[rdkb][common][bsp][Refactor and sync wifi from openwrt]
[Description]
Refactor and sync wifi from openwrt
57df49c [MAC80211][mt76][Enhance iwpriv to read multiple cr]
[Release-log]
Change-Id: I80f0891d3429fed4944ab7bba0c8ba5bdc3747bd
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch
new file mode 100644
index 0000000..f790577
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch
@@ -0,0 +1,475 @@
+From 4791a374c9861b0d90db7fbdefe509f4e7d12247 Mon Sep 17 00:00:00 2001
+From: "howard.hsu" <howard-yh.hsu@mediatek.com>
+Date: Wed, 19 Jan 2022 19:18:07 +0800
+Subject: [PATCH 99900/99910] hostapd: mtk: Add neighbor report and BSS
+ Termination for MBO certification
+
+1. Add hostapd_neighbor_count() and hostapd_neighbor_insert_buffer ()
+The first function can count the number of neighbor report in neighbore report
+database. The second can iterate neighbor report database to build up neighbor
+report data.
+
+2. Support including neighbor report elements in ANQP response
+3. Support including neignbor report elements in BTM response
+4. Support configuring BSS Termination TSF by using hostapd_cli command
+5. Disable interface if BSS Termination TSF is set
+6. Add set_send_disassoc_frame_timer() to send disassociate frame
+Function set_disassoc_timer() may fail if key was deleted first. This new
+function will not ask to delete key as set_disassoc_timer() did.
+7. Support including neighbor report elements in BTM request
+8. Add hostapd_neighbor_set_own_report_pref()
+9. Add hostapd_neighbor_set_pref_by_non_pref_chan()
+---
+ hostapd/ctrl_iface.c | 5 ++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 1 +
+ src/ap/ctrl_iface_ap.c | 19 ++++++-
+ src/ap/gas_serv.c | 29 ++++++++++
+ src/ap/gas_serv.h | 2 +
+ src/ap/neighbor_db.c | 119 +++++++++++++++++++++++++++++++++++++++++
+ src/ap/neighbor_db.h | 9 ++++
+ src/ap/wnm_ap.c | 72 +++++++++++++++++++++++--
+ 9 files changed, 252 insertions(+), 5 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index a258492..c2a2822 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1338,6 +1338,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
+ #endif /* CONFIG_DPP */
+ } else if (os_strcasecmp(cmd, "setband") == 0) {
+ ret = hostapd_ctrl_iface_set_band(hapd, value);
++ } else if (os_strcasecmp(cmd, "bss_termination_tsf") == 0) {
++ int termination_sec = atoi(value);
++ hapd->conf->bss_termination_tsf = termination_sec;
++ wpa_printf(MSG_DEBUG, "BSS Termination TSF: value = %d",
++ termination_sec);
+ } else {
+ ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
+ if (ret)
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index d7a0c7c..4a20eb4 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
+ /* comeback after 10 TUs */
+ bss->pasn_comeback_after = 10;
+ #endif /* CONFIG_PASN */
++ bss->bss_termination_tsf = 0;
+ }
+
+
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index ed3bec7..3f68e76 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -557,6 +557,7 @@ struct hostapd_bss_config {
+ int wnm_sleep_mode;
+ int wnm_sleep_mode_no_keys;
+ int bss_transition;
++ unsigned int bss_termination_tsf;
+
+ /* IEEE 802.11u - Interworking */
+ int interworking;
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index 96209ce..18bae5c 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1203,6 +1203,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ wpa_printf(MSG_DEBUG, "Invalid bss_term data");
+ return -1;
+ }
++ if (hapd->conf->bss_termination_tsf) {
++ WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
++ }
++
+ end++;
+ WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
+ }
+@@ -1229,14 +1233,25 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ req_mode |= WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT;
+ }
+
+- if (os_strstr(cmd, " pref=1"))
++ if (os_strstr(cmd, " pref=1")) {
+ req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
++ if (nei_len == 0) {
++ // Add neigibor report from neighbor report db to nei_rep buffer
++ nei_len = hostapd_neighbor_insert_buffer (hapd, nei_rep, 1000);
++ }
++ }
+ if (os_strstr(cmd, " abridged=1"))
+ req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
+- if (os_strstr(cmd, " disassoc_imminent=1"))
++ if (os_strstr(cmd, " disassoc_imminent=1")) {
+ req_mode |= WNM_BSS_TM_REQ_DISASSOC_IMMINENT;
++ /* Set own BSS neighbor report preference value as 0 */
++ hostapd_neighbor_set_own_report_pref(hapd, nei_rep, nei_len, 0);
++ }
++
+
+ #ifdef CONFIG_MBO
++ hostapd_neighbor_set_pref_by_non_pref_chan(hapd, sta, nei_rep, nei_len);
++
+ pos = os_strstr(cmd, "mbo=");
+ if (pos) {
+ unsigned int mbo_reason, cell_pref, reassoc_delay;
+diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
+index 90f1577..5845ff8 100644
+--- a/src/ap/gas_serv.c
++++ b/src/ap/gas_serv.c
+@@ -19,6 +19,7 @@
+ #include "dpp_hostapd.h"
+ #include "sta_info.h"
+ #include "gas_serv.h"
++#include "neighbor_db.h"
+
+
+ #ifdef CONFIG_DPP
+@@ -369,6 +370,24 @@ static void anqp_add_network_auth_type(struct hostapd_data *hapd,
+ }
+ }
+
++static void anqp_add_neighbor_report(struct hostapd_data *hapd,
++ struct wpabuf *buf)
++{
++ struct hostapd_neighbor_entry *nr;
++ u8 *len_pos = gas_anqp_add_element(buf, ANQP_NEIGHBOR_REPORT);
++ if (dl_list_empty(&hapd->nr_db)) {
++ wpabuf_put_le16(buf, 0);
++ }
++ else {
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry, list ) {
++ wpabuf_put_u8(buf, WLAN_EID_NEIGHBOR_REPORT);
++ wpabuf_put_u8(buf, wpabuf_len(nr->nr));
++ wpabuf_put_buf(buf, nr->nr);
++ }
++ }
++ gas_anqp_set_element_len(buf, len_pos);
++}
++
+
+ static void anqp_add_roaming_consortium(struct hostapd_data *hapd,
+ struct wpabuf *buf)
+@@ -986,6 +1005,9 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
+ len += 1000;
+ if (request & ANQP_REQ_ICON_REQUEST)
+ len += 65536;
++ if (request & ANQP_REQ_NEIGHBOR_REPORT) {
++ len += (40 * hostapd_neighbor_count(hapd));
++ }
+ #ifdef CONFIG_FILS
+ if (request & ANQP_FILS_REALM_INFO)
+ len += 2 * dl_list_len(&hapd->conf->fils_realms);
+@@ -1028,6 +1050,8 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
+ anqp_add_elem(hapd, buf, ANQP_TDLS_CAPABILITY);
+ if (request & ANQP_REQ_EMERGENCY_NAI)
+ anqp_add_elem(hapd, buf, ANQP_EMERGENCY_NAI);
++ if (request & ANQP_REQ_NEIGHBOR_REPORT)
++ anqp_add_neighbor_report(hapd, buf);
+
+ for (i = 0; i < num_extra_req; i++) {
+ #ifdef CONFIG_FILS
+@@ -1172,6 +1196,11 @@ static void rx_anqp_query_list_id(struct hostapd_data *hapd, u16 info_id,
+ "Emergency NAI",
+ get_anqp_elem(hapd, info_id) != NULL, qi);
+ break;
++ case ANQP_NEIGHBOR_REPORT:
++ set_anqp_req(ANQP_REQ_NEIGHBOR_REPORT,
++ "Neighbor Report",
++ get_anqp_elem(hapd, info_id) != NULL, qi);
++ break;
+ default:
+ #ifdef CONFIG_FILS
+ if (info_id == ANQP_FILS_REALM_INFO &&
+diff --git a/src/ap/gas_serv.h b/src/ap/gas_serv.h
+index 1528af4..d0241f2 100644
+--- a/src/ap/gas_serv.h
++++ b/src/ap/gas_serv.h
+@@ -40,6 +40,8 @@
+ (1 << (ANQP_TDLS_CAPABILITY - ANQP_QUERY_LIST))
+ #define ANQP_REQ_EMERGENCY_NAI \
+ (1 << (ANQP_EMERGENCY_NAI - ANQP_QUERY_LIST))
++#define ANQP_REQ_NEIGHBOR_REPORT \
++ (1 << (ANQP_NEIGHBOR_REPORT - ANQP_QUERY_LIST))
+ /*
+ * First 15 Hotspot 2.0 vendor specific ANQP-elements can be included in the
+ * optimized bitmap.
+diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
+index 52f25eb..9254d09 100644
+--- a/src/ap/neighbor_db.c
++++ b/src/ap/neighbor_db.c
+@@ -89,6 +89,38 @@ int hostapd_neighbor_show(struct hostapd_data *hapd, char *buf, size_t buflen)
+ }
+
+
++int hostapd_neighbor_count(struct hostapd_data *hapd)
++{
++ struct hostapd_neighbor_entry *nr;
++ int count = 0;
++
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++ list) {
++ count++;
++ }
++ return count;
++}
++
++
++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++ size_t buflen)
++{
++ struct hostapd_neighbor_entry *nr;
++ char *pos = buf;
++
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++ list) {
++ /* For neighbor report IE, we only need bssid and nr*/
++ *pos++ = WLAN_EID_NEIGHBOR_REPORT;
++ *pos++ = wpabuf_len(nr->nr);
++ os_memcpy(pos, wpabuf_head(nr->nr), wpabuf_len(nr->nr));
++ pos += wpabuf_len(nr->nr);
++ }
++
++ return pos - buf;
++}
++
++
+ static void hostapd_neighbor_clear_entry(struct hostapd_neighbor_entry *nr)
+ {
+ wpabuf_free(nr->nr);
+@@ -325,3 +357,90 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
+ wpabuf_free(nr);
+ #endif /* NEED_AP_MLME */
+ }
++
++
++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
++ size_t buflen, const int pref)
++{
++ struct hostapd_neighbor_entry *nr;
++ char *pos, *next_nr;
++
++ pos = nei_buf;
++ next_nr = nei_buf;
++
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++ list) {
++ pos = next_nr;
++ next_nr = pos + 2 + wpabuf_len(nr->nr);
++ /* Shift 2 bytes for Element ID and Neighbor report length */
++ pos = pos + 2;
++ if(os_memcmp(pos, hapd->own_addr, ETH_ALEN) == 0) {
++ /* Shift for BSSID + BSSID info + Op_class + channel num + PHY type */
++ pos = pos + 6 + 4 + 1 + 1 + 1;
++
++ /* Iterate Subelement */
++ while (next_nr - pos > 0) {
++ if (*pos == 3) {
++ pos = pos + 2;
++ *pos = pref;
++ return;
++ } else {
++ pos++;
++ int shift_len = *pos++;
++ pos = pos + shift_len;
++ }
++ }
++ }
++ }
++}
++
++#ifdef CONFIG_MBO
++void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
++ struct sta_info* sta, char *nei_buf, size_t buflen)
++{
++ struct hostapd_neighbor_entry *nr;
++ struct mbo_non_pref_chan_info *info;
++ u8 i;
++
++ for(info = sta->non_pref_chan; info; info = info->next) {
++ /* Check OP_Class and Channel num */
++ for(i = 0; i < info->num_channels; i++) {
++ char *pos, *next_nr;
++
++ pos = nei_buf;
++ next_nr = nei_buf;
++
++ /* Iterate Neighbor report database */
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++ list) {
++ pos = next_nr;
++ next_nr = pos + 2 + wpabuf_len(nr->nr);
++ /**
++ * Shift 12 bytes for Element ID, Neighbor report length,
++ * BSSID and BSSID info.
