_VENDOR_ATTRS_IBF_DUMP - 1
++};
++
++static struct nla_policy
++ibf_ctrl_policy[NUM_MTK_VENDOR_ATTRS_IBF_CTRL] = {
++	[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE] = { .type = NLA_U8 },
++};
++
++static struct nla_policy
++ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
++	[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE] = { .type = NLA_U8 },
++};
++
+ 
+ #define CSI_MAX_COUNT 256
+ #define ETH_ALEN 6
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 9ca19af..71ded61 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1628,6 +1628,11 @@ struct wpa_driver_ap_params {
+ 	 * hemu onoff=<val> (bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0))
+ 	 */
+ 	u8 hemu_onoff;
++
++	/**
++	 * ibf_enable=<val>
++	 */
++	u8 ibf_enable;
+ };
+ 
+ struct wpa_driver_mesh_bss_params {
+@@ -4701,6 +4706,20 @@ struct wpa_driver_ops {
+ 	 *
+ 	 */
+ 	 int (*three_wire_ctrl)(void *priv, u8 three_wire_enable);
++
++	/**
++	 * ibf_ctrl - ctrl disable/enable for ibf
++	 * @priv: Private driver interface data
++	 *
++	 */
++	int (*ibf_ctrl)(void *priv, u8 ibf_enable);
++
++	/**
++	 * ibf_dump - dump ibf
++	 * @priv: Private driver interface data
++	 *
++	 */
++	int (*ibf_dump)(void *priv, u8 *ibf_enable);
+ };
+ 
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 2bb8cc2..e974f85 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12670,6 +12670,112 @@ static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
+ 	return ret;
+ }
+ 
++static int nl80211_ibf_enable(void *priv, u8 ibf_enable)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_ibf_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting ibf control");
++		return 0;
++	}
++
++	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++	if (!msg)
++		goto fail;
++
++	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL))
++		goto fail;
++
++	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++	if (!data)
++		goto fail;
++
++	nla_put_u8(msg, MTK_VENDOR_ATTR_IBF_CTRL_ENABLE, ibf_enable);
++
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to set ibf_enable. ret=%d (%s)", ret, strerror(-ret));
++	}
++
++	return ret;
++
++fail:
++	nlmsg_free(msg);
++	return -ENOBUFS;
++}
++
++static int ibf_dump_handler(struct nl_msg *msg, void *arg)
++{
++	u8 *ibf_enable = (u8 *) arg;
++	struct nlattr *tb[NL80211_ATTR_MAX + 1];
++	struct nlattr *tb_vendor[MTK_VENDOR_ATTR_IBF_DUMP_MAX + 1];
++	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++	struct nlattr *nl_vend, *attr;
++
++	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++			genlmsg_attrlen(gnlh, 0), NULL);
++
++	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++	if (!nl_vend)
++		return NL_SKIP;
++
++	nla_parse(tb_vendor, MTK_VENDOR_ATTR_IBF_DUMP_MAX,
++			nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++	attr = tb_vendor[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE];
++	if (!attr) {
++		wpa_printf(MSG_ERROR, "nl80211: cannot find MTK_VENDOR_ATTR_IBF_DUMP_ENABLE");
++		return NL_SKIP;
++	}
++
++	*ibf_enable = nla_get_u8(attr);
++
++	return NL_SKIP;
++}
++
++static int
++nl80211_ibf_dump(void *priv, u8 *ibf_enable)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
++	if (!msg)
++		goto fail;
++
++	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL))
++		goto fail;
++
++	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED);
++	if (!data)
++		goto fail;
++
++	nla_nest_end(msg, data);
++
++	ret = send_and_recv_msgs(drv, msg, ibf_dump_handler, ibf_enable, NULL, NULL);
++
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to dump ibf_enable. ret=%d (%s)", ret, strerror(-ret));
++	}
++
++	return ret;
++
++fail:
++	nlmsg_free(msg);
++	return -ENOBUFS;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.name = "nl80211",
+ 	.desc = "Linux nl80211/cfg80211",
+@@ -12822,4 +12928,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.configure_edcca_threshold = nl80211_configure_edcca_threshold,
+ 	.get_edcca = nl80211_get_edcca,
+ 	.three_wire_ctrl = nl80211_enable_three_wire,
++	.ibf_ctrl = nl80211_ibf_enable,
++	.ibf_dump = nl80211_ibf_dump,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 9fe7811..607592c 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -184,6 +184,7 @@ struct wpa_driver_nl80211_data {
+ 	unsigned int mtk_edcca_vendor_cmd_avail:1;
+ 	unsigned int mtk_hemu_vendor_cmd_avail:1;
+ 	unsigned int mtk_3wire_vendor_cmd_avail:1;
++	unsigned int mtk_ibf_vendor_cmd_avail:1;
+ 
+ 	u64 vendor_scan_cookie;