++ */
++ pos = pos + 12;
++ int nr_op_class = *pos++;
++ int nr_channel = *pos;
++ if(info->op_class == nr_op_class && info->channels[i] == nr_channel) {
++ /* Shift for Channel Num + PHY type */
++ pos = pos + 1 + 1;
++
++ // Iterate Subelement
++ while(next_nr - pos > 0) {
++ if(*pos == 3) {
++ pos = pos + 2;
++ *pos = info->pref;
++ break;
++ }else {
++ pos++;
++ int shift_len = *pos++;
++ pos = pos + shift_len;
++ }
++ }
++ }
++ }
++ }
++ }
++}
++#endif
+diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
+index 992671b..a1ddc07 100644
+--- a/src/ap/neighbor_db.h
++++ b/src/ap/neighbor_db.h
+@@ -24,4 +24,13 @@ int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid,
+ const struct wpa_ssid_value *ssid);
+ void hostapd_free_neighbor_db(struct hostapd_data *hapd);
+
++int hostapd_neighbor_count(struct hostapd_data *hapd);
++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++ size_t buflen);
++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
++ size_t buflen, const int pref);
++#ifdef CONFIG_MBO
++void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
++ struct sta_info* sta, char *nei_buf, size_t buflen);
++#endif
+ #endif /* NEIGHBOR_DB_H */
+diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
+index 3ea92af..4349e1d 100644
+--- a/src/ap/wnm_ap.c
++++ b/src/ap/wnm_ap.c
+@@ -20,6 +20,7 @@
+ #include "ap/wpa_auth.h"
+ #include "mbo_ap.h"
+ #include "wnm_ap.h"
++#include "ap/neighbor_db.h"
+
+ #define MAX_TFS_IE_LEN 1024
+
+@@ -370,9 +371,21 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
+ u8 *pos;
+ int res;
+
+- mgmt = os_zalloc(sizeof(*mgmt));
+- if (mgmt == NULL)
++ int nr_num = hostapd_neighbor_count(hapd);
++ int nr_size = ETH_ALEN + 4 + 1 + 1 + 1 + 5;
++ int total_nr_size = nr_num * nr_size;
++ u8 *nr_data = os_malloc(total_nr_size);
++ int nr_data_len = 0;
++ if(nr_data == NULL) {
++ wpa_printf (MSG_ERROR, "Failed to allocate memory");
++ } else {
++ nr_data_len = hostapd_neighbor_insert_buffer(hapd, nr_data, total_nr_size);
++ }
++ mgmt = os_zalloc(sizeof(*mgmt) + nr_data_len);
++ if (mgmt == NULL) {
++ wpa_printf (MSG_ERROR, "Failed to allocate memory for mgmt frame");
+ return -1;
++ }
+ os_memcpy(mgmt->da, addr, ETH_ALEN);
+ os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
+ os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
+@@ -382,10 +395,18 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
+ mgmt->u.action.u.bss_tm_req.action = WNM_BSS_TRANS_MGMT_REQ;
+ mgmt->u.action.u.bss_tm_req.dialog_token = dialog_token;
+ mgmt->u.action.u.bss_tm_req.req_mode = 0;
++ if(nr_num) {
++ mgmt->u.action.u.bss_tm_req.req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
++ }
+ mgmt->u.action.u.bss_tm_req.disassoc_timer = host_to_le16(0);
+ mgmt->u.action.u.bss_tm_req.validity_interval = 1;
+ pos = mgmt->u.action.u.bss_tm_req.variable;
+
++ if(nr_num) {
++ os_memcpy(pos, nr_data, nr_data_len);
++ pos += nr_data_len;
++ }
++
+ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
+ MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
+@@ -759,6 +780,50 @@ static void set_disassoc_timer(struct hostapd_data *hapd, struct sta_info *sta,
+ }
+
+
++static void set_send_disassoc_frame_timer(struct hostapd_data *hapd, struct sta_info *sta,
++ int disassoc_timer)
++{
++ int timeout, beacon_int;
++
++ /*
++ * Prevent STA from reconnecting using cached PMKSA to force
++ * full authentication with the authentication server (which may
++ * decide to reject the connection),
++ */
++ wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
++
++ beacon_int = hapd->iconf->beacon_int;
++ if (beacon_int < 1)
++ beacon_int = 100; /* best guess */
++ /* Calculate timeout in ms based on beacon_int in TU */
++ timeout = disassoc_timer * beacon_int * 128 / 125;
++ wpa_printf(MSG_DEBUG, "Disassociation timer for " MACSTR
++ " set to %d ms", MAC2STR(sta->addr), timeout);
++
++ u16 reason = WLAN_REASON_PREV_AUTH_NOT_VALID;
++
++ hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
++ if (sta)
++ ap_sta_disassociate(hapd, sta, reason);
++}
++
++
++void bss_termination_disable_iface(void *eloop_ctx, void *timeout_ctx)
++{
++ struct hostapd_data *hapd = eloop_ctx;
++ hostapd_disable_iface(hapd->iface);
++}
++
++
++static void set_disable_iface_timer(struct hostapd_data *hapd, struct sta_info *sta,
++ int disable_iface_timer)
++{
++ wpa_printf(MSG_DEBUG, "Disable interface timer set to %d secs", disable_iface_timer);
++ eloop_register_timeout(disable_iface_timer, 0,
++ bss_termination_disable_iface, hapd, NULL);
++}
++
++
+ int wnm_send_ess_disassoc_imminent(struct hostapd_data *hapd,
+ struct sta_info *sta, const char *url,
+ int disassoc_timer)
+@@ -848,6 +913,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
+ bss_term_dur) {
+ os_memcpy(pos, bss_term_dur, 12);
+ pos += 12;
++ set_disable_iface_timer(hapd, sta, hapd->conf->bss_termination_tsf);
+ }
+
+ if (url) {
+@@ -884,7 +950,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
+ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ if (disassoc_timer) {
+ /* send disassociation frame after time-out */
+- set_disassoc_timer(hapd, sta, disassoc_timer);
++ set_send_disassoc_frame_timer(hapd, sta, disassoc_timer);
+ }
+
+ return 0;
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
new file mode 100644
index 0000000..3c5137d
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
@@ -0,0 +1,36 @@
+From 6d95c027c13fba5404fa8d096d55b4a072b2ec59 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 20 Sep 2022 19:33:45 +0800
+Subject: [PATCH 99901/99910] hostapd: mtk: print sae groups by hostapd ctrl
+
+---
+ hostapd/ctrl_iface.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index c2a2822..bc690c5 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1412,6 +1412,19 @@ static int hostapd_ctrl_iface_get(struct hostapd_data *hapd, char *cmd,
+ if (os_snprintf_error(buflen, res))
+ return -1;
+ return res;
++ } else if (os_strcmp(cmd, "sae_group_capability") == 0) {
++#ifdef CONFIG_SAE
++ /* see sae_set_group() */
++ res = os_snprintf(buf, buflen, "%s%s%s%s19 20 21",
++ dh_groups_get(15) ? "15 ": "",
++ dh_groups_get(16) ? "16 ": "",
++ dh_groups_get(17) ? "17 ": "",
++ dh_groups_get(18) ? "18 ": "");
++
++ if (os_snprintf_error(buflen, res))
++ return -1;
++ return res;
++#endif /* CONFIG_SAE */
+ }
+
+ return -1;
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
new file mode 100644
index 0000000..885c6c9
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
@@ -0,0 +1,211 @@
+From 7a84545afb1f5bc2784eb5a046d56d869fb52067 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Tue, 31 May 2022 21:15:54 +0800
+Subject: [PATCH 99902/99910] hostapd: mtk: add support for runtime set in-band
+ discovery
+
+Usage:
+hostapd_cli unsolic_probe_resp [tx_type] [interval]
+
+0: disable all in-band discovery
+1: enable unsolicited probe response
+2: enable FILS discovery
+
+Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+---
+ hostapd/ctrl_iface.c | 66 ++++++++++++++++++++++++++++++++++++
+ hostapd/hostapd_cli.c | 20 +++++++++++
+ src/ap/beacon.c | 5 ++-
+ src/drivers/driver_nl80211.c | 10 ++++--
+ src/drivers/nl80211_copy.h | 1 +
+ 5 files changed, 98 insertions(+), 4 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index bc690c5..bb8c74f 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -826,6 +826,69 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
+
+ #endif /* CONFIG_INTERWORKING */
+
++static int hostapd_ctrl_iface_inband_discovery(struct hostapd_data *hapd,
++ const char *cmd)
++{
++ struct hostapd_bss_config *conf = hapd->conf;
++ const char *pos = cmd;
++ int tx_type, interval, ret;
++
++ tx_type = atoi(pos);
++ if (tx_type < 0 || tx_type > 2) {
++ wpa_printf(MSG_ERROR, "Invalid tx type\n");
++ return -1;
++ }
++
++ pos = os_strchr(pos, ' ');
++ if(!pos)
++ return -1;
++ pos++;
++ interval = atoi(pos);
++ if (interval < 0 || interval > 20) {
++ wpa_printf(MSG_ERROR, "Invalid interval value\n");
++ return -1;
++ }
++
++ wpa_printf(MSG_ERROR, "Set inband discovery type:%d, interval:%d\n",
++ tx_type, interval);
++
++#define DISABLE_INBAND_DISC 0
++#define UNSOL_PROBE_RESP 1
++#define FILS_DISCOVERY 2
++
++#ifdef CONFIG_FILS
++ conf->fils_discovery_max_int = 0;
++ conf->fils_discovery_min_int = 0;
++#endif /* CONFIG_FILS */
++ conf->unsol_bcast_probe_resp_interval = 0;
++
++ switch (tx_type) {
++ case DISABLE_INBAND_DISC:
++ default:
++ /* Disable both Unsolicited probe response and FILS discovery*/
++ break;
++ case UNSOL_PROBE_RESP:
++ /* Enable Unsolicited probe response */
++ conf->unsol_bcast_probe_resp_interval = interval;
++ break;
++#ifdef CONFIG_FILS
++ case FILS_DISCOVERY:
++ /* Enable FILS discovery */
++ conf->fils_discovery_min_int = interval;
++ conf->fils_discovery_max_int = interval;
++ break;
++#endif /* CONFIG_FILS */
++ }
++
++ ret = ieee802_11_update_beacons(hapd->iface);
++ if(ret) {
++ wpa_printf(MSG_DEBUG,
++ "Failed to update with inband discovery parameters\n");
++ return -1;
++ }
++
++ return 0;
++}
+
+ #ifdef CONFIG_WNM_AP
+
+@@ -3434,6 +3497,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ if (hostapd_ctrl_iface_coloc_intf_req(hapd, buf + 15))
+ reply_len = -1;
+ #endif /* CONFIG_WNM_AP */
++ } else if (os_strncmp(buf, "INBAND_DISCOVERY ", 17) == 0) {
++ if (hostapd_ctrl_iface_inband_discovery(hapd, buf + 17))
++ reply_len = -1;
+ } else if (os_strcmp(buf, "GET_CONFIG") == 0) {
+ reply_len = hostapd_ctrl_iface_get_config(hapd, reply,
+ reply_size);
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index 85c41d0..db21258 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -642,6 +642,24 @@ static int hostapd_cli_cmd_wps_config(struct wpa_ctrl *ctrl, int argc,
+ return wpa_ctrl_command(ctrl, buf);
+ }
+
++static int hostapd_cli_cmd_inband_discovery(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ char buf[300];
++ int res;
++
++ if (argc < 2) {
++ printf("Invalid 'inband_discovery' command - two arguments"
++ "tx_type interval\n");
++ return -1;
++ }
++
++ res = os_snprintf(buf, sizeof(buf), "INBAND_DISCOVERY %s %s",
++ argv[0], argv[1]);
++ if (os_snprintf_error(sizeof(buf), res))
++ return -1;
++ return wpa_ctrl_command(ctrl, buf);
++}
+
+ static int hostapd_cli_cmd_disassoc_imminent(struct wpa_ctrl *ctrl, int argc,
+ char *argv[])
+@@ -1749,6 +1767,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ { "driver", hostapd_cli_cmd_driver, NULL,
+ "<driver sub command> [<hex formatted data>] = send driver command data" },
+ #endif /* ANDROID */
++ { "inband_discovery", hostapd_cli_cmd_inband_discovery, NULL,
++ "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
+ { NULL, NULL, NULL, NULL }
+ };
+
+diff --git a/src/ap/beacon.c b/src/ap/beacon.c
+index 814e86e..1a26f11 100644
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1497,6 +1497,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+ struct wpa_driver_ap_params *params)
+ {
+ params->fd_max_int = hapd->conf->fils_discovery_max_int;
++ params->unsol_bcast_probe_resp_interval =
++ hapd->conf->unsol_bcast_probe_resp_interval;
+ if (is_6ghz_op_class(hapd->iconf->op_class) &&
+ params->fd_max_int > FD_MAX_INTERVAL_6GHZ)
+ params->fd_max_int = FD_MAX_INTERVAL_6GHZ;
+@@ -1505,7 +1507,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+ if (params->fd_min_int > params->fd_max_int)
+ params->fd_min_int = params->fd_max_int;
+
+- if (params->fd_max_int)
++ if (params->fd_max_int || (is_6ghz_op_class(hapd->iconf->op_class) &&
++ !params->unsol_bcast_probe_resp_interval))
+ return hostapd_gen_fils_discovery(hapd,
+ ¶ms->fd_frame_tmpl_len);
+
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 53f2503..5eba0ea 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -4498,9 +4498,10 @@ static int nl80211_fils_discovery(struct i802_bss *bss, struct nl_msg *msg,
+ params->fd_max_int) ||
+ (params->fd_frame_tmpl &&
+ nla_put(msg, NL80211_FILS_DISCOVERY_ATTR_TMPL,
+- params->fd_frame_tmpl_len, params->fd_frame_tmpl)))
++ params->fd_frame_tmpl_len, params->fd_frame_tmpl)) ||
++ nla_put_u32(msg, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE,
++ params->unsol_bcast_probe_resp_interval))
+ return -1;
+-
+ nla_nest_end(msg, attr);
+ return 0;
+ }
+@@ -4844,7 +4845,10 @@ static int wpa_driver_nl80211_set_ap(void *priv,
+ #endif /* CONFIG_SAE */
+
+ #ifdef CONFIG_FILS
+- if (params->fd_max_int && nl80211_fils_discovery(bss, msg, params) < 0)
++ if ((params->fd_max_int ||
++ ((params->freq->freq > 5950 && params->freq->freq <= 7115) &&
++ !(params->unsol_bcast_probe_resp_interval))) &&
++ nl80211_fils_discovery(bss, msg, params) < 0)
+ goto fail;
+ #endif /* CONFIG_FILS */
+
+diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
+index 0568a79..c4bf3ad 100644
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -7379,6 +7379,7 @@ enum nl80211_fils_discovery_attributes {
+ NL80211_FILS_DISCOVERY_ATTR_INT_MIN,
+ NL80211_FILS_DISCOVERY_ATTR_INT_MAX,
+ NL80211_FILS_DISCOVERY_ATTR_TMPL,
++ NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE,
+
+ /* keep last */
+ __NL80211_FILS_DISCOVERY_ATTR_LAST,
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99903-hostapd-mtk-Add-mtk_vendor.h.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99903-hostapd-mtk-Add-mtk_vendor.h.patch
new file mode 100644
index 0000000..d108ca3
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99903-hostapd-mtk-Add-mtk_vendor.h.patch
@@ -0,0 +1,214 @@
+From 8694400211d08019e4c495fc98ca3e3783465044 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Mon, 30 May 2022 15:04:57 +0800
+Subject: [PATCH 99903/99910] hostapd: mtk: Add mtk_vendor.h
+
+---
+ src/common/mtk_vendor.h | 195 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 195 insertions(+)
+ create mode 100644 src/common/mtk_vendor.h
+
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+new file mode 100644
+index 0000000..528387f
+--- /dev/null
++++ b/src/common/mtk_vendor.h
+@@ -0,0 +1,195 @@
++// SPDX-License-Identifier: ISC
++/* Copyright (C) 2020 Felix Fietkau <nbd@nbd.name> */
++#ifndef MTK_VENDOR_H
++#define MTK_VENDOR_H
++
++#define OUI_MTK 0x000ce7
++
++enum mtk_nl80211_vendor_subcmds {
++ MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
++ MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
++ MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
++ MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++};
++
++enum mtk_vendor_attr_edcca_ctrl {
++ MTK_VENDOR_ATTR_EDCCA_THRESHOLD_INVALID = 0,
++
++ MTK_VENDOR_ATTR_EDCCA_CTRL_MODE,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
++};
++
++enum mtk_vendor_attr_edcca_ctrl_mode {
++ EDCCA_CTRL_SET_EN = 0,
++ EDCCA_CTRL_SET_THERS,
++ EDCCA_CTRL_GET_EN,
++ EDCCA_CTRL_GET_THERS,
++ EDCCA_CTRL_NUM,
++};
++
++static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_U8 },
++};
++
++enum mtk_vendor_attr_csi_ctrl {
++ MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2,
++ MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR,
++ MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL,
++
++ MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM,
++
++ MTK_VENDOR_ATTR_CSI_CTRL_DATA,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_CSI_CTRL,
++ MTK_VENDOR_ATTR_CSI_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_CSI_CTRL - 1
++};
++
++enum mtk_vendor_attr_csi_data {
++ MTK_VENDOR_ATTR_CSI_DATA_UNSPEC,
++ MTK_VENDOR_ATTR_CSI_DATA_PAD,
++
++ MTK_VENDOR_ATTR_CSI_DATA_VER,
++ MTK_VENDOR_ATTR_CSI_DATA_TS,
++ MTK_VENDOR_ATTR_CSI_DATA_RSSI,
++ MTK_VENDOR_ATTR_CSI_DATA_SNR,
++ MTK_VENDOR_ATTR_CSI_DATA_BW,
++ MTK_VENDOR_ATTR_CSI_DATA_CH_IDX,
++ MTK_VENDOR_ATTR_CSI_DATA_TA,
++ MTK_VENDOR_ATTR_CSI_DATA_I,
++ MTK_VENDOR_ATTR_CSI_DATA_Q,
++ MTK_VENDOR_ATTR_CSI_DATA_INFO,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD1,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD2,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD3,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD4,
++ MTK_VENDOR_ATTR_CSI_DATA_TX_ANT,
++ MTK_VENDOR_ATTR_CSI_DATA_RX_ANT,
++ MTK_VENDOR_ATTR_CSI_DATA_MODE,
++ MTK_VENDOR_ATTR_CSI_DATA_H_IDX,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_CSI_DATA,
++ MTK_VENDOR_ATTR_CSI_DATA_MAX =
++ NUM_MTK_VENDOR_ATTRS_CSI_DATA - 1
++};
++
++enum mtk_vendor_attr_mnt_ctrl {
++ MTK_VENDOR_ATTR_AMNT_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_AMNT_CTRL_SET,
++ MTK_VENDOR_ATTR_AMNT_CTRL_DUMP,
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_AMNT_CTRL,
++ MTK_VENDOR_ATTR_AMNT_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_AMNT_CTRL - 1
++};
++
++enum mtk_vendor_attr_mnt_set {
++ MTK_VENDOR_ATTR_AMNT_SET_UNSPEC,
++
++ MTK_VENDOR_ATTR_AMNT_SET_INDEX,
++ MTK_VENDOR_ATTR_AMNT_SET_MACADDR,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_AMNT_SET,
++ MTK_VENDOR_ATTR_AMNT_SET_MAX =
++ NUM_MTK_VENDOR_ATTRS_AMNT_SET - 1
++};
++
++enum mtk_vendor_attr_mnt_dump {
++ MTK_VENDOR_ATTR_AMNT_DUMP_UNSPEC,
++
++ MTK_VENDOR_ATTR_AMNT_DUMP_INDEX,
++ MTK_VENDOR_ATTR_AMNT_DUMP_LEN,
++ MTK_VENDOR_ATTR_AMNT_DUMP_RESULT,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_AMNT_DUMP,
++ MTK_VENDOR_ATTR_AMNT_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_AMNT_DUMP - 1
++};
++
++enum mtk_vendor_attr_wireless_ctrl {
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_OFDMA,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
++};
++
++enum mtk_vendor_attr_rfeature_ctrl {
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_EN,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
++};
++
++#define CSI_MAX_COUNT 256
++#define ETH_ALEN 6
++
++struct csi_data {
++ s16 data_i[CSI_MAX_COUNT];
++ s16 data_q[CSI_MAX_COUNT];
++ s8 rssi;
++ u8 snr;
++ u32 ts;
++ u8 data_bw;
++ u8 pri_ch_idx;
++ u8 ta[ETH_ALEN];
++ u32 info;
++ u8 rx_mode;
++ u32 h_idx;
++ u16 tx_idx;
++ u16 rx_idx;
++};
++
++struct amnt_data {
++ u8 idx;
++ u8 addr[ETH_ALEN];
++ s8 rssi[4];
++ u32 last_seen;
++};
++#endif /* MTK_VENDOR_H */
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
new file mode 100644
index 0000000..e9bb053
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
@@ -0,0 +1,619 @@
+From d3d5b514064036fb17729743fa13e25646f468e9 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Mon, 30 May 2022 16:31:34 +0800
+Subject: [PATCH 99904/99910] hostapd: mtk: Support EDCCA hostapd configuration
+
+edcca_enable and edcca_compensation and implement edcca related handlers.
+---
+ hostapd/config_file.c | 32 ++++++
+ hostapd/ctrl_iface.c | 125 ++++++++++++++++++++++
+ src/ap/ap_config.c | 4 +
+ src/ap/ap_config.h | 29 ++++++
+ src/ap/ap_drv_ops.c | 24 +++++
+ src/ap/ap_drv_ops.h | 5 +-
+ src/ap/hostapd.c | 7 ++
+ src/common/mtk_vendor.h | 19 ++--
+ src/drivers/driver.h | 4 +
+ src/drivers/driver_nl80211.c | 165 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 7 ++
+ 12 files changed, 415 insertions(+), 7 deletions(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index eda9db0..0ee8952 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4753,6 +4753,38 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ } else if (os_strcmp(buf, "eht_mu_beamformer") == 0) {
+ conf->eht_phy_capab.mu_beamformer = atoi(pos);
+ #endif /* CONFIG_IEEE80211BE */
++ } else if (os_strcmp(buf, "edcca_threshold") == 0) {
++ if (hostapd_parse_intlist(&conf->edcca_threshold, pos) ||
++ conf->edcca_threshold[0] < EDCCA_MIN_CONFIG_THRES ||
++ conf->edcca_threshold[0] > EDCCA_MAX_CONFIG_THRES ||
++ conf->edcca_threshold[1] < EDCCA_MIN_CONFIG_THRES ||
++ conf->edcca_threshold[1] > EDCCA_MAX_CONFIG_THRES ||
++ conf->edcca_threshold[2] < EDCCA_MIN_CONFIG_THRES ||
++ conf->edcca_threshold[2] > EDCCA_MAX_CONFIG_THRES) {
++ wpa_printf(MSG_ERROR, "Line %d: invalid edcca threshold",
++ line);
++ return 1;
++ }
++ } else if (os_strcmp(buf, "edcca_enable") == 0) {
++ int mode = atoi(pos);
++ if (mode < EDCCA_MODE_FORCE_DISABLE || mode > EDCCA_MODE_AUTO) {
++ wpa_printf(MSG_ERROR, "Line %d: Invalid edcca_enable %d;"
++ " allowed value 0 (Force Disable) or 1(Auto) ",
++ line, mode);
++ return 1;
++ }
++ conf->edcca_enable = (u8) mode;
++ } else if (os_strcmp(buf, "edcca_compensation") == 0) {
++ int val = atoi(pos);
++ if (val < EDCCA_MIN_COMPENSATION ||
++ val > EDCCA_MAX_COMPENSATION) {
++ wpa_printf(MSG_ERROR, "Line %d: Invalid compensation"
++ " value %d; allowed value %d ~ %d.",
++ line, val, EDCCA_MIN_COMPENSATION,
++ EDCCA_MAX_COMPENSATION);
++ return 1;
++ }
++ conf->edcca_compensation = (s8) val;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index bb8c74f..9c70d54 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -598,6 +598,19 @@ static const char * pbc_status_str(enum pbc_status status)
+ }
+
+
++static const char * edcca_mode_str(enum edcca_mode status)
++{
++ switch (status) {
++ case EDCCA_MODE_FORCE_DISABLE:
++ return "Force Disable";
++ case EDCCA_MODE_AUTO:
++ return "Auto";
++ default:
++ return "Unknown";
++ }
++}
++
++
+ static int hostapd_ctrl_iface_wps_get_status(struct hostapd_data *hapd,
+ char *buf, size_t buflen)
+ {
+@@ -3322,6 +3335,112 @@ static int hostapd_ctrl_iface_driver_cmd(struct hostapd_data *hapd, char *cmd,
+ #endif /* ANDROID */
+
+
++static int
++hostapd_ctrl_iface_set_edcca(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ char *pos, *config, *value;
++ config = cmd;
++ pos = os_strchr(config, ' ');
++ if (pos == NULL)
++ return -1;
++ *pos++ = '\0';
++
++ if(pos == NULL)
++ return -1;
++ value = pos;
++
++ if (os_strcmp(config, "enable") == 0) {
++ int mode = atoi(value);
++ if (mode < EDCCA_MODE_FORCE_DISABLE || mode > EDCCA_MODE_AUTO) {
++ wpa_printf(MSG_ERROR, "Invalid value for edcca enable");
++ return -1;
++ }
++ hapd->iconf->edcca_enable = (u8) mode;
++ if (hostapd_drv_configure_edcca_enable(hapd) != 0)
++ return -1;
++ } else if (os_strcmp(config, "compensation") == 0) {
++ int compensation = atoi(value);
++ if (compensation < EDCCA_MIN_COMPENSATION ||
++ compensation > EDCCA_MAX_COMPENSATION) {
++ wpa_printf(MSG_ERROR, "Invalid value for edcca compensation");
++ return -1;
++ }
++ hapd->iconf->edcca_compensation = (s8) compensation;
++ if (hostapd_drv_configure_edcca_enable(hapd) != 0)
++ return -1;
++ } else if (os_strcmp(config, "threshold") == 0) {
++ char *thres_value;
++ thres_value = os_strchr(value, ':');
++ if (thres_value == NULL)
++ return -1;
++ *thres_value++ = '\0';
++
++ if(thres_value == NULL)
++ return -1;
++ int bw_idx= atoi(value);
++ int threshold = atoi(thres_value);
++
++ if (bw_idx < EDCCA_BW_20 || bw_idx > EDCCA_BW_80) {
++ wpa_printf(MSG_ERROR,
++ "Unsupported Bandwidth idx %d for SET_EDCCA",
++ bw_idx);
++ return -1;
++ }
++ if (threshold < EDCCA_MIN_CONFIG_THRES ||
++ threshold > EDCCA_MAX_CONFIG_THRES) {
++ wpa_printf(MSG_ERROR,
++ "Unsupported threshold %d for SET_EDCCA",
++ threshold);
++ return -1;
++ }
++
++ int threshold_arr[EDCCA_MAX_BW_NUM];
++ /* 0x7f means keep the origival value in firmware */
++ os_memset(threshold_arr, 0x7f, sizeof(threshold_arr));
++ threshold_arr[bw_idx] = threshold;
++
++ if (hostapd_drv_configure_edcca_threshold(hapd, threshold_arr) != 0)
++ return -1;
++ } else {
++ wpa_printf(MSG_ERROR,
++ "Unsupported parameter %s for SET_EDCCA", config);
++ return -1;
++ }
++ return os_snprintf(buf, buflen, "OK\n");
++}
++
++
++static int
++hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
++ size_t buflen)
++{
++ char *pos, *end;
++
++ pos = buf;
++ end = buf + buflen;
++ u8 value[EDCCA_MAX_BW_NUM] = {0};
++
++ if (os_strcmp(cmd, "enable") == 0) {
++ return os_snprintf(pos, end - pos, "Enable: %s\n",
++ edcca_mode_str(hapd->iconf->edcca_enable));
++ } else if (os_strcmp(cmd, "compensation") == 0) {
++ return os_snprintf(pos, end - pos, "Compensation: %d\n",
++ hapd->iconf->edcca_compensation);
++ } else if (os_strcmp(cmd, "threshold") == 0) {
++ if (hostapd_drv_get_edcca(hapd, EDCCA_CTRL_GET_THRES, &value) != 0)
++ return -1;
++ return os_snprintf(pos, end - pos,
++ "Threshold BW20: 0x%x, BW40: 0x%x, BW80: 0x%x\n",
++ value[0], value[1], value[2]);
++ } else {
++ wpa_printf(MSG_ERROR,
++ "Unsupported parameter %s for GET_EDCCA", cmd);
++ return -1;
++ }
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -3868,6 +3987,12 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply_len = hostapd_ctrl_iface_driver_cmd(hapd, buf + 7, reply,
+ reply_size);
+ #endif /* ANDROID */
++ } else if (os_strncmp(buf, "SET_EDCCA ", 10) == 0) {
++ reply_len = hostapd_ctrl_iface_set_edcca(hapd, buf+10, reply,
++ reply_size);
++ } else if (os_strncmp(buf, "GET_EDCCA ", 10) == 0) {
++ reply_len = hostapd_ctrl_iface_get_edcca(hapd, buf+10, reply,
++ reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 4a20eb4..344585a 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -294,6 +294,9 @@ struct hostapd_config * hostapd_config_defaults(void)
+ conf->airtime_update_interval = AIRTIME_DEFAULT_UPDATE_INTERVAL;
+ #endif /* CONFIG_AIRTIME_POLICY */
+
++ conf->edcca_enable = EDCCA_MODE_AUTO;
++ conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
++
+ return conf;
+ }
+
+@@ -1007,6 +1010,7 @@ void hostapd_config_free(struct hostapd_config *conf)
+ #ifdef CONFIG_ACS
+ os_free(conf->acs_chan_bias);
+ #endif /* CONFIG_ACS */
++ os_free(conf->edcca_threshold);
+ wpabuf_free(conf->lci);
+ wpabuf_free(conf->civic);
+
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 3f68e76..775c567 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1153,8 +1153,37 @@ struct hostapd_config {
+ #define CH_SWITCH_EHT_ENABLED BIT(0)
+ #define CH_SWITCH_EHT_DISABLED BIT(1)
+ unsigned int ch_switch_eht_config;
++ u8 edcca_enable;
++ s8 edcca_compensation;
++ int *edcca_threshold;
+ };
+
++enum edcca_mode {
++ EDCCA_MODE_FORCE_DISABLE = 0,
++ EDCCA_MODE_AUTO = 1,
++};
++
++enum edcca_bw_id {
++ EDCCA_BW_20 = 0,
++ EDCCA_BW_40,
++ EDCCA_BW_80,
++ EDCCA_MAX_BW_NUM,
++};
++
++enum mtk_vendor_attr_edcca_ctrl_mode {
++ EDCCA_CTRL_SET_EN = 0,
++ EDCCA_CTRL_SET_THRES,
++ EDCCA_CTRL_GET_EN,
++ EDCCA_CTRL_GET_THRES,
++ EDCCA_CTRL_NUM,
++};
++
++#define EDCCA_DEFAULT_COMPENSATION -6
++#define EDCCA_MIN_COMPENSATION -126
++#define EDCCA_MAX_COMPENSATION 126
++#define EDCCA_MIN_CONFIG_THRES -126
++#define EDCCA_MAX_CONFIG_THRES 0
++
+
+ static inline enum oper_chan_width