+ 	u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 04bc54e..9ecc0ff 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1062,6 +1062,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ 				case MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL :
+ 					drv->mtk_3wire_vendor_cmd_avail = 1;
+ 					break;
++				case MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL:
++					drv->mtk_ibf_vendor_cmd_avail = 1;
++					break;
+ 				}
+ 			}
+ 
+-- 
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
new file mode 100644
index 0000000..47628d7
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
@@ -0,0 +1,27 @@
+From f96a62568fb3c419e71f8d7469d485dce55f4da6 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 22 Sep 2022 16:08:09 +0800
+Subject: [PATCH 99908/99910] hostapd: mtk: Do not include HE capab IE if
+ associated sta's HE capab IE is invalid
+
+---
+ src/ap/ieee802_11.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
+index d921783..098793e 100644
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -5192,7 +5192,8 @@ static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
+ #endif /* CONFIG_IEEE80211AC */
+ 
+ #ifdef CONFIG_IEEE80211AX
+-	if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax) {
++	if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax &&
++			sta->flags & WLAN_STA_HE) {
+ 		p = hostapd_eid_he_capab(hapd, p, IEEE80211_MODE_AP);
+ 		p = hostapd_eid_he_operation(hapd, p);
+ 		p = hostapd_eid_cca(hapd, p);
+-- 
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
new file mode 100644
index 0000000..c1fc3f1
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
@@ -0,0 +1,376 @@
+From 782f38f2eec27e438e55cb09e824a6ffc1c3eb18 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 7 Oct 2022 10:46:29 +0800
+Subject: [PATCH 99909/99910] hostapd: mtk: Add DFS and ZWDFS support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c        |  4 ++
+ hostapd/ctrl_iface.c         | 95 ++++++++++++++++++++++++++++++++++++
+ src/ap/ap_config.h           | 13 +++++
+ src/ap/dfs.c                 | 35 +++++++------
+ src/ap/dfs.h                 | 15 ++++++
+ src/ap/hostapd.c             |  4 +-
+ src/drivers/driver.h         |  7 +++
+ src/drivers/driver_nl80211.c | 29 +++++++++++
+ src/drivers/nl80211_copy.h   |  1 +
+ 9 files changed, 186 insertions(+), 17 deletions(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index d9d882c..fd61448 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4801,6 +4801,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 	} else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
+ 		int val = atoi(pos);
+ 		conf->ibf_enable = !!val;
++	} else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
++		u8 en = strtol(pos, NULL, 10);
++
++		conf->dfs_detect_mode = en;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index c881d37..6ea1573 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3522,6 +3522,96 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
++				       char *buf, size_t buflen)
++{
++	u8 dfs_detect_mode;
++
++	if (!value)
++		return -1;
++
++	dfs_detect_mode = strtol(value, NULL, 10);
++	if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
++		wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
++		return -1;
++	}
++	hapd->iconf->dfs_detect_mode = dfs_detect_mode;
++
++	return os_snprintf(buf, buflen, "OK\n");
++}
++
++
++static int
++hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
++				    char *buf, size_t buflen)
++{
++	struct hostapd_iface *iface = hapd->iface;
++	char *pos, *param;
++	enum hostapd_hw_mode hw_mode;
++	bool chan_found = false;
++	int i, num_available_chandefs, channel, chan_width, sec = 0;
++	int sec_chan_idx_80p80 = -1;
++	u8 oper_centr_freq_seg0_idx, oper_centr_freq_seg1_idx;
++	struct hostapd_channel_data *chan;
++	enum dfs_channel_type type = DFS_NO_CAC_YET;
++
++	param = os_strchr(cmd, ' ');
++	if (!param)
++		return -1;
++	*param++ = '\0';
++
++	pos = os_strstr(param, "chan=");
++	if (pos)
++		channel = strtol(pos + 5, NULL, 10);
++	else
++		return -1;
++
++	num_available_chandefs = dfs_find_channel(iface, NULL, 0, type);
++	for (i = 0; i < num_available_chandefs; i++) {
++		dfs_find_channel(iface, &chan, i, type);
++		if (chan->chan == channel) {
++			chan_found = true;
++			break;
++		}
++	}
++
++	if (!chan_found)
++		return -1;
++
++	if (iface->conf->secondary_channel)
++		sec = 1;
++
++	dfs_adjust_center_freq(iface, chan,
++			       sec,
++			       sec_chan_idx_80p80,
++			       &oper_centr_freq_seg0_idx,
++			       &oper_centr_freq_seg1_idx);
++
++	if (hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
++				  chan->freq, chan->chan,
++				  iface->conf->ieee80211n,
++				  iface->conf->ieee80211ac,
++				  iface->conf->ieee80211ax,
++				  iface->conf->ieee80211be,
++				  sec, hostapd_get_oper_chwidth(iface->conf),
++				  oper_centr_freq_seg0_idx,
++				  oper_centr_freq_seg1_idx, true)) {
++		wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
++		iface->radar_background.channel = -1;
++		return -1;
++	}
++
++	iface->radar_background.channel = chan->chan;
++	iface->radar_background.freq = chan->freq;
++	iface->radar_background.secondary_channel = sec;
++	iface->radar_background.centr_freq_seg0_idx = oper_centr_freq_seg0_idx;
++	iface->radar_background.centr_freq_seg1_idx = oper_centr_freq_seg1_idx;
++
++	return os_snprintf(buf, buflen, "OK\n");
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -4081,6 +4171,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 		reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ 	} else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
+ 		reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
++	} else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
++		reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
++								   reply, reply_size);
++	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
++		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 44a0e7e..3f5afdf 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1159,6 +1159,7 @@ struct hostapd_config {
+ 	int *edcca_threshold;
+ 	u8 three_wire_enable;
+ 	u8 ibf_enable;
++	u8 dfs_detect_mode;
+ };
+ 
+ enum three_wire_mode {
+@@ -1173,6 +1174,18 @@ enum three_wire_mode {
+ 		NUM_THREE_WIRE_MODE - 1
+ };
+ 
++enum dfs_mode {
++	DFS_DETECT_MODE_DISABLE,
++	DFS_DETECT_MODE_AP_ENABLE,
++	DFS_DETECT_MODE_BACKGROUND_ENABLE,
++	DFS_DETECT_MODE_ALL_ENABLE,
++
++	/* keep last */
++	NUM_DFS_DETECT_MODE,
++	DFS_DETECT_MODE_MAX =
++		NUM_DFS_DETECT_MODE - 1
++};
++
+ enum edcca_mode {
+ 	EDCCA_MODE_FORCE_DISABLE = 0,
+ 	EDCCA_MODE_AUTO = 1,
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index b5d105d..1c3f678 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -19,13 +19,6 @@
+ #include "dfs.h"
+ #include "crypto/crypto.h"
+ 
+-
+-enum dfs_channel_type {
+-	DFS_ANY_CHANNEL,
+-	DFS_AVAILABLE, /* non-radar or radar-available */
+-	DFS_NO_CAC_YET, /* radar-not-yet-available */
+-};
+-
+ static struct hostapd_channel_data *
+ dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
+ 			u8 *oper_centr_freq_seg0_idx,
+@@ -238,9 +231,9 @@ static int is_in_chanlist(struct hostapd_iface *iface,
+  *  - hapd->vht/he_oper_centr_freq_seg0_idx
+  *  - hapd->vht/he_oper_centr_freq_seg1_idx
+  */
+-static int dfs_find_channel(struct hostapd_iface *iface,
+-			    struct hostapd_channel_data **ret_chan,
+-			    int idx, enum dfs_channel_type type)
++int dfs_find_channel(struct hostapd_iface *iface,
++		     struct hostapd_channel_data **ret_chan,
++		     int idx, enum dfs_channel_type type)
+ {
+ 	struct hostapd_hw_modes *mode;
+ 	struct hostapd_channel_data *chan;
+@@ -299,12 +292,12 @@ static int dfs_find_channel(struct hostapd_iface *iface,
+ }
+ 
+ 
+-static void dfs_adjust_center_freq(struct hostapd_iface *iface,
+-				   struct hostapd_channel_data *chan,
+-				   int secondary_channel,
+-				   int sec_chan_idx_80p80,
+-				   u8 *oper_centr_freq_seg0_idx,
+-				   u8 *oper_centr_freq_seg1_idx)
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++			    struct hostapd_channel_data *chan,
++			    int secondary_channel,
++			    int sec_chan_idx_80p80,
++			    u8 *oper_centr_freq_seg0_idx,
++			    u8 *oper_centr_freq_seg1_idx)
+ {
+ 	if (!iface->conf->ieee80211ac && !iface->conf->ieee80211ax)
+ 		return;
+@@ -1317,6 +1310,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
+ 		   __func__, iface->radar_background.cac_started ? "yes" : "no",
+ 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
+ 
++	/* Skip channel switch when background dfs detect mode is on */
++	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
++	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++		return 0;
++
+ 	/* Check if CSA in progress */
+ 	if (hostapd_csa_in_progress(iface))
+ 		return 0;
+@@ -1365,6 +1363,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
+ 		   __func__, iface->cac_started ? "yes" : "no",
+ 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