+ hostapd_get_oper_chwidth(struct hostapd_config *conf)
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 0c7aee2..25e967d 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1015,3 +1015,27 @@ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable)
+ return 0;
+ return hapd->driver->dpp_listen(hapd->drv_priv, enable);
+ }
++
++int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->configure_edcca_enable)
++ return 0;
++ return hapd->driver->configure_edcca_enable(hapd->drv_priv,
++ hapd->iconf->edcca_enable,
++ hapd->iconf->edcca_compensation);
++}
++
++int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
++ const int *threshold)
++{
++ if (!hapd->driver || !hapd->driver->configure_edcca_threshold)
++ return 0;
++ return hapd->driver->configure_edcca_threshold(hapd->drv_priv, threshold);
++}
++
++int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
++{
++ if (!hapd->driver || !hapd->driver->get_edcca)
++ return 0;
++ return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index b4fb766..70a99f4 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -138,7 +138,10 @@ int hostapd_drv_do_acs(struct hostapd_data *hapd);
+ int hostapd_drv_update_dh_ie(struct hostapd_data *hapd, const u8 *peer,
+ u16 reason_code, const u8 *ie, size_t ielen);
+ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable);
+-
++int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
++int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
++ const int *threshold);
++int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 0dd8c13..d05f948 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2295,6 +2295,13 @@ dfs_offload:
+ }
+ #endif /* CONFIG_MESH */
+
++ if (hostapd_drv_configure_edcca_enable(hapd) < 0)
++ goto fail;
++
++ if (hostapd_drv_configure_edcca_threshold(hapd,
++ hapd->iconf->edcca_threshold) < 0)
++ goto fail;
++
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+ if (iface->interfaces && iface->interfaces->terminate_on_error > 0)
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 528387f..7056126 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -29,14 +29,21 @@ enum mtk_vendor_attr_edcca_ctrl {
+ NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
+ };
+
+-enum mtk_vendor_attr_edcca_ctrl_mode {
+- EDCCA_CTRL_SET_EN = 0,
+- EDCCA_CTRL_SET_THERS,
+- EDCCA_CTRL_GET_EN,
+- EDCCA_CTRL_GET_THERS,
+- EDCCA_CTRL_NUM,
++enum mtk_vendor_attr_edcca_dump {
++ MTK_VENDOR_ATTR_EDCCA_DUMP_UNSPEC = 0,
++
++ MTK_VENDOR_ATTR_EDCCA_DUMP_MODE,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP - 1
+ };
+
++
+ static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
+ [MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
+ [MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 1d2b1b2..3559974 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4676,6 +4676,10 @@ struct wpa_driver_ops {
+ const u8 *match, size_t match_len,
+ bool multicast);
+ #endif /* CONFIG_TESTING_OPTIONS */
++ int (*configure_edcca_enable)(void *priv, const u8 edcca_enable,
++ const s8 edcca_compensation);
++ int (*configure_edcca_threshold)(void *priv, const int *threshold);
++ int (*get_edcca)(void *priv, const u8 mode, u8 *value);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 5eba0ea..9c2782c 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -35,6 +35,8 @@
+ #include "radiotap_iter.h"
+ #include "rfkill.h"
+ #include "driver_nl80211.h"
++#include "common/mtk_vendor.h"
++#include "ap/ap_config.h"
+
+
+ #ifndef NETLINK_CAP_ACK
+@@ -12368,6 +12370,165 @@ static int testing_nl80211_radio_disable(void *priv, int disabled)
+
+ #endif /* CONFIG_TESTING_OPTIONS */
+
++static int nl80211_configure_edcca_enable(void *priv,
++ const u8 edcca_enable,
++ const s8 edcca_compensation)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_edcca_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting EDCCA enable");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, EDCCA_CTRL_SET_EN) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL, edcca_enable) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
++ edcca_compensation)) {
++ wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to configure EDCCA enable. ret=%d (%s) ",
++ ret, strerror(-ret));
++ }
++ return ret;
++}
++
++static int nl80211_configure_edcca_threshold(void *priv, const int *threshold)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_edcca_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting EDCCA threshold");
++ return 0;
++ }
++
++ if (!threshold) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Input EDCCA threshold is empty!");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, EDCCA_CTRL_SET_THRES) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL, threshold[0] & 0xff) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL, threshold[1] & 0xff) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL, threshold[2] & 0xff)) {
++ wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to configure EDCCA threshold. ret=%d (%s) ",
++ ret, strerror(-ret));
++ }
++ return ret;
++}
++
++
++static int edcca_info_handler(struct nl_msg *msg, void *arg)
++{
++ u8 *info = (u8*) arg;
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_MAX + 1];
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct nlattr *nl_vend, *attr;
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!nl_vend)
++ return NL_SKIP;
++
++ nla_parse(tb_vendor, MTK_VENDOR_ATTR_EDCCA_DUMP_MAX,
++ nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL");
++ return NL_SKIP;
++ }
++
++ *info++ = nla_get_u8(attr);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL");
++ return NL_SKIP;
++ }
++
++ *info++ = nla_get_u8(attr);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL");
++ return NL_SKIP;
++ }
++
++ *info = nla_get_u8(attr);
++ return NL_SKIP;
++}
++
++
++static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_edcca_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting EDCCA threshold");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, mode)) {
++ wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, edcca_info_handler, value, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to get EDCCA configuration. ret=%d (%s)",
++ ret, strerror(-ret));
++ }
++ return ret;
++}
++
+
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+@@ -12514,4 +12675,8 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .register_frame = testing_nl80211_register_frame,
+ .radio_disable = testing_nl80211_radio_disable,
+ #endif /* CONFIG_TESTING_OPTIONS */
++/* Need ifdef CONFIG_DRIVER_NL80211_MTK */
++ .configure_edcca_enable = nl80211_configure_edcca_enable,
++ .configure_edcca_threshold = nl80211_configure_edcca_threshold,
++ .get_edcca = nl80211_get_edcca,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 6e40d55..13e5d24 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -181,6 +181,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int qca_do_acs:1;
+ unsigned int brcm_do_acs:1;
+ unsigned int uses_6ghz:1;
++ unsigned int mtk_edcca_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 7ede0d0..732ae29 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -18,6 +18,7 @@
+ #include "common/qca-vendor-attr.h"
+ #include "common/brcm_vendor.h"
+ #include "driver_nl80211.h"
++#include "common/mtk_vendor.h"
+
+
+ static int protocol_feature_handler(struct nl_msg *msg, void *arg)
+@@ -1050,6 +1051,12 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ break;
+ }
+ #endif /* CONFIG_DRIVER_NL80211_BRCM */
++ } else if (vinfo->vendor_id == OUI_MTK) {
++ switch (vinfo->subcmd) {
++ case MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL :
++ drv->mtk_edcca_vendor_cmd_avail = 1;
++ break;
++ }
+ }
+
+ wpa_printf(MSG_DEBUG, "nl80211: Supported vendor command: vendor_id=0x%x subcmd=%u",
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
new file mode 100644
index 0000000..1a622f3
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
@@ -0,0 +1,450 @@
+From 893c5f92257a7313a179dc728ba51a74efbfc74a Mon Sep 17 00:00:00 2001
+From: TomLiu <tomml.liu@mediatek.com>
+Date: Tue, 9 Aug 2022 10:23:44 -0700
+Subject: [PATCH 99905/99910] hostapd: mtk: Add hostapd HEMU SET/GET control
+
+---
+ hostapd/config_file.c | 9 +++
+ hostapd/ctrl_iface.c | 62 +++++++++++++++++
+ hostapd/hostapd_cli.c | 18 +++++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 1 +
+ src/ap/ap_drv_ops.c | 14 ++++
+ src/ap/ap_drv_ops.h | 2 +
+ src/ap/hostapd.c | 2 +
+ src/common/mtk_vendor.h | 15 ++++
+ src/drivers/driver.h | 13 ++++
+ src/drivers/driver_nl80211.c | 110 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 3 +
+ 13 files changed, 251 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 0ee8952..b22d10b 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3659,6 +3659,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ return 1;
+ }
+ bss->unsol_bcast_probe_resp_interval = val;
++ } else if (os_strcmp(buf, "hemu_onoff") == 0) {
++ int val = atoi(pos);
++ if (val < 0 || val > 15) {
++ wpa_printf(MSG_ERROR,
++ "Line %d: invalid hemu_onoff value",
++ line);
++ return 1;
++ }
++ conf->hemu_onoff = val;
+ #endif /* CONFIG_IEEE80211AX */
+ } else if (os_strcmp(buf, "max_listen_interval") == 0) {
+ bss->max_listen_interval = atoi(pos);
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 9c70d54..5f71aee 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3441,6 +3441,63 @@ hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
+ }
+
+
++static int
++hostapd_ctrl_iface_set_hemu(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ char *pos, *config, *value;
++ config = cmd;
++ pos = os_strchr(config, ' ');
++ if (pos == NULL)
++ return -1;
++ *pos++ = '\0';
++
++ if(pos == NULL)
++ return -1;
++ value = pos;
++
++ if (os_strcmp(config, "onoff") == 0) {
++ int hemu = atoi(value);
++ if (hemu < 0 || hemu > 15) {
++ wpa_printf(MSG_ERROR, "Invalid value for hemu");
++ return -1;
++ }
++ hapd->iconf->hemu_onoff = (u8) hemu;
++ } else {
++ wpa_printf(MSG_ERROR,
++ "Unsupported parameter %s for SET_HEMU", config);
++ return -1;
++ }
++
++ if(hostapd_drv_hemu_ctrl(hapd) == 0) {
++ return os_snprintf(buf, buflen, "OK\n");
++ } else {
++ return -1;
++ }
++}
++
++
++static int
++hostapd_ctrl_iface_get_hemu(struct hostapd_data *hapd, char *buf,
++ size_t buflen)
++{
++ u8 hemu_onoff;
++ char *pos, *end;
++
++ pos = buf;
++ end = buf + buflen;
++
++ if (hostapd_drv_hemu_dump(hapd, &hemu_onoff) == 0) {
++ hapd->iconf->hemu_onoff = hemu_onoff;
++ return os_snprintf(pos, end - pos, "[hostapd_cli] = UL MU-MIMO: %d, DL MU-MIMO: %d, UL OFDMA: %d, DL OFDMA: %d\n",
++ !!(hemu_onoff&BIT(3)), !!(hemu_onoff&BIT(2)), !!(hemu_onoff&BIT(1)), !!(hemu_onoff&BIT(0)));
++ } else {
++ wpa_printf(MSG_INFO, "ctrl iface failed to call");
++ return -1;
++ }
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -3993,6 +4050,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ } else if (os_strncmp(buf, "GET_EDCCA ", 10) == 0) {
+ reply_len = hostapd_ctrl_iface_get_edcca(hapd, buf+10, reply,
+ reply_size);
++ } else if (os_strncmp(buf, "SET_HEMU ", 9) == 0) {
++ reply_len = hostapd_ctrl_iface_set_hemu(hapd, buf+9, reply,
++ reply_size);
++ } else if (os_strncmp(buf, "GET_HEMU", 8) == 0) {
++ reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index db21258..0d36477 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1380,6 +1380,20 @@ static int hostapd_cli_cmd_driver_flags(struct wpa_ctrl *ctrl, int argc,
+ }
+
+
++static int hostapd_cli_cmd_set_hemu(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "SET_HEMU", 1, argc, argv);
++}
++
++
++static int hostapd_cli_cmd_get_hemu(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "GET_HEMU", 0, NULL, NULL);
++}
++
++
+ #ifdef CONFIG_DPP
+
+ static int hostapd_cli_cmd_dpp_qr_code(struct wpa_ctrl *ctrl, int argc,
+@@ -1705,6 +1719,10 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ " = send FTM range request"},
+ { "driver_flags", hostapd_cli_cmd_driver_flags, NULL,
+ " = show supported driver flags"},
++ { "set_hemu", hostapd_cli_cmd_set_hemu, NULL,
++ "<value> [0-15] bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0)"},
++ { "get_hemu", hostapd_cli_cmd_get_hemu, NULL,
++ " = show hemu onoff value in 0-15 bitmap"},
+ #ifdef CONFIG_DPP
+ { "dpp_qr_code", hostapd_cli_cmd_dpp_qr_code, NULL,
+ "report a scanned DPP URI from a QR Code" },
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 344585a..0e1f192 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -280,6 +280,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ conf->he_6ghz_max_ampdu_len_exp = 7;
+ conf->he_6ghz_rx_ant_pat = 1;
+ conf->he_6ghz_tx_ant_pat = 1;
++ conf->hemu_onoff = 13;
+ #endif /* CONFIG_IEEE80211AX */
+
+ /* The third octet of the country string uses an ASCII space character
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 775c567..41b8c68 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1114,6 +1114,7 @@ struct hostapd_config {
+ u8 he_6ghz_rx_ant_pat;
+ u8 he_6ghz_tx_ant_pat;
+ u8 he_6ghz_reg_pwr_type;
++ u8 hemu_onoff;
+ #endif /* CONFIG_IEEE80211AX */