+ 
++	/* Skip channel switch when dfs detect mode is on */
++	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
++	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++		return 0;
++
+ 	/* Check if CSA in progress */
+ 	if (hostapd_csa_in_progress(iface))
+ 		return 0;
+diff --git a/src/ap/dfs.h b/src/ap/dfs.h
+index 606c1b3..c2556d2 100644
+--- a/src/ap/dfs.h
++++ b/src/ap/dfs.h
+@@ -9,6 +9,12 @@
+ #ifndef DFS_H
+ #define DFS_H
+ 
++enum dfs_channel_type {
++	DFS_ANY_CHANNEL,
++	DFS_AVAILABLE, /* non-radar or radar-available */
++	DFS_NO_CAC_YET, /* radar-not-yet-available */
++};
++
+ int hostapd_handle_dfs(struct hostapd_iface *iface);
+ 
+ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
+@@ -32,5 +38,14 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
+ int hostapd_handle_dfs_offload(struct hostapd_iface *iface);
+ int hostapd_is_dfs_overlap(struct hostapd_iface *iface, enum chan_width width,
+ 			   int center_freq);
++int dfs_find_channel(struct hostapd_iface *iface,
++		     struct hostapd_channel_data **ret_chan,
++		     int idx, enum dfs_channel_type type);
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++			    struct hostapd_channel_data *chan,
++			    int secondary_channel,
++			    int sec_chan_idx_80p80,
++			    u8 *oper_centr_freq_seg0_idx,
++			    u8 *oper_centr_freq_seg1_idx);
+ 
+ #endif /* DFS_H */
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index e44b73d..793ce2f 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -1463,7 +1463,9 @@ static int hostapd_setup_bss(struct hostapd_data *hapd, int first)
+ 		return -1;
+ 	}
+ 
+-	if (!conf->start_disabled && ieee802_11_set_beacon(hapd) < 0)
++	if (conf->start_disabled)
++		hapd->driver->start_disabled(hapd->drv_priv);
++	else if (ieee802_11_set_beacon(hapd) < 0)
+ 		return -1;
+ 
+ 	if (flush_old_stations && !conf->start_disabled &&
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 71ded61..aa23fbd 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4720,6 +4720,13 @@ struct wpa_driver_ops {
+ 	 *
+ 	 */
+ 	int (*ibf_dump)(void *priv, u8 *ibf_enable);
++
++	/**
++	 * start_disabled - set start_disabled to cfg80211
++	 * @priv: Private driver interface data
++	 *
++	 */
++	int (*start_disabled)(void *priv);
+ };
+ 
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index e974f85..003adc4 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12776,6 +12776,34 @@ fail:
+ 	return -ENOBUFS;
+ }
+ 
++static int nl80211_start_disabled(void *priv)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	msg = nl80211_bss_msg(bss, 0, NL80211_CMD_NEW_BEACON);
++	if (!msg)
++		goto fail;
++
++	if (nla_put_flag(msg, NL80211_ATTR_START_DISABLED))
++		goto fail;
++
++	ret = send_and_recv_msgs_connect_handle(drv, msg, bss, 1);
++
++	if (ret)
++		wpa_printf(MSG_ERROR, "Failed to set start_disabled. ret=%d (%s)",
++			   ret, strerror(-ret));
++
++	return ret;
++
++fail:
++	nlmsg_free(msg);
++	return ret;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.name = "nl80211",
+ 	.desc = "Linux nl80211/cfg80211",
+@@ -12930,4 +12958,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.three_wire_ctrl = nl80211_enable_three_wire,
+ 	.ibf_ctrl = nl80211_ibf_enable,
+ 	.ibf_dump = nl80211_ibf_dump,
++	.start_disabled = nl80211_start_disabled,
+ };
+diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
+index c4bf3ad..79bc76c 100644
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -3176,6 +3176,7 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_EHT_CAPABILITY,
+ 
+ 	/* add attributes here, update the policy in nl80211.c */
++	NL80211_ATTR_START_DISABLED = 999,
+ 
+ 	__NL80211_ATTR_AFTER_LAST,
+ 	NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
+-- 
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99910-hostapd-mtk-Add-amsdu-set-get-ctrl.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99910-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
new file mode 100644
index 0000000..c05a444
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99910-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
@@ -0,0 +1,400 @@
+From 6cf5ec59e09945a075909b8070d9795869db081e Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Fri, 16 Dec 2022 03:57:11 +0800
+Subject: [PATCH 99910/99910] hostapd: mtk: Add amsdu set get ctrl
+
+---
+ hostapd/config_file.c             |   9 +++
+ hostapd/ctrl_iface.c              |  26 +++++++
+ hostapd/hostapd_cli.c             |   9 +++
+ src/ap/ap_config.c                |   1 +
+ src/ap/ap_config.h                |   1 +
+ src/ap/ap_drv_ops.c               |  14 ++++
+ src/ap/ap_drv_ops.h               |   2 +
+ src/ap/hostapd.c                  |   2 +
+ src/common/mtk_vendor.h           |  17 ++++-
+ src/drivers/driver.h              |   9 +++
+ src/drivers/driver_nl80211.c      | 114 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h      |   1 +
+ src/drivers/driver_nl80211_capa.c |   3 +
+ 13 files changed, 207 insertions(+), 1 deletion(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index fd61448..759033b 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4805,6 +4805,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 		u8 en = strtol(pos, NULL, 10);
+ 
+ 		conf->dfs_detect_mode = en;
++	} else if (os_strcmp(buf, "amsdu") == 0) {
++		int val = atoi(pos);
++		if (val < 0 || val > 1) {
++			wpa_printf(MSG_ERROR,
++					 "Line %d: invalid amsdu value",
++					 line);
++			return 1;
++		}
++		conf->amsdu = val;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 6ea1573..0ad8451 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3612,6 +3612,30 @@ hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_get_amsdu(struct hostapd_data *hapd, char *buf,
++					 size_t buflen)
++{
++	u8 amsdu;
++	int ret;
++	char *pos, *end;
++
++	pos = buf;
++	end = buf + buflen;
++
++	if (hostapd_drv_amsdu_dump(hapd, &amsdu) == 0) {
++		hapd->iconf->amsdu = amsdu;
++		ret = os_snprintf(pos, end - pos, "[hostapd_cli] AMSDU: %u\n",
++					hapd->iconf->amsdu);
++	}
++
++	if (os_snprintf_error(end - pos, ret))
++		return 0;
++
++	return ret;
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -4176,6 +4200,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 								   reply, reply_size);
+ 	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
+ 		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
++	} else if (os_strncmp(buf, "GET_AMSDU", 9) == 0) {
++		reply_len = hostapd_ctrl_iface_get_amsdu(hapd, reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index c2a123a..30b3392 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1593,6 +1593,13 @@ static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
+ }
+ 
+ 
++static int hostapd_cli_cmd_get_amsdu(struct wpa_ctrl *ctrl, int argc,
++					   char *argv[])
++{
++	return hostapd_cli_cmd(ctrl, "GET_AMSDU", 0, NULL, NULL);
++}
++
++
+ struct hostapd_cli_cmd {
+ 	const char *cmd;
+ 	int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]);
+@@ -1796,6 +1803,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+           "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
+ 	{ "get_ibf", hostapd_cli_cmd_get_ibf, NULL,
+ 	  " = show iBF state (enabled/disabled)"},
++	{ "get_amsdu", hostapd_cli_cmd_get_amsdu, NULL,
++		" = show AMSDU state"},
+ 	{ NULL, NULL, NULL, NULL }
+ };
+ 
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 7a96cb8..85ad5e4 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -299,6 +299,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ 	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
+ 	conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
+ 	conf->ibf_enable = IBF_DEFAULT_ENABLE;
++	conf->amsdu = 1;
+ 
+ 	return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 3f5afdf..92f1bd6 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1160,6 +1160,7 @@ struct hostapd_config {
+ 	u8 three_wire_enable;
+ 	u8 ibf_enable;
+ 	u8 dfs_detect_mode;
++	u8 amsdu;
+ };
+ 
+ enum three_wire_mode {
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 60ae825..1a82f23 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1077,4 +1077,18 @@ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
+ 	if (!hapd->driver || !hapd->driver->ibf_dump)
+ 		return 0;
+ 	return hapd->driver->ibf_dump(hapd->drv_priv, ibf_enable);
++}
++
++int hostapd_drv_amsdu_ctrl(struct hostapd_data *hapd)
++{
++	if (!hapd->driver || !hapd->driver->amsdu_ctrl)
++		return 0;
++	return hapd->driver->amsdu_ctrl(hapd->drv_priv, hapd->iconf->amsdu);
++}
++
++int hostapd_drv_amsdu_dump(struct hostapd_data *hapd, u8 *amsdu)
++{
++	if (!hapd->driver || !hapd->driver->amsdu_dump)
++		return 0;
++	return hapd->driver->amsdu_dump(hapd->drv_priv, amsdu);
+ }
+\ No newline at end of file
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index ab9aedc..4406666 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -147,6 +147,8 @@ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable);