+
+ /* VHT enable/disable config from CHAN_SWITCH */
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 25e967d..4598737 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1039,3 +1039,17 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
+ return 0;
+ return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
+ }
++
++int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->hemu_ctrl)
++ return 0;
++ return hapd->driver->hemu_ctrl(hapd->drv_priv, hapd->iconf->hemu_onoff);
++}
++
++int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff)
++{
++ if (!hapd->driver || !hapd->driver->hemu_dump)
++ return 0;
++ return hapd->driver->hemu_dump(hapd->drv_priv, hemu_onoff);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 70a99f4..bca39c5 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -142,6 +142,8 @@ int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
+ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
+ const int *threshold);
+ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
++int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index d05f948..921769d 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2301,6 +2301,8 @@ dfs_offload:
+ if (hostapd_drv_configure_edcca_threshold(hapd,
+ hapd->iconf->edcca_threshold) < 0)
+ goto fail;
++ if (hostapd_drv_hemu_ctrl(hapd) < 0)
++ goto fail;
+
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 7056126..69a46df 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -10,6 +10,8 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
+ MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
+ MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
++ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
++ MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
+ };
+
+@@ -174,6 +176,19 @@ enum mtk_vendor_attr_rfeature_ctrl {
+ NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
+ };
+
++enum mtk_vendor_attr_hemu_ctrl {
++ MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF,
++ MTK_VENDOR_ATTR_HEMU_CTRL_DUMP,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
++ MTK_VENDOR_ATTR_HEMU_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
++};
++
++
+ #define CSI_MAX_COUNT 256
+ #define ETH_ALEN 6
+
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 3559974..4cd7505 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1623,6 +1623,11 @@ struct wpa_driver_ap_params {
+ * Unsolicited broadcast Probe Response template length
+ */
+ size_t unsol_bcast_probe_resp_tmpl_len;
++
++ /**
++ * hemu onoff=<val> (bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0))
++ */
++ u8 hemu_onoff;
+ };
+
+ struct wpa_driver_mesh_bss_params {
+@@ -4680,6 +4685,14 @@ struct wpa_driver_ops {
+ const s8 edcca_compensation);
+ int (*configure_edcca_threshold)(void *priv, const int *threshold);
+ int (*get_edcca)(void *priv, const u8 mode, u8 *value);
++
++ /**
++ * hemu_ctrl - ctrl on off for UL/DL MURU
++ * @priv: Private driver interface data
++ *
++ */
++ int (*hemu_ctrl)(void *priv, u8 hemu_onoff);
++ int (*hemu_dump)(void *priv, u8 *hemu_onoff);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 9c2782c..73dee2e 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12304,6 +12304,114 @@ fail:
+ }
+
+
++#ifdef CONFIG_IEEE80211AX
++static int nl80211_hemu_muruonoff(void *priv, u8 hemu_onoff)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_hemu_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting hemu control");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF, hemu_onoff)) {
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if(ret){
++ wpa_printf(MSG_ERROR, "Failed to set hemu_onoff. ret=%d (%s)", ret, strerror(-ret));
++ }
++ return ret;
++}
++
++
++static int hemu_dump_handler(struct nl_msg *msg, void *arg)
++{
++ u8 *hemu_onoff = (u8 *) arg;
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb_vendor[MTK_VENDOR_ATTR_HEMU_CTRL_MAX + 1];
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct nlattr *nl_vend, *attr;
++
++ static const struct nla_policy
++ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL + 1] = {
++ [MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_HEMU_CTRL_DUMP] = {.type = NLA_U8 },
++ };
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!nl_vend)
++ return NL_SKIP;
++
++ nla_parse(tb_vendor, MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
++ nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_HEMU_CTRL_DUMP];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: cannot find MTK_VENDOR_ATTR_HEMU_CTRL_DUMP");
++ return NL_SKIP;
++ }
++
++ *hemu_onoff = nla_get_u8(attr);
++ wpa_printf(MSG_DEBUG, "nla_get hemu_onoff: %d\n", *hemu_onoff);
++
++ return 0;
++}
++
++static int nl80211_hemu_dump(void *priv, u8 *hemu_onoff)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *attr;
++ int ret;
++
++ if (!drv->mtk_hemu_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting hemu control");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL)) {
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++
++ attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++ if (!attr) {
++ nlmsg_free(msg);
++ return -1;
++ }
++
++ nla_nest_end(msg, attr);
++
++ ret = send_and_recv_msgs(drv, msg, hemu_dump_handler, hemu_onoff, NULL, NULL);
++
++ if(ret){
++ wpa_printf(MSG_ERROR, "Failed to get hemu_onoff. ret=%d (%s)", ret, strerror(-ret));
++ }
++
++ return ret;
++}
++#endif /* CONFIG_IEEE80211AX */
++
++
+ #ifdef CONFIG_DPP
+ static int nl80211_dpp_listen(void *priv, bool enable)
+ {
+@@ -12668,6 +12776,8 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .update_connect_params = nl80211_update_connection_params,
+ .send_external_auth_status = nl80211_send_external_auth_status,
+ .set_4addr_mode = nl80211_set_4addr_mode,
++ .hemu_ctrl = nl80211_hemu_muruonoff,
++ .hemu_dump = nl80211_hemu_dump,
+ #ifdef CONFIG_DPP
+ .dpp_listen = nl80211_dpp_listen,
+ #endif /* CONFIG_DPP */
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 13e5d24..57f0249 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -182,6 +182,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int brcm_do_acs:1;
+ unsigned int uses_6ghz:1;
+ unsigned int mtk_edcca_vendor_cmd_avail:1;
++ unsigned int mtk_hemu_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 732ae29..cc146d9 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1056,6 +1056,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ case MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL :
+ drv->mtk_edcca_vendor_cmd_avail = 1;
+ break;
++ case MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL :
++ drv->mtk_hemu_vendor_cmd_avail = 1;
++ break;
+ }
+ }
+
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
new file mode 100644
index 0000000..594e476
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
@@ -0,0 +1,247 @@
+From c91612769eba54821da1136d5959a40438c02824 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 2 Sep 2022 01:03:23 +0800
+Subject: [PATCH 99906/99910] hostapd: mtk: Add three wire PTA ctrl hostapd
+ vendor command
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c | 4 ++++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 13 ++++++++++++
+ src/ap/ap_drv_ops.c | 11 +++++++++++
+ src/ap/ap_drv_ops.h | 1 +
+ src/ap/hostapd.c | 2 ++
+ src/common/mtk_vendor.h | 16 +++++++++++++++
+ src/drivers/driver.h | 8 ++++++++
+ src/drivers/driver_nl80211.c | 33 +++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 3 +++
+ 11 files changed, 93 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index b22d10b..18b372a 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4794,6 +4794,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ return 1;
+ }
+ conf->edcca_compensation = (s8) val;
++ } else if (os_strcmp(buf, "three_wire_enable") == 0) {
++ u8 en = atoi(pos);
++
++ conf->three_wire_enable = en;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 0e1f192..9249a6b 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -297,6 +297,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+
+ conf->edcca_enable = EDCCA_MODE_AUTO;
+ conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
++ conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
+
+ return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 41b8c68..71cf515 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1157,6 +1157,19 @@ struct hostapd_config {
+ u8 edcca_enable;
+ s8 edcca_compensation;
+ int *edcca_threshold;
++ u8 three_wire_enable;
++};
++
++enum three_wire_mode {
++ THREE_WIRE_MODE_DISABLE,
++ THREE_WIRE_MODE_EXT0_ENABLE,
++ THREE_WIRE_MODE_EXT1_ENABLE,
++ THREE_WIRE_MODE_ALL_ENABLE,
++
++ /* keep last */
++ NUM_THREE_WIRE_MODE,
++ THREE_WIRE_MODE_MAX =
++ NUM_THREE_WIRE_MODE - 1
+ };
+
+ enum edcca_mode {
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 4598737..a1d83e4 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1053,3 +1053,14 @@ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff)
+ return 0;
+ return hapd->driver->hemu_dump(hapd->drv_priv, hemu_onoff);
+ }
++
++int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->three_wire_ctrl)
++ return 0;
++ if (hapd->iconf->three_wire_enable > THREE_WIRE_MODE_MAX) {
++ wpa_printf(MSG_INFO, "Invalid value for three wire enable\n");
++ return 0;
++ }
++ return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index bca39c5..5ba6297 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -144,6 +144,7 @@ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
+ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+ int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
++int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 921769d..f9dabdf 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2303,6 +2303,8 @@ dfs_offload:
+ goto fail;
+ if (hostapd_drv_hemu_ctrl(hapd) < 0)
+ goto fail;
++ if (hostapd_drv_three_wire_ctrl(hapd) < 0)
++ goto fail;
+
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 69a46df..ee5a4f4 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -13,6 +13,7 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++ MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
+ };
+
+ enum mtk_vendor_attr_edcca_ctrl {
+@@ -55,6 +56,21 @@ static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
+ [MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_U8 },
+ };
+
++enum mtk_vendor_attr_3wire_ctrl {
++ MTK_VENDOR_ATTR_3WIRE_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_3WIRE_CTRL_MODE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL,
++ MTK_VENDOR_ATTR_3WIRE_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL - 1
++};
++
++static struct nla_policy three_wire_ctrl_policy[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL] = {
++ [MTK_VENDOR_ATTR_3WIRE_CTRL_MODE] = {.type = NLA_U8 },
++};
++
+ enum mtk_vendor_attr_csi_ctrl {
+ MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
+
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 4cd7505..9ca19af 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4693,6 +4693,14 @@ struct wpa_driver_ops {
+ */
+ int (*hemu_ctrl)(void *priv, u8 hemu_onoff);
+ int (*hemu_dump)(void *priv, u8 *hemu_onoff);
++
++ /**
++ * three_wire_ctrl - set three_wire_ctrl mode
++ * @priv: Private driver interface data
++ * @three_wire_enable: three_wire_ctrl mode
++ *
++ */
++ int (*three_wire_ctrl)(void *priv, u8 three_wire_enable);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 73dee2e..2bb8cc2 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12637,6 +12637,38 @@ static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
+ return ret;
+ }
+
++static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ /* Prepare nl80211 cmd */
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_3wire_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting three wire control");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_3WIRE_CTRL_MODE, three_wire_enable)) {
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to enable three wire. ret=%d (%s) ",
++ ret, strerror(-ret));
++ }
++ return ret;
++}
+
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+@@ -12789,4 +12821,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .configure_edcca_enable = nl80211_configure_edcca_enable,
+ .configure_edcca_threshold = nl80211_configure_edcca_threshold,
+ .get_edcca = nl80211_get_edcca,
++ .three_wire_ctrl = nl80211_enable_three_wire,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 57f0249..9fe7811 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -183,6 +183,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int uses_6ghz:1;
+ unsigned int mtk_edcca_vendor_cmd_avail:1;
+ unsigned int mtk_hemu_vendor_cmd_avail:1;
++ unsigned int mtk_3wire_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index cc146d9..04bc54e 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1059,6 +1059,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ case MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL :
+ drv->mtk_hemu_vendor_cmd_avail = 1;
+ break;
++ case MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL :
++ drv->mtk_3wire_vendor_cmd_avail = 1;
++ break;
+ }
+ }
+
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99907-hostapd-mtk-Add-hostapd-iBF-control.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
new file mode 100644
index 0000000..c37cb40
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
@@ -0,0 +1,431 @@
+From 4971762bfaba906054d43bd2d042c436a1ac97b2 Mon Sep 17 00:00:00 2001
+From: mtk27835 <shurong.wen@mediatek.com>
+Date: Wed, 7 Sep 2022 14:41:51 -0700
+Subject: [PATCH 99907/99910] hostapd: mtk: Add hostapd iBF control
+
+Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
+---
+ hostapd/config_file.c | 3 +
+ hostapd/ctrl_iface.c | 26 +++++++
+ hostapd/hostapd_cli.c | 9 +++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 2 +
+ src/ap/ap_drv_ops.c | 14 ++++
+ src/ap/ap_drv_ops.h | 2 +
+ src/ap/hostapd.c | 2 +
+ src/common/mtk_vendor.h | 35 +++++++++-
+ src/drivers/driver.h | 19 ++++++
+ src/drivers/driver_nl80211.c | 108 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 3 +
+ 13 files changed, 224 insertions(+), 1 deletion(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 18b372a..d9d882c 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4798,6 +4798,9 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ u8 en = atoi(pos);
+
+ conf->three_wire_enable = en;
++ } else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
++ int val = atoi(pos);
++ conf->ibf_enable = !!val;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 5f71aee..c881d37 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3498,6 +3498,30 @@ hostapd_ctrl_iface_get_hemu(struct hostapd_data *hapd, char *buf,
+ }
+
+
++static int
++hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
++ size_t buflen)
++{
++ u8 ibf_enable;
++ int ret;
++ char *pos, *end;
++
++ pos = buf;
++ end = buf + buflen;
++
++ if (hostapd_drv_ibf_dump(hapd, &ibf_enable) == 0) {
++ hapd->iconf->ibf_enable = ibf_enable;
++ ret = os_snprintf(pos, end - pos, "ibf_enable: %u\n",
++ ibf_enable);
++ }
++
++ if (os_snprintf_error(end - pos, ret))
++ return 0;
++
++ return ret;
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -4055,6 +4079,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply_size);
+ } else if (os_strncmp(buf, "GET_HEMU", 8) == 0) {
+ reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
++ } else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
++ reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index 0d36477..c2a123a 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1586,6 +1586,13 @@ static int hostapd_cli_cmd_driver(struct wpa_ctrl *ctrl, int argc, char *argv[])
+ #endif /* ANDROID */
+
+
++static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "GET_IBF", 0, NULL, NULL);
++}
++
++
+ struct hostapd_cli_cmd {
+ const char *cmd;
+ int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]);
+@@ -1787,6 +1794,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ #endif /* ANDROID */
+ { "inband_discovery", hostapd_cli_cmd_inband_discovery, NULL,
+ "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
++ { "get_ibf", hostapd_cli_cmd_get_ibf, NULL,
++ " = show iBF state (enabled/disabled)"},
+ { NULL, NULL, NULL, NULL }
+ };
+
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 9249a6b..7a96cb8 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -298,6 +298,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ conf->edcca_enable = EDCCA_MODE_AUTO;
+ conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
+ conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
++ conf->ibf_enable = IBF_DEFAULT_ENABLE;
+
+ return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 71cf515..44a0e7e 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1158,6 +1158,7 @@ struct hostapd_config {
+ s8 edcca_compensation;
+ int *edcca_threshold;
+ u8 three_wire_enable;
++ u8 ibf_enable;
+ };
+
+ enum three_wire_mode {
+@@ -1198,6 +1199,7 @@ enum mtk_vendor_attr_edcca_ctrl_mode {
+ #define EDCCA_MIN_CONFIG_THRES -126
+ #define EDCCA_MAX_CONFIG_THRES 0
+
++#define IBF_DEFAULT_ENABLE 0
+
+ static inline enum oper_chan_width
+ hostapd_get_oper_chwidth(struct hostapd_config *conf)
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index a1d83e4..60ae825 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1064,3 +1064,17 @@ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
+ }
+ return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
+ }
++
++int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->ibf_ctrl)
++ return 0;
++ return hapd->driver->ibf_ctrl(hapd->drv_priv, hapd->iconf->ibf_enable);
++}
++
++int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
++{
++ if (!hapd->driver || !hapd->driver->ibf_dump)
++ return 0;
++ return hapd->driver->ibf_dump(hapd->drv_priv, ibf_enable);
++}
+\ No newline at end of file
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 5ba6297..ab9aedc 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -145,6 +145,8 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+ int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index f9dabdf..e44b73d 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2305,6 +2305,8 @@ dfs_offload:
+ goto fail;
+ if (hostapd_drv_three_wire_ctrl(hapd) < 0)
+ goto fail;
++ if (hostapd_drv_ibf_ctrl(hapd) < 0)
++ goto fail;
+
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index ee5a4f4..4050cf8 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -13,7 +13,8 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
+- MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
++ MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8,
++ MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL = 0xc9,
+ };
+
+ enum mtk_vendor_attr_edcca_ctrl {
+@@ -204,6 +205,38 @@ enum mtk_vendor_attr_hemu_ctrl {
+ NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
+ };
+
++enum mtk_vendor_attr_ibf_ctrl {
++ MTK_VENDOR_ATTR_IBF_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_IBF_CTRL_ENABLE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_IBF_CTRL,
++ MTK_VENDOR_ATTR_IBF_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_IBF_CTRL - 1
++};
++
++enum mtk_vendor_attr_ibf_dump {
++ MTK_VENDOR_ATTR_IBF_DUMP_UNSPEC,
++
++ MTK_VENDOR_ATTR_IBF_DUMP_ENABLE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_IBF_DUMP,
++ MTK_VENDOR_ATTR_IBF_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_IBF_DUMP - 1
++};
++
++static struct nla_policy
++ibf_ctrl_policy[NUM_MTK_VENDOR_ATTRS_IBF_CTRL] = {
++ [MTK_VENDOR_ATTR_IBF_CTRL_ENABLE] = { .type = NLA_U8 },
++};
++
++static struct nla_policy
++ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
++ [MTK_VENDOR_ATTR_IBF_DUMP_ENABLE] = { .type = NLA_U8 },
++};
++
+
+ #define CSI_MAX_COUNT 256
+ #define ETH_ALEN 6
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 9ca19af..71ded61 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1628,6 +1628,11 @@ struct wpa_driver_ap_params {
+ * hemu onoff=<val> (bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0))
+ */
+ u8 hemu_onoff;
++
++ /**
++ * ibf_enable=<val>
++ */
++ u8 ibf_enable;
+ };
+
+ struct wpa_driver_mesh_bss_params {
+@@ -4701,6 +4706,20 @@ struct wpa_driver_ops {
+ *
+ */
+ int (*three_wire_ctrl)(void *priv, u8 three_wire_enable);
++
++ /**
++ * ibf_ctrl - ctrl disable/enable for ibf
++ * @priv: Private driver interface data
++ *
++ */
++ int (*ibf_ctrl)(void *priv, u8 ibf_enable);
++
++ /**
++ * ibf_dump - dump ibf
++ * @priv: Private driver interface data
++ *
++ */
++ int (*ibf_dump)(void *priv, u8 *ibf_enable);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 2bb8cc2..e974f85 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12670,6 +12670,112 @@ static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
+ return ret;
+ }
+
++static int nl80211_ibf_enable(void *priv, u8 ibf_enable)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_ibf_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting ibf control");
++ return 0;
++ }
++
++ msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++ if (!data)
++ goto fail;
++
++ nla_put_u8(msg, MTK_VENDOR_ATTR_IBF_CTRL_ENABLE, ibf_enable);
++
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to set ibf_enable. ret=%d (%s)", ret, strerror(-ret));
++ }
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++}
++
++static int ibf_dump_handler(struct nl_msg *msg, void *arg)
++{
++ u8 *ibf_enable = (u8 *) arg;
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb_vendor[MTK_VENDOR_ATTR_IBF_DUMP_MAX + 1];
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct nlattr *nl_vend, *attr;
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!nl_vend)
++ return NL_SKIP;
++
++ nla_parse(tb_vendor, MTK_VENDOR_ATTR_IBF_DUMP_MAX,
++ nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: cannot find MTK_VENDOR_ATTR_IBF_DUMP_ENABLE");
++ return NL_SKIP;
++ }
++
++ *ibf_enable = nla_get_u8(attr);
++
++ return NL_SKIP;
++}
++
++static int
++nl80211_ibf_dump(void *priv, u8 *ibf_enable)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED);
++ if (!data)
++ goto fail;
++
++ nla_nest_end(msg, data);
++
++ ret = send_and_recv_msgs(drv, msg, ibf_dump_handler, ibf_enable, NULL, NULL);
++
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to dump ibf_enable. ret=%d (%s)", ret, strerror(-ret));
++ }
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+ .desc = "Linux nl80211/cfg80211",
+@@ -12822,4 +12928,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .configure_edcca_threshold = nl80211_configure_edcca_threshold,
+ .get_edcca = nl80211_get_edcca,
+ .three_wire_ctrl = nl80211_enable_three_wire,
++ .ibf_ctrl = nl80211_ibf_enable,
++ .ibf_dump = nl80211_ibf_dump,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 9fe7811..607592c 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -184,6 +184,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int mtk_edcca_vendor_cmd_avail:1;
+ unsigned int mtk_hemu_vendor_cmd_avail:1;
+ unsigned int mtk_3wire_vendor_cmd_avail:1;
++ unsigned int mtk_ibf_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 04bc54e..9ecc0ff 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1062,6 +1062,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ case MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL :
+ drv->mtk_3wire_vendor_cmd_avail = 1;
+ break;
++ case MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL:
++ drv->mtk_ibf_vendor_cmd_avail = 1;
++ break;
+ }
+ }
+
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
new file mode 100644
index 0000000..47628d7
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
@@ -0,0 +1,27 @@
+From f96a62568fb3c419e71f8d7469d485dce55f4da6 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 22 Sep 2022 16:08:09 +0800
+Subject: [PATCH 99908/99910] hostapd: mtk: Do not include HE capab IE if
+ associated sta's HE capab IE is invalid
+
+---
+ src/ap/ieee802_11.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
+index d921783..098793e 100644
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -5192,7 +5192,8 @@ static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
+ #endif /* CONFIG_IEEE80211AC */
+
+ #ifdef CONFIG_IEEE80211AX
+- if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax) {
++ if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax &&
++ sta->flags & WLAN_STA_HE) {
+ p = hostapd_eid_he_capab(hapd, p, IEEE80211_MODE_AP);
+ p = hostapd_eid_he_operation(hapd, p);
+ p = hostapd_eid_cca(hapd, p);
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
new file mode 100644
index 0000000..c1fc3f1
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
@@ -0,0 +1,376 @@
+From 782f38f2eec27e438e55cb09e824a6ffc1c3eb18 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 7 Oct 2022 10:46:29 +0800
+Subject: [PATCH 99909/99910] hostapd: mtk: Add DFS and ZWDFS support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c | 4 ++
+ hostapd/ctrl_iface.c | 95 ++++++++++++++++++++++++++++++++++++
+ src/ap/ap_config.h | 13 +++++
+ src/ap/dfs.c | 35 +++++++------
+ src/ap/dfs.h | 15 ++++++
+ src/ap/hostapd.c | 4 +-
+ src/drivers/driver.h | 7 +++
+ src/drivers/driver_nl80211.c | 29 +++++++++++
+ src/drivers/nl80211_copy.h | 1 +
+ 9 files changed, 186 insertions(+), 17 deletions(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index d9d882c..fd61448 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4801,6 +4801,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ } else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
+ int val = atoi(pos);
+ conf->ibf_enable = !!val;
++ } else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
++ u8 en = strtol(pos, NULL, 10);
++
++ conf->dfs_detect_mode = en;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index c881d37..6ea1573 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3522,6 +3522,96 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
+ }
+
+
++static int
++hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
++ char *buf, size_t buflen)
++{
++ u8 dfs_detect_mode;
++
++ if (!value)
++ return -1;
++
++ dfs_detect_mode = strtol(value, NULL, 10);