++int hostapd_drv_amsdu_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_amsdu_dump(struct hostapd_data *hapd, u8 *amsdu);
+ 
+ #include "drivers/driver.h"
+ 
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 793ce2f..aef01f2 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2309,6 +2309,8 @@ dfs_offload:
+ 		goto fail;
+ 	if (hostapd_drv_ibf_ctrl(hapd) < 0)
+ 		goto fail;
++	if (hostapd_drv_amsdu_ctrl(hapd) < 0)
++		goto fail;
+ 
+ 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ 		   iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 4050cf8..0999ea9 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -167,7 +167,6 @@ enum mtk_vendor_attr_wireless_ctrl {
+ 	MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
+ 	MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
+ 	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
+-	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU,
+ 	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
+ 	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT,
+ 
+@@ -177,6 +176,22 @@ enum mtk_vendor_attr_wireless_ctrl {
+ 		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
+ };
+ 
++enum mtk_vendor_attr_wireless_dump {
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_UNSPEC,
++
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP,
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX =
++		NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP - 1
++};
++
++static const struct nla_policy
++wireless_dump_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP] = {
++	[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU] = { .type = NLA_U8 },
++};
++
+ enum mtk_vendor_attr_rfeature_ctrl {
+ 	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
+ 
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index aa23fbd..b07aaf3 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4727,6 +4727,15 @@ struct wpa_driver_ops {
+ 	 *
+ 	 */
+ 	int (*start_disabled)(void *priv);
++
++	/**
++	 * amsdu_ctrl - enable/disable amsdu
++	 * amsdu_dump - get current amsdu status
++	 * @priv: Private driver interface data
++	 *
++	 */
++	int (*amsdu_ctrl)(void *priv, u8 amsdu);
++	int (*amsdu_dump)(void *priv, u8 *amsdu);
+ };
+ 
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 003adc4..5c04284 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12804,6 +12804,118 @@ fail:
+ 	return ret;
+ }
+ 
++static int nl80211_enable_amsdu(void *priv, u8 amsdu)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_wireless_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting ap wireless control");
++		return 0;
++	}
++
++	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++	if (!msg)
++		goto fail;
++
++	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
++		goto fail;
++
++	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++	if (!data)
++		goto fail;
++
++	nla_put_u8(msg, MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU, amsdu);
++
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to set amsdu. ret=%d (%s)", ret, strerror(-ret));
++	}
++
++	return ret;
++
++fail:
++	nlmsg_free(msg);
++	return -ENOBUFS;
++}
++
++static int dump_amsdu_handler(struct nl_msg *msg, void *arg)
++{
++	u8 *amsdu = (u8 *) arg;
++	struct nlattr *tb[NL80211_ATTR_MAX + 1];
++	struct nlattr *tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX + 1];
++	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++	struct nlattr *nl_vend, *attr_amsdu;
++
++	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++			genlmsg_attrlen(gnlh, 0), NULL);
++
++	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++	if (!nl_vend)
++		return NL_SKIP;
++
++	nla_parse(tb_vendor, MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX,
++			nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++	attr_amsdu = tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU];
++	if (!attr_amsdu ){
++		wpa_printf(MSG_ERROR, "nl80211: cannot find vendor attributes");
++		return NL_SKIP;
++	}
++
++	*amsdu = nla_get_u8(attr_amsdu);
++
++	return NL_SKIP;
++}
++
++static int
++nl80211_dump_amsdu(void *priv, u8 *amsdu)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_wireless_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++				 "nl80211: Driver does not support ap_wireless control");
++		return 0;
++	}
++
++	msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
++	if (!msg)
++		goto fail;
++
++	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
++		goto fail;
++
++	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++	if (!data)
++		goto fail;
++
++	nla_nest_end(msg, data);
++
++	ret = send_and_recv_msgs(drv, msg, dump_amsdu_handler, amsdu, NULL, NULL);
++
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to dump amsdu. ret=%d (%s)", ret, strerror(-ret));
++	}
++
++	return ret;
++
++fail:
++	nlmsg_free(msg);
++	return -ENOBUFS;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.name = "nl80211",
+ 	.desc = "Linux nl80211/cfg80211",
+@@ -12959,4 +13071,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.ibf_ctrl = nl80211_ibf_enable,
+ 	.ibf_dump = nl80211_ibf_dump,
+ 	.start_disabled = nl80211_start_disabled,
++	.amsdu_ctrl = nl80211_enable_amsdu,
++	.amsdu_dump = nl80211_dump_amsdu,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 607592c..e570224 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -185,6 +185,7 @@ struct wpa_driver_nl80211_data {
+ 	unsigned int mtk_hemu_vendor_cmd_avail:1;
+ 	unsigned int mtk_3wire_vendor_cmd_avail:1;
+ 	unsigned int mtk_ibf_vendor_cmd_avail:1;
++	unsigned int mtk_wireless_vendor_cmd_avail:1;
+ 
+ 	u64 vendor_scan_cookie;
+ 	u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 9ecc0ff..fcfa68b 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1065,6 +1065,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ 				case MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL:
+ 					drv->mtk_ibf_vendor_cmd_avail = 1;
+ 					break;
++				case MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL:
++					drv->mtk_wireless_vendor_cmd_avail = 1;
++					break;
+ 				}
+ 			}
+ 
+-- 
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99911-hostapd-mtk-Add-he_ldpc-configuration.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99911-hostapd-mtk-Add-he_ldpc-configuration.patch
new file mode 100644
index 0000000..2e8dfe0
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99911-hostapd-mtk-Add-he_ldpc-configuration.patch
@@ -0,0 +1,102 @@
+From 216258435a119d48c233b63c2383850bc5f86e94 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Thu, 12 Jan 2023 15:18:19 +0800
+Subject: [PATCH] hostapd: mtk: Add he_ldpc configuration
+
+---
+ hostapd/config_file.c        | 2 ++
+ hostapd/hostapd.conf         | 5 +++++
+ src/ap/ap_config.c           | 1 +
+ src/ap/ap_config.h           | 1 +
+ src/ap/ieee802_11_he.c       | 7 +++++++
+ src/common/ieee802_11_defs.h | 3 +++
+ 6 files changed, 19 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 10ea525..4237a5c 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3508,6 +3508,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 		conf->he_phy_capab.he_su_beamformee = atoi(pos);
+ 	} else if (os_strcmp(buf, "he_mu_beamformer") == 0) {
+ 		conf->he_phy_capab.he_mu_beamformer = atoi(pos);
++	} else if (os_strcmp(buf, "he_ldpc") == 0) {
++		conf->he_phy_capab.he_ldpc = atoi(pos);
+ 	} else if (os_strcmp(buf, "he_bss_color") == 0) {
+ 		conf->he_op.he_bss_color = atoi(pos) & 0x3f;
+ 		conf->he_op.he_bss_color_disabled = 0;
+diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
+index ea67aa1..e3a5eb3 100644
+--- a/hostapd/hostapd.conf
++++ b/hostapd/hostapd.conf
+@@ -830,6 +830,11 @@ wmm_ac_vo_acm=0
+ # 1 = supported
+ #he_mu_beamformer=1
+ 
++#he_ldpc: HE LDPC support
++# 0 = not supported
++# 1 = supported (default)
++#he_ldpc=1
++
+ # he_bss_color: BSS color (1-63)
+ #he_bss_color=1
+ 
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 85ad5e4..b283de6 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -268,6 +268,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ #endif /* CONFIG_ACS */
+ 
+ #ifdef CONFIG_IEEE80211AX
++	conf->he_phy_capab.he_ldpc = 1;
+ 	conf->he_op.he_rts_threshold = HE_OPERATION_RTS_THRESHOLD_MASK >>
+ 		HE_OPERATION_RTS_THRESHOLD_OFFSET;
+ 	/* Set default basic MCS/NSS set to single stream MCS 0-7 */
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index a9ac396..b8b20a7 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -929,6 +929,7 @@ struct hostapd_bss_config {
+  * struct he_phy_capabilities_info - HE PHY capabilities
+  */
+ struct he_phy_capabilities_info {
++	bool he_ldpc;
+ 	bool he_su_beamformer;
+ 	bool he_su_beamformee;
+ 	bool he_mu_beamformer;
+diff --git a/src/ap/ieee802_11_he.c b/src/ap/ieee802_11_he.c
+index b5b7e5d..f27aeb1 100644
+--- a/src/ap/ieee802_11_he.c
++++ b/src/ap/ieee802_11_he.c
+@@ -138,6 +138,13 @@ u8 * hostapd_eid_he_capab(struct hostapd_data *hapd, u8 *eid,
+ 		os_memcpy(&cap->optional[mcs_nss_size],