++ if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
++ wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
++ return -1;
++ }
++ hapd->iconf->dfs_detect_mode = dfs_detect_mode;
++
++ return os_snprintf(buf, buflen, "OK\n");
++}
++
++
++static int
++hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ struct hostapd_iface *iface = hapd->iface;
++ char *pos, *param;
++ enum hostapd_hw_mode hw_mode;
++ bool chan_found = false;
++ int i, num_available_chandefs, channel, chan_width, sec = 0;
++ int sec_chan_idx_80p80 = -1;
++ u8 oper_centr_freq_seg0_idx, oper_centr_freq_seg1_idx;
++ struct hostapd_channel_data *chan;
++ enum dfs_channel_type type = DFS_NO_CAC_YET;
++
++ param = os_strchr(cmd, ' ');
++ if (!param)
++ return -1;
++ *param++ = '\0';
++
++ pos = os_strstr(param, "chan=");
++ if (pos)
++ channel = strtol(pos + 5, NULL, 10);
++ else
++ return -1;
++
++ num_available_chandefs = dfs_find_channel(iface, NULL, 0, type);
++ for (i = 0; i < num_available_chandefs; i++) {
++ dfs_find_channel(iface, &chan, i, type);
++ if (chan->chan == channel) {
++ chan_found = true;
++ break;
++ }
++ }
++
++ if (!chan_found)
++ return -1;
++
++ if (iface->conf->secondary_channel)
++ sec = 1;
++
++ dfs_adjust_center_freq(iface, chan,
++ sec,
++ sec_chan_idx_80p80,
++ &oper_centr_freq_seg0_idx,
++ &oper_centr_freq_seg1_idx);
++
++ if (hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
++ chan->freq, chan->chan,
++ iface->conf->ieee80211n,
++ iface->conf->ieee80211ac,
++ iface->conf->ieee80211ax,
++ iface->conf->ieee80211be,
++ sec, hostapd_get_oper_chwidth(iface->conf),
++ oper_centr_freq_seg0_idx,
++ oper_centr_freq_seg1_idx, true)) {
++ wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
++ iface->radar_background.channel = -1;
++ return -1;
++ }
++
++ iface->radar_background.channel = chan->chan;
++ iface->radar_background.freq = chan->freq;
++ iface->radar_background.secondary_channel = sec;
++ iface->radar_background.centr_freq_seg0_idx = oper_centr_freq_seg0_idx;
++ iface->radar_background.centr_freq_seg1_idx = oper_centr_freq_seg1_idx;
++
++ return os_snprintf(buf, buflen, "OK\n");
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -4081,6 +4171,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ } else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
+ reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
++ } else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
++ reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
++ reply, reply_size);
++ } else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
++ reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 44a0e7e..3f5afdf 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1159,6 +1159,7 @@ struct hostapd_config {
+ int *edcca_threshold;
+ u8 three_wire_enable;
+ u8 ibf_enable;
++ u8 dfs_detect_mode;
+ };
+
+ enum three_wire_mode {
+@@ -1173,6 +1174,18 @@ enum three_wire_mode {
+ NUM_THREE_WIRE_MODE - 1
+ };
+
++enum dfs_mode {
++ DFS_DETECT_MODE_DISABLE,
++ DFS_DETECT_MODE_AP_ENABLE,
++ DFS_DETECT_MODE_BACKGROUND_ENABLE,
++ DFS_DETECT_MODE_ALL_ENABLE,
++
++ /* keep last */
++ NUM_DFS_DETECT_MODE,
++ DFS_DETECT_MODE_MAX =
++ NUM_DFS_DETECT_MODE - 1
++};
++
+ enum edcca_mode {
+ EDCCA_MODE_FORCE_DISABLE = 0,
+ EDCCA_MODE_AUTO = 1,
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index b5d105d..1c3f678 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -19,13 +19,6 @@
+ #include "dfs.h"
+ #include "crypto/crypto.h"
+
+-
+-enum dfs_channel_type {
+- DFS_ANY_CHANNEL,
+- DFS_AVAILABLE, /* non-radar or radar-available */
+- DFS_NO_CAC_YET, /* radar-not-yet-available */
+-};
+-
+ static struct hostapd_channel_data *
+ dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
+ u8 *oper_centr_freq_seg0_idx,
+@@ -238,9 +231,9 @@ static int is_in_chanlist(struct hostapd_iface *iface,
+ * - hapd->vht/he_oper_centr_freq_seg0_idx
+ * - hapd->vht/he_oper_centr_freq_seg1_idx
+ */
+-static int dfs_find_channel(struct hostapd_iface *iface,
+- struct hostapd_channel_data **ret_chan,
+- int idx, enum dfs_channel_type type)
++int dfs_find_channel(struct hostapd_iface *iface,
++ struct hostapd_channel_data **ret_chan,
++ int idx, enum dfs_channel_type type)
+ {
+ struct hostapd_hw_modes *mode;
+ struct hostapd_channel_data *chan;
+@@ -299,12 +292,12 @@ static int dfs_find_channel(struct hostapd_iface *iface,
+ }
+
+
+-static void dfs_adjust_center_freq(struct hostapd_iface *iface,
+- struct hostapd_channel_data *chan,
+- int secondary_channel,
+- int sec_chan_idx_80p80,
+- u8 *oper_centr_freq_seg0_idx,
+- u8 *oper_centr_freq_seg1_idx)
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++ struct hostapd_channel_data *chan,
++ int secondary_channel,
++ int sec_chan_idx_80p80,
++ u8 *oper_centr_freq_seg0_idx,
++ u8 *oper_centr_freq_seg1_idx)
+ {
+ if (!iface->conf->ieee80211ac && !iface->conf->ieee80211ax)
+ return;
+@@ -1317,6 +1310,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
+ __func__, iface->radar_background.cac_started ? "yes" : "no",
+ hostapd_csa_in_progress(iface) ? "yes" : "no");
+
++ /* Skip channel switch when background dfs detect mode is on */
++ if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
++ iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++ return 0;
++
+ /* Check if CSA in progress */
+ if (hostapd_csa_in_progress(iface))
+ return 0;
+@@ -1365,6 +1363,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
+ __func__, iface->cac_started ? "yes" : "no",
+ hostapd_csa_in_progress(iface) ? "yes" : "no");
+
++ /* Skip channel switch when dfs detect mode is on */
++ if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
++ iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++ return 0;
++
+ /* Check if CSA in progress */
+ if (hostapd_csa_in_progress(iface))
+ return 0;
+diff --git a/src/ap/dfs.h b/src/ap/dfs.h
+index 606c1b3..c2556d2 100644
+--- a/src/ap/dfs.h
++++ b/src/ap/dfs.h
+@@ -9,6 +9,12 @@
+ #ifndef DFS_H
+ #define DFS_H
+
++enum dfs_channel_type {
++ DFS_ANY_CHANNEL,
++ DFS_AVAILABLE, /* non-radar or radar-available */
++ DFS_NO_CAC_YET, /* radar-not-yet-available */
++};
++
+ int hostapd_handle_dfs(struct hostapd_iface *iface);
+
+ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
+@@ -32,5 +38,14 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
+ int hostapd_handle_dfs_offload(struct hostapd_iface *iface);
+ int hostapd_is_dfs_overlap(struct hostapd_iface *iface, enum chan_width width,
+ int center_freq);
++int dfs_find_channel(struct hostapd_iface *iface,
++ struct hostapd_channel_data **ret_chan,
++ int idx, enum dfs_channel_type type);
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++ struct hostapd_channel_data *chan,
++ int secondary_channel,
++ int sec_chan_idx_80p80,
++ u8 *oper_centr_freq_seg0_idx,
++ u8 *oper_centr_freq_seg1_idx);
+
+ #endif /* DFS_H */
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index e44b73d..793ce2f 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -1463,7 +1463,9 @@ static int hostapd_setup_bss(struct hostapd_data *hapd, int first)
+ return -1;
+ }
+
+- if (!conf->start_disabled && ieee802_11_set_beacon(hapd) < 0)
++ if (conf->start_disabled)
++ hapd->driver->start_disabled(hapd->drv_priv);
++ else if (ieee802_11_set_beacon(hapd) < 0)
+ return -1;
+
+ if (flush_old_stations && !conf->start_disabled &&
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 71ded61..aa23fbd 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4720,6 +4720,13 @@ struct wpa_driver_ops {
+ *
+ */
+ int (*ibf_dump)(void *priv, u8 *ibf_enable);
++
++ /**
++ * start_disabled - set start_disabled to cfg80211
++ * @priv: Private driver interface data
++ *
++ */
++ int (*start_disabled)(void *priv);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index e974f85..003adc4 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12776,6 +12776,34 @@ fail:
+ return -ENOBUFS;
+ }
+
++static int nl80211_start_disabled(void *priv)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ msg = nl80211_bss_msg(bss, 0, NL80211_CMD_NEW_BEACON);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_flag(msg, NL80211_ATTR_START_DISABLED))
++ goto fail;
++
++ ret = send_and_recv_msgs_connect_handle(drv, msg, bss, 1);
++
++ if (ret)
++ wpa_printf(MSG_ERROR, "Failed to set start_disabled. ret=%d (%s)",
++ ret, strerror(-ret));
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return ret;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+ .desc = "Linux nl80211/cfg80211",
+@@ -12930,4 +12958,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .three_wire_ctrl = nl80211_enable_three_wire,
+ .ibf_ctrl = nl80211_ibf_enable,
+ .ibf_dump = nl80211_ibf_dump,
++ .start_disabled = nl80211_start_disabled,
+ };
+diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
+index c4bf3ad..79bc76c 100644
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -3176,6 +3176,7 @@ enum nl80211_attrs {
+ NL80211_ATTR_EHT_CAPABILITY,
+
+ /* add attributes here, update the policy in nl80211.c */
++ NL80211_ATTR_START_DISABLED = 999,
+
+ __NL80211_ATTR_AFTER_LAST,
+ NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99910-hostapd-mtk-Add-amsdu-set-get-ctrl.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99910-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
new file mode 100644
index 0000000..c05a444
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99910-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
@@ -0,0 +1,400 @@
+From 6cf5ec59e09945a075909b8070d9795869db081e Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Fri, 16 Dec 2022 03:57:11 +0800
+Subject: [PATCH 99910/99910] hostapd: mtk: Add amsdu set get ctrl
+
+---
+ hostapd/config_file.c | 9 +++
+ hostapd/ctrl_iface.c | 26 +++++++
+ hostapd/hostapd_cli.c | 9 +++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 1 +
+ src/ap/ap_drv_ops.c | 14 ++++
+ src/ap/ap_drv_ops.h | 2 +
+ src/ap/hostapd.c | 2 +
+ src/common/mtk_vendor.h | 17 ++++-
+ src/drivers/driver.h | 9 +++
+ src/drivers/driver_nl80211.c | 114 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 3 +
+ 13 files changed, 207 insertions(+), 1 deletion(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index fd61448..759033b 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4805,6 +4805,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ u8 en = strtol(pos, NULL, 10);
+
+ conf->dfs_detect_mode = en;
++ } else if (os_strcmp(buf, "amsdu") == 0) {
++ int val = atoi(pos);
++ if (val < 0 || val > 1) {
++ wpa_printf(MSG_ERROR,
++ "Line %d: invalid amsdu value",
++ line);
++ return 1;
++ }
++ conf->amsdu = val;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 6ea1573..0ad8451 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3612,6 +3612,30 @@ hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
+ }
+
+
++static int
++hostapd_ctrl_iface_get_amsdu(struct hostapd_data *hapd, char *buf,
++ size_t buflen)
++{
++ u8 amsdu;
++ int ret;
++ char *pos, *end;
++
++ pos = buf;
++ end = buf + buflen;
++
++ if (hostapd_drv_amsdu_dump(hapd, &amsdu) == 0) {
++ hapd->iconf->amsdu = amsdu;
++ ret = os_snprintf(pos, end - pos, "[hostapd_cli] AMSDU: %u\n",
++ hapd->iconf->amsdu);
++ }
++
++ if (os_snprintf_error(end - pos, ret))
++ return 0;
++
++ return ret;
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -4176,6 +4200,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply, reply_size);
+ } else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
+ reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
++ } else if (os_strncmp(buf, "GET_AMSDU", 9) == 0) {
++ reply_len = hostapd_ctrl_iface_get_amsdu(hapd, reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index c2a123a..30b3392 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1593,6 +1593,13 @@ static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
+ }
+
+
++static int hostapd_cli_cmd_get_amsdu(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "GET_AMSDU", 0, NULL, NULL);
++}
++
++
+ struct hostapd_cli_cmd {
+ const char *cmd;
+ int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]);
+@@ -1796,6 +1803,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
+ { "get_ibf", hostapd_cli_cmd_get_ibf, NULL,
+ " = show iBF state (enabled/disabled)"},
++ { "get_amsdu", hostapd_cli_cmd_get_amsdu, NULL,
++ " = show AMSDU state"},
+ { NULL, NULL, NULL, NULL }
+ };
+
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 7a96cb8..85ad5e4 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -299,6 +299,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
+ conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
+ conf->ibf_enable = IBF_DEFAULT_ENABLE;
++ conf->amsdu = 1;
+
+ return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 3f5afdf..92f1bd6 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1160,6 +1160,7 @@ struct hostapd_config {
+ u8 three_wire_enable;
+ u8 ibf_enable;
+ u8 dfs_detect_mode;
++ u8 amsdu;
+ };
+
+ enum three_wire_mode {
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 60ae825..1a82f23 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1077,4 +1077,18 @@ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