+ 			  mode->he_capab[opmode].ppet,  ppet_size);
+ 
++	if (hapd->iface->conf->he_phy_capab.he_ldpc)
++		cap->he_phy_capab_info[HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX] |=
++			HE_PHYCAP_LDPC_CODING_IN_PAYLOAD;
++	else
++		cap->he_phy_capab_info[HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX] &=
++			~HE_PHYCAP_LDPC_CODING_IN_PAYLOAD;
++
+ 	if (hapd->iface->conf->he_phy_capab.he_su_beamformer)
+ 		cap->he_phy_capab_info[HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX] |=
+ 			HE_PHYCAP_SU_BEAMFORMER_CAPAB;
+diff --git a/src/common/ieee802_11_defs.h b/src/common/ieee802_11_defs.h
+index 65e125e..62088bd 100644
+--- a/src/common/ieee802_11_defs.h
++++ b/src/common/ieee802_11_defs.h
+@@ -2298,6 +2298,9 @@ struct ieee80211_spatial_reuse {
+ #define HE_PHYCAP_CHANNEL_WIDTH_SET_160MHZ_IN_5G	((u8) BIT(3))
+ #define HE_PHYCAP_CHANNEL_WIDTH_SET_80PLUS80MHZ_IN_5G	((u8) BIT(4))
+ 
++#define HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX	1
++#define HE_PHYCAP_LDPC_CODING_IN_PAYLOAD	((u8) BIT(5))
++
+ #define HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX	3
+ #define HE_PHYCAP_SU_BEAMFORMER_CAPAB		((u8) BIT(7))
+ #define HE_PHYCAP_SU_BEAMFORMEE_CAPAB_IDX	4
+-- 
+2.39.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99912-hostapd-mtk-Add-the-broadcast-destination-address-of.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99912-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
new file mode 100644
index 0000000..df9dcc5
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99912-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
@@ -0,0 +1,43 @@
+From 9c04bbbe2677cc11b88c867ab7b1df7e408483b5 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Tue, 17 Jan 2023 13:25:18 +0800
+Subject: [PATCH] hostapd: mtk: Add the broadcast destination address of Probe
+ Response frame on 6 GHz
+
+According to IEEE 802.11ax 26.17.2.3.2,
+if a 6 GHz AP receives a Probe Request frame and responds with a Probe Response frame,
+the Address 1 field of the Probe Response frame shall be set to the broadcast address,
+unless the AP is not indicating its actual SSID in the SSID element of its Beacon frames.
+
+Without this, hostapd fill the Address 1 feild of the Probe Response frame
+with the source address from Probe Request frame on 6 GHz.
+Fix this to use broadcast address instead.
+
+Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
+---
+ src/ap/beacon.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/src/ap/beacon.c b/src/ap/beacon.c
+index 1a26f11..f3ea5c2 100644
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1156,8 +1156,13 @@ void handle_probe_req(struct hostapd_data *hapd,
+ 	wpa_msg_ctrl(hapd->msg_ctx, MSG_INFO, RX_PROBE_REQUEST "sa=" MACSTR
+ 		     " signal=%d", MAC2STR(mgmt->sa), ssi_signal);
+ 
+-	resp = hostapd_gen_probe_resp(hapd, mgmt, elems.p2p != NULL,
+-				      &resp_len, false);
++	if (is_6ghz_op_class(hapd->iconf->op_class) &&
++	    is_broadcast_ether_addr(mgmt->da))
++		resp = hostapd_gen_probe_resp(hapd, NULL, elems.p2p != NULL,
++					      &resp_len, true);
++	else
++		resp = hostapd_gen_probe_resp(hapd, mgmt, elems.p2p != NULL,
++					      &resp_len, false);
+ 	if (resp == NULL)
+ 		return;
+ 
+-- 
+2.39.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
index 500c124..23e59fe 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
@@ -62,4 +62,17 @@
     file://800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch \
     file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
     file://992-openssl-include-rsa.patch \
+    file://99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch \
+    file://99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch \
+    file://99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch \
+    file://99903-hostapd-mtk-Add-mtk_vendor.h.patch \
+    file://99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch \
+    file://99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch \
+    file://99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch \
+    file://99907-hostapd-mtk-Add-hostapd-iBF-control.patch \
+    file://99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch \
+    file://99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch \
+    file://99910-hostapd-mtk-Add-amsdu-set-get-ctrl.patch \
+    file://99911-hostapd-mtk-Add-he_ldpc-configuration.patch \
+    file://99912-hostapd-mtk-Add-the-broadcast-destination-address-of.patch \
     "