+ if (!hapd->driver || !hapd->driver->ibf_dump)
+ return 0;
+ return hapd->driver->ibf_dump(hapd->drv_priv, ibf_enable);
++}
++
++int hostapd_drv_amsdu_ctrl(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->amsdu_ctrl)
++ return 0;
++ return hapd->driver->amsdu_ctrl(hapd->drv_priv, hapd->iconf->amsdu);
++}
++
++int hostapd_drv_amsdu_dump(struct hostapd_data *hapd, u8 *amsdu)
++{
++ if (!hapd->driver || !hapd->driver->amsdu_dump)
++ return 0;
++ return hapd->driver->amsdu_dump(hapd->drv_priv, amsdu);
+ }
+\ No newline at end of file
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index ab9aedc..4406666 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -147,6 +147,8 @@ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable);
++int hostapd_drv_amsdu_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_amsdu_dump(struct hostapd_data *hapd, u8 *amsdu);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 793ce2f..aef01f2 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2309,6 +2309,8 @@ dfs_offload:
+ goto fail;
+ if (hostapd_drv_ibf_ctrl(hapd) < 0)
+ goto fail;
++ if (hostapd_drv_amsdu_ctrl(hapd) < 0)
++ goto fail;
+
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 4050cf8..0999ea9 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -167,7 +167,6 @@ enum mtk_vendor_attr_wireless_ctrl {
+ MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
+ MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
+ MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
+- MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU,
+ MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
+ MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT,
+
+@@ -177,6 +176,22 @@ enum mtk_vendor_attr_wireless_ctrl {
+ NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
+ };
+
++enum mtk_vendor_attr_wireless_dump {
++ MTK_VENDOR_ATTR_WIRELESS_DUMP_UNSPEC,
++
++ MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP,
++ MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP - 1
++};
++
++static const struct nla_policy
++wireless_dump_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP] = {
++ [MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU] = { .type = NLA_U8 },
++};
++
+ enum mtk_vendor_attr_rfeature_ctrl {
+ MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
+
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index aa23fbd..b07aaf3 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4727,6 +4727,15 @@ struct wpa_driver_ops {
+ *
+ */
+ int (*start_disabled)(void *priv);
++
++ /**
++ * amsdu_ctrl - enable/disable amsdu
++ * amsdu_dump - get current amsdu status
++ * @priv: Private driver interface data
++ *
++ */
++ int (*amsdu_ctrl)(void *priv, u8 amsdu);
++ int (*amsdu_dump)(void *priv, u8 *amsdu);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 003adc4..5c04284 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12804,6 +12804,118 @@ fail:
+ return ret;
+ }
+
++static int nl80211_enable_amsdu(void *priv, u8 amsdu)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_wireless_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting ap wireless control");
++ return 0;
++ }
++
++ msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++ if (!data)
++ goto fail;
++
++ nla_put_u8(msg, MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU, amsdu);
++
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to set amsdu. ret=%d (%s)", ret, strerror(-ret));
++ }
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++}
++
++static int dump_amsdu_handler(struct nl_msg *msg, void *arg)
++{
++ u8 *amsdu = (u8 *) arg;
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX + 1];
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct nlattr *nl_vend, *attr_amsdu;
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!nl_vend)
++ return NL_SKIP;
++
++ nla_parse(tb_vendor, MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX,
++ nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++ attr_amsdu = tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU];
++ if (!attr_amsdu ){
++ wpa_printf(MSG_ERROR, "nl80211: cannot find vendor attributes");
++ return NL_SKIP;
++ }
++
++ *amsdu = nla_get_u8(attr_amsdu);
++
++ return NL_SKIP;
++}
++
++static int
++nl80211_dump_amsdu(void *priv, u8 *amsdu)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_wireless_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support ap_wireless control");
++ return 0;
++ }
++
++ msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++ if (!data)
++ goto fail;
++
++ nla_nest_end(msg, data);
++
++ ret = send_and_recv_msgs(drv, msg, dump_amsdu_handler, amsdu, NULL, NULL);
++
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to dump amsdu. ret=%d (%s)", ret, strerror(-ret));
++ }
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+ .desc = "Linux nl80211/cfg80211",
+@@ -12959,4 +13071,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .ibf_ctrl = nl80211_ibf_enable,
+ .ibf_dump = nl80211_ibf_dump,
+ .start_disabled = nl80211_start_disabled,
++ .amsdu_ctrl = nl80211_enable_amsdu,
++ .amsdu_dump = nl80211_dump_amsdu,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 607592c..e570224 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -185,6 +185,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int mtk_hemu_vendor_cmd_avail:1;
+ unsigned int mtk_3wire_vendor_cmd_avail:1;
+ unsigned int mtk_ibf_vendor_cmd_avail:1;
++ unsigned int mtk_wireless_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 9ecc0ff..fcfa68b 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1065,6 +1065,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ case MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL:
+ drv->mtk_ibf_vendor_cmd_avail = 1;
+ break;
++ case MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL:
++ drv->mtk_wireless_vendor_cmd_avail = 1;
++ break;
+ }
+ }
+
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99911-hostapd-mtk-Add-he_ldpc-configuration.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99911-hostapd-mtk-Add-he_ldpc-configuration.patch
new file mode 100644
index 0000000..2e8dfe0
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99911-hostapd-mtk-Add-he_ldpc-configuration.patch
@@ -0,0 +1,102 @@
+From 216258435a119d48c233b63c2383850bc5f86e94 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Thu, 12 Jan 2023 15:18:19 +0800
+Subject: [PATCH] hostapd: mtk: Add he_ldpc configuration
+
+---
+ hostapd/config_file.c | 2 ++
+ hostapd/hostapd.conf | 5 +++++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 1 +
+ src/ap/ieee802_11_he.c | 7 +++++++
+ src/common/ieee802_11_defs.h | 3 +++
+ 6 files changed, 19 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 10ea525..4237a5c 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3508,6 +3508,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ conf->he_phy_capab.he_su_beamformee = atoi(pos);
+ } else if (os_strcmp(buf, "he_mu_beamformer") == 0) {
+ conf->he_phy_capab.he_mu_beamformer = atoi(pos);
++ } else if (os_strcmp(buf, "he_ldpc") == 0) {
++ conf->he_phy_capab.he_ldpc = atoi(pos);
+ } else if (os_strcmp(buf, "he_bss_color") == 0) {
+ conf->he_op.he_bss_color = atoi(pos) & 0x3f;
+ conf->he_op.he_bss_color_disabled = 0;
+diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
+index ea67aa1..e3a5eb3 100644
+--- a/hostapd/hostapd.conf
++++ b/hostapd/hostapd.conf
+@@ -830,6 +830,11 @@ wmm_ac_vo_acm=0
+ # 1 = supported
+ #he_mu_beamformer=1
+
++#he_ldpc: HE LDPC support
++# 0 = not supported
++# 1 = supported (default)
++#he_ldpc=1
++
+ # he_bss_color: BSS color (1-63)
+ #he_bss_color=1
+
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 85ad5e4..b283de6 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -268,6 +268,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ #endif /* CONFIG_ACS */
+
+ #ifdef CONFIG_IEEE80211AX
++ conf->he_phy_capab.he_ldpc = 1;
+ conf->he_op.he_rts_threshold = HE_OPERATION_RTS_THRESHOLD_MASK >>
+ HE_OPERATION_RTS_THRESHOLD_OFFSET;
+ /* Set default basic MCS/NSS set to single stream MCS 0-7 */
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index a9ac396..b8b20a7 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -929,6 +929,7 @@ struct hostapd_bss_config {
+ * struct he_phy_capabilities_info - HE PHY capabilities
+ */
+ struct he_phy_capabilities_info {
++ bool he_ldpc;
+ bool he_su_beamformer;
+ bool he_su_beamformee;
+ bool he_mu_beamformer;
+diff --git a/src/ap/ieee802_11_he.c b/src/ap/ieee802_11_he.c
+index b5b7e5d..f27aeb1 100644
+--- a/src/ap/ieee802_11_he.c
++++ b/src/ap/ieee802_11_he.c
+@@ -138,6 +138,13 @@ u8 * hostapd_eid_he_capab(struct hostapd_data *hapd, u8 *eid,
+ os_memcpy(&cap->optional[mcs_nss_size],
+ mode->he_capab[opmode].ppet, ppet_size);
+
++ if (hapd->iface->conf->he_phy_capab.he_ldpc)
++ cap->he_phy_capab_info[HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX] |=
++ HE_PHYCAP_LDPC_CODING_IN_PAYLOAD;
++ else
++ cap->he_phy_capab_info[HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX] &=
++ ~HE_PHYCAP_LDPC_CODING_IN_PAYLOAD;
++
+ if (hapd->iface->conf->he_phy_capab.he_su_beamformer)
+ cap->he_phy_capab_info[HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX] |=
+ HE_PHYCAP_SU_BEAMFORMER_CAPAB;
+diff --git a/src/common/ieee802_11_defs.h b/src/common/ieee802_11_defs.h
+index 65e125e..62088bd 100644
+--- a/src/common/ieee802_11_defs.h
++++ b/src/common/ieee802_11_defs.h
+@@ -2298,6 +2298,9 @@ struct ieee80211_spatial_reuse {
+ #define HE_PHYCAP_CHANNEL_WIDTH_SET_160MHZ_IN_5G ((u8) BIT(3))
+ #define HE_PHYCAP_CHANNEL_WIDTH_SET_80PLUS80MHZ_IN_5G ((u8) BIT(4))
+
++#define HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX 1
++#define HE_PHYCAP_LDPC_CODING_IN_PAYLOAD ((u8) BIT(5))
++
+ #define HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX 3
+ #define HE_PHYCAP_SU_BEAMFORMER_CAPAB ((u8) BIT(7))
+ #define HE_PHYCAP_SU_BEAMFORMEE_CAPAB_IDX 4
+--
+2.39.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99912-hostapd-mtk-Add-the-broadcast-destination-address-of.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99912-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
new file mode 100644
index 0000000..df9dcc5
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/99912-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
@@ -0,0 +1,43 @@
+From 9c04bbbe2677cc11b88c867ab7b1df7e408483b5 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Tue, 17 Jan 2023 13:25:18 +0800
+Subject: [PATCH] hostapd: mtk: Add the broadcast destination address of Probe
+ Response frame on 6 GHz
+
+According to IEEE 802.11ax 26.17.2.3.2,
+if a 6 GHz AP receives a Probe Request frame and responds with a Probe Response frame,
+the Address 1 field of the Probe Response frame shall be set to the broadcast address,
+unless the AP is not indicating its actual SSID in the SSID element of its Beacon frames.
+
+Without this, hostapd fill the Address 1 feild of the Probe Response frame
+with the source address from Probe Request frame on 6 GHz.
+Fix this to use broadcast address instead.
+
+Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
+---
+ src/ap/beacon.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/src/ap/beacon.c b/src/ap/beacon.c
+index 1a26f11..f3ea5c2 100644
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1156,8 +1156,13 @@ void handle_probe_req(struct hostapd_data *hapd,
+ wpa_msg_ctrl(hapd->msg_ctx, MSG_INFO, RX_PROBE_REQUEST "sa=" MACSTR
+ " signal=%d", MAC2STR(mgmt->sa), ssi_signal);
+
+- resp = hostapd_gen_probe_resp(hapd, mgmt, elems.p2p != NULL,
+- &resp_len, false);
++ if (is_6ghz_op_class(hapd->iconf->op_class) &&
++ is_broadcast_ether_addr(mgmt->da))
++ resp = hostapd_gen_probe_resp(hapd, NULL, elems.p2p != NULL,
++ &resp_len, true);
++ else
++ resp = hostapd_gen_probe_resp(hapd, mgmt, elems.p2p != NULL,
++ &resp_len, false);
+ if (resp == NULL)
+ return;
+
+--
+2.39.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
index 500c124..23e59fe 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
@@ -62,4 +62,17 @@
file://800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch \
file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
file://992-openssl-include-rsa.patch \
+ file://99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch \
+ file://99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch \
+ file://99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch \
+ file://99903-hostapd-mtk-Add-mtk_vendor.h.patch \
+ file://99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch \
+ file://99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch \
+ file://99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch \
+ file://99907-hostapd-mtk-Add-hostapd-iBF-control.patch \
+ file://99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch \
+ file://99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch \
+ file://99910-hostapd-mtk-Add-amsdu-set-get-ctrl.patch \
+ file://99911-hostapd-mtk-Add-he_ldpc-configuration.patch \
+ file://99912-hostapd-mtk-Add-the-broadcast-destination-address-of.patch \
